xmrig | fb8ddaa476fcac0552bd8e315fb0da01adb5e673213db5630725183ab8e65b54

Analysis

max time kernel
95s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
Size

2.9MB
MD5

d9093ac834ebdb186a86a56ba8ffbd70
SHA1

308ac7388a3847dea47595ecd5ccec9845f66f0c
SHA256

fb8ddaa476fcac0552bd8e315fb0da01adb5e673213db5630725183ab8e65b54
SHA512

217a74e4d57b14f16e1c8a99c61eb26b4e02c5a473e07dcf9408fc2d9493bc47c739890e19680f9699ec0d13889d577e53d9bf06ad51d3b033ac8725f3212f95
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2auTlKT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4900-0-0x00007FF6E23A0000-0x00007FF6E2796000-memory.dmp	xmrig
behavioral2/files/0x0008000000023422-6.dat	xmrig
behavioral2/files/0x0007000000023426-19.dat	xmrig
behavioral2/files/0x000700000002342b-44.dat	xmrig
behavioral2/files/0x000700000002342c-51.dat	xmrig
behavioral2/files/0x0008000000023429-53.dat	xmrig
behavioral2/files/0x000700000002342d-61.dat	xmrig
behavioral2/files/0x000700000002342f-67.dat	xmrig
behavioral2/memory/3004-71-0x00007FF6FFF40000-0x00007FF700336000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-76.dat	xmrig
behavioral2/memory/3656-80-0x00007FF72BF00000-0x00007FF72C2F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-90.dat	xmrig
behavioral2/files/0x0008000000023423-100.dat	xmrig
behavioral2/files/0x0007000000023434-111.dat	xmrig
behavioral2/memory/1604-115-0x00007FF73F4D0000-0x00007FF73F8C6000-memory.dmp	xmrig
behavioral2/memory/812-116-0x00007FF684B20000-0x00007FF684F16000-memory.dmp	xmrig
behavioral2/memory/2724-114-0x00007FF62BEE0000-0x00007FF62C2D6000-memory.dmp	xmrig
behavioral2/memory/5116-113-0x00007FF6EE9E0000-0x00007FF6EEDD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-109.dat	xmrig
behavioral2/memory/3892-108-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp	xmrig
behavioral2/memory/3384-105-0x00007FF752940000-0x00007FF752D36000-memory.dmp	xmrig
behavioral2/memory/648-104-0x00007FF757D60000-0x00007FF758156000-memory.dmp	xmrig
behavioral2/memory/5068-98-0x00007FF6BA3B0000-0x00007FF6BA7A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-94.dat	xmrig
behavioral2/memory/4092-89-0x00007FF77C820000-0x00007FF77CC16000-memory.dmp	xmrig
behavioral2/memory/4632-86-0x00007FF7CC170000-0x00007FF7CC566000-memory.dmp	xmrig
behavioral2/memory/3348-81-0x00007FF7E79C0000-0x00007FF7E7DB6000-memory.dmp	xmrig
behavioral2/memory/228-77-0x00007FF602620000-0x00007FF602A16000-memory.dmp	xmrig
behavioral2/memory/3880-68-0x00007FF75D9D0000-0x00007FF75DDC6000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-70.dat	xmrig
behavioral2/memory/4668-56-0x00007FF6AB190000-0x00007FF6AB586000-memory.dmp	xmrig
behavioral2/memory/4352-52-0x00007FF6DB430000-0x00007FF6DB826000-memory.dmp	xmrig
behavioral2/files/0x000800000002342a-38.dat	xmrig
behavioral2/files/0x0007000000023428-36.dat	xmrig
behavioral2/files/0x0007000000023427-25.dat	xmrig
behavioral2/files/0x0007000000023435-121.dat	xmrig
behavioral2/memory/3788-125-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-136.dat	xmrig
behavioral2/files/0x000700000002343c-158.dat	xmrig
behavioral2/memory/3804-159-0x00007FF787E70000-0x00007FF788266000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-168.dat	xmrig
behavioral2/files/0x000700000002343b-166.dat	xmrig
behavioral2/files/0x000700000002343a-152.dat	xmrig
behavioral2/memory/4888-149-0x00007FF6456F0000-0x00007FF645AE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-155.dat	xmrig
behavioral2/memory/5108-144-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp	xmrig
behavioral2/memory/4916-139-0x00007FF7A98D0000-0x00007FF7A9CC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-137.dat	xmrig
behavioral2/files/0x0007000000023436-129.dat	xmrig
behavioral2/memory/4492-200-0x00007FF6E5BC0000-0x00007FF6E5FB6000-memory.dmp	xmrig
behavioral2/files/0x000700000002343e-207.dat	xmrig
behavioral2/files/0x000200000001e711-211.dat	xmrig
behavioral2/memory/1240-188-0x00007FF7FE940000-0x00007FF7FED36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-230.dat	xmrig
behavioral2/files/0x000700000002344e-257.dat	xmrig
behavioral2/files/0x000700000002344b-252.dat	xmrig
behavioral2/files/0x0007000000023448-240.dat	xmrig
behavioral2/memory/4900-786-0x00007FF6E23A0000-0x00007FF6E2796000-memory.dmp	xmrig
behavioral2/memory/3892-1996-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp	xmrig
behavioral2/memory/3788-2186-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp	xmrig
behavioral2/memory/5108-2187-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp	xmrig
behavioral2/memory/3804-2188-0x00007FF787E70000-0x00007FF788266000-memory.dmp	xmrig
behavioral2/memory/3348-2189-0x00007FF7E79C0000-0x00007FF7E7DB6000-memory.dmp	xmrig
behavioral2/memory/4668-2190-0x00007FF6AB190000-0x00007FF6AB586000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	1840	powershell.exe
10	1840	powershell.exe
15	1840	powershell.exe
16	1840	powershell.exe
18	1840	powershell.exe
27	1840	powershell.exe
28	1840	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1840	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3348	MUnGmGh.exe
4352	TOIRrDy.exe
4668	qJbUWMb.exe
4632	NiUHnMO.exe
3880	kXcimmP.exe
3004	jaoPVwM.exe
228	EhdbFkc.exe
4092	DRMhARE.exe
5068	irFoarm.exe
648	qVyJyTm.exe
3656	igfdmAK.exe
3384	Rjlfdrz.exe
2724	IweagVO.exe
1604	jefJoAR.exe
812	eQShBmt.exe
3892	yiYuzaL.exe
5116	jvbqgYL.exe
3788	zGRvdhn.exe
4916	KGDYvff.exe
4888	hKzRFjt.exe
5108	UjoGETT.exe
3804	hXeHaQI.exe
1240	tcxMSOb.exe
4492	QwEeiey.exe
1440	VBmhfGF.exe
2776	yNddAdn.exe
4148	XcSOTww.exe
2852	pLpGEWJ.exe
1824	PhNJcHm.exe
644	lRrBXrw.exe
2428	vGTbAlC.exe
2620	vDqhfPo.exe
4712	YrlonGc.exe
2468	Extxnqd.exe
3376	TFUbWgI.exe
4716	BRNjkYJ.exe
64	ESnrguW.exe
2952	AZBLruf.exe
4992	WWaCvzE.exe
1208	QZPjmej.exe
4116	XkKIHED.exe
4444	EdKckbq.exe
3528	eCHdGIM.exe
2712	isPomcC.exe
4276	dZvSxth.exe
3792	KATVCpW.exe
4464	EhEcdtm.exe
3092	YRUvWRJ.exe
4592	hrwAkco.exe
4824	DFsBypr.exe
2052	EwmeIhC.exe
4224	USsaPgj.exe
4252	LMILWeT.exe
4772	RzqEDjq.exe
4360	aMBtgtF.exe
2480	sUhzlBe.exe
1596	zHsWzEH.exe
3372	RLBrSqD.exe
4160	YOJFfnT.exe
2540	RuJjhvD.exe
2300	NegPhde.exe
1220	fOFwubR.exe
3360	PDoqcVp.exe
2992	DsXWaHT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4900-0-0x00007FF6E23A0000-0x00007FF6E2796000-memory.dmp	upx
behavioral2/files/0x0008000000023422-6.dat	upx
behavioral2/files/0x0007000000023426-19.dat	upx
behavioral2/files/0x000700000002342b-44.dat	upx
behavioral2/files/0x000700000002342c-51.dat	upx
behavioral2/files/0x0008000000023429-53.dat	upx
behavioral2/files/0x000700000002342d-61.dat	upx
behavioral2/files/0x000700000002342f-67.dat	upx
behavioral2/memory/3004-71-0x00007FF6FFF40000-0x00007FF700336000-memory.dmp	upx
behavioral2/files/0x0007000000023430-76.dat	upx
behavioral2/memory/3656-80-0x00007FF72BF00000-0x00007FF72C2F6000-memory.dmp	upx
behavioral2/files/0x0007000000023432-90.dat	upx
behavioral2/files/0x0008000000023423-100.dat	upx
behavioral2/files/0x0007000000023434-111.dat	upx
behavioral2/memory/1604-115-0x00007FF73F4D0000-0x00007FF73F8C6000-memory.dmp	upx
behavioral2/memory/812-116-0x00007FF684B20000-0x00007FF684F16000-memory.dmp	upx
behavioral2/memory/2724-114-0x00007FF62BEE0000-0x00007FF62C2D6000-memory.dmp	upx
behavioral2/memory/5116-113-0x00007FF6EE9E0000-0x00007FF6EEDD6000-memory.dmp	upx
behavioral2/files/0x0007000000023433-109.dat	upx
behavioral2/memory/3892-108-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp	upx
behavioral2/memory/3384-105-0x00007FF752940000-0x00007FF752D36000-memory.dmp	upx
behavioral2/memory/648-104-0x00007FF757D60000-0x00007FF758156000-memory.dmp	upx
behavioral2/memory/5068-98-0x00007FF6BA3B0000-0x00007FF6BA7A6000-memory.dmp	upx
behavioral2/files/0x0007000000023431-94.dat	upx
behavioral2/memory/4092-89-0x00007FF77C820000-0x00007FF77CC16000-memory.dmp	upx
behavioral2/memory/4632-86-0x00007FF7CC170000-0x00007FF7CC566000-memory.dmp	upx
behavioral2/memory/3348-81-0x00007FF7E79C0000-0x00007FF7E7DB6000-memory.dmp	upx
behavioral2/memory/228-77-0x00007FF602620000-0x00007FF602A16000-memory.dmp	upx
behavioral2/memory/3880-68-0x00007FF75D9D0000-0x00007FF75DDC6000-memory.dmp	upx
behavioral2/files/0x000700000002342e-70.dat	upx
behavioral2/memory/4668-56-0x00007FF6AB190000-0x00007FF6AB586000-memory.dmp	upx
behavioral2/memory/4352-52-0x00007FF6DB430000-0x00007FF6DB826000-memory.dmp	upx
behavioral2/files/0x000800000002342a-38.dat	upx
behavioral2/files/0x0007000000023428-36.dat	upx
behavioral2/files/0x0007000000023427-25.dat	upx
behavioral2/files/0x0007000000023435-121.dat	upx
behavioral2/memory/3788-125-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp	upx
behavioral2/files/0x0007000000023438-136.dat	upx
behavioral2/files/0x000700000002343c-158.dat	upx
behavioral2/memory/3804-159-0x00007FF787E70000-0x00007FF788266000-memory.dmp	upx
behavioral2/files/0x000700000002343d-168.dat	upx
behavioral2/files/0x000700000002343b-166.dat	upx
behavioral2/files/0x000700000002343a-152.dat	upx
behavioral2/memory/4888-149-0x00007FF6456F0000-0x00007FF645AE6000-memory.dmp	upx
behavioral2/files/0x0007000000023439-155.dat	upx
behavioral2/memory/5108-144-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp	upx
behavioral2/memory/4916-139-0x00007FF7A98D0000-0x00007FF7A9CC6000-memory.dmp	upx
behavioral2/files/0x0007000000023437-137.dat	upx
behavioral2/files/0x0007000000023436-129.dat	upx
behavioral2/memory/4492-200-0x00007FF6E5BC0000-0x00007FF6E5FB6000-memory.dmp	upx
behavioral2/files/0x000700000002343e-207.dat	upx
behavioral2/files/0x000200000001e711-211.dat	upx
behavioral2/memory/1240-188-0x00007FF7FE940000-0x00007FF7FED36000-memory.dmp	upx
behavioral2/files/0x0007000000023440-230.dat	upx
behavioral2/files/0x000700000002344e-257.dat	upx
behavioral2/files/0x000700000002344b-252.dat	upx
behavioral2/files/0x0007000000023448-240.dat	upx
behavioral2/memory/4900-786-0x00007FF6E23A0000-0x00007FF6E2796000-memory.dmp	upx
behavioral2/memory/3892-1996-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp	upx
behavioral2/memory/3788-2186-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp	upx
behavioral2/memory/5108-2187-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp	upx
behavioral2/memory/3804-2188-0x00007FF787E70000-0x00007FF788266000-memory.dmp	upx
behavioral2/memory/3348-2189-0x00007FF7E79C0000-0x00007FF7E7DB6000-memory.dmp	upx
behavioral2/memory/4668-2190-0x00007FF6AB190000-0x00007FF6AB586000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hcQqmAL.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\hRXdprB.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\qydAFYO.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\ftvjqRt.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\MRpLUFn.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\oMQFBfo.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\HwDCrrY.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\LyGWDWq.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\ZzfGLLd.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\CYqOKGx.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\WuxPbfa.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\djbLDZg.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\IZEIwIR.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\NdZEtXP.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\lBolSgN.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\NJPFbnz.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\kRLrSIg.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\CNECQui.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\YEnxvZr.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\nmcFdRy.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\chFGxuL.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\vMrycHb.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\QkurCiO.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\FWPPQCe.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\toZgWqZ.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\AUHlbrE.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\BRNjkYJ.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\hSCMBcC.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\TMxwLgu.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\DsXWaHT.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\BJUJDZv.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\CRaEGUf.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\ABWEUVS.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\dzaCYxI.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\iLWrqzB.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\fSQpoDb.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\QSNPJeA.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\SdCkTBT.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\UkZhiEG.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\EUfiyBf.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\lBKerAl.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\ekSbabi.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\CLnWKgE.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\EdKckbq.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\gHwGZMG.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\NhnFTtM.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\WfkGPql.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\FmExXHG.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\FeIQJEI.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\DtjiKRP.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\UjoGETT.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\cxMLyQQ.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\WyXFkqa.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\YWHdxLL.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\nfztnqe.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\CRwSqCY.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\YfLNjvG.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\YUumWYX.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\YGBGJVq.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\qJbUWMb.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\KGDYvff.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\norTahG.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\fDIEgIA.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
File created	C:\Windows\System\VAnnTXL.exe	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	powershell.exe
1840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
Token: SeDebugPrivilege	1840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1840	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	83
PID 4900 wrote to memory of 1840	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	83
PID 4900 wrote to memory of 3348	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	84
PID 4900 wrote to memory of 3348	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	84
PID 4900 wrote to memory of 4352	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	85
PID 4900 wrote to memory of 4352	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	85
PID 4900 wrote to memory of 4668	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	86
PID 4900 wrote to memory of 4668	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	86
PID 4900 wrote to memory of 4632	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	87
PID 4900 wrote to memory of 4632	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	87
PID 4900 wrote to memory of 3880	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	88
PID 4900 wrote to memory of 3880	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	88
PID 4900 wrote to memory of 3004	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	89
PID 4900 wrote to memory of 3004	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	89
PID 4900 wrote to memory of 228	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	90
PID 4900 wrote to memory of 228	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	90
PID 4900 wrote to memory of 4092	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	91
PID 4900 wrote to memory of 4092	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	91
PID 4900 wrote to memory of 5068	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	92
PID 4900 wrote to memory of 5068	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	92
PID 4900 wrote to memory of 648	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	93
PID 4900 wrote to memory of 648	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	93
PID 4900 wrote to memory of 3656	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	94
PID 4900 wrote to memory of 3656	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	94
PID 4900 wrote to memory of 3384	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	95
PID 4900 wrote to memory of 3384	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	95
PID 4900 wrote to memory of 2724	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	96
PID 4900 wrote to memory of 2724	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	96
PID 4900 wrote to memory of 1604	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	97
PID 4900 wrote to memory of 1604	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	97
PID 4900 wrote to memory of 812	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	98
PID 4900 wrote to memory of 812	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	98
PID 4900 wrote to memory of 3892	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	99
PID 4900 wrote to memory of 3892	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	99
PID 4900 wrote to memory of 5116	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	100
PID 4900 wrote to memory of 5116	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	100
PID 4900 wrote to memory of 3788	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	101
PID 4900 wrote to memory of 3788	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	101
PID 4900 wrote to memory of 4916	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	102
PID 4900 wrote to memory of 4916	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	102
PID 4900 wrote to memory of 4888	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	103
PID 4900 wrote to memory of 4888	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	103
PID 4900 wrote to memory of 5108	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	104
PID 4900 wrote to memory of 5108	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	104
PID 4900 wrote to memory of 3804	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	105
PID 4900 wrote to memory of 3804	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	105
PID 4900 wrote to memory of 1240	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	106
PID 4900 wrote to memory of 1240	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	106
PID 4900 wrote to memory of 4492	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	107
PID 4900 wrote to memory of 4492	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	107
PID 4900 wrote to memory of 1440	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	109
PID 4900 wrote to memory of 1440	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	109
PID 4900 wrote to memory of 2776	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	110
PID 4900 wrote to memory of 2776	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	110
PID 4900 wrote to memory of 2852	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	111
PID 4900 wrote to memory of 2852	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	111
PID 4900 wrote to memory of 4148	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	113
PID 4900 wrote to memory of 4148	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	113
PID 4900 wrote to memory of 1824	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	114
PID 4900 wrote to memory of 1824	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	114
PID 4900 wrote to memory of 644	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	115
PID 4900 wrote to memory of 644	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	115
PID 4900 wrote to memory of 2428	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	116
PID 4900 wrote to memory of 2428	4900	d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d9093ac834ebdb186a86a56ba8ffbd70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System\MUnGmGh.exe
  C:\Windows\System\MUnGmGh.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\TOIRrDy.exe
  C:\Windows\System\TOIRrDy.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\qJbUWMb.exe
  C:\Windows\System\qJbUWMb.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\NiUHnMO.exe
  C:\Windows\System\NiUHnMO.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\kXcimmP.exe
  C:\Windows\System\kXcimmP.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\jaoPVwM.exe
  C:\Windows\System\jaoPVwM.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\EhdbFkc.exe
  C:\Windows\System\EhdbFkc.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\DRMhARE.exe
  C:\Windows\System\DRMhARE.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\irFoarm.exe
  C:\Windows\System\irFoarm.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\qVyJyTm.exe
  C:\Windows\System\qVyJyTm.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\igfdmAK.exe
  C:\Windows\System\igfdmAK.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\Rjlfdrz.exe
  C:\Windows\System\Rjlfdrz.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\IweagVO.exe
  C:\Windows\System\IweagVO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\jefJoAR.exe
  C:\Windows\System\jefJoAR.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\eQShBmt.exe
  C:\Windows\System\eQShBmt.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\yiYuzaL.exe
  C:\Windows\System\yiYuzaL.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\jvbqgYL.exe
  C:\Windows\System\jvbqgYL.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\zGRvdhn.exe
  C:\Windows\System\zGRvdhn.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\KGDYvff.exe
  C:\Windows\System\KGDYvff.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\hKzRFjt.exe
  C:\Windows\System\hKzRFjt.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\UjoGETT.exe
  C:\Windows\System\UjoGETT.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\hXeHaQI.exe
  C:\Windows\System\hXeHaQI.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\tcxMSOb.exe
  C:\Windows\System\tcxMSOb.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\QwEeiey.exe
  C:\Windows\System\QwEeiey.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\VBmhfGF.exe
  C:\Windows\System\VBmhfGF.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\yNddAdn.exe
  C:\Windows\System\yNddAdn.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\pLpGEWJ.exe
  C:\Windows\System\pLpGEWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\XcSOTww.exe
  C:\Windows\System\XcSOTww.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\PhNJcHm.exe
  C:\Windows\System\PhNJcHm.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\lRrBXrw.exe
  C:\Windows\System\lRrBXrw.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\vGTbAlC.exe
  C:\Windows\System\vGTbAlC.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\vDqhfPo.exe
  C:\Windows\System\vDqhfPo.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\YrlonGc.exe
  C:\Windows\System\YrlonGc.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\Extxnqd.exe
  C:\Windows\System\Extxnqd.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\TFUbWgI.exe
  C:\Windows\System\TFUbWgI.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\BRNjkYJ.exe
  C:\Windows\System\BRNjkYJ.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\ESnrguW.exe
  C:\Windows\System\ESnrguW.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\AZBLruf.exe
  C:\Windows\System\AZBLruf.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\WWaCvzE.exe
  C:\Windows\System\WWaCvzE.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\QZPjmej.exe
  C:\Windows\System\QZPjmej.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\XkKIHED.exe
  C:\Windows\System\XkKIHED.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\EdKckbq.exe
  C:\Windows\System\EdKckbq.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\eCHdGIM.exe
  C:\Windows\System\eCHdGIM.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\isPomcC.exe
  C:\Windows\System\isPomcC.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\dZvSxth.exe
  C:\Windows\System\dZvSxth.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\KATVCpW.exe
  C:\Windows\System\KATVCpW.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\EhEcdtm.exe
  C:\Windows\System\EhEcdtm.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\YRUvWRJ.exe
  C:\Windows\System\YRUvWRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\hrwAkco.exe
  C:\Windows\System\hrwAkco.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\DFsBypr.exe
  C:\Windows\System\DFsBypr.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\EwmeIhC.exe
  C:\Windows\System\EwmeIhC.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\USsaPgj.exe
  C:\Windows\System\USsaPgj.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\LMILWeT.exe
  C:\Windows\System\LMILWeT.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\RzqEDjq.exe
  C:\Windows\System\RzqEDjq.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\aMBtgtF.exe
  C:\Windows\System\aMBtgtF.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\sUhzlBe.exe
  C:\Windows\System\sUhzlBe.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\zHsWzEH.exe
  C:\Windows\System\zHsWzEH.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RLBrSqD.exe
  C:\Windows\System\RLBrSqD.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\YOJFfnT.exe
  C:\Windows\System\YOJFfnT.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\RuJjhvD.exe
  C:\Windows\System\RuJjhvD.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\NegPhde.exe
  C:\Windows\System\NegPhde.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\fOFwubR.exe
  C:\Windows\System\fOFwubR.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\PDoqcVp.exe
  C:\Windows\System\PDoqcVp.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\DsXWaHT.exe
  C:\Windows\System\DsXWaHT.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\JkJzofn.exe
  C:\Windows\System\JkJzofn.exe
  2⤵
  PID:3908
- C:\Windows\System\hOzivBA.exe
  C:\Windows\System\hOzivBA.exe
  2⤵
  PID:4556
- C:\Windows\System\JUdXVYU.exe
  C:\Windows\System\JUdXVYU.exe
  2⤵
  PID:3592
- C:\Windows\System\ePxRJCx.exe
  C:\Windows\System\ePxRJCx.exe
  2⤵
  PID:2324
- C:\Windows\System\vSuJEZz.exe
  C:\Windows\System\vSuJEZz.exe
  2⤵
  PID:1924
- C:\Windows\System\WisVmLj.exe
  C:\Windows\System\WisVmLj.exe
  2⤵
  PID:2040
- C:\Windows\System\hFMEQUg.exe
  C:\Windows\System\hFMEQUg.exe
  2⤵
  PID:3224
- C:\Windows\System\LlhGZdU.exe
  C:\Windows\System\LlhGZdU.exe
  2⤵
  PID:2384
- C:\Windows\System\norTahG.exe
  C:\Windows\System\norTahG.exe
  2⤵
  PID:2660
- C:\Windows\System\byTWKum.exe
  C:\Windows\System\byTWKum.exe
  2⤵
  PID:1424
- C:\Windows\System\aaHGcyB.exe
  C:\Windows\System\aaHGcyB.exe
  2⤵
  PID:1504
- C:\Windows\System\gxBcSQU.exe
  C:\Windows\System\gxBcSQU.exe
  2⤵
  PID:3608
- C:\Windows\System\bRZvUJb.exe
  C:\Windows\System\bRZvUJb.exe
  2⤵
  PID:2948
- C:\Windows\System\DtdYqSy.exe
  C:\Windows\System\DtdYqSy.exe
  2⤵
  PID:2112
- C:\Windows\System\uLzSjBO.exe
  C:\Windows\System\uLzSjBO.exe
  2⤵
  PID:2132
- C:\Windows\System\XXBjpGj.exe
  C:\Windows\System\XXBjpGj.exe
  2⤵
  PID:4732
- C:\Windows\System\jLYRfZj.exe
  C:\Windows\System\jLYRfZj.exe
  2⤵
  PID:3904
- C:\Windows\System\iFanZLl.exe
  C:\Windows\System\iFanZLl.exe
  2⤵
  PID:4284
- C:\Windows\System\MzZwflu.exe
  C:\Windows\System\MzZwflu.exe
  2⤵
  PID:3508
- C:\Windows\System\XrxzvXU.exe
  C:\Windows\System\XrxzvXU.exe
  2⤵
  PID:4568
- C:\Windows\System\nMDjgcX.exe
  C:\Windows\System\nMDjgcX.exe
  2⤵
  PID:416
- C:\Windows\System\UCJsECu.exe
  C:\Windows\System\UCJsECu.exe
  2⤵
  PID:3208
- C:\Windows\System\CodcjfG.exe
  C:\Windows\System\CodcjfG.exe
  2⤵
  PID:208
- C:\Windows\System\KUPqrea.exe
  C:\Windows\System\KUPqrea.exe
  2⤵
  PID:116
- C:\Windows\System\nuLfmwA.exe
  C:\Windows\System\nuLfmwA.exe
  2⤵
  PID:4548
- C:\Windows\System\wbNqFRw.exe
  C:\Windows\System\wbNqFRw.exe
  2⤵
  PID:4156
- C:\Windows\System\MlQyCld.exe
  C:\Windows\System\MlQyCld.exe
  2⤵
  PID:1376
- C:\Windows\System\evXOehQ.exe
  C:\Windows\System\evXOehQ.exe
  2⤵
  PID:456
- C:\Windows\System\UcGYjPj.exe
  C:\Windows\System\UcGYjPj.exe
  2⤵
  PID:5136
- C:\Windows\System\lwNUUNk.exe
  C:\Windows\System\lwNUUNk.exe
  2⤵
  PID:5168
- C:\Windows\System\efXyobR.exe
  C:\Windows\System\efXyobR.exe
  2⤵
  PID:5200
- C:\Windows\System\PWEDEen.exe
  C:\Windows\System\PWEDEen.exe
  2⤵
  PID:5240
- C:\Windows\System\sAjXqrv.exe
  C:\Windows\System\sAjXqrv.exe
  2⤵
  PID:5272
- C:\Windows\System\nyNNtmq.exe
  C:\Windows\System\nyNNtmq.exe
  2⤵
  PID:5296
- C:\Windows\System\nFIJaqY.exe
  C:\Windows\System\nFIJaqY.exe
  2⤵
  PID:5320
- C:\Windows\System\OavLTbq.exe
  C:\Windows\System\OavLTbq.exe
  2⤵
  PID:5344
- C:\Windows\System\RgxElhj.exe
  C:\Windows\System\RgxElhj.exe
  2⤵
  PID:5384
- C:\Windows\System\bcNopKE.exe
  C:\Windows\System\bcNopKE.exe
  2⤵
  PID:5424
- C:\Windows\System\MZYnQWc.exe
  C:\Windows\System\MZYnQWc.exe
  2⤵
  PID:5472
- C:\Windows\System\hSCMBcC.exe
  C:\Windows\System\hSCMBcC.exe
  2⤵
  PID:5500
- C:\Windows\System\bfCjzpP.exe
  C:\Windows\System\bfCjzpP.exe
  2⤵
  PID:5532
- C:\Windows\System\rZDrQJG.exe
  C:\Windows\System\rZDrQJG.exe
  2⤵
  PID:5548
- C:\Windows\System\GKnXvSc.exe
  C:\Windows\System\GKnXvSc.exe
  2⤵
  PID:5564
- C:\Windows\System\XspRdIH.exe
  C:\Windows\System\XspRdIH.exe
  2⤵
  PID:5592
- C:\Windows\System\OuYlOTJ.exe
  C:\Windows\System\OuYlOTJ.exe
  2⤵
  PID:5644
- C:\Windows\System\nBrAgqf.exe
  C:\Windows\System\nBrAgqf.exe
  2⤵
  PID:5672
- C:\Windows\System\AgCLQYl.exe
  C:\Windows\System\AgCLQYl.exe
  2⤵
  PID:5700
- C:\Windows\System\fZddgYt.exe
  C:\Windows\System\fZddgYt.exe
  2⤵
  PID:5728
- C:\Windows\System\dilClWR.exe
  C:\Windows\System\dilClWR.exe
  2⤵
  PID:5764
- C:\Windows\System\vyqgIFE.exe
  C:\Windows\System\vyqgIFE.exe
  2⤵
  PID:5788
- C:\Windows\System\PqOJPRM.exe
  C:\Windows\System\PqOJPRM.exe
  2⤵
  PID:5804
- C:\Windows\System\LAPzyJs.exe
  C:\Windows\System\LAPzyJs.exe
  2⤵
  PID:5832
- C:\Windows\System\lEfmGHf.exe
  C:\Windows\System\lEfmGHf.exe
  2⤵
  PID:5872
- C:\Windows\System\HdpbPiY.exe
  C:\Windows\System\HdpbPiY.exe
  2⤵
  PID:5916
- C:\Windows\System\lCDZwYd.exe
  C:\Windows\System\lCDZwYd.exe
  2⤵
  PID:5956
- C:\Windows\System\fFqWYuN.exe
  C:\Windows\System\fFqWYuN.exe
  2⤵
  PID:6008
- C:\Windows\System\rWEMpxO.exe
  C:\Windows\System\rWEMpxO.exe
  2⤵
  PID:6028
- C:\Windows\System\znFyGdU.exe
  C:\Windows\System\znFyGdU.exe
  2⤵
  PID:6056
- C:\Windows\System\mjkbeKY.exe
  C:\Windows\System\mjkbeKY.exe
  2⤵
  PID:6084
- C:\Windows\System\WqUPfWz.exe
  C:\Windows\System\WqUPfWz.exe
  2⤵
  PID:6112
- C:\Windows\System\nfztnqe.exe
  C:\Windows\System\nfztnqe.exe
  2⤵
  PID:6140
- C:\Windows\System\snyPGRQ.exe
  C:\Windows\System\snyPGRQ.exe
  2⤵
  PID:5156
- C:\Windows\System\HxUjZwm.exe
  C:\Windows\System\HxUjZwm.exe
  2⤵
  PID:5196
- C:\Windows\System\XGxlfee.exe
  C:\Windows\System\XGxlfee.exe
  2⤵
  PID:5260
- C:\Windows\System\yhkAQmQ.exe
  C:\Windows\System\yhkAQmQ.exe
  2⤵
  PID:5316
- C:\Windows\System\lMxuven.exe
  C:\Windows\System\lMxuven.exe
  2⤵
  PID:5368
- C:\Windows\System\NJPFbnz.exe
  C:\Windows\System\NJPFbnz.exe
  2⤵
  PID:5440
- C:\Windows\System\ALEDuPo.exe
  C:\Windows\System\ALEDuPo.exe
  2⤵
  PID:5492
- C:\Windows\System\jvjstHN.exe
  C:\Windows\System\jvjstHN.exe
  2⤵
  PID:2500
- C:\Windows\System\uRVAlvq.exe
  C:\Windows\System\uRVAlvq.exe
  2⤵
  PID:5584
- C:\Windows\System\JNNWsFs.exe
  C:\Windows\System\JNNWsFs.exe
  2⤵
  PID:5664
- C:\Windows\System\qIyBNgF.exe
  C:\Windows\System\qIyBNgF.exe
  2⤵
  PID:5724
- C:\Windows\System\ZplmVcN.exe
  C:\Windows\System\ZplmVcN.exe
  2⤵
  PID:5820
- C:\Windows\System\hcQqmAL.exe
  C:\Windows\System\hcQqmAL.exe
  2⤵
  PID:5856
- C:\Windows\System\hRXdprB.exe
  C:\Windows\System\hRXdprB.exe
  2⤵
  PID:5948
- C:\Windows\System\GzDOgSZ.exe
  C:\Windows\System\GzDOgSZ.exe
  2⤵
  PID:6020
- C:\Windows\System\VvglAIl.exe
  C:\Windows\System\VvglAIl.exe
  2⤵
  PID:6096
- C:\Windows\System\aYdbHuS.exe
  C:\Windows\System\aYdbHuS.exe
  2⤵
  PID:5128
- C:\Windows\System\Optfsxn.exe
  C:\Windows\System\Optfsxn.exe
  2⤵
  PID:5292
- C:\Windows\System\lRymbGg.exe
  C:\Windows\System\lRymbGg.exe
  2⤵
  PID:5400
- C:\Windows\System\reDRNTu.exe
  C:\Windows\System\reDRNTu.exe
  2⤵
  PID:5520
- C:\Windows\System\zyxdNII.exe
  C:\Windows\System\zyxdNII.exe
  2⤵
  PID:5696
- C:\Windows\System\MJiirCv.exe
  C:\Windows\System\MJiirCv.exe
  2⤵
  PID:5816
- C:\Windows\System\WhlJHsG.exe
  C:\Windows\System\WhlJHsG.exe
  2⤵
  PID:6052
- C:\Windows\System\cYBLQBM.exe
  C:\Windows\System\cYBLQBM.exe
  2⤵
  PID:6136
- C:\Windows\System\uRSNJCe.exe
  C:\Windows\System\uRSNJCe.exe
  2⤵
  PID:5308
- C:\Windows\System\nkFUitV.exe
  C:\Windows\System\nkFUitV.exe
  2⤵
  PID:5528
- C:\Windows\System\uBRcwRg.exe
  C:\Windows\System\uBRcwRg.exe
  2⤵
  PID:5780
- C:\Windows\System\tTiVTjb.exe
  C:\Windows\System\tTiVTjb.exe
  2⤵
  PID:6076
- C:\Windows\System\dZgOykj.exe
  C:\Windows\System\dZgOykj.exe
  2⤵
  PID:6160
- C:\Windows\System\FoqOBfC.exe
  C:\Windows\System\FoqOBfC.exe
  2⤵
  PID:6208
- C:\Windows\System\cxMLyQQ.exe
  C:\Windows\System\cxMLyQQ.exe
  2⤵
  PID:6228
- C:\Windows\System\LyGWDWq.exe
  C:\Windows\System\LyGWDWq.exe
  2⤵
  PID:6260
- C:\Windows\System\dCRaUlj.exe
  C:\Windows\System\dCRaUlj.exe
  2⤵
  PID:6284
- C:\Windows\System\VQEhzbc.exe
  C:\Windows\System\VQEhzbc.exe
  2⤵
  PID:6320
- C:\Windows\System\OvSohEf.exe
  C:\Windows\System\OvSohEf.exe
  2⤵
  PID:6344
- C:\Windows\System\pYjnLDW.exe
  C:\Windows\System\pYjnLDW.exe
  2⤵
  PID:6384
- C:\Windows\System\UoVUfNT.exe
  C:\Windows\System\UoVUfNT.exe
  2⤵
  PID:6428
- C:\Windows\System\IXPnLLN.exe
  C:\Windows\System\IXPnLLN.exe
  2⤵
  PID:6480
- C:\Windows\System\ImuQFYG.exe
  C:\Windows\System\ImuQFYG.exe
  2⤵
  PID:6520
- C:\Windows\System\FAOgDna.exe
  C:\Windows\System\FAOgDna.exe
  2⤵
  PID:6556
- C:\Windows\System\akfBhnY.exe
  C:\Windows\System\akfBhnY.exe
  2⤵
  PID:6620
- C:\Windows\System\PmzoLig.exe
  C:\Windows\System\PmzoLig.exe
  2⤵
  PID:6652
- C:\Windows\System\Zxxqbhi.exe
  C:\Windows\System\Zxxqbhi.exe
  2⤵
  PID:6720
- C:\Windows\System\rOfXkyC.exe
  C:\Windows\System\rOfXkyC.exe
  2⤵
  PID:6752
- C:\Windows\System\ICjgcHQ.exe
  C:\Windows\System\ICjgcHQ.exe
  2⤵
  PID:6772
- C:\Windows\System\vsSMpfI.exe
  C:\Windows\System\vsSMpfI.exe
  2⤵
  PID:6816
- C:\Windows\System\bktLuFj.exe
  C:\Windows\System\bktLuFj.exe
  2⤵
  PID:6840
- C:\Windows\System\MNQLcYN.exe
  C:\Windows\System\MNQLcYN.exe
  2⤵
  PID:6872
- C:\Windows\System\xaVsnpH.exe
  C:\Windows\System\xaVsnpH.exe
  2⤵
  PID:6920
- C:\Windows\System\oawGGZD.exe
  C:\Windows\System\oawGGZD.exe
  2⤵
  PID:6960
- C:\Windows\System\RaVmiYT.exe
  C:\Windows\System\RaVmiYT.exe
  2⤵
  PID:6980
- C:\Windows\System\xyoEDEF.exe
  C:\Windows\System\xyoEDEF.exe
  2⤵
  PID:7004
- C:\Windows\System\yIbKysF.exe
  C:\Windows\System\yIbKysF.exe
  2⤵
  PID:7036
- C:\Windows\System\YxNXpov.exe
  C:\Windows\System\YxNXpov.exe
  2⤵
  PID:7060
- C:\Windows\System\CRrPvgf.exe
  C:\Windows\System\CRrPvgf.exe
  2⤵
  PID:7096
- C:\Windows\System\hLRzvQV.exe
  C:\Windows\System\hLRzvQV.exe
  2⤵
  PID:7120
- C:\Windows\System\JsCCFiW.exe
  C:\Windows\System\JsCCFiW.exe
  2⤵
  PID:7152
- C:\Windows\System\EUfiyBf.exe
  C:\Windows\System\EUfiyBf.exe
  2⤵
  PID:6128
- C:\Windows\System\MACgqbq.exe
  C:\Windows\System\MACgqbq.exe
  2⤵
  PID:6216
- C:\Windows\System\XFVixvI.exe
  C:\Windows\System\XFVixvI.exe
  2⤵
  PID:6280
- C:\Windows\System\vxIvPsH.exe
  C:\Windows\System\vxIvPsH.exe
  2⤵
  PID:6332
- C:\Windows\System\mRuvYgd.exe
  C:\Windows\System\mRuvYgd.exe
  2⤵
  PID:6420
- C:\Windows\System\GeoATQS.exe
  C:\Windows\System\GeoATQS.exe
  2⤵
  PID:6516
- C:\Windows\System\fdVONHP.exe
  C:\Windows\System\fdVONHP.exe
  2⤵
  PID:6632
- C:\Windows\System\CvAmQIn.exe
  C:\Windows\System\CvAmQIn.exe
  2⤵
  PID:6764
- C:\Windows\System\uGaFxgS.exe
  C:\Windows\System\uGaFxgS.exe
  2⤵
  PID:6836
- C:\Windows\System\NdOHsUz.exe
  C:\Windows\System\NdOHsUz.exe
  2⤵
  PID:6884
- C:\Windows\System\CRwSqCY.exe
  C:\Windows\System\CRwSqCY.exe
  2⤵
  PID:6968
- C:\Windows\System\zvOozDH.exe
  C:\Windows\System\zvOozDH.exe
  2⤵
  PID:7052
- C:\Windows\System\YUfGCmK.exe
  C:\Windows\System\YUfGCmK.exe
  2⤵
  PID:7112
- C:\Windows\System\iHTesBV.exe
  C:\Windows\System\iHTesBV.exe
  2⤵
  PID:6148
- C:\Windows\System\WCslDJI.exe
  C:\Windows\System\WCslDJI.exe
  2⤵
  PID:6308
- C:\Windows\System\VkvXaJz.exe
  C:\Windows\System\VkvXaJz.exe
  2⤵
  PID:6512
- C:\Windows\System\CRaEGUf.exe
  C:\Windows\System\CRaEGUf.exe
  2⤵
  PID:6716
- C:\Windows\System\WgOzKPg.exe
  C:\Windows\System\WgOzKPg.exe
  2⤵
  PID:6956
- C:\Windows\System\rNROBUA.exe
  C:\Windows\System\rNROBUA.exe
  2⤵
  PID:4584
- C:\Windows\System\BgjQWCp.exe
  C:\Windows\System\BgjQWCp.exe
  2⤵
  PID:6224
- C:\Windows\System\ZJCwThO.exe
  C:\Windows\System\ZJCwThO.exe
  2⤵
  PID:6604
- C:\Windows\System\Jdlkoid.exe
  C:\Windows\System\Jdlkoid.exe
  2⤵
  PID:7136
- C:\Windows\System\leazjDt.exe
  C:\Windows\System\leazjDt.exe
  2⤵
  PID:7016
- C:\Windows\System\KCFUZLF.exe
  C:\Windows\System\KCFUZLF.exe
  2⤵
  PID:7172
- C:\Windows\System\bDUhLeO.exe
  C:\Windows\System\bDUhLeO.exe
  2⤵
  PID:7196
- C:\Windows\System\OFychlq.exe
  C:\Windows\System\OFychlq.exe
  2⤵
  PID:7224
- C:\Windows\System\LRilQeH.exe
  C:\Windows\System\LRilQeH.exe
  2⤵
  PID:7260
- C:\Windows\System\TBUmpls.exe
  C:\Windows\System\TBUmpls.exe
  2⤵
  PID:7280
- C:\Windows\System\TVeYAvh.exe
  C:\Windows\System\TVeYAvh.exe
  2⤵
  PID:7316
- C:\Windows\System\VBmdZIj.exe
  C:\Windows\System\VBmdZIj.exe
  2⤵
  PID:7340
- C:\Windows\System\jxqOxmu.exe
  C:\Windows\System\jxqOxmu.exe
  2⤵
  PID:7376
- C:\Windows\System\ZzfGLLd.exe
  C:\Windows\System\ZzfGLLd.exe
  2⤵
  PID:7396
- C:\Windows\System\kbbtnIH.exe
  C:\Windows\System\kbbtnIH.exe
  2⤵
  PID:7428
- C:\Windows\System\oVLlMEj.exe
  C:\Windows\System\oVLlMEj.exe
  2⤵
  PID:7456
- C:\Windows\System\fTeYKIs.exe
  C:\Windows\System\fTeYKIs.exe
  2⤵
  PID:7480
- C:\Windows\System\sabQzjW.exe
  C:\Windows\System\sabQzjW.exe
  2⤵
  PID:7516
- C:\Windows\System\cBQjMhR.exe
  C:\Windows\System\cBQjMhR.exe
  2⤵
  PID:7544
- C:\Windows\System\jirIiMe.exe
  C:\Windows\System\jirIiMe.exe
  2⤵
  PID:7572
- C:\Windows\System\ZlOCrtt.exe
  C:\Windows\System\ZlOCrtt.exe
  2⤵
  PID:7596
- C:\Windows\System\oplihvB.exe
  C:\Windows\System\oplihvB.exe
  2⤵
  PID:7628
- C:\Windows\System\EhKRnAx.exe
  C:\Windows\System\EhKRnAx.exe
  2⤵
  PID:7656
- C:\Windows\System\rZybiqR.exe
  C:\Windows\System\rZybiqR.exe
  2⤵
  PID:7684
- C:\Windows\System\KoHrqsX.exe
  C:\Windows\System\KoHrqsX.exe
  2⤵
  PID:7708
- C:\Windows\System\jJDSJIO.exe
  C:\Windows\System\jJDSJIO.exe
  2⤵
  PID:7736
- C:\Windows\System\sDNnjgL.exe
  C:\Windows\System\sDNnjgL.exe
  2⤵
  PID:7764
- C:\Windows\System\GayJcDl.exe
  C:\Windows\System\GayJcDl.exe
  2⤵
  PID:7792
- C:\Windows\System\nVKKgYd.exe
  C:\Windows\System\nVKKgYd.exe
  2⤵
  PID:7824
- C:\Windows\System\inhDnib.exe
  C:\Windows\System\inhDnib.exe
  2⤵
  PID:7844
- C:\Windows\System\mEvPZEz.exe
  C:\Windows\System\mEvPZEz.exe
  2⤵
  PID:7872
- C:\Windows\System\KiqAyyX.exe
  C:\Windows\System\KiqAyyX.exe
  2⤵
  PID:7900
- C:\Windows\System\PEZvYGQ.exe
  C:\Windows\System\PEZvYGQ.exe
  2⤵
  PID:7928
- C:\Windows\System\ABWEUVS.exe
  C:\Windows\System\ABWEUVS.exe
  2⤵
  PID:7972
- C:\Windows\System\TMxwLgu.exe
  C:\Windows\System\TMxwLgu.exe
  2⤵
  PID:8000
- C:\Windows\System\wzKemAi.exe
  C:\Windows\System\wzKemAi.exe
  2⤵
  PID:8028
- C:\Windows\System\ZWYwOJn.exe
  C:\Windows\System\ZWYwOJn.exe
  2⤵
  PID:8060
- C:\Windows\System\nmcFdRy.exe
  C:\Windows\System\nmcFdRy.exe
  2⤵
  PID:8084
- C:\Windows\System\pIPKCUU.exe
  C:\Windows\System\pIPKCUU.exe
  2⤵
  PID:8116
- C:\Windows\System\wYZtwPJ.exe
  C:\Windows\System\wYZtwPJ.exe
  2⤵
  PID:8140
- C:\Windows\System\hoYmQtA.exe
  C:\Windows\System\hoYmQtA.exe
  2⤵
  PID:8172
- C:\Windows\System\nLEKdPg.exe
  C:\Windows\System\nLEKdPg.exe
  2⤵
  PID:7188
- C:\Windows\System\nubkQWc.exe
  C:\Windows\System\nubkQWc.exe
  2⤵
  PID:7252
- C:\Windows\System\AegVaki.exe
  C:\Windows\System\AegVaki.exe
  2⤵
  PID:7292
- C:\Windows\System\DbSDPUU.exe
  C:\Windows\System\DbSDPUU.exe
  2⤵
  PID:7352
- C:\Windows\System\UtciQlb.exe
  C:\Windows\System\UtciQlb.exe
  2⤵
  PID:7472
- C:\Windows\System\jGvnqnI.exe
  C:\Windows\System\jGvnqnI.exe
  2⤵
  PID:7532
- C:\Windows\System\DcxopgP.exe
  C:\Windows\System\DcxopgP.exe
  2⤵
  PID:7608
- C:\Windows\System\EvISDjt.exe
  C:\Windows\System\EvISDjt.exe
  2⤵
  PID:7668
- C:\Windows\System\ZcKKMLf.exe
  C:\Windows\System\ZcKKMLf.exe
  2⤵
  PID:7728
- C:\Windows\System\IRraPGo.exe
  C:\Windows\System\IRraPGo.exe
  2⤵
  PID:7804
- C:\Windows\System\PBJGRDk.exe
  C:\Windows\System\PBJGRDk.exe
  2⤵
  PID:7856
- C:\Windows\System\lBKerAl.exe
  C:\Windows\System\lBKerAl.exe
  2⤵
  PID:7920
- C:\Windows\System\wbsWZkg.exe
  C:\Windows\System\wbsWZkg.exe
  2⤵
  PID:7996
- C:\Windows\System\VGJnWep.exe
  C:\Windows\System\VGJnWep.exe
  2⤵
  PID:8052
- C:\Windows\System\hamgWyt.exe
  C:\Windows\System\hamgWyt.exe
  2⤵
  PID:8124
- C:\Windows\System\rxZBSIL.exe
  C:\Windows\System\rxZBSIL.exe
  2⤵
  PID:7216
- C:\Windows\System\fYOxHcY.exe
  C:\Windows\System\fYOxHcY.exe
  2⤵
  PID:7332
- C:\Windows\System\hgHVYQb.exe
  C:\Windows\System\hgHVYQb.exe
  2⤵
  PID:7584
- C:\Windows\System\gHwGZMG.exe
  C:\Windows\System\gHwGZMG.exe
  2⤵
  PID:7752
- C:\Windows\System\zycEsuQ.exe
  C:\Windows\System\zycEsuQ.exe
  2⤵
  PID:7836
- C:\Windows\System\pPyLJJE.exe
  C:\Windows\System\pPyLJJE.exe
  2⤵
  PID:8040
- C:\Windows\System\DExSLpO.exe
  C:\Windows\System\DExSLpO.exe
  2⤵
  PID:8152
- C:\Windows\System\dtVIzqM.exe
  C:\Windows\System\dtVIzqM.exe
  2⤵
  PID:2612
- C:\Windows\System\pFJjYnm.exe
  C:\Windows\System\pFJjYnm.exe
  2⤵
  PID:7444
- C:\Windows\System\INSyWkA.exe
  C:\Windows\System\INSyWkA.exe
  2⤵
  PID:7644
- C:\Windows\System\snbJVlM.exe
  C:\Windows\System\snbJVlM.exe
  2⤵
  PID:7964
- C:\Windows\System\sOFvHfw.exe
  C:\Windows\System\sOFvHfw.exe
  2⤵
  PID:4612
- C:\Windows\System\afGTrSh.exe
  C:\Windows\System\afGTrSh.exe
  2⤵
  PID:8200
- C:\Windows\System\isuoeis.exe
  C:\Windows\System\isuoeis.exe
  2⤵
  PID:8232
- C:\Windows\System\fQcDkRd.exe
  C:\Windows\System\fQcDkRd.exe
  2⤵
  PID:8260
- C:\Windows\System\MrpwHQV.exe
  C:\Windows\System\MrpwHQV.exe
  2⤵
  PID:8288
- C:\Windows\System\zILOuXY.exe
  C:\Windows\System\zILOuXY.exe
  2⤵
  PID:8316
- C:\Windows\System\ZaWqhWW.exe
  C:\Windows\System\ZaWqhWW.exe
  2⤵
  PID:8344
- C:\Windows\System\vnOMovI.exe
  C:\Windows\System\vnOMovI.exe
  2⤵
  PID:8384
- C:\Windows\System\suYYdpM.exe
  C:\Windows\System\suYYdpM.exe
  2⤵
  PID:8400
- C:\Windows\System\UgrHKiS.exe
  C:\Windows\System\UgrHKiS.exe
  2⤵
  PID:8428
- C:\Windows\System\jENkEqE.exe
  C:\Windows\System\jENkEqE.exe
  2⤵
  PID:8456
- C:\Windows\System\xDCHqdc.exe
  C:\Windows\System\xDCHqdc.exe
  2⤵
  PID:8484
- C:\Windows\System\USbspjX.exe
  C:\Windows\System\USbspjX.exe
  2⤵
  PID:8512
- C:\Windows\System\VnbYcjF.exe
  C:\Windows\System\VnbYcjF.exe
  2⤵
  PID:8540
- C:\Windows\System\NQcZslK.exe
  C:\Windows\System\NQcZslK.exe
  2⤵
  PID:8568
- C:\Windows\System\iARgrHA.exe
  C:\Windows\System\iARgrHA.exe
  2⤵
  PID:8596
- C:\Windows\System\avHSnms.exe
  C:\Windows\System\avHSnms.exe
  2⤵
  PID:8624
- C:\Windows\System\QVIlbUG.exe
  C:\Windows\System\QVIlbUG.exe
  2⤵
  PID:8652
- C:\Windows\System\QzHOwzT.exe
  C:\Windows\System\QzHOwzT.exe
  2⤵
  PID:8680
- C:\Windows\System\UFReCGG.exe
  C:\Windows\System\UFReCGG.exe
  2⤵
  PID:8708
- C:\Windows\System\jNipbUL.exe
  C:\Windows\System\jNipbUL.exe
  2⤵
  PID:8740
- C:\Windows\System\nElIvag.exe
  C:\Windows\System\nElIvag.exe
  2⤵
  PID:8768
- C:\Windows\System\wLdaAze.exe
  C:\Windows\System\wLdaAze.exe
  2⤵
  PID:8796
- C:\Windows\System\GwSRske.exe
  C:\Windows\System\GwSRske.exe
  2⤵
  PID:8824
- C:\Windows\System\kRLrSIg.exe
  C:\Windows\System\kRLrSIg.exe
  2⤵
  PID:8852
- C:\Windows\System\icFbmii.exe
  C:\Windows\System\icFbmii.exe
  2⤵
  PID:8880
- C:\Windows\System\adBVcqa.exe
  C:\Windows\System\adBVcqa.exe
  2⤵
  PID:8908
- C:\Windows\System\xRkuxMQ.exe
  C:\Windows\System\xRkuxMQ.exe
  2⤵
  PID:8936
- C:\Windows\System\aZqMBux.exe
  C:\Windows\System\aZqMBux.exe
  2⤵
  PID:8964
- C:\Windows\System\nSlAajR.exe
  C:\Windows\System\nSlAajR.exe
  2⤵
  PID:8992
- C:\Windows\System\CNECQui.exe
  C:\Windows\System\CNECQui.exe
  2⤵
  PID:9020
- C:\Windows\System\ZZmSRBs.exe
  C:\Windows\System\ZZmSRBs.exe
  2⤵
  PID:9048
- C:\Windows\System\Fewlccd.exe
  C:\Windows\System\Fewlccd.exe
  2⤵
  PID:9076
- C:\Windows\System\sACAcyO.exe
  C:\Windows\System\sACAcyO.exe
  2⤵
  PID:9104
- C:\Windows\System\USQGZfk.exe
  C:\Windows\System\USQGZfk.exe
  2⤵
  PID:9132
- C:\Windows\System\hVYXlIF.exe
  C:\Windows\System\hVYXlIF.exe
  2⤵
  PID:9160
- C:\Windows\System\eZnTblZ.exe
  C:\Windows\System\eZnTblZ.exe
  2⤵
  PID:9188
- C:\Windows\System\FfVFbPP.exe
  C:\Windows\System\FfVFbPP.exe
  2⤵
  PID:4828
- C:\Windows\System\NhnFTtM.exe
  C:\Windows\System\NhnFTtM.exe
  2⤵
  PID:8252
- C:\Windows\System\xggXedV.exe
  C:\Windows\System\xggXedV.exe
  2⤵
  PID:8312
- C:\Windows\System\MKPjXmE.exe
  C:\Windows\System\MKPjXmE.exe
  2⤵
  PID:8380
- C:\Windows\System\vEyyMRw.exe
  C:\Windows\System\vEyyMRw.exe
  2⤵
  PID:8440
- C:\Windows\System\CLnWKgE.exe
  C:\Windows\System\CLnWKgE.exe
  2⤵
  PID:8504
- C:\Windows\System\WLQlwPZ.exe
  C:\Windows\System\WLQlwPZ.exe
  2⤵
  PID:8564
- C:\Windows\System\lyPjcAt.exe
  C:\Windows\System\lyPjcAt.exe
  2⤵
  PID:8636
- C:\Windows\System\sknaoIh.exe
  C:\Windows\System\sknaoIh.exe
  2⤵
  PID:8700
- C:\Windows\System\xFvMNhg.exe
  C:\Windows\System\xFvMNhg.exe
  2⤵
  PID:8764
- C:\Windows\System\BackuUs.exe
  C:\Windows\System\BackuUs.exe
  2⤵
  PID:8836
- C:\Windows\System\AcQFyYC.exe
  C:\Windows\System\AcQFyYC.exe
  2⤵
  PID:8900
- C:\Windows\System\tSeoRoo.exe
  C:\Windows\System\tSeoRoo.exe
  2⤵
  PID:8956
- C:\Windows\System\WfkGPql.exe
  C:\Windows\System\WfkGPql.exe
  2⤵
  PID:9044
- C:\Windows\System\ciNuCRD.exe
  C:\Windows\System\ciNuCRD.exe
  2⤵
  PID:9096
- C:\Windows\System\HBuzXsz.exe
  C:\Windows\System\HBuzXsz.exe
  2⤵
  PID:9156
- C:\Windows\System\gMAwhDW.exe
  C:\Windows\System\gMAwhDW.exe
  2⤵
  PID:8224
- C:\Windows\System\BTplHIv.exe
  C:\Windows\System\BTplHIv.exe
  2⤵
  PID:8356
- C:\Windows\System\nGOnrjp.exe
  C:\Windows\System\nGOnrjp.exe
  2⤵
  PID:8480
- C:\Windows\System\eqByEpy.exe
  C:\Windows\System\eqByEpy.exe
  2⤵
  PID:8664
- C:\Windows\System\ekSbabi.exe
  C:\Windows\System\ekSbabi.exe
  2⤵
  PID:8816
- C:\Windows\System\IySEjec.exe
  C:\Windows\System\IySEjec.exe
  2⤵
  PID:8960
- C:\Windows\System\RfdZyTz.exe
  C:\Windows\System\RfdZyTz.exe
  2⤵
  PID:9128
- C:\Windows\System\SAPwssI.exe
  C:\Windows\System\SAPwssI.exe
  2⤵
  PID:8308
- C:\Windows\System\ohTwNSP.exe
  C:\Windows\System\ohTwNSP.exe
  2⤵
  PID:8616
- C:\Windows\System\RxsVKxw.exe
  C:\Windows\System\RxsVKxw.exe
  2⤵
  PID:8928
- C:\Windows\System\hjEAbOn.exe
  C:\Windows\System\hjEAbOn.exe
  2⤵
  PID:9212
- C:\Windows\System\OjxfgqW.exe
  C:\Windows\System\OjxfgqW.exe
  2⤵
  PID:8728
- C:\Windows\System\eiWybYn.exe
  C:\Windows\System\eiWybYn.exe
  2⤵
  PID:1944
- C:\Windows\System\qWxGhbx.exe
  C:\Windows\System\qWxGhbx.exe
  2⤵
  PID:9236
- C:\Windows\System\vFRGPWT.exe
  C:\Windows\System\vFRGPWT.exe
  2⤵
  PID:9264
- C:\Windows\System\xuzXKWB.exe
  C:\Windows\System\xuzXKWB.exe
  2⤵
  PID:9292
- C:\Windows\System\LygEOCk.exe
  C:\Windows\System\LygEOCk.exe
  2⤵
  PID:9312
- C:\Windows\System\IELYaSM.exe
  C:\Windows\System\IELYaSM.exe
  2⤵
  PID:9328
- C:\Windows\System\hWoeJDU.exe
  C:\Windows\System\hWoeJDU.exe
  2⤵
  PID:9380
- C:\Windows\System\fefRXvE.exe
  C:\Windows\System\fefRXvE.exe
  2⤵
  PID:9400
- C:\Windows\System\QkurCiO.exe
  C:\Windows\System\QkurCiO.exe
  2⤵
  PID:9416
- C:\Windows\System\WuxPbfa.exe
  C:\Windows\System\WuxPbfa.exe
  2⤵
  PID:9432
- C:\Windows\System\yCSOfsA.exe
  C:\Windows\System\yCSOfsA.exe
  2⤵
  PID:9456
- C:\Windows\System\GsjjWNQ.exe
  C:\Windows\System\GsjjWNQ.exe
  2⤵
  PID:9528
- C:\Windows\System\AadkvvI.exe
  C:\Windows\System\AadkvvI.exe
  2⤵
  PID:9556
- C:\Windows\System\NLtAtLs.exe
  C:\Windows\System\NLtAtLs.exe
  2⤵
  PID:9584
- C:\Windows\System\ZswHyYU.exe
  C:\Windows\System\ZswHyYU.exe
  2⤵
  PID:9612
- C:\Windows\System\RooZuRh.exe
  C:\Windows\System\RooZuRh.exe
  2⤵
  PID:9628
- C:\Windows\System\VcqTjKA.exe
  C:\Windows\System\VcqTjKA.exe
  2⤵
  PID:9668
- C:\Windows\System\YUumWYX.exe
  C:\Windows\System\YUumWYX.exe
  2⤵
  PID:9696
- C:\Windows\System\PFKznKG.exe
  C:\Windows\System\PFKznKG.exe
  2⤵
  PID:9724
- C:\Windows\System\YGBGJVq.exe
  C:\Windows\System\YGBGJVq.exe
  2⤵
  PID:9752
- C:\Windows\System\MTkiDfA.exe
  C:\Windows\System\MTkiDfA.exe
  2⤵
  PID:9780
- C:\Windows\System\vCOOmRf.exe
  C:\Windows\System\vCOOmRf.exe
  2⤵
  PID:9808
- C:\Windows\System\Oyrmpwi.exe
  C:\Windows\System\Oyrmpwi.exe
  2⤵
  PID:9836
- C:\Windows\System\CYqOKGx.exe
  C:\Windows\System\CYqOKGx.exe
  2⤵
  PID:9864
- C:\Windows\System\cVHHUfQ.exe
  C:\Windows\System\cVHHUfQ.exe
  2⤵
  PID:9892
- C:\Windows\System\pkGcyQv.exe
  C:\Windows\System\pkGcyQv.exe
  2⤵
  PID:9920
- C:\Windows\System\dSGVSZp.exe
  C:\Windows\System\dSGVSZp.exe
  2⤵
  PID:10072
- C:\Windows\System\QdKzwON.exe
  C:\Windows\System\QdKzwON.exe
  2⤵
  PID:10104
- C:\Windows\System\zLtqOuq.exe
  C:\Windows\System\zLtqOuq.exe
  2⤵
  PID:10132
- C:\Windows\System\ybqLEXP.exe
  C:\Windows\System\ybqLEXP.exe
  2⤵
  PID:10160
- C:\Windows\System\djbLDZg.exe
  C:\Windows\System\djbLDZg.exe
  2⤵
  PID:10188
- C:\Windows\System\lRnlAOC.exe
  C:\Windows\System\lRnlAOC.exe
  2⤵
  PID:10216
- C:\Windows\System\tnnOOeb.exe
  C:\Windows\System\tnnOOeb.exe
  2⤵
  PID:9228
- C:\Windows\System\TRpojuJ.exe
  C:\Windows\System\TRpojuJ.exe
  2⤵
  PID:9288
- C:\Windows\System\SWeZxFk.exe
  C:\Windows\System\SWeZxFk.exe
  2⤵
  PID:9344
- C:\Windows\System\WSRPRUZ.exe
  C:\Windows\System\WSRPRUZ.exe
  2⤵
  PID:9424
- C:\Windows\System\tpklMWl.exe
  C:\Windows\System\tpklMWl.exe
  2⤵
  PID:9452
- C:\Windows\System\awmbZsm.exe
  C:\Windows\System\awmbZsm.exe
  2⤵
  PID:9552
- C:\Windows\System\oMQFBfo.exe
  C:\Windows\System\oMQFBfo.exe
  2⤵
  PID:9620
- C:\Windows\System\jKaqiVG.exe
  C:\Windows\System\jKaqiVG.exe
  2⤵
  PID:9692
- C:\Windows\System\qXtjZQR.exe
  C:\Windows\System\qXtjZQR.exe
  2⤵
  PID:9748
- C:\Windows\System\lgXDaWj.exe
  C:\Windows\System\lgXDaWj.exe
  2⤵
  PID:9800
- C:\Windows\System\RbvgAdd.exe
  C:\Windows\System\RbvgAdd.exe
  2⤵
  PID:9884
- C:\Windows\System\IZEIwIR.exe
  C:\Windows\System\IZEIwIR.exe
  2⤵
  PID:9944
- C:\Windows\System\cuULKkE.exe
  C:\Windows\System\cuULKkE.exe
  2⤵
  PID:9972
- C:\Windows\System\YfLNjvG.exe
  C:\Windows\System\YfLNjvG.exe
  2⤵
  PID:10000
- C:\Windows\System\fprdtBR.exe
  C:\Windows\System\fprdtBR.exe
  2⤵
  PID:10028
- C:\Windows\System\xDzsYiW.exe
  C:\Windows\System\xDzsYiW.exe
  2⤵
  PID:10056
- C:\Windows\System\AVtFzcB.exe
  C:\Windows\System\AVtFzcB.exe
  2⤵
  PID:10092
- C:\Windows\System\UeqjMSF.exe
  C:\Windows\System\UeqjMSF.exe
  2⤵
  PID:10172
- C:\Windows\System\EqmawiF.exe
  C:\Windows\System\EqmawiF.exe
  2⤵
  PID:10236
- C:\Windows\System\YRsREJT.exe
  C:\Windows\System\YRsREJT.exe
  2⤵
  PID:9356
- C:\Windows\System\ZHXABID.exe
  C:\Windows\System\ZHXABID.exe
  2⤵
  PID:9516
- C:\Windows\System\CQLUEkS.exe
  C:\Windows\System\CQLUEkS.exe
  2⤵
  PID:9720
- C:\Windows\System\gRcgWtE.exe
  C:\Windows\System\gRcgWtE.exe
  2⤵
  PID:9832
- C:\Windows\System\YtgXdYJ.exe
  C:\Windows\System\YtgXdYJ.exe
  2⤵
  PID:9956
- C:\Windows\System\fDIEgIA.exe
  C:\Windows\System\fDIEgIA.exe
  2⤵
  PID:9996
- C:\Windows\System\wEYByVz.exe
  C:\Windows\System\wEYByVz.exe
  2⤵
  PID:10052
- C:\Windows\System\GKtpTjL.exe
  C:\Windows\System\GKtpTjL.exe
  2⤵
  PID:10228
- C:\Windows\System\NVgSSOm.exe
  C:\Windows\System\NVgSSOm.exe
  2⤵
  PID:9604
- C:\Windows\System\uMOiskn.exe
  C:\Windows\System\uMOiskn.exe
  2⤵
  PID:9936
- C:\Windows\System\olpcqBR.exe
  C:\Windows\System\olpcqBR.exe
  2⤵
  PID:9524
- C:\Windows\System\chFGxuL.exe
  C:\Windows\System\chFGxuL.exe
  2⤵
  PID:9480
- C:\Windows\System\VAnnTXL.exe
  C:\Windows\System\VAnnTXL.exe
  2⤵
  PID:10316
- C:\Windows\System\cnVvsiW.exe
  C:\Windows\System\cnVvsiW.exe
  2⤵
  PID:10340
- C:\Windows\System\qjJIWFy.exe
  C:\Windows\System\qjJIWFy.exe
  2⤵
  PID:10384
- C:\Windows\System\MWjitxI.exe
  C:\Windows\System\MWjitxI.exe
  2⤵
  PID:10420
- C:\Windows\System\MPJdoVK.exe
  C:\Windows\System\MPJdoVK.exe
  2⤵
  PID:10464
- C:\Windows\System\vMrycHb.exe
  C:\Windows\System\vMrycHb.exe
  2⤵
  PID:10480
- C:\Windows\System\ucPpaCU.exe
  C:\Windows\System\ucPpaCU.exe
  2⤵
  PID:10512
- C:\Windows\System\iLWrqzB.exe
  C:\Windows\System\iLWrqzB.exe
  2⤵
  PID:10540
- C:\Windows\System\qefGgoK.exe
  C:\Windows\System\qefGgoK.exe
  2⤵
  PID:10568
- C:\Windows\System\JKpBjKg.exe
  C:\Windows\System\JKpBjKg.exe
  2⤵
  PID:10596
- C:\Windows\System\BXWPAJj.exe
  C:\Windows\System\BXWPAJj.exe
  2⤵
  PID:10632
- C:\Windows\System\YEnxvZr.exe
  C:\Windows\System\YEnxvZr.exe
  2⤵
  PID:10652
- C:\Windows\System\DcOfQXe.exe
  C:\Windows\System\DcOfQXe.exe
  2⤵
  PID:10692
- C:\Windows\System\aOEhhxz.exe
  C:\Windows\System\aOEhhxz.exe
  2⤵
  PID:10732
- C:\Windows\System\CkZySxq.exe
  C:\Windows\System\CkZySxq.exe
  2⤵
  PID:10796
- C:\Windows\System\vGPRFhC.exe
  C:\Windows\System\vGPRFhC.exe
  2⤵
  PID:10836
- C:\Windows\System\MlasvrZ.exe
  C:\Windows\System\MlasvrZ.exe
  2⤵
  PID:10852
- C:\Windows\System\RYrHzIn.exe
  C:\Windows\System\RYrHzIn.exe
  2⤵
  PID:10892
- C:\Windows\System\odeUhCL.exe
  C:\Windows\System\odeUhCL.exe
  2⤵
  PID:10920
- C:\Windows\System\jBDhdUE.exe
  C:\Windows\System\jBDhdUE.exe
  2⤵
  PID:10952
- C:\Windows\System\naDlSWX.exe
  C:\Windows\System\naDlSWX.exe
  2⤵
  PID:10968
- C:\Windows\System\RCcUcYT.exe
  C:\Windows\System\RCcUcYT.exe
  2⤵
  PID:10984
- C:\Windows\System\VvGrtXR.exe
  C:\Windows\System\VvGrtXR.exe
  2⤵
  PID:11004
- C:\Windows\System\wneqCkY.exe
  C:\Windows\System\wneqCkY.exe
  2⤵
  PID:11040
- C:\Windows\System\cbhxUVC.exe
  C:\Windows\System\cbhxUVC.exe
  2⤵
  PID:11104
- C:\Windows\System\QPVhGnz.exe
  C:\Windows\System\QPVhGnz.exe
  2⤵
  PID:11120
- C:\Windows\System\thIALYY.exe
  C:\Windows\System\thIALYY.exe
  2⤵
  PID:11160
- C:\Windows\System\kiWaCoB.exe
  C:\Windows\System\kiWaCoB.exe
  2⤵
  PID:11188
- C:\Windows\System\AiVwEGV.exe
  C:\Windows\System\AiVwEGV.exe
  2⤵
  PID:11216
- C:\Windows\System\coyQciy.exe
  C:\Windows\System\coyQciy.exe
  2⤵
  PID:11244
- C:\Windows\System\vDqPgcF.exe
  C:\Windows\System\vDqPgcF.exe
  2⤵
  PID:10244
- C:\Windows\System\TzeKpBF.exe
  C:\Windows\System\TzeKpBF.exe
  2⤵
  PID:10272
- C:\Windows\System\PkEZWqP.exe
  C:\Windows\System\PkEZWqP.exe
  2⤵
  PID:10300
- C:\Windows\System\cFEbcFo.exe
  C:\Windows\System\cFEbcFo.exe
  2⤵
  PID:10332
- C:\Windows\System\hsAGLTF.exe
  C:\Windows\System\hsAGLTF.exe
  2⤵
  PID:10460
- C:\Windows\System\WukjPNL.exe
  C:\Windows\System\WukjPNL.exe
  2⤵
  PID:10472
- C:\Windows\System\gyCyXxL.exe
  C:\Windows\System\gyCyXxL.exe
  2⤵
  PID:10520
- C:\Windows\System\FnDGnwl.exe
  C:\Windows\System\FnDGnwl.exe
  2⤵
  PID:10620
- C:\Windows\System\NwLXIJY.exe
  C:\Windows\System\NwLXIJY.exe
  2⤵
  PID:10672
- C:\Windows\System\qmnaIYE.exe
  C:\Windows\System\qmnaIYE.exe
  2⤵
  PID:10764
- C:\Windows\System\WyXFkqa.exe
  C:\Windows\System\WyXFkqa.exe
  2⤵
  PID:10868
- C:\Windows\System\qgDPywj.exe
  C:\Windows\System\qgDPywj.exe
  2⤵
  PID:10964
- C:\Windows\System\QJcBVpF.exe
  C:\Windows\System\QJcBVpF.exe
  2⤵
  PID:10996
- C:\Windows\System\xQnvzAL.exe
  C:\Windows\System\xQnvzAL.exe
  2⤵
  PID:11064
- C:\Windows\System\WqVwnAi.exe
  C:\Windows\System\WqVwnAi.exe
  2⤵
  PID:11112
- C:\Windows\System\tnBYrEG.exe
  C:\Windows\System\tnBYrEG.exe
  2⤵
  PID:11212
- C:\Windows\System\InWIwAt.exe
  C:\Windows\System\InWIwAt.exe
  2⤵
  PID:11260
- C:\Windows\System\smRQtmf.exe
  C:\Windows\System\smRQtmf.exe
  2⤵
  PID:10312
- C:\Windows\System\mdgfsKV.exe
  C:\Windows\System\mdgfsKV.exe
  2⤵
  PID:4408
- C:\Windows\System\MizoZQT.exe
  C:\Windows\System\MizoZQT.exe
  2⤵
  PID:10648
- C:\Windows\System\CZAlWcI.exe
  C:\Windows\System\CZAlWcI.exe
  2⤵
  PID:10728
- C:\Windows\System\IyEKopx.exe
  C:\Windows\System\IyEKopx.exe
  2⤵
  PID:10908
- C:\Windows\System\qzmmuWo.exe
  C:\Windows\System\qzmmuWo.exe
  2⤵
  PID:11028
- C:\Windows\System\fSQpoDb.exe
  C:\Windows\System\fSQpoDb.exe
  2⤵
  PID:10260
- C:\Windows\System\kmtUIIf.exe
  C:\Windows\System\kmtUIIf.exe
  2⤵
  PID:1788
- C:\Windows\System\QSNPJeA.exe
  C:\Windows\System\QSNPJeA.exe
  2⤵
  PID:10884
- C:\Windows\System\jbsAgdj.exe
  C:\Windows\System\jbsAgdj.exe
  2⤵
  PID:11200
- C:\Windows\System\OlFLGgg.exe
  C:\Windows\System\OlFLGgg.exe
  2⤵
  PID:10492
- C:\Windows\System\sRGPYBh.exe
  C:\Windows\System\sRGPYBh.exe
  2⤵
  PID:11288
- C:\Windows\System\PobKChX.exe
  C:\Windows\System\PobKChX.exe
  2⤵
  PID:11356
- C:\Windows\System\GEAfbTd.exe
  C:\Windows\System\GEAfbTd.exe
  2⤵
  PID:11372
- C:\Windows\System\FHqYFza.exe
  C:\Windows\System\FHqYFza.exe
  2⤵
  PID:11408
- C:\Windows\System\dYZliGw.exe
  C:\Windows\System\dYZliGw.exe
  2⤵
  PID:11440
- C:\Windows\System\NoYDvdx.exe
  C:\Windows\System\NoYDvdx.exe
  2⤵
  PID:11468
- C:\Windows\System\NkOkImz.exe
  C:\Windows\System\NkOkImz.exe
  2⤵
  PID:11496
- C:\Windows\System\sZzwcAS.exe
  C:\Windows\System\sZzwcAS.exe
  2⤵
  PID:11524
- C:\Windows\System\akCrpFu.exe
  C:\Windows\System\akCrpFu.exe
  2⤵
  PID:11552
- C:\Windows\System\dzaCYxI.exe
  C:\Windows\System\dzaCYxI.exe
  2⤵
  PID:11580
- C:\Windows\System\VBNVniU.exe
  C:\Windows\System\VBNVniU.exe
  2⤵
  PID:11608
- C:\Windows\System\TpPxkBi.exe
  C:\Windows\System\TpPxkBi.exe
  2⤵
  PID:11624
- C:\Windows\System\etuJzGR.exe
  C:\Windows\System\etuJzGR.exe
  2⤵
  PID:11644
- C:\Windows\System\oRTfPCv.exe
  C:\Windows\System\oRTfPCv.exe
  2⤵
  PID:11692
- C:\Windows\System\KBIHyyY.exe
  C:\Windows\System\KBIHyyY.exe
  2⤵
  PID:11720
- C:\Windows\System\xpTLhBv.exe
  C:\Windows\System\xpTLhBv.exe
  2⤵
  PID:11736
- C:\Windows\System\IbLbTJf.exe
  C:\Windows\System\IbLbTJf.exe
  2⤵
  PID:11760
- C:\Windows\System\ZqNwMLB.exe
  C:\Windows\System\ZqNwMLB.exe
  2⤵
  PID:11792
- C:\Windows\System\FSUHhQh.exe
  C:\Windows\System\FSUHhQh.exe
  2⤵
  PID:11832
- C:\Windows\System\JgsTENR.exe
  C:\Windows\System\JgsTENR.exe
  2⤵
  PID:11848
- C:\Windows\System\CXAXcqW.exe
  C:\Windows\System\CXAXcqW.exe
  2⤵
  PID:11880
- C:\Windows\System\WqFVYuB.exe
  C:\Windows\System\WqFVYuB.exe
  2⤵
  PID:11916
- C:\Windows\System\bdpgXRQ.exe
  C:\Windows\System\bdpgXRQ.exe
  2⤵
  PID:11940
- C:\Windows\System\WdXVkxT.exe
  C:\Windows\System\WdXVkxT.exe
  2⤵
  PID:11960
- C:\Windows\System\IWHyLHh.exe
  C:\Windows\System\IWHyLHh.exe
  2⤵
  PID:12000
- C:\Windows\System\PomACUS.exe
  C:\Windows\System\PomACUS.exe
  2⤵
  PID:12016
- C:\Windows\System\xKEnAjI.exe
  C:\Windows\System\xKEnAjI.exe
  2⤵
  PID:12044
- C:\Windows\System\ScFLgYJ.exe
  C:\Windows\System\ScFLgYJ.exe
  2⤵
  PID:12072
- C:\Windows\System\wadXjgI.exe
  C:\Windows\System\wadXjgI.exe
  2⤵
  PID:12112
- C:\Windows\System\QJxhfHT.exe
  C:\Windows\System\QJxhfHT.exe
  2⤵
  PID:12128
- C:\Windows\System\vJmxQLd.exe
  C:\Windows\System\vJmxQLd.exe
  2⤵
  PID:12168
- C:\Windows\System\LjlKonD.exe
  C:\Windows\System\LjlKonD.exe
  2⤵
  PID:12188
- C:\Windows\System\NjHwCJg.exe
  C:\Windows\System\NjHwCJg.exe
  2⤵
  PID:12216
- C:\Windows\System\EqqakQw.exe
  C:\Windows\System\EqqakQw.exe
  2⤵
  PID:12252
- C:\Windows\System\SdCkTBT.exe
  C:\Windows\System\SdCkTBT.exe
  2⤵
  PID:12268
- C:\Windows\System\lhBLYYs.exe
  C:\Windows\System\lhBLYYs.exe
  2⤵
  PID:11280
- C:\Windows\System\UQKhpco.exe
  C:\Windows\System\UQKhpco.exe
  2⤵
  PID:11344
- C:\Windows\System\rBZsnIX.exe
  C:\Windows\System\rBZsnIX.exe
  2⤵
  PID:11416
- C:\Windows\System\kqdfSPr.exe
  C:\Windows\System\kqdfSPr.exe
  2⤵
  PID:11464
- C:\Windows\System\xcwSHVW.exe
  C:\Windows\System\xcwSHVW.exe
  2⤵
  PID:11544
- C:\Windows\System\fvnltmY.exe
  C:\Windows\System\fvnltmY.exe
  2⤵
  PID:11604
- C:\Windows\System\jLopUVx.exe
  C:\Windows\System\jLopUVx.exe
  2⤵
  PID:11680
- C:\Windows\System\svaDSze.exe
  C:\Windows\System\svaDSze.exe
  2⤵
  PID:11728
- C:\Windows\System\JoznoOF.exe
  C:\Windows\System\JoznoOF.exe
  2⤵
  PID:11816
- C:\Windows\System\WLkCDzr.exe
  C:\Windows\System\WLkCDzr.exe
  2⤵
  PID:11888
- C:\Windows\System\etidHKh.exe
  C:\Windows\System\etidHKh.exe
  2⤵
  PID:11932
- C:\Windows\System\BNplHFR.exe
  C:\Windows\System\BNplHFR.exe
  2⤵
  PID:11984
- C:\Windows\System\FmExXHG.exe
  C:\Windows\System\FmExXHG.exe
  2⤵
  PID:12036
- C:\Windows\System\fhnAVFv.exe
  C:\Windows\System\fhnAVFv.exe
  2⤵
  PID:12124
- C:\Windows\System\ALbrfNV.exe
  C:\Windows\System\ALbrfNV.exe
  2⤵
  PID:12196
- C:\Windows\System\pFwfWPI.exe
  C:\Windows\System\pFwfWPI.exe
  2⤵
  PID:10444
- C:\Windows\System\dfsGhXk.exe
  C:\Windows\System\dfsGhXk.exe
  2⤵
  PID:11000
- C:\Windows\System\jNFKVed.exe
  C:\Windows\System\jNFKVed.exe
  2⤵
  PID:11536
- C:\Windows\System\qErlMyX.exe
  C:\Windows\System\qErlMyX.exe
  2⤵
  PID:11600
- C:\Windows\System\vnuEbAU.exe
  C:\Windows\System\vnuEbAU.exe
  2⤵
  PID:11768
- C:\Windows\System\btFqvDJ.exe
  C:\Windows\System\btFqvDJ.exe
  2⤵
  PID:11824
- C:\Windows\System\AIYfnDe.exe
  C:\Windows\System\AIYfnDe.exe
  2⤵
  PID:11972
- C:\Windows\System\ftvjqRt.exe
  C:\Windows\System\ftvjqRt.exe
  2⤵
  PID:12212
- C:\Windows\System\nHbJsKn.exe
  C:\Windows\System\nHbJsKn.exe
  2⤵
  PID:11428
- C:\Windows\System\kUVyxLb.exe
  C:\Windows\System\kUVyxLb.exe
  2⤵
  PID:11676
- C:\Windows\System\lBCgNPQ.exe
  C:\Windows\System\lBCgNPQ.exe
  2⤵
  PID:12160
- C:\Windows\System\lJNMAXV.exe
  C:\Windows\System\lJNMAXV.exe
  2⤵
  PID:11368
- C:\Windows\System\pVRuJDU.exe
  C:\Windows\System\pVRuJDU.exe
  2⤵
  PID:4756
- C:\Windows\System\TbBpgws.exe
  C:\Windows\System\TbBpgws.exe
  2⤵
  PID:12316
- C:\Windows\System\UrSGEHf.exe
  C:\Windows\System\UrSGEHf.exe
  2⤵
  PID:12344
- C:\Windows\System\NhGbfIC.exe
  C:\Windows\System\NhGbfIC.exe
  2⤵
  PID:12372
- C:\Windows\System\xssSgEx.exe
  C:\Windows\System\xssSgEx.exe
  2⤵
  PID:12400
- C:\Windows\System\LavvAQo.exe
  C:\Windows\System\LavvAQo.exe
  2⤵
  PID:12428
- C:\Windows\System\cwRZPyo.exe
  C:\Windows\System\cwRZPyo.exe
  2⤵
  PID:12452
- C:\Windows\System\EQKSWxL.exe
  C:\Windows\System\EQKSWxL.exe
  2⤵
  PID:12468
- C:\Windows\System\MYqRrWf.exe
  C:\Windows\System\MYqRrWf.exe
  2⤵
  PID:12512
- C:\Windows\System\zRVKcZX.exe
  C:\Windows\System\zRVKcZX.exe
  2⤵
  PID:12544
- C:\Windows\System\jdEmHiB.exe
  C:\Windows\System\jdEmHiB.exe
  2⤵
  PID:12572
- C:\Windows\System\VPLrODE.exe
  C:\Windows\System\VPLrODE.exe
  2⤵
  PID:12604
- C:\Windows\System\sBsciII.exe
  C:\Windows\System\sBsciII.exe
  2⤵
  PID:12632
- C:\Windows\System\ofgIaFf.exe
  C:\Windows\System\ofgIaFf.exe
  2⤵
  PID:12660
- C:\Windows\System\JMBTAxv.exe
  C:\Windows\System\JMBTAxv.exe
  2⤵
  PID:12676
- C:\Windows\System\lGjKAlT.exe
  C:\Windows\System\lGjKAlT.exe
  2⤵
  PID:12708
- C:\Windows\System\dYGCbhl.exe
  C:\Windows\System\dYGCbhl.exe
  2⤵
  PID:12736
- C:\Windows\System\vPUiWcf.exe
  C:\Windows\System\vPUiWcf.exe
  2⤵
  PID:12772
- C:\Windows\System\DvCEBSu.exe
  C:\Windows\System\DvCEBSu.exe
  2⤵
  PID:12796
- C:\Windows\System\rcxxsST.exe
  C:\Windows\System\rcxxsST.exe
  2⤵
  PID:12828
- C:\Windows\System\SSZRPpZ.exe
  C:\Windows\System\SSZRPpZ.exe
  2⤵
  PID:12860
- C:\Windows\System\HzqFGaq.exe
  C:\Windows\System\HzqFGaq.exe
  2⤵
  PID:12888
- C:\Windows\System\DMuSRHT.exe
  C:\Windows\System\DMuSRHT.exe
  2⤵
  PID:12916
- C:\Windows\System\srWQQmZ.exe
  C:\Windows\System\srWQQmZ.exe
  2⤵
  PID:12952
- C:\Windows\System\qVFBtmi.exe
  C:\Windows\System\qVFBtmi.exe
  2⤵
  PID:12972
- C:\Windows\System\WkOPAKp.exe
  C:\Windows\System\WkOPAKp.exe
  2⤵
  PID:13000
- C:\Windows\System\FeyYXNX.exe
  C:\Windows\System\FeyYXNX.exe
  2⤵
  PID:13028
- C:\Windows\System\WfyzqJT.exe
  C:\Windows\System\WfyzqJT.exe
  2⤵
  PID:13056
- C:\Windows\System\NdZEtXP.exe
  C:\Windows\System\NdZEtXP.exe
  2⤵
  PID:13084
- C:\Windows\System\kukzOVC.exe
  C:\Windows\System\kukzOVC.exe
  2⤵
  PID:13108
- C:\Windows\System\CnHCOFc.exe
  C:\Windows\System\CnHCOFc.exe
  2⤵
  PID:13128
- C:\Windows\System\GQPWoii.exe
  C:\Windows\System\GQPWoii.exe
  2⤵
  PID:13168
- C:\Windows\System\RrjROlM.exe
  C:\Windows\System\RrjROlM.exe
  2⤵
  PID:13196
- C:\Windows\System\HxRJuPc.exe
  C:\Windows\System\HxRJuPc.exe
  2⤵
  PID:13224
- C:\Windows\System\dIblKwr.exe
  C:\Windows\System\dIblKwr.exe
  2⤵
  PID:13252
- C:\Windows\System\PKYgUmn.exe
  C:\Windows\System\PKYgUmn.exe
  2⤵
  PID:13280
- C:\Windows\System\WqPvLwB.exe
  C:\Windows\System\WqPvLwB.exe
  2⤵
  PID:13308
- C:\Windows\System\tNlGiru.exe
  C:\Windows\System\tNlGiru.exe
  2⤵
  PID:12304
- C:\Windows\System\OjxqFEU.exe
  C:\Windows\System\OjxqFEU.exe
  2⤵
  PID:11488
- C:\Windows\System\ZZrNOva.exe
  C:\Windows\System\ZZrNOva.exe
  2⤵
  PID:12436
- C:\Windows\System\VbgQgya.exe
  C:\Windows\System\VbgQgya.exe
  2⤵
  PID:12508
- C:\Windows\System\gwWYpQa.exe
  C:\Windows\System\gwWYpQa.exe
  2⤵
  PID:12564
- C:\Windows\System\tRkRqyv.exe
  C:\Windows\System\tRkRqyv.exe
  2⤵
  PID:12652
- C:\Windows\System\ECipSYi.exe
  C:\Windows\System\ECipSYi.exe
  2⤵
  PID:12692
- C:\Windows\System\qydAFYO.exe
  C:\Windows\System\qydAFYO.exe
  2⤵
  PID:12756
- C:\Windows\System\ytFNfvQ.exe
  C:\Windows\System\ytFNfvQ.exe
  2⤵
  PID:12820
- C:\Windows\System\FeIQJEI.exe
  C:\Windows\System\FeIQJEI.exe
  2⤵
  PID:5980
- C:\Windows\System\TSnqHaz.exe
  C:\Windows\System\TSnqHaz.exe
  2⤵
  PID:12872
- C:\Windows\System\NMcuVNM.exe
  C:\Windows\System\NMcuVNM.exe
  2⤵
  PID:1136
- C:\Windows\System\WWhiMVf.exe
  C:\Windows\System\WWhiMVf.exe
  2⤵
  PID:12940
- C:\Windows\System\yxmXPon.exe
  C:\Windows\System\yxmXPon.exe
  2⤵
  PID:12996
- C:\Windows\System\kjNMmfe.exe
  C:\Windows\System\kjNMmfe.exe
  2⤵
  PID:13052
- C:\Windows\System\rhHYimj.exe
  C:\Windows\System\rhHYimj.exe
  2⤵
  PID:13100
- C:\Windows\System\SjcwyLw.exe
  C:\Windows\System\SjcwyLw.exe
  2⤵
  PID:13208
- C:\Windows\System\wQerTGf.exe
  C:\Windows\System\wQerTGf.exe
  2⤵
  PID:13244
- C:\Windows\System\vEsmUGj.exe
  C:\Windows\System\vEsmUGj.exe
  2⤵
  PID:13300
- C:\Windows\System\oVANATG.exe
  C:\Windows\System\oVANATG.exe
  2⤵
  PID:12336
- C:\Windows\System\kwhvaWx.exe
  C:\Windows\System\kwhvaWx.exe
  2⤵
  PID:12616
- C:\Windows\System\fWpqiIb.exe
  C:\Windows\System\fWpqiIb.exe
  2⤵
  PID:12792
- C:\Windows\System\TwfcKTr.exe
  C:\Windows\System\TwfcKTr.exe
  2⤵
  PID:12804
- C:\Windows\System\awzDZmu.exe
  C:\Windows\System\awzDZmu.exe
  2⤵
  PID:5892
- C:\Windows\System\amwkfBW.exe
  C:\Windows\System\amwkfBW.exe
  2⤵
  PID:12936
- C:\Windows\System\wKxCiSD.exe
  C:\Windows\System\wKxCiSD.exe
  2⤵
  PID:13124
- C:\Windows\System\AmxhPIr.exe
  C:\Windows\System\AmxhPIr.exe
  2⤵
  PID:13220
- C:\Windows\System\MLwhwux.exe
  C:\Windows\System\MLwhwux.exe
  2⤵
  PID:12356
- C:\Windows\System\inAwQcH.exe
  C:\Windows\System\inAwQcH.exe
  2⤵
  PID:12984
- C:\Windows\System\DrjnAjV.exe
  C:\Windows\System\DrjnAjV.exe
  2⤵
  PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmlushej.ptg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DRMhARE.exe

Filesize
2.9MB

MD5
3740d03be1d218437956db6dc4fca9a5

SHA1
febd439305edeebdaf37055dcc5e7badd44f03c0

SHA256
cba67bd8b75c413d8512efb0a1d3f429d5633f3d552b7842742fe59962cc2e08

SHA512
e5f42a3e9713051f466305aeaf26c8bce98b6b545e8d816ecd928dbc7c8d1d1430bc9e32802b0cd23dd098296f21ed32c0ec1456618360c755060d1578535654

Download Submit
C:\Windows\System\EhdbFkc.exe

Filesize
2.9MB

MD5
b27b9ce41bd76b92e12d6a6a416720d1

SHA1
4a1c3ad6e458361b5b4f1d40b61f7351ee45c133

SHA256
d7688a5ad33cef0969cceb73d896aeaa505662eec677f670ab5793bdd2fcd83a

SHA512
92565750f06bafb876b209b0b982983d6da22a9c2f0f68b7359a96521ad4d7551b968e499d1fc9919cb626f0179f3c815fe326485ea9ae8a0a06cda3cb5596d8

Download Submit
C:\Windows\System\IweagVO.exe

Filesize
2.9MB

MD5
57c0a42a1b7ff213a862ec911fc00ae1

SHA1
b0a9e5dd4b9a928d5000950504aeb79d3b4e0148

SHA256
bc3b2fa46df572340ac892c9d849bb485014977e145af825091a6701837b00ea

SHA512
a46a67456322ea10dbc4413c90f9e196f5475c5d4f30c7c0b7c12a3495e497ae38ccebe9f9dea657d0d2f01e4f87fdcbf8b3d7cc445510745f02c6ad33736c7a

Download Submit
C:\Windows\System\KGDYvff.exe

Filesize
2.9MB

MD5
455f2254925b88d907a9fc2c93448ea5

SHA1
b8c8a4036a9334b855bdff382527d43a40031739

SHA256
01b586e56e9fa228a2143eef22c8c5ced5bfaf984508fceac5b75ab026550f06

SHA512
65a00347edb7ae866e32fd0facd05170eba584d3c21877b6009219f870e0df52c8255bd4dc1ed4fb3bb86ecf8d196fa39aa944eb6d953d8c3d65be0bf7738370

Download Submit
C:\Windows\System\MUnGmGh.exe

Filesize
2.9MB

MD5
71684754555723b7b453b4d4667be5f7

SHA1
12b4cfed98a0497e3481901ed990e11de833bd9b

SHA256
ea3f2a041a39494a086aa2e54cc85b6b7a0c1001cded48ef48b98074356c7615

SHA512
fe07106c8c9da883928d103f4a3fac047b660e4808309dc84e284e5eca67c4f5cc8b79352d4e1b0e92a49dce2d174c7c19d43ead82b03f6fe16ab26319c88e1d

Download Submit
C:\Windows\System\NiUHnMO.exe

Filesize
2.9MB

MD5
e4b2ff62f4cc8b45b0502de2cfd30aac

SHA1
d280b56ae26371cb019a95432d61d5dea0752113

SHA256
a3ccdaa12b249c56b90f23e7d78a6f59bbc6cd3e92940f0dd92a2c650ff44b23

SHA512
610f3d5dae0c9be6b52df403b015213fb345738e2ed12a26c095d3efdf3a0a172865e9fa3485e70294f88e31037d93fb2234bf321fb9a4ff1409e5c28ec8430e

Download Submit
C:\Windows\System\PhNJcHm.exe

Filesize
2.9MB

MD5
8e6abe04f01af74251ed6f1bb374cff0

SHA1
07694d18358d892d3a4d5e41f94b49a863df4d4e

SHA256
1b0f3e63f906b230acb7b8249364eb1e080916f2320bc0bba6efe0415a2be93b

SHA512
df839912cc8254098a598d56df434f7180be57314d7049b613f3ff7a4896591653b065bc0242b339eb4b13cb35d9d8a71c5ec463e071f5bca324a39a87e9ea7d

Download Submit
C:\Windows\System\QwEeiey.exe

Filesize
2.9MB

MD5
3e931439bd1e814a21475785bd8bce35

SHA1
bf5eda9073def5151cef036849d2c10af97b311c

SHA256
849b617cc47b1467ce3273da587ac66fe314e77a8f620dcd077da5f2d643698e

SHA512
110b63d16796ef457aec60fa880ce2cf206b8270b733f63ce55a95361d9b9622b6e87070174277b29d48e60780871b78737ba37652acf7c760bdab3bcb94530a

Download Submit
C:\Windows\System\Rjlfdrz.exe

Filesize
2.9MB

MD5
bede550e084a9c7e40784bc297d37a1d

SHA1
b1ffcb836ef47a8b53882925eecab0ac146904d8

SHA256
407a05b545c3d56efd7d7940958d0f8717b143805adae4854570b4ae1f442b3b

SHA512
f26a95c5d8b97094e16c944162d8d4ec56c37282de6574d734b39f8e5f02186119eca86e5ffd93aa70aa7a3c24aa926de3784af51fdd70aa4a4d961af4fc671e

Download Submit
C:\Windows\System\TOIRrDy.exe

Filesize
2.9MB

MD5
b9d4cd19c72545a83a2ed358c42bd3b4

SHA1
243dd18a4167de3845ce87b313e38b2464720056

SHA256
726880dea5d277b40cfbe2d6e35a97b070b19e837d6448897ba2c63ac50bdf20

SHA512
6c2a9c8ad66c96c538e69f388639bd4482a99daa96aebbc5946668e53d612d0abc5f2f7443dcda680ac0ab7750107dc2bc773193bc1f8cbf57054059beb5263b

Download Submit
C:\Windows\System\UjoGETT.exe

Filesize
2.9MB

MD5
a78f3ddab662e19bd5ba29f212d9ee51

SHA1
818a8b25d844edc5455984380d6072c52de373e8

SHA256
f16d51f5772d130c3ce2de1bb8f7a8feb96e6466a307e2014fb655b7e9ed1148

SHA512
337ce4a9960d0a2c9ee792a4925e5d576b007be4002a63058bd0ed41effbcc9baa659a387af75e3bcbfd0346cf8d781693771f71da4c1a2af67be28cc866927b

Download Submit
C:\Windows\System\VBmhfGF.exe

Filesize
2.9MB

MD5
d2d1ccc4a677f8c4ec515b3122eb46ea

SHA1
350f699555801c3ae0c2306e0e475cb95ce1ca0a

SHA256
f8de20361cb420e6593395ef47f032aa25bd23450e6e5401511e7e6dfd0615c9

SHA512
ef4feba0fd91a3b532a394575ede9fc8eab98badb6961f55bb8f8a27d09285eecc868b7915c016bb9cd69fcc1243e6330a423f5f6801849c023d834e2bfdcdef

Download Submit
C:\Windows\System\XcSOTww.exe

Filesize
2.9MB

MD5
c0b8f965636407a6aa158a7552eb1524

SHA1
6121cb47c654a340ee26c1e237acc132a8680c99

SHA256
7f4d9bdc107b89c921d8c30cb8c2dc202db9141588e7b1b50c44000eb3522a11

SHA512
de16d8b905823225905c24456a763c0c1e8f320d4e190b0ecff82eea8ea50041ef23b4919213354d9d2fa476a244c6692452500ddb0387c3603e34fc623e076e

Download Submit
C:\Windows\System\eQShBmt.exe

Filesize
2.9MB

MD5
b65120b1dbf878425407ce01f1b72012

SHA1
dc1c2fad4b8c823369e2e5bb73e6ff6ac8645201

SHA256
724a4a74768dc26c90511d89daee519d18c5f7d7aec119fb04170f169c7bd2c4

SHA512
3f0a25574a4f7674f7b54b04a8fc31ce17b98f273f5110bb0796abe8a0310cd24414cadd4f2429e87d4f469c7371e6e1d954df49a58beeaa340e94eaeefc8c0c

Download Submit
C:\Windows\System\hKzRFjt.exe

Filesize
2.9MB

MD5
4ae14d3fca3bb900bc4b02fbfa4db69f

SHA1
093bde9ecc2f2477e7d86827d74b9f49ca19c055

SHA256
15baf4e2c33f229c8658d058e301bb1650e15c69d87c809770ec7b312e752666

SHA512
225dcf7f827031457f0a32122034704e0c19873e6144026ff1b74ea59fc6b036b1c37091714bf6be29fa6208df83503301adea862e4d1d670687f339c7650571

Download Submit
C:\Windows\System\hXeHaQI.exe

Filesize
2.9MB

MD5
d8ea707bab1b8163e6e9a1a38d4901e0

SHA1
3927d128ff0263eafb16e386a49574c992dea614

SHA256
5e624bd18fd0cbc36f682bec0144f729c79fbf2d0a5eef365547f1c9244e99ca

SHA512
04f673686120086389e9b27bad1131d66dc96e0dcb5518a5f90aeaa693a617f16846ef51a1c6db02ffdc1c34f9962a6a952f135b86037d58087b03cd88c20af7

Download Submit
C:\Windows\System\igfdmAK.exe

Filesize
2.9MB

MD5
5e872670fef7ebe13f6a4cb497c72cc2

SHA1
16c9c8b7e33e6c24b48eb8ed797eb9755833427d

SHA256
f057e003f789f206fa6955821eda3ac9ef60181fd78f6ed66f0aef21204ad923

SHA512
d11e5f7d630e1e2c59e0906402d76ecf200df1079ef580482a3768274762516f585d75edeb310e5e191ce5dd25968c29594934c16a4184882dc33a17324e239a

Download Submit
C:\Windows\System\irFoarm.exe

Filesize
2.9MB

MD5
49916638ba348c52943cc37fce05b334

SHA1
bbfa1701a4c05bbb4b5c5561e1d8add1c2a9f6fa

SHA256
0a9a8b128d7035ec37dfc2e194727a07fa3b40052b7b9f8c3a76b8e29c56fbe5

SHA512
9fbfb807c0fdb404cd969b5abf05c413b1fa0e46d76b3fbfbbcbb15c4f3cddf959def66428d1d2106ac3f395a9cf637387d4b55a6a7c99a016d965f3ed5b55fb

Download Submit
C:\Windows\System\jaoPVwM.exe

Filesize
2.9MB

MD5
6b116372b16a1c38cf322a9b7291ddfc

SHA1
65a011d7a93a2057b9a3c16cdebba5a52b0ee9df

SHA256
f44f9899ce0f333e4b35b641f058e1375eb0d2a8c1c7cd2755f13ec880c5cc14

SHA512
889150573a6012210baf46326fed71179c4c9b555ab6369b38ba267dceac3218301adc51d3aa36c8e02f8be4b6bb5c21fc691f926b189cd8eb2edfe468375213

Download Submit
C:\Windows\System\jefJoAR.exe

Filesize
2.9MB

MD5
95f89a3f26d19d60af4f7b2513ec696c

SHA1
3b24ba9c56018252939862193ed16ed3e3104fe4

SHA256
694dc97bc1f493a00c63c3b0cab5178a5f78d7fe0982a3ee644b5ba4035c8678

SHA512
2fd30c3db5f8cda35fb66f57918ea220f92f4febea8f7c04c0630e771e2005cce287d48ba32ff8bb6c6fcaceb93d8ceac13815b537b135454f0eb7e9761e4c30

Download Submit
C:\Windows\System\jvbqgYL.exe

Filesize
2.9MB

MD5
452ed851a2b493f037208c7c453611ac

SHA1
eabf3c765b5506a6cd158c02bd21f5ca8b3ef2b6

SHA256
0a4171aa74e141d34bb622d23580bae04bb4c66643e4b46ab27cad68276ece9f

SHA512
81ef4958d6961ffaf66506acecf0587fedb10dcb17247fc901d8496715da7bc3ccfca3cab3c40554b6a1fcc44726433f547b606193396a213c1f0c27e0c84047

Download Submit
C:\Windows\System\kXcimmP.exe

Filesize
2.9MB

MD5
164946dcbf472ea6be33f7eaa9b92bdc

SHA1
768c08aafa89f62dd821d59dc298f6600c1c9d0e

SHA256
d7eff009758eb4ce34e549697453221b4786d19807736af909cd072fe0b56dd1

SHA512
36a6be563dbb6890ae62c97cd1e2573f869e0e076153ab0e370c9811ff747089d3a850ba3d424e25b697caa0e7534a985b6298a2ff516212c542c11724f0447f

Download Submit
C:\Windows\System\lRrBXrw.exe

Filesize
2.9MB

MD5
aa5ed65742a70175a24dc70ded7d3f9d

SHA1
688aa95020bca7c12231646236c344a4af313187

SHA256
e50e5691735bbcd2d6d531c3a57e7c20cb149025b7a912fbea5b1facc849276d

SHA512
3643a1725f7161e29d489ecd58735337a905b5d00f19b91b4c5ebbba9115216345ecc768620492de836eecb6ef9bd4aa8cbf3c8f325bc69b55d2ace5aa74598e

Download Submit
C:\Windows\System\pLpGEWJ.exe

Filesize
2.9MB

MD5
908baf38705acda8f046bae86fcb8928

SHA1
96720cf0c05f20beed72b8185f3c6f9f26f4bc01

SHA256
66dc7cd65287dc803adeccc67dcb4556f57ecc80b7161717fd48c902ecdb136b

SHA512
61ef3129e6daf74868ca01064b0f2267197e613b8d3f7f4022bda3d9db5298a258e219ffe05604d20096966101ca84c1e983c30d05870b8f46fe5788d36d3515

Download Submit
C:\Windows\System\qJbUWMb.exe

Filesize
2.9MB

MD5
2843bd0150c0cdc525654b25539b3d33

SHA1
90a09a23ed32d3a190256be0a59e6f3b83621607

SHA256
be0d1538589a42d4c03ae5deddd504a04a01c1beb07cb438fa85d6204c28325e

SHA512
8e82019b59ef80bfa6a325f6c26cc32e82ada252ba82a5daa954b207f0f860cca6fcc7dd17b73f3983dad319af30154fb54aea97fdf7ee9df6ab4532ac9147fa

Download Submit
C:\Windows\System\qVyJyTm.exe

Filesize
2.9MB

MD5
1f63538aa7056476427ea0292469d1c3

SHA1
180dd0edd4654a64006cfbef58790f91d7afd916

SHA256
2453c343b965a3a9aadc195e0ceb64c41b22d1d15880c6f8164e0f0ae0f8e470

SHA512
e312f40fcfb45d4e5b711e9669443c12b211d79f3f1e2e12d48419e3e3e4239dc9dc9b99588437386c6dba1c766aa381023ca726191c99776ab4ebcdf5557e71

Download Submit
C:\Windows\System\tcxMSOb.exe

Filesize
2.9MB

MD5
42ed9bb760e7d1c5b43d474b14b1fdb8

SHA1
9443e87cd927c75280fabc848d2046dbd5588679

SHA256
5d8018f969df196a033d54eca7ef6b73fad5ab6efefce62a91032d82794c79ed

SHA512
88af5e75a048ebc0ea4d5f8309bab71e6475753a3ce32286ee5af205c552de794d5a9bbc9d3c47ab51aec90308041e3c49ecb4370d77b83db59d746f82851a27

Download Submit
C:\Windows\System\vDqhfPo.exe

Filesize
2.9MB

MD5
e2c8c1cab529ce2a4f6eaf4717a5bce0

SHA1
abf85fc73779bb72efc49252fa0926c81255ee74

SHA256
e51e13cb4bb0ff8e53a7e0273a6a2ce7d3eaff313a895a7235f99bcc1df51af5

SHA512
d465da92d00f5ebdaee55ddee2043697c50a2d7793b75a9124deff7e901dd32f591ebb765658769a56a5b0e6679152d9829c051a714477760b3986edc931654a

Download Submit
C:\Windows\System\vGTbAlC.exe

Filesize
2.9MB

MD5
ae58de2a658df15f549bdf36a31d0519

SHA1
8e8d5d96df0913e5e3665bc896d059af89febb9d

SHA256
f1cc3198f73171a443f4eab52c38c7b1071aaa0e6404aa29dca4122af8c09010

SHA512
fa1644fb6004757e6a5d7edd9e300147a940381a2e97640bf2babf2502367b23db0a528e3bbac5fb87abf41d9c2e6ef84cbe926c5b60f629fe183a5a6d540363

Download Submit
C:\Windows\System\yNddAdn.exe

Filesize
2.9MB

MD5
cd13c159394c7feec24f5a49dcf9af88

SHA1
e054308aafcdc8cdbdc61acc1c4c0d7aa2ed2c5e

SHA256
92780121ce8bc22bd107575f75b4affbe3ea9c21849bbc13c476cb6f961ed348

SHA512
60826b350477f7cbfc95b5eaf889f2b4cfe02ee78ff07c849a99742f5b6fbfab0bba1c1b90d4163fe35902dd580aa3b599b742cae0793c373c51be0f966c663c

Download Submit
C:\Windows\System\yiYuzaL.exe

Filesize
2.9MB

MD5
a2c89e25ba089e51b8dbd6b8d92d25ca

SHA1
b28313e8775dbc233f1b38580840f0ac698bce2c

SHA256
5f8e93a1995efcb8c2ee39115533b0a7a9dc4c5e3460140929cdd25a8f298090

SHA512
815f7ac384a3fcc7338872f4d30439f9e84835d03c69f2d0a5d0f6002a3eb9c56564a388a594eedf53554d77738599ec9c7ed4623074fe491090fc4b0af98034

Download Submit
C:\Windows\System\zGRvdhn.exe

Filesize
2.9MB

MD5
1a3e4b8e32d2a4914b1067a48d1acb49

SHA1
e00a8f761277bec937745f936db24091f7038e58

SHA256
154833c78a247229c775538bb8fe81b9a673aa1ea4c754a2e84d3ebe4c853fca

SHA512
53f9ce2b4dab20a072bf78efb8a2899a5a1734ceebbed8b23547b0a36d82022468bd55589ae4eb8c582e40dc6fdea830611b06ab748f6a6915d6088f5b2df209

Download Submit
memory/228-77-0x00007FF602620000-0x00007FF602A16000-memory.dmp

Filesize
4.0MB

Download
memory/228-2195-0x00007FF602620000-0x00007FF602A16000-memory.dmp

Filesize
4.0MB

Download
memory/648-104-0x00007FF757D60000-0x00007FF758156000-memory.dmp

Filesize
4.0MB

Download
memory/648-2200-0x00007FF757D60000-0x00007FF758156000-memory.dmp

Filesize
4.0MB

Download
memory/812-2203-0x00007FF684B20000-0x00007FF684F16000-memory.dmp

Filesize
4.0MB

Download
memory/812-116-0x00007FF684B20000-0x00007FF684F16000-memory.dmp

Filesize
4.0MB

Download
memory/1240-188-0x00007FF7FE940000-0x00007FF7FED36000-memory.dmp

Filesize
4.0MB

Download
memory/1240-2210-0x00007FF7FE940000-0x00007FF7FED36000-memory.dmp

Filesize
4.0MB

Download
memory/1604-2201-0x00007FF73F4D0000-0x00007FF73F8C6000-memory.dmp

Filesize
4.0MB

Download
memory/1604-115-0x00007FF73F4D0000-0x00007FF73F8C6000-memory.dmp

Filesize
4.0MB

Download
memory/1840-117-0x000002B34B290000-0x000002B34BA36000-memory.dmp

Filesize
7.6MB

Download
memory/1840-1354-0x00007FFE6E7A0000-0x00007FFE6F261000-memory.dmp

Filesize
10.8MB

Download
memory/1840-5-0x00007FFE6E7A3000-0x00007FFE6E7A5000-memory.dmp

Filesize
8KB

Download
memory/1840-1346-0x00007FFE6E7A3000-0x00007FFE6E7A5000-memory.dmp

Filesize
8KB

Download
memory/1840-11-0x000002B34A620000-0x000002B34A642000-memory.dmp

Filesize
136KB

Download
memory/1840-27-0x00007FFE6E7A0000-0x00007FFE6F261000-memory.dmp

Filesize
10.8MB

Download
memory/1840-46-0x00007FFE6E7A0000-0x00007FFE6F261000-memory.dmp

Filesize
10.8MB

Download
memory/2724-2202-0x00007FF62BEE0000-0x00007FF62C2D6000-memory.dmp

Filesize
4.0MB

Download
memory/2724-114-0x00007FF62BEE0000-0x00007FF62C2D6000-memory.dmp

Filesize
4.0MB

Download
memory/3004-71-0x00007FF6FFF40000-0x00007FF700336000-memory.dmp

Filesize
4.0MB

Download
memory/3004-2196-0x00007FF6FFF40000-0x00007FF700336000-memory.dmp

Filesize
4.0MB

Download
memory/3348-2189-0x00007FF7E79C0000-0x00007FF7E7DB6000-memory.dmp

Filesize
4.0MB

Download
memory/3348-81-0x00007FF7E79C0000-0x00007FF7E7DB6000-memory.dmp

Filesize
4.0MB

Download
memory/3384-2198-0x00007FF752940000-0x00007FF752D36000-memory.dmp

Filesize
4.0MB

Download
memory/3384-105-0x00007FF752940000-0x00007FF752D36000-memory.dmp

Filesize
4.0MB

Download
memory/3656-2199-0x00007FF72BF00000-0x00007FF72C2F6000-memory.dmp

Filesize
4.0MB

Download
memory/3656-80-0x00007FF72BF00000-0x00007FF72C2F6000-memory.dmp

Filesize
4.0MB

Download
memory/3788-2186-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp

Filesize
4.0MB

Download
memory/3788-125-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp

Filesize
4.0MB

Download
memory/3788-2206-0x00007FF7E9990000-0x00007FF7E9D86000-memory.dmp

Filesize
4.0MB

Download
memory/3804-2188-0x00007FF787E70000-0x00007FF788266000-memory.dmp

Filesize
4.0MB

Download
memory/3804-2211-0x00007FF787E70000-0x00007FF788266000-memory.dmp

Filesize
4.0MB

Download
memory/3804-159-0x00007FF787E70000-0x00007FF788266000-memory.dmp

Filesize
4.0MB

Download
memory/3880-2193-0x00007FF75D9D0000-0x00007FF75DDC6000-memory.dmp

Filesize
4.0MB

Download
memory/3880-68-0x00007FF75D9D0000-0x00007FF75DDC6000-memory.dmp

Filesize
4.0MB

Download
memory/3892-108-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp

Filesize
4.0MB

Download
memory/3892-1996-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp

Filesize
4.0MB

Download
memory/3892-2205-0x00007FF69FF30000-0x00007FF6A0326000-memory.dmp

Filesize
4.0MB

Download
memory/4092-2194-0x00007FF77C820000-0x00007FF77CC16000-memory.dmp

Filesize
4.0MB

Download
memory/4092-89-0x00007FF77C820000-0x00007FF77CC16000-memory.dmp

Filesize
4.0MB

Download
memory/4352-2191-0x00007FF6DB430000-0x00007FF6DB826000-memory.dmp

Filesize
4.0MB

Download
memory/4352-52-0x00007FF6DB430000-0x00007FF6DB826000-memory.dmp

Filesize
4.0MB

Download
memory/4492-2212-0x00007FF6E5BC0000-0x00007FF6E5FB6000-memory.dmp

Filesize
4.0MB

Download
memory/4492-200-0x00007FF6E5BC0000-0x00007FF6E5FB6000-memory.dmp

Filesize
4.0MB

Download
memory/4632-86-0x00007FF7CC170000-0x00007FF7CC566000-memory.dmp

Filesize
4.0MB

Download
memory/4632-2192-0x00007FF7CC170000-0x00007FF7CC566000-memory.dmp

Filesize
4.0MB

Download
memory/4668-56-0x00007FF6AB190000-0x00007FF6AB586000-memory.dmp

Filesize
4.0MB

Download
memory/4668-2190-0x00007FF6AB190000-0x00007FF6AB586000-memory.dmp

Filesize
4.0MB

Download
memory/4888-149-0x00007FF6456F0000-0x00007FF645AE6000-memory.dmp

Filesize
4.0MB

Download
memory/4888-2208-0x00007FF6456F0000-0x00007FF645AE6000-memory.dmp

Filesize
4.0MB

Download
memory/4900-786-0x00007FF6E23A0000-0x00007FF6E2796000-memory.dmp

Filesize
4.0MB

Download
memory/4900-1-0x0000017AC5820000-0x0000017AC5830000-memory.dmp

Filesize
64KB

Download
memory/4900-0-0x00007FF6E23A0000-0x00007FF6E2796000-memory.dmp

Filesize
4.0MB

Download
memory/4916-2207-0x00007FF7A98D0000-0x00007FF7A9CC6000-memory.dmp

Filesize
4.0MB

Download
memory/4916-139-0x00007FF7A98D0000-0x00007FF7A9CC6000-memory.dmp

Filesize
4.0MB

Download
memory/5068-2197-0x00007FF6BA3B0000-0x00007FF6BA7A6000-memory.dmp

Filesize
4.0MB

Download
memory/5068-98-0x00007FF6BA3B0000-0x00007FF6BA7A6000-memory.dmp

Filesize
4.0MB

Download
memory/5108-2209-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp

Filesize
4.0MB

Download
memory/5108-2187-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp

Filesize
4.0MB

Download
memory/5108-144-0x00007FF67B970000-0x00007FF67BD66000-memory.dmp

Filesize
4.0MB

Download
memory/5116-113-0x00007FF6EE9E0000-0x00007FF6EEDD6000-memory.dmp

Filesize
4.0MB

Download
memory/5116-2204-0x00007FF6EE9E0000-0x00007FF6EEDD6000-memory.dmp

Filesize
4.0MB

Download