xmrig | 2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
Size

2.2MB
MD5

f96d218f8a2c1a5b3deca4008ca57f00
SHA1

ccf5bd9baf33bc344b851e62bdcedd85af1a0b36
SHA256

2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac
SHA512

b18065b40edc355400096414f1be905664e9296694f634bd6e02ccb2f91629de3388886784d48971fbb07c9429f1d620096b947fc01bb8cf40aabc39c022a322
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopOm:NABY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/5004-64-0x00007FF6CCD40000-0x00007FF6CD132000-memory.dmp	xmrig
behavioral2/memory/2716-86-0x00007FF7CC9F0000-0x00007FF7CCDE2000-memory.dmp	xmrig
behavioral2/memory/4496-92-0x00007FF6E2430000-0x00007FF6E2822000-memory.dmp	xmrig
behavioral2/memory/3572-104-0x00007FF6B7830000-0x00007FF6B7C22000-memory.dmp	xmrig
behavioral2/memory/524-109-0x00007FF79BAE0000-0x00007FF79BED2000-memory.dmp	xmrig
behavioral2/memory/4536-151-0x00007FF60DF30000-0x00007FF60E322000-memory.dmp	xmrig
behavioral2/memory/452-187-0x00007FF7E3240000-0x00007FF7E3632000-memory.dmp	xmrig
behavioral2/memory/3848-1986-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp	xmrig
behavioral2/memory/1836-2017-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp	xmrig
behavioral2/memory/3076-176-0x00007FF6AE350000-0x00007FF6AE742000-memory.dmp	xmrig
behavioral2/memory/5000-170-0x00007FF6C1EE0000-0x00007FF6C22D2000-memory.dmp	xmrig
behavioral2/memory/5044-164-0x00007FF616B70000-0x00007FF616F62000-memory.dmp	xmrig
behavioral2/memory/4308-158-0x00007FF6C58F0000-0x00007FF6C5CE2000-memory.dmp	xmrig
behavioral2/memory/1388-157-0x00007FF73BD70000-0x00007FF73C162000-memory.dmp	xmrig
behavioral2/memory/4516-145-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp	xmrig
behavioral2/memory/4724-134-0x00007FF6E3620000-0x00007FF6E3A12000-memory.dmp	xmrig
behavioral2/memory/1804-128-0x00007FF61A890000-0x00007FF61AC82000-memory.dmp	xmrig
behavioral2/memory/460-122-0x00007FF737330000-0x00007FF737722000-memory.dmp	xmrig
behavioral2/memory/1920-118-0x00007FF683E50000-0x00007FF684242000-memory.dmp	xmrig
behavioral2/memory/1036-114-0x00007FF644C30000-0x00007FF645022000-memory.dmp	xmrig
behavioral2/memory/4320-108-0x00007FF6B67F0000-0x00007FF6B6BE2000-memory.dmp	xmrig
behavioral2/memory/1232-97-0x00007FF6802D0000-0x00007FF6806C2000-memory.dmp	xmrig
behavioral2/memory/2308-93-0x00007FF725F60000-0x00007FF726352000-memory.dmp	xmrig
behavioral2/memory/1488-89-0x00007FF68F4C0000-0x00007FF68F8B2000-memory.dmp	xmrig
behavioral2/memory/3820-59-0x00007FF6570E0000-0x00007FF6574D2000-memory.dmp	xmrig
behavioral2/memory/5004-2054-0x00007FF6CCD40000-0x00007FF6CD132000-memory.dmp	xmrig
behavioral2/memory/2716-2056-0x00007FF7CC9F0000-0x00007FF7CCDE2000-memory.dmp	xmrig
behavioral2/memory/3820-2052-0x00007FF6570E0000-0x00007FF6574D2000-memory.dmp	xmrig
behavioral2/memory/524-2058-0x00007FF79BAE0000-0x00007FF79BED2000-memory.dmp	xmrig
behavioral2/memory/4496-2060-0x00007FF6E2430000-0x00007FF6E2822000-memory.dmp	xmrig
behavioral2/memory/1488-2062-0x00007FF68F4C0000-0x00007FF68F8B2000-memory.dmp	xmrig
behavioral2/memory/2308-2064-0x00007FF725F60000-0x00007FF726352000-memory.dmp	xmrig
behavioral2/memory/1036-2066-0x00007FF644C30000-0x00007FF645022000-memory.dmp	xmrig
behavioral2/memory/1920-2068-0x00007FF683E50000-0x00007FF684242000-memory.dmp	xmrig
behavioral2/memory/460-2070-0x00007FF737330000-0x00007FF737722000-memory.dmp	xmrig
behavioral2/memory/1232-2072-0x00007FF6802D0000-0x00007FF6806C2000-memory.dmp	xmrig
behavioral2/memory/4320-2033-0x00007FF6B67F0000-0x00007FF6B6BE2000-memory.dmp	xmrig
behavioral2/memory/3572-2074-0x00007FF6B7830000-0x00007FF6B7C22000-memory.dmp	xmrig
behavioral2/memory/1836-2078-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp	xmrig
behavioral2/memory/1804-2077-0x00007FF61A890000-0x00007FF61AC82000-memory.dmp	xmrig
behavioral2/memory/4724-2080-0x00007FF6E3620000-0x00007FF6E3A12000-memory.dmp	xmrig
behavioral2/memory/4536-2082-0x00007FF60DF30000-0x00007FF60E322000-memory.dmp	xmrig
behavioral2/memory/1388-2084-0x00007FF73BD70000-0x00007FF73C162000-memory.dmp	xmrig
behavioral2/memory/4308-2086-0x00007FF6C58F0000-0x00007FF6C5CE2000-memory.dmp	xmrig
behavioral2/memory/4516-2088-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp	xmrig
behavioral2/memory/5044-2090-0x00007FF616B70000-0x00007FF616F62000-memory.dmp	xmrig
behavioral2/memory/5000-2092-0x00007FF6C1EE0000-0x00007FF6C22D2000-memory.dmp	xmrig
behavioral2/memory/3076-2094-0x00007FF6AE350000-0x00007FF6AE742000-memory.dmp	xmrig
behavioral2/memory/452-2096-0x00007FF7E3240000-0x00007FF7E3632000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1984	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4320	shBiNJp.exe
3820	ddNnooA.exe
5004	CFfvFWH.exe
2716	rlQyCek.exe
524	GKbKyBC.exe
1488	jYGzhlU.exe
4496	fitrxaX.exe
2308	IHKvXco.exe
1036	VszCKmm.exe
1920	MpBvWBV.exe
460	UxJeMXb.exe
1232	LnBMNuZ.exe
1836	SnvhbUr.exe
3572	qfSgsuk.exe
1804	QaMeKTb.exe
4724	qOirkhd.exe
4536	fbxtQYH.exe
1388	MQCKDkD.exe
4308	soSpEqZ.exe
4516	tsTcfQJ.exe
5044	czMIdjQ.exe
5000	gaGilid.exe
3076	JZlKFPK.exe
452	DwDoPTW.exe
1268	MWjPopS.exe
4164	ZscVYll.exe
3204	EfJlTan.exe
1972	FQmcoIH.exe
5076	tGWtOHC.exe
4940	NREsPQe.exe
5040	anbMaha.exe
4852	CrhznSE.exe
3468	ZHVtfLX.exe
1472	tikVvPn.exe
3460	wNkjDNX.exe
4036	SYiaqNH.exe
620	xRwthOs.exe
1188	zFpRWae.exe
4400	hqvirpU.exe
2480	XcMnMAx.exe
3548	WwdLBJl.exe
3744	RQxTCmC.exe
5096	QARYDKr.exe
3376	tKYKzoD.exe
4440	FWeWvaX.exe
4640	qbBqIjy.exe
3600	zrXRHFS.exe
3164	PvlqLGK.exe
956	jQvFkbJ.exe
1220	inIrjnH.exe
2272	xeDcpSO.exe
4736	nntqrOs.exe
1380	kRfjBSB.exe
1352	LqGpXyi.exe
1080	CHOdiiu.exe
1492	grJCAnn.exe
2096	OiFqsJi.exe
2156	DIKYvLx.exe
3704	YEDeKVZ.exe
1820	ZWWYbFz.exe
952	iqHZLdP.exe
220	sGLayhk.exe
228	wzwtFxo.exe
752	hrrSSBx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3848-0-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp	upx
behavioral2/files/0x0008000000023407-6.dat	upx
behavioral2/files/0x000700000002340c-8.dat	upx
behavioral2/files/0x000700000002340b-15.dat	upx
behavioral2/files/0x000700000002340d-20.dat	upx
behavioral2/files/0x000700000002340e-38.dat	upx
behavioral2/files/0x000700000002340f-51.dat	upx
behavioral2/files/0x0007000000023411-57.dat	upx
behavioral2/files/0x0008000000023413-63.dat	upx
behavioral2/memory/5004-64-0x00007FF6CCD40000-0x00007FF6CD132000-memory.dmp	upx
behavioral2/files/0x0008000000023412-71.dat	upx
behavioral2/files/0x0007000000023414-68.dat	upx
behavioral2/files/0x0007000000023415-75.dat	upx
behavioral2/memory/2716-86-0x00007FF7CC9F0000-0x00007FF7CCDE2000-memory.dmp	upx
behavioral2/memory/4496-92-0x00007FF6E2430000-0x00007FF6E2822000-memory.dmp	upx
behavioral2/files/0x0007000000023419-94.dat	upx
behavioral2/files/0x0007000000023418-98.dat	upx
behavioral2/memory/3572-104-0x00007FF6B7830000-0x00007FF6B7C22000-memory.dmp	upx
behavioral2/memory/524-109-0x00007FF79BAE0000-0x00007FF79BED2000-memory.dmp	upx
behavioral2/files/0x000700000002341a-115.dat	upx
behavioral2/files/0x000700000002341b-119.dat	upx
behavioral2/files/0x000700000002341c-125.dat	upx
behavioral2/files/0x000700000002341f-142.dat	upx
behavioral2/memory/4536-151-0x00007FF60DF30000-0x00007FF60E322000-memory.dmp	upx
behavioral2/files/0x0007000000023421-165.dat	upx
behavioral2/files/0x0007000000023423-177.dat	upx
behavioral2/memory/452-187-0x00007FF7E3240000-0x00007FF7E3632000-memory.dmp	upx
behavioral2/files/0x0007000000023429-200.dat	upx
behavioral2/memory/3848-1986-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp	upx
behavioral2/memory/1836-2017-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp	upx
behavioral2/files/0x0007000000023427-198.dat	upx
behavioral2/files/0x0007000000023428-195.dat	upx
behavioral2/files/0x0007000000023426-193.dat	upx
behavioral2/files/0x0007000000023425-188.dat	upx
behavioral2/files/0x0007000000023424-182.dat	upx
behavioral2/memory/3076-176-0x00007FF6AE350000-0x00007FF6AE742000-memory.dmp	upx
behavioral2/files/0x0007000000023422-171.dat	upx
behavioral2/memory/5000-170-0x00007FF6C1EE0000-0x00007FF6C22D2000-memory.dmp	upx
behavioral2/memory/5044-164-0x00007FF616B70000-0x00007FF616F62000-memory.dmp	upx
behavioral2/files/0x0007000000023420-159.dat	upx
behavioral2/memory/4308-158-0x00007FF6C58F0000-0x00007FF6C5CE2000-memory.dmp	upx
behavioral2/memory/1388-157-0x00007FF73BD70000-0x00007FF73C162000-memory.dmp	upx
behavioral2/files/0x000700000002341e-146.dat	upx
behavioral2/memory/4516-145-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp	upx
behavioral2/files/0x000700000002341d-140.dat	upx
behavioral2/memory/4724-134-0x00007FF6E3620000-0x00007FF6E3A12000-memory.dmp	upx
behavioral2/memory/1804-128-0x00007FF61A890000-0x00007FF61AC82000-memory.dmp	upx
behavioral2/memory/460-122-0x00007FF737330000-0x00007FF737722000-memory.dmp	upx
behavioral2/memory/1920-118-0x00007FF683E50000-0x00007FF684242000-memory.dmp	upx
behavioral2/memory/1036-114-0x00007FF644C30000-0x00007FF645022000-memory.dmp	upx
behavioral2/files/0x0008000000023408-112.dat	upx
behavioral2/memory/4320-108-0x00007FF6B67F0000-0x00007FF6B6BE2000-memory.dmp	upx
behavioral2/memory/1836-101-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp	upx
behavioral2/memory/1232-97-0x00007FF6802D0000-0x00007FF6806C2000-memory.dmp	upx
behavioral2/memory/2308-93-0x00007FF725F60000-0x00007FF726352000-memory.dmp	upx
behavioral2/files/0x0007000000023417-95.dat	upx
behavioral2/memory/1488-89-0x00007FF68F4C0000-0x00007FF68F8B2000-memory.dmp	upx
behavioral2/files/0x0007000000023416-87.dat	upx
behavioral2/memory/3820-59-0x00007FF6570E0000-0x00007FF6574D2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-40.dat	upx
behavioral2/memory/5004-2054-0x00007FF6CCD40000-0x00007FF6CD132000-memory.dmp	upx
behavioral2/memory/2716-2056-0x00007FF7CC9F0000-0x00007FF7CCDE2000-memory.dmp	upx
behavioral2/memory/3820-2052-0x00007FF6570E0000-0x00007FF6574D2000-memory.dmp	upx
behavioral2/memory/524-2058-0x00007FF79BAE0000-0x00007FF79BED2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PnRHfGe.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\uVausvI.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\YYCOfRv.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\CuaJQlj.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\QARYDKr.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\gpDfMnf.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\VkqazRV.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ykmtglZ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\QltXFpU.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\wNkjDNX.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\QSKiTTH.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\EeePiOX.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\AncyZPe.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\yUhFKAH.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\LtcHdLc.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\fbxtQYH.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\RArkYUL.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\VodsLRk.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\VOpMIXc.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\jpZRhPm.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\qytfaOu.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\OPKtLJm.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\hyZUhYp.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\hQSbHob.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\udixWTj.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\redaEPx.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\bxPXYzC.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\VAtpPdu.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ZHVtfLX.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\TxCqRlR.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\jAdwxYc.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\zltUUeZ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ArnquSy.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\YMFjWWl.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\afrWVLQ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\qhqAOMl.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\QbwpwJr.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ytXQfxD.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\DONCNWr.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\iKncZVQ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ZhAnwZw.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\hPepUaY.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\gofiazO.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\nLeNzML.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\zFRYxgg.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\rdybTsj.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\rCWSFmJ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\kfVZbZY.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\RzaObQQ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\rPbonuU.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\grJCAnn.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ssAnvDc.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\hsYTZAR.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\FonlXJh.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\dwLHWms.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\RwHKKDv.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\kdYrXBa.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\LRsyTRb.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\NmnVUWC.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\ETXJoOZ.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\LyoUsPj.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\xdgnVyV.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\yXHeFsh.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
File created	C:\Windows\System\VpgniXF.exe	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1984	powershell.exe
1984	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
Token: SeDebugPrivilege	1984	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1984	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	81
PID 3848 wrote to memory of 1984	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	81
PID 3848 wrote to memory of 4320	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	82
PID 3848 wrote to memory of 4320	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	82
PID 3848 wrote to memory of 3820	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	83
PID 3848 wrote to memory of 3820	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	83
PID 3848 wrote to memory of 5004	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	84
PID 3848 wrote to memory of 5004	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	84
PID 3848 wrote to memory of 2716	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	85
PID 3848 wrote to memory of 2716	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	85
PID 3848 wrote to memory of 524	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	86
PID 3848 wrote to memory of 524	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	86
PID 3848 wrote to memory of 1488	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	87
PID 3848 wrote to memory of 1488	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	87
PID 3848 wrote to memory of 4496	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	88
PID 3848 wrote to memory of 4496	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	88
PID 3848 wrote to memory of 2308	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	89
PID 3848 wrote to memory of 2308	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	89
PID 3848 wrote to memory of 1036	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	90
PID 3848 wrote to memory of 1036	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	90
PID 3848 wrote to memory of 1920	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	91
PID 3848 wrote to memory of 1920	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	91
PID 3848 wrote to memory of 460	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	92
PID 3848 wrote to memory of 460	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	92
PID 3848 wrote to memory of 1232	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	93
PID 3848 wrote to memory of 1232	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	93
PID 3848 wrote to memory of 1836	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	94
PID 3848 wrote to memory of 1836	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	94
PID 3848 wrote to memory of 3572	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	95
PID 3848 wrote to memory of 3572	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	95
PID 3848 wrote to memory of 1804	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	96
PID 3848 wrote to memory of 1804	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	96
PID 3848 wrote to memory of 4724	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	97
PID 3848 wrote to memory of 4724	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	97
PID 3848 wrote to memory of 4536	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	98
PID 3848 wrote to memory of 4536	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	98
PID 3848 wrote to memory of 1388	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	99
PID 3848 wrote to memory of 1388	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	99
PID 3848 wrote to memory of 4308	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	100
PID 3848 wrote to memory of 4308	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	100
PID 3848 wrote to memory of 4516	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	101
PID 3848 wrote to memory of 4516	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	101
PID 3848 wrote to memory of 5044	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	102
PID 3848 wrote to memory of 5044	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	102
PID 3848 wrote to memory of 5000	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	103
PID 3848 wrote to memory of 5000	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	103
PID 3848 wrote to memory of 3076	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	104
PID 3848 wrote to memory of 3076	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	104
PID 3848 wrote to memory of 452	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	105
PID 3848 wrote to memory of 452	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	105
PID 3848 wrote to memory of 1268	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	106
PID 3848 wrote to memory of 1268	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	106
PID 3848 wrote to memory of 4164	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	107
PID 3848 wrote to memory of 4164	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	107
PID 3848 wrote to memory of 3204	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	108
PID 3848 wrote to memory of 3204	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	108
PID 3848 wrote to memory of 1972	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	109
PID 3848 wrote to memory of 1972	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	109
PID 3848 wrote to memory of 5076	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	110
PID 3848 wrote to memory of 5076	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	110
PID 3848 wrote to memory of 4940	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	111
PID 3848 wrote to memory of 4940	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	111
PID 3848 wrote to memory of 5040	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	112
PID 3848 wrote to memory of 5040	3848	2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fe200e739f701df965c70a7edf3c4f4927c4939d95c858e3ce6826523dec2ac_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\System\shBiNJp.exe
  C:\Windows\System\shBiNJp.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ddNnooA.exe
  C:\Windows\System\ddNnooA.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\CFfvFWH.exe
  C:\Windows\System\CFfvFWH.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\rlQyCek.exe
  C:\Windows\System\rlQyCek.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\GKbKyBC.exe
  C:\Windows\System\GKbKyBC.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\jYGzhlU.exe
  C:\Windows\System\jYGzhlU.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\fitrxaX.exe
  C:\Windows\System\fitrxaX.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\IHKvXco.exe
  C:\Windows\System\IHKvXco.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\VszCKmm.exe
  C:\Windows\System\VszCKmm.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\MpBvWBV.exe
  C:\Windows\System\MpBvWBV.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\UxJeMXb.exe
  C:\Windows\System\UxJeMXb.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\LnBMNuZ.exe
  C:\Windows\System\LnBMNuZ.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\SnvhbUr.exe
  C:\Windows\System\SnvhbUr.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\qfSgsuk.exe
  C:\Windows\System\qfSgsuk.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\QaMeKTb.exe
  C:\Windows\System\QaMeKTb.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\qOirkhd.exe
  C:\Windows\System\qOirkhd.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\fbxtQYH.exe
  C:\Windows\System\fbxtQYH.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\MQCKDkD.exe
  C:\Windows\System\MQCKDkD.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\soSpEqZ.exe
  C:\Windows\System\soSpEqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\tsTcfQJ.exe
  C:\Windows\System\tsTcfQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\czMIdjQ.exe
  C:\Windows\System\czMIdjQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\gaGilid.exe
  C:\Windows\System\gaGilid.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\JZlKFPK.exe
  C:\Windows\System\JZlKFPK.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\DwDoPTW.exe
  C:\Windows\System\DwDoPTW.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\MWjPopS.exe
  C:\Windows\System\MWjPopS.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\ZscVYll.exe
  C:\Windows\System\ZscVYll.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\EfJlTan.exe
  C:\Windows\System\EfJlTan.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\FQmcoIH.exe
  C:\Windows\System\FQmcoIH.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\tGWtOHC.exe
  C:\Windows\System\tGWtOHC.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\NREsPQe.exe
  C:\Windows\System\NREsPQe.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\anbMaha.exe
  C:\Windows\System\anbMaha.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\CrhznSE.exe
  C:\Windows\System\CrhznSE.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\ZHVtfLX.exe
  C:\Windows\System\ZHVtfLX.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\tikVvPn.exe
  C:\Windows\System\tikVvPn.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\wNkjDNX.exe
  C:\Windows\System\wNkjDNX.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\SYiaqNH.exe
  C:\Windows\System\SYiaqNH.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\xRwthOs.exe
  C:\Windows\System\xRwthOs.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\zFpRWae.exe
  C:\Windows\System\zFpRWae.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\hqvirpU.exe
  C:\Windows\System\hqvirpU.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\XcMnMAx.exe
  C:\Windows\System\XcMnMAx.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\WwdLBJl.exe
  C:\Windows\System\WwdLBJl.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\RQxTCmC.exe
  C:\Windows\System\RQxTCmC.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\QARYDKr.exe
  C:\Windows\System\QARYDKr.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\tKYKzoD.exe
  C:\Windows\System\tKYKzoD.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\FWeWvaX.exe
  C:\Windows\System\FWeWvaX.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\qbBqIjy.exe
  C:\Windows\System\qbBqIjy.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\zrXRHFS.exe
  C:\Windows\System\zrXRHFS.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\PvlqLGK.exe
  C:\Windows\System\PvlqLGK.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\jQvFkbJ.exe
  C:\Windows\System\jQvFkbJ.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\inIrjnH.exe
  C:\Windows\System\inIrjnH.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\xeDcpSO.exe
  C:\Windows\System\xeDcpSO.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\nntqrOs.exe
  C:\Windows\System\nntqrOs.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\kRfjBSB.exe
  C:\Windows\System\kRfjBSB.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\LqGpXyi.exe
  C:\Windows\System\LqGpXyi.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\CHOdiiu.exe
  C:\Windows\System\CHOdiiu.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\grJCAnn.exe
  C:\Windows\System\grJCAnn.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\OiFqsJi.exe
  C:\Windows\System\OiFqsJi.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\DIKYvLx.exe
  C:\Windows\System\DIKYvLx.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\YEDeKVZ.exe
  C:\Windows\System\YEDeKVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\ZWWYbFz.exe
  C:\Windows\System\ZWWYbFz.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\iqHZLdP.exe
  C:\Windows\System\iqHZLdP.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\sGLayhk.exe
  C:\Windows\System\sGLayhk.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\wzwtFxo.exe
  C:\Windows\System\wzwtFxo.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\hrrSSBx.exe
  C:\Windows\System\hrrSSBx.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\adiQecp.exe
  C:\Windows\System\adiQecp.exe
  2⤵
  PID:740
- C:\Windows\System\PUHppag.exe
  C:\Windows\System\PUHppag.exe
  2⤵
  PID:1092
- C:\Windows\System\zFRYxgg.exe
  C:\Windows\System\zFRYxgg.exe
  2⤵
  PID:3264
- C:\Windows\System\KGiXkxN.exe
  C:\Windows\System\KGiXkxN.exe
  2⤵
  PID:4136
- C:\Windows\System\oPcxTPb.exe
  C:\Windows\System\oPcxTPb.exe
  2⤵
  PID:1040
- C:\Windows\System\zBcUfcs.exe
  C:\Windows\System\zBcUfcs.exe
  2⤵
  PID:3728
- C:\Windows\System\QxWoKju.exe
  C:\Windows\System\QxWoKju.exe
  2⤵
  PID:2152
- C:\Windows\System\IjIXZwd.exe
  C:\Windows\System\IjIXZwd.exe
  2⤵
  PID:1104
- C:\Windows\System\TtwBytc.exe
  C:\Windows\System\TtwBytc.exe
  2⤵
  PID:1936
- C:\Windows\System\NYefKVF.exe
  C:\Windows\System\NYefKVF.exe
  2⤵
  PID:4728
- C:\Windows\System\jxIzWVT.exe
  C:\Windows\System\jxIzWVT.exe
  2⤵
  PID:2936
- C:\Windows\System\ZGHAKmP.exe
  C:\Windows\System\ZGHAKmP.exe
  2⤵
  PID:436
- C:\Windows\System\FVkCJAN.exe
  C:\Windows\System\FVkCJAN.exe
  2⤵
  PID:3136
- C:\Windows\System\ZEDSPNR.exe
  C:\Windows\System\ZEDSPNR.exe
  2⤵
  PID:3172
- C:\Windows\System\vVMvslS.exe
  C:\Windows\System\vVMvslS.exe
  2⤵
  PID:1256
- C:\Windows\System\mSkHmRG.exe
  C:\Windows\System\mSkHmRG.exe
  2⤵
  PID:4544
- C:\Windows\System\RArkYUL.exe
  C:\Windows\System\RArkYUL.exe
  2⤵
  PID:4040
- C:\Windows\System\UYRTBAz.exe
  C:\Windows\System\UYRTBAz.exe
  2⤵
  PID:1656
- C:\Windows\System\NfqLbYY.exe
  C:\Windows\System\NfqLbYY.exe
  2⤵
  PID:2916
- C:\Windows\System\mfdktbE.exe
  C:\Windows\System\mfdktbE.exe
  2⤵
  PID:5012
- C:\Windows\System\PozgWWO.exe
  C:\Windows\System\PozgWWO.exe
  2⤵
  PID:5148
- C:\Windows\System\MXFsBzt.exe
  C:\Windows\System\MXFsBzt.exe
  2⤵
  PID:5176
- C:\Windows\System\bKJKpGe.exe
  C:\Windows\System\bKJKpGe.exe
  2⤵
  PID:5208
- C:\Windows\System\yCyRNIK.exe
  C:\Windows\System\yCyRNIK.exe
  2⤵
  PID:5236
- C:\Windows\System\npjJHxh.exe
  C:\Windows\System\npjJHxh.exe
  2⤵
  PID:5260
- C:\Windows\System\CcmwFsx.exe
  C:\Windows\System\CcmwFsx.exe
  2⤵
  PID:5292
- C:\Windows\System\KyhNyeP.exe
  C:\Windows\System\KyhNyeP.exe
  2⤵
  PID:5316
- C:\Windows\System\gpDfMnf.exe
  C:\Windows\System\gpDfMnf.exe
  2⤵
  PID:5348
- C:\Windows\System\rRXoFBw.exe
  C:\Windows\System\rRXoFBw.exe
  2⤵
  PID:5376
- C:\Windows\System\RHVgSMk.exe
  C:\Windows\System\RHVgSMk.exe
  2⤵
  PID:5412
- C:\Windows\System\BGWrxAy.exe
  C:\Windows\System\BGWrxAy.exe
  2⤵
  PID:5440
- C:\Windows\System\wiXRInP.exe
  C:\Windows\System\wiXRInP.exe
  2⤵
  PID:5468
- C:\Windows\System\JOoPOiu.exe
  C:\Windows\System\JOoPOiu.exe
  2⤵
  PID:5488
- C:\Windows\System\KmWaMTY.exe
  C:\Windows\System\KmWaMTY.exe
  2⤵
  PID:5512
- C:\Windows\System\gJBTbEY.exe
  C:\Windows\System\gJBTbEY.exe
  2⤵
  PID:5540
- C:\Windows\System\mgasbBm.exe
  C:\Windows\System\mgasbBm.exe
  2⤵
  PID:5576
- C:\Windows\System\XtJJoED.exe
  C:\Windows\System\XtJJoED.exe
  2⤵
  PID:5612
- C:\Windows\System\VpgniXF.exe
  C:\Windows\System\VpgniXF.exe
  2⤵
  PID:5668
- C:\Windows\System\WndjhAY.exe
  C:\Windows\System\WndjhAY.exe
  2⤵
  PID:5688
- C:\Windows\System\FJJRNNC.exe
  C:\Windows\System\FJJRNNC.exe
  2⤵
  PID:5712
- C:\Windows\System\DbGFlKr.exe
  C:\Windows\System\DbGFlKr.exe
  2⤵
  PID:5728
- C:\Windows\System\TdDAiVo.exe
  C:\Windows\System\TdDAiVo.exe
  2⤵
  PID:5748
- C:\Windows\System\QimyTjB.exe
  C:\Windows\System\QimyTjB.exe
  2⤵
  PID:5768
- C:\Windows\System\yiiOIzi.exe
  C:\Windows\System\yiiOIzi.exe
  2⤵
  PID:5796
- C:\Windows\System\GwuKIoW.exe
  C:\Windows\System\GwuKIoW.exe
  2⤵
  PID:5820
- C:\Windows\System\UxPvRwo.exe
  C:\Windows\System\UxPvRwo.exe
  2⤵
  PID:5852
- C:\Windows\System\TpdYjjU.exe
  C:\Windows\System\TpdYjjU.exe
  2⤵
  PID:5880
- C:\Windows\System\gZULiKV.exe
  C:\Windows\System\gZULiKV.exe
  2⤵
  PID:5896
- C:\Windows\System\XEPJiYQ.exe
  C:\Windows\System\XEPJiYQ.exe
  2⤵
  PID:5920
- C:\Windows\System\JPiSdAP.exe
  C:\Windows\System\JPiSdAP.exe
  2⤵
  PID:5936
- C:\Windows\System\xNulPFd.exe
  C:\Windows\System\xNulPFd.exe
  2⤵
  PID:5968
- C:\Windows\System\aZBtYii.exe
  C:\Windows\System\aZBtYii.exe
  2⤵
  PID:6016
- C:\Windows\System\kdYrXBa.exe
  C:\Windows\System\kdYrXBa.exe
  2⤵
  PID:6048
- C:\Windows\System\hqceKfp.exe
  C:\Windows\System\hqceKfp.exe
  2⤵
  PID:6064
- C:\Windows\System\vVDVqTQ.exe
  C:\Windows\System\vVDVqTQ.exe
  2⤵
  PID:6092
- C:\Windows\System\phfyueO.exe
  C:\Windows\System\phfyueO.exe
  2⤵
  PID:6108
- C:\Windows\System\pOlUrcb.exe
  C:\Windows\System\pOlUrcb.exe
  2⤵
  PID:6136
- C:\Windows\System\QbVBmpX.exe
  C:\Windows\System\QbVBmpX.exe
  2⤵
  PID:3580
- C:\Windows\System\bxQfLJU.exe
  C:\Windows\System\bxQfLJU.exe
  2⤵
  PID:5136
- C:\Windows\System\vYvHPmf.exe
  C:\Windows\System\vYvHPmf.exe
  2⤵
  PID:5192
- C:\Windows\System\WVzTdYR.exe
  C:\Windows\System\WVzTdYR.exe
  2⤵
  PID:4056
- C:\Windows\System\jSLiyDD.exe
  C:\Windows\System\jSLiyDD.exe
  2⤵
  PID:5252
- C:\Windows\System\MFMBTQj.exe
  C:\Windows\System\MFMBTQj.exe
  2⤵
  PID:5456
- C:\Windows\System\YRltJle.exe
  C:\Windows\System\YRltJle.exe
  2⤵
  PID:5388
- C:\Windows\System\rYSYMoW.exe
  C:\Windows\System\rYSYMoW.exe
  2⤵
  PID:2224
- C:\Windows\System\asgdyjZ.exe
  C:\Windows\System\asgdyjZ.exe
  2⤵
  PID:5464
- C:\Windows\System\xBBPkpu.exe
  C:\Windows\System\xBBPkpu.exe
  2⤵
  PID:5564
- C:\Windows\System\YNEvLFD.exe
  C:\Windows\System\YNEvLFD.exe
  2⤵
  PID:5536
- C:\Windows\System\rJStfEQ.exe
  C:\Windows\System\rJStfEQ.exe
  2⤵
  PID:652
- C:\Windows\System\OwGQydZ.exe
  C:\Windows\System\OwGQydZ.exe
  2⤵
  PID:5700
- C:\Windows\System\RUkVMAU.exe
  C:\Windows\System\RUkVMAU.exe
  2⤵
  PID:4980
- C:\Windows\System\mEcXPya.exe
  C:\Windows\System\mEcXPya.exe
  2⤵
  PID:5836
- C:\Windows\System\rdybTsj.exe
  C:\Windows\System\rdybTsj.exe
  2⤵
  PID:5844
- C:\Windows\System\nTxIccW.exe
  C:\Windows\System\nTxIccW.exe
  2⤵
  PID:5912
- C:\Windows\System\EiBdOJD.exe
  C:\Windows\System\EiBdOJD.exe
  2⤵
  PID:6004
- C:\Windows\System\CgxLLnv.exe
  C:\Windows\System\CgxLLnv.exe
  2⤵
  PID:6036
- C:\Windows\System\djPMSAY.exe
  C:\Windows\System\djPMSAY.exe
  2⤵
  PID:6100
- C:\Windows\System\nPAqIEv.exe
  C:\Windows\System\nPAqIEv.exe
  2⤵
  PID:6132
- C:\Windows\System\UqNXWDP.exe
  C:\Windows\System\UqNXWDP.exe
  2⤵
  PID:5172
- C:\Windows\System\EawyHpU.exe
  C:\Windows\System\EawyHpU.exe
  2⤵
  PID:4576
- C:\Windows\System\efSGUti.exe
  C:\Windows\System\efSGUti.exe
  2⤵
  PID:3396
- C:\Windows\System\udixWTj.exe
  C:\Windows\System\udixWTj.exe
  2⤵
  PID:4548
- C:\Windows\System\YSMTBFC.exe
  C:\Windows\System\YSMTBFC.exe
  2⤵
  PID:5636
- C:\Windows\System\OtrgNKi.exe
  C:\Windows\System\OtrgNKi.exe
  2⤵
  PID:1392
- C:\Windows\System\brFVSMp.exe
  C:\Windows\System\brFVSMp.exe
  2⤵
  PID:5740
- C:\Windows\System\vLVqeBb.exe
  C:\Windows\System\vLVqeBb.exe
  2⤵
  PID:5804
- C:\Windows\System\DCuKqdx.exe
  C:\Windows\System\DCuKqdx.exe
  2⤵
  PID:6024
- C:\Windows\System\CYLsbUl.exe
  C:\Windows\System\CYLsbUl.exe
  2⤵
  PID:6072
- C:\Windows\System\AeIOMaO.exe
  C:\Windows\System\AeIOMaO.exe
  2⤵
  PID:5432
- C:\Windows\System\TxCqRlR.exe
  C:\Windows\System\TxCqRlR.exe
  2⤵
  PID:5504
- C:\Windows\System\CFUXFlf.exe
  C:\Windows\System\CFUXFlf.exe
  2⤵
  PID:5596
- C:\Windows\System\KkoRMyp.exe
  C:\Windows\System\KkoRMyp.exe
  2⤵
  PID:4712
- C:\Windows\System\hsWVTum.exe
  C:\Windows\System\hsWVTum.exe
  2⤵
  PID:3980
- C:\Windows\System\zMhEOFE.exe
  C:\Windows\System\zMhEOFE.exe
  2⤵
  PID:5656
- C:\Windows\System\ycYleMX.exe
  C:\Windows\System\ycYleMX.exe
  2⤵
  PID:2388
- C:\Windows\System\LjqhZrf.exe
  C:\Windows\System\LjqhZrf.exe
  2⤵
  PID:6152
- C:\Windows\System\cQaODeu.exe
  C:\Windows\System\cQaODeu.exe
  2⤵
  PID:6192
- C:\Windows\System\ISBtjhl.exe
  C:\Windows\System\ISBtjhl.exe
  2⤵
  PID:6212
- C:\Windows\System\kuMJGHt.exe
  C:\Windows\System\kuMJGHt.exe
  2⤵
  PID:6240
- C:\Windows\System\OmGKMSM.exe
  C:\Windows\System\OmGKMSM.exe
  2⤵
  PID:6264
- C:\Windows\System\XBRBeBG.exe
  C:\Windows\System\XBRBeBG.exe
  2⤵
  PID:6304
- C:\Windows\System\WbQNQIm.exe
  C:\Windows\System\WbQNQIm.exe
  2⤵
  PID:6320
- C:\Windows\System\dbLrDvC.exe
  C:\Windows\System\dbLrDvC.exe
  2⤵
  PID:6352
- C:\Windows\System\qasZSpa.exe
  C:\Windows\System\qasZSpa.exe
  2⤵
  PID:6388
- C:\Windows\System\ssAnvDc.exe
  C:\Windows\System\ssAnvDc.exe
  2⤵
  PID:6412
- C:\Windows\System\eGLrebO.exe
  C:\Windows\System\eGLrebO.exe
  2⤵
  PID:6444
- C:\Windows\System\tmIlJbb.exe
  C:\Windows\System\tmIlJbb.exe
  2⤵
  PID:6476
- C:\Windows\System\TRUBSnT.exe
  C:\Windows\System\TRUBSnT.exe
  2⤵
  PID:6496
- C:\Windows\System\FODzpwQ.exe
  C:\Windows\System\FODzpwQ.exe
  2⤵
  PID:6520
- C:\Windows\System\qqMMehg.exe
  C:\Windows\System\qqMMehg.exe
  2⤵
  PID:6548
- C:\Windows\System\iKYGdOQ.exe
  C:\Windows\System\iKYGdOQ.exe
  2⤵
  PID:6584
- C:\Windows\System\zjNKIhB.exe
  C:\Windows\System\zjNKIhB.exe
  2⤵
  PID:6608
- C:\Windows\System\GPAmixt.exe
  C:\Windows\System\GPAmixt.exe
  2⤵
  PID:6632
- C:\Windows\System\qYTfJYv.exe
  C:\Windows\System\qYTfJYv.exe
  2⤵
  PID:6656
- C:\Windows\System\SVwjdLL.exe
  C:\Windows\System\SVwjdLL.exe
  2⤵
  PID:6680
- C:\Windows\System\TDkulBf.exe
  C:\Windows\System\TDkulBf.exe
  2⤵
  PID:6700
- C:\Windows\System\slnixOj.exe
  C:\Windows\System\slnixOj.exe
  2⤵
  PID:6728
- C:\Windows\System\eJdVuRT.exe
  C:\Windows\System\eJdVuRT.exe
  2⤵
  PID:6756
- C:\Windows\System\QbwpwJr.exe
  C:\Windows\System\QbwpwJr.exe
  2⤵
  PID:6776
- C:\Windows\System\HriUUTS.exe
  C:\Windows\System\HriUUTS.exe
  2⤵
  PID:6836
- C:\Windows\System\ixCxJwt.exe
  C:\Windows\System\ixCxJwt.exe
  2⤵
  PID:6868
- C:\Windows\System\ufKPMZR.exe
  C:\Windows\System\ufKPMZR.exe
  2⤵
  PID:6896
- C:\Windows\System\PCwyzLO.exe
  C:\Windows\System\PCwyzLO.exe
  2⤵
  PID:6924
- C:\Windows\System\dNgVoXu.exe
  C:\Windows\System\dNgVoXu.exe
  2⤵
  PID:6944
- C:\Windows\System\jhijSqa.exe
  C:\Windows\System\jhijSqa.exe
  2⤵
  PID:6972
- C:\Windows\System\dUAuPLI.exe
  C:\Windows\System\dUAuPLI.exe
  2⤵
  PID:7004
- C:\Windows\System\XvVWbAA.exe
  C:\Windows\System\XvVWbAA.exe
  2⤵
  PID:7028
- C:\Windows\System\nLlRrpg.exe
  C:\Windows\System\nLlRrpg.exe
  2⤵
  PID:7048
- C:\Windows\System\HpLlowO.exe
  C:\Windows\System\HpLlowO.exe
  2⤵
  PID:7076
- C:\Windows\System\voeyJTm.exe
  C:\Windows\System\voeyJTm.exe
  2⤵
  PID:7104
- C:\Windows\System\cubMfxj.exe
  C:\Windows\System\cubMfxj.exe
  2⤵
  PID:7128
- C:\Windows\System\WvGWDmU.exe
  C:\Windows\System\WvGWDmU.exe
  2⤵
  PID:5336
- C:\Windows\System\bIuOfYF.exe
  C:\Windows\System\bIuOfYF.exe
  2⤵
  PID:6172
- C:\Windows\System\VCozmyx.exe
  C:\Windows\System\VCozmyx.exe
  2⤵
  PID:6208
- C:\Windows\System\EtKCfpP.exe
  C:\Windows\System\EtKCfpP.exe
  2⤵
  PID:6276
- C:\Windows\System\QSKiTTH.exe
  C:\Windows\System\QSKiTTH.exe
  2⤵
  PID:6328
- C:\Windows\System\UbThhbt.exe
  C:\Windows\System\UbThhbt.exe
  2⤵
  PID:6384
- C:\Windows\System\WOZUOhi.exe
  C:\Windows\System\WOZUOhi.exe
  2⤵
  PID:6452
- C:\Windows\System\WkRlqgo.exe
  C:\Windows\System\WkRlqgo.exe
  2⤵
  PID:6488
- C:\Windows\System\qhDKyRF.exe
  C:\Windows\System\qhDKyRF.exe
  2⤵
  PID:6536
- C:\Windows\System\ytXQfxD.exe
  C:\Windows\System\ytXQfxD.exe
  2⤵
  PID:6664
- C:\Windows\System\sVaPObs.exe
  C:\Windows\System\sVaPObs.exe
  2⤵
  PID:6772
- C:\Windows\System\hiyEyKD.exe
  C:\Windows\System\hiyEyKD.exe
  2⤵
  PID:6796
- C:\Windows\System\DaCmyjF.exe
  C:\Windows\System\DaCmyjF.exe
  2⤵
  PID:6876
- C:\Windows\System\ihNRSHC.exe
  C:\Windows\System\ihNRSHC.exe
  2⤵
  PID:6936
- C:\Windows\System\FClJWsf.exe
  C:\Windows\System\FClJWsf.exe
  2⤵
  PID:6968
- C:\Windows\System\rmRsOEN.exe
  C:\Windows\System\rmRsOEN.exe
  2⤵
  PID:7020
- C:\Windows\System\xiZgBqN.exe
  C:\Windows\System\xiZgBqN.exe
  2⤵
  PID:7096
- C:\Windows\System\EOdQlNk.exe
  C:\Windows\System\EOdQlNk.exe
  2⤵
  PID:7144
- C:\Windows\System\VOpMIXc.exe
  C:\Windows\System\VOpMIXc.exe
  2⤵
  PID:7152
- C:\Windows\System\jsbdYtq.exe
  C:\Windows\System\jsbdYtq.exe
  2⤵
  PID:6316
- C:\Windows\System\CvKJALN.exe
  C:\Windows\System\CvKJALN.exe
  2⤵
  PID:6580
- C:\Windows\System\ZqYrlgu.exe
  C:\Windows\System\ZqYrlgu.exe
  2⤵
  PID:6692
- C:\Windows\System\anFkplG.exe
  C:\Windows\System\anFkplG.exe
  2⤵
  PID:6856
- C:\Windows\System\XlJzWaA.exe
  C:\Windows\System\XlJzWaA.exe
  2⤵
  PID:4512
- C:\Windows\System\Pylbiew.exe
  C:\Windows\System\Pylbiew.exe
  2⤵
  PID:3348
- C:\Windows\System\NcXkYyP.exe
  C:\Windows\System\NcXkYyP.exe
  2⤵
  PID:6528
- C:\Windows\System\JrOkzbX.exe
  C:\Windows\System\JrOkzbX.exe
  2⤵
  PID:6932
- C:\Windows\System\fVrvoEb.exe
  C:\Windows\System\fVrvoEb.exe
  2⤵
  PID:6284
- C:\Windows\System\YXviQqC.exe
  C:\Windows\System\YXviQqC.exe
  2⤵
  PID:6956
- C:\Windows\System\yxBEZaV.exe
  C:\Windows\System\yxBEZaV.exe
  2⤵
  PID:7176
- C:\Windows\System\vKnxuOu.exe
  C:\Windows\System\vKnxuOu.exe
  2⤵
  PID:7216
- C:\Windows\System\ubZYnoj.exe
  C:\Windows\System\ubZYnoj.exe
  2⤵
  PID:7240
- C:\Windows\System\ocigPvc.exe
  C:\Windows\System\ocigPvc.exe
  2⤵
  PID:7268
- C:\Windows\System\fueUzcp.exe
  C:\Windows\System\fueUzcp.exe
  2⤵
  PID:7296
- C:\Windows\System\igsDiVh.exe
  C:\Windows\System\igsDiVh.exe
  2⤵
  PID:7312
- C:\Windows\System\kdpMvHO.exe
  C:\Windows\System\kdpMvHO.exe
  2⤵
  PID:7340
- C:\Windows\System\bEeySvD.exe
  C:\Windows\System\bEeySvD.exe
  2⤵
  PID:7360
- C:\Windows\System\rsBpedH.exe
  C:\Windows\System\rsBpedH.exe
  2⤵
  PID:7404
- C:\Windows\System\hsYTZAR.exe
  C:\Windows\System\hsYTZAR.exe
  2⤵
  PID:7428
- C:\Windows\System\TuUeGdh.exe
  C:\Windows\System\TuUeGdh.exe
  2⤵
  PID:7468
- C:\Windows\System\zniQVHO.exe
  C:\Windows\System\zniQVHO.exe
  2⤵
  PID:7492
- C:\Windows\System\phPioTn.exe
  C:\Windows\System\phPioTn.exe
  2⤵
  PID:7520
- C:\Windows\System\XZeEBXi.exe
  C:\Windows\System\XZeEBXi.exe
  2⤵
  PID:7540
- C:\Windows\System\FxnITJz.exe
  C:\Windows\System\FxnITJz.exe
  2⤵
  PID:7560
- C:\Windows\System\mKrbCat.exe
  C:\Windows\System\mKrbCat.exe
  2⤵
  PID:7588
- C:\Windows\System\DoFiWas.exe
  C:\Windows\System\DoFiWas.exe
  2⤵
  PID:7636
- C:\Windows\System\DONCNWr.exe
  C:\Windows\System\DONCNWr.exe
  2⤵
  PID:7656
- C:\Windows\System\QxPPFAa.exe
  C:\Windows\System\QxPPFAa.exe
  2⤵
  PID:7680
- C:\Windows\System\YSssUCF.exe
  C:\Windows\System\YSssUCF.exe
  2⤵
  PID:7700
- C:\Windows\System\qPsKyxY.exe
  C:\Windows\System\qPsKyxY.exe
  2⤵
  PID:7728
- C:\Windows\System\CrfBmMu.exe
  C:\Windows\System\CrfBmMu.exe
  2⤵
  PID:7960
- C:\Windows\System\jiNkzXR.exe
  C:\Windows\System\jiNkzXR.exe
  2⤵
  PID:7980
- C:\Windows\System\zaIEIDm.exe
  C:\Windows\System\zaIEIDm.exe
  2⤵
  PID:8000
- C:\Windows\System\aqOeXQh.exe
  C:\Windows\System\aqOeXQh.exe
  2⤵
  PID:8028
- C:\Windows\System\qPVOocj.exe
  C:\Windows\System\qPVOocj.exe
  2⤵
  PID:8060
- C:\Windows\System\hQuOGAg.exe
  C:\Windows\System\hQuOGAg.exe
  2⤵
  PID:8084
- C:\Windows\System\tAFendb.exe
  C:\Windows\System\tAFendb.exe
  2⤵
  PID:8104
- C:\Windows\System\JJyUnfA.exe
  C:\Windows\System\JJyUnfA.exe
  2⤵
  PID:8124
- C:\Windows\System\nBkdUPY.exe
  C:\Windows\System\nBkdUPY.exe
  2⤵
  PID:8148
- C:\Windows\System\dueSnQa.exe
  C:\Windows\System\dueSnQa.exe
  2⤵
  PID:8164
- C:\Windows\System\AeQsoze.exe
  C:\Windows\System\AeQsoze.exe
  2⤵
  PID:6628
- C:\Windows\System\LRohcRg.exe
  C:\Windows\System\LRohcRg.exe
  2⤵
  PID:1860
- C:\Windows\System\MlHBfhA.exe
  C:\Windows\System\MlHBfhA.exe
  2⤵
  PID:7228
- C:\Windows\System\pUfeMbN.exe
  C:\Windows\System\pUfeMbN.exe
  2⤵
  PID:7280
- C:\Windows\System\OIkmxkD.exe
  C:\Windows\System\OIkmxkD.exe
  2⤵
  PID:7348
- C:\Windows\System\AncyZPe.exe
  C:\Windows\System\AncyZPe.exe
  2⤵
  PID:7392
- C:\Windows\System\mbybcgv.exe
  C:\Windows\System\mbybcgv.exe
  2⤵
  PID:7696
- C:\Windows\System\KUUijIU.exe
  C:\Windows\System\KUUijIU.exe
  2⤵
  PID:7744
- C:\Windows\System\gQTmKuQ.exe
  C:\Windows\System\gQTmKuQ.exe
  2⤵
  PID:7768
- C:\Windows\System\fkVrNPd.exe
  C:\Windows\System\fkVrNPd.exe
  2⤵
  PID:7808
- C:\Windows\System\TyUVygu.exe
  C:\Windows\System\TyUVygu.exe
  2⤵
  PID:7832
- C:\Windows\System\gySfdtg.exe
  C:\Windows\System\gySfdtg.exe
  2⤵
  PID:7852
- C:\Windows\System\mcdhtDO.exe
  C:\Windows\System\mcdhtDO.exe
  2⤵
  PID:7988
- C:\Windows\System\ZkWuqeK.exe
  C:\Windows\System\ZkWuqeK.exe
  2⤵
  PID:7952
- C:\Windows\System\pJMHFrL.exe
  C:\Windows\System\pJMHFrL.exe
  2⤵
  PID:7948
- C:\Windows\System\hRDPjqA.exe
  C:\Windows\System\hRDPjqA.exe
  2⤵
  PID:4748
- C:\Windows\System\bbuvhDv.exe
  C:\Windows\System\bbuvhDv.exe
  2⤵
  PID:7884
- C:\Windows\System\JJwypdE.exe
  C:\Windows\System\JJwypdE.exe
  2⤵
  PID:7900
- C:\Windows\System\ggCCmcD.exe
  C:\Windows\System\ggCCmcD.exe
  2⤵
  PID:7632
- C:\Windows\System\YrLKuaj.exe
  C:\Windows\System\YrLKuaj.exe
  2⤵
  PID:6724
- C:\Windows\System\XFvrjjm.exe
  C:\Windows\System\XFvrjjm.exe
  2⤵
  PID:7784
- C:\Windows\System\uhflksj.exe
  C:\Windows\System\uhflksj.exe
  2⤵
  PID:7800
- C:\Windows\System\brNhsWG.exe
  C:\Windows\System\brNhsWG.exe
  2⤵
  PID:7844
- C:\Windows\System\zltUUeZ.exe
  C:\Windows\System\zltUUeZ.exe
  2⤵
  PID:7972
- C:\Windows\System\cOXssYl.exe
  C:\Windows\System\cOXssYl.exe
  2⤵
  PID:8092
- C:\Windows\System\hFFgQSb.exe
  C:\Windows\System\hFFgQSb.exe
  2⤵
  PID:8156
- C:\Windows\System\yhxNXjq.exe
  C:\Windows\System\yhxNXjq.exe
  2⤵
  PID:7876
- C:\Windows\System\FZEETGc.exe
  C:\Windows\System\FZEETGc.exe
  2⤵
  PID:888
- C:\Windows\System\DjTItGC.exe
  C:\Windows\System\DjTItGC.exe
  2⤵
  PID:7932
- C:\Windows\System\VIPcIAR.exe
  C:\Windows\System\VIPcIAR.exe
  2⤵
  PID:8116
- C:\Windows\System\WiPfmZL.exe
  C:\Windows\System\WiPfmZL.exe
  2⤵
  PID:8120
- C:\Windows\System\ykmtglZ.exe
  C:\Windows\System\ykmtglZ.exe
  2⤵
  PID:7276
- C:\Windows\System\dtDFrry.exe
  C:\Windows\System\dtDFrry.exe
  2⤵
  PID:7860
- C:\Windows\System\rsYGgYG.exe
  C:\Windows\System\rsYGgYG.exe
  2⤵
  PID:7484
- C:\Windows\System\HrzPsNj.exe
  C:\Windows\System\HrzPsNj.exe
  2⤵
  PID:8224
- C:\Windows\System\xhsygDR.exe
  C:\Windows\System\xhsygDR.exe
  2⤵
  PID:8248
- C:\Windows\System\OPKtLJm.exe
  C:\Windows\System\OPKtLJm.exe
  2⤵
  PID:8272
- C:\Windows\System\VodsLRk.exe
  C:\Windows\System\VodsLRk.exe
  2⤵
  PID:8292
- C:\Windows\System\CskUafa.exe
  C:\Windows\System\CskUafa.exe
  2⤵
  PID:8336
- C:\Windows\System\uyvwfUd.exe
  C:\Windows\System\uyvwfUd.exe
  2⤵
  PID:8364
- C:\Windows\System\BXhlAAM.exe
  C:\Windows\System\BXhlAAM.exe
  2⤵
  PID:8388
- C:\Windows\System\OerLGfU.exe
  C:\Windows\System\OerLGfU.exe
  2⤵
  PID:8412
- C:\Windows\System\SOopYvz.exe
  C:\Windows\System\SOopYvz.exe
  2⤵
  PID:8436
- C:\Windows\System\eiTBbZs.exe
  C:\Windows\System\eiTBbZs.exe
  2⤵
  PID:8468
- C:\Windows\System\efVymbE.exe
  C:\Windows\System\efVymbE.exe
  2⤵
  PID:8484
- C:\Windows\System\eEVTTdu.exe
  C:\Windows\System\eEVTTdu.exe
  2⤵
  PID:8532
- C:\Windows\System\PXkYAle.exe
  C:\Windows\System\PXkYAle.exe
  2⤵
  PID:8556
- C:\Windows\System\mLeWTJP.exe
  C:\Windows\System\mLeWTJP.exe
  2⤵
  PID:8600
- C:\Windows\System\TiBxCmJ.exe
  C:\Windows\System\TiBxCmJ.exe
  2⤵
  PID:8624
- C:\Windows\System\AMeendK.exe
  C:\Windows\System\AMeendK.exe
  2⤵
  PID:8644
- C:\Windows\System\htJaQvg.exe
  C:\Windows\System\htJaQvg.exe
  2⤵
  PID:8664
- C:\Windows\System\TeJxVfx.exe
  C:\Windows\System\TeJxVfx.exe
  2⤵
  PID:8696
- C:\Windows\System\jpZRhPm.exe
  C:\Windows\System\jpZRhPm.exe
  2⤵
  PID:8720
- C:\Windows\System\hVfzSQR.exe
  C:\Windows\System\hVfzSQR.exe
  2⤵
  PID:8744
- C:\Windows\System\tgWoJrQ.exe
  C:\Windows\System\tgWoJrQ.exe
  2⤵
  PID:8792
- C:\Windows\System\SZaPbaJ.exe
  C:\Windows\System\SZaPbaJ.exe
  2⤵
  PID:8816
- C:\Windows\System\TOFNkpq.exe
  C:\Windows\System\TOFNkpq.exe
  2⤵
  PID:8836
- C:\Windows\System\qizWWUk.exe
  C:\Windows\System\qizWWUk.exe
  2⤵
  PID:8864
- C:\Windows\System\yvbDQqa.exe
  C:\Windows\System\yvbDQqa.exe
  2⤵
  PID:8892
- C:\Windows\System\XDToJjH.exe
  C:\Windows\System\XDToJjH.exe
  2⤵
  PID:8920
- C:\Windows\System\BqKsacG.exe
  C:\Windows\System\BqKsacG.exe
  2⤵
  PID:8960
- C:\Windows\System\xZprjTS.exe
  C:\Windows\System\xZprjTS.exe
  2⤵
  PID:8984
- C:\Windows\System\ghBwnXB.exe
  C:\Windows\System\ghBwnXB.exe
  2⤵
  PID:9004
- C:\Windows\System\vJvxZqr.exe
  C:\Windows\System\vJvxZqr.exe
  2⤵
  PID:9024
- C:\Windows\System\GCQvMPQ.exe
  C:\Windows\System\GCQvMPQ.exe
  2⤵
  PID:9044
- C:\Windows\System\KHhkyys.exe
  C:\Windows\System\KHhkyys.exe
  2⤵
  PID:9060
- C:\Windows\System\rCWSFmJ.exe
  C:\Windows\System\rCWSFmJ.exe
  2⤵
  PID:9080
- C:\Windows\System\KSJmgkX.exe
  C:\Windows\System\KSJmgkX.exe
  2⤵
  PID:9100
- C:\Windows\System\hbCRjeA.exe
  C:\Windows\System\hbCRjeA.exe
  2⤵
  PID:9156
- C:\Windows\System\KvFrvMP.exe
  C:\Windows\System\KvFrvMP.exe
  2⤵
  PID:9184
- C:\Windows\System\vSEqefv.exe
  C:\Windows\System\vSEqefv.exe
  2⤵
  PID:9204
- C:\Windows\System\oWPVgLA.exe
  C:\Windows\System\oWPVgLA.exe
  2⤵
  PID:7444
- C:\Windows\System\hnNItcF.exe
  C:\Windows\System\hnNItcF.exe
  2⤵
  PID:8216
- C:\Windows\System\dIDoxgf.exe
  C:\Windows\System\dIDoxgf.exe
  2⤵
  PID:8256
- C:\Windows\System\InxrCXj.exe
  C:\Windows\System\InxrCXj.exe
  2⤵
  PID:8376
- C:\Windows\System\QxyXIZd.exe
  C:\Windows\System\QxyXIZd.exe
  2⤵
  PID:8480
- C:\Windows\System\MZEvmOl.exe
  C:\Windows\System\MZEvmOl.exe
  2⤵
  PID:8508
- C:\Windows\System\AUzpkdJ.exe
  C:\Windows\System\AUzpkdJ.exe
  2⤵
  PID:8548
- C:\Windows\System\UJGPGcJ.exe
  C:\Windows\System\UJGPGcJ.exe
  2⤵
  PID:8612
- C:\Windows\System\IGIzZCw.exe
  C:\Windows\System\IGIzZCw.exe
  2⤵
  PID:8672
- C:\Windows\System\NpACwWd.exe
  C:\Windows\System\NpACwWd.exe
  2⤵
  PID:8772
- C:\Windows\System\QITIprN.exe
  C:\Windows\System\QITIprN.exe
  2⤵
  PID:8808
- C:\Windows\System\hPepUaY.exe
  C:\Windows\System\hPepUaY.exe
  2⤵
  PID:8876
- C:\Windows\System\SsULaXq.exe
  C:\Windows\System\SsULaXq.exe
  2⤵
  PID:8936
- C:\Windows\System\ordSqsa.exe
  C:\Windows\System\ordSqsa.exe
  2⤵
  PID:8972
- C:\Windows\System\atDzRqP.exe
  C:\Windows\System\atDzRqP.exe
  2⤵
  PID:9020
- C:\Windows\System\fChWYKn.exe
  C:\Windows\System\fChWYKn.exe
  2⤵
  PID:9132
- C:\Windows\System\dhaXoXO.exe
  C:\Windows\System\dhaXoXO.exe
  2⤵
  PID:8332
- C:\Windows\System\YmugQwC.exe
  C:\Windows\System\YmugQwC.exe
  2⤵
  PID:8360
- C:\Windows\System\oaWwcpr.exe
  C:\Windows\System\oaWwcpr.exe
  2⤵
  PID:8576
- C:\Windows\System\iAzrJkf.exe
  C:\Windows\System\iAzrJkf.exe
  2⤵
  PID:8660
- C:\Windows\System\oqZXTlp.exe
  C:\Windows\System\oqZXTlp.exe
  2⤵
  PID:8736
- C:\Windows\System\rSUxdzL.exe
  C:\Windows\System\rSUxdzL.exe
  2⤵
  PID:8768
- C:\Windows\System\LRsyTRb.exe
  C:\Windows\System\LRsyTRb.exe
  2⤵
  PID:9144
- C:\Windows\System\Hnwphgm.exe
  C:\Windows\System\Hnwphgm.exe
  2⤵
  PID:7256
- C:\Windows\System\hqhewOp.exe
  C:\Windows\System\hqhewOp.exe
  2⤵
  PID:8632
- C:\Windows\System\EHMaZDy.exe
  C:\Windows\System\EHMaZDy.exe
  2⤵
  PID:4832
- C:\Windows\System\bivPBJF.exe
  C:\Windows\System\bivPBJF.exe
  2⤵
  PID:8400
- C:\Windows\System\YZtupnN.exe
  C:\Windows\System\YZtupnN.exe
  2⤵
  PID:8828
- C:\Windows\System\lDFccNv.exe
  C:\Windows\System\lDFccNv.exe
  2⤵
  PID:9220
- C:\Windows\System\PyuGIfG.exe
  C:\Windows\System\PyuGIfG.exe
  2⤵
  PID:9244
- C:\Windows\System\TKjqeiX.exe
  C:\Windows\System\TKjqeiX.exe
  2⤵
  PID:9264
- C:\Windows\System\ETgtTCx.exe
  C:\Windows\System\ETgtTCx.exe
  2⤵
  PID:9308
- C:\Windows\System\Dtyrdxx.exe
  C:\Windows\System\Dtyrdxx.exe
  2⤵
  PID:9328
- C:\Windows\System\QuTFKzW.exe
  C:\Windows\System\QuTFKzW.exe
  2⤵
  PID:9348
- C:\Windows\System\ofpkLWX.exe
  C:\Windows\System\ofpkLWX.exe
  2⤵
  PID:9388
- C:\Windows\System\sxGQxAy.exe
  C:\Windows\System\sxGQxAy.exe
  2⤵
  PID:9416
- C:\Windows\System\ygotXRL.exe
  C:\Windows\System\ygotXRL.exe
  2⤵
  PID:9440
- C:\Windows\System\guHgrhc.exe
  C:\Windows\System\guHgrhc.exe
  2⤵
  PID:9472
- C:\Windows\System\wcVBlat.exe
  C:\Windows\System\wcVBlat.exe
  2⤵
  PID:9488
- C:\Windows\System\iXKUlwQ.exe
  C:\Windows\System\iXKUlwQ.exe
  2⤵
  PID:9512
- C:\Windows\System\PnRHfGe.exe
  C:\Windows\System\PnRHfGe.exe
  2⤵
  PID:9556
- C:\Windows\System\FSItagp.exe
  C:\Windows\System\FSItagp.exe
  2⤵
  PID:9596
- C:\Windows\System\kXnJOEJ.exe
  C:\Windows\System\kXnJOEJ.exe
  2⤵
  PID:9624
- C:\Windows\System\JwwQync.exe
  C:\Windows\System\JwwQync.exe
  2⤵
  PID:9644
- C:\Windows\System\XMJYQtU.exe
  C:\Windows\System\XMJYQtU.exe
  2⤵
  PID:9668
- C:\Windows\System\qKBKmAM.exe
  C:\Windows\System\qKBKmAM.exe
  2⤵
  PID:9708
- C:\Windows\System\hnMmdhn.exe
  C:\Windows\System\hnMmdhn.exe
  2⤵
  PID:9728
- C:\Windows\System\jzILkvw.exe
  C:\Windows\System\jzILkvw.exe
  2⤵
  PID:9752
- C:\Windows\System\MSANsVz.exe
  C:\Windows\System\MSANsVz.exe
  2⤵
  PID:9776
- C:\Windows\System\JHfYbfv.exe
  C:\Windows\System\JHfYbfv.exe
  2⤵
  PID:9804
- C:\Windows\System\kdEimyg.exe
  C:\Windows\System\kdEimyg.exe
  2⤵
  PID:9848
- C:\Windows\System\rFyaHKx.exe
  C:\Windows\System\rFyaHKx.exe
  2⤵
  PID:9868
- C:\Windows\System\bDpwqdC.exe
  C:\Windows\System\bDpwqdC.exe
  2⤵
  PID:9900
- C:\Windows\System\ATsFjID.exe
  C:\Windows\System\ATsFjID.exe
  2⤵
  PID:9916
- C:\Windows\System\dnFohlE.exe
  C:\Windows\System\dnFohlE.exe
  2⤵
  PID:9940
- C:\Windows\System\HbCmPxF.exe
  C:\Windows\System\HbCmPxF.exe
  2⤵
  PID:9960
- C:\Windows\System\LyoUsPj.exe
  C:\Windows\System\LyoUsPj.exe
  2⤵
  PID:10000
- C:\Windows\System\NmnVUWC.exe
  C:\Windows\System\NmnVUWC.exe
  2⤵
  PID:10040
- C:\Windows\System\DwSXpZG.exe
  C:\Windows\System\DwSXpZG.exe
  2⤵
  PID:10064
- C:\Windows\System\vAPoeVa.exe
  C:\Windows\System\vAPoeVa.exe
  2⤵
  PID:10084
- C:\Windows\System\dQJsAQV.exe
  C:\Windows\System\dQJsAQV.exe
  2⤵
  PID:10128
- C:\Windows\System\IAwrPBw.exe
  C:\Windows\System\IAwrPBw.exe
  2⤵
  PID:10156
- C:\Windows\System\NMgVkww.exe
  C:\Windows\System\NMgVkww.exe
  2⤵
  PID:10180
- C:\Windows\System\DTSxNeW.exe
  C:\Windows\System\DTSxNeW.exe
  2⤵
  PID:10196
- C:\Windows\System\YjVBuWR.exe
  C:\Windows\System\YjVBuWR.exe
  2⤵
  PID:10236
- C:\Windows\System\vzyTqBC.exe
  C:\Windows\System\vzyTqBC.exe
  2⤵
  PID:9252
- C:\Windows\System\CuUlDqP.exe
  C:\Windows\System\CuUlDqP.exe
  2⤵
  PID:9316
- C:\Windows\System\bNMTtkc.exe
  C:\Windows\System\bNMTtkc.exe
  2⤵
  PID:9408
- C:\Windows\System\RFMEdAF.exe
  C:\Windows\System\RFMEdAF.exe
  2⤵
  PID:9428
- C:\Windows\System\OaaRkCZ.exe
  C:\Windows\System\OaaRkCZ.exe
  2⤵
  PID:9528
- C:\Windows\System\VFvmWDs.exe
  C:\Windows\System\VFvmWDs.exe
  2⤵
  PID:9564
- C:\Windows\System\PyYqbmc.exe
  C:\Windows\System\PyYqbmc.exe
  2⤵
  PID:9636
- C:\Windows\System\redaEPx.exe
  C:\Windows\System\redaEPx.exe
  2⤵
  PID:9684
- C:\Windows\System\LMobtoD.exe
  C:\Windows\System\LMobtoD.exe
  2⤵
  PID:9800
- C:\Windows\System\JWGhqew.exe
  C:\Windows\System\JWGhqew.exe
  2⤵
  PID:9864
- C:\Windows\System\bmXOdjA.exe
  C:\Windows\System\bmXOdjA.exe
  2⤵
  PID:9908
- C:\Windows\System\ZunNgyB.exe
  C:\Windows\System\ZunNgyB.exe
  2⤵
  PID:528
- C:\Windows\System\ZfToWmM.exe
  C:\Windows\System\ZfToWmM.exe
  2⤵
  PID:9068
- C:\Windows\System\qytfaOu.exe
  C:\Windows\System\qytfaOu.exe
  2⤵
  PID:10148
- C:\Windows\System\DBVzuee.exe
  C:\Windows\System\DBVzuee.exe
  2⤵
  PID:10188
- C:\Windows\System\SLrhKBd.exe
  C:\Windows\System\SLrhKBd.exe
  2⤵
  PID:10224
- C:\Windows\System\ArnquSy.exe
  C:\Windows\System\ArnquSy.exe
  2⤵
  PID:9336
- C:\Windows\System\SGeIFpc.exe
  C:\Windows\System\SGeIFpc.exe
  2⤵
  PID:4116
- C:\Windows\System\gMcClAg.exe
  C:\Windows\System\gMcClAg.exe
  2⤵
  PID:9632
- C:\Windows\System\YMFjWWl.exe
  C:\Windows\System\YMFjWWl.exe
  2⤵
  PID:9880
- C:\Windows\System\VkqazRV.exe
  C:\Windows\System\VkqazRV.exe
  2⤵
  PID:10036
- C:\Windows\System\ivwZWIV.exe
  C:\Windows\System\ivwZWIV.exe
  2⤵
  PID:9284
- C:\Windows\System\myxQeIT.exe
  C:\Windows\System\myxQeIT.exe
  2⤵
  PID:392
- C:\Windows\System\nmkvBgb.exe
  C:\Windows\System\nmkvBgb.exe
  2⤵
  PID:3732
- C:\Windows\System\XBQIGdS.exe
  C:\Windows\System\XBQIGdS.exe
  2⤵
  PID:4180
- C:\Windows\System\yyKEeAm.exe
  C:\Windows\System\yyKEeAm.exe
  2⤵
  PID:10208
- C:\Windows\System\bMdziYK.exe
  C:\Windows\System\bMdziYK.exe
  2⤵
  PID:10260
- C:\Windows\System\mSppYyR.exe
  C:\Windows\System\mSppYyR.exe
  2⤵
  PID:10284
- C:\Windows\System\sXTuayo.exe
  C:\Windows\System\sXTuayo.exe
  2⤵
  PID:10304
- C:\Windows\System\rVbhJFS.exe
  C:\Windows\System\rVbhJFS.exe
  2⤵
  PID:10376
- C:\Windows\System\ZgJdZxm.exe
  C:\Windows\System\ZgJdZxm.exe
  2⤵
  PID:10404
- C:\Windows\System\TTAuYLY.exe
  C:\Windows\System\TTAuYLY.exe
  2⤵
  PID:10436
- C:\Windows\System\BWfAUBj.exe
  C:\Windows\System\BWfAUBj.exe
  2⤵
  PID:10452
- C:\Windows\System\NmiBVuM.exe
  C:\Windows\System\NmiBVuM.exe
  2⤵
  PID:10480
- C:\Windows\System\kFTFZwF.exe
  C:\Windows\System\kFTFZwF.exe
  2⤵
  PID:10508
- C:\Windows\System\gNPHGON.exe
  C:\Windows\System\gNPHGON.exe
  2⤵
  PID:10536
- C:\Windows\System\mEimGnR.exe
  C:\Windows\System\mEimGnR.exe
  2⤵
  PID:10560
- C:\Windows\System\LJkdWVk.exe
  C:\Windows\System\LJkdWVk.exe
  2⤵
  PID:10588
- C:\Windows\System\IqEzHIQ.exe
  C:\Windows\System\IqEzHIQ.exe
  2⤵
  PID:10616
- C:\Windows\System\LOwAFDq.exe
  C:\Windows\System\LOwAFDq.exe
  2⤵
  PID:10648
- C:\Windows\System\Lapzteh.exe
  C:\Windows\System\Lapzteh.exe
  2⤵
  PID:10672
- C:\Windows\System\TAocdjX.exe
  C:\Windows\System\TAocdjX.exe
  2⤵
  PID:10692
- C:\Windows\System\hHNjDxU.exe
  C:\Windows\System\hHNjDxU.exe
  2⤵
  PID:10724
- C:\Windows\System\BqTpayP.exe
  C:\Windows\System\BqTpayP.exe
  2⤵
  PID:10740
- C:\Windows\System\IeJyAul.exe
  C:\Windows\System\IeJyAul.exe
  2⤵
  PID:10792
- C:\Windows\System\mOznrxI.exe
  C:\Windows\System\mOznrxI.exe
  2⤵
  PID:10816
- C:\Windows\System\MRSdwcV.exe
  C:\Windows\System\MRSdwcV.exe
  2⤵
  PID:10840
- C:\Windows\System\dWxfuBv.exe
  C:\Windows\System\dWxfuBv.exe
  2⤵
  PID:10876
- C:\Windows\System\gIzVpSD.exe
  C:\Windows\System\gIzVpSD.exe
  2⤵
  PID:10932
- C:\Windows\System\auNSkgz.exe
  C:\Windows\System\auNSkgz.exe
  2⤵
  PID:10960
- C:\Windows\System\eHIbqxf.exe
  C:\Windows\System\eHIbqxf.exe
  2⤵
  PID:10984
- C:\Windows\System\kfVZbZY.exe
  C:\Windows\System\kfVZbZY.exe
  2⤵
  PID:11008
- C:\Windows\System\yyuxNor.exe
  C:\Windows\System\yyuxNor.exe
  2⤵
  PID:11036
- C:\Windows\System\PRIOPGf.exe
  C:\Windows\System\PRIOPGf.exe
  2⤵
  PID:11056
- C:\Windows\System\awvFdeb.exe
  C:\Windows\System\awvFdeb.exe
  2⤵
  PID:11080
- C:\Windows\System\vmhTAuw.exe
  C:\Windows\System\vmhTAuw.exe
  2⤵
  PID:11100
- C:\Windows\System\RnowOIA.exe
  C:\Windows\System\RnowOIA.exe
  2⤵
  PID:11128
- C:\Windows\System\AMLyVna.exe
  C:\Windows\System\AMLyVna.exe
  2⤵
  PID:11168
- C:\Windows\System\srKoaXA.exe
  C:\Windows\System\srKoaXA.exe
  2⤵
  PID:11192
- C:\Windows\System\tsgHPKH.exe
  C:\Windows\System\tsgHPKH.exe
  2⤵
  PID:11244
- C:\Windows\System\mhOeHEN.exe
  C:\Windows\System\mhOeHEN.exe
  2⤵
  PID:10124
- C:\Windows\System\aNkVYiW.exe
  C:\Windows\System\aNkVYiW.exe
  2⤵
  PID:10268
- C:\Windows\System\WAMbORe.exe
  C:\Windows\System\WAMbORe.exe
  2⤵
  PID:10324
- C:\Windows\System\AWTQyjh.exe
  C:\Windows\System\AWTQyjh.exe
  2⤵
  PID:10416
- C:\Windows\System\ejdQrUM.exe
  C:\Windows\System\ejdQrUM.exe
  2⤵
  PID:10464
- C:\Windows\System\rnGGKou.exe
  C:\Windows\System\rnGGKou.exe
  2⤵
  PID:10520
- C:\Windows\System\jnJRnHp.exe
  C:\Windows\System\jnJRnHp.exe
  2⤵
  PID:10604
- C:\Windows\System\nlwHZFa.exe
  C:\Windows\System\nlwHZFa.exe
  2⤵
  PID:10656
- C:\Windows\System\rZBCLmo.exe
  C:\Windows\System\rZBCLmo.exe
  2⤵
  PID:10680
- C:\Windows\System\PigtTTT.exe
  C:\Windows\System\PigtTTT.exe
  2⤵
  PID:10768
- C:\Windows\System\UHyhtwN.exe
  C:\Windows\System\UHyhtwN.exe
  2⤵
  PID:4372
- C:\Windows\System\IciFRtR.exe
  C:\Windows\System\IciFRtR.exe
  2⤵
  PID:10872
- C:\Windows\System\uPuJFRt.exe
  C:\Windows\System\uPuJFRt.exe
  2⤵
  PID:3388
- C:\Windows\System\qzJqQyU.exe
  C:\Windows\System\qzJqQyU.exe
  2⤵
  PID:10992
- C:\Windows\System\vqLEWbd.exe
  C:\Windows\System\vqLEWbd.exe
  2⤵
  PID:11092
- C:\Windows\System\pAUhSsk.exe
  C:\Windows\System\pAUhSsk.exe
  2⤵
  PID:11160
- C:\Windows\System\EySHbJA.exe
  C:\Windows\System\EySHbJA.exe
  2⤵
  PID:11232
- C:\Windows\System\wfddOxu.exe
  C:\Windows\System\wfddOxu.exe
  2⤵
  PID:10108
- C:\Windows\System\KeKjlbj.exe
  C:\Windows\System\KeKjlbj.exe
  2⤵
  PID:10396
- C:\Windows\System\vIVvQfq.exe
  C:\Windows\System\vIVvQfq.exe
  2⤵
  PID:10492
- C:\Windows\System\ZoHpbXO.exe
  C:\Windows\System\ZoHpbXO.exe
  2⤵
  PID:4212
- C:\Windows\System\MgbELJA.exe
  C:\Windows\System\MgbELJA.exe
  2⤵
  PID:10824
- C:\Windows\System\jkXAVig.exe
  C:\Windows\System\jkXAVig.exe
  2⤵
  PID:10924
- C:\Windows\System\uyKRwOC.exe
  C:\Windows\System\uyKRwOC.exe
  2⤵
  PID:11184
- C:\Windows\System\zJQWJfN.exe
  C:\Windows\System\zJQWJfN.exe
  2⤵
  PID:11188
- C:\Windows\System\ihqeTeU.exe
  C:\Windows\System\ihqeTeU.exe
  2⤵
  PID:10300
- C:\Windows\System\MwaxQkS.exe
  C:\Windows\System\MwaxQkS.exe
  2⤵
  PID:10576
- C:\Windows\System\pFPsULo.exe
  C:\Windows\System\pFPsULo.exe
  2⤵
  PID:668
- C:\Windows\System\okWUKzX.exe
  C:\Windows\System\okWUKzX.exe
  2⤵
  PID:10248
- C:\Windows\System\FuFJEXa.exe
  C:\Windows\System\FuFJEXa.exe
  2⤵
  PID:3912
- C:\Windows\System\afrWVLQ.exe
  C:\Windows\System\afrWVLQ.exe
  2⤵
  PID:3764
- C:\Windows\System\EeePiOX.exe
  C:\Windows\System\EeePiOX.exe
  2⤵
  PID:4348
- C:\Windows\System\PGfiGyt.exe
  C:\Windows\System\PGfiGyt.exe
  2⤵
  PID:11028
- C:\Windows\System\stlaGbm.exe
  C:\Windows\System\stlaGbm.exe
  2⤵
  PID:1560
- C:\Windows\System\WXdxIZO.exe
  C:\Windows\System\WXdxIZO.exe
  2⤵
  PID:3048
- C:\Windows\System\aAjdACh.exe
  C:\Windows\System\aAjdACh.exe
  2⤵
  PID:10296
- C:\Windows\System\bfZrwyM.exe
  C:\Windows\System\bfZrwyM.exe
  2⤵
  PID:11288
- C:\Windows\System\BQMRpzY.exe
  C:\Windows\System\BQMRpzY.exe
  2⤵
  PID:11312
- C:\Windows\System\gGhERPs.exe
  C:\Windows\System\gGhERPs.exe
  2⤵
  PID:11332
- C:\Windows\System\nkMSUvk.exe
  C:\Windows\System\nkMSUvk.exe
  2⤵
  PID:11376
- C:\Windows\System\SEIbZBx.exe
  C:\Windows\System\SEIbZBx.exe
  2⤵
  PID:11400
- C:\Windows\System\gSoSbLE.exe
  C:\Windows\System\gSoSbLE.exe
  2⤵
  PID:11432
- C:\Windows\System\lImyukH.exe
  C:\Windows\System\lImyukH.exe
  2⤵
  PID:11452
- C:\Windows\System\iUjEANx.exe
  C:\Windows\System\iUjEANx.exe
  2⤵
  PID:11468
- C:\Windows\System\cUQeGhN.exe
  C:\Windows\System\cUQeGhN.exe
  2⤵
  PID:11504
- C:\Windows\System\GHhPGAj.exe
  C:\Windows\System\GHhPGAj.exe
  2⤵
  PID:11544
- C:\Windows\System\nDTwXCF.exe
  C:\Windows\System\nDTwXCF.exe
  2⤵
  PID:11572
- C:\Windows\System\nFPnfdW.exe
  C:\Windows\System\nFPnfdW.exe
  2⤵
  PID:11600
- C:\Windows\System\hceyQhg.exe
  C:\Windows\System\hceyQhg.exe
  2⤵
  PID:11620
- C:\Windows\System\oGwhZXe.exe
  C:\Windows\System\oGwhZXe.exe
  2⤵
  PID:11644
- C:\Windows\System\pFNDJZl.exe
  C:\Windows\System\pFNDJZl.exe
  2⤵
  PID:11684
- C:\Windows\System\BgPBdOa.exe
  C:\Windows\System\BgPBdOa.exe
  2⤵
  PID:11716
- C:\Windows\System\UNqbulo.exe
  C:\Windows\System\UNqbulo.exe
  2⤵
  PID:11748
- C:\Windows\System\LiqxXeU.exe
  C:\Windows\System\LiqxXeU.exe
  2⤵
  PID:11768
- C:\Windows\System\NBIhLGG.exe
  C:\Windows\System\NBIhLGG.exe
  2⤵
  PID:11784
- C:\Windows\System\CjQgXRn.exe
  C:\Windows\System\CjQgXRn.exe
  2⤵
  PID:11808
- C:\Windows\System\novVcog.exe
  C:\Windows\System\novVcog.exe
  2⤵
  PID:11828
- C:\Windows\System\lPpuQpd.exe
  C:\Windows\System\lPpuQpd.exe
  2⤵
  PID:11856
- C:\Windows\System\QzZeLJH.exe
  C:\Windows\System\QzZeLJH.exe
  2⤵
  PID:11888
- C:\Windows\System\ZArutVL.exe
  C:\Windows\System\ZArutVL.exe
  2⤵
  PID:11912
- C:\Windows\System\vJDwwxe.exe
  C:\Windows\System\vJDwwxe.exe
  2⤵
  PID:11944
- C:\Windows\System\sjRVWTt.exe
  C:\Windows\System\sjRVWTt.exe
  2⤵
  PID:11992
- C:\Windows\System\afMlkYa.exe
  C:\Windows\System\afMlkYa.exe
  2⤵
  PID:12012
- C:\Windows\System\xIQYRKl.exe
  C:\Windows\System\xIQYRKl.exe
  2⤵
  PID:12040
- C:\Windows\System\jAdwxYc.exe
  C:\Windows\System\jAdwxYc.exe
  2⤵
  PID:12076
- C:\Windows\System\vLrzfHP.exe
  C:\Windows\System\vLrzfHP.exe
  2⤵
  PID:12116
- C:\Windows\System\ETXJoOZ.exe
  C:\Windows\System\ETXJoOZ.exe
  2⤵
  PID:12140
- C:\Windows\System\bEazSkv.exe
  C:\Windows\System\bEazSkv.exe
  2⤵
  PID:12160
- C:\Windows\System\Woyinql.exe
  C:\Windows\System\Woyinql.exe
  2⤵
  PID:12204
- C:\Windows\System\DSBGSua.exe
  C:\Windows\System\DSBGSua.exe
  2⤵
  PID:12232
- C:\Windows\System\UGRVcNu.exe
  C:\Windows\System\UGRVcNu.exe
  2⤵
  PID:12256
- C:\Windows\System\Syenttn.exe
  C:\Windows\System\Syenttn.exe
  2⤵
  PID:12280
- C:\Windows\System\jKcHInR.exe
  C:\Windows\System\jKcHInR.exe
  2⤵
  PID:11304
- C:\Windows\System\aXnxzuW.exe
  C:\Windows\System\aXnxzuW.exe
  2⤵
  PID:11372
- C:\Windows\System\pysUtep.exe
  C:\Windows\System\pysUtep.exe
  2⤵
  PID:11424
- C:\Windows\System\kVjPajH.exe
  C:\Windows\System\kVjPajH.exe
  2⤵
  PID:11460
- C:\Windows\System\jKPZVkQ.exe
  C:\Windows\System\jKPZVkQ.exe
  2⤵
  PID:11496
- C:\Windows\System\CyIKfLv.exe
  C:\Windows\System\CyIKfLv.exe
  2⤵
  PID:11540
- C:\Windows\System\vvxomxW.exe
  C:\Windows\System\vvxomxW.exe
  2⤵
  PID:11616
- C:\Windows\System\WkHeGkj.exe
  C:\Windows\System\WkHeGkj.exe
  2⤵
  PID:11660
- C:\Windows\System\HgcgNIC.exe
  C:\Windows\System\HgcgNIC.exe
  2⤵
  PID:11732
- C:\Windows\System\flwoBnJ.exe
  C:\Windows\System\flwoBnJ.exe
  2⤵
  PID:11780
- C:\Windows\System\QiSXVlG.exe
  C:\Windows\System\QiSXVlG.exe
  2⤵
  PID:11900
- C:\Windows\System\CwKdgeS.exe
  C:\Windows\System\CwKdgeS.exe
  2⤵
  PID:11980
- C:\Windows\System\ImoyoPH.exe
  C:\Windows\System\ImoyoPH.exe
  2⤵
  PID:12004
- C:\Windows\System\cBNHyWy.exe
  C:\Windows\System\cBNHyWy.exe
  2⤵
  PID:12072
- C:\Windows\System\YRYqwvt.exe
  C:\Windows\System\YRYqwvt.exe
  2⤵
  PID:12132
- C:\Windows\System\ENGBixr.exe
  C:\Windows\System\ENGBixr.exe
  2⤵
  PID:848
- C:\Windows\System\MUlGNeg.exe
  C:\Windows\System\MUlGNeg.exe
  2⤵
  PID:12196
- C:\Windows\System\EYGtMfi.exe
  C:\Windows\System\EYGtMfi.exe
  2⤵
  PID:12220
- C:\Windows\System\uJjPfZb.exe
  C:\Windows\System\uJjPfZb.exe
  2⤵
  PID:11328
- C:\Windows\System\JvLwozS.exe
  C:\Windows\System\JvLwozS.exe
  2⤵
  PID:11492
- C:\Windows\System\acyNpOT.exe
  C:\Windows\System\acyNpOT.exe
  2⤵
  PID:11760
- C:\Windows\System\znRRgvv.exe
  C:\Windows\System\znRRgvv.exe
  2⤵
  PID:11884
- C:\Windows\System\jKgOYVx.exe
  C:\Windows\System\jKgOYVx.exe
  2⤵
  PID:12176
- C:\Windows\System\wWyXHoF.exe
  C:\Windows\System\wWyXHoF.exe
  2⤵
  PID:12216
- C:\Windows\System\BtwCKyP.exe
  C:\Windows\System\BtwCKyP.exe
  2⤵
  PID:11300
- C:\Windows\System\WNttTze.exe
  C:\Windows\System\WNttTze.exe
  2⤵
  PID:11924
- C:\Windows\System\KSGhUmn.exe
  C:\Windows\System\KSGhUmn.exe
  2⤵
  PID:12112
- C:\Windows\System\xrhghhk.exe
  C:\Windows\System\xrhghhk.exe
  2⤵
  PID:4052
- C:\Windows\System\VAtpPdu.exe
  C:\Windows\System\VAtpPdu.exe
  2⤵
  PID:4772
- C:\Windows\System\kpzZdQd.exe
  C:\Windows\System\kpzZdQd.exe
  2⤵
  PID:12292
- C:\Windows\System\OntEEdj.exe
  C:\Windows\System\OntEEdj.exe
  2⤵
  PID:12316
- C:\Windows\System\izLcFWj.exe
  C:\Windows\System\izLcFWj.exe
  2⤵
  PID:12344
- C:\Windows\System\aHPUKkv.exe
  C:\Windows\System\aHPUKkv.exe
  2⤵
  PID:12364
- C:\Windows\System\BIKNevz.exe
  C:\Windows\System\BIKNevz.exe
  2⤵
  PID:12396
- C:\Windows\System\BQFsKJH.exe
  C:\Windows\System\BQFsKJH.exe
  2⤵
  PID:12416
- C:\Windows\System\cgHhgPe.exe
  C:\Windows\System\cgHhgPe.exe
  2⤵
  PID:12440
- C:\Windows\System\JyizoAd.exe
  C:\Windows\System\JyizoAd.exe
  2⤵
  PID:12476
- C:\Windows\System\bWDNEEh.exe
  C:\Windows\System\bWDNEEh.exe
  2⤵
  PID:12504
- C:\Windows\System\GMAHeeu.exe
  C:\Windows\System\GMAHeeu.exe
  2⤵
  PID:12524
- C:\Windows\System\nIZsnLl.exe
  C:\Windows\System\nIZsnLl.exe
  2⤵
  PID:12548
- C:\Windows\System\VBOSpdt.exe
  C:\Windows\System\VBOSpdt.exe
  2⤵
  PID:12596
- C:\Windows\System\syQRlwY.exe
  C:\Windows\System\syQRlwY.exe
  2⤵
  PID:12616
- C:\Windows\System\AcrZUbY.exe
  C:\Windows\System\AcrZUbY.exe
  2⤵
  PID:12640
- C:\Windows\System\gFsnOrK.exe
  C:\Windows\System\gFsnOrK.exe
  2⤵
  PID:12672
- C:\Windows\System\xYCWiSQ.exe
  C:\Windows\System\xYCWiSQ.exe
  2⤵
  PID:12708
- C:\Windows\System\rIHgOdL.exe
  C:\Windows\System\rIHgOdL.exe
  2⤵
  PID:12740
- C:\Windows\System\iwGgriB.exe
  C:\Windows\System\iwGgriB.exe
  2⤵
  PID:12772
- C:\Windows\System\JZYMquq.exe
  C:\Windows\System\JZYMquq.exe
  2⤵
  PID:12792
- C:\Windows\System\EthtcKY.exe
  C:\Windows\System\EthtcKY.exe
  2⤵
  PID:12824
- C:\Windows\System\NiMXtrv.exe
  C:\Windows\System\NiMXtrv.exe
  2⤵
  PID:12860
- C:\Windows\System\qhqAOMl.exe
  C:\Windows\System\qhqAOMl.exe
  2⤵
  PID:12888
- C:\Windows\System\rhsQUYV.exe
  C:\Windows\System\rhsQUYV.exe
  2⤵
  PID:12916
- C:\Windows\System\lrAixId.exe
  C:\Windows\System\lrAixId.exe
  2⤵
  PID:12944
- C:\Windows\System\gkynozF.exe
  C:\Windows\System\gkynozF.exe
  2⤵
  PID:12972
- C:\Windows\System\BDPxHvX.exe
  C:\Windows\System\BDPxHvX.exe
  2⤵
  PID:12992
- C:\Windows\System\fQnuiCT.exe
  C:\Windows\System\fQnuiCT.exe
  2⤵
  PID:13016
- C:\Windows\System\PRkpwBG.exe
  C:\Windows\System\PRkpwBG.exe
  2⤵
  PID:13036
- C:\Windows\System\yeouWOh.exe
  C:\Windows\System\yeouWOh.exe
  2⤵
  PID:13060
- C:\Windows\System\CMCaTzR.exe
  C:\Windows\System\CMCaTzR.exe
  2⤵
  PID:13108
- C:\Windows\System\ppBNQlz.exe
  C:\Windows\System\ppBNQlz.exe
  2⤵
  PID:13128
- C:\Windows\System\QmprizH.exe
  C:\Windows\System\QmprizH.exe
  2⤵
  PID:13148
- C:\Windows\System\ZRfqruN.exe
  C:\Windows\System\ZRfqruN.exe
  2⤵
  PID:13172
- C:\Windows\System\ipamQaf.exe
  C:\Windows\System\ipamQaf.exe
  2⤵
  PID:13188
- C:\Windows\System\HzCFsjQ.exe
  C:\Windows\System\HzCFsjQ.exe
  2⤵
  PID:13208
- C:\Windows\System\iKncZVQ.exe
  C:\Windows\System\iKncZVQ.exe
  2⤵
  PID:13236
- C:\Windows\System\aqhvBUm.exe
  C:\Windows\System\aqhvBUm.exe
  2⤵
  PID:13264
- C:\Windows\System\BcXiiGy.exe
  C:\Windows\System\BcXiiGy.exe
  2⤵
  PID:13280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0eekytxr.qpq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CFfvFWH.exe

Filesize
2.2MB

MD5
88f418d654119bfde66f4a02b1954d10

SHA1
e4893615f9f0139f3b704fc7b661990fba0d0f1f

SHA256
e9a3846b0baf15579918fdb98ececa0e098d69bb84c37da79ea8519e601715fe

SHA512
9a3d7bed63210d0ed24ad424f17f2f3be8ebede09248b307cbd28964cf343ab5339ce6ea703b4bb253786cb9e6fc1ed9503bcf5aa9a25ccc323fa8c2b728c43c

Download Submit
C:\Windows\System\CrhznSE.exe

Filesize
2.2MB

MD5
aeb30eb9ceac8e2fca186c2851ada063

SHA1
2274c54004528e476b5f9451f4cc6e062df00b12

SHA256
f5f8397f9ca2b40b516e0ef76b58e32fa56ba8e32132191a80b4b9599c294966

SHA512
fe41041a5b334079d876e25637c4d50fdd6ad813e5a676a6398772090a32f6ddb2690e0aae39caa2329f5d841d7caeef5513188916ab0b96f8f8bccb5b2aac1a

Download Submit
C:\Windows\System\DwDoPTW.exe

Filesize
2.2MB

MD5
8acfe61425c5d1d732a0b5632fa50ae0

SHA1
cc7c7bcd8c30b6c2ea958904fca7a43b30d74c12

SHA256
7c7b00cda2134371692496facb3b5e8a6b0be5981598d1c6d34cf89543b9ee1d

SHA512
b2969e3bda235501b8c391b0f4ec8d937672033939e7aaba155591866e8d42c9ac257a921f8aa03828b66276634fd84c4fa2b74e1997c3d299e31a96c0b9cf23

Download Submit
C:\Windows\System\EfJlTan.exe

Filesize
2.2MB

MD5
802a7a170fe585a6e4f9b7958b6d9af3

SHA1
4d70263c08765744a764569a0459f90f76480ea5

SHA256
193281f8b2ee9d95a00f7c60ca9fd23400e630160dac317097acc912531c44c1

SHA512
805382815b029150970f5e309069a9a87bfe2f8d20c8c24184a506ca69af81c33fdc5d3ddd03459ccd43b6dc1608773275e72b92b132d069d62c1f1c5ef5ad6c

Download Submit
C:\Windows\System\FQmcoIH.exe

Filesize
2.2MB

MD5
0ef9b84293e07405c3cbaa755e196c47

SHA1
256bfa333db771bb88e52e324d6ce3a7da4d52c1

SHA256
32e8bfcd2f176b3c5c6271020fa01e5efbf84aaeb0b96a163cee58dd2aa745f9

SHA512
76f1ef3bf72644fac5ab1235dc2bbf95086401c8d809d42dc3a26db16030a738fd0028c511a425de55a6112a469ff05003f3ba3a8f6bca71094aa7b47fb45569

Download Submit
C:\Windows\System\GKbKyBC.exe

Filesize
2.2MB

MD5
6915ab3c9f1f6e70a2fbfb715e5c3671

SHA1
aae81fff9aa468aa99990cf6d2d35d64eb09d1ed

SHA256
6a151b91e6339652d24ba7f5b46cf2566c014032666d0e077d82d5c5559c99e0

SHA512
70a2c2804d51c8dcc09c8d2d903777c0bf4f9727caaad0f03028eb0f8ecb9bda8abcdcefe5136513fafc2ce2a477fdd84a308c4b6715b18cab144d757111bcec

Download Submit
C:\Windows\System\IHKvXco.exe

Filesize
2.2MB

MD5
fd2584eddaeb39af9fe854cdc82003df

SHA1
edff4bcd72e1558c4c7f11cce5b6c46e83057d3a

SHA256
477f36cc0fa31670be6f0bcea5504218d1620fa44681e469f76c0e2354fd48b0

SHA512
e48735a6f0001d2a9351453d1aa2048db832d181b80f792016ba46636d5b13b74bf1ea972fe473f3696139379f0a0f5e2d2fcbe07effc469c1af567c1964a3ad

Download Submit
C:\Windows\System\JZlKFPK.exe

Filesize
2.2MB

MD5
38da8b8ccd6db4585b22385bcec86f64

SHA1
ba06e8a369fae94dbdc75423c0a012c59c44d52a

SHA256
fc489071077c1c0defeec3a9e7a8135b3fa812faeab623cd49e4c689b57b6f6e

SHA512
4701c62182d805473f838ec10486d68cb37fe338697cda69c0f37dd1816827ecee0b9891f90b43de39bfd8584002df11dcdf9973928e7a9cd6e3e4e77a6bdbc2

Download Submit
C:\Windows\System\LnBMNuZ.exe

Filesize
2.2MB

MD5
7c12bfdcbd92a1a1a19833280e1e62c0

SHA1
5d96e36a9148eebed6261316c32614eb2d263ecf

SHA256
ca06f3fa4659a3c7d572f53ba47402434ff0bd2f36bdaabfca356ba1358351d5

SHA512
cf46b2766a2293f8e9edff428022dc80fdb4df77ea07962959dfa5b19edee4911f9b7ef6a44cb31ed2d0512a02bc927c52ec27d6d5503f0a88b0238d2a6b8e66

Download Submit
C:\Windows\System\MQCKDkD.exe

Filesize
2.2MB

MD5
387282728e0d823a78e2f018dba5cc4f

SHA1
5243c9cc291f16003e66c1843afb7edc2550eae8

SHA256
1deb419bdf37a9242785d2491e848a0ccc3ddc99ad5156e2770f6e60dfdf2811

SHA512
226cb771f5d5386035aa9d154fc2abd2493559e5f19f3498b37cc3bc93814c94f9775f2e8406a172da9d50bac753e945e6d3c804a68088a907365a71a0d51e42

Download Submit
C:\Windows\System\MWjPopS.exe

Filesize
2.2MB

MD5
7bd85df4af0de536ea4f4d1f0e646628

SHA1
039b96b9c8066e6f1df549b8bf7a27318610bf64

SHA256
a7d80bfd9d09deb7dbe79373fa39f6e23245d6eb433813536ec3d46543b1caad

SHA512
e9b6da7be6f94852b5926a469698d29b01f81cfa739ac6d685f8f423433158b4ba7e0f4ac21b27118c6d27c0d70aba7633f2b4be5b1cacd97c03ca745a75281d

Download Submit
C:\Windows\System\MpBvWBV.exe

Filesize
2.2MB

MD5
cb2c70d50709d6cfbdc0f6eb1847f44b

SHA1
82af7eab9292a5160d2f0f43ae60b8f3ca216eb6

SHA256
93f07a0d829836200825a0ffee49a0057953a56ee41a7e7755986ed9576c8c03

SHA512
f8ccc0f0e85d924becba67e861305ac63f87001fbf82e973141d33a00e60efd526ea0759e1e12a404afbf9542e77962115ceb19da8f4f6987ebba35cce0330b3

Download Submit
C:\Windows\System\NREsPQe.exe

Filesize
2.2MB

MD5
63f6e1824bc04d55fd5e1d4dc3beff23

SHA1
807f8ae43c9eafd54048df9dc925b046eb7bd0d9

SHA256
6bb447314dd818a0c61abd1f23c526207ee6701133862c1b6c7a97e4bcd6cd2d

SHA512
a063e60bfdfa80ef9bd12f08f74590a5a793ff9d7a453b165b22ad9e808aa511fa3692eeb566344fe9aa36003417ab96b94ee9f4b1c33be338476c2874ec7840

Download Submit
C:\Windows\System\QaMeKTb.exe

Filesize
2.2MB

MD5
6bbc3eeee9bbcbeda2e06dfc5a82f952

SHA1
de10c2465c9c1c8e14fe2f7aab707f80c2d9dfd4

SHA256
a7b3dc76f0c468c81b5d0f22f4b86885d9c1323907cefc557085edc679b50f0c

SHA512
47c63252b49598b731aa200dbb83452c86cde41d8415f4f76ec2b0ac4eaca2071a4bea4c9ae5289b31667fd2a49d3ee1503f3809f0b7ece9478b4561b68fd62e

Download Submit
C:\Windows\System\SnvhbUr.exe

Filesize
2.2MB

MD5
8b91e13b644f70162a6f91786f260bfc

SHA1
6da7351876d450da42c846d7f8d6a81adf2adfa7

SHA256
63742be20706dfbbe7d8effede541ce4e455197e4f64265a9be71e59b3c265b8

SHA512
c4a202f28a7bd4706525bbbf4b758ecb3d7ef6f32b8f10d8e49b0af4f069d50769d905476d2a6496e1566e5433d6518072e5765008dd2ec3b8c66538fe3978de

Download Submit
C:\Windows\System\UxJeMXb.exe

Filesize
2.2MB

MD5
1ea9eaf5d9bf85db511b848c5a4dd350

SHA1
96005d77a65cda5136632d1f931099b3f3303e14

SHA256
4871247ea7464f80067468a50a2c3ed634f4a06425d0b707cb5caedf29c3a2d7

SHA512
c98c24acec84e2d597c91427f098a251e0f5b63e121f3038fc7671a4f1eab13dccf318da042705e4c2d91d66c5e226d68e7de8c80720b08805653bfce77dc081

Download Submit
C:\Windows\System\VszCKmm.exe

Filesize
2.2MB

MD5
e9cac0d02c5f4a72efbe73d987606519

SHA1
1a1cc97e926e129deb62507c4b224c0274921dcc

SHA256
b253962ada0e43569b995cd62cceb49de3a2cfb0e8798e92a7c4dc196268e8d3

SHA512
8ed18c229b4c87020caf22928e45b29a2115368baf2af010c849a35f2b12099ed0a54e37d63e4cdb205b65c25af4b0f89c0e2f327eebd135cd8c823e13a25844

Download Submit
C:\Windows\System\ZHVtfLX.exe

Filesize
2.2MB

MD5
eb7e3c69cfd632858c00b9de34e3af8f

SHA1
77034ee0149e66d9bb9759b957ceef7bab0acf3c

SHA256
759330b01cb556df2a86e04d2e001e3323250af94336070fd962324bacb1ba05

SHA512
20fc0528af1dc5881c62af99625207afb5d68ed7fbdc15f768b0c6b4062b9b743e9107770c7ef7bc96e6246e535df44bd3399095ffe7aea259d222459fc3d41c

Download Submit
C:\Windows\System\ZscVYll.exe

Filesize
2.2MB

MD5
264791d2132bddd5dbf2ad7dbe3594ab

SHA1
547c9f6536cfedc99ec3ad6f669a10636277f046

SHA256
25625a1c23fad7f6dba5b54b8f6f44cb75a9b4206add7231caf2a5d9fe9c5523

SHA512
a672a4a6edc6f51fe664959ecd655b6c9594722c06f84f619b3133e460ec2e54f3b1e8715d00d770f40327b2407a56568dffc5ef64fe97f6ece85c02c99fc0b6

Download Submit
C:\Windows\System\Zwsvgey.exe

Filesize
8B

MD5
ce98e4fb0d1b3e55b413072afff0d9b0

SHA1
ea92124ca4b7f582ca9bded1d03be27e59b4ea59

SHA256
ff9bed5abd6e63c0617526102c0f954cef8653d22647e6d0cc15dd6455af1a78

SHA512
b03d5e8e2563e87b69e649ee452bd2c1714db6cee8c57a2d9c80350a9bfea4a14df4deeed12085a7535561f33b8025c13820b94443ecdbd732b098776b2234a9

Download Submit
C:\Windows\System\anbMaha.exe

Filesize
2.2MB

MD5
297900175d4f6c92f2f198356ba93390

SHA1
d9011266137e26a4432bd81e4aa91c9a3fa6354b

SHA256
b8a7630c8aad8d865b06639ceefc09e7154117deff5ed9c3135c8bd8ed940ae3

SHA512
e1c5afad1842cf23e13a83c160ae64075f7f54c00594cba032f9910c7dd6f0a6f2d2204b5b24bb2d10dc63da7852482be453646b1e58cf12b34ce43b31bb9b03

Download Submit
C:\Windows\System\czMIdjQ.exe

Filesize
2.2MB

MD5
548e90df383588e28d3e4b3b9ccb6d6e

SHA1
10011c516494f7d28b693cd7808ca52fe272573b

SHA256
8a5fd9353a0f8e808ac4fb6b93532907ae7af4822f8c5864ecc0a76eee09d24b

SHA512
548a4f6b527a6a2c7e56255bddb96ed3fb2632548bed999f93419ddf5a9df01f1ccecafda6cc4a5e64ce8800d9c6aa0af2794e0c08756df6b05672cf5add3a30

Download Submit
C:\Windows\System\ddNnooA.exe

Filesize
2.2MB

MD5
ac4daae914bb40b9548630d7ae2437e4

SHA1
8a685bfad6b7445e70cf6620d0c148cbde655d64

SHA256
b2217d57096332380df65adaf06c007759e940a14a5f5f018ea4adec07705964

SHA512
20b5deea17fbb1e1d146ba7e4f188b2a3c3150b5e2dcb5d070f07446bbcf152b5b6f764f2a0cce0b2f1c1bcb59821977aacddd513476f46e10243b8169744214

Download Submit
C:\Windows\System\fbxtQYH.exe

Filesize
2.2MB

MD5
ac17a756d396ab8c471128e810ec5978

SHA1
9200c92387bd72fc456bb58db9bb71485fb1779e

SHA256
b8a3bf73d3d388300448853eb7cf55a0541bff6a5160f11ec234085db178b6fd

SHA512
29b7ea0b169db028e58d6adba4a313b5bfc2e49931cf3c0ddc19c596b52c91a84695caa386b0bbb3db1c0304a193f601a205c2688ccbde5b27a292d33e49eda9

Download Submit
C:\Windows\System\fitrxaX.exe

Filesize
2.2MB

MD5
40821d903e954f6e12650232cce2c167

SHA1
8a56e18d33b720e8c1f8bf851aba61a8b38b1158

SHA256
72f3e2f5a0a396118b7262cd6bac277e9ebbe3b78dfd2e5cade033afb1fa4d38

SHA512
9c283419888bab7f1ce0c7a5971db88c843b20c5819e3868a1e5e887eb7bfbfbfe2e7c5ec608fec7915b17243c2ac97615405d006f4fab19673e0b742e29b095

Download Submit
C:\Windows\System\gaGilid.exe

Filesize
2.2MB

MD5
c41d5248fc95755063cad5d0d3a709e5

SHA1
de555806c9e1e5306020f59618cb4ef1a5116e40

SHA256
a1acc21a68bf0b78211f28a7a8ff02b4352c9e9e92a6e76adfd84e167c5dac07

SHA512
d358e93970f587605444aea26e3c0f614d8541fc3ff0a365c949835d238824e42ece2bc1274ef60c0ede633292cb1e51a9b04f6f47ec0523b19dd341a28ee573

Download Submit
C:\Windows\System\jYGzhlU.exe

Filesize
2.2MB

MD5
f888455cc5a3bfdac3f0602ca5d0f53c

SHA1
cf09453de5f9b1620a0a4c449bf262603c0dd5e3

SHA256
6594732be49e813695e7e5693d8ba7b460ae9d8c61eca11eca24bfdbaac183e8

SHA512
601a45cc6610a1223c99ca7a8de278a7c3414f59c746a80d2a9fd62a0f352954bf2df20876a615c1a35ccdfe7a06fcf447b8c481f76b80360e87e38cff839dbe

Download Submit
C:\Windows\System\qOirkhd.exe

Filesize
2.2MB

MD5
07ae7fe92636a06ffd40f18803fe1254

SHA1
dd5d2a32ba0b57ef06c67d62c1174508e9b983c3

SHA256
1589a124406f735915b60291c8a99b65b951d41138a4f3802ea2aa04fad77ea3

SHA512
ba1cb2439ac71805f42e8abfd680abdd1de01db7b2ba414898e5e819e8de538bdc1365a286714fac7fffe6fd3bfee4943fb154a4aba2261c723741283e4a9109

Download Submit
C:\Windows\System\qfSgsuk.exe

Filesize
2.2MB

MD5
6aa0b43cc92860a0560dd0befab38493

SHA1
feaa4aadde5640c538fc68f4c355efab31a59164

SHA256
8c9d4becc22da920fcb44f8a2b8451627d0b98d3387d85939c84ba8151496924

SHA512
d94917644813eacb3305d67442839cb3716cbf9827d2596af9d46ae3fd9ae92651d82564e8c2f06788e2388837ad4ef47fb361c522b520ba18b8c46f7273f63d

Download Submit
C:\Windows\System\rlQyCek.exe

Filesize
2.2MB

MD5
ca7443df009cef40196028ed7c9dde86

SHA1
0231014f8d72e3b0530244887e72799136482255

SHA256
71d09a7526c3af802a37f613e849431ef1b92ed7ef3628b89078c66ae2e967c6

SHA512
14a430dbf0cdc3ad25de80de6fc243299021144b3709dcefb1edd38e083386deaef1e180f41b540fecb3110ee3970885529db9c4d7339cb99a666916593d95c5

Download Submit
C:\Windows\System\shBiNJp.exe

Filesize
2.2MB

MD5
7b1568183e4068a3f2785f48beaac5bc

SHA1
e9b8150c7603e22c22132ae22d872dbc654198c5

SHA256
3da42b847d72ebed43b75e206c3069379a73959b3d770b4b85de78b2ee256676

SHA512
ab3918afcd816bbb6f82e1f21b592256e6a16e1f01f0d3d881826de8bfbf8e5c8dee07819d637cd8de20e8ef1d011e197e0b88748ec23ca62e165647916281d0

Download Submit
C:\Windows\System\soSpEqZ.exe

Filesize
2.2MB

MD5
44d20cc85c50c95be64a0672dae002ea

SHA1
52e7b29677367516a58932f0a9bbc62ac06d94e1

SHA256
066a572fbe4c88a8f16cf1245b807f5af692a09bc61f31a79c55d6e9d4aae17c

SHA512
8ff4a4d5572c2f4010c84465959dff671755aba85b35671cbd25673dee11ff22f2a622671c7ea0fa9da1d269e3fca38e05e52725f721368b07a7a356320eae84

Download Submit
C:\Windows\System\tGWtOHC.exe

Filesize
2.2MB

MD5
ce2ebfc19f79d2193b267bd366a1aced

SHA1
4b6c586ba02f079041c8001aa7d83ec7116b0fbf

SHA256
8937134484f915065e562fb86373b1f9ee6b689e75148754f6fef814ed082940

SHA512
ce4dfb5c5c3e5f69bf2343b27f769c5471357ee0e39cb596ec639f03999367ab16538fb2b60bd99f517b29154d5c7f9f36e55d2113353761bac01866d80218ae

Download Submit
C:\Windows\System\tsTcfQJ.exe

Filesize
2.2MB

MD5
64e6f88a9976fc976d62f4834a04c2e0

SHA1
e2fcfbd535f58a1170560a1a712e4c6ac6b6cdba

SHA256
9e19fbf11bb78b33652d5048a3e510bf0342300d7a356da256162b45cfa880e5

SHA512
75376b7fb7c8ffc279ee41c5a1b33b007a4d68ead1e9400b82d0ee7bddd79af0f762bde73b710a835785592a0165bf3dee45239bd15f7755dc08087d775e486c

Download Submit
memory/452-2096-0x00007FF7E3240000-0x00007FF7E3632000-memory.dmp

Filesize
3.9MB

Download
memory/452-187-0x00007FF7E3240000-0x00007FF7E3632000-memory.dmp

Filesize
3.9MB

Download
memory/460-2070-0x00007FF737330000-0x00007FF737722000-memory.dmp

Filesize
3.9MB

Download
memory/460-122-0x00007FF737330000-0x00007FF737722000-memory.dmp

Filesize
3.9MB

Download
memory/524-109-0x00007FF79BAE0000-0x00007FF79BED2000-memory.dmp

Filesize
3.9MB

Download
memory/524-2058-0x00007FF79BAE0000-0x00007FF79BED2000-memory.dmp

Filesize
3.9MB

Download
memory/1036-2066-0x00007FF644C30000-0x00007FF645022000-memory.dmp

Filesize
3.9MB

Download
memory/1036-114-0x00007FF644C30000-0x00007FF645022000-memory.dmp

Filesize
3.9MB

Download
memory/1232-97-0x00007FF6802D0000-0x00007FF6806C2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-2072-0x00007FF6802D0000-0x00007FF6806C2000-memory.dmp

Filesize
3.9MB

Download
memory/1388-157-0x00007FF73BD70000-0x00007FF73C162000-memory.dmp

Filesize
3.9MB

Download
memory/1388-2084-0x00007FF73BD70000-0x00007FF73C162000-memory.dmp

Filesize
3.9MB

Download
memory/1488-2062-0x00007FF68F4C0000-0x00007FF68F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-89-0x00007FF68F4C0000-0x00007FF68F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-2077-0x00007FF61A890000-0x00007FF61AC82000-memory.dmp

Filesize
3.9MB

Download
memory/1804-128-0x00007FF61A890000-0x00007FF61AC82000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2078-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-101-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2017-0x00007FF7C26F0000-0x00007FF7C2AE2000-memory.dmp

Filesize
3.9MB

Download
memory/1920-2068-0x00007FF683E50000-0x00007FF684242000-memory.dmp

Filesize
3.9MB

Download
memory/1920-118-0x00007FF683E50000-0x00007FF684242000-memory.dmp

Filesize
3.9MB

Download
memory/1984-1561-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Filesize
10.8MB

Download
memory/1984-5-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

Filesize
8KB

Download
memory/1984-46-0x000002250A460000-0x000002250A482000-memory.dmp

Filesize
136KB

Download
memory/1984-25-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Filesize
10.8MB

Download
memory/1984-52-0x00007FFB82730000-0x00007FFB831F1000-memory.dmp

Filesize
10.8MB

Download
memory/2308-93-0x00007FF725F60000-0x00007FF726352000-memory.dmp

Filesize
3.9MB

Download
memory/2308-2064-0x00007FF725F60000-0x00007FF726352000-memory.dmp

Filesize
3.9MB

Download
memory/2716-86-0x00007FF7CC9F0000-0x00007FF7CCDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-2056-0x00007FF7CC9F0000-0x00007FF7CCDE2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-2094-0x00007FF6AE350000-0x00007FF6AE742000-memory.dmp

Filesize
3.9MB

Download
memory/3076-176-0x00007FF6AE350000-0x00007FF6AE742000-memory.dmp

Filesize
3.9MB

Download
memory/3572-2074-0x00007FF6B7830000-0x00007FF6B7C22000-memory.dmp

Filesize
3.9MB

Download
memory/3572-104-0x00007FF6B7830000-0x00007FF6B7C22000-memory.dmp

Filesize
3.9MB

Download
memory/3820-59-0x00007FF6570E0000-0x00007FF6574D2000-memory.dmp

Filesize
3.9MB

Download
memory/3820-2052-0x00007FF6570E0000-0x00007FF6574D2000-memory.dmp

Filesize
3.9MB

Download
memory/3848-0-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3848-1-0x000001E1845E0000-0x000001E1845F0000-memory.dmp

Filesize
64KB

Download
memory/3848-1986-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4308-158-0x00007FF6C58F0000-0x00007FF6C5CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4308-2086-0x00007FF6C58F0000-0x00007FF6C5CE2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-2033-0x00007FF6B67F0000-0x00007FF6B6BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-108-0x00007FF6B67F0000-0x00007FF6B6BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4496-2060-0x00007FF6E2430000-0x00007FF6E2822000-memory.dmp

Filesize
3.9MB

Download
memory/4496-92-0x00007FF6E2430000-0x00007FF6E2822000-memory.dmp

Filesize
3.9MB

Download
memory/4516-145-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2088-0x00007FF75A0C0000-0x00007FF75A4B2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-2082-0x00007FF60DF30000-0x00007FF60E322000-memory.dmp

Filesize
3.9MB

Download
memory/4536-151-0x00007FF60DF30000-0x00007FF60E322000-memory.dmp

Filesize
3.9MB

Download
memory/4724-2080-0x00007FF6E3620000-0x00007FF6E3A12000-memory.dmp

Filesize
3.9MB

Download
memory/4724-134-0x00007FF6E3620000-0x00007FF6E3A12000-memory.dmp

Filesize
3.9MB

Download
memory/5000-170-0x00007FF6C1EE0000-0x00007FF6C22D2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-2092-0x00007FF6C1EE0000-0x00007FF6C22D2000-memory.dmp

Filesize
3.9MB

Download
memory/5004-64-0x00007FF6CCD40000-0x00007FF6CD132000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2054-0x00007FF6CCD40000-0x00007FF6CD132000-memory.dmp

Filesize
3.9MB

Download
memory/5044-2090-0x00007FF616B70000-0x00007FF616F62000-memory.dmp

Filesize
3.9MB

Download
memory/5044-164-0x00007FF616B70000-0x00007FF616F62000-memory.dmp

Filesize
3.9MB

Download