xmrig | 98514f9ddea025448db573d443ec3cbda0f497279347f1f9bbf95254088bfcd9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
Size

1.7MB
MD5

b031a99b8d27f4e714b1c8d6bfc76940
SHA1

08db254ee681ab5474a33228a1e69f7c787d3bb1
SHA256

98514f9ddea025448db573d443ec3cbda0f497279347f1f9bbf95254088bfcd9
SHA512

c1799953b17aa5a637e075a387ba6442db3621e1f4506678efa4bef5208365adf1a49bfa7e783abc739ffcc83f0df5d7fc9cb313f41db46428dd5d3254207c66
SSDEEP

49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADb9:NABj

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/4180-60-0x00007FF7405C0000-0x00007FF7409B2000-memory.dmp	xmrig
behavioral2/memory/4440-65-0x00007FF6817B0000-0x00007FF681BA2000-memory.dmp	xmrig
behavioral2/memory/2644-86-0x00007FF69BA60000-0x00007FF69BE52000-memory.dmp	xmrig
behavioral2/memory/3940-88-0x00007FF6E07B0000-0x00007FF6E0BA2000-memory.dmp	xmrig
behavioral2/memory/2348-378-0x00007FF6EF780000-0x00007FF6EFB72000-memory.dmp	xmrig
behavioral2/memory/3208-380-0x00007FF74F6C0000-0x00007FF74FAB2000-memory.dmp	xmrig
behavioral2/memory/5040-379-0x00007FF602BA0000-0x00007FF602F92000-memory.dmp	xmrig
behavioral2/memory/1796-377-0x00007FF645F90000-0x00007FF646382000-memory.dmp	xmrig
behavioral2/memory/4260-381-0x00007FF668450000-0x00007FF668842000-memory.dmp	xmrig
behavioral2/memory/2056-132-0x00007FF7EB270000-0x00007FF7EB662000-memory.dmp	xmrig
behavioral2/memory/924-131-0x00007FF65FEE0000-0x00007FF6602D2000-memory.dmp	xmrig
behavioral2/memory/1880-126-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp	xmrig
behavioral2/memory/4880-119-0x00007FF75D150000-0x00007FF75D542000-memory.dmp	xmrig
behavioral2/memory/2940-382-0x00007FF6B2DE0000-0x00007FF6B31D2000-memory.dmp	xmrig
behavioral2/memory/1892-383-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp	xmrig
behavioral2/memory/1792-384-0x00007FF6F0770000-0x00007FF6F0B62000-memory.dmp	xmrig
behavioral2/memory/1044-1056-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp	xmrig
behavioral2/memory/2756-1087-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	xmrig
behavioral2/memory/2140-1990-0x00007FF789820000-0x00007FF789C12000-memory.dmp	xmrig
behavioral2/memory/3136-1999-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp	xmrig
behavioral2/memory/680-2218-0x00007FF6C6560000-0x00007FF6C6952000-memory.dmp	xmrig
behavioral2/memory/1836-2217-0x00007FF719290000-0x00007FF719682000-memory.dmp	xmrig
behavioral2/memory/4404-2236-0x00007FF79BD20000-0x00007FF79C112000-memory.dmp	xmrig
behavioral2/memory/3232-2237-0x00007FF772450000-0x00007FF772842000-memory.dmp	xmrig
behavioral2/memory/2728-2238-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp	xmrig
behavioral2/memory/1880-2253-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp	xmrig
behavioral2/memory/1892-2272-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp	xmrig
behavioral2/memory/4180-2274-0x00007FF7405C0000-0x00007FF7409B2000-memory.dmp	xmrig
behavioral2/memory/1044-2276-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp	xmrig
behavioral2/memory/4440-2278-0x00007FF6817B0000-0x00007FF681BA2000-memory.dmp	xmrig
behavioral2/memory/2140-2280-0x00007FF789820000-0x00007FF789C12000-memory.dmp	xmrig
behavioral2/memory/1836-2291-0x00007FF719290000-0x00007FF719682000-memory.dmp	xmrig
behavioral2/memory/3940-2288-0x00007FF6E07B0000-0x00007FF6E0BA2000-memory.dmp	xmrig
behavioral2/memory/2756-2292-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	xmrig
behavioral2/memory/4404-2294-0x00007FF79BD20000-0x00007FF79C112000-memory.dmp	xmrig
behavioral2/memory/680-2287-0x00007FF6C6560000-0x00007FF6C6952000-memory.dmp	xmrig
behavioral2/memory/2644-2283-0x00007FF69BA60000-0x00007FF69BE52000-memory.dmp	xmrig
behavioral2/memory/3136-2285-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp	xmrig
behavioral2/memory/3232-2296-0x00007FF772450000-0x00007FF772842000-memory.dmp	xmrig
behavioral2/memory/2728-2312-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp	xmrig
behavioral2/memory/4880-2314-0x00007FF75D150000-0x00007FF75D542000-memory.dmp	xmrig
behavioral2/memory/1880-2317-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp	xmrig
behavioral2/memory/2056-2320-0x00007FF7EB270000-0x00007FF7EB662000-memory.dmp	xmrig
behavioral2/memory/1796-2322-0x00007FF645F90000-0x00007FF646382000-memory.dmp	xmrig
behavioral2/memory/2348-2319-0x00007FF6EF780000-0x00007FF6EFB72000-memory.dmp	xmrig
behavioral2/memory/2940-2330-0x00007FF6B2DE0000-0x00007FF6B31D2000-memory.dmp	xmrig
behavioral2/memory/1792-2337-0x00007FF6F0770000-0x00007FF6F0B62000-memory.dmp	xmrig
behavioral2/memory/3208-2336-0x00007FF74F6C0000-0x00007FF74FAB2000-memory.dmp	xmrig
behavioral2/memory/4260-2334-0x00007FF668450000-0x00007FF668842000-memory.dmp	xmrig
behavioral2/memory/5040-2328-0x00007FF602BA0000-0x00007FF602F92000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
5	428	powershell.exe
7	428	powershell.exe
15	428	powershell.exe
16	428	powershell.exe
18	428	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
428	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1892	RNuBiYj.exe
4180	QBwjjwZ.exe
1044	XSPtGqr.exe
4440	tPncuOL.exe
2140	HGfOWXn.exe
2756	trzKnWc.exe
680	IuhWaGO.exe
4404	KUuAifo.exe
3136	iQCYClD.exe
1836	fuCbrbm.exe
2644	asZanAf.exe
3940	dtxzhlC.exe
3232	PbdtnLL.exe
2728	LFewvNk.exe
4880	qkzoTfU.exe
2056	eifiyJU.exe
1880	LukNRrV.exe
1796	upwgfXx.exe
2348	EckcAIA.exe
1792	tIBOTCH.exe
5040	YmbhKjz.exe
3208	ggkeyvv.exe
4260	xVmyPTa.exe
2940	AvplGaz.exe
3860	xjWIgwe.exe
2764	eCrlktP.exe
2460	nYZEsAq.exe
3664	fdAnAVz.exe
4168	NtubcTd.exe
4528	vnIFlmL.exe
2108	dbCYsrB.exe
1380	mCUNtXG.exe
2616	mvfYJSm.exe
4196	NaoVkUd.exe
3152	GwljqYE.exe
2516	jXSOUkx.exe
4588	geynIhW.exe
4948	hoKlhrV.exe
3888	esWOJhE.exe
1704	jsghilp.exe
4776	TepSMBx.exe
452	ClUbklf.exe
3968	zuNDUsE.exe
3832	MsGAnMl.exe
440	pwTbAeT.exe
400	EyPQOFd.exe
2392	GlYrrTH.exe
116	oBcGtTa.exe
2424	sPHPlZG.exe
3276	QctYwpc.exe
736	uvVqkdN.exe
4384	yBWNCRn.exe
4936	XvqFFrd.exe
3848	qcQFhVG.exe
3768	ofTqxDd.exe
5028	acRGaWi.exe
4344	WOInjoK.exe
2024	TqXuBxu.exe
1004	pPrNplv.exe
4228	SaLycMR.exe
3916	YrKoRcT.exe
3568	xISNrjs.exe
4664	UbZWZgx.exe
1460	TxIYESc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/924-0-0x00007FF65FEE0000-0x00007FF6602D2000-memory.dmp	upx
behavioral2/files/0x0006000000022f3c-5.dat	upx
behavioral2/memory/1892-6-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp	upx
behavioral2/files/0x0007000000023446-12.dat	upx
behavioral2/files/0x0007000000023447-27.dat	upx
behavioral2/memory/2140-32-0x00007FF789820000-0x00007FF789C12000-memory.dmp	upx
behavioral2/memory/2756-33-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	upx
behavioral2/memory/4180-60-0x00007FF7405C0000-0x00007FF7409B2000-memory.dmp	upx
behavioral2/memory/4440-65-0x00007FF6817B0000-0x00007FF681BA2000-memory.dmp	upx
behavioral2/memory/680-79-0x00007FF6C6560000-0x00007FF6C6952000-memory.dmp	upx
behavioral2/memory/4404-85-0x00007FF79BD20000-0x00007FF79C112000-memory.dmp	upx
behavioral2/memory/2644-86-0x00007FF69BA60000-0x00007FF69BE52000-memory.dmp	upx
behavioral2/files/0x0008000000023451-89.dat	upx
behavioral2/memory/3232-91-0x00007FF772450000-0x00007FF772842000-memory.dmp	upx
behavioral2/memory/3940-88-0x00007FF6E07B0000-0x00007FF6E0BA2000-memory.dmp	upx
behavioral2/files/0x000700000002344d-83.dat	upx
behavioral2/files/0x000700000002344e-82.dat	upx
behavioral2/files/0x000700000002344c-81.dat	upx
behavioral2/files/0x0007000000023452-74.dat	upx
behavioral2/files/0x000700000002344f-73.dat	upx
behavioral2/files/0x000700000002344b-71.dat	upx
behavioral2/memory/1836-70-0x00007FF719290000-0x00007FF719682000-memory.dmp	upx
behavioral2/memory/3136-66-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp	upx
behavioral2/files/0x000700000002344a-58.dat	upx
behavioral2/files/0x0007000000023449-41.dat	upx
behavioral2/files/0x0007000000023448-36.dat	upx
behavioral2/memory/1044-24-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp	upx
behavioral2/files/0x0008000000023450-98.dat	upx
behavioral2/files/0x0007000000023453-113.dat	upx
behavioral2/files/0x0007000000023454-118.dat	upx
behavioral2/files/0x0007000000023455-123.dat	upx
behavioral2/files/0x0007000000023458-136.dat	upx
behavioral2/files/0x0007000000023459-141.dat	upx
behavioral2/files/0x000700000002345c-156.dat	upx
behavioral2/files/0x0007000000023462-186.dat	upx
behavioral2/files/0x0007000000023464-196.dat	upx
behavioral2/memory/2348-378-0x00007FF6EF780000-0x00007FF6EFB72000-memory.dmp	upx
behavioral2/memory/3208-380-0x00007FF74F6C0000-0x00007FF74FAB2000-memory.dmp	upx
behavioral2/memory/5040-379-0x00007FF602BA0000-0x00007FF602F92000-memory.dmp	upx
behavioral2/memory/1796-377-0x00007FF645F90000-0x00007FF646382000-memory.dmp	upx
behavioral2/memory/4260-381-0x00007FF668450000-0x00007FF668842000-memory.dmp	upx
behavioral2/files/0x0007000000023463-191.dat	upx
behavioral2/files/0x0007000000023461-189.dat	upx
behavioral2/files/0x0007000000023460-184.dat	upx
behavioral2/files/0x000700000002345f-179.dat	upx
behavioral2/files/0x000700000002345e-174.dat	upx
behavioral2/files/0x000700000002345d-169.dat	upx
behavioral2/files/0x000700000002345b-159.dat	upx
behavioral2/files/0x000700000002345a-154.dat	upx
behavioral2/files/0x0007000000023457-139.dat	upx
behavioral2/memory/2056-132-0x00007FF7EB270000-0x00007FF7EB662000-memory.dmp	upx
behavioral2/memory/924-131-0x00007FF65FEE0000-0x00007FF6602D2000-memory.dmp	upx
behavioral2/files/0x0007000000023456-127.dat	upx
behavioral2/memory/1880-126-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp	upx
behavioral2/memory/4880-119-0x00007FF75D150000-0x00007FF75D542000-memory.dmp	upx
behavioral2/memory/2940-382-0x00007FF6B2DE0000-0x00007FF6B31D2000-memory.dmp	upx
behavioral2/memory/2728-105-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp	upx
behavioral2/files/0x0009000000023443-110.dat	upx
behavioral2/memory/1892-383-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp	upx
behavioral2/memory/1792-384-0x00007FF6F0770000-0x00007FF6F0B62000-memory.dmp	upx
behavioral2/memory/1044-1056-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp	upx
behavioral2/memory/2756-1087-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	upx
behavioral2/memory/2140-1990-0x00007FF789820000-0x00007FF789C12000-memory.dmp	upx
behavioral2/memory/3136-1999-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EckcAIA.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\OmlDBsl.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\HETThDg.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\iYnmXxx.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\WvynHAB.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\hLZaZlx.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\HIXBiAV.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\vEkUjLN.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\yUbceuI.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\GVdGosX.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\GpeLVwl.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\FGDecIG.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\qMKZEvt.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\ysqKLXR.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\GfEUNEq.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\ZkmxSyR.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\eGWmyNt.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\xISNrjs.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\GSmLWLI.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\ejaHdQX.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\JSoBGed.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\dyUWlZX.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\AjJxEwP.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\oBgwUWB.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\hpeprRZ.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\OjjUbsI.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\XhpRfaN.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\YNpxxtI.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\snawjjk.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\DAMoinj.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\hJNlAXe.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\xcwWWlZ.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\RxIdhUJ.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\AipTlDr.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\bhGJPFA.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\ncWBsAX.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\LqSbBnt.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\abdrWem.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\trzKnWc.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\NaoVkUd.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\wbJXHtL.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\flErzgY.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\fVzfSRD.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\cZeLUeb.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\LukNRrV.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\LpnrQsP.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\OthCELj.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\GHyrFFO.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\fvnHygn.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\jVGQpnA.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\aapwRMZ.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\sFjWhkC.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\PdHWmNs.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\DMfUsYz.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\KtyeoCN.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\oQSVVrZ.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\pkzXFIg.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\NUQeTEv.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\hAsTUlg.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\GjKvSxl.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\QctYwpc.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\WOInjoK.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\DmfvTCk.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
File created	C:\Windows\System\SySRyFv.exe	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
428	powershell.exe
428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
Token: SeDebugPrivilege	428	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 428	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	85
PID 924 wrote to memory of 428	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	85
PID 924 wrote to memory of 1892	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	86
PID 924 wrote to memory of 1892	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	86
PID 924 wrote to memory of 4180	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	87
PID 924 wrote to memory of 4180	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	87
PID 924 wrote to memory of 1044	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	88
PID 924 wrote to memory of 1044	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	88
PID 924 wrote to memory of 4440	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	89
PID 924 wrote to memory of 4440	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	89
PID 924 wrote to memory of 2140	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	90
PID 924 wrote to memory of 2140	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	90
PID 924 wrote to memory of 2756	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	91
PID 924 wrote to memory of 2756	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	91
PID 924 wrote to memory of 680	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	92
PID 924 wrote to memory of 680	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	92
PID 924 wrote to memory of 4404	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	93
PID 924 wrote to memory of 4404	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	93
PID 924 wrote to memory of 2644	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	94
PID 924 wrote to memory of 2644	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	94
PID 924 wrote to memory of 3136	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	95
PID 924 wrote to memory of 3136	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	95
PID 924 wrote to memory of 1836	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	96
PID 924 wrote to memory of 1836	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	96
PID 924 wrote to memory of 3940	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	97
PID 924 wrote to memory of 3940	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	97
PID 924 wrote to memory of 3232	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	98
PID 924 wrote to memory of 3232	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	98
PID 924 wrote to memory of 2728	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	99
PID 924 wrote to memory of 2728	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	99
PID 924 wrote to memory of 4880	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	102
PID 924 wrote to memory of 4880	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	102
PID 924 wrote to memory of 2056	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	103
PID 924 wrote to memory of 2056	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	103
PID 924 wrote to memory of 1880	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	104
PID 924 wrote to memory of 1880	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	104
PID 924 wrote to memory of 1796	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	105
PID 924 wrote to memory of 1796	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	105
PID 924 wrote to memory of 2348	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	106
PID 924 wrote to memory of 2348	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	106
PID 924 wrote to memory of 1792	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	107
PID 924 wrote to memory of 1792	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	107
PID 924 wrote to memory of 5040	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	108
PID 924 wrote to memory of 5040	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	108
PID 924 wrote to memory of 3208	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	109
PID 924 wrote to memory of 3208	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	109
PID 924 wrote to memory of 4260	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	110
PID 924 wrote to memory of 4260	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	110
PID 924 wrote to memory of 2940	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	111
PID 924 wrote to memory of 2940	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	111
PID 924 wrote to memory of 3860	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	112
PID 924 wrote to memory of 3860	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	112
PID 924 wrote to memory of 2764	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	113
PID 924 wrote to memory of 2764	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	113
PID 924 wrote to memory of 2460	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	114
PID 924 wrote to memory of 2460	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	114
PID 924 wrote to memory of 3664	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	115
PID 924 wrote to memory of 3664	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	115
PID 924 wrote to memory of 4168	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	116
PID 924 wrote to memory of 4168	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	116
PID 924 wrote to memory of 4528	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	117
PID 924 wrote to memory of 4528	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	117
PID 924 wrote to memory of 2108	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	118
PID 924 wrote to memory of 2108	924	b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe	118

C:\Users\Admin\AppData\Local\Temp\b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b031a99b8d27f4e714b1c8d6bfc76940_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\System\RNuBiYj.exe
  C:\Windows\System\RNuBiYj.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\QBwjjwZ.exe
  C:\Windows\System\QBwjjwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\XSPtGqr.exe
  C:\Windows\System\XSPtGqr.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\tPncuOL.exe
  C:\Windows\System\tPncuOL.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\HGfOWXn.exe
  C:\Windows\System\HGfOWXn.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\trzKnWc.exe
  C:\Windows\System\trzKnWc.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\IuhWaGO.exe
  C:\Windows\System\IuhWaGO.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\KUuAifo.exe
  C:\Windows\System\KUuAifo.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\asZanAf.exe
  C:\Windows\System\asZanAf.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\iQCYClD.exe
  C:\Windows\System\iQCYClD.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\fuCbrbm.exe
  C:\Windows\System\fuCbrbm.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\dtxzhlC.exe
  C:\Windows\System\dtxzhlC.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\PbdtnLL.exe
  C:\Windows\System\PbdtnLL.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\LFewvNk.exe
  C:\Windows\System\LFewvNk.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qkzoTfU.exe
  C:\Windows\System\qkzoTfU.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\eifiyJU.exe
  C:\Windows\System\eifiyJU.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\LukNRrV.exe
  C:\Windows\System\LukNRrV.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\upwgfXx.exe
  C:\Windows\System\upwgfXx.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\EckcAIA.exe
  C:\Windows\System\EckcAIA.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\tIBOTCH.exe
  C:\Windows\System\tIBOTCH.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\YmbhKjz.exe
  C:\Windows\System\YmbhKjz.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\ggkeyvv.exe
  C:\Windows\System\ggkeyvv.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\xVmyPTa.exe
  C:\Windows\System\xVmyPTa.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\AvplGaz.exe
  C:\Windows\System\AvplGaz.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\xjWIgwe.exe
  C:\Windows\System\xjWIgwe.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\eCrlktP.exe
  C:\Windows\System\eCrlktP.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\nYZEsAq.exe
  C:\Windows\System\nYZEsAq.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\fdAnAVz.exe
  C:\Windows\System\fdAnAVz.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\NtubcTd.exe
  C:\Windows\System\NtubcTd.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\vnIFlmL.exe
  C:\Windows\System\vnIFlmL.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\dbCYsrB.exe
  C:\Windows\System\dbCYsrB.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\mCUNtXG.exe
  C:\Windows\System\mCUNtXG.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\mvfYJSm.exe
  C:\Windows\System\mvfYJSm.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\NaoVkUd.exe
  C:\Windows\System\NaoVkUd.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\GwljqYE.exe
  C:\Windows\System\GwljqYE.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\jXSOUkx.exe
  C:\Windows\System\jXSOUkx.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\geynIhW.exe
  C:\Windows\System\geynIhW.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\hoKlhrV.exe
  C:\Windows\System\hoKlhrV.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\esWOJhE.exe
  C:\Windows\System\esWOJhE.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\jsghilp.exe
  C:\Windows\System\jsghilp.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\TepSMBx.exe
  C:\Windows\System\TepSMBx.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\ClUbklf.exe
  C:\Windows\System\ClUbklf.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\zuNDUsE.exe
  C:\Windows\System\zuNDUsE.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\MsGAnMl.exe
  C:\Windows\System\MsGAnMl.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\pwTbAeT.exe
  C:\Windows\System\pwTbAeT.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\EyPQOFd.exe
  C:\Windows\System\EyPQOFd.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\GlYrrTH.exe
  C:\Windows\System\GlYrrTH.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\oBcGtTa.exe
  C:\Windows\System\oBcGtTa.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\sPHPlZG.exe
  C:\Windows\System\sPHPlZG.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\QctYwpc.exe
  C:\Windows\System\QctYwpc.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\uvVqkdN.exe
  C:\Windows\System\uvVqkdN.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\yBWNCRn.exe
  C:\Windows\System\yBWNCRn.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\XvqFFrd.exe
  C:\Windows\System\XvqFFrd.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\qcQFhVG.exe
  C:\Windows\System\qcQFhVG.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\ofTqxDd.exe
  C:\Windows\System\ofTqxDd.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\acRGaWi.exe
  C:\Windows\System\acRGaWi.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\WOInjoK.exe
  C:\Windows\System\WOInjoK.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\TqXuBxu.exe
  C:\Windows\System\TqXuBxu.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\pPrNplv.exe
  C:\Windows\System\pPrNplv.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\SaLycMR.exe
  C:\Windows\System\SaLycMR.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\YrKoRcT.exe
  C:\Windows\System\YrKoRcT.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\xISNrjs.exe
  C:\Windows\System\xISNrjs.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\UbZWZgx.exe
  C:\Windows\System\UbZWZgx.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\TxIYESc.exe
  C:\Windows\System\TxIYESc.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\DIRvnuD.exe
  C:\Windows\System\DIRvnuD.exe
  2⤵
  PID:2720
- C:\Windows\System\dyUWlZX.exe
  C:\Windows\System\dyUWlZX.exe
  2⤵
  PID:1652
- C:\Windows\System\NtasZHD.exe
  C:\Windows\System\NtasZHD.exe
  2⤵
  PID:876
- C:\Windows\System\AjJxEwP.exe
  C:\Windows\System\AjJxEwP.exe
  2⤵
  PID:2568
- C:\Windows\System\SshOufl.exe
  C:\Windows\System\SshOufl.exe
  2⤵
  PID:5056
- C:\Windows\System\DAMoinj.exe
  C:\Windows\System\DAMoinj.exe
  2⤵
  PID:1236
- C:\Windows\System\aOWkziy.exe
  C:\Windows\System\aOWkziy.exe
  2⤵
  PID:2936
- C:\Windows\System\oBgwUWB.exe
  C:\Windows\System\oBgwUWB.exe
  2⤵
  PID:5140
- C:\Windows\System\cRdYGiA.exe
  C:\Windows\System\cRdYGiA.exe
  2⤵
  PID:5168
- C:\Windows\System\ZVoWpTG.exe
  C:\Windows\System\ZVoWpTG.exe
  2⤵
  PID:5192
- C:\Windows\System\yXcdcEJ.exe
  C:\Windows\System\yXcdcEJ.exe
  2⤵
  PID:5220
- C:\Windows\System\JjmIIyY.exe
  C:\Windows\System\JjmIIyY.exe
  2⤵
  PID:5252
- C:\Windows\System\akqgkjs.exe
  C:\Windows\System\akqgkjs.exe
  2⤵
  PID:5280
- C:\Windows\System\hAiGFMr.exe
  C:\Windows\System\hAiGFMr.exe
  2⤵
  PID:5308
- C:\Windows\System\PTLEhwc.exe
  C:\Windows\System\PTLEhwc.exe
  2⤵
  PID:5332
- C:\Windows\System\ygGHoWC.exe
  C:\Windows\System\ygGHoWC.exe
  2⤵
  PID:5364
- C:\Windows\System\RCgkKsO.exe
  C:\Windows\System\RCgkKsO.exe
  2⤵
  PID:5392
- C:\Windows\System\bfOGeuB.exe
  C:\Windows\System\bfOGeuB.exe
  2⤵
  PID:5420
- C:\Windows\System\ownstBY.exe
  C:\Windows\System\ownstBY.exe
  2⤵
  PID:5448
- C:\Windows\System\VfWSvxq.exe
  C:\Windows\System\VfWSvxq.exe
  2⤵
  PID:5476
- C:\Windows\System\WAuBOgq.exe
  C:\Windows\System\WAuBOgq.exe
  2⤵
  PID:5504
- C:\Windows\System\VXiGaAo.exe
  C:\Windows\System\VXiGaAo.exe
  2⤵
  PID:5532
- C:\Windows\System\TOITEXd.exe
  C:\Windows\System\TOITEXd.exe
  2⤵
  PID:5560
- C:\Windows\System\qUBxhvW.exe
  C:\Windows\System\qUBxhvW.exe
  2⤵
  PID:5588
- C:\Windows\System\AVcFRuy.exe
  C:\Windows\System\AVcFRuy.exe
  2⤵
  PID:5616
- C:\Windows\System\LYDMgeV.exe
  C:\Windows\System\LYDMgeV.exe
  2⤵
  PID:5644
- C:\Windows\System\DyCTbpx.exe
  C:\Windows\System\DyCTbpx.exe
  2⤵
  PID:5676
- C:\Windows\System\wZXikmA.exe
  C:\Windows\System\wZXikmA.exe
  2⤵
  PID:5700
- C:\Windows\System\smYaHAL.exe
  C:\Windows\System\smYaHAL.exe
  2⤵
  PID:5728
- C:\Windows\System\JAGBzmQ.exe
  C:\Windows\System\JAGBzmQ.exe
  2⤵
  PID:5756
- C:\Windows\System\xfzBVDK.exe
  C:\Windows\System\xfzBVDK.exe
  2⤵
  PID:5860
- C:\Windows\System\GakFXNq.exe
  C:\Windows\System\GakFXNq.exe
  2⤵
  PID:5904
- C:\Windows\System\apHzclP.exe
  C:\Windows\System\apHzclP.exe
  2⤵
  PID:5920
- C:\Windows\System\shlpdYx.exe
  C:\Windows\System\shlpdYx.exe
  2⤵
  PID:5944
- C:\Windows\System\GYtPzra.exe
  C:\Windows\System\GYtPzra.exe
  2⤵
  PID:5960
- C:\Windows\System\znowATh.exe
  C:\Windows\System\znowATh.exe
  2⤵
  PID:5996
- C:\Windows\System\bQoTCtI.exe
  C:\Windows\System\bQoTCtI.exe
  2⤵
  PID:6036
- C:\Windows\System\gpWIflh.exe
  C:\Windows\System\gpWIflh.exe
  2⤵
  PID:6064
- C:\Windows\System\cOpqGDk.exe
  C:\Windows\System\cOpqGDk.exe
  2⤵
  PID:6104
- C:\Windows\System\DmfvTCk.exe
  C:\Windows\System\DmfvTCk.exe
  2⤵
  PID:6136
- C:\Windows\System\RtPzomd.exe
  C:\Windows\System\RtPzomd.exe
  2⤵
  PID:720
- C:\Windows\System\hJNlAXe.exe
  C:\Windows\System\hJNlAXe.exe
  2⤵
  PID:1576
- C:\Windows\System\SySRyFv.exe
  C:\Windows\System\SySRyFv.exe
  2⤵
  PID:2008
- C:\Windows\System\EEVzeYn.exe
  C:\Windows\System\EEVzeYn.exe
  2⤵
  PID:5128
- C:\Windows\System\OmlDBsl.exe
  C:\Windows\System\OmlDBsl.exe
  2⤵
  PID:5208
- C:\Windows\System\BTWQAfj.exe
  C:\Windows\System\BTWQAfj.exe
  2⤵
  PID:2096
- C:\Windows\System\AQAsXpg.exe
  C:\Windows\System\AQAsXpg.exe
  2⤵
  PID:5268
- C:\Windows\System\VqqbAMN.exe
  C:\Windows\System\VqqbAMN.exe
  2⤵
  PID:5320
- C:\Windows\System\vabPAIQ.exe
  C:\Windows\System\vabPAIQ.exe
  2⤵
  PID:5432
- C:\Windows\System\TyUcaOB.exe
  C:\Windows\System\TyUcaOB.exe
  2⤵
  PID:5492
- C:\Windows\System\MEIEIgb.exe
  C:\Windows\System\MEIEIgb.exe
  2⤵
  PID:5544
- C:\Windows\System\IvXWpmT.exe
  C:\Windows\System\IvXWpmT.exe
  2⤵
  PID:5576
- C:\Windows\System\OjjUbsI.exe
  C:\Windows\System\OjjUbsI.exe
  2⤵
  PID:5604
- C:\Windows\System\dzZlTrL.exe
  C:\Windows\System\dzZlTrL.exe
  2⤵
  PID:4308
- C:\Windows\System\GifVHiH.exe
  C:\Windows\System\GifVHiH.exe
  2⤵
  PID:5632
- C:\Windows\System\iuqDXJL.exe
  C:\Windows\System\iuqDXJL.exe
  2⤵
  PID:4852
- C:\Windows\System\wTcCUFR.exe
  C:\Windows\System\wTcCUFR.exe
  2⤵
  PID:2844
- C:\Windows\System\sjaojqc.exe
  C:\Windows\System\sjaojqc.exe
  2⤵
  PID:5744
- C:\Windows\System\tQiQdGl.exe
  C:\Windows\System\tQiQdGl.exe
  2⤵
  PID:4248
- C:\Windows\System\DAIkgoF.exe
  C:\Windows\System\DAIkgoF.exe
  2⤵
  PID:868
- C:\Windows\System\tIcwHIr.exe
  C:\Windows\System\tIcwHIr.exe
  2⤵
  PID:3608
- C:\Windows\System\WnarGGU.exe
  C:\Windows\System\WnarGGU.exe
  2⤵
  PID:5872
- C:\Windows\System\lYmphVE.exe
  C:\Windows\System\lYmphVE.exe
  2⤵
  PID:5932
- C:\Windows\System\LpnrQsP.exe
  C:\Windows\System\LpnrQsP.exe
  2⤵
  PID:5992
- C:\Windows\System\TGMmUSs.exe
  C:\Windows\System\TGMmUSs.exe
  2⤵
  PID:6056
- C:\Windows\System\GSmLWLI.exe
  C:\Windows\System\GSmLWLI.exe
  2⤵
  PID:6096
- C:\Windows\System\vJXlOAn.exe
  C:\Windows\System\vJXlOAn.exe
  2⤵
  PID:5784
- C:\Windows\System\lrHDHUo.exe
  C:\Windows\System\lrHDHUo.exe
  2⤵
  PID:5076
- C:\Windows\System\OthCELj.exe
  C:\Windows\System\OthCELj.exe
  2⤵
  PID:1120
- C:\Windows\System\oqwTvSz.exe
  C:\Windows\System\oqwTvSz.exe
  2⤵
  PID:5244
- C:\Windows\System\bpXzIHp.exe
  C:\Windows\System\bpXzIHp.exe
  2⤵
  PID:5352
- C:\Windows\System\HswDkBm.exe
  C:\Windows\System\HswDkBm.exe
  2⤵
  PID:5496
- C:\Windows\System\JJeHfxf.exe
  C:\Windows\System\JJeHfxf.exe
  2⤵
  PID:5052
- C:\Windows\System\NRTfPdh.exe
  C:\Windows\System\NRTfPdh.exe
  2⤵
  PID:5720
- C:\Windows\System\ZDcukKM.exe
  C:\Windows\System\ZDcukKM.exe
  2⤵
  PID:4940
- C:\Windows\System\VIyCipI.exe
  C:\Windows\System\VIyCipI.exe
  2⤵
  PID:4012
- C:\Windows\System\dvgeZmo.exe
  C:\Windows\System\dvgeZmo.exe
  2⤵
  PID:5008
- C:\Windows\System\NjvYXik.exe
  C:\Windows\System\NjvYXik.exe
  2⤵
  PID:5816
- C:\Windows\System\SDLGXiW.exe
  C:\Windows\System\SDLGXiW.exe
  2⤵
  PID:2104
- C:\Windows\System\HETThDg.exe
  C:\Windows\System\HETThDg.exe
  2⤵
  PID:1188
- C:\Windows\System\tRUsvkF.exe
  C:\Windows\System\tRUsvkF.exe
  2⤵
  PID:4428
- C:\Windows\System\QeJPbWg.exe
  C:\Windows\System\QeJPbWg.exe
  2⤵
  PID:5072
- C:\Windows\System\heEMJao.exe
  C:\Windows\System\heEMJao.exe
  2⤵
  PID:5236
- C:\Windows\System\oKSQQLC.exe
  C:\Windows\System\oKSQQLC.exe
  2⤵
  PID:1108
- C:\Windows\System\tzewAqZ.exe
  C:\Windows\System\tzewAqZ.exe
  2⤵
  PID:5668
- C:\Windows\System\llnyqaV.exe
  C:\Windows\System\llnyqaV.exe
  2⤵
  PID:5804
- C:\Windows\System\ozfoPAK.exe
  C:\Windows\System\ozfoPAK.exe
  2⤵
  PID:6156
- C:\Windows\System\BiHEOkN.exe
  C:\Windows\System\BiHEOkN.exe
  2⤵
  PID:6184
- C:\Windows\System\qMvTmuz.exe
  C:\Windows\System\qMvTmuz.exe
  2⤵
  PID:6212
- C:\Windows\System\QDNGcrv.exe
  C:\Windows\System\QDNGcrv.exe
  2⤵
  PID:6244
- C:\Windows\System\zWMoEBj.exe
  C:\Windows\System\zWMoEBj.exe
  2⤵
  PID:6264
- C:\Windows\System\kpNrESH.exe
  C:\Windows\System\kpNrESH.exe
  2⤵
  PID:6304
- C:\Windows\System\fErDsml.exe
  C:\Windows\System\fErDsml.exe
  2⤵
  PID:6324
- C:\Windows\System\CdRFywM.exe
  C:\Windows\System\CdRFywM.exe
  2⤵
  PID:6352
- C:\Windows\System\cwQsbOq.exe
  C:\Windows\System\cwQsbOq.exe
  2⤵
  PID:6368
- C:\Windows\System\KVOALjU.exe
  C:\Windows\System\KVOALjU.exe
  2⤵
  PID:6408
- C:\Windows\System\EraOIeu.exe
  C:\Windows\System\EraOIeu.exe
  2⤵
  PID:6436
- C:\Windows\System\cOHAhng.exe
  C:\Windows\System\cOHAhng.exe
  2⤵
  PID:6464
- C:\Windows\System\LZeSwiA.exe
  C:\Windows\System\LZeSwiA.exe
  2⤵
  PID:6480
- C:\Windows\System\ejaHdQX.exe
  C:\Windows\System\ejaHdQX.exe
  2⤵
  PID:6508
- C:\Windows\System\DQPLaZe.exe
  C:\Windows\System\DQPLaZe.exe
  2⤵
  PID:6572
- C:\Windows\System\GHyrFFO.exe
  C:\Windows\System\GHyrFFO.exe
  2⤵
  PID:6592
- C:\Windows\System\HTbErAh.exe
  C:\Windows\System\HTbErAh.exe
  2⤵
  PID:6616
- C:\Windows\System\EuEkHPT.exe
  C:\Windows\System\EuEkHPT.exe
  2⤵
  PID:6632
- C:\Windows\System\mvhRhpL.exe
  C:\Windows\System\mvhRhpL.exe
  2⤵
  PID:6660
- C:\Windows\System\iYnmXxx.exe
  C:\Windows\System\iYnmXxx.exe
  2⤵
  PID:6688
- C:\Windows\System\lBFZUqZ.exe
  C:\Windows\System\lBFZUqZ.exe
  2⤵
  PID:6724
- C:\Windows\System\bUDAdjm.exe
  C:\Windows\System\bUDAdjm.exe
  2⤵
  PID:6744
- C:\Windows\System\TyoLEhz.exe
  C:\Windows\System\TyoLEhz.exe
  2⤵
  PID:6780
- C:\Windows\System\NIcdOMD.exe
  C:\Windows\System\NIcdOMD.exe
  2⤵
  PID:6820
- C:\Windows\System\oUAerpP.exe
  C:\Windows\System\oUAerpP.exe
  2⤵
  PID:6840
- C:\Windows\System\GeKXiZC.exe
  C:\Windows\System\GeKXiZC.exe
  2⤵
  PID:6856
- C:\Windows\System\pqDYkVE.exe
  C:\Windows\System\pqDYkVE.exe
  2⤵
  PID:6884
- C:\Windows\System\XbILWwm.exe
  C:\Windows\System\XbILWwm.exe
  2⤵
  PID:6920
- C:\Windows\System\jzdBkjc.exe
  C:\Windows\System\jzdBkjc.exe
  2⤵
  PID:6940
- C:\Windows\System\ELvEUww.exe
  C:\Windows\System\ELvEUww.exe
  2⤵
  PID:6972
- C:\Windows\System\haLrOpb.exe
  C:\Windows\System\haLrOpb.exe
  2⤵
  PID:6996
- C:\Windows\System\qamKCSK.exe
  C:\Windows\System\qamKCSK.exe
  2⤵
  PID:7012
- C:\Windows\System\CebdSHS.exe
  C:\Windows\System\CebdSHS.exe
  2⤵
  PID:7036
- C:\Windows\System\fRAzLQT.exe
  C:\Windows\System\fRAzLQT.exe
  2⤵
  PID:7052
- C:\Windows\System\ecUvOlp.exe
  C:\Windows\System\ecUvOlp.exe
  2⤵
  PID:7076
- C:\Windows\System\SOjikAq.exe
  C:\Windows\System\SOjikAq.exe
  2⤵
  PID:7096
- C:\Windows\System\xfjxoOW.exe
  C:\Windows\System\xfjxoOW.exe
  2⤵
  PID:7136
- C:\Windows\System\eCkbwDi.exe
  C:\Windows\System\eCkbwDi.exe
  2⤵
  PID:7160
- C:\Windows\System\vgNbzXT.exe
  C:\Windows\System\vgNbzXT.exe
  2⤵
  PID:5852
- C:\Windows\System\DWWLBQC.exe
  C:\Windows\System\DWWLBQC.exe
  2⤵
  PID:6152
- C:\Windows\System\lsWkBFM.exe
  C:\Windows\System\lsWkBFM.exe
  2⤵
  PID:6256
- C:\Windows\System\vrLaVem.exe
  C:\Windows\System\vrLaVem.exe
  2⤵
  PID:6312
- C:\Windows\System\PdHWmNs.exe
  C:\Windows\System\PdHWmNs.exe
  2⤵
  PID:6380
- C:\Windows\System\woFIBsI.exe
  C:\Windows\System\woFIBsI.exe
  2⤵
  PID:6400
- C:\Windows\System\zweWOly.exe
  C:\Windows\System\zweWOly.exe
  2⤵
  PID:6448
- C:\Windows\System\FrozGTD.exe
  C:\Windows\System\FrozGTD.exe
  2⤵
  PID:6476
- C:\Windows\System\HIXBiAV.exe
  C:\Windows\System\HIXBiAV.exe
  2⤵
  PID:6584
- C:\Windows\System\vEkUjLN.exe
  C:\Windows\System\vEkUjLN.exe
  2⤵
  PID:6624
- C:\Windows\System\yUnYZmt.exe
  C:\Windows\System\yUnYZmt.exe
  2⤵
  PID:6712
- C:\Windows\System\ypOBnsS.exe
  C:\Windows\System\ypOBnsS.exe
  2⤵
  PID:6752
- C:\Windows\System\RqaQvXQ.exe
  C:\Windows\System\RqaQvXQ.exe
  2⤵
  PID:6804
- C:\Windows\System\OWwkEzT.exe
  C:\Windows\System\OWwkEzT.exe
  2⤵
  PID:6832
- C:\Windows\System\YJZyezv.exe
  C:\Windows\System\YJZyezv.exe
  2⤵
  PID:6880
- C:\Windows\System\LyOqCui.exe
  C:\Windows\System\LyOqCui.exe
  2⤵
  PID:6980
- C:\Windows\System\hQYfQuI.exe
  C:\Windows\System\hQYfQuI.exe
  2⤵
  PID:6292
- C:\Windows\System\EyrsdaX.exe
  C:\Windows\System\EyrsdaX.exe
  2⤵
  PID:6428
- C:\Windows\System\nLCshnh.exe
  C:\Windows\System\nLCshnh.exe
  2⤵
  PID:6656
- C:\Windows\System\luKqQVe.exe
  C:\Windows\System\luKqQVe.exe
  2⤵
  PID:6792
- C:\Windows\System\cFAaNuu.exe
  C:\Windows\System\cFAaNuu.exe
  2⤵
  PID:7108
- C:\Windows\System\GoCEXlK.exe
  C:\Windows\System\GoCEXlK.exe
  2⤵
  PID:4324
- C:\Windows\System\DWNyUnz.exe
  C:\Windows\System\DWNyUnz.exe
  2⤵
  PID:6236
- C:\Windows\System\llvndfd.exe
  C:\Windows\System\llvndfd.exe
  2⤵
  PID:6772
- C:\Windows\System\NUZKhTH.exe
  C:\Windows\System\NUZKhTH.exe
  2⤵
  PID:7028
- C:\Windows\System\AEHMLDl.exe
  C:\Windows\System\AEHMLDl.exe
  2⤵
  PID:6548
- C:\Windows\System\wJxrRAg.exe
  C:\Windows\System\wJxrRAg.exe
  2⤵
  PID:7176
- C:\Windows\System\hnaadZz.exe
  C:\Windows\System\hnaadZz.exe
  2⤵
  PID:7232
- C:\Windows\System\fjtGYxu.exe
  C:\Windows\System\fjtGYxu.exe
  2⤵
  PID:7248
- C:\Windows\System\mdAsKsE.exe
  C:\Windows\System\mdAsKsE.exe
  2⤵
  PID:7268
- C:\Windows\System\AIUtkNM.exe
  C:\Windows\System\AIUtkNM.exe
  2⤵
  PID:7284
- C:\Windows\System\DMfUsYz.exe
  C:\Windows\System\DMfUsYz.exe
  2⤵
  PID:7304
- C:\Windows\System\rYBMnob.exe
  C:\Windows\System\rYBMnob.exe
  2⤵
  PID:7332
- C:\Windows\System\ZaOTywE.exe
  C:\Windows\System\ZaOTywE.exe
  2⤵
  PID:7352
- C:\Windows\System\ZlMgiqb.exe
  C:\Windows\System\ZlMgiqb.exe
  2⤵
  PID:7372
- C:\Windows\System\rORiyRz.exe
  C:\Windows\System\rORiyRz.exe
  2⤵
  PID:7416
- C:\Windows\System\suYHYWa.exe
  C:\Windows\System\suYHYWa.exe
  2⤵
  PID:7436
- C:\Windows\System\wlEbgPm.exe
  C:\Windows\System\wlEbgPm.exe
  2⤵
  PID:7464
- C:\Windows\System\hpeprRZ.exe
  C:\Windows\System\hpeprRZ.exe
  2⤵
  PID:7484
- C:\Windows\System\fvnHygn.exe
  C:\Windows\System\fvnHygn.exe
  2⤵
  PID:7508
- C:\Windows\System\UejGBWr.exe
  C:\Windows\System\UejGBWr.exe
  2⤵
  PID:7528
- C:\Windows\System\DNWYokJ.exe
  C:\Windows\System\DNWYokJ.exe
  2⤵
  PID:7604
- C:\Windows\System\OxpnluQ.exe
  C:\Windows\System\OxpnluQ.exe
  2⤵
  PID:7624
- C:\Windows\System\GpeLVwl.exe
  C:\Windows\System\GpeLVwl.exe
  2⤵
  PID:7644
- C:\Windows\System\pSbESSy.exe
  C:\Windows\System\pSbESSy.exe
  2⤵
  PID:7684
- C:\Windows\System\rQPuNDP.exe
  C:\Windows\System\rQPuNDP.exe
  2⤵
  PID:7712
- C:\Windows\System\pmNhvYE.exe
  C:\Windows\System\pmNhvYE.exe
  2⤵
  PID:7732
- C:\Windows\System\cgVORbq.exe
  C:\Windows\System\cgVORbq.exe
  2⤵
  PID:7752
- C:\Windows\System\SAsyTPJ.exe
  C:\Windows\System\SAsyTPJ.exe
  2⤵
  PID:7784
- C:\Windows\System\jVGQpnA.exe
  C:\Windows\System\jVGQpnA.exe
  2⤵
  PID:7804
- C:\Windows\System\TATJozr.exe
  C:\Windows\System\TATJozr.exe
  2⤵
  PID:7824
- C:\Windows\System\sPrCHuA.exe
  C:\Windows\System\sPrCHuA.exe
  2⤵
  PID:7880
- C:\Windows\System\FGDecIG.exe
  C:\Windows\System\FGDecIG.exe
  2⤵
  PID:7896
- C:\Windows\System\jhWlaqW.exe
  C:\Windows\System\jhWlaqW.exe
  2⤵
  PID:7920
- C:\Windows\System\XBgxZWV.exe
  C:\Windows\System\XBgxZWV.exe
  2⤵
  PID:7940
- C:\Windows\System\LOcLXNr.exe
  C:\Windows\System\LOcLXNr.exe
  2⤵
  PID:7968
- C:\Windows\System\ZCwYJTB.exe
  C:\Windows\System\ZCwYJTB.exe
  2⤵
  PID:8020
- C:\Windows\System\jhjwpgG.exe
  C:\Windows\System\jhjwpgG.exe
  2⤵
  PID:8040
- C:\Windows\System\VJPyJug.exe
  C:\Windows\System\VJPyJug.exe
  2⤵
  PID:8084
- C:\Windows\System\JHkvGPr.exe
  C:\Windows\System\JHkvGPr.exe
  2⤵
  PID:8124
- C:\Windows\System\KlosYuH.exe
  C:\Windows\System\KlosYuH.exe
  2⤵
  PID:8144
- C:\Windows\System\wbJXHtL.exe
  C:\Windows\System\wbJXHtL.exe
  2⤵
  PID:8172
- C:\Windows\System\etSJduU.exe
  C:\Windows\System\etSJduU.exe
  2⤵
  PID:8188
- C:\Windows\System\koMjVgx.exe
  C:\Windows\System\koMjVgx.exe
  2⤵
  PID:6020
- C:\Windows\System\FZbaOzO.exe
  C:\Windows\System\FZbaOzO.exe
  2⤵
  PID:7264
- C:\Windows\System\JaWfhvS.exe
  C:\Windows\System\JaWfhvS.exe
  2⤵
  PID:7296
- C:\Windows\System\IlKIGeu.exe
  C:\Windows\System\IlKIGeu.exe
  2⤵
  PID:7340
- C:\Windows\System\pXNEaVI.exe
  C:\Windows\System\pXNEaVI.exe
  2⤵
  PID:7364
- C:\Windows\System\dfVQldt.exe
  C:\Windows\System\dfVQldt.exe
  2⤵
  PID:7480
- C:\Windows\System\rQvUPix.exe
  C:\Windows\System\rQvUPix.exe
  2⤵
  PID:7600
- C:\Windows\System\KtyeoCN.exe
  C:\Windows\System\KtyeoCN.exe
  2⤵
  PID:7616
- C:\Windows\System\LjpfyHD.exe
  C:\Windows\System\LjpfyHD.exe
  2⤵
  PID:7704
- C:\Windows\System\sdTguYe.exe
  C:\Windows\System\sdTguYe.exe
  2⤵
  PID:7748
- C:\Windows\System\JuPpBLV.exe
  C:\Windows\System\JuPpBLV.exe
  2⤵
  PID:7860
- C:\Windows\System\ncWBsAX.exe
  C:\Windows\System\ncWBsAX.exe
  2⤵
  PID:7888
- C:\Windows\System\DNNiYve.exe
  C:\Windows\System\DNNiYve.exe
  2⤵
  PID:8016
- C:\Windows\System\UTVGBLi.exe
  C:\Windows\System\UTVGBLi.exe
  2⤵
  PID:8076
- C:\Windows\System\LCrXbiJ.exe
  C:\Windows\System\LCrXbiJ.exe
  2⤵
  PID:8156
- C:\Windows\System\dcoZHop.exe
  C:\Windows\System\dcoZHop.exe
  2⤵
  PID:8136
- C:\Windows\System\nIqWqdB.exe
  C:\Windows\System\nIqWqdB.exe
  2⤵
  PID:7312
- C:\Windows\System\pTdzZJr.exe
  C:\Windows\System\pTdzZJr.exe
  2⤵
  PID:7568
- C:\Windows\System\xiaNArb.exe
  C:\Windows\System\xiaNArb.exe
  2⤵
  PID:7572
- C:\Windows\System\vDxokzb.exe
  C:\Windows\System\vDxokzb.exe
  2⤵
  PID:7836
- C:\Windows\System\kLutyyL.exe
  C:\Windows\System\kLutyyL.exe
  2⤵
  PID:7960
- C:\Windows\System\eMLcoWI.exe
  C:\Windows\System\eMLcoWI.exe
  2⤵
  PID:8120
- C:\Windows\System\xfZbKNJ.exe
  C:\Windows\System\xfZbKNJ.exe
  2⤵
  PID:7496
- C:\Windows\System\tIdMxAS.exe
  C:\Windows\System\tIdMxAS.exe
  2⤵
  PID:7696
- C:\Windows\System\pIiyvwc.exe
  C:\Windows\System\pIiyvwc.exe
  2⤵
  PID:7728
- C:\Windows\System\pYwOhFV.exe
  C:\Windows\System\pYwOhFV.exe
  2⤵
  PID:7324
- C:\Windows\System\ajIWEii.exe
  C:\Windows\System\ajIWEii.exe
  2⤵
  PID:8068
- C:\Windows\System\KTWeRfE.exe
  C:\Windows\System\KTWeRfE.exe
  2⤵
  PID:8268
- C:\Windows\System\lGGjfCZ.exe
  C:\Windows\System\lGGjfCZ.exe
  2⤵
  PID:8288
- C:\Windows\System\SSuqvJX.exe
  C:\Windows\System\SSuqvJX.exe
  2⤵
  PID:8312
- C:\Windows\System\gOuEbit.exe
  C:\Windows\System\gOuEbit.exe
  2⤵
  PID:8340
- C:\Windows\System\VNWFLiR.exe
  C:\Windows\System\VNWFLiR.exe
  2⤵
  PID:8360
- C:\Windows\System\wklbCvF.exe
  C:\Windows\System\wklbCvF.exe
  2⤵
  PID:8388
- C:\Windows\System\EzzcKZM.exe
  C:\Windows\System\EzzcKZM.exe
  2⤵
  PID:8420
- C:\Windows\System\HAEybvX.exe
  C:\Windows\System\HAEybvX.exe
  2⤵
  PID:8444
- C:\Windows\System\tGwZhhV.exe
  C:\Windows\System\tGwZhhV.exe
  2⤵
  PID:8464
- C:\Windows\System\hZtbIYN.exe
  C:\Windows\System\hZtbIYN.exe
  2⤵
  PID:8492
- C:\Windows\System\cdulFfA.exe
  C:\Windows\System\cdulFfA.exe
  2⤵
  PID:8520
- C:\Windows\System\QKyQhTU.exe
  C:\Windows\System\QKyQhTU.exe
  2⤵
  PID:8556
- C:\Windows\System\HXfWNsm.exe
  C:\Windows\System\HXfWNsm.exe
  2⤵
  PID:8576
- C:\Windows\System\awkkgxs.exe
  C:\Windows\System\awkkgxs.exe
  2⤵
  PID:8600
- C:\Windows\System\eqWjeyc.exe
  C:\Windows\System\eqWjeyc.exe
  2⤵
  PID:8620
- C:\Windows\System\mzdCQAB.exe
  C:\Windows\System\mzdCQAB.exe
  2⤵
  PID:8672
- C:\Windows\System\binrQTd.exe
  C:\Windows\System\binrQTd.exe
  2⤵
  PID:8692
- C:\Windows\System\oFHSCpW.exe
  C:\Windows\System\oFHSCpW.exe
  2⤵
  PID:8708
- C:\Windows\System\nJtQUpY.exe
  C:\Windows\System\nJtQUpY.exe
  2⤵
  PID:8732
- C:\Windows\System\UHAdpGd.exe
  C:\Windows\System\UHAdpGd.exe
  2⤵
  PID:8772
- C:\Windows\System\aFzMSRy.exe
  C:\Windows\System\aFzMSRy.exe
  2⤵
  PID:8812
- C:\Windows\System\gcGdxxk.exe
  C:\Windows\System\gcGdxxk.exe
  2⤵
  PID:8828
- C:\Windows\System\UwOMwtO.exe
  C:\Windows\System\UwOMwtO.exe
  2⤵
  PID:8860
- C:\Windows\System\InfXEsz.exe
  C:\Windows\System\InfXEsz.exe
  2⤵
  PID:8896
- C:\Windows\System\oQSVVrZ.exe
  C:\Windows\System\oQSVVrZ.exe
  2⤵
  PID:8912
- C:\Windows\System\jqCwWUp.exe
  C:\Windows\System\jqCwWUp.exe
  2⤵
  PID:8936
- C:\Windows\System\oZKdFFZ.exe
  C:\Windows\System\oZKdFFZ.exe
  2⤵
  PID:8956
- C:\Windows\System\gqBSoHi.exe
  C:\Windows\System\gqBSoHi.exe
  2⤵
  PID:8980
- C:\Windows\System\DkwUGdy.exe
  C:\Windows\System\DkwUGdy.exe
  2⤵
  PID:9024
- C:\Windows\System\sdjYvgI.exe
  C:\Windows\System\sdjYvgI.exe
  2⤵
  PID:9044
- C:\Windows\System\yNGBSEL.exe
  C:\Windows\System\yNGBSEL.exe
  2⤵
  PID:9068
- C:\Windows\System\pkzXFIg.exe
  C:\Windows\System\pkzXFIg.exe
  2⤵
  PID:9084
- C:\Windows\System\PtvwZzj.exe
  C:\Windows\System\PtvwZzj.exe
  2⤵
  PID:9112
- C:\Windows\System\YDxWsmf.exe
  C:\Windows\System\YDxWsmf.exe
  2⤵
  PID:9132
- C:\Windows\System\ouryPOL.exe
  C:\Windows\System\ouryPOL.exe
  2⤵
  PID:9160
- C:\Windows\System\iytfZHc.exe
  C:\Windows\System\iytfZHc.exe
  2⤵
  PID:8280
- C:\Windows\System\IUalhPF.exe
  C:\Windows\System\IUalhPF.exe
  2⤵
  PID:8320
- C:\Windows\System\QGHwGLe.exe
  C:\Windows\System\QGHwGLe.exe
  2⤵
  PID:8352
- C:\Windows\System\AxmULTx.exe
  C:\Windows\System\AxmULTx.exe
  2⤵
  PID:8380
- C:\Windows\System\rxpNqUz.exe
  C:\Windows\System\rxpNqUz.exe
  2⤵
  PID:8412
- C:\Windows\System\dyqSAiR.exe
  C:\Windows\System\dyqSAiR.exe
  2⤵
  PID:8472
- C:\Windows\System\bJlsdzS.exe
  C:\Windows\System\bJlsdzS.exe
  2⤵
  PID:8532
- C:\Windows\System\FabaMEX.exe
  C:\Windows\System\FabaMEX.exe
  2⤵
  PID:8540
- C:\Windows\System\WvynHAB.exe
  C:\Windows\System\WvynHAB.exe
  2⤵
  PID:8572
- C:\Windows\System\TToJFLk.exe
  C:\Windows\System\TToJFLk.exe
  2⤵
  PID:8616
- C:\Windows\System\wYWdixF.exe
  C:\Windows\System\wYWdixF.exe
  2⤵
  PID:8664
- C:\Windows\System\GwspRtu.exe
  C:\Windows\System\GwspRtu.exe
  2⤵
  PID:8684
- C:\Windows\System\tcSDzUK.exe
  C:\Windows\System\tcSDzUK.exe
  2⤵
  PID:8928
- C:\Windows\System\LgWEbcK.exe
  C:\Windows\System\LgWEbcK.exe
  2⤵
  PID:8996
- C:\Windows\System\zqOPhaG.exe
  C:\Windows\System\zqOPhaG.exe
  2⤵
  PID:8964
- C:\Windows\System\lExkXau.exe
  C:\Windows\System\lExkXau.exe
  2⤵
  PID:9020
- C:\Windows\System\NnrCkAr.exe
  C:\Windows\System\NnrCkAr.exe
  2⤵
  PID:8400
- C:\Windows\System\lmlsjKn.exe
  C:\Windows\System\lmlsjKn.exe
  2⤵
  PID:8760
- C:\Windows\System\qChwXvO.exe
  C:\Windows\System\qChwXvO.exe
  2⤵
  PID:8436
- C:\Windows\System\bMYXBhW.exe
  C:\Windows\System\bMYXBhW.exe
  2⤵
  PID:8704
- C:\Windows\System\dBRWMPw.exe
  C:\Windows\System\dBRWMPw.exe
  2⤵
  PID:8788
- C:\Windows\System\yzApsAZ.exe
  C:\Windows\System\yzApsAZ.exe
  2⤵
  PID:8992
- C:\Windows\System\flErzgY.exe
  C:\Windows\System\flErzgY.exe
  2⤵
  PID:8700
- C:\Windows\System\OoSwsUk.exe
  C:\Windows\System\OoSwsUk.exe
  2⤵
  PID:8428
- C:\Windows\System\IJdafRT.exe
  C:\Windows\System\IJdafRT.exe
  2⤵
  PID:7492
- C:\Windows\System\HhOxJKR.exe
  C:\Windows\System\HhOxJKR.exe
  2⤵
  PID:7992
- C:\Windows\System\kQaYFMa.exe
  C:\Windows\System\kQaYFMa.exe
  2⤵
  PID:9016
- C:\Windows\System\edefrOL.exe
  C:\Windows\System\edefrOL.exe
  2⤵
  PID:9232
- C:\Windows\System\ingmfjw.exe
  C:\Windows\System\ingmfjw.exe
  2⤵
  PID:9264
- C:\Windows\System\ngkHVfS.exe
  C:\Windows\System\ngkHVfS.exe
  2⤵
  PID:9304
- C:\Windows\System\KHJrAru.exe
  C:\Windows\System\KHJrAru.exe
  2⤵
  PID:9320
- C:\Windows\System\EZzXWAq.exe
  C:\Windows\System\EZzXWAq.exe
  2⤵
  PID:9340
- C:\Windows\System\bgIvODG.exe
  C:\Windows\System\bgIvODG.exe
  2⤵
  PID:9356
- C:\Windows\System\bDRgoSC.exe
  C:\Windows\System\bDRgoSC.exe
  2⤵
  PID:9372
- C:\Windows\System\cIKDvGk.exe
  C:\Windows\System\cIKDvGk.exe
  2⤵
  PID:9420
- C:\Windows\System\VAksbjF.exe
  C:\Windows\System\VAksbjF.exe
  2⤵
  PID:9460
- C:\Windows\System\MdNSYLH.exe
  C:\Windows\System\MdNSYLH.exe
  2⤵
  PID:9480
- C:\Windows\System\IPPvNCB.exe
  C:\Windows\System\IPPvNCB.exe
  2⤵
  PID:9496
- C:\Windows\System\DOEAYTD.exe
  C:\Windows\System\DOEAYTD.exe
  2⤵
  PID:9524
- C:\Windows\System\VUsYffX.exe
  C:\Windows\System\VUsYffX.exe
  2⤵
  PID:9580
- C:\Windows\System\mNSpNmO.exe
  C:\Windows\System\mNSpNmO.exe
  2⤵
  PID:9600
- C:\Windows\System\iHJPVcS.exe
  C:\Windows\System\iHJPVcS.exe
  2⤵
  PID:9620
- C:\Windows\System\NUQeTEv.exe
  C:\Windows\System\NUQeTEv.exe
  2⤵
  PID:9636
- C:\Windows\System\ksNYWXp.exe
  C:\Windows\System\ksNYWXp.exe
  2⤵
  PID:9672
- C:\Windows\System\DVsRtqj.exe
  C:\Windows\System\DVsRtqj.exe
  2⤵
  PID:9700
- C:\Windows\System\eEMoriX.exe
  C:\Windows\System\eEMoriX.exe
  2⤵
  PID:9756
- C:\Windows\System\DsIsdSU.exe
  C:\Windows\System\DsIsdSU.exe
  2⤵
  PID:9776
- C:\Windows\System\fkqyayS.exe
  C:\Windows\System\fkqyayS.exe
  2⤵
  PID:9808
- C:\Windows\System\qgzrIlD.exe
  C:\Windows\System\qgzrIlD.exe
  2⤵
  PID:9836
- C:\Windows\System\TWfFjbM.exe
  C:\Windows\System\TWfFjbM.exe
  2⤵
  PID:9872
- C:\Windows\System\SsHxqqQ.exe
  C:\Windows\System\SsHxqqQ.exe
  2⤵
  PID:9912
- C:\Windows\System\kyaBDTL.exe
  C:\Windows\System\kyaBDTL.exe
  2⤵
  PID:9928
- C:\Windows\System\XQkzVDj.exe
  C:\Windows\System\XQkzVDj.exe
  2⤵
  PID:9948
- C:\Windows\System\hAsTUlg.exe
  C:\Windows\System\hAsTUlg.exe
  2⤵
  PID:9972
- C:\Windows\System\esnpgVd.exe
  C:\Windows\System\esnpgVd.exe
  2⤵
  PID:9988
- C:\Windows\System\tVkRTcq.exe
  C:\Windows\System\tVkRTcq.exe
  2⤵
  PID:10044
- C:\Windows\System\xNerkFS.exe
  C:\Windows\System\xNerkFS.exe
  2⤵
  PID:10068
- C:\Windows\System\wKaXhtW.exe
  C:\Windows\System\wKaXhtW.exe
  2⤵
  PID:10084
- C:\Windows\System\MArxIJC.exe
  C:\Windows\System\MArxIJC.exe
  2⤵
  PID:10108
- C:\Windows\System\XizkZCM.exe
  C:\Windows\System\XizkZCM.exe
  2⤵
  PID:10168
- C:\Windows\System\zziLpCf.exe
  C:\Windows\System\zziLpCf.exe
  2⤵
  PID:10192
- C:\Windows\System\LdCvtuf.exe
  C:\Windows\System\LdCvtuf.exe
  2⤵
  PID:10208
- C:\Windows\System\XBRMoNO.exe
  C:\Windows\System\XBRMoNO.exe
  2⤵
  PID:9224
- C:\Windows\System\hrGaTsY.exe
  C:\Windows\System\hrGaTsY.exe
  2⤵
  PID:9276
- C:\Windows\System\CPLqRUk.exe
  C:\Windows\System\CPLqRUk.exe
  2⤵
  PID:9312
- C:\Windows\System\mZQrInB.exe
  C:\Windows\System\mZQrInB.exe
  2⤵
  PID:9412
- C:\Windows\System\zweLgEE.exe
  C:\Windows\System\zweLgEE.exe
  2⤵
  PID:9492
- C:\Windows\System\DzogIrI.exe
  C:\Windows\System\DzogIrI.exe
  2⤵
  PID:9476
- C:\Windows\System\nIcrrEi.exe
  C:\Windows\System\nIcrrEi.exe
  2⤵
  PID:9572
- C:\Windows\System\VTltqAm.exe
  C:\Windows\System\VTltqAm.exe
  2⤵
  PID:9644
- C:\Windows\System\tFCYyCb.exe
  C:\Windows\System\tFCYyCb.exe
  2⤵
  PID:9784
- C:\Windows\System\INRashL.exe
  C:\Windows\System\INRashL.exe
  2⤵
  PID:9796
- C:\Windows\System\djaRLmk.exe
  C:\Windows\System\djaRLmk.exe
  2⤵
  PID:9964
- C:\Windows\System\cRnQdZa.exe
  C:\Windows\System\cRnQdZa.exe
  2⤵
  PID:10060
- C:\Windows\System\MIyonGl.exe
  C:\Windows\System\MIyonGl.exe
  2⤵
  PID:10180
- C:\Windows\System\gpypulb.exe
  C:\Windows\System\gpypulb.exe
  2⤵
  PID:9260
- C:\Windows\System\ULRrNEV.exe
  C:\Windows\System\ULRrNEV.exe
  2⤵
  PID:9520
- C:\Windows\System\GAZreyb.exe
  C:\Windows\System\GAZreyb.exe
  2⤵
  PID:9632
- C:\Windows\System\QWlHTap.exe
  C:\Windows\System\QWlHTap.exe
  2⤵
  PID:9828
- C:\Windows\System\RGEMKCg.exe
  C:\Windows\System\RGEMKCg.exe
  2⤵
  PID:9956
- C:\Windows\System\oLRYtrk.exe
  C:\Windows\System\oLRYtrk.exe
  2⤵
  PID:10144
- C:\Windows\System\HyUZRoE.exe
  C:\Windows\System\HyUZRoE.exe
  2⤵
  PID:9380
- C:\Windows\System\AksGUTV.exe
  C:\Windows\System\AksGUTV.exe
  2⤵
  PID:9984
- C:\Windows\System\EDRpIBk.exe
  C:\Windows\System\EDRpIBk.exe
  2⤵
  PID:9488
- C:\Windows\System\gpEBhBs.exe
  C:\Windows\System\gpEBhBs.exe
  2⤵
  PID:9408
- C:\Windows\System\YzGPULm.exe
  C:\Windows\System\YzGPULm.exe
  2⤵
  PID:10244
- C:\Windows\System\CykXyBc.exe
  C:\Windows\System\CykXyBc.exe
  2⤵
  PID:10268
- C:\Windows\System\xIdVgxS.exe
  C:\Windows\System\xIdVgxS.exe
  2⤵
  PID:10316
- C:\Windows\System\gdfcbRA.exe
  C:\Windows\System\gdfcbRA.exe
  2⤵
  PID:10344
- C:\Windows\System\HHhBDrH.exe
  C:\Windows\System\HHhBDrH.exe
  2⤵
  PID:10384
- C:\Windows\System\VbpKITV.exe
  C:\Windows\System\VbpKITV.exe
  2⤵
  PID:10428
- C:\Windows\System\EplGYEw.exe
  C:\Windows\System\EplGYEw.exe
  2⤵
  PID:10484
- C:\Windows\System\VuTHxux.exe
  C:\Windows\System\VuTHxux.exe
  2⤵
  PID:10504
- C:\Windows\System\zOwRaxJ.exe
  C:\Windows\System\zOwRaxJ.exe
  2⤵
  PID:10528
- C:\Windows\System\LyVjnZP.exe
  C:\Windows\System\LyVjnZP.exe
  2⤵
  PID:10544
- C:\Windows\System\cMcJKdK.exe
  C:\Windows\System\cMcJKdK.exe
  2⤵
  PID:10572
- C:\Windows\System\PkpqoVe.exe
  C:\Windows\System\PkpqoVe.exe
  2⤵
  PID:10652
- C:\Windows\System\aIKqoHK.exe
  C:\Windows\System\aIKqoHK.exe
  2⤵
  PID:10696
- C:\Windows\System\OJLcOeN.exe
  C:\Windows\System\OJLcOeN.exe
  2⤵
  PID:10724
- C:\Windows\System\HWuSGNh.exe
  C:\Windows\System\HWuSGNh.exe
  2⤵
  PID:10764
- C:\Windows\System\LPWgJyN.exe
  C:\Windows\System\LPWgJyN.exe
  2⤵
  PID:10804
- C:\Windows\System\pISbmdf.exe
  C:\Windows\System\pISbmdf.exe
  2⤵
  PID:10832
- C:\Windows\System\hlcbPpk.exe
  C:\Windows\System\hlcbPpk.exe
  2⤵
  PID:10856
- C:\Windows\System\yzGUZZY.exe
  C:\Windows\System\yzGUZZY.exe
  2⤵
  PID:10876
- C:\Windows\System\YnjsQTP.exe
  C:\Windows\System\YnjsQTP.exe
  2⤵
  PID:10952
- C:\Windows\System\pdRPUzq.exe
  C:\Windows\System\pdRPUzq.exe
  2⤵
  PID:10976
- C:\Windows\System\CIcWKez.exe
  C:\Windows\System\CIcWKez.exe
  2⤵
  PID:11000
- C:\Windows\System\fMPEAIx.exe
  C:\Windows\System\fMPEAIx.exe
  2⤵
  PID:11032
- C:\Windows\System\oIeNyPr.exe
  C:\Windows\System\oIeNyPr.exe
  2⤵
  PID:11100
- C:\Windows\System\gGwSrja.exe
  C:\Windows\System\gGwSrja.exe
  2⤵
  PID:11120
- C:\Windows\System\bkYtfIt.exe
  C:\Windows\System\bkYtfIt.exe
  2⤵
  PID:11168
- C:\Windows\System\aYKUZxL.exe
  C:\Windows\System\aYKUZxL.exe
  2⤵
  PID:11188
- C:\Windows\System\BfwIWvk.exe
  C:\Windows\System\BfwIWvk.exe
  2⤵
  PID:11220
- C:\Windows\System\RxEiaVt.exe
  C:\Windows\System\RxEiaVt.exe
  2⤵
  PID:11240
- C:\Windows\System\PIMDwNq.exe
  C:\Windows\System\PIMDwNq.exe
  2⤵
  PID:9564
- C:\Windows\System\EDwpxND.exe
  C:\Windows\System\EDwpxND.exe
  2⤵
  PID:9868
- C:\Windows\System\FKlpNsW.exe
  C:\Windows\System\FKlpNsW.exe
  2⤵
  PID:10260
- C:\Windows\System\nIyVieK.exe
  C:\Windows\System\nIyVieK.exe
  2⤵
  PID:10372
- C:\Windows\System\qEuxBfp.exe
  C:\Windows\System\qEuxBfp.exe
  2⤵
  PID:10408
- C:\Windows\System\FxvTaCg.exe
  C:\Windows\System\FxvTaCg.exe
  2⤵
  PID:10476
- C:\Windows\System\MShKDbt.exe
  C:\Windows\System\MShKDbt.exe
  2⤵
  PID:10524
- C:\Windows\System\OFqEHoC.exe
  C:\Windows\System\OFqEHoC.exe
  2⤵
  PID:10536
- C:\Windows\System\XoFkCcK.exe
  C:\Windows\System\XoFkCcK.exe
  2⤵
  PID:10648
- C:\Windows\System\RINnbYe.exe
  C:\Windows\System\RINnbYe.exe
  2⤵
  PID:10752
- C:\Windows\System\fvuVSCd.exe
  C:\Windows\System\fvuVSCd.exe
  2⤵
  PID:10792
- C:\Windows\System\yxcceIt.exe
  C:\Windows\System\yxcceIt.exe
  2⤵
  PID:10888
- C:\Windows\System\PpapKRp.exe
  C:\Windows\System\PpapKRp.exe
  2⤵
  PID:10924
- C:\Windows\System\lMlLDEv.exe
  C:\Windows\System\lMlLDEv.exe
  2⤵
  PID:11048
- C:\Windows\System\qjCgRqI.exe
  C:\Windows\System\qjCgRqI.exe
  2⤵
  PID:11136
- C:\Windows\System\NVQBZcN.exe
  C:\Windows\System\NVQBZcN.exe
  2⤵
  PID:11156
- C:\Windows\System\NyVOvbs.exe
  C:\Windows\System\NyVOvbs.exe
  2⤵
  PID:11256
- C:\Windows\System\Yfvwuzu.exe
  C:\Windows\System\Yfvwuzu.exe
  2⤵
  PID:9364
- C:\Windows\System\xoarNZf.exe
  C:\Windows\System\xoarNZf.exe
  2⤵
  PID:10324
- C:\Windows\System\LowpRIV.exe
  C:\Windows\System\LowpRIV.exe
  2⤵
  PID:10444
- C:\Windows\System\AHBnbFM.exe
  C:\Windows\System\AHBnbFM.exe
  2⤵
  PID:10560
- C:\Windows\System\eoKOFjZ.exe
  C:\Windows\System\eoKOFjZ.exe
  2⤵
  PID:10704
- C:\Windows\System\WJMeMYM.exe
  C:\Windows\System\WJMeMYM.exe
  2⤵
  PID:10720
- C:\Windows\System\KkwlHiQ.exe
  C:\Windows\System\KkwlHiQ.exe
  2⤵
  PID:11012
- C:\Windows\System\WVOkkVi.exe
  C:\Windows\System\WVOkkVi.exe
  2⤵
  PID:11112
- C:\Windows\System\PtPJmqT.exe
  C:\Windows\System\PtPJmqT.exe
  2⤵
  PID:11204
- C:\Windows\System\KpLQpNa.exe
  C:\Windows\System\KpLQpNa.exe
  2⤵
  PID:8512
- C:\Windows\System\YsTgKaR.exe
  C:\Windows\System\YsTgKaR.exe
  2⤵
  PID:10332
- C:\Windows\System\GrlZxtU.exe
  C:\Windows\System\GrlZxtU.exe
  2⤵
  PID:10448
- C:\Windows\System\rDKVFEr.exe
  C:\Windows\System\rDKVFEr.exe
  2⤵
  PID:10632
- C:\Windows\System\XhpRfaN.exe
  C:\Windows\System\XhpRfaN.exe
  2⤵
  PID:10636
- C:\Windows\System\xcwWWlZ.exe
  C:\Windows\System\xcwWWlZ.exe
  2⤵
  PID:10840
- C:\Windows\System\AHPWukJ.exe
  C:\Windows\System\AHPWukJ.exe
  2⤵
  PID:9940
- C:\Windows\System\fVzfSRD.exe
  C:\Windows\System\fVzfSRD.exe
  2⤵
  PID:10356
- C:\Windows\System\ZszWaNF.exe
  C:\Windows\System\ZszWaNF.exe
  2⤵
  PID:11216
- C:\Windows\System\MDEidFU.exe
  C:\Windows\System\MDEidFU.exe
  2⤵
  PID:11284
- C:\Windows\System\ShFvUXQ.exe
  C:\Windows\System\ShFvUXQ.exe
  2⤵
  PID:11308
- C:\Windows\System\aMfPUrp.exe
  C:\Windows\System\aMfPUrp.exe
  2⤵
  PID:11372
- C:\Windows\System\sfqNJJF.exe
  C:\Windows\System\sfqNJJF.exe
  2⤵
  PID:11392
- C:\Windows\System\DQZIoFF.exe
  C:\Windows\System\DQZIoFF.exe
  2⤵
  PID:11416
- C:\Windows\System\lPIRgHi.exe
  C:\Windows\System\lPIRgHi.exe
  2⤵
  PID:11468
- C:\Windows\System\aDOMIiF.exe
  C:\Windows\System\aDOMIiF.exe
  2⤵
  PID:11488
- C:\Windows\System\mNWltnb.exe
  C:\Windows\System\mNWltnb.exe
  2⤵
  PID:11544
- C:\Windows\System\tIRAfOa.exe
  C:\Windows\System\tIRAfOa.exe
  2⤵
  PID:11572
- C:\Windows\System\tHvdpOQ.exe
  C:\Windows\System\tHvdpOQ.exe
  2⤵
  PID:11592
- C:\Windows\System\rAIsSEb.exe
  C:\Windows\System\rAIsSEb.exe
  2⤵
  PID:11672
- C:\Windows\System\fnDfgfy.exe
  C:\Windows\System\fnDfgfy.exe
  2⤵
  PID:11696
- C:\Windows\System\JqcYLUO.exe
  C:\Windows\System\JqcYLUO.exe
  2⤵
  PID:11716
- C:\Windows\System\XtPqJEg.exe
  C:\Windows\System\XtPqJEg.exe
  2⤵
  PID:11764
- C:\Windows\System\qDGfQrV.exe
  C:\Windows\System\qDGfQrV.exe
  2⤵
  PID:11788
- C:\Windows\System\RhaGUGY.exe
  C:\Windows\System\RhaGUGY.exe
  2⤵
  PID:11816
- C:\Windows\System\wZlrbOC.exe
  C:\Windows\System\wZlrbOC.exe
  2⤵
  PID:11840
- C:\Windows\System\RCJCxwF.exe
  C:\Windows\System\RCJCxwF.exe
  2⤵
  PID:11864
- C:\Windows\System\xejhYVn.exe
  C:\Windows\System\xejhYVn.exe
  2⤵
  PID:11880
- C:\Windows\System\LqSbBnt.exe
  C:\Windows\System\LqSbBnt.exe
  2⤵
  PID:11908
- C:\Windows\System\SBnWGXe.exe
  C:\Windows\System\SBnWGXe.exe
  2⤵
  PID:11928
- C:\Windows\System\NpAquCu.exe
  C:\Windows\System\NpAquCu.exe
  2⤵
  PID:11964
- C:\Windows\System\GjKvSxl.exe
  C:\Windows\System\GjKvSxl.exe
  2⤵
  PID:12008
- C:\Windows\System\fKEvfqk.exe
  C:\Windows\System\fKEvfqk.exe
  2⤵
  PID:12076
- C:\Windows\System\JgVhoms.exe
  C:\Windows\System\JgVhoms.exe
  2⤵
  PID:12100
- C:\Windows\System\nbxmABa.exe
  C:\Windows\System\nbxmABa.exe
  2⤵
  PID:12144
- C:\Windows\System\wnzMBPR.exe
  C:\Windows\System\wnzMBPR.exe
  2⤵
  PID:12160
- C:\Windows\System\ZkmxSyR.exe
  C:\Windows\System\ZkmxSyR.exe
  2⤵
  PID:12184
- C:\Windows\System\HWfbciq.exe
  C:\Windows\System\HWfbciq.exe
  2⤵
  PID:12204
- C:\Windows\System\bkoZOFB.exe
  C:\Windows\System\bkoZOFB.exe
  2⤵
  PID:12248
- C:\Windows\System\RFvEirD.exe
  C:\Windows\System\RFvEirD.exe
  2⤵
  PID:12280
- C:\Windows\System\VQRYfbl.exe
  C:\Windows\System\VQRYfbl.exe
  2⤵
  PID:11084
- C:\Windows\System\hMHVesc.exe
  C:\Windows\System\hMHVesc.exe
  2⤵
  PID:10584
- C:\Windows\System\ftGFYVF.exe
  C:\Windows\System\ftGFYVF.exe
  2⤵
  PID:11368
- C:\Windows\System\YNpxxtI.exe
  C:\Windows\System\YNpxxtI.exe
  2⤵
  PID:11300
- C:\Windows\System\iFxNRKU.exe
  C:\Windows\System\iFxNRKU.exe
  2⤵
  PID:11532
- C:\Windows\System\sLLRjcu.exe
  C:\Windows\System\sLLRjcu.exe
  2⤵
  PID:11500
- C:\Windows\System\QnoscOc.exe
  C:\Windows\System\QnoscOc.exe
  2⤵
  PID:11584
- C:\Windows\System\ftQFoWO.exe
  C:\Windows\System\ftQFoWO.exe
  2⤵
  PID:11608
- C:\Windows\System\GuBDAkn.exe
  C:\Windows\System\GuBDAkn.exe
  2⤵
  PID:11708
- C:\Windows\System\EtzJwHV.exe
  C:\Windows\System\EtzJwHV.exe
  2⤵
  PID:11772
- C:\Windows\System\DAoZIFM.exe
  C:\Windows\System\DAoZIFM.exe
  2⤵
  PID:11824
- C:\Windows\System\DWLBgaL.exe
  C:\Windows\System\DWLBgaL.exe
  2⤵
  PID:11904
- C:\Windows\System\fUjJnos.exe
  C:\Windows\System\fUjJnos.exe
  2⤵
  PID:11956
- C:\Windows\System\hLZaZlx.exe
  C:\Windows\System\hLZaZlx.exe
  2⤵
  PID:12028
- C:\Windows\System\VxjXHoR.exe
  C:\Windows\System\VxjXHoR.exe
  2⤵
  PID:12084
- C:\Windows\System\dhXPMXI.exe
  C:\Windows\System\dhXPMXI.exe
  2⤵
  PID:12108
- C:\Windows\System\nwlkkdB.exe
  C:\Windows\System\nwlkkdB.exe
  2⤵
  PID:12180
- C:\Windows\System\IOCaUeB.exe
  C:\Windows\System\IOCaUeB.exe
  2⤵
  PID:12200
- C:\Windows\System\EbtSZUZ.exe
  C:\Windows\System\EbtSZUZ.exe
  2⤵
  PID:11388
- C:\Windows\System\LovkWxx.exe
  C:\Windows\System\LovkWxx.exe
  2⤵
  PID:11272
- C:\Windows\System\rSwbVSW.exe
  C:\Windows\System\rSwbVSW.exe
  2⤵
  PID:11336
- C:\Windows\System\wpfWkUZ.exe
  C:\Windows\System\wpfWkUZ.exe
  2⤵
  PID:11504
- C:\Windows\System\fdehXyl.exe
  C:\Windows\System\fdehXyl.exe
  2⤵
  PID:11628
- C:\Windows\System\zaJHkbC.exe
  C:\Windows\System\zaJHkbC.exe
  2⤵
  PID:10608
- C:\Windows\System\KEZuFJo.exe
  C:\Windows\System\KEZuFJo.exe
  2⤵
  PID:11984
- C:\Windows\System\AIdefUC.exe
  C:\Windows\System\AIdefUC.exe
  2⤵
  PID:12072
- C:\Windows\System\JbXfEBa.exe
  C:\Windows\System\JbXfEBa.exe
  2⤵
  PID:10292
- C:\Windows\System\soELFpo.exe
  C:\Windows\System\soELFpo.exe
  2⤵
  PID:10776
- C:\Windows\System\ztGNJNu.exe
  C:\Windows\System\ztGNJNu.exe
  2⤵
  PID:11600
- C:\Windows\System\AhxtpvO.exe
  C:\Windows\System\AhxtpvO.exe
  2⤵
  PID:11800
- C:\Windows\System\TNhjAov.exe
  C:\Windows\System\TNhjAov.exe
  2⤵
  PID:11992
- C:\Windows\System\yUbceuI.exe
  C:\Windows\System\yUbceuI.exe
  2⤵
  PID:4872
- C:\Windows\System\tkZXowL.exe
  C:\Windows\System\tkZXowL.exe
  2⤵
  PID:1752
- C:\Windows\System\KPZCTwP.exe
  C:\Windows\System\KPZCTwP.exe
  2⤵
  PID:2292
- C:\Windows\System\nGAypNY.exe
  C:\Windows\System\nGAypNY.exe
  2⤵
  PID:3064
- C:\Windows\System\DRNCyoy.exe
  C:\Windows\System\DRNCyoy.exe
  2⤵
  PID:10256
- C:\Windows\System\qPnFOBG.exe
  C:\Windows\System\qPnFOBG.exe
  2⤵
  PID:12196
- C:\Windows\System\zToDHGG.exe
  C:\Windows\System\zToDHGG.exe
  2⤵
  PID:11516
- C:\Windows\System\Uyelwps.exe
  C:\Windows\System\Uyelwps.exe
  2⤵
  PID:12304
- C:\Windows\System\NXoxuAt.exe
  C:\Windows\System\NXoxuAt.exe
  2⤵
  PID:12328
- C:\Windows\System\eNRENSm.exe
  C:\Windows\System\eNRENSm.exe
  2⤵
  PID:12372
- C:\Windows\System\aapwRMZ.exe
  C:\Windows\System\aapwRMZ.exe
  2⤵
  PID:12392
- C:\Windows\System\ULuvmMo.exe
  C:\Windows\System\ULuvmMo.exe
  2⤵
  PID:12428
- C:\Windows\System\tXAJcNr.exe
  C:\Windows\System\tXAJcNr.exe
  2⤵
  PID:12460
- C:\Windows\System\cXukzll.exe
  C:\Windows\System\cXukzll.exe
  2⤵
  PID:12508
- C:\Windows\System\VTIkQJy.exe
  C:\Windows\System\VTIkQJy.exe
  2⤵
  PID:12528
- C:\Windows\System\vZLVJIA.exe
  C:\Windows\System\vZLVJIA.exe
  2⤵
  PID:12560
- C:\Windows\System\piDkxKt.exe
  C:\Windows\System\piDkxKt.exe
  2⤵
  PID:12580
- C:\Windows\System\eGWmyNt.exe
  C:\Windows\System\eGWmyNt.exe
  2⤵
  PID:12604
- C:\Windows\System\DOLNlRI.exe
  C:\Windows\System\DOLNlRI.exe
  2⤵
  PID:12644
- C:\Windows\System\duVjVTR.exe
  C:\Windows\System\duVjVTR.exe
  2⤵
  PID:12676
- C:\Windows\System\fZoDPHb.exe
  C:\Windows\System\fZoDPHb.exe
  2⤵
  PID:12716
- C:\Windows\System\qMKZEvt.exe
  C:\Windows\System\qMKZEvt.exe
  2⤵
  PID:12744
- C:\Windows\System\ePzkiGp.exe
  C:\Windows\System\ePzkiGp.exe
  2⤵
  PID:12780
- C:\Windows\System\MGTwDcd.exe
  C:\Windows\System\MGTwDcd.exe
  2⤵
  PID:12816
- C:\Windows\System\mLzxpyU.exe
  C:\Windows\System\mLzxpyU.exe
  2⤵
  PID:12844
- C:\Windows\System\MhaxtXj.exe
  C:\Windows\System\MhaxtXj.exe
  2⤵
  PID:12868
- C:\Windows\System\NOJKJjT.exe
  C:\Windows\System\NOJKJjT.exe
  2⤵
  PID:12900
- C:\Windows\System\EcQFfrK.exe
  C:\Windows\System\EcQFfrK.exe
  2⤵
  PID:12936
- C:\Windows\System\wrnNZuB.exe
  C:\Windows\System\wrnNZuB.exe
  2⤵
  PID:12960
- C:\Windows\System\Zjyclll.exe
  C:\Windows\System\Zjyclll.exe
  2⤵
  PID:12980
- C:\Windows\System\udbiFQm.exe
  C:\Windows\System\udbiFQm.exe
  2⤵
  PID:13000
- C:\Windows\System\RxIdhUJ.exe
  C:\Windows\System\RxIdhUJ.exe
  2⤵
  PID:13040
- C:\Windows\System\CmYixFT.exe
  C:\Windows\System\CmYixFT.exe
  2⤵
  PID:13068
- C:\Windows\System\hhNvhQX.exe
  C:\Windows\System\hhNvhQX.exe
  2⤵
  PID:13100
- C:\Windows\System\hxJiZNJ.exe
  C:\Windows\System\hxJiZNJ.exe
  2⤵
  PID:13120
- C:\Windows\System\whXTarB.exe
  C:\Windows\System\whXTarB.exe
  2⤵
  PID:13172
- C:\Windows\System\OOWlgPK.exe
  C:\Windows\System\OOWlgPK.exe
  2⤵
  PID:13196
- C:\Windows\System\qanbpAP.exe
  C:\Windows\System\qanbpAP.exe
  2⤵
  PID:13224
- C:\Windows\System\vnCFCkB.exe
  C:\Windows\System\vnCFCkB.exe
  2⤵
  PID:13244
- C:\Windows\System\sbeFGNT.exe
  C:\Windows\System\sbeFGNT.exe
  2⤵
  PID:13260
- C:\Windows\System\GVdGosX.exe
  C:\Windows\System\GVdGosX.exe
  2⤵
  PID:13280
- C:\Windows\System\vWfXTVk.exe
  C:\Windows\System\vWfXTVk.exe
  2⤵
  PID:13300
- C:\Windows\System\sxkcOJa.exe
  C:\Windows\System\sxkcOJa.exe
  2⤵
  PID:12384
- C:\Windows\System\EwoYAkG.exe
  C:\Windows\System\EwoYAkG.exe
  2⤵
  PID:12504
- C:\Windows\System\MLBkJeR.exe
  C:\Windows\System\MLBkJeR.exe
  2⤵
  PID:12468
- C:\Windows\System\ckhhnSv.exe
  C:\Windows\System\ckhhnSv.exe
  2⤵
  PID:12436
- C:\Windows\System\pXwKTGB.exe
  C:\Windows\System\pXwKTGB.exe
  2⤵
  PID:12552
- C:\Windows\System\wHtZvkU.exe
  C:\Windows\System\wHtZvkU.exe
  2⤵
  PID:12500
- C:\Windows\System\GpZFErN.exe
  C:\Windows\System\GpZFErN.exe
  2⤵
  PID:12712
- C:\Windows\System\ysqKLXR.exe
  C:\Windows\System\ysqKLXR.exe
  2⤵
  PID:12724
- C:\Windows\System\QnoAgen.exe
  C:\Windows\System\QnoAgen.exe
  2⤵
  PID:12772
- C:\Windows\System\kCzfXPO.exe
  C:\Windows\System\kCzfXPO.exe
  2⤵
  PID:12852
- C:\Windows\System\izYfIcC.exe
  C:\Windows\System\izYfIcC.exe
  2⤵
  PID:12968
- C:\Windows\System\QhNCQxd.exe
  C:\Windows\System\QhNCQxd.exe
  2⤵
  PID:13024
- C:\Windows\System\THtYYvW.exe
  C:\Windows\System\THtYYvW.exe
  2⤵
  PID:12368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_samr1kn2.eu2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AvplGaz.exe

Filesize
1.7MB

MD5
76458e8f3492b2d363061fc9a4d0917f

SHA1
af24c03cecbac7c9312d35aea04eecb211540289

SHA256
44b61590b36bc5e035dd76bd2e16e2e8b67a7ee18469e58769431e7dbda97cbe

SHA512
d2dff1ebc77fcb5c143787a554b1e1a4f1f7ede386936287697844087a28a2bf477b490f170961fc022bea7fd185fcd9db4e6acda40477c89de0b340e8811c66

Download Submit
C:\Windows\System\EckcAIA.exe

Filesize
1.7MB

MD5
4b4447072fda56736a16a81d97f2a213

SHA1
42eaea7364ee9a6f18719a7c90a25d56a62094d5

SHA256
78ebe2dace975cb01d0e95ca96c7f52891d8a80fe1704458bfe815ff7f44ef86

SHA512
b458ec4e793a0f0fca51418ba5552a0b0fb8cf02c860eab62e64ec1ae1a0294189083749522696cb5eacc996d31997ea5f2863d8e03342595b73df722fd13846

Download Submit
C:\Windows\System\HGfOWXn.exe

Filesize
1.7MB

MD5
4632b78fb06872e2472e74d60f6f93c4

SHA1
4b510710c920ed51eaf18ac323fbee21f4f411ee

SHA256
ad25caec6e37b8d399be307901fc99cb9293ae4c34b25ec9e55e6fb40d16561d

SHA512
6bbfb9cb96e8cba644bf37df7e5e75f5833d46f216eb1a44b7a29ef3be27a572eec9a5feb4a7fef20802a880ef495a40a6c9dbdf7e5dbf5e716b75e9fb5add94

Download Submit
C:\Windows\System\IuhWaGO.exe

Filesize
1.7MB

MD5
27e30a8cebf3d4cd2f78d96f50be29cc

SHA1
2f8ea74f7da925c1f62052c8fc245c798a985778

SHA256
f3e6eea9ca28fc4c8a7eff5df1dff207cc8131cd44535532d0e7d3aca1cc6966

SHA512
715681d30865bdf5907d0869e4a9cb328dccf2b580e0cd4d84be5069bf7a735115261a23486479c0f3f17b179b9c0960fcb7b55b32560843ab862d0d74893648

Download Submit
C:\Windows\System\KUuAifo.exe

Filesize
1.7MB

MD5
95e06ede323f42704755bc8846324688

SHA1
3d2924e5642447d7b3a2bf6185c0c1d9e97eb82f

SHA256
68af11287cf3b225f9cc94aa6562be6f69b930612a3043a06cc49fe189caa245

SHA512
05bb80bc16c641b47ee58525f007c12ba2143459e76eb15316885e35b717e910eb5f872d09a7fc647db4f9696a37109bd753b0d7994edf9c006d604dba5e9de2

Download Submit
C:\Windows\System\LFewvNk.exe

Filesize
1.7MB

MD5
df2df383228b717b80625dd6769be92e

SHA1
bca4b0bdcd057cc74ef1a3ff7671c88cede845dd

SHA256
b0af19f74420ac394cd0c326e09aeafbd9cb0fc73af914b7afaea4658bcb2fb4

SHA512
7874b1347f4d1063bd77c169750d62154e122df41c61581836e828d2a5e13e2bdc484ec555a2053791a354c0cd25437479aafebd74a2a246b37aff3b77135d12

Download Submit
C:\Windows\System\LukNRrV.exe

Filesize
1.7MB

MD5
0c036640f6919dac925af2924f028cb5

SHA1
212297108f465dc8f59e6e0339cc612e0bc4b8d0

SHA256
141776dbe5abf3a8f51588e3d8e0177bf3ce03312a2ce2ba3f0117c032c7be19

SHA512
6c3e11a86f95e511e1e1772e69fd9986f83e6e41918cf56bc8f7f6359824693e7d10f64ebeaa9bc7b9e2b66905d4f3956da8ad81db70c4424cdb149be10589e2

Download Submit
C:\Windows\System\NtubcTd.exe

Filesize
1.7MB

MD5
89366b7e233c483baac741f3d19c52df

SHA1
dd0ef10f4e8c87061401431069c0864437012f71

SHA256
19077a877076a24ec5fe8bed5bafa770d39f355f2e6f7b493ea4e91eb0729914

SHA512
8ecca1d55de2d912712cca472d938daf2c709bef959e8fd97611ee76ebf7a014800e747a11cb9c934cc5d7f57da6fc46a93fc73e3dde641e60735ed4952d1018

Download Submit
C:\Windows\System\PbdtnLL.exe

Filesize
1.7MB

MD5
ab02d998a068e131b21ba4164ddb330d

SHA1
e1a9f246fa334deef4baa756015a119736ec9bfe

SHA256
2c67fac7dc8ad10484c4b5ac25b2f042f3ad1865fe93db5aa45b0143663f0427

SHA512
7bcd9f3265d3dc20e216eccdf99c581374c02f624e19ada54c6423a27666e00ebb9b6d9588120c3ed581a738615c30bc0e554796480b55a6cc5533eb64b069bb

Download Submit
C:\Windows\System\QBwjjwZ.exe

Filesize
1.7MB

MD5
3db9926bce639238f4085b2a185c586d

SHA1
56f0a154ecf3dac27a4df5eab68adc228051ca48

SHA256
fd6fa4ab16d0357d25dc451c4fc24b332b1a287849246fe477425f91efadcf65

SHA512
387e7cf9688262b39010d3105fa25ff913fd4c0a84885493424236d92ac6f9ad9f24fda98ef720d90c04797d6ff7cdab57c5dbba7fe60e5340d00621ecac3a79

Download Submit
C:\Windows\System\RNuBiYj.exe

Filesize
1.7MB

MD5
79775d32a993a5a8c50dfa1ed18857cb

SHA1
406ca9298c2104d4ded14145b1edc3c6ae55910b

SHA256
863d3c09565af4396d6197744cc53e6cea8bfe59a21873aff41172d5ee447513

SHA512
b20f683c0489740aecab035e6b6b3dfa5723585608daa2150333c15983c1fc21bb9cdbd8ea31abd1cd61e4c70685b912c50c4b9f5a21dec72cac6245f3e57749

Download Submit
C:\Windows\System\XSPtGqr.exe

Filesize
1.7MB

MD5
f353af245970606b045d545481e67789

SHA1
7af4541519f60b178cd578a19231e6fa55387f8c

SHA256
914d8aa5831edb0bfbc2101fe651ff3054126974f767a966f12159e0ef912233

SHA512
4fa91172f2ca0fbf71b4dacb32fdafa9f098760b9360f7f4884eba44c1673937c1eaca286c04984b809c0425798c36dc10a7a47d7308df36302807a440548780

Download Submit
C:\Windows\System\YmbhKjz.exe

Filesize
1.7MB

MD5
5689e401bf71b5aa2ad0087230f150bf

SHA1
686ce950e4ada244762ae02c024f99f233cf9efb

SHA256
104f691d1da63c05f37e30f41778227ae1ff9672e2350112ef976eb5e96ff3c3

SHA512
d5976227e258a640bc54b78a12fdcb13174475c4e362d6afaf6712afc6b5e00341ef4557793003a949af4e755415d9d7e86d8e89fb94f1c4f9f4d198adc35225

Download Submit
C:\Windows\System\asZanAf.exe

Filesize
1.7MB

MD5
cf429cd3ff914636603a9b97ad236e2f

SHA1
2cf77dc00179b97e6695bfed3e525b5afd698a7d

SHA256
36c163859620130c7e23a802597dc92c263d19e3bacc91ce9c999000f6233365

SHA512
f65a2842dab7beeb6557fd98f65f636cb9ac619666baf959abc644f5fa23055d311efefebf8727a38cb18d31b7c2dcac53dd635872a17435b0bdbef2e45092b1

Download Submit
C:\Windows\System\dbCYsrB.exe

Filesize
1.7MB

MD5
9e696c97fefc9bb805f37a6d073c8cea

SHA1
da8b0ddc5fb1c0bfae5008be06f283022c62997d

SHA256
77fb2c05221cba79933e6ff53358433c77ebfad00e358266bf738606eb056753

SHA512
fdb368078fb1a66ca6191c9ebcf4ca72b629f0e391ad48b013a869c27de90b862f9a384cf90b962c15391c54a885cb0bbbe1c7f15010b8e1f96ddac528f3a86d

Download Submit
C:\Windows\System\dtxzhlC.exe

Filesize
1.7MB

MD5
d189459b15cfb4f832d586e352d29ce1

SHA1
ae6a35f570e3024b0205fc8f6b2e685becb3815b

SHA256
471c3f45af0abc119a8beb433ee9cbeac64292079749f93db9663c35de24773d

SHA512
0d640f4911855f96a330946c17fe9373d554cc769f399a810a793778141d2c122268c48dfc7f679b58ae968479d08a0c82151fc6083ed2b05e32e181d0790712

Download Submit
C:\Windows\System\eCrlktP.exe

Filesize
1.7MB

MD5
d536be3ff3d36784b28117321361a0d1

SHA1
9388f9bff76ce0ff8d1feafe4608e9900b22264a

SHA256
a10ca140c57952198de9ad1d3ada700ef7e8cdcfb19715ab9fceeba32044fb09

SHA512
40af647524610795aeaf9dd7b0d45ddc61357ae131821cf58b343d09ee69c2cae5e81f4f37f030f7453376ca97b72eb552f7d7b233a360890991c24d5b6229d5

Download Submit
C:\Windows\System\eifiyJU.exe

Filesize
1.7MB

MD5
b0de1a975087d26fbb5110290cdbfdfc

SHA1
46d37ce3daef952bc6460f73905bb7127a7a390c

SHA256
fb27b047f7331887f8714ca44919c496684a4170e31937309fd42a73c7228cdc

SHA512
50b789397663f29da942a705aace54376085601e8456723cbd68fecbf0910ba60fa2ff4f255cdfe694527c7ebabba9b4b46ae4641287194c6ec185b36ff98031

Download Submit
C:\Windows\System\fdAnAVz.exe

Filesize
1.7MB

MD5
5a34b5db6abd25fef2f75224876569a5

SHA1
6fc2d35ae8736b860d18c037abecf19625eb06a1

SHA256
98f3275a2c3f0298eca911ee13cc00967a351753a9163df3317fe61b4e1d91ee

SHA512
38f013f8fbfaf61e2efbad87d14b7a33dbc15397328e052dfc58f64b5fc97f0daf723560ece1de490bc6a05d5244417966fc8b1a30ba38a6e55dbc35625275a7

Download Submit
C:\Windows\System\fuCbrbm.exe

Filesize
1.7MB

MD5
746f31eccdbb8becc2259f8d3b844e2c

SHA1
b824a33e17a3dc04ca9d61cbad0f8a8af2517b97

SHA256
30c312763be3df7154d0ad5fa27b454ec053a283857e87427e536169de03bfc6

SHA512
8466c04eeb4b4b90f0d340c83307ec0c656a073c92f09d602b5657afa8d5678cf9d828c40371b422f0b87f9348411d620f5cdeef7b591254c4348e3dbb9b69e9

Download Submit
C:\Windows\System\ggkeyvv.exe

Filesize
1.7MB

MD5
e86aaed2ed73d283996619124251399d

SHA1
f0d43674c8b0890c89296b8b6d1d4c60d79ab33f

SHA256
2da5ad0ef06324681651fb3bf703df35e4adc0459659ed27d559bc341f61da41

SHA512
c9511da79207ca7eadfa6fd1d5b615698b2279517d9d2304288062edf54ef5f673f8728e1257301b027a1d2d375fd4d83728c6581210c4c0bd250244f874706c

Download Submit
C:\Windows\System\iQCYClD.exe

Filesize
1.7MB

MD5
9f5634f1adb6a4de9748b045933cf51f

SHA1
cd904799a3b98193479cd5ea75cc24852cca9bff

SHA256
c4c854c6ccd5787832b7aa21a84e8daf1cfb207bdde328119344043dec670979

SHA512
05aa90c1598c3a21d8d1b39d9879a43ed75357798c7bf94db076918c363555c4f855df952cde10bf639e82a3026560b3aadc45b40517ade455bbb7a10f54b17d

Download Submit
C:\Windows\System\mCUNtXG.exe

Filesize
1.7MB

MD5
ed5b80921321a8aa3f8a933e3b43dd7d

SHA1
fd35e1ae52ab4a9bbaf8701c5a3fbfd056d30220

SHA256
aa354f411539ae5df0a37048007ca4f209fda5254a531bddcff04283da3408da

SHA512
2503274d276f57085b0930adba6828718336ef3ac01f4ec838b788b9c8d3b9e4401dfe2fe0318bf7e5d3d528464c9ddacd224f8e8a9b847349474c253b6a34a7

Download Submit
C:\Windows\System\mvfYJSm.exe

Filesize
1.7MB

MD5
8ecd1131e7a3c94d3c63b668a7355217

SHA1
4f387a133815293f30efce374acb45102a2dc1c9

SHA256
b544245e7a38ceaf3132208b39bf8b3c6c3a50068cb0907782319422759a784d

SHA512
809e69f1d67746b5243e4ce48fae8a1776c2246d9d59331f0443aafe2dfade2b908d190587a47df30cf472ab6b9ac7e5b9ccbef13199eb29da189ec034997185

Download Submit
C:\Windows\System\nYZEsAq.exe

Filesize
1.7MB

MD5
20a0ec2d502ffa8ec6706b55ba029467

SHA1
08eb69c1277885802e61a61312837773c9f88602

SHA256
864c160bab0f5af4a58b6737167cb3f07fdafaebdb408cdf4ce21be7b7304790

SHA512
3d4f5b4a1f6f1cc982f839395d282930f38dc8e0f3106ce5c6fed9dcf9842c3228e7a859d1d5be46f22d402684457f1da22497889883c966c93e0bc94d304bc1

Download Submit
C:\Windows\System\qkzoTfU.exe

Filesize
1.7MB

MD5
3cc16f0bc657593087ba5cba831c1d7b

SHA1
3008e22cc9eff7419fac086df32c0bac6c3a5a66

SHA256
d6df364578ad2e7fbea0c7c674f9a460afc321f05122f1323c715e8f68646435

SHA512
c138e80ba5d0f15fb4be55601a1ca6f4a5b3ce47c4d8cbfde2eaaff2405b3e63381f97120082d5bcb90c66133e78e96e5f25fe5266704647fe7d5a8cf2c50662

Download Submit
C:\Windows\System\tIBOTCH.exe

Filesize
1.7MB

MD5
1da84d6c03eed0b1202f17672ec26101

SHA1
f60a4ae147f7bb7a9f9819dd5d76db2c12b87c31

SHA256
d036fdfe33858658fffd69c07382aac2c9f1988b7e975cd33ae854dabe78399b

SHA512
55d864ea3d3d98d2b2836a00fd7351b710a6dcc7c583e07ce35fb14d451fde90963a9a42ab8dd8b63b57658b248789fff8b3e6acd5bb97537163e9c6bfd14d55

Download Submit
C:\Windows\System\tPncuOL.exe

Filesize
1.7MB

MD5
a842ba579497ce9028e094eac0a87dc5

SHA1
bce914f5fef297a39b33dbe153f05c9af885c8fc

SHA256
85f56065a609478d91e85318d2cd2c351fb2eb152efbc6cfe0215f91ef69af1f

SHA512
49677d937f59d1234a110c373b9a959def197549b8c6073c35b126239b596e06b8c76ed480467fe51b076d085e2d603fd87b9fd3d9f5eabaa6991b766e6c9d9d

Download Submit
C:\Windows\System\trzKnWc.exe

Filesize
1.7MB

MD5
dd544c638321444ee99aaf4b34eebbf3

SHA1
7ad127818ac886bfb9cafe5104cc450e8d0bea56

SHA256
d4e0660a6df2e118e05b06f201aa43fd25f28ae7bb229a89ae4f2523b07f40c4

SHA512
a4843552c159bcc97d8c891397b49e4cd92f44f602f9e7cd213eac4752abf9a49c171beed90a6624e5d05140dca3aac30094d96cafc203686cacd364015b79b9

Download Submit
C:\Windows\System\upwgfXx.exe

Filesize
1.7MB

MD5
5de8cf39fe481f6250b855236b0e6dba

SHA1
4b93c005ef560ddbcc44ee4233f1d2542869bdd3

SHA256
050da292f9a422ad0427e2308e148eeca60f6e78811a36ec8c5844d7e6f6be16

SHA512
dd12b732decd27fd9e8076a9df917aa46df2c28eee5ed02b88d8cd238692bd431b4a51dfc528b729d2120a3bdc925c7ef5a4f6c65860cfa6030b7b5285ade183

Download Submit
C:\Windows\System\vnIFlmL.exe

Filesize
1.7MB

MD5
f5954ea8337ea945cff293a72f2212d7

SHA1
250475c43d7736e4078caf4a25260057f7fb9ad4

SHA256
5390c73371b5a0a8c0c6e26e1b13a5f42c00df8990f77f56941bcb2899badd4d

SHA512
66fbb4af20a6dd4c98c6abf3ad30f6eb6e63106ae10f000376ce24d82b5266c1f100f7951a809c93e2142f26bd086de48a244b24d913647eb522952558b12d36

Download Submit
C:\Windows\System\xVmyPTa.exe

Filesize
1.7MB

MD5
f28767dac6f626d30835fa7fd910d1c0

SHA1
49a72faf0bd5f1cc5c5e38e6f0642019e9bcdd01

SHA256
860818d3b2d1281e76993dd243d3f05c48f66801717778c161c472f71db94b2d

SHA512
02545078ceb895dd6051be12295629f703d7a99a50acb0e362fd418dbc138869850ebe606b11247ec19fa1a319b91c77bbf52a7daa67cbcae0df19ff9280dc6b

Download Submit
C:\Windows\System\xjWIgwe.exe

Filesize
1.7MB

MD5
22932eed06f04db3c43e1511787816d5

SHA1
e31b4663375f416a84bcc2247f1003dfbc39b236

SHA256
3b372e5bd14d8700c2f40faca436625dd05e76020d0dafe01a9fc2ef89019a14

SHA512
5cf31897f6fa711b64144766a1fcd6d08a2d1e1d70610a7641873354806f9177bc2d3b58e80df35879ade044f004c7c56a701a424f6201896c88dc34c5fa01d0

Download Submit
memory/428-94-0x000001C2D75B0000-0x000001C2D7D56000-memory.dmp

Filesize
7.6MB

Download
memory/428-385-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/428-7-0x000001C2BDE80000-0x000001C2BDE90000-memory.dmp

Filesize
64KB

Download
memory/428-56-0x000001C2BDF00000-0x000001C2BDF22000-memory.dmp

Filesize
136KB

Download
memory/428-1987-0x00007FFE778F3000-0x00007FFE778F5000-memory.dmp

Filesize
8KB

Download
memory/428-21-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/428-8-0x00007FFE778F3000-0x00007FFE778F5000-memory.dmp

Filesize
8KB

Download
memory/680-2218-0x00007FF6C6560000-0x00007FF6C6952000-memory.dmp

Filesize
3.9MB

Download
memory/680-2287-0x00007FF6C6560000-0x00007FF6C6952000-memory.dmp

Filesize
3.9MB

Download
memory/680-79-0x00007FF6C6560000-0x00007FF6C6952000-memory.dmp

Filesize
3.9MB

Download
memory/924-0-0x00007FF65FEE0000-0x00007FF6602D2000-memory.dmp

Filesize
3.9MB

Download
memory/924-131-0x00007FF65FEE0000-0x00007FF6602D2000-memory.dmp

Filesize
3.9MB

Download
memory/924-1-0x000001822A860000-0x000001822A870000-memory.dmp

Filesize
64KB

Download
memory/1044-1056-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp

Filesize
3.9MB

Download
memory/1044-2276-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp

Filesize
3.9MB

Download
memory/1044-24-0x00007FF72CF20000-0x00007FF72D312000-memory.dmp

Filesize
3.9MB

Download
memory/1792-2337-0x00007FF6F0770000-0x00007FF6F0B62000-memory.dmp

Filesize
3.9MB

Download
memory/1792-384-0x00007FF6F0770000-0x00007FF6F0B62000-memory.dmp

Filesize
3.9MB

Download
memory/1796-377-0x00007FF645F90000-0x00007FF646382000-memory.dmp

Filesize
3.9MB

Download
memory/1796-2322-0x00007FF645F90000-0x00007FF646382000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2291-0x00007FF719290000-0x00007FF719682000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2217-0x00007FF719290000-0x00007FF719682000-memory.dmp

Filesize
3.9MB

Download
memory/1836-70-0x00007FF719290000-0x00007FF719682000-memory.dmp

Filesize
3.9MB

Download
memory/1880-126-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp

Filesize
3.9MB

Download
memory/1880-2317-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp

Filesize
3.9MB

Download
memory/1880-2253-0x00007FF61DE60000-0x00007FF61E252000-memory.dmp

Filesize
3.9MB

Download
memory/1892-6-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp

Filesize
3.9MB

Download
memory/1892-383-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2272-0x00007FF7A4C10000-0x00007FF7A5002000-memory.dmp

Filesize
3.9MB

Download
memory/2056-132-0x00007FF7EB270000-0x00007FF7EB662000-memory.dmp

Filesize
3.9MB

Download
memory/2056-2320-0x00007FF7EB270000-0x00007FF7EB662000-memory.dmp

Filesize
3.9MB

Download
memory/2140-1990-0x00007FF789820000-0x00007FF789C12000-memory.dmp

Filesize
3.9MB

Download
memory/2140-32-0x00007FF789820000-0x00007FF789C12000-memory.dmp

Filesize
3.9MB

Download
memory/2140-2280-0x00007FF789820000-0x00007FF789C12000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2319-0x00007FF6EF780000-0x00007FF6EFB72000-memory.dmp

Filesize
3.9MB

Download
memory/2348-378-0x00007FF6EF780000-0x00007FF6EFB72000-memory.dmp

Filesize
3.9MB

Download
memory/2644-86-0x00007FF69BA60000-0x00007FF69BE52000-memory.dmp

Filesize
3.9MB

Download
memory/2644-2283-0x00007FF69BA60000-0x00007FF69BE52000-memory.dmp

Filesize
3.9MB

Download
memory/2728-105-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-2312-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-2238-0x00007FF7B9DF0000-0x00007FF7BA1E2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-1087-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp

Filesize
3.9MB

Download
memory/2756-33-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp

Filesize
3.9MB

Download
memory/2756-2292-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp

Filesize
3.9MB

Download
memory/2940-382-0x00007FF6B2DE0000-0x00007FF6B31D2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2330-0x00007FF6B2DE0000-0x00007FF6B31D2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-1999-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp

Filesize
3.9MB

Download
memory/3136-66-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp

Filesize
3.9MB

Download
memory/3136-2285-0x00007FF74E670000-0x00007FF74EA62000-memory.dmp

Filesize
3.9MB

Download
memory/3208-380-0x00007FF74F6C0000-0x00007FF74FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-2336-0x00007FF74F6C0000-0x00007FF74FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-2296-0x00007FF772450000-0x00007FF772842000-memory.dmp

Filesize
3.9MB

Download
memory/3232-91-0x00007FF772450000-0x00007FF772842000-memory.dmp

Filesize
3.9MB

Download
memory/3232-2237-0x00007FF772450000-0x00007FF772842000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2288-0x00007FF6E07B0000-0x00007FF6E0BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-88-0x00007FF6E07B0000-0x00007FF6E0BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-60-0x00007FF7405C0000-0x00007FF7409B2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-2274-0x00007FF7405C0000-0x00007FF7409B2000-memory.dmp

Filesize
3.9MB

Download
memory/4260-381-0x00007FF668450000-0x00007FF668842000-memory.dmp

Filesize
3.9MB

Download
memory/4260-2334-0x00007FF668450000-0x00007FF668842000-memory.dmp

Filesize
3.9MB

Download
memory/4404-2236-0x00007FF79BD20000-0x00007FF79C112000-memory.dmp

Filesize
3.9MB

Download
memory/4404-85-0x00007FF79BD20000-0x00007FF79C112000-memory.dmp

Filesize
3.9MB

Download
memory/4404-2294-0x00007FF79BD20000-0x00007FF79C112000-memory.dmp

Filesize
3.9MB

Download
memory/4440-65-0x00007FF6817B0000-0x00007FF681BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2278-0x00007FF6817B0000-0x00007FF681BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-2314-0x00007FF75D150000-0x00007FF75D542000-memory.dmp

Filesize
3.9MB

Download
memory/4880-119-0x00007FF75D150000-0x00007FF75D542000-memory.dmp

Filesize
3.9MB

Download
memory/5040-379-0x00007FF602BA0000-0x00007FF602F92000-memory.dmp

Filesize
3.9MB

Download
memory/5040-2328-0x00007FF602BA0000-0x00007FF602F92000-memory.dmp

Filesize
3.9MB

Download