xmrig | 673ec9bac4756aa6e27456e504ddc9e76bc17cfa1375a0087c3df007c14452e0

Analysis

max time kernel
129s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
Size

1.7MB
MD5

0b8f75c1fb317f8388256a2235fdf690
SHA1

acb31a1d5dde5f66f6c1bbefa838cad4a9941191
SHA256

673ec9bac4756aa6e27456e504ddc9e76bc17cfa1375a0087c3df007c14452e0
SHA512

dfc6ab2793b1642173da959964bfd42d58bf19dd808985dd908b78b0816feaf21836e0a8af319940c66e813311714922b085186b5159ad7a78ee9d2850cf95bd
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoCSxnhvuqAP9dbWmbOt0BXdnyr+Dh:Lz071uv4BPMkHC0I6GCInhG1dtdF2+Dh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/2240-85-0x00007FF693FE0000-0x00007FF6943D2000-memory.dmp	xmrig
behavioral2/memory/4448-91-0x00007FF7A3F80000-0x00007FF7A4372000-memory.dmp	xmrig
behavioral2/memory/2332-100-0x00007FF7BA3D0000-0x00007FF7BA7C2000-memory.dmp	xmrig
behavioral2/memory/2992-108-0x00007FF6CD9E0000-0x00007FF6CDDD2000-memory.dmp	xmrig
behavioral2/memory/3264-121-0x00007FF698330000-0x00007FF698722000-memory.dmp	xmrig
behavioral2/memory/1972-117-0x00007FF67F570000-0x00007FF67F962000-memory.dmp	xmrig
behavioral2/memory/220-112-0x00007FF76C7E0000-0x00007FF76CBD2000-memory.dmp	xmrig
behavioral2/memory/2168-109-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp	xmrig
behavioral2/memory/1636-104-0x00007FF70DB80000-0x00007FF70DF72000-memory.dmp	xmrig
behavioral2/memory/3084-96-0x00007FF62B7F0000-0x00007FF62BBE2000-memory.dmp	xmrig
behavioral2/memory/2208-95-0x00007FF680A20000-0x00007FF680E12000-memory.dmp	xmrig
behavioral2/memory/4280-81-0x00007FF736550000-0x00007FF736942000-memory.dmp	xmrig
behavioral2/memory/4092-67-0x00007FF62A280000-0x00007FF62A672000-memory.dmp	xmrig
behavioral2/memory/2020-52-0x00007FF6A63A0000-0x00007FF6A6792000-memory.dmp	xmrig
behavioral2/memory/4200-1174-0x00007FF60A4D0000-0x00007FF60A8C2000-memory.dmp	xmrig
behavioral2/memory/2924-1179-0x00007FF684780000-0x00007FF684B72000-memory.dmp	xmrig
behavioral2/memory/112-1180-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp	xmrig
behavioral2/memory/4568-1802-0x00007FF694C30000-0x00007FF695022000-memory.dmp	xmrig
behavioral2/memory/2168-2452-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp	xmrig
behavioral2/memory/952-2516-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp	xmrig
behavioral2/memory/3672-2533-0x00007FF6A30B0000-0x00007FF6A34A2000-memory.dmp	xmrig
behavioral2/memory/3240-2549-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp	xmrig
behavioral2/memory/4652-2550-0x00007FF65A7C0000-0x00007FF65ABB2000-memory.dmp	xmrig
behavioral2/memory/1936-2551-0x00007FF60DC50000-0x00007FF60E042000-memory.dmp	xmrig
behavioral2/memory/4996-2563-0x00007FF707DB0000-0x00007FF7081A2000-memory.dmp	xmrig
behavioral2/memory/2924-2568-0x00007FF684780000-0x00007FF684B72000-memory.dmp	xmrig
behavioral2/memory/816-2585-0x00007FF619AB0000-0x00007FF619EA2000-memory.dmp	xmrig
behavioral2/memory/4092-2592-0x00007FF62A280000-0x00007FF62A672000-memory.dmp	xmrig
behavioral2/memory/4568-2590-0x00007FF694C30000-0x00007FF695022000-memory.dmp	xmrig
behavioral2/memory/3084-2594-0x00007FF62B7F0000-0x00007FF62BBE2000-memory.dmp	xmrig
behavioral2/memory/112-2588-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp	xmrig
behavioral2/memory/2020-2599-0x00007FF6A63A0000-0x00007FF6A6792000-memory.dmp	xmrig
behavioral2/memory/4280-2597-0x00007FF736550000-0x00007FF736942000-memory.dmp	xmrig
behavioral2/memory/2240-2600-0x00007FF693FE0000-0x00007FF6943D2000-memory.dmp	xmrig
behavioral2/memory/4448-2604-0x00007FF7A3F80000-0x00007FF7A4372000-memory.dmp	xmrig
behavioral2/memory/2332-2603-0x00007FF7BA3D0000-0x00007FF7BA7C2000-memory.dmp	xmrig
behavioral2/memory/1636-2606-0x00007FF70DB80000-0x00007FF70DF72000-memory.dmp	xmrig
behavioral2/memory/2208-2608-0x00007FF680A20000-0x00007FF680E12000-memory.dmp	xmrig
behavioral2/memory/2992-2610-0x00007FF6CD9E0000-0x00007FF6CDDD2000-memory.dmp	xmrig
behavioral2/memory/220-2612-0x00007FF76C7E0000-0x00007FF76CBD2000-memory.dmp	xmrig
behavioral2/memory/1972-2614-0x00007FF67F570000-0x00007FF67F962000-memory.dmp	xmrig
behavioral2/memory/3264-2616-0x00007FF698330000-0x00007FF698722000-memory.dmp	xmrig
behavioral2/memory/952-2619-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp	xmrig
behavioral2/memory/3672-2622-0x00007FF6A30B0000-0x00007FF6A34A2000-memory.dmp	xmrig
behavioral2/memory/3240-2621-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp	xmrig
behavioral2/memory/4652-2624-0x00007FF65A7C0000-0x00007FF65ABB2000-memory.dmp	xmrig
behavioral2/memory/816-2634-0x00007FF619AB0000-0x00007FF619EA2000-memory.dmp	xmrig
behavioral2/memory/1936-2630-0x00007FF60DC50000-0x00007FF60E042000-memory.dmp	xmrig
behavioral2/memory/4996-2627-0x00007FF707DB0000-0x00007FF7081A2000-memory.dmp	xmrig
behavioral2/memory/2168-2822-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	3828	powershell.exe
12	3828	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3828	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2924	bSzhDeG.exe
112	rTdbUmZ.exe
4568	SpioCit.exe
3084	ARkMbop.exe
2020	OZaPPox.exe
4092	nxIrGtl.exe
4280	zFQfmft.exe
2240	UIpOdAY.exe
4448	gldYCbk.exe
2332	SWNurwj.exe
1636	ezLdZBg.exe
2208	HRIUItK.exe
2992	NlRMpmt.exe
2168	LcfhXsL.exe
220	GmEouSU.exe
1972	dQdrAlN.exe
3264	AwlwjkJ.exe
952	dtPZlci.exe
3672	FaQwzTR.exe
3240	lBLuMke.exe
4652	ypVyKCo.exe
1936	uUzxyBV.exe
4996	Ewzcbya.exe
816	DxTzkDi.exe
3868	QrkrtgJ.exe
4712	vkVcLGv.exe
3796	ZQBattv.exe
4184	bvhCmkj.exe
2696	dBoitvT.exe
4752	UDOqQvV.exe
1572	tudECJR.exe
5004	ZhTQGfy.exe
1612	nvdFuPi.exe
2368	PqGqMMe.exe
3476	TFoKTmL.exe
1664	kARKMHY.exe
5016	zvGZoLJ.exe
852	npitscS.exe
4812	csWmjbz.exe
4492	mtOsDFn.exe
4356	BRMOLOS.exe
1444	QgZMzxV.exe
1912	EpxFmVp.exe
2352	pjbPsKZ.exe
2204	NszYuTk.exe
1340	zNKUQOb.exe
1672	TJwrmCm.exe
4824	qNTHHfr.exe
4024	NnvGjlA.exe
4552	KtvUKpp.exe
3568	UDCHaoi.exe
4728	MSmwkvh.exe
3700	nPjSuoT.exe
3764	gwAhFeB.exe
3916	wwIHkXC.exe
428	TGTIgvC.exe
2272	GjglzOi.exe
940	uwLbZFn.exe
3492	puqEgrK.exe
3108	SoBbrzx.exe
2968	qVReLoP.exe
3972	oSkRtqL.exe
3188	DeGWsuJ.exe
1392	kdNPBMM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4200-0-0x00007FF60A4D0000-0x00007FF60A8C2000-memory.dmp	upx
behavioral2/files/0x00070000000233ec-11.dat	upx
behavioral2/files/0x00080000000233e8-8.dat	upx
behavioral2/files/0x0008000000022f51-7.dat	upx
behavioral2/memory/4568-21-0x00007FF694C30000-0x00007FF695022000-memory.dmp	upx
behavioral2/files/0x00070000000233f0-36.dat	upx
behavioral2/files/0x00070000000233ed-34.dat	upx
behavioral2/files/0x00070000000233ee-31.dat	upx
behavioral2/files/0x00070000000233ef-39.dat	upx
behavioral2/files/0x00070000000233f2-48.dat	upx
behavioral2/files/0x00070000000233f3-54.dat	upx
behavioral2/memory/2240-85-0x00007FF693FE0000-0x00007FF6943D2000-memory.dmp	upx
behavioral2/memory/4448-91-0x00007FF7A3F80000-0x00007FF7A4372000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-97.dat	upx
behavioral2/memory/2332-100-0x00007FF7BA3D0000-0x00007FF7BA7C2000-memory.dmp	upx
behavioral2/memory/2992-108-0x00007FF6CD9E0000-0x00007FF6CDDD2000-memory.dmp	upx
behavioral2/files/0x00080000000233f8-122.dat	upx
behavioral2/files/0x00070000000233fc-128.dat	upx
behavioral2/files/0x00070000000233fe-140.dat	upx
behavioral2/files/0x00070000000233ff-146.dat	upx
behavioral2/files/0x0007000000023401-158.dat	upx
behavioral2/files/0x0007000000023403-169.dat	upx
behavioral2/files/0x0007000000023409-199.dat	upx
behavioral2/files/0x0007000000023407-197.dat	upx
behavioral2/files/0x0007000000023408-194.dat	upx
behavioral2/files/0x0007000000023406-192.dat	upx
behavioral2/files/0x0007000000023405-187.dat	upx
behavioral2/files/0x0007000000023404-182.dat	upx
behavioral2/files/0x0007000000023402-172.dat	upx
behavioral2/files/0x0007000000023400-162.dat	upx
behavioral2/memory/816-161-0x00007FF619AB0000-0x00007FF619EA2000-memory.dmp	upx
behavioral2/memory/4996-155-0x00007FF707DB0000-0x00007FF7081A2000-memory.dmp	upx
behavioral2/memory/1936-149-0x00007FF60DC50000-0x00007FF60E042000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-144.dat	upx
behavioral2/memory/4652-143-0x00007FF65A7C0000-0x00007FF65ABB2000-memory.dmp	upx
behavioral2/memory/3240-137-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp	upx
behavioral2/memory/3672-131-0x00007FF6A30B0000-0x00007FF6A34A2000-memory.dmp	upx
behavioral2/files/0x00080000000233e9-126.dat	upx
behavioral2/memory/952-125-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp	upx
behavioral2/memory/3264-121-0x00007FF698330000-0x00007FF698722000-memory.dmp	upx
behavioral2/memory/1972-117-0x00007FF67F570000-0x00007FF67F962000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-113.dat	upx
behavioral2/memory/220-112-0x00007FF76C7E0000-0x00007FF76CBD2000-memory.dmp	upx
behavioral2/files/0x00080000000233f9-110.dat	upx
behavioral2/memory/2168-109-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-105.dat	upx
behavioral2/memory/1636-104-0x00007FF70DB80000-0x00007FF70DF72000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-99.dat	upx
behavioral2/memory/3084-96-0x00007FF62B7F0000-0x00007FF62BBE2000-memory.dmp	upx
behavioral2/memory/2208-95-0x00007FF680A20000-0x00007FF680E12000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-87.dat	upx
behavioral2/memory/4280-81-0x00007FF736550000-0x00007FF736942000-memory.dmp	upx
behavioral2/memory/4092-67-0x00007FF62A280000-0x00007FF62A672000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-66.dat	upx
behavioral2/files/0x00070000000233f1-53.dat	upx
behavioral2/memory/2020-52-0x00007FF6A63A0000-0x00007FF6A6792000-memory.dmp	upx
behavioral2/memory/112-15-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp	upx
behavioral2/memory/2924-12-0x00007FF684780000-0x00007FF684B72000-memory.dmp	upx
behavioral2/memory/4200-1174-0x00007FF60A4D0000-0x00007FF60A8C2000-memory.dmp	upx
behavioral2/memory/2924-1179-0x00007FF684780000-0x00007FF684B72000-memory.dmp	upx
behavioral2/memory/112-1180-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp	upx
behavioral2/memory/4568-1802-0x00007FF694C30000-0x00007FF695022000-memory.dmp	upx
behavioral2/memory/2168-2452-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp	upx
behavioral2/memory/952-2516-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EpxFmVp.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\dbOLaYn.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\clcbnEP.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\fgDkhSH.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\YRYsxAI.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\wGEsjZe.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\alhAlgB.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\svhQKgK.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\xTUaHta.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\sTxftOp.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\DuDYnqC.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\HZpSUyc.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\fpUFthV.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\rsRwOhj.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\kIMeoAs.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\rdbcYor.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\hhQijYs.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\yJLxucc.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\thUQxKc.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\KzhtYMN.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\YZAhmfp.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\DuUEtJf.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\AJEoNmL.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\MzNEJkw.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\iZMPIRv.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\kXxpwlH.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\kUfzRFU.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\CPBIhVr.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\BfZZeVf.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\VJkriwU.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\TmhFtVL.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\TyNDxKB.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\CZvUhAL.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\SoBbrzx.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\cymduFd.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\iWQJIke.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\mJWzvEF.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\LVWsJnQ.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\gHYstHg.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\yiAcPqR.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\rGcYMoA.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\yhlabUU.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\IiuuWaV.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\THJSXnW.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\iEcByEf.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\eYiWVHM.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\WabIzRY.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\OnNPdZN.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\UbIyJPy.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\UsAYDfg.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\DRzMYPX.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\ruOthjj.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\ghATFue.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\IOFHKyC.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\xrQkDgK.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\CiUzUTZ.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\jeFsfYe.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\zJKkIwt.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\IWiQLGB.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\ZLDFFvU.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\bImJNDH.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\fbHoecg.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\fdiScIn.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\dlPOWJZ.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3828	powershell.exe
3828	powershell.exe
3828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeLockMemoryPrivilege	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 3828	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	84
PID 4200 wrote to memory of 3828	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	84
PID 4200 wrote to memory of 2924	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	85
PID 4200 wrote to memory of 2924	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	85
PID 4200 wrote to memory of 112	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	86
PID 4200 wrote to memory of 112	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	86
PID 4200 wrote to memory of 4568	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	87
PID 4200 wrote to memory of 4568	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	87
PID 4200 wrote to memory of 4092	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	88
PID 4200 wrote to memory of 4092	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	88
PID 4200 wrote to memory of 3084	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	89
PID 4200 wrote to memory of 3084	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	89
PID 4200 wrote to memory of 2020	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	90
PID 4200 wrote to memory of 2020	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	90
PID 4200 wrote to memory of 4280	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	91
PID 4200 wrote to memory of 4280	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	91
PID 4200 wrote to memory of 2240	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	92
PID 4200 wrote to memory of 2240	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	92
PID 4200 wrote to memory of 4448	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	93
PID 4200 wrote to memory of 4448	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	93
PID 4200 wrote to memory of 2332	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	94
PID 4200 wrote to memory of 2332	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	94
PID 4200 wrote to memory of 1636	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	95
PID 4200 wrote to memory of 1636	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	95
PID 4200 wrote to memory of 2208	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	96
PID 4200 wrote to memory of 2208	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	96
PID 4200 wrote to memory of 2992	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	97
PID 4200 wrote to memory of 2992	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	97
PID 4200 wrote to memory of 2168	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	98
PID 4200 wrote to memory of 2168	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	98
PID 4200 wrote to memory of 220	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	99
PID 4200 wrote to memory of 220	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	99
PID 4200 wrote to memory of 1972	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	100
PID 4200 wrote to memory of 1972	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	100
PID 4200 wrote to memory of 3264	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	101
PID 4200 wrote to memory of 3264	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	101
PID 4200 wrote to memory of 952	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	102
PID 4200 wrote to memory of 952	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	102
PID 4200 wrote to memory of 3672	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	103
PID 4200 wrote to memory of 3672	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	103
PID 4200 wrote to memory of 3240	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	104
PID 4200 wrote to memory of 3240	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	104
PID 4200 wrote to memory of 4652	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	105
PID 4200 wrote to memory of 4652	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	105
PID 4200 wrote to memory of 1936	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	106
PID 4200 wrote to memory of 1936	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	106
PID 4200 wrote to memory of 4996	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	107
PID 4200 wrote to memory of 4996	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	107
PID 4200 wrote to memory of 816	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	108
PID 4200 wrote to memory of 816	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	108
PID 4200 wrote to memory of 3868	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	109
PID 4200 wrote to memory of 3868	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	109
PID 4200 wrote to memory of 4712	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	110
PID 4200 wrote to memory of 4712	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	110
PID 4200 wrote to memory of 3796	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	111
PID 4200 wrote to memory of 3796	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	111
PID 4200 wrote to memory of 4184	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	112
PID 4200 wrote to memory of 4184	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	112
PID 4200 wrote to memory of 2696	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	113
PID 4200 wrote to memory of 2696	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	113
PID 4200 wrote to memory of 4752	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	114
PID 4200 wrote to memory of 4752	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	114
PID 4200 wrote to memory of 1572	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	115
PID 4200 wrote to memory of 1572	4200	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3828" "2960" "2764" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13488
- C:\Windows\System\bSzhDeG.exe
  C:\Windows\System\bSzhDeG.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\rTdbUmZ.exe
  C:\Windows\System\rTdbUmZ.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\SpioCit.exe
  C:\Windows\System\SpioCit.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\nxIrGtl.exe
  C:\Windows\System\nxIrGtl.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\ARkMbop.exe
  C:\Windows\System\ARkMbop.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\OZaPPox.exe
  C:\Windows\System\OZaPPox.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\zFQfmft.exe
  C:\Windows\System\zFQfmft.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\UIpOdAY.exe
  C:\Windows\System\UIpOdAY.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\gldYCbk.exe
  C:\Windows\System\gldYCbk.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\SWNurwj.exe
  C:\Windows\System\SWNurwj.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\ezLdZBg.exe
  C:\Windows\System\ezLdZBg.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\HRIUItK.exe
  C:\Windows\System\HRIUItK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\NlRMpmt.exe
  C:\Windows\System\NlRMpmt.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\LcfhXsL.exe
  C:\Windows\System\LcfhXsL.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\GmEouSU.exe
  C:\Windows\System\GmEouSU.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\dQdrAlN.exe
  C:\Windows\System\dQdrAlN.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\AwlwjkJ.exe
  C:\Windows\System\AwlwjkJ.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\dtPZlci.exe
  C:\Windows\System\dtPZlci.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\FaQwzTR.exe
  C:\Windows\System\FaQwzTR.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\lBLuMke.exe
  C:\Windows\System\lBLuMke.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ypVyKCo.exe
  C:\Windows\System\ypVyKCo.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\uUzxyBV.exe
  C:\Windows\System\uUzxyBV.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\Ewzcbya.exe
  C:\Windows\System\Ewzcbya.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\DxTzkDi.exe
  C:\Windows\System\DxTzkDi.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\QrkrtgJ.exe
  C:\Windows\System\QrkrtgJ.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\vkVcLGv.exe
  C:\Windows\System\vkVcLGv.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\ZQBattv.exe
  C:\Windows\System\ZQBattv.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\bvhCmkj.exe
  C:\Windows\System\bvhCmkj.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\dBoitvT.exe
  C:\Windows\System\dBoitvT.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\UDOqQvV.exe
  C:\Windows\System\UDOqQvV.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\tudECJR.exe
  C:\Windows\System\tudECJR.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\ZhTQGfy.exe
  C:\Windows\System\ZhTQGfy.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\nvdFuPi.exe
  C:\Windows\System\nvdFuPi.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\PqGqMMe.exe
  C:\Windows\System\PqGqMMe.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\TFoKTmL.exe
  C:\Windows\System\TFoKTmL.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\kARKMHY.exe
  C:\Windows\System\kARKMHY.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\zvGZoLJ.exe
  C:\Windows\System\zvGZoLJ.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\npitscS.exe
  C:\Windows\System\npitscS.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\csWmjbz.exe
  C:\Windows\System\csWmjbz.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\mtOsDFn.exe
  C:\Windows\System\mtOsDFn.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\BRMOLOS.exe
  C:\Windows\System\BRMOLOS.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\QgZMzxV.exe
  C:\Windows\System\QgZMzxV.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\EpxFmVp.exe
  C:\Windows\System\EpxFmVp.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\pjbPsKZ.exe
  C:\Windows\System\pjbPsKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\NszYuTk.exe
  C:\Windows\System\NszYuTk.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\zNKUQOb.exe
  C:\Windows\System\zNKUQOb.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\TJwrmCm.exe
  C:\Windows\System\TJwrmCm.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qNTHHfr.exe
  C:\Windows\System\qNTHHfr.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\NnvGjlA.exe
  C:\Windows\System\NnvGjlA.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\KtvUKpp.exe
  C:\Windows\System\KtvUKpp.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\UDCHaoi.exe
  C:\Windows\System\UDCHaoi.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\MSmwkvh.exe
  C:\Windows\System\MSmwkvh.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\nPjSuoT.exe
  C:\Windows\System\nPjSuoT.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\gwAhFeB.exe
  C:\Windows\System\gwAhFeB.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\wwIHkXC.exe
  C:\Windows\System\wwIHkXC.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\TGTIgvC.exe
  C:\Windows\System\TGTIgvC.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\GjglzOi.exe
  C:\Windows\System\GjglzOi.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\uwLbZFn.exe
  C:\Windows\System\uwLbZFn.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\puqEgrK.exe
  C:\Windows\System\puqEgrK.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\SoBbrzx.exe
  C:\Windows\System\SoBbrzx.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\qVReLoP.exe
  C:\Windows\System\qVReLoP.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\oSkRtqL.exe
  C:\Windows\System\oSkRtqL.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\DeGWsuJ.exe
  C:\Windows\System\DeGWsuJ.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\kdNPBMM.exe
  C:\Windows\System\kdNPBMM.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\tIyeomB.exe
  C:\Windows\System\tIyeomB.exe
  2⤵
  PID:4532
- C:\Windows\System\JvfQseb.exe
  C:\Windows\System\JvfQseb.exe
  2⤵
  PID:3140
- C:\Windows\System\nmRcjdd.exe
  C:\Windows\System\nmRcjdd.exe
  2⤵
  PID:5124
- C:\Windows\System\PGwSuTm.exe
  C:\Windows\System\PGwSuTm.exe
  2⤵
  PID:5152
- C:\Windows\System\zedsHYz.exe
  C:\Windows\System\zedsHYz.exe
  2⤵
  PID:5180
- C:\Windows\System\yAJViWG.exe
  C:\Windows\System\yAJViWG.exe
  2⤵
  PID:5208
- C:\Windows\System\MYliqrK.exe
  C:\Windows\System\MYliqrK.exe
  2⤵
  PID:5236
- C:\Windows\System\qmAzHcf.exe
  C:\Windows\System\qmAzHcf.exe
  2⤵
  PID:5260
- C:\Windows\System\aySWDQE.exe
  C:\Windows\System\aySWDQE.exe
  2⤵
  PID:5292
- C:\Windows\System\SfAaEYg.exe
  C:\Windows\System\SfAaEYg.exe
  2⤵
  PID:5324
- C:\Windows\System\VJkriwU.exe
  C:\Windows\System\VJkriwU.exe
  2⤵
  PID:5356
- C:\Windows\System\RrcYOHW.exe
  C:\Windows\System\RrcYOHW.exe
  2⤵
  PID:5384
- C:\Windows\System\Jhfcfdf.exe
  C:\Windows\System\Jhfcfdf.exe
  2⤵
  PID:5412
- C:\Windows\System\XbcLafA.exe
  C:\Windows\System\XbcLafA.exe
  2⤵
  PID:5440
- C:\Windows\System\dGQKVWU.exe
  C:\Windows\System\dGQKVWU.exe
  2⤵
  PID:5472
- C:\Windows\System\LsxnDai.exe
  C:\Windows\System\LsxnDai.exe
  2⤵
  PID:5500
- C:\Windows\System\mfWPwKw.exe
  C:\Windows\System\mfWPwKw.exe
  2⤵
  PID:5528
- C:\Windows\System\oYcQRBh.exe
  C:\Windows\System\oYcQRBh.exe
  2⤵
  PID:5556
- C:\Windows\System\ZolEPuX.exe
  C:\Windows\System\ZolEPuX.exe
  2⤵
  PID:5584
- C:\Windows\System\TolhCix.exe
  C:\Windows\System\TolhCix.exe
  2⤵
  PID:5612
- C:\Windows\System\QPRCOum.exe
  C:\Windows\System\QPRCOum.exe
  2⤵
  PID:5636
- C:\Windows\System\GaJCGnK.exe
  C:\Windows\System\GaJCGnK.exe
  2⤵
  PID:5668
- C:\Windows\System\xRYrpql.exe
  C:\Windows\System\xRYrpql.exe
  2⤵
  PID:5696
- C:\Windows\System\SaSVkMR.exe
  C:\Windows\System\SaSVkMR.exe
  2⤵
  PID:5724
- C:\Windows\System\fFlUDJV.exe
  C:\Windows\System\fFlUDJV.exe
  2⤵
  PID:5752
- C:\Windows\System\gBAemgC.exe
  C:\Windows\System\gBAemgC.exe
  2⤵
  PID:5780
- C:\Windows\System\GSjawrh.exe
  C:\Windows\System\GSjawrh.exe
  2⤵
  PID:5808
- C:\Windows\System\OulWhSP.exe
  C:\Windows\System\OulWhSP.exe
  2⤵
  PID:5836
- C:\Windows\System\lsyAMwR.exe
  C:\Windows\System\lsyAMwR.exe
  2⤵
  PID:5860
- C:\Windows\System\mnmkAJj.exe
  C:\Windows\System\mnmkAJj.exe
  2⤵
  PID:5888
- C:\Windows\System\MKZBJgJ.exe
  C:\Windows\System\MKZBJgJ.exe
  2⤵
  PID:5920
- C:\Windows\System\ObJxmQP.exe
  C:\Windows\System\ObJxmQP.exe
  2⤵
  PID:5948
- C:\Windows\System\vtQJVjn.exe
  C:\Windows\System\vtQJVjn.exe
  2⤵
  PID:5976
- C:\Windows\System\oReboQf.exe
  C:\Windows\System\oReboQf.exe
  2⤵
  PID:6004
- C:\Windows\System\vOUawmO.exe
  C:\Windows\System\vOUawmO.exe
  2⤵
  PID:6032
- C:\Windows\System\xjBMLwL.exe
  C:\Windows\System\xjBMLwL.exe
  2⤵
  PID:6060
- C:\Windows\System\KljeyNI.exe
  C:\Windows\System\KljeyNI.exe
  2⤵
  PID:6088
- C:\Windows\System\JGaeeWJ.exe
  C:\Windows\System\JGaeeWJ.exe
  2⤵
  PID:6116
- C:\Windows\System\VEhnLRM.exe
  C:\Windows\System\VEhnLRM.exe
  2⤵
  PID:4440
- C:\Windows\System\rHLNpNx.exe
  C:\Windows\System\rHLNpNx.exe
  2⤵
  PID:1816
- C:\Windows\System\bGjQNxJ.exe
  C:\Windows\System\bGjQNxJ.exe
  2⤵
  PID:1712
- C:\Windows\System\wGemScX.exe
  C:\Windows\System\wGemScX.exe
  2⤵
  PID:4588
- C:\Windows\System\ZVhhMXq.exe
  C:\Windows\System\ZVhhMXq.exe
  2⤵
  PID:2844
- C:\Windows\System\jBmQSmg.exe
  C:\Windows\System\jBmQSmg.exe
  2⤵
  PID:5136
- C:\Windows\System\EgbsrvN.exe
  C:\Windows\System\EgbsrvN.exe
  2⤵
  PID:5196
- C:\Windows\System\fhNIAvg.exe
  C:\Windows\System\fhNIAvg.exe
  2⤵
  PID:5252
- C:\Windows\System\kXxpwlH.exe
  C:\Windows\System\kXxpwlH.exe
  2⤵
  PID:5312
- C:\Windows\System\ZzWtUTt.exe
  C:\Windows\System\ZzWtUTt.exe
  2⤵
  PID:5376
- C:\Windows\System\lpqMGbk.exe
  C:\Windows\System\lpqMGbk.exe
  2⤵
  PID:4528
- C:\Windows\System\gDaLfHm.exe
  C:\Windows\System\gDaLfHm.exe
  2⤵
  PID:5492
- C:\Windows\System\jlQSLPe.exe
  C:\Windows\System\jlQSLPe.exe
  2⤵
  PID:5568
- C:\Windows\System\rnfPZJG.exe
  C:\Windows\System\rnfPZJG.exe
  2⤵
  PID:5624
- C:\Windows\System\mivrvXx.exe
  C:\Windows\System\mivrvXx.exe
  2⤵
  PID:5680
- C:\Windows\System\SJPpwTI.exe
  C:\Windows\System\SJPpwTI.exe
  2⤵
  PID:5712
- C:\Windows\System\WuXvioT.exe
  C:\Windows\System\WuXvioT.exe
  2⤵
  PID:4076
- C:\Windows\System\QLzaLpE.exe
  C:\Windows\System\QLzaLpE.exe
  2⤵
  PID:5848
- C:\Windows\System\WJrvCkW.exe
  C:\Windows\System\WJrvCkW.exe
  2⤵
  PID:5884
- C:\Windows\System\cfSrWGS.exe
  C:\Windows\System\cfSrWGS.exe
  2⤵
  PID:5960
- C:\Windows\System\rhjCMPY.exe
  C:\Windows\System\rhjCMPY.exe
  2⤵
  PID:6020
- C:\Windows\System\ZcUfnTF.exe
  C:\Windows\System\ZcUfnTF.exe
  2⤵
  PID:6072
- C:\Windows\System\ifdHWJr.exe
  C:\Windows\System\ifdHWJr.exe
  2⤵
  PID:6128
- C:\Windows\System\FvnYyWc.exe
  C:\Windows\System\FvnYyWc.exe
  2⤵
  PID:3212
- C:\Windows\System\csueKrP.exe
  C:\Windows\System\csueKrP.exe
  2⤵
  PID:1800
- C:\Windows\System\TJXiSsc.exe
  C:\Windows\System\TJXiSsc.exe
  2⤵
  PID:5168
- C:\Windows\System\HYhZuFf.exe
  C:\Windows\System\HYhZuFf.exe
  2⤵
  PID:5284
- C:\Windows\System\CyDSISK.exe
  C:\Windows\System\CyDSISK.exe
  2⤵
  PID:5404
- C:\Windows\System\GrmwZKa.exe
  C:\Windows\System\GrmwZKa.exe
  2⤵
  PID:5540
- C:\Windows\System\OQNQTza.exe
  C:\Windows\System\OQNQTza.exe
  2⤵
  PID:1764
- C:\Windows\System\XRSTjhS.exe
  C:\Windows\System\XRSTjhS.exe
  2⤵
  PID:5744
- C:\Windows\System\efZhiIr.exe
  C:\Windows\System\efZhiIr.exe
  2⤵
  PID:5876
- C:\Windows\System\wFSkIjf.exe
  C:\Windows\System\wFSkIjf.exe
  2⤵
  PID:5996
- C:\Windows\System\RjyMJcf.exe
  C:\Windows\System\RjyMJcf.exe
  2⤵
  PID:6048
- C:\Windows\System\lnYGmcO.exe
  C:\Windows\System\lnYGmcO.exe
  2⤵
  PID:2644
- C:\Windows\System\XYlvcNy.exe
  C:\Windows\System\XYlvcNy.exe
  2⤵
  PID:5224
- C:\Windows\System\qyXhKdh.exe
  C:\Windows\System\qyXhKdh.exe
  2⤵
  PID:5368
- C:\Windows\System\yWcGdtg.exe
  C:\Windows\System\yWcGdtg.exe
  2⤵
  PID:5600
- C:\Windows\System\vIdIwBh.exe
  C:\Windows\System\vIdIwBh.exe
  2⤵
  PID:5820
- C:\Windows\System\LLZDatE.exe
  C:\Windows\System\LLZDatE.exe
  2⤵
  PID:532
- C:\Windows\System\AWOPZYj.exe
  C:\Windows\System\AWOPZYj.exe
  2⤵
  PID:6148
- C:\Windows\System\nEDEiVI.exe
  C:\Windows\System\nEDEiVI.exe
  2⤵
  PID:6176
- C:\Windows\System\svhQKgK.exe
  C:\Windows\System\svhQKgK.exe
  2⤵
  PID:6204
- C:\Windows\System\RKETCHg.exe
  C:\Windows\System\RKETCHg.exe
  2⤵
  PID:6232
- C:\Windows\System\mSMbUKq.exe
  C:\Windows\System\mSMbUKq.exe
  2⤵
  PID:6260
- C:\Windows\System\AEWjxLP.exe
  C:\Windows\System\AEWjxLP.exe
  2⤵
  PID:6288
- C:\Windows\System\MgolKIA.exe
  C:\Windows\System\MgolKIA.exe
  2⤵
  PID:6316
- C:\Windows\System\ehEUbTe.exe
  C:\Windows\System\ehEUbTe.exe
  2⤵
  PID:6344
- C:\Windows\System\SLNosVG.exe
  C:\Windows\System\SLNosVG.exe
  2⤵
  PID:6372
- C:\Windows\System\KWbjryB.exe
  C:\Windows\System\KWbjryB.exe
  2⤵
  PID:6400
- C:\Windows\System\OgLLHVc.exe
  C:\Windows\System\OgLLHVc.exe
  2⤵
  PID:6428
- C:\Windows\System\zJKkIwt.exe
  C:\Windows\System\zJKkIwt.exe
  2⤵
  PID:6456
- C:\Windows\System\JHPzmuj.exe
  C:\Windows\System\JHPzmuj.exe
  2⤵
  PID:6524
- C:\Windows\System\EeKryDi.exe
  C:\Windows\System\EeKryDi.exe
  2⤵
  PID:6552
- C:\Windows\System\kazBSNL.exe
  C:\Windows\System\kazBSNL.exe
  2⤵
  PID:6572
- C:\Windows\System\ilAgOTo.exe
  C:\Windows\System\ilAgOTo.exe
  2⤵
  PID:6600
- C:\Windows\System\TGSoSNE.exe
  C:\Windows\System\TGSoSNE.exe
  2⤵
  PID:6620
- C:\Windows\System\eYiWVHM.exe
  C:\Windows\System\eYiWVHM.exe
  2⤵
  PID:6692
- C:\Windows\System\STUnyRe.exe
  C:\Windows\System\STUnyRe.exe
  2⤵
  PID:6728
- C:\Windows\System\vYHRTxd.exe
  C:\Windows\System\vYHRTxd.exe
  2⤵
  PID:6748
- C:\Windows\System\MlbaJfp.exe
  C:\Windows\System\MlbaJfp.exe
  2⤵
  PID:6764
- C:\Windows\System\yLStiEc.exe
  C:\Windows\System\yLStiEc.exe
  2⤵
  PID:6784
- C:\Windows\System\vaiEXFz.exe
  C:\Windows\System\vaiEXFz.exe
  2⤵
  PID:6808
- C:\Windows\System\rHyyyAz.exe
  C:\Windows\System\rHyyyAz.exe
  2⤵
  PID:6828
- C:\Windows\System\AtYuSmw.exe
  C:\Windows\System\AtYuSmw.exe
  2⤵
  PID:6868
- C:\Windows\System\xvCOkyK.exe
  C:\Windows\System\xvCOkyK.exe
  2⤵
  PID:6884
- C:\Windows\System\GgndwGb.exe
  C:\Windows\System\GgndwGb.exe
  2⤵
  PID:6908
- C:\Windows\System\ecnIEPl.exe
  C:\Windows\System\ecnIEPl.exe
  2⤵
  PID:6928
- C:\Windows\System\bjbxWqX.exe
  C:\Windows\System\bjbxWqX.exe
  2⤵
  PID:6980
- C:\Windows\System\gtkvjot.exe
  C:\Windows\System\gtkvjot.exe
  2⤵
  PID:6996
- C:\Windows\System\dfpEZvZ.exe
  C:\Windows\System\dfpEZvZ.exe
  2⤵
  PID:7044
- C:\Windows\System\HScZRCj.exe
  C:\Windows\System\HScZRCj.exe
  2⤵
  PID:7064
- C:\Windows\System\oGawEnM.exe
  C:\Windows\System\oGawEnM.exe
  2⤵
  PID:7096
- C:\Windows\System\ecsAtcL.exe
  C:\Windows\System\ecsAtcL.exe
  2⤵
  PID:7120
- C:\Windows\System\sfgYzhz.exe
  C:\Windows\System\sfgYzhz.exe
  2⤵
  PID:7140
- C:\Windows\System\vkTmfGb.exe
  C:\Windows\System\vkTmfGb.exe
  2⤵
  PID:4872
- C:\Windows\System\jaUCHzs.exe
  C:\Windows\System\jaUCHzs.exe
  2⤵
  PID:5484
- C:\Windows\System\KSZUHax.exe
  C:\Windows\System\KSZUHax.exe
  2⤵
  PID:5936
- C:\Windows\System\OxZhtLj.exe
  C:\Windows\System\OxZhtLj.exe
  2⤵
  PID:6108
- C:\Windows\System\YrizPXh.exe
  C:\Windows\System\YrizPXh.exe
  2⤵
  PID:6160
- C:\Windows\System\eQyFatg.exe
  C:\Windows\System\eQyFatg.exe
  2⤵
  PID:3048
- C:\Windows\System\HKaxKnu.exe
  C:\Windows\System\HKaxKnu.exe
  2⤵
  PID:6192
- C:\Windows\System\hVjkfiQ.exe
  C:\Windows\System\hVjkfiQ.exe
  2⤵
  PID:2652
- C:\Windows\System\DEnUKIC.exe
  C:\Windows\System\DEnUKIC.exe
  2⤵
  PID:6272
- C:\Windows\System\arSsAFf.exe
  C:\Windows\System\arSsAFf.exe
  2⤵
  PID:6304
- C:\Windows\System\DVPmRRj.exe
  C:\Windows\System\DVPmRRj.exe
  2⤵
  PID:6388
- C:\Windows\System\zxrFwnU.exe
  C:\Windows\System\zxrFwnU.exe
  2⤵
  PID:6440
- C:\Windows\System\dRyVFRA.exe
  C:\Windows\System\dRyVFRA.exe
  2⤵
  PID:6512
- C:\Windows\System\UsPAOkH.exe
  C:\Windows\System\UsPAOkH.exe
  2⤵
  PID:4736
- C:\Windows\System\ngnNiVu.exe
  C:\Windows\System\ngnNiVu.exe
  2⤵
  PID:2536
- C:\Windows\System\QFFydjc.exe
  C:\Windows\System\QFFydjc.exe
  2⤵
  PID:2828
- C:\Windows\System\TgutHoS.exe
  C:\Windows\System\TgutHoS.exe
  2⤵
  PID:6564
- C:\Windows\System\iyiZuAT.exe
  C:\Windows\System\iyiZuAT.exe
  2⤵
  PID:6744
- C:\Windows\System\lSOktPV.exe
  C:\Windows\System\lSOktPV.exe
  2⤵
  PID:6820
- C:\Windows\System\pQFLrMq.exe
  C:\Windows\System\pQFLrMq.exe
  2⤵
  PID:6824
- C:\Windows\System\eTxskBK.exe
  C:\Windows\System\eTxskBK.exe
  2⤵
  PID:6920
- C:\Windows\System\vrfonJO.exe
  C:\Windows\System\vrfonJO.exe
  2⤵
  PID:6940
- C:\Windows\System\ikzxfyf.exe
  C:\Windows\System\ikzxfyf.exe
  2⤵
  PID:7032
- C:\Windows\System\iyCkTPn.exe
  C:\Windows\System\iyCkTPn.exe
  2⤵
  PID:7056
- C:\Windows\System\yzcbxvV.exe
  C:\Windows\System\yzcbxvV.exe
  2⤵
  PID:7092
- C:\Windows\System\ZylsxWf.exe
  C:\Windows\System\ZylsxWf.exe
  2⤵
  PID:7084
- C:\Windows\System\raWiitU.exe
  C:\Windows\System\raWiitU.exe
  2⤵
  PID:5800
- C:\Windows\System\CzBBlac.exe
  C:\Windows\System\CzBBlac.exe
  2⤵
  PID:6044
- C:\Windows\System\vIaCtSb.exe
  C:\Windows\System\vIaCtSb.exe
  2⤵
  PID:6252
- C:\Windows\System\CkMZUuJ.exe
  C:\Windows\System\CkMZUuJ.exe
  2⤵
  PID:2628
- C:\Windows\System\dHwBdUb.exe
  C:\Windows\System\dHwBdUb.exe
  2⤵
  PID:2684
- C:\Windows\System\FNosqJu.exe
  C:\Windows\System\FNosqJu.exe
  2⤵
  PID:6580
- C:\Windows\System\vbjSKyQ.exe
  C:\Windows\System\vbjSKyQ.exe
  2⤵
  PID:6792
- C:\Windows\System\BClTPHu.exe
  C:\Windows\System\BClTPHu.exe
  2⤵
  PID:6896
- C:\Windows\System\ZVtQjoz.exe
  C:\Windows\System\ZVtQjoz.exe
  2⤵
  PID:6960
- C:\Windows\System\lYKFheX.exe
  C:\Windows\System\lYKFheX.exe
  2⤵
  PID:7136
- C:\Windows\System\KSUdNPl.exe
  C:\Windows\System\KSUdNPl.exe
  2⤵
  PID:3748
- C:\Windows\System\SaTQkoa.exe
  C:\Windows\System\SaTQkoa.exe
  2⤵
  PID:980
- C:\Windows\System\rVkGelK.exe
  C:\Windows\System\rVkGelK.exe
  2⤵
  PID:2804
- C:\Windows\System\VgNpVYK.exe
  C:\Windows\System\VgNpVYK.exe
  2⤵
  PID:7024
- C:\Windows\System\TQGWrYp.exe
  C:\Windows\System\TQGWrYp.exe
  2⤵
  PID:6916
- C:\Windows\System\VPmTnNq.exe
  C:\Windows\System\VPmTnNq.exe
  2⤵
  PID:2184
- C:\Windows\System\CPLLRPj.exe
  C:\Windows\System\CPLLRPj.exe
  2⤵
  PID:7176
- C:\Windows\System\LTXTkbu.exe
  C:\Windows\System\LTXTkbu.exe
  2⤵
  PID:7208
- C:\Windows\System\rbCWGgD.exe
  C:\Windows\System\rbCWGgD.exe
  2⤵
  PID:7252
- C:\Windows\System\hILthJF.exe
  C:\Windows\System\hILthJF.exe
  2⤵
  PID:7272
- C:\Windows\System\DZmznTq.exe
  C:\Windows\System\DZmznTq.exe
  2⤵
  PID:7300
- C:\Windows\System\BiArMjo.exe
  C:\Windows\System\BiArMjo.exe
  2⤵
  PID:7324
- C:\Windows\System\fxksiwn.exe
  C:\Windows\System\fxksiwn.exe
  2⤵
  PID:7372
- C:\Windows\System\sFczSFZ.exe
  C:\Windows\System\sFczSFZ.exe
  2⤵
  PID:7392
- C:\Windows\System\TZIgYnE.exe
  C:\Windows\System\TZIgYnE.exe
  2⤵
  PID:7416
- C:\Windows\System\GStVRGD.exe
  C:\Windows\System\GStVRGD.exe
  2⤵
  PID:7432
- C:\Windows\System\AijjXkb.exe
  C:\Windows\System\AijjXkb.exe
  2⤵
  PID:7472
- C:\Windows\System\QjAymGK.exe
  C:\Windows\System\QjAymGK.exe
  2⤵
  PID:7492
- C:\Windows\System\tjkjFBF.exe
  C:\Windows\System\tjkjFBF.exe
  2⤵
  PID:7552
- C:\Windows\System\LwcQJvH.exe
  C:\Windows\System\LwcQJvH.exe
  2⤵
  PID:7580
- C:\Windows\System\ahqfGkI.exe
  C:\Windows\System\ahqfGkI.exe
  2⤵
  PID:7596
- C:\Windows\System\aJBJPKt.exe
  C:\Windows\System\aJBJPKt.exe
  2⤵
  PID:7616
- C:\Windows\System\xpEJRCt.exe
  C:\Windows\System\xpEJRCt.exe
  2⤵
  PID:7640
- C:\Windows\System\rEPFKRa.exe
  C:\Windows\System\rEPFKRa.exe
  2⤵
  PID:7660
- C:\Windows\System\CrMRkMB.exe
  C:\Windows\System\CrMRkMB.exe
  2⤵
  PID:7684
- C:\Windows\System\NKhyBYL.exe
  C:\Windows\System\NKhyBYL.exe
  2⤵
  PID:7740
- C:\Windows\System\ghATFue.exe
  C:\Windows\System\ghATFue.exe
  2⤵
  PID:7756
- C:\Windows\System\LPfLGBB.exe
  C:\Windows\System\LPfLGBB.exe
  2⤵
  PID:7780
- C:\Windows\System\QpbdTFd.exe
  C:\Windows\System\QpbdTFd.exe
  2⤵
  PID:7800
- C:\Windows\System\oqvZqRl.exe
  C:\Windows\System\oqvZqRl.exe
  2⤵
  PID:7828
- C:\Windows\System\FdALLRm.exe
  C:\Windows\System\FdALLRm.exe
  2⤵
  PID:7852
- C:\Windows\System\dbOLaYn.exe
  C:\Windows\System\dbOLaYn.exe
  2⤵
  PID:7872
- C:\Windows\System\VOCflWN.exe
  C:\Windows\System\VOCflWN.exe
  2⤵
  PID:7900
- C:\Windows\System\nUuFTdD.exe
  C:\Windows\System\nUuFTdD.exe
  2⤵
  PID:7920
- C:\Windows\System\PVonJjp.exe
  C:\Windows\System\PVonJjp.exe
  2⤵
  PID:7948
- C:\Windows\System\TCYyGGV.exe
  C:\Windows\System\TCYyGGV.exe
  2⤵
  PID:7980
- C:\Windows\System\ItXsKDO.exe
  C:\Windows\System\ItXsKDO.exe
  2⤵
  PID:8000
- C:\Windows\System\nlkrnrm.exe
  C:\Windows\System\nlkrnrm.exe
  2⤵
  PID:8024
- C:\Windows\System\dvWOgTM.exe
  C:\Windows\System\dvWOgTM.exe
  2⤵
  PID:8048
- C:\Windows\System\phwCaiK.exe
  C:\Windows\System\phwCaiK.exe
  2⤵
  PID:8068
- C:\Windows\System\mIyoVHT.exe
  C:\Windows\System\mIyoVHT.exe
  2⤵
  PID:8112
- C:\Windows\System\AYhELwW.exe
  C:\Windows\System\AYhELwW.exe
  2⤵
  PID:8144
- C:\Windows\System\BXqEzcs.exe
  C:\Windows\System\BXqEzcs.exe
  2⤵
  PID:6684
- C:\Windows\System\FPBlCgr.exe
  C:\Windows\System\FPBlCgr.exe
  2⤵
  PID:7248
- C:\Windows\System\bRsjebG.exe
  C:\Windows\System\bRsjebG.exe
  2⤵
  PID:7264
- C:\Windows\System\MxdRWSd.exe
  C:\Windows\System\MxdRWSd.exe
  2⤵
  PID:7312
- C:\Windows\System\AOAdyqG.exe
  C:\Windows\System\AOAdyqG.exe
  2⤵
  PID:7344
- C:\Windows\System\txqnWLS.exe
  C:\Windows\System\txqnWLS.exe
  2⤵
  PID:7460
- C:\Windows\System\NVekYdY.exe
  C:\Windows\System\NVekYdY.exe
  2⤵
  PID:7484
- C:\Windows\System\aZSlkvo.exe
  C:\Windows\System\aZSlkvo.exe
  2⤵
  PID:7544
- C:\Windows\System\JjCDhxA.exe
  C:\Windows\System\JjCDhxA.exe
  2⤵
  PID:7672
- C:\Windows\System\UmMohiP.exe
  C:\Windows\System\UmMohiP.exe
  2⤵
  PID:7708
- C:\Windows\System\edDftnA.exe
  C:\Windows\System\edDftnA.exe
  2⤵
  PID:7792
- C:\Windows\System\uZemAht.exe
  C:\Windows\System\uZemAht.exe
  2⤵
  PID:7808
- C:\Windows\System\UfjYlAM.exe
  C:\Windows\System\UfjYlAM.exe
  2⤵
  PID:7928
- C:\Windows\System\rUvJuYw.exe
  C:\Windows\System\rUvJuYw.exe
  2⤵
  PID:7880
- C:\Windows\System\uTxqwCs.exe
  C:\Windows\System\uTxqwCs.exe
  2⤵
  PID:8044
- C:\Windows\System\YuCijel.exe
  C:\Windows\System\YuCijel.exe
  2⤵
  PID:7992
- C:\Windows\System\IxHqbta.exe
  C:\Windows\System\IxHqbta.exe
  2⤵
  PID:8100
- C:\Windows\System\ybDiXpw.exe
  C:\Windows\System\ybDiXpw.exe
  2⤵
  PID:8136
- C:\Windows\System\fzEimjo.exe
  C:\Windows\System\fzEimjo.exe
  2⤵
  PID:7308
- C:\Windows\System\VRmqTFS.exe
  C:\Windows\System\VRmqTFS.exe
  2⤵
  PID:7548
- C:\Windows\System\KDwOpru.exe
  C:\Windows\System\KDwOpru.exe
  2⤵
  PID:7656
- C:\Windows\System\EwylguG.exe
  C:\Windows\System\EwylguG.exe
  2⤵
  PID:7764
- C:\Windows\System\dQMQKKL.exe
  C:\Windows\System\dQMQKKL.exe
  2⤵
  PID:7972
- C:\Windows\System\nGFNjdI.exe
  C:\Windows\System\nGFNjdI.exe
  2⤵
  PID:8124
- C:\Windows\System\GvXIkJr.exe
  C:\Windows\System\GvXIkJr.exe
  2⤵
  PID:7400
- C:\Windows\System\QlUxFWu.exe
  C:\Windows\System\QlUxFWu.exe
  2⤵
  PID:7364
- C:\Windows\System\xapRRSR.exe
  C:\Windows\System\xapRRSR.exe
  2⤵
  PID:8180
- C:\Windows\System\nqjnEGy.exe
  C:\Windows\System\nqjnEGy.exe
  2⤵
  PID:8200
- C:\Windows\System\widldCn.exe
  C:\Windows\System\widldCn.exe
  2⤵
  PID:8280
- C:\Windows\System\lXtQuPe.exe
  C:\Windows\System\lXtQuPe.exe
  2⤵
  PID:8300
- C:\Windows\System\aPwqTbd.exe
  C:\Windows\System\aPwqTbd.exe
  2⤵
  PID:8340
- C:\Windows\System\zLZdpFp.exe
  C:\Windows\System\zLZdpFp.exe
  2⤵
  PID:8356
- C:\Windows\System\tFsUlgU.exe
  C:\Windows\System\tFsUlgU.exe
  2⤵
  PID:8380
- C:\Windows\System\wPthIPs.exe
  C:\Windows\System\wPthIPs.exe
  2⤵
  PID:8404
- C:\Windows\System\KGvilLt.exe
  C:\Windows\System\KGvilLt.exe
  2⤵
  PID:8432
- C:\Windows\System\orIQGMl.exe
  C:\Windows\System\orIQGMl.exe
  2⤵
  PID:8452
- C:\Windows\System\XfagrWv.exe
  C:\Windows\System\XfagrWv.exe
  2⤵
  PID:8476
- C:\Windows\System\TVpfqwg.exe
  C:\Windows\System\TVpfqwg.exe
  2⤵
  PID:8504
- C:\Windows\System\taIHZXK.exe
  C:\Windows\System\taIHZXK.exe
  2⤵
  PID:8548
- C:\Windows\System\TCshEtP.exe
  C:\Windows\System\TCshEtP.exe
  2⤵
  PID:8584
- C:\Windows\System\aaZUXos.exe
  C:\Windows\System\aaZUXos.exe
  2⤵
  PID:8608
- C:\Windows\System\VotqQTi.exe
  C:\Windows\System\VotqQTi.exe
  2⤵
  PID:8636
- C:\Windows\System\jdHNgeo.exe
  C:\Windows\System\jdHNgeo.exe
  2⤵
  PID:8656
- C:\Windows\System\TyRGsDw.exe
  C:\Windows\System\TyRGsDw.exe
  2⤵
  PID:8700
- C:\Windows\System\hHYYwLk.exe
  C:\Windows\System\hHYYwLk.exe
  2⤵
  PID:8720
- C:\Windows\System\LdryCAg.exe
  C:\Windows\System\LdryCAg.exe
  2⤵
  PID:8736
- C:\Windows\System\haZiZqu.exe
  C:\Windows\System\haZiZqu.exe
  2⤵
  PID:8760
- C:\Windows\System\kIMeoAs.exe
  C:\Windows\System\kIMeoAs.exe
  2⤵
  PID:8780
- C:\Windows\System\YUTONFS.exe
  C:\Windows\System\YUTONFS.exe
  2⤵
  PID:8804
- C:\Windows\System\twromkx.exe
  C:\Windows\System\twromkx.exe
  2⤵
  PID:8820
- C:\Windows\System\PsioGKM.exe
  C:\Windows\System\PsioGKM.exe
  2⤵
  PID:8840
- C:\Windows\System\fxZBSQw.exe
  C:\Windows\System\fxZBSQw.exe
  2⤵
  PID:8860
- C:\Windows\System\DuUEtJf.exe
  C:\Windows\System\DuUEtJf.exe
  2⤵
  PID:8884
- C:\Windows\System\IcSsTSO.exe
  C:\Windows\System\IcSsTSO.exe
  2⤵
  PID:8932
- C:\Windows\System\ybexgFE.exe
  C:\Windows\System\ybexgFE.exe
  2⤵
  PID:9004
- C:\Windows\System\fMPkzAN.exe
  C:\Windows\System\fMPkzAN.exe
  2⤵
  PID:9024
- C:\Windows\System\BnsVLXA.exe
  C:\Windows\System\BnsVLXA.exe
  2⤵
  PID:9048
- C:\Windows\System\GDxfKaV.exe
  C:\Windows\System\GDxfKaV.exe
  2⤵
  PID:9068
- C:\Windows\System\PFdFWEi.exe
  C:\Windows\System\PFdFWEi.exe
  2⤵
  PID:9100
- C:\Windows\System\OJNZGbe.exe
  C:\Windows\System\OJNZGbe.exe
  2⤵
  PID:9120
- C:\Windows\System\XOalVfz.exe
  C:\Windows\System\XOalVfz.exe
  2⤵
  PID:9160
- C:\Windows\System\mRoQDGQ.exe
  C:\Windows\System\mRoQDGQ.exe
  2⤵
  PID:9192
- C:\Windows\System\pAjBPpA.exe
  C:\Windows\System\pAjBPpA.exe
  2⤵
  PID:9208
- C:\Windows\System\IRzPeHz.exe
  C:\Windows\System\IRzPeHz.exe
  2⤵
  PID:7704
- C:\Windows\System\YcvHPff.exe
  C:\Windows\System\YcvHPff.exe
  2⤵
  PID:7776
- C:\Windows\System\NWyKxgo.exe
  C:\Windows\System\NWyKxgo.exe
  2⤵
  PID:8292
- C:\Windows\System\sxchgEL.exe
  C:\Windows\System\sxchgEL.exe
  2⤵
  PID:8320
- C:\Windows\System\YeCOWKY.exe
  C:\Windows\System\YeCOWKY.exe
  2⤵
  PID:8428
- C:\Windows\System\mfiRcXG.exe
  C:\Windows\System\mfiRcXG.exe
  2⤵
  PID:8460
- C:\Windows\System\qqKDMUb.exe
  C:\Windows\System\qqKDMUb.exe
  2⤵
  PID:8520
- C:\Windows\System\gbQzKwg.exe
  C:\Windows\System\gbQzKwg.exe
  2⤵
  PID:8628
- C:\Windows\System\VdYVqkk.exe
  C:\Windows\System\VdYVqkk.exe
  2⤵
  PID:8676
- C:\Windows\System\RJEYyte.exe
  C:\Windows\System\RJEYyte.exe
  2⤵
  PID:8756
- C:\Windows\System\dfICQbx.exe
  C:\Windows\System\dfICQbx.exe
  2⤵
  PID:8796
- C:\Windows\System\gHYstHg.exe
  C:\Windows\System\gHYstHg.exe
  2⤵
  PID:8852
- C:\Windows\System\ULFFLZM.exe
  C:\Windows\System\ULFFLZM.exe
  2⤵
  PID:8984
- C:\Windows\System\tFSsGrS.exe
  C:\Windows\System\tFSsGrS.exe
  2⤵
  PID:9060
- C:\Windows\System\qgdeyQw.exe
  C:\Windows\System\qgdeyQw.exe
  2⤵
  PID:9172
- C:\Windows\System\MGsZqdA.exe
  C:\Windows\System\MGsZqdA.exe
  2⤵
  PID:8040
- C:\Windows\System\WqddReU.exe
  C:\Windows\System\WqddReU.exe
  2⤵
  PID:8256
- C:\Windows\System\daREpjq.exe
  C:\Windows\System\daREpjq.exe
  2⤵
  PID:8316
- C:\Windows\System\OSwdLMK.exe
  C:\Windows\System\OSwdLMK.exe
  2⤵
  PID:8620
- C:\Windows\System\oywttwd.exe
  C:\Windows\System\oywttwd.exe
  2⤵
  PID:8668
- C:\Windows\System\vcpOqsD.exe
  C:\Windows\System\vcpOqsD.exe
  2⤵
  PID:8776
- C:\Windows\System\eKIepaQ.exe
  C:\Windows\System\eKIepaQ.exe
  2⤵
  PID:8828
- C:\Windows\System\NiBhnjS.exe
  C:\Windows\System\NiBhnjS.exe
  2⤵
  PID:8952
- C:\Windows\System\QrJGUTC.exe
  C:\Windows\System\QrJGUTC.exe
  2⤵
  PID:8420
- C:\Windows\System\enQBPdd.exe
  C:\Windows\System\enQBPdd.exe
  2⤵
  PID:8744
- C:\Windows\System\TIpHmat.exe
  C:\Windows\System\TIpHmat.exe
  2⤵
  PID:9220
- C:\Windows\System\qkPiWHZ.exe
  C:\Windows\System\qkPiWHZ.exe
  2⤵
  PID:9292
- C:\Windows\System\okTcapm.exe
  C:\Windows\System\okTcapm.exe
  2⤵
  PID:9316
- C:\Windows\System\iUbMBQC.exe
  C:\Windows\System\iUbMBQC.exe
  2⤵
  PID:9332
- C:\Windows\System\dqPNuYe.exe
  C:\Windows\System\dqPNuYe.exe
  2⤵
  PID:9348
- C:\Windows\System\saiCXAW.exe
  C:\Windows\System\saiCXAW.exe
  2⤵
  PID:9372
- C:\Windows\System\ucDUmKJ.exe
  C:\Windows\System\ucDUmKJ.exe
  2⤵
  PID:9444
- C:\Windows\System\QLDOnbg.exe
  C:\Windows\System\QLDOnbg.exe
  2⤵
  PID:9492
- C:\Windows\System\pQdlren.exe
  C:\Windows\System\pQdlren.exe
  2⤵
  PID:9556
- C:\Windows\System\ehqlRPT.exe
  C:\Windows\System\ehqlRPT.exe
  2⤵
  PID:9576
- C:\Windows\System\OCRQzUZ.exe
  C:\Windows\System\OCRQzUZ.exe
  2⤵
  PID:9612
- C:\Windows\System\TQmJWtu.exe
  C:\Windows\System\TQmJWtu.exe
  2⤵
  PID:9656
- C:\Windows\System\PztHMLU.exe
  C:\Windows\System\PztHMLU.exe
  2⤵
  PID:9672
- C:\Windows\System\NgBFOfh.exe
  C:\Windows\System\NgBFOfh.exe
  2⤵
  PID:9696
- C:\Windows\System\eMCgWKg.exe
  C:\Windows\System\eMCgWKg.exe
  2⤵
  PID:9716
- C:\Windows\System\yTGKPPL.exe
  C:\Windows\System\yTGKPPL.exe
  2⤵
  PID:9744
- C:\Windows\System\FkUKUsE.exe
  C:\Windows\System\FkUKUsE.exe
  2⤵
  PID:9788
- C:\Windows\System\mqWJBOY.exe
  C:\Windows\System\mqWJBOY.exe
  2⤵
  PID:9820
- C:\Windows\System\uAYkSJI.exe
  C:\Windows\System\uAYkSJI.exe
  2⤵
  PID:9844
- C:\Windows\System\ySLbpeP.exe
  C:\Windows\System\ySLbpeP.exe
  2⤵
  PID:9868
- C:\Windows\System\qSFlZrN.exe
  C:\Windows\System\qSFlZrN.exe
  2⤵
  PID:9896
- C:\Windows\System\glRGukj.exe
  C:\Windows\System\glRGukj.exe
  2⤵
  PID:9916
- C:\Windows\System\vmGSfbV.exe
  C:\Windows\System\vmGSfbV.exe
  2⤵
  PID:9940
- C:\Windows\System\gWzMsoN.exe
  C:\Windows\System\gWzMsoN.exe
  2⤵
  PID:9964
- C:\Windows\System\WbEWFiy.exe
  C:\Windows\System\WbEWFiy.exe
  2⤵
  PID:9984
- C:\Windows\System\IGALwTb.exe
  C:\Windows\System\IGALwTb.exe
  2⤵
  PID:10008
- C:\Windows\System\fbHoecg.exe
  C:\Windows\System\fbHoecg.exe
  2⤵
  PID:10064
- C:\Windows\System\kvVVoXX.exe
  C:\Windows\System\kvVVoXX.exe
  2⤵
  PID:10108
- C:\Windows\System\hIIUMzB.exe
  C:\Windows\System\hIIUMzB.exe
  2⤵
  PID:10132
- C:\Windows\System\uEgfrhv.exe
  C:\Windows\System\uEgfrhv.exe
  2⤵
  PID:10148
- C:\Windows\System\nQfBRyN.exe
  C:\Windows\System\nQfBRyN.exe
  2⤵
  PID:10188
- C:\Windows\System\yiAcPqR.exe
  C:\Windows\System\yiAcPqR.exe
  2⤵
  PID:10208
- C:\Windows\System\kvbwlpo.exe
  C:\Windows\System\kvbwlpo.exe
  2⤵
  PID:9248
- C:\Windows\System\vuLawBH.exe
  C:\Windows\System\vuLawBH.exe
  2⤵
  PID:9340
- C:\Windows\System\HrqONpM.exe
  C:\Windows\System\HrqONpM.exe
  2⤵
  PID:8544
- C:\Windows\System\aNkEhji.exe
  C:\Windows\System\aNkEhji.exe
  2⤵
  PID:9228
- C:\Windows\System\MCrWUDF.exe
  C:\Windows\System\MCrWUDF.exe
  2⤵
  PID:9252
- C:\Windows\System\cbKuBzm.exe
  C:\Windows\System\cbKuBzm.exe
  2⤵
  PID:9384
- C:\Windows\System\lRkMfJU.exe
  C:\Windows\System\lRkMfJU.exe
  2⤵
  PID:9412
- C:\Windows\System\nIJDLNn.exe
  C:\Windows\System\nIJDLNn.exe
  2⤵
  PID:9428
- C:\Windows\System\BQPGagS.exe
  C:\Windows\System\BQPGagS.exe
  2⤵
  PID:9356
- C:\Windows\System\FuUaVUZ.exe
  C:\Windows\System\FuUaVUZ.exe
  2⤵
  PID:9388
- C:\Windows\System\rVXcWlB.exe
  C:\Windows\System\rVXcWlB.exe
  2⤵
  PID:9480
- C:\Windows\System\BrODOkX.exe
  C:\Windows\System\BrODOkX.exe
  2⤵
  PID:9584
- C:\Windows\System\MJBnfol.exe
  C:\Windows\System\MJBnfol.exe
  2⤵
  PID:9572
- C:\Windows\System\FSJTnVd.exe
  C:\Windows\System\FSJTnVd.exe
  2⤵
  PID:9668
- C:\Windows\System\jfOIxWX.exe
  C:\Windows\System\jfOIxWX.exe
  2⤵
  PID:9728
- C:\Windows\System\YqUYDjX.exe
  C:\Windows\System\YqUYDjX.exe
  2⤵
  PID:9772
- C:\Windows\System\frVaXWo.exe
  C:\Windows\System\frVaXWo.exe
  2⤵
  PID:10020
- C:\Windows\System\iNsyKsG.exe
  C:\Windows\System\iNsyKsG.exe
  2⤵
  PID:10056
- C:\Windows\System\YjXxMJA.exe
  C:\Windows\System\YjXxMJA.exe
  2⤵
  PID:10100
- C:\Windows\System\fNbzaqY.exe
  C:\Windows\System\fNbzaqY.exe
  2⤵
  PID:10184
- C:\Windows\System\RNdffsH.exe
  C:\Windows\System\RNdffsH.exe
  2⤵
  PID:10236
- C:\Windows\System\GcwbOAF.exe
  C:\Windows\System\GcwbOAF.exe
  2⤵
  PID:9312
- C:\Windows\System\KDvClba.exe
  C:\Windows\System\KDvClba.exe
  2⤵
  PID:9244
- C:\Windows\System\bTRqwtm.exe
  C:\Windows\System\bTRqwtm.exe
  2⤵
  PID:9276
- C:\Windows\System\TWSdSCy.exe
  C:\Windows\System\TWSdSCy.exe
  2⤵
  PID:9644
- C:\Windows\System\yrInTOS.exe
  C:\Windows\System\yrInTOS.exe
  2⤵
  PID:9776
- C:\Windows\System\DojJwbX.exe
  C:\Windows\System\DojJwbX.exe
  2⤵
  PID:9992
- C:\Windows\System\PJyCRNA.exe
  C:\Windows\System\PJyCRNA.exe
  2⤵
  PID:9468
- C:\Windows\System\pzMJDIA.exe
  C:\Windows\System\pzMJDIA.exe
  2⤵
  PID:10232
- C:\Windows\System\PAipxJz.exe
  C:\Windows\System\PAipxJz.exe
  2⤵
  PID:9264
- C:\Windows\System\njCJDAl.exe
  C:\Windows\System\njCJDAl.exe
  2⤵
  PID:672
- C:\Windows\System\axQSUFl.exe
  C:\Windows\System\axQSUFl.exe
  2⤵
  PID:9980
- C:\Windows\System\JhFBwpv.exe
  C:\Windows\System\JhFBwpv.exe
  2⤵
  PID:9440
- C:\Windows\System\zHYaNbj.exe
  C:\Windows\System\zHYaNbj.exe
  2⤵
  PID:10140
- C:\Windows\System\BkjajxL.exe
  C:\Windows\System\BkjajxL.exe
  2⤵
  PID:9948
- C:\Windows\System\LpyhSwT.exe
  C:\Windows\System\LpyhSwT.exe
  2⤵
  PID:10256
- C:\Windows\System\CKibOlH.exe
  C:\Windows\System\CKibOlH.exe
  2⤵
  PID:10276
- C:\Windows\System\pceAYRX.exe
  C:\Windows\System\pceAYRX.exe
  2⤵
  PID:10300
- C:\Windows\System\FyLReAw.exe
  C:\Windows\System\FyLReAw.exe
  2⤵
  PID:10332
- C:\Windows\System\dsuerpN.exe
  C:\Windows\System\dsuerpN.exe
  2⤵
  PID:10360
- C:\Windows\System\vCwXwJD.exe
  C:\Windows\System\vCwXwJD.exe
  2⤵
  PID:10380
- C:\Windows\System\MngIRGR.exe
  C:\Windows\System\MngIRGR.exe
  2⤵
  PID:10412
- C:\Windows\System\jxhTFKF.exe
  C:\Windows\System\jxhTFKF.exe
  2⤵
  PID:10448
- C:\Windows\System\jQkmGmM.exe
  C:\Windows\System\jQkmGmM.exe
  2⤵
  PID:10512
- C:\Windows\System\zHwAqQE.exe
  C:\Windows\System\zHwAqQE.exe
  2⤵
  PID:10540
- C:\Windows\System\chHguPr.exe
  C:\Windows\System\chHguPr.exe
  2⤵
  PID:10572
- C:\Windows\System\rGcYMoA.exe
  C:\Windows\System\rGcYMoA.exe
  2⤵
  PID:10592
- C:\Windows\System\kgLJEkt.exe
  C:\Windows\System\kgLJEkt.exe
  2⤵
  PID:10616
- C:\Windows\System\StakUqp.exe
  C:\Windows\System\StakUqp.exe
  2⤵
  PID:10648
- C:\Windows\System\yhlabUU.exe
  C:\Windows\System\yhlabUU.exe
  2⤵
  PID:10672
- C:\Windows\System\iejLPyQ.exe
  C:\Windows\System\iejLPyQ.exe
  2⤵
  PID:10704
- C:\Windows\System\LtxfyNT.exe
  C:\Windows\System\LtxfyNT.exe
  2⤵
  PID:10720
- C:\Windows\System\ReSRsWd.exe
  C:\Windows\System\ReSRsWd.exe
  2⤵
  PID:10752
- C:\Windows\System\QAWTmxu.exe
  C:\Windows\System\QAWTmxu.exe
  2⤵
  PID:10768
- C:\Windows\System\BcIQPPr.exe
  C:\Windows\System\BcIQPPr.exe
  2⤵
  PID:10792
- C:\Windows\System\HdTUqaU.exe
  C:\Windows\System\HdTUqaU.exe
  2⤵
  PID:10820
- C:\Windows\System\FtkREvX.exe
  C:\Windows\System\FtkREvX.exe
  2⤵
  PID:10848
- C:\Windows\System\BhNcUlB.exe
  C:\Windows\System\BhNcUlB.exe
  2⤵
  PID:10868
- C:\Windows\System\VNbDYjg.exe
  C:\Windows\System\VNbDYjg.exe
  2⤵
  PID:10912
- C:\Windows\System\DoAtvUr.exe
  C:\Windows\System\DoAtvUr.exe
  2⤵
  PID:10960
- C:\Windows\System\XrQVcon.exe
  C:\Windows\System\XrQVcon.exe
  2⤵
  PID:10992
- C:\Windows\System\NXwVDKc.exe
  C:\Windows\System\NXwVDKc.exe
  2⤵
  PID:11012
- C:\Windows\System\vPxMjfB.exe
  C:\Windows\System\vPxMjfB.exe
  2⤵
  PID:11028
- C:\Windows\System\VdObCnU.exe
  C:\Windows\System\VdObCnU.exe
  2⤵
  PID:11056
- C:\Windows\System\CbpWbIF.exe
  C:\Windows\System\CbpWbIF.exe
  2⤵
  PID:11076
- C:\Windows\System\lShbkvw.exe
  C:\Windows\System\lShbkvw.exe
  2⤵
  PID:11104
- C:\Windows\System\JJJGcMF.exe
  C:\Windows\System\JJJGcMF.exe
  2⤵
  PID:11156
- C:\Windows\System\QgGXXNj.exe
  C:\Windows\System\QgGXXNj.exe
  2⤵
  PID:11172
- C:\Windows\System\APtlMme.exe
  C:\Windows\System\APtlMme.exe
  2⤵
  PID:11196
- C:\Windows\System\XNPMBCC.exe
  C:\Windows\System\XNPMBCC.exe
  2⤵
  PID:11212
- C:\Windows\System\sEiakBv.exe
  C:\Windows\System\sEiakBv.exe
  2⤵
  PID:11232
- C:\Windows\System\eQJiqjt.exe
  C:\Windows\System\eQJiqjt.exe
  2⤵
  PID:10248
- C:\Windows\System\oMmeOqK.exe
  C:\Windows\System\oMmeOqK.exe
  2⤵
  PID:10272
- C:\Windows\System\JwuDzmA.exe
  C:\Windows\System\JwuDzmA.exe
  2⤵
  PID:10356
- C:\Windows\System\bPBGszD.exe
  C:\Windows\System\bPBGszD.exe
  2⤵
  PID:10404
- C:\Windows\System\MXswySf.exe
  C:\Windows\System\MXswySf.exe
  2⤵
  PID:10476
- C:\Windows\System\BMxDIUy.exe
  C:\Windows\System\BMxDIUy.exe
  2⤵
  PID:10584
- C:\Windows\System\qpDXRoX.exe
  C:\Windows\System\qpDXRoX.exe
  2⤵
  PID:10628
- C:\Windows\System\VMNeGrp.exe
  C:\Windows\System\VMNeGrp.exe
  2⤵
  PID:10660
- C:\Windows\System\KYAQhKh.exe
  C:\Windows\System\KYAQhKh.exe
  2⤵
  PID:10716
- C:\Windows\System\fAADjUz.exe
  C:\Windows\System\fAADjUz.exe
  2⤵
  PID:10816
- C:\Windows\System\GElNhLx.exe
  C:\Windows\System\GElNhLx.exe
  2⤵
  PID:10904
- C:\Windows\System\FDGKLId.exe
  C:\Windows\System\FDGKLId.exe
  2⤵
  PID:11008
- C:\Windows\System\ZuYyMkI.exe
  C:\Windows\System\ZuYyMkI.exe
  2⤵
  PID:11048
- C:\Windows\System\wGEsjZe.exe
  C:\Windows\System\wGEsjZe.exe
  2⤵
  PID:11168
- C:\Windows\System\ESrwqqS.exe
  C:\Windows\System\ESrwqqS.exe
  2⤵
  PID:11132
- C:\Windows\System\kVDheJz.exe
  C:\Windows\System\kVDheJz.exe
  2⤵
  PID:11260
- C:\Windows\System\whJOxDS.exe
  C:\Windows\System\whJOxDS.exe
  2⤵
  PID:10424
- C:\Windows\System\TOyCDSY.exe
  C:\Windows\System\TOyCDSY.exe
  2⤵
  PID:10440
- C:\Windows\System\aMGDyTk.exe
  C:\Windows\System\aMGDyTk.exe
  2⤵
  PID:10640
- C:\Windows\System\sVooPuh.exe
  C:\Windows\System\sVooPuh.exe
  2⤵
  PID:10812
- C:\Windows\System\MSiWzGe.exe
  C:\Windows\System\MSiWzGe.exe
  2⤵
  PID:10844
- C:\Windows\System\xURdzcn.exe
  C:\Windows\System\xURdzcn.exe
  2⤵
  PID:11000
- C:\Windows\System\nZmVPkE.exe
  C:\Windows\System\nZmVPkE.exe
  2⤵
  PID:11096
- C:\Windows\System\ZoEuYIm.exe
  C:\Windows\System\ZoEuYIm.exe
  2⤵
  PID:11208
- C:\Windows\System\FJQOskD.exe
  C:\Windows\System\FJQOskD.exe
  2⤵
  PID:10604
- C:\Windows\System\ZMsAdAG.exe
  C:\Windows\System\ZMsAdAG.exe
  2⤵
  PID:10800
- C:\Windows\System\JcQYdzT.exe
  C:\Windows\System\JcQYdzT.exe
  2⤵
  PID:10284
- C:\Windows\System\QEORcau.exe
  C:\Windows\System\QEORcau.exe
  2⤵
  PID:11292
- C:\Windows\System\yJLxucc.exe
  C:\Windows\System\yJLxucc.exe
  2⤵
  PID:11312
- C:\Windows\System\HkaPbav.exe
  C:\Windows\System\HkaPbav.exe
  2⤵
  PID:11360
- C:\Windows\System\zCYuMQt.exe
  C:\Windows\System\zCYuMQt.exe
  2⤵
  PID:11384
- C:\Windows\System\AdvHYqW.exe
  C:\Windows\System\AdvHYqW.exe
  2⤵
  PID:11404
- C:\Windows\System\Szdsoal.exe
  C:\Windows\System\Szdsoal.exe
  2⤵
  PID:11432
- C:\Windows\System\fHeYCij.exe
  C:\Windows\System\fHeYCij.exe
  2⤵
  PID:11468
- C:\Windows\System\tvnQRcB.exe
  C:\Windows\System\tvnQRcB.exe
  2⤵
  PID:11492
- C:\Windows\System\ujoybpN.exe
  C:\Windows\System\ujoybpN.exe
  2⤵
  PID:11512
- C:\Windows\System\cIDfZRq.exe
  C:\Windows\System\cIDfZRq.exe
  2⤵
  PID:11536
- C:\Windows\System\qpMQqjP.exe
  C:\Windows\System\qpMQqjP.exe
  2⤵
  PID:11580
- C:\Windows\System\SGIOyEF.exe
  C:\Windows\System\SGIOyEF.exe
  2⤵
  PID:11604
- C:\Windows\System\fpzmDBj.exe
  C:\Windows\System\fpzmDBj.exe
  2⤵
  PID:11620
- C:\Windows\System\CPqjLdy.exe
  C:\Windows\System\CPqjLdy.exe
  2⤵
  PID:11664
- C:\Windows\System\NKHJohK.exe
  C:\Windows\System\NKHJohK.exe
  2⤵
  PID:11684
- C:\Windows\System\icYSHZX.exe
  C:\Windows\System\icYSHZX.exe
  2⤵
  PID:11732
- C:\Windows\System\onQGELO.exe
  C:\Windows\System\onQGELO.exe
  2⤵
  PID:11756
- C:\Windows\System\hfNEduk.exe
  C:\Windows\System\hfNEduk.exe
  2⤵
  PID:11780
- C:\Windows\System\xjMfoNY.exe
  C:\Windows\System\xjMfoNY.exe
  2⤵
  PID:11824
- C:\Windows\System\YyqQSTm.exe
  C:\Windows\System\YyqQSTm.exe
  2⤵
  PID:11856
- C:\Windows\System\zCGsJaA.exe
  C:\Windows\System\zCGsJaA.exe
  2⤵
  PID:11872
- C:\Windows\System\dqMOKUZ.exe
  C:\Windows\System\dqMOKUZ.exe
  2⤵
  PID:11888
- C:\Windows\System\OqrlnuI.exe
  C:\Windows\System\OqrlnuI.exe
  2⤵
  PID:11936
- C:\Windows\System\fxnbFGp.exe
  C:\Windows\System\fxnbFGp.exe
  2⤵
  PID:11964
- C:\Windows\System\YWCzbAQ.exe
  C:\Windows\System\YWCzbAQ.exe
  2⤵
  PID:11980
- C:\Windows\System\vQVFpWn.exe
  C:\Windows\System\vQVFpWn.exe
  2⤵
  PID:12004
- C:\Windows\System\YPCFnlL.exe
  C:\Windows\System\YPCFnlL.exe
  2⤵
  PID:12032
- C:\Windows\System\yFkHjnd.exe
  C:\Windows\System\yFkHjnd.exe
  2⤵
  PID:12052
- C:\Windows\System\vbvIrqE.exe
  C:\Windows\System\vbvIrqE.exe
  2⤵
  PID:12080
- C:\Windows\System\YhZMeTe.exe
  C:\Windows\System\YhZMeTe.exe
  2⤵
  PID:12100
- C:\Windows\System\QOlxoMi.exe
  C:\Windows\System\QOlxoMi.exe
  2⤵
  PID:12128
- C:\Windows\System\ibxyRUT.exe
  C:\Windows\System\ibxyRUT.exe
  2⤵
  PID:12156
- C:\Windows\System\hGMfTXY.exe
  C:\Windows\System\hGMfTXY.exe
  2⤵
  PID:12184
- C:\Windows\System\sKDBFMt.exe
  C:\Windows\System\sKDBFMt.exe
  2⤵
  PID:12208
- C:\Windows\System\pqrbeQB.exe
  C:\Windows\System\pqrbeQB.exe
  2⤵
  PID:12228
- C:\Windows\System\QmyCOxy.exe
  C:\Windows\System\QmyCOxy.exe
  2⤵
  PID:12276
- C:\Windows\System\qgtxrQU.exe
  C:\Windows\System\qgtxrQU.exe
  2⤵
  PID:10636
- C:\Windows\System\NNgzWDr.exe
  C:\Windows\System\NNgzWDr.exe
  2⤵
  PID:11276
- C:\Windows\System\UbLRMtH.exe
  C:\Windows\System\UbLRMtH.exe
  2⤵
  PID:11440
- C:\Windows\System\cONjXwB.exe
  C:\Windows\System\cONjXwB.exe
  2⤵
  PID:11396
- C:\Windows\System\xpdZBju.exe
  C:\Windows\System\xpdZBju.exe
  2⤵
  PID:11484
- C:\Windows\System\gOZdlNA.exe
  C:\Windows\System\gOZdlNA.exe
  2⤵
  PID:11528
- C:\Windows\System\mZyuHky.exe
  C:\Windows\System\mZyuHky.exe
  2⤵
  PID:11576
- C:\Windows\System\QzrTKAC.exe
  C:\Windows\System\QzrTKAC.exe
  2⤵
  PID:11612
- C:\Windows\System\TCgbQMF.exe
  C:\Windows\System\TCgbQMF.exe
  2⤵
  PID:11660
- C:\Windows\System\IwVioYR.exe
  C:\Windows\System\IwVioYR.exe
  2⤵
  PID:11740
- C:\Windows\System\ssyZPgW.exe
  C:\Windows\System\ssyZPgW.exe
  2⤵
  PID:11880
- C:\Windows\System\ShmuBWg.exe
  C:\Windows\System\ShmuBWg.exe
  2⤵
  PID:11908
- C:\Windows\System\oKiLxoD.exe
  C:\Windows\System\oKiLxoD.exe
  2⤵
  PID:11952
- C:\Windows\System\IprlCvR.exe
  C:\Windows\System\IprlCvR.exe
  2⤵
  PID:12108
- C:\Windows\System\jnBKkxs.exe
  C:\Windows\System\jnBKkxs.exe
  2⤵
  PID:4868
- C:\Windows\System\QwIFZdl.exe
  C:\Windows\System\QwIFZdl.exe
  2⤵
  PID:748
- C:\Windows\System\icAuAtr.exe
  C:\Windows\System\icAuAtr.exe
  2⤵
  PID:12248
- C:\Windows\System\gYKHrpp.exe
  C:\Windows\System\gYKHrpp.exe
  2⤵
  PID:10432
- C:\Windows\System\ZowAUbN.exe
  C:\Windows\System\ZowAUbN.exe
  2⤵
  PID:11304
- C:\Windows\System\tLMRCAB.exe
  C:\Windows\System\tLMRCAB.exe
  2⤵
  PID:11476
- C:\Windows\System\OGUwFno.exe
  C:\Windows\System\OGUwFno.exe
  2⤵
  PID:4424
- C:\Windows\System\LCxKZxR.exe
  C:\Windows\System\LCxKZxR.exe
  2⤵
  PID:11944
- C:\Windows\System\wPmMcgE.exe
  C:\Windows\System\wPmMcgE.exe
  2⤵
  PID:11976
- C:\Windows\System\ZdJGYgO.exe
  C:\Windows\System\ZdJGYgO.exe
  2⤵
  PID:4524
- C:\Windows\System\jazOLwW.exe
  C:\Windows\System\jazOLwW.exe
  2⤵
  PID:12204
- C:\Windows\System\sBhYteI.exe
  C:\Windows\System\sBhYteI.exe
  2⤵
  PID:12224
- C:\Windows\System\bzBnqNl.exe
  C:\Windows\System\bzBnqNl.exe
  2⤵
  PID:10400
- C:\Windows\System\iJyZzdC.exe
  C:\Windows\System\iJyZzdC.exe
  2⤵
  PID:11508
- C:\Windows\System\geroVcY.exe
  C:\Windows\System\geroVcY.exe
  2⤵
  PID:6584
- C:\Windows\System\GNTiVCC.exe
  C:\Windows\System\GNTiVCC.exe
  2⤵
  PID:11852
- C:\Windows\System\zPzxJai.exe
  C:\Windows\System\zPzxJai.exe
  2⤵
  PID:12336
- C:\Windows\System\DjlspIH.exe
  C:\Windows\System\DjlspIH.exe
  2⤵
  PID:12352
- C:\Windows\System\XNYogWD.exe
  C:\Windows\System\XNYogWD.exe
  2⤵
  PID:12376
- C:\Windows\System\WuKkfeT.exe
  C:\Windows\System\WuKkfeT.exe
  2⤵
  PID:12400
- C:\Windows\System\UTTGufc.exe
  C:\Windows\System\UTTGufc.exe
  2⤵
  PID:12440
- C:\Windows\System\KBerAlU.exe
  C:\Windows\System\KBerAlU.exe
  2⤵
  PID:12460
- C:\Windows\System\XNVMktK.exe
  C:\Windows\System\XNVMktK.exe
  2⤵
  PID:12504
- C:\Windows\System\ojyUEJV.exe
  C:\Windows\System\ojyUEJV.exe
  2⤵
  PID:12540
- C:\Windows\System\BAxdzKY.exe
  C:\Windows\System\BAxdzKY.exe
  2⤵
  PID:12592
- C:\Windows\System\AdXoFjw.exe
  C:\Windows\System\AdXoFjw.exe
  2⤵
  PID:12612
- C:\Windows\System\eSPKoNd.exe
  C:\Windows\System\eSPKoNd.exe
  2⤵
  PID:12628
- C:\Windows\System\frBqfNW.exe
  C:\Windows\System\frBqfNW.exe
  2⤵
  PID:12656
- C:\Windows\System\VFWHoVo.exe
  C:\Windows\System\VFWHoVo.exe
  2⤵
  PID:12676
- C:\Windows\System\SJfokCE.exe
  C:\Windows\System\SJfokCE.exe
  2⤵
  PID:12752
- C:\Windows\System\gEIREBs.exe
  C:\Windows\System\gEIREBs.exe
  2⤵
  PID:12780
- C:\Windows\System\lQXFZoh.exe
  C:\Windows\System\lQXFZoh.exe
  2⤵
  PID:12800
- C:\Windows\System\IiuuWaV.exe
  C:\Windows\System\IiuuWaV.exe
  2⤵
  PID:12816
- C:\Windows\System\PwlFZTK.exe
  C:\Windows\System\PwlFZTK.exe
  2⤵
  PID:12832
- C:\Windows\System\RttiQkj.exe
  C:\Windows\System\RttiQkj.exe
  2⤵
  PID:12848
- C:\Windows\System\wIdrTFd.exe
  C:\Windows\System\wIdrTFd.exe
  2⤵
  PID:12864
- C:\Windows\System\guoEqqm.exe
  C:\Windows\System\guoEqqm.exe
  2⤵
  PID:12908
- C:\Windows\System\QTNkcyj.exe
  C:\Windows\System\QTNkcyj.exe
  2⤵
  PID:12928
- C:\Windows\System\RyDzRhK.exe
  C:\Windows\System\RyDzRhK.exe
  2⤵
  PID:12972
- C:\Windows\System\UchpnyY.exe
  C:\Windows\System\UchpnyY.exe
  2⤵
  PID:12992
- C:\Windows\System\EkLXbYm.exe
  C:\Windows\System\EkLXbYm.exe
  2⤵
  PID:13052
- C:\Windows\System\IDqhOKk.exe
  C:\Windows\System\IDqhOKk.exe
  2⤵
  PID:13088
- C:\Windows\System\vrmrgNZ.exe
  C:\Windows\System\vrmrgNZ.exe
  2⤵
  PID:13132
- C:\Windows\System\jOUrgTq.exe
  C:\Windows\System\jOUrgTq.exe
  2⤵
  PID:13152
- C:\Windows\System\thUQxKc.exe
  C:\Windows\System\thUQxKc.exe
  2⤵
  PID:13172
- C:\Windows\System\XqUTrcW.exe
  C:\Windows\System\XqUTrcW.exe
  2⤵
  PID:13220
- C:\Windows\System\iDYUNUz.exe
  C:\Windows\System\iDYUNUz.exe
  2⤵
  PID:13260
- C:\Windows\System\JPeQeQn.exe
  C:\Windows\System\JPeQeQn.exe
  2⤵
  PID:13280
- C:\Windows\System\dpqqVaj.exe
  C:\Windows\System\dpqqVaj.exe
  2⤵
  PID:13304
- C:\Windows\System\ryMQKay.exe
  C:\Windows\System\ryMQKay.exe
  2⤵
  PID:660
- C:\Windows\System\VgwHbRL.exe
  C:\Windows\System\VgwHbRL.exe
  2⤵
  PID:11332
- C:\Windows\System\THJSXnW.exe
  C:\Windows\System\THJSXnW.exe
  2⤵
  PID:12332
- C:\Windows\System\mRfprBk.exe
  C:\Windows\System\mRfprBk.exe
  2⤵
  PID:12364
- C:\Windows\System\buJZERV.exe
  C:\Windows\System\buJZERV.exe
  2⤵
  PID:12456
- C:\Windows\System\sqEISEe.exe
  C:\Windows\System\sqEISEe.exe
  2⤵
  PID:12584
- C:\Windows\System\StZGDBd.exe
  C:\Windows\System\StZGDBd.exe
  2⤵
  PID:12644
- C:\Windows\System\zqjOzyc.exe
  C:\Windows\System\zqjOzyc.exe
  2⤵
  PID:12684
- C:\Windows\System\AANgbdV.exe
  C:\Windows\System\AANgbdV.exe
  2⤵
  PID:12840
- C:\Windows\System\UNQPgHM.exe
  C:\Windows\System\UNQPgHM.exe
  2⤵
  PID:12808
- C:\Windows\System\lISXFek.exe
  C:\Windows\System\lISXFek.exe
  2⤵
  PID:12764
- C:\Windows\System\nXDvbUG.exe
  C:\Windows\System\nXDvbUG.exe
  2⤵
  PID:12860
- C:\Windows\System\GyMEroc.exe
  C:\Windows\System\GyMEroc.exe
  2⤵
  PID:12988
- C:\Windows\System\IMCELxd.exe
  C:\Windows\System\IMCELxd.exe
  2⤵
  PID:13076
- C:\Windows\System\kMFkHPX.exe
  C:\Windows\System\kMFkHPX.exe
  2⤵
  PID:13068
- C:\Windows\System\KqtjngU.exe
  C:\Windows\System\KqtjngU.exe
  2⤵
  PID:13124
- C:\Windows\System\BlgSEBr.exe
  C:\Windows\System\BlgSEBr.exe
  2⤵
  PID:13168
- C:\Windows\System\rICVwxC.exe
  C:\Windows\System\rICVwxC.exe
  2⤵
  PID:13248
- C:\Windows\System\oAEuwNK.exe
  C:\Windows\System\oAEuwNK.exe
  2⤵
  PID:13276
- C:\Windows\System\cKEuNyw.exe
  C:\Windows\System\cKEuNyw.exe
  2⤵
  PID:12384
- C:\Windows\System\IDPyLfV.exe
  C:\Windows\System\IDPyLfV.exe
  2⤵
  PID:12432
- C:\Windows\System\WabIzRY.exe
  C:\Windows\System\WabIzRY.exe
  2⤵
  PID:12524
- C:\Windows\System\vFmXPJg.exe
  C:\Windows\System\vFmXPJg.exe
  2⤵
  PID:12692
- C:\Windows\System\jkBgxPp.exe
  C:\Windows\System\jkBgxPp.exe
  2⤵
  PID:12480
- C:\Windows\System\udoXTyF.exe
  C:\Windows\System\udoXTyF.exe
  2⤵
  PID:12872
- C:\Windows\System\TvSHCuc.exe
  C:\Windows\System\TvSHCuc.exe
  2⤵
  PID:13184
- C:\Windows\System\qlSXYbX.exe
  C:\Windows\System\qlSXYbX.exe
  2⤵
  PID:4252
- C:\Windows\System\JQXeAwM.exe
  C:\Windows\System\JQXeAwM.exe
  2⤵
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wc4l34v3.qdy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ARkMbop.exe

Filesize
1.7MB

MD5
fe51a9cb28d9438a35d65fb10fa096af

SHA1
f5d0bfde15c3c7f9800600c0e9d593dce372b232

SHA256
57818dc00e830ab4c2f5e43d4bc6f1a28e9c308bf9cdd57a2c3ecd383fb7dcab

SHA512
261a9b361b386609140ae7340da0186fb3d538333252128423d14e92a10c05468b624b1a26d68dbdd5fafac54062c7b9450b7ba66b4121c9f73e56b2b7b0878e

Download Submit
C:\Windows\System\AwlwjkJ.exe

Filesize
1.7MB

MD5
9e5137fc04e17f21bfa0c4e886a39705

SHA1
b972d9be7232585b8cfaebf546241fde77654293

SHA256
66e3f6a7d7f3e8f6b5af79b2b8bccd47b17393cd4bba958eb168440d541085c9

SHA512
d5357ab189fa7e69716761dc4ef44d42fe9dc0b33154bfb4c1fd782dec3a0835fa41a463d7bb81a7471e6deb6f47a1e330d2da321162e733679777031e863a28

Download Submit
C:\Windows\System\DxTzkDi.exe

Filesize
1.7MB

MD5
6847f8543ce1cea1b85f35a3471c083a

SHA1
caf4bae299996cbdadf950892ac432a4e6af1586

SHA256
d2b438052d1850b42d60e92d7470b99b5880347e8315b9d830838ff1808120fa

SHA512
485d4437a0886f9b947f9139a8464f58dc06b61166078de4d7bfa43e3d0d24f1417fb6589030ca480075be8933718ea9340a76a500f09a1f547536b8d5a2db6d

Download Submit
C:\Windows\System\Ewzcbya.exe

Filesize
1.7MB

MD5
5f10d22d4d3f3b14703fae4b19148373

SHA1
d1e16a888d088537e814078619ee400f872ac11c

SHA256
f92484ae3f8c88bf69f68d1c382bb2507f9898838136d4909904aabf80348126

SHA512
7a5f91405286008b11926f34182a881aa7ebc547a8f2f8d1e7b470a7dd55c0a42e5c32533fc78431ac110d3be877af5f0cfb0fde5adcbaf4aba19e804b9d7b21

Download Submit
C:\Windows\System\FaQwzTR.exe

Filesize
1.7MB

MD5
36e36333284b09568eb3208cad1b75f5

SHA1
a8e1e016eeda15c1f545b4190fc293ac46c8ef9e

SHA256
2c0de2c92dbb48a60c5d62db602a659ff0c89fc9022d9cd698ec95f1272f7af1

SHA512
9783969ba4d415e1359be0580780b119a38d0e4b8eb602482506cdb7f037f8c68c8af583cfe7fe28956e6de66d79eb43b7afe6a263e6c47172e54d1a97f57b1b

Download Submit
C:\Windows\System\GmEouSU.exe

Filesize
1.7MB

MD5
bb081efe89f8a0d658e604deda8a8ae7

SHA1
ce538b434b8c33b3aa25ed9c6e0a2494b3728e97

SHA256
6dc79ab64f0af405f07c233261ed706f0170694bd08f941c940642bad0f9ef7a

SHA512
62a076fc4f9dc2f12a0f8ff8c0c3f88349da7366c7997fc373df059b90e992f8328b1bfec906b2c50c2f322fc418e7abbb7d2cab01295f05e3d78bb5cbfc7d2f

Download Submit
C:\Windows\System\HRIUItK.exe

Filesize
1.7MB

MD5
dd273c12200c90b2f310437a333bbcfe

SHA1
f905b316afbeefa544f847bf5b48219260a3ba56

SHA256
5c95bc61149ed80abde10cd559ec156fed648623b1694f7d634e4d7d0b2e3355

SHA512
2c97e9c0ac7a67ee7a296a471a62e69bf68e46170cb7a89ca380d175efa52d807cedabb43636bbdd818510cc478620a3e9640ee2e15d3f6d610af2b7e7b8dc05

Download Submit
C:\Windows\System\LcfhXsL.exe

Filesize
1.7MB

MD5
998f28e6515da0e0309470e4220f52d6

SHA1
6d1e920bd949e89a3039d9e84a63df369df82a2a

SHA256
bdb3cc4e489c09c3366b63e2642459652819a45859cb2364866073ac2a74ac15

SHA512
39a76f4444b8a220c9101bb88467e54a631cb365c0194285e4f129c41fbc2b8eda33f5bc1bbbdd17244f3b28b416dff26cdb1c78f2efb4b89ea475301c8b6c16

Download Submit
C:\Windows\System\NlRMpmt.exe

Filesize
1.7MB

MD5
a2ef7b75ba88c0dff05987e94c54b315

SHA1
2bb528dd3e843efcddffd69cf9b97cf0578e5fd6

SHA256
8561d3c420bf8894f67bc1d3aab18ad963b1c290486ce220725f202fb5f13dbb

SHA512
ae72220d530022a8c6f3e86aa1c70231186cb1924ef79f4fd901a991be8542e822e7459bd1055ce74497b4eb85b4c0dd7ff2325fe692b24c6f648797b133befa

Download Submit
C:\Windows\System\OZaPPox.exe

Filesize
1.7MB

MD5
3ef11bcff45db7af5ffa341c458eadac

SHA1
8c4bdf9d596201a80e852b7448c4c121bed7b377

SHA256
268656f4fd6aa9a42fe471685fea78215ebd74c8dbc96c75efcaf2ebaf4ee161

SHA512
74d2cd97331442f3faaeca7b99166f9afed4224ffda8586f5dd41223eb75faef11d0b1c4e948e0f3c8601da24254ca9cb1290ef5b26306419a4da4262630f6d9

Download Submit
C:\Windows\System\QrkrtgJ.exe

Filesize
1.7MB

MD5
2d3fa9415e08a54c1f0cef754918b0ba

SHA1
274f7a89222156553833f36a7ce8d4c9c6a9a752

SHA256
3d9ba919afb99050564d26ab442762e8f8a3b5935aa5c10f37805d6bc55b56d0

SHA512
967821f290d4aec46bc3accaee6e74d914f6201dfca52061659a51e11b3a8723b89100165da277b4a8085349630bec0a22876e0bd334731a65537f41cda92018

Download Submit
C:\Windows\System\RaruZXL.exe

Filesize
8B

MD5
4585af961e6be7f3b03d075298565b62

SHA1
8e84c60639225761f581ea4ec1ff9a2d8e5472c9

SHA256
b8920be4ca9181e84576dfb449141c7d9af40d7ddc5588ea3cac8c68ef3a0a88

SHA512
aca862ef42a6056537a17dcbf9d8778efa38fbecbcb6ce3dce02a2eb0f5b9ffb56a667b21c26a29159a0ebcd14d21a77c5b25a36880c46863acba28da90e75f0

Download Submit
C:\Windows\System\SWNurwj.exe

Filesize
1.7MB

MD5
a4e94f044199d10ad3484ea84c37da03

SHA1
a082669a9554ed8a72dc1edacb59e8b9975cef19

SHA256
df3def3f413c9694021892e971eead48506eb7fd093be5542498495b02acf26e

SHA512
003b17511d3f434219dc519545817d10abf9326efaf0eada2613f1768d973680e1e641f83d30667cbc04aef10db3c60e3ba852c622f9d35096ca4e62e51119c7

Download Submit
C:\Windows\System\SpioCit.exe

Filesize
1.7MB

MD5
ada8ed5776d69426d135bf3f2b8407ec

SHA1
4440a1b1c95953e078aa59ce4b51855c00c2e0a1

SHA256
3f2e683151ab2404a0cbe3bf2b7e0d381faa2b24a072e1dcb97a3d8d058fe46e

SHA512
80198ac2ccfb8ae98f3b2236898a214c7322949c6a216fa72390c0248973d0e6430e4f8e89609b24dee97ba5bf4eccfde6ceb63b607f6ea72cfbaaee5222832f

Download Submit
C:\Windows\System\UDOqQvV.exe

Filesize
1.7MB

MD5
2418f2504c1a68d917883fdbe7d53f0d

SHA1
f293c429bec6d0834fd8ddce98186da3f1dd942d

SHA256
9f54457d6c88048002a5b89fabb575d4e5e54983a4de04451e7bbc425389f95b

SHA512
7bde0de2f3df9dfc8e8a056c2c4ef803ffc0d7eb71d98dd1b059b9b1ed4bb33e87860757d5ea27e932ea687384520ce1746b8c17f4648bcfc53be840b9298f5a

Download Submit
C:\Windows\System\UIpOdAY.exe

Filesize
1.7MB

MD5
2c01a4db9a815ae232939eab86303d11

SHA1
0a98ed2d68af4928ea13243d6846c79ceb9fac17

SHA256
73834379571fff38cff8ad2f32cc41b07e077d53e110931711099499e3888eed

SHA512
c8070ac808db2ba865cb1eb6e5d67b938915d3394f7bf871b9159fdce1a6886a8c4fa0361a50446ce52aebe284629a6977e32a87e117df6d0b636ec5ec3abbf0

Download Submit
C:\Windows\System\ZQBattv.exe

Filesize
1.7MB

MD5
d1263c186b6ba870c8be277e3ab91a15

SHA1
d0090a7cfdbd3d5ae7d6fb5610736a6f4729dd5e

SHA256
33815ad64b0079d0521db01416477ec983ff12bcc6f855a23dd4e5cc7cdc1549

SHA512
3aae547bdb647c22e811e95eed0d611519b7b433d97cb5c2aeed16fb56b0c9ae5c8359e0b4f8a558fdc935b79b6978e9859cfbd878ec90d300707d82086c1f6d

Download Submit
C:\Windows\System\ZhTQGfy.exe

Filesize
1.7MB

MD5
759fda4507c9e732454456644af22d4f

SHA1
15addebc29d60dedcb52bf54cd68c3fe636c9960

SHA256
1becdb448b2c154b42d56d315467cbbe29ec8222c82c4f9ca3f67fba8edf7689

SHA512
562c25b46a4214bda1dec52e280f832a68d25cd39a88cdbc4cb9cc293168b6eb83be9f91987b2f7aa6a29c7c595d069803a0a1e664b008a93e72536de303b0d2

Download Submit
C:\Windows\System\bSzhDeG.exe

Filesize
1.7MB

MD5
60b49976d6ea31f0571a432f029e84c5

SHA1
1da04c81cfad36e0e4f0a1d4bfb2b3d00baefd2b

SHA256
f93fb73057335aeb4a0f7017dfae7295391c96864ecaa3ae18b5a46df7588cb1

SHA512
dfeca7ebf6a927b8bf7b40461b621e263a2b383ca43b6e04f06272641580d19fa9c523498ab843a27a4d8360e66439bae45a4cbceeb97e0d1b9098178e2d1ddf

Download Submit
C:\Windows\System\bvhCmkj.exe

Filesize
1.7MB

MD5
322028e580ad77de3bef584e97e9b689

SHA1
b835797918ff6cce4f24120d0c99380611b8dfbb

SHA256
03273e26b374f3885569741c64e814e4b52f9333cd93bd5746975c8e5cb4250b

SHA512
f2745cc5497e3659dcc3d4715296de4a33444b1a69232002563151ece75b57ba1415beb2881304512db7301a1d2d03f5ec8bfc880a8176b29a192cb8cb643e1a

Download Submit
C:\Windows\System\dBoitvT.exe

Filesize
1.7MB

MD5
c87297192fe159b7fd22e128d103a930

SHA1
c8551d012842418035b083d863b10b09fdd1c82b

SHA256
289fbcd2bc73e66bf66c7adacb58a7547c5660f0485da928f5f50918c1dab2ce

SHA512
88bb2e2c33b626d807555c78cd09981ebe1798ea9dde7b19bb7e40532ce993c72ac109505f3ac7f9376acd8546250658f110c087256f36715231c22ca87b74f8

Download Submit
C:\Windows\System\dQdrAlN.exe

Filesize
1.7MB

MD5
9fc0779d2b1d3bdd456470f04d6c4fd1

SHA1
705c0b075ff673e3c4d0e5e8f7291d6ac9d50768

SHA256
194dfcfecd6f767ebcda360e8e61a036d0f60cd01d5df875c48c0f8606dab8f3

SHA512
609f5cccedb909866c8897e34ac05c9f6ae34fe67d7a54ed7b17026fb8bfdbb0697e0beacf3897c174aa25a5cddf0ee9d13eb0a42466ed39f111660c3e7db69f

Download Submit
C:\Windows\System\dtPZlci.exe

Filesize
1.7MB

MD5
28bab842c913fd61d8f5af2dce18490b

SHA1
78e5629896f5ab6f3df3cdff11a7c4386ec1d2d6

SHA256
f2237f4f67173f05f56a73fbaccda8579aa19f64eb5c6fb119c75e5685f235ea

SHA512
f0ff9e94d61a65c85945539ffaf65c7b55781be3c803825d84172648faf5fc7bc559a3a0181e8e435eb7c8efe56809c5007121320bc5ce6088aedf03ccf83465

Download Submit
C:\Windows\System\ezLdZBg.exe

Filesize
1.7MB

MD5
b0c5fd09b3b92bf89537c62a891495c5

SHA1
4c6a9446bb001bf19d1ccdf230064da8cfd973fa

SHA256
7b6997c4771469f43e82e01008f95465556ed417019e81e34810f8d3e2014136

SHA512
9c10d475ac5b11884293603cefd24aaae7a030ee7bfcdf2fe65c71d0493677fca929d14c7f8db555fca713cc63382187f38011d5dd902f35db47f2b4a8960680

Download Submit
C:\Windows\System\gldYCbk.exe

Filesize
1.7MB

MD5
c5e1ef51a9d46124ab19cde9e48e94b3

SHA1
9adf5889bd4db8f8f328f3091373c5722d98d51b

SHA256
33e7f629250b825bf69c2ad7f45608249c846983d3bf4ce308b9e807cd97dbd9

SHA512
47e17a61c33916e7beefd5f2fed2344f2a08a9d2c4fe0138b7f8067d6426f76d2b4e1d5f48c43ec5bb0036d8c3af9e4b89716bf92a098e55cb6a40829e8392cb

Download Submit
C:\Windows\System\lBLuMke.exe

Filesize
1.7MB

MD5
4284263901e41dc496808692b4ae604c

SHA1
1085ec5fafea7a841ee1dc8440011b3ff8e9c8e7

SHA256
a51e3562a578b9afffa4ba9c2d15efa8f244cd87d80c6e8f246f7d5a9b1f9eb1

SHA512
47d06094c7d871629c48dc48d2dfd91ba74385dd4ce5e3de262005ec2b73ff207e915ef92e8d46969fac492562afc3065d3d571439a337e045d99ed53c6023d7

Download Submit
C:\Windows\System\nvdFuPi.exe

Filesize
1.7MB

MD5
df55664e59b7a209dc552213093cd6bb

SHA1
41eefd230fffa2c60fa3a0f458ca7197d8170d5f

SHA256
9e587b92512f79475abe0ae4296aad094cd7cc11fb9656c51f4fc81c4ccc5a8b

SHA512
b7fe9f8e879bbf8c55f9635f6cec4756cf7435afb25a083018c38b3100dc1067a3e89bb03a90dae580d7cd30279d9f1dbddc2cfda2042338ed83a9feb325b4e4

Download Submit
C:\Windows\System\nxIrGtl.exe

Filesize
1.7MB

MD5
973d005627d5a0678d97ee5a983dfc21

SHA1
aff973d33144ff7894d9b03f9c2dd3420cecc52a

SHA256
fecaab4f429bb4ba9bccbc692882f9d9faa1e121ad338123cb5aef68ba22b3c3

SHA512
ddc0f6b04a2304b085aa2cd66753b2d3a6a6b7be1cfe0c4c0bb8c6041277de3865873f67faeea66b2e13f45e0b88468a96d39def1deae65b77964c0a52b5b053

Download Submit
C:\Windows\System\rTdbUmZ.exe

Filesize
1.7MB

MD5
5dfc04133f5614f2af5f33aa7639edb1

SHA1
fa82c24561d8e28511e5cfc4b5d2c5764e7d5213

SHA256
f2352c85abaa387c72d2cda64e572e6023772ede92a89bda79fee153f620b4d5

SHA512
fc30cda70dc697a1da126316a4cf8ab861f546ba556a2f9c9067b80d66aa91785d1e6df74990a332c6552e75186bf6827287bd0c21c203c49f52ff82eee18c27

Download Submit
C:\Windows\System\tudECJR.exe

Filesize
1.7MB

MD5
806abee81b62e44f86ad2b2a99086a12

SHA1
46cf6226e2fe934deb317bbb354f312cbde3e315

SHA256
ea79a036065d7a83ff2cd60dd7df8d025138ab5209e73b9d74e27a75ba5141d3

SHA512
44771958c6fa6d75a4f3f7469b616d6aef91e9d97a26f9c2f537f5ee493636bd217cc6a9509c55c47816189eeb2363491d33795a1a5fde3e55eac8a4296a22b3

Download Submit
C:\Windows\System\uUzxyBV.exe

Filesize
1.7MB

MD5
2a2885f604af15a544a7705066ffad9f

SHA1
7a824fb72518496df578eca5e1610683f41a1886

SHA256
6c2a29e9bca6ee35a1afd8af10764f668d95220a01809cbe96da980417eef3bd

SHA512
be44b31fadc587b2b1fc57bc2ae660fe52634aeeea5c5062b2a284c55b2819e3d4fd08ceaefc72f2156c863a37546c877f8b23fc215aa98b3855c003be407ef9

Download Submit
C:\Windows\System\vkVcLGv.exe

Filesize
1.7MB

MD5
c8bce34ff5ceeab27fce85630fb3e338

SHA1
b2f7379d297fa9c4809d59d7f8983dfba1f544da

SHA256
f03ebba8c07bf1eb44a53cf21895e0d37ed5ff1ac274340b8bcabee3f97709f9

SHA512
16e15ab6b8d457998f3ad23c55a434e60fc27ce30d84d66a3e10fea583703cacaedf747f39a92d38460b13cc1111f109f6ebe21143a4ca14759da6765a3a78e6

Download Submit
C:\Windows\System\ypVyKCo.exe

Filesize
1.7MB

MD5
aeec9dae6b19fe61222704add3cf008a

SHA1
6aad887c539eddcc11b59b69876fdc9c1ea4fe96

SHA256
db4e3fd2b11f73f37a160e2663c9dbda35df0b7afef594116089fba938ecc176

SHA512
e5cf739712e3629885918c2efba55c4976b5079d87544976702b2e25d98fdb1ccbdc574e6b728f23b987c12709f5d9f68731bb063467a91cb26e276e7b350563

Download Submit
C:\Windows\System\zFQfmft.exe

Filesize
1.7MB

MD5
4fe644d05cf9b22813d5a0dd97a98f66

SHA1
586a3c2149ace9021e218c65b67add7cd124ce95

SHA256
a7fc52bb62c1f87f9714a18c7e97363832e6545152137af36c1d9974e93b4e23

SHA512
f001e43d298bad863ef6ffa6acda61e94f65517ab74df399ef6f6313cdd283cd45d3c9139b2daa513db6624ab0fb36847adf13d0e00de2d98786c32c0709b244

Download Submit
memory/112-1180-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp

Filesize
3.9MB

Download
memory/112-2588-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp

Filesize
3.9MB

Download
memory/112-15-0x00007FF6299F0000-0x00007FF629DE2000-memory.dmp

Filesize
3.9MB

Download
memory/220-2612-0x00007FF76C7E0000-0x00007FF76CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/220-112-0x00007FF76C7E0000-0x00007FF76CBD2000-memory.dmp

Filesize
3.9MB

Download
memory/816-161-0x00007FF619AB0000-0x00007FF619EA2000-memory.dmp

Filesize
3.9MB

Download
memory/816-2585-0x00007FF619AB0000-0x00007FF619EA2000-memory.dmp

Filesize
3.9MB

Download
memory/816-2634-0x00007FF619AB0000-0x00007FF619EA2000-memory.dmp

Filesize
3.9MB

Download
memory/952-2619-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp

Filesize
3.9MB

Download
memory/952-125-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp

Filesize
3.9MB

Download
memory/952-2516-0x00007FF77FCE0000-0x00007FF7800D2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-2606-0x00007FF70DB80000-0x00007FF70DF72000-memory.dmp

Filesize
3.9MB

Download
memory/1636-104-0x00007FF70DB80000-0x00007FF70DF72000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2551-0x00007FF60DC50000-0x00007FF60E042000-memory.dmp

Filesize
3.9MB

Download
memory/1936-149-0x00007FF60DC50000-0x00007FF60E042000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2630-0x00007FF60DC50000-0x00007FF60E042000-memory.dmp

Filesize
3.9MB

Download
memory/1972-117-0x00007FF67F570000-0x00007FF67F962000-memory.dmp

Filesize
3.9MB

Download
memory/1972-2614-0x00007FF67F570000-0x00007FF67F962000-memory.dmp

Filesize
3.9MB

Download
memory/2020-2599-0x00007FF6A63A0000-0x00007FF6A6792000-memory.dmp

Filesize
3.9MB

Download
memory/2020-52-0x00007FF6A63A0000-0x00007FF6A6792000-memory.dmp

Filesize
3.9MB

Download
memory/2168-109-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-2452-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-2822-0x00007FF695EB0000-0x00007FF6962A2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-95-0x00007FF680A20000-0x00007FF680E12000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2608-0x00007FF680A20000-0x00007FF680E12000-memory.dmp

Filesize
3.9MB

Download
memory/2240-85-0x00007FF693FE0000-0x00007FF6943D2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2600-0x00007FF693FE0000-0x00007FF6943D2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-100-0x00007FF7BA3D0000-0x00007FF7BA7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-2603-0x00007FF7BA3D0000-0x00007FF7BA7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-12-0x00007FF684780000-0x00007FF684B72000-memory.dmp

Filesize
3.9MB

Download
memory/2924-1179-0x00007FF684780000-0x00007FF684B72000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2568-0x00007FF684780000-0x00007FF684B72000-memory.dmp

Filesize
3.9MB

Download
memory/2992-2610-0x00007FF6CD9E0000-0x00007FF6CDDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-108-0x00007FF6CD9E0000-0x00007FF6CDDD2000-memory.dmp

Filesize
3.9MB

Download
memory/3084-96-0x00007FF62B7F0000-0x00007FF62BBE2000-memory.dmp

Filesize
3.9MB

Download
memory/3084-2594-0x00007FF62B7F0000-0x00007FF62BBE2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-137-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-2549-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-2621-0x00007FF69F0F0000-0x00007FF69F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3264-2616-0x00007FF698330000-0x00007FF698722000-memory.dmp

Filesize
3.9MB

Download
memory/3264-121-0x00007FF698330000-0x00007FF698722000-memory.dmp

Filesize
3.9MB

Download
memory/3672-2533-0x00007FF6A30B0000-0x00007FF6A34A2000-memory.dmp

Filesize
3.9MB

Download
memory/3672-131-0x00007FF6A30B0000-0x00007FF6A34A2000-memory.dmp

Filesize
3.9MB

Download
memory/3672-2622-0x00007FF6A30B0000-0x00007FF6A34A2000-memory.dmp

Filesize
3.9MB

Download
memory/3828-1813-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/3828-2560-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/3828-51-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp

Filesize
10.8MB

Download
memory/3828-80-0x000002427F3E0000-0x000002427F402000-memory.dmp

Filesize
136KB

Download
memory/3828-25-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp

Filesize
8KB

Download
memory/3828-23-0x000002427F720000-0x000002427F730000-memory.dmp

Filesize
64KB

Download
memory/3828-895-0x000002427FEE0000-0x0000024280686000-memory.dmp

Filesize
7.6MB

Download
memory/3828-2148-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp

Filesize
8KB

Download
memory/4092-2592-0x00007FF62A280000-0x00007FF62A672000-memory.dmp

Filesize
3.9MB

Download
memory/4092-67-0x00007FF62A280000-0x00007FF62A672000-memory.dmp

Filesize
3.9MB

Download
memory/4200-1-0x000001B5D9FD0000-0x000001B5D9FE0000-memory.dmp

Filesize
64KB

Download
memory/4200-1174-0x00007FF60A4D0000-0x00007FF60A8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4200-0-0x00007FF60A4D0000-0x00007FF60A8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-2597-0x00007FF736550000-0x00007FF736942000-memory.dmp

Filesize
3.9MB

Download
memory/4280-81-0x00007FF736550000-0x00007FF736942000-memory.dmp

Filesize
3.9MB

Download
memory/4448-91-0x00007FF7A3F80000-0x00007FF7A4372000-memory.dmp

Filesize
3.9MB

Download
memory/4448-2604-0x00007FF7A3F80000-0x00007FF7A4372000-memory.dmp

Filesize
3.9MB

Download
memory/4568-1802-0x00007FF694C30000-0x00007FF695022000-memory.dmp

Filesize
3.9MB

Download
memory/4568-2590-0x00007FF694C30000-0x00007FF695022000-memory.dmp

Filesize
3.9MB

Download
memory/4568-21-0x00007FF694C30000-0x00007FF695022000-memory.dmp

Filesize
3.9MB

Download
memory/4652-143-0x00007FF65A7C0000-0x00007FF65ABB2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2550-0x00007FF65A7C0000-0x00007FF65ABB2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2624-0x00007FF65A7C0000-0x00007FF65ABB2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2563-0x00007FF707DB0000-0x00007FF7081A2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2627-0x00007FF707DB0000-0x00007FF7081A2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-155-0x00007FF707DB0000-0x00007FF7081A2000-memory.dmp

Filesize
3.9MB

Download