xmrig | 3c0333788346402a398dcd3f87af22f7770de59345551cc3f7dbfe754ee88ace

Analysis

max time kernel
123s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
Size

1.6MB
MD5

6fe27815a3c5c75754ad401ce88d7b30
SHA1

aeae9d35061b730c09ac3db342331588a57987ff
SHA256

3c0333788346402a398dcd3f87af22f7770de59345551cc3f7dbfe754ee88ace
SHA512

e61a98b5eac704d8f5e2d7f95f1dd0ea429d1cf8971e36bae5cdcdee230ba6023af64eac39f87a3570474cc8b3bdf02e3cb53db30353c894b543b9f17c7e2cbc
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8s1:Lz071uv4BPMkHC0IlnASEx/mi1DI8U

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3720-12-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp	xmrig
behavioral2/memory/3348-289-0x00007FF6645E0000-0x00007FF6649D2000-memory.dmp	xmrig
behavioral2/memory/5104-294-0x00007FF62AFE0000-0x00007FF62B3D2000-memory.dmp	xmrig
behavioral2/memory/1020-311-0x00007FF795330000-0x00007FF795722000-memory.dmp	xmrig
behavioral2/memory/1516-326-0x00007FF7674D0000-0x00007FF7678C2000-memory.dmp	xmrig
behavioral2/memory/1436-331-0x00007FF7C7C30000-0x00007FF7C8022000-memory.dmp	xmrig
behavioral2/memory/5076-345-0x00007FF6A11E0000-0x00007FF6A15D2000-memory.dmp	xmrig
behavioral2/memory/2896-346-0x00007FF754CC0000-0x00007FF7550B2000-memory.dmp	xmrig
behavioral2/memory/4028-348-0x00007FF7CD9D0000-0x00007FF7CDDC2000-memory.dmp	xmrig
behavioral2/memory/2156-349-0x00007FF6CC8C0000-0x00007FF6CCCB2000-memory.dmp	xmrig
behavioral2/memory/1348-347-0x00007FF607830000-0x00007FF607C22000-memory.dmp	xmrig
behavioral2/memory/5092-344-0x00007FF6E18A0000-0x00007FF6E1C92000-memory.dmp	xmrig
behavioral2/memory/4692-321-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	xmrig
behavioral2/memory/4260-317-0x00007FF7B2020000-0x00007FF7B2412000-memory.dmp	xmrig
behavioral2/memory/4480-308-0x00007FF704580000-0x00007FF704972000-memory.dmp	xmrig
behavioral2/memory/4244-305-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp	xmrig
behavioral2/memory/3308-302-0x00007FF79FCC0000-0x00007FF7A00B2000-memory.dmp	xmrig
behavioral2/memory/1260-295-0x00007FF709010000-0x00007FF709402000-memory.dmp	xmrig
behavioral2/memory/1236-293-0x00007FF7BEDB0000-0x00007FF7BF1A2000-memory.dmp	xmrig
behavioral2/memory/2744-288-0x00007FF6F4100000-0x00007FF6F44F2000-memory.dmp	xmrig
behavioral2/memory/1352-66-0x00007FF70B2C0000-0x00007FF70B6B2000-memory.dmp	xmrig
behavioral2/memory/3468-61-0x00007FF7030D0000-0x00007FF7034C2000-memory.dmp	xmrig
behavioral2/memory/1388-40-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	xmrig
behavioral2/memory/3720-1997-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp	xmrig
behavioral2/memory/544-1998-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp	xmrig
behavioral2/memory/3720-2032-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp	xmrig
behavioral2/memory/1388-2034-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	xmrig
behavioral2/memory/3468-2036-0x00007FF7030D0000-0x00007FF7034C2000-memory.dmp	xmrig
behavioral2/memory/2896-2038-0x00007FF754CC0000-0x00007FF7550B2000-memory.dmp	xmrig
behavioral2/memory/544-2040-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp	xmrig
behavioral2/memory/1352-2044-0x00007FF70B2C0000-0x00007FF70B6B2000-memory.dmp	xmrig
behavioral2/memory/2744-2043-0x00007FF6F4100000-0x00007FF6F44F2000-memory.dmp	xmrig
behavioral2/memory/3348-2049-0x00007FF6645E0000-0x00007FF6649D2000-memory.dmp	xmrig
behavioral2/memory/2156-2052-0x00007FF6CC8C0000-0x00007FF6CCCB2000-memory.dmp	xmrig
behavioral2/memory/4028-2051-0x00007FF7CD9D0000-0x00007FF7CDDC2000-memory.dmp	xmrig
behavioral2/memory/1348-2046-0x00007FF607830000-0x00007FF607C22000-memory.dmp	xmrig
behavioral2/memory/1020-2058-0x00007FF795330000-0x00007FF795722000-memory.dmp	xmrig
behavioral2/memory/1236-2057-0x00007FF7BEDB0000-0x00007FF7BF1A2000-memory.dmp	xmrig
behavioral2/memory/3308-2066-0x00007FF79FCC0000-0x00007FF7A00B2000-memory.dmp	xmrig
behavioral2/memory/4692-2068-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	xmrig
behavioral2/memory/1516-2072-0x00007FF7674D0000-0x00007FF7678C2000-memory.dmp	xmrig
behavioral2/memory/1436-2074-0x00007FF7C7C30000-0x00007FF7C8022000-memory.dmp	xmrig
behavioral2/memory/4260-2070-0x00007FF7B2020000-0x00007FF7B2412000-memory.dmp	xmrig
behavioral2/memory/4244-2065-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp	xmrig
behavioral2/memory/4480-2062-0x00007FF704580000-0x00007FF704972000-memory.dmp	xmrig
behavioral2/memory/1260-2060-0x00007FF709010000-0x00007FF709402000-memory.dmp	xmrig
behavioral2/memory/5104-2055-0x00007FF62AFE0000-0x00007FF62B3D2000-memory.dmp	xmrig
behavioral2/memory/5076-2084-0x00007FF6A11E0000-0x00007FF6A15D2000-memory.dmp	xmrig
behavioral2/memory/5092-2093-0x00007FF6E18A0000-0x00007FF6E1C92000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	3548	powershell.exe
10	3548	powershell.exe
26	3548	powershell.exe
27	3548	powershell.exe
28	3548	powershell.exe
29	3548	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3548	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3720	cApFhyr.exe
1388	XhuqXPH.exe
544	BFitlEo.exe
3468	eBKqVnI.exe
2896	GnGYgXb.exe
1348	OXvuLJo.exe
1352	psfyaIj.exe
2744	tdtBvqN.exe
4028	wjXyncl.exe
2156	MlpAKkM.exe
3348	WByhujQ.exe
1236	yRMIFWp.exe
5104	NfRrGmy.exe
1260	vLtkkFy.exe
3308	zfEjqWJ.exe
4244	WtwyHaB.exe
4480	cfYzwfz.exe
1020	BnHxMpj.exe
4260	ipeQwBw.exe
4692	saqopXd.exe
1516	fiQlaHS.exe
1436	CSyWqaa.exe
5092	npuJixC.exe
5076	BfvrrLU.exe
1608	yFgUcwz.exe
1028	MekYULY.exe
4800	Ocgqfia.exe
4568	wXfSdZg.exe
3388	OsisTmD.exe
2792	IiEriZa.exe
2992	sEvuQwi.exe
3332	PrMXQKS.exe
4832	torpHbu.exe
4192	boHPuyw.exe
4512	qaoxMQF.exe
3368	vjYOvJs.exe
3356	NKQIEeJ.exe
4616	TaGehtG.exe
232	GwYMehC.exe
1756	jEKNiWi.exe
5008	dAFDouS.exe
3928	bgEbMuv.exe
1120	NJIXsGq.exe
4252	QbguyCF.exe
1424	tNepbBP.exe
856	hlfPsLq.exe
760	ayXBjjp.exe
2756	YEKNxAc.exe
2768	fdPHvlo.exe
404	mCzjYQv.exe
4076	gHaKlZx.exe
4440	IHuCtOY.exe
1604	PTwcCqj.exe
4080	SPqzBfO.exe
4708	CBRLbRp.exe
3184	cXuViaA.exe
1828	RuFHsnh.exe
5032	ayZIBrR.exe
664	ZNXlQpi.exe
4392	uUTRSHZ.exe
1488	ETdfxfE.exe
2604	wJXpMzM.exe
424	lajNCZs.exe
464	RbIILzf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3360-0-0x00007FF661970000-0x00007FF661D62000-memory.dmp	upx
behavioral2/files/0x000800000002342f-5.dat	upx
behavioral2/files/0x0007000000023434-8.dat	upx
behavioral2/memory/3720-12-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp	upx
behavioral2/files/0x0007000000023433-11.dat	upx
behavioral2/files/0x0007000000023435-22.dat	upx
behavioral2/files/0x0007000000023437-48.dat	upx
behavioral2/files/0x000700000002343a-51.dat	upx
behavioral2/files/0x000700000002343b-59.dat	upx
behavioral2/files/0x000700000002343c-72.dat	upx
behavioral2/files/0x0008000000023438-74.dat	upx
behavioral2/files/0x000700000002343d-78.dat	upx
behavioral2/files/0x0007000000023440-91.dat	upx
behavioral2/files/0x0007000000023441-96.dat	upx
behavioral2/files/0x0007000000023442-109.dat	upx
behavioral2/files/0x0007000000023445-116.dat	upx
behavioral2/files/0x0007000000023449-144.dat	upx
behavioral2/files/0x000700000002344b-154.dat	upx
behavioral2/files/0x0007000000023450-171.dat	upx
behavioral2/files/0x0007000000023452-181.dat	upx
behavioral2/memory/3348-289-0x00007FF6645E0000-0x00007FF6649D2000-memory.dmp	upx
behavioral2/memory/5104-294-0x00007FF62AFE0000-0x00007FF62B3D2000-memory.dmp	upx
behavioral2/memory/1020-311-0x00007FF795330000-0x00007FF795722000-memory.dmp	upx
behavioral2/memory/1516-326-0x00007FF7674D0000-0x00007FF7678C2000-memory.dmp	upx
behavioral2/memory/1436-331-0x00007FF7C7C30000-0x00007FF7C8022000-memory.dmp	upx
behavioral2/memory/5076-345-0x00007FF6A11E0000-0x00007FF6A15D2000-memory.dmp	upx
behavioral2/memory/2896-346-0x00007FF754CC0000-0x00007FF7550B2000-memory.dmp	upx
behavioral2/memory/4028-348-0x00007FF7CD9D0000-0x00007FF7CDDC2000-memory.dmp	upx
behavioral2/memory/2156-349-0x00007FF6CC8C0000-0x00007FF6CCCB2000-memory.dmp	upx
behavioral2/memory/1348-347-0x00007FF607830000-0x00007FF607C22000-memory.dmp	upx
behavioral2/memory/5092-344-0x00007FF6E18A0000-0x00007FF6E1C92000-memory.dmp	upx
behavioral2/memory/4692-321-0x00007FF658A80000-0x00007FF658E72000-memory.dmp	upx
behavioral2/memory/4260-317-0x00007FF7B2020000-0x00007FF7B2412000-memory.dmp	upx
behavioral2/memory/4480-308-0x00007FF704580000-0x00007FF704972000-memory.dmp	upx
behavioral2/memory/4244-305-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp	upx
behavioral2/memory/3308-302-0x00007FF79FCC0000-0x00007FF7A00B2000-memory.dmp	upx
behavioral2/memory/1260-295-0x00007FF709010000-0x00007FF709402000-memory.dmp	upx
behavioral2/memory/1236-293-0x00007FF7BEDB0000-0x00007FF7BF1A2000-memory.dmp	upx
behavioral2/memory/2744-288-0x00007FF6F4100000-0x00007FF6F44F2000-memory.dmp	upx
behavioral2/files/0x0007000000023451-176.dat	upx
behavioral2/files/0x000700000002344f-174.dat	upx
behavioral2/files/0x000700000002344e-169.dat	upx
behavioral2/files/0x000700000002344d-164.dat	upx
behavioral2/files/0x000700000002344c-159.dat	upx
behavioral2/files/0x000700000002344a-149.dat	upx
behavioral2/files/0x0007000000023448-139.dat	upx
behavioral2/files/0x0007000000023447-134.dat	upx
behavioral2/files/0x0007000000023446-129.dat	upx
behavioral2/files/0x0007000000023444-119.dat	upx
behavioral2/files/0x0007000000023443-114.dat	upx
behavioral2/files/0x000700000002343f-94.dat	upx
behavioral2/files/0x000700000002343e-86.dat	upx
behavioral2/memory/1352-66-0x00007FF70B2C0000-0x00007FF70B6B2000-memory.dmp	upx
behavioral2/memory/3468-61-0x00007FF7030D0000-0x00007FF7034C2000-memory.dmp	upx
behavioral2/files/0x0008000000023439-52.dat	upx
behavioral2/memory/1388-40-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	upx
behavioral2/files/0x0007000000023436-39.dat	upx
behavioral2/memory/544-28-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp	upx
behavioral2/memory/3720-1997-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp	upx
behavioral2/memory/544-1998-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp	upx
behavioral2/memory/3720-2032-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp	upx
behavioral2/memory/1388-2034-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	upx
behavioral2/memory/3468-2036-0x00007FF7030D0000-0x00007FF7034C2000-memory.dmp	upx
behavioral2/memory/2896-2038-0x00007FF754CC0000-0x00007FF7550B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bPyXPUg.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\rTtTKWR.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\CZblpyE.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\yJkPgnh.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\XrQuhpX.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\WcyMItF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\sVfuJQx.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\MzlzKiW.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ZOwtzWf.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\OOBbEjI.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\wXfSdZg.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\BPuvLVz.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\tdtBvqN.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\AdqnHUT.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\zGXiGmG.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\mKQnkKt.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\YuUsjgF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\KwTDxrv.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xwqdWRS.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\PiuSWex.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\sHRHvki.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\qPfzwrj.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\fLLGsrk.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\YEKNxAc.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\tpdjSCF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\RSjMqlF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\OJnPwiE.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\HXaERxV.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\igyGgNt.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\MtMomKO.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\RRKZddj.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\NKQIEeJ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\sevcxPU.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\LEsjaTg.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\jDHjvKk.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ZaClaqJ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\VekWCFt.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\rfeoAOy.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\EncsafX.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xXNyLZD.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\WzGRQxJ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\UqpTfNZ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\OdAibYS.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\eJfkwGm.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\KQlnldQ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ajVouxF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\uxmIJeR.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\OIhUtYM.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\hlpRCXx.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\djkpjPe.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\gPEWMBq.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\RbIILzf.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\IMJkGAz.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\YNUhdCB.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\fPxXiKD.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\FmAssxS.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\GRZgHLV.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\MTGqRAp.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\MuyBRvu.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\eIFDSjW.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xDiAiKT.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\eloVyIo.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\INWLDUH.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\qfZLlKi.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3548	powershell.exe
3548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
Token: SeDebugPrivilege	3548	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 3548	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	84
PID 3360 wrote to memory of 3548	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	84
PID 3360 wrote to memory of 3720	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	85
PID 3360 wrote to memory of 3720	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	85
PID 3360 wrote to memory of 1388	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	86
PID 3360 wrote to memory of 1388	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	86
PID 3360 wrote to memory of 544	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	87
PID 3360 wrote to memory of 544	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	87
PID 3360 wrote to memory of 3468	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	88
PID 3360 wrote to memory of 3468	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	88
PID 3360 wrote to memory of 2896	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	89
PID 3360 wrote to memory of 2896	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	89
PID 3360 wrote to memory of 1348	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	90
PID 3360 wrote to memory of 1348	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	90
PID 3360 wrote to memory of 1352	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	91
PID 3360 wrote to memory of 1352	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	91
PID 3360 wrote to memory of 2744	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	92
PID 3360 wrote to memory of 2744	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	92
PID 3360 wrote to memory of 4028	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	93
PID 3360 wrote to memory of 4028	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	93
PID 3360 wrote to memory of 2156	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	94
PID 3360 wrote to memory of 2156	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	94
PID 3360 wrote to memory of 3348	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	95
PID 3360 wrote to memory of 3348	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	95
PID 3360 wrote to memory of 1236	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	96
PID 3360 wrote to memory of 1236	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	96
PID 3360 wrote to memory of 5104	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	97
PID 3360 wrote to memory of 5104	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	97
PID 3360 wrote to memory of 1260	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	98
PID 3360 wrote to memory of 1260	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	98
PID 3360 wrote to memory of 3308	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	99
PID 3360 wrote to memory of 3308	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	99
PID 3360 wrote to memory of 4244	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	100
PID 3360 wrote to memory of 4244	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	100
PID 3360 wrote to memory of 4480	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	101
PID 3360 wrote to memory of 4480	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	101
PID 3360 wrote to memory of 1020	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	102
PID 3360 wrote to memory of 1020	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	102
PID 3360 wrote to memory of 4260	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	103
PID 3360 wrote to memory of 4260	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	103
PID 3360 wrote to memory of 4692	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	104
PID 3360 wrote to memory of 4692	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	104
PID 3360 wrote to memory of 1516	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	105
PID 3360 wrote to memory of 1516	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	105
PID 3360 wrote to memory of 1436	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	106
PID 3360 wrote to memory of 1436	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	106
PID 3360 wrote to memory of 5092	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	107
PID 3360 wrote to memory of 5092	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	107
PID 3360 wrote to memory of 5076	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	108
PID 3360 wrote to memory of 5076	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	108
PID 3360 wrote to memory of 1608	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	109
PID 3360 wrote to memory of 1608	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	109
PID 3360 wrote to memory of 1028	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	110
PID 3360 wrote to memory of 1028	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	110
PID 3360 wrote to memory of 4800	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	111
PID 3360 wrote to memory of 4800	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	111
PID 3360 wrote to memory of 4568	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	112
PID 3360 wrote to memory of 4568	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	112
PID 3360 wrote to memory of 3388	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	113
PID 3360 wrote to memory of 3388	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	113
PID 3360 wrote to memory of 2792	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	114
PID 3360 wrote to memory of 2792	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	114
PID 3360 wrote to memory of 2992	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	115
PID 3360 wrote to memory of 2992	3360	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\System\cApFhyr.exe
  C:\Windows\System\cApFhyr.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\XhuqXPH.exe
  C:\Windows\System\XhuqXPH.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\BFitlEo.exe
  C:\Windows\System\BFitlEo.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\eBKqVnI.exe
  C:\Windows\System\eBKqVnI.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\GnGYgXb.exe
  C:\Windows\System\GnGYgXb.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\OXvuLJo.exe
  C:\Windows\System\OXvuLJo.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\psfyaIj.exe
  C:\Windows\System\psfyaIj.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\tdtBvqN.exe
  C:\Windows\System\tdtBvqN.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\wjXyncl.exe
  C:\Windows\System\wjXyncl.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\MlpAKkM.exe
  C:\Windows\System\MlpAKkM.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\WByhujQ.exe
  C:\Windows\System\WByhujQ.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\yRMIFWp.exe
  C:\Windows\System\yRMIFWp.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\NfRrGmy.exe
  C:\Windows\System\NfRrGmy.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\vLtkkFy.exe
  C:\Windows\System\vLtkkFy.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\zfEjqWJ.exe
  C:\Windows\System\zfEjqWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\WtwyHaB.exe
  C:\Windows\System\WtwyHaB.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\cfYzwfz.exe
  C:\Windows\System\cfYzwfz.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\BnHxMpj.exe
  C:\Windows\System\BnHxMpj.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\ipeQwBw.exe
  C:\Windows\System\ipeQwBw.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\saqopXd.exe
  C:\Windows\System\saqopXd.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\fiQlaHS.exe
  C:\Windows\System\fiQlaHS.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\CSyWqaa.exe
  C:\Windows\System\CSyWqaa.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\npuJixC.exe
  C:\Windows\System\npuJixC.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\BfvrrLU.exe
  C:\Windows\System\BfvrrLU.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\yFgUcwz.exe
  C:\Windows\System\yFgUcwz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\MekYULY.exe
  C:\Windows\System\MekYULY.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\Ocgqfia.exe
  C:\Windows\System\Ocgqfia.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\wXfSdZg.exe
  C:\Windows\System\wXfSdZg.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\OsisTmD.exe
  C:\Windows\System\OsisTmD.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\IiEriZa.exe
  C:\Windows\System\IiEriZa.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\sEvuQwi.exe
  C:\Windows\System\sEvuQwi.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\PrMXQKS.exe
  C:\Windows\System\PrMXQKS.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\torpHbu.exe
  C:\Windows\System\torpHbu.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\boHPuyw.exe
  C:\Windows\System\boHPuyw.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\qaoxMQF.exe
  C:\Windows\System\qaoxMQF.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\vjYOvJs.exe
  C:\Windows\System\vjYOvJs.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\NKQIEeJ.exe
  C:\Windows\System\NKQIEeJ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\TaGehtG.exe
  C:\Windows\System\TaGehtG.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\GwYMehC.exe
  C:\Windows\System\GwYMehC.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\jEKNiWi.exe
  C:\Windows\System\jEKNiWi.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\dAFDouS.exe
  C:\Windows\System\dAFDouS.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\bgEbMuv.exe
  C:\Windows\System\bgEbMuv.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\NJIXsGq.exe
  C:\Windows\System\NJIXsGq.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\QbguyCF.exe
  C:\Windows\System\QbguyCF.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\tNepbBP.exe
  C:\Windows\System\tNepbBP.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\hlfPsLq.exe
  C:\Windows\System\hlfPsLq.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ayXBjjp.exe
  C:\Windows\System\ayXBjjp.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\YEKNxAc.exe
  C:\Windows\System\YEKNxAc.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\fdPHvlo.exe
  C:\Windows\System\fdPHvlo.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\mCzjYQv.exe
  C:\Windows\System\mCzjYQv.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\gHaKlZx.exe
  C:\Windows\System\gHaKlZx.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\IHuCtOY.exe
  C:\Windows\System\IHuCtOY.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\PTwcCqj.exe
  C:\Windows\System\PTwcCqj.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\SPqzBfO.exe
  C:\Windows\System\SPqzBfO.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\CBRLbRp.exe
  C:\Windows\System\CBRLbRp.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\cXuViaA.exe
  C:\Windows\System\cXuViaA.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\RuFHsnh.exe
  C:\Windows\System\RuFHsnh.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\ayZIBrR.exe
  C:\Windows\System\ayZIBrR.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ZNXlQpi.exe
  C:\Windows\System\ZNXlQpi.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\uUTRSHZ.exe
  C:\Windows\System\uUTRSHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\ETdfxfE.exe
  C:\Windows\System\ETdfxfE.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\wJXpMzM.exe
  C:\Windows\System\wJXpMzM.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\lajNCZs.exe
  C:\Windows\System\lajNCZs.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\RbIILzf.exe
  C:\Windows\System\RbIILzf.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\imAPhuC.exe
  C:\Windows\System\imAPhuC.exe
  2⤵
  PID:4472
- C:\Windows\System\CUavAxU.exe
  C:\Windows\System\CUavAxU.exe
  2⤵
  PID:4904
- C:\Windows\System\tJywlad.exe
  C:\Windows\System\tJywlad.exe
  2⤵
  PID:4944
- C:\Windows\System\IfxtVtB.exe
  C:\Windows\System\IfxtVtB.exe
  2⤵
  PID:552
- C:\Windows\System\CuGXlni.exe
  C:\Windows\System\CuGXlni.exe
  2⤵
  PID:2436
- C:\Windows\System\FustmMt.exe
  C:\Windows\System\FustmMt.exe
  2⤵
  PID:2504
- C:\Windows\System\iwAcIwP.exe
  C:\Windows\System\iwAcIwP.exe
  2⤵
  PID:4900
- C:\Windows\System\afSjoDU.exe
  C:\Windows\System\afSjoDU.exe
  2⤵
  PID:4016
- C:\Windows\System\RFuxNbl.exe
  C:\Windows\System\RFuxNbl.exe
  2⤵
  PID:3420
- C:\Windows\System\GGCewDP.exe
  C:\Windows\System\GGCewDP.exe
  2⤵
  PID:3248
- C:\Windows\System\PdTPLHj.exe
  C:\Windows\System\PdTPLHj.exe
  2⤵
  PID:4736
- C:\Windows\System\aFTmuEu.exe
  C:\Windows\System\aFTmuEu.exe
  2⤵
  PID:1224
- C:\Windows\System\tpdjSCF.exe
  C:\Windows\System\tpdjSCF.exe
  2⤵
  PID:5140
- C:\Windows\System\UexmslE.exe
  C:\Windows\System\UexmslE.exe
  2⤵
  PID:5160
- C:\Windows\System\kcnDILw.exe
  C:\Windows\System\kcnDILw.exe
  2⤵
  PID:5180
- C:\Windows\System\Tprsecb.exe
  C:\Windows\System\Tprsecb.exe
  2⤵
  PID:5208
- C:\Windows\System\gPvEUKN.exe
  C:\Windows\System\gPvEUKN.exe
  2⤵
  PID:5228
- C:\Windows\System\twembTZ.exe
  C:\Windows\System\twembTZ.exe
  2⤵
  PID:5244
- C:\Windows\System\EGyppBI.exe
  C:\Windows\System\EGyppBI.exe
  2⤵
  PID:5264
- C:\Windows\System\aBQBvOu.exe
  C:\Windows\System\aBQBvOu.exe
  2⤵
  PID:5284
- C:\Windows\System\eTuHtFs.exe
  C:\Windows\System\eTuHtFs.exe
  2⤵
  PID:5312
- C:\Windows\System\YEndCFa.exe
  C:\Windows\System\YEndCFa.exe
  2⤵
  PID:5424
- C:\Windows\System\XgcwVpG.exe
  C:\Windows\System\XgcwVpG.exe
  2⤵
  PID:5480
- C:\Windows\System\GlHmDkr.exe
  C:\Windows\System\GlHmDkr.exe
  2⤵
  PID:5508
- C:\Windows\System\HjQHGPj.exe
  C:\Windows\System\HjQHGPj.exe
  2⤵
  PID:5536
- C:\Windows\System\rTtTKWR.exe
  C:\Windows\System\rTtTKWR.exe
  2⤵
  PID:5564
- C:\Windows\System\dMgNwnz.exe
  C:\Windows\System\dMgNwnz.exe
  2⤵
  PID:5600
- C:\Windows\System\TPTVzXM.exe
  C:\Windows\System\TPTVzXM.exe
  2⤵
  PID:5636
- C:\Windows\System\LRUkaKT.exe
  C:\Windows\System\LRUkaKT.exe
  2⤵
  PID:5672
- C:\Windows\System\YQVuweL.exe
  C:\Windows\System\YQVuweL.exe
  2⤵
  PID:5696
- C:\Windows\System\AdqnHUT.exe
  C:\Windows\System\AdqnHUT.exe
  2⤵
  PID:5716
- C:\Windows\System\idNpmmA.exe
  C:\Windows\System\idNpmmA.exe
  2⤵
  PID:5736
- C:\Windows\System\BtIodgk.exe
  C:\Windows\System\BtIodgk.exe
  2⤵
  PID:5752
- C:\Windows\System\hGjLjup.exe
  C:\Windows\System\hGjLjup.exe
  2⤵
  PID:5776
- C:\Windows\System\ovuLsDW.exe
  C:\Windows\System\ovuLsDW.exe
  2⤵
  PID:5812
- C:\Windows\System\eZdImjI.exe
  C:\Windows\System\eZdImjI.exe
  2⤵
  PID:5832
- C:\Windows\System\ajVouxF.exe
  C:\Windows\System\ajVouxF.exe
  2⤵
  PID:5856
- C:\Windows\System\ctlvyFy.exe
  C:\Windows\System\ctlvyFy.exe
  2⤵
  PID:5872
- C:\Windows\System\eZOWlIw.exe
  C:\Windows\System\eZOWlIw.exe
  2⤵
  PID:5920
- C:\Windows\System\XeKGnRs.exe
  C:\Windows\System\XeKGnRs.exe
  2⤵
  PID:5948
- C:\Windows\System\OAwqCjX.exe
  C:\Windows\System\OAwqCjX.exe
  2⤵
  PID:5964
- C:\Windows\System\tDPWYcM.exe
  C:\Windows\System\tDPWYcM.exe
  2⤵
  PID:6048
- C:\Windows\System\bPKdaeL.exe
  C:\Windows\System\bPKdaeL.exe
  2⤵
  PID:6072
- C:\Windows\System\swPcYbj.exe
  C:\Windows\System\swPcYbj.exe
  2⤵
  PID:6092
- C:\Windows\System\AnBELvm.exe
  C:\Windows\System\AnBELvm.exe
  2⤵
  PID:6112
- C:\Windows\System\CZblpyE.exe
  C:\Windows\System\CZblpyE.exe
  2⤵
  PID:6132
- C:\Windows\System\lThLDnX.exe
  C:\Windows\System\lThLDnX.exe
  2⤵
  PID:4908
- C:\Windows\System\tKnAvxM.exe
  C:\Windows\System\tKnAvxM.exe
  2⤵
  PID:4060
- C:\Windows\System\lVoCikp.exe
  C:\Windows\System\lVoCikp.exe
  2⤵
  PID:5128
- C:\Windows\System\VIFXTLF.exe
  C:\Windows\System\VIFXTLF.exe
  2⤵
  PID:5176
- C:\Windows\System\wZiWted.exe
  C:\Windows\System\wZiWted.exe
  2⤵
  PID:5272
- C:\Windows\System\kGiOaqQ.exe
  C:\Windows\System\kGiOaqQ.exe
  2⤵
  PID:5308
- C:\Windows\System\uaHajDv.exe
  C:\Windows\System\uaHajDv.exe
  2⤵
  PID:2416
- C:\Windows\System\kZFDfmh.exe
  C:\Windows\System\kZFDfmh.exe
  2⤵
  PID:1156
- C:\Windows\System\eiriPEW.exe
  C:\Windows\System\eiriPEW.exe
  2⤵
  PID:5096
- C:\Windows\System\YwleGlb.exe
  C:\Windows\System\YwleGlb.exe
  2⤵
  PID:1720
- C:\Windows\System\lBtCfUm.exe
  C:\Windows\System\lBtCfUm.exe
  2⤵
  PID:5404
- C:\Windows\System\uxmIJeR.exe
  C:\Windows\System\uxmIJeR.exe
  2⤵
  PID:5440
- C:\Windows\System\EHwZmpd.exe
  C:\Windows\System\EHwZmpd.exe
  2⤵
  PID:5532
- C:\Windows\System\hRmItPu.exe
  C:\Windows\System\hRmItPu.exe
  2⤵
  PID:5556
- C:\Windows\System\rkymUxg.exe
  C:\Windows\System\rkymUxg.exe
  2⤵
  PID:5608
- C:\Windows\System\MtMomKO.exe
  C:\Windows\System\MtMomKO.exe
  2⤵
  PID:5664
- C:\Windows\System\OKswntB.exe
  C:\Windows\System\OKswntB.exe
  2⤵
  PID:5732
- C:\Windows\System\KIWjeDU.exe
  C:\Windows\System\KIWjeDU.exe
  2⤵
  PID:5764
- C:\Windows\System\sevcxPU.exe
  C:\Windows\System\sevcxPU.exe
  2⤵
  PID:5844
- C:\Windows\System\DLxBoRi.exe
  C:\Windows\System\DLxBoRi.exe
  2⤵
  PID:5824
- C:\Windows\System\BWYZcze.exe
  C:\Windows\System\BWYZcze.exe
  2⤵
  PID:5960
- C:\Windows\System\eloVyIo.exe
  C:\Windows\System\eloVyIo.exe
  2⤵
  PID:6020
- C:\Windows\System\TxFnxpY.exe
  C:\Windows\System\TxFnxpY.exe
  2⤵
  PID:6064
- C:\Windows\System\ztFLiIl.exe
  C:\Windows\System\ztFLiIl.exe
  2⤵
  PID:6104
- C:\Windows\System\eySCzNJ.exe
  C:\Windows\System\eySCzNJ.exe
  2⤵
  PID:5200
- C:\Windows\System\IWxPFkK.exe
  C:\Windows\System\IWxPFkK.exe
  2⤵
  PID:5300
- C:\Windows\System\OxtrHOk.exe
  C:\Windows\System\OxtrHOk.exe
  2⤵
  PID:2104
- C:\Windows\System\pnVFKcH.exe
  C:\Windows\System\pnVFKcH.exe
  2⤵
  PID:5584
- C:\Windows\System\RCBCnWK.exe
  C:\Windows\System\RCBCnWK.exe
  2⤵
  PID:5828
- C:\Windows\System\ZUpTMbd.exe
  C:\Windows\System\ZUpTMbd.exe
  2⤵
  PID:5808
- C:\Windows\System\WriweCA.exe
  C:\Windows\System\WriweCA.exe
  2⤵
  PID:6088
- C:\Windows\System\EncsafX.exe
  C:\Windows\System\EncsafX.exe
  2⤵
  PID:5188
- C:\Windows\System\tZjcXUp.exe
  C:\Windows\System\tZjcXUp.exe
  2⤵
  PID:5476
- C:\Windows\System\YGRVBNB.exe
  C:\Windows\System\YGRVBNB.exe
  2⤵
  PID:5840
- C:\Windows\System\MfKllDd.exe
  C:\Windows\System\MfKllDd.exe
  2⤵
  PID:5980
- C:\Windows\System\mPbVDkr.exe
  C:\Windows\System\mPbVDkr.exe
  2⤵
  PID:5496
- C:\Windows\System\OIhUtYM.exe
  C:\Windows\System\OIhUtYM.exe
  2⤵
  PID:864
- C:\Windows\System\MzlzKiW.exe
  C:\Windows\System\MzlzKiW.exe
  2⤵
  PID:6160
- C:\Windows\System\zYGKzqn.exe
  C:\Windows\System\zYGKzqn.exe
  2⤵
  PID:6192
- C:\Windows\System\YhAnmsc.exe
  C:\Windows\System\YhAnmsc.exe
  2⤵
  PID:6212
- C:\Windows\System\WqfHOus.exe
  C:\Windows\System\WqfHOus.exe
  2⤵
  PID:6236
- C:\Windows\System\pGxSmQz.exe
  C:\Windows\System\pGxSmQz.exe
  2⤵
  PID:6256
- C:\Windows\System\mDoKCfF.exe
  C:\Windows\System\mDoKCfF.exe
  2⤵
  PID:6276
- C:\Windows\System\nIAEEUT.exe
  C:\Windows\System\nIAEEUT.exe
  2⤵
  PID:6296
- C:\Windows\System\IVipTTQ.exe
  C:\Windows\System\IVipTTQ.exe
  2⤵
  PID:6356
- C:\Windows\System\VWCrSij.exe
  C:\Windows\System\VWCrSij.exe
  2⤵
  PID:6372
- C:\Windows\System\FiUaJVz.exe
  C:\Windows\System\FiUaJVz.exe
  2⤵
  PID:6392
- C:\Windows\System\vNqpbwe.exe
  C:\Windows\System\vNqpbwe.exe
  2⤵
  PID:6436
- C:\Windows\System\OYhbWcD.exe
  C:\Windows\System\OYhbWcD.exe
  2⤵
  PID:6472
- C:\Windows\System\LsQkTRq.exe
  C:\Windows\System\LsQkTRq.exe
  2⤵
  PID:6508
- C:\Windows\System\xFZbkxp.exe
  C:\Windows\System\xFZbkxp.exe
  2⤵
  PID:6528
- C:\Windows\System\xqcgbAG.exe
  C:\Windows\System\xqcgbAG.exe
  2⤵
  PID:6572
- C:\Windows\System\XAwCOKX.exe
  C:\Windows\System\XAwCOKX.exe
  2⤵
  PID:6596
- C:\Windows\System\xiPRhrl.exe
  C:\Windows\System\xiPRhrl.exe
  2⤵
  PID:6628
- C:\Windows\System\DkkJwua.exe
  C:\Windows\System\DkkJwua.exe
  2⤵
  PID:6648
- C:\Windows\System\EuobqZl.exe
  C:\Windows\System\EuobqZl.exe
  2⤵
  PID:6668
- C:\Windows\System\ycYMcTf.exe
  C:\Windows\System\ycYMcTf.exe
  2⤵
  PID:6708
- C:\Windows\System\PeYNHXu.exe
  C:\Windows\System\PeYNHXu.exe
  2⤵
  PID:6736
- C:\Windows\System\HRGrhlf.exe
  C:\Windows\System\HRGrhlf.exe
  2⤵
  PID:6760
- C:\Windows\System\wnrGLsy.exe
  C:\Windows\System\wnrGLsy.exe
  2⤵
  PID:6780
- C:\Windows\System\dCldIhk.exe
  C:\Windows\System\dCldIhk.exe
  2⤵
  PID:6800
- C:\Windows\System\vRlNnYb.exe
  C:\Windows\System\vRlNnYb.exe
  2⤵
  PID:6828
- C:\Windows\System\gWRcHzh.exe
  C:\Windows\System\gWRcHzh.exe
  2⤵
  PID:6844
- C:\Windows\System\BkubPql.exe
  C:\Windows\System\BkubPql.exe
  2⤵
  PID:6892
- C:\Windows\System\XyWGVpH.exe
  C:\Windows\System\XyWGVpH.exe
  2⤵
  PID:6912
- C:\Windows\System\stSRbMI.exe
  C:\Windows\System\stSRbMI.exe
  2⤵
  PID:6940
- C:\Windows\System\aYmNtJw.exe
  C:\Windows\System\aYmNtJw.exe
  2⤵
  PID:6976
- C:\Windows\System\ESJEOpn.exe
  C:\Windows\System\ESJEOpn.exe
  2⤵
  PID:7004
- C:\Windows\System\qTYAYKt.exe
  C:\Windows\System\qTYAYKt.exe
  2⤵
  PID:7036
- C:\Windows\System\GMthXDj.exe
  C:\Windows\System\GMthXDj.exe
  2⤵
  PID:7056
- C:\Windows\System\bGzXmEr.exe
  C:\Windows\System\bGzXmEr.exe
  2⤵
  PID:7084
- C:\Windows\System\ClMjTCW.exe
  C:\Windows\System\ClMjTCW.exe
  2⤵
  PID:7100
- C:\Windows\System\cNacUTt.exe
  C:\Windows\System\cNacUTt.exe
  2⤵
  PID:7124
- C:\Windows\System\pPqhwmS.exe
  C:\Windows\System\pPqhwmS.exe
  2⤵
  PID:7144
- C:\Windows\System\MSZVneJ.exe
  C:\Windows\System\MSZVneJ.exe
  2⤵
  PID:5932
- C:\Windows\System\yhuirLU.exe
  C:\Windows\System\yhuirLU.exe
  2⤵
  PID:6184
- C:\Windows\System\MSrqbsw.exe
  C:\Windows\System\MSrqbsw.exe
  2⤵
  PID:6208
- C:\Windows\System\PJmzNUi.exe
  C:\Windows\System\PJmzNUi.exe
  2⤵
  PID:2180
- C:\Windows\System\TJZrqto.exe
  C:\Windows\System\TJZrqto.exe
  2⤵
  PID:6364
- C:\Windows\System\SjxfhiS.exe
  C:\Windows\System\SjxfhiS.exe
  2⤵
  PID:6428
- C:\Windows\System\eQCilBI.exe
  C:\Windows\System\eQCilBI.exe
  2⤵
  PID:5380
- C:\Windows\System\vhzcYJw.exe
  C:\Windows\System\vhzcYJw.exe
  2⤵
  PID:5124
- C:\Windows\System\qhGpTBc.exe
  C:\Windows\System\qhGpTBc.exe
  2⤵
  PID:6560
- C:\Windows\System\xXNyLZD.exe
  C:\Windows\System\xXNyLZD.exe
  2⤵
  PID:6588
- C:\Windows\System\LEsjaTg.exe
  C:\Windows\System\LEsjaTg.exe
  2⤵
  PID:6680
- C:\Windows\System\yhMYYcJ.exe
  C:\Windows\System\yhMYYcJ.exe
  2⤵
  PID:6700
- C:\Windows\System\RJdlEOG.exe
  C:\Windows\System\RJdlEOG.exe
  2⤵
  PID:6732
- C:\Windows\System\tFShIFS.exe
  C:\Windows\System\tFShIFS.exe
  2⤵
  PID:6808
- C:\Windows\System\mvPTYyC.exe
  C:\Windows\System\mvPTYyC.exe
  2⤵
  PID:6920
- C:\Windows\System\kJTIYLU.exe
  C:\Windows\System\kJTIYLU.exe
  2⤵
  PID:6908
- C:\Windows\System\FMoIaes.exe
  C:\Windows\System\FMoIaes.exe
  2⤵
  PID:6964
- C:\Windows\System\pxjGCwG.exe
  C:\Windows\System\pxjGCwG.exe
  2⤵
  PID:6992
- C:\Windows\System\MTGqRAp.exe
  C:\Windows\System\MTGqRAp.exe
  2⤵
  PID:7028
- C:\Windows\System\ImEhwmS.exe
  C:\Windows\System\ImEhwmS.exe
  2⤵
  PID:7164
- C:\Windows\System\hueXdPT.exe
  C:\Windows\System\hueXdPT.exe
  2⤵
  PID:6336
- C:\Windows\System\sfUiUtZ.exe
  C:\Windows\System\sfUiUtZ.exe
  2⤵
  PID:6352
- C:\Windows\System\RwSwoiR.exe
  C:\Windows\System\RwSwoiR.exe
  2⤵
  PID:5340
- C:\Windows\System\PThWswT.exe
  C:\Windows\System\PThWswT.exe
  2⤵
  PID:6660
- C:\Windows\System\DUyCDrr.exe
  C:\Windows\System\DUyCDrr.exe
  2⤵
  PID:6756
- C:\Windows\System\MuyBRvu.exe
  C:\Windows\System\MuyBRvu.exe
  2⤵
  PID:6856
- C:\Windows\System\WzGRQxJ.exe
  C:\Windows\System\WzGRQxJ.exe
  2⤵
  PID:7048
- C:\Windows\System\EoCsuHT.exe
  C:\Windows\System\EoCsuHT.exe
  2⤵
  PID:7136
- C:\Windows\System\ALHjoRR.exe
  C:\Windows\System\ALHjoRR.exe
  2⤵
  PID:6388
- C:\Windows\System\LsptUUU.exe
  C:\Windows\System\LsptUUU.exe
  2⤵
  PID:6816
- C:\Windows\System\EatNvro.exe
  C:\Windows\System\EatNvro.exe
  2⤵
  PID:7140
- C:\Windows\System\ZFIQQbC.exe
  C:\Windows\System\ZFIQQbC.exe
  2⤵
  PID:7072
- C:\Windows\System\Nyodfzx.exe
  C:\Windows\System\Nyodfzx.exe
  2⤵
  PID:1924
- C:\Windows\System\AKxKERJ.exe
  C:\Windows\System\AKxKERJ.exe
  2⤵
  PID:7188
- C:\Windows\System\UTOrqOt.exe
  C:\Windows\System\UTOrqOt.exe
  2⤵
  PID:7212
- C:\Windows\System\SvWqTCE.exe
  C:\Windows\System\SvWqTCE.exe
  2⤵
  PID:7232
- C:\Windows\System\XdWyjKH.exe
  C:\Windows\System\XdWyjKH.exe
  2⤵
  PID:7256
- C:\Windows\System\BtXnOeb.exe
  C:\Windows\System\BtXnOeb.exe
  2⤵
  PID:7276
- C:\Windows\System\UqpTfNZ.exe
  C:\Windows\System\UqpTfNZ.exe
  2⤵
  PID:7324
- C:\Windows\System\dvGFXjg.exe
  C:\Windows\System\dvGFXjg.exe
  2⤵
  PID:7344
- C:\Windows\System\DvCCBzE.exe
  C:\Windows\System\DvCCBzE.exe
  2⤵
  PID:7368
- C:\Windows\System\RysjyxI.exe
  C:\Windows\System\RysjyxI.exe
  2⤵
  PID:7384
- C:\Windows\System\jCzrwHY.exe
  C:\Windows\System\jCzrwHY.exe
  2⤵
  PID:7436
- C:\Windows\System\DdwaujB.exe
  C:\Windows\System\DdwaujB.exe
  2⤵
  PID:7460
- C:\Windows\System\SHKHRGu.exe
  C:\Windows\System\SHKHRGu.exe
  2⤵
  PID:7476
- C:\Windows\System\zGXiGmG.exe
  C:\Windows\System\zGXiGmG.exe
  2⤵
  PID:7500
- C:\Windows\System\VONhhCd.exe
  C:\Windows\System\VONhhCd.exe
  2⤵
  PID:7516
- C:\Windows\System\hlpRCXx.exe
  C:\Windows\System\hlpRCXx.exe
  2⤵
  PID:7540
- C:\Windows\System\aiZdVPB.exe
  C:\Windows\System\aiZdVPB.exe
  2⤵
  PID:7604
- C:\Windows\System\FvWXBYE.exe
  C:\Windows\System\FvWXBYE.exe
  2⤵
  PID:7624
- C:\Windows\System\ZeXiMeZ.exe
  C:\Windows\System\ZeXiMeZ.exe
  2⤵
  PID:7668
- C:\Windows\System\VDcODNa.exe
  C:\Windows\System\VDcODNa.exe
  2⤵
  PID:7712
- C:\Windows\System\xNcGJqR.exe
  C:\Windows\System\xNcGJqR.exe
  2⤵
  PID:7732
- C:\Windows\System\olOhKak.exe
  C:\Windows\System\olOhKak.exe
  2⤵
  PID:7748
- C:\Windows\System\FhPTgjq.exe
  C:\Windows\System\FhPTgjq.exe
  2⤵
  PID:7820
- C:\Windows\System\jUTknDU.exe
  C:\Windows\System\jUTknDU.exe
  2⤵
  PID:7836
- C:\Windows\System\PJbcWyi.exe
  C:\Windows\System\PJbcWyi.exe
  2⤵
  PID:7868
- C:\Windows\System\BlLMLpO.exe
  C:\Windows\System\BlLMLpO.exe
  2⤵
  PID:7908
- C:\Windows\System\YmfTbtq.exe
  C:\Windows\System\YmfTbtq.exe
  2⤵
  PID:7928
- C:\Windows\System\IMJkGAz.exe
  C:\Windows\System\IMJkGAz.exe
  2⤵
  PID:7944
- C:\Windows\System\BCyldus.exe
  C:\Windows\System\BCyldus.exe
  2⤵
  PID:7960
- C:\Windows\System\fILbDKF.exe
  C:\Windows\System\fILbDKF.exe
  2⤵
  PID:7992
- C:\Windows\System\STRGLHO.exe
  C:\Windows\System\STRGLHO.exe
  2⤵
  PID:8008
- C:\Windows\System\LlpyKKm.exe
  C:\Windows\System\LlpyKKm.exe
  2⤵
  PID:8052
- C:\Windows\System\ifFvxtO.exe
  C:\Windows\System\ifFvxtO.exe
  2⤵
  PID:8084
- C:\Windows\System\ERQVdHs.exe
  C:\Windows\System\ERQVdHs.exe
  2⤵
  PID:8104
- C:\Windows\System\ZOwtzWf.exe
  C:\Windows\System\ZOwtzWf.exe
  2⤵
  PID:8128
- C:\Windows\System\AsChOuE.exe
  C:\Windows\System\AsChOuE.exe
  2⤵
  PID:8152
- C:\Windows\System\NUbFrUp.exe
  C:\Windows\System\NUbFrUp.exe
  2⤵
  PID:8168
- C:\Windows\System\HUGWunB.exe
  C:\Windows\System\HUGWunB.exe
  2⤵
  PID:6640
- C:\Windows\System\yZvYYLd.exe
  C:\Windows\System\yZvYYLd.exe
  2⤵
  PID:7244
- C:\Windows\System\GOhyaDQ.exe
  C:\Windows\System\GOhyaDQ.exe
  2⤵
  PID:7356
- C:\Windows\System\KHpiCrF.exe
  C:\Windows\System\KHpiCrF.exe
  2⤵
  PID:7404
- C:\Windows\System\sTADWLc.exe
  C:\Windows\System\sTADWLc.exe
  2⤵
  PID:7420
- C:\Windows\System\SKfHARt.exe
  C:\Windows\System\SKfHARt.exe
  2⤵
  PID:7472
- C:\Windows\System\CkDTTcE.exe
  C:\Windows\System\CkDTTcE.exe
  2⤵
  PID:7532
- C:\Windows\System\RSjMqlF.exe
  C:\Windows\System\RSjMqlF.exe
  2⤵
  PID:7620
- C:\Windows\System\ORMLLWO.exe
  C:\Windows\System\ORMLLWO.exe
  2⤵
  PID:7664
- C:\Windows\System\oHxghIE.exe
  C:\Windows\System\oHxghIE.exe
  2⤵
  PID:7720
- C:\Windows\System\INWLDUH.exe
  C:\Windows\System\INWLDUH.exe
  2⤵
  PID:7832
- C:\Windows\System\EmvCPzv.exe
  C:\Windows\System\EmvCPzv.exe
  2⤵
  PID:7916
- C:\Windows\System\aQDNyHW.exe
  C:\Windows\System\aQDNyHW.exe
  2⤵
  PID:8100
- C:\Windows\System\EhlALBk.exe
  C:\Windows\System\EhlALBk.exe
  2⤵
  PID:8176
- C:\Windows\System\yGLuMKW.exe
  C:\Windows\System\yGLuMKW.exe
  2⤵
  PID:7204
- C:\Windows\System\NygcbAS.exe
  C:\Windows\System\NygcbAS.exe
  2⤵
  PID:7428
- C:\Windows\System\yJkPgnh.exe
  C:\Windows\System\yJkPgnh.exe
  2⤵
  PID:7656
- C:\Windows\System\sJWwJYz.exe
  C:\Windows\System\sJWwJYz.exe
  2⤵
  PID:7468
- C:\Windows\System\HpzuBmu.exe
  C:\Windows\System\HpzuBmu.exe
  2⤵
  PID:7940
- C:\Windows\System\RNlHOdw.exe
  C:\Windows\System\RNlHOdw.exe
  2⤵
  PID:8040
- C:\Windows\System\DJvHqcU.exe
  C:\Windows\System\DJvHqcU.exe
  2⤵
  PID:8120
- C:\Windows\System\bucPGFN.exe
  C:\Windows\System\bucPGFN.exe
  2⤵
  PID:7552
- C:\Windows\System\jnshbkn.exe
  C:\Windows\System\jnshbkn.exe
  2⤵
  PID:7808
- C:\Windows\System\XJHOEHE.exe
  C:\Windows\System\XJHOEHE.exe
  2⤵
  PID:8208
- C:\Windows\System\SuDeDou.exe
  C:\Windows\System\SuDeDou.exe
  2⤵
  PID:8232
- C:\Windows\System\pagHSRy.exe
  C:\Windows\System\pagHSRy.exe
  2⤵
  PID:8292
- C:\Windows\System\FMaTKse.exe
  C:\Windows\System\FMaTKse.exe
  2⤵
  PID:8308
- C:\Windows\System\WUsfZns.exe
  C:\Windows\System\WUsfZns.exe
  2⤵
  PID:8332
- C:\Windows\System\OdAibYS.exe
  C:\Windows\System\OdAibYS.exe
  2⤵
  PID:8348
- C:\Windows\System\KNZrIDq.exe
  C:\Windows\System\KNZrIDq.exe
  2⤵
  PID:8368
- C:\Windows\System\bHmkNeL.exe
  C:\Windows\System\bHmkNeL.exe
  2⤵
  PID:8388
- C:\Windows\System\jDHjvKk.exe
  C:\Windows\System\jDHjvKk.exe
  2⤵
  PID:8408
- C:\Windows\System\iHkKDVa.exe
  C:\Windows\System\iHkKDVa.exe
  2⤵
  PID:8428
- C:\Windows\System\cqdXgGZ.exe
  C:\Windows\System\cqdXgGZ.exe
  2⤵
  PID:8452
- C:\Windows\System\QrJMOQf.exe
  C:\Windows\System\QrJMOQf.exe
  2⤵
  PID:8476
- C:\Windows\System\BoHdGRl.exe
  C:\Windows\System\BoHdGRl.exe
  2⤵
  PID:8520
- C:\Windows\System\fmdHUYB.exe
  C:\Windows\System\fmdHUYB.exe
  2⤵
  PID:8580
- C:\Windows\System\QUsKRba.exe
  C:\Windows\System\QUsKRba.exe
  2⤵
  PID:8600
- C:\Windows\System\VnWvDvX.exe
  C:\Windows\System\VnWvDvX.exe
  2⤵
  PID:8640
- C:\Windows\System\aaVfJlT.exe
  C:\Windows\System\aaVfJlT.exe
  2⤵
  PID:8672
- C:\Windows\System\BVXmTQQ.exe
  C:\Windows\System\BVXmTQQ.exe
  2⤵
  PID:8700
- C:\Windows\System\vDfqXXw.exe
  C:\Windows\System\vDfqXXw.exe
  2⤵
  PID:8744
- C:\Windows\System\oGnKguz.exe
  C:\Windows\System\oGnKguz.exe
  2⤵
  PID:8804
- C:\Windows\System\YNBeCCB.exe
  C:\Windows\System\YNBeCCB.exe
  2⤵
  PID:8844
- C:\Windows\System\OwabOFl.exe
  C:\Windows\System\OwabOFl.exe
  2⤵
  PID:8864
- C:\Windows\System\tmTtwdq.exe
  C:\Windows\System\tmTtwdq.exe
  2⤵
  PID:8884
- C:\Windows\System\yRXjMgL.exe
  C:\Windows\System\yRXjMgL.exe
  2⤵
  PID:8900
- C:\Windows\System\HhBKLsQ.exe
  C:\Windows\System\HhBKLsQ.exe
  2⤵
  PID:8916
- C:\Windows\System\uBXmanw.exe
  C:\Windows\System\uBXmanw.exe
  2⤵
  PID:8932
- C:\Windows\System\ZOhNUNv.exe
  C:\Windows\System\ZOhNUNv.exe
  2⤵
  PID:8948
- C:\Windows\System\zQCsiUs.exe
  C:\Windows\System\zQCsiUs.exe
  2⤵
  PID:9016
- C:\Windows\System\iAkCXUB.exe
  C:\Windows\System\iAkCXUB.exe
  2⤵
  PID:9032
- C:\Windows\System\rVTpksY.exe
  C:\Windows\System\rVTpksY.exe
  2⤵
  PID:9048
- C:\Windows\System\UKNElOu.exe
  C:\Windows\System\UKNElOu.exe
  2⤵
  PID:9064
- C:\Windows\System\peMSuZq.exe
  C:\Windows\System\peMSuZq.exe
  2⤵
  PID:9088
- C:\Windows\System\QcDkSjZ.exe
  C:\Windows\System\QcDkSjZ.exe
  2⤵
  PID:9104
- C:\Windows\System\LdfGpGD.exe
  C:\Windows\System\LdfGpGD.exe
  2⤵
  PID:9152
- C:\Windows\System\yXwAijh.exe
  C:\Windows\System\yXwAijh.exe
  2⤵
  PID:8228
- C:\Windows\System\LdekDlR.exe
  C:\Windows\System\LdekDlR.exe
  2⤵
  PID:8324
- C:\Windows\System\fRZhLgy.exe
  C:\Windows\System\fRZhLgy.exe
  2⤵
  PID:8420
- C:\Windows\System\HSVyOGg.exe
  C:\Windows\System\HSVyOGg.exe
  2⤵
  PID:8416
- C:\Windows\System\nqPFzXm.exe
  C:\Windows\System\nqPFzXm.exe
  2⤵
  PID:8488
- C:\Windows\System\oRuKMds.exe
  C:\Windows\System\oRuKMds.exe
  2⤵
  PID:8656
- C:\Windows\System\vLeFzJJ.exe
  C:\Windows\System\vLeFzJJ.exe
  2⤵
  PID:8708
- C:\Windows\System\gTHcjoZ.exe
  C:\Windows\System\gTHcjoZ.exe
  2⤵
  PID:8800
- C:\Windows\System\QFBZsUw.exe
  C:\Windows\System\QFBZsUw.exe
  2⤵
  PID:8764
- C:\Windows\System\RhqZaWY.exe
  C:\Windows\System\RhqZaWY.exe
  2⤵
  PID:8824
- C:\Windows\System\FvdyeKh.exe
  C:\Windows\System\FvdyeKh.exe
  2⤵
  PID:8892
- C:\Windows\System\sstyQwK.exe
  C:\Windows\System\sstyQwK.exe
  2⤵
  PID:8820
- C:\Windows\System\eJfkwGm.exe
  C:\Windows\System\eJfkwGm.exe
  2⤵
  PID:9072
- C:\Windows\System\gpTxfsF.exe
  C:\Windows\System\gpTxfsF.exe
  2⤵
  PID:8872
- C:\Windows\System\FnkNYfc.exe
  C:\Windows\System\FnkNYfc.exe
  2⤵
  PID:8940
- C:\Windows\System\tPRAfAY.exe
  C:\Windows\System\tPRAfAY.exe
  2⤵
  PID:8968
- C:\Windows\System\Rdftwjh.exe
  C:\Windows\System\Rdftwjh.exe
  2⤵
  PID:8976
- C:\Windows\System\GekLRFy.exe
  C:\Windows\System\GekLRFy.exe
  2⤵
  PID:9132
- C:\Windows\System\yLauFAY.exe
  C:\Windows\System\yLauFAY.exe
  2⤵
  PID:8280
- C:\Windows\System\cjoBpYq.exe
  C:\Windows\System\cjoBpYq.exe
  2⤵
  PID:8468
- C:\Windows\System\BEuMBgn.exe
  C:\Windows\System\BEuMBgn.exe
  2⤵
  PID:8556
- C:\Windows\System\btWmqHA.exe
  C:\Windows\System\btWmqHA.exe
  2⤵
  PID:8712
- C:\Windows\System\xGczYTq.exe
  C:\Windows\System\xGczYTq.exe
  2⤵
  PID:8776
- C:\Windows\System\bLxMFOD.exe
  C:\Windows\System\bLxMFOD.exe
  2⤵
  PID:8860
- C:\Windows\System\SqSvMvK.exe
  C:\Windows\System\SqSvMvK.exe
  2⤵
  PID:7596
- C:\Windows\System\ETPrJCU.exe
  C:\Windows\System\ETPrJCU.exe
  2⤵
  PID:8404
- C:\Windows\System\eIFDSjW.exe
  C:\Windows\System\eIFDSjW.exe
  2⤵
  PID:8444
- C:\Windows\System\YpibyRn.exe
  C:\Windows\System\YpibyRn.exe
  2⤵
  PID:8828
- C:\Windows\System\aqVbTMy.exe
  C:\Windows\System\aqVbTMy.exe
  2⤵
  PID:8924
- C:\Windows\System\yFOtSiY.exe
  C:\Windows\System\yFOtSiY.exe
  2⤵
  PID:9116
- C:\Windows\System\SdVbjcz.exe
  C:\Windows\System\SdVbjcz.exe
  2⤵
  PID:9248
- C:\Windows\System\fPEXzZP.exe
  C:\Windows\System\fPEXzZP.exe
  2⤵
  PID:9288
- C:\Windows\System\BffZCAu.exe
  C:\Windows\System\BffZCAu.exe
  2⤵
  PID:9304
- C:\Windows\System\jAbgqEh.exe
  C:\Windows\System\jAbgqEh.exe
  2⤵
  PID:9324
- C:\Windows\System\nMQNUtA.exe
  C:\Windows\System\nMQNUtA.exe
  2⤵
  PID:9376
- C:\Windows\System\iZioyms.exe
  C:\Windows\System\iZioyms.exe
  2⤵
  PID:9416
- C:\Windows\System\YnNctaY.exe
  C:\Windows\System\YnNctaY.exe
  2⤵
  PID:9440
- C:\Windows\System\nGmVczU.exe
  C:\Windows\System\nGmVczU.exe
  2⤵
  PID:9480
- C:\Windows\System\QrpGvtc.exe
  C:\Windows\System\QrpGvtc.exe
  2⤵
  PID:9496
- C:\Windows\System\WQxPZAM.exe
  C:\Windows\System\WQxPZAM.exe
  2⤵
  PID:9516
- C:\Windows\System\EZMmTco.exe
  C:\Windows\System\EZMmTco.exe
  2⤵
  PID:9544
- C:\Windows\System\hYLpwrV.exe
  C:\Windows\System\hYLpwrV.exe
  2⤵
  PID:9560
- C:\Windows\System\GgBTAFY.exe
  C:\Windows\System\GgBTAFY.exe
  2⤵
  PID:9608
- C:\Windows\System\mHlJFKD.exe
  C:\Windows\System\mHlJFKD.exe
  2⤵
  PID:9628
- C:\Windows\System\XrQuhpX.exe
  C:\Windows\System\XrQuhpX.exe
  2⤵
  PID:9652
- C:\Windows\System\tUgjqcA.exe
  C:\Windows\System\tUgjqcA.exe
  2⤵
  PID:9672
- C:\Windows\System\fevpQiI.exe
  C:\Windows\System\fevpQiI.exe
  2⤵
  PID:9696
- C:\Windows\System\zqqZauB.exe
  C:\Windows\System\zqqZauB.exe
  2⤵
  PID:9724
- C:\Windows\System\cfROXAi.exe
  C:\Windows\System\cfROXAi.exe
  2⤵
  PID:9748
- C:\Windows\System\xaACFUW.exe
  C:\Windows\System\xaACFUW.exe
  2⤵
  PID:9816
- C:\Windows\System\qjADUtj.exe
  C:\Windows\System\qjADUtj.exe
  2⤵
  PID:9836
- C:\Windows\System\pttIOqj.exe
  C:\Windows\System\pttIOqj.exe
  2⤵
  PID:9856
- C:\Windows\System\DjxFOYr.exe
  C:\Windows\System\DjxFOYr.exe
  2⤵
  PID:9884
- C:\Windows\System\DtKgSbZ.exe
  C:\Windows\System\DtKgSbZ.exe
  2⤵
  PID:9908
- C:\Windows\System\PZQfjcf.exe
  C:\Windows\System\PZQfjcf.exe
  2⤵
  PID:9928
- C:\Windows\System\PrjmABT.exe
  C:\Windows\System\PrjmABT.exe
  2⤵
  PID:9956
- C:\Windows\System\hdLWFZF.exe
  C:\Windows\System\hdLWFZF.exe
  2⤵
  PID:9996
- C:\Windows\System\ZtrKsIZ.exe
  C:\Windows\System\ZtrKsIZ.exe
  2⤵
  PID:10032
- C:\Windows\System\xDiAiKT.exe
  C:\Windows\System\xDiAiKT.exe
  2⤵
  PID:10052
- C:\Windows\System\KBNDcWz.exe
  C:\Windows\System\KBNDcWz.exe
  2⤵
  PID:10068
- C:\Windows\System\VKtfiqr.exe
  C:\Windows\System\VKtfiqr.exe
  2⤵
  PID:10108
- C:\Windows\System\djkpjPe.exe
  C:\Windows\System\djkpjPe.exe
  2⤵
  PID:10124
- C:\Windows\System\FJGVHHZ.exe
  C:\Windows\System\FJGVHHZ.exe
  2⤵
  PID:10160
- C:\Windows\System\uZORvkC.exe
  C:\Windows\System\uZORvkC.exe
  2⤵
  PID:10208
- C:\Windows\System\eWDxXwm.exe
  C:\Windows\System\eWDxXwm.exe
  2⤵
  PID:10232
- C:\Windows\System\PpZIzaF.exe
  C:\Windows\System\PpZIzaF.exe
  2⤵
  PID:9256
- C:\Windows\System\LDhvDHE.exe
  C:\Windows\System\LDhvDHE.exe
  2⤵
  PID:9240
- C:\Windows\System\DsjEeDE.exe
  C:\Windows\System\DsjEeDE.exe
  2⤵
  PID:9284
- C:\Windows\System\qfZLlKi.exe
  C:\Windows\System\qfZLlKi.exe
  2⤵
  PID:9352
- C:\Windows\System\nhyYYgG.exe
  C:\Windows\System\nhyYYgG.exe
  2⤵
  PID:9424
- C:\Windows\System\fiMbfJC.exe
  C:\Windows\System\fiMbfJC.exe
  2⤵
  PID:9460
- C:\Windows\System\UNhFmpD.exe
  C:\Windows\System\UNhFmpD.exe
  2⤵
  PID:9492
- C:\Windows\System\lnreajZ.exe
  C:\Windows\System\lnreajZ.exe
  2⤵
  PID:9648
- C:\Windows\System\uYBiyxR.exe
  C:\Windows\System\uYBiyxR.exe
  2⤵
  PID:9716
- C:\Windows\System\EyoyPpQ.exe
  C:\Windows\System\EyoyPpQ.exe
  2⤵
  PID:9784
- C:\Windows\System\mtXfIXM.exe
  C:\Windows\System\mtXfIXM.exe
  2⤵
  PID:9824
- C:\Windows\System\ngizgGM.exe
  C:\Windows\System\ngizgGM.exe
  2⤵
  PID:9880
- C:\Windows\System\OJnPwiE.exe
  C:\Windows\System\OJnPwiE.exe
  2⤵
  PID:9952
- C:\Windows\System\KpGYdvn.exe
  C:\Windows\System\KpGYdvn.exe
  2⤵
  PID:10016
- C:\Windows\System\ADDNUuA.exe
  C:\Windows\System\ADDNUuA.exe
  2⤵
  PID:10120
- C:\Windows\System\SOFVIys.exe
  C:\Windows\System\SOFVIys.exe
  2⤵
  PID:10172
- C:\Windows\System\Rzsuiss.exe
  C:\Windows\System\Rzsuiss.exe
  2⤵
  PID:10220
- C:\Windows\System\sCmfcGE.exe
  C:\Windows\System\sCmfcGE.exe
  2⤵
  PID:8780
- C:\Windows\System\vLIXvMu.exe
  C:\Windows\System\vLIXvMu.exe
  2⤵
  PID:9396
- C:\Windows\System\wHJltqz.exe
  C:\Windows\System\wHJltqz.exe
  2⤵
  PID:9556
- C:\Windows\System\XetvZYL.exe
  C:\Windows\System\XetvZYL.exe
  2⤵
  PID:9668
- C:\Windows\System\LziToQF.exe
  C:\Windows\System\LziToQF.exe
  2⤵
  PID:9832
- C:\Windows\System\IeVZrSj.exe
  C:\Windows\System\IeVZrSj.exe
  2⤵
  PID:10012
- C:\Windows\System\vpZWvWE.exe
  C:\Windows\System\vpZWvWE.exe
  2⤵
  PID:10156
- C:\Windows\System\WGRaRZX.exe
  C:\Windows\System\WGRaRZX.exe
  2⤵
  PID:8992
- C:\Windows\System\LFIjrFv.exe
  C:\Windows\System\LFIjrFv.exe
  2⤵
  PID:9316
- C:\Windows\System\tuQdCfR.exe
  C:\Windows\System\tuQdCfR.exe
  2⤵
  PID:9008
- C:\Windows\System\FmAssxS.exe
  C:\Windows\System\FmAssxS.exe
  2⤵
  PID:10076
- C:\Windows\System\LxEhOpM.exe
  C:\Windows\System\LxEhOpM.exe
  2⤵
  PID:9892
- C:\Windows\System\DVqdqXB.exe
  C:\Windows\System\DVqdqXB.exe
  2⤵
  PID:10272
- C:\Windows\System\UuOAdfB.exe
  C:\Windows\System\UuOAdfB.exe
  2⤵
  PID:10288
- C:\Windows\System\FYyGvEF.exe
  C:\Windows\System\FYyGvEF.exe
  2⤵
  PID:10344
- C:\Windows\System\yolvObZ.exe
  C:\Windows\System\yolvObZ.exe
  2⤵
  PID:10376
- C:\Windows\System\bydSAbn.exe
  C:\Windows\System\bydSAbn.exe
  2⤵
  PID:10392
- C:\Windows\System\OBFXgua.exe
  C:\Windows\System\OBFXgua.exe
  2⤵
  PID:10412
- C:\Windows\System\MncXxxN.exe
  C:\Windows\System\MncXxxN.exe
  2⤵
  PID:10444
- C:\Windows\System\JzSWYsD.exe
  C:\Windows\System\JzSWYsD.exe
  2⤵
  PID:10460
- C:\Windows\System\PiuSWex.exe
  C:\Windows\System\PiuSWex.exe
  2⤵
  PID:10488
- C:\Windows\System\iDCJJMw.exe
  C:\Windows\System\iDCJJMw.exe
  2⤵
  PID:10512
- C:\Windows\System\HmMpfPw.exe
  C:\Windows\System\HmMpfPw.exe
  2⤵
  PID:10532
- C:\Windows\System\WhHfVcE.exe
  C:\Windows\System\WhHfVcE.exe
  2⤵
  PID:10592
- C:\Windows\System\aqiYIYB.exe
  C:\Windows\System\aqiYIYB.exe
  2⤵
  PID:10612
- C:\Windows\System\NBfVxed.exe
  C:\Windows\System\NBfVxed.exe
  2⤵
  PID:10640
- C:\Windows\System\KXtLAON.exe
  C:\Windows\System\KXtLAON.exe
  2⤵
  PID:10668
- C:\Windows\System\onFzuue.exe
  C:\Windows\System\onFzuue.exe
  2⤵
  PID:10716
- C:\Windows\System\ZaClaqJ.exe
  C:\Windows\System\ZaClaqJ.exe
  2⤵
  PID:10732
- C:\Windows\System\bSeAVpB.exe
  C:\Windows\System\bSeAVpB.exe
  2⤵
  PID:10772
- C:\Windows\System\ExzCbZS.exe
  C:\Windows\System\ExzCbZS.exe
  2⤵
  PID:10792
- C:\Windows\System\GYHnSUF.exe
  C:\Windows\System\GYHnSUF.exe
  2⤵
  PID:10824
- C:\Windows\System\fHPTsJH.exe
  C:\Windows\System\fHPTsJH.exe
  2⤵
  PID:10844
- C:\Windows\System\ZkWzKRB.exe
  C:\Windows\System\ZkWzKRB.exe
  2⤵
  PID:10864
- C:\Windows\System\OopMEdl.exe
  C:\Windows\System\OopMEdl.exe
  2⤵
  PID:10892
- C:\Windows\System\yQRgZea.exe
  C:\Windows\System\yQRgZea.exe
  2⤵
  PID:10936
- C:\Windows\System\LGZiXzn.exe
  C:\Windows\System\LGZiXzn.exe
  2⤵
  PID:10960
- C:\Windows\System\DIrnObt.exe
  C:\Windows\System\DIrnObt.exe
  2⤵
  PID:10980
- C:\Windows\System\sHRHvki.exe
  C:\Windows\System\sHRHvki.exe
  2⤵
  PID:11020
- C:\Windows\System\oLyxNiu.exe
  C:\Windows\System\oLyxNiu.exe
  2⤵
  PID:11052
- C:\Windows\System\PsnSmJO.exe
  C:\Windows\System\PsnSmJO.exe
  2⤵
  PID:11072
- C:\Windows\System\SCGjrGW.exe
  C:\Windows\System\SCGjrGW.exe
  2⤵
  PID:11112
- C:\Windows\System\fLjzido.exe
  C:\Windows\System\fLjzido.exe
  2⤵
  PID:11136
- C:\Windows\System\snEilSV.exe
  C:\Windows\System\snEilSV.exe
  2⤵
  PID:11152
- C:\Windows\System\OQXQHKy.exe
  C:\Windows\System\OQXQHKy.exe
  2⤵
  PID:11172
- C:\Windows\System\EsWUPKk.exe
  C:\Windows\System\EsWUPKk.exe
  2⤵
  PID:11192
- C:\Windows\System\xoOusmK.exe
  C:\Windows\System\xoOusmK.exe
  2⤵
  PID:11228
- C:\Windows\System\ZiGNyqF.exe
  C:\Windows\System\ZiGNyqF.exe
  2⤵
  PID:11256
- C:\Windows\System\HzKcvnD.exe
  C:\Windows\System\HzKcvnD.exe
  2⤵
  PID:10020
- C:\Windows\System\caoACvw.exe
  C:\Windows\System\caoACvw.exe
  2⤵
  PID:10264
- C:\Windows\System\CdRrjHV.exe
  C:\Windows\System\CdRrjHV.exe
  2⤵
  PID:10404
- C:\Windows\System\hDCNwoP.exe
  C:\Windows\System\hDCNwoP.exe
  2⤵
  PID:10424
- C:\Windows\System\YXjqCkW.exe
  C:\Windows\System\YXjqCkW.exe
  2⤵
  PID:10524
- C:\Windows\System\TOeHmso.exe
  C:\Windows\System\TOeHmso.exe
  2⤵
  PID:10620
- C:\Windows\System\ushXsml.exe
  C:\Windows\System\ushXsml.exe
  2⤵
  PID:10676
- C:\Windows\System\AvaxVNS.exe
  C:\Windows\System\AvaxVNS.exe
  2⤵
  PID:10712
- C:\Windows\System\JEMVJtY.exe
  C:\Windows\System\JEMVJtY.exe
  2⤵
  PID:10784
- C:\Windows\System\gPEWMBq.exe
  C:\Windows\System\gPEWMBq.exe
  2⤵
  PID:10876
- C:\Windows\System\xgeTPsi.exe
  C:\Windows\System\xgeTPsi.exe
  2⤵
  PID:10944
- C:\Windows\System\TTHtbUJ.exe
  C:\Windows\System\TTHtbUJ.exe
  2⤵
  PID:10956
- C:\Windows\System\xMbkEDN.exe
  C:\Windows\System\xMbkEDN.exe
  2⤵
  PID:11016
- C:\Windows\System\HPgdqpq.exe
  C:\Windows\System\HPgdqpq.exe
  2⤵
  PID:11068
- C:\Windows\System\CtURICx.exe
  C:\Windows\System\CtURICx.exe
  2⤵
  PID:11188
- C:\Windows\System\AZFJidD.exe
  C:\Windows\System\AZFJidD.exe
  2⤵
  PID:9540
- C:\Windows\System\YvRLMgJ.exe
  C:\Windows\System\YvRLMgJ.exe
  2⤵
  PID:9488
- C:\Windows\System\rnSfgmC.exe
  C:\Windows\System\rnSfgmC.exe
  2⤵
  PID:10256
- C:\Windows\System\rfeoAOy.exe
  C:\Windows\System\rfeoAOy.exe
  2⤵
  PID:10484
- C:\Windows\System\mKQnkKt.exe
  C:\Windows\System\mKQnkKt.exe
  2⤵
  PID:10656
- C:\Windows\System\WcyMItF.exe
  C:\Windows\System\WcyMItF.exe
  2⤵
  PID:10904
- C:\Windows\System\sdBtqbd.exe
  C:\Windows\System\sdBtqbd.exe
  2⤵
  PID:10976
- C:\Windows\System\TChVcrc.exe
  C:\Windows\System\TChVcrc.exe
  2⤵
  PID:11180
- C:\Windows\System\FyuuvTB.exe
  C:\Windows\System\FyuuvTB.exe
  2⤵
  PID:10284
- C:\Windows\System\GuMaWxi.exe
  C:\Windows\System\GuMaWxi.exe
  2⤵
  PID:10696
- C:\Windows\System\IDvjFxQ.exe
  C:\Windows\System\IDvjFxQ.exe
  2⤵
  PID:11124
- C:\Windows\System\BPuvLVz.exe
  C:\Windows\System\BPuvLVz.exe
  2⤵
  PID:10816
- C:\Windows\System\ENONSQy.exe
  C:\Windows\System\ENONSQy.exe
  2⤵
  PID:11268
- C:\Windows\System\hiIILpU.exe
  C:\Windows\System\hiIILpU.exe
  2⤵
  PID:11316
- C:\Windows\System\UETYDFG.exe
  C:\Windows\System\UETYDFG.exe
  2⤵
  PID:11336
- C:\Windows\System\fXGfJAx.exe
  C:\Windows\System\fXGfJAx.exe
  2⤵
  PID:11360
- C:\Windows\System\iZZvBAJ.exe
  C:\Windows\System\iZZvBAJ.exe
  2⤵
  PID:11400
- C:\Windows\System\KQlnldQ.exe
  C:\Windows\System\KQlnldQ.exe
  2⤵
  PID:11420
- C:\Windows\System\sFfkwts.exe
  C:\Windows\System\sFfkwts.exe
  2⤵
  PID:11452
- C:\Windows\System\BDMPgqX.exe
  C:\Windows\System\BDMPgqX.exe
  2⤵
  PID:11468
- C:\Windows\System\TbuHpGx.exe
  C:\Windows\System\TbuHpGx.exe
  2⤵
  PID:11512
- C:\Windows\System\yzdEBWy.exe
  C:\Windows\System\yzdEBWy.exe
  2⤵
  PID:11536
- C:\Windows\System\sJAeZMJ.exe
  C:\Windows\System\sJAeZMJ.exe
  2⤵
  PID:11560
- C:\Windows\System\hGAgEOP.exe
  C:\Windows\System\hGAgEOP.exe
  2⤵
  PID:11576
- C:\Windows\System\NHZGScz.exe
  C:\Windows\System\NHZGScz.exe
  2⤵
  PID:11600
- C:\Windows\System\ZLsWdZI.exe
  C:\Windows\System\ZLsWdZI.exe
  2⤵
  PID:11620
- C:\Windows\System\qEzSRqv.exe
  C:\Windows\System\qEzSRqv.exe
  2⤵
  PID:11660
- C:\Windows\System\XjxzjFf.exe
  C:\Windows\System\XjxzjFf.exe
  2⤵
  PID:11684
- C:\Windows\System\fhnmXcS.exe
  C:\Windows\System\fhnmXcS.exe
  2⤵
  PID:11704
- C:\Windows\System\ErMSXNa.exe
  C:\Windows\System\ErMSXNa.exe
  2⤵
  PID:11732
- C:\Windows\System\LpuCGEm.exe
  C:\Windows\System\LpuCGEm.exe
  2⤵
  PID:11756
- C:\Windows\System\viSSEDI.exe
  C:\Windows\System\viSSEDI.exe
  2⤵
  PID:11776
- C:\Windows\System\MKIVFzc.exe
  C:\Windows\System\MKIVFzc.exe
  2⤵
  PID:11812
- C:\Windows\System\XiDfEaB.exe
  C:\Windows\System\XiDfEaB.exe
  2⤵
  PID:11832
- C:\Windows\System\OOBbEjI.exe
  C:\Windows\System\OOBbEjI.exe
  2⤵
  PID:11860
- C:\Windows\System\OCzkZMK.exe
  C:\Windows\System\OCzkZMK.exe
  2⤵
  PID:11880
- C:\Windows\System\Bttfumx.exe
  C:\Windows\System\Bttfumx.exe
  2⤵
  PID:11904
- C:\Windows\System\tEpiaNP.exe
  C:\Windows\System\tEpiaNP.exe
  2⤵
  PID:11920
- C:\Windows\System\CEcrmWo.exe
  C:\Windows\System\CEcrmWo.exe
  2⤵
  PID:11944
- C:\Windows\System\SUbXelB.exe
  C:\Windows\System\SUbXelB.exe
  2⤵
  PID:11964
- C:\Windows\System\EZwfJni.exe
  C:\Windows\System\EZwfJni.exe
  2⤵
  PID:12004
- C:\Windows\System\kLhDDAw.exe
  C:\Windows\System\kLhDDAw.exe
  2⤵
  PID:12020
- C:\Windows\System\vgApSFB.exe
  C:\Windows\System\vgApSFB.exe
  2⤵
  PID:12084
- C:\Windows\System\uMfldmh.exe
  C:\Windows\System\uMfldmh.exe
  2⤵
  PID:12112
- C:\Windows\System\DykMxue.exe
  C:\Windows\System\DykMxue.exe
  2⤵
  PID:12140
- C:\Windows\System\EzXBCHr.exe
  C:\Windows\System\EzXBCHr.exe
  2⤵
  PID:12180
- C:\Windows\System\eBWaEIc.exe
  C:\Windows\System\eBWaEIc.exe
  2⤵
  PID:12212
- C:\Windows\System\rFxHLsj.exe
  C:\Windows\System\rFxHLsj.exe
  2⤵
  PID:12244
- C:\Windows\System\HXaERxV.exe
  C:\Windows\System\HXaERxV.exe
  2⤵
  PID:10564
- C:\Windows\System\JhqxVUp.exe
  C:\Windows\System\JhqxVUp.exe
  2⤵
  PID:11312
- C:\Windows\System\OJyKkNI.exe
  C:\Windows\System\OJyKkNI.exe
  2⤵
  PID:11356
- C:\Windows\System\kHyIsgF.exe
  C:\Windows\System\kHyIsgF.exe
  2⤵
  PID:11416
- C:\Windows\System\PcaxiAR.exe
  C:\Windows\System\PcaxiAR.exe
  2⤵
  PID:11460
- C:\Windows\System\VgtfPVX.exe
  C:\Windows\System\VgtfPVX.exe
  2⤵
  PID:11524
- C:\Windows\System\htcXOGr.exe
  C:\Windows\System\htcXOGr.exe
  2⤵
  PID:11584
- C:\Windows\System\qLrnARO.exe
  C:\Windows\System\qLrnARO.exe
  2⤵
  PID:11632
- C:\Windows\System\rrRqrhO.exe
  C:\Windows\System\rrRqrhO.exe
  2⤵
  PID:11792
- C:\Windows\System\isAJMeq.exe
  C:\Windows\System\isAJMeq.exe
  2⤵
  PID:11804
- C:\Windows\System\EirSftw.exe
  C:\Windows\System\EirSftw.exe
  2⤵
  PID:11820
- C:\Windows\System\QoNKJNg.exe
  C:\Windows\System\QoNKJNg.exe
  2⤵
  PID:11892
- C:\Windows\System\Pcrizzx.exe
  C:\Windows\System\Pcrizzx.exe
  2⤵
  PID:11940
- C:\Windows\System\dbGWPYN.exe
  C:\Windows\System\dbGWPYN.exe
  2⤵
  PID:11996
- C:\Windows\System\IBattRf.exe
  C:\Windows\System\IBattRf.exe
  2⤵
  PID:12152
- C:\Windows\System\wPKpvuc.exe
  C:\Windows\System\wPKpvuc.exe
  2⤵
  PID:12136
- C:\Windows\System\pctHdNy.exe
  C:\Windows\System\pctHdNy.exe
  2⤵
  PID:12092
- C:\Windows\System\PAJLZfI.exe
  C:\Windows\System\PAJLZfI.exe
  2⤵
  PID:12188
- C:\Windows\System\NJqowHy.exe
  C:\Windows\System\NJqowHy.exe
  2⤵
  PID:12276
- C:\Windows\System\MLNZLBS.exe
  C:\Windows\System\MLNZLBS.exe
  2⤵
  PID:11800
- C:\Windows\System\sVfuJQx.exe
  C:\Windows\System\sVfuJQx.exe
  2⤵
  PID:11888
- C:\Windows\System\eupYabJ.exe
  C:\Windows\System\eupYabJ.exe
  2⤵
  PID:12048
- C:\Windows\System\zeuVasd.exe
  C:\Windows\System\zeuVasd.exe
  2⤵
  PID:12268
- C:\Windows\System\neVDmTu.exe
  C:\Windows\System\neVDmTu.exe
  2⤵
  PID:11344
- C:\Windows\System\yacAhvU.exe
  C:\Windows\System\yacAhvU.exe
  2⤵
  PID:11928
- C:\Windows\System\VVMRhkC.exe
  C:\Windows\System\VVMRhkC.exe
  2⤵
  PID:11936
- C:\Windows\System\sJtIOVj.exe
  C:\Windows\System\sJtIOVj.exe
  2⤵
  PID:12060
- C:\Windows\System\jhNEuYU.exe
  C:\Windows\System\jhNEuYU.exe
  2⤵
  PID:12208
- C:\Windows\System\smgccYu.exe
  C:\Windows\System\smgccYu.exe
  2⤵
  PID:11852
- C:\Windows\System\MXAxIdn.exe
  C:\Windows\System\MXAxIdn.exe
  2⤵
  PID:12296
- C:\Windows\System\fdtMjwF.exe
  C:\Windows\System\fdtMjwF.exe
  2⤵
  PID:12316
- C:\Windows\System\FJxXVso.exe
  C:\Windows\System\FJxXVso.exe
  2⤵
  PID:12336
- C:\Windows\System\cPwFjYZ.exe
  C:\Windows\System\cPwFjYZ.exe
  2⤵
  PID:12360
- C:\Windows\System\gYmEosb.exe
  C:\Windows\System\gYmEosb.exe
  2⤵
  PID:12384
- C:\Windows\System\eLyzYzL.exe
  C:\Windows\System\eLyzYzL.exe
  2⤵
  PID:12400
- C:\Windows\System\fvnpSxU.exe
  C:\Windows\System\fvnpSxU.exe
  2⤵
  PID:12456
- C:\Windows\System\AZPfndg.exe
  C:\Windows\System\AZPfndg.exe
  2⤵
  PID:12496
- C:\Windows\System\yMqsOtT.exe
  C:\Windows\System\yMqsOtT.exe
  2⤵
  PID:12536
- C:\Windows\System\Gadfqmt.exe
  C:\Windows\System\Gadfqmt.exe
  2⤵
  PID:12564
- C:\Windows\System\jdAeKiL.exe
  C:\Windows\System\jdAeKiL.exe
  2⤵
  PID:12600
- C:\Windows\System\cVRQtDh.exe
  C:\Windows\System\cVRQtDh.exe
  2⤵
  PID:12620
- C:\Windows\System\ojeaDGW.exe
  C:\Windows\System\ojeaDGW.exe
  2⤵
  PID:12640
- C:\Windows\System\VzFZjPR.exe
  C:\Windows\System\VzFZjPR.exe
  2⤵
  PID:12664
- C:\Windows\System\VgrAMXR.exe
  C:\Windows\System\VgrAMXR.exe
  2⤵
  PID:12712
- C:\Windows\System\hVudFnp.exe
  C:\Windows\System\hVudFnp.exe
  2⤵
  PID:12732
- C:\Windows\System\EokIoGn.exe
  C:\Windows\System\EokIoGn.exe
  2⤵
  PID:12756
- C:\Windows\System\RaZUQwt.exe
  C:\Windows\System\RaZUQwt.exe
  2⤵
  PID:12776
- C:\Windows\System\BZktrqQ.exe
  C:\Windows\System\BZktrqQ.exe
  2⤵
  PID:12816
- C:\Windows\System\QZTGMUj.exe
  C:\Windows\System\QZTGMUj.exe
  2⤵
  PID:12856
- C:\Windows\System\qUanCHK.exe
  C:\Windows\System\qUanCHK.exe
  2⤵
  PID:12888
- C:\Windows\System\YOCNezu.exe
  C:\Windows\System\YOCNezu.exe
  2⤵
  PID:12916
- C:\Windows\System\MlEJlTE.exe
  C:\Windows\System\MlEJlTE.exe
  2⤵
  PID:12936
- C:\Windows\System\bNQLPLy.exe
  C:\Windows\System\bNQLPLy.exe
  2⤵
  PID:12968
- C:\Windows\System\nOOkUZX.exe
  C:\Windows\System\nOOkUZX.exe
  2⤵
  PID:12984
- C:\Windows\System\VekWCFt.exe
  C:\Windows\System\VekWCFt.exe
  2⤵
  PID:13012
- C:\Windows\System\votfveD.exe
  C:\Windows\System\votfveD.exe
  2⤵
  PID:13040
- C:\Windows\System\kXPFcqP.exe
  C:\Windows\System\kXPFcqP.exe
  2⤵
  PID:13068
- C:\Windows\System\QBzsJNw.exe
  C:\Windows\System\QBzsJNw.exe
  2⤵
  PID:13096
- C:\Windows\System\uexsviI.exe
  C:\Windows\System\uexsviI.exe
  2⤵
  PID:13112
- C:\Windows\System\qWiUzWC.exe
  C:\Windows\System\qWiUzWC.exe
  2⤵
  PID:13132
- C:\Windows\System\Ufgpxel.exe
  C:\Windows\System\Ufgpxel.exe
  2⤵
  PID:13164
- C:\Windows\System\IPwXhrl.exe
  C:\Windows\System\IPwXhrl.exe
  2⤵
  PID:13184
- C:\Windows\System\mRawuDi.exe
  C:\Windows\System\mRawuDi.exe
  2⤵
  PID:13228
- C:\Windows\System\wMVHPrX.exe
  C:\Windows\System\wMVHPrX.exe
  2⤵
  PID:13252
- C:\Windows\System\PRDJeeh.exe
  C:\Windows\System\PRDJeeh.exe
  2⤵
  PID:13272
- C:\Windows\System\rnzdkGd.exe
  C:\Windows\System\rnzdkGd.exe
  2⤵
  PID:13292
- C:\Windows\System\tlLtJeE.exe
  C:\Windows\System\tlLtJeE.exe
  2⤵
  PID:12200
- C:\Windows\System\SyCTXXd.exe
  C:\Windows\System\SyCTXXd.exe
  2⤵
  PID:11768
- C:\Windows\System\MIrJpZS.exe
  C:\Windows\System\MIrJpZS.exe
  2⤵
  PID:12328
- C:\Windows\System\YRtiQNA.exe
  C:\Windows\System\YRtiQNA.exe
  2⤵
  PID:12472
- C:\Windows\System\CrpwIKc.exe
  C:\Windows\System\CrpwIKc.exe
  2⤵
  PID:12592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpder12a.amk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BFitlEo.exe

Filesize
1.6MB

MD5
33b0c8a23baf4d21547b2fa4649eb0c7

SHA1
1bbea40aa95cd71b2f076cb21427bd7ec5b858cb

SHA256
d3c0f4309e2c6a0699ce529b093bfdea3f81b532c25eb55f3b505e49fa588f52

SHA512
8fbd018455efbb592ca48fc1e334903d17b405a2408f262bc24bb858a4d83834f4174fd839bf3c3a4333108b97902f2c555642840b78ff81d42bfc204ed9b219

Download Submit
C:\Windows\System\BfvrrLU.exe

Filesize
1.6MB

MD5
2a8b67e73f878e7bbe2aa160c230fead

SHA1
b49c01a06f4cbd22cc6b150965bfa5d5a15cd4b7

SHA256
199f85277b81e1b528fefd5f1b37c9a8fa26cd2a5b29c4403d433c094b80d8a9

SHA512
9163eddca214a02e11a4c04dfd68ac85f373a576612cedad705c06c62747c6f2be68f45ee4af88c4f49a173909e21509a706e8eae8beb33340b0340eeba4099e

Download Submit
C:\Windows\System\BnHxMpj.exe

Filesize
1.6MB

MD5
ffd94e8938b16398c6fb385d36c42428

SHA1
24e43a9b08fed87192b7bd9107b453d8069c564c

SHA256
7f1faf994405eba1d94df87c475c35b1ac5d509071dfa2e622a5407367ea826f

SHA512
f995c88e4c062c16bebe72d8dc921a2e3efdc41a851fb9bb106c8eda41c8b0eb02c7e48e224bfe0640b7a77dbcddd4eb5c49179073d3e0b5c97eaedce982920b

Download Submit
C:\Windows\System\CSyWqaa.exe

Filesize
1.6MB

MD5
fa350fca7c31d1e62aa8adc726031b1f

SHA1
8ff56f1b1405060b4ffd6c3094035eb2c323921c

SHA256
de7bcdad8cdb7fa7a00b89a00b794742692f3709e3b79c5e1bc7c3dfe0b29d83

SHA512
6829997bf8f86de500f757ef4bad6dccaa22a0edbc211e190a7a816dd202e403b73677557d6373c859e004312bea683b1a45e2a25dc133876e25b668a7e3afa8

Download Submit
C:\Windows\System\GnGYgXb.exe

Filesize
1.6MB

MD5
296ef99cf4058b3e3cbb5b4a799679f2

SHA1
48a2c0fad10610660a9576d899997df6de9c9582

SHA256
1797db756bf6189cb3d705d6dfed2368771639e2fbbfef4177411ebc6a2fd7f7

SHA512
14e3b03aef5521b84c7ba81fe8ed1aa1479df7758c02ef06414ea52f6758dab9d059ede95412acf8ae66ee1618299ffc5b419f6a7ac1b4b0a58c433a594795ce

Download Submit
C:\Windows\System\IiEriZa.exe

Filesize
1.6MB

MD5
fd871179448f9bfe1706565b39d01cc7

SHA1
b40949f5956d2413efb16f64b8d51436ff1ebc53

SHA256
31613c6805b315eee283733e1995ea5468c2af21b62da4f22346544c1d242cfb

SHA512
0c94250f01a6b4e1405c1973667ade2140a8f2e5e9700c9e49b53df52ad0102587188a783bc1e6665b2509bbc8e406593c3ae9d07f28b5dfe0b71005a36321c4

Download Submit
C:\Windows\System\MekYULY.exe

Filesize
1.6MB

MD5
3770afbffc6249e37363d9678c0a7f4d

SHA1
0a50b71c732f06e89714e436fda4c1be686c1377

SHA256
89bb4155f34da528171f88e6c06d4ab8a04a3ebede4aa6d77774d3a74e64ab5f

SHA512
3825cbcf493302fb21446ba1a2960a6c0ea877a7cc1b15baab0b91e7712def1e33f76ffae38cfaa0cda87521004f45fcd27d1c22025cc04b70f65db7bb76dee9

Download Submit
C:\Windows\System\MlpAKkM.exe

Filesize
1.6MB

MD5
bbbbcd8115da8a3abc9b2cc6e6785e2c

SHA1
30749ada6520fcc648328b50f63e16a7004be3dd

SHA256
3fb66af7912d3491431cf1e86c35b32844807001f6d35e8b6fc0d541d1c7d85f

SHA512
11257bc55f3b3f1adc54f29724b7974e203904be9a97b7b480135dcb1ca8cdd0d186ad81d774a1ba87387debc35060594709b2c52f5acf53388313aff5c1e902

Download Submit
C:\Windows\System\NfRrGmy.exe

Filesize
1.6MB

MD5
a0c021ba49e86557e301bf6bb4d59bee

SHA1
68bfb72a36ced7c82995781ef23b87a900ff80e6

SHA256
21ebc066d0e95369610a3cef12468e062a91a3d123c30ad20721df642a572a21

SHA512
b9ee67d18edaa82beeefc2548e1f575f5ff2ac82212c94fb74a1d2339a61b136dd3c50b19f3176642aca799d55d6a938cbb5f877e932e10862203db3ec0605f9

Download Submit
C:\Windows\System\OXvuLJo.exe

Filesize
1.6MB

MD5
f54665ae0c696ac3c40e7b9f8e4fe13e

SHA1
0f8310d04b3b60ca189f58f2badb203da342a092

SHA256
d52c8688c331869df7a796107147d22ed37c75140bbac17af894f4a04d244028

SHA512
14b640b9a5c560e3b2215d54a0c0bf7f6e192ea0df08952a946f950c955b25fd4b8d019d31b08f03fa078e7693ca32e7d170f8a6a4016e1864adbb02fb3acba9

Download Submit
C:\Windows\System\Ocgqfia.exe

Filesize
1.6MB

MD5
cf1153fb340404074cd8ca8a4e32b5e8

SHA1
d76ce35a3fc787aebf319d21f26163ad718f6917

SHA256
801686f50495603dc2de327553faea4efd06948e39c4e99715fae458f986ed07

SHA512
02c52e6e3d5a686b4b530ee285d59509ccf786ed16c591f2e9f60384e2d9170bffa93b645c821a5ef5d2cefe2c1b0414bf81d8c4e3afd3bae621489963684350

Download Submit
C:\Windows\System\OsisTmD.exe

Filesize
1.6MB

MD5
034cee343237d7768083cd0f7424d18e

SHA1
c7755fd71d3e2cbfe782e2c3dcad529fad29b5d4

SHA256
1c499ad8b8642af5456bf9fb372d2472f32035efb8c58ccd7cdf55d4c60f5856

SHA512
0ecb37d81cd2b6045df4e39db2cd21e256f202a2f874118db416cdcc4074070c8d946002459e58c6d38f31167924123d9a88441790e6d5f97ec0adccf00589d7

Download Submit
C:\Windows\System\PrMXQKS.exe

Filesize
1.6MB

MD5
c2ccef3769373f6da6f1b7c89ecbf2af

SHA1
3ddce1450a01c0e827e533ce7c4e1e468735721b

SHA256
e2d360e45ade6284439849d495e6d1e49ab5e988e47c4225905698d16a390a8d

SHA512
fd42fc5adc7e402ce93322a1add8c6452a7dc4d5027ca1ed557bac3820f5ab1f18c1cbcdae235b5996c7718ea275c642da5d44f53f563b5cf86b5fdc554c7aae

Download Submit
C:\Windows\System\VRUXeiE.exe

Filesize
8B

MD5
4585af961e6be7f3b03d075298565b62

SHA1
8e84c60639225761f581ea4ec1ff9a2d8e5472c9

SHA256
b8920be4ca9181e84576dfb449141c7d9af40d7ddc5588ea3cac8c68ef3a0a88

SHA512
aca862ef42a6056537a17dcbf9d8778efa38fbecbcb6ce3dce02a2eb0f5b9ffb56a667b21c26a29159a0ebcd14d21a77c5b25a36880c46863acba28da90e75f0

Download Submit
C:\Windows\System\WByhujQ.exe

Filesize
1.6MB

MD5
caa12f4141181ecb57f1c3b83683925b

SHA1
f3e3289dcf795de5ec975f32fe5c779b05b61137

SHA256
cdc18536282279ff935be8120d5d3662f8daeff0a440ba073fa161d719f3c989

SHA512
57367ce32e044b9ef111a4eaa6ea253ccd55edb3b83014ced8e1185bb1d418af260bf3c7f9429e3adf12ee971f398964f04264fb70a13d5da2b83bb0a3bd1441

Download Submit
C:\Windows\System\WtwyHaB.exe

Filesize
1.6MB

MD5
eef2c8139a291bd7df64e11550bb9261

SHA1
b08066aaaf193e53ad3c7f6ba0eca0e89c7f0a8a

SHA256
1249d31843e6cc9ca8997502dd2ca3bd4579459f8445c042c6bf83099944ede8

SHA512
d98530b309263843994e15fb32000ce40cbf36c67300deb5e1426259fca290a0d4a5c78fef34763f422e73b24c880fed4326938a989dfc0f81c637181dda7cdb

Download Submit
C:\Windows\System\XhuqXPH.exe

Filesize
1.6MB

MD5
f264585c47c31cf4d98cccde458d07c6

SHA1
766f22ca66eba0c757356ab3d62d0d476cad90e3

SHA256
2f256f99b7feefaa0dc260c1f5ef889b596b2d72234750754eec299228d23f7d

SHA512
0c981e39068d8552b412620483ff7ec30a176d01958578e113dd905259dd4a095b16f045f51949d85a6a7f40437c77314f05184c5e872d889f257a2f6e57e3ee

Download Submit
C:\Windows\System\cApFhyr.exe

Filesize
1.6MB

MD5
dfa543460e8fb7477b7aac69f563c1ea

SHA1
1473808262ad0cfb892584619e5cfdef3e09bd5b

SHA256
a72759d150d3d23ed4f92a8433f19f2c124bd66d78f9f4c5789805c493f73897

SHA512
9bf8d9dc10c48c2570d412ee5fcdca19cc9a5804ef2042c85f91b01c48c85823c85fa8104105208fb102d5ce5f7a97de00edc6181c76b9118dacfa62c5a9b26b

Download Submit
C:\Windows\System\cfYzwfz.exe

Filesize
1.6MB

MD5
4b5f2a153b72dbee8c3ae86fad8de3f2

SHA1
9203a80604840e3973c1c8d22eaf38fe8c562485

SHA256
33bb5667dde9cdba0d2fa6b964055d0d09c6ef7555ccf584f17cb70a408efecc

SHA512
0f825d8122fd91aa8e2febfce527ef7a1bae27ad3efb830411696ef4f5a504e16a713f58ae33200567fa4a2ee45e2f0d534c7cd1784c823e9796d8ade22bee86

Download Submit
C:\Windows\System\eBKqVnI.exe

Filesize
1.6MB

MD5
2642a3b241aa1c6869f9c89a4ba5acac

SHA1
db17d808e233bbb8c15096cea8f4d74303f02b6b

SHA256
8dae928ac0bb2598f7e9cadfd8a19dff81d8b1f0a45c3d6c69b6208dac794b6a

SHA512
b6c409d6dafdac5f42eae96f5f528bdfcf4bcd10dfd1c995de049d438483282d7e33ce2547146cf03082492eacc2179af80dbf4267104269b34fd96dd658f945

Download Submit
C:\Windows\System\fiQlaHS.exe

Filesize
1.6MB

MD5
e59e19aef684d663e15ee0d080b8a726

SHA1
9d7113bc37ee05d8ff02d5fecb13a0d13200c35b

SHA256
ca62851d6694e89a82eef92bbce9ddb860980e40290e0473bee816771aec9d6e

SHA512
58a42da89dec6b1aaefa9d02d56e78b723385ab3b40671cf0c451f47a173e14ed0162a666ca386383fc0ce27e150a1a1d2e0d0baa9651c3a68173e9eba460d2b

Download Submit
C:\Windows\System\ipeQwBw.exe

Filesize
1.6MB

MD5
c134a12d0b3323f6a4e28f06015773ba

SHA1
196f8d648c348af39e54c7441fc0dbf15cbffd83

SHA256
df7efc6ee2a237a7f3f5debda9fefa321a21b541e5a2623ea3f7875ad56f54bd

SHA512
b384aa9b38b91c10d012e550d27c9e57d11129f6f41c7ed73365cd6863847cf417a35a3b3620823f0fd0c2e8aa0df794415c408fefb424bcc0d47c9f7bb762d3

Download Submit
C:\Windows\System\npuJixC.exe

Filesize
1.6MB

MD5
3e287f7a8cf3f506a1f4e8e5c80464ed

SHA1
16b940943873031ffc280886bbe30226968f56b0

SHA256
6ab2ed87a86e2cf3fbce6387c8a05a49c2bca32c362eccc67e3d6414d0732c29

SHA512
2ae94df0acf27a6988fad7ccf5a38bdb3eb6e89217dabeb76a49df8a31bc34b2525c563a9829a351c55d10dbe8d5133d127f17c6cc421f46029d893a10742a12

Download Submit
C:\Windows\System\psfyaIj.exe

Filesize
1.6MB

MD5
c58c5d3bba96471232ed5070480173f3

SHA1
c7a8ec5f947e82817f5c1636bbd15289a5494af5

SHA256
7c296c3bcbbb81d62e68bfef89968b3907329bd1b296c86d4af945f736fe05fc

SHA512
bf5541533f648d03576fa46e834279e925b190a3d47722eac42bea6a4e6924fb7de126a64ea6e7a78104f9f4c2f558652d6b0eb43f8acffa754883d331156a08

Download Submit
C:\Windows\System\sEvuQwi.exe

Filesize
1.6MB

MD5
0a69d17d71eff57154c4f756c72e6528

SHA1
ef965e9813b26b90e9bd4833211cfac4ded24ee9

SHA256
27946672c803aac6515a5cc79295e29bab9ccb7ccee0541582cad1f853d82267

SHA512
76c7d33a86d30ab020e05933c567d5b2c50f35aced082dc6bbc291805a7aa3491b47c340941a385a4f4c11268b1cc6309527a5a94e9d3a1cf2619ad415b6ea61

Download Submit
C:\Windows\System\saqopXd.exe

Filesize
1.6MB

MD5
6bcee9a169f72f9fed669b0aa8f0fba1

SHA1
d185168d00c596045ddb9b4a4aebfdfce34d7dc4

SHA256
688217075074d03a3ba4e4bbad4280f3bbe4fa2764c216e192af434ec82b0809

SHA512
fbbcb81f06c60c7227b4468efee8b47e033652214001b6705d66c53ae6930dd0e2b6527c95cb6ee8fd16b1945aa4c35d11c7e7f62a25499dc9525b268fd0de69

Download Submit
C:\Windows\System\tdtBvqN.exe

Filesize
1.6MB

MD5
8fc302070d948ded5af06c46d11765e5

SHA1
f6639de99661dee4390626cd9b72ee388b1bf86b

SHA256
d74401f7ad7845a2f3868c9e400b77b2674372d924b071be21752c17e817131f

SHA512
1e18b86bc1ae27e2b3d426f9b00b644008dd2e9a6d74dd41ad01ccb28197e23c067d2892de848868a7d1cb341c82d75318ef4195a1889bfcd482027a2c2706ac

Download Submit
C:\Windows\System\torpHbu.exe

Filesize
1.6MB

MD5
cf3188059a27462bbc00742c13c41e2e

SHA1
b036e2518373f1bb3aa6b625a91c498003541437

SHA256
da73fd38eef4c01548260cdc5edb1aba82d63ab744e5ac05d2cbe11a81357521

SHA512
fe1afdeb6b5c9c3981b1d226a364166734bcc97a06d3fbee70e2c74c0b470d6415aa53e116f4f786d59425f914cdf0b68276e40572d21b8317862ba8291b6377

Download Submit
C:\Windows\System\vLtkkFy.exe

Filesize
1.6MB

MD5
77dba240b7bb9b67db5f32a4e56123c5

SHA1
fabc3fc03f1bb5723aed1fa4df481d00ddbe149f

SHA256
90cb8ed575c0346271c4405880818c82b9242c5c274340e03f71d44209e92628

SHA512
484e90caeae99e587f88473c7dd535a79dc1b42876ee2830ca05fb0428fe92fbf3449db8b726c284ced0d6b0bbbd9dc695097710bbcc16da8e25f469bb2a66a3

Download Submit
C:\Windows\System\wXfSdZg.exe

Filesize
1.6MB

MD5
4af8c1a1ebd7ca2737673a1d7053e812

SHA1
46c8305ec4f8ebbda69d3d4c8baadaf32d124eed

SHA256
710d43856dd11abc0dd5c93fbaa79d4679035c890bde2d1c62fdca180f9af87e

SHA512
0ae5194c962738895df0da1984ffa636ec38866ae1d067114fe024e4017ec02dfc2bbcdc6f0e8f4b5a5c7526989d14fcb22be44d5e0663af8a22e3d1a1a5e48d

Download Submit
C:\Windows\System\wjXyncl.exe

Filesize
1.6MB

MD5
2e27a4e8ff0570f3388ea20324243f01

SHA1
44e93678d3b3dae44eb1c61a02f892fd1866153e

SHA256
d5c13a9d00601d010d86783a131ee369fd300aa0375ec10c642ed7cc994bcbaa

SHA512
4430119c211bcde173ecc36e96d5859ac1313d3a85cb073cb21a7614873c32c60a3b20a9ac60eda8b9a738301175e7e0f04a6294eb24e5071bfbbec554409202

Download Submit
C:\Windows\System\yFgUcwz.exe

Filesize
1.6MB

MD5
4a52fd9e4bf6f781a323aff75f2aaaad

SHA1
940bd57e8a391e44543452e86309301c1b28a08b

SHA256
79dd882e9c2fc98f6297f6f230a050bafba23f4378aa55a9e5b8bb7a8cdb7079

SHA512
b747c5bd45469a5f8d034c6813d8f2be73ed90efcbae95da5ba5ac784e8d3cbcf3a15b53526515013d5e20e0832b82441252810004eb4d9e705224f9c2bdb9b5

Download Submit
C:\Windows\System\yRMIFWp.exe

Filesize
1.6MB

MD5
bbbee1d102c0d749e6f92a71c74149ea

SHA1
070c82fc299c8ff2d11e24ae8f27c2dfd783706b

SHA256
1213f3353ec19eec51298593373f6982294c17d170984a895a401d66d1ae229a

SHA512
81f26f660d329d28eb55bc2d96e6077ed9915383b8b20f65c7cc4befc26bbf93a6dd52905ec205c9dd2ec67799e10261c3b22feada81622a36d47bcb84b30ea1

Download Submit
C:\Windows\System\zfEjqWJ.exe

Filesize
1.6MB

MD5
3a72d8bc313c6c0abd7bbc18d9ac0fc5

SHA1
0c23fbe1626ed9efd86de41bc9e01ef8b398f3a2

SHA256
9edd401357383efc778e822a0223d01ce93560dcd4f1d60a46b5d4f57d1472f6

SHA512
264616e11cf4e0f8a1888a29ad8161230294456833a3ad8a3f31d55584a08d6089a2470305fb9b5dcc414754c875395e3da0ef61c89cbab2486e8b07a570a591

Download Submit
memory/544-2040-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp

Filesize
3.9MB

Download
memory/544-28-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp

Filesize
3.9MB

Download
memory/544-1998-0x00007FF7D4280000-0x00007FF7D4672000-memory.dmp

Filesize
3.9MB

Download
memory/1020-2058-0x00007FF795330000-0x00007FF795722000-memory.dmp

Filesize
3.9MB

Download
memory/1020-311-0x00007FF795330000-0x00007FF795722000-memory.dmp

Filesize
3.9MB

Download
memory/1236-2057-0x00007FF7BEDB0000-0x00007FF7BF1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-293-0x00007FF7BEDB0000-0x00007FF7BF1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1260-295-0x00007FF709010000-0x00007FF709402000-memory.dmp

Filesize
3.9MB

Download
memory/1260-2060-0x00007FF709010000-0x00007FF709402000-memory.dmp

Filesize
3.9MB

Download
memory/1348-347-0x00007FF607830000-0x00007FF607C22000-memory.dmp

Filesize
3.9MB

Download
memory/1348-2046-0x00007FF607830000-0x00007FF607C22000-memory.dmp

Filesize
3.9MB

Download
memory/1352-66-0x00007FF70B2C0000-0x00007FF70B6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1352-2044-0x00007FF70B2C0000-0x00007FF70B6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1388-2034-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp

Filesize
3.9MB

Download
memory/1388-40-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp

Filesize
3.9MB

Download
memory/1436-2074-0x00007FF7C7C30000-0x00007FF7C8022000-memory.dmp

Filesize
3.9MB

Download
memory/1436-331-0x00007FF7C7C30000-0x00007FF7C8022000-memory.dmp

Filesize
3.9MB

Download
memory/1516-2072-0x00007FF7674D0000-0x00007FF7678C2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-326-0x00007FF7674D0000-0x00007FF7678C2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-2052-0x00007FF6CC8C0000-0x00007FF6CCCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-349-0x00007FF6CC8C0000-0x00007FF6CCCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-288-0x00007FF6F4100000-0x00007FF6F44F2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-2043-0x00007FF6F4100000-0x00007FF6F44F2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-2038-0x00007FF754CC0000-0x00007FF7550B2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-346-0x00007FF754CC0000-0x00007FF7550B2000-memory.dmp

Filesize
3.9MB

Download
memory/3308-2066-0x00007FF79FCC0000-0x00007FF7A00B2000-memory.dmp

Filesize
3.9MB

Download
memory/3308-302-0x00007FF79FCC0000-0x00007FF7A00B2000-memory.dmp

Filesize
3.9MB

Download
memory/3348-289-0x00007FF6645E0000-0x00007FF6649D2000-memory.dmp

Filesize
3.9MB

Download
memory/3348-2049-0x00007FF6645E0000-0x00007FF6649D2000-memory.dmp

Filesize
3.9MB

Download
memory/3360-0-0x00007FF661970000-0x00007FF661D62000-memory.dmp

Filesize
3.9MB

Download
memory/3360-1-0x00000245E6F60000-0x00000245E6F70000-memory.dmp

Filesize
64KB

Download
memory/3468-61-0x00007FF7030D0000-0x00007FF7034C2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-2036-0x00007FF7030D0000-0x00007FF7034C2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-1994-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Filesize
10.8MB

Download
memory/3548-20-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Filesize
10.8MB

Download
memory/3548-13-0x00007FFFFD8A3000-0x00007FFFFD8A5000-memory.dmp

Filesize
8KB

Download
memory/3548-62-0x000001F072380000-0x000001F0723A2000-memory.dmp

Filesize
136KB

Download
memory/3548-259-0x000001F072F70000-0x000001F073716000-memory.dmp

Filesize
7.6MB

Download
memory/3548-53-0x00007FFFFD8A0000-0x00007FFFFE361000-memory.dmp

Filesize
10.8MB

Download
memory/3720-2032-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp

Filesize
3.9MB

Download
memory/3720-1997-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp

Filesize
3.9MB

Download
memory/3720-12-0x00007FF6BE610000-0x00007FF6BEA02000-memory.dmp

Filesize
3.9MB

Download
memory/4028-348-0x00007FF7CD9D0000-0x00007FF7CDDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-2051-0x00007FF7CD9D0000-0x00007FF7CDDC2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-2065-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp

Filesize
3.9MB

Download
memory/4244-305-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2070-0x00007FF7B2020000-0x00007FF7B2412000-memory.dmp

Filesize
3.9MB

Download
memory/4260-317-0x00007FF7B2020000-0x00007FF7B2412000-memory.dmp

Filesize
3.9MB

Download
memory/4480-2062-0x00007FF704580000-0x00007FF704972000-memory.dmp

Filesize
3.9MB

Download
memory/4480-308-0x00007FF704580000-0x00007FF704972000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2068-0x00007FF658A80000-0x00007FF658E72000-memory.dmp

Filesize
3.9MB

Download
memory/4692-321-0x00007FF658A80000-0x00007FF658E72000-memory.dmp

Filesize
3.9MB

Download
memory/5076-345-0x00007FF6A11E0000-0x00007FF6A15D2000-memory.dmp

Filesize
3.9MB

Download
memory/5076-2084-0x00007FF6A11E0000-0x00007FF6A15D2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-344-0x00007FF6E18A0000-0x00007FF6E1C92000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2093-0x00007FF6E18A0000-0x00007FF6E1C92000-memory.dmp

Filesize
3.9MB

Download
memory/5104-294-0x00007FF62AFE0000-0x00007FF62B3D2000-memory.dmp

Filesize
3.9MB

Download
memory/5104-2055-0x00007FF62AFE0000-0x00007FF62B3D2000-memory.dmp

Filesize
3.9MB

Download