xmrig | 5430c682bd7e1d634299faf01798f189e72ee052f001efa647a00f83724aca71

Analysis

max time kernel
120s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
Size

3.2MB
MD5

1a74ee13665a6a057671fe8eebda1ed0
SHA1

23000d12bd76c38161086ade25238a840b0763e2
SHA256

5430c682bd7e1d634299faf01798f189e72ee052f001efa647a00f83724aca71
SHA512

2456853c7d31bd61fa0a0e279ebb74db5dc9aab4af7158bc76ea712363356729d1f95a2b97d7f6fc6b0d4507ecefad0d75747a8fe26a421b9d5424ed7e136a30
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFkl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2596-0-0x00007FF7333E0000-0x00007FF7337D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002336e-6.dat	xmrig
behavioral2/files/0x00080000000234ee-9.dat	xmrig
behavioral2/files/0x000a0000000234eb-27.dat	xmrig
behavioral2/files/0x00080000000234f0-34.dat	xmrig
behavioral2/files/0x00080000000234ef-48.dat	xmrig
behavioral2/files/0x00070000000234f3-56.dat	xmrig
behavioral2/files/0x00070000000234f4-66.dat	xmrig
behavioral2/files/0x00070000000234f6-75.dat	xmrig
behavioral2/files/0x00070000000234f9-87.dat	xmrig
behavioral2/memory/4796-96-0x00007FF6E2D00000-0x00007FF6E30F6000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fb-100.dat	xmrig
behavioral2/memory/1084-105-0x00007FF679EB0000-0x00007FF67A2A6000-memory.dmp	xmrig
behavioral2/memory/2968-108-0x00007FF68E770000-0x00007FF68EB66000-memory.dmp	xmrig
behavioral2/memory/1680-110-0x00007FF67C030000-0x00007FF67C426000-memory.dmp	xmrig
behavioral2/memory/2244-109-0x00007FF78E170000-0x00007FF78E566000-memory.dmp	xmrig
behavioral2/memory/912-107-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp	xmrig
behavioral2/memory/4316-106-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	xmrig
behavioral2/memory/5056-104-0x00007FF6F45A0000-0x00007FF6F4996000-memory.dmp	xmrig
behavioral2/memory/3624-103-0x00007FF78CA80000-0x00007FF78CE76000-memory.dmp	xmrig
behavioral2/memory/4284-99-0x00007FF697B20000-0x00007FF697F16000-memory.dmp	xmrig
behavioral2/memory/4612-98-0x00007FF7B78A0000-0x00007FF7B7C96000-memory.dmp	xmrig
behavioral2/files/0x00070000000234fa-97.dat	xmrig
behavioral2/memory/2436-95-0x00007FF781170000-0x00007FF781566000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f8-85.dat	xmrig
behavioral2/files/0x00070000000234f7-81.dat	xmrig
behavioral2/files/0x00070000000234f5-71.dat	xmrig
behavioral2/memory/4064-61-0x00007FF64A3B0000-0x00007FF64A7A6000-memory.dmp	xmrig
behavioral2/memory/1016-54-0x00007FF621530000-0x00007FF621926000-memory.dmp	xmrig
behavioral2/memory/2604-53-0x00007FF7C7AA0000-0x00007FF7C7E96000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f2-49.dat	xmrig
behavioral2/memory/936-46-0x00007FF6E35A0000-0x00007FF6E3996000-memory.dmp	xmrig
behavioral2/files/0x00070000000234f1-36.dat	xmrig
behavioral2/files/0x00070000000234fc-197.dat	xmrig
behavioral2/files/0x0007000000023518-209.dat	xmrig
behavioral2/files/0x000700000002351b-218.dat	xmrig
behavioral2/files/0x000700000002351c-220.dat	xmrig
behavioral2/files/0x000700000002351e-235.dat	xmrig
behavioral2/files/0x0007000000023520-249.dat	xmrig
behavioral2/files/0x0007000000023523-254.dat	xmrig
behavioral2/memory/3100-228-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp	xmrig
behavioral2/memory/3024-227-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp	xmrig
behavioral2/memory/4236-215-0x00007FF6509E0000-0x00007FF650DD6000-memory.dmp	xmrig
behavioral2/memory/1508-211-0x00007FF62FFB0000-0x00007FF6303A6000-memory.dmp	xmrig
behavioral2/memory/3012-349-0x00007FF726460000-0x00007FF726856000-memory.dmp	xmrig
behavioral2/files/0x0007000000023524-353.dat	xmrig
behavioral2/memory/224-350-0x00007FF7E9EF0000-0x00007FF7EA2E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023549-356.dat	xmrig
behavioral2/memory/3212-367-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp	xmrig
behavioral2/files/0x000700000002354a-382.dat	xmrig
behavioral2/files/0x0007000000023551-385.dat	xmrig
behavioral2/files/0x0007000000023553-393.dat	xmrig
behavioral2/files/0x0007000000023556-395.dat	xmrig
behavioral2/files/0x0007000000023552-394.dat	xmrig
behavioral2/files/0x000700000002354e-389.dat	xmrig
behavioral2/files/0x000700000002354d-378.dat	xmrig
behavioral2/memory/5092-359-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp	xmrig
behavioral2/memory/2596-765-0x00007FF7333E0000-0x00007FF7337D6000-memory.dmp	xmrig
behavioral2/memory/3024-1929-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp	xmrig
behavioral2/memory/3100-2217-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp	xmrig
behavioral2/memory/3012-2218-0x00007FF726460000-0x00007FF726856000-memory.dmp	xmrig
behavioral2/memory/3212-2219-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp	xmrig
behavioral2/memory/4316-2220-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	xmrig
behavioral2/memory/2604-2221-0x00007FF7C7AA0000-0x00007FF7C7E96000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	468	powershell.exe
5	468	powershell.exe
7	468	powershell.exe
8	468	powershell.exe
10	468	powershell.exe
15	468	powershell.exe
16	468	powershell.exe
19	468	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
468	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4316	rnecneP.exe
936	StnrXHG.exe
2604	KNGnvrl.exe
912	vWmIMOH.exe
1016	lzwzpCh.exe
4064	dCOtYnj.exe
2968	UAIUUxN.exe
2436	rPxIOaJ.exe
2244	OCdrtNm.exe
1680	UYBDiwm.exe
4796	ScqwJoW.exe
4612	GPQOZQH.exe
4284	MalbFNA.exe
3624	GBrDHLR.exe
5056	eHejGnP.exe
1084	YZaNVIB.exe
1508	hUHmtyO.exe
4236	ZLMgRcd.exe
3024	jzuuDWV.exe
3100	FJAiGHA.exe
3012	ORxTgFG.exe
5092	gqHvwBf.exe
224	ArBmewj.exe
3212	LJlkHjb.exe
4836	fphwmLu.exe
3192	yNtXCOp.exe
3408	VCXmXRG.exe
4900	fdHYBJk.exe
4804	VBtOlZs.exe
2872	usXXxxS.exe
2292	MpjjnOr.exe
4560	yczDdFs.exe
4884	KnwaRrP.exe
1480	mouocWK.exe
868	NGqfqFw.exe
4792	PWhkVEp.exe
660	slmwDHZ.exe
640	kEUhKFp.exe
344	MlfENyj.exe
2788	oDHsjJK.exe
2004	RRgtaLi.exe
228	mDmGOQf.exe
1776	fNvhyjP.exe
3000	SDxIYnC.exe
2996	VDEfmZH.exe
3380	HkKioJf.exe
4216	hVHUjyn.exe
4872	VuKLLgB.exe
3632	KGtFOno.exe
2740	rvQzRMS.exe
3468	ClVZNmE.exe
1452	QQfYyOZ.exe
3460	YHCNaFY.exe
5000	VWQTAUL.exe
1820	tuePnfZ.exe
4964	XRhibJE.exe
2704	hfJdCUc.exe
3320	LHRyUIb.exe
3900	OnmWnuE.exe
4920	dUsGHwq.exe
4956	snLTdFs.exe
2656	DZZOPAh.exe
3736	lckQeyt.exe
4976	rRbmOhD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2596-0-0x00007FF7333E0000-0x00007FF7337D6000-memory.dmp	upx
behavioral2/files/0x000700000002336e-6.dat	upx
behavioral2/files/0x00080000000234ee-9.dat	upx
behavioral2/files/0x000a0000000234eb-27.dat	upx
behavioral2/files/0x00080000000234f0-34.dat	upx
behavioral2/files/0x00080000000234ef-48.dat	upx
behavioral2/files/0x00070000000234f3-56.dat	upx
behavioral2/files/0x00070000000234f4-66.dat	upx
behavioral2/files/0x00070000000234f6-75.dat	upx
behavioral2/files/0x00070000000234f9-87.dat	upx
behavioral2/memory/4796-96-0x00007FF6E2D00000-0x00007FF6E30F6000-memory.dmp	upx
behavioral2/files/0x00070000000234fb-100.dat	upx
behavioral2/memory/1084-105-0x00007FF679EB0000-0x00007FF67A2A6000-memory.dmp	upx
behavioral2/memory/2968-108-0x00007FF68E770000-0x00007FF68EB66000-memory.dmp	upx
behavioral2/memory/1680-110-0x00007FF67C030000-0x00007FF67C426000-memory.dmp	upx
behavioral2/memory/2244-109-0x00007FF78E170000-0x00007FF78E566000-memory.dmp	upx
behavioral2/memory/912-107-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp	upx
behavioral2/memory/4316-106-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	upx
behavioral2/memory/5056-104-0x00007FF6F45A0000-0x00007FF6F4996000-memory.dmp	upx
behavioral2/memory/3624-103-0x00007FF78CA80000-0x00007FF78CE76000-memory.dmp	upx
behavioral2/memory/4284-99-0x00007FF697B20000-0x00007FF697F16000-memory.dmp	upx
behavioral2/memory/4612-98-0x00007FF7B78A0000-0x00007FF7B7C96000-memory.dmp	upx
behavioral2/files/0x00070000000234fa-97.dat	upx
behavioral2/memory/2436-95-0x00007FF781170000-0x00007FF781566000-memory.dmp	upx
behavioral2/files/0x00070000000234f8-85.dat	upx
behavioral2/files/0x00070000000234f7-81.dat	upx
behavioral2/files/0x00070000000234f5-71.dat	upx
behavioral2/memory/4064-61-0x00007FF64A3B0000-0x00007FF64A7A6000-memory.dmp	upx
behavioral2/memory/1016-54-0x00007FF621530000-0x00007FF621926000-memory.dmp	upx
behavioral2/memory/2604-53-0x00007FF7C7AA0000-0x00007FF7C7E96000-memory.dmp	upx
behavioral2/files/0x00070000000234f2-49.dat	upx
behavioral2/memory/936-46-0x00007FF6E35A0000-0x00007FF6E3996000-memory.dmp	upx
behavioral2/files/0x00070000000234f1-36.dat	upx
behavioral2/files/0x00070000000234fc-197.dat	upx
behavioral2/files/0x0007000000023518-209.dat	upx
behavioral2/files/0x000700000002351b-218.dat	upx
behavioral2/files/0x000700000002351c-220.dat	upx
behavioral2/files/0x000700000002351e-235.dat	upx
behavioral2/files/0x0007000000023520-249.dat	upx
behavioral2/files/0x0007000000023523-254.dat	upx
behavioral2/memory/3100-228-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp	upx
behavioral2/memory/3024-227-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp	upx
behavioral2/memory/4236-215-0x00007FF6509E0000-0x00007FF650DD6000-memory.dmp	upx
behavioral2/memory/1508-211-0x00007FF62FFB0000-0x00007FF6303A6000-memory.dmp	upx
behavioral2/memory/3012-349-0x00007FF726460000-0x00007FF726856000-memory.dmp	upx
behavioral2/files/0x0007000000023524-353.dat	upx
behavioral2/memory/224-350-0x00007FF7E9EF0000-0x00007FF7EA2E6000-memory.dmp	upx
behavioral2/files/0x0007000000023549-356.dat	upx
behavioral2/memory/3212-367-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp	upx
behavioral2/files/0x000700000002354a-382.dat	upx
behavioral2/files/0x0007000000023551-385.dat	upx
behavioral2/files/0x0007000000023553-393.dat	upx
behavioral2/files/0x0007000000023556-395.dat	upx
behavioral2/files/0x0007000000023552-394.dat	upx
behavioral2/files/0x000700000002354e-389.dat	upx
behavioral2/files/0x000700000002354d-378.dat	upx
behavioral2/memory/5092-359-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp	upx
behavioral2/memory/2596-765-0x00007FF7333E0000-0x00007FF7337D6000-memory.dmp	upx
behavioral2/memory/3024-1929-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp	upx
behavioral2/memory/3100-2217-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp	upx
behavioral2/memory/3012-2218-0x00007FF726460000-0x00007FF726856000-memory.dmp	upx
behavioral2/memory/3212-2219-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp	upx
behavioral2/memory/4316-2220-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	upx
behavioral2/memory/2604-2221-0x00007FF7C7AA0000-0x00007FF7C7E96000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aPAhwsu.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ShAAOaI.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ttxsflg.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\DxfodsW.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\vYUBTNP.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\yfEizYt.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\vwsFDTt.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\notnudq.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\kgpwNkp.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\StLgUQV.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\UUgwsao.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\RHObzvp.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\zDyXTtd.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gRPIeMC.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\eossNHA.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\WVGFNpo.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\jSBVBXq.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\cFxRjJx.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\MfBxlsQ.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gpBfKWB.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\HEBXRwT.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gLMmETn.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\uvNSNtq.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\XroaVxy.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\NDXNrbq.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\LLdanXF.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\slvXvaC.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\mKQoQIk.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\GZOhZYx.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\FftsQIW.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gZZslQb.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\xTFyqRA.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\vPJgkRD.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\tWUJTWk.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\bXZBftT.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\cvMYDem.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\amMWYEA.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\lyofnTw.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\RLhtmna.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\VtwbSIh.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\IpVLBGk.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\QRKLyMX.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ZLMgRcd.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\xwCHfYs.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\NigCcyQ.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ibdSKiy.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\lckQeyt.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\DqDrnxo.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gUKBxBk.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\AYKCAES.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\gelGqdd.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\KGtFOno.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\hakLdei.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\hnUprxg.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\GBrDHLR.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\qsIYuUm.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\WdzaZif.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\OOXLMWP.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\ASSWJgB.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\RHPHoDI.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\fphwmLu.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\tuePnfZ.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\WpKsPfl.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
File created	C:\Windows\System\VGdBOZA.exe	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	powershell.exe
468	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeLockMemoryPrivilege	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 468	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	81
PID 2596 wrote to memory of 468	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	81
PID 2596 wrote to memory of 4316	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	82
PID 2596 wrote to memory of 4316	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	82
PID 2596 wrote to memory of 936	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	83
PID 2596 wrote to memory of 936	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	83
PID 2596 wrote to memory of 2604	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	84
PID 2596 wrote to memory of 2604	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	84
PID 2596 wrote to memory of 912	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	85
PID 2596 wrote to memory of 912	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	85
PID 2596 wrote to memory of 1016	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	86
PID 2596 wrote to memory of 1016	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	86
PID 2596 wrote to memory of 4064	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	87
PID 2596 wrote to memory of 4064	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	87
PID 2596 wrote to memory of 2968	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	88
PID 2596 wrote to memory of 2968	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	88
PID 2596 wrote to memory of 2436	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	89
PID 2596 wrote to memory of 2436	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	89
PID 2596 wrote to memory of 2244	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	90
PID 2596 wrote to memory of 2244	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	90
PID 2596 wrote to memory of 1680	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	91
PID 2596 wrote to memory of 1680	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	91
PID 2596 wrote to memory of 4796	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	92
PID 2596 wrote to memory of 4796	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	92
PID 2596 wrote to memory of 4612	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	93
PID 2596 wrote to memory of 4612	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	93
PID 2596 wrote to memory of 4284	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	94
PID 2596 wrote to memory of 4284	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	94
PID 2596 wrote to memory of 3624	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	95
PID 2596 wrote to memory of 3624	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	95
PID 2596 wrote to memory of 5056	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	96
PID 2596 wrote to memory of 5056	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	96
PID 2596 wrote to memory of 1084	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	97
PID 2596 wrote to memory of 1084	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	97
PID 2596 wrote to memory of 1508	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	99
PID 2596 wrote to memory of 1508	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	99
PID 2596 wrote to memory of 4236	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	101
PID 2596 wrote to memory of 4236	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	101
PID 2596 wrote to memory of 3024	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	102
PID 2596 wrote to memory of 3024	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	102
PID 2596 wrote to memory of 3100	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	103
PID 2596 wrote to memory of 3100	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	103
PID 2596 wrote to memory of 3012	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	104
PID 2596 wrote to memory of 3012	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	104
PID 2596 wrote to memory of 5092	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	105
PID 2596 wrote to memory of 5092	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	105
PID 2596 wrote to memory of 224	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	106
PID 2596 wrote to memory of 224	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	106
PID 2596 wrote to memory of 3212	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	107
PID 2596 wrote to memory of 3212	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	107
PID 2596 wrote to memory of 4836	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	108
PID 2596 wrote to memory of 4836	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	108
PID 2596 wrote to memory of 3192	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	109
PID 2596 wrote to memory of 3192	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	109
PID 2596 wrote to memory of 3408	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	110
PID 2596 wrote to memory of 3408	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	110
PID 2596 wrote to memory of 4900	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	111
PID 2596 wrote to memory of 4900	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	111
PID 2596 wrote to memory of 4804	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	112
PID 2596 wrote to memory of 4804	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	112
PID 2596 wrote to memory of 2872	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	113
PID 2596 wrote to memory of 2872	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	113
PID 2596 wrote to memory of 2292	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	114
PID 2596 wrote to memory of 2292	2596	1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1a74ee13665a6a057671fe8eebda1ed0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\System\rnecneP.exe
  C:\Windows\System\rnecneP.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\StnrXHG.exe
  C:\Windows\System\StnrXHG.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\KNGnvrl.exe
  C:\Windows\System\KNGnvrl.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\vWmIMOH.exe
  C:\Windows\System\vWmIMOH.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\lzwzpCh.exe
  C:\Windows\System\lzwzpCh.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\dCOtYnj.exe
  C:\Windows\System\dCOtYnj.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\UAIUUxN.exe
  C:\Windows\System\UAIUUxN.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\rPxIOaJ.exe
  C:\Windows\System\rPxIOaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\OCdrtNm.exe
  C:\Windows\System\OCdrtNm.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UYBDiwm.exe
  C:\Windows\System\UYBDiwm.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ScqwJoW.exe
  C:\Windows\System\ScqwJoW.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\GPQOZQH.exe
  C:\Windows\System\GPQOZQH.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\MalbFNA.exe
  C:\Windows\System\MalbFNA.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\GBrDHLR.exe
  C:\Windows\System\GBrDHLR.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\eHejGnP.exe
  C:\Windows\System\eHejGnP.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\YZaNVIB.exe
  C:\Windows\System\YZaNVIB.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\hUHmtyO.exe
  C:\Windows\System\hUHmtyO.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ZLMgRcd.exe
  C:\Windows\System\ZLMgRcd.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\jzuuDWV.exe
  C:\Windows\System\jzuuDWV.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\FJAiGHA.exe
  C:\Windows\System\FJAiGHA.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\ORxTgFG.exe
  C:\Windows\System\ORxTgFG.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\gqHvwBf.exe
  C:\Windows\System\gqHvwBf.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\ArBmewj.exe
  C:\Windows\System\ArBmewj.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\LJlkHjb.exe
  C:\Windows\System\LJlkHjb.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\fphwmLu.exe
  C:\Windows\System\fphwmLu.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\yNtXCOp.exe
  C:\Windows\System\yNtXCOp.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\VCXmXRG.exe
  C:\Windows\System\VCXmXRG.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\fdHYBJk.exe
  C:\Windows\System\fdHYBJk.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\VBtOlZs.exe
  C:\Windows\System\VBtOlZs.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\usXXxxS.exe
  C:\Windows\System\usXXxxS.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\MpjjnOr.exe
  C:\Windows\System\MpjjnOr.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\yczDdFs.exe
  C:\Windows\System\yczDdFs.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\KnwaRrP.exe
  C:\Windows\System\KnwaRrP.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\mouocWK.exe
  C:\Windows\System\mouocWK.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\NGqfqFw.exe
  C:\Windows\System\NGqfqFw.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\PWhkVEp.exe
  C:\Windows\System\PWhkVEp.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\slmwDHZ.exe
  C:\Windows\System\slmwDHZ.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\kEUhKFp.exe
  C:\Windows\System\kEUhKFp.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\MlfENyj.exe
  C:\Windows\System\MlfENyj.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\oDHsjJK.exe
  C:\Windows\System\oDHsjJK.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\RRgtaLi.exe
  C:\Windows\System\RRgtaLi.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\mDmGOQf.exe
  C:\Windows\System\mDmGOQf.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\fNvhyjP.exe
  C:\Windows\System\fNvhyjP.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\SDxIYnC.exe
  C:\Windows\System\SDxIYnC.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VDEfmZH.exe
  C:\Windows\System\VDEfmZH.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\HkKioJf.exe
  C:\Windows\System\HkKioJf.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\hVHUjyn.exe
  C:\Windows\System\hVHUjyn.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\VuKLLgB.exe
  C:\Windows\System\VuKLLgB.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\KGtFOno.exe
  C:\Windows\System\KGtFOno.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\rvQzRMS.exe
  C:\Windows\System\rvQzRMS.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ClVZNmE.exe
  C:\Windows\System\ClVZNmE.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\QQfYyOZ.exe
  C:\Windows\System\QQfYyOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\YHCNaFY.exe
  C:\Windows\System\YHCNaFY.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\VWQTAUL.exe
  C:\Windows\System\VWQTAUL.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\tuePnfZ.exe
  C:\Windows\System\tuePnfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\XRhibJE.exe
  C:\Windows\System\XRhibJE.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\hfJdCUc.exe
  C:\Windows\System\hfJdCUc.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\LHRyUIb.exe
  C:\Windows\System\LHRyUIb.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\OnmWnuE.exe
  C:\Windows\System\OnmWnuE.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\dUsGHwq.exe
  C:\Windows\System\dUsGHwq.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\snLTdFs.exe
  C:\Windows\System\snLTdFs.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\DZZOPAh.exe
  C:\Windows\System\DZZOPAh.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\lckQeyt.exe
  C:\Windows\System\lckQeyt.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\rRbmOhD.exe
  C:\Windows\System\rRbmOhD.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\OTcPtqE.exe
  C:\Windows\System\OTcPtqE.exe
  2⤵
  PID:1672
- C:\Windows\System\rZFqPac.exe
  C:\Windows\System\rZFqPac.exe
  2⤵
  PID:744
- C:\Windows\System\usbEnUc.exe
  C:\Windows\System\usbEnUc.exe
  2⤵
  PID:4732
- C:\Windows\System\YjlHXxI.exe
  C:\Windows\System\YjlHXxI.exe
  2⤵
  PID:3224
- C:\Windows\System\jMsVbcu.exe
  C:\Windows\System\jMsVbcu.exe
  2⤵
  PID:2000
- C:\Windows\System\EymPptz.exe
  C:\Windows\System\EymPptz.exe
  2⤵
  PID:1492
- C:\Windows\System\BkioqYx.exe
  C:\Windows\System\BkioqYx.exe
  2⤵
  PID:1104
- C:\Windows\System\hakLdei.exe
  C:\Windows\System\hakLdei.exe
  2⤵
  PID:956
- C:\Windows\System\rRxRenP.exe
  C:\Windows\System\rRxRenP.exe
  2⤵
  PID:3780
- C:\Windows\System\rJevBhD.exe
  C:\Windows\System\rJevBhD.exe
  2⤵
  PID:1472
- C:\Windows\System\OohRgVY.exe
  C:\Windows\System\OohRgVY.exe
  2⤵
  PID:1612
- C:\Windows\System\WpKsPfl.exe
  C:\Windows\System\WpKsPfl.exe
  2⤵
  PID:1604
- C:\Windows\System\ovhASiP.exe
  C:\Windows\System\ovhASiP.exe
  2⤵
  PID:5052
- C:\Windows\System\KFPfFRM.exe
  C:\Windows\System\KFPfFRM.exe
  2⤵
  PID:5012
- C:\Windows\System\zMjhcql.exe
  C:\Windows\System\zMjhcql.exe
  2⤵
  PID:4952
- C:\Windows\System\NrcKvao.exe
  C:\Windows\System\NrcKvao.exe
  2⤵
  PID:2972
- C:\Windows\System\DhywiVB.exe
  C:\Windows\System\DhywiVB.exe
  2⤵
  PID:1824
- C:\Windows\System\xDvJxOK.exe
  C:\Windows\System\xDvJxOK.exe
  2⤵
  PID:2512
- C:\Windows\System\UPzXgcX.exe
  C:\Windows\System\UPzXgcX.exe
  2⤵
  PID:4912
- C:\Windows\System\ShOGaHN.exe
  C:\Windows\System\ShOGaHN.exe
  2⤵
  PID:4460
- C:\Windows\System\lYedQLt.exe
  C:\Windows\System\lYedQLt.exe
  2⤵
  PID:3792
- C:\Windows\System\FDojoKC.exe
  C:\Windows\System\FDojoKC.exe
  2⤵
  PID:4632
- C:\Windows\System\YdlmwsO.exe
  C:\Windows\System\YdlmwsO.exe
  2⤵
  PID:3424
- C:\Windows\System\QYWkmsD.exe
  C:\Windows\System\QYWkmsD.exe
  2⤵
  PID:1944
- C:\Windows\System\XRbyzOm.exe
  C:\Windows\System\XRbyzOm.exe
  2⤵
  PID:3248
- C:\Windows\System\VzqJFud.exe
  C:\Windows\System\VzqJFud.exe
  2⤵
  PID:3984
- C:\Windows\System\hnUprxg.exe
  C:\Windows\System\hnUprxg.exe
  2⤵
  PID:3952
- C:\Windows\System\GRbKLFi.exe
  C:\Windows\System\GRbKLFi.exe
  2⤵
  PID:2616
- C:\Windows\System\cJngRDv.exe
  C:\Windows\System\cJngRDv.exe
  2⤵
  PID:4640
- C:\Windows\System\tSuzmsU.exe
  C:\Windows\System\tSuzmsU.exe
  2⤵
  PID:4312
- C:\Windows\System\XaGTosw.exe
  C:\Windows\System\XaGTosw.exe
  2⤵
  PID:5128
- C:\Windows\System\ZUrFtcF.exe
  C:\Windows\System\ZUrFtcF.exe
  2⤵
  PID:5168
- C:\Windows\System\XHYNEor.exe
  C:\Windows\System\XHYNEor.exe
  2⤵
  PID:5184
- C:\Windows\System\PAhZMLI.exe
  C:\Windows\System\PAhZMLI.exe
  2⤵
  PID:5224
- C:\Windows\System\FpuhuIB.exe
  C:\Windows\System\FpuhuIB.exe
  2⤵
  PID:5244
- C:\Windows\System\bzNQvbB.exe
  C:\Windows\System\bzNQvbB.exe
  2⤵
  PID:5268
- C:\Windows\System\DpqdMhs.exe
  C:\Windows\System\DpqdMhs.exe
  2⤵
  PID:5284
- C:\Windows\System\hTQfiTD.exe
  C:\Windows\System\hTQfiTD.exe
  2⤵
  PID:5336
- C:\Windows\System\amMWYEA.exe
  C:\Windows\System\amMWYEA.exe
  2⤵
  PID:5368
- C:\Windows\System\vTsgEif.exe
  C:\Windows\System\vTsgEif.exe
  2⤵
  PID:5396
- C:\Windows\System\TFDJJrz.exe
  C:\Windows\System\TFDJJrz.exe
  2⤵
  PID:5424
- C:\Windows\System\jLkFXHF.exe
  C:\Windows\System\jLkFXHF.exe
  2⤵
  PID:5456
- C:\Windows\System\VkaZMwi.exe
  C:\Windows\System\VkaZMwi.exe
  2⤵
  PID:5484
- C:\Windows\System\TDyBQJB.exe
  C:\Windows\System\TDyBQJB.exe
  2⤵
  PID:5500
- C:\Windows\System\cJetIoa.exe
  C:\Windows\System\cJetIoa.exe
  2⤵
  PID:5528
- C:\Windows\System\vPJgkRD.exe
  C:\Windows\System\vPJgkRD.exe
  2⤵
  PID:5560
- C:\Windows\System\RNNJZeP.exe
  C:\Windows\System\RNNJZeP.exe
  2⤵
  PID:5588
- C:\Windows\System\fTBXTqS.exe
  C:\Windows\System\fTBXTqS.exe
  2⤵
  PID:5628
- C:\Windows\System\KSanvMW.exe
  C:\Windows\System\KSanvMW.exe
  2⤵
  PID:5644
- C:\Windows\System\LrattPy.exe
  C:\Windows\System\LrattPy.exe
  2⤵
  PID:5676
- C:\Windows\System\TmsjrYm.exe
  C:\Windows\System\TmsjrYm.exe
  2⤵
  PID:5700
- C:\Windows\System\AcrwBvB.exe
  C:\Windows\System\AcrwBvB.exe
  2⤵
  PID:5728
- C:\Windows\System\VAHqKTs.exe
  C:\Windows\System\VAHqKTs.exe
  2⤵
  PID:5768
- C:\Windows\System\RpGMAhU.exe
  C:\Windows\System\RpGMAhU.exe
  2⤵
  PID:5796
- C:\Windows\System\mtSxLVx.exe
  C:\Windows\System\mtSxLVx.exe
  2⤵
  PID:5824
- C:\Windows\System\UhsUjoc.exe
  C:\Windows\System\UhsUjoc.exe
  2⤵
  PID:5840
- C:\Windows\System\aVeBhxp.exe
  C:\Windows\System\aVeBhxp.exe
  2⤵
  PID:5880
- C:\Windows\System\onusuLg.exe
  C:\Windows\System\onusuLg.exe
  2⤵
  PID:5908
- C:\Windows\System\oCodCaz.exe
  C:\Windows\System\oCodCaz.exe
  2⤵
  PID:5936
- C:\Windows\System\mCQqzGQ.exe
  C:\Windows\System\mCQqzGQ.exe
  2⤵
  PID:5952
- C:\Windows\System\bonWeBt.exe
  C:\Windows\System\bonWeBt.exe
  2⤵
  PID:5980
- C:\Windows\System\PpbMnVs.exe
  C:\Windows\System\PpbMnVs.exe
  2⤵
  PID:6012
- C:\Windows\System\vJkJLQU.exe
  C:\Windows\System\vJkJLQU.exe
  2⤵
  PID:6048
- C:\Windows\System\XZaztjV.exe
  C:\Windows\System\XZaztjV.exe
  2⤵
  PID:6088
- C:\Windows\System\aPAhwsu.exe
  C:\Windows\System\aPAhwsu.exe
  2⤵
  PID:6112
- C:\Windows\System\IyrYAJB.exe
  C:\Windows\System\IyrYAJB.exe
  2⤵
  PID:1056
- C:\Windows\System\KZFXsdc.exe
  C:\Windows\System\KZFXsdc.exe
  2⤵
  PID:5156
- C:\Windows\System\fbCfCJD.exe
  C:\Windows\System\fbCfCJD.exe
  2⤵
  PID:5220
- C:\Windows\System\TqEMHBC.exe
  C:\Windows\System\TqEMHBC.exe
  2⤵
  PID:5300
- C:\Windows\System\oMTZBjY.exe
  C:\Windows\System\oMTZBjY.exe
  2⤵
  PID:5364
- C:\Windows\System\AICFbEf.exe
  C:\Windows\System\AICFbEf.exe
  2⤵
  PID:5416
- C:\Windows\System\ADjgnJL.exe
  C:\Windows\System\ADjgnJL.exe
  2⤵
  PID:5496
- C:\Windows\System\xiTjuSN.exe
  C:\Windows\System\xiTjuSN.exe
  2⤵
  PID:5584
- C:\Windows\System\GkspFcW.exe
  C:\Windows\System\GkspFcW.exe
  2⤵
  PID:5624
- C:\Windows\System\ShAAOaI.exe
  C:\Windows\System\ShAAOaI.exe
  2⤵
  PID:5712
- C:\Windows\System\gTKKWYZ.exe
  C:\Windows\System\gTKKWYZ.exe
  2⤵
  PID:5764
- C:\Windows\System\zdNGNqi.exe
  C:\Windows\System\zdNGNqi.exe
  2⤵
  PID:5820
- C:\Windows\System\XVSDWJM.exe
  C:\Windows\System\XVSDWJM.exe
  2⤵
  PID:5896
- C:\Windows\System\SIiKxGw.exe
  C:\Windows\System\SIiKxGw.exe
  2⤵
  PID:5924
- C:\Windows\System\NDXNrbq.exe
  C:\Windows\System\NDXNrbq.exe
  2⤵
  PID:5972
- C:\Windows\System\BNZWcOZ.exe
  C:\Windows\System\BNZWcOZ.exe
  2⤵
  PID:6028
- C:\Windows\System\RbvsOWy.exe
  C:\Windows\System\RbvsOWy.exe
  2⤵
  PID:6020
- C:\Windows\System\tBVBLEJ.exe
  C:\Windows\System\tBVBLEJ.exe
  2⤵
  PID:6124
- C:\Windows\System\pQTjJEM.exe
  C:\Windows\System\pQTjJEM.exe
  2⤵
  PID:5216
- C:\Windows\System\vgbNTJS.exe
  C:\Windows\System\vgbNTJS.exe
  2⤵
  PID:5320
- C:\Windows\System\QeksPYl.exe
  C:\Windows\System\QeksPYl.exe
  2⤵
  PID:3284
- C:\Windows\System\HucPdRT.exe
  C:\Windows\System\HucPdRT.exe
  2⤵
  PID:5568
- C:\Windows\System\BwszrZi.exe
  C:\Windows\System\BwszrZi.exe
  2⤵
  PID:5720
- C:\Windows\System\JkAwXpj.exe
  C:\Windows\System\JkAwXpj.exe
  2⤵
  PID:5872
- C:\Windows\System\MtzCtEs.exe
  C:\Windows\System\MtzCtEs.exe
  2⤵
  PID:5948
- C:\Windows\System\NsPPtco.exe
  C:\Windows\System\NsPPtco.exe
  2⤵
  PID:5448
- C:\Windows\System\wZGVWGQ.exe
  C:\Windows\System\wZGVWGQ.exe
  2⤵
  PID:2748
- C:\Windows\System\enOQwRw.exe
  C:\Windows\System\enOQwRw.exe
  2⤵
  PID:5516
- C:\Windows\System\dzXzALv.exe
  C:\Windows\System\dzXzALv.exe
  2⤵
  PID:6040
- C:\Windows\System\FXfkkLZ.exe
  C:\Windows\System\FXfkkLZ.exe
  2⤵
  PID:5256
- C:\Windows\System\XeWwzax.exe
  C:\Windows\System\XeWwzax.exe
  2⤵
  PID:5808
- C:\Windows\System\ySGQSKT.exe
  C:\Windows\System\ySGQSKT.exe
  2⤵
  PID:5348
- C:\Windows\System\PymHHAo.exe
  C:\Windows\System\PymHHAo.exe
  2⤵
  PID:6160
- C:\Windows\System\JeuJMON.exe
  C:\Windows\System\JeuJMON.exe
  2⤵
  PID:6188
- C:\Windows\System\MDbEykl.exe
  C:\Windows\System\MDbEykl.exe
  2⤵
  PID:6220
- C:\Windows\System\NVyvfFt.exe
  C:\Windows\System\NVyvfFt.exe
  2⤵
  PID:6248
- C:\Windows\System\htPYWOr.exe
  C:\Windows\System\htPYWOr.exe
  2⤵
  PID:6272
- C:\Windows\System\WsrRXHN.exe
  C:\Windows\System\WsrRXHN.exe
  2⤵
  PID:6312
- C:\Windows\System\VsCbOry.exe
  C:\Windows\System\VsCbOry.exe
  2⤵
  PID:6340
- C:\Windows\System\SAJtTpR.exe
  C:\Windows\System\SAJtTpR.exe
  2⤵
  PID:6364
- C:\Windows\System\EASuaOh.exe
  C:\Windows\System\EASuaOh.exe
  2⤵
  PID:6396
- C:\Windows\System\XjmbkcL.exe
  C:\Windows\System\XjmbkcL.exe
  2⤵
  PID:6412
- C:\Windows\System\WWWNIAV.exe
  C:\Windows\System\WWWNIAV.exe
  2⤵
  PID:6440
- C:\Windows\System\EjhAgVv.exe
  C:\Windows\System\EjhAgVv.exe
  2⤵
  PID:6472
- C:\Windows\System\pMDiLbv.exe
  C:\Windows\System\pMDiLbv.exe
  2⤵
  PID:6500
- C:\Windows\System\fAazSal.exe
  C:\Windows\System\fAazSal.exe
  2⤵
  PID:6528
- C:\Windows\System\pRoBdil.exe
  C:\Windows\System\pRoBdil.exe
  2⤵
  PID:6552
- C:\Windows\System\EeKJYZU.exe
  C:\Windows\System\EeKJYZU.exe
  2⤵
  PID:6580
- C:\Windows\System\CMEVXtN.exe
  C:\Windows\System\CMEVXtN.exe
  2⤵
  PID:6608
- C:\Windows\System\McRCueT.exe
  C:\Windows\System\McRCueT.exe
  2⤵
  PID:6636
- C:\Windows\System\mKpRZJB.exe
  C:\Windows\System\mKpRZJB.exe
  2⤵
  PID:6664
- C:\Windows\System\xnFFrca.exe
  C:\Windows\System\xnFFrca.exe
  2⤵
  PID:6692
- C:\Windows\System\ScXADYF.exe
  C:\Windows\System\ScXADYF.exe
  2⤵
  PID:6720
- C:\Windows\System\qsIYuUm.exe
  C:\Windows\System\qsIYuUm.exe
  2⤵
  PID:6752
- C:\Windows\System\xBEzNzG.exe
  C:\Windows\System\xBEzNzG.exe
  2⤵
  PID:6784
- C:\Windows\System\AiyJfiK.exe
  C:\Windows\System\AiyJfiK.exe
  2⤵
  PID:6808
- C:\Windows\System\lZQLdlY.exe
  C:\Windows\System\lZQLdlY.exe
  2⤵
  PID:6836
- C:\Windows\System\VCfizxQ.exe
  C:\Windows\System\VCfizxQ.exe
  2⤵
  PID:6868
- C:\Windows\System\cLuHnCT.exe
  C:\Windows\System\cLuHnCT.exe
  2⤵
  PID:6892
- C:\Windows\System\pesvNEJ.exe
  C:\Windows\System\pesvNEJ.exe
  2⤵
  PID:6924
- C:\Windows\System\sITCuDz.exe
  C:\Windows\System\sITCuDz.exe
  2⤵
  PID:6952
- C:\Windows\System\UxbtPwn.exe
  C:\Windows\System\UxbtPwn.exe
  2⤵
  PID:6976
- C:\Windows\System\vtPiahm.exe
  C:\Windows\System\vtPiahm.exe
  2⤵
  PID:7008
- C:\Windows\System\cxEEyHY.exe
  C:\Windows\System\cxEEyHY.exe
  2⤵
  PID:7032
- C:\Windows\System\YYeHILF.exe
  C:\Windows\System\YYeHILF.exe
  2⤵
  PID:7060
- C:\Windows\System\eyfsrME.exe
  C:\Windows\System\eyfsrME.exe
  2⤵
  PID:7092
- C:\Windows\System\XuCzoJF.exe
  C:\Windows\System\XuCzoJF.exe
  2⤵
  PID:7120
- C:\Windows\System\wZVyEBA.exe
  C:\Windows\System\wZVyEBA.exe
  2⤵
  PID:7148
- C:\Windows\System\mGIuBHS.exe
  C:\Windows\System\mGIuBHS.exe
  2⤵
  PID:6156
- C:\Windows\System\taktEGI.exe
  C:\Windows\System\taktEGI.exe
  2⤵
  PID:6236
- C:\Windows\System\SNbUOfC.exe
  C:\Windows\System\SNbUOfC.exe
  2⤵
  PID:6292
- C:\Windows\System\trsViGn.exe
  C:\Windows\System\trsViGn.exe
  2⤵
  PID:6352
- C:\Windows\System\lQSxOrX.exe
  C:\Windows\System\lQSxOrX.exe
  2⤵
  PID:6432
- C:\Windows\System\xHseVWn.exe
  C:\Windows\System\xHseVWn.exe
  2⤵
  PID:6488
- C:\Windows\System\cQpFQGd.exe
  C:\Windows\System\cQpFQGd.exe
  2⤵
  PID:6548
- C:\Windows\System\OoLnddD.exe
  C:\Windows\System\OoLnddD.exe
  2⤵
  PID:6632
- C:\Windows\System\ekPbjlI.exe
  C:\Windows\System\ekPbjlI.exe
  2⤵
  PID:6684
- C:\Windows\System\TqIkjPY.exe
  C:\Windows\System\TqIkjPY.exe
  2⤵
  PID:6764
- C:\Windows\System\cfizMHS.exe
  C:\Windows\System\cfizMHS.exe
  2⤵
  PID:6828
- C:\Windows\System\CwZQdYC.exe
  C:\Windows\System\CwZQdYC.exe
  2⤵
  PID:6884
- C:\Windows\System\slUlMeQ.exe
  C:\Windows\System\slUlMeQ.exe
  2⤵
  PID:6960
- C:\Windows\System\iIUynbt.exe
  C:\Windows\System\iIUynbt.exe
  2⤵
  PID:7000
- C:\Windows\System\xOuYsum.exe
  C:\Windows\System\xOuYsum.exe
  2⤵
  PID:7084
- C:\Windows\System\yWpzvCa.exe
  C:\Windows\System\yWpzvCa.exe
  2⤵
  PID:7140
- C:\Windows\System\QgSJWgF.exe
  C:\Windows\System\QgSJWgF.exe
  2⤵
  PID:6268
- C:\Windows\System\bPBfKiQ.exe
  C:\Windows\System\bPBfKiQ.exe
  2⤵
  PID:6392
- C:\Windows\System\KVKAxhE.exe
  C:\Windows\System\KVKAxhE.exe
  2⤵
  PID:6536
- C:\Windows\System\kqcakll.exe
  C:\Windows\System\kqcakll.exe
  2⤵
  PID:6712
- C:\Windows\System\DRocfFN.exe
  C:\Windows\System\DRocfFN.exe
  2⤵
  PID:6912
- C:\Windows\System\YvRiUXL.exe
  C:\Windows\System\YvRiUXL.exe
  2⤵
  PID:7052
- C:\Windows\System\TDkHPgk.exe
  C:\Windows\System\TDkHPgk.exe
  2⤵
  PID:7164
- C:\Windows\System\INpOzCn.exe
  C:\Windows\System\INpOzCn.exe
  2⤵
  PID:6480
- C:\Windows\System\YkXnxMr.exe
  C:\Windows\System\YkXnxMr.exe
  2⤵
  PID:6804
- C:\Windows\System\cifNcTn.exe
  C:\Windows\System\cifNcTn.exe
  2⤵
  PID:6452
- C:\Windows\System\ENLaifX.exe
  C:\Windows\System\ENLaifX.exe
  2⤵
  PID:6940
- C:\Windows\System\fguzjdb.exe
  C:\Windows\System\fguzjdb.exe
  2⤵
  PID:6740
- C:\Windows\System\flnHfLT.exe
  C:\Windows\System\flnHfLT.exe
  2⤵
  PID:7196
- C:\Windows\System\dYeEQbk.exe
  C:\Windows\System\dYeEQbk.exe
  2⤵
  PID:7224
- C:\Windows\System\zRJgMhi.exe
  C:\Windows\System\zRJgMhi.exe
  2⤵
  PID:7252
- C:\Windows\System\nzEQvhQ.exe
  C:\Windows\System\nzEQvhQ.exe
  2⤵
  PID:7284
- C:\Windows\System\ZmVuCvb.exe
  C:\Windows\System\ZmVuCvb.exe
  2⤵
  PID:7308
- C:\Windows\System\UopPiTg.exe
  C:\Windows\System\UopPiTg.exe
  2⤵
  PID:7332
- C:\Windows\System\mSIHOPB.exe
  C:\Windows\System\mSIHOPB.exe
  2⤵
  PID:7348
- C:\Windows\System\HKFdxTE.exe
  C:\Windows\System\HKFdxTE.exe
  2⤵
  PID:7372
- C:\Windows\System\oyJNGZk.exe
  C:\Windows\System\oyJNGZk.exe
  2⤵
  PID:7388
- C:\Windows\System\gMuXyrU.exe
  C:\Windows\System\gMuXyrU.exe
  2⤵
  PID:7416
- C:\Windows\System\yRouAdV.exe
  C:\Windows\System\yRouAdV.exe
  2⤵
  PID:7436
- C:\Windows\System\DvlqNez.exe
  C:\Windows\System\DvlqNez.exe
  2⤵
  PID:7476
- C:\Windows\System\hYkUSyQ.exe
  C:\Windows\System\hYkUSyQ.exe
  2⤵
  PID:7500
- C:\Windows\System\uOGdnrv.exe
  C:\Windows\System\uOGdnrv.exe
  2⤵
  PID:7516
- C:\Windows\System\WdzaZif.exe
  C:\Windows\System\WdzaZif.exe
  2⤵
  PID:7552
- C:\Windows\System\rFInxfD.exe
  C:\Windows\System\rFInxfD.exe
  2⤵
  PID:7600
- C:\Windows\System\ROTrqKX.exe
  C:\Windows\System\ROTrqKX.exe
  2⤵
  PID:7648
- C:\Windows\System\QPmEULL.exe
  C:\Windows\System\QPmEULL.exe
  2⤵
  PID:7676
- C:\Windows\System\tQSOEby.exe
  C:\Windows\System\tQSOEby.exe
  2⤵
  PID:7708
- C:\Windows\System\NPIHmFE.exe
  C:\Windows\System\NPIHmFE.exe
  2⤵
  PID:7736
- C:\Windows\System\KWLdNYL.exe
  C:\Windows\System\KWLdNYL.exe
  2⤵
  PID:7768
- C:\Windows\System\WWMOVYH.exe
  C:\Windows\System\WWMOVYH.exe
  2⤵
  PID:7792
- C:\Windows\System\FnxCIsj.exe
  C:\Windows\System\FnxCIsj.exe
  2⤵
  PID:7820
- C:\Windows\System\AOFNZtP.exe
  C:\Windows\System\AOFNZtP.exe
  2⤵
  PID:7848
- C:\Windows\System\BTeJqpb.exe
  C:\Windows\System\BTeJqpb.exe
  2⤵
  PID:7884
- C:\Windows\System\GPKdRXs.exe
  C:\Windows\System\GPKdRXs.exe
  2⤵
  PID:7908
- C:\Windows\System\gkrLjiK.exe
  C:\Windows\System\gkrLjiK.exe
  2⤵
  PID:7932
- C:\Windows\System\vVOjKDw.exe
  C:\Windows\System\vVOjKDw.exe
  2⤵
  PID:7964
- C:\Windows\System\LqCdIaf.exe
  C:\Windows\System\LqCdIaf.exe
  2⤵
  PID:7992
- C:\Windows\System\tswibNH.exe
  C:\Windows\System\tswibNH.exe
  2⤵
  PID:8016
- C:\Windows\System\aPHjwSZ.exe
  C:\Windows\System\aPHjwSZ.exe
  2⤵
  PID:8056
- C:\Windows\System\gjRTfzw.exe
  C:\Windows\System\gjRTfzw.exe
  2⤵
  PID:8080
- C:\Windows\System\EAFdYoz.exe
  C:\Windows\System\EAFdYoz.exe
  2⤵
  PID:8100
- C:\Windows\System\mdbIrTy.exe
  C:\Windows\System\mdbIrTy.exe
  2⤵
  PID:8132
- C:\Windows\System\tAgbGwF.exe
  C:\Windows\System\tAgbGwF.exe
  2⤵
  PID:8160
- C:\Windows\System\sOemnYZ.exe
  C:\Windows\System\sOemnYZ.exe
  2⤵
  PID:8184
- C:\Windows\System\mHXoAoY.exe
  C:\Windows\System\mHXoAoY.exe
  2⤵
  PID:7220
- C:\Windows\System\rMyultP.exe
  C:\Windows\System\rMyultP.exe
  2⤵
  PID:7276
- C:\Windows\System\vYUBTNP.exe
  C:\Windows\System\vYUBTNP.exe
  2⤵
  PID:7368
- C:\Windows\System\DGHjuQy.exe
  C:\Windows\System\DGHjuQy.exe
  2⤵
  PID:7400
- C:\Windows\System\PURjdQE.exe
  C:\Windows\System\PURjdQE.exe
  2⤵
  PID:7484
- C:\Windows\System\oyUxxVR.exe
  C:\Windows\System\oyUxxVR.exe
  2⤵
  PID:7580
- C:\Windows\System\NwvwRpF.exe
  C:\Windows\System\NwvwRpF.exe
  2⤵
  PID:7512
- C:\Windows\System\tMhWLIu.exe
  C:\Windows\System\tMhWLIu.exe
  2⤵
  PID:7660
- C:\Windows\System\fdaIwmR.exe
  C:\Windows\System\fdaIwmR.exe
  2⤵
  PID:7728
- C:\Windows\System\VoBuzVE.exe
  C:\Windows\System\VoBuzVE.exe
  2⤵
  PID:7788
- C:\Windows\System\jlivKTO.exe
  C:\Windows\System\jlivKTO.exe
  2⤵
  PID:7860
- C:\Windows\System\YntWRvL.exe
  C:\Windows\System\YntWRvL.exe
  2⤵
  PID:7924
- C:\Windows\System\XTiQUtd.exe
  C:\Windows\System\XTiQUtd.exe
  2⤵
  PID:7984
- C:\Windows\System\CPrBdCU.exe
  C:\Windows\System\CPrBdCU.exe
  2⤵
  PID:8040
- C:\Windows\System\wPxFvBW.exe
  C:\Windows\System\wPxFvBW.exe
  2⤵
  PID:8120
- C:\Windows\System\UUgwsao.exe
  C:\Windows\System\UUgwsao.exe
  2⤵
  PID:8180
- C:\Windows\System\mmHyUUd.exe
  C:\Windows\System\mmHyUUd.exe
  2⤵
  PID:6404
- C:\Windows\System\YGpkmJV.exe
  C:\Windows\System\YGpkmJV.exe
  2⤵
  PID:7428
- C:\Windows\System\PLpjNIg.exe
  C:\Windows\System\PLpjNIg.exe
  2⤵
  PID:7540
- C:\Windows\System\ZoqlfPf.exe
  C:\Windows\System\ZoqlfPf.exe
  2⤵
  PID:7756
- C:\Windows\System\VWftjmh.exe
  C:\Windows\System\VWftjmh.exe
  2⤵
  PID:7900
- C:\Windows\System\nGRIBRk.exe
  C:\Windows\System\nGRIBRk.exe
  2⤵
  PID:8036
- C:\Windows\System\jtEqpjb.exe
  C:\Windows\System\jtEqpjb.exe
  2⤵
  PID:8176
- C:\Windows\System\iYpyBmJ.exe
  C:\Windows\System\iYpyBmJ.exe
  2⤵
  PID:7472
- C:\Windows\System\cAVzhif.exe
  C:\Windows\System\cAVzhif.exe
  2⤵
  PID:7784
- C:\Windows\System\QtZSsVV.exe
  C:\Windows\System\QtZSsVV.exe
  2⤵
  PID:8148
- C:\Windows\System\NZMvboU.exe
  C:\Windows\System\NZMvboU.exe
  2⤵
  PID:7700
- C:\Windows\System\yhpOZKl.exe
  C:\Windows\System\yhpOZKl.exe
  2⤵
  PID:8096
- C:\Windows\System\vtQaYmM.exe
  C:\Windows\System\vtQaYmM.exe
  2⤵
  PID:8220
- C:\Windows\System\UfggBMO.exe
  C:\Windows\System\UfggBMO.exe
  2⤵
  PID:8256
- C:\Windows\System\YHRopQg.exe
  C:\Windows\System\YHRopQg.exe
  2⤵
  PID:8276
- C:\Windows\System\JiJvVce.exe
  C:\Windows\System\JiJvVce.exe
  2⤵
  PID:8304
- C:\Windows\System\wvaRBEj.exe
  C:\Windows\System\wvaRBEj.exe
  2⤵
  PID:8332
- C:\Windows\System\PraqNYG.exe
  C:\Windows\System\PraqNYG.exe
  2⤵
  PID:8364
- C:\Windows\System\QiLWElp.exe
  C:\Windows\System\QiLWElp.exe
  2⤵
  PID:8392
- C:\Windows\System\pXnpenv.exe
  C:\Windows\System\pXnpenv.exe
  2⤵
  PID:8420
- C:\Windows\System\cigegKK.exe
  C:\Windows\System\cigegKK.exe
  2⤵
  PID:8448
- C:\Windows\System\RuruVaD.exe
  C:\Windows\System\RuruVaD.exe
  2⤵
  PID:8476
- C:\Windows\System\IKFiLqm.exe
  C:\Windows\System\IKFiLqm.exe
  2⤵
  PID:8504
- C:\Windows\System\hQheEie.exe
  C:\Windows\System\hQheEie.exe
  2⤵
  PID:8532
- C:\Windows\System\rEjiFSt.exe
  C:\Windows\System\rEjiFSt.exe
  2⤵
  PID:8572
- C:\Windows\System\rMEXAqB.exe
  C:\Windows\System\rMEXAqB.exe
  2⤵
  PID:8600
- C:\Windows\System\ztQdLZj.exe
  C:\Windows\System\ztQdLZj.exe
  2⤵
  PID:8628
- C:\Windows\System\cKZpFLX.exe
  C:\Windows\System\cKZpFLX.exe
  2⤵
  PID:8656
- C:\Windows\System\ItTjnXD.exe
  C:\Windows\System\ItTjnXD.exe
  2⤵
  PID:8684
- C:\Windows\System\ckPkaDJ.exe
  C:\Windows\System\ckPkaDJ.exe
  2⤵
  PID:8712
- C:\Windows\System\CsyzSPI.exe
  C:\Windows\System\CsyzSPI.exe
  2⤵
  PID:8740
- C:\Windows\System\FhzeGUk.exe
  C:\Windows\System\FhzeGUk.exe
  2⤵
  PID:8768
- C:\Windows\System\qvprrla.exe
  C:\Windows\System\qvprrla.exe
  2⤵
  PID:8796
- C:\Windows\System\RzPVfih.exe
  C:\Windows\System\RzPVfih.exe
  2⤵
  PID:8824
- C:\Windows\System\qqWChBz.exe
  C:\Windows\System\qqWChBz.exe
  2⤵
  PID:8852
- C:\Windows\System\GBSpudq.exe
  C:\Windows\System\GBSpudq.exe
  2⤵
  PID:8880
- C:\Windows\System\FDQopmo.exe
  C:\Windows\System\FDQopmo.exe
  2⤵
  PID:8908
- C:\Windows\System\fVeVAQD.exe
  C:\Windows\System\fVeVAQD.exe
  2⤵
  PID:8936
- C:\Windows\System\hTrQSQi.exe
  C:\Windows\System\hTrQSQi.exe
  2⤵
  PID:8964
- C:\Windows\System\wxsMwNG.exe
  C:\Windows\System\wxsMwNG.exe
  2⤵
  PID:8992
- C:\Windows\System\MYYzXWX.exe
  C:\Windows\System\MYYzXWX.exe
  2⤵
  PID:9020
- C:\Windows\System\lyofnTw.exe
  C:\Windows\System\lyofnTw.exe
  2⤵
  PID:9048
- C:\Windows\System\RxpGUNH.exe
  C:\Windows\System\RxpGUNH.exe
  2⤵
  PID:9076
- C:\Windows\System\RnSysjX.exe
  C:\Windows\System\RnSysjX.exe
  2⤵
  PID:9104
- C:\Windows\System\AYJIbcE.exe
  C:\Windows\System\AYJIbcE.exe
  2⤵
  PID:9132
- C:\Windows\System\MkOxKhL.exe
  C:\Windows\System\MkOxKhL.exe
  2⤵
  PID:9160
- C:\Windows\System\oiJLnXc.exe
  C:\Windows\System\oiJLnXc.exe
  2⤵
  PID:9188
- C:\Windows\System\kfhsUfJ.exe
  C:\Windows\System\kfhsUfJ.exe
  2⤵
  PID:7724
- C:\Windows\System\TzVLcHv.exe
  C:\Windows\System\TzVLcHv.exe
  2⤵
  PID:8268
- C:\Windows\System\jNCfZNa.exe
  C:\Windows\System\jNCfZNa.exe
  2⤵
  PID:8316
- C:\Windows\System\gshFNFz.exe
  C:\Windows\System\gshFNFz.exe
  2⤵
  PID:8384
- C:\Windows\System\SBROKyy.exe
  C:\Windows\System\SBROKyy.exe
  2⤵
  PID:8444
- C:\Windows\System\JCRHCFn.exe
  C:\Windows\System\JCRHCFn.exe
  2⤵
  PID:8516
- C:\Windows\System\LLdanXF.exe
  C:\Windows\System\LLdanXF.exe
  2⤵
  PID:8592
- C:\Windows\System\UrnyeVT.exe
  C:\Windows\System\UrnyeVT.exe
  2⤵
  PID:8652
- C:\Windows\System\DqDrnxo.exe
  C:\Windows\System\DqDrnxo.exe
  2⤵
  PID:8724
- C:\Windows\System\tXBgMtz.exe
  C:\Windows\System\tXBgMtz.exe
  2⤵
  PID:8788
- C:\Windows\System\BBdkUAJ.exe
  C:\Windows\System\BBdkUAJ.exe
  2⤵
  PID:8848
- C:\Windows\System\icrcXxL.exe
  C:\Windows\System\icrcXxL.exe
  2⤵
  PID:8920
- C:\Windows\System\UwLcVDB.exe
  C:\Windows\System\UwLcVDB.exe
  2⤵
  PID:8988
- C:\Windows\System\JTsJift.exe
  C:\Windows\System\JTsJift.exe
  2⤵
  PID:9044
- C:\Windows\System\OwHGUsl.exe
  C:\Windows\System\OwHGUsl.exe
  2⤵
  PID:9128
- C:\Windows\System\HXBmhyu.exe
  C:\Windows\System\HXBmhyu.exe
  2⤵
  PID:9180
- C:\Windows\System\BADeHZu.exe
  C:\Windows\System\BADeHZu.exe
  2⤵
  PID:9212
- C:\Windows\System\anCDyRq.exe
  C:\Windows\System\anCDyRq.exe
  2⤵
  PID:8288
- C:\Windows\System\cpUNPOE.exe
  C:\Windows\System\cpUNPOE.exe
  2⤵
  PID:8376
- C:\Windows\System\TmgRDzr.exe
  C:\Windows\System\TmgRDzr.exe
  2⤵
  PID:8708
- C:\Windows\System\ERDDalF.exe
  C:\Windows\System\ERDDalF.exe
  2⤵
  PID:8876
- C:\Windows\System\KZaXAxQ.exe
  C:\Windows\System\KZaXAxQ.exe
  2⤵
  PID:8360
- C:\Windows\System\SrJQXWc.exe
  C:\Windows\System\SrJQXWc.exe
  2⤵
  PID:9200
- C:\Windows\System\SijBCUw.exe
  C:\Windows\System\SijBCUw.exe
  2⤵
  PID:8432
- C:\Windows\System\XZqBIuO.exe
  C:\Windows\System\XZqBIuO.exe
  2⤵
  PID:8844
- C:\Windows\System\pnagJUI.exe
  C:\Windows\System\pnagJUI.exe
  2⤵
  PID:9116
- C:\Windows\System\zvfTfLM.exe
  C:\Windows\System\zvfTfLM.exe
  2⤵
  PID:9072
- C:\Windows\System\qzyJyzX.exe
  C:\Windows\System\qzyJyzX.exe
  2⤵
  PID:9224
- C:\Windows\System\iBfZSDf.exe
  C:\Windows\System\iBfZSDf.exe
  2⤵
  PID:9252
- C:\Windows\System\vGLjswV.exe
  C:\Windows\System\vGLjswV.exe
  2⤵
  PID:9280
- C:\Windows\System\nvOWkvu.exe
  C:\Windows\System\nvOWkvu.exe
  2⤵
  PID:9308
- C:\Windows\System\OIXAzgy.exe
  C:\Windows\System\OIXAzgy.exe
  2⤵
  PID:9336
- C:\Windows\System\PqMkwdv.exe
  C:\Windows\System\PqMkwdv.exe
  2⤵
  PID:9364
- C:\Windows\System\oOhzobY.exe
  C:\Windows\System\oOhzobY.exe
  2⤵
  PID:9392
- C:\Windows\System\DVltDeq.exe
  C:\Windows\System\DVltDeq.exe
  2⤵
  PID:9420
- C:\Windows\System\RHObzvp.exe
  C:\Windows\System\RHObzvp.exe
  2⤵
  PID:9448
- C:\Windows\System\FoVCgwj.exe
  C:\Windows\System\FoVCgwj.exe
  2⤵
  PID:9476
- C:\Windows\System\UacNceW.exe
  C:\Windows\System\UacNceW.exe
  2⤵
  PID:9504
- C:\Windows\System\BNUqagQ.exe
  C:\Windows\System\BNUqagQ.exe
  2⤵
  PID:9532
- C:\Windows\System\ELxfWxT.exe
  C:\Windows\System\ELxfWxT.exe
  2⤵
  PID:9560
- C:\Windows\System\jeSEApM.exe
  C:\Windows\System\jeSEApM.exe
  2⤵
  PID:9588
- C:\Windows\System\Jektnzf.exe
  C:\Windows\System\Jektnzf.exe
  2⤵
  PID:9616
- C:\Windows\System\eUJREOI.exe
  C:\Windows\System\eUJREOI.exe
  2⤵
  PID:9648
- C:\Windows\System\knJVCzS.exe
  C:\Windows\System\knJVCzS.exe
  2⤵
  PID:9672
- C:\Windows\System\qEkblwb.exe
  C:\Windows\System\qEkblwb.exe
  2⤵
  PID:9700
- C:\Windows\System\DxUyuGu.exe
  C:\Windows\System\DxUyuGu.exe
  2⤵
  PID:9728
- C:\Windows\System\gpxqfTB.exe
  C:\Windows\System\gpxqfTB.exe
  2⤵
  PID:9756
- C:\Windows\System\UcEokEz.exe
  C:\Windows\System\UcEokEz.exe
  2⤵
  PID:9784
- C:\Windows\System\UjGAwnm.exe
  C:\Windows\System\UjGAwnm.exe
  2⤵
  PID:9812
- C:\Windows\System\ZUqMdnS.exe
  C:\Windows\System\ZUqMdnS.exe
  2⤵
  PID:9844
- C:\Windows\System\BbdEZxE.exe
  C:\Windows\System\BbdEZxE.exe
  2⤵
  PID:9872
- C:\Windows\System\qqTkUdJ.exe
  C:\Windows\System\qqTkUdJ.exe
  2⤵
  PID:9900
- C:\Windows\System\Ormmcet.exe
  C:\Windows\System\Ormmcet.exe
  2⤵
  PID:9928
- C:\Windows\System\hcbmlFE.exe
  C:\Windows\System\hcbmlFE.exe
  2⤵
  PID:9956
- C:\Windows\System\fUXsCdU.exe
  C:\Windows\System\fUXsCdU.exe
  2⤵
  PID:9984
- C:\Windows\System\kldNxjv.exe
  C:\Windows\System\kldNxjv.exe
  2⤵
  PID:10012
- C:\Windows\System\lOXIIdG.exe
  C:\Windows\System\lOXIIdG.exe
  2⤵
  PID:10040
- C:\Windows\System\CUgOlAx.exe
  C:\Windows\System\CUgOlAx.exe
  2⤵
  PID:10068
- C:\Windows\System\KLacaaO.exe
  C:\Windows\System\KLacaaO.exe
  2⤵
  PID:10096
- C:\Windows\System\YRPnOoM.exe
  C:\Windows\System\YRPnOoM.exe
  2⤵
  PID:10132
- C:\Windows\System\cLpSFGM.exe
  C:\Windows\System\cLpSFGM.exe
  2⤵
  PID:10152
- C:\Windows\System\bSNWPIP.exe
  C:\Windows\System\bSNWPIP.exe
  2⤵
  PID:10180
- C:\Windows\System\bFjtlui.exe
  C:\Windows\System\bFjtlui.exe
  2⤵
  PID:10208
- C:\Windows\System\heVzgjl.exe
  C:\Windows\System\heVzgjl.exe
  2⤵
  PID:10236
- C:\Windows\System\fKvQGIj.exe
  C:\Windows\System\fKvQGIj.exe
  2⤵
  PID:9276
- C:\Windows\System\WylJySL.exe
  C:\Windows\System\WylJySL.exe
  2⤵
  PID:9332
- C:\Windows\System\YFEkBRG.exe
  C:\Windows\System\YFEkBRG.exe
  2⤵
  PID:9408
- C:\Windows\System\JZLHRFC.exe
  C:\Windows\System\JZLHRFC.exe
  2⤵
  PID:9472
- C:\Windows\System\rbaQJJy.exe
  C:\Windows\System\rbaQJJy.exe
  2⤵
  PID:9524
- C:\Windows\System\WVGFNpo.exe
  C:\Windows\System\WVGFNpo.exe
  2⤵
  PID:9604
- C:\Windows\System\pZrGnMs.exe
  C:\Windows\System\pZrGnMs.exe
  2⤵
  PID:9664
- C:\Windows\System\otmZTKc.exe
  C:\Windows\System\otmZTKc.exe
  2⤵
  PID:9724
- C:\Windows\System\tcGKsCB.exe
  C:\Windows\System\tcGKsCB.exe
  2⤵
  PID:9796
- C:\Windows\System\xHmBUhd.exe
  C:\Windows\System\xHmBUhd.exe
  2⤵
  PID:9864
- C:\Windows\System\OdzyUwT.exe
  C:\Windows\System\OdzyUwT.exe
  2⤵
  PID:9924
- C:\Windows\System\xIwIVfA.exe
  C:\Windows\System\xIwIVfA.exe
  2⤵
  PID:9996
- C:\Windows\System\xlIKBdo.exe
  C:\Windows\System\xlIKBdo.exe
  2⤵
  PID:10060
- C:\Windows\System\MMqpWsL.exe
  C:\Windows\System\MMqpWsL.exe
  2⤵
  PID:10120
- C:\Windows\System\amnhytd.exe
  C:\Windows\System\amnhytd.exe
  2⤵
  PID:10192
- C:\Windows\System\RbdrDjT.exe
  C:\Windows\System\RbdrDjT.exe
  2⤵
  PID:9264
- C:\Windows\System\LZHTIbB.exe
  C:\Windows\System\LZHTIbB.exe
  2⤵
  PID:9384
- C:\Windows\System\vGAUEsw.exe
  C:\Windows\System\vGAUEsw.exe
  2⤵
  PID:9556
- C:\Windows\System\xPxamjG.exe
  C:\Windows\System\xPxamjG.exe
  2⤵
  PID:9712
- C:\Windows\System\iXgUPgo.exe
  C:\Windows\System\iXgUPgo.exe
  2⤵
  PID:9856
- C:\Windows\System\kMOWNhZ.exe
  C:\Windows\System\kMOWNhZ.exe
  2⤵
  PID:10024
- C:\Windows\System\kAdEHsF.exe
  C:\Windows\System\kAdEHsF.exe
  2⤵
  PID:10172
- C:\Windows\System\MtiqIRL.exe
  C:\Windows\System\MtiqIRL.exe
  2⤵
  PID:9388
- C:\Windows\System\JKFIvhx.exe
  C:\Windows\System\JKFIvhx.exe
  2⤵
  PID:9776
- C:\Windows\System\cnTthAd.exe
  C:\Windows\System\cnTthAd.exe
  2⤵
  PID:10116
- C:\Windows\System\UcOEZsZ.exe
  C:\Windows\System\UcOEZsZ.exe
  2⤵
  PID:9696
- C:\Windows\System\fEiwuLg.exe
  C:\Windows\System\fEiwuLg.exe
  2⤵
  PID:10088
- C:\Windows\System\KhExyRB.exe
  C:\Windows\System\KhExyRB.exe
  2⤵
  PID:10260
- C:\Windows\System\ERnAGSt.exe
  C:\Windows\System\ERnAGSt.exe
  2⤵
  PID:10288
- C:\Windows\System\aclONcI.exe
  C:\Windows\System\aclONcI.exe
  2⤵
  PID:10316
- C:\Windows\System\JBAfVqY.exe
  C:\Windows\System\JBAfVqY.exe
  2⤵
  PID:10344
- C:\Windows\System\VEYkXZl.exe
  C:\Windows\System\VEYkXZl.exe
  2⤵
  PID:10372
- C:\Windows\System\gHvzaev.exe
  C:\Windows\System\gHvzaev.exe
  2⤵
  PID:10400
- C:\Windows\System\NVTxabG.exe
  C:\Windows\System\NVTxabG.exe
  2⤵
  PID:10428
- C:\Windows\System\qvHAwuW.exe
  C:\Windows\System\qvHAwuW.exe
  2⤵
  PID:10456
- C:\Windows\System\pcrBMxr.exe
  C:\Windows\System\pcrBMxr.exe
  2⤵
  PID:10484
- C:\Windows\System\vXdiIez.exe
  C:\Windows\System\vXdiIez.exe
  2⤵
  PID:10512
- C:\Windows\System\vkFHJWl.exe
  C:\Windows\System\vkFHJWl.exe
  2⤵
  PID:10540
- C:\Windows\System\GZOhZYx.exe
  C:\Windows\System\GZOhZYx.exe
  2⤵
  PID:10568
- C:\Windows\System\JazIhoG.exe
  C:\Windows\System\JazIhoG.exe
  2⤵
  PID:10596
- C:\Windows\System\pJoYiLk.exe
  C:\Windows\System\pJoYiLk.exe
  2⤵
  PID:10624
- C:\Windows\System\ykFntuy.exe
  C:\Windows\System\ykFntuy.exe
  2⤵
  PID:10652
- C:\Windows\System\ekUbADs.exe
  C:\Windows\System\ekUbADs.exe
  2⤵
  PID:10680
- C:\Windows\System\MdyQrdM.exe
  C:\Windows\System\MdyQrdM.exe
  2⤵
  PID:10708
- C:\Windows\System\rkqFRCw.exe
  C:\Windows\System\rkqFRCw.exe
  2⤵
  PID:10736
- C:\Windows\System\xTFyqRA.exe
  C:\Windows\System\xTFyqRA.exe
  2⤵
  PID:10764
- C:\Windows\System\rogWBVl.exe
  C:\Windows\System\rogWBVl.exe
  2⤵
  PID:10792
- C:\Windows\System\RLhtmna.exe
  C:\Windows\System\RLhtmna.exe
  2⤵
  PID:10820
- C:\Windows\System\jyjvHpP.exe
  C:\Windows\System\jyjvHpP.exe
  2⤵
  PID:10848
- C:\Windows\System\BLpZveK.exe
  C:\Windows\System\BLpZveK.exe
  2⤵
  PID:10876
- C:\Windows\System\fnmLvwn.exe
  C:\Windows\System\fnmLvwn.exe
  2⤵
  PID:10904
- C:\Windows\System\xfeEEoO.exe
  C:\Windows\System\xfeEEoO.exe
  2⤵
  PID:10932
- C:\Windows\System\rIVOEpw.exe
  C:\Windows\System\rIVOEpw.exe
  2⤵
  PID:10960
- C:\Windows\System\sKDKWDX.exe
  C:\Windows\System\sKDKWDX.exe
  2⤵
  PID:11000
- C:\Windows\System\TpYGZUQ.exe
  C:\Windows\System\TpYGZUQ.exe
  2⤵
  PID:11020
- C:\Windows\System\NbqGjfd.exe
  C:\Windows\System\NbqGjfd.exe
  2⤵
  PID:11056
- C:\Windows\System\OErhulN.exe
  C:\Windows\System\OErhulN.exe
  2⤵
  PID:11084
- C:\Windows\System\aorMrya.exe
  C:\Windows\System\aorMrya.exe
  2⤵
  PID:11112
- C:\Windows\System\ZQjKIKM.exe
  C:\Windows\System\ZQjKIKM.exe
  2⤵
  PID:11140
- C:\Windows\System\mayDVij.exe
  C:\Windows\System\mayDVij.exe
  2⤵
  PID:11168
- C:\Windows\System\gCbhqVw.exe
  C:\Windows\System\gCbhqVw.exe
  2⤵
  PID:11196
- C:\Windows\System\KpjGRSd.exe
  C:\Windows\System\KpjGRSd.exe
  2⤵
  PID:11224
- C:\Windows\System\lHjOfWA.exe
  C:\Windows\System\lHjOfWA.exe
  2⤵
  PID:11252
- C:\Windows\System\HeQzRwu.exe
  C:\Windows\System\HeQzRwu.exe
  2⤵
  PID:10280
- C:\Windows\System\SRnyyNH.exe
  C:\Windows\System\SRnyyNH.exe
  2⤵
  PID:10340
- C:\Windows\System\CsMTdCz.exe
  C:\Windows\System\CsMTdCz.exe
  2⤵
  PID:10412
- C:\Windows\System\zAJNcsS.exe
  C:\Windows\System\zAJNcsS.exe
  2⤵
  PID:10476
- C:\Windows\System\lMVbDvE.exe
  C:\Windows\System\lMVbDvE.exe
  2⤵
  PID:10536
- C:\Windows\System\dEhPbeT.exe
  C:\Windows\System\dEhPbeT.exe
  2⤵
  PID:10608
- C:\Windows\System\LSfqNUp.exe
  C:\Windows\System\LSfqNUp.exe
  2⤵
  PID:10672
- C:\Windows\System\XPxgQIS.exe
  C:\Windows\System\XPxgQIS.exe
  2⤵
  PID:10732
- C:\Windows\System\yDHobgD.exe
  C:\Windows\System\yDHobgD.exe
  2⤵
  PID:10804
- C:\Windows\System\LgOvrZA.exe
  C:\Windows\System\LgOvrZA.exe
  2⤵
  PID:10868
- C:\Windows\System\uSppIWA.exe
  C:\Windows\System\uSppIWA.exe
  2⤵
  PID:10928
- C:\Windows\System\dBoEQal.exe
  C:\Windows\System\dBoEQal.exe
  2⤵
  PID:10984
- C:\Windows\System\zNWyMoL.exe
  C:\Windows\System\zNWyMoL.exe
  2⤵
  PID:11040
- C:\Windows\System\ssnAorT.exe
  C:\Windows\System\ssnAorT.exe
  2⤵
  PID:11104
- C:\Windows\System\xWOOPUg.exe
  C:\Windows\System\xWOOPUg.exe
  2⤵
  PID:11160
- C:\Windows\System\hpgetwg.exe
  C:\Windows\System\hpgetwg.exe
  2⤵
  PID:11236
- C:\Windows\System\UxHEVic.exe
  C:\Windows\System\UxHEVic.exe
  2⤵
  PID:10328
- C:\Windows\System\TzUpCEc.exe
  C:\Windows\System\TzUpCEc.exe
  2⤵
  PID:10472
- C:\Windows\System\ehteJEu.exe
  C:\Windows\System\ehteJEu.exe
  2⤵
  PID:10636
- C:\Windows\System\notnudq.exe
  C:\Windows\System\notnudq.exe
  2⤵
  PID:10784
- C:\Windows\System\mNdRssw.exe
  C:\Windows\System\mNdRssw.exe
  2⤵
  PID:10924
- C:\Windows\System\qrEAgqk.exe
  C:\Windows\System\qrEAgqk.exe
  2⤵
  PID:11068
- C:\Windows\System\REtzTSd.exe
  C:\Windows\System\REtzTSd.exe
  2⤵
  PID:11192
- C:\Windows\System\SITrZFA.exe
  C:\Windows\System\SITrZFA.exe
  2⤵
  PID:10392
- C:\Windows\System\HhZjXEe.exe
  C:\Windows\System\HhZjXEe.exe
  2⤵
  PID:10728
- C:\Windows\System\EaxcbFX.exe
  C:\Windows\System\EaxcbFX.exe
  2⤵
  PID:3356
- C:\Windows\System\tecFBmT.exe
  C:\Windows\System\tecFBmT.exe
  2⤵
  PID:10564
- C:\Windows\System\MItZVTQ.exe
  C:\Windows\System\MItZVTQ.exe
  2⤵
  PID:10312
- C:\Windows\System\SJjAMbe.exe
  C:\Windows\System\SJjAMbe.exe
  2⤵
  PID:11272
- C:\Windows\System\PHysbmJ.exe
  C:\Windows\System\PHysbmJ.exe
  2⤵
  PID:11300
- C:\Windows\System\tvJjfYB.exe
  C:\Windows\System\tvJjfYB.exe
  2⤵
  PID:11328
- C:\Windows\System\fvASjbS.exe
  C:\Windows\System\fvASjbS.exe
  2⤵
  PID:11356
- C:\Windows\System\PYgIYTB.exe
  C:\Windows\System\PYgIYTB.exe
  2⤵
  PID:11384
- C:\Windows\System\llvQcTF.exe
  C:\Windows\System\llvQcTF.exe
  2⤵
  PID:11412
- C:\Windows\System\FzHbRkh.exe
  C:\Windows\System\FzHbRkh.exe
  2⤵
  PID:11440
- C:\Windows\System\yILrmOi.exe
  C:\Windows\System\yILrmOi.exe
  2⤵
  PID:11468
- C:\Windows\System\tHrOmNI.exe
  C:\Windows\System\tHrOmNI.exe
  2⤵
  PID:11496
- C:\Windows\System\eSDrplQ.exe
  C:\Windows\System\eSDrplQ.exe
  2⤵
  PID:11524
- C:\Windows\System\iPGaggb.exe
  C:\Windows\System\iPGaggb.exe
  2⤵
  PID:11552
- C:\Windows\System\drAeJoj.exe
  C:\Windows\System\drAeJoj.exe
  2⤵
  PID:11580
- C:\Windows\System\wxUBTtU.exe
  C:\Windows\System\wxUBTtU.exe
  2⤵
  PID:11608
- C:\Windows\System\vZWCmoy.exe
  C:\Windows\System\vZWCmoy.exe
  2⤵
  PID:11636
- C:\Windows\System\UdESONh.exe
  C:\Windows\System\UdESONh.exe
  2⤵
  PID:11668
- C:\Windows\System\cPKSfxB.exe
  C:\Windows\System\cPKSfxB.exe
  2⤵
  PID:11696
- C:\Windows\System\YxwZhJQ.exe
  C:\Windows\System\YxwZhJQ.exe
  2⤵
  PID:11724
- C:\Windows\System\ovPIQJl.exe
  C:\Windows\System\ovPIQJl.exe
  2⤵
  PID:11752
- C:\Windows\System\KhKZkbY.exe
  C:\Windows\System\KhKZkbY.exe
  2⤵
  PID:11780
- C:\Windows\System\unfVhvT.exe
  C:\Windows\System\unfVhvT.exe
  2⤵
  PID:11808
- C:\Windows\System\eNsHPmd.exe
  C:\Windows\System\eNsHPmd.exe
  2⤵
  PID:11836
- C:\Windows\System\iHgVZyL.exe
  C:\Windows\System\iHgVZyL.exe
  2⤵
  PID:11864
- C:\Windows\System\bWDjgKG.exe
  C:\Windows\System\bWDjgKG.exe
  2⤵
  PID:11892
- C:\Windows\System\WVNicNb.exe
  C:\Windows\System\WVNicNb.exe
  2⤵
  PID:11920
- C:\Windows\System\gpBfKWB.exe
  C:\Windows\System\gpBfKWB.exe
  2⤵
  PID:11948
- C:\Windows\System\RZivRAx.exe
  C:\Windows\System\RZivRAx.exe
  2⤵
  PID:11976
- C:\Windows\System\XhwQmAU.exe
  C:\Windows\System\XhwQmAU.exe
  2⤵
  PID:12004
- C:\Windows\System\jSBVBXq.exe
  C:\Windows\System\jSBVBXq.exe
  2⤵
  PID:12032
- C:\Windows\System\HEBXRwT.exe
  C:\Windows\System\HEBXRwT.exe
  2⤵
  PID:12060
- C:\Windows\System\TsPpdQq.exe
  C:\Windows\System\TsPpdQq.exe
  2⤵
  PID:12088
- C:\Windows\System\IahPYyV.exe
  C:\Windows\System\IahPYyV.exe
  2⤵
  PID:12116
- C:\Windows\System\dvnPzfq.exe
  C:\Windows\System\dvnPzfq.exe
  2⤵
  PID:12144
- C:\Windows\System\kgpwNkp.exe
  C:\Windows\System\kgpwNkp.exe
  2⤵
  PID:12172
- C:\Windows\System\TMHQGFa.exe
  C:\Windows\System\TMHQGFa.exe
  2⤵
  PID:12200
- C:\Windows\System\BtUggkq.exe
  C:\Windows\System\BtUggkq.exe
  2⤵
  PID:12228
- C:\Windows\System\vWReSlp.exe
  C:\Windows\System\vWReSlp.exe
  2⤵
  PID:12256
- C:\Windows\System\cFRbdHE.exe
  C:\Windows\System\cFRbdHE.exe
  2⤵
  PID:12284
- C:\Windows\System\keficsP.exe
  C:\Windows\System\keficsP.exe
  2⤵
  PID:11316
- C:\Windows\System\AVCuDkn.exe
  C:\Windows\System\AVCuDkn.exe
  2⤵
  PID:2240
- C:\Windows\System\sWJmUfb.exe
  C:\Windows\System\sWJmUfb.exe
  2⤵
  PID:11432
- C:\Windows\System\lzpRehw.exe
  C:\Windows\System\lzpRehw.exe
  2⤵
  PID:11488
- C:\Windows\System\GMvCSEY.exe
  C:\Windows\System\GMvCSEY.exe
  2⤵
  PID:11564
- C:\Windows\System\onAYPyf.exe
  C:\Windows\System\onAYPyf.exe
  2⤵
  PID:11628
- C:\Windows\System\svcvLUK.exe
  C:\Windows\System\svcvLUK.exe
  2⤵
  PID:11692
- C:\Windows\System\mTzXHgK.exe
  C:\Windows\System\mTzXHgK.exe
  2⤵
  PID:11764
- C:\Windows\System\AYKCAES.exe
  C:\Windows\System\AYKCAES.exe
  2⤵
  PID:3392
- C:\Windows\System\NAkaXUQ.exe
  C:\Windows\System\NAkaXUQ.exe
  2⤵
  PID:11876
- C:\Windows\System\iXrjrQM.exe
  C:\Windows\System\iXrjrQM.exe
  2⤵
  PID:11940
- C:\Windows\System\AwBCBIM.exe
  C:\Windows\System\AwBCBIM.exe
  2⤵
  PID:12000
- C:\Windows\System\IXtLbLu.exe
  C:\Windows\System\IXtLbLu.exe
  2⤵
  PID:12072
- C:\Windows\System\DNKmZUv.exe
  C:\Windows\System\DNKmZUv.exe
  2⤵
  PID:12136
- C:\Windows\System\UeKqhwV.exe
  C:\Windows\System\UeKqhwV.exe
  2⤵
  PID:5020
- C:\Windows\System\MTwpOuO.exe
  C:\Windows\System\MTwpOuO.exe
  2⤵
  PID:12268
- C:\Windows\System\gelGqdd.exe
  C:\Windows\System\gelGqdd.exe
  2⤵
  PID:11352
- C:\Windows\System\iTUHuhR.exe
  C:\Windows\System\iTUHuhR.exe
  2⤵
  PID:3568
- C:\Windows\System\bAHkJhq.exe
  C:\Windows\System\bAHkJhq.exe
  2⤵
  PID:11492
- C:\Windows\System\VXWBeoj.exe
  C:\Windows\System\VXWBeoj.exe
  2⤵
  PID:11660
- C:\Windows\System\VtwbSIh.exe
  C:\Windows\System\VtwbSIh.exe
  2⤵
  PID:11800
- C:\Windows\System\JKCsGfk.exe
  C:\Windows\System\JKCsGfk.exe
  2⤵
  PID:11932
- C:\Windows\System\jQhFhfE.exe
  C:\Windows\System\jQhFhfE.exe
  2⤵
  PID:12100
- C:\Windows\System\yfEizYt.exe
  C:\Windows\System\yfEizYt.exe
  2⤵
  PID:12248
- C:\Windows\System\tWUJTWk.exe
  C:\Windows\System\tWUJTWk.exe
  2⤵
  PID:4668
- C:\Windows\System\EKVusAa.exe
  C:\Windows\System\EKVusAa.exe
  2⤵
  PID:11484
- C:\Windows\System\zDyXTtd.exe
  C:\Windows\System\zDyXTtd.exe
  2⤵
  PID:11912
- C:\Windows\System\StLgUQV.exe
  C:\Windows\System\StLgUQV.exe
  2⤵
  PID:12108
- C:\Windows\System\oNgTzLx.exe
  C:\Windows\System\oNgTzLx.exe
  2⤵
  PID:4776
- C:\Windows\System\PElyPMB.exe
  C:\Windows\System\PElyPMB.exe
  2⤵
  PID:12156
- C:\Windows\System\drUbXgF.exe
  C:\Windows\System\drUbXgF.exe
  2⤵
  PID:12296
- C:\Windows\System\GyWhYeB.exe
  C:\Windows\System\GyWhYeB.exe
  2⤵
  PID:12324
- C:\Windows\System\lVrcteC.exe
  C:\Windows\System\lVrcteC.exe
  2⤵
  PID:12352
- C:\Windows\System\RPaOOGE.exe
  C:\Windows\System\RPaOOGE.exe
  2⤵
  PID:12380
- C:\Windows\System\PfuaGsI.exe
  C:\Windows\System\PfuaGsI.exe
  2⤵
  PID:12408
- C:\Windows\System\JLdGKoL.exe
  C:\Windows\System\JLdGKoL.exe
  2⤵
  PID:12436
- C:\Windows\System\ngNYFlK.exe
  C:\Windows\System\ngNYFlK.exe
  2⤵
  PID:12464
- C:\Windows\System\FSgIlCr.exe
  C:\Windows\System\FSgIlCr.exe
  2⤵
  PID:12492
- C:\Windows\System\hZIBrfJ.exe
  C:\Windows\System\hZIBrfJ.exe
  2⤵
  PID:12520
- C:\Windows\System\MTfTNvY.exe
  C:\Windows\System\MTfTNvY.exe
  2⤵
  PID:12548
- C:\Windows\System\EisrfNo.exe
  C:\Windows\System\EisrfNo.exe
  2⤵
  PID:12576
- C:\Windows\System\cFxRjJx.exe
  C:\Windows\System\cFxRjJx.exe
  2⤵
  PID:12604
- C:\Windows\System\gRPIeMC.exe
  C:\Windows\System\gRPIeMC.exe
  2⤵
  PID:12632
- C:\Windows\System\UyDtVZz.exe
  C:\Windows\System\UyDtVZz.exe
  2⤵
  PID:12660
- C:\Windows\System\YdmqWZH.exe
  C:\Windows\System\YdmqWZH.exe
  2⤵
  PID:12688
- C:\Windows\System\HlVdzMm.exe
  C:\Windows\System\HlVdzMm.exe
  2⤵
  PID:12716
- C:\Windows\System\xkrBaLv.exe
  C:\Windows\System\xkrBaLv.exe
  2⤵
  PID:12744
- C:\Windows\System\aSegwmK.exe
  C:\Windows\System\aSegwmK.exe
  2⤵
  PID:12772
- C:\Windows\System\okpBTeJ.exe
  C:\Windows\System\okpBTeJ.exe
  2⤵
  PID:12800
- C:\Windows\System\aHcUIcX.exe
  C:\Windows\System\aHcUIcX.exe
  2⤵
  PID:12828
- C:\Windows\System\XPjFFXL.exe
  C:\Windows\System\XPjFFXL.exe
  2⤵
  PID:12856
- C:\Windows\System\PokYhbv.exe
  C:\Windows\System\PokYhbv.exe
  2⤵
  PID:12884
- C:\Windows\System\yUeINpG.exe
  C:\Windows\System\yUeINpG.exe
  2⤵
  PID:12912
- C:\Windows\System\ttxsflg.exe
  C:\Windows\System\ttxsflg.exe
  2⤵
  PID:12940
- C:\Windows\System\WVsmYdw.exe
  C:\Windows\System\WVsmYdw.exe
  2⤵
  PID:12968
- C:\Windows\System\fjXsDKl.exe
  C:\Windows\System\fjXsDKl.exe
  2⤵
  PID:12996
- C:\Windows\System\XEUryLC.exe
  C:\Windows\System\XEUryLC.exe
  2⤵
  PID:13024
- C:\Windows\System\rAhaJbg.exe
  C:\Windows\System\rAhaJbg.exe
  2⤵
  PID:13052
- C:\Windows\System\PSxIZCZ.exe
  C:\Windows\System\PSxIZCZ.exe
  2⤵
  PID:13080
- C:\Windows\System\FftsQIW.exe
  C:\Windows\System\FftsQIW.exe
  2⤵
  PID:13108
- C:\Windows\System\uReodKs.exe
  C:\Windows\System\uReodKs.exe
  2⤵
  PID:13136
- C:\Windows\System\LKvgFMq.exe
  C:\Windows\System\LKvgFMq.exe
  2⤵
  PID:13164
- C:\Windows\System\VyDorQU.exe
  C:\Windows\System\VyDorQU.exe
  2⤵
  PID:13192
- C:\Windows\System\WfEgdfC.exe
  C:\Windows\System\WfEgdfC.exe
  2⤵
  PID:13220
- C:\Windows\System\vwsFDTt.exe
  C:\Windows\System\vwsFDTt.exe
  2⤵
  PID:13248
- C:\Windows\System\IJyAkzt.exe
  C:\Windows\System\IJyAkzt.exe
  2⤵
  PID:13276
- C:\Windows\System\bjbrWDU.exe
  C:\Windows\System\bjbrWDU.exe
  2⤵
  PID:13304
- C:\Windows\System\pQUZray.exe
  C:\Windows\System\pQUZray.exe
  2⤵
  PID:12340
- C:\Windows\System\HIgAvqO.exe
  C:\Windows\System\HIgAvqO.exe
  2⤵
  PID:12400
- C:\Windows\System\hFiFGQd.exe
  C:\Windows\System\hFiFGQd.exe
  2⤵
  PID:12460
- C:\Windows\System\SonZsuJ.exe
  C:\Windows\System\SonZsuJ.exe
  2⤵
  PID:12532
- C:\Windows\System\nbKjrYG.exe
  C:\Windows\System\nbKjrYG.exe
  2⤵
  PID:12596
- C:\Windows\System\pGbkWub.exe
  C:\Windows\System\pGbkWub.exe
  2⤵
  PID:12656
- C:\Windows\System\qWEbWrM.exe
  C:\Windows\System\qWEbWrM.exe
  2⤵
  PID:12728
- C:\Windows\System\YMJBiYH.exe
  C:\Windows\System\YMJBiYH.exe
  2⤵
  PID:12796
- C:\Windows\System\WbYIsnQ.exe
  C:\Windows\System\WbYIsnQ.exe
  2⤵
  PID:12852
- C:\Windows\System\apSFajv.exe
  C:\Windows\System\apSFajv.exe
  2⤵
  PID:12952
- C:\Windows\System\YOybKCh.exe
  C:\Windows\System\YOybKCh.exe
  2⤵
  PID:12992
- C:\Windows\System\qvMLnWR.exe
  C:\Windows\System\qvMLnWR.exe
  2⤵
  PID:13064
- C:\Windows\System\PDrbzDl.exe
  C:\Windows\System\PDrbzDl.exe
  2⤵
  PID:13128
- C:\Windows\System\QGXVwMB.exe
  C:\Windows\System\QGXVwMB.exe
  2⤵
  PID:13188
- C:\Windows\System\ZdGhjHh.exe
  C:\Windows\System\ZdGhjHh.exe
  2⤵
  PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbdmfc0k.2nt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ArBmewj.exe

Filesize
3.2MB

MD5
93e2e31204c6f11f0302ae6d02b205d8

SHA1
8c812568724aa3cd07985500b14fb54e78e86b02

SHA256
971be9615b187143fe7899882304a068feb3266b959cca26e2fd2594a94b6e63

SHA512
0de636707c3bf0f5a5afc2f489b887a85c32c36dc588f6beb468c9b41a03230ccf47670617faae173287acc51f21e306fadf7033c2cafcd109c83be70a94e109

Download Submit
C:\Windows\System\FJAiGHA.exe

Filesize
3.2MB

MD5
dab367010d2b615348774624d4fa61bb

SHA1
8df69d6a6a3497f9fb380153f4225623cb576a53

SHA256
ed3c72fc8794b92c1a11ba9e91b9a4b13fd35719d8e74b4519ac60424fd9f7a5

SHA512
151a054c894998ebdccb31ccb4294670bc3eff7792ade66235684494eb41ecd410ec129be002f4110a12823c5f69f64d20fe64e997f0f98e0c6c58a05fe34ca7

Download Submit
C:\Windows\System\GBrDHLR.exe

Filesize
3.2MB

MD5
27dbffcf934ff8f2721940b0d1d01c36

SHA1
9a8121d4152828513f5650f17a2a29dfc082a641

SHA256
02f728c11114e0e46520da7ca82b72c2a3b3e72a181f1c4550eecc88b47fe5bb

SHA512
f82df9aad9797e0737d49c669ecd0e5b0f3d3fd1f2a4f0b7eb76e978af54f47cd466a64e9bc7e345252d928f4669938fd4b9419b53306a8a60d0195bc8f26502

Download Submit
C:\Windows\System\GPQOZQH.exe

Filesize
3.2MB

MD5
6bc78850a34cd422dd831495481875e9

SHA1
1dd70ea2aef1b029e80ab1294685f925f6053b5d

SHA256
01ec5fd78704cc61fe62e921599bd30d1a06abddf8685fd0cf6d1cde6709a9be

SHA512
7977187393e3f5d089c6ed3d304223e51ff3370cd756ed9b9dbac57c90da4b15f0cd3bdfabd17433e3b25d9ca65512b455113c4d279ea82da627f8437a2683b8

Download Submit
C:\Windows\System\KNGnvrl.exe

Filesize
3.2MB

MD5
73464b2dbc2bc8bdad8b39cc5ed3a9d8

SHA1
4d457658468b889e830748c43df39486ffef2f54

SHA256
2932b68b743d6f5d2bcfce805a87b341bd947f8e7e63aa59b9655fc269e3f288

SHA512
86922bd7bb9ac1c12415067caa3a8f44c07490d9d7b407cfefe40fb1c003e777febe85bef54f93bf9b32f41d635ca7479022f18bcf8c590cc44c5d040e4dc2c7

Download Submit
C:\Windows\System\LJlkHjb.exe

Filesize
3.2MB

MD5
f8091f4e64b9d3cb205d2e475ac55b0c

SHA1
445aa2b008fbe68924504207d80c2a70d72e47f9

SHA256
420cb021c6e65d57f03de1c60d107f9231370eeeba0d7689c7ecfd50c0eda08e

SHA512
6004d45eab51fbded29a24727a22cc0e9860fab2b335e178c6d2a420bb5ec4bec9220d33a7618beb1248d6876ff1fbec8568389e3f0c95e58ed6f2427983fd10

Download Submit
C:\Windows\System\MalbFNA.exe

Filesize
3.2MB

MD5
891e443bcc527d0d8fad5980d5a87409

SHA1
bdaf5002fde543d0398bcb022eda78e7d4bc1712

SHA256
5631aca8e8f8798378cbd5b819cec6dbaddd3d0d23079b89b79a9a8d92e93342

SHA512
48db4b4c96313be582772c8e6dee05499670e7ed41e1d3e75c34234a84acfd37fd551b66b1f89d08b6fba0b0f544041d34b478b06bfafcf39643b17713fa3531

Download Submit
C:\Windows\System\MpjjnOr.exe

Filesize
3.2MB

MD5
1064ad1e3c0159d7ef56e2f45f486af3

SHA1
e32bc84b6dfdfd603677904367bb361e1d27e991

SHA256
83d13ffc98b0e6a50960d0309c044f19260ac3721defb78551cbf2857662e69e

SHA512
946748f863a7d6e43be0b805af4510f30c54bc0b8bae91f730eb5338537add36f9a823501a41cd5a0a90d42c22e8020a8e63d171c047a0dce411adad8acb924a

Download Submit
C:\Windows\System\OCdrtNm.exe

Filesize
3.2MB

MD5
b256e5cf7d102a3731db2925caac28ba

SHA1
0577bc08cb5a0cef9add8a8a1c51010fd5ca49c9

SHA256
9c4cf1e5afb36d838eea337bc5107aa69efd87456d8e49ad68ef603a7bc2c721

SHA512
0e869179b93efb97c0a491bbd06dea5933a3dd76ef40b1308f757f739cdb20cebcdcda530dfa9bae0f71ff64a19f8cff2734c92b0c5c188923adea81062e514a

Download Submit
C:\Windows\System\ORxTgFG.exe

Filesize
3.2MB

MD5
5de6944499714206fcaa5d47102545d3

SHA1
b15a0f3be2f346719ce4c55fe98072b9eaa3bdee

SHA256
505dd0ccd493f06a16bc65a3a5297f075c83e787567f72261b2629590321a1a3

SHA512
a3ad50d218d76f12f589b4e7fcd00e4785f65d6ea5c0d90e6173d594a9807a14697cee217c38341cdc26de16e556e60744ff2d53d27b233c63f9c6ae168955e2

Download Submit
C:\Windows\System\ScqwJoW.exe

Filesize
3.2MB

MD5
c7e39dd6963e3d03ea9f89774f6146ea

SHA1
edc3ca3abaf990f58e000d7ea7a96e217ec608b8

SHA256
6f1eed660c61df8499500867432126f3e96da7f3d2bceaa2bdb9a22d20dfac81

SHA512
97c138c6011a3f05bd4da76d42bd5f095fb4c5dbd9671624bc95aeb91c92b359facc6b0c99013d53b2987ed7f9023441ba4eb286f71e0b3b0bf6d6ee49362f95

Download Submit
C:\Windows\System\StnrXHG.exe

Filesize
3.2MB

MD5
77d6cd3d58b712f99365b323db166a72

SHA1
ac5595a4aed0b7b6bf8727b351ec6d8bacaf72b5

SHA256
f05fd53daad60b734d00142368b76fe1f2d88a0c94376e520ff186cb5c9cbccc

SHA512
6eb681bc3c016f0c80b0187971774c66a020ad0ab1f2add874efeec7b358e4460a41a02ad29028852ce24f126dc65d67d2619decfd136ece4347ba4e9d4efb92

Download Submit
C:\Windows\System\UAIUUxN.exe

Filesize
3.2MB

MD5
96af908218b498b36ea4f1e7ed2fb04f

SHA1
68f528636bf1efad116ebb875dd7aa2da31160ae

SHA256
763dc0fd2dcd92598263622fbca25bc977e00535fedd0526f1f53cbee79d9bf9

SHA512
bed6bf408dee831756fcc06e619b50034fc43053300b9e6904e8312b09a90e2fe538fb41c96a94a07543a3e5528e94d0b99a81c5d3bd5c912f9de4f78a5fe6c1

Download Submit
C:\Windows\System\UYBDiwm.exe

Filesize
3.2MB

MD5
172918253e92dcc47741882a661e903e

SHA1
0e1d9a4c2297965c96d9c9afdf1c5b571c1afcf6

SHA256
1c339b5b107a84d3cd43f02b2bf7d85be2d6d59d8abd4d529d168d896efb7b12

SHA512
425fd71e7ca65f2b83e8888ac6dae7a39afd242cdfd6790974450494023fb11bfc1fffcb225d94217338212711c06957e9d805ab61cae0e449c43a4733359ace

Download Submit
C:\Windows\System\VBtOlZs.exe

Filesize
3.2MB

MD5
20f0b78a61ab2a111d03dc4a704be328

SHA1
88cac775780904e87bcc2716a3e2db8fe00e05a3

SHA256
16d3c62f42b642873c6eb6fbbb4bda4ac877752933d8a8c4211854e753dbbb88

SHA512
c0358cec0b77e076c2c2241a644e7a85442200857422fb79e3d179f3da93a454027e5a5fcacab33c23521b1182f4572c46a83b7c04ecd8df92338c67b0e2b9de

Download Submit
C:\Windows\System\VCXmXRG.exe

Filesize
3.2MB

MD5
4459b9e75d0abcf7f4d458a5c59dec52

SHA1
d7b242be00adab9ec6add108380550a97d3aaad4

SHA256
e49f4b7a56444e0cc0bf06a54d9aaca924e7d307fc52294436f7dd151be13bbd

SHA512
2de8ed568a70a7ce31266335f0f74791501433517ac913f495ad590ae2e93cccc7deb0d520ff523a32fda24a5acbdf88c6448d4d741601cb512e70ece02d8312

Download Submit
C:\Windows\System\YZaNVIB.exe

Filesize
3.2MB

MD5
7d85a3e2e14d2acdad742c4045b7f96f

SHA1
834e09674993668f15a5efa9d571c1ea0169f4b6

SHA256
d5db6b4e264340ff5346eabd6f4ef91dcc97a7ea1030f4bb03cdaf5ccc87be42

SHA512
24112116fb08932b87e9090381a9c1e9746e966c3d3ee1d347260cb6e20b6ce84497c8f34aff1e5f62ef4be3ca4f843f4a0973d81fea9dca5e15877d95abd85e

Download Submit
C:\Windows\System\ZLMgRcd.exe

Filesize
3.2MB

MD5
b0dc7afc22dba808b18628eb40322f56

SHA1
d5417f937294c59e7fba55b96402b1c29964e72e

SHA256
a9f70a715e50e3615cfe7dd8ef24c8a24e401e40bc3f334e7455d420937c707c

SHA512
bc6ffe5cd3828330bfa78b6ab6bdc54dd41091818d1758fc560cb049e8cdbfc459066dd99acdf18520f35104e94285cc08c7d3c00c60fd339e64c46c63728f1c

Download Submit
C:\Windows\System\dCOtYnj.exe

Filesize
3.2MB

MD5
434be1e0d4b63e003e10136e30391a5a

SHA1
41395117bec19fbf636411bae6510027f15ba2ce

SHA256
e4b6927027e448e4a931489e3130b090e62a463f217dbe27dfbd921149d60fc2

SHA512
42add70c82662f27ab7de6b349a425066a20895354bae88db9888c18e3556f45cd9505adc55f6a121e0424b45224d5a80f6beba0340b54861a88ede7cd49a95b

Download Submit
C:\Windows\System\eHejGnP.exe

Filesize
3.2MB

MD5
6be61db8f867d5b7ec97e5ff0b308369

SHA1
2389aefb7fa10838521265667392219dae5a484a

SHA256
8e7b48019dfae19d0eb9c2eaa02076755e6848659a9d507cf865ea0bb3cfa11f

SHA512
120b1ed169ff3e4167c086e47e476ec0ca16aff2693dfb159ed53d1fcf946d5a7007235101f822b920772d6de09080725e8f27327484f64a8fd3930ca5c2e367

Download Submit
C:\Windows\System\fdHYBJk.exe

Filesize
3.2MB

MD5
880a731ad51f3be341a249e0ad1bd14c

SHA1
f4efbbb68086fd27308c181ed08adee5e92222d7

SHA256
2c5fc84e11f39473a10d4618901908f2a6e08871fa129a10dbdf2a87a5cb8d5f

SHA512
9625114e891ea9e6df09fea74c19eee3ae63b16383022dd3e0be08b023c166c07c7dad9a6242f9a68b98aa316d3a842ef7bd387c093dbd8194132faec69dd0e3

Download Submit
C:\Windows\System\fphwmLu.exe

Filesize
3.2MB

MD5
60ba599e08216a912d349972a8a65303

SHA1
a2cbb42931f86a84b4b7c54ae56fa6a7d00c2139

SHA256
83b380a45b63493025ce656508427c1cdf2a703e66824217c8e7ba64205c6ac8

SHA512
2dbbdc55ef7b6254200dfb2c0b0d61dde4a01db091ef265ca59696fd5cab06c8e86253f811ed0166589465a3b88ed6829fd0bf4cf1e394d6f55ae9735f2d3a17

Download Submit
C:\Windows\System\gqHvwBf.exe

Filesize
3.2MB

MD5
45c29db2d11119e7c346681ae91ab7da

SHA1
7519458c8632d07629f708b554432def2d941bbe

SHA256
64c1965bbaa5ab4c6f15580c5a16e5ea0fb81fbe285b2f2c7479490ad29a1586

SHA512
a03cab4871f3e56940995c0a98d6c3da8ef4e9e3e72dcdcb73c3d38021be59fb884ebc325be16122dabc559d07749d63709eafbf92c2dbaacd0419a824b7083b

Download Submit
C:\Windows\System\hUHmtyO.exe

Filesize
3.2MB

MD5
5cfe48a535213ad2c5bc304d5a544d7a

SHA1
eecefd7e89c84c89ea996d709a4e30b487ef587a

SHA256
e0dc2671e8649152d382f0d7fffd893eee4fa97ddf78b16280ee986b0d803665

SHA512
152e3f1b5b66286022dc0ad19c6488742d8e6eeb06e71a150852bd48aff9e7cd1e55f45fcfeb48294f04e4b9a6acd65bd739d0ba310025b673990dbecb779853

Download Submit
C:\Windows\System\jzuuDWV.exe

Filesize
3.2MB

MD5
c9c214503e1392e14f9157bad2c9fdad

SHA1
34d12a25b69c98feae77a14843d5ee8a20fe038b

SHA256
49e91ec3bf93b6e554bffa2460c88afc42e41d5e469b2023f9913cd9b45df150

SHA512
3465bd92d0b3864620fa5cf22fb654d990484e96efc07aa23b103e811820e07737d708082a9c47fbe5fb8ea6cc895a201b25ed275a596b73b6ffdfdb80c3693a

Download Submit
C:\Windows\System\lzwzpCh.exe

Filesize
3.2MB

MD5
0c67bbbb2fda9c9d62f0c77d9effc6d7

SHA1
7d156a362f06d604860a67ab4d503bdb0d548d9c

SHA256
80294435f29e96037faae8c0723e7f438a64a929e50793d66a5ecd2d151005d9

SHA512
e6fc124f00b3b737eb679957bef3531a00498092a977e6aa16f1946a6ac86225cafd4ee8a63a7ec1058fd16f5cf40bf214abfde7ab5bb50d6483588b1c8547e1

Download Submit
C:\Windows\System\rPxIOaJ.exe

Filesize
3.2MB

MD5
fea5aa01b14dafd225dddf792ed10045

SHA1
865c1ca1d9f9eaf5f66ee1f67244ca0a5a4ea075

SHA256
c36384de2ec8dbf55a752d632ea8e0959f3adeee09a7325c60b4990f5133383a

SHA512
16cef65ddae1ed84b2eb68a6d606cad87ff422166d16418a032de9d38b6229c800bb01e36c9fa7a67f8efa613dfafa39d250fd70145276b0cf3bf8a690f2e578

Download Submit
C:\Windows\System\rnecneP.exe

Filesize
3.2MB

MD5
cf5f4259cb40759bb9c348334068ac7a

SHA1
f51aa65a1241f80933db7081e410f0110686da3c

SHA256
6dae6e642649dde2250c2a7103c2ffe6f8e6cbd5a50cdb5927bd0d08c5d250a2

SHA512
f43c24ad0f26c73b1f2236dbc0a5d7abdbb1d894e960ebd0230f02eec5136daaf632ca7edb9e3d92d7d7c594251151bc6dee1879e01528e396e8f0ba30f60d34

Download Submit
C:\Windows\System\usXXxxS.exe

Filesize
3.2MB

MD5
7f64339c7ce11e9c089a5d16ef3c71e3

SHA1
ab7f00ec6ff21154936addea05f4a09b2cc9bc68

SHA256
04b449527f88c1e07fea946c11fff7c3b0ede6920219f6e448d7944d97683110

SHA512
15e4542a569981b76cd896c83c54d4ee18b88c27ae9be658b29717419ce0f637959d68be0dbbaeb96922defea6b70a99dd2d697b6463d567b730b57b9b7f0cd7

Download Submit
C:\Windows\System\vWmIMOH.exe

Filesize
3.2MB

MD5
914a7ccdf23b8aa58fd939bce1c5d61a

SHA1
2e68baa85f6a2272da9e13a79743f3669e1629ea

SHA256
367101511b3d37f762bcc4c0078c43f185659d9014b524637de0e6c42ae60992

SHA512
adce57ab88fc8a77cec2771ac8274894c6210ef935beed2f1bae95df9dff8fced2a83aec46d2e67824a017805a1925c135e4b7c0a6046a3dbd404806e00a5b92

Download Submit
C:\Windows\System\yNtXCOp.exe

Filesize
3.2MB

MD5
065ca58c5d9229f44ef6890be06e37f5

SHA1
e21b69a685225cee3e57e4ccd0b78382ff1b55cb

SHA256
ff7269298f3b3c2e9af1482ddde4383497fd929db663efbc818c74a65aac88ec

SHA512
f7e2f56ddd0c01fa0d01c7ba6bcc1e74137ee76e5c89c2ee5fe1609514c32169769ea6dda46505cd9db15fda7325fcb86f7bcaa28cbb016068ff509df85e32be

Download Submit
C:\Windows\System\yczDdFs.exe

Filesize
3.2MB

MD5
2c486fb3fede896fa8de51570391d226

SHA1
9829aa155882550ebaf004beee9bcd087c52b609

SHA256
2aa2f4e372e25a4a8da16abbaed0de0a1f5b853d4affdef030de5dc273d7a4ae

SHA512
ebebc37d8efc0c7b6f7680772c664532ab73246283f8e6b700d69e5eba8085ad42d81f52c241f2cd882b9c07112914a389cef43b1169fe6cd3ee038fda3ec725

Download Submit
memory/224-350-0x00007FF7E9EF0000-0x00007FF7EA2E6000-memory.dmp

Filesize
4.0MB

Download
memory/224-2242-0x00007FF7E9EF0000-0x00007FF7EA2E6000-memory.dmp

Filesize
4.0MB

Download
memory/468-1028-0x00007FFFA8223000-0x00007FFFA8225000-memory.dmp

Filesize
8KB

Download
memory/468-111-0x000001AAB0C40000-0x000001AAB13E6000-memory.dmp

Filesize
7.6MB

Download
memory/468-42-0x00007FFFA8220000-0x00007FFFA8CE1000-memory.dmp

Filesize
10.8MB

Download
memory/468-5-0x00007FFFA8223000-0x00007FFFA8225000-memory.dmp

Filesize
8KB

Download
memory/468-31-0x00007FFFA8220000-0x00007FFFA8CE1000-memory.dmp

Filesize
10.8MB

Download
memory/468-19-0x000001AAAFFF0000-0x000001AAB0012000-memory.dmp

Filesize
136KB

Download
memory/468-388-0x00007FFFA8220000-0x00007FFFA8CE1000-memory.dmp

Filesize
10.8MB

Download
memory/912-107-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp

Filesize
4.0MB

Download
memory/912-2225-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp

Filesize
4.0MB

Download
memory/936-2222-0x00007FF6E35A0000-0x00007FF6E3996000-memory.dmp

Filesize
4.0MB

Download
memory/936-46-0x00007FF6E35A0000-0x00007FF6E3996000-memory.dmp

Filesize
4.0MB

Download
memory/1016-2224-0x00007FF621530000-0x00007FF621926000-memory.dmp

Filesize
4.0MB

Download
memory/1016-54-0x00007FF621530000-0x00007FF621926000-memory.dmp

Filesize
4.0MB

Download
memory/1084-105-0x00007FF679EB0000-0x00007FF67A2A6000-memory.dmp

Filesize
4.0MB

Download
memory/1084-2234-0x00007FF679EB0000-0x00007FF67A2A6000-memory.dmp

Filesize
4.0MB

Download
memory/1508-211-0x00007FF62FFB0000-0x00007FF6303A6000-memory.dmp

Filesize
4.0MB

Download
memory/1508-2236-0x00007FF62FFB0000-0x00007FF6303A6000-memory.dmp

Filesize
4.0MB

Download
memory/1680-2232-0x00007FF67C030000-0x00007FF67C426000-memory.dmp

Filesize
4.0MB

Download
memory/1680-110-0x00007FF67C030000-0x00007FF67C426000-memory.dmp

Filesize
4.0MB

Download
memory/2244-109-0x00007FF78E170000-0x00007FF78E566000-memory.dmp

Filesize
4.0MB

Download
memory/2244-2229-0x00007FF78E170000-0x00007FF78E566000-memory.dmp

Filesize
4.0MB

Download
memory/2436-2231-0x00007FF781170000-0x00007FF781566000-memory.dmp

Filesize
4.0MB

Download
memory/2436-95-0x00007FF781170000-0x00007FF781566000-memory.dmp

Filesize
4.0MB

Download
memory/2596-1-0x00000238EC460000-0x00000238EC470000-memory.dmp

Filesize
64KB

Download
memory/2596-0-0x00007FF7333E0000-0x00007FF7337D6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-765-0x00007FF7333E0000-0x00007FF7337D6000-memory.dmp

Filesize
4.0MB

Download
memory/2604-2221-0x00007FF7C7AA0000-0x00007FF7C7E96000-memory.dmp

Filesize
4.0MB

Download
memory/2604-53-0x00007FF7C7AA0000-0x00007FF7C7E96000-memory.dmp

Filesize
4.0MB

Download
memory/2968-108-0x00007FF68E770000-0x00007FF68EB66000-memory.dmp

Filesize
4.0MB

Download
memory/2968-2230-0x00007FF68E770000-0x00007FF68EB66000-memory.dmp

Filesize
4.0MB

Download
memory/3012-2241-0x00007FF726460000-0x00007FF726856000-memory.dmp

Filesize
4.0MB

Download
memory/3012-349-0x00007FF726460000-0x00007FF726856000-memory.dmp

Filesize
4.0MB

Download
memory/3012-2218-0x00007FF726460000-0x00007FF726856000-memory.dmp

Filesize
4.0MB

Download
memory/3024-2238-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp

Filesize
4.0MB

Download
memory/3024-1929-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp

Filesize
4.0MB

Download
memory/3024-227-0x00007FF7FF3E0000-0x00007FF7FF7D6000-memory.dmp

Filesize
4.0MB

Download
memory/3100-2217-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp

Filesize
4.0MB

Download
memory/3100-2239-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp

Filesize
4.0MB

Download
memory/3100-228-0x00007FF7F83A0000-0x00007FF7F8796000-memory.dmp

Filesize
4.0MB

Download
memory/3212-2219-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp

Filesize
4.0MB

Download
memory/3212-2243-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp

Filesize
4.0MB

Download
memory/3212-367-0x00007FF6E88A0000-0x00007FF6E8C96000-memory.dmp

Filesize
4.0MB

Download
memory/3624-2233-0x00007FF78CA80000-0x00007FF78CE76000-memory.dmp

Filesize
4.0MB

Download
memory/3624-103-0x00007FF78CA80000-0x00007FF78CE76000-memory.dmp

Filesize
4.0MB

Download
memory/4064-2223-0x00007FF64A3B0000-0x00007FF64A7A6000-memory.dmp

Filesize
4.0MB

Download
memory/4064-61-0x00007FF64A3B0000-0x00007FF64A7A6000-memory.dmp

Filesize
4.0MB

Download
memory/4236-215-0x00007FF6509E0000-0x00007FF650DD6000-memory.dmp

Filesize
4.0MB

Download
memory/4236-2237-0x00007FF6509E0000-0x00007FF650DD6000-memory.dmp

Filesize
4.0MB

Download
memory/4284-99-0x00007FF697B20000-0x00007FF697F16000-memory.dmp

Filesize
4.0MB

Download
memory/4284-2227-0x00007FF697B20000-0x00007FF697F16000-memory.dmp

Filesize
4.0MB

Download
memory/4316-2220-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4316-106-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4612-98-0x00007FF7B78A0000-0x00007FF7B7C96000-memory.dmp

Filesize
4.0MB

Download
memory/4612-2226-0x00007FF7B78A0000-0x00007FF7B7C96000-memory.dmp

Filesize
4.0MB

Download
memory/4796-2228-0x00007FF6E2D00000-0x00007FF6E30F6000-memory.dmp

Filesize
4.0MB

Download
memory/4796-96-0x00007FF6E2D00000-0x00007FF6E30F6000-memory.dmp

Filesize
4.0MB

Download
memory/5056-2235-0x00007FF6F45A0000-0x00007FF6F4996000-memory.dmp

Filesize
4.0MB

Download
memory/5056-104-0x00007FF6F45A0000-0x00007FF6F4996000-memory.dmp

Filesize
4.0MB

Download
memory/5092-2240-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp

Filesize
4.0MB

Download
memory/5092-359-0x00007FF64A760000-0x00007FF64AB56000-memory.dmp

Filesize
4.0MB

Download