xmrig | cbadab8bf269b316f2f5d608829ad2d41fed41e952c770853e6e2d24203dafd8

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
Size

1.5MB
MD5

daa173d32ac3a438da8c8b1ff3d77fe0
SHA1

48c40d9c8e845b974523ea869631adee4496c42e
SHA256

cbadab8bf269b316f2f5d608829ad2d41fed41e952c770853e6e2d24203dafd8
SHA512

de7f54618f83070d12aba031c4a5e445005d1657b1f6f61455d4e13f02b347cc54824ae116d23fcd3661c32032f7d1205e93b833ab7c990f109d7c8a377f4025
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5eSh0eKITNEZ:Lz071uv4BPMkyW10/wKV7hjSeShTw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2728-65-0x00007FF7415A0000-0x00007FF741992000-memory.dmp	xmrig
behavioral2/memory/2376-82-0x00007FF7FCBE0000-0x00007FF7FCFD2000-memory.dmp	xmrig
behavioral2/memory/1328-94-0x00007FF7C75B0000-0x00007FF7C79A2000-memory.dmp	xmrig
behavioral2/memory/3448-96-0x00007FF67EE90000-0x00007FF67F282000-memory.dmp	xmrig
behavioral2/memory/1960-100-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp	xmrig
behavioral2/memory/2380-128-0x00007FF7BE090000-0x00007FF7BE482000-memory.dmp	xmrig
behavioral2/memory/3716-148-0x00007FF7628D0000-0x00007FF762CC2000-memory.dmp	xmrig
behavioral2/memory/4788-152-0x00007FF73CB90000-0x00007FF73CF82000-memory.dmp	xmrig
behavioral2/memory/1492-165-0x00007FF61B360000-0x00007FF61B752000-memory.dmp	xmrig
behavioral2/memory/3532-110-0x00007FF7F8BC0000-0x00007FF7F8FB2000-memory.dmp	xmrig
behavioral2/memory/2592-107-0x00007FF608F50000-0x00007FF609342000-memory.dmp	xmrig
behavioral2/memory/4512-172-0x00007FF7C8470000-0x00007FF7C8862000-memory.dmp	xmrig
behavioral2/memory/2184-1504-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp	xmrig
behavioral2/memory/3992-721-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	xmrig
behavioral2/memory/2356-105-0x00007FF69EB00000-0x00007FF69EEF2000-memory.dmp	xmrig
behavioral2/memory/1964-104-0x00007FF6D0620000-0x00007FF6D0A12000-memory.dmp	xmrig
behavioral2/memory/972-95-0x00007FF65C0C0000-0x00007FF65C4B2000-memory.dmp	xmrig
behavioral2/memory/3992-86-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	xmrig
behavioral2/memory/4816-78-0x00007FF7CCA70000-0x00007FF7CCE62000-memory.dmp	xmrig
behavioral2/memory/2612-77-0x00007FF694B40000-0x00007FF694F32000-memory.dmp	xmrig
behavioral2/memory/2288-53-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp	xmrig
behavioral2/memory/4972-2379-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp	xmrig
behavioral2/memory/3396-2380-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp	xmrig
behavioral2/memory/3528-2381-0x00007FF6B4A20000-0x00007FF6B4E12000-memory.dmp	xmrig
behavioral2/memory/4792-2406-0x00007FF6CA3F0000-0x00007FF6CA7E2000-memory.dmp	xmrig
behavioral2/memory/1328-2441-0x00007FF7C75B0000-0x00007FF7C79A2000-memory.dmp	xmrig
behavioral2/memory/1492-2443-0x00007FF61B360000-0x00007FF61B752000-memory.dmp	xmrig
behavioral2/memory/2288-2446-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp	xmrig
behavioral2/memory/972-2447-0x00007FF65C0C0000-0x00007FF65C4B2000-memory.dmp	xmrig
behavioral2/memory/2612-2451-0x00007FF694B40000-0x00007FF694F32000-memory.dmp	xmrig
behavioral2/memory/2728-2450-0x00007FF7415A0000-0x00007FF741992000-memory.dmp	xmrig
behavioral2/memory/4816-2456-0x00007FF7CCA70000-0x00007FF7CCE62000-memory.dmp	xmrig
behavioral2/memory/3448-2454-0x00007FF67EE90000-0x00007FF67F282000-memory.dmp	xmrig
behavioral2/memory/2376-2459-0x00007FF7FCBE0000-0x00007FF7FCFD2000-memory.dmp	xmrig
behavioral2/memory/1960-2457-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp	xmrig
behavioral2/memory/1964-2464-0x00007FF6D0620000-0x00007FF6D0A12000-memory.dmp	xmrig
behavioral2/memory/3992-2465-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	xmrig
behavioral2/memory/2356-2462-0x00007FF69EB00000-0x00007FF69EEF2000-memory.dmp	xmrig
behavioral2/memory/3532-2468-0x00007FF7F8BC0000-0x00007FF7F8FB2000-memory.dmp	xmrig
behavioral2/memory/2592-2469-0x00007FF608F50000-0x00007FF609342000-memory.dmp	xmrig
behavioral2/memory/4980-2471-0x00007FF6FDA20000-0x00007FF6FDE12000-memory.dmp	xmrig
behavioral2/memory/2184-2473-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp	xmrig
behavioral2/memory/2380-2475-0x00007FF7BE090000-0x00007FF7BE482000-memory.dmp	xmrig
behavioral2/memory/4972-2477-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp	xmrig
behavioral2/memory/3716-2481-0x00007FF7628D0000-0x00007FF762CC2000-memory.dmp	xmrig
behavioral2/memory/3528-2479-0x00007FF6B4A20000-0x00007FF6B4E12000-memory.dmp	xmrig
behavioral2/memory/3396-2483-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp	xmrig
behavioral2/memory/4792-2485-0x00007FF6CA3F0000-0x00007FF6CA7E2000-memory.dmp	xmrig
behavioral2/memory/4512-2513-0x00007FF7C8470000-0x00007FF7C8862000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	1244	powershell.exe
12	1244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1492	lKFhkkD.exe
1328	PDcHpqY.exe
972	OUVddGO.exe
2288	PyCEsNj.exe
2728	PUEpVWW.exe
2612	QUtJXQE.exe
4816	THyMFvh.exe
3448	MRPNuLI.exe
1960	psipLWy.exe
2376	qbpHvBi.exe
3992	fAQAqUn.exe
1964	VsqqWIm.exe
2356	WFnAThX.exe
3532	XVIHrUK.exe
2592	VXaguTO.exe
2184	pOhLOYP.exe
4980	LjHqGBe.exe
2380	accqFDt.exe
4972	vPvtTjC.exe
3396	AORpqNT.exe
3528	bbkfqTI.exe
3716	lonjeGa.exe
4792	yWMiAsm.exe
4512	ITZdnNc.exe
3200	vVXvoGw.exe
4016	cXoMihW.exe
1468	aROVMIu.exe
5092	rKbhilR.exe
2420	qmSEfJK.exe
2300	nuGRTqA.exe
4040	rOixfzr.exe
4548	fBuYrgN.exe
1224	jfiUdJQ.exe
1308	nUzHctw.exe
4252	YpnRUrU.exe
4892	KFdLEHk.exe
4360	EKmlDlL.exe
1464	khqIiqP.exe
3320	hoCKbQP.exe
2944	VxZsjNt.exe
4576	AktOfEA.exe
2536	RVxAhFU.exe
1436	zvCfXmF.exe
4256	MABudbS.exe
3888	NmxCgDE.exe
2212	BpJAKRQ.exe
3328	BFOmErC.exe
4580	doriKDh.exe
2760	HvrDdMU.exe
1912	wTAuiEJ.exe
4028	MfkyNvV.exe
60	WhwQdeW.exe
4544	frmOsKe.exe
2448	PkMoHFm.exe
4060	IuyeWwz.exe
2372	zlocmnV.exe
2460	cmyIeoE.exe
824	gVhKQyU.exe
3416	ROtTSVt.exe
4872	IuqOopK.exe
1792	syFkSxf.exe
4316	JqxImaW.exe
4964	FzFwPeq.exe
2076	PdrvvRF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4788-0-0x00007FF73CB90000-0x00007FF73CF82000-memory.dmp	upx
behavioral2/files/0x0008000000023413-5.dat	upx
behavioral2/files/0x0007000000023419-19.dat	upx
behavioral2/files/0x000700000002341a-24.dat	upx
behavioral2/files/0x000700000002341c-41.dat	upx
behavioral2/files/0x000700000002341d-51.dat	upx
behavioral2/files/0x0007000000023420-59.dat	upx
behavioral2/memory/2728-65-0x00007FF7415A0000-0x00007FF741992000-memory.dmp	upx
behavioral2/files/0x0007000000023421-68.dat	upx
behavioral2/files/0x000800000002341e-79.dat	upx
behavioral2/memory/2376-82-0x00007FF7FCBE0000-0x00007FF7FCFD2000-memory.dmp	upx
behavioral2/files/0x0007000000023423-89.dat	upx
behavioral2/memory/1328-94-0x00007FF7C75B0000-0x00007FF7C79A2000-memory.dmp	upx
behavioral2/memory/3448-96-0x00007FF67EE90000-0x00007FF67F282000-memory.dmp	upx
behavioral2/memory/1960-100-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp	upx
behavioral2/files/0x0007000000023425-106.dat	upx
behavioral2/memory/2184-115-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp	upx
behavioral2/files/0x0008000000023414-112.dat	upx
behavioral2/memory/2380-128-0x00007FF7BE090000-0x00007FF7BE482000-memory.dmp	upx
behavioral2/files/0x0007000000023427-134.dat	upx
behavioral2/files/0x000700000002342a-139.dat	upx
behavioral2/memory/3716-148-0x00007FF7628D0000-0x00007FF762CC2000-memory.dmp	upx
behavioral2/files/0x000700000002342b-153.dat	upx
behavioral2/memory/4788-152-0x00007FF73CB90000-0x00007FF73CF82000-memory.dmp	upx
behavioral2/memory/4792-151-0x00007FF6CA3F0000-0x00007FF6CA7E2000-memory.dmp	upx
behavioral2/memory/3528-147-0x00007FF6B4A20000-0x00007FF6B4E12000-memory.dmp	upx
behavioral2/files/0x0007000000023429-143.dat	upx
behavioral2/files/0x0007000000023428-149.dat	upx
behavioral2/memory/3396-138-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp	upx
behavioral2/memory/4972-132-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp	upx
behavioral2/memory/4980-123-0x00007FF6FDA20000-0x00007FF6FDE12000-memory.dmp	upx
behavioral2/files/0x0007000000023426-119.dat	upx
behavioral2/memory/1492-165-0x00007FF61B360000-0x00007FF61B752000-memory.dmp	upx
behavioral2/files/0x000700000002342d-164.dat	upx
behavioral2/files/0x000700000002342c-161.dat	upx
behavioral2/memory/3532-110-0x00007FF7F8BC0000-0x00007FF7F8FB2000-memory.dmp	upx
behavioral2/memory/2592-107-0x00007FF608F50000-0x00007FF609342000-memory.dmp	upx
behavioral2/memory/4512-172-0x00007FF7C8470000-0x00007FF7C8862000-memory.dmp	upx
behavioral2/files/0x0007000000023431-190.dat	upx
behavioral2/files/0x0007000000023433-197.dat	upx
behavioral2/files/0x0007000000023435-205.dat	upx
behavioral2/files/0x0007000000023434-202.dat	upx
behavioral2/files/0x0007000000023432-192.dat	upx
behavioral2/files/0x0007000000023430-185.dat	upx
behavioral2/memory/2184-1504-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp	upx
behavioral2/memory/3992-721-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	upx
behavioral2/files/0x000700000002342f-183.dat	upx
behavioral2/files/0x000700000002342e-171.dat	upx
behavioral2/memory/2356-105-0x00007FF69EB00000-0x00007FF69EEF2000-memory.dmp	upx
behavioral2/memory/1964-104-0x00007FF6D0620000-0x00007FF6D0A12000-memory.dmp	upx
behavioral2/memory/972-95-0x00007FF65C0C0000-0x00007FF65C4B2000-memory.dmp	upx
behavioral2/files/0x0007000000023424-98.dat	upx
behavioral2/memory/3992-86-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp	upx
behavioral2/files/0x0007000000023422-84.dat	upx
behavioral2/memory/4816-78-0x00007FF7CCA70000-0x00007FF7CCE62000-memory.dmp	upx
behavioral2/memory/2612-77-0x00007FF694B40000-0x00007FF694F32000-memory.dmp	upx
behavioral2/files/0x000800000002341f-73.dat	upx
behavioral2/files/0x000700000002341b-48.dat	upx
behavioral2/memory/2288-53-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp	upx
behavioral2/files/0x0007000000023418-31.dat	upx
behavioral2/memory/1492-14-0x00007FF61B360000-0x00007FF61B752000-memory.dmp	upx
behavioral2/files/0x0007000000023417-13.dat	upx
behavioral2/memory/4972-2379-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp	upx
behavioral2/memory/3396-2380-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oJfmzsu.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ZrZcKeN.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\rgGGhSN.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\kewtgmn.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\VKrgwLK.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\gzFbTNB.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\arGPUBL.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\VyDDauE.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\lLfxrhZ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ofDcCZf.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\MjUMGxx.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\qofEsDs.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\AaClNBm.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ZiYbzQA.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\HKCOUul.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\loPpBqr.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mTvwDAS.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\HjJquaT.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\qRXwdJX.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\POdrcAY.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\kefcXMK.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mVlorio.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\NNBXrvq.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\skdfOEQ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\dsHGHAA.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\bGyaDAt.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\BpUuxgd.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\BWGSsEd.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\XjwryYc.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\jZQzHJt.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\bTmUKbV.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\pyQuLCG.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vywrgjf.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\wklroPQ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\nURPmzh.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\OcPPOCx.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\zWDjQUW.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\LmGYLgR.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\SoUuTcv.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\XmIWDtm.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\eqbZRtY.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\UoAhQzq.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\uxMXyZL.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\iqJthYP.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\rRvskdM.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\kYBQsUH.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\duzcqWy.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\DnwKBRL.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\bLBKkRt.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ISQXBIS.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\qCZAcUi.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\oKbRgkw.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\uBBVPfX.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vEiyzQv.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\cfyzPaY.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\yKoDQiA.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\RTDnjdy.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mmkXjiG.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\PNyiSMC.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\wWoQifQ.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\Qguyjbv.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\uygdmoy.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\xshIRDs.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
File created	C:\Windows\System\QMAYSCI.exe	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeLockMemoryPrivilege	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1244	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	84
PID 4788 wrote to memory of 1244	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	84
PID 4788 wrote to memory of 1492	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	85
PID 4788 wrote to memory of 1492	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	85
PID 4788 wrote to memory of 1328	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	86
PID 4788 wrote to memory of 1328	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	86
PID 4788 wrote to memory of 972	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	87
PID 4788 wrote to memory of 972	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	87
PID 4788 wrote to memory of 2288	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	88
PID 4788 wrote to memory of 2288	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	88
PID 4788 wrote to memory of 2728	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	89
PID 4788 wrote to memory of 2728	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	89
PID 4788 wrote to memory of 2612	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	90
PID 4788 wrote to memory of 2612	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	90
PID 4788 wrote to memory of 4816	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	91
PID 4788 wrote to memory of 4816	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	91
PID 4788 wrote to memory of 3448	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	92
PID 4788 wrote to memory of 3448	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	92
PID 4788 wrote to memory of 1960	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	93
PID 4788 wrote to memory of 1960	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	93
PID 4788 wrote to memory of 2376	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	94
PID 4788 wrote to memory of 2376	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	94
PID 4788 wrote to memory of 3992	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	95
PID 4788 wrote to memory of 3992	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	95
PID 4788 wrote to memory of 1964	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	96
PID 4788 wrote to memory of 1964	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	96
PID 4788 wrote to memory of 2356	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	97
PID 4788 wrote to memory of 2356	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	97
PID 4788 wrote to memory of 3532	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	98
PID 4788 wrote to memory of 3532	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	98
PID 4788 wrote to memory of 2592	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	99
PID 4788 wrote to memory of 2592	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	99
PID 4788 wrote to memory of 2184	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	100
PID 4788 wrote to memory of 2184	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	100
PID 4788 wrote to memory of 4980	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	101
PID 4788 wrote to memory of 4980	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	101
PID 4788 wrote to memory of 2380	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	102
PID 4788 wrote to memory of 2380	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	102
PID 4788 wrote to memory of 4972	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	103
PID 4788 wrote to memory of 4972	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	103
PID 4788 wrote to memory of 3396	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	104
PID 4788 wrote to memory of 3396	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	104
PID 4788 wrote to memory of 3528	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	105
PID 4788 wrote to memory of 3528	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	105
PID 4788 wrote to memory of 3716	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	106
PID 4788 wrote to memory of 3716	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	106
PID 4788 wrote to memory of 4792	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	107
PID 4788 wrote to memory of 4792	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	107
PID 4788 wrote to memory of 4512	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	108
PID 4788 wrote to memory of 4512	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	108
PID 4788 wrote to memory of 3200	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	109
PID 4788 wrote to memory of 3200	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	109
PID 4788 wrote to memory of 4016	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	110
PID 4788 wrote to memory of 4016	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	110
PID 4788 wrote to memory of 1468	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	111
PID 4788 wrote to memory of 1468	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	111
PID 4788 wrote to memory of 5092	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	112
PID 4788 wrote to memory of 5092	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	112
PID 4788 wrote to memory of 2420	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	113
PID 4788 wrote to memory of 2420	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	113
PID 4788 wrote to memory of 2300	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	114
PID 4788 wrote to memory of 2300	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	114
PID 4788 wrote to memory of 4040	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	115
PID 4788 wrote to memory of 4040	4788	daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\daa173d32ac3a438da8c8b1ff3d77fe0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1244" "2928" "2864" "2932" "0" "0" "2936" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13824
- C:\Windows\System\lKFhkkD.exe
  C:\Windows\System\lKFhkkD.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\PDcHpqY.exe
  C:\Windows\System\PDcHpqY.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\OUVddGO.exe
  C:\Windows\System\OUVddGO.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\PyCEsNj.exe
  C:\Windows\System\PyCEsNj.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\PUEpVWW.exe
  C:\Windows\System\PUEpVWW.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\QUtJXQE.exe
  C:\Windows\System\QUtJXQE.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\THyMFvh.exe
  C:\Windows\System\THyMFvh.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\MRPNuLI.exe
  C:\Windows\System\MRPNuLI.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\psipLWy.exe
  C:\Windows\System\psipLWy.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\qbpHvBi.exe
  C:\Windows\System\qbpHvBi.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\fAQAqUn.exe
  C:\Windows\System\fAQAqUn.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\VsqqWIm.exe
  C:\Windows\System\VsqqWIm.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WFnAThX.exe
  C:\Windows\System\WFnAThX.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\XVIHrUK.exe
  C:\Windows\System\XVIHrUK.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\VXaguTO.exe
  C:\Windows\System\VXaguTO.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\pOhLOYP.exe
  C:\Windows\System\pOhLOYP.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\LjHqGBe.exe
  C:\Windows\System\LjHqGBe.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\accqFDt.exe
  C:\Windows\System\accqFDt.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\vPvtTjC.exe
  C:\Windows\System\vPvtTjC.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\AORpqNT.exe
  C:\Windows\System\AORpqNT.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\bbkfqTI.exe
  C:\Windows\System\bbkfqTI.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\lonjeGa.exe
  C:\Windows\System\lonjeGa.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\yWMiAsm.exe
  C:\Windows\System\yWMiAsm.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\ITZdnNc.exe
  C:\Windows\System\ITZdnNc.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\vVXvoGw.exe
  C:\Windows\System\vVXvoGw.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\cXoMihW.exe
  C:\Windows\System\cXoMihW.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\aROVMIu.exe
  C:\Windows\System\aROVMIu.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\rKbhilR.exe
  C:\Windows\System\rKbhilR.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\qmSEfJK.exe
  C:\Windows\System\qmSEfJK.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\nuGRTqA.exe
  C:\Windows\System\nuGRTqA.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\rOixfzr.exe
  C:\Windows\System\rOixfzr.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\fBuYrgN.exe
  C:\Windows\System\fBuYrgN.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\jfiUdJQ.exe
  C:\Windows\System\jfiUdJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\nUzHctw.exe
  C:\Windows\System\nUzHctw.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\YpnRUrU.exe
  C:\Windows\System\YpnRUrU.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\KFdLEHk.exe
  C:\Windows\System\KFdLEHk.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\EKmlDlL.exe
  C:\Windows\System\EKmlDlL.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\khqIiqP.exe
  C:\Windows\System\khqIiqP.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\hoCKbQP.exe
  C:\Windows\System\hoCKbQP.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\VxZsjNt.exe
  C:\Windows\System\VxZsjNt.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\AktOfEA.exe
  C:\Windows\System\AktOfEA.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\RVxAhFU.exe
  C:\Windows\System\RVxAhFU.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\zvCfXmF.exe
  C:\Windows\System\zvCfXmF.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\MABudbS.exe
  C:\Windows\System\MABudbS.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\NmxCgDE.exe
  C:\Windows\System\NmxCgDE.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\BpJAKRQ.exe
  C:\Windows\System\BpJAKRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\BFOmErC.exe
  C:\Windows\System\BFOmErC.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\doriKDh.exe
  C:\Windows\System\doriKDh.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\HvrDdMU.exe
  C:\Windows\System\HvrDdMU.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\wTAuiEJ.exe
  C:\Windows\System\wTAuiEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\MfkyNvV.exe
  C:\Windows\System\MfkyNvV.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\WhwQdeW.exe
  C:\Windows\System\WhwQdeW.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\frmOsKe.exe
  C:\Windows\System\frmOsKe.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\PkMoHFm.exe
  C:\Windows\System\PkMoHFm.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\IuyeWwz.exe
  C:\Windows\System\IuyeWwz.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\zlocmnV.exe
  C:\Windows\System\zlocmnV.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\cmyIeoE.exe
  C:\Windows\System\cmyIeoE.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\ROtTSVt.exe
  C:\Windows\System\ROtTSVt.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\gVhKQyU.exe
  C:\Windows\System\gVhKQyU.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\IuqOopK.exe
  C:\Windows\System\IuqOopK.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\syFkSxf.exe
  C:\Windows\System\syFkSxf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\JqxImaW.exe
  C:\Windows\System\JqxImaW.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\FzFwPeq.exe
  C:\Windows\System\FzFwPeq.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\PdrvvRF.exe
  C:\Windows\System\PdrvvRF.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\WSznvnM.exe
  C:\Windows\System\WSznvnM.exe
  2⤵
  PID:3096
- C:\Windows\System\YzVPttB.exe
  C:\Windows\System\YzVPttB.exe
  2⤵
  PID:1728
- C:\Windows\System\TbCpEoG.exe
  C:\Windows\System\TbCpEoG.exe
  2⤵
  PID:4052
- C:\Windows\System\xvkDyVF.exe
  C:\Windows\System\xvkDyVF.exe
  2⤵
  PID:1332
- C:\Windows\System\dQDjdCX.exe
  C:\Windows\System\dQDjdCX.exe
  2⤵
  PID:3220
- C:\Windows\System\IqrMmwu.exe
  C:\Windows\System\IqrMmwu.exe
  2⤵
  PID:1904
- C:\Windows\System\imsEwCU.exe
  C:\Windows\System\imsEwCU.exe
  2⤵
  PID:4560
- C:\Windows\System\NwWpXbe.exe
  C:\Windows\System\NwWpXbe.exe
  2⤵
  PID:2596
- C:\Windows\System\AglhEQe.exe
  C:\Windows\System\AglhEQe.exe
  2⤵
  PID:4104
- C:\Windows\System\lWJlJSL.exe
  C:\Windows\System\lWJlJSL.exe
  2⤵
  PID:4944
- C:\Windows\System\XOidZYf.exe
  C:\Windows\System\XOidZYf.exe
  2⤵
  PID:2936
- C:\Windows\System\qUDOMaI.exe
  C:\Windows\System\qUDOMaI.exe
  2⤵
  PID:1884
- C:\Windows\System\yuenWxy.exe
  C:\Windows\System\yuenWxy.exe
  2⤵
  PID:860
- C:\Windows\System\ASmXSmy.exe
  C:\Windows\System\ASmXSmy.exe
  2⤵
  PID:4236
- C:\Windows\System\cfXqxqd.exe
  C:\Windows\System\cfXqxqd.exe
  2⤵
  PID:2736
- C:\Windows\System\cxSegDy.exe
  C:\Windows\System\cxSegDy.exe
  2⤵
  PID:3476
- C:\Windows\System\CHdaDXs.exe
  C:\Windows\System\CHdaDXs.exe
  2⤵
  PID:3604
- C:\Windows\System\JWOnXfL.exe
  C:\Windows\System\JWOnXfL.exe
  2⤵
  PID:1508
- C:\Windows\System\rqYXXAq.exe
  C:\Windows\System\rqYXXAq.exe
  2⤵
  PID:4804
- C:\Windows\System\yZmZsNj.exe
  C:\Windows\System\yZmZsNj.exe
  2⤵
  PID:3708
- C:\Windows\System\FAgNkmm.exe
  C:\Windows\System\FAgNkmm.exe
  2⤵
  PID:3724
- C:\Windows\System\LmGYLgR.exe
  C:\Windows\System\LmGYLgR.exe
  2⤵
  PID:4144
- C:\Windows\System\AKEsiGu.exe
  C:\Windows\System\AKEsiGu.exe
  2⤵
  PID:3164
- C:\Windows\System\PIgaeOT.exe
  C:\Windows\System\PIgaeOT.exe
  2⤵
  PID:5132
- C:\Windows\System\dNwFQXa.exe
  C:\Windows\System\dNwFQXa.exe
  2⤵
  PID:5160
- C:\Windows\System\qVGIHsL.exe
  C:\Windows\System\qVGIHsL.exe
  2⤵
  PID:5180
- C:\Windows\System\dKqvaWM.exe
  C:\Windows\System\dKqvaWM.exe
  2⤵
  PID:5208
- C:\Windows\System\PeKkfLR.exe
  C:\Windows\System\PeKkfLR.exe
  2⤵
  PID:5228
- C:\Windows\System\ANOPQSS.exe
  C:\Windows\System\ANOPQSS.exe
  2⤵
  PID:5288
- C:\Windows\System\KjSvhbK.exe
  C:\Windows\System\KjSvhbK.exe
  2⤵
  PID:5304
- C:\Windows\System\fjIFclg.exe
  C:\Windows\System\fjIFclg.exe
  2⤵
  PID:5332
- C:\Windows\System\HtsjzIY.exe
  C:\Windows\System\HtsjzIY.exe
  2⤵
  PID:5372
- C:\Windows\System\FtMAGHF.exe
  C:\Windows\System\FtMAGHF.exe
  2⤵
  PID:5424
- C:\Windows\System\qXoLXwe.exe
  C:\Windows\System\qXoLXwe.exe
  2⤵
  PID:5444
- C:\Windows\System\auBMixh.exe
  C:\Windows\System\auBMixh.exe
  2⤵
  PID:5472
- C:\Windows\System\RQXhxBK.exe
  C:\Windows\System\RQXhxBK.exe
  2⤵
  PID:5504
- C:\Windows\System\SKMYwxL.exe
  C:\Windows\System\SKMYwxL.exe
  2⤵
  PID:5524
- C:\Windows\System\NVUWbMl.exe
  C:\Windows\System\NVUWbMl.exe
  2⤵
  PID:5544
- C:\Windows\System\HvleavI.exe
  C:\Windows\System\HvleavI.exe
  2⤵
  PID:5580
- C:\Windows\System\ZiYbzQA.exe
  C:\Windows\System\ZiYbzQA.exe
  2⤵
  PID:5624
- C:\Windows\System\ZjGpTua.exe
  C:\Windows\System\ZjGpTua.exe
  2⤵
  PID:5644
- C:\Windows\System\rBDjMYp.exe
  C:\Windows\System\rBDjMYp.exe
  2⤵
  PID:5676
- C:\Windows\System\npOJbAw.exe
  C:\Windows\System\npOJbAw.exe
  2⤵
  PID:5708
- C:\Windows\System\MHLmeCS.exe
  C:\Windows\System\MHLmeCS.exe
  2⤵
  PID:5732
- C:\Windows\System\vKQLprI.exe
  C:\Windows\System\vKQLprI.exe
  2⤵
  PID:5752
- C:\Windows\System\cShTFUG.exe
  C:\Windows\System\cShTFUG.exe
  2⤵
  PID:5780
- C:\Windows\System\YTquMZK.exe
  C:\Windows\System\YTquMZK.exe
  2⤵
  PID:5812
- C:\Windows\System\YALTlUD.exe
  C:\Windows\System\YALTlUD.exe
  2⤵
  PID:5832
- C:\Windows\System\ncxxMwO.exe
  C:\Windows\System\ncxxMwO.exe
  2⤵
  PID:5868
- C:\Windows\System\ZMmCMQI.exe
  C:\Windows\System\ZMmCMQI.exe
  2⤵
  PID:5908
- C:\Windows\System\yRtDoDO.exe
  C:\Windows\System\yRtDoDO.exe
  2⤵
  PID:5936
- C:\Windows\System\IutaGMb.exe
  C:\Windows\System\IutaGMb.exe
  2⤵
  PID:5972
- C:\Windows\System\iUbkiXX.exe
  C:\Windows\System\iUbkiXX.exe
  2⤵
  PID:6008
- C:\Windows\System\SoCApSS.exe
  C:\Windows\System\SoCApSS.exe
  2⤵
  PID:6028
- C:\Windows\System\EuGRwbS.exe
  C:\Windows\System\EuGRwbS.exe
  2⤵
  PID:6052
- C:\Windows\System\AQYvkMS.exe
  C:\Windows\System\AQYvkMS.exe
  2⤵
  PID:6080
- C:\Windows\System\MKlGuio.exe
  C:\Windows\System\MKlGuio.exe
  2⤵
  PID:6096
- C:\Windows\System\XtyoRmc.exe
  C:\Windows\System\XtyoRmc.exe
  2⤵
  PID:6116
- C:\Windows\System\nCkKPxx.exe
  C:\Windows\System\nCkKPxx.exe
  2⤵
  PID:6136
- C:\Windows\System\qvqlIfN.exe
  C:\Windows\System\qvqlIfN.exe
  2⤵
  PID:3928
- C:\Windows\System\bXCnuNg.exe
  C:\Windows\System\bXCnuNg.exe
  2⤵
  PID:5224
- C:\Windows\System\rPWeYwK.exe
  C:\Windows\System\rPWeYwK.exe
  2⤵
  PID:5252
- C:\Windows\System\GdifCiH.exe
  C:\Windows\System\GdifCiH.exe
  2⤵
  PID:5328
- C:\Windows\System\jOjrbSD.exe
  C:\Windows\System\jOjrbSD.exe
  2⤵
  PID:5468
- C:\Windows\System\VSoimES.exe
  C:\Windows\System\VSoimES.exe
  2⤵
  PID:2508
- C:\Windows\System\MYHKLXj.exe
  C:\Windows\System\MYHKLXj.exe
  2⤵
  PID:2648
- C:\Windows\System\jfBzVuZ.exe
  C:\Windows\System\jfBzVuZ.exe
  2⤵
  PID:540
- C:\Windows\System\xDtjgib.exe
  C:\Windows\System\xDtjgib.exe
  2⤵
  PID:5664
- C:\Windows\System\KhPYbou.exe
  C:\Windows\System\KhPYbou.exe
  2⤵
  PID:5740
- C:\Windows\System\KjNIglM.exe
  C:\Windows\System\KjNIglM.exe
  2⤵
  PID:5800
- C:\Windows\System\LAsbfpf.exe
  C:\Windows\System\LAsbfpf.exe
  2⤵
  PID:5852
- C:\Windows\System\DjhDCGa.exe
  C:\Windows\System\DjhDCGa.exe
  2⤵
  PID:5924
- C:\Windows\System\MPHARrb.exe
  C:\Windows\System\MPHARrb.exe
  2⤵
  PID:6040
- C:\Windows\System\PaGSxfY.exe
  C:\Windows\System\PaGSxfY.exe
  2⤵
  PID:6072
- C:\Windows\System\eYBMxSB.exe
  C:\Windows\System\eYBMxSB.exe
  2⤵
  PID:4240
- C:\Windows\System\hgPCZqw.exe
  C:\Windows\System\hgPCZqw.exe
  2⤵
  PID:5220
- C:\Windows\System\dIWHyIr.exe
  C:\Windows\System\dIWHyIr.exe
  2⤵
  PID:1976
- C:\Windows\System\WGEmhQb.exe
  C:\Windows\System\WGEmhQb.exe
  2⤵
  PID:5888
- C:\Windows\System\gPydzzG.exe
  C:\Windows\System\gPydzzG.exe
  2⤵
  PID:5536
- C:\Windows\System\ytYMxiz.exe
  C:\Windows\System\ytYMxiz.exe
  2⤵
  PID:5096
- C:\Windows\System\SWuTjdv.exe
  C:\Windows\System\SWuTjdv.exe
  2⤵
  PID:1816
- C:\Windows\System\veZmoGH.exe
  C:\Windows\System\veZmoGH.exe
  2⤵
  PID:4436
- C:\Windows\System\rDRQgwV.exe
  C:\Windows\System\rDRQgwV.exe
  2⤵
  PID:5824
- C:\Windows\System\dzehezl.exe
  C:\Windows\System\dzehezl.exe
  2⤵
  PID:6000
- C:\Windows\System\ciMYTYG.exe
  C:\Windows\System\ciMYTYG.exe
  2⤵
  PID:6092
- C:\Windows\System\iTMOjHN.exe
  C:\Windows\System\iTMOjHN.exe
  2⤵
  PID:5512
- C:\Windows\System\TddDYdQ.exe
  C:\Windows\System\TddDYdQ.exe
  2⤵
  PID:5688
- C:\Windows\System\DBhgoqZ.exe
  C:\Windows\System\DBhgoqZ.exe
  2⤵
  PID:2320
- C:\Windows\System\ANkTvRi.exe
  C:\Windows\System\ANkTvRi.exe
  2⤵
  PID:5876
- C:\Windows\System\fBROfqi.exe
  C:\Windows\System\fBROfqi.exe
  2⤵
  PID:5312
- C:\Windows\System\PgXEmak.exe
  C:\Windows\System\PgXEmak.exe
  2⤵
  PID:4072
- C:\Windows\System\UeHvDVH.exe
  C:\Windows\System\UeHvDVH.exe
  2⤵
  PID:6148
- C:\Windows\System\tNDgPSJ.exe
  C:\Windows\System\tNDgPSJ.exe
  2⤵
  PID:6172
- C:\Windows\System\rglmvxh.exe
  C:\Windows\System\rglmvxh.exe
  2⤵
  PID:6192
- C:\Windows\System\BGYOUca.exe
  C:\Windows\System\BGYOUca.exe
  2⤵
  PID:6224
- C:\Windows\System\uyGdcuO.exe
  C:\Windows\System\uyGdcuO.exe
  2⤵
  PID:6284
- C:\Windows\System\hFYlPyn.exe
  C:\Windows\System\hFYlPyn.exe
  2⤵
  PID:6304
- C:\Windows\System\UDSQIaO.exe
  C:\Windows\System\UDSQIaO.exe
  2⤵
  PID:6324
- C:\Windows\System\AhYBmWy.exe
  C:\Windows\System\AhYBmWy.exe
  2⤵
  PID:6344
- C:\Windows\System\WxnTdlR.exe
  C:\Windows\System\WxnTdlR.exe
  2⤵
  PID:6376
- C:\Windows\System\PcqRPhN.exe
  C:\Windows\System\PcqRPhN.exe
  2⤵
  PID:6392
- C:\Windows\System\cExUakQ.exe
  C:\Windows\System\cExUakQ.exe
  2⤵
  PID:6436
- C:\Windows\System\TEudYAJ.exe
  C:\Windows\System\TEudYAJ.exe
  2⤵
  PID:6472
- C:\Windows\System\QILFdrO.exe
  C:\Windows\System\QILFdrO.exe
  2⤵
  PID:6512
- C:\Windows\System\xSFVoKS.exe
  C:\Windows\System\xSFVoKS.exe
  2⤵
  PID:6528
- C:\Windows\System\hpqhYeV.exe
  C:\Windows\System\hpqhYeV.exe
  2⤵
  PID:6552
- C:\Windows\System\uEECYEl.exe
  C:\Windows\System\uEECYEl.exe
  2⤵
  PID:6592
- C:\Windows\System\pyhuQeE.exe
  C:\Windows\System\pyhuQeE.exe
  2⤵
  PID:6636
- C:\Windows\System\EbpXdJH.exe
  C:\Windows\System\EbpXdJH.exe
  2⤵
  PID:6660
- C:\Windows\System\iFTvTLl.exe
  C:\Windows\System\iFTvTLl.exe
  2⤵
  PID:6680
- C:\Windows\System\KsdbJcf.exe
  C:\Windows\System\KsdbJcf.exe
  2⤵
  PID:6720
- C:\Windows\System\ewbKeEY.exe
  C:\Windows\System\ewbKeEY.exe
  2⤵
  PID:6740
- C:\Windows\System\sVOsWdF.exe
  C:\Windows\System\sVOsWdF.exe
  2⤵
  PID:6764
- C:\Windows\System\trRcviS.exe
  C:\Windows\System\trRcviS.exe
  2⤵
  PID:6780
- C:\Windows\System\QEfaYbK.exe
  C:\Windows\System\QEfaYbK.exe
  2⤵
  PID:6816
- C:\Windows\System\stMDdYt.exe
  C:\Windows\System\stMDdYt.exe
  2⤵
  PID:6848
- C:\Windows\System\YHOZnui.exe
  C:\Windows\System\YHOZnui.exe
  2⤵
  PID:6864
- C:\Windows\System\KzHMfgm.exe
  C:\Windows\System\KzHMfgm.exe
  2⤵
  PID:6892
- C:\Windows\System\WopExKG.exe
  C:\Windows\System\WopExKG.exe
  2⤵
  PID:6912
- C:\Windows\System\espNcjx.exe
  C:\Windows\System\espNcjx.exe
  2⤵
  PID:6976
- C:\Windows\System\aeJlBdG.exe
  C:\Windows\System\aeJlBdG.exe
  2⤵
  PID:7008
- C:\Windows\System\UpMzRKH.exe
  C:\Windows\System\UpMzRKH.exe
  2⤵
  PID:7032
- C:\Windows\System\ZUYoMsV.exe
  C:\Windows\System\ZUYoMsV.exe
  2⤵
  PID:7048
- C:\Windows\System\WadIIGt.exe
  C:\Windows\System\WadIIGt.exe
  2⤵
  PID:7088
- C:\Windows\System\ObHnMcp.exe
  C:\Windows\System\ObHnMcp.exe
  2⤵
  PID:7104
- C:\Windows\System\rDfVWiA.exe
  C:\Windows\System\rDfVWiA.exe
  2⤵
  PID:7124
- C:\Windows\System\hapaEUJ.exe
  C:\Windows\System\hapaEUJ.exe
  2⤵
  PID:7148
- C:\Windows\System\ufvxWaB.exe
  C:\Windows\System\ufvxWaB.exe
  2⤵
  PID:6168
- C:\Windows\System\CwfNkJE.exe
  C:\Windows\System\CwfNkJE.exe
  2⤵
  PID:6064
- C:\Windows\System\ZClmuYl.exe
  C:\Windows\System\ZClmuYl.exe
  2⤵
  PID:6220
- C:\Windows\System\rEHPMaj.exe
  C:\Windows\System\rEHPMaj.exe
  2⤵
  PID:6300
- C:\Windows\System\TaRnyti.exe
  C:\Windows\System\TaRnyti.exe
  2⤵
  PID:6336
- C:\Windows\System\LfgSfmk.exe
  C:\Windows\System\LfgSfmk.exe
  2⤵
  PID:6456
- C:\Windows\System\GcRsSzD.exe
  C:\Windows\System\GcRsSzD.exe
  2⤵
  PID:6416
- C:\Windows\System\OOfjGmm.exe
  C:\Windows\System\OOfjGmm.exe
  2⤵
  PID:6600
- C:\Windows\System\wcEgSNR.exe
  C:\Windows\System\wcEgSNR.exe
  2⤵
  PID:6676
- C:\Windows\System\fNjcRDJ.exe
  C:\Windows\System\fNjcRDJ.exe
  2⤵
  PID:6712
- C:\Windows\System\FfUMqiX.exe
  C:\Windows\System\FfUMqiX.exe
  2⤵
  PID:6776
- C:\Windows\System\VgBeXcC.exe
  C:\Windows\System\VgBeXcC.exe
  2⤵
  PID:6872
- C:\Windows\System\hWteair.exe
  C:\Windows\System\hWteair.exe
  2⤵
  PID:6840
- C:\Windows\System\UXXegyL.exe
  C:\Windows\System\UXXegyL.exe
  2⤵
  PID:7020
- C:\Windows\System\SVAKEAB.exe
  C:\Windows\System\SVAKEAB.exe
  2⤵
  PID:7112
- C:\Windows\System\auUsRJj.exe
  C:\Windows\System\auUsRJj.exe
  2⤵
  PID:7144
- C:\Windows\System\oWnAasT.exe
  C:\Windows\System\oWnAasT.exe
  2⤵
  PID:6188
- C:\Windows\System\EIeIAZG.exe
  C:\Windows\System\EIeIAZG.exe
  2⤵
  PID:6384
- C:\Windows\System\iTAXNgK.exe
  C:\Windows\System\iTAXNgK.exe
  2⤵
  PID:6296
- C:\Windows\System\TUDqjzK.exe
  C:\Windows\System\TUDqjzK.exe
  2⤵
  PID:6536
- C:\Windows\System\SoctoJv.exe
  C:\Windows\System\SoctoJv.exe
  2⤵
  PID:6756
- C:\Windows\System\VidGoFY.exe
  C:\Windows\System\VidGoFY.exe
  2⤵
  PID:6832
- C:\Windows\System\kHVkbgp.exe
  C:\Windows\System\kHVkbgp.exe
  2⤵
  PID:6856
- C:\Windows\System\AbuqZZe.exe
  C:\Windows\System\AbuqZZe.exe
  2⤵
  PID:5744
- C:\Windows\System\ZglxOxJ.exe
  C:\Windows\System\ZglxOxJ.exe
  2⤵
  PID:6648
- C:\Windows\System\EseGGZh.exe
  C:\Windows\System\EseGGZh.exe
  2⤵
  PID:6164
- C:\Windows\System\UVVKbQz.exe
  C:\Windows\System\UVVKbQz.exe
  2⤵
  PID:7188
- C:\Windows\System\JXlTMOQ.exe
  C:\Windows\System\JXlTMOQ.exe
  2⤵
  PID:7212
- C:\Windows\System\rSHrzlo.exe
  C:\Windows\System\rSHrzlo.exe
  2⤵
  PID:7236
- C:\Windows\System\CPFzQlv.exe
  C:\Windows\System\CPFzQlv.exe
  2⤵
  PID:7252
- C:\Windows\System\yYHsJAx.exe
  C:\Windows\System\yYHsJAx.exe
  2⤵
  PID:7280
- C:\Windows\System\kdqPxkc.exe
  C:\Windows\System\kdqPxkc.exe
  2⤵
  PID:7324
- C:\Windows\System\pJQUggf.exe
  C:\Windows\System\pJQUggf.exe
  2⤵
  PID:7348
- C:\Windows\System\LtCuTah.exe
  C:\Windows\System\LtCuTah.exe
  2⤵
  PID:7368
- C:\Windows\System\qUVkOLJ.exe
  C:\Windows\System\qUVkOLJ.exe
  2⤵
  PID:7388
- C:\Windows\System\mNvIkad.exe
  C:\Windows\System\mNvIkad.exe
  2⤵
  PID:7408
- C:\Windows\System\ECrlYiM.exe
  C:\Windows\System\ECrlYiM.exe
  2⤵
  PID:7460
- C:\Windows\System\TmNFXEa.exe
  C:\Windows\System\TmNFXEa.exe
  2⤵
  PID:7476
- C:\Windows\System\AWgeuwr.exe
  C:\Windows\System\AWgeuwr.exe
  2⤵
  PID:7496
- C:\Windows\System\sZKNzRr.exe
  C:\Windows\System\sZKNzRr.exe
  2⤵
  PID:7516
- C:\Windows\System\iXnssgq.exe
  C:\Windows\System\iXnssgq.exe
  2⤵
  PID:7532
- C:\Windows\System\ugewkrF.exe
  C:\Windows\System\ugewkrF.exe
  2⤵
  PID:7556
- C:\Windows\System\LPupuzH.exe
  C:\Windows\System\LPupuzH.exe
  2⤵
  PID:7592
- C:\Windows\System\tQGgroh.exe
  C:\Windows\System\tQGgroh.exe
  2⤵
  PID:7616
- C:\Windows\System\gUgKkrm.exe
  C:\Windows\System\gUgKkrm.exe
  2⤵
  PID:7632
- C:\Windows\System\VRhBeXw.exe
  C:\Windows\System\VRhBeXw.exe
  2⤵
  PID:7676
- C:\Windows\System\NYxXCMl.exe
  C:\Windows\System\NYxXCMl.exe
  2⤵
  PID:7700
- C:\Windows\System\ExWEVYd.exe
  C:\Windows\System\ExWEVYd.exe
  2⤵
  PID:7724
- C:\Windows\System\kGYHxYL.exe
  C:\Windows\System\kGYHxYL.exe
  2⤵
  PID:7764
- C:\Windows\System\fIhjEoN.exe
  C:\Windows\System\fIhjEoN.exe
  2⤵
  PID:7784
- C:\Windows\System\ZOFMXAm.exe
  C:\Windows\System\ZOFMXAm.exe
  2⤵
  PID:7828
- C:\Windows\System\BYVYaZh.exe
  C:\Windows\System\BYVYaZh.exe
  2⤵
  PID:7844
- C:\Windows\System\mUGhBtL.exe
  C:\Windows\System\mUGhBtL.exe
  2⤵
  PID:7896
- C:\Windows\System\tTlYAZE.exe
  C:\Windows\System\tTlYAZE.exe
  2⤵
  PID:7912
- C:\Windows\System\wkPHFrL.exe
  C:\Windows\System\wkPHFrL.exe
  2⤵
  PID:7940
- C:\Windows\System\qCTnjTi.exe
  C:\Windows\System\qCTnjTi.exe
  2⤵
  PID:7960
- C:\Windows\System\uqqBKyP.exe
  C:\Windows\System\uqqBKyP.exe
  2⤵
  PID:7976
- C:\Windows\System\yQdjElY.exe
  C:\Windows\System\yQdjElY.exe
  2⤵
  PID:8000
- C:\Windows\System\JmGkiIA.exe
  C:\Windows\System\JmGkiIA.exe
  2⤵
  PID:8040
- C:\Windows\System\yAcoWdc.exe
  C:\Windows\System\yAcoWdc.exe
  2⤵
  PID:8068
- C:\Windows\System\QJyzMzJ.exe
  C:\Windows\System\QJyzMzJ.exe
  2⤵
  PID:8116
- C:\Windows\System\BvhdbrL.exe
  C:\Windows\System\BvhdbrL.exe
  2⤵
  PID:8136
- C:\Windows\System\YjCwrCK.exe
  C:\Windows\System\YjCwrCK.exe
  2⤵
  PID:8156
- C:\Windows\System\FavFmGM.exe
  C:\Windows\System\FavFmGM.exe
  2⤵
  PID:7184
- C:\Windows\System\pWwmydA.exe
  C:\Windows\System\pWwmydA.exe
  2⤵
  PID:7228
- C:\Windows\System\oedTOYz.exe
  C:\Windows\System\oedTOYz.exe
  2⤵
  PID:7276
- C:\Windows\System\VScBfNJ.exe
  C:\Windows\System\VScBfNJ.exe
  2⤵
  PID:7332
- C:\Windows\System\CGPJJNH.exe
  C:\Windows\System\CGPJJNH.exe
  2⤵
  PID:7380
- C:\Windows\System\iBIvPAa.exe
  C:\Windows\System\iBIvPAa.exe
  2⤵
  PID:7492
- C:\Windows\System\HKCOUul.exe
  C:\Windows\System\HKCOUul.exe
  2⤵
  PID:396
- C:\Windows\System\HUrYrKj.exe
  C:\Windows\System\HUrYrKj.exe
  2⤵
  PID:7580
- C:\Windows\System\CWMQwUf.exe
  C:\Windows\System\CWMQwUf.exe
  2⤵
  PID:7708
- C:\Windows\System\gtZqFiG.exe
  C:\Windows\System\gtZqFiG.exe
  2⤵
  PID:7808
- C:\Windows\System\CeyPUhT.exe
  C:\Windows\System\CeyPUhT.exe
  2⤵
  PID:7840
- C:\Windows\System\HGelFBF.exe
  C:\Windows\System\HGelFBF.exe
  2⤵
  PID:7908
- C:\Windows\System\UZVdPNZ.exe
  C:\Windows\System\UZVdPNZ.exe
  2⤵
  PID:7956
- C:\Windows\System\XoSWzsw.exe
  C:\Windows\System\XoSWzsw.exe
  2⤵
  PID:8048
- C:\Windows\System\LgYrYPO.exe
  C:\Windows\System\LgYrYPO.exe
  2⤵
  PID:8144
- C:\Windows\System\cfOauNb.exe
  C:\Windows\System\cfOauNb.exe
  2⤵
  PID:7244
- C:\Windows\System\JsdDTQx.exe
  C:\Windows\System\JsdDTQx.exe
  2⤵
  PID:7376
- C:\Windows\System\yQKeOZB.exe
  C:\Windows\System\yQKeOZB.exe
  2⤵
  PID:7544
- C:\Windows\System\ghVVrGm.exe
  C:\Windows\System\ghVVrGm.exe
  2⤵
  PID:7484
- C:\Windows\System\wUADFpI.exe
  C:\Windows\System\wUADFpI.exe
  2⤵
  PID:7936
- C:\Windows\System\SnuXIpG.exe
  C:\Windows\System\SnuXIpG.exe
  2⤵
  PID:8028
- C:\Windows\System\FAxlxRm.exe
  C:\Windows\System\FAxlxRm.exe
  2⤵
  PID:8096
- C:\Windows\System\juzezqB.exe
  C:\Windows\System\juzezqB.exe
  2⤵
  PID:7528
- C:\Windows\System\mzkCWFG.exe
  C:\Windows\System\mzkCWFG.exe
  2⤵
  PID:7888
- C:\Windows\System\SUFByjc.exe
  C:\Windows\System\SUFByjc.exe
  2⤵
  PID:7100
- C:\Windows\System\AwHUrzs.exe
  C:\Windows\System\AwHUrzs.exe
  2⤵
  PID:7600
- C:\Windows\System\Caaxdme.exe
  C:\Windows\System\Caaxdme.exe
  2⤵
  PID:8200
- C:\Windows\System\tzmBmow.exe
  C:\Windows\System\tzmBmow.exe
  2⤵
  PID:8224
- C:\Windows\System\CbYsXxi.exe
  C:\Windows\System\CbYsXxi.exe
  2⤵
  PID:8264
- C:\Windows\System\rIWKaqb.exe
  C:\Windows\System\rIWKaqb.exe
  2⤵
  PID:8308
- C:\Windows\System\vaXZevf.exe
  C:\Windows\System\vaXZevf.exe
  2⤵
  PID:8332
- C:\Windows\System\ufnrmEx.exe
  C:\Windows\System\ufnrmEx.exe
  2⤵
  PID:8352
- C:\Windows\System\tDjUIeP.exe
  C:\Windows\System\tDjUIeP.exe
  2⤵
  PID:8372
- C:\Windows\System\gwgKVRu.exe
  C:\Windows\System\gwgKVRu.exe
  2⤵
  PID:8392
- C:\Windows\System\ylriejF.exe
  C:\Windows\System\ylriejF.exe
  2⤵
  PID:8412
- C:\Windows\System\wyguCDO.exe
  C:\Windows\System\wyguCDO.exe
  2⤵
  PID:8484
- C:\Windows\System\bZTVbJi.exe
  C:\Windows\System\bZTVbJi.exe
  2⤵
  PID:8508
- C:\Windows\System\YWgnPTw.exe
  C:\Windows\System\YWgnPTw.exe
  2⤵
  PID:8528
- C:\Windows\System\AmBOJrq.exe
  C:\Windows\System\AmBOJrq.exe
  2⤵
  PID:8548
- C:\Windows\System\GcKEdmT.exe
  C:\Windows\System\GcKEdmT.exe
  2⤵
  PID:8572
- C:\Windows\System\LRdyhki.exe
  C:\Windows\System\LRdyhki.exe
  2⤵
  PID:8592
- C:\Windows\System\RfAyxhJ.exe
  C:\Windows\System\RfAyxhJ.exe
  2⤵
  PID:8616
- C:\Windows\System\MkbkzJe.exe
  C:\Windows\System\MkbkzJe.exe
  2⤵
  PID:8644
- C:\Windows\System\VWHTivE.exe
  C:\Windows\System\VWHTivE.exe
  2⤵
  PID:8664
- C:\Windows\System\jNURcKU.exe
  C:\Windows\System\jNURcKU.exe
  2⤵
  PID:8696
- C:\Windows\System\FJfWRRl.exe
  C:\Windows\System\FJfWRRl.exe
  2⤵
  PID:8716
- C:\Windows\System\iQrZYkQ.exe
  C:\Windows\System\iQrZYkQ.exe
  2⤵
  PID:8760
- C:\Windows\System\FWIbUpa.exe
  C:\Windows\System\FWIbUpa.exe
  2⤵
  PID:8780
- C:\Windows\System\xkelpSz.exe
  C:\Windows\System\xkelpSz.exe
  2⤵
  PID:8808
- C:\Windows\System\KIheJmF.exe
  C:\Windows\System\KIheJmF.exe
  2⤵
  PID:8828
- C:\Windows\System\kLveqXF.exe
  C:\Windows\System\kLveqXF.exe
  2⤵
  PID:8844
- C:\Windows\System\RqlXedR.exe
  C:\Windows\System\RqlXedR.exe
  2⤵
  PID:8876
- C:\Windows\System\SlMDyfe.exe
  C:\Windows\System\SlMDyfe.exe
  2⤵
  PID:8896
- C:\Windows\System\FRCUEwC.exe
  C:\Windows\System\FRCUEwC.exe
  2⤵
  PID:8920
- C:\Windows\System\KYJJAnw.exe
  C:\Windows\System\KYJJAnw.exe
  2⤵
  PID:8992
- C:\Windows\System\DdScyTw.exe
  C:\Windows\System\DdScyTw.exe
  2⤵
  PID:9016
- C:\Windows\System\byYODJH.exe
  C:\Windows\System\byYODJH.exe
  2⤵
  PID:9036
- C:\Windows\System\jMITtTb.exe
  C:\Windows\System\jMITtTb.exe
  2⤵
  PID:9084
- C:\Windows\System\PmuuqPz.exe
  C:\Windows\System\PmuuqPz.exe
  2⤵
  PID:9128
- C:\Windows\System\BwUUNej.exe
  C:\Windows\System\BwUUNej.exe
  2⤵
  PID:9156
- C:\Windows\System\AMdSehR.exe
  C:\Windows\System\AMdSehR.exe
  2⤵
  PID:9180
- C:\Windows\System\fDODTga.exe
  C:\Windows\System\fDODTga.exe
  2⤵
  PID:9200
- C:\Windows\System\IIQCEtR.exe
  C:\Windows\System\IIQCEtR.exe
  2⤵
  PID:7692
- C:\Windows\System\vKPjwbg.exe
  C:\Windows\System\vKPjwbg.exe
  2⤵
  PID:8248
- C:\Windows\System\uKvcIGj.exe
  C:\Windows\System\uKvcIGj.exe
  2⤵
  PID:8284
- C:\Windows\System\rOSAkXv.exe
  C:\Windows\System\rOSAkXv.exe
  2⤵
  PID:8348
- C:\Windows\System\YWdSEHa.exe
  C:\Windows\System\YWdSEHa.exe
  2⤵
  PID:8432
- C:\Windows\System\sjAKOYI.exe
  C:\Windows\System\sjAKOYI.exe
  2⤵
  PID:8520
- C:\Windows\System\ROHlOAu.exe
  C:\Windows\System\ROHlOAu.exe
  2⤵
  PID:8588
- C:\Windows\System\KatjAEa.exe
  C:\Windows\System\KatjAEa.exe
  2⤵
  PID:8652
- C:\Windows\System\gaQRrCY.exe
  C:\Windows\System\gaQRrCY.exe
  2⤵
  PID:8708
- C:\Windows\System\iKIAQfk.exe
  C:\Windows\System\iKIAQfk.exe
  2⤵
  PID:8816
- C:\Windows\System\PWMMmwQ.exe
  C:\Windows\System\PWMMmwQ.exe
  2⤵
  PID:8888
- C:\Windows\System\cImvcPC.exe
  C:\Windows\System\cImvcPC.exe
  2⤵
  PID:8884
- C:\Windows\System\gukXMHO.exe
  C:\Windows\System\gukXMHO.exe
  2⤵
  PID:8988
- C:\Windows\System\wBREOSR.exe
  C:\Windows\System\wBREOSR.exe
  2⤵
  PID:9044
- C:\Windows\System\WiybVGL.exe
  C:\Windows\System\WiybVGL.exe
  2⤵
  PID:9072
- C:\Windows\System\nMOvPrx.exe
  C:\Windows\System\nMOvPrx.exe
  2⤵
  PID:9172
- C:\Windows\System\xdWqJUT.exe
  C:\Windows\System\xdWqJUT.exe
  2⤵
  PID:9192
- C:\Windows\System\oJfmzsu.exe
  C:\Windows\System\oJfmzsu.exe
  2⤵
  PID:8256
- C:\Windows\System\iZoypYL.exe
  C:\Windows\System\iZoypYL.exe
  2⤵
  PID:8304
- C:\Windows\System\sXSiXBX.exe
  C:\Windows\System\sXSiXBX.exe
  2⤵
  PID:8776
- C:\Windows\System\iCWOXwf.exe
  C:\Windows\System\iCWOXwf.exe
  2⤵
  PID:8868
- C:\Windows\System\ZrZcKeN.exe
  C:\Windows\System\ZrZcKeN.exe
  2⤵
  PID:9060
- C:\Windows\System\ZXtZzzV.exe
  C:\Windows\System\ZXtZzzV.exe
  2⤵
  PID:9108
- C:\Windows\System\hLVJaeF.exe
  C:\Windows\System\hLVJaeF.exe
  2⤵
  PID:8240
- C:\Windows\System\sndczZt.exe
  C:\Windows\System\sndczZt.exe
  2⤵
  PID:8852
- C:\Windows\System\zxdkpYY.exe
  C:\Windows\System\zxdkpYY.exe
  2⤵
  PID:8960
- C:\Windows\System\uoDBzRH.exe
  C:\Windows\System\uoDBzRH.exe
  2⤵
  PID:8128
- C:\Windows\System\WNtZlsu.exe
  C:\Windows\System\WNtZlsu.exe
  2⤵
  PID:9256
- C:\Windows\System\SjFDbgj.exe
  C:\Windows\System\SjFDbgj.exe
  2⤵
  PID:9276
- C:\Windows\System\RqjdWYr.exe
  C:\Windows\System\RqjdWYr.exe
  2⤵
  PID:9296
- C:\Windows\System\DQDEkHm.exe
  C:\Windows\System\DQDEkHm.exe
  2⤵
  PID:9356
- C:\Windows\System\RRTVCNu.exe
  C:\Windows\System\RRTVCNu.exe
  2⤵
  PID:9380
- C:\Windows\System\zOekpAG.exe
  C:\Windows\System\zOekpAG.exe
  2⤵
  PID:9408
- C:\Windows\System\ouaKmCW.exe
  C:\Windows\System\ouaKmCW.exe
  2⤵
  PID:9432
- C:\Windows\System\IYzREkj.exe
  C:\Windows\System\IYzREkj.exe
  2⤵
  PID:9448
- C:\Windows\System\CEEVnhA.exe
  C:\Windows\System\CEEVnhA.exe
  2⤵
  PID:9472
- C:\Windows\System\XbHzCtM.exe
  C:\Windows\System\XbHzCtM.exe
  2⤵
  PID:9492
- C:\Windows\System\mlwenee.exe
  C:\Windows\System\mlwenee.exe
  2⤵
  PID:9516
- C:\Windows\System\AbLkAPL.exe
  C:\Windows\System\AbLkAPL.exe
  2⤵
  PID:9560
- C:\Windows\System\pFFZKDA.exe
  C:\Windows\System\pFFZKDA.exe
  2⤵
  PID:9584
- C:\Windows\System\jehSBId.exe
  C:\Windows\System\jehSBId.exe
  2⤵
  PID:9600
- C:\Windows\System\CYiCgJc.exe
  C:\Windows\System\CYiCgJc.exe
  2⤵
  PID:9644
- C:\Windows\System\rkOSiAN.exe
  C:\Windows\System\rkOSiAN.exe
  2⤵
  PID:9672
- C:\Windows\System\zRtBLNG.exe
  C:\Windows\System\zRtBLNG.exe
  2⤵
  PID:9688
- C:\Windows\System\QMWcaEP.exe
  C:\Windows\System\QMWcaEP.exe
  2⤵
  PID:9724
- C:\Windows\System\yKoDQiA.exe
  C:\Windows\System\yKoDQiA.exe
  2⤵
  PID:9744
- C:\Windows\System\xwATywh.exe
  C:\Windows\System\xwATywh.exe
  2⤵
  PID:9796
- C:\Windows\System\UpAXNZk.exe
  C:\Windows\System\UpAXNZk.exe
  2⤵
  PID:9812
- C:\Windows\System\CoVzcEO.exe
  C:\Windows\System\CoVzcEO.exe
  2⤵
  PID:9840
- C:\Windows\System\jPfnVoT.exe
  C:\Windows\System\jPfnVoT.exe
  2⤵
  PID:9876
- C:\Windows\System\jroGsVd.exe
  C:\Windows\System\jroGsVd.exe
  2⤵
  PID:9900
- C:\Windows\System\XIDLTgW.exe
  C:\Windows\System\XIDLTgW.exe
  2⤵
  PID:9920
- C:\Windows\System\uZbtHUq.exe
  C:\Windows\System\uZbtHUq.exe
  2⤵
  PID:9940
- C:\Windows\System\oECPVFP.exe
  C:\Windows\System\oECPVFP.exe
  2⤵
  PID:9988
- C:\Windows\System\nEQxzAK.exe
  C:\Windows\System\nEQxzAK.exe
  2⤵
  PID:10012
- C:\Windows\System\aiemfne.exe
  C:\Windows\System\aiemfne.exe
  2⤵
  PID:10040
- C:\Windows\System\vmCsdIb.exe
  C:\Windows\System\vmCsdIb.exe
  2⤵
  PID:10064
- C:\Windows\System\kefcXMK.exe
  C:\Windows\System\kefcXMK.exe
  2⤵
  PID:10092
- C:\Windows\System\CaHZAgh.exe
  C:\Windows\System\CaHZAgh.exe
  2⤵
  PID:10132
- C:\Windows\System\uIqfGQa.exe
  C:\Windows\System\uIqfGQa.exe
  2⤵
  PID:10160
- C:\Windows\System\tOrNgBG.exe
  C:\Windows\System\tOrNgBG.exe
  2⤵
  PID:10180
- C:\Windows\System\hzUpGgW.exe
  C:\Windows\System\hzUpGgW.exe
  2⤵
  PID:10204
- C:\Windows\System\deqOkhF.exe
  C:\Windows\System\deqOkhF.exe
  2⤵
  PID:10232
- C:\Windows\System\UYJOSTn.exe
  C:\Windows\System\UYJOSTn.exe
  2⤵
  PID:9148
- C:\Windows\System\aKHIiZt.exe
  C:\Windows\System\aKHIiZt.exe
  2⤵
  PID:9236
- C:\Windows\System\QvjeZRc.exe
  C:\Windows\System\QvjeZRc.exe
  2⤵
  PID:9336
- C:\Windows\System\KYTLZrb.exe
  C:\Windows\System\KYTLZrb.exe
  2⤵
  PID:9372
- C:\Windows\System\ZzQNfZU.exe
  C:\Windows\System\ZzQNfZU.exe
  2⤵
  PID:9420
- C:\Windows\System\iqJthYP.exe
  C:\Windows\System\iqJthYP.exe
  2⤵
  PID:9440
- C:\Windows\System\gkYxWvV.exe
  C:\Windows\System\gkYxWvV.exe
  2⤵
  PID:9500
- C:\Windows\System\EOUzCVw.exe
  C:\Windows\System\EOUzCVw.exe
  2⤵
  PID:9572
- C:\Windows\System\VnZTdqP.exe
  C:\Windows\System\VnZTdqP.exe
  2⤵
  PID:9628
- C:\Windows\System\DTuVYtB.exe
  C:\Windows\System\DTuVYtB.exe
  2⤵
  PID:9664
- C:\Windows\System\mYoNVUF.exe
  C:\Windows\System\mYoNVUF.exe
  2⤵
  PID:9776
- C:\Windows\System\zwHATYh.exe
  C:\Windows\System\zwHATYh.exe
  2⤵
  PID:9784
- C:\Windows\System\EQrFaeZ.exe
  C:\Windows\System\EQrFaeZ.exe
  2⤵
  PID:9860
- C:\Windows\System\LGMnLDR.exe
  C:\Windows\System\LGMnLDR.exe
  2⤵
  PID:9980
- C:\Windows\System\RiEFAno.exe
  C:\Windows\System\RiEFAno.exe
  2⤵
  PID:10076
- C:\Windows\System\sBsDwVg.exe
  C:\Windows\System\sBsDwVg.exe
  2⤵
  PID:10112
- C:\Windows\System\oYMvvni.exe
  C:\Windows\System\oYMvvni.exe
  2⤵
  PID:10172
- C:\Windows\System\zYoPQrq.exe
  C:\Windows\System\zYoPQrq.exe
  2⤵
  PID:10200
- C:\Windows\System\ZNfChjt.exe
  C:\Windows\System\ZNfChjt.exe
  2⤵
  PID:9352
- C:\Windows\System\ZtGtyRm.exe
  C:\Windows\System\ZtGtyRm.exe
  2⤵
  PID:9528
- C:\Windows\System\JjygWke.exe
  C:\Windows\System\JjygWke.exe
  2⤵
  PID:9468
- C:\Windows\System\ZhizGjA.exe
  C:\Windows\System\ZhizGjA.exe
  2⤵
  PID:9912
- C:\Windows\System\uvyscdM.exe
  C:\Windows\System\uvyscdM.exe
  2⤵
  PID:10004
- C:\Windows\System\kQFmLDy.exe
  C:\Windows\System\kQFmLDy.exe
  2⤵
  PID:10224
- C:\Windows\System\iWsZCLV.exe
  C:\Windows\System\iWsZCLV.exe
  2⤵
  PID:9244
- C:\Windows\System\oKIEZIH.exe
  C:\Windows\System\oKIEZIH.exe
  2⤵
  PID:9684
- C:\Windows\System\cDGnzkq.exe
  C:\Windows\System\cDGnzkq.exe
  2⤵
  PID:9508
- C:\Windows\System\wETYzlX.exe
  C:\Windows\System\wETYzlX.exe
  2⤵
  PID:9536
- C:\Windows\System\oQYBtUP.exe
  C:\Windows\System\oQYBtUP.exe
  2⤵
  PID:10024
- C:\Windows\System\AbniVjQ.exe
  C:\Windows\System\AbniVjQ.exe
  2⤵
  PID:10260
- C:\Windows\System\tmwUTOo.exe
  C:\Windows\System\tmwUTOo.exe
  2⤵
  PID:10304
- C:\Windows\System\gODdPsm.exe
  C:\Windows\System\gODdPsm.exe
  2⤵
  PID:10336
- C:\Windows\System\tCzxgUK.exe
  C:\Windows\System\tCzxgUK.exe
  2⤵
  PID:10360
- C:\Windows\System\PmSmrYH.exe
  C:\Windows\System\PmSmrYH.exe
  2⤵
  PID:10376
- C:\Windows\System\XPDlvJg.exe
  C:\Windows\System\XPDlvJg.exe
  2⤵
  PID:10404
- C:\Windows\System\Qguyjbv.exe
  C:\Windows\System\Qguyjbv.exe
  2⤵
  PID:10424
- C:\Windows\System\EqYnjUQ.exe
  C:\Windows\System\EqYnjUQ.exe
  2⤵
  PID:10460
- C:\Windows\System\dcutJAt.exe
  C:\Windows\System\dcutJAt.exe
  2⤵
  PID:10504
- C:\Windows\System\nxsUTEp.exe
  C:\Windows\System\nxsUTEp.exe
  2⤵
  PID:10524
- C:\Windows\System\knQeaoV.exe
  C:\Windows\System\knQeaoV.exe
  2⤵
  PID:10544
- C:\Windows\System\IPIjVDd.exe
  C:\Windows\System\IPIjVDd.exe
  2⤵
  PID:10564
- C:\Windows\System\HwSUSJC.exe
  C:\Windows\System\HwSUSJC.exe
  2⤵
  PID:10604
- C:\Windows\System\nMpQrFe.exe
  C:\Windows\System\nMpQrFe.exe
  2⤵
  PID:10628
- C:\Windows\System\BWGSsEd.exe
  C:\Windows\System\BWGSsEd.exe
  2⤵
  PID:10648
- C:\Windows\System\RTDnjdy.exe
  C:\Windows\System\RTDnjdy.exe
  2⤵
  PID:10676
- C:\Windows\System\OHPolwp.exe
  C:\Windows\System\OHPolwp.exe
  2⤵
  PID:10732
- C:\Windows\System\PISdjxa.exe
  C:\Windows\System\PISdjxa.exe
  2⤵
  PID:10760
- C:\Windows\System\DHXweVp.exe
  C:\Windows\System\DHXweVp.exe
  2⤵
  PID:10780
- C:\Windows\System\QAzrQZs.exe
  C:\Windows\System\QAzrQZs.exe
  2⤵
  PID:10824
- C:\Windows\System\xxMvKLD.exe
  C:\Windows\System\xxMvKLD.exe
  2⤵
  PID:10840
- C:\Windows\System\XjwryYc.exe
  C:\Windows\System\XjwryYc.exe
  2⤵
  PID:10872
- C:\Windows\System\uZtDzgV.exe
  C:\Windows\System\uZtDzgV.exe
  2⤵
  PID:10908
- C:\Windows\System\YVeebBd.exe
  C:\Windows\System\YVeebBd.exe
  2⤵
  PID:10936
- C:\Windows\System\iCWkQts.exe
  C:\Windows\System\iCWkQts.exe
  2⤵
  PID:10960
- C:\Windows\System\jSwCbgH.exe
  C:\Windows\System\jSwCbgH.exe
  2⤵
  PID:10980
- C:\Windows\System\fjsJSoQ.exe
  C:\Windows\System\fjsJSoQ.exe
  2⤵
  PID:11028
- C:\Windows\System\RizUpja.exe
  C:\Windows\System\RizUpja.exe
  2⤵
  PID:11144
- C:\Windows\System\ExLtAFB.exe
  C:\Windows\System\ExLtAFB.exe
  2⤵
  PID:11160
- C:\Windows\System\npvsvec.exe
  C:\Windows\System\npvsvec.exe
  2⤵
  PID:11176
- C:\Windows\System\rBApIoP.exe
  C:\Windows\System\rBApIoP.exe
  2⤵
  PID:11192
- C:\Windows\System\uZJehUI.exe
  C:\Windows\System\uZJehUI.exe
  2⤵
  PID:11208
- C:\Windows\System\JOKICUi.exe
  C:\Windows\System\JOKICUi.exe
  2⤵
  PID:11224
- C:\Windows\System\hgUtBoH.exe
  C:\Windows\System\hgUtBoH.exe
  2⤵
  PID:11240
- C:\Windows\System\NlEQrHk.exe
  C:\Windows\System\NlEQrHk.exe
  2⤵
  PID:11256
- C:\Windows\System\XwiiNjJ.exe
  C:\Windows\System\XwiiNjJ.exe
  2⤵
  PID:10128
- C:\Windows\System\DWjRTRI.exe
  C:\Windows\System\DWjRTRI.exe
  2⤵
  PID:10272
- C:\Windows\System\akWFdcD.exe
  C:\Windows\System\akWFdcD.exe
  2⤵
  PID:10324
- C:\Windows\System\LWceONb.exe
  C:\Windows\System\LWceONb.exe
  2⤵
  PID:10348
- C:\Windows\System\rRvskdM.exe
  C:\Windows\System\rRvskdM.exe
  2⤵
  PID:10396
- C:\Windows\System\hdSFuKD.exe
  C:\Windows\System\hdSFuKD.exe
  2⤵
  PID:10420
- C:\Windows\System\bLBKkRt.exe
  C:\Windows\System\bLBKkRt.exe
  2⤵
  PID:10476
- C:\Windows\System\yINkTyE.exe
  C:\Windows\System\yINkTyE.exe
  2⤵
  PID:10536
- C:\Windows\System\lKzUVtE.exe
  C:\Windows\System\lKzUVtE.exe
  2⤵
  PID:10516
- C:\Windows\System\veZQOHO.exe
  C:\Windows\System\veZQOHO.exe
  2⤵
  PID:10584
- C:\Windows\System\QVmhJXT.exe
  C:\Windows\System\QVmhJXT.exe
  2⤵
  PID:10624
- C:\Windows\System\kiMVspQ.exe
  C:\Windows\System\kiMVspQ.exe
  2⤵
  PID:10640
- C:\Windows\System\UpqKkJS.exe
  C:\Windows\System\UpqKkJS.exe
  2⤵
  PID:10756
- C:\Windows\System\PsnLhsZ.exe
  C:\Windows\System\PsnLhsZ.exe
  2⤵
  PID:11216
- C:\Windows\System\WEsBwbR.exe
  C:\Windows\System\WEsBwbR.exe
  2⤵
  PID:10700
- C:\Windows\System\VyaNgbL.exe
  C:\Windows\System\VyaNgbL.exe
  2⤵
  PID:11152
- C:\Windows\System\rvtoqEY.exe
  C:\Windows\System\rvtoqEY.exe
  2⤵
  PID:11252
- C:\Windows\System\BwTvRCp.exe
  C:\Windows\System\BwTvRCp.exe
  2⤵
  PID:10596
- C:\Windows\System\HxqOWIB.exe
  C:\Windows\System\HxqOWIB.exe
  2⤵
  PID:10704
- C:\Windows\System\RNCIXnx.exe
  C:\Windows\System\RNCIXnx.exe
  2⤵
  PID:11220
- C:\Windows\System\JZLBSyl.exe
  C:\Windows\System\JZLBSyl.exe
  2⤵
  PID:11024
- C:\Windows\System\NYoclre.exe
  C:\Windows\System\NYoclre.exe
  2⤵
  PID:11112
- C:\Windows\System\fVQCpYt.exe
  C:\Windows\System\fVQCpYt.exe
  2⤵
  PID:11236
- C:\Windows\System\qyhdQPm.exe
  C:\Windows\System\qyhdQPm.exe
  2⤵
  PID:10768
- C:\Windows\System\qrhqXeh.exe
  C:\Windows\System\qrhqXeh.exe
  2⤵
  PID:10972
- C:\Windows\System\ZWnfxmM.exe
  C:\Windows\System\ZWnfxmM.exe
  2⤵
  PID:11084
- C:\Windows\System\QAtJOxx.exe
  C:\Windows\System\QAtJOxx.exe
  2⤵
  PID:11004
- C:\Windows\System\XaCgDyT.exe
  C:\Windows\System\XaCgDyT.exe
  2⤵
  PID:11268
- C:\Windows\System\pDPSKUK.exe
  C:\Windows\System\pDPSKUK.exe
  2⤵
  PID:11288
- C:\Windows\System\LLApOHi.exe
  C:\Windows\System\LLApOHi.exe
  2⤵
  PID:11308
- C:\Windows\System\xfmobsB.exe
  C:\Windows\System\xfmobsB.exe
  2⤵
  PID:11332
- C:\Windows\System\kpjonYg.exe
  C:\Windows\System\kpjonYg.exe
  2⤵
  PID:11352
- C:\Windows\System\GpWBXIe.exe
  C:\Windows\System\GpWBXIe.exe
  2⤵
  PID:11380
- C:\Windows\System\GdimqMP.exe
  C:\Windows\System\GdimqMP.exe
  2⤵
  PID:11396
- C:\Windows\System\oHLEToG.exe
  C:\Windows\System\oHLEToG.exe
  2⤵
  PID:11428
- C:\Windows\System\yzHrxcX.exe
  C:\Windows\System\yzHrxcX.exe
  2⤵
  PID:11488
- C:\Windows\System\ehpDxmP.exe
  C:\Windows\System\ehpDxmP.exe
  2⤵
  PID:11516
- C:\Windows\System\plrCURa.exe
  C:\Windows\System\plrCURa.exe
  2⤵
  PID:11584
- C:\Windows\System\zLZwrBu.exe
  C:\Windows\System\zLZwrBu.exe
  2⤵
  PID:11600
- C:\Windows\System\wDmtyEn.exe
  C:\Windows\System\wDmtyEn.exe
  2⤵
  PID:11616
- C:\Windows\System\dACSzEr.exe
  C:\Windows\System\dACSzEr.exe
  2⤵
  PID:11640
- C:\Windows\System\qjYzJsV.exe
  C:\Windows\System\qjYzJsV.exe
  2⤵
  PID:11668
- C:\Windows\System\WiPHxKY.exe
  C:\Windows\System\WiPHxKY.exe
  2⤵
  PID:11684
- C:\Windows\System\lbNngyu.exe
  C:\Windows\System\lbNngyu.exe
  2⤵
  PID:11704
- C:\Windows\System\aPGPRXV.exe
  C:\Windows\System\aPGPRXV.exe
  2⤵
  PID:11736
- C:\Windows\System\ulXYLyL.exe
  C:\Windows\System\ulXYLyL.exe
  2⤵
  PID:11776
- C:\Windows\System\jKoZjyT.exe
  C:\Windows\System\jKoZjyT.exe
  2⤵
  PID:11804
- C:\Windows\System\QcAzXFU.exe
  C:\Windows\System\QcAzXFU.exe
  2⤵
  PID:11828
- C:\Windows\System\NziAUng.exe
  C:\Windows\System\NziAUng.exe
  2⤵
  PID:11860
- C:\Windows\System\dHHxZNX.exe
  C:\Windows\System\dHHxZNX.exe
  2⤵
  PID:11888
- C:\Windows\System\liEfvZL.exe
  C:\Windows\System\liEfvZL.exe
  2⤵
  PID:11928
- C:\Windows\System\vNJkVJs.exe
  C:\Windows\System\vNJkVJs.exe
  2⤵
  PID:11952
- C:\Windows\System\czxwQZf.exe
  C:\Windows\System\czxwQZf.exe
  2⤵
  PID:11972
- C:\Windows\System\bHkDpcq.exe
  C:\Windows\System\bHkDpcq.exe
  2⤵
  PID:12000
- C:\Windows\System\iCunCqu.exe
  C:\Windows\System\iCunCqu.exe
  2⤵
  PID:12044
- C:\Windows\System\nURPmzh.exe
  C:\Windows\System\nURPmzh.exe
  2⤵
  PID:12068
- C:\Windows\System\BNorXVj.exe
  C:\Windows\System\BNorXVj.exe
  2⤵
  PID:12084
- C:\Windows\System\MFIRgsR.exe
  C:\Windows\System\MFIRgsR.exe
  2⤵
  PID:12132
- C:\Windows\System\XXNNXmH.exe
  C:\Windows\System\XXNNXmH.exe
  2⤵
  PID:12156
- C:\Windows\System\dDlMUNt.exe
  C:\Windows\System\dDlMUNt.exe
  2⤵
  PID:12180
- C:\Windows\System\VvlWtTM.exe
  C:\Windows\System\VvlWtTM.exe
  2⤵
  PID:12200
- C:\Windows\System\LVsDbVq.exe
  C:\Windows\System\LVsDbVq.exe
  2⤵
  PID:12228
- C:\Windows\System\kKkHhHK.exe
  C:\Windows\System\kKkHhHK.exe
  2⤵
  PID:12244
- C:\Windows\System\pJDtIRx.exe
  C:\Windows\System\pJDtIRx.exe
  2⤵
  PID:12260
- C:\Windows\System\nnSqfcY.exe
  C:\Windows\System\nnSqfcY.exe
  2⤵
  PID:11168
- C:\Windows\System\hPrwkol.exe
  C:\Windows\System\hPrwkol.exe
  2⤵
  PID:11324
- C:\Windows\System\KgTEwJk.exe
  C:\Windows\System\KgTEwJk.exe
  2⤵
  PID:11464
- C:\Windows\System\hetxaIs.exe
  C:\Windows\System\hetxaIs.exe
  2⤵
  PID:11552
- C:\Windows\System\cRLxDtu.exe
  C:\Windows\System\cRLxDtu.exe
  2⤵
  PID:11632
- C:\Windows\System\mjPUOVV.exe
  C:\Windows\System\mjPUOVV.exe
  2⤵
  PID:11652
- C:\Windows\System\BjmWYWI.exe
  C:\Windows\System\BjmWYWI.exe
  2⤵
  PID:11692
- C:\Windows\System\wnHyWiD.exe
  C:\Windows\System\wnHyWiD.exe
  2⤵
  PID:11732
- C:\Windows\System\qZIsxgW.exe
  C:\Windows\System\qZIsxgW.exe
  2⤵
  PID:11816
- C:\Windows\System\ShRZGMB.exe
  C:\Windows\System\ShRZGMB.exe
  2⤵
  PID:11848
- C:\Windows\System\gGDBxvR.exe
  C:\Windows\System\gGDBxvR.exe
  2⤵
  PID:11992
- C:\Windows\System\KvEVdQv.exe
  C:\Windows\System\KvEVdQv.exe
  2⤵
  PID:12056
- C:\Windows\System\nUUNlTO.exe
  C:\Windows\System\nUUNlTO.exe
  2⤵
  PID:12104
- C:\Windows\System\mmkXjiG.exe
  C:\Windows\System\mmkXjiG.exe
  2⤵
  PID:12164
- C:\Windows\System\mmFSNiK.exe
  C:\Windows\System\mmFSNiK.exe
  2⤵
  PID:12188
- C:\Windows\System\GvxhLVV.exe
  C:\Windows\System\GvxhLVV.exe
  2⤵
  PID:11300
- C:\Windows\System\vtFFFqD.exe
  C:\Windows\System\vtFFFqD.exe
  2⤵
  PID:11456
- C:\Windows\System\SRXwrIq.exe
  C:\Windows\System\SRXwrIq.exe
  2⤵
  PID:11508
- C:\Windows\System\nYLSGNG.exe
  C:\Windows\System\nYLSGNG.exe
  2⤵
  PID:11680
- C:\Windows\System\fPZnXDa.exe
  C:\Windows\System\fPZnXDa.exe
  2⤵
  PID:11968
- C:\Windows\System\OTxnMoW.exe
  C:\Windows\System\OTxnMoW.exe
  2⤵
  PID:12284
- C:\Windows\System\LKNtXsE.exe
  C:\Windows\System\LKNtXsE.exe
  2⤵
  PID:12252
- C:\Windows\System\rfvaXKh.exe
  C:\Windows\System\rfvaXKh.exe
  2⤵
  PID:11404
- C:\Windows\System\AJGacpQ.exe
  C:\Windows\System\AJGacpQ.exe
  2⤵
  PID:11676
- C:\Windows\System\LIYuCKa.exe
  C:\Windows\System\LIYuCKa.exe
  2⤵
  PID:11964
- C:\Windows\System\dDHzOnM.exe
  C:\Windows\System\dDHzOnM.exe
  2⤵
  PID:11500
- C:\Windows\System\VcvscHk.exe
  C:\Windows\System\VcvscHk.exe
  2⤵
  PID:12300
- C:\Windows\System\wwMvjDs.exe
  C:\Windows\System\wwMvjDs.exe
  2⤵
  PID:12320
- C:\Windows\System\WDbyNSj.exe
  C:\Windows\System\WDbyNSj.exe
  2⤵
  PID:12352
- C:\Windows\System\flHQHMJ.exe
  C:\Windows\System\flHQHMJ.exe
  2⤵
  PID:12372
- C:\Windows\System\QJtbzdX.exe
  C:\Windows\System\QJtbzdX.exe
  2⤵
  PID:12408
- C:\Windows\System\cyACsfE.exe
  C:\Windows\System\cyACsfE.exe
  2⤵
  PID:12428
- C:\Windows\System\loPpBqr.exe
  C:\Windows\System\loPpBqr.exe
  2⤵
  PID:12448
- C:\Windows\System\WsPIiHC.exe
  C:\Windows\System\WsPIiHC.exe
  2⤵
  PID:12464
- C:\Windows\System\XTKAaxJ.exe
  C:\Windows\System\XTKAaxJ.exe
  2⤵
  PID:12488
- C:\Windows\System\VRWkQat.exe
  C:\Windows\System\VRWkQat.exe
  2⤵
  PID:12512
- C:\Windows\System\XdfBRLp.exe
  C:\Windows\System\XdfBRLp.exe
  2⤵
  PID:12532
- C:\Windows\System\rwaLCWM.exe
  C:\Windows\System\rwaLCWM.exe
  2⤵
  PID:12552
- C:\Windows\System\UVvHOiG.exe
  C:\Windows\System\UVvHOiG.exe
  2⤵
  PID:12604
- C:\Windows\System\wokvYwz.exe
  C:\Windows\System\wokvYwz.exe
  2⤵
  PID:12644
- C:\Windows\System\URuowiZ.exe
  C:\Windows\System\URuowiZ.exe
  2⤵
  PID:12668
- C:\Windows\System\RzqhyHg.exe
  C:\Windows\System\RzqhyHg.exe
  2⤵
  PID:12692
- C:\Windows\System\nkfpPwG.exe
  C:\Windows\System\nkfpPwG.exe
  2⤵
  PID:12716
- C:\Windows\System\SQGExhP.exe
  C:\Windows\System\SQGExhP.exe
  2⤵
  PID:12736
- C:\Windows\System\rUpRoka.exe
  C:\Windows\System\rUpRoka.exe
  2⤵
  PID:12780
- C:\Windows\System\nnKoNMK.exe
  C:\Windows\System\nnKoNMK.exe
  2⤵
  PID:12828
- C:\Windows\System\TpXXSLm.exe
  C:\Windows\System\TpXXSLm.exe
  2⤵
  PID:12864
- C:\Windows\System\FetQDcp.exe
  C:\Windows\System\FetQDcp.exe
  2⤵
  PID:12880
- C:\Windows\System\dACNbKp.exe
  C:\Windows\System\dACNbKp.exe
  2⤵
  PID:12932
- C:\Windows\System\APfSWbV.exe
  C:\Windows\System\APfSWbV.exe
  2⤵
  PID:12948
- C:\Windows\System\gpubwDW.exe
  C:\Windows\System\gpubwDW.exe
  2⤵
  PID:12976
- C:\Windows\System\SqLmTLV.exe
  C:\Windows\System\SqLmTLV.exe
  2⤵
  PID:13000
- C:\Windows\System\ZeRPjoj.exe
  C:\Windows\System\ZeRPjoj.exe
  2⤵
  PID:13020
- C:\Windows\System\mSsblcx.exe
  C:\Windows\System\mSsblcx.exe
  2⤵
  PID:13060
- C:\Windows\System\svRGvHo.exe
  C:\Windows\System\svRGvHo.exe
  2⤵
  PID:13080
- C:\Windows\System\HNqzwht.exe
  C:\Windows\System\HNqzwht.exe
  2⤵
  PID:13136
- C:\Windows\System\XPrNdLM.exe
  C:\Windows\System\XPrNdLM.exe
  2⤵
  PID:13152
- C:\Windows\System\vyPOibU.exe
  C:\Windows\System\vyPOibU.exe
  2⤵
  PID:13172
- C:\Windows\System\VFKJHub.exe
  C:\Windows\System\VFKJHub.exe
  2⤵
  PID:13192
- C:\Windows\System\lgckLwF.exe
  C:\Windows\System\lgckLwF.exe
  2⤵
  PID:13212
- C:\Windows\System\kKllXlX.exe
  C:\Windows\System\kKllXlX.exe
  2⤵
  PID:13240
- C:\Windows\System\Trgawbz.exe
  C:\Windows\System\Trgawbz.exe
  2⤵
  PID:13292
- C:\Windows\System\HQRPeJU.exe
  C:\Windows\System\HQRPeJU.exe
  2⤵
  PID:11136
- C:\Windows\System\ZWKoXOl.exe
  C:\Windows\System\ZWKoXOl.exe
  2⤵
  PID:12336
- C:\Windows\System\sZtGxyX.exe
  C:\Windows\System\sZtGxyX.exe
  2⤵
  PID:12496
- C:\Windows\System\FshhcHR.exe
  C:\Windows\System\FshhcHR.exe
  2⤵
  PID:12424
- C:\Windows\System\DPvfECF.exe
  C:\Windows\System\DPvfECF.exe
  2⤵
  PID:12584
- C:\Windows\System\uygdmoy.exe
  C:\Windows\System\uygdmoy.exe
  2⤵
  PID:12676
- C:\Windows\System\BVvEXsv.exe
  C:\Windows\System\BVvEXsv.exe
  2⤵
  PID:12588
- C:\Windows\System\QAegalz.exe
  C:\Windows\System\QAegalz.exe
  2⤵
  PID:12728
- C:\Windows\System\jgcHBOl.exe
  C:\Windows\System\jgcHBOl.exe
  2⤵
  PID:12808
- C:\Windows\System\pjWzrJc.exe
  C:\Windows\System\pjWzrJc.exe
  2⤵
  PID:12876
- C:\Windows\System\xvwtxZJ.exe
  C:\Windows\System\xvwtxZJ.exe
  2⤵
  PID:12888
- C:\Windows\System\USucnYK.exe
  C:\Windows\System\USucnYK.exe
  2⤵
  PID:12964
- C:\Windows\System\GNriRTI.exe
  C:\Windows\System\GNriRTI.exe
  2⤵
  PID:3916
- C:\Windows\System\qPreBTq.exe
  C:\Windows\System\qPreBTq.exe
  2⤵
  PID:13072
- C:\Windows\System\qDMCLop.exe
  C:\Windows\System\qDMCLop.exe
  2⤵
  PID:13128
- C:\Windows\System\mLszVZv.exe
  C:\Windows\System\mLszVZv.exe
  2⤵
  PID:13232
- C:\Windows\System\CzjxYNw.exe
  C:\Windows\System\CzjxYNw.exe
  2⤵
  PID:13284
- C:\Windows\System\PlgvHSV.exe
  C:\Windows\System\PlgvHSV.exe
  2⤵
  PID:12024
- C:\Windows\System\NaXukpf.exe
  C:\Windows\System\NaXukpf.exe
  2⤵
  PID:12444
- C:\Windows\System\XXPsfFa.exe
  C:\Windows\System\XXPsfFa.exe
  2⤵
  PID:12656
- C:\Windows\System\pKKvbIb.exe
  C:\Windows\System\pKKvbIb.exe
  2⤵
  PID:12764
- C:\Windows\System\bBHHvzi.exe
  C:\Windows\System\bBHHvzi.exe
  2⤵
  PID:12836
- C:\Windows\System\VjnMsEm.exe
  C:\Windows\System\VjnMsEm.exe
  2⤵
  PID:1384
- C:\Windows\System\Pjlrxnv.exe
  C:\Windows\System\Pjlrxnv.exe
  2⤵
  PID:13056
- C:\Windows\System\fCOEOSI.exe
  C:\Windows\System\fCOEOSI.exe
  2⤵
  PID:3004
- C:\Windows\System\xZYmsfR.exe
  C:\Windows\System\xZYmsfR.exe
  2⤵
  PID:12312
- C:\Windows\System\lYKXiMo.exe
  C:\Windows\System\lYKXiMo.exe
  2⤵
  PID:12620
- C:\Windows\System\EAoadre.exe
  C:\Windows\System\EAoadre.exe
  2⤵
  PID:11580
- C:\Windows\System\MHviBKk.exe
  C:\Windows\System\MHviBKk.exe
  2⤵
  PID:4472
- C:\Windows\System\nYYLGiC.exe
  C:\Windows\System\nYYLGiC.exe
  2⤵
  PID:13288
- C:\Windows\System\nRsfmoM.exe
  C:\Windows\System\nRsfmoM.exe
  2⤵
  PID:12908
- C:\Windows\System\anJAkCh.exe
  C:\Windows\System\anJAkCh.exe
  2⤵
  PID:6252
- C:\Windows\System\yElcuhl.exe
  C:\Windows\System\yElcuhl.exe
  2⤵
  PID:13332
- C:\Windows\System\sENOcer.exe
  C:\Windows\System\sENOcer.exe
  2⤵
  PID:13352
- C:\Windows\System\VxrsHix.exe
  C:\Windows\System\VxrsHix.exe
  2⤵
  PID:13484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfl5eoew.k5y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AORpqNT.exe

Filesize
1.5MB

MD5
af041818bff6530caf780b9e70136d61

SHA1
121ce9147210536ff17af4aebeea5c49db15879e

SHA256
9acf29f5e499c25219654def2e47ae87b16051376970e9ecc1600d54ec3e6b1a

SHA512
9defcb13c04db1774716dcb87fe3af814cde0340a8c0ef28b3abcd00b72c6dbbe9898d9dc97fc7f135f7e6b01e7ba0ae647b6513d9c5341b5befa1de33d9d311

Download Submit
C:\Windows\System\FcGUkeb.exe

Filesize
8B

MD5
df9f51a1b551c980f8fba6cb17278b4c

SHA1
afc88e532b2022bea92d5c0b9b385d3c5cb999b8

SHA256
055dcd514a2542509f068419247af897ae44ac816177996de78f41054584b6d8

SHA512
b6db0ce137231f359601e4e32e1c1ebb7f37eb538721849b884584421ccc171e728d5e3ef35153d8dfcc0ee39ac75e7674fbb19971bf842685c872c4c29458ec

Download Submit
C:\Windows\System\ITZdnNc.exe

Filesize
1.5MB

MD5
a3583065edb43d54318fffc300356b6b

SHA1
e824769aa2bee0bebf3186f74dc3a85ccf429389

SHA256
d3eefe5377779a2b6d7fece471743c73c723228ba33ef16c06f1d8d01689681a

SHA512
cd9520f38085637bdfe2d97c8d81a5a3b4665aca8091ed944646cc821c0f2b3cda4d13946f9dcff051ca8b592ff79fd07400181481544dc4897fc9702b0b0e45

Download Submit
C:\Windows\System\LjHqGBe.exe

Filesize
1.5MB

MD5
6f4e8c6d789c0b6b9a07861b9d727694

SHA1
c2691187b82ba5b796d744caea243e405006b1a1

SHA256
e5453b7aad4eb41490626e72ce00adae56e4367735d0893dc752680c91cdadd8

SHA512
b6451d7d962f30e352af5591761f468e826ea5c49830afd5c65499ddd9599ad3842ec40daf44959e9e820e4aab2fcd079516552bf33e7b91f5112d44866276ce

Download Submit
C:\Windows\System\MRPNuLI.exe

Filesize
1.5MB

MD5
e64febb7a5af00b2dd1fefce9927ed86

SHA1
161dea946635e7539796a4e4040117ba7cde7c24

SHA256
396c4b4391e9f690aed0e518853e9364af50293066e12ccbb78a2f925ac37084

SHA512
751141ff9e6402aab625ac2b54ed84a0efbff5ecbb56f0aadedb671d54329e2bd29e115a09eaa57c8529abcc6208832e95cd971b3f3c9c5eaca7a30de5bdad5a

Download Submit
C:\Windows\System\OUVddGO.exe

Filesize
1.5MB

MD5
ea77674faf40ce86c439be73ebb336c9

SHA1
cb3f3caee878d0bd77d990e76e1618de708f9b2f

SHA256
66fafa048084138a0ffcd7e6f38afe270e72058dc295e8f31473e4294cb0202b

SHA512
9c616cbbd4ded85dd127e8c93350d7fad2b3295686db7a01aa04575486ae44f76a72fb0389ca44b0b4dc0811453d34bc28e6043a4e03c5b04dde9e596cfd12e5

Download Submit
C:\Windows\System\PDcHpqY.exe

Filesize
1.5MB

MD5
0cf39f6a35ae06108c3d3c1e544343d1

SHA1
2d3376e579201c2f3ce8e9db90643d5db0976abc

SHA256
684fd20dd0de8abc7a248d1e651374a2d964473f7171991cd2ffd65cedeeeffe

SHA512
be28fdbacc9f78ffbbafa21a5654dc8046783c30b667d7572cce824c3218dba4dd5d3370053ecfef3864e71cde468cd246e5ea078d5642f2b9649e5376c40a27

Download Submit
C:\Windows\System\PUEpVWW.exe

Filesize
1.5MB

MD5
c5cde0c9a23868e681f9d3ed559e2584

SHA1
83a26734a8d4bc2386b3351d7d73f79f1ffee0f9

SHA256
81fdddc7d46897906652c49818854e7a2e5623a677faf43ab88b75d30c3900a6

SHA512
a39919120262b3af7a4ea814eb475ca05b827eb2431c50112daf1ea993fbaf4c7d012fca60b4edd2ea3b04139c2151dc4e57f7026c6ce4ff06c928b08d68c46d

Download Submit
C:\Windows\System\PyCEsNj.exe

Filesize
1.5MB

MD5
fec48eabe2c53c8052628f6bb5d384ae

SHA1
f541f29c1d38740148b1fa72e2e614b9c93be8ac

SHA256
c8c75f399db1660da096c2f11e0ff295cdc2750d4a179d2d7462e34f4aefde2a

SHA512
16370469ea16f6e94a0784715df80e339b4286bd2d3228d075b93e6e7a5dcc5e8ead71294301bfcbad07d909c3c8a590fc4d3ab178c8192d5d7952140c14d898

Download Submit
C:\Windows\System\QUtJXQE.exe

Filesize
1.5MB

MD5
28fc5a0ef171b53c5922d08ac81e9b85

SHA1
7f3b5a2e2151a7c98d8ded4d8380c971e826e1e3

SHA256
0b6a0d37e5ae02f88a887402fb66cacdda493a6e58f11cd37456551d78ce655f

SHA512
343063722e3673b8680ceb80c8de693506138f2e624ef88e46c898b1bcf98b5f8d5143e11761e8f8bdf560251d9d24c101c2e07425f1b3be5c60bb9eb564c44e

Download Submit
C:\Windows\System\THyMFvh.exe

Filesize
1.5MB

MD5
066336df0d7b57dc9d1ea70abe54ee51

SHA1
1969782c5a76e93aeb3c97864babf00aee4709de

SHA256
1282787076815aafbe50b90506be486ab5aa87960c79fd6a5ec278db01962ef7

SHA512
96e3b86206e21502473d446b24d4da2f935e2330b673acff648e0c40431e80df83213338e808fe1903b922e58d1efa9c4297d022e3899bac26800e2cdc955d52

Download Submit
C:\Windows\System\VXaguTO.exe

Filesize
1.5MB

MD5
5de73293df0643501dfcf9258aa414d1

SHA1
5ee5a9ab160796456adeaac12d9603545b09403e

SHA256
f5fe706d5f19119b67d963a2a38bbac6b524d6458b62ecc6ea617bfafb0f36cd

SHA512
8415f413cd53dabae34f5a43b6f6fd00c6f1a5e1a4e5dc2068a0e23d46ad21fc2354a1fdf6e1d94af1063b5fac4159d0c68b8fe3a1e93769a12821b054d6ab04

Download Submit
C:\Windows\System\VsqqWIm.exe

Filesize
1.5MB

MD5
2a064976abd8de030af596145d710244

SHA1
0009316936cc68c34a89d76f048e9fab043ade7c

SHA256
8bc1056f0cb2466bf82a67dd228ec167adfb16ee07bbf69d34159be4a53f9a32

SHA512
3f8bdcc6abc0e092eda8aa37c2c801592bca961d8bc3582610b788dcbf91a165743c89b90820144efed12a80ba9c9cb28715a29e6c28ac05a037ade0711fc84a

Download Submit
C:\Windows\System\WFnAThX.exe

Filesize
1.5MB

MD5
941ab11c49d0c6a7d533afb765638526

SHA1
b059f045bcd591bb36737b97d0c1b5ef85e06e29

SHA256
fc0f9d4947131c62ffff6585a996e319e2113d70f060bdc61a84ce622ddd6e56

SHA512
773d42f9166a62609a7344e9e01f4e0e59a7d3bd437bd44b9bf470c5ce1c31d714d57c9b766837cf49ad37961807b6812f9c1ff7996969174ae946cd9c66a669

Download Submit
C:\Windows\System\XVIHrUK.exe

Filesize
1.5MB

MD5
0b6805999f274d5394b7d35671864278

SHA1
d7e35a28667f72345a75ecdc83276831cfbc20a4

SHA256
0478a0b1c2a2fcd119533ec89679da4030ca6063f5dd631d9977248c8d2e51d1

SHA512
75c62eb7feef0e84fc2ae591c93dc2100038838e0d7470ce31f8cbe30a68a872e659e088fcaac8b7ca0395e462fae13b234ce53253885cc68881c667f3736fe4

Download Submit
C:\Windows\System\aROVMIu.exe

Filesize
1.5MB

MD5
36ed4584e894b5f3829718bb44c20a85

SHA1
92c772d11fd68da26c6e94a68b54a2697259bd68

SHA256
156f294160486038da50d77075b0d2e52f7da7e41003a0a753279879efa5e49f

SHA512
0e9c5035a77738c548d65549da196bdc1270ae7c33294746e20e8e337b50018503b3d2c013b83d9a8bf7f80915b212f048cea5cd0f49e0b1cc10f6dd76b7e812

Download Submit
C:\Windows\System\accqFDt.exe

Filesize
1.5MB

MD5
ae9061bcf7d7fda009b5f5bdfe10df5b

SHA1
e3ec8a15489e78682179ba60b3572ba5c0369595

SHA256
27678ad41ca10a38ac7e045d2f4a9186ec38cac648e014d2671190fc04e62d2d

SHA512
a206795ee41b200fc38bb27d48645cb2cd334cd52f7984e64229a836d7674fea15ca0a80c9888b9eb46a0a31945f52727c512b04c31e1409eac2d7926b51f9fa

Download Submit
C:\Windows\System\bbkfqTI.exe

Filesize
1.5MB

MD5
6aef4f84a84173d120611c66709a3ab4

SHA1
adf8e41fe2d7e4d1ae61ff0800adc017293f9766

SHA256
67ceb7590c9513bdb7016e26b5dbb69a303260c81742b727fddf0f80a3f03055

SHA512
c9b48389a3d65b1a0a755a83cc696e6c1797f5633937ad0dbb7cde73b2c53accedf2764f2ffa34896d9f477adaef863b0ed30e654d120738122449d0ecc6f4a7

Download Submit
C:\Windows\System\cXoMihW.exe

Filesize
1.5MB

MD5
4575749586f6460d8142ebab0cef478c

SHA1
3de43d79e1999876ad21e2a3cb8801035cfe6ac0

SHA256
53b1cbdb8c0f9810c5883198f78f7c4191add7e97df68e0a44d3ceb6a79b445a

SHA512
97146224eef4fce4ab3fe9d1d27c92746b2e360082cff519d2853f417d8fb1c9be17e1a4d8e9c5b2333914f41c99ed451ebfe0af4e9745a884b2acacf200930a

Download Submit
C:\Windows\System\fAQAqUn.exe

Filesize
1.5MB

MD5
84e7bac6ec8b000540ea42b7593f8642

SHA1
c32ca9516df6c9df5acb775ca51ea1b91ef1c0fd

SHA256
928e17b59e6b431bbb6a7ed1de829a6009e05c4a1a8acf5cba7ff11043baae84

SHA512
8e03651bd9a8f52bfd493cf827bb1c355b3041084c007eda976db8be27350d517f63203ff5c8b677538042066446f61603e88c905cfabaae7f278e0c0f0c2d1d

Download Submit
C:\Windows\System\fBuYrgN.exe

Filesize
1.5MB

MD5
c460a0fe7e97e7e964489d17e66a96fc

SHA1
9083eaeb1d5703ab9574068ee1792224c484e14a

SHA256
6168d4a75d35bb98bd3238568c88afb7378a471fd77273802187d75461bce01d

SHA512
b269f3bea2d12bdfd324b9d9adb6d4a2e60046f2fb77c784e9b96f8d7554d693781733808e4169d46f7004388e0fa763527b2e43dfd5ee7c8929ae8629420dfd

Download Submit
C:\Windows\System\jfiUdJQ.exe

Filesize
1.5MB

MD5
9f456973f82a518f4cabccfc6ebe0733

SHA1
d2a3b8f6d2af059b520015c003e5b6a9db45ec6b

SHA256
25a09861926a95f522b1422729f677165c2c368a8a936334294352852194e5f1

SHA512
30071a6d01d5c28c1c116c1a28e35736f085c8175f0925147bf0ec20e94daf36d79af37276d531d3a85fc13ef5ac0cb69bcadfad1a440aaeb2f25d650832247d

Download Submit
C:\Windows\System\lKFhkkD.exe

Filesize
1.5MB

MD5
b0bf6b4b2c008e8677a5948070e1c2f8

SHA1
3a96bbdca9b02610973a8ff36451a10386c0bf09

SHA256
51323eab18b2d889108a7478ecfc524033d8d440d9ac79752530286275306667

SHA512
0b8bc72c2c915d66c8f31f7c2afcd5d9244f825d52bf4c60afb13dc07445b284747ff2438133327ac3ca4cf474d3ca7434342910df95287ca15d811b89cff0d9

Download Submit
C:\Windows\System\lonjeGa.exe

Filesize
1.5MB

MD5
fffcd468ebbf88a074190107d23ddc6f

SHA1
5c0cd44aa65f43a606a8e4fccc3d626c28fd7037

SHA256
7ac2bf9abbe37d3bff0926337dd325c097bb7f805967c3f490d1cdc2c239f564

SHA512
b0d7d6ff39fdfddf06b38c77c67a2f9241adaa39aae76a14fcaa4ca7754fa8c309ec824374bd39c554ef0f439027ab511b9c848a9ac6cc9ffce8138c87822c53

Download Submit
C:\Windows\System\nuGRTqA.exe

Filesize
1.5MB

MD5
c2e4a1c2efc74caf08a8a50ecc813156

SHA1
a80162154a2f2653f9dfafa4866545bfce8f5b5e

SHA256
27d055aa1b4dc065fd1bfb2e8717f5323275c7098821383ac4cd2c42bee8243b

SHA512
c4ef606c8c42a051742ec5e3d40b20e9e5cade436d42265219f6ef738cfa57ad8359fd3a826bebf7698622e950d84db7fdff7e44e2038e5401e0b4fdee7b73c1

Download Submit
C:\Windows\System\pOhLOYP.exe

Filesize
1.5MB

MD5
c825b15db290d342a363413fc05198d8

SHA1
95fcb9a955b1b44e27b350131ceaf0f7200c8883

SHA256
042fef7609a0dcd9e02c0b0a707c6e410f52a6a266cab3841e4a5d77553b5c91

SHA512
bbc194342710bc4cd7d7ea312781c79c87304f90351662752872ee50a3e518b6555631f816016edf89e04ba2245e2100e7388e24f2d4880c656f09444443c12e

Download Submit
C:\Windows\System\psipLWy.exe

Filesize
1.5MB

MD5
c9e59dab65ccba77c5d6601e6a814b1d

SHA1
4205957e94585f0af64b3a7c1fee2eea93526ff9

SHA256
72980cac896d91fc715d608ed7dd3232ee3061b76b2365b8718dde4d55495176

SHA512
ec4163c9202fc0d3df14ffe39a503a655373cfac083b8511a68892c5a54434b03d45e9ed0294a7d4ae8d8e6949bceb35bb6d98f932bc712a175986aec315f250

Download Submit
C:\Windows\System\qbpHvBi.exe

Filesize
1.5MB

MD5
1d9f4c23ab635cf5e98032b946b0929d

SHA1
3a2a74762ea3df5b338c6f2649b2001aabfd2806

SHA256
7e9af3e86ec2ff06028cf0c38d7c86319a44e7baa4d03ab50cbc7adf63581431

SHA512
fa785b494266117531262e5725fc0e3b8ffd361d6be25f4c33b9a44bd4897e73603253fe08727a8ab71a70d29a8eeaea4859f78226a4fbf87cba1d7cdf08ffe9

Download Submit
C:\Windows\System\qmSEfJK.exe

Filesize
1.5MB

MD5
c378f9872f793d9559248d02b4b95d8f

SHA1
0f860b2f76a2ad07764979828d89f02674d104bf

SHA256
637fb8e50979851fb5fb3fb734e1de3e922183e76c0c09729ea789cbdef9ba1f

SHA512
37f8d2c51283c65c3087d56c631d3d862d433fa6a71f6a8af6e3e34083c065e1d8560294be84a8524adc9d0e152a508bf43d512fb26b1830ceef7da05da8066a

Download Submit
C:\Windows\System\rKbhilR.exe

Filesize
1.5MB

MD5
a90ecd69fa33b2615c14141ab1476fbd

SHA1
0b6587b29b6fe4e3b3304a8aba32b41de0280e29

SHA256
5116606a7368dda82dc195693f4302de84f5854d64bbb9bd8f16d869d40f0de6

SHA512
faead554e080dd3ca022e6e9610078899be0d94cc4689ee5a314064d11815716525032e1658079bd8b34fb224f221041dcb6015558422057bfcc20787501b0f8

Download Submit
C:\Windows\System\rOixfzr.exe

Filesize
1.5MB

MD5
5163acb99778fdfc5aecde1449693253

SHA1
14b32c41f6fa6acfe958abf2c17e0d009697b242

SHA256
879be298f20d145a5a56b784e85da78de16e08daa418955127b37c94e80929e5

SHA512
88f45342626f0f05b35e0d78f57969ae7d51330ef0c7a0c385d3250c6af35076b872218d4c57895c01b398792667a976005212412de47b212c9923a9eb73f917

Download Submit
C:\Windows\System\vPvtTjC.exe

Filesize
1.5MB

MD5
69331e8e44ed9fc1384e45043ccff628

SHA1
8360bb2d8f788755c8fb52a28808f27664304c45

SHA256
07dbef3b46a572c20381a9b328e30fba7dcfee8125dc3a42d312e9eaa8856261

SHA512
8189baea11951195010846939ca67ce23ed4a80c0163515b945558dc2bea13a1dee5b9525cc7dedff1d2ab5145c81a2f39d149717b4f929a41322d7981899b71

Download Submit
C:\Windows\System\vVXvoGw.exe

Filesize
1.5MB

MD5
86b7d573ad2259f4b070b8af6c8ee1f5

SHA1
2efcfba70636356bf22518c89642e59c6dc4fdd3

SHA256
d9aac032508d9ca3bec359f2519e76ab54a3cc0370d076b4aa0612c52e007e4e

SHA512
5bb617bd1a1af74cbd4a8acd7f1aaf2fa9c1f8a36b78b20c93bcfc8261fe35f8766d6e2d1de1ad68a99919b7b286d7ea3aa8933acda4e15ed6857701e2db8c1f

Download Submit
C:\Windows\System\yWMiAsm.exe

Filesize
1.5MB

MD5
7067a2dfd7f8c3e396094ba064f25d40

SHA1
6d62cdb53acb6329c06781d74ca1652159458916

SHA256
c004ff3c325a7c4a1c48b40bf21746114c7135c9da1a91d9bafb4d1f83ec442b

SHA512
54a7c123fe9f80336bf2d4c4c8c43a6c5b8f9239bafcb5d55203bece6995917733fbeb50ebeb49288a1ae330baa47c5016d35c140d3187558c6ff9069568fcc8

Download Submit
memory/972-95-0x00007FF65C0C0000-0x00007FF65C4B2000-memory.dmp

Filesize
3.9MB

Download
memory/972-2447-0x00007FF65C0C0000-0x00007FF65C4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1244-729-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/1244-716-0x00007FFFEF2C3000-0x00007FFFEF2C5000-memory.dmp

Filesize
8KB

Download
memory/1244-156-0x0000015EE9120000-0x0000015EE98C6000-memory.dmp

Filesize
7.6MB

Download
memory/1244-92-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/1244-72-0x0000015EE8500000-0x0000015EE8522000-memory.dmp

Filesize
136KB

Download
memory/1244-155-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/1244-16-0x00007FFFEF2C3000-0x00007FFFEF2C5000-memory.dmp

Filesize
8KB

Download
memory/1244-2415-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/1244-45-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/1328-94-0x00007FF7C75B0000-0x00007FF7C79A2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-2441-0x00007FF7C75B0000-0x00007FF7C79A2000-memory.dmp

Filesize
3.9MB

Download
memory/1492-14-0x00007FF61B360000-0x00007FF61B752000-memory.dmp

Filesize
3.9MB

Download
memory/1492-2443-0x00007FF61B360000-0x00007FF61B752000-memory.dmp

Filesize
3.9MB

Download
memory/1492-165-0x00007FF61B360000-0x00007FF61B752000-memory.dmp

Filesize
3.9MB

Download
memory/1960-100-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2457-0x00007FF7BEEE0000-0x00007FF7BF2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-104-0x00007FF6D0620000-0x00007FF6D0A12000-memory.dmp

Filesize
3.9MB

Download
memory/1964-2464-0x00007FF6D0620000-0x00007FF6D0A12000-memory.dmp

Filesize
3.9MB

Download
memory/2184-1504-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp

Filesize
3.9MB

Download
memory/2184-115-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp

Filesize
3.9MB

Download
memory/2184-2473-0x00007FF7F5990000-0x00007FF7F5D82000-memory.dmp

Filesize
3.9MB

Download
memory/2288-53-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp

Filesize
3.9MB

Download
memory/2288-2446-0x00007FF6D3180000-0x00007FF6D3572000-memory.dmp

Filesize
3.9MB

Download
memory/2356-105-0x00007FF69EB00000-0x00007FF69EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2462-0x00007FF69EB00000-0x00007FF69EEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-82-0x00007FF7FCBE0000-0x00007FF7FCFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2459-0x00007FF7FCBE0000-0x00007FF7FCFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-128-0x00007FF7BE090000-0x00007FF7BE482000-memory.dmp

Filesize
3.9MB

Download
memory/2380-2475-0x00007FF7BE090000-0x00007FF7BE482000-memory.dmp

Filesize
3.9MB

Download
memory/2592-107-0x00007FF608F50000-0x00007FF609342000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2469-0x00007FF608F50000-0x00007FF609342000-memory.dmp

Filesize
3.9MB

Download
memory/2612-2451-0x00007FF694B40000-0x00007FF694F32000-memory.dmp

Filesize
3.9MB

Download
memory/2612-77-0x00007FF694B40000-0x00007FF694F32000-memory.dmp

Filesize
3.9MB

Download
memory/2728-2450-0x00007FF7415A0000-0x00007FF741992000-memory.dmp

Filesize
3.9MB

Download
memory/2728-65-0x00007FF7415A0000-0x00007FF741992000-memory.dmp

Filesize
3.9MB

Download
memory/3396-2380-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp

Filesize
3.9MB

Download
memory/3396-2483-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp

Filesize
3.9MB

Download
memory/3396-138-0x00007FF7C3C00000-0x00007FF7C3FF2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-96-0x00007FF67EE90000-0x00007FF67F282000-memory.dmp

Filesize
3.9MB

Download
memory/3448-2454-0x00007FF67EE90000-0x00007FF67F282000-memory.dmp

Filesize
3.9MB

Download
memory/3528-2381-0x00007FF6B4A20000-0x00007FF6B4E12000-memory.dmp

Filesize
3.9MB

Download
memory/3528-147-0x00007FF6B4A20000-0x00007FF6B4E12000-memory.dmp

Filesize
3.9MB

Download
memory/3528-2479-0x00007FF6B4A20000-0x00007FF6B4E12000-memory.dmp

Filesize
3.9MB

Download
memory/3532-2468-0x00007FF7F8BC0000-0x00007FF7F8FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3532-110-0x00007FF7F8BC0000-0x00007FF7F8FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-148-0x00007FF7628D0000-0x00007FF762CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-2481-0x00007FF7628D0000-0x00007FF762CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-721-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-2465-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-86-0x00007FF7EFC00000-0x00007FF7EFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-2513-0x00007FF7C8470000-0x00007FF7C8862000-memory.dmp

Filesize
3.9MB

Download
memory/4512-172-0x00007FF7C8470000-0x00007FF7C8862000-memory.dmp

Filesize
3.9MB

Download
memory/4788-0-0x00007FF73CB90000-0x00007FF73CF82000-memory.dmp

Filesize
3.9MB

Download
memory/4788-1-0x000001DC91EF0000-0x000001DC91F00000-memory.dmp

Filesize
64KB

Download
memory/4788-152-0x00007FF73CB90000-0x00007FF73CF82000-memory.dmp

Filesize
3.9MB

Download
memory/4792-2406-0x00007FF6CA3F0000-0x00007FF6CA7E2000-memory.dmp

Filesize
3.9MB

Download
memory/4792-151-0x00007FF6CA3F0000-0x00007FF6CA7E2000-memory.dmp

Filesize
3.9MB

Download
memory/4792-2485-0x00007FF6CA3F0000-0x00007FF6CA7E2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-78-0x00007FF7CCA70000-0x00007FF7CCE62000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2456-0x00007FF7CCA70000-0x00007FF7CCE62000-memory.dmp

Filesize
3.9MB

Download
memory/4972-2379-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp

Filesize
3.9MB

Download
memory/4972-2477-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp

Filesize
3.9MB

Download
memory/4972-132-0x00007FF79ACA0000-0x00007FF79B092000-memory.dmp

Filesize
3.9MB

Download
memory/4980-2471-0x00007FF6FDA20000-0x00007FF6FDE12000-memory.dmp

Filesize
3.9MB

Download
memory/4980-123-0x00007FF6FDA20000-0x00007FF6FDE12000-memory.dmp

Filesize
3.9MB

Download