xmrig | 79613bc3dc8f9a8133ca9d5ba54a22825ba5ac3436f04b5b59e7e570fad13e84

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
Size

2.9MB
MD5

51a13cc776e992d3b9ed0649bf5bb450
SHA1

e887564ed98b92f29723956cc904722879e9cde9
SHA256

79613bc3dc8f9a8133ca9d5ba54a22825ba5ac3436f04b5b59e7e570fad13e84
SHA512

bfe533fa68dffd2e639973b23d90c390363d5953412bed2538172063c4d0f9bdad4856d18c3cb4cbaefef89d118bff0459a5b5ff0e32c61d282c7243ed45c8ef
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mlF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4276-0-0x00007FF6CA010000-0x00007FF6CA406000-memory.dmp	xmrig
behavioral2/files/0x0005000000022975-7.dat	xmrig
behavioral2/files/0x000a0000000232f5-9.dat	xmrig
behavioral2/memory/2568-15-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp	xmrig
behavioral2/files/0x00080000000232fc-19.dat	xmrig
behavioral2/files/0x00080000000232fb-18.dat	xmrig
behavioral2/memory/3580-21-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp	xmrig
behavioral2/files/0x00080000000232fe-28.dat	xmrig
behavioral2/files/0x00080000000232ff-34.dat	xmrig
behavioral2/files/0x00070000000235d9-57.dat	xmrig
behavioral2/files/0x00070000000235da-64.dat	xmrig
behavioral2/files/0x00070000000235dc-88.dat	xmrig
behavioral2/files/0x00080000000235df-98.dat	xmrig
behavioral2/files/0x00070000000235e1-108.dat	xmrig
behavioral2/files/0x00070000000235e4-122.dat	xmrig
behavioral2/files/0x00070000000235e5-133.dat	xmrig
behavioral2/files/0x00070000000235e7-143.dat	xmrig
behavioral2/memory/1116-645-0x00007FF7F0460000-0x00007FF7F0856000-memory.dmp	xmrig
behavioral2/memory/1112-646-0x00007FF73C3E0000-0x00007FF73C7D6000-memory.dmp	xmrig
behavioral2/memory/4468-647-0x00007FF6A8D40000-0x00007FF6A9136000-memory.dmp	xmrig
behavioral2/memory/4112-653-0x00007FF6FBA60000-0x00007FF6FBE56000-memory.dmp	xmrig
behavioral2/memory/1948-663-0x00007FF66A560000-0x00007FF66A956000-memory.dmp	xmrig
behavioral2/memory/1084-669-0x00007FF6098A0000-0x00007FF609C96000-memory.dmp	xmrig
behavioral2/memory/1236-671-0x00007FF742E90000-0x00007FF743286000-memory.dmp	xmrig
behavioral2/memory/4840-705-0x00007FF7031A0000-0x00007FF703596000-memory.dmp	xmrig
behavioral2/memory/2596-712-0x00007FF6ED320000-0x00007FF6ED716000-memory.dmp	xmrig
behavioral2/memory/2284-713-0x00007FF651270000-0x00007FF651666000-memory.dmp	xmrig
behavioral2/memory/4412-728-0x00007FF6C9230000-0x00007FF6C9626000-memory.dmp	xmrig
behavioral2/memory/3720-737-0x00007FF622C80000-0x00007FF623076000-memory.dmp	xmrig
behavioral2/memory/1752-734-0x00007FF747510000-0x00007FF747906000-memory.dmp	xmrig
behavioral2/memory/3396-722-0x00007FF7A7A50000-0x00007FF7A7E46000-memory.dmp	xmrig
behavioral2/memory/4632-695-0x00007FF7B0560000-0x00007FF7B0956000-memory.dmp	xmrig
behavioral2/memory/2708-690-0x00007FF6D3C60000-0x00007FF6D4056000-memory.dmp	xmrig
behavioral2/memory/3220-685-0x00007FF61B9C0000-0x00007FF61BDB6000-memory.dmp	xmrig
behavioral2/memory/5100-676-0x00007FF6D76B0000-0x00007FF6D7AA6000-memory.dmp	xmrig
behavioral2/memory/828-744-0x00007FF647C40000-0x00007FF648036000-memory.dmp	xmrig
behavioral2/memory/3088-648-0x00007FF615BE0000-0x00007FF615FD6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ef-177.dat	xmrig
behavioral2/files/0x00070000000235ed-175.dat	xmrig
behavioral2/files/0x00070000000235ee-172.dat	xmrig
behavioral2/files/0x00070000000235ec-165.dat	xmrig
behavioral2/files/0x00070000000235eb-163.dat	xmrig
behavioral2/files/0x00070000000235ea-158.dat	xmrig
behavioral2/files/0x00070000000235e9-153.dat	xmrig
behavioral2/files/0x00070000000235e8-148.dat	xmrig
behavioral2/files/0x00070000000235e6-138.dat	xmrig
behavioral2/files/0x00080000000235de-123.dat	xmrig
behavioral2/files/0x00070000000235e3-118.dat	xmrig
behavioral2/files/0x00070000000235e2-113.dat	xmrig
behavioral2/files/0x00070000000235e0-103.dat	xmrig
behavioral2/files/0x00070000000235dd-93.dat	xmrig
behavioral2/files/0x00070000000235db-82.dat	xmrig
behavioral2/files/0x00070000000235d8-58.dat	xmrig
behavioral2/files/0x00070000000235d7-52.dat	xmrig
behavioral2/files/0x00080000000235d6-48.dat	xmrig
behavioral2/files/0x000d0000000233b3-45.dat	xmrig
behavioral2/memory/3908-27-0x00007FF647510000-0x00007FF647906000-memory.dmp	xmrig
behavioral2/memory/4864-20-0x00007FF6A3080000-0x00007FF6A3476000-memory.dmp	xmrig
behavioral2/memory/2568-1925-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp	xmrig
behavioral2/memory/3580-1926-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp	xmrig
behavioral2/memory/3908-1927-0x00007FF647510000-0x00007FF647906000-memory.dmp	xmrig
behavioral2/memory/4864-2224-0x00007FF6A3080000-0x00007FF6A3476000-memory.dmp	xmrig
behavioral2/memory/2568-2225-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp	xmrig
behavioral2/memory/3908-2226-0x00007FF647510000-0x00007FF647906000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2468	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2568	xLWtbGl.exe
4864	DyhPwfr.exe
3908	qsHNTBD.exe
3580	qcrLJAt.exe
1116	wsAvWcj.exe
828	widHKmr.exe
1112	DzlBasO.exe
4468	HbYPIEq.exe
3088	WDJRmfP.exe
4112	ZblEjmC.exe
1948	tZXCTYK.exe
1084	yASJQwx.exe
1236	FTtxTLA.exe
5100	nRlWIlu.exe
3220	QjhygsN.exe
2708	qJKxeSJ.exe
4632	YzvnSNQ.exe
4840	zslwfBA.exe
2596	VPOKtbc.exe
2284	TvQHgKt.exe
3396	WiBbhpO.exe
4412	nVQOFZl.exe
1752	utBphkc.exe
3720	pjRjIQD.exe
1744	jMTtQOI.exe
4320	IQzCjcs.exe
1248	SOVHDHe.exe
2044	lFOoqkU.exe
328	bvfGfnp.exe
4380	iAFeQgu.exe
2124	sMMbaNn.exe
4668	uEeGpna.exe
2032	JCEkrgk.exe
4832	ReHtbXu.exe
3600	JhpfBkt.exe
1164	QswhhDK.exe
2324	JXpBItn.exe
1688	XwigULb.exe
5000	pLSTstQ.exe
3660	MNztbCt.exe
2620	hmTpYzp.exe
4124	VhyNQTV.exe
4736	GQmZjKq.exe
1340	zQxbnOW.exe
5132	EvMAQBe.exe
5160	niPHxzW.exe
5188	cNYbyxk.exe
5216	JvQadvv.exe
5240	peARwvg.exe
5268	uIQDAsu.exe
5296	HUWGmOO.exe
5324	WEhavmQ.exe
5352	FElxTNC.exe
5380	rUITYWd.exe
5408	wCXfDqa.exe
5440	TMuDNIG.exe
5468	guhKlQU.exe
5496	WEmOfXu.exe
5524	pLBilqa.exe
5552	gdAgPAK.exe
5580	kzzeGki.exe
5608	GuUXxXN.exe
5636	yHVfNif.exe
5664	gYKYSjo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4276-0-0x00007FF6CA010000-0x00007FF6CA406000-memory.dmp	upx
behavioral2/files/0x0005000000022975-7.dat	upx
behavioral2/files/0x000a0000000232f5-9.dat	upx
behavioral2/memory/2568-15-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp	upx
behavioral2/files/0x00080000000232fc-19.dat	upx
behavioral2/files/0x00080000000232fb-18.dat	upx
behavioral2/memory/3580-21-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp	upx
behavioral2/files/0x00080000000232fe-28.dat	upx
behavioral2/files/0x00080000000232ff-34.dat	upx
behavioral2/files/0x00070000000235d9-57.dat	upx
behavioral2/files/0x00070000000235da-64.dat	upx
behavioral2/files/0x00070000000235dc-88.dat	upx
behavioral2/files/0x00080000000235df-98.dat	upx
behavioral2/files/0x00070000000235e1-108.dat	upx
behavioral2/files/0x00070000000235e4-122.dat	upx
behavioral2/files/0x00070000000235e5-133.dat	upx
behavioral2/files/0x00070000000235e7-143.dat	upx
behavioral2/memory/1116-645-0x00007FF7F0460000-0x00007FF7F0856000-memory.dmp	upx
behavioral2/memory/1112-646-0x00007FF73C3E0000-0x00007FF73C7D6000-memory.dmp	upx
behavioral2/memory/4468-647-0x00007FF6A8D40000-0x00007FF6A9136000-memory.dmp	upx
behavioral2/memory/4112-653-0x00007FF6FBA60000-0x00007FF6FBE56000-memory.dmp	upx
behavioral2/memory/1948-663-0x00007FF66A560000-0x00007FF66A956000-memory.dmp	upx
behavioral2/memory/1084-669-0x00007FF6098A0000-0x00007FF609C96000-memory.dmp	upx
behavioral2/memory/1236-671-0x00007FF742E90000-0x00007FF743286000-memory.dmp	upx
behavioral2/memory/4840-705-0x00007FF7031A0000-0x00007FF703596000-memory.dmp	upx
behavioral2/memory/2596-712-0x00007FF6ED320000-0x00007FF6ED716000-memory.dmp	upx
behavioral2/memory/2284-713-0x00007FF651270000-0x00007FF651666000-memory.dmp	upx
behavioral2/memory/4412-728-0x00007FF6C9230000-0x00007FF6C9626000-memory.dmp	upx
behavioral2/memory/3720-737-0x00007FF622C80000-0x00007FF623076000-memory.dmp	upx
behavioral2/memory/1752-734-0x00007FF747510000-0x00007FF747906000-memory.dmp	upx
behavioral2/memory/3396-722-0x00007FF7A7A50000-0x00007FF7A7E46000-memory.dmp	upx
behavioral2/memory/4632-695-0x00007FF7B0560000-0x00007FF7B0956000-memory.dmp	upx
behavioral2/memory/2708-690-0x00007FF6D3C60000-0x00007FF6D4056000-memory.dmp	upx
behavioral2/memory/3220-685-0x00007FF61B9C0000-0x00007FF61BDB6000-memory.dmp	upx
behavioral2/memory/5100-676-0x00007FF6D76B0000-0x00007FF6D7AA6000-memory.dmp	upx
behavioral2/memory/828-744-0x00007FF647C40000-0x00007FF648036000-memory.dmp	upx
behavioral2/memory/3088-648-0x00007FF615BE0000-0x00007FF615FD6000-memory.dmp	upx
behavioral2/files/0x00070000000235ef-177.dat	upx
behavioral2/files/0x00070000000235ed-175.dat	upx
behavioral2/files/0x00070000000235ee-172.dat	upx
behavioral2/files/0x00070000000235ec-165.dat	upx
behavioral2/files/0x00070000000235eb-163.dat	upx
behavioral2/files/0x00070000000235ea-158.dat	upx
behavioral2/files/0x00070000000235e9-153.dat	upx
behavioral2/files/0x00070000000235e8-148.dat	upx
behavioral2/files/0x00070000000235e6-138.dat	upx
behavioral2/files/0x00080000000235de-123.dat	upx
behavioral2/files/0x00070000000235e3-118.dat	upx
behavioral2/files/0x00070000000235e2-113.dat	upx
behavioral2/files/0x00070000000235e0-103.dat	upx
behavioral2/files/0x00070000000235dd-93.dat	upx
behavioral2/files/0x00070000000235db-82.dat	upx
behavioral2/files/0x00070000000235d8-58.dat	upx
behavioral2/files/0x00070000000235d7-52.dat	upx
behavioral2/files/0x00080000000235d6-48.dat	upx
behavioral2/files/0x000d0000000233b3-45.dat	upx
behavioral2/memory/3908-27-0x00007FF647510000-0x00007FF647906000-memory.dmp	upx
behavioral2/memory/4864-20-0x00007FF6A3080000-0x00007FF6A3476000-memory.dmp	upx
behavioral2/memory/2568-1925-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp	upx
behavioral2/memory/3580-1926-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp	upx
behavioral2/memory/3908-1927-0x00007FF647510000-0x00007FF647906000-memory.dmp	upx
behavioral2/memory/4864-2224-0x00007FF6A3080000-0x00007FF6A3476000-memory.dmp	upx
behavioral2/memory/2568-2225-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp	upx
behavioral2/memory/3908-2226-0x00007FF647510000-0x00007FF647906000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ReHtbXu.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\iRRZMaB.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\qBfHWaw.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\EvMAQBe.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\bKlvSCw.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\tyNtpvL.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\AwumBxV.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\wRiflon.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\oZPxUzz.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\KcmtRKC.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\AgyQcVH.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\Agyfuez.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\GWBxqoB.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\wlcVmIU.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\EonXBVa.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\JpEYQqT.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\IHYfTWm.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\lZnViGB.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\JinBIOV.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\IhEaWwS.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\zlhFVjQ.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\KTUhiVd.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\EbyaExH.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\LMjadYL.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\XBHgGPy.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\nEDYAmT.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\iUWTqyL.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\WdoKuPZ.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\kVGYCAc.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\Pqcrves.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\YXgJfex.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\YOPDsnt.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\GBxITyO.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\EabIKit.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\jgUBvFT.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\DlARndA.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\OMqQbcs.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\oJveUqV.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\WtjBsKj.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\dRsawWd.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\cfKpRkg.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\ylKrufN.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\THzVdbH.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\bonBEDp.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\MFdlWaz.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\FsDzeCH.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\WPKqnnZ.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\TggIRMW.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\VXLpqCa.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\IsRoWnF.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\rZWxhFT.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\iOvqhqo.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\OxdZjGh.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\eVCJcyO.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\nMKmqeY.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\HSMPxPu.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\ImeWARw.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\xtYgBTP.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\wsAvWcj.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\EejTQvf.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\RGetjYQ.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\SvlNZFV.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\thJFGQM.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
File created	C:\Windows\System\tmFrzaI.exe	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2468	powershell.exe
2468	powershell.exe
2468	powershell.exe
2468	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
Token: SeDebugPrivilege	2468	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 2468	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	92
PID 4276 wrote to memory of 2468	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	92
PID 4276 wrote to memory of 2568	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	93
PID 4276 wrote to memory of 2568	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	93
PID 4276 wrote to memory of 4864	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	94
PID 4276 wrote to memory of 4864	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	94
PID 4276 wrote to memory of 3908	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	95
PID 4276 wrote to memory of 3908	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	95
PID 4276 wrote to memory of 3580	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	96
PID 4276 wrote to memory of 3580	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	96
PID 4276 wrote to memory of 1116	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	97
PID 4276 wrote to memory of 1116	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	97
PID 4276 wrote to memory of 828	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	98
PID 4276 wrote to memory of 828	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	98
PID 4276 wrote to memory of 1112	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	99
PID 4276 wrote to memory of 1112	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	99
PID 4276 wrote to memory of 4468	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	100
PID 4276 wrote to memory of 4468	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	100
PID 4276 wrote to memory of 3088	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	101
PID 4276 wrote to memory of 3088	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	101
PID 4276 wrote to memory of 4112	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	102
PID 4276 wrote to memory of 4112	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	102
PID 4276 wrote to memory of 1948	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	103
PID 4276 wrote to memory of 1948	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	103
PID 4276 wrote to memory of 1084	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	104
PID 4276 wrote to memory of 1084	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	104
PID 4276 wrote to memory of 1236	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	105
PID 4276 wrote to memory of 1236	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	105
PID 4276 wrote to memory of 5100	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	106
PID 4276 wrote to memory of 5100	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	106
PID 4276 wrote to memory of 3220	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	107
PID 4276 wrote to memory of 3220	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	107
PID 4276 wrote to memory of 2708	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	108
PID 4276 wrote to memory of 2708	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	108
PID 4276 wrote to memory of 4632	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	109
PID 4276 wrote to memory of 4632	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	109
PID 4276 wrote to memory of 4840	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	110
PID 4276 wrote to memory of 4840	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	110
PID 4276 wrote to memory of 2596	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	111
PID 4276 wrote to memory of 2596	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	111
PID 4276 wrote to memory of 2284	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	112
PID 4276 wrote to memory of 2284	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	112
PID 4276 wrote to memory of 3396	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	113
PID 4276 wrote to memory of 3396	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	113
PID 4276 wrote to memory of 4412	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	114
PID 4276 wrote to memory of 4412	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	114
PID 4276 wrote to memory of 1752	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	115
PID 4276 wrote to memory of 1752	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	115
PID 4276 wrote to memory of 3720	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	116
PID 4276 wrote to memory of 3720	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	116
PID 4276 wrote to memory of 1744	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	117
PID 4276 wrote to memory of 1744	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	117
PID 4276 wrote to memory of 4320	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	118
PID 4276 wrote to memory of 4320	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	118
PID 4276 wrote to memory of 1248	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	119
PID 4276 wrote to memory of 1248	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	119
PID 4276 wrote to memory of 2044	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	120
PID 4276 wrote to memory of 2044	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	120
PID 4276 wrote to memory of 328	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	121
PID 4276 wrote to memory of 328	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	121
PID 4276 wrote to memory of 4380	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	122
PID 4276 wrote to memory of 4380	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	122
PID 4276 wrote to memory of 2124	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	123
PID 4276 wrote to memory of 2124	4276	51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51a13cc776e992d3b9ed0649bf5bb450_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\System\xLWtbGl.exe
  C:\Windows\System\xLWtbGl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\DyhPwfr.exe
  C:\Windows\System\DyhPwfr.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\qsHNTBD.exe
  C:\Windows\System\qsHNTBD.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\qcrLJAt.exe
  C:\Windows\System\qcrLJAt.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\wsAvWcj.exe
  C:\Windows\System\wsAvWcj.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\widHKmr.exe
  C:\Windows\System\widHKmr.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\DzlBasO.exe
  C:\Windows\System\DzlBasO.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\HbYPIEq.exe
  C:\Windows\System\HbYPIEq.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\WDJRmfP.exe
  C:\Windows\System\WDJRmfP.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ZblEjmC.exe
  C:\Windows\System\ZblEjmC.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\tZXCTYK.exe
  C:\Windows\System\tZXCTYK.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\yASJQwx.exe
  C:\Windows\System\yASJQwx.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\FTtxTLA.exe
  C:\Windows\System\FTtxTLA.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\nRlWIlu.exe
  C:\Windows\System\nRlWIlu.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\QjhygsN.exe
  C:\Windows\System\QjhygsN.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\qJKxeSJ.exe
  C:\Windows\System\qJKxeSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\YzvnSNQ.exe
  C:\Windows\System\YzvnSNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\zslwfBA.exe
  C:\Windows\System\zslwfBA.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\VPOKtbc.exe
  C:\Windows\System\VPOKtbc.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\TvQHgKt.exe
  C:\Windows\System\TvQHgKt.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\WiBbhpO.exe
  C:\Windows\System\WiBbhpO.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\nVQOFZl.exe
  C:\Windows\System\nVQOFZl.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\utBphkc.exe
  C:\Windows\System\utBphkc.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\pjRjIQD.exe
  C:\Windows\System\pjRjIQD.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\jMTtQOI.exe
  C:\Windows\System\jMTtQOI.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\IQzCjcs.exe
  C:\Windows\System\IQzCjcs.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\SOVHDHe.exe
  C:\Windows\System\SOVHDHe.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\lFOoqkU.exe
  C:\Windows\System\lFOoqkU.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bvfGfnp.exe
  C:\Windows\System\bvfGfnp.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\iAFeQgu.exe
  C:\Windows\System\iAFeQgu.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\sMMbaNn.exe
  C:\Windows\System\sMMbaNn.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\uEeGpna.exe
  C:\Windows\System\uEeGpna.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\JCEkrgk.exe
  C:\Windows\System\JCEkrgk.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ReHtbXu.exe
  C:\Windows\System\ReHtbXu.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\JhpfBkt.exe
  C:\Windows\System\JhpfBkt.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\QswhhDK.exe
  C:\Windows\System\QswhhDK.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\JXpBItn.exe
  C:\Windows\System\JXpBItn.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\XwigULb.exe
  C:\Windows\System\XwigULb.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\pLSTstQ.exe
  C:\Windows\System\pLSTstQ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\MNztbCt.exe
  C:\Windows\System\MNztbCt.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\hmTpYzp.exe
  C:\Windows\System\hmTpYzp.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\VhyNQTV.exe
  C:\Windows\System\VhyNQTV.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\GQmZjKq.exe
  C:\Windows\System\GQmZjKq.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\zQxbnOW.exe
  C:\Windows\System\zQxbnOW.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\EvMAQBe.exe
  C:\Windows\System\EvMAQBe.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\niPHxzW.exe
  C:\Windows\System\niPHxzW.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\cNYbyxk.exe
  C:\Windows\System\cNYbyxk.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\JvQadvv.exe
  C:\Windows\System\JvQadvv.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\peARwvg.exe
  C:\Windows\System\peARwvg.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\uIQDAsu.exe
  C:\Windows\System\uIQDAsu.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\HUWGmOO.exe
  C:\Windows\System\HUWGmOO.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\WEhavmQ.exe
  C:\Windows\System\WEhavmQ.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\FElxTNC.exe
  C:\Windows\System\FElxTNC.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\rUITYWd.exe
  C:\Windows\System\rUITYWd.exe
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Windows\System\wCXfDqa.exe
  C:\Windows\System\wCXfDqa.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\TMuDNIG.exe
  C:\Windows\System\TMuDNIG.exe
  2⤵
  - Executes dropped EXE
  PID:5440
- C:\Windows\System\guhKlQU.exe
  C:\Windows\System\guhKlQU.exe
  2⤵
  - Executes dropped EXE
  PID:5468
- C:\Windows\System\WEmOfXu.exe
  C:\Windows\System\WEmOfXu.exe
  2⤵
  - Executes dropped EXE
  PID:5496
- C:\Windows\System\pLBilqa.exe
  C:\Windows\System\pLBilqa.exe
  2⤵
  - Executes dropped EXE
  PID:5524
- C:\Windows\System\gdAgPAK.exe
  C:\Windows\System\gdAgPAK.exe
  2⤵
  - Executes dropped EXE
  PID:5552
- C:\Windows\System\kzzeGki.exe
  C:\Windows\System\kzzeGki.exe
  2⤵
  - Executes dropped EXE
  PID:5580
- C:\Windows\System\GuUXxXN.exe
  C:\Windows\System\GuUXxXN.exe
  2⤵
  - Executes dropped EXE
  PID:5608
- C:\Windows\System\yHVfNif.exe
  C:\Windows\System\yHVfNif.exe
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Windows\System\gYKYSjo.exe
  C:\Windows\System\gYKYSjo.exe
  2⤵
  - Executes dropped EXE
  PID:5664
- C:\Windows\System\jrmTwLT.exe
  C:\Windows\System\jrmTwLT.exe
  2⤵
  PID:5692
- C:\Windows\System\auUymao.exe
  C:\Windows\System\auUymao.exe
  2⤵
  PID:5720
- C:\Windows\System\EejTQvf.exe
  C:\Windows\System\EejTQvf.exe
  2⤵
  PID:5748
- C:\Windows\System\YSQnpSd.exe
  C:\Windows\System\YSQnpSd.exe
  2⤵
  PID:5772
- C:\Windows\System\cahRiUp.exe
  C:\Windows\System\cahRiUp.exe
  2⤵
  PID:5804
- C:\Windows\System\pYuhdpJ.exe
  C:\Windows\System\pYuhdpJ.exe
  2⤵
  PID:5832
- C:\Windows\System\lEcbtNk.exe
  C:\Windows\System\lEcbtNk.exe
  2⤵
  PID:5860
- C:\Windows\System\TggIRMW.exe
  C:\Windows\System\TggIRMW.exe
  2⤵
  PID:5888
- C:\Windows\System\ZTtFQxQ.exe
  C:\Windows\System\ZTtFQxQ.exe
  2⤵
  PID:5916
- C:\Windows\System\iYnBDkg.exe
  C:\Windows\System\iYnBDkg.exe
  2⤵
  PID:5944
- C:\Windows\System\OnDybdc.exe
  C:\Windows\System\OnDybdc.exe
  2⤵
  PID:5972
- C:\Windows\System\iCpzAey.exe
  C:\Windows\System\iCpzAey.exe
  2⤵
  PID:6000
- C:\Windows\System\nwteNpk.exe
  C:\Windows\System\nwteNpk.exe
  2⤵
  PID:6028
- C:\Windows\System\vGFVTrW.exe
  C:\Windows\System\vGFVTrW.exe
  2⤵
  PID:6056
- C:\Windows\System\FDnBygY.exe
  C:\Windows\System\FDnBygY.exe
  2⤵
  PID:6084
- C:\Windows\System\yxZPQky.exe
  C:\Windows\System\yxZPQky.exe
  2⤵
  PID:6112
- C:\Windows\System\SdaCQMG.exe
  C:\Windows\System\SdaCQMG.exe
  2⤵
  PID:6140
- C:\Windows\System\HGISUXN.exe
  C:\Windows\System\HGISUXN.exe
  2⤵
  PID:4076
- C:\Windows\System\CAAmhuH.exe
  C:\Windows\System\CAAmhuH.exe
  2⤵
  PID:2796
- C:\Windows\System\bdGmMnY.exe
  C:\Windows\System\bdGmMnY.exe
  2⤵
  PID:380
- C:\Windows\System\xkVHSVz.exe
  C:\Windows\System\xkVHSVz.exe
  2⤵
  PID:2188
- C:\Windows\System\IOgWBFb.exe
  C:\Windows\System\IOgWBFb.exe
  2⤵
  PID:5156
- C:\Windows\System\WGdeBEP.exe
  C:\Windows\System\WGdeBEP.exe
  2⤵
  PID:5232
- C:\Windows\System\JqmEfQc.exe
  C:\Windows\System\JqmEfQc.exe
  2⤵
  PID:5288
- C:\Windows\System\bxkrImS.exe
  C:\Windows\System\bxkrImS.exe
  2⤵
  PID:5364
- C:\Windows\System\bgioarX.exe
  C:\Windows\System\bgioarX.exe
  2⤵
  PID:5428
- C:\Windows\System\ZeydhZD.exe
  C:\Windows\System\ZeydhZD.exe
  2⤵
  PID:5488
- C:\Windows\System\rzClkYl.exe
  C:\Windows\System\rzClkYl.exe
  2⤵
  PID:5564
- C:\Windows\System\KNoqLFw.exe
  C:\Windows\System\KNoqLFw.exe
  2⤵
  PID:5624
- C:\Windows\System\kFdjVZH.exe
  C:\Windows\System\kFdjVZH.exe
  2⤵
  PID:5684
- C:\Windows\System\eDtPQKi.exe
  C:\Windows\System\eDtPQKi.exe
  2⤵
  PID:5760
- C:\Windows\System\mnEzrIW.exe
  C:\Windows\System\mnEzrIW.exe
  2⤵
  PID:5820
- C:\Windows\System\JlpaMyx.exe
  C:\Windows\System\JlpaMyx.exe
  2⤵
  PID:5880
- C:\Windows\System\UXUwfsO.exe
  C:\Windows\System\UXUwfsO.exe
  2⤵
  PID:5956
- C:\Windows\System\DsHWHcQ.exe
  C:\Windows\System\DsHWHcQ.exe
  2⤵
  PID:6016
- C:\Windows\System\hZWupdM.exe
  C:\Windows\System\hZWupdM.exe
  2⤵
  PID:6076
- C:\Windows\System\uwWzblW.exe
  C:\Windows\System\uwWzblW.exe
  2⤵
  PID:3248
- C:\Windows\System\mJkiLGn.exe
  C:\Windows\System\mJkiLGn.exe
  2⤵
  PID:1540
- C:\Windows\System\YmgPEtq.exe
  C:\Windows\System\YmgPEtq.exe
  2⤵
  PID:5148
- C:\Windows\System\nbCoZUk.exe
  C:\Windows\System\nbCoZUk.exe
  2⤵
  PID:5316
- C:\Windows\System\RATLgEX.exe
  C:\Windows\System\RATLgEX.exe
  2⤵
  PID:5460
- C:\Windows\System\kcESbBz.exe
  C:\Windows\System\kcESbBz.exe
  2⤵
  PID:5604
- C:\Windows\System\UFutiWm.exe
  C:\Windows\System\UFutiWm.exe
  2⤵
  PID:6148
- C:\Windows\System\gULnYOf.exe
  C:\Windows\System\gULnYOf.exe
  2⤵
  PID:6176
- C:\Windows\System\tBOpLlF.exe
  C:\Windows\System\tBOpLlF.exe
  2⤵
  PID:6204
- C:\Windows\System\MiegaPq.exe
  C:\Windows\System\MiegaPq.exe
  2⤵
  PID:6232
- C:\Windows\System\oJveUqV.exe
  C:\Windows\System\oJveUqV.exe
  2⤵
  PID:6260
- C:\Windows\System\fZPYCgZ.exe
  C:\Windows\System\fZPYCgZ.exe
  2⤵
  PID:6288
- C:\Windows\System\FIBAqTV.exe
  C:\Windows\System\FIBAqTV.exe
  2⤵
  PID:6316
- C:\Windows\System\SvuipAX.exe
  C:\Windows\System\SvuipAX.exe
  2⤵
  PID:6344
- C:\Windows\System\MzKqvoB.exe
  C:\Windows\System\MzKqvoB.exe
  2⤵
  PID:6372
- C:\Windows\System\KGVtXPZ.exe
  C:\Windows\System\KGVtXPZ.exe
  2⤵
  PID:6396
- C:\Windows\System\GVdtWEd.exe
  C:\Windows\System\GVdtWEd.exe
  2⤵
  PID:6428
- C:\Windows\System\HcRKTae.exe
  C:\Windows\System\HcRKTae.exe
  2⤵
  PID:6456
- C:\Windows\System\MgOmVoF.exe
  C:\Windows\System\MgOmVoF.exe
  2⤵
  PID:6484
- C:\Windows\System\TYVBRSy.exe
  C:\Windows\System\TYVBRSy.exe
  2⤵
  PID:6512
- C:\Windows\System\QctiTTP.exe
  C:\Windows\System\QctiTTP.exe
  2⤵
  PID:6540
- C:\Windows\System\jupTZuD.exe
  C:\Windows\System\jupTZuD.exe
  2⤵
  PID:6568
- C:\Windows\System\KarTOMc.exe
  C:\Windows\System\KarTOMc.exe
  2⤵
  PID:6596
- C:\Windows\System\DgbGyqV.exe
  C:\Windows\System\DgbGyqV.exe
  2⤵
  PID:6624
- C:\Windows\System\ylKrufN.exe
  C:\Windows\System\ylKrufN.exe
  2⤵
  PID:6648
- C:\Windows\System\shoHsOP.exe
  C:\Windows\System\shoHsOP.exe
  2⤵
  PID:6680
- C:\Windows\System\iNgDHbY.exe
  C:\Windows\System\iNgDHbY.exe
  2⤵
  PID:6708
- C:\Windows\System\GCRMTqa.exe
  C:\Windows\System\GCRMTqa.exe
  2⤵
  PID:6736
- C:\Windows\System\KqktUOa.exe
  C:\Windows\System\KqktUOa.exe
  2⤵
  PID:6768
- C:\Windows\System\hQkqPgn.exe
  C:\Windows\System\hQkqPgn.exe
  2⤵
  PID:6792
- C:\Windows\System\WpHDysF.exe
  C:\Windows\System\WpHDysF.exe
  2⤵
  PID:6820
- C:\Windows\System\YLXIdFa.exe
  C:\Windows\System\YLXIdFa.exe
  2⤵
  PID:6852
- C:\Windows\System\TRuOUEV.exe
  C:\Windows\System\TRuOUEV.exe
  2⤵
  PID:6880
- C:\Windows\System\rUlowQA.exe
  C:\Windows\System\rUlowQA.exe
  2⤵
  PID:6908
- C:\Windows\System\JwGKmAn.exe
  C:\Windows\System\JwGKmAn.exe
  2⤵
  PID:6936
- C:\Windows\System\qfOQccQ.exe
  C:\Windows\System\qfOQccQ.exe
  2⤵
  PID:6960
- C:\Windows\System\Nbcduwp.exe
  C:\Windows\System\Nbcduwp.exe
  2⤵
  PID:6988
- C:\Windows\System\eWxpheY.exe
  C:\Windows\System\eWxpheY.exe
  2⤵
  PID:7020
- C:\Windows\System\meYRsBG.exe
  C:\Windows\System\meYRsBG.exe
  2⤵
  PID:7044
- C:\Windows\System\ojfKfdv.exe
  C:\Windows\System\ojfKfdv.exe
  2⤵
  PID:7076
- C:\Windows\System\baCwRrR.exe
  C:\Windows\System\baCwRrR.exe
  2⤵
  PID:7104
- C:\Windows\System\VXLpqCa.exe
  C:\Windows\System\VXLpqCa.exe
  2⤵
  PID:7132
- C:\Windows\System\waAgHND.exe
  C:\Windows\System\waAgHND.exe
  2⤵
  PID:7160
- C:\Windows\System\luBwAUN.exe
  C:\Windows\System\luBwAUN.exe
  2⤵
  PID:5872
- C:\Windows\System\KPEBaER.exe
  C:\Windows\System\KPEBaER.exe
  2⤵
  PID:6044
- C:\Windows\System\DFYKCJJ.exe
  C:\Windows\System\DFYKCJJ.exe
  2⤵
  PID:2924
- C:\Windows\System\jvSTDJo.exe
  C:\Windows\System\jvSTDJo.exe
  2⤵
  PID:5260
- C:\Windows\System\VrwyjVD.exe
  C:\Windows\System\VrwyjVD.exe
  2⤵
  PID:5676
- C:\Windows\System\YrqikDv.exe
  C:\Windows\System\YrqikDv.exe
  2⤵
  PID:6192
- C:\Windows\System\TFvhEGm.exe
  C:\Windows\System\TFvhEGm.exe
  2⤵
  PID:6248
- C:\Windows\System\nyLvNhv.exe
  C:\Windows\System\nyLvNhv.exe
  2⤵
  PID:6328
- C:\Windows\System\VenwvjL.exe
  C:\Windows\System\VenwvjL.exe
  2⤵
  PID:6388
- C:\Windows\System\oBPhofF.exe
  C:\Windows\System\oBPhofF.exe
  2⤵
  PID:6448
- C:\Windows\System\NoiALaB.exe
  C:\Windows\System\NoiALaB.exe
  2⤵
  PID:6524
- C:\Windows\System\vsYsFet.exe
  C:\Windows\System\vsYsFet.exe
  2⤵
  PID:6584
- C:\Windows\System\GEUVERE.exe
  C:\Windows\System\GEUVERE.exe
  2⤵
  PID:6640
- C:\Windows\System\fgtYAeH.exe
  C:\Windows\System\fgtYAeH.exe
  2⤵
  PID:6700
- C:\Windows\System\vWZBOuF.exe
  C:\Windows\System\vWZBOuF.exe
  2⤵
  PID:6784
- C:\Windows\System\yJabeNu.exe
  C:\Windows\System\yJabeNu.exe
  2⤵
  PID:6836
- C:\Windows\System\NMPmnfV.exe
  C:\Windows\System\NMPmnfV.exe
  2⤵
  PID:6920
- C:\Windows\System\jQJYZte.exe
  C:\Windows\System\jQJYZte.exe
  2⤵
  PID:6980
- C:\Windows\System\DmCuwQs.exe
  C:\Windows\System\DmCuwQs.exe
  2⤵
  PID:7040
- C:\Windows\System\hMtPmDa.exe
  C:\Windows\System\hMtPmDa.exe
  2⤵
  PID:7092
- C:\Windows\System\jGLuFVU.exe
  C:\Windows\System\jGLuFVU.exe
  2⤵
  PID:7152
- C:\Windows\System\TVUScgj.exe
  C:\Windows\System\TVUScgj.exe
  2⤵
  PID:6104
- C:\Windows\System\jdsNNqg.exe
  C:\Windows\System\jdsNNqg.exe
  2⤵
  PID:5536
- C:\Windows\System\xvOcUGN.exe
  C:\Windows\System\xvOcUGN.exe
  2⤵
  PID:6224
- C:\Windows\System\KySNRxC.exe
  C:\Windows\System\KySNRxC.exe
  2⤵
  PID:6364
- C:\Windows\System\yZFpwtl.exe
  C:\Windows\System\yZFpwtl.exe
  2⤵
  PID:6500
- C:\Windows\System\OtvJoGJ.exe
  C:\Windows\System\OtvJoGJ.exe
  2⤵
  PID:6616
- C:\Windows\System\XvDjmWY.exe
  C:\Windows\System\XvDjmWY.exe
  2⤵
  PID:6748
- C:\Windows\System\Djwzwrh.exe
  C:\Windows\System\Djwzwrh.exe
  2⤵
  PID:6896
- C:\Windows\System\mLBpzQC.exe
  C:\Windows\System\mLBpzQC.exe
  2⤵
  PID:7032
- C:\Windows\System\vEguDlb.exe
  C:\Windows\System\vEguDlb.exe
  2⤵
  PID:7144
- C:\Windows\System\ysllVPT.exe
  C:\Windows\System\ysllVPT.exe
  2⤵
  PID:6164
- C:\Windows\System\tYXDgky.exe
  C:\Windows\System\tYXDgky.exe
  2⤵
  PID:4644
- C:\Windows\System\sVQjHvD.exe
  C:\Windows\System\sVQjHvD.exe
  2⤵
  PID:6612
- C:\Windows\System\SCETUXy.exe
  C:\Windows\System\SCETUXy.exe
  2⤵
  PID:6956
- C:\Windows\System\cqfJRcZ.exe
  C:\Windows\System\cqfJRcZ.exe
  2⤵
  PID:7176
- C:\Windows\System\SvXYqKC.exe
  C:\Windows\System\SvXYqKC.exe
  2⤵
  PID:7204
- C:\Windows\System\bnODLhu.exe
  C:\Windows\System\bnODLhu.exe
  2⤵
  PID:7232
- C:\Windows\System\AHdingL.exe
  C:\Windows\System\AHdingL.exe
  2⤵
  PID:7260
- C:\Windows\System\POoBaMx.exe
  C:\Windows\System\POoBaMx.exe
  2⤵
  PID:7288
- C:\Windows\System\HhBhtvp.exe
  C:\Windows\System\HhBhtvp.exe
  2⤵
  PID:7316
- C:\Windows\System\PmzDMXO.exe
  C:\Windows\System\PmzDMXO.exe
  2⤵
  PID:7344
- C:\Windows\System\PxpXIMa.exe
  C:\Windows\System\PxpXIMa.exe
  2⤵
  PID:7372
- C:\Windows\System\uaBCRxc.exe
  C:\Windows\System\uaBCRxc.exe
  2⤵
  PID:7400
- C:\Windows\System\TPNYQiT.exe
  C:\Windows\System\TPNYQiT.exe
  2⤵
  PID:7428
- C:\Windows\System\zBVNYuX.exe
  C:\Windows\System\zBVNYuX.exe
  2⤵
  PID:7456
- C:\Windows\System\VcDeySt.exe
  C:\Windows\System\VcDeySt.exe
  2⤵
  PID:7484
- C:\Windows\System\MPizJeC.exe
  C:\Windows\System\MPizJeC.exe
  2⤵
  PID:7584
- C:\Windows\System\LCMeqKK.exe
  C:\Windows\System\LCMeqKK.exe
  2⤵
  PID:7608
- C:\Windows\System\HYRvpVl.exe
  C:\Windows\System\HYRvpVl.exe
  2⤵
  PID:7632
- C:\Windows\System\MjAQlCl.exe
  C:\Windows\System\MjAQlCl.exe
  2⤵
  PID:7656
- C:\Windows\System\zSDhaxv.exe
  C:\Windows\System\zSDhaxv.exe
  2⤵
  PID:7672
- C:\Windows\System\JSCQpJI.exe
  C:\Windows\System\JSCQpJI.exe
  2⤵
  PID:7752
- C:\Windows\System\GBAAnug.exe
  C:\Windows\System\GBAAnug.exe
  2⤵
  PID:7784
- C:\Windows\System\DIyaStT.exe
  C:\Windows\System\DIyaStT.exe
  2⤵
  PID:7816
- C:\Windows\System\TPfhkTC.exe
  C:\Windows\System\TPfhkTC.exe
  2⤵
  PID:7840
- C:\Windows\System\gboyEXi.exe
  C:\Windows\System\gboyEXi.exe
  2⤵
  PID:7872
- C:\Windows\System\LCxGPIU.exe
  C:\Windows\System\LCxGPIU.exe
  2⤵
  PID:7916
- C:\Windows\System\myonAnz.exe
  C:\Windows\System\myonAnz.exe
  2⤵
  PID:7944
- C:\Windows\System\OvVnjJi.exe
  C:\Windows\System\OvVnjJi.exe
  2⤵
  PID:7976
- C:\Windows\System\YPnUtdZ.exe
  C:\Windows\System\YPnUtdZ.exe
  2⤵
  PID:8004
- C:\Windows\System\AxDIaIS.exe
  C:\Windows\System\AxDIaIS.exe
  2⤵
  PID:8048
- C:\Windows\System\FPZwtKn.exe
  C:\Windows\System\FPZwtKn.exe
  2⤵
  PID:8072
- C:\Windows\System\NJzMcfX.exe
  C:\Windows\System\NJzMcfX.exe
  2⤵
  PID:8092
- C:\Windows\System\xjFzZwr.exe
  C:\Windows\System\xjFzZwr.exe
  2⤵
  PID:8124
- C:\Windows\System\vzJIndt.exe
  C:\Windows\System\vzJIndt.exe
  2⤵
  PID:8156
- C:\Windows\System\fuRQFew.exe
  C:\Windows\System\fuRQFew.exe
  2⤵
  PID:8184
- C:\Windows\System\TbtjecE.exe
  C:\Windows\System\TbtjecE.exe
  2⤵
  PID:4544
- C:\Windows\System\NXEtKZf.exe
  C:\Windows\System\NXEtKZf.exe
  2⤵
  PID:6356
- C:\Windows\System\PITXMYF.exe
  C:\Windows\System\PITXMYF.exe
  2⤵
  PID:6696
- C:\Windows\System\TgYcvoZ.exe
  C:\Windows\System\TgYcvoZ.exe
  2⤵
  PID:704
- C:\Windows\System\mZpoVjb.exe
  C:\Windows\System\mZpoVjb.exe
  2⤵
  PID:7356
- C:\Windows\System\RPGZQix.exe
  C:\Windows\System\RPGZQix.exe
  2⤵
  PID:2876
- C:\Windows\System\UglzjZJ.exe
  C:\Windows\System\UglzjZJ.exe
  2⤵
  PID:7440
- C:\Windows\System\reqfEAa.exe
  C:\Windows\System\reqfEAa.exe
  2⤵
  PID:7468
- C:\Windows\System\ZaaSWjL.exe
  C:\Windows\System\ZaaSWjL.exe
  2⤵
  PID:3084
- C:\Windows\System\YEphtfX.exe
  C:\Windows\System\YEphtfX.exe
  2⤵
  PID:2320
- C:\Windows\System\lkCIybA.exe
  C:\Windows\System\lkCIybA.exe
  2⤵
  PID:2848
- C:\Windows\System\puiTekv.exe
  C:\Windows\System\puiTekv.exe
  2⤵
  PID:3000
- C:\Windows\System\zKczEgS.exe
  C:\Windows\System\zKczEgS.exe
  2⤵
  PID:7600
- C:\Windows\System\wCnvxqS.exe
  C:\Windows\System\wCnvxqS.exe
  2⤵
  PID:7652
- C:\Windows\System\HBvWByw.exe
  C:\Windows\System\HBvWByw.exe
  2⤵
  PID:7724
- C:\Windows\System\OxdZjGh.exe
  C:\Windows\System\OxdZjGh.exe
  2⤵
  PID:7828
- C:\Windows\System\KVxObJP.exe
  C:\Windows\System\KVxObJP.exe
  2⤵
  PID:7856
- C:\Windows\System\jdXLhhU.exe
  C:\Windows\System\jdXLhhU.exe
  2⤵
  PID:7888
- C:\Windows\System\Agyfuez.exe
  C:\Windows\System\Agyfuez.exe
  2⤵
  PID:7992
- C:\Windows\System\CBrbzIm.exe
  C:\Windows\System\CBrbzIm.exe
  2⤵
  PID:8056
- C:\Windows\System\QcFBvIV.exe
  C:\Windows\System\QcFBvIV.exe
  2⤵
  PID:8148
- C:\Windows\System\AeGXepr.exe
  C:\Windows\System\AeGXepr.exe
  2⤵
  PID:6476
- C:\Windows\System\oeiIfwP.exe
  C:\Windows\System\oeiIfwP.exe
  2⤵
  PID:7300
- C:\Windows\System\cbSiGrJ.exe
  C:\Windows\System\cbSiGrJ.exe
  2⤵
  PID:1632
- C:\Windows\System\QiZYAVS.exe
  C:\Windows\System\QiZYAVS.exe
  2⤵
  PID:7448
- C:\Windows\System\LtowptX.exe
  C:\Windows\System\LtowptX.exe
  2⤵
  PID:4728
- C:\Windows\System\CDBShqO.exe
  C:\Windows\System\CDBShqO.exe
  2⤵
  PID:1976
- C:\Windows\System\wOBALQY.exe
  C:\Windows\System\wOBALQY.exe
  2⤵
  PID:3988
- C:\Windows\System\xyxsVCh.exe
  C:\Windows\System\xyxsVCh.exe
  2⤵
  PID:1336
- C:\Windows\System\CQQpokx.exe
  C:\Windows\System\CQQpokx.exe
  2⤵
  PID:7680
- C:\Windows\System\oqiiEph.exe
  C:\Windows\System\oqiiEph.exe
  2⤵
  PID:7572
- C:\Windows\System\iDvyseb.exe
  C:\Windows\System\iDvyseb.exe
  2⤵
  PID:7940
- C:\Windows\System\gKItuMw.exe
  C:\Windows\System\gKItuMw.exe
  2⤵
  PID:628
- C:\Windows\System\lXFUkCo.exe
  C:\Windows\System\lXFUkCo.exe
  2⤵
  PID:7276
- C:\Windows\System\cqgfeCq.exe
  C:\Windows\System\cqgfeCq.exe
  2⤵
  PID:7416
- C:\Windows\System\UVoNmyR.exe
  C:\Windows\System\UVoNmyR.exe
  2⤵
  PID:7580
- C:\Windows\System\vTFQUsy.exe
  C:\Windows\System\vTFQUsy.exe
  2⤵
  PID:3752
- C:\Windows\System\iWNPsju.exe
  C:\Windows\System\iWNPsju.exe
  2⤵
  PID:7956
- C:\Windows\System\fetHxvS.exe
  C:\Windows\System\fetHxvS.exe
  2⤵
  PID:7420
- C:\Windows\System\zmqstdQ.exe
  C:\Windows\System\zmqstdQ.exe
  2⤵
  PID:732
- C:\Windows\System\NcHyJxb.exe
  C:\Windows\System\NcHyJxb.exe
  2⤵
  PID:8152
- C:\Windows\System\RNhrnen.exe
  C:\Windows\System\RNhrnen.exe
  2⤵
  PID:960
- C:\Windows\System\kahSDAv.exe
  C:\Windows\System\kahSDAv.exe
  2⤵
  PID:7848
- C:\Windows\System\ThgOpmD.exe
  C:\Windows\System\ThgOpmD.exe
  2⤵
  PID:8224
- C:\Windows\System\MwqcPiI.exe
  C:\Windows\System\MwqcPiI.exe
  2⤵
  PID:8264
- C:\Windows\System\QeLCTkp.exe
  C:\Windows\System\QeLCTkp.exe
  2⤵
  PID:8300
- C:\Windows\System\CVMpJeh.exe
  C:\Windows\System\CVMpJeh.exe
  2⤵
  PID:8332
- C:\Windows\System\bspddKd.exe
  C:\Windows\System\bspddKd.exe
  2⤵
  PID:8364
- C:\Windows\System\kINRYoX.exe
  C:\Windows\System\kINRYoX.exe
  2⤵
  PID:8404
- C:\Windows\System\kVflZaK.exe
  C:\Windows\System\kVflZaK.exe
  2⤵
  PID:8432
- C:\Windows\System\kCnUoUV.exe
  C:\Windows\System\kCnUoUV.exe
  2⤵
  PID:8460
- C:\Windows\System\YDLpYnX.exe
  C:\Windows\System\YDLpYnX.exe
  2⤵
  PID:8488
- C:\Windows\System\TGSYZIy.exe
  C:\Windows\System\TGSYZIy.exe
  2⤵
  PID:8516
- C:\Windows\System\uESCmha.exe
  C:\Windows\System\uESCmha.exe
  2⤵
  PID:8544
- C:\Windows\System\iYRuoxP.exe
  C:\Windows\System\iYRuoxP.exe
  2⤵
  PID:8572
- C:\Windows\System\CiwDCHk.exe
  C:\Windows\System\CiwDCHk.exe
  2⤵
  PID:8600
- C:\Windows\System\CQDqkso.exe
  C:\Windows\System\CQDqkso.exe
  2⤵
  PID:8628
- C:\Windows\System\VPWyrCT.exe
  C:\Windows\System\VPWyrCT.exe
  2⤵
  PID:8656
- C:\Windows\System\sZRvtLB.exe
  C:\Windows\System\sZRvtLB.exe
  2⤵
  PID:8684
- C:\Windows\System\zPQovXl.exe
  C:\Windows\System\zPQovXl.exe
  2⤵
  PID:8712
- C:\Windows\System\jyFLUXM.exe
  C:\Windows\System\jyFLUXM.exe
  2⤵
  PID:8744
- C:\Windows\System\MOCYwbr.exe
  C:\Windows\System\MOCYwbr.exe
  2⤵
  PID:8772
- C:\Windows\System\anIDsfF.exe
  C:\Windows\System\anIDsfF.exe
  2⤵
  PID:8800
- C:\Windows\System\PbmYCGJ.exe
  C:\Windows\System\PbmYCGJ.exe
  2⤵
  PID:8828
- C:\Windows\System\jgUBvFT.exe
  C:\Windows\System\jgUBvFT.exe
  2⤵
  PID:8856
- C:\Windows\System\SbaJElb.exe
  C:\Windows\System\SbaJElb.exe
  2⤵
  PID:8884
- C:\Windows\System\lpZuhML.exe
  C:\Windows\System\lpZuhML.exe
  2⤵
  PID:8912
- C:\Windows\System\BGAIafZ.exe
  C:\Windows\System\BGAIafZ.exe
  2⤵
  PID:8944
- C:\Windows\System\nLoBsGc.exe
  C:\Windows\System\nLoBsGc.exe
  2⤵
  PID:8972
- C:\Windows\System\UtQosbq.exe
  C:\Windows\System\UtQosbq.exe
  2⤵
  PID:9000
- C:\Windows\System\sliKKdh.exe
  C:\Windows\System\sliKKdh.exe
  2⤵
  PID:9028
- C:\Windows\System\hJHrcAh.exe
  C:\Windows\System\hJHrcAh.exe
  2⤵
  PID:9056
- C:\Windows\System\rWVOBaD.exe
  C:\Windows\System\rWVOBaD.exe
  2⤵
  PID:9084
- C:\Windows\System\SktydPT.exe
  C:\Windows\System\SktydPT.exe
  2⤵
  PID:9112
- C:\Windows\System\mSsOPOI.exe
  C:\Windows\System\mSsOPOI.exe
  2⤵
  PID:9140
- C:\Windows\System\fdnIOEy.exe
  C:\Windows\System\fdnIOEy.exe
  2⤵
  PID:9168
- C:\Windows\System\VDOYNpm.exe
  C:\Windows\System\VDOYNpm.exe
  2⤵
  PID:9196
- C:\Windows\System\DhTvMMn.exe
  C:\Windows\System\DhTvMMn.exe
  2⤵
  PID:8244
- C:\Windows\System\geUIcTm.exe
  C:\Windows\System\geUIcTm.exe
  2⤵
  PID:8284
- C:\Windows\System\cOErPgh.exe
  C:\Windows\System\cOErPgh.exe
  2⤵
  PID:7304
- C:\Windows\System\WfUPNue.exe
  C:\Windows\System\WfUPNue.exe
  2⤵
  PID:8424
- C:\Windows\System\NrVXkDo.exe
  C:\Windows\System\NrVXkDo.exe
  2⤵
  PID:8480
- C:\Windows\System\YoVPSLS.exe
  C:\Windows\System\YoVPSLS.exe
  2⤵
  PID:8540
- C:\Windows\System\mMRaJOo.exe
  C:\Windows\System\mMRaJOo.exe
  2⤵
  PID:8596
- C:\Windows\System\YcwmasV.exe
  C:\Windows\System\YcwmasV.exe
  2⤵
  PID:8640
- C:\Windows\System\GoHUVFe.exe
  C:\Windows\System\GoHUVFe.exe
  2⤵
  PID:8680
- C:\Windows\System\cyVGmHb.exe
  C:\Windows\System\cyVGmHb.exe
  2⤵
  PID:8740
- C:\Windows\System\Fqatmic.exe
  C:\Windows\System\Fqatmic.exe
  2⤵
  PID:8816
- C:\Windows\System\mijaPsx.exe
  C:\Windows\System\mijaPsx.exe
  2⤵
  PID:8876
- C:\Windows\System\OmaQdRq.exe
  C:\Windows\System\OmaQdRq.exe
  2⤵
  PID:8936
- C:\Windows\System\qrBWRAA.exe
  C:\Windows\System\qrBWRAA.exe
  2⤵
  PID:8996
- C:\Windows\System\qGoVHYq.exe
  C:\Windows\System\qGoVHYq.exe
  2⤵
  PID:9072
- C:\Windows\System\ibYIJaE.exe
  C:\Windows\System\ibYIJaE.exe
  2⤵
  PID:1220
- C:\Windows\System\qqZBaaH.exe
  C:\Windows\System\qqZBaaH.exe
  2⤵
  PID:9184
- C:\Windows\System\OxiShfb.exe
  C:\Windows\System\OxiShfb.exe
  2⤵
  PID:8212
- C:\Windows\System\pBCnuco.exe
  C:\Windows\System\pBCnuco.exe
  2⤵
  PID:8416
- C:\Windows\System\YcGYILC.exe
  C:\Windows\System\YcGYILC.exe
  2⤵
  PID:8564
- C:\Windows\System\NWpwSzX.exe
  C:\Windows\System\NWpwSzX.exe
  2⤵
  PID:8144
- C:\Windows\System\ACCtSqg.exe
  C:\Windows\System\ACCtSqg.exe
  2⤵
  PID:8796
- C:\Windows\System\AXphgWr.exe
  C:\Windows\System\AXphgWr.exe
  2⤵
  PID:8964
- C:\Windows\System\AWAzJqj.exe
  C:\Windows\System\AWAzJqj.exe
  2⤵
  PID:9104
- C:\Windows\System\dtKwQOO.exe
  C:\Windows\System\dtKwQOO.exe
  2⤵
  PID:8232
- C:\Windows\System\ByRMyBy.exe
  C:\Windows\System\ByRMyBy.exe
  2⤵
  PID:8620
- C:\Windows\System\iDnsPRE.exe
  C:\Windows\System\iDnsPRE.exe
  2⤵
  PID:8908
- C:\Windows\System\RGetjYQ.exe
  C:\Windows\System\RGetjYQ.exe
  2⤵
  PID:7196
- C:\Windows\System\MRoxYcf.exe
  C:\Windows\System\MRoxYcf.exe
  2⤵
  PID:4912
- C:\Windows\System\psxGFxu.exe
  C:\Windows\System\psxGFxu.exe
  2⤵
  PID:9220
- C:\Windows\System\mCQKetX.exe
  C:\Windows\System\mCQKetX.exe
  2⤵
  PID:9248
- C:\Windows\System\uIEYwLU.exe
  C:\Windows\System\uIEYwLU.exe
  2⤵
  PID:9276
- C:\Windows\System\FQkBJJH.exe
  C:\Windows\System\FQkBJJH.exe
  2⤵
  PID:9304
- C:\Windows\System\OFKXIoK.exe
  C:\Windows\System\OFKXIoK.exe
  2⤵
  PID:9332
- C:\Windows\System\pRTgihM.exe
  C:\Windows\System\pRTgihM.exe
  2⤵
  PID:9360
- C:\Windows\System\lanUjLJ.exe
  C:\Windows\System\lanUjLJ.exe
  2⤵
  PID:9388
- C:\Windows\System\ZXiyMAl.exe
  C:\Windows\System\ZXiyMAl.exe
  2⤵
  PID:9416
- C:\Windows\System\mZyzDVS.exe
  C:\Windows\System\mZyzDVS.exe
  2⤵
  PID:9444
- C:\Windows\System\weuDdyI.exe
  C:\Windows\System\weuDdyI.exe
  2⤵
  PID:9472
- C:\Windows\System\DnUECuy.exe
  C:\Windows\System\DnUECuy.exe
  2⤵
  PID:9500
- C:\Windows\System\ceJgteY.exe
  C:\Windows\System\ceJgteY.exe
  2⤵
  PID:9528
- C:\Windows\System\HSMPxPu.exe
  C:\Windows\System\HSMPxPu.exe
  2⤵
  PID:9556
- C:\Windows\System\ZcVaQuc.exe
  C:\Windows\System\ZcVaQuc.exe
  2⤵
  PID:9584
- C:\Windows\System\lztDuVp.exe
  C:\Windows\System\lztDuVp.exe
  2⤵
  PID:9612
- C:\Windows\System\UmEFtkD.exe
  C:\Windows\System\UmEFtkD.exe
  2⤵
  PID:9640
- C:\Windows\System\MiQzyWL.exe
  C:\Windows\System\MiQzyWL.exe
  2⤵
  PID:9684
- C:\Windows\System\eRzgAFr.exe
  C:\Windows\System\eRzgAFr.exe
  2⤵
  PID:9700
- C:\Windows\System\THpqgbx.exe
  C:\Windows\System\THpqgbx.exe
  2⤵
  PID:9728
- C:\Windows\System\SKMvFRi.exe
  C:\Windows\System\SKMvFRi.exe
  2⤵
  PID:9756
- C:\Windows\System\jyKuMGW.exe
  C:\Windows\System\jyKuMGW.exe
  2⤵
  PID:9784
- C:\Windows\System\quMWNGx.exe
  C:\Windows\System\quMWNGx.exe
  2⤵
  PID:9800
- C:\Windows\System\KiBNuFE.exe
  C:\Windows\System\KiBNuFE.exe
  2⤵
  PID:9832
- C:\Windows\System\dhchSPE.exe
  C:\Windows\System\dhchSPE.exe
  2⤵
  PID:9868
- C:\Windows\System\zsLLMgu.exe
  C:\Windows\System\zsLLMgu.exe
  2⤵
  PID:9896
- C:\Windows\System\JDbstXm.exe
  C:\Windows\System\JDbstXm.exe
  2⤵
  PID:9920
- C:\Windows\System\RBTmKTy.exe
  C:\Windows\System\RBTmKTy.exe
  2⤵
  PID:9952
- C:\Windows\System\KtsixcN.exe
  C:\Windows\System\KtsixcN.exe
  2⤵
  PID:9980
- C:\Windows\System\vbdwJNK.exe
  C:\Windows\System\vbdwJNK.exe
  2⤵
  PID:10008
- C:\Windows\System\ypZKJgv.exe
  C:\Windows\System\ypZKJgv.exe
  2⤵
  PID:10036
- C:\Windows\System\gzIkeFG.exe
  C:\Windows\System\gzIkeFG.exe
  2⤵
  PID:10064
- C:\Windows\System\fmjqhDX.exe
  C:\Windows\System\fmjqhDX.exe
  2⤵
  PID:10092
- C:\Windows\System\SYLCdlG.exe
  C:\Windows\System\SYLCdlG.exe
  2⤵
  PID:10120
- C:\Windows\System\UzGymxd.exe
  C:\Windows\System\UzGymxd.exe
  2⤵
  PID:10148
- C:\Windows\System\OGaYmCs.exe
  C:\Windows\System\OGaYmCs.exe
  2⤵
  PID:10164
- C:\Windows\System\mGPwpUN.exe
  C:\Windows\System\mGPwpUN.exe
  2⤵
  PID:10204
- C:\Windows\System\bCDDodd.exe
  C:\Windows\System\bCDDodd.exe
  2⤵
  PID:10228
- C:\Windows\System\iAoXRBb.exe
  C:\Windows\System\iAoXRBb.exe
  2⤵
  PID:9236
- C:\Windows\System\bKlvSCw.exe
  C:\Windows\System\bKlvSCw.exe
  2⤵
  PID:9300
- C:\Windows\System\UhKAHWV.exe
  C:\Windows\System\UhKAHWV.exe
  2⤵
  PID:9380
- C:\Windows\System\oVhFbMs.exe
  C:\Windows\System\oVhFbMs.exe
  2⤵
  PID:9436
- C:\Windows\System\cVVNOav.exe
  C:\Windows\System\cVVNOav.exe
  2⤵
  PID:9516
- C:\Windows\System\KnFwBwC.exe
  C:\Windows\System\KnFwBwC.exe
  2⤵
  PID:9568
- C:\Windows\System\ELdDxnA.exe
  C:\Windows\System\ELdDxnA.exe
  2⤵
  PID:9636
- C:\Windows\System\eBTJhEy.exe
  C:\Windows\System\eBTJhEy.exe
  2⤵
  PID:8724
- C:\Windows\System\anzisdK.exe
  C:\Windows\System\anzisdK.exe
  2⤵
  PID:9768
- C:\Windows\System\fPlyUlY.exe
  C:\Windows\System\fPlyUlY.exe
  2⤵
  PID:9812
- C:\Windows\System\JinBIOV.exe
  C:\Windows\System\JinBIOV.exe
  2⤵
  PID:9888
- C:\Windows\System\CpSUGAl.exe
  C:\Windows\System\CpSUGAl.exe
  2⤵
  PID:9964
- C:\Windows\System\OWaXrlR.exe
  C:\Windows\System\OWaXrlR.exe
  2⤵
  PID:10004
- C:\Windows\System\Zzufpnf.exe
  C:\Windows\System\Zzufpnf.exe
  2⤵
  PID:10088
- C:\Windows\System\TMGvtsX.exe
  C:\Windows\System\TMGvtsX.exe
  2⤵
  PID:10156
- C:\Windows\System\BzdJlPm.exe
  C:\Windows\System\BzdJlPm.exe
  2⤵
  PID:10216
- C:\Windows\System\EkCyWBf.exe
  C:\Windows\System\EkCyWBf.exe
  2⤵
  PID:9352
- C:\Windows\System\PnsNzdn.exe
  C:\Windows\System\PnsNzdn.exe
  2⤵
  PID:9488
- C:\Windows\System\blfYMRe.exe
  C:\Windows\System\blfYMRe.exe
  2⤵
  PID:9604
- C:\Windows\System\MHwNAKt.exe
  C:\Windows\System\MHwNAKt.exe
  2⤵
  PID:9740
- C:\Windows\System\rTNZPzO.exe
  C:\Windows\System\rTNZPzO.exe
  2⤵
  PID:9928
- C:\Windows\System\PpRqddt.exe
  C:\Windows\System\PpRqddt.exe
  2⤵
  PID:10056
- C:\Windows\System\oRQOqVs.exe
  C:\Windows\System\oRQOqVs.exe
  2⤵
  PID:10140
- C:\Windows\System\ckrojtn.exe
  C:\Windows\System\ckrojtn.exe
  2⤵
  PID:9264
- C:\Windows\System\tCNGDNY.exe
  C:\Windows\System\tCNGDNY.exe
  2⤵
  PID:9724
- C:\Windows\System\ICGayGw.exe
  C:\Windows\System\ICGayGw.exe
  2⤵
  PID:9976
- C:\Windows\System\JxKAqXn.exe
  C:\Windows\System\JxKAqXn.exe
  2⤵
  PID:9692
- C:\Windows\System\qLOrLKU.exe
  C:\Windows\System\qLOrLKU.exe
  2⤵
  PID:10196
- C:\Windows\System\kdCmEUe.exe
  C:\Windows\System\kdCmEUe.exe
  2⤵
  PID:10256
- C:\Windows\System\NfqldmT.exe
  C:\Windows\System\NfqldmT.exe
  2⤵
  PID:10292
- C:\Windows\System\dvtdcmv.exe
  C:\Windows\System\dvtdcmv.exe
  2⤵
  PID:10320
- C:\Windows\System\YcvCnPo.exe
  C:\Windows\System\YcvCnPo.exe
  2⤵
  PID:10348
- C:\Windows\System\GXdZFYa.exe
  C:\Windows\System\GXdZFYa.exe
  2⤵
  PID:10376
- C:\Windows\System\ZGCYwZG.exe
  C:\Windows\System\ZGCYwZG.exe
  2⤵
  PID:10404
- C:\Windows\System\TEMDqHB.exe
  C:\Windows\System\TEMDqHB.exe
  2⤵
  PID:10432
- C:\Windows\System\goKojIQ.exe
  C:\Windows\System\goKojIQ.exe
  2⤵
  PID:10460
- C:\Windows\System\EXbKXOZ.exe
  C:\Windows\System\EXbKXOZ.exe
  2⤵
  PID:10488
- C:\Windows\System\OggjPqP.exe
  C:\Windows\System\OggjPqP.exe
  2⤵
  PID:10516
- C:\Windows\System\GdFYvae.exe
  C:\Windows\System\GdFYvae.exe
  2⤵
  PID:10532
- C:\Windows\System\eupIpbv.exe
  C:\Windows\System\eupIpbv.exe
  2⤵
  PID:10572
- C:\Windows\System\IzmaVsv.exe
  C:\Windows\System\IzmaVsv.exe
  2⤵
  PID:10596
- C:\Windows\System\IrkvaKt.exe
  C:\Windows\System\IrkvaKt.exe
  2⤵
  PID:10616
- C:\Windows\System\tbosfLq.exe
  C:\Windows\System\tbosfLq.exe
  2⤵
  PID:10644
- C:\Windows\System\PNPmowH.exe
  C:\Windows\System\PNPmowH.exe
  2⤵
  PID:10672
- C:\Windows\System\eiYIGNa.exe
  C:\Windows\System\eiYIGNa.exe
  2⤵
  PID:10712
- C:\Windows\System\RLICQFf.exe
  C:\Windows\System\RLICQFf.exe
  2⤵
  PID:10728
- C:\Windows\System\cfWInXE.exe
  C:\Windows\System\cfWInXE.exe
  2⤵
  PID:10768
- C:\Windows\System\RAmOomI.exe
  C:\Windows\System\RAmOomI.exe
  2⤵
  PID:10784
- C:\Windows\System\wRiflon.exe
  C:\Windows\System\wRiflon.exe
  2⤵
  PID:10824
- C:\Windows\System\SBxjutM.exe
  C:\Windows\System\SBxjutM.exe
  2⤵
  PID:10844
- C:\Windows\System\iXrpMJq.exe
  C:\Windows\System\iXrpMJq.exe
  2⤵
  PID:10880
- C:\Windows\System\ZQujZDd.exe
  C:\Windows\System\ZQujZDd.exe
  2⤵
  PID:10896
- C:\Windows\System\ijELzpH.exe
  C:\Windows\System\ijELzpH.exe
  2⤵
  PID:10936
- C:\Windows\System\VJoDNEs.exe
  C:\Windows\System\VJoDNEs.exe
  2⤵
  PID:10964
- C:\Windows\System\BBApvkz.exe
  C:\Windows\System\BBApvkz.exe
  2⤵
  PID:10992
- C:\Windows\System\HbnDPHr.exe
  C:\Windows\System\HbnDPHr.exe
  2⤵
  PID:11020
- C:\Windows\System\fKbnwPD.exe
  C:\Windows\System\fKbnwPD.exe
  2⤵
  PID:11040
- C:\Windows\System\JpEYQqT.exe
  C:\Windows\System\JpEYQqT.exe
  2⤵
  PID:11076
- C:\Windows\System\ZfMXUxQ.exe
  C:\Windows\System\ZfMXUxQ.exe
  2⤵
  PID:11096
- C:\Windows\System\nMeUALz.exe
  C:\Windows\System\nMeUALz.exe
  2⤵
  PID:11132
- C:\Windows\System\Gswklua.exe
  C:\Windows\System\Gswklua.exe
  2⤵
  PID:11148
- C:\Windows\System\sFQdrZu.exe
  C:\Windows\System\sFQdrZu.exe
  2⤵
  PID:11188
- C:\Windows\System\AnNELQH.exe
  C:\Windows\System\AnNELQH.exe
  2⤵
  PID:11204
- C:\Windows\System\soVtrlh.exe
  C:\Windows\System\soVtrlh.exe
  2⤵
  PID:11240
- C:\Windows\System\XThRNNs.exe
  C:\Windows\System\XThRNNs.exe
  2⤵
  PID:10272
- C:\Windows\System\jjyEDWM.exe
  C:\Windows\System\jjyEDWM.exe
  2⤵
  PID:10304
- C:\Windows\System\xZCJCaH.exe
  C:\Windows\System\xZCJCaH.exe
  2⤵
  PID:10396
- C:\Windows\System\TPZtiDE.exe
  C:\Windows\System\TPZtiDE.exe
  2⤵
  PID:10456
- C:\Windows\System\MCwbfCi.exe
  C:\Windows\System\MCwbfCi.exe
  2⤵
  PID:10528
- C:\Windows\System\VeFRPCz.exe
  C:\Windows\System\VeFRPCz.exe
  2⤵
  PID:10588
- C:\Windows\System\NGfBHZd.exe
  C:\Windows\System\NGfBHZd.exe
  2⤵
  PID:10664
- C:\Windows\System\erbjzSv.exe
  C:\Windows\System\erbjzSv.exe
  2⤵
  PID:10720
- C:\Windows\System\vEUKzzC.exe
  C:\Windows\System\vEUKzzC.exe
  2⤵
  PID:10780
- C:\Windows\System\oylxrFZ.exe
  C:\Windows\System\oylxrFZ.exe
  2⤵
  PID:10832
- C:\Windows\System\fVfaMPx.exe
  C:\Windows\System\fVfaMPx.exe
  2⤵
  PID:10916
- C:\Windows\System\ZMszpIV.exe
  C:\Windows\System\ZMszpIV.exe
  2⤵
  PID:10956
- C:\Windows\System\rBmCWLs.exe
  C:\Windows\System\rBmCWLs.exe
  2⤵
  PID:11028
- C:\Windows\System\ayCHJJw.exe
  C:\Windows\System\ayCHJJw.exe
  2⤵
  PID:11084
- C:\Windows\System\rMZsyJi.exe
  C:\Windows\System\rMZsyJi.exe
  2⤵
  PID:11180
- C:\Windows\System\SFLNxQO.exe
  C:\Windows\System\SFLNxQO.exe
  2⤵
  PID:11256
- C:\Windows\System\udnAzMh.exe
  C:\Windows\System\udnAzMh.exe
  2⤵
  PID:10368
- C:\Windows\System\qOgUsOG.exe
  C:\Windows\System\qOgUsOG.exe
  2⤵
  PID:2464
- C:\Windows\System\GiokhEu.exe
  C:\Windows\System\GiokhEu.exe
  2⤵
  PID:10564
- C:\Windows\System\bNUsXcR.exe
  C:\Windows\System\bNUsXcR.exe
  2⤵
  PID:10760
- C:\Windows\System\XLkgUVG.exe
  C:\Windows\System\XLkgUVG.exe
  2⤵
  PID:10888
- C:\Windows\System\sfeyNtf.exe
  C:\Windows\System\sfeyNtf.exe
  2⤵
  PID:11048
- C:\Windows\System\iqGzBiN.exe
  C:\Windows\System\iqGzBiN.exe
  2⤵
  PID:11140
- C:\Windows\System\liJZXRx.exe
  C:\Windows\System\liJZXRx.exe
  2⤵
  PID:10332
- C:\Windows\System\MxEqBbt.exe
  C:\Windows\System\MxEqBbt.exe
  2⤵
  PID:10740
- C:\Windows\System\euHhfTD.exe
  C:\Windows\System\euHhfTD.exe
  2⤵
  PID:11164
- C:\Windows\System\UgWnXvx.exe
  C:\Windows\System\UgWnXvx.exe
  2⤵
  PID:10608
- C:\Windows\System\KPYKwFU.exe
  C:\Windows\System\KPYKwFU.exe
  2⤵
  PID:10512
- C:\Windows\System\LMjadYL.exe
  C:\Windows\System\LMjadYL.exe
  2⤵
  PID:11276
- C:\Windows\System\eRaxhVU.exe
  C:\Windows\System\eRaxhVU.exe
  2⤵
  PID:11304
- C:\Windows\System\RzmwGlu.exe
  C:\Windows\System\RzmwGlu.exe
  2⤵
  PID:11332
- C:\Windows\System\fCmYKHS.exe
  C:\Windows\System\fCmYKHS.exe
  2⤵
  PID:11360
- C:\Windows\System\cTcAeWq.exe
  C:\Windows\System\cTcAeWq.exe
  2⤵
  PID:11388
- C:\Windows\System\tTBfLRW.exe
  C:\Windows\System\tTBfLRW.exe
  2⤵
  PID:11416
- C:\Windows\System\XopwFsV.exe
  C:\Windows\System\XopwFsV.exe
  2⤵
  PID:11444
- C:\Windows\System\BlSHBji.exe
  C:\Windows\System\BlSHBji.exe
  2⤵
  PID:11460
- C:\Windows\System\bvPdLvD.exe
  C:\Windows\System\bvPdLvD.exe
  2⤵
  PID:11488
- C:\Windows\System\esvmruN.exe
  C:\Windows\System\esvmruN.exe
  2⤵
  PID:11516
- C:\Windows\System\nSKKxlR.exe
  C:\Windows\System\nSKKxlR.exe
  2⤵
  PID:11544
- C:\Windows\System\yaRMlXo.exe
  C:\Windows\System\yaRMlXo.exe
  2⤵
  PID:11584
- C:\Windows\System\XnnhPpV.exe
  C:\Windows\System\XnnhPpV.exe
  2⤵
  PID:11612
- C:\Windows\System\mwkZbKY.exe
  C:\Windows\System\mwkZbKY.exe
  2⤵
  PID:11640
- C:\Windows\System\joDCIfD.exe
  C:\Windows\System\joDCIfD.exe
  2⤵
  PID:11656
- C:\Windows\System\GoLrYyW.exe
  C:\Windows\System\GoLrYyW.exe
  2⤵
  PID:11680
- C:\Windows\System\VHkYPGu.exe
  C:\Windows\System\VHkYPGu.exe
  2⤵
  PID:11712
- C:\Windows\System\sSRCvjN.exe
  C:\Windows\System\sSRCvjN.exe
  2⤵
  PID:11744
- C:\Windows\System\SugnOzN.exe
  C:\Windows\System\SugnOzN.exe
  2⤵
  PID:11780
- C:\Windows\System\ppdtkEW.exe
  C:\Windows\System\ppdtkEW.exe
  2⤵
  PID:11808
- C:\Windows\System\iGFZbCI.exe
  C:\Windows\System\iGFZbCI.exe
  2⤵
  PID:11828
- C:\Windows\System\cqXLwsy.exe
  C:\Windows\System\cqXLwsy.exe
  2⤵
  PID:11852
- C:\Windows\System\ccCFhds.exe
  C:\Windows\System\ccCFhds.exe
  2⤵
  PID:11884
- C:\Windows\System\uhCIfRi.exe
  C:\Windows\System\uhCIfRi.exe
  2⤵
  PID:11920
- C:\Windows\System\lCsPcDB.exe
  C:\Windows\System\lCsPcDB.exe
  2⤵
  PID:11948
- C:\Windows\System\TRHBnPv.exe
  C:\Windows\System\TRHBnPv.exe
  2⤵
  PID:11976
- C:\Windows\System\LvADHDU.exe
  C:\Windows\System\LvADHDU.exe
  2⤵
  PID:12000
- C:\Windows\System\deQqBad.exe
  C:\Windows\System\deQqBad.exe
  2⤵
  PID:12032
- C:\Windows\System\jkyexBW.exe
  C:\Windows\System\jkyexBW.exe
  2⤵
  PID:12060
- C:\Windows\System\BtJegfU.exe
  C:\Windows\System\BtJegfU.exe
  2⤵
  PID:12080
- C:\Windows\System\MkEIDXB.exe
  C:\Windows\System\MkEIDXB.exe
  2⤵
  PID:12116
- C:\Windows\System\DViFlQD.exe
  C:\Windows\System\DViFlQD.exe
  2⤵
  PID:12144
- C:\Windows\System\GpkrYhu.exe
  C:\Windows\System\GpkrYhu.exe
  2⤵
  PID:12164
- C:\Windows\System\rzWCrtZ.exe
  C:\Windows\System\rzWCrtZ.exe
  2⤵
  PID:12192
- C:\Windows\System\daOWfcz.exe
  C:\Windows\System\daOWfcz.exe
  2⤵
  PID:12224
- C:\Windows\System\OmKkBiN.exe
  C:\Windows\System\OmKkBiN.exe
  2⤵
  PID:12260
- C:\Windows\System\wzqRXZQ.exe
  C:\Windows\System\wzqRXZQ.exe
  2⤵
  PID:12276
- C:\Windows\System\CcfArYo.exe
  C:\Windows\System\CcfArYo.exe
  2⤵
  PID:11316
- C:\Windows\System\UpQKAXt.exe
  C:\Windows\System\UpQKAXt.exe
  2⤵
  PID:11384
- C:\Windows\System\SqiyPyK.exe
  C:\Windows\System\SqiyPyK.exe
  2⤵
  PID:11428
- C:\Windows\System\NGZuYsK.exe
  C:\Windows\System\NGZuYsK.exe
  2⤵
  PID:11500
- C:\Windows\System\WnPHBFt.exe
  C:\Windows\System\WnPHBFt.exe
  2⤵
  PID:11580
- C:\Windows\System\yvJwCuU.exe
  C:\Windows\System\yvJwCuU.exe
  2⤵
  PID:11648
- C:\Windows\System\PgTGtBc.exe
  C:\Windows\System\PgTGtBc.exe
  2⤵
  PID:11692
- C:\Windows\System\beafMgI.exe
  C:\Windows\System\beafMgI.exe
  2⤵
  PID:11732
- C:\Windows\System\chdaDxl.exe
  C:\Windows\System\chdaDxl.exe
  2⤵
  PID:11816
- C:\Windows\System\GwtGXum.exe
  C:\Windows\System\GwtGXum.exe
  2⤵
  PID:11912
- C:\Windows\System\MoWJuWz.exe
  C:\Windows\System\MoWJuWz.exe
  2⤵
  PID:11972
- C:\Windows\System\uYxMhWA.exe
  C:\Windows\System\uYxMhWA.exe
  2⤵
  PID:12044
- C:\Windows\System\YBVvEoY.exe
  C:\Windows\System\YBVvEoY.exe
  2⤵
  PID:2668
- C:\Windows\System\GZgKQlg.exe
  C:\Windows\System\GZgKQlg.exe
  2⤵
  PID:12100
- C:\Windows\System\dGXktGn.exe
  C:\Windows\System\dGXktGn.exe
  2⤵
  PID:4676
- C:\Windows\System\UyUrCsJ.exe
  C:\Windows\System\UyUrCsJ.exe
  2⤵
  PID:12160
- C:\Windows\System\obPGXSM.exe
  C:\Windows\System\obPGXSM.exe
  2⤵
  PID:12204
- C:\Windows\System\TjIkjMT.exe
  C:\Windows\System\TjIkjMT.exe
  2⤵
  PID:11268
- C:\Windows\System\GhsUgZX.exe
  C:\Windows\System\GhsUgZX.exe
  2⤵
  PID:11408
- C:\Windows\System\QOdUyQm.exe
  C:\Windows\System\QOdUyQm.exe
  2⤵
  PID:11576
- C:\Windows\System\nFVpxOa.exe
  C:\Windows\System\nFVpxOa.exe
  2⤵
  PID:11752
- C:\Windows\System\wUtyOPZ.exe
  C:\Windows\System\wUtyOPZ.exe
  2⤵
  PID:11792
- C:\Windows\System\HTdGPKv.exe
  C:\Windows\System\HTdGPKv.exe
  2⤵
  PID:11960
- C:\Windows\System\yibcYha.exe
  C:\Windows\System\yibcYha.exe
  2⤵
  PID:4520
- C:\Windows\System\VMcjeXF.exe
  C:\Windows\System\VMcjeXF.exe
  2⤵
  PID:12208
- C:\Windows\System\tfpWgUO.exe
  C:\Windows\System\tfpWgUO.exe
  2⤵
  PID:11372
- C:\Windows\System\dxuMasr.exe
  C:\Windows\System\dxuMasr.exe
  2⤵
  PID:11804
- C:\Windows\System\HajiuuY.exe
  C:\Windows\System\HajiuuY.exe
  2⤵
  PID:4760
- C:\Windows\System\gOIWBax.exe
  C:\Windows\System\gOIWBax.exe
  2⤵
  PID:11512
- C:\Windows\System\IwJtNED.exe
  C:\Windows\System\IwJtNED.exe
  2⤵
  PID:12184
- C:\Windows\System\wYAfMQo.exe
  C:\Windows\System\wYAfMQo.exe
  2⤵
  PID:3972
- C:\Windows\System\xQzZADh.exe
  C:\Windows\System\xQzZADh.exe
  2⤵
  PID:12320
- C:\Windows\System\IeJMHhx.exe
  C:\Windows\System\IeJMHhx.exe
  2⤵
  PID:12348
- C:\Windows\System\IsNpzGR.exe
  C:\Windows\System\IsNpzGR.exe
  2⤵
  PID:12364
- C:\Windows\System\yXgYgWC.exe
  C:\Windows\System\yXgYgWC.exe
  2⤵
  PID:12404
- C:\Windows\System\vrWgEOV.exe
  C:\Windows\System\vrWgEOV.exe
  2⤵
  PID:12432
- C:\Windows\System\gDJyOnf.exe
  C:\Windows\System\gDJyOnf.exe
  2⤵
  PID:12464
- C:\Windows\System\fHveCXc.exe
  C:\Windows\System\fHveCXc.exe
  2⤵
  PID:12492
- C:\Windows\System\IEodRpp.exe
  C:\Windows\System\IEodRpp.exe
  2⤵
  PID:12520
- C:\Windows\System\FImNbax.exe
  C:\Windows\System\FImNbax.exe
  2⤵
  PID:12544
- C:\Windows\System\RyswCqN.exe
  C:\Windows\System\RyswCqN.exe
  2⤵
  PID:12576
- C:\Windows\System\fwRpEFs.exe
  C:\Windows\System\fwRpEFs.exe
  2⤵
  PID:12592
- C:\Windows\System\plQGpiw.exe
  C:\Windows\System\plQGpiw.exe
  2⤵
  PID:12624
- C:\Windows\System\MfqkPLC.exe
  C:\Windows\System\MfqkPLC.exe
  2⤵
  PID:12660
- C:\Windows\System\ZkWeSfN.exe
  C:\Windows\System\ZkWeSfN.exe
  2⤵
  PID:12680
- C:\Windows\System\nJcMkes.exe
  C:\Windows\System\nJcMkes.exe
  2⤵
  PID:12704
- C:\Windows\System\eOuJXOJ.exe
  C:\Windows\System\eOuJXOJ.exe
  2⤵
  PID:12744
- C:\Windows\System\YENGrKj.exe
  C:\Windows\System\YENGrKj.exe
  2⤵
  PID:12768
- C:\Windows\System\LHVZoxz.exe
  C:\Windows\System\LHVZoxz.exe
  2⤵
  PID:12788
- C:\Windows\System\wMLxOOL.exe
  C:\Windows\System\wMLxOOL.exe
  2⤵
  PID:12828
- C:\Windows\System\Lrmobma.exe
  C:\Windows\System\Lrmobma.exe
  2⤵
  PID:12844
- C:\Windows\System\BBWnNjs.exe
  C:\Windows\System\BBWnNjs.exe
  2⤵
  PID:12880
- C:\Windows\System\GTOjIWK.exe
  C:\Windows\System\GTOjIWK.exe
  2⤵
  PID:12924
- C:\Windows\System\oqxztJv.exe
  C:\Windows\System\oqxztJv.exe
  2⤵
  PID:12940
- C:\Windows\System\sNfRTuY.exe
  C:\Windows\System\sNfRTuY.exe
  2⤵
  PID:12968
- C:\Windows\System\zrtbHDY.exe
  C:\Windows\System\zrtbHDY.exe
  2⤵
  PID:12996
- C:\Windows\System\JdHjOXi.exe
  C:\Windows\System\JdHjOXi.exe
  2⤵
  PID:13024
- C:\Windows\System\GEiBmzI.exe
  C:\Windows\System\GEiBmzI.exe
  2⤵
  PID:13048
- C:\Windows\System\STbDcoR.exe
  C:\Windows\System\STbDcoR.exe
  2⤵
  PID:13084
- C:\Windows\System\nEPtOlc.exe
  C:\Windows\System\nEPtOlc.exe
  2⤵
  PID:13112
- C:\Windows\System\MMlvDKc.exe
  C:\Windows\System\MMlvDKc.exe
  2⤵
  PID:13136
- C:\Windows\System\mJdCJma.exe
  C:\Windows\System\mJdCJma.exe
  2⤵
  PID:13168
- C:\Windows\System\urhrgMm.exe
  C:\Windows\System\urhrgMm.exe
  2⤵
  PID:13196
- C:\Windows\System\psATmLO.exe
  C:\Windows\System\psATmLO.exe
  2⤵
  PID:13224
- C:\Windows\System\eDFWYmx.exe
  C:\Windows\System\eDFWYmx.exe
  2⤵
  PID:13252
- C:\Windows\System\IwIwmBM.exe
  C:\Windows\System\IwIwmBM.exe
  2⤵
  PID:13280
- C:\Windows\System\ZPDjVTQ.exe
  C:\Windows\System\ZPDjVTQ.exe
  2⤵
  PID:13308
- C:\Windows\System\otiuAvX.exe
  C:\Windows\System\otiuAvX.exe
  2⤵
  PID:12332
- C:\Windows\System\tYssfxv.exe
  C:\Windows\System\tYssfxv.exe
  2⤵
  PID:12356
- C:\Windows\System\iRRZMaB.exe
  C:\Windows\System\iRRZMaB.exe
  2⤵
  PID:12448
- C:\Windows\System\CgFlemm.exe
  C:\Windows\System\CgFlemm.exe
  2⤵
  PID:12540
- C:\Windows\System\bGZjGUK.exe
  C:\Windows\System\bGZjGUK.exe
  2⤵
  PID:12584
- C:\Windows\System\YKBBZwX.exe
  C:\Windows\System\YKBBZwX.exe
  2⤵
  PID:12656
- C:\Windows\System\WpGDJqM.exe
  C:\Windows\System\WpGDJqM.exe
  2⤵
  PID:12696
- C:\Windows\System\amdmUsc.exe
  C:\Windows\System\amdmUsc.exe
  2⤵
  PID:12760
- C:\Windows\System\bJTuPOZ.exe
  C:\Windows\System\bJTuPOZ.exe
  2⤵
  PID:12856
- C:\Windows\System\fLTDGkq.exe
  C:\Windows\System\fLTDGkq.exe
  2⤵
  PID:12896
- C:\Windows\System\ZvkiowU.exe
  C:\Windows\System\ZvkiowU.exe
  2⤵
  PID:12988
- C:\Windows\System\lCWYAJM.exe
  C:\Windows\System\lCWYAJM.exe
  2⤵
  PID:13044
- C:\Windows\System\alChyak.exe
  C:\Windows\System\alChyak.exe
  2⤵
  PID:13104
- C:\Windows\System\DlARndA.exe
  C:\Windows\System\DlARndA.exe
  2⤵
  PID:13180
- C:\Windows\System\yOnILqY.exe
  C:\Windows\System\yOnILqY.exe
  2⤵
  PID:13240
- C:\Windows\System\FekrLmw.exe
  C:\Windows\System\FekrLmw.exe
  2⤵
  PID:12360
- C:\Windows\System\nvFNTwX.exe
  C:\Windows\System\nvFNTwX.exe
  2⤵
  PID:12488
- C:\Windows\System\nBONAIi.exe
  C:\Windows\System\nBONAIi.exe
  2⤵
  PID:12604
- C:\Windows\System\doBTBWo.exe
  C:\Windows\System\doBTBWo.exe
  2⤵
  PID:12784
- C:\Windows\System\HbbvSNa.exe
  C:\Windows\System\HbbvSNa.exe
  2⤵
  PID:12952
- C:\Windows\System\cUKExmx.exe
  C:\Windows\System\cUKExmx.exe
  2⤵
  PID:12980
- C:\Windows\System\PHpOyPd.exe
  C:\Windows\System\PHpOyPd.exe
  2⤵
  PID:872
- C:\Windows\System\Xwexwjt.exe
  C:\Windows\System\Xwexwjt.exe
  2⤵
  PID:4888
- C:\Windows\System\lbRXtpR.exe
  C:\Windows\System\lbRXtpR.exe
  2⤵
  PID:13072
- C:\Windows\System\JPtXWMe.exe
  C:\Windows\System\JPtXWMe.exe
  2⤵
  PID:13208
- C:\Windows\System\igSSdPz.exe
  C:\Windows\System\igSSdPz.exe
  2⤵
  PID:5452
- C:\Windows\System\WBDNTHf.exe
  C:\Windows\System\WBDNTHf.exe
  2⤵
  PID:6660
- C:\Windows\System\ARbnyPB.exe
  C:\Windows\System\ARbnyPB.exe
  2⤵
  PID:6520
- C:\Windows\System\rvaNRYa.exe
  C:\Windows\System\rvaNRYa.exe
  2⤵
  PID:1944
- C:\Windows\System\EAAELZP.exe
  C:\Windows\System\EAAELZP.exe
  2⤵
  PID:13340
- C:\Windows\System\diFJvAX.exe
  C:\Windows\System\diFJvAX.exe
  2⤵
  PID:13368
- C:\Windows\System\WOTzWAe.exe
  C:\Windows\System\WOTzWAe.exe
  2⤵
  PID:13400
- C:\Windows\System\hpNtmmx.exe
  C:\Windows\System\hpNtmmx.exe
  2⤵
  PID:13428
- C:\Windows\System\pdAISiN.exe
  C:\Windows\System\pdAISiN.exe
  2⤵
  PID:13468
- C:\Windows\System\eeflYNL.exe
  C:\Windows\System\eeflYNL.exe
  2⤵
  PID:13484
- C:\Windows\System\fyUMgok.exe
  C:\Windows\System\fyUMgok.exe
  2⤵
  PID:13512
- C:\Windows\System\zBBNtXr.exe
  C:\Windows\System\zBBNtXr.exe
  2⤵
  PID:13540
- C:\Windows\System\pdmKPfU.exe
  C:\Windows\System\pdmKPfU.exe
  2⤵
  PID:13568
- C:\Windows\System\bIkltoZ.exe
  C:\Windows\System\bIkltoZ.exe
  2⤵
  PID:13596
- C:\Windows\System\XrfGJUe.exe
  C:\Windows\System\XrfGJUe.exe
  2⤵
  PID:13624
- C:\Windows\System\BaPRDLA.exe
  C:\Windows\System\BaPRDLA.exe
  2⤵
  PID:13652
- C:\Windows\System\sZPfNFG.exe
  C:\Windows\System\sZPfNFG.exe
  2⤵
  PID:13680
- C:\Windows\System\MldvXTX.exe
  C:\Windows\System\MldvXTX.exe
  2⤵
  PID:13708
- C:\Windows\System\XMYBmcB.exe
  C:\Windows\System\XMYBmcB.exe
  2⤵
  PID:13736
- C:\Windows\System\rUzYwTQ.exe
  C:\Windows\System\rUzYwTQ.exe
  2⤵
  PID:13764
- C:\Windows\System\axDlCaL.exe
  C:\Windows\System\axDlCaL.exe
  2⤵
  PID:13792
- C:\Windows\System\lCwbZtm.exe
  C:\Windows\System\lCwbZtm.exe
  2⤵
  PID:13820
- C:\Windows\System\THzVdbH.exe
  C:\Windows\System\THzVdbH.exe
  2⤵
  PID:13848
- C:\Windows\System\fYUVpIz.exe
  C:\Windows\System\fYUVpIz.exe
  2⤵
  PID:13876
- C:\Windows\System\PgVNjlY.exe
  C:\Windows\System\PgVNjlY.exe
  2⤵
  PID:13904
- C:\Windows\System\weuyQpr.exe
  C:\Windows\System\weuyQpr.exe
  2⤵
  PID:13932
- C:\Windows\System\WVHVUvU.exe
  C:\Windows\System\WVHVUvU.exe
  2⤵
  PID:13960
- C:\Windows\System\rYlZYTz.exe
  C:\Windows\System\rYlZYTz.exe
  2⤵
  PID:13988
- C:\Windows\System\dVlDAcy.exe
  C:\Windows\System\dVlDAcy.exe
  2⤵
  PID:14028
- C:\Windows\System\VOExVEc.exe
  C:\Windows\System\VOExVEc.exe
  2⤵
  PID:14044
- C:\Windows\System\DRouCCY.exe
  C:\Windows\System\DRouCCY.exe
  2⤵
  PID:14072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3444,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:8
1⤵
PID:7560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3q3fqk5t.rix.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DyhPwfr.exe

Filesize
2.9MB

MD5
e75f8ee51e5b0871e6c05941dbc2450d

SHA1
642e518f5cda965617876e0e69009364b7bd9af5

SHA256
01c1cb715dcb2dd94ac08d84c89acc25f466fd3d031ca6b4ab1b38b4ea8a2f25

SHA512
a366eddfcdc689a1910735ea21c77d4778ebb920c452d212f87c951dd0d4faf81edd74c5b2743cb0219066ec91b58df9d5b3a23f3da88e20e51621f9ef9361f0

Download Submit
C:\Windows\System\DzlBasO.exe

Filesize
2.9MB

MD5
a36db066d0a11baf5945018f409e88cf

SHA1
c6e29746ca93accaacb78a9dc54207306bf03ebe

SHA256
c9a530f8903f972f2d61fbde9d9a6f1487eda351f63d2ac972c5a09eca621527

SHA512
9efeba25b042a53439fc8511e844c2a20e47444a382cbe4471756c66dd6f32f9883aed55e303abb56bd001bbc672e6eefdf69531770f71762ad4954dce63cce6

Download Submit
C:\Windows\System\FTtxTLA.exe

Filesize
2.9MB

MD5
83307a087e3d3b2c42fce1d436bf856a

SHA1
74517b14d68a9f7a72205bb7c16f45c30eb11246

SHA256
8dfcd1f17bfdf7fff70a825cb2ba0401e3ec1cdbb78d584d81613e0176bb444a

SHA512
e83c4e3b411653c63c826782502de7b2849fd5f8f49fd092eb2132130182e4bd30a01309c98d75b972f8284393f4ca4178ef5e31289a3b9c4cb7f3b38e748446

Download Submit
C:\Windows\System\HbYPIEq.exe

Filesize
2.9MB

MD5
6e90c4ca3ef98ed113655b92ca53b0da

SHA1
7d5e3b13c2f9aeb777f667878255f748f42a69ef

SHA256
bf06d67cd6e5be2503b06e1aa825d4c6c77744aef5825ea3fdc61c245ea8341c

SHA512
46608868369f8200a0c545fd3334edb46e4ef891ee43382583876b9af08a9c8744de3eb5b33636b524eef8829acf39c338a5f1af0879143d7e8ffc2110934c03

Download Submit
C:\Windows\System\IQzCjcs.exe

Filesize
2.9MB

MD5
7cc4856753e6cce98bec309f3efd2477

SHA1
d9559762e754a06a9de10882d37e581ce28d6e86

SHA256
4bb6b6c7812e4f02e9db48de460dc06fe19f7df0860d80a612d0cb29c6267a36

SHA512
63f20beee95fdd0d3be3ac69eb7f2976f86c932b91da1a3630ea12ec27eae1e098bebf8984a07e1d532620ce16bf9f8d371eec61be3247a6ffe4f2e86028f70d

Download Submit
C:\Windows\System\JCEkrgk.exe

Filesize
2.9MB

MD5
068b0e135f0800900dc100854a7dd843

SHA1
cc3c0cf39834a9150971d708fa2ab99c2bbfed66

SHA256
81380b4b2b57588934f5c65e2676f21033f041ab3b4d4a8d31392c2cc97d2b76

SHA512
6c3f8fe5e53a159ecbaeb792baf7bcbe667fbf2b345e80cfe75ce2939902122557a31cfd0eea8979fbb1b931018173516c970f8e3127f015521c486c6a7285a5

Download Submit
C:\Windows\System\QjhygsN.exe

Filesize
2.9MB

MD5
8ddbf661a99f959839ba293f401425e8

SHA1
7c4f33a5c9b6d203f3de11427b09afdb2e984924

SHA256
f3b5e05e8335ac9c059c4d802a58268ad0bc725cdbcf29a2976e2119eb248bf8

SHA512
3991801caa15a6da6109d32f7453703cc6cc0557e6e6a3f9512a1460f0f24c7d4e4c67b69facdb8500232de11680534d4126baafaac0313caf94267820687c48

Download Submit
C:\Windows\System\SOVHDHe.exe

Filesize
2.9MB

MD5
f6c9c87271b98398fe32d4150c02156e

SHA1
db3182976eabf5a176f348a7010f48161833c793

SHA256
1fd58231cc6426c7c4ee2c77aaa0d503815b01fa21fd415405b4fec3af0e4ada

SHA512
86c50d25bc1b27455522ef62aad27012446418e21da469bb248df7f0c92025d3d2b697cfa4af2c1417b570acdce0b282ec86ee0cf3a1dd5c4c5694fbec6a92df

Download Submit
C:\Windows\System\TvQHgKt.exe

Filesize
2.9MB

MD5
3ae9bf41fd38367ae9f5a95023369067

SHA1
f728618b8bf65c1f4026a53964546ed6c322d245

SHA256
8e15cbb78e8c8003b7dc85533b631d9e15300786cec2f76f9facb707d4ccf77f

SHA512
098cc523207a908cd2699e1f0a0a7984a9a6c66c797f790a9caa0f22abecb07aa28e0a2e70d886fe45068a0e9d97bd8c1f127e612eb72020a37f603d7276f4e5

Download Submit
C:\Windows\System\VPOKtbc.exe

Filesize
2.9MB

MD5
9e635c6c804d7ef737d3c58a2d8e93a3

SHA1
2d285abd41ced7a653474e3db5bdca030cd95d79

SHA256
8974fd75a9e5b000367bd879fb157045a99496b204ed88a5a5e6ba472a51cea1

SHA512
8df470b6ed96dfc5f02410bc3348c5295b8d787ae2e6d2a236e890cf0837e5aca457e04c84942fbd7be5933f4398c23681fe051ab7922f67e9d700007c6197ff

Download Submit
C:\Windows\System\WDJRmfP.exe

Filesize
2.9MB

MD5
0f324edf924bfd823620dfd112c42474

SHA1
1a314f598c88189740f8fc52ef9dbdc2c1d8b240

SHA256
4fe8017a80a2f9d4c35a690b5a56228f16799aa0ed0ccde1aa5cc0908b65b4e5

SHA512
6f4ccc9cec1c14f159d753d0536a770e83ba64fdf9265301462c2557a5a1e6baf27e9664f20b7dc2ebe600a06fd5d0a782dc01aa4854b5903bb48d04f66ea0ec

Download Submit
C:\Windows\System\WiBbhpO.exe

Filesize
2.9MB

MD5
68b60d0230c1aea8444e78cb685c886c

SHA1
85412c51b96eea36368ba9b7a42dd51ff8849b39

SHA256
1dd9cdc0fe0b08be4229e622b697d957bc36983032f4df536012ba4aab5120c0

SHA512
45575168e7b4322e45f0a9ce8069b3132caa73c852894a9b955d4cb7e30b1d8f9772a85742352721050f6dbfa81862eb7b59bbcd938b6bfa8a6421ca53ca42aa

Download Submit
C:\Windows\System\YzvnSNQ.exe

Filesize
2.9MB

MD5
0f897ba0f0281bf3861ab3866cd198ff

SHA1
8335948c3c377caf33dd46cca6c96c456b73c09f

SHA256
79fda193ca63b059a4c098acf0ede99368b13af8eaf8ae69ffd0e7566df070dc

SHA512
a0c9dba847d7be172fc04b79a8075ffaa97f13a1b45e5d418e62fc512e5489b384a258f6bb1a7deedc57163227e021b0538fab1ed93940129a30733b78ccdd7f

Download Submit
C:\Windows\System\ZblEjmC.exe

Filesize
2.9MB

MD5
f14ba189c6a232e6cb9d0a4361d55cc8

SHA1
0cc9d468f1b1d5b242ac3e5b6a4da59e761638a9

SHA256
1cc52ab21c19340199fc4bbdcacf6b65bde44521a0226af8b6febe632039f241

SHA512
4298d2b60975fd85923c47e9120de49de5df68988e55c1be46cbcb2aeb8e11e52b3aa8421d0a7f4f826d5db1053f5dc98380da99f3c259bfe70ddd1c1fa5896b

Download Submit
C:\Windows\System\bvfGfnp.exe

Filesize
2.9MB

MD5
efd3e3d3f436f5f484b8a7888512da43

SHA1
2c8177a0ba043ea107b57b7c82d6f5511dcbb4bb

SHA256
7b8594c4f480a8d655d1d18746ac348682b9387c10964c4b5c7fcec922fb7941

SHA512
87756f0c3ba4d5058e0c942d3193e24c91e6f7c7f7ee700d960ecb8797165b61379cf10bf9c5518f2840f521f3de188bb6e8100e0bf883381f17e2e8e43e8e39

Download Submit
C:\Windows\System\iAFeQgu.exe

Filesize
2.9MB

MD5
05aea79931c13ea853d1223d8e88bead

SHA1
6fe4bb3dffbcc259803eae6d89add753b7c1ef44

SHA256
e8aac682d355b6d3dccdeefbc3542318f2998df00e3bdda2522346ac7f298b07

SHA512
2827d7d5c6eaad4af4377d0f8a9a0cd903125a3d386bbad4ec525b4b06642dc1a108082a93d572b3dffd0413d331febe4ee8d26fb7a392ee9c57d2f234875c2b

Download Submit
C:\Windows\System\jMTtQOI.exe

Filesize
2.9MB

MD5
ff5d4a9669d2adcf826f01d0ff3e594a

SHA1
560e076d591b274aa636a2e8c7a525e9044884fa

SHA256
6287d0665353a7c2c735f1341a65c280b117cece57558e3657350288b76d23a4

SHA512
6f06a25294326ccb88d3b5706b2731f44fca8cb480efd2a8f7cc074a9483d9989640cb8b7d9f98705b2ccded3e3668b5d8ba9d4a75c102366672c44486b39d19

Download Submit
C:\Windows\System\lFOoqkU.exe

Filesize
2.9MB

MD5
b29c55a3bb375ba8bf28c80cdd6ea1cb

SHA1
4fab61bf81033dc0d4025d423a01e43d792daf99

SHA256
8de8cfa08d10ea376b21159d1477acd7e6a160cb29f5d77c1dbdb1abc2b5060c

SHA512
ff81375c42f60ffe479ad6b29ffe32e91bb7deccdca62151a07a5eaae3bc87ead77cbf0e9ddd8d64e5de8b799e57b1dd99a4939b0b8d0db0a8dc7e6c8ec8cfb9

Download Submit
C:\Windows\System\nRlWIlu.exe

Filesize
2.9MB

MD5
360a65b593f716a1e26c6b5ee63eee80

SHA1
0d1a4d201cbf47cb49fa7b47c41c1da6bd24108b

SHA256
61d277b86df2719a80bdb6cf473c774b976f19969219b260378388890d86ed54

SHA512
0b452b8f45642997407a7d14a413fe86123b193fe26ee439ff0cb66805c5fed8f2eef0203b0b3848aae69b6e100d07f8ffc178ab55a6310463230359df8b224b

Download Submit
C:\Windows\System\nVQOFZl.exe

Filesize
2.9MB

MD5
d977e2e6bf15cfcd6c38eede50bd0cd7

SHA1
abd1e2e072de9bc93b8d2e1decd9c52fcd0f205a

SHA256
fdbacf7273a62928a55ea6a2cf84745b590ec6ae60dc57ef984988c2cac19f2d

SHA512
1dda15d2c0c32ca5e58ebd07c87c2532d9a3b318e265455290eefe5429821bcb01476788ecf0eab4690cfd1f40594433706b70fcff808519c447076cf5d594ac

Download Submit
C:\Windows\System\pjRjIQD.exe

Filesize
2.9MB

MD5
0b84fd6351bf15ad347dd1672cecdddf

SHA1
f4edfbd2c39cfd0cbc6138f0f2ce2b49d02a9453

SHA256
37a23c7fc6421c15a5d4c9680b7b59a010c2ae840d4702d416135dc34ba90480

SHA512
4bc14df7a06525c2953a0c999452d7149e496700a80265837744eadf8d6fb4cdfa901b5eefb366269dc657fe2dcda6e244b97d27fc7e0cca230a25b4cfefba90

Download Submit
C:\Windows\System\qJKxeSJ.exe

Filesize
2.9MB

MD5
4aff94961a207fdf04e21db9e36b9812

SHA1
fd7374bf1a1edcd62bed1c03feef540211eb5184

SHA256
d93c3adeb49e9ee0028ac6aceb7770df0895eb6756531958a4575e1d588cec28

SHA512
6ecb9ba87b078b05508d903de6f0d259ca7e2fd6261b6a8265b9f766095255e9ad6e7f5d449befe2ee032375a32a6112a0e903c2af1f01bea719893cc7b79547

Download Submit
C:\Windows\System\qcrLJAt.exe

Filesize
2.9MB

MD5
9dfdc1a2032610bb6561f1793254b00b

SHA1
ac0bb30770799b8d684042af55ea7bd90572f1fc

SHA256
60148d026b2237c73cb656eeda599a40d2ceb5359d6fdecd9af695c554967a19

SHA512
be26c070f09e666a99a48d79494f75e0ef13797227513f8b360893484fed5cd07c25991af934afdfdaa51fc8f073f8cb5bd6f2313f5c5ca4bb49ddf3d0d0d12c

Download Submit
C:\Windows\System\qsHNTBD.exe

Filesize
2.9MB

MD5
1fa9ed851cb3d8b2dbe1c2191e4eecd6

SHA1
22a01684b49adf00b04272d8b2775e44d85a670a

SHA256
0d56ae75a3996221a899ccdba3ea726dd9c5eeaa16afc13d6de956e4564dfbe4

SHA512
bbf18f645c4e32abafa9bae0d110c96268c3716a7aff5259283effa68e18e7536fb2ce4ef3bc3e89c68a1736206fd71ba38cf7c36ef9027547399d0f29fa6e98

Download Submit
C:\Windows\System\rAFdGnJ.exe

Filesize
8B

MD5
f249cce64f1edf5dc7bee5be6e2d5ad9

SHA1
0d569e38ec2ee4118bd367894784a63582261e47

SHA256
c376b4c1019dfb02d31ea3137efb150405ef95ba0305dcf5e026248ffc8d7cc2

SHA512
fdeb5b006eba899c911e624dadfb6c7b2eb030236757e187df8ba8d194a5a42df30b590d0fcf3f859b2532e60fc00c33154f75c1e6481913447ff2fa15b08be2

Download Submit
C:\Windows\System\sMMbaNn.exe

Filesize
2.9MB

MD5
a114ed1d171e65b391bc21ba85b4e85d

SHA1
9484227864cf2b6de6a5129bfb3cb59edc51a9d1

SHA256
9a2674e30bd0290c5174fb3fa91de6cf876679b32857bdfe8446b734f0ea7cfd

SHA512
3e62af27464618e3cd95db05d00ceab2dd59e7d5dee6393201dbdf25142612df48163bbfed5ca264ba738e0a9d450a05ec980a7658f3ef852b30dbe99c0eb1a6

Download Submit
C:\Windows\System\tZXCTYK.exe

Filesize
2.9MB

MD5
1b5af973dcbde1ea9ac7f9de36e1fbf9

SHA1
4a1f813afe11f1e7b737a1a5c7000ee92a70e566

SHA256
71865ed270863b0eaccb73c422e15ff3d94a6a909c19c4fa5b42ff07ef84047e

SHA512
ecc0995ffa7083162791cd72fde764c90045a0713e174aca274911a04a94ecaa6dff48dcdb0fa5ff4eda8a4c2a57584cda886544f3a5d1247901ff717d9b45e8

Download Submit
C:\Windows\System\uEeGpna.exe

Filesize
2.9MB

MD5
34bb1439d0df97637d34a415893195ed

SHA1
baa0ff039b6afbc13dfbc101059cd2d048445ada

SHA256
b3c53292ef95082602c9f10a05b6cc9241e5f82ec144523507d061d4bcf6b447

SHA512
9919a1db844c256d85918a872cb411c69e6710dd19006300b2121f97c64b4c276554440a37221f171206bf7e7798fdd51fc9f7aa1b8390428ea43485bb013f21

Download Submit
C:\Windows\System\utBphkc.exe

Filesize
2.9MB

MD5
09cba8ca677ed5a15f2a22ab022e0825

SHA1
7c7a6e6369099dc4676717d4f9edd9d287c40aeb

SHA256
bb3b818a3de7b8589b30f15fecd77a180159891dcdd443bd5c5bf99a03efd956

SHA512
a0f44f577cb27039fd1a907e07a6fd33915bdfd8533b196d4cd30bdc9a3e4f7c00c316a12688b70a762e8ef242d96e0b62f0bc7163f39964556d310c58749021

Download Submit
C:\Windows\System\widHKmr.exe

Filesize
2.9MB

MD5
6921d1b8f2890ea1f271a3cac4b3bb8c

SHA1
6b87d9c0f95f3630cd48d1a30ed22aff0b9ab6a5

SHA256
5e5bcd29d3ddcd2f0bccf3e67ea61708d648638b813515904f49f8dabe9db841

SHA512
29dbc2ef54d49a5d2f5b725d49a3e7d646840ee02829514806757b9133176116128926d3e50a76b7a422933d53076da510c523a7b0358c5a86393a0213bd8efc

Download Submit
C:\Windows\System\wsAvWcj.exe

Filesize
2.9MB

MD5
f09fb87ac4ff0cb1bef75ef80c699071

SHA1
1a5c039b0603d4e958e359c31e45a98eebeb145e

SHA256
a3111f4b8f0625717d96dc3ccc56fd824f2a49a07f956e40905c19a8368a7b42

SHA512
ea329fa5f3611c121840217a2c00a555dec5dd51d1ed610cef1f3dfed90a8f0edc8b220f2e2f10dad727351b23fc963a81ca30163b2c8f11c22120f492deeca6

Download Submit
C:\Windows\System\xLWtbGl.exe

Filesize
2.9MB

MD5
2a9d0b19708c26fddb16acc00954a670

SHA1
c43beea34c240aac0ed645beba2b0e49907bbb06

SHA256
a2373c229059cdd0224a83c5eaf9d79891e37713bd2961f33b370ddc6f39dba1

SHA512
59dda6d89555d146cc5bab01756887c023502ed02f3205786761384abdc10d29d43b7362e28f3b317c7abbf3a16bc568c0adc840583a01b7a8ce5984d9395c67

Download Submit
C:\Windows\System\yASJQwx.exe

Filesize
2.9MB

MD5
988581477e3ba7bbe51a38fbfc69a343

SHA1
da48c288f7c8729491acd9324076e1401f5de7b4

SHA256
884198ceac3465987c5f277a097ea51b3bce9da7ce414884c37815a5ff0ba350

SHA512
05476bf4ca408803315dd1aa25013aa71e5521201d42bac5ccfa2c373be63778edbd49e8c9d29ce730d4eb18c19a19e11ec3f852ca9e03c45f3d458686e8c28d

Download Submit
C:\Windows\System\zslwfBA.exe

Filesize
2.9MB

MD5
8540f3701aaebb91336cd506dfa3e71d

SHA1
0bac9427e545b1b02915e9881452f2e7aca9d639

SHA256
55e642ba3e8e411ed4b615f3dc1d44c5bbbf4b12b9de3d1459e24090076c5ba2

SHA512
6cdc2eb9b257abedf08a33a5f17eaaefc2a10c9294a53322e279d87991f5f0b4ad05cbb6655cd8e4d02ccb2096e7a154c58951abcf4978457803e527f08d37e9

Download Submit
memory/828-744-0x00007FF647C40000-0x00007FF648036000-memory.dmp

Filesize
4.0MB

Download
memory/828-2229-0x00007FF647C40000-0x00007FF648036000-memory.dmp

Filesize
4.0MB

Download
memory/1084-2235-0x00007FF6098A0000-0x00007FF609C96000-memory.dmp

Filesize
4.0MB

Download
memory/1084-669-0x00007FF6098A0000-0x00007FF609C96000-memory.dmp

Filesize
4.0MB

Download
memory/1112-2230-0x00007FF73C3E0000-0x00007FF73C7D6000-memory.dmp

Filesize
4.0MB

Download
memory/1112-646-0x00007FF73C3E0000-0x00007FF73C7D6000-memory.dmp

Filesize
4.0MB

Download
memory/1116-645-0x00007FF7F0460000-0x00007FF7F0856000-memory.dmp

Filesize
4.0MB

Download
memory/1116-2227-0x00007FF7F0460000-0x00007FF7F0856000-memory.dmp

Filesize
4.0MB

Download
memory/1236-671-0x00007FF742E90000-0x00007FF743286000-memory.dmp

Filesize
4.0MB

Download
memory/1236-2236-0x00007FF742E90000-0x00007FF743286000-memory.dmp

Filesize
4.0MB

Download
memory/1752-2247-0x00007FF747510000-0x00007FF747906000-memory.dmp

Filesize
4.0MB

Download
memory/1752-734-0x00007FF747510000-0x00007FF747906000-memory.dmp

Filesize
4.0MB

Download
memory/1948-2233-0x00007FF66A560000-0x00007FF66A956000-memory.dmp

Filesize
4.0MB

Download
memory/1948-663-0x00007FF66A560000-0x00007FF66A956000-memory.dmp

Filesize
4.0MB

Download
memory/2284-2240-0x00007FF651270000-0x00007FF651666000-memory.dmp

Filesize
4.0MB

Download
memory/2284-713-0x00007FF651270000-0x00007FF651666000-memory.dmp

Filesize
4.0MB

Download
memory/2468-81-0x00000230D6130000-0x00000230D6152000-memory.dmp

Filesize
136KB

Download
memory/2568-1925-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp

Filesize
4.0MB

Download
memory/2568-2225-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp

Filesize
4.0MB

Download
memory/2568-15-0x00007FF77E8F0000-0x00007FF77ECE6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-712-0x00007FF6ED320000-0x00007FF6ED716000-memory.dmp

Filesize
4.0MB

Download
memory/2596-2241-0x00007FF6ED320000-0x00007FF6ED716000-memory.dmp

Filesize
4.0MB

Download
memory/2708-2239-0x00007FF6D3C60000-0x00007FF6D4056000-memory.dmp

Filesize
4.0MB

Download
memory/2708-690-0x00007FF6D3C60000-0x00007FF6D4056000-memory.dmp

Filesize
4.0MB

Download
memory/3088-2232-0x00007FF615BE0000-0x00007FF615FD6000-memory.dmp

Filesize
4.0MB

Download
memory/3088-648-0x00007FF615BE0000-0x00007FF615FD6000-memory.dmp

Filesize
4.0MB

Download
memory/3220-685-0x00007FF61B9C0000-0x00007FF61BDB6000-memory.dmp

Filesize
4.0MB

Download
memory/3220-2237-0x00007FF61B9C0000-0x00007FF61BDB6000-memory.dmp

Filesize
4.0MB

Download
memory/3396-2244-0x00007FF7A7A50000-0x00007FF7A7E46000-memory.dmp

Filesize
4.0MB

Download
memory/3396-722-0x00007FF7A7A50000-0x00007FF7A7E46000-memory.dmp

Filesize
4.0MB

Download
memory/3580-1926-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp

Filesize
4.0MB

Download
memory/3580-21-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp

Filesize
4.0MB

Download
memory/3580-2228-0x00007FF7AC110000-0x00007FF7AC506000-memory.dmp

Filesize
4.0MB

Download
memory/3720-2246-0x00007FF622C80000-0x00007FF623076000-memory.dmp

Filesize
4.0MB

Download
memory/3720-737-0x00007FF622C80000-0x00007FF623076000-memory.dmp

Filesize
4.0MB

Download
memory/3908-2226-0x00007FF647510000-0x00007FF647906000-memory.dmp

Filesize
4.0MB

Download
memory/3908-27-0x00007FF647510000-0x00007FF647906000-memory.dmp

Filesize
4.0MB

Download
memory/3908-1927-0x00007FF647510000-0x00007FF647906000-memory.dmp

Filesize
4.0MB

Download
memory/4112-653-0x00007FF6FBA60000-0x00007FF6FBE56000-memory.dmp

Filesize
4.0MB

Download
memory/4112-2234-0x00007FF6FBA60000-0x00007FF6FBE56000-memory.dmp

Filesize
4.0MB

Download
memory/4276-1-0x0000029E46760000-0x0000029E46770000-memory.dmp

Filesize
64KB

Download
memory/4276-0-0x00007FF6CA010000-0x00007FF6CA406000-memory.dmp

Filesize
4.0MB

Download
memory/4412-728-0x00007FF6C9230000-0x00007FF6C9626000-memory.dmp

Filesize
4.0MB

Download
memory/4412-2245-0x00007FF6C9230000-0x00007FF6C9626000-memory.dmp

Filesize
4.0MB

Download
memory/4468-647-0x00007FF6A8D40000-0x00007FF6A9136000-memory.dmp

Filesize
4.0MB

Download
memory/4468-2231-0x00007FF6A8D40000-0x00007FF6A9136000-memory.dmp

Filesize
4.0MB

Download
memory/4632-2243-0x00007FF7B0560000-0x00007FF7B0956000-memory.dmp

Filesize
4.0MB

Download
memory/4632-695-0x00007FF7B0560000-0x00007FF7B0956000-memory.dmp

Filesize
4.0MB

Download
memory/4840-2242-0x00007FF7031A0000-0x00007FF703596000-memory.dmp

Filesize
4.0MB

Download
memory/4840-705-0x00007FF7031A0000-0x00007FF703596000-memory.dmp

Filesize
4.0MB

Download
memory/4864-20-0x00007FF6A3080000-0x00007FF6A3476000-memory.dmp

Filesize
4.0MB

Download
memory/4864-2224-0x00007FF6A3080000-0x00007FF6A3476000-memory.dmp

Filesize
4.0MB

Download
memory/5100-676-0x00007FF6D76B0000-0x00007FF6D7AA6000-memory.dmp

Filesize
4.0MB

Download
memory/5100-2238-0x00007FF6D76B0000-0x00007FF6D7AA6000-memory.dmp

Filesize
4.0MB

Download