xmrig | 85dbca05285b4b28172bffdff9b402d29dc1267393987102dd9e918237143b64

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
Size

1.4MB
MD5

b9017f0aefb06fd3ffe01c62f112a850
SHA1

330237faf71ad8845d1b5c3c80184d50ef7a3015
SHA256

85dbca05285b4b28172bffdff9b402d29dc1267393987102dd9e918237143b64
SHA512

2eb38f66c9453de6502ec246bf574d670d83eb6398f7dc39724ec0a9660d8893d0650f47457bd1abac2e49211dbdb921303b83caa8f3175047e3c19dbbfe3fc2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGR+ckP7:Lz071uv4BPMkHC0IlnASEx/RkhD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3060-139-0x00007FF6CD2A0000-0x00007FF6CD692000-memory.dmp	xmrig
behavioral2/memory/5024-160-0x00007FF716B80000-0x00007FF716F72000-memory.dmp	xmrig
behavioral2/memory/3792-214-0x00007FF6CB9C0000-0x00007FF6CBDB2000-memory.dmp	xmrig
behavioral2/memory/1984-243-0x00007FF7E5DC0000-0x00007FF7E61B2000-memory.dmp	xmrig
behavioral2/memory/4632-222-0x00007FF6C29D0000-0x00007FF6C2DC2000-memory.dmp	xmrig
behavioral2/memory/1864-221-0x00007FF7CEF50000-0x00007FF7CF342000-memory.dmp	xmrig
behavioral2/memory/4528-217-0x00007FF686970000-0x00007FF686D62000-memory.dmp	xmrig
behavioral2/memory/760-211-0x00007FF76BCB0000-0x00007FF76C0A2000-memory.dmp	xmrig
behavioral2/memory/3192-201-0x00007FF75F2B0000-0x00007FF75F6A2000-memory.dmp	xmrig
behavioral2/memory/2832-199-0x00007FF7D6000000-0x00007FF7D63F2000-memory.dmp	xmrig
behavioral2/memory/996-198-0x00007FF6FE530000-0x00007FF6FE922000-memory.dmp	xmrig
behavioral2/memory/4044-178-0x00007FF6A3D20000-0x00007FF6A4112000-memory.dmp	xmrig
behavioral2/memory/5016-174-0x00007FF632F80000-0x00007FF633372000-memory.dmp	xmrig
behavioral2/memory/428-155-0x00007FF78AED0000-0x00007FF78B2C2000-memory.dmp	xmrig
behavioral2/memory/3744-143-0x00007FF7EC5C0000-0x00007FF7EC9B2000-memory.dmp	xmrig
behavioral2/memory/628-128-0x00007FF7B9EB0000-0x00007FF7BA2A2000-memory.dmp	xmrig
behavioral2/memory/3996-127-0x00007FF72FD10000-0x00007FF730102000-memory.dmp	xmrig
behavioral2/memory/1512-115-0x00007FF605FB0000-0x00007FF6063A2000-memory.dmp	xmrig
behavioral2/memory/2096-103-0x00007FF6EF5C0000-0x00007FF6EF9B2000-memory.dmp	xmrig
behavioral2/memory/3900-93-0x00007FF735610000-0x00007FF735A02000-memory.dmp	xmrig
behavioral2/memory/3116-76-0x00007FF728F90000-0x00007FF729382000-memory.dmp	xmrig
behavioral2/memory/3724-63-0x00007FF725FF0000-0x00007FF7263E2000-memory.dmp	xmrig
behavioral2/memory/3740-56-0x00007FF60EA50000-0x00007FF60EE42000-memory.dmp	xmrig
behavioral2/memory/2116-1989-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	xmrig
behavioral2/memory/996-2024-0x00007FF6FE530000-0x00007FF6FE922000-memory.dmp	xmrig
behavioral2/memory/2116-2026-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	xmrig
behavioral2/memory/3740-2028-0x00007FF60EA50000-0x00007FF60EE42000-memory.dmp	xmrig
behavioral2/memory/3724-2030-0x00007FF725FF0000-0x00007FF7263E2000-memory.dmp	xmrig
behavioral2/memory/3116-2032-0x00007FF728F90000-0x00007FF729382000-memory.dmp	xmrig
behavioral2/memory/2832-2034-0x00007FF7D6000000-0x00007FF7D63F2000-memory.dmp	xmrig
behavioral2/memory/3900-2036-0x00007FF735610000-0x00007FF735A02000-memory.dmp	xmrig
behavioral2/memory/2096-2038-0x00007FF6EF5C0000-0x00007FF6EF9B2000-memory.dmp	xmrig
behavioral2/memory/628-2040-0x00007FF7B9EB0000-0x00007FF7BA2A2000-memory.dmp	xmrig
behavioral2/memory/1512-2042-0x00007FF605FB0000-0x00007FF6063A2000-memory.dmp	xmrig
behavioral2/memory/760-2044-0x00007FF76BCB0000-0x00007FF76C0A2000-memory.dmp	xmrig
behavioral2/memory/3192-2046-0x00007FF75F2B0000-0x00007FF75F6A2000-memory.dmp	xmrig
behavioral2/memory/3060-2051-0x00007FF6CD2A0000-0x00007FF6CD692000-memory.dmp	xmrig
behavioral2/memory/428-2058-0x00007FF78AED0000-0x00007FF78B2C2000-memory.dmp	xmrig
behavioral2/memory/1864-2062-0x00007FF7CEF50000-0x00007FF7CF342000-memory.dmp	xmrig
behavioral2/memory/4044-2066-0x00007FF6A3D20000-0x00007FF6A4112000-memory.dmp	xmrig
behavioral2/memory/5016-2064-0x00007FF632F80000-0x00007FF633372000-memory.dmp	xmrig
behavioral2/memory/4528-2060-0x00007FF686970000-0x00007FF686D62000-memory.dmp	xmrig
behavioral2/memory/4632-2070-0x00007FF6C29D0000-0x00007FF6C2DC2000-memory.dmp	xmrig
behavioral2/memory/1984-2073-0x00007FF7E5DC0000-0x00007FF7E61B2000-memory.dmp	xmrig
behavioral2/memory/3744-2056-0x00007FF7EC5C0000-0x00007FF7EC9B2000-memory.dmp	xmrig
behavioral2/memory/3996-2054-0x00007FF72FD10000-0x00007FF730102000-memory.dmp	xmrig
behavioral2/memory/3792-2052-0x00007FF6CB9C0000-0x00007FF6CBDB2000-memory.dmp	xmrig
behavioral2/memory/5024-2048-0x00007FF716B80000-0x00007FF716F72000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2708	powershell.exe
11	2708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2116	XqphSpn.exe
996	wYqGHGx.exe
3740	aSOVVqR.exe
3724	VBqUZjC.exe
3116	zKTwOtq.exe
3900	FWSWPmL.exe
2096	VFXXQGc.exe
1512	Zkvsnte.exe
3996	ogRrqtY.exe
628	GwHdtWT.exe
2832	QecRchZ.exe
3192	QoRzyOJ.exe
3060	IJQLXqR.exe
3744	KwCSfRL.exe
760	GuhQEdG.exe
3792	ObjROGk.exe
428	gOnCJZK.exe
5024	PmUuruk.exe
4528	QjFKkXh.exe
5016	oPQQIwx.exe
1864	uOwtpiH.exe
4044	yGFMvbA.exe
4632	LgTMkuR.exe
1984	lhRdEfW.exe
4932	OwYmRla.exe
3512	InjkPQY.exe
3548	DSEJBzn.exe
3036	FBnRZBD.exe
4672	MakCxHS.exe
5084	bLAaXGX.exe
3132	bNNTeZQ.exe
2280	iVfpIJp.exe
4268	phAEMSL.exe
2780	CqdmXwR.exe
3624	xGFXCJA.exe
4272	bthkUNE.exe
2100	EZaePaf.exe
708	XYaUgEs.exe
4376	FZfXYkV.exe
3680	KpHQXPN.exe
4696	SVDrYHV.exe
3852	jsWKDtq.exe
4400	soObdwz.exe
3676	xlIlieO.exe
4840	txURhDd.exe
2948	GQyydVK.exe
868	qTFWeXf.exe
1960	GhHqDWF.exe
4692	qcCqAte.exe
4264	DMTKCth.exe
808	VFwqOMM.exe
3024	YOUXoOn.exe
2540	ixJESWO.exe
4208	KjhvDDl.exe
3572	twqRZkW.exe
3764	wVdHXim.exe
3848	NXYlIrq.exe
1416	XiOQMjQ.exe
4008	caKtPqJ.exe
2452	uLCGOLt.exe
1788	eJgoPlF.exe
5048	YPvkkdk.exe
412	utNdibt.exe
1472	jHDyxjo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/928-0-0x00007FF6AACC0000-0x00007FF6AB0B2000-memory.dmp	upx
behavioral2/files/0x0007000000023441-9.dat	upx
behavioral2/files/0x0007000000023441-18.dat	upx
behavioral2/files/0x0007000000023440-12.dat	upx
behavioral2/files/0x0007000000023448-48.dat	upx
behavioral2/files/0x0007000000023442-33.dat	upx
behavioral2/files/0x0007000000023444-58.dat	upx
behavioral2/files/0x0007000000023447-83.dat	upx
behavioral2/files/0x0007000000023450-113.dat	upx
behavioral2/files/0x0008000000023445-112.dat	upx
behavioral2/files/0x0007000000023452-123.dat	upx
behavioral2/memory/3060-139-0x00007FF6CD2A0000-0x00007FF6CD692000-memory.dmp	upx
behavioral2/files/0x0007000000023455-149.dat	upx
behavioral2/memory/5024-160-0x00007FF716B80000-0x00007FF716F72000-memory.dmp	upx
behavioral2/files/0x000700000002345d-185.dat	upx
behavioral2/files/0x000700000002345c-192.dat	upx
behavioral2/files/0x000700000002345a-182.dat	upx
behavioral2/memory/3792-214-0x00007FF6CB9C0000-0x00007FF6CBDB2000-memory.dmp	upx
behavioral2/memory/1984-243-0x00007FF7E5DC0000-0x00007FF7E61B2000-memory.dmp	upx
behavioral2/memory/4632-222-0x00007FF6C29D0000-0x00007FF6C2DC2000-memory.dmp	upx
behavioral2/memory/1864-221-0x00007FF7CEF50000-0x00007FF7CF342000-memory.dmp	upx
behavioral2/memory/4528-217-0x00007FF686970000-0x00007FF686D62000-memory.dmp	upx
behavioral2/memory/760-211-0x00007FF76BCB0000-0x00007FF76C0A2000-memory.dmp	upx
behavioral2/memory/3192-201-0x00007FF75F2B0000-0x00007FF75F6A2000-memory.dmp	upx
behavioral2/memory/2832-199-0x00007FF7D6000000-0x00007FF7D63F2000-memory.dmp	upx
behavioral2/memory/996-198-0x00007FF6FE530000-0x00007FF6FE922000-memory.dmp	upx
behavioral2/files/0x0007000000023457-179.dat	upx
behavioral2/memory/4044-178-0x00007FF6A3D20000-0x00007FF6A4112000-memory.dmp	upx
behavioral2/files/0x000700000002345b-180.dat	upx
behavioral2/memory/5016-174-0x00007FF632F80000-0x00007FF633372000-memory.dmp	upx
behavioral2/files/0x0007000000023458-166.dat	upx
behavioral2/files/0x0007000000023459-168.dat	upx
behavioral2/files/0x0007000000023456-164.dat	upx
behavioral2/memory/428-155-0x00007FF78AED0000-0x00007FF78B2C2000-memory.dmp	upx
behavioral2/files/0x0007000000023457-154.dat	upx
behavioral2/files/0x000800000002343d-152.dat	upx
behavioral2/memory/3744-143-0x00007FF7EC5C0000-0x00007FF7EC9B2000-memory.dmp	upx
behavioral2/files/0x0007000000023454-131.dat	upx
behavioral2/memory/628-128-0x00007FF7B9EB0000-0x00007FF7BA2A2000-memory.dmp	upx
behavioral2/files/0x0007000000023451-121.dat	upx
behavioral2/files/0x0007000000023453-129.dat	upx
behavioral2/memory/3996-127-0x00007FF72FD10000-0x00007FF730102000-memory.dmp	upx
behavioral2/memory/1512-115-0x00007FF605FB0000-0x00007FF6063A2000-memory.dmp	upx
behavioral2/files/0x000700000002344e-104.dat	upx
behavioral2/memory/2096-103-0x00007FF6EF5C0000-0x00007FF6EF9B2000-memory.dmp	upx
behavioral2/files/0x0008000000023446-109.dat	upx
behavioral2/files/0x000700000002344d-99.dat	upx
behavioral2/memory/3900-93-0x00007FF735610000-0x00007FF735A02000-memory.dmp	upx
behavioral2/files/0x000700000002344f-92.dat	upx
behavioral2/files/0x000700000002344a-84.dat	upx
behavioral2/memory/3116-76-0x00007FF728F90000-0x00007FF729382000-memory.dmp	upx
behavioral2/files/0x000700000002344c-71.dat	upx
behavioral2/memory/3724-63-0x00007FF725FF0000-0x00007FF7263E2000-memory.dmp	upx
behavioral2/memory/3740-56-0x00007FF60EA50000-0x00007FF60EE42000-memory.dmp	upx
behavioral2/files/0x000700000002344b-55.dat	upx
behavioral2/files/0x0007000000023443-45.dat	upx
behavioral2/files/0x0007000000023449-49.dat	upx
behavioral2/memory/2116-6-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	upx
behavioral2/files/0x000800000002343c-10.dat	upx
behavioral2/memory/2116-1989-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	upx
behavioral2/memory/996-2024-0x00007FF6FE530000-0x00007FF6FE922000-memory.dmp	upx
behavioral2/memory/2116-2026-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp	upx
behavioral2/memory/3740-2028-0x00007FF60EA50000-0x00007FF60EE42000-memory.dmp	upx
behavioral2/memory/3724-2030-0x00007FF725FF0000-0x00007FF7263E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BacfWao.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\tCxPqlj.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\PKvWMxZ.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\WKtNYro.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\kgkGqvF.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\xstpWlX.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\xcfRZue.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\tyFvFrk.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\TkFKeqA.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\WFUFHVg.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\xMDzMIj.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\IUkdKmf.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\utNdibt.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\PbeqRix.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\BfPkpjL.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\lyipLff.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\VzXdpbw.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\hYuQdbx.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\dxotLZp.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\mdmWMQh.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\EZaePaf.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\GtcZtJY.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\aGrTEAx.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\yVyiPTn.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\GyrMMdo.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\ckTSRBo.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\RgOdaAP.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\WtcKQol.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\KNlfWiH.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\wzsVNdk.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\bNNTeZQ.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\DxwPzWM.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\OxzSiZy.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\NZEgNno.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\zdjztcV.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\uLCGOLt.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\jlIwRpV.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\XCumJas.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\kNNicfd.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\TchrXez.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\eJgoPlF.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\AUzQCAh.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\goQWCoT.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\JUrAYlZ.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\mWLumpG.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\DIckDRe.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\LQTrgKx.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\GCKzGgv.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\MnHAgGt.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\SVixYEN.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\PadnxPN.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\OFIqLCj.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\xGFXCJA.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\hqFqPkJ.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\cEOMmrp.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\kLnTFid.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\GkkHxMV.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\UTHozTy.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\GQyydVK.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\pYHhwYl.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\thmdyMs.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\dBFDzql.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\xSwWQzs.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
File created	C:\Windows\System\fuYgSJY.exe	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeLockMemoryPrivilege	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2708	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	84
PID 928 wrote to memory of 2708	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	84
PID 928 wrote to memory of 2116	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	85
PID 928 wrote to memory of 2116	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	85
PID 928 wrote to memory of 996	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	86
PID 928 wrote to memory of 996	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	86
PID 928 wrote to memory of 3740	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	87
PID 928 wrote to memory of 3740	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	87
PID 928 wrote to memory of 3724	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	88
PID 928 wrote to memory of 3724	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	88
PID 928 wrote to memory of 3116	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	89
PID 928 wrote to memory of 3116	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	89
PID 928 wrote to memory of 3900	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	90
PID 928 wrote to memory of 3900	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	90
PID 928 wrote to memory of 3996	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	91
PID 928 wrote to memory of 3996	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	91
PID 928 wrote to memory of 2096	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	92
PID 928 wrote to memory of 2096	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	92
PID 928 wrote to memory of 1512	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	93
PID 928 wrote to memory of 1512	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	93
PID 928 wrote to memory of 628	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	94
PID 928 wrote to memory of 628	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	94
PID 928 wrote to memory of 2832	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	95
PID 928 wrote to memory of 2832	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	95
PID 928 wrote to memory of 3192	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	96
PID 928 wrote to memory of 3192	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	96
PID 928 wrote to memory of 3060	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	97
PID 928 wrote to memory of 3060	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	97
PID 928 wrote to memory of 3744	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	98
PID 928 wrote to memory of 3744	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	98
PID 928 wrote to memory of 760	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	99
PID 928 wrote to memory of 760	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	99
PID 928 wrote to memory of 3792	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	100
PID 928 wrote to memory of 3792	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	100
PID 928 wrote to memory of 428	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	101
PID 928 wrote to memory of 428	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	101
PID 928 wrote to memory of 5024	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	102
PID 928 wrote to memory of 5024	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	102
PID 928 wrote to memory of 4528	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	103
PID 928 wrote to memory of 4528	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	103
PID 928 wrote to memory of 4044	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	104
PID 928 wrote to memory of 4044	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	104
PID 928 wrote to memory of 5016	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	105
PID 928 wrote to memory of 5016	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	105
PID 928 wrote to memory of 1864	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	106
PID 928 wrote to memory of 1864	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	106
PID 928 wrote to memory of 4632	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	107
PID 928 wrote to memory of 4632	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	107
PID 928 wrote to memory of 1984	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	108
PID 928 wrote to memory of 1984	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	108
PID 928 wrote to memory of 4932	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	109
PID 928 wrote to memory of 4932	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	109
PID 928 wrote to memory of 3512	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	110
PID 928 wrote to memory of 3512	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	110
PID 928 wrote to memory of 3548	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	111
PID 928 wrote to memory of 3548	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	111
PID 928 wrote to memory of 3036	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	112
PID 928 wrote to memory of 3036	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	112
PID 928 wrote to memory of 4672	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	113
PID 928 wrote to memory of 4672	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	113
PID 928 wrote to memory of 5084	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	114
PID 928 wrote to memory of 5084	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	114
PID 928 wrote to memory of 3132	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	115
PID 928 wrote to memory of 3132	928	b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b9017f0aefb06fd3ffe01c62f112a850_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2708" "2944" "2876" "2948" "0" "0" "2952" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12700
- C:\Windows\System\XqphSpn.exe
  C:\Windows\System\XqphSpn.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\wYqGHGx.exe
  C:\Windows\System\wYqGHGx.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\aSOVVqR.exe
  C:\Windows\System\aSOVVqR.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\VBqUZjC.exe
  C:\Windows\System\VBqUZjC.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\zKTwOtq.exe
  C:\Windows\System\zKTwOtq.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\FWSWPmL.exe
  C:\Windows\System\FWSWPmL.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ogRrqtY.exe
  C:\Windows\System\ogRrqtY.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\VFXXQGc.exe
  C:\Windows\System\VFXXQGc.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\Zkvsnte.exe
  C:\Windows\System\Zkvsnte.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\GwHdtWT.exe
  C:\Windows\System\GwHdtWT.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\QecRchZ.exe
  C:\Windows\System\QecRchZ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\QoRzyOJ.exe
  C:\Windows\System\QoRzyOJ.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\IJQLXqR.exe
  C:\Windows\System\IJQLXqR.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\KwCSfRL.exe
  C:\Windows\System\KwCSfRL.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\GuhQEdG.exe
  C:\Windows\System\GuhQEdG.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ObjROGk.exe
  C:\Windows\System\ObjROGk.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\gOnCJZK.exe
  C:\Windows\System\gOnCJZK.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\PmUuruk.exe
  C:\Windows\System\PmUuruk.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\QjFKkXh.exe
  C:\Windows\System\QjFKkXh.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\yGFMvbA.exe
  C:\Windows\System\yGFMvbA.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\oPQQIwx.exe
  C:\Windows\System\oPQQIwx.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\uOwtpiH.exe
  C:\Windows\System\uOwtpiH.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\LgTMkuR.exe
  C:\Windows\System\LgTMkuR.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\lhRdEfW.exe
  C:\Windows\System\lhRdEfW.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\OwYmRla.exe
  C:\Windows\System\OwYmRla.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\InjkPQY.exe
  C:\Windows\System\InjkPQY.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\DSEJBzn.exe
  C:\Windows\System\DSEJBzn.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\FBnRZBD.exe
  C:\Windows\System\FBnRZBD.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MakCxHS.exe
  C:\Windows\System\MakCxHS.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\bLAaXGX.exe
  C:\Windows\System\bLAaXGX.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\bNNTeZQ.exe
  C:\Windows\System\bNNTeZQ.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\iVfpIJp.exe
  C:\Windows\System\iVfpIJp.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\phAEMSL.exe
  C:\Windows\System\phAEMSL.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\CqdmXwR.exe
  C:\Windows\System\CqdmXwR.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\xGFXCJA.exe
  C:\Windows\System\xGFXCJA.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\bthkUNE.exe
  C:\Windows\System\bthkUNE.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\KpHQXPN.exe
  C:\Windows\System\KpHQXPN.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\SVDrYHV.exe
  C:\Windows\System\SVDrYHV.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\EZaePaf.exe
  C:\Windows\System\EZaePaf.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\XYaUgEs.exe
  C:\Windows\System\XYaUgEs.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\FZfXYkV.exe
  C:\Windows\System\FZfXYkV.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\jsWKDtq.exe
  C:\Windows\System\jsWKDtq.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\soObdwz.exe
  C:\Windows\System\soObdwz.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\xlIlieO.exe
  C:\Windows\System\xlIlieO.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\txURhDd.exe
  C:\Windows\System\txURhDd.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\GQyydVK.exe
  C:\Windows\System\GQyydVK.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\qTFWeXf.exe
  C:\Windows\System\qTFWeXf.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\GhHqDWF.exe
  C:\Windows\System\GhHqDWF.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\qcCqAte.exe
  C:\Windows\System\qcCqAte.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\DMTKCth.exe
  C:\Windows\System\DMTKCth.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\VFwqOMM.exe
  C:\Windows\System\VFwqOMM.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\YOUXoOn.exe
  C:\Windows\System\YOUXoOn.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ixJESWO.exe
  C:\Windows\System\ixJESWO.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\KjhvDDl.exe
  C:\Windows\System\KjhvDDl.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\twqRZkW.exe
  C:\Windows\System\twqRZkW.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\wVdHXim.exe
  C:\Windows\System\wVdHXim.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\NXYlIrq.exe
  C:\Windows\System\NXYlIrq.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\XiOQMjQ.exe
  C:\Windows\System\XiOQMjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\caKtPqJ.exe
  C:\Windows\System\caKtPqJ.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\uLCGOLt.exe
  C:\Windows\System\uLCGOLt.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\eJgoPlF.exe
  C:\Windows\System\eJgoPlF.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\YPvkkdk.exe
  C:\Windows\System\YPvkkdk.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\utNdibt.exe
  C:\Windows\System\utNdibt.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\NHkWaJL.exe
  C:\Windows\System\NHkWaJL.exe
  2⤵
  PID:4152
- C:\Windows\System\jHDyxjo.exe
  C:\Windows\System\jHDyxjo.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\MhxfKZq.exe
  C:\Windows\System\MhxfKZq.exe
  2⤵
  PID:3732
- C:\Windows\System\DzwngDn.exe
  C:\Windows\System\DzwngDn.exe
  2⤵
  PID:1736
- C:\Windows\System\QADYebW.exe
  C:\Windows\System\QADYebW.exe
  2⤵
  PID:4540
- C:\Windows\System\pYHhwYl.exe
  C:\Windows\System\pYHhwYl.exe
  2⤵
  PID:4460
- C:\Windows\System\Vltatts.exe
  C:\Windows\System\Vltatts.exe
  2⤵
  PID:2924
- C:\Windows\System\KvLCjce.exe
  C:\Windows\System\KvLCjce.exe
  2⤵
  PID:772
- C:\Windows\System\DTMhSkg.exe
  C:\Windows\System\DTMhSkg.exe
  2⤵
  PID:664
- C:\Windows\System\tCxPqlj.exe
  C:\Windows\System\tCxPqlj.exe
  2⤵
  PID:216
- C:\Windows\System\xXGuyRA.exe
  C:\Windows\System\xXGuyRA.exe
  2⤵
  PID:64
- C:\Windows\System\SJwoueF.exe
  C:\Windows\System\SJwoueF.exe
  2⤵
  PID:2744
- C:\Windows\System\VrzcAJK.exe
  C:\Windows\System\VrzcAJK.exe
  2⤵
  PID:1432
- C:\Windows\System\ttgInzN.exe
  C:\Windows\System\ttgInzN.exe
  2⤵
  PID:4040
- C:\Windows\System\yvIyzmj.exe
  C:\Windows\System\yvIyzmj.exe
  2⤵
  PID:3304
- C:\Windows\System\PccrlIG.exe
  C:\Windows\System\PccrlIG.exe
  2⤵
  PID:3172
- C:\Windows\System\GtcZtJY.exe
  C:\Windows\System\GtcZtJY.exe
  2⤵
  PID:3468
- C:\Windows\System\MbrzhIt.exe
  C:\Windows\System\MbrzhIt.exe
  2⤵
  PID:1468
- C:\Windows\System\nVlanVM.exe
  C:\Windows\System\nVlanVM.exe
  2⤵
  PID:4364
- C:\Windows\System\klbBTrb.exe
  C:\Windows\System\klbBTrb.exe
  2⤵
  PID:2480
- C:\Windows\System\jWpirMs.exe
  C:\Windows\System\jWpirMs.exe
  2⤵
  PID:5148
- C:\Windows\System\qqEzmZC.exe
  C:\Windows\System\qqEzmZC.exe
  2⤵
  PID:5180
- C:\Windows\System\SJBNbvK.exe
  C:\Windows\System\SJBNbvK.exe
  2⤵
  PID:5216
- C:\Windows\System\GoTsPkm.exe
  C:\Windows\System\GoTsPkm.exe
  2⤵
  PID:5240
- C:\Windows\System\fxdOHdM.exe
  C:\Windows\System\fxdOHdM.exe
  2⤵
  PID:5276
- C:\Windows\System\TIoFJJS.exe
  C:\Windows\System\TIoFJJS.exe
  2⤵
  PID:5292
- C:\Windows\System\FBNNxcx.exe
  C:\Windows\System\FBNNxcx.exe
  2⤵
  PID:5312
- C:\Windows\System\eNyzCaS.exe
  C:\Windows\System\eNyzCaS.exe
  2⤵
  PID:5332
- C:\Windows\System\PlDnsfI.exe
  C:\Windows\System\PlDnsfI.exe
  2⤵
  PID:5352
- C:\Windows\System\KHOtaIA.exe
  C:\Windows\System\KHOtaIA.exe
  2⤵
  PID:5392
- C:\Windows\System\IQZIgdi.exe
  C:\Windows\System\IQZIgdi.exe
  2⤵
  PID:5408
- C:\Windows\System\UHBylGH.exe
  C:\Windows\System\UHBylGH.exe
  2⤵
  PID:5444
- C:\Windows\System\mdwDrYq.exe
  C:\Windows\System\mdwDrYq.exe
  2⤵
  PID:5476
- C:\Windows\System\jTrGjhK.exe
  C:\Windows\System\jTrGjhK.exe
  2⤵
  PID:5500
- C:\Windows\System\dVayaRp.exe
  C:\Windows\System\dVayaRp.exe
  2⤵
  PID:5516
- C:\Windows\System\dRpEaSJ.exe
  C:\Windows\System\dRpEaSJ.exe
  2⤵
  PID:5576
- C:\Windows\System\IlPiQPy.exe
  C:\Windows\System\IlPiQPy.exe
  2⤵
  PID:5592
- C:\Windows\System\ODKmUDK.exe
  C:\Windows\System\ODKmUDK.exe
  2⤵
  PID:5612
- C:\Windows\System\ohIpVEX.exe
  C:\Windows\System\ohIpVEX.exe
  2⤵
  PID:5652
- C:\Windows\System\eXvhtta.exe
  C:\Windows\System\eXvhtta.exe
  2⤵
  PID:5676
- C:\Windows\System\stVxSxj.exe
  C:\Windows\System\stVxSxj.exe
  2⤵
  PID:5716
- C:\Windows\System\WLUeAJa.exe
  C:\Windows\System\WLUeAJa.exe
  2⤵
  PID:5748
- C:\Windows\System\kUlJxtt.exe
  C:\Windows\System\kUlJxtt.exe
  2⤵
  PID:5776
- C:\Windows\System\DndmmSv.exe
  C:\Windows\System\DndmmSv.exe
  2⤵
  PID:5800
- C:\Windows\System\XQdyZIr.exe
  C:\Windows\System\XQdyZIr.exe
  2⤵
  PID:5820
- C:\Windows\System\yWiptnT.exe
  C:\Windows\System\yWiptnT.exe
  2⤵
  PID:5852
- C:\Windows\System\SenKaJi.exe
  C:\Windows\System\SenKaJi.exe
  2⤵
  PID:5872
- C:\Windows\System\hqFqPkJ.exe
  C:\Windows\System\hqFqPkJ.exe
  2⤵
  PID:5896
- C:\Windows\System\LQTrgKx.exe
  C:\Windows\System\LQTrgKx.exe
  2⤵
  PID:5912
- C:\Windows\System\guaNgXn.exe
  C:\Windows\System\guaNgXn.exe
  2⤵
  PID:5928
- C:\Windows\System\KZiwuDj.exe
  C:\Windows\System\KZiwuDj.exe
  2⤵
  PID:5972
- C:\Windows\System\IocDxjR.exe
  C:\Windows\System\IocDxjR.exe
  2⤵
  PID:6012
- C:\Windows\System\jPZWzdJ.exe
  C:\Windows\System\jPZWzdJ.exe
  2⤵
  PID:6028
- C:\Windows\System\JNFjDJs.exe
  C:\Windows\System\JNFjDJs.exe
  2⤵
  PID:6052
- C:\Windows\System\MnHAgGt.exe
  C:\Windows\System\MnHAgGt.exe
  2⤵
  PID:6080
- C:\Windows\System\ILxQhhU.exe
  C:\Windows\System\ILxQhhU.exe
  2⤵
  PID:6124
- C:\Windows\System\SneqqYk.exe
  C:\Windows\System\SneqqYk.exe
  2⤵
  PID:6140
- C:\Windows\System\fikkpOV.exe
  C:\Windows\System\fikkpOV.exe
  2⤵
  PID:5248
- C:\Windows\System\lAMOVQm.exe
  C:\Windows\System\lAMOVQm.exe
  2⤵
  PID:3272
- C:\Windows\System\RtAXCSt.exe
  C:\Windows\System\RtAXCSt.exe
  2⤵
  PID:5328
- C:\Windows\System\xKSkfJp.exe
  C:\Windows\System\xKSkfJp.exe
  2⤵
  PID:5420
- C:\Windows\System\glrhYVL.exe
  C:\Windows\System\glrhYVL.exe
  2⤵
  PID:5472
- C:\Windows\System\GmrtzBf.exe
  C:\Windows\System\GmrtzBf.exe
  2⤵
  PID:5468
- C:\Windows\System\BUSJzXl.exe
  C:\Windows\System\BUSJzXl.exe
  2⤵
  PID:5536
- C:\Windows\System\WfNgTxN.exe
  C:\Windows\System\WfNgTxN.exe
  2⤵
  PID:5640
- C:\Windows\System\PKvWMxZ.exe
  C:\Windows\System\PKvWMxZ.exe
  2⤵
  PID:5608
- C:\Windows\System\iiMZqWV.exe
  C:\Windows\System\iiMZqWV.exe
  2⤵
  PID:5728
- C:\Windows\System\LVGKJDD.exe
  C:\Windows\System\LVGKJDD.exe
  2⤵
  PID:5700
- C:\Windows\System\XteDWMC.exe
  C:\Windows\System\XteDWMC.exe
  2⤵
  PID:5764
- C:\Windows\System\NKiIjwe.exe
  C:\Windows\System\NKiIjwe.exe
  2⤵
  PID:5812
- C:\Windows\System\WvLGlYg.exe
  C:\Windows\System\WvLGlYg.exe
  2⤵
  PID:5860
- C:\Windows\System\wsCpCOh.exe
  C:\Windows\System\wsCpCOh.exe
  2⤵
  PID:4616
- C:\Windows\System\vGKJczG.exe
  C:\Windows\System\vGKJczG.exe
  2⤵
  PID:6024
- C:\Windows\System\WvFQbyr.exe
  C:\Windows\System\WvFQbyr.exe
  2⤵
  PID:2348
- C:\Windows\System\SrVpqag.exe
  C:\Windows\System\SrVpqag.exe
  2⤵
  PID:6120
- C:\Windows\System\eZjsVFq.exe
  C:\Windows\System\eZjsVFq.exe
  2⤵
  PID:1892
- C:\Windows\System\DNrdowk.exe
  C:\Windows\System\DNrdowk.exe
  2⤵
  PID:5492
- C:\Windows\System\uZsykuP.exe
  C:\Windows\System\uZsykuP.exe
  2⤵
  PID:5508
- C:\Windows\System\vZAyBjC.exe
  C:\Windows\System\vZAyBjC.exe
  2⤵
  PID:2088
- C:\Windows\System\QFNZqLO.exe
  C:\Windows\System\QFNZqLO.exe
  2⤵
  PID:6076
- C:\Windows\System\lolgsPx.exe
  C:\Windows\System\lolgsPx.exe
  2⤵
  PID:6048
- C:\Windows\System\FaYjYEk.exe
  C:\Windows\System\FaYjYEk.exe
  2⤵
  PID:5288
- C:\Windows\System\GISCgia.exe
  C:\Windows\System\GISCgia.exe
  2⤵
  PID:5568
- C:\Windows\System\qSAFipn.exe
  C:\Windows\System\qSAFipn.exe
  2⤵
  PID:5436
- C:\Windows\System\tBjHZko.exe
  C:\Windows\System\tBjHZko.exe
  2⤵
  PID:5924
- C:\Windows\System\OuoultZ.exe
  C:\Windows\System\OuoultZ.exe
  2⤵
  PID:6168
- C:\Windows\System\jeAgkUs.exe
  C:\Windows\System\jeAgkUs.exe
  2⤵
  PID:6192
- C:\Windows\System\eBBAAhg.exe
  C:\Windows\System\eBBAAhg.exe
  2⤵
  PID:6212
- C:\Windows\System\oOUImeQ.exe
  C:\Windows\System\oOUImeQ.exe
  2⤵
  PID:6240
- C:\Windows\System\OVyQIMl.exe
  C:\Windows\System\OVyQIMl.exe
  2⤵
  PID:6268
- C:\Windows\System\fEvvIys.exe
  C:\Windows\System\fEvvIys.exe
  2⤵
  PID:6288
- C:\Windows\System\AsjijKL.exe
  C:\Windows\System\AsjijKL.exe
  2⤵
  PID:6368
- C:\Windows\System\eXhMeJI.exe
  C:\Windows\System\eXhMeJI.exe
  2⤵
  PID:6400
- C:\Windows\System\DFoZgcI.exe
  C:\Windows\System\DFoZgcI.exe
  2⤵
  PID:6440
- C:\Windows\System\GyrMMdo.exe
  C:\Windows\System\GyrMMdo.exe
  2⤵
  PID:6464
- C:\Windows\System\yHzIqEh.exe
  C:\Windows\System\yHzIqEh.exe
  2⤵
  PID:6500
- C:\Windows\System\kdquOVh.exe
  C:\Windows\System\kdquOVh.exe
  2⤵
  PID:6516
- C:\Windows\System\ikwgYJl.exe
  C:\Windows\System\ikwgYJl.exe
  2⤵
  PID:6540
- C:\Windows\System\eoTKqJT.exe
  C:\Windows\System\eoTKqJT.exe
  2⤵
  PID:6560
- C:\Windows\System\YlMKToL.exe
  C:\Windows\System\YlMKToL.exe
  2⤵
  PID:6584
- C:\Windows\System\qTqTXag.exe
  C:\Windows\System\qTqTXag.exe
  2⤵
  PID:6608
- C:\Windows\System\YJVuBsH.exe
  C:\Windows\System\YJVuBsH.exe
  2⤵
  PID:6628
- C:\Windows\System\vzGdxFm.exe
  C:\Windows\System\vzGdxFm.exe
  2⤵
  PID:6668
- C:\Windows\System\xTdTNgQ.exe
  C:\Windows\System\xTdTNgQ.exe
  2⤵
  PID:6720
- C:\Windows\System\wihclUc.exe
  C:\Windows\System\wihclUc.exe
  2⤵
  PID:6740
- C:\Windows\System\DvrPPBi.exe
  C:\Windows\System\DvrPPBi.exe
  2⤵
  PID:6768
- C:\Windows\System\efbwdzF.exe
  C:\Windows\System\efbwdzF.exe
  2⤵
  PID:6784
- C:\Windows\System\gfEiEmF.exe
  C:\Windows\System\gfEiEmF.exe
  2⤵
  PID:6804
- C:\Windows\System\VBLeGHQ.exe
  C:\Windows\System\VBLeGHQ.exe
  2⤵
  PID:6828
- C:\Windows\System\FcndaNc.exe
  C:\Windows\System\FcndaNc.exe
  2⤵
  PID:6872
- C:\Windows\System\PbeqRix.exe
  C:\Windows\System\PbeqRix.exe
  2⤵
  PID:6900
- C:\Windows\System\hQziuWr.exe
  C:\Windows\System\hQziuWr.exe
  2⤵
  PID:6928
- C:\Windows\System\vDoOGMD.exe
  C:\Windows\System\vDoOGMD.exe
  2⤵
  PID:6952
- C:\Windows\System\LWFGGJv.exe
  C:\Windows\System\LWFGGJv.exe
  2⤵
  PID:6980
- C:\Windows\System\gmtTPbo.exe
  C:\Windows\System\gmtTPbo.exe
  2⤵
  PID:7040
- C:\Windows\System\GoflVkA.exe
  C:\Windows\System\GoflVkA.exe
  2⤵
  PID:7060
- C:\Windows\System\TbMZRjD.exe
  C:\Windows\System\TbMZRjD.exe
  2⤵
  PID:7080
- C:\Windows\System\XMVcAOP.exe
  C:\Windows\System\XMVcAOP.exe
  2⤵
  PID:7100
- C:\Windows\System\LZPUYhS.exe
  C:\Windows\System\LZPUYhS.exe
  2⤵
  PID:7120
- C:\Windows\System\onKTvnJ.exe
  C:\Windows\System\onKTvnJ.exe
  2⤵
  PID:7144
- C:\Windows\System\CuzuOnr.exe
  C:\Windows\System\CuzuOnr.exe
  2⤵
  PID:7164
- C:\Windows\System\WugamKN.exe
  C:\Windows\System\WugamKN.exe
  2⤵
  PID:5840
- C:\Windows\System\BbRdOLu.exe
  C:\Windows\System\BbRdOLu.exe
  2⤵
  PID:6204
- C:\Windows\System\gghrZbv.exe
  C:\Windows\System\gghrZbv.exe
  2⤵
  PID:6224
- C:\Windows\System\cEOMmrp.exe
  C:\Windows\System\cEOMmrp.exe
  2⤵
  PID:6336
- C:\Windows\System\AUzQCAh.exe
  C:\Windows\System\AUzQCAh.exe
  2⤵
  PID:6424
- C:\Windows\System\ccEdgtF.exe
  C:\Windows\System\ccEdgtF.exe
  2⤵
  PID:6456
- C:\Windows\System\NhddgyN.exe
  C:\Windows\System\NhddgyN.exe
  2⤵
  PID:6552
- C:\Windows\System\tbmgprl.exe
  C:\Windows\System\tbmgprl.exe
  2⤵
  PID:6600
- C:\Windows\System\ggdNIXG.exe
  C:\Windows\System\ggdNIXG.exe
  2⤵
  PID:6696
- C:\Windows\System\frboSxS.exe
  C:\Windows\System\frboSxS.exe
  2⤵
  PID:6716
- C:\Windows\System\FqXnKBE.exe
  C:\Windows\System\FqXnKBE.exe
  2⤵
  PID:6732
- C:\Windows\System\fwepEca.exe
  C:\Windows\System\fwepEca.exe
  2⤵
  PID:6816
- C:\Windows\System\VVNcubh.exe
  C:\Windows\System\VVNcubh.exe
  2⤵
  PID:6848
- C:\Windows\System\gOiQQzU.exe
  C:\Windows\System\gOiQQzU.exe
  2⤵
  PID:6916
- C:\Windows\System\DgPiwhz.exe
  C:\Windows\System\DgPiwhz.exe
  2⤵
  PID:6992
- C:\Windows\System\WJGyXmx.exe
  C:\Windows\System\WJGyXmx.exe
  2⤵
  PID:5168
- C:\Windows\System\obOpTzz.exe
  C:\Windows\System\obOpTzz.exe
  2⤵
  PID:5452
- C:\Windows\System\mGMlwNE.exe
  C:\Windows\System\mGMlwNE.exe
  2⤵
  PID:6252
- C:\Windows\System\ZFhZBqJ.exe
  C:\Windows\System\ZFhZBqJ.exe
  2⤵
  PID:3136
- C:\Windows\System\hZwQTTV.exe
  C:\Windows\System\hZwQTTV.exe
  2⤵
  PID:6344
- C:\Windows\System\RgvtRPi.exe
  C:\Windows\System\RgvtRPi.exe
  2⤵
  PID:6660
- C:\Windows\System\AFxFqIp.exe
  C:\Windows\System\AFxFqIp.exe
  2⤵
  PID:6780
- C:\Windows\System\aXzfRDi.exe
  C:\Windows\System\aXzfRDi.exe
  2⤵
  PID:6864
- C:\Windows\System\WEpLMWc.exe
  C:\Windows\System\WEpLMWc.exe
  2⤵
  PID:6960
- C:\Windows\System\WrrCOQi.exe
  C:\Windows\System\WrrCOQi.exe
  2⤵
  PID:696
- C:\Windows\System\kLnTFid.exe
  C:\Windows\System\kLnTFid.exe
  2⤵
  PID:6228
- C:\Windows\System\zklBGdl.exe
  C:\Windows\System\zklBGdl.exe
  2⤵
  PID:4920
- C:\Windows\System\bNPMCJc.exe
  C:\Windows\System\bNPMCJc.exe
  2⤵
  PID:6596
- C:\Windows\System\hVEvQYx.exe
  C:\Windows\System\hVEvQYx.exe
  2⤵
  PID:6880
- C:\Windows\System\ldMGbtW.exe
  C:\Windows\System\ldMGbtW.exe
  2⤵
  PID:5944
- C:\Windows\System\iBAyDXd.exe
  C:\Windows\System\iBAyDXd.exe
  2⤵
  PID:6556
- C:\Windows\System\bvzPrIe.exe
  C:\Windows\System\bvzPrIe.exe
  2⤵
  PID:7188
- C:\Windows\System\thmdyMs.exe
  C:\Windows\System\thmdyMs.exe
  2⤵
  PID:7228
- C:\Windows\System\xSwWQzs.exe
  C:\Windows\System\xSwWQzs.exe
  2⤵
  PID:7276
- C:\Windows\System\JfReNxp.exe
  C:\Windows\System\JfReNxp.exe
  2⤵
  PID:7296
- C:\Windows\System\SUpZfrA.exe
  C:\Windows\System\SUpZfrA.exe
  2⤵
  PID:7320
- C:\Windows\System\rDJPuBS.exe
  C:\Windows\System\rDJPuBS.exe
  2⤵
  PID:7368
- C:\Windows\System\wHzEHVe.exe
  C:\Windows\System\wHzEHVe.exe
  2⤵
  PID:7388
- C:\Windows\System\wJfBZCq.exe
  C:\Windows\System\wJfBZCq.exe
  2⤵
  PID:7408
- C:\Windows\System\VJLzbId.exe
  C:\Windows\System\VJLzbId.exe
  2⤵
  PID:7436
- C:\Windows\System\ZfmtApv.exe
  C:\Windows\System\ZfmtApv.exe
  2⤵
  PID:7452
- C:\Windows\System\PzgwufT.exe
  C:\Windows\System\PzgwufT.exe
  2⤵
  PID:7472
- C:\Windows\System\KVjNwBb.exe
  C:\Windows\System\KVjNwBb.exe
  2⤵
  PID:7496
- C:\Windows\System\MbHvxMl.exe
  C:\Windows\System\MbHvxMl.exe
  2⤵
  PID:7512
- C:\Windows\System\goQWCoT.exe
  C:\Windows\System\goQWCoT.exe
  2⤵
  PID:7556
- C:\Windows\System\XgCZrWw.exe
  C:\Windows\System\XgCZrWw.exe
  2⤵
  PID:7572
- C:\Windows\System\ktxstHS.exe
  C:\Windows\System\ktxstHS.exe
  2⤵
  PID:7612
- C:\Windows\System\KzjPYZO.exe
  C:\Windows\System\KzjPYZO.exe
  2⤵
  PID:7644
- C:\Windows\System\tFnPMWa.exe
  C:\Windows\System\tFnPMWa.exe
  2⤵
  PID:7688
- C:\Windows\System\nnapcvC.exe
  C:\Windows\System\nnapcvC.exe
  2⤵
  PID:7704
- C:\Windows\System\JbSoOMd.exe
  C:\Windows\System\JbSoOMd.exe
  2⤵
  PID:7732
- C:\Windows\System\AQYNyuB.exe
  C:\Windows\System\AQYNyuB.exe
  2⤵
  PID:7756
- C:\Windows\System\cSwrAVq.exe
  C:\Windows\System\cSwrAVq.exe
  2⤵
  PID:7776
- C:\Windows\System\NuysDTH.exe
  C:\Windows\System\NuysDTH.exe
  2⤵
  PID:7796
- C:\Windows\System\hYuQdbx.exe
  C:\Windows\System\hYuQdbx.exe
  2⤵
  PID:7812
- C:\Windows\System\OqoGAVf.exe
  C:\Windows\System\OqoGAVf.exe
  2⤵
  PID:7828
- C:\Windows\System\qIpnvns.exe
  C:\Windows\System\qIpnvns.exe
  2⤵
  PID:7852
- C:\Windows\System\lPEPheK.exe
  C:\Windows\System\lPEPheK.exe
  2⤵
  PID:7868
- C:\Windows\System\ScKZZcB.exe
  C:\Windows\System\ScKZZcB.exe
  2⤵
  PID:7888
- C:\Windows\System\AdtDtiY.exe
  C:\Windows\System\AdtDtiY.exe
  2⤵
  PID:7908
- C:\Windows\System\folhuVo.exe
  C:\Windows\System\folhuVo.exe
  2⤵
  PID:7928
- C:\Windows\System\LZcgXkW.exe
  C:\Windows\System\LZcgXkW.exe
  2⤵
  PID:7944
- C:\Windows\System\dGMxUVm.exe
  C:\Windows\System\dGMxUVm.exe
  2⤵
  PID:8004
- C:\Windows\System\FxwcHJX.exe
  C:\Windows\System\FxwcHJX.exe
  2⤵
  PID:8028
- C:\Windows\System\tVPjMOM.exe
  C:\Windows\System\tVPjMOM.exe
  2⤵
  PID:8048
- C:\Windows\System\oqnQAtf.exe
  C:\Windows\System\oqnQAtf.exe
  2⤵
  PID:8120
- C:\Windows\System\qDnoWXK.exe
  C:\Windows\System\qDnoWXK.exe
  2⤵
  PID:8148
- C:\Windows\System\QghQohR.exe
  C:\Windows\System\QghQohR.exe
  2⤵
  PID:8164
- C:\Windows\System\TolEBQS.exe
  C:\Windows\System\TolEBQS.exe
  2⤵
  PID:8184
- C:\Windows\System\CTmkIpT.exe
  C:\Windows\System\CTmkIpT.exe
  2⤵
  PID:7268
- C:\Windows\System\ZcOHneB.exe
  C:\Windows\System\ZcOHneB.exe
  2⤵
  PID:7284
- C:\Windows\System\InvBLXu.exe
  C:\Windows\System\InvBLXu.exe
  2⤵
  PID:7420
- C:\Windows\System\CQAjcRW.exe
  C:\Windows\System\CQAjcRW.exe
  2⤵
  PID:7488
- C:\Windows\System\GQlZTKR.exe
  C:\Windows\System\GQlZTKR.exe
  2⤵
  PID:7540
- C:\Windows\System\CogorxX.exe
  C:\Windows\System\CogorxX.exe
  2⤵
  PID:7600
- C:\Windows\System\UdcjxZx.exe
  C:\Windows\System\UdcjxZx.exe
  2⤵
  PID:7632
- C:\Windows\System\fvboezN.exe
  C:\Windows\System\fvboezN.exe
  2⤵
  PID:7764
- C:\Windows\System\aAjxBWQ.exe
  C:\Windows\System\aAjxBWQ.exe
  2⤵
  PID:7844
- C:\Windows\System\vNenckB.exe
  C:\Windows\System\vNenckB.exe
  2⤵
  PID:7920
- C:\Windows\System\fALjbWK.exe
  C:\Windows\System\fALjbWK.exe
  2⤵
  PID:7964
- C:\Windows\System\fsJdGYP.exe
  C:\Windows\System\fsJdGYP.exe
  2⤵
  PID:8084
- C:\Windows\System\xOeieaH.exe
  C:\Windows\System\xOeieaH.exe
  2⤵
  PID:8140
- C:\Windows\System\bNPzyph.exe
  C:\Windows\System\bNPzyph.exe
  2⤵
  PID:8076
- C:\Windows\System\cYvzhGR.exe
  C:\Windows\System\cYvzhGR.exe
  2⤵
  PID:8112
- C:\Windows\System\CcSmHqL.exe
  C:\Windows\System\CcSmHqL.exe
  2⤵
  PID:7180
- C:\Windows\System\SHsLVdY.exe
  C:\Windows\System\SHsLVdY.exe
  2⤵
  PID:7312
- C:\Windows\System\FwPXuTS.exe
  C:\Windows\System\FwPXuTS.exe
  2⤵
  PID:7536
- C:\Windows\System\SHRXVoc.exe
  C:\Windows\System\SHRXVoc.exe
  2⤵
  PID:4684
- C:\Windows\System\fuYgSJY.exe
  C:\Windows\System\fuYgSJY.exe
  2⤵
  PID:7700
- C:\Windows\System\gyXCDPW.exe
  C:\Windows\System\gyXCDPW.exe
  2⤵
  PID:7740
- C:\Windows\System\TOKPPEM.exe
  C:\Windows\System\TOKPPEM.exe
  2⤵
  PID:8132
- C:\Windows\System\WYkzqmP.exe
  C:\Windows\System\WYkzqmP.exe
  2⤵
  PID:7288
- C:\Windows\System\nJkaUoG.exe
  C:\Windows\System\nJkaUoG.exe
  2⤵
  PID:1424
- C:\Windows\System\vOqjBCU.exe
  C:\Windows\System\vOqjBCU.exe
  2⤵
  PID:7628
- C:\Windows\System\TvJLhZt.exe
  C:\Windows\System\TvJLhZt.exe
  2⤵
  PID:8128
- C:\Windows\System\tYNTMBy.exe
  C:\Windows\System\tYNTMBy.exe
  2⤵
  PID:8180
- C:\Windows\System\kazGuET.exe
  C:\Windows\System\kazGuET.exe
  2⤵
  PID:7464
- C:\Windows\System\tFdPEtO.exe
  C:\Windows\System\tFdPEtO.exe
  2⤵
  PID:8216
- C:\Windows\System\gyOcfuR.exe
  C:\Windows\System\gyOcfuR.exe
  2⤵
  PID:8240
- C:\Windows\System\WXuAWNH.exe
  C:\Windows\System\WXuAWNH.exe
  2⤵
  PID:8256
- C:\Windows\System\BVJNlNd.exe
  C:\Windows\System\BVJNlNd.exe
  2⤵
  PID:8280
- C:\Windows\System\DFBLEpP.exe
  C:\Windows\System\DFBLEpP.exe
  2⤵
  PID:8304
- C:\Windows\System\WKtNYro.exe
  C:\Windows\System\WKtNYro.exe
  2⤵
  PID:8324
- C:\Windows\System\pufkXhL.exe
  C:\Windows\System\pufkXhL.exe
  2⤵
  PID:8344
- C:\Windows\System\VbftzeB.exe
  C:\Windows\System\VbftzeB.exe
  2⤵
  PID:8360
- C:\Windows\System\FeQnrvk.exe
  C:\Windows\System\FeQnrvk.exe
  2⤵
  PID:8380
- C:\Windows\System\aJydCUF.exe
  C:\Windows\System\aJydCUF.exe
  2⤵
  PID:8432
- C:\Windows\System\jpeaFru.exe
  C:\Windows\System\jpeaFru.exe
  2⤵
  PID:8448
- C:\Windows\System\sffTVOc.exe
  C:\Windows\System\sffTVOc.exe
  2⤵
  PID:8508
- C:\Windows\System\HSIQnrK.exe
  C:\Windows\System\HSIQnrK.exe
  2⤵
  PID:8548
- C:\Windows\System\oyKIGuv.exe
  C:\Windows\System\oyKIGuv.exe
  2⤵
  PID:8588
- C:\Windows\System\HkCPUca.exe
  C:\Windows\System\HkCPUca.exe
  2⤵
  PID:8636
- C:\Windows\System\oWYXQvu.exe
  C:\Windows\System\oWYXQvu.exe
  2⤵
  PID:8748
- C:\Windows\System\nTAOBZW.exe
  C:\Windows\System\nTAOBZW.exe
  2⤵
  PID:8764
- C:\Windows\System\rgESQBK.exe
  C:\Windows\System\rgESQBK.exe
  2⤵
  PID:8780
- C:\Windows\System\XlZXBVh.exe
  C:\Windows\System\XlZXBVh.exe
  2⤵
  PID:8796
- C:\Windows\System\kgkGqvF.exe
  C:\Windows\System\kgkGqvF.exe
  2⤵
  PID:8812
- C:\Windows\System\XsQKgUK.exe
  C:\Windows\System\XsQKgUK.exe
  2⤵
  PID:8828
- C:\Windows\System\OxzSiZy.exe
  C:\Windows\System\OxzSiZy.exe
  2⤵
  PID:8844
- C:\Windows\System\vlTHXkU.exe
  C:\Windows\System\vlTHXkU.exe
  2⤵
  PID:8860
- C:\Windows\System\OAqGqxr.exe
  C:\Windows\System\OAqGqxr.exe
  2⤵
  PID:8876
- C:\Windows\System\NgGcDOJ.exe
  C:\Windows\System\NgGcDOJ.exe
  2⤵
  PID:8892
- C:\Windows\System\xstpWlX.exe
  C:\Windows\System\xstpWlX.exe
  2⤵
  PID:8912
- C:\Windows\System\JUrAYlZ.exe
  C:\Windows\System\JUrAYlZ.exe
  2⤵
  PID:8944
- C:\Windows\System\CcMwYrP.exe
  C:\Windows\System\CcMwYrP.exe
  2⤵
  PID:9016
- C:\Windows\System\MnvTBDd.exe
  C:\Windows\System\MnvTBDd.exe
  2⤵
  PID:9048
- C:\Windows\System\inwqnje.exe
  C:\Windows\System\inwqnje.exe
  2⤵
  PID:9072
- C:\Windows\System\GkYXMZl.exe
  C:\Windows\System\GkYXMZl.exe
  2⤵
  PID:9100
- C:\Windows\System\dKTHiqa.exe
  C:\Windows\System\dKTHiqa.exe
  2⤵
  PID:9120
- C:\Windows\System\dxotLZp.exe
  C:\Windows\System\dxotLZp.exe
  2⤵
  PID:9144
- C:\Windows\System\mWLumpG.exe
  C:\Windows\System\mWLumpG.exe
  2⤵
  PID:9168
- C:\Windows\System\BltXUrk.exe
  C:\Windows\System\BltXUrk.exe
  2⤵
  PID:9188
- C:\Windows\System\BEUhwvU.exe
  C:\Windows\System\BEUhwvU.exe
  2⤵
  PID:9212
- C:\Windows\System\eJfjeZE.exe
  C:\Windows\System\eJfjeZE.exe
  2⤵
  PID:3228
- C:\Windows\System\uNUdwuU.exe
  C:\Windows\System\uNUdwuU.exe
  2⤵
  PID:8276
- C:\Windows\System\JcoDaOA.exe
  C:\Windows\System\JcoDaOA.exe
  2⤵
  PID:8372
- C:\Windows\System\YeNhyzN.exe
  C:\Windows\System\YeNhyzN.exe
  2⤵
  PID:8336
- C:\Windows\System\QBUCwZp.exe
  C:\Windows\System\QBUCwZp.exe
  2⤵
  PID:8472
- C:\Windows\System\tyFvFrk.exe
  C:\Windows\System\tyFvFrk.exe
  2⤵
  PID:8420
- C:\Windows\System\ZYgAtyM.exe
  C:\Windows\System\ZYgAtyM.exe
  2⤵
  PID:8528
- C:\Windows\System\nGeivGH.exe
  C:\Windows\System\nGeivGH.exe
  2⤵
  PID:8560
- C:\Windows\System\EQxmBZE.exe
  C:\Windows\System\EQxmBZE.exe
  2⤵
  PID:8756
- C:\Windows\System\kMmPnXG.exe
  C:\Windows\System\kMmPnXG.exe
  2⤵
  PID:8628
- C:\Windows\System\HznzToF.exe
  C:\Windows\System\HznzToF.exe
  2⤵
  PID:8820
- C:\Windows\System\WbhQrZO.exe
  C:\Windows\System\WbhQrZO.exe
  2⤵
  PID:8668
- C:\Windows\System\CWLtVJD.exe
  C:\Windows\System\CWLtVJD.exe
  2⤵
  PID:8888
- C:\Windows\System\jaBKznf.exe
  C:\Windows\System\jaBKznf.exe
  2⤵
  PID:8804
- C:\Windows\System\oYnNttt.exe
  C:\Windows\System\oYnNttt.exe
  2⤵
  PID:9116
- C:\Windows\System\GkkHxMV.exe
  C:\Windows\System\GkkHxMV.exe
  2⤵
  PID:8408
- C:\Windows\System\QUhIfiS.exe
  C:\Windows\System\QUhIfiS.exe
  2⤵
  PID:8620
- C:\Windows\System\UDxqLLx.exe
  C:\Windows\System\UDxqLLx.exe
  2⤵
  PID:8656
- C:\Windows\System\hSkMyIG.exe
  C:\Windows\System\hSkMyIG.exe
  2⤵
  PID:8500
- C:\Windows\System\aPPBplm.exe
  C:\Windows\System\aPPBplm.exe
  2⤵
  PID:8612
- C:\Windows\System\vVvhRjc.exe
  C:\Windows\System\vVvhRjc.exe
  2⤵
  PID:8700
- C:\Windows\System\pMfOcYF.exe
  C:\Windows\System\pMfOcYF.exe
  2⤵
  PID:8716
- C:\Windows\System\StDZkfO.exe
  C:\Windows\System\StDZkfO.exe
  2⤵
  PID:9080
- C:\Windows\System\bpnRhmq.exe
  C:\Windows\System\bpnRhmq.exe
  2⤵
  PID:9196
- C:\Windows\System\pdiDGQt.exe
  C:\Windows\System\pdiDGQt.exe
  2⤵
  PID:2920
- C:\Windows\System\ZLUkGLm.exe
  C:\Windows\System\ZLUkGLm.exe
  2⤵
  PID:8740
- C:\Windows\System\uNHQhcH.exe
  C:\Windows\System\uNHQhcH.exe
  2⤵
  PID:8776
- C:\Windows\System\QiuCtEF.exe
  C:\Windows\System\QiuCtEF.exe
  2⤵
  PID:8580
- C:\Windows\System\gMqsVaR.exe
  C:\Windows\System\gMqsVaR.exe
  2⤵
  PID:9236
- C:\Windows\System\SRfaXpi.exe
  C:\Windows\System\SRfaXpi.exe
  2⤵
  PID:9272
- C:\Windows\System\rIlLgTO.exe
  C:\Windows\System\rIlLgTO.exe
  2⤵
  PID:9312
- C:\Windows\System\mLORhzG.exe
  C:\Windows\System\mLORhzG.exe
  2⤵
  PID:9332
- C:\Windows\System\Lmskghc.exe
  C:\Windows\System\Lmskghc.exe
  2⤵
  PID:9360
- C:\Windows\System\CAwcAFB.exe
  C:\Windows\System\CAwcAFB.exe
  2⤵
  PID:9404
- C:\Windows\System\fOYXlka.exe
  C:\Windows\System\fOYXlka.exe
  2⤵
  PID:9432
- C:\Windows\System\aCcoUCj.exe
  C:\Windows\System\aCcoUCj.exe
  2⤵
  PID:9452
- C:\Windows\System\ntwCtmb.exe
  C:\Windows\System\ntwCtmb.exe
  2⤵
  PID:9492
- C:\Windows\System\hFALdlA.exe
  C:\Windows\System\hFALdlA.exe
  2⤵
  PID:9516
- C:\Windows\System\bWiMAin.exe
  C:\Windows\System\bWiMAin.exe
  2⤵
  PID:9536
- C:\Windows\System\lWdGcNb.exe
  C:\Windows\System\lWdGcNb.exe
  2⤵
  PID:9556
- C:\Windows\System\AHTOTRv.exe
  C:\Windows\System\AHTOTRv.exe
  2⤵
  PID:9588
- C:\Windows\System\dshjftZ.exe
  C:\Windows\System\dshjftZ.exe
  2⤵
  PID:9608
- C:\Windows\System\ChQBBJb.exe
  C:\Windows\System\ChQBBJb.exe
  2⤵
  PID:9636
- C:\Windows\System\TwYNCwt.exe
  C:\Windows\System\TwYNCwt.exe
  2⤵
  PID:9656
- C:\Windows\System\GHhZKJW.exe
  C:\Windows\System\GHhZKJW.exe
  2⤵
  PID:9696
- C:\Windows\System\pkKqwrl.exe
  C:\Windows\System\pkKqwrl.exe
  2⤵
  PID:9720
- C:\Windows\System\jAxknoV.exe
  C:\Windows\System\jAxknoV.exe
  2⤵
  PID:9740
- C:\Windows\System\AGFOIIy.exe
  C:\Windows\System\AGFOIIy.exe
  2⤵
  PID:9776
- C:\Windows\System\SLsqAJs.exe
  C:\Windows\System\SLsqAJs.exe
  2⤵
  PID:9808
- C:\Windows\System\DRFfJHH.exe
  C:\Windows\System\DRFfJHH.exe
  2⤵
  PID:9832
- C:\Windows\System\rdqdipT.exe
  C:\Windows\System\rdqdipT.exe
  2⤵
  PID:9868
- C:\Windows\System\XrxNAIP.exe
  C:\Windows\System\XrxNAIP.exe
  2⤵
  PID:9884
- C:\Windows\System\XxEqqtD.exe
  C:\Windows\System\XxEqqtD.exe
  2⤵
  PID:9920
- C:\Windows\System\GgTPgFn.exe
  C:\Windows\System\GgTPgFn.exe
  2⤵
  PID:9944
- C:\Windows\System\ziPYqky.exe
  C:\Windows\System\ziPYqky.exe
  2⤵
  PID:9964
- C:\Windows\System\cMLUDWX.exe
  C:\Windows\System\cMLUDWX.exe
  2⤵
  PID:9992
- C:\Windows\System\RcMEVXp.exe
  C:\Windows\System\RcMEVXp.exe
  2⤵
  PID:10032
- C:\Windows\System\QGpKZlr.exe
  C:\Windows\System\QGpKZlr.exe
  2⤵
  PID:10064
- C:\Windows\System\yHkvyql.exe
  C:\Windows\System\yHkvyql.exe
  2⤵
  PID:10080
- C:\Windows\System\mRxHuig.exe
  C:\Windows\System\mRxHuig.exe
  2⤵
  PID:10104
- C:\Windows\System\aQUHmet.exe
  C:\Windows\System\aQUHmet.exe
  2⤵
  PID:10140
- C:\Windows\System\FqMlEVQ.exe
  C:\Windows\System\FqMlEVQ.exe
  2⤵
  PID:10172
- C:\Windows\System\utLBgVH.exe
  C:\Windows\System\utLBgVH.exe
  2⤵
  PID:10196
- C:\Windows\System\ZUOYcYP.exe
  C:\Windows\System\ZUOYcYP.exe
  2⤵
  PID:10216
- C:\Windows\System\yddAIdx.exe
  C:\Windows\System\yddAIdx.exe
  2⤵
  PID:10236
- C:\Windows\System\whACUGe.exe
  C:\Windows\System\whACUGe.exe
  2⤵
  PID:8984
- C:\Windows\System\xMkDCet.exe
  C:\Windows\System\xMkDCet.exe
  2⤵
  PID:9256
- C:\Windows\System\fSwJrmJ.exe
  C:\Windows\System\fSwJrmJ.exe
  2⤵
  PID:9340
- C:\Windows\System\FuNEymW.exe
  C:\Windows\System\FuNEymW.exe
  2⤵
  PID:9380
- C:\Windows\System\ocxzkPe.exe
  C:\Windows\System\ocxzkPe.exe
  2⤵
  PID:9420
- C:\Windows\System\XeBfrbX.exe
  C:\Windows\System\XeBfrbX.exe
  2⤵
  PID:9468
- C:\Windows\System\ClDegTf.exe
  C:\Windows\System\ClDegTf.exe
  2⤵
  PID:9524
- C:\Windows\System\XxhxUpD.exe
  C:\Windows\System\XxhxUpD.exe
  2⤵
  PID:9580
- C:\Windows\System\VmEGReL.exe
  C:\Windows\System\VmEGReL.exe
  2⤵
  PID:9632
- C:\Windows\System\aGrTEAx.exe
  C:\Windows\System\aGrTEAx.exe
  2⤵
  PID:9704
- C:\Windows\System\VdHXmWl.exe
  C:\Windows\System\VdHXmWl.exe
  2⤵
  PID:9716
- C:\Windows\System\eOJoMGM.exe
  C:\Windows\System\eOJoMGM.exe
  2⤵
  PID:9844
- C:\Windows\System\xiOScaL.exe
  C:\Windows\System\xiOScaL.exe
  2⤵
  PID:9988
- C:\Windows\System\EyCGbwp.exe
  C:\Windows\System\EyCGbwp.exe
  2⤵
  PID:10208
- C:\Windows\System\BtOhszl.exe
  C:\Windows\System\BtOhszl.exe
  2⤵
  PID:10212
- C:\Windows\System\rGAwgXs.exe
  C:\Windows\System\rGAwgXs.exe
  2⤵
  PID:9328
- C:\Windows\System\AEAxlCT.exe
  C:\Windows\System\AEAxlCT.exe
  2⤵
  PID:8704
- C:\Windows\System\aWDfMOS.exe
  C:\Windows\System\aWDfMOS.exe
  2⤵
  PID:9600
- C:\Windows\System\VrvaGxv.exe
  C:\Windows\System\VrvaGxv.exe
  2⤵
  PID:9692
- C:\Windows\System\ckTSRBo.exe
  C:\Windows\System\ckTSRBo.exe
  2⤵
  PID:9624
- C:\Windows\System\WernWfs.exe
  C:\Windows\System\WernWfs.exe
  2⤵
  PID:9732
- C:\Windows\System\igMbFMc.exe
  C:\Windows\System\igMbFMc.exe
  2⤵
  PID:9800
- C:\Windows\System\WdmVGff.exe
  C:\Windows\System\WdmVGff.exe
  2⤵
  PID:10004
- C:\Windows\System\lLjrhFv.exe
  C:\Windows\System\lLjrhFv.exe
  2⤵
  PID:9324
- C:\Windows\System\jlIwRpV.exe
  C:\Windows\System\jlIwRpV.exe
  2⤵
  PID:9548
- C:\Windows\System\KPBzzFF.exe
  C:\Windows\System\KPBzzFF.exe
  2⤵
  PID:9904
- C:\Windows\System\RgOdaAP.exe
  C:\Windows\System\RgOdaAP.exe
  2⤵
  PID:10132
- C:\Windows\System\qfuLjhC.exe
  C:\Windows\System\qfuLjhC.exe
  2⤵
  PID:10244
- C:\Windows\System\WwTuOmt.exe
  C:\Windows\System\WwTuOmt.exe
  2⤵
  PID:10276
- C:\Windows\System\BHmgYlZ.exe
  C:\Windows\System\BHmgYlZ.exe
  2⤵
  PID:10292
- C:\Windows\System\FdBSxbg.exe
  C:\Windows\System\FdBSxbg.exe
  2⤵
  PID:10316
- C:\Windows\System\bxxdSdN.exe
  C:\Windows\System\bxxdSdN.exe
  2⤵
  PID:10332
- C:\Windows\System\mthKUPp.exe
  C:\Windows\System\mthKUPp.exe
  2⤵
  PID:10352
- C:\Windows\System\cbAHXyH.exe
  C:\Windows\System\cbAHXyH.exe
  2⤵
  PID:10380
- C:\Windows\System\DnUOtGI.exe
  C:\Windows\System\DnUOtGI.exe
  2⤵
  PID:10400
- C:\Windows\System\LkDEEGf.exe
  C:\Windows\System\LkDEEGf.exe
  2⤵
  PID:10492
- C:\Windows\System\SVixYEN.exe
  C:\Windows\System\SVixYEN.exe
  2⤵
  PID:10560
- C:\Windows\System\vsplutA.exe
  C:\Windows\System\vsplutA.exe
  2⤵
  PID:10584
- C:\Windows\System\yVyiPTn.exe
  C:\Windows\System\yVyiPTn.exe
  2⤵
  PID:10608
- C:\Windows\System\SWgnJeo.exe
  C:\Windows\System\SWgnJeo.exe
  2⤵
  PID:10632
- C:\Windows\System\iBGeWQl.exe
  C:\Windows\System\iBGeWQl.exe
  2⤵
  PID:10676
- C:\Windows\System\Iadwudm.exe
  C:\Windows\System\Iadwudm.exe
  2⤵
  PID:10696
- C:\Windows\System\DxwPzWM.exe
  C:\Windows\System\DxwPzWM.exe
  2⤵
  PID:10720
- C:\Windows\System\DbSVYXp.exe
  C:\Windows\System\DbSVYXp.exe
  2⤵
  PID:10744
- C:\Windows\System\lwTvwwt.exe
  C:\Windows\System\lwTvwwt.exe
  2⤵
  PID:10772
- C:\Windows\System\MGytvcx.exe
  C:\Windows\System\MGytvcx.exe
  2⤵
  PID:10800
- C:\Windows\System\yQMjAiN.exe
  C:\Windows\System\yQMjAiN.exe
  2⤵
  PID:10820
- C:\Windows\System\dgpKqXt.exe
  C:\Windows\System\dgpKqXt.exe
  2⤵
  PID:10844
- C:\Windows\System\ZUVjvNn.exe
  C:\Windows\System\ZUVjvNn.exe
  2⤵
  PID:10868
- C:\Windows\System\yQtAWcQ.exe
  C:\Windows\System\yQtAWcQ.exe
  2⤵
  PID:10912
- C:\Windows\System\wDCrxiG.exe
  C:\Windows\System\wDCrxiG.exe
  2⤵
  PID:10932
- C:\Windows\System\LbRtWCu.exe
  C:\Windows\System\LbRtWCu.exe
  2⤵
  PID:10956
- C:\Windows\System\TkFKeqA.exe
  C:\Windows\System\TkFKeqA.exe
  2⤵
  PID:10976
- C:\Windows\System\yugPijm.exe
  C:\Windows\System\yugPijm.exe
  2⤵
  PID:11016
- C:\Windows\System\MESpTgR.exe
  C:\Windows\System\MESpTgR.exe
  2⤵
  PID:11048
- C:\Windows\System\CeSFvaD.exe
  C:\Windows\System\CeSFvaD.exe
  2⤵
  PID:11080
- C:\Windows\System\yXURGMa.exe
  C:\Windows\System\yXURGMa.exe
  2⤵
  PID:11108
- C:\Windows\System\BfPkpjL.exe
  C:\Windows\System\BfPkpjL.exe
  2⤵
  PID:11144
- C:\Windows\System\PiIdJqq.exe
  C:\Windows\System\PiIdJqq.exe
  2⤵
  PID:11172
- C:\Windows\System\QvonCmn.exe
  C:\Windows\System\QvonCmn.exe
  2⤵
  PID:11196
- C:\Windows\System\HBshKII.exe
  C:\Windows\System\HBshKII.exe
  2⤵
  PID:11228
- C:\Windows\System\ormHdnd.exe
  C:\Windows\System\ormHdnd.exe
  2⤵
  PID:11248
- C:\Windows\System\AxYfQTx.exe
  C:\Windows\System\AxYfQTx.exe
  2⤵
  PID:9352
- C:\Windows\System\GLUljBh.exe
  C:\Windows\System\GLUljBh.exe
  2⤵
  PID:9876
- C:\Windows\System\efCqbat.exe
  C:\Windows\System\efCqbat.exe
  2⤵
  PID:10268
- C:\Windows\System\HNXLWcO.exe
  C:\Windows\System\HNXLWcO.exe
  2⤵
  PID:10392
- C:\Windows\System\mgopigo.exe
  C:\Windows\System\mgopigo.exe
  2⤵
  PID:10312
- C:\Windows\System\coeQdRG.exe
  C:\Windows\System\coeQdRG.exe
  2⤵
  PID:10348
- C:\Windows\System\MXhkXFK.exe
  C:\Windows\System\MXhkXFK.exe
  2⤵
  PID:10628
- C:\Windows\System\WtcKQol.exe
  C:\Windows\System\WtcKQol.exe
  2⤵
  PID:10736
- C:\Windows\System\sEdGaaE.exe
  C:\Windows\System\sEdGaaE.exe
  2⤵
  PID:10756
- C:\Windows\System\nxPUFQq.exe
  C:\Windows\System\nxPUFQq.exe
  2⤵
  PID:10832
- C:\Windows\System\yFXUyKU.exe
  C:\Windows\System\yFXUyKU.exe
  2⤵
  PID:10860
- C:\Windows\System\ApSICTf.exe
  C:\Windows\System\ApSICTf.exe
  2⤵
  PID:10928
- C:\Windows\System\ucPYtDM.exe
  C:\Windows\System\ucPYtDM.exe
  2⤵
  PID:11060
- C:\Windows\System\oeCUMBI.exe
  C:\Windows\System\oeCUMBI.exe
  2⤵
  PID:11092
- C:\Windows\System\TLzgWcc.exe
  C:\Windows\System\TLzgWcc.exe
  2⤵
  PID:11180
- C:\Windows\System\pzZOdbU.exe
  C:\Windows\System\pzZOdbU.exe
  2⤵
  PID:11220
- C:\Windows\System\WhcBYND.exe
  C:\Windows\System\WhcBYND.exe
  2⤵
  PID:10060
- C:\Windows\System\HCsQgQh.exe
  C:\Windows\System\HCsQgQh.exe
  2⤵
  PID:10344
- C:\Windows\System\MPNTzXG.exe
  C:\Windows\System\MPNTzXG.exe
  2⤵
  PID:10592
- C:\Windows\System\KNlfWiH.exe
  C:\Windows\System\KNlfWiH.exe
  2⤵
  PID:10620
- C:\Windows\System\wwkZmaM.exe
  C:\Windows\System\wwkZmaM.exe
  2⤵
  PID:10708
- C:\Windows\System\MYyANZW.exe
  C:\Windows\System\MYyANZW.exe
  2⤵
  PID:11012
- C:\Windows\System\xUvIlEM.exe
  C:\Windows\System\xUvIlEM.exe
  2⤵
  PID:11260
- C:\Windows\System\DhGQMBP.exe
  C:\Windows\System\DhGQMBP.exe
  2⤵
  PID:10328
- C:\Windows\System\fFkPINd.exe
  C:\Windows\System\fFkPINd.exe
  2⤵
  PID:10968
- C:\Windows\System\lyipLff.exe
  C:\Windows\System\lyipLff.exe
  2⤵
  PID:11168
- C:\Windows\System\mdmWMQh.exe
  C:\Windows\System\mdmWMQh.exe
  2⤵
  PID:11192
- C:\Windows\System\okmyWwR.exe
  C:\Windows\System\okmyWwR.exe
  2⤵
  PID:11040
- C:\Windows\System\vUFPadl.exe
  C:\Windows\System\vUFPadl.exe
  2⤵
  PID:11300
- C:\Windows\System\CKijhKZ.exe
  C:\Windows\System\CKijhKZ.exe
  2⤵
  PID:11340
- C:\Windows\System\dwTWzyi.exe
  C:\Windows\System\dwTWzyi.exe
  2⤵
  PID:11360
- C:\Windows\System\nwIBXnb.exe
  C:\Windows\System\nwIBXnb.exe
  2⤵
  PID:11388
- C:\Windows\System\zjtviJQ.exe
  C:\Windows\System\zjtviJQ.exe
  2⤵
  PID:11404
- C:\Windows\System\EaLqjOl.exe
  C:\Windows\System\EaLqjOl.exe
  2⤵
  PID:11428
- C:\Windows\System\urrsmFB.exe
  C:\Windows\System\urrsmFB.exe
  2⤵
  PID:11452
- C:\Windows\System\InnYdOa.exe
  C:\Windows\System\InnYdOa.exe
  2⤵
  PID:11476
- C:\Windows\System\FuVDzDk.exe
  C:\Windows\System\FuVDzDk.exe
  2⤵
  PID:11496
- C:\Windows\System\SIDyDYa.exe
  C:\Windows\System\SIDyDYa.exe
  2⤵
  PID:11516
- C:\Windows\System\WFUFHVg.exe
  C:\Windows\System\WFUFHVg.exe
  2⤵
  PID:11544
- C:\Windows\System\sRwKWMc.exe
  C:\Windows\System\sRwKWMc.exe
  2⤵
  PID:11560
- C:\Windows\System\pIvuvoB.exe
  C:\Windows\System\pIvuvoB.exe
  2⤵
  PID:11608
- C:\Windows\System\cvanhMI.exe
  C:\Windows\System\cvanhMI.exe
  2⤵
  PID:11636
- C:\Windows\System\Qogzkrq.exe
  C:\Windows\System\Qogzkrq.exe
  2⤵
  PID:11660
- C:\Windows\System\VsKIgzT.exe
  C:\Windows\System\VsKIgzT.exe
  2⤵
  PID:11676
- C:\Windows\System\UTHozTy.exe
  C:\Windows\System\UTHozTy.exe
  2⤵
  PID:11696
- C:\Windows\System\bHXCWsN.exe
  C:\Windows\System\bHXCWsN.exe
  2⤵
  PID:11776
- C:\Windows\System\nhUhcjD.exe
  C:\Windows\System\nhUhcjD.exe
  2⤵
  PID:11820
- C:\Windows\System\NZEgNno.exe
  C:\Windows\System\NZEgNno.exe
  2⤵
  PID:11844
- C:\Windows\System\DrEBYjq.exe
  C:\Windows\System\DrEBYjq.exe
  2⤵
  PID:11860
- C:\Windows\System\NcUFuUf.exe
  C:\Windows\System\NcUFuUf.exe
  2⤵
  PID:11880
- C:\Windows\System\owfDAff.exe
  C:\Windows\System\owfDAff.exe
  2⤵
  PID:11932
- C:\Windows\System\DIckDRe.exe
  C:\Windows\System\DIckDRe.exe
  2⤵
  PID:11948
- C:\Windows\System\iWpkkto.exe
  C:\Windows\System\iWpkkto.exe
  2⤵
  PID:11964
- C:\Windows\System\DYquOha.exe
  C:\Windows\System\DYquOha.exe
  2⤵
  PID:12000
- C:\Windows\System\dgTmxyL.exe
  C:\Windows\System\dgTmxyL.exe
  2⤵
  PID:12016
- C:\Windows\System\xcfRZue.exe
  C:\Windows\System\xcfRZue.exe
  2⤵
  PID:12044
- C:\Windows\System\rYorPrI.exe
  C:\Windows\System\rYorPrI.exe
  2⤵
  PID:12072
- C:\Windows\System\JDyiheO.exe
  C:\Windows\System\JDyiheO.exe
  2⤵
  PID:12116
- C:\Windows\System\dqFUyOW.exe
  C:\Windows\System\dqFUyOW.exe
  2⤵
  PID:12136
- C:\Windows\System\muWOcJu.exe
  C:\Windows\System\muWOcJu.exe
  2⤵
  PID:12160
- C:\Windows\System\VFtDCrD.exe
  C:\Windows\System\VFtDCrD.exe
  2⤵
  PID:12180
- C:\Windows\System\auQHrUb.exe
  C:\Windows\System\auQHrUb.exe
  2⤵
  PID:12200
- C:\Windows\System\TFoqVEq.exe
  C:\Windows\System\TFoqVEq.exe
  2⤵
  PID:12232
- C:\Windows\System\aonrCeP.exe
  C:\Windows\System\aonrCeP.exe
  2⤵
  PID:12272
- C:\Windows\System\lRRTZcg.exe
  C:\Windows\System\lRRTZcg.exe
  2⤵
  PID:11368
- C:\Windows\System\XLWEGWt.exe
  C:\Windows\System\XLWEGWt.exe
  2⤵
  PID:11416
- C:\Windows\System\BmFtxKz.exe
  C:\Windows\System\BmFtxKz.exe
  2⤵
  PID:11444
- C:\Windows\System\sibVbBG.exe
  C:\Windows\System\sibVbBG.exe
  2⤵
  PID:11488
- C:\Windows\System\CAScgjC.exe
  C:\Windows\System\CAScgjC.exe
  2⤵
  PID:11556
- C:\Windows\System\GRrZYjL.exe
  C:\Windows\System\GRrZYjL.exe
  2⤵
  PID:11592
- C:\Windows\System\INEqwZr.exe
  C:\Windows\System\INEqwZr.exe
  2⤵
  PID:11628
- C:\Windows\System\lrJgLxn.exe
  C:\Windows\System\lrJgLxn.exe
  2⤵
  PID:11656
- C:\Windows\System\NXSjUbb.exe
  C:\Windows\System\NXSjUbb.exe
  2⤵
  PID:11692
- C:\Windows\System\greGpwA.exe
  C:\Windows\System\greGpwA.exe
  2⤵
  PID:11796
- C:\Windows\System\wzsVNdk.exe
  C:\Windows\System\wzsVNdk.exe
  2⤵
  PID:11876
- C:\Windows\System\slJeEEq.exe
  C:\Windows\System\slJeEEq.exe
  2⤵
  PID:11944
- C:\Windows\System\DmQYKpK.exe
  C:\Windows\System\DmQYKpK.exe
  2⤵
  PID:12040
- C:\Windows\System\ezSOFTt.exe
  C:\Windows\System\ezSOFTt.exe
  2⤵
  PID:12148
- C:\Windows\System\ffQyxQX.exe
  C:\Windows\System\ffQyxQX.exe
  2⤵
  PID:12196
- C:\Windows\System\PGHVJrL.exe
  C:\Windows\System\PGHVJrL.exe
  2⤵
  PID:12260
- C:\Windows\System\nBVSgZq.exe
  C:\Windows\System\nBVSgZq.exe
  2⤵
  PID:10468
- C:\Windows\System\jFFKaKO.exe
  C:\Windows\System\jFFKaKO.exe
  2⤵
  PID:11380
- C:\Windows\System\dVQnPvw.exe
  C:\Windows\System\dVQnPvw.exe
  2⤵
  PID:11504
- C:\Windows\System\BxYvZsK.exe
  C:\Windows\System\BxYvZsK.exe
  2⤵
  PID:11704
- C:\Windows\System\JUMoECE.exe
  C:\Windows\System\JUMoECE.exe
  2⤵
  PID:11808
- C:\Windows\System\rnpLZLC.exe
  C:\Windows\System\rnpLZLC.exe
  2⤵
  PID:11852
- C:\Windows\System\nXWKwiq.exe
  C:\Windows\System\nXWKwiq.exe
  2⤵
  PID:12008
- C:\Windows\System\UwSHPqA.exe
  C:\Windows\System\UwSHPqA.exe
  2⤵
  PID:11908
- C:\Windows\System\HVupfiW.exe
  C:\Windows\System\HVupfiW.exe
  2⤵
  PID:12168
- C:\Windows\System\xMDzMIj.exe
  C:\Windows\System\xMDzMIj.exe
  2⤵
  PID:12172
- C:\Windows\System\BHhMYiM.exe
  C:\Windows\System\BHhMYiM.exe
  2⤵
  PID:11672
- C:\Windows\System\AZXbiFP.exe
  C:\Windows\System\AZXbiFP.exe
  2⤵
  PID:12144
- C:\Windows\System\NboBdhK.exe
  C:\Windows\System\NboBdhK.exe
  2⤵
  PID:12332
- C:\Windows\System\wSmoMlZ.exe
  C:\Windows\System\wSmoMlZ.exe
  2⤵
  PID:12352
- C:\Windows\System\rQiggXo.exe
  C:\Windows\System\rQiggXo.exe
  2⤵
  PID:12372
- C:\Windows\System\WrUhZmF.exe
  C:\Windows\System\WrUhZmF.exe
  2⤵
  PID:12440
- C:\Windows\System\QCsnzFW.exe
  C:\Windows\System\QCsnzFW.exe
  2⤵
  PID:12460
- C:\Windows\System\BpzRnyl.exe
  C:\Windows\System\BpzRnyl.exe
  2⤵
  PID:12480
- C:\Windows\System\TgDUzXp.exe
  C:\Windows\System\TgDUzXp.exe
  2⤵
  PID:12532
- C:\Windows\System\mIeeJfC.exe
  C:\Windows\System\mIeeJfC.exe
  2⤵
  PID:12556
- C:\Windows\System\LgkAIYF.exe
  C:\Windows\System\LgkAIYF.exe
  2⤵
  PID:12588
- C:\Windows\System\rPJdehF.exe
  C:\Windows\System\rPJdehF.exe
  2⤵
  PID:12640
- C:\Windows\System\RStBQFg.exe
  C:\Windows\System\RStBQFg.exe
  2⤵
  PID:12668
- C:\Windows\System\ysGqofr.exe
  C:\Windows\System\ysGqofr.exe
  2⤵
  PID:12692
- C:\Windows\System\zjgcAuN.exe
  C:\Windows\System\zjgcAuN.exe
  2⤵
  PID:12708
- C:\Windows\System\vaaXtlZ.exe
  C:\Windows\System\vaaXtlZ.exe
  2⤵
  PID:12732
- C:\Windows\System\jYAkcne.exe
  C:\Windows\System\jYAkcne.exe
  2⤵
  PID:12748
- C:\Windows\System\EtDJvWN.exe
  C:\Windows\System\EtDJvWN.exe
  2⤵
  PID:12764
- C:\Windows\System\hEDEhkQ.exe
  C:\Windows\System\hEDEhkQ.exe
  2⤵
  PID:12784
- C:\Windows\System\dwkIJXT.exe
  C:\Windows\System\dwkIJXT.exe
  2⤵
  PID:12800
- C:\Windows\System\ZmYkREn.exe
  C:\Windows\System\ZmYkREn.exe
  2⤵
  PID:12824
- C:\Windows\System\nvxbjjX.exe
  C:\Windows\System\nvxbjjX.exe
  2⤵
  PID:12872
- C:\Windows\System\yhbEUOc.exe
  C:\Windows\System\yhbEUOc.exe
  2⤵
  PID:12920
- C:\Windows\System\BacfWao.exe
  C:\Windows\System\BacfWao.exe
  2⤵
  PID:12940
- C:\Windows\System\MiKxEBz.exe
  C:\Windows\System\MiKxEBz.exe
  2⤵
  PID:13000
- C:\Windows\System\HMapxcJ.exe
  C:\Windows\System\HMapxcJ.exe
  2⤵
  PID:13020
- C:\Windows\System\dLxMSvb.exe
  C:\Windows\System\dLxMSvb.exe
  2⤵
  PID:13044
- C:\Windows\System\tinbfGs.exe
  C:\Windows\System\tinbfGs.exe
  2⤵
  PID:13076
- C:\Windows\System\TtcLNII.exe
  C:\Windows\System\TtcLNII.exe
  2⤵
  PID:13116
- C:\Windows\System\MtMyiVq.exe
  C:\Windows\System\MtMyiVq.exe
  2⤵
  PID:13136
- C:\Windows\System\MYyyYJh.exe
  C:\Windows\System\MYyyYJh.exe
  2⤵
  PID:13156
- C:\Windows\System\ERnpdGU.exe
  C:\Windows\System\ERnpdGU.exe
  2⤵
  PID:13176
- C:\Windows\System\xUPZMIY.exe
  C:\Windows\System\xUPZMIY.exe
  2⤵
  PID:13200
- C:\Windows\System\WuNFfJm.exe
  C:\Windows\System\WuNFfJm.exe
  2⤵
  PID:13228
- C:\Windows\System\vCHUabU.exe
  C:\Windows\System\vCHUabU.exe
  2⤵
  PID:13276
- C:\Windows\System\atHMoAg.exe
  C:\Windows\System\atHMoAg.exe
  2⤵
  PID:13292
- C:\Windows\System\mQnVIqZ.exe
  C:\Windows\System\mQnVIqZ.exe
  2⤵
  PID:2092
- C:\Windows\System\lOyTFot.exe
  C:\Windows\System\lOyTFot.exe
  2⤵
  PID:2748
- C:\Windows\System\ZiOdPcw.exe
  C:\Windows\System\ZiOdPcw.exe
  2⤵
  PID:12220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4k3j32wp.dt5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DSEJBzn.exe

Filesize
1.4MB

MD5
3e80d66ad13eef6e1d7f269fb16bd700

SHA1
b14cadf44e0601a08c294d6ce8a025ee7c61ebb0

SHA256
e4eaa29285a73b3b5e4fcc12e8e74c8a30f1b4a29efbdd52e54006803ac5fef4

SHA512
d1286aeaab502e735f337af2acbe3bcd20edcbc70ba2af4490979ece37f454d14dc794f3b8a01d74532b186e039efa549b55febaf520d2346a26ade03ac776c1

Download Submit
C:\Windows\System\FBnRZBD.exe

Filesize
1.4MB

MD5
3c802852a5a6a21236d96c32d97d4327

SHA1
980f62646bd8c7d4db2ea891bbd6a803ed27c702

SHA256
0d24e315652e89ced6ff2a711f518e59f41022611914396bb06264c5411b37a0

SHA512
8d7d7bb3776c48dab77364b15c0fe0360eaa9a1140968d212ab1bac16d163ec627810db28e818fe9efe171a0a532507c8d0c9aa4b697078cf0eee0b6f5308ac7

Download Submit
C:\Windows\System\FWSWPmL.exe

Filesize
1.4MB

MD5
d384405952aeb743ae7dcf341db05605

SHA1
9c9a1b5c6eca8fc4b54ecd145535e1475296290c

SHA256
9846ce69c0813f33ba2adec300e1ff24a325f51bac8e07c1be626aeb7a4dd603

SHA512
c1f866677faf864a9aefb2df4e265ed9598c7e600419c1958b55008682f9e49275d714391e761e9f7262ddb036f00c4d0dbf98d3bc34ce0370a4cdd603ab1173

Download Submit
C:\Windows\System\GuhQEdG.exe

Filesize
1.4MB

MD5
9ec5c4b8cf298269c998c7098cb9ef50

SHA1
8a7bc2e2cd3fb3d22850453948afcca81eb02941

SHA256
9510e59509777535eaa6a9e51cc5d3ac3a7ea5fa12c3c65804a8a5208c67561f

SHA512
b4d8e8c31b76bcc209eff609bd02febf972fa5afd19e4f7f42922bb81e1d9859ad0a654ed11540a1f21bdc57d7832b421d1360c1bbb644c690fc832afed663ec

Download Submit
C:\Windows\System\GwHdtWT.exe

Filesize
1.4MB

MD5
49b46d829a3a6a9b3f9a5c6a22e3c68a

SHA1
2dfed1d025b8bf359e55d3d8a519c4eecc7b1fce

SHA256
42838fcc81a05c82fa0135b0990803d764c92375d66a7cd4be033b8d7f9a0375

SHA512
3f9a3274d70873cb63d5b0a349eed135feabe5c90e15ac20050ca02360e7aefa5cd7ebe467dc4e0e476f047f094e92d2ebe27da3215d4fa1f770c61572b75ffb

Download Submit
C:\Windows\System\IJQLXqR.exe

Filesize
1.4MB

MD5
ff2032743deb76dd7a6f5fd7397a402e

SHA1
b865356d1488916e14f52b34dc4645ecda4dc381

SHA256
82435e8943cfdf532b12bdb1f8a5040644ca7dcd7800efe45280a832acdf77c4

SHA512
3f2ef3baf7921bed9e3a44866d1e46e58dd938206a2f24b6e540ac733b58c7131f2b337ada0d3ce64e484a16f97ba20b1fc505c7aaced0da0bf2f10582f9984e

Download Submit
C:\Windows\System\InjkPQY.exe

Filesize
1.2MB

MD5
98199d367a8bc8eaccf3aa80e73e69d5

SHA1
90d7b87c1a2bd5ba7827cd8897e0f42c7b97b5f6

SHA256
8142d4854c544b96c1202978d1714caeec26bd1255bd39e24eac15ebef3cb77a

SHA512
087fcbd093773b3a5cd2a7a0e18d7d3bc58f86e5cb97ee477d62cf55695c3bdeada23d7613b1c4325932374fa1efbbebbb034b5c98bec53a15c460319ce9e9dd

Download Submit
C:\Windows\System\InjkPQY.exe

Filesize
1.4MB

MD5
371c8e1e9b5b9cf0d93a41a5a4a2727c

SHA1
ef0ae20f1e32a309e9cb8e0ea6eb1845b6285645

SHA256
67218098dbf6f4c1591111dcb17b303f45c548041ec93b42edeede9ba80288b7

SHA512
d63d8b7844f6d851dd31c404946e7c03c3d1c03df7f37d2c30580522a467b86a4445b69382e198d417570754065c137d0cb4299c49abe8500f830094ed8c962e

Download Submit
C:\Windows\System\KwCSfRL.exe

Filesize
1.4MB

MD5
42d37011a51aaf8e83b4934baa923093

SHA1
9f74205f235f2e727d1327fb4c5ee71707abbb44

SHA256
ea8422d358df6e1e903e427bac06d33f76a3d5635e8452b641c47055fa2bcb8a

SHA512
fbf4fa0d8f5e53dfa2a2d38f235c59ceb46b8cc45e61b115404c4a825f6c35e2e406893ee81eab0f22e229b041b53aa18017d3dad9aad87af8de5e83122e1126

Download Submit
C:\Windows\System\LgTMkuR.exe

Filesize
1.4MB

MD5
e78d3c97c62454040578df6fd758831d

SHA1
1498ff9bf1fe08ee2ca4929c09d0ff558c51c8e7

SHA256
d4522ce7ca31fa1e92f501ee4f34a4bae515d39e5f79b443129486da800c3b38

SHA512
214dda4b472fc09ab789ad8c26cdeba4394c93094c4f6dbb1a50134ae916f57cf5716a8c194b7688c685b3bb405c8ad6e88835e648adc74b8452856d8036a323

Download Submit
C:\Windows\System\MakCxHS.exe

Filesize
1.4MB

MD5
25d932a4e5409ff52442c492ed2fdb29

SHA1
1f1e0547e19e32909343e1b2f9d4895e5a3433fd

SHA256
bb79a56af56ef26385c27f12878d3a87698e0c31165e660270932c7b31381163

SHA512
2674631980c1e9735f9f95011208e6c2ae9cfd9c2bd213498468881d3577afb8488f7ef8d8d89f11cbefe62ea418606caf1a7bdd0c0d03fd3957fd6e46d08da0

Download Submit
C:\Windows\System\ObjROGk.exe

Filesize
1.4MB

MD5
6f5f5bc36da2b2eb1de7de5102cf5c64

SHA1
3ef8c0b6118f781ae149b60e539850fb91757f4e

SHA256
e62f53faca233c01b27302928f3011b66ba1539b5545dcb1fde0199a33fbd6bc

SHA512
8fcbd7890849ec03c53011dc29a1b89a05a8ff4c45b004415a3daf3d1c5c9f5fa0a1d52c8f07738edbe00da4efcddfaceca913b93cf6e5df2fbc7dc1ce1600f4

Download Submit
C:\Windows\System\OwYmRla.exe

Filesize
1.4MB

MD5
4fa45cd9643c874d22a4b24aa671afc7

SHA1
e8b0a005522205a37608b46ed0e5e89fa6c773a4

SHA256
21bbea7e83879a29a758e5319595170f752d1fbd5c3285ec7a3450fb5a53cbe5

SHA512
b5637a61fdf7b2bd52e7ba87bf1e68042bebddfb51e76d06a4be1c617297b4d24c8fe90437c95bfe3a38cfd3d7f5b571c4a749492e1cda6123e807da4dd9007e

Download Submit
C:\Windows\System\PmUuruk.exe

Filesize
1.4MB

MD5
d3f4fc91296ea731689663c4440fc897

SHA1
21101302c4bfebb0310adb0b287d8961a2ebb93f

SHA256
9655c98e0bfaf5bc94bc0c004998f9e32b456db5c93381dd190c89124557b75f

SHA512
708192bce2a92900b70e5c604c219bceb9f7d63105f16877173b5165c8d3b7936b22289bc8b9d45fc29c7c5dac298052b8397e6711d255540d76abcfcb85528f

Download Submit
C:\Windows\System\QecRchZ.exe

Filesize
1.4MB

MD5
a6b7bffd50c405047ae65cebc955a662

SHA1
6d7a4c4c2b7a0b0ad0f7254e3573a040dffd44b2

SHA256
9ddb4c73c69bd6a6fce2282c5b0f35d7143f19c72b535cc9af94c209c5bc2f41

SHA512
a01bd8fad667cc17108bddd94788e8b5c74803d48f551eb70d1039c69bca3b581c0847fbb18c91dccbac44698c9c582f95a4df9e51747e9ffd946a68ced138cd

Download Submit
C:\Windows\System\QjFKkXh.exe

Filesize
1.4MB

MD5
4cd9ae3506d083fbe71d8bdf542c6b17

SHA1
d64c44c3e82cb4dcb3595159b9cafe2debe2d6b5

SHA256
45e26ee5f3620c48fdcab924d7d1aab35c16818be09a0e78c58ce9fb20abbe2b

SHA512
e9e066b217df1782be991d2683b253ad8be1be53230fca361ee9aaa969022b0885eccf977c7dadfbf3431c450a4ebaf2080e5c7190f505fb4c81a7e985f7601b

Download Submit
C:\Windows\System\QoRzyOJ.exe

Filesize
1.4MB

MD5
8321203a2e4a030fe86ecc9965805552

SHA1
9b2bbf02cc20abed41f640bdd7545e9c55618f65

SHA256
860cecc0d8c39a87c3db14149878791ad21e3e8044f6d83425d65a74638e605c

SHA512
e55312a85febb9083b2b77c1fbfb23eb3675d3778966b63c68feb99f33b559925e03e68ba1d71020c90fcff01bb73d5a185f8e25c8ec27a289e582e3734f87a3

Download Submit
C:\Windows\System\VBqUZjC.exe

Filesize
1.4MB

MD5
68bf7be7d3c6658f116ddd409c508a8c

SHA1
06bffba55c3a20bd9eab99eede966ce82b3156e2

SHA256
260619397d99c82e3011e0e9f1dbaa96237b52497ba85e95263bb7c52b89a85a

SHA512
932e7458844c4a15132ec30efc0a10fdb36ae5a0a75cf0b6d8295c76b4f289cd19fb46344df4bce888d3d89145c70c1eb999c61c7c694586395dd29784ff9417

Download Submit
C:\Windows\System\VFXXQGc.exe

Filesize
1.4MB

MD5
0fff277865211448885f7e5e99816127

SHA1
eb909bc57f60324e70ab6609928434206fca2a8e

SHA256
466f71045f89e9611ff1577e124470cdec33f0de6ccba534f9983385c8134b2f

SHA512
38ca696fc56953a90d3beeaee8604487183ff07c0e60884b6263254a91fe41775c0e2fc9c72098834b6d9f71c293732b73c91a14b700d5c73a99cfc71536065f

Download Submit
C:\Windows\System\XqphSpn.exe

Filesize
1.4MB

MD5
e6ca9d8f722f10773bcb88acb3186c11

SHA1
b0943e19152e57dcf5dff3a6e1e826867b79b9f9

SHA256
7cd794d05900a58334a348b9ce73bc613233a97c5cc0896244d4367b56beb850

SHA512
e1e4d35d336867172ae6db46063ddab1f1bf7c330cbd2ae3977c937a6d518d630a1e160ebbfa5dd458858baa55609df3f96266090f3ed5142b568570793051c2

Download Submit
C:\Windows\System\Zkvsnte.exe

Filesize
1.4MB

MD5
bb102f2fed00abd3b4d7ad77041bbbcc

SHA1
be51dcef1d1cd0520243336a8d567b14d9365857

SHA256
88bb81023a85115c9923504d25db95f2a3d73799bf3209580e906a100629a3e7

SHA512
5a514df5fdfdb4e360302a187fe89313ceffe6d874db7672f1a2703fa6b61740c3fe8a1d3b6d4348df6b8ffbffdca66a5a158a9c7a1bd365744ebb5695aca430

Download Submit
C:\Windows\System\aSOVVqR.exe

Filesize
1.2MB

MD5
20c3143324d6cd0b53984d3e2ab879c2

SHA1
0721d6fff84e15bad83c385302867d61e5ae20be

SHA256
1c223c5bff0b5fbbbdc2590baa6c5668234dc8c09f9cacf6a2d9b3900963e9f3

SHA512
054facb2dd2843d657477715b9da3f764343162ce777edb6d7df6378fcb27e00d88a6ec75b76806549c79345447ca944a7f4079dc398e39287e519a7066eef1d

Download Submit
C:\Windows\System\aSOVVqR.exe

Filesize
1.4MB

MD5
3f95eb19c72b2aec47b5e7593ec2e1ff

SHA1
a794a9cb7e3882d585837e20fca62d96df70ea44

SHA256
323b8b364948fd20a5bd871664e3f06d3959ea977162cbcf66c8a61c51bbe400

SHA512
44ae4e8f84002950d1f8db97c8baecccb436912941760f9b265ddc1011e39257770905290ff1b572a02dea55dbaef3f293d273913b20eaa917f4f6042441dc44

Download Submit
C:\Windows\System\bLAaXGX.exe

Filesize
1.4MB

MD5
9150b1a5a065204b4bac264cc19e2d66

SHA1
661e83021b59da572002255be6b23b17433da31e

SHA256
f87572c5211ca023c27a8b456bba2328c9b9ea3067b29a9aea6768f621cf373d

SHA512
e3d8e4772bad18e50cff35e5e4dcbc14b3aaaac1e3ebd652c88ab5e3385014fb91f40e7dd2f1eb44ca4f7f08a773b4aff9c8fa5330f37cffeeb1d071faf8d4f4

Download Submit
C:\Windows\System\bNNTeZQ.exe

Filesize
1.4MB

MD5
6a290d5ec052ad4654ca8bcf40439159

SHA1
fff718666fe5fec14bba6f4e97f4898662e07c21

SHA256
2df700e27d08a91d0135c8152f963cc6ea67428f1e3ea2e2b6dcd7c8f27186ba

SHA512
e705fa17d2fd09b2c082b81b9ac94d7821d592cdd752220c14703fcd2d1aadf882352a9acba74828f7182df31f25d59da7b5b69829ed73233caa73aaa2fe8428

Download Submit
C:\Windows\System\gOnCJZK.exe

Filesize
1.4MB

MD5
94b04504d3f25b2eed33b8bf1a424598

SHA1
6de02b28c9473f89bb1afa2e48bb063b47afbaf8

SHA256
367fe2e2e8b7c06008f0e9d5f761d0ad16f2f620797f95810e8c230b83449853

SHA512
7b50aa1f0475825938caf546e7ce35141f4079eaf389f2ff1e2bd7470b557d48175d6a51c0292d0b2de918d06f8be763ce5eb67ebb04b61ecf7360d8b1782c1f

Download Submit
C:\Windows\System\iVfpIJp.exe

Filesize
1.4MB

MD5
54f0f16012075e719297de1759cf6e40

SHA1
474b9c89e8b591e6579b13026e6f2650b3d9b135

SHA256
249db2fca720165425b5a51cf4d83419ebf75d602a9746b43002167874974c34

SHA512
fb0d233a524cf62f433c829f6989880fc932d53db297dd21f67abab754c1a5cea7801dc4888cc5f33e5f74149987f95b24683f6202b45ef21d1731efe5567efc

Download Submit
C:\Windows\System\lhRdEfW.exe

Filesize
1.4MB

MD5
1bfd1ed6bd1281a38b5a386a012a8f4c

SHA1
a7cdb9729a9915148f67c51ab44bc52965771025

SHA256
01fda000640f5ee8b8fa665393c44f60292cd2b974e5934c7ba65091831dea5c

SHA512
8a83464bc125564ce89cbe779a683dc3b2bf7d43140047c7bb258ff94abe2b5d8fbf8e85a69400a945c195ee1abc8d47a57f6d3b72533997c94bab4f0a348aa4

Download Submit
C:\Windows\System\oPQQIwx.exe

Filesize
1.4MB

MD5
7cc98ad230ab9855e2faf3bef5a0efe8

SHA1
f8ca46445a2cc63467af41002f3835b996fc151d

SHA256
de152ae53bd9a2cf0500456a539483ac1adf270b7a4b39c33f658e6270bba96b

SHA512
b5559ce073c955c45b25dc89fc1eeef86e54e5cbe6ef3b969f1a995add911105faaead5d5313c62d7d1675900a3f2a1b15abd4bede8862d12f9bde53e92e342a

Download Submit
C:\Windows\System\ogRrqtY.exe

Filesize
1.4MB

MD5
03bdad4b7665465808bfb9763e71806c

SHA1
4ed07efaccb7317ff0096b55c791076d2184265c

SHA256
df6e7530f5cb4c6cbc126db3d55e90b0fff9b5059a8f58f0c916358fec0c8015

SHA512
25a771f9f3dd370d12dd37b4337a4a7da52c86a40004db43f83ede83e29e75aa86b2cde420726c6ef6a378fe5efaa85711585273b6078981a38a1713ef20c87f

Download Submit
C:\Windows\System\uOwtpiH.exe

Filesize
1.4MB

MD5
3f31830ea4737ab341c84d7b284a7afd

SHA1
8935ed80fbf0e61de73c1e80637c7ce647e81234

SHA256
fefab12bd0ae1b716da883e43c0fea161536f605d0b02ce9195529ba8c7fe017

SHA512
5a9ece4b350adc04d426cfe3b6809d8a2864a5c06f3533527d8f213b863a80123a1d4baf3ef66d495affb1babb92221c95e0d29a2989df86301e361100525a94

Download Submit
C:\Windows\System\wYqGHGx.exe

Filesize
1.4MB

MD5
2727548ac463418c5e42c89a8b160880

SHA1
fdf70d73228417c4d76cb54d7353c58cfa4c9e43

SHA256
533917d9ffcee464ba462ecb8f4eb41afbeceb2e0ced35b9651ef51c11f2678d

SHA512
9a8876c909bb3105ab278a7bfe62f29dc5f093fad7a641a806b4726236f77b46f8997635f8fb5795078432ea2657973cc1bac640e3c7bce0355fa8754ce341ba

Download Submit
C:\Windows\System\yGFMvbA.exe

Filesize
1.4MB

MD5
2c42836f9bf053807e811f4b38227679

SHA1
71f2582c2fc6088add1ca7d985e926c7c739f97d

SHA256
43e50d53bca2c6fa1eaa87854ce32ff46998a769f18ced6239436f1b5fa4a8f7

SHA512
e4b16e6ed25b5eb0a283128b38810197dae410f719f6b7b0221944b0a343e19bb4db9d15a5a914f3430dae173288f875707f8b339347ea67543750f127e87055

Download Submit
C:\Windows\System\zKTwOtq.exe

Filesize
1.4MB

MD5
7c851d6fcf3bc15f4019b5b21f518f50

SHA1
bed84e0308519061d3778ad7e3a8f8052f1bdf2f

SHA256
3d32793b4a96aca69fdfac67ff1920dc0549f7d1fa196d89e8702353a95f3488

SHA512
1b2751ca0ab5fda05e75e561623ac41034793dab3fcf720ba3ec3b7a4d368beb459ea3740dd9b2bf5512d43cd9d112e0e6a48f94cf499b17f44f1d0edeeca1cb

Download Submit
memory/428-2058-0x00007FF78AED0000-0x00007FF78B2C2000-memory.dmp

Filesize
3.9MB

Download
memory/428-155-0x00007FF78AED0000-0x00007FF78B2C2000-memory.dmp

Filesize
3.9MB

Download
memory/628-128-0x00007FF7B9EB0000-0x00007FF7BA2A2000-memory.dmp

Filesize
3.9MB

Download
memory/628-2040-0x00007FF7B9EB0000-0x00007FF7BA2A2000-memory.dmp

Filesize
3.9MB

Download
memory/760-2044-0x00007FF76BCB0000-0x00007FF76C0A2000-memory.dmp

Filesize
3.9MB

Download
memory/760-211-0x00007FF76BCB0000-0x00007FF76C0A2000-memory.dmp

Filesize
3.9MB

Download
memory/928-0-0x00007FF6AACC0000-0x00007FF6AB0B2000-memory.dmp

Filesize
3.9MB

Download
memory/928-1-0x00000243B85E0000-0x00000243B85F0000-memory.dmp

Filesize
64KB

Download
memory/996-198-0x00007FF6FE530000-0x00007FF6FE922000-memory.dmp

Filesize
3.9MB

Download
memory/996-2024-0x00007FF6FE530000-0x00007FF6FE922000-memory.dmp

Filesize
3.9MB

Download
memory/1512-115-0x00007FF605FB0000-0x00007FF6063A2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-2042-0x00007FF605FB0000-0x00007FF6063A2000-memory.dmp

Filesize
3.9MB

Download
memory/1864-221-0x00007FF7CEF50000-0x00007FF7CF342000-memory.dmp

Filesize
3.9MB

Download
memory/1864-2062-0x00007FF7CEF50000-0x00007FF7CF342000-memory.dmp

Filesize
3.9MB

Download
memory/1984-243-0x00007FF7E5DC0000-0x00007FF7E61B2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-2073-0x00007FF7E5DC0000-0x00007FF7E61B2000-memory.dmp

Filesize
3.9MB

Download
memory/2096-2038-0x00007FF6EF5C0000-0x00007FF6EF9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2096-103-0x00007FF6EF5C0000-0x00007FF6EF9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-2026-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp

Filesize
3.9MB

Download
memory/2116-1989-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp

Filesize
3.9MB

Download
memory/2116-6-0x00007FF6B4090000-0x00007FF6B4482000-memory.dmp

Filesize
3.9MB

Download
memory/2708-7-0x00007FFD7B753000-0x00007FFD7B755000-memory.dmp

Filesize
8KB

Download
memory/2708-70-0x00000182F3650000-0x00000182F3672000-memory.dmp

Filesize
136KB

Download
memory/2708-193-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Filesize
10.8MB

Download
memory/2708-52-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Filesize
10.8MB

Download
memory/2708-2000-0x00007FFD7B750000-0x00007FFD7C211000-memory.dmp

Filesize
10.8MB

Download
memory/2708-257-0x00000182F4E00000-0x00000182F55A6000-memory.dmp

Filesize
7.6MB

Download
memory/2832-2034-0x00007FF7D6000000-0x00007FF7D63F2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-199-0x00007FF7D6000000-0x00007FF7D63F2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-139-0x00007FF6CD2A0000-0x00007FF6CD692000-memory.dmp

Filesize
3.9MB

Download
memory/3060-2051-0x00007FF6CD2A0000-0x00007FF6CD692000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2032-0x00007FF728F90000-0x00007FF729382000-memory.dmp

Filesize
3.9MB

Download
memory/3116-76-0x00007FF728F90000-0x00007FF729382000-memory.dmp

Filesize
3.9MB

Download
memory/3192-2046-0x00007FF75F2B0000-0x00007FF75F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-201-0x00007FF75F2B0000-0x00007FF75F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-63-0x00007FF725FF0000-0x00007FF7263E2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-2030-0x00007FF725FF0000-0x00007FF7263E2000-memory.dmp

Filesize
3.9MB

Download
memory/3740-2028-0x00007FF60EA50000-0x00007FF60EE42000-memory.dmp

Filesize
3.9MB

Download
memory/3740-56-0x00007FF60EA50000-0x00007FF60EE42000-memory.dmp

Filesize
3.9MB

Download
memory/3744-143-0x00007FF7EC5C0000-0x00007FF7EC9B2000-memory.dmp

Filesize
3.9MB

Download
memory/3744-2056-0x00007FF7EC5C0000-0x00007FF7EC9B2000-memory.dmp

Filesize
3.9MB

Download
memory/3792-2052-0x00007FF6CB9C0000-0x00007FF6CBDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3792-214-0x00007FF6CB9C0000-0x00007FF6CBDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-93-0x00007FF735610000-0x00007FF735A02000-memory.dmp

Filesize
3.9MB

Download
memory/3900-2036-0x00007FF735610000-0x00007FF735A02000-memory.dmp

Filesize
3.9MB

Download
memory/3996-2054-0x00007FF72FD10000-0x00007FF730102000-memory.dmp

Filesize
3.9MB

Download
memory/3996-127-0x00007FF72FD10000-0x00007FF730102000-memory.dmp

Filesize
3.9MB

Download
memory/4044-178-0x00007FF6A3D20000-0x00007FF6A4112000-memory.dmp

Filesize
3.9MB

Download
memory/4044-2066-0x00007FF6A3D20000-0x00007FF6A4112000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2060-0x00007FF686970000-0x00007FF686D62000-memory.dmp

Filesize
3.9MB

Download
memory/4528-217-0x00007FF686970000-0x00007FF686D62000-memory.dmp

Filesize
3.9MB

Download
memory/4632-2070-0x00007FF6C29D0000-0x00007FF6C2DC2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-222-0x00007FF6C29D0000-0x00007FF6C2DC2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2064-0x00007FF632F80000-0x00007FF633372000-memory.dmp

Filesize
3.9MB

Download
memory/5016-174-0x00007FF632F80000-0x00007FF633372000-memory.dmp

Filesize
3.9MB

Download
memory/5024-160-0x00007FF716B80000-0x00007FF716F72000-memory.dmp

Filesize
3.9MB

Download
memory/5024-2048-0x00007FF716B80000-0x00007FF716F72000-memory.dmp

Filesize
3.9MB

Download