xmrig | a170957e819b3b758a304ae16a074a11a2af404cf7001d95238e5450d1d7c189

Analysis

max time kernel
96s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
Size

3.0MB
MD5

386d50eaf38d464d5a8b6ceb8a283d20
SHA1

31be985a18b4f4e43896a410486dd30afb87a099
SHA256

a170957e819b3b758a304ae16a074a11a2af404cf7001d95238e5450d1d7c189
SHA512

777684fd891a78d01bf787ed07d9677e7e8b7d15954cbab1a649fdbbf0c4d3df084ddc858bfee165dd2fde4aa686f55cdcd3780ba9c2d45f22df1e7feffa922f
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:7bBeSFkq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4624-0-0x00007FF66BC10000-0x00007FF66C006000-memory.dmp	xmrig
behavioral2/files/0x00080000000233eb-6.dat	xmrig
behavioral2/files/0x00070000000233ef-22.dat	xmrig
behavioral2/files/0x00080000000233f1-27.dat	xmrig
behavioral2/files/0x00070000000233f2-37.dat	xmrig
behavioral2/files/0x00070000000233f3-41.dat	xmrig
behavioral2/files/0x00070000000233f6-56.dat	xmrig
behavioral2/memory/2672-53-0x00007FF6A99E0000-0x00007FF6A9DD6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-69.dat	xmrig
behavioral2/files/0x00070000000233f8-75.dat	xmrig
behavioral2/files/0x00070000000233f9-77.dat	xmrig
behavioral2/memory/4844-81-0x00007FF7244A0000-0x00007FF724896000-memory.dmp	xmrig
behavioral2/memory/1104-85-0x00007FF6A6420000-0x00007FF6A6816000-memory.dmp	xmrig
behavioral2/memory/3016-87-0x00007FF706E80000-0x00007FF707276000-memory.dmp	xmrig
behavioral2/memory/3096-86-0x00007FF725170000-0x00007FF725566000-memory.dmp	xmrig
behavioral2/memory/2776-84-0x00007FF681150000-0x00007FF681546000-memory.dmp	xmrig
behavioral2/memory/5032-74-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp	xmrig
behavioral2/memory/3988-73-0x00007FF70E320000-0x00007FF70E716000-memory.dmp	xmrig
behavioral2/memory/1116-68-0x00007FF746B20000-0x00007FF746F16000-memory.dmp	xmrig
behavioral2/memory/1016-59-0x00007FF74C720000-0x00007FF74CB16000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-58.dat	xmrig
behavioral2/memory/3888-57-0x00007FF69D830000-0x00007FF69DC26000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-51.dat	xmrig
behavioral2/memory/4208-38-0x00007FF6E5350000-0x00007FF6E5746000-memory.dmp	xmrig
behavioral2/files/0x00080000000233f0-31.dat	xmrig
behavioral2/files/0x00070000000233fa-95.dat	xmrig
behavioral2/files/0x00070000000233fb-102.dat	xmrig
behavioral2/memory/4644-107-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp	xmrig
behavioral2/memory/2668-106-0x00007FF775880000-0x00007FF775C76000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-103.dat	xmrig
behavioral2/files/0x00080000000233ec-98.dat	xmrig
behavioral2/memory/3376-110-0x00007FF757140000-0x00007FF757536000-memory.dmp	xmrig
behavioral2/memory/4592-119-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-130.dat	xmrig
behavioral2/files/0x0007000000023400-134.dat	xmrig
behavioral2/files/0x0007000000023401-136.dat	xmrig
behavioral2/memory/4728-140-0x00007FF6EA1F0000-0x00007FF6EA5E6000-memory.dmp	xmrig
behavioral2/memory/4272-143-0x00007FF6D95B0000-0x00007FF6D99A6000-memory.dmp	xmrig
behavioral2/memory/2304-149-0x00007FF7FA8C0000-0x00007FF7FACB6000-memory.dmp	xmrig
behavioral2/memory/1524-151-0x00007FF7FD5A0000-0x00007FF7FD996000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-153.dat	xmrig
behavioral2/files/0x0007000000023404-152.dat	xmrig
behavioral2/memory/5088-150-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp	xmrig
behavioral2/memory/1840-147-0x00007FF6748B0000-0x00007FF674CA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-138.dat	xmrig
behavioral2/memory/3804-126-0x00007FF756910000-0x00007FF756D06000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fd-123.dat	xmrig
behavioral2/files/0x0007000000023405-167.dat	xmrig
behavioral2/files/0x000700000001d9e8-176.dat	xmrig
behavioral2/files/0x000200000001e702-233.dat	xmrig
behavioral2/files/0x0007000000023411-248.dat	xmrig
behavioral2/files/0x0007000000023414-246.dat	xmrig
behavioral2/files/0x0007000000023415-254.dat	xmrig
behavioral2/memory/908-238-0x00007FF7B3E00000-0x00007FF7B41F6000-memory.dmp	xmrig
behavioral2/memory/4624-232-0x00007FF66BC10000-0x00007FF66C006000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-313.dat	xmrig
behavioral2/files/0x0007000000023429-316.dat	xmrig
behavioral2/files/0x000700000002342d-365.dat	xmrig
behavioral2/files/0x000700000002343c-377.dat	xmrig
behavioral2/memory/5032-991-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp	xmrig
behavioral2/memory/3804-1830-0x00007FF756910000-0x00007FF756D06000-memory.dmp	xmrig
behavioral2/memory/4592-1827-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp	xmrig
behavioral2/memory/4644-1824-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp	xmrig
behavioral2/memory/5088-2275-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
7	3604	powershell.exe
9	3604	powershell.exe
15	3604	powershell.exe
16	3604	powershell.exe
20	3604	powershell.exe
28	3604	powershell.exe
29	3604	powershell.exe
30	3604	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3604	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4208	lETGEuS.exe
2672	LDiKmCJ.exe
3888	fEmHwql.exe
1016	XFvYsyz.exe
4844	NWOvkJl.exe
2776	MoVKLyg.exe
1116	lawgivo.exe
3988	JDpxQlc.exe
1104	qFovwMN.exe
3096	FtyatZH.exe
5032	FPbryvb.exe
3016	ArTytdG.exe
2668	CpiVZVd.exe
3376	ABAeFVx.exe
4592	ZqLXtYq.exe
4644	QrnBbUN.exe
4728	siAWyky.exe
3804	sBFFoEA.exe
4272	ZTgoCAI.exe
2304	HIaEakX.exe
1840	IOwfoIA.exe
5088	WdvVZfg.exe
1524	IvzlUTg.exe
908	yuqyHci.exe
2636	xKdgzGi.exe
3420	ewWBaMt.exe
3568	qIUXalC.exe
3876	RBbCKuS.exe
3268	THnyyQs.exe
2952	DEEXcuA.exe
380	WImtZzT.exe
2900	JUYdpQf.exe
2632	sjHmDUA.exe
2880	JBWiFNj.exe
3652	HGSmcIy.exe
3696	AyqlLAY.exe
2288	aiQOIHU.exe
2732	KZVqjyV.exe
3328	KFjdnrN.exe
4556	EYTfvgM.exe
1752	tDYaYgO.exe
3552	jyMmnao.exe
2392	nGBfzqS.exe
2056	qOOaqYZ.exe
3200	VtCVvWA.exe
3132	XkmlOnq.exe
3788	OmUJTtL.exe
4760	mGlddRY.exe
1424	JYOQgeW.exe
3260	KbDylRt.exe
3976	hBTJsdV.exe
4648	DGgnxYI.exe
2332	mOKbITM.exe
1964	quZgZEL.exe
4460	tevZqIW.exe
4200	ROipgWl.exe
3032	CBQiuhK.exe
4428	JEDJPJa.exe
4904	YyZrBst.exe
3704	ZOgenIM.exe
4812	yURhiui.exe
732	WfLYMCy.exe
2560	JnFdzJb.exe
384	AfJNCqj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-0-0x00007FF66BC10000-0x00007FF66C006000-memory.dmp	upx
behavioral2/files/0x00080000000233eb-6.dat	upx
behavioral2/files/0x00070000000233ef-22.dat	upx
behavioral2/files/0x00080000000233f1-27.dat	upx
behavioral2/files/0x00070000000233f2-37.dat	upx
behavioral2/files/0x00070000000233f3-41.dat	upx
behavioral2/files/0x00070000000233f6-56.dat	upx
behavioral2/memory/2672-53-0x00007FF6A99E0000-0x00007FF6A9DD6000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-69.dat	upx
behavioral2/files/0x00070000000233f8-75.dat	upx
behavioral2/files/0x00070000000233f9-77.dat	upx
behavioral2/memory/4844-81-0x00007FF7244A0000-0x00007FF724896000-memory.dmp	upx
behavioral2/memory/1104-85-0x00007FF6A6420000-0x00007FF6A6816000-memory.dmp	upx
behavioral2/memory/3016-87-0x00007FF706E80000-0x00007FF707276000-memory.dmp	upx
behavioral2/memory/3096-86-0x00007FF725170000-0x00007FF725566000-memory.dmp	upx
behavioral2/memory/2776-84-0x00007FF681150000-0x00007FF681546000-memory.dmp	upx
behavioral2/memory/5032-74-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp	upx
behavioral2/memory/3988-73-0x00007FF70E320000-0x00007FF70E716000-memory.dmp	upx
behavioral2/memory/1116-68-0x00007FF746B20000-0x00007FF746F16000-memory.dmp	upx
behavioral2/memory/1016-59-0x00007FF74C720000-0x00007FF74CB16000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-58.dat	upx
behavioral2/memory/3888-57-0x00007FF69D830000-0x00007FF69DC26000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-51.dat	upx
behavioral2/memory/4208-38-0x00007FF6E5350000-0x00007FF6E5746000-memory.dmp	upx
behavioral2/files/0x00080000000233f0-31.dat	upx
behavioral2/files/0x00070000000233fa-95.dat	upx
behavioral2/files/0x00070000000233fb-102.dat	upx
behavioral2/memory/4644-107-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp	upx
behavioral2/memory/2668-106-0x00007FF775880000-0x00007FF775C76000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-103.dat	upx
behavioral2/files/0x00080000000233ec-98.dat	upx
behavioral2/memory/3376-110-0x00007FF757140000-0x00007FF757536000-memory.dmp	upx
behavioral2/memory/4592-119-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-130.dat	upx
behavioral2/files/0x0007000000023400-134.dat	upx
behavioral2/files/0x0007000000023401-136.dat	upx
behavioral2/memory/4728-140-0x00007FF6EA1F0000-0x00007FF6EA5E6000-memory.dmp	upx
behavioral2/memory/4272-143-0x00007FF6D95B0000-0x00007FF6D99A6000-memory.dmp	upx
behavioral2/memory/2304-149-0x00007FF7FA8C0000-0x00007FF7FACB6000-memory.dmp	upx
behavioral2/memory/1524-151-0x00007FF7FD5A0000-0x00007FF7FD996000-memory.dmp	upx
behavioral2/files/0x0007000000023403-153.dat	upx
behavioral2/files/0x0007000000023404-152.dat	upx
behavioral2/memory/5088-150-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp	upx
behavioral2/memory/1840-147-0x00007FF6748B0000-0x00007FF674CA6000-memory.dmp	upx
behavioral2/files/0x0007000000023402-138.dat	upx
behavioral2/memory/3804-126-0x00007FF756910000-0x00007FF756D06000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-123.dat	upx
behavioral2/files/0x0007000000023405-167.dat	upx
behavioral2/files/0x000700000001d9e8-176.dat	upx
behavioral2/files/0x000200000001e702-233.dat	upx
behavioral2/files/0x0007000000023411-248.dat	upx
behavioral2/files/0x0007000000023414-246.dat	upx
behavioral2/files/0x0007000000023415-254.dat	upx
behavioral2/memory/908-238-0x00007FF7B3E00000-0x00007FF7B41F6000-memory.dmp	upx
behavioral2/memory/4624-232-0x00007FF66BC10000-0x00007FF66C006000-memory.dmp	upx
behavioral2/files/0x0007000000023418-313.dat	upx
behavioral2/files/0x0007000000023429-316.dat	upx
behavioral2/files/0x000700000002342d-365.dat	upx
behavioral2/files/0x000700000002343c-377.dat	upx
behavioral2/memory/5032-991-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp	upx
behavioral2/memory/3804-1830-0x00007FF756910000-0x00007FF756D06000-memory.dmp	upx
behavioral2/memory/4592-1827-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp	upx
behavioral2/memory/4644-1824-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp	upx
behavioral2/memory/5088-2275-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DmedByQ.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\adKnAol.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\hiiVFGL.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\YyZrBst.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\tCBDiAc.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\VHiFBPs.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\GvjsHIH.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\iFHJbjL.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\XFvYsyz.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\ifPMalv.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\jeNDaun.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\QungFLZ.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\OEsgbAq.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\HKKbBWC.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\IBoEMQn.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\TIpTsml.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\NzqXWPE.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\RIvZYuM.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\eZPYzgm.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\VesMeaB.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\RnTHoZg.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\fuGRdDt.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\itjlpQt.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\BACYAPl.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\fvtoOdf.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\dSKjNmR.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\mHdGsXT.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\FFxcyJO.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\jLfKWLs.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\oeGiYQc.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\XTLtxfA.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\DIriFVh.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\ZTgoCAI.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\IKbXneN.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\OFeBaYW.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\fgOsboZ.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\kwgUpwo.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\AyqlLAY.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\rvgaNum.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\plWtfTm.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\khUnMfv.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\qoxCuhO.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\beGvxXc.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\EYTfvgM.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\nFtNnTz.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\nSTIczA.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\UPFmkLk.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\exveQNB.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\DzJsSOk.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\zwyBBuu.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\oJKJLMN.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\nNWxNDK.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\aOpYYFz.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\wIKJYOF.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\sTKqFml.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\IFUEBOk.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\NlegfnK.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\CpiVZVd.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\cxECxTK.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\QPTLkAy.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\ZVMhiLp.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\eaPqAbN.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\OFgQFLV.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
File created	C:\Windows\System\TSyADXO.exe	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3604	powershell.exe
3604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeLockMemoryPrivilege	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3604	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	81
PID 4624 wrote to memory of 3604	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	81
PID 4624 wrote to memory of 4208	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	82
PID 4624 wrote to memory of 4208	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	82
PID 4624 wrote to memory of 2672	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	83
PID 4624 wrote to memory of 2672	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	83
PID 4624 wrote to memory of 3888	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	84
PID 4624 wrote to memory of 3888	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	84
PID 4624 wrote to memory of 1016	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	85
PID 4624 wrote to memory of 1016	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	85
PID 4624 wrote to memory of 4844	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	86
PID 4624 wrote to memory of 4844	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	86
PID 4624 wrote to memory of 2776	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	87
PID 4624 wrote to memory of 2776	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	87
PID 4624 wrote to memory of 1116	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	88
PID 4624 wrote to memory of 1116	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	88
PID 4624 wrote to memory of 3988	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	89
PID 4624 wrote to memory of 3988	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	89
PID 4624 wrote to memory of 1104	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	90
PID 4624 wrote to memory of 1104	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	90
PID 4624 wrote to memory of 3096	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	91
PID 4624 wrote to memory of 3096	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	91
PID 4624 wrote to memory of 5032	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	92
PID 4624 wrote to memory of 5032	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	92
PID 4624 wrote to memory of 3016	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	93
PID 4624 wrote to memory of 3016	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	93
PID 4624 wrote to memory of 2668	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	94
PID 4624 wrote to memory of 2668	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	94
PID 4624 wrote to memory of 3376	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	95
PID 4624 wrote to memory of 3376	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	95
PID 4624 wrote to memory of 4592	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	96
PID 4624 wrote to memory of 4592	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	96
PID 4624 wrote to memory of 4644	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	97
PID 4624 wrote to memory of 4644	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	97
PID 4624 wrote to memory of 4728	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	98
PID 4624 wrote to memory of 4728	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	98
PID 4624 wrote to memory of 3804	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	99
PID 4624 wrote to memory of 3804	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	99
PID 4624 wrote to memory of 4272	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	100
PID 4624 wrote to memory of 4272	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	100
PID 4624 wrote to memory of 2304	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	101
PID 4624 wrote to memory of 2304	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	101
PID 4624 wrote to memory of 1840	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	102
PID 4624 wrote to memory of 1840	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	102
PID 4624 wrote to memory of 5088	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	103
PID 4624 wrote to memory of 5088	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	103
PID 4624 wrote to memory of 1524	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	104
PID 4624 wrote to memory of 1524	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	104
PID 4624 wrote to memory of 908	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	105
PID 4624 wrote to memory of 908	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	105
PID 4624 wrote to memory of 2636	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	106
PID 4624 wrote to memory of 2636	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	106
PID 4624 wrote to memory of 3420	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	107
PID 4624 wrote to memory of 3420	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	107
PID 4624 wrote to memory of 3568	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	108
PID 4624 wrote to memory of 3568	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	108
PID 4624 wrote to memory of 3876	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	109
PID 4624 wrote to memory of 3876	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	109
PID 4624 wrote to memory of 3268	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	110
PID 4624 wrote to memory of 3268	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	110
PID 4624 wrote to memory of 2952	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	111
PID 4624 wrote to memory of 2952	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	111
PID 4624 wrote to memory of 380	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	112
PID 4624 wrote to memory of 380	4624	386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\386d50eaf38d464d5a8b6ceb8a283d20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\System\lETGEuS.exe
  C:\Windows\System\lETGEuS.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\LDiKmCJ.exe
  C:\Windows\System\LDiKmCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\fEmHwql.exe
  C:\Windows\System\fEmHwql.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\XFvYsyz.exe
  C:\Windows\System\XFvYsyz.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\NWOvkJl.exe
  C:\Windows\System\NWOvkJl.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\MoVKLyg.exe
  C:\Windows\System\MoVKLyg.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\lawgivo.exe
  C:\Windows\System\lawgivo.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\JDpxQlc.exe
  C:\Windows\System\JDpxQlc.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\qFovwMN.exe
  C:\Windows\System\qFovwMN.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\FtyatZH.exe
  C:\Windows\System\FtyatZH.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\FPbryvb.exe
  C:\Windows\System\FPbryvb.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ArTytdG.exe
  C:\Windows\System\ArTytdG.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\CpiVZVd.exe
  C:\Windows\System\CpiVZVd.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ABAeFVx.exe
  C:\Windows\System\ABAeFVx.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\ZqLXtYq.exe
  C:\Windows\System\ZqLXtYq.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\QrnBbUN.exe
  C:\Windows\System\QrnBbUN.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\siAWyky.exe
  C:\Windows\System\siAWyky.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\sBFFoEA.exe
  C:\Windows\System\sBFFoEA.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\ZTgoCAI.exe
  C:\Windows\System\ZTgoCAI.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\HIaEakX.exe
  C:\Windows\System\HIaEakX.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\IOwfoIA.exe
  C:\Windows\System\IOwfoIA.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\WdvVZfg.exe
  C:\Windows\System\WdvVZfg.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\IvzlUTg.exe
  C:\Windows\System\IvzlUTg.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\yuqyHci.exe
  C:\Windows\System\yuqyHci.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\xKdgzGi.exe
  C:\Windows\System\xKdgzGi.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\ewWBaMt.exe
  C:\Windows\System\ewWBaMt.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\qIUXalC.exe
  C:\Windows\System\qIUXalC.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\RBbCKuS.exe
  C:\Windows\System\RBbCKuS.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\THnyyQs.exe
  C:\Windows\System\THnyyQs.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\DEEXcuA.exe
  C:\Windows\System\DEEXcuA.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\WImtZzT.exe
  C:\Windows\System\WImtZzT.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\JUYdpQf.exe
  C:\Windows\System\JUYdpQf.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\sjHmDUA.exe
  C:\Windows\System\sjHmDUA.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\JBWiFNj.exe
  C:\Windows\System\JBWiFNj.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\HGSmcIy.exe
  C:\Windows\System\HGSmcIy.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\AyqlLAY.exe
  C:\Windows\System\AyqlLAY.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\aiQOIHU.exe
  C:\Windows\System\aiQOIHU.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\KZVqjyV.exe
  C:\Windows\System\KZVqjyV.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\KFjdnrN.exe
  C:\Windows\System\KFjdnrN.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\EYTfvgM.exe
  C:\Windows\System\EYTfvgM.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\tDYaYgO.exe
  C:\Windows\System\tDYaYgO.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\jyMmnao.exe
  C:\Windows\System\jyMmnao.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\nGBfzqS.exe
  C:\Windows\System\nGBfzqS.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\qOOaqYZ.exe
  C:\Windows\System\qOOaqYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\VtCVvWA.exe
  C:\Windows\System\VtCVvWA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\XkmlOnq.exe
  C:\Windows\System\XkmlOnq.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\OmUJTtL.exe
  C:\Windows\System\OmUJTtL.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\mGlddRY.exe
  C:\Windows\System\mGlddRY.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\JYOQgeW.exe
  C:\Windows\System\JYOQgeW.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\KbDylRt.exe
  C:\Windows\System\KbDylRt.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\hBTJsdV.exe
  C:\Windows\System\hBTJsdV.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\DGgnxYI.exe
  C:\Windows\System\DGgnxYI.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\mOKbITM.exe
  C:\Windows\System\mOKbITM.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\quZgZEL.exe
  C:\Windows\System\quZgZEL.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\tevZqIW.exe
  C:\Windows\System\tevZqIW.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\ROipgWl.exe
  C:\Windows\System\ROipgWl.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\CBQiuhK.exe
  C:\Windows\System\CBQiuhK.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\JEDJPJa.exe
  C:\Windows\System\JEDJPJa.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\YyZrBst.exe
  C:\Windows\System\YyZrBst.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\ZOgenIM.exe
  C:\Windows\System\ZOgenIM.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\yURhiui.exe
  C:\Windows\System\yURhiui.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\WfLYMCy.exe
  C:\Windows\System\WfLYMCy.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\JnFdzJb.exe
  C:\Windows\System\JnFdzJb.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\AfJNCqj.exe
  C:\Windows\System\AfJNCqj.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\AtkKPzz.exe
  C:\Windows\System\AtkKPzz.exe
  2⤵
  PID:4156
- C:\Windows\System\spjkAhU.exe
  C:\Windows\System\spjkAhU.exe
  2⤵
  PID:1084
- C:\Windows\System\zlDrkCt.exe
  C:\Windows\System\zlDrkCt.exe
  2⤵
  PID:1328
- C:\Windows\System\mnxxiUj.exe
  C:\Windows\System\mnxxiUj.exe
  2⤵
  PID:1056
- C:\Windows\System\WLSfwAB.exe
  C:\Windows\System\WLSfwAB.exe
  2⤵
  PID:2292
- C:\Windows\System\AqnPzos.exe
  C:\Windows\System\AqnPzos.exe
  2⤵
  PID:320
- C:\Windows\System\KnSmDrr.exe
  C:\Windows\System\KnSmDrr.exe
  2⤵
  PID:3068
- C:\Windows\System\WslhCSl.exe
  C:\Windows\System\WslhCSl.exe
  2⤵
  PID:4064
- C:\Windows\System\phjRVvx.exe
  C:\Windows\System\phjRVvx.exe
  2⤵
  PID:2556
- C:\Windows\System\bydujRB.exe
  C:\Windows\System\bydujRB.exe
  2⤵
  PID:4384
- C:\Windows\System\cqrJDgf.exe
  C:\Windows\System\cqrJDgf.exe
  2⤵
  PID:2444
- C:\Windows\System\YfhNWJe.exe
  C:\Windows\System\YfhNWJe.exe
  2⤵
  PID:4568
- C:\Windows\System\tTxeKLx.exe
  C:\Windows\System\tTxeKLx.exe
  2⤵
  PID:1696
- C:\Windows\System\bAXtSdm.exe
  C:\Windows\System\bAXtSdm.exe
  2⤵
  PID:3048
- C:\Windows\System\aKhlklQ.exe
  C:\Windows\System\aKhlklQ.exe
  2⤵
  PID:1456
- C:\Windows\System\mYdsIAI.exe
  C:\Windows\System\mYdsIAI.exe
  2⤵
  PID:3796
- C:\Windows\System\lYwbqXC.exe
  C:\Windows\System\lYwbqXC.exe
  2⤵
  PID:1908
- C:\Windows\System\yyYfBRD.exe
  C:\Windows\System\yyYfBRD.exe
  2⤵
  PID:3908
- C:\Windows\System\ZUieqAS.exe
  C:\Windows\System\ZUieqAS.exe
  2⤵
  PID:4504
- C:\Windows\System\WtEsALk.exe
  C:\Windows\System\WtEsALk.exe
  2⤵
  PID:2176
- C:\Windows\System\qVeCavY.exe
  C:\Windows\System\qVeCavY.exe
  2⤵
  PID:2664
- C:\Windows\System\cszgDcX.exe
  C:\Windows\System\cszgDcX.exe
  2⤵
  PID:452
- C:\Windows\System\nFtNnTz.exe
  C:\Windows\System\nFtNnTz.exe
  2⤵
  PID:3664
- C:\Windows\System\FpYtPzH.exe
  C:\Windows\System\FpYtPzH.exe
  2⤵
  PID:2348
- C:\Windows\System\qPMcmyO.exe
  C:\Windows\System\qPMcmyO.exe
  2⤵
  PID:4976
- C:\Windows\System\LxZxjSE.exe
  C:\Windows\System\LxZxjSE.exe
  2⤵
  PID:5136
- C:\Windows\System\ALhZiMj.exe
  C:\Windows\System\ALhZiMj.exe
  2⤵
  PID:5152
- C:\Windows\System\rvgaNum.exe
  C:\Windows\System\rvgaNum.exe
  2⤵
  PID:5192
- C:\Windows\System\QRQJNfs.exe
  C:\Windows\System\QRQJNfs.exe
  2⤵
  PID:5224
- C:\Windows\System\AVOTIPd.exe
  C:\Windows\System\AVOTIPd.exe
  2⤵
  PID:5248
- C:\Windows\System\tlWgCgM.exe
  C:\Windows\System\tlWgCgM.exe
  2⤵
  PID:5276
- C:\Windows\System\UzXynYt.exe
  C:\Windows\System\UzXynYt.exe
  2⤵
  PID:5292
- C:\Windows\System\wfblrgZ.exe
  C:\Windows\System\wfblrgZ.exe
  2⤵
  PID:5324
- C:\Windows\System\jziZmqD.exe
  C:\Windows\System\jziZmqD.exe
  2⤵
  PID:5348
- C:\Windows\System\cmzfCez.exe
  C:\Windows\System\cmzfCez.exe
  2⤵
  PID:5388
- C:\Windows\System\UsLmiek.exe
  C:\Windows\System\UsLmiek.exe
  2⤵
  PID:5424
- C:\Windows\System\mpKtVhw.exe
  C:\Windows\System\mpKtVhw.exe
  2⤵
  PID:5444
- C:\Windows\System\iDOEgcl.exe
  C:\Windows\System\iDOEgcl.exe
  2⤵
  PID:5472
- C:\Windows\System\kumtGNt.exe
  C:\Windows\System\kumtGNt.exe
  2⤵
  PID:5488
- C:\Windows\System\CgPDszS.exe
  C:\Windows\System\CgPDszS.exe
  2⤵
  PID:5520
- C:\Windows\System\mAdlnaT.exe
  C:\Windows\System\mAdlnaT.exe
  2⤵
  PID:5560
- C:\Windows\System\MZFcGZh.exe
  C:\Windows\System\MZFcGZh.exe
  2⤵
  PID:5588
- C:\Windows\System\psTwQFp.exe
  C:\Windows\System\psTwQFp.exe
  2⤵
  PID:5612
- C:\Windows\System\oPgiCnP.exe
  C:\Windows\System\oPgiCnP.exe
  2⤵
  PID:5640
- C:\Windows\System\qsROSdF.exe
  C:\Windows\System\qsROSdF.exe
  2⤵
  PID:5656
- C:\Windows\System\olmhHVZ.exe
  C:\Windows\System\olmhHVZ.exe
  2⤵
  PID:5696
- C:\Windows\System\sJNfwey.exe
  C:\Windows\System\sJNfwey.exe
  2⤵
  PID:5716
- C:\Windows\System\YtkaqMm.exe
  C:\Windows\System\YtkaqMm.exe
  2⤵
  PID:5748
- C:\Windows\System\CVlgeNO.exe
  C:\Windows\System\CVlgeNO.exe
  2⤵
  PID:5780
- C:\Windows\System\BACYAPl.exe
  C:\Windows\System\BACYAPl.exe
  2⤵
  PID:5808
- C:\Windows\System\yPhjfab.exe
  C:\Windows\System\yPhjfab.exe
  2⤵
  PID:5836
- C:\Windows\System\yOhXoLh.exe
  C:\Windows\System\yOhXoLh.exe
  2⤵
  PID:5864
- C:\Windows\System\fvtoOdf.exe
  C:\Windows\System\fvtoOdf.exe
  2⤵
  PID:5900
- C:\Windows\System\EUMOQhG.exe
  C:\Windows\System\EUMOQhG.exe
  2⤵
  PID:5920
- C:\Windows\System\uVxaNGe.exe
  C:\Windows\System\uVxaNGe.exe
  2⤵
  PID:5956
- C:\Windows\System\BeZgjCS.exe
  C:\Windows\System\BeZgjCS.exe
  2⤵
  PID:5980
- C:\Windows\System\abYgpLT.exe
  C:\Windows\System\abYgpLT.exe
  2⤵
  PID:6008
- C:\Windows\System\BvfPgbv.exe
  C:\Windows\System\BvfPgbv.exe
  2⤵
  PID:6044
- C:\Windows\System\hTcLKaI.exe
  C:\Windows\System\hTcLKaI.exe
  2⤵
  PID:6064
- C:\Windows\System\asGQmPy.exe
  C:\Windows\System\asGQmPy.exe
  2⤵
  PID:6080
- C:\Windows\System\YSnKDry.exe
  C:\Windows\System\YSnKDry.exe
  2⤵
  PID:6100
- C:\Windows\System\NyeGTwt.exe
  C:\Windows\System\NyeGTwt.exe
  2⤵
  PID:6128
- C:\Windows\System\kjpvmFk.exe
  C:\Windows\System\kjpvmFk.exe
  2⤵
  PID:5132
- C:\Windows\System\TsvVxdE.exe
  C:\Windows\System\TsvVxdE.exe
  2⤵
  PID:5180
- C:\Windows\System\pVrtUfw.exe
  C:\Windows\System\pVrtUfw.exe
  2⤵
  PID:5260
- C:\Windows\System\bnDgoTZ.exe
  C:\Windows\System\bnDgoTZ.exe
  2⤵
  PID:5372
- C:\Windows\System\uBEFdFH.exe
  C:\Windows\System\uBEFdFH.exe
  2⤵
  PID:5432
- C:\Windows\System\qAVKfCP.exe
  C:\Windows\System\qAVKfCP.exe
  2⤵
  PID:5508
- C:\Windows\System\GEWZBOE.exe
  C:\Windows\System\GEWZBOE.exe
  2⤵
  PID:5608
- C:\Windows\System\VDmcimz.exe
  C:\Windows\System\VDmcimz.exe
  2⤵
  PID:5652
- C:\Windows\System\qtyLBsl.exe
  C:\Windows\System\qtyLBsl.exe
  2⤵
  PID:5712
- C:\Windows\System\RhxaQWA.exe
  C:\Windows\System\RhxaQWA.exe
  2⤵
  PID:5772
- C:\Windows\System\UPFmkLk.exe
  C:\Windows\System\UPFmkLk.exe
  2⤵
  PID:5832
- C:\Windows\System\jLfKWLs.exe
  C:\Windows\System\jLfKWLs.exe
  2⤵
  PID:5880
- C:\Windows\System\ayksdnt.exe
  C:\Windows\System\ayksdnt.exe
  2⤵
  PID:5992
- C:\Windows\System\wSYDyul.exe
  C:\Windows\System\wSYDyul.exe
  2⤵
  PID:6076
- C:\Windows\System\DCzUDAb.exe
  C:\Windows\System\DCzUDAb.exe
  2⤵
  PID:5144
- C:\Windows\System\ayDTSJf.exe
  C:\Windows\System\ayDTSJf.exe
  2⤵
  PID:5212
- C:\Windows\System\UBJTjvT.exe
  C:\Windows\System\UBJTjvT.exe
  2⤵
  PID:5456
- C:\Windows\System\jCaXKas.exe
  C:\Windows\System\jCaXKas.exe
  2⤵
  PID:5692
- C:\Windows\System\aYhnhnG.exe
  C:\Windows\System\aYhnhnG.exe
  2⤵
  PID:5828
- C:\Windows\System\DXTlvwD.exe
  C:\Windows\System\DXTlvwD.exe
  2⤵
  PID:6052
- C:\Windows\System\jKfRvaZ.exe
  C:\Windows\System\jKfRvaZ.exe
  2⤵
  PID:5408
- C:\Windows\System\kRhzAOV.exe
  C:\Windows\System\kRhzAOV.exe
  2⤵
  PID:5708
- C:\Windows\System\CYbukdN.exe
  C:\Windows\System\CYbukdN.exe
  2⤵
  PID:5932
- C:\Windows\System\GhdFERF.exe
  C:\Windows\System\GhdFERF.exe
  2⤵
  PID:5856
- C:\Windows\System\StQgozB.exe
  C:\Windows\System\StQgozB.exe
  2⤵
  PID:6116
- C:\Windows\System\exveQNB.exe
  C:\Windows\System\exveQNB.exe
  2⤵
  PID:6176
- C:\Windows\System\YSxjLix.exe
  C:\Windows\System\YSxjLix.exe
  2⤵
  PID:6204
- C:\Windows\System\OqnaWDX.exe
  C:\Windows\System\OqnaWDX.exe
  2⤵
  PID:6228
- C:\Windows\System\kqFYcud.exe
  C:\Windows\System\kqFYcud.exe
  2⤵
  PID:6256
- C:\Windows\System\eaPqAbN.exe
  C:\Windows\System\eaPqAbN.exe
  2⤵
  PID:6288
- C:\Windows\System\zHtOFhZ.exe
  C:\Windows\System\zHtOFhZ.exe
  2⤵
  PID:6312
- C:\Windows\System\aAibCDW.exe
  C:\Windows\System\aAibCDW.exe
  2⤵
  PID:6344
- C:\Windows\System\sYMmmoV.exe
  C:\Windows\System\sYMmmoV.exe
  2⤵
  PID:6372
- C:\Windows\System\RnrMnyY.exe
  C:\Windows\System\RnrMnyY.exe
  2⤵
  PID:6408
- C:\Windows\System\BmpQOdK.exe
  C:\Windows\System\BmpQOdK.exe
  2⤵
  PID:6428
- C:\Windows\System\oJKJLMN.exe
  C:\Windows\System\oJKJLMN.exe
  2⤵
  PID:6456
- C:\Windows\System\MzoSFpi.exe
  C:\Windows\System\MzoSFpi.exe
  2⤵
  PID:6484
- C:\Windows\System\cDRyUgk.exe
  C:\Windows\System\cDRyUgk.exe
  2⤵
  PID:6512
- C:\Windows\System\hYviuKy.exe
  C:\Windows\System\hYviuKy.exe
  2⤵
  PID:6540
- C:\Windows\System\cSEohmg.exe
  C:\Windows\System\cSEohmg.exe
  2⤵
  PID:6560
- C:\Windows\System\DercILR.exe
  C:\Windows\System\DercILR.exe
  2⤵
  PID:6596
- C:\Windows\System\nNWxNDK.exe
  C:\Windows\System\nNWxNDK.exe
  2⤵
  PID:6632
- C:\Windows\System\srPYWbE.exe
  C:\Windows\System\srPYWbE.exe
  2⤵
  PID:6652
- C:\Windows\System\AIRgtuv.exe
  C:\Windows\System\AIRgtuv.exe
  2⤵
  PID:6668
- C:\Windows\System\GxCZyHq.exe
  C:\Windows\System\GxCZyHq.exe
  2⤵
  PID:6708
- C:\Windows\System\jmMSFGs.exe
  C:\Windows\System\jmMSFGs.exe
  2⤵
  PID:6724
- C:\Windows\System\FyLUVLT.exe
  C:\Windows\System\FyLUVLT.exe
  2⤵
  PID:6760
- C:\Windows\System\VsXlaAf.exe
  C:\Windows\System\VsXlaAf.exe
  2⤵
  PID:6796
- C:\Windows\System\nSTIczA.exe
  C:\Windows\System\nSTIczA.exe
  2⤵
  PID:6820
- C:\Windows\System\gZzMVpW.exe
  C:\Windows\System\gZzMVpW.exe
  2⤵
  PID:6844
- C:\Windows\System\oIlAiVO.exe
  C:\Windows\System\oIlAiVO.exe
  2⤵
  PID:6880
- C:\Windows\System\wltnYXe.exe
  C:\Windows\System\wltnYXe.exe
  2⤵
  PID:6904
- C:\Windows\System\OUOneho.exe
  C:\Windows\System\OUOneho.exe
  2⤵
  PID:6932
- C:\Windows\System\hoAFmCZ.exe
  C:\Windows\System\hoAFmCZ.exe
  2⤵
  PID:6964
- C:\Windows\System\XMRfAaa.exe
  C:\Windows\System\XMRfAaa.exe
  2⤵
  PID:6988
- C:\Windows\System\uUJvqSs.exe
  C:\Windows\System\uUJvqSs.exe
  2⤵
  PID:7016
- C:\Windows\System\TtNPpMm.exe
  C:\Windows\System\TtNPpMm.exe
  2⤵
  PID:7044
- C:\Windows\System\EqflyYB.exe
  C:\Windows\System\EqflyYB.exe
  2⤵
  PID:7072
- C:\Windows\System\mABcNlU.exe
  C:\Windows\System\mABcNlU.exe
  2⤵
  PID:7108
- C:\Windows\System\IKbXneN.exe
  C:\Windows\System\IKbXneN.exe
  2⤵
  PID:7132
- C:\Windows\System\plWtfTm.exe
  C:\Windows\System\plWtfTm.exe
  2⤵
  PID:7160
- C:\Windows\System\nNVVzWH.exe
  C:\Windows\System\nNVVzWH.exe
  2⤵
  PID:6184
- C:\Windows\System\twgXNSw.exe
  C:\Windows\System\twgXNSw.exe
  2⤵
  PID:6248
- C:\Windows\System\ViLbNfo.exe
  C:\Windows\System\ViLbNfo.exe
  2⤵
  PID:6308
- C:\Windows\System\AFFNvJV.exe
  C:\Windows\System\AFFNvJV.exe
  2⤵
  PID:6396
- C:\Windows\System\XigtkqO.exe
  C:\Windows\System\XigtkqO.exe
  2⤵
  PID:6448
- C:\Windows\System\NnkjwsZ.exe
  C:\Windows\System\NnkjwsZ.exe
  2⤵
  PID:6532
- C:\Windows\System\tgmQkyD.exe
  C:\Windows\System\tgmQkyD.exe
  2⤵
  PID:6588
- C:\Windows\System\vWxASmb.exe
  C:\Windows\System\vWxASmb.exe
  2⤵
  PID:6648
- C:\Windows\System\qLaRaYT.exe
  C:\Windows\System\qLaRaYT.exe
  2⤵
  PID:6692
- C:\Windows\System\YNpcfRU.exe
  C:\Windows\System\YNpcfRU.exe
  2⤵
  PID:6784
- C:\Windows\System\aaMMwMi.exe
  C:\Windows\System\aaMMwMi.exe
  2⤵
  PID:6856
- C:\Windows\System\ctMHTcn.exe
  C:\Windows\System\ctMHTcn.exe
  2⤵
  PID:6916
- C:\Windows\System\DdAwAcM.exe
  C:\Windows\System\DdAwAcM.exe
  2⤵
  PID:6980
- C:\Windows\System\MHPzZPf.exe
  C:\Windows\System\MHPzZPf.exe
  2⤵
  PID:7056
- C:\Windows\System\bghsmDx.exe
  C:\Windows\System\bghsmDx.exe
  2⤵
  PID:7116
- C:\Windows\System\WRMMojV.exe
  C:\Windows\System\WRMMojV.exe
  2⤵
  PID:6164
- C:\Windows\System\lyhEITo.exe
  C:\Windows\System\lyhEITo.exe
  2⤵
  PID:6296
- C:\Windows\System\oppvxKy.exe
  C:\Windows\System\oppvxKy.exe
  2⤵
  PID:6476
- C:\Windows\System\aOpYYFz.exe
  C:\Windows\System\aOpYYFz.exe
  2⤵
  PID:6620
- C:\Windows\System\TlWTYgZ.exe
  C:\Windows\System\TlWTYgZ.exe
  2⤵
  PID:6776
- C:\Windows\System\eDvwZZj.exe
  C:\Windows\System\eDvwZZj.exe
  2⤵
  PID:6900
- C:\Windows\System\sqVWLXC.exe
  C:\Windows\System\sqVWLXC.exe
  2⤵
  PID:7088
- C:\Windows\System\vPWRhVt.exe
  C:\Windows\System\vPWRhVt.exe
  2⤵
  PID:6356
- C:\Windows\System\wLFpInW.exe
  C:\Windows\System\wLFpInW.exe
  2⤵
  PID:6688
- C:\Windows\System\oieRTFR.exe
  C:\Windows\System\oieRTFR.exe
  2⤵
  PID:7040
- C:\Windows\System\eTpbPlo.exe
  C:\Windows\System\eTpbPlo.exe
  2⤵
  PID:6816
- C:\Windows\System\FhYKfrn.exe
  C:\Windows\System\FhYKfrn.exe
  2⤵
  PID:6568
- C:\Windows\System\JDNiEMu.exe
  C:\Windows\System\JDNiEMu.exe
  2⤵
  PID:7184
- C:\Windows\System\iBRzRAE.exe
  C:\Windows\System\iBRzRAE.exe
  2⤵
  PID:7204
- C:\Windows\System\KcjlXaI.exe
  C:\Windows\System\KcjlXaI.exe
  2⤵
  PID:7220
- C:\Windows\System\VHhZRGA.exe
  C:\Windows\System\VHhZRGA.exe
  2⤵
  PID:7240
- C:\Windows\System\juVRNRh.exe
  C:\Windows\System\juVRNRh.exe
  2⤵
  PID:7256
- C:\Windows\System\FkPxkQU.exe
  C:\Windows\System\FkPxkQU.exe
  2⤵
  PID:7284
- C:\Windows\System\RhOcpVj.exe
  C:\Windows\System\RhOcpVj.exe
  2⤵
  PID:7316
- C:\Windows\System\AaQCvPm.exe
  C:\Windows\System\AaQCvPm.exe
  2⤵
  PID:7340
- C:\Windows\System\MNwkxJy.exe
  C:\Windows\System\MNwkxJy.exe
  2⤵
  PID:7388
- C:\Windows\System\Vulfaip.exe
  C:\Windows\System\Vulfaip.exe
  2⤵
  PID:7440
- C:\Windows\System\SrdqXdK.exe
  C:\Windows\System\SrdqXdK.exe
  2⤵
  PID:7476
- C:\Windows\System\PTNmNRU.exe
  C:\Windows\System\PTNmNRU.exe
  2⤵
  PID:7504
- C:\Windows\System\vHAhUXj.exe
  C:\Windows\System\vHAhUXj.exe
  2⤵
  PID:7532
- C:\Windows\System\glFZBqn.exe
  C:\Windows\System\glFZBqn.exe
  2⤵
  PID:7560
- C:\Windows\System\DrkvAYZ.exe
  C:\Windows\System\DrkvAYZ.exe
  2⤵
  PID:7576
- C:\Windows\System\ywgHsUn.exe
  C:\Windows\System\ywgHsUn.exe
  2⤵
  PID:7616
- C:\Windows\System\jXFyltl.exe
  C:\Windows\System\jXFyltl.exe
  2⤵
  PID:7652
- C:\Windows\System\jqxIaOT.exe
  C:\Windows\System\jqxIaOT.exe
  2⤵
  PID:7680
- C:\Windows\System\CcGOadZ.exe
  C:\Windows\System\CcGOadZ.exe
  2⤵
  PID:7700
- C:\Windows\System\nHskVuS.exe
  C:\Windows\System\nHskVuS.exe
  2⤵
  PID:7728
- C:\Windows\System\KucEBjF.exe
  C:\Windows\System\KucEBjF.exe
  2⤵
  PID:7748
- C:\Windows\System\vsqoahV.exe
  C:\Windows\System\vsqoahV.exe
  2⤵
  PID:7792
- C:\Windows\System\fxRjaCn.exe
  C:\Windows\System\fxRjaCn.exe
  2⤵
  PID:7812
- C:\Windows\System\LgaPQSW.exe
  C:\Windows\System\LgaPQSW.exe
  2⤵
  PID:7880
- C:\Windows\System\OWQEKht.exe
  C:\Windows\System\OWQEKht.exe
  2⤵
  PID:7932
- C:\Windows\System\nUWYYfj.exe
  C:\Windows\System\nUWYYfj.exe
  2⤵
  PID:7968
- C:\Windows\System\qmDqlIJ.exe
  C:\Windows\System\qmDqlIJ.exe
  2⤵
  PID:8012
- C:\Windows\System\cePvYqk.exe
  C:\Windows\System\cePvYqk.exe
  2⤵
  PID:8056
- C:\Windows\System\QungFLZ.exe
  C:\Windows\System\QungFLZ.exe
  2⤵
  PID:8100
- C:\Windows\System\JJsrmZx.exe
  C:\Windows\System\JJsrmZx.exe
  2⤵
  PID:8132
- C:\Windows\System\iVXHUpU.exe
  C:\Windows\System\iVXHUpU.exe
  2⤵
  PID:8160
- C:\Windows\System\ljLLHre.exe
  C:\Windows\System\ljLLHre.exe
  2⤵
  PID:8176
- C:\Windows\System\RoHrpKG.exe
  C:\Windows\System\RoHrpKG.exe
  2⤵
  PID:5632
- C:\Windows\System\lydTqgW.exe
  C:\Windows\System\lydTqgW.exe
  2⤵
  PID:7252
- C:\Windows\System\imgYZXd.exe
  C:\Windows\System\imgYZXd.exe
  2⤵
  PID:7364
- C:\Windows\System\ZtbouEB.exe
  C:\Windows\System\ZtbouEB.exe
  2⤵
  PID:7428
- C:\Windows\System\jKswtJZ.exe
  C:\Windows\System\jKswtJZ.exe
  2⤵
  PID:7500
- C:\Windows\System\kwuurxE.exe
  C:\Windows\System\kwuurxE.exe
  2⤵
  PID:7588
- C:\Windows\System\taweEvj.exe
  C:\Windows\System\taweEvj.exe
  2⤵
  PID:7636
- C:\Windows\System\RMRzxNK.exe
  C:\Windows\System\RMRzxNK.exe
  2⤵
  PID:7696
- C:\Windows\System\stwiLuG.exe
  C:\Windows\System\stwiLuG.exe
  2⤵
  PID:7744
- C:\Windows\System\KYITUWV.exe
  C:\Windows\System\KYITUWV.exe
  2⤵
  PID:7808
- C:\Windows\System\jfXsnJB.exe
  C:\Windows\System\jfXsnJB.exe
  2⤵
  PID:7924
- C:\Windows\System\aXWegwr.exe
  C:\Windows\System\aXWegwr.exe
  2⤵
  PID:8064
- C:\Windows\System\Hnxdwto.exe
  C:\Windows\System\Hnxdwto.exe
  2⤵
  PID:8116
- C:\Windows\System\DzBcwye.exe
  C:\Windows\System\DzBcwye.exe
  2⤵
  PID:8156
- C:\Windows\System\CyoctfO.exe
  C:\Windows\System\CyoctfO.exe
  2⤵
  PID:7360
- C:\Windows\System\dSKjNmR.exe
  C:\Windows\System\dSKjNmR.exe
  2⤵
  PID:7424
- C:\Windows\System\uAPLHow.exe
  C:\Windows\System\uAPLHow.exe
  2⤵
  PID:7548
- C:\Windows\System\AqnLAXy.exe
  C:\Windows\System\AqnLAXy.exe
  2⤵
  PID:7740
- C:\Windows\System\tZkOJLW.exe
  C:\Windows\System\tZkOJLW.exe
  2⤵
  PID:7912
- C:\Windows\System\ZhzPuaT.exe
  C:\Windows\System\ZhzPuaT.exe
  2⤵
  PID:4616
- C:\Windows\System\plUxjXK.exe
  C:\Windows\System\plUxjXK.exe
  2⤵
  PID:7328
- C:\Windows\System\fYXcdwb.exe
  C:\Windows\System\fYXcdwb.exe
  2⤵
  PID:7228
- C:\Windows\System\DQGnonP.exe
  C:\Windows\System\DQGnonP.exe
  2⤵
  PID:8092
- C:\Windows\System\GEFQBmv.exe
  C:\Windows\System\GEFQBmv.exe
  2⤵
  PID:4324
- C:\Windows\System\eIBLzaC.exe
  C:\Windows\System\eIBLzaC.exe
  2⤵
  PID:7632
- C:\Windows\System\khUnMfv.exe
  C:\Windows\System\khUnMfv.exe
  2⤵
  PID:8212
- C:\Windows\System\jvhAXeR.exe
  C:\Windows\System\jvhAXeR.exe
  2⤵
  PID:8240
- C:\Windows\System\xtAOXdM.exe
  C:\Windows\System\xtAOXdM.exe
  2⤵
  PID:8268
- C:\Windows\System\DdajCeN.exe
  C:\Windows\System\DdajCeN.exe
  2⤵
  PID:8296
- C:\Windows\System\sJqvEUp.exe
  C:\Windows\System\sJqvEUp.exe
  2⤵
  PID:8324
- C:\Windows\System\PiFmuHs.exe
  C:\Windows\System\PiFmuHs.exe
  2⤵
  PID:8352
- C:\Windows\System\IOWSxcN.exe
  C:\Windows\System\IOWSxcN.exe
  2⤵
  PID:8380
- C:\Windows\System\dvHcbQo.exe
  C:\Windows\System\dvHcbQo.exe
  2⤵
  PID:8408
- C:\Windows\System\IlPSnpO.exe
  C:\Windows\System\IlPSnpO.exe
  2⤵
  PID:8436
- C:\Windows\System\Jfyqemm.exe
  C:\Windows\System\Jfyqemm.exe
  2⤵
  PID:8476
- C:\Windows\System\xsKUkWb.exe
  C:\Windows\System\xsKUkWb.exe
  2⤵
  PID:8504
- C:\Windows\System\tOxKknX.exe
  C:\Windows\System\tOxKknX.exe
  2⤵
  PID:8532
- C:\Windows\System\xohvcJP.exe
  C:\Windows\System\xohvcJP.exe
  2⤵
  PID:8560
- C:\Windows\System\SLjAmPL.exe
  C:\Windows\System\SLjAmPL.exe
  2⤵
  PID:8588
- C:\Windows\System\mJXULoi.exe
  C:\Windows\System\mJXULoi.exe
  2⤵
  PID:8616
- C:\Windows\System\IQpwOtb.exe
  C:\Windows\System\IQpwOtb.exe
  2⤵
  PID:8644
- C:\Windows\System\sqwwLtr.exe
  C:\Windows\System\sqwwLtr.exe
  2⤵
  PID:8672
- C:\Windows\System\gGaiXea.exe
  C:\Windows\System\gGaiXea.exe
  2⤵
  PID:8700
- C:\Windows\System\hxsscsd.exe
  C:\Windows\System\hxsscsd.exe
  2⤵
  PID:8728
- C:\Windows\System\Eggyhot.exe
  C:\Windows\System\Eggyhot.exe
  2⤵
  PID:8756
- C:\Windows\System\dpjDgwC.exe
  C:\Windows\System\dpjDgwC.exe
  2⤵
  PID:8784
- C:\Windows\System\MuNufVh.exe
  C:\Windows\System\MuNufVh.exe
  2⤵
  PID:8812
- C:\Windows\System\kAqKSmt.exe
  C:\Windows\System\kAqKSmt.exe
  2⤵
  PID:8840
- C:\Windows\System\jjdzkwM.exe
  C:\Windows\System\jjdzkwM.exe
  2⤵
  PID:8868
- C:\Windows\System\xzkbcPF.exe
  C:\Windows\System\xzkbcPF.exe
  2⤵
  PID:8900
- C:\Windows\System\FfbLCLt.exe
  C:\Windows\System\FfbLCLt.exe
  2⤵
  PID:8924
- C:\Windows\System\gLsOOXU.exe
  C:\Windows\System\gLsOOXU.exe
  2⤵
  PID:8952
- C:\Windows\System\IMRPNFx.exe
  C:\Windows\System\IMRPNFx.exe
  2⤵
  PID:8980
- C:\Windows\System\PLxSXAy.exe
  C:\Windows\System\PLxSXAy.exe
  2⤵
  PID:9008
- C:\Windows\System\fgOsboZ.exe
  C:\Windows\System\fgOsboZ.exe
  2⤵
  PID:9036
- C:\Windows\System\GPjlENz.exe
  C:\Windows\System\GPjlENz.exe
  2⤵
  PID:9060
- C:\Windows\System\xnVvzPj.exe
  C:\Windows\System\xnVvzPj.exe
  2⤵
  PID:9076
- C:\Windows\System\cgUwHIG.exe
  C:\Windows\System\cgUwHIG.exe
  2⤵
  PID:9096
- C:\Windows\System\deLQnMI.exe
  C:\Windows\System\deLQnMI.exe
  2⤵
  PID:9120
- C:\Windows\System\YHRNOGd.exe
  C:\Windows\System\YHRNOGd.exe
  2⤵
  PID:9176
- C:\Windows\System\dwMCCTJ.exe
  C:\Windows\System\dwMCCTJ.exe
  2⤵
  PID:9204
- C:\Windows\System\xHncBsx.exe
  C:\Windows\System\xHncBsx.exe
  2⤵
  PID:8232
- C:\Windows\System\jeOAXSL.exe
  C:\Windows\System\jeOAXSL.exe
  2⤵
  PID:8292
- C:\Windows\System\hzzeeFP.exe
  C:\Windows\System\hzzeeFP.exe
  2⤵
  PID:8392
- C:\Windows\System\TxSWzpx.exe
  C:\Windows\System\TxSWzpx.exe
  2⤵
  PID:8428
- C:\Windows\System\JGmSqzA.exe
  C:\Windows\System\JGmSqzA.exe
  2⤵
  PID:8500
- C:\Windows\System\IPdTvlV.exe
  C:\Windows\System\IPdTvlV.exe
  2⤵
  PID:8576
- C:\Windows\System\FROqOQX.exe
  C:\Windows\System\FROqOQX.exe
  2⤵
  PID:8640
- C:\Windows\System\EsdwMSl.exe
  C:\Windows\System\EsdwMSl.exe
  2⤵
  PID:8696
- C:\Windows\System\OpJVmsR.exe
  C:\Windows\System\OpJVmsR.exe
  2⤵
  PID:8768
- C:\Windows\System\LQBafOU.exe
  C:\Windows\System\LQBafOU.exe
  2⤵
  PID:8832
- C:\Windows\System\KpBHQMv.exe
  C:\Windows\System\KpBHQMv.exe
  2⤵
  PID:8892
- C:\Windows\System\pfYyWnu.exe
  C:\Windows\System\pfYyWnu.exe
  2⤵
  PID:8964
- C:\Windows\System\cxECxTK.exe
  C:\Windows\System\cxECxTK.exe
  2⤵
  PID:9028
- C:\Windows\System\tJfhQRh.exe
  C:\Windows\System\tJfhQRh.exe
  2⤵
  PID:9108
- C:\Windows\System\JZdVFoN.exe
  C:\Windows\System\JZdVFoN.exe
  2⤵
  PID:9164
- C:\Windows\System\BApGaKf.exe
  C:\Windows\System\BApGaKf.exe
  2⤵
  PID:8224
- C:\Windows\System\oeGiYQc.exe
  C:\Windows\System\oeGiYQc.exe
  2⤵
  PID:8376
- C:\Windows\System\lQyJEOC.exe
  C:\Windows\System\lQyJEOC.exe
  2⤵
  PID:8552
- C:\Windows\System\IdTxsxf.exe
  C:\Windows\System\IdTxsxf.exe
  2⤵
  PID:8684
- C:\Windows\System\QszVqxl.exe
  C:\Windows\System\QszVqxl.exe
  2⤵
  PID:8864
- C:\Windows\System\oDRgoxp.exe
  C:\Windows\System\oDRgoxp.exe
  2⤵
  PID:9004
- C:\Windows\System\jVKBwHA.exe
  C:\Windows\System\jVKBwHA.exe
  2⤵
  PID:9144
- C:\Windows\System\mTQcECA.exe
  C:\Windows\System\mTQcECA.exe
  2⤵
  PID:8468
- C:\Windows\System\vYXHzYJ.exe
  C:\Windows\System\vYXHzYJ.exe
  2⤵
  PID:8824
- C:\Windows\System\ZhXroFh.exe
  C:\Windows\System\ZhXroFh.exe
  2⤵
  PID:9088
- C:\Windows\System\tPnsHFF.exe
  C:\Windows\System\tPnsHFF.exe
  2⤵
  PID:8664
- C:\Windows\System\fcvLFjS.exe
  C:\Windows\System\fcvLFjS.exe
  2⤵
  PID:9072
- C:\Windows\System\qkNqSwH.exe
  C:\Windows\System\qkNqSwH.exe
  2⤵
  PID:9244
- C:\Windows\System\VrkGozA.exe
  C:\Windows\System\VrkGozA.exe
  2⤵
  PID:9272
- C:\Windows\System\SmcZumg.exe
  C:\Windows\System\SmcZumg.exe
  2⤵
  PID:9300
- C:\Windows\System\qeWgfyt.exe
  C:\Windows\System\qeWgfyt.exe
  2⤵
  PID:9328
- C:\Windows\System\aHqSUip.exe
  C:\Windows\System\aHqSUip.exe
  2⤵
  PID:9356
- C:\Windows\System\ZfHjYUJ.exe
  C:\Windows\System\ZfHjYUJ.exe
  2⤵
  PID:9384
- C:\Windows\System\cFGdSfS.exe
  C:\Windows\System\cFGdSfS.exe
  2⤵
  PID:9412
- C:\Windows\System\EuVZKFm.exe
  C:\Windows\System\EuVZKFm.exe
  2⤵
  PID:9440
- C:\Windows\System\ulXkUtp.exe
  C:\Windows\System\ulXkUtp.exe
  2⤵
  PID:9480
- C:\Windows\System\iFgFaZF.exe
  C:\Windows\System\iFgFaZF.exe
  2⤵
  PID:9496
- C:\Windows\System\JNYiMyU.exe
  C:\Windows\System\JNYiMyU.exe
  2⤵
  PID:9524
- C:\Windows\System\dirgsdk.exe
  C:\Windows\System\dirgsdk.exe
  2⤵
  PID:9552
- C:\Windows\System\BZlJqPm.exe
  C:\Windows\System\BZlJqPm.exe
  2⤵
  PID:9580
- C:\Windows\System\VesMeaB.exe
  C:\Windows\System\VesMeaB.exe
  2⤵
  PID:9608
- C:\Windows\System\uFjgrAx.exe
  C:\Windows\System\uFjgrAx.exe
  2⤵
  PID:9636
- C:\Windows\System\unAZJIJ.exe
  C:\Windows\System\unAZJIJ.exe
  2⤵
  PID:9668
- C:\Windows\System\dNYMaKj.exe
  C:\Windows\System\dNYMaKj.exe
  2⤵
  PID:9696
- C:\Windows\System\pOSFwVv.exe
  C:\Windows\System\pOSFwVv.exe
  2⤵
  PID:9724
- C:\Windows\System\awtuijq.exe
  C:\Windows\System\awtuijq.exe
  2⤵
  PID:9752
- C:\Windows\System\RnTHoZg.exe
  C:\Windows\System\RnTHoZg.exe
  2⤵
  PID:9780
- C:\Windows\System\YhXoJmg.exe
  C:\Windows\System\YhXoJmg.exe
  2⤵
  PID:9808
- C:\Windows\System\XvCotSp.exe
  C:\Windows\System\XvCotSp.exe
  2⤵
  PID:9836
- C:\Windows\System\DqVmaMD.exe
  C:\Windows\System\DqVmaMD.exe
  2⤵
  PID:9864
- C:\Windows\System\fCFoiNH.exe
  C:\Windows\System\fCFoiNH.exe
  2⤵
  PID:9892
- C:\Windows\System\cgSfaGr.exe
  C:\Windows\System\cgSfaGr.exe
  2⤵
  PID:9920
- C:\Windows\System\ygOkTqy.exe
  C:\Windows\System\ygOkTqy.exe
  2⤵
  PID:9948
- C:\Windows\System\hcCrIup.exe
  C:\Windows\System\hcCrIup.exe
  2⤵
  PID:9976
- C:\Windows\System\EenlbLX.exe
  C:\Windows\System\EenlbLX.exe
  2⤵
  PID:10004
- C:\Windows\System\ZSyklqn.exe
  C:\Windows\System\ZSyklqn.exe
  2⤵
  PID:10032
- C:\Windows\System\PpOPBHS.exe
  C:\Windows\System\PpOPBHS.exe
  2⤵
  PID:10060
- C:\Windows\System\bcPiYfE.exe
  C:\Windows\System\bcPiYfE.exe
  2⤵
  PID:10088
- C:\Windows\System\GYNWfAd.exe
  C:\Windows\System\GYNWfAd.exe
  2⤵
  PID:10116
- C:\Windows\System\WfxqvUY.exe
  C:\Windows\System\WfxqvUY.exe
  2⤵
  PID:10148
- C:\Windows\System\YICKTva.exe
  C:\Windows\System\YICKTva.exe
  2⤵
  PID:10176
- C:\Windows\System\VLcdjYn.exe
  C:\Windows\System\VLcdjYn.exe
  2⤵
  PID:10204
- C:\Windows\System\KwnQnRC.exe
  C:\Windows\System\KwnQnRC.exe
  2⤵
  PID:10232
- C:\Windows\System\pyJBbwC.exe
  C:\Windows\System\pyJBbwC.exe
  2⤵
  PID:9260
- C:\Windows\System\SoCIyTh.exe
  C:\Windows\System\SoCIyTh.exe
  2⤵
  PID:9320
- C:\Windows\System\iwgSkaQ.exe
  C:\Windows\System\iwgSkaQ.exe
  2⤵
  PID:9376
- C:\Windows\System\huFhsik.exe
  C:\Windows\System\huFhsik.exe
  2⤵
  PID:9452
- C:\Windows\System\KRTjbgz.exe
  C:\Windows\System\KRTjbgz.exe
  2⤵
  PID:9508
- C:\Windows\System\XqXavrM.exe
  C:\Windows\System\XqXavrM.exe
  2⤵
  PID:9572
- C:\Windows\System\uivxQbB.exe
  C:\Windows\System\uivxQbB.exe
  2⤵
  PID:9632
- C:\Windows\System\gEJpHCa.exe
  C:\Windows\System\gEJpHCa.exe
  2⤵
  PID:1808
- C:\Windows\System\wqXNHVj.exe
  C:\Windows\System\wqXNHVj.exe
  2⤵
  PID:2620
- C:\Windows\System\BslkoDF.exe
  C:\Windows\System\BslkoDF.exe
  2⤵
  PID:9688
- C:\Windows\System\TOZDXnr.exe
  C:\Windows\System\TOZDXnr.exe
  2⤵
  PID:9748
- C:\Windows\System\IXLKGuB.exe
  C:\Windows\System\IXLKGuB.exe
  2⤵
  PID:9200
- C:\Windows\System\WnyRDQC.exe
  C:\Windows\System\WnyRDQC.exe
  2⤵
  PID:9876
- C:\Windows\System\RPkWKjd.exe
  C:\Windows\System\RPkWKjd.exe
  2⤵
  PID:9940
- C:\Windows\System\slMEUSh.exe
  C:\Windows\System\slMEUSh.exe
  2⤵
  PID:10000
- C:\Windows\System\uzzZbmc.exe
  C:\Windows\System\uzzZbmc.exe
  2⤵
  PID:10076
- C:\Windows\System\CpopZWQ.exe
  C:\Windows\System\CpopZWQ.exe
  2⤵
  PID:10140
- C:\Windows\System\uQsSfqP.exe
  C:\Windows\System\uQsSfqP.exe
  2⤵
  PID:10200
- C:\Windows\System\IBoEMQn.exe
  C:\Windows\System\IBoEMQn.exe
  2⤵
  PID:9288
- C:\Windows\System\bHNORDh.exe
  C:\Windows\System\bHNORDh.exe
  2⤵
  PID:9432
- C:\Windows\System\EnZvPpq.exe
  C:\Windows\System\EnZvPpq.exe
  2⤵
  PID:9628
- C:\Windows\System\SQjFJJT.exe
  C:\Windows\System\SQjFJJT.exe
  2⤵
  PID:4368
- C:\Windows\System\pnNXCrm.exe
  C:\Windows\System\pnNXCrm.exe
  2⤵
  PID:9744
- C:\Windows\System\dshpNVd.exe
  C:\Windows\System\dshpNVd.exe
  2⤵
  PID:9904
- C:\Windows\System\fYKKTbK.exe
  C:\Windows\System\fYKKTbK.exe
  2⤵
  PID:10108
- C:\Windows\System\wHdCyur.exe
  C:\Windows\System\wHdCyur.exe
  2⤵
  PID:9236
- C:\Windows\System\ROEKDmt.exe
  C:\Windows\System\ROEKDmt.exe
  2⤵
  PID:9352
- C:\Windows\System\VeSijDS.exe
  C:\Windows\System\VeSijDS.exe
  2⤵
  PID:1300
- C:\Windows\System\vbQTHxs.exe
  C:\Windows\System\vbQTHxs.exe
  2⤵
  PID:9832
- C:\Windows\System\sVLuNNT.exe
  C:\Windows\System\sVLuNNT.exe
  2⤵
  PID:9620
- C:\Windows\System\evQCLiK.exe
  C:\Windows\System\evQCLiK.exe
  2⤵
  PID:10276
- C:\Windows\System\xLDTruU.exe
  C:\Windows\System\xLDTruU.exe
  2⤵
  PID:10304
- C:\Windows\System\mxXdEpz.exe
  C:\Windows\System\mxXdEpz.exe
  2⤵
  PID:10332
- C:\Windows\System\KStTPPU.exe
  C:\Windows\System\KStTPPU.exe
  2⤵
  PID:10360
- C:\Windows\System\zpKifWt.exe
  C:\Windows\System\zpKifWt.exe
  2⤵
  PID:10388
- C:\Windows\System\NrhHRTn.exe
  C:\Windows\System\NrhHRTn.exe
  2⤵
  PID:10416
- C:\Windows\System\AhpEEBp.exe
  C:\Windows\System\AhpEEBp.exe
  2⤵
  PID:10444
- C:\Windows\System\JdhadGO.exe
  C:\Windows\System\JdhadGO.exe
  2⤵
  PID:10480
- C:\Windows\System\dNPyQqW.exe
  C:\Windows\System\dNPyQqW.exe
  2⤵
  PID:10500
- C:\Windows\System\zLAGZSy.exe
  C:\Windows\System\zLAGZSy.exe
  2⤵
  PID:10528
- C:\Windows\System\oRvAKIv.exe
  C:\Windows\System\oRvAKIv.exe
  2⤵
  PID:10544
- C:\Windows\System\yWlYnvb.exe
  C:\Windows\System\yWlYnvb.exe
  2⤵
  PID:10560
- C:\Windows\System\sTKqFml.exe
  C:\Windows\System\sTKqFml.exe
  2⤵
  PID:10576
- C:\Windows\System\SOKVGRR.exe
  C:\Windows\System\SOKVGRR.exe
  2⤵
  PID:10592
- C:\Windows\System\noxyFzL.exe
  C:\Windows\System\noxyFzL.exe
  2⤵
  PID:10672
- C:\Windows\System\FKbsVAo.exe
  C:\Windows\System\FKbsVAo.exe
  2⤵
  PID:10692
- C:\Windows\System\ZPdivYC.exe
  C:\Windows\System\ZPdivYC.exe
  2⤵
  PID:10732
- C:\Windows\System\gRZoQgY.exe
  C:\Windows\System\gRZoQgY.exe
  2⤵
  PID:10756
- C:\Windows\System\emefXCi.exe
  C:\Windows\System\emefXCi.exe
  2⤵
  PID:10784
- C:\Windows\System\ifPMalv.exe
  C:\Windows\System\ifPMalv.exe
  2⤵
  PID:10812
- C:\Windows\System\MVZTqsz.exe
  C:\Windows\System\MVZTqsz.exe
  2⤵
  PID:10840
- C:\Windows\System\fuGRdDt.exe
  C:\Windows\System\fuGRdDt.exe
  2⤵
  PID:10876
- C:\Windows\System\WwJWvFd.exe
  C:\Windows\System\WwJWvFd.exe
  2⤵
  PID:10904
- C:\Windows\System\RdQCjLg.exe
  C:\Windows\System\RdQCjLg.exe
  2⤵
  PID:10932
- C:\Windows\System\ljfLZkR.exe
  C:\Windows\System\ljfLZkR.exe
  2⤵
  PID:10960
- C:\Windows\System\HadEFwv.exe
  C:\Windows\System\HadEFwv.exe
  2⤵
  PID:10988
- C:\Windows\System\BwvStgq.exe
  C:\Windows\System\BwvStgq.exe
  2⤵
  PID:11016
- C:\Windows\System\VAIjbmi.exe
  C:\Windows\System\VAIjbmi.exe
  2⤵
  PID:11044
- C:\Windows\System\MLnQKFl.exe
  C:\Windows\System\MLnQKFl.exe
  2⤵
  PID:11072
- C:\Windows\System\qstKEem.exe
  C:\Windows\System\qstKEem.exe
  2⤵
  PID:11100
- C:\Windows\System\exODdiY.exe
  C:\Windows\System\exODdiY.exe
  2⤵
  PID:11128
- C:\Windows\System\ikItwBU.exe
  C:\Windows\System\ikItwBU.exe
  2⤵
  PID:11156
- C:\Windows\System\RrHgOEd.exe
  C:\Windows\System\RrHgOEd.exe
  2⤵
  PID:11184
- C:\Windows\System\zGMHlZK.exe
  C:\Windows\System\zGMHlZK.exe
  2⤵
  PID:11212
- C:\Windows\System\HgxyEsd.exe
  C:\Windows\System\HgxyEsd.exe
  2⤵
  PID:11244
- C:\Windows\System\sKEHmLs.exe
  C:\Windows\System\sKEHmLs.exe
  2⤵
  PID:10252
- C:\Windows\System\BxGpxzO.exe
  C:\Windows\System\BxGpxzO.exe
  2⤵
  PID:10316
- C:\Windows\System\imIaNAZ.exe
  C:\Windows\System\imIaNAZ.exe
  2⤵
  PID:10144
- C:\Windows\System\yiRlDKC.exe
  C:\Windows\System\yiRlDKC.exe
  2⤵
  PID:10436
- C:\Windows\System\EGAghyJ.exe
  C:\Windows\System\EGAghyJ.exe
  2⤵
  PID:10496
- C:\Windows\System\YvnmnSs.exe
  C:\Windows\System\YvnmnSs.exe
  2⤵
  PID:10536
- C:\Windows\System\pQntcKX.exe
  C:\Windows\System\pQntcKX.exe
  2⤵
  PID:10616
- C:\Windows\System\SUvDjaD.exe
  C:\Windows\System\SUvDjaD.exe
  2⤵
  PID:10704
- C:\Windows\System\ZBfOQed.exe
  C:\Windows\System\ZBfOQed.exe
  2⤵
  PID:10768
- C:\Windows\System\vgUlPrD.exe
  C:\Windows\System\vgUlPrD.exe
  2⤵
  PID:10832
- C:\Windows\System\mEqTKpV.exe
  C:\Windows\System\mEqTKpV.exe
  2⤵
  PID:10872
- C:\Windows\System\YthLvdB.exe
  C:\Windows\System\YthLvdB.exe
  2⤵
  PID:10944
- C:\Windows\System\wRgjslx.exe
  C:\Windows\System\wRgjslx.exe
  2⤵
  PID:11008
- C:\Windows\System\LIsXmAk.exe
  C:\Windows\System\LIsXmAk.exe
  2⤵
  PID:11064
- C:\Windows\System\PutWeyt.exe
  C:\Windows\System\PutWeyt.exe
  2⤵
  PID:11144
- C:\Windows\System\iCPkVjm.exe
  C:\Windows\System\iCPkVjm.exe
  2⤵
  PID:11204
- C:\Windows\System\NLQSdFJ.exe
  C:\Windows\System\NLQSdFJ.exe
  2⤵
  PID:11256
- C:\Windows\System\tLmfQYZ.exe
  C:\Windows\System\tLmfQYZ.exe
  2⤵
  PID:10372
- C:\Windows\System\jeNDaun.exe
  C:\Windows\System\jeNDaun.exe
  2⤵
  PID:10492
- C:\Windows\System\PoRQnKu.exe
  C:\Windows\System\PoRQnKu.exe
  2⤵
  PID:10664
- C:\Windows\System\PGlgnge.exe
  C:\Windows\System\PGlgnge.exe
  2⤵
  PID:10828
- C:\Windows\System\jQGnGAT.exe
  C:\Windows\System\jQGnGAT.exe
  2⤵
  PID:10928
- C:\Windows\System\PyJrfdx.exe
  C:\Windows\System\PyJrfdx.exe
  2⤵
  PID:11036
- C:\Windows\System\CkJDkls.exe
  C:\Windows\System\CkJDkls.exe
  2⤵
  PID:10644
- C:\Windows\System\ogMDbjl.exe
  C:\Windows\System\ogMDbjl.exe
  2⤵
  PID:10268
- C:\Windows\System\IixtXpz.exe
  C:\Windows\System\IixtXpz.exe
  2⤵
  PID:10620
- C:\Windows\System\gqmrcIc.exe
  C:\Windows\System\gqmrcIc.exe
  2⤵
  PID:10852
- C:\Windows\System\gwPQWvx.exe
  C:\Windows\System\gwPQWvx.exe
  2⤵
  PID:11112
- C:\Windows\System\uHrAmdU.exe
  C:\Windows\System\uHrAmdU.exe
  2⤵
  PID:10556
- C:\Windows\System\aVeZneg.exe
  C:\Windows\System\aVeZneg.exe
  2⤵
  PID:11000
- C:\Windows\System\TRwkDkQ.exe
  C:\Windows\System\TRwkDkQ.exe
  2⤵
  PID:4328
- C:\Windows\System\KjCaweL.exe
  C:\Windows\System\KjCaweL.exe
  2⤵
  PID:10628
- C:\Windows\System\gcSZoDn.exe
  C:\Windows\System\gcSZoDn.exe
  2⤵
  PID:11288
- C:\Windows\System\kZBDUKK.exe
  C:\Windows\System\kZBDUKK.exe
  2⤵
  PID:11316
- C:\Windows\System\GvjsHIH.exe
  C:\Windows\System\GvjsHIH.exe
  2⤵
  PID:11344
- C:\Windows\System\qfQufKZ.exe
  C:\Windows\System\qfQufKZ.exe
  2⤵
  PID:11372
- C:\Windows\System\EJhshOw.exe
  C:\Windows\System\EJhshOw.exe
  2⤵
  PID:11400
- C:\Windows\System\eHrUSeH.exe
  C:\Windows\System\eHrUSeH.exe
  2⤵
  PID:11428
- C:\Windows\System\rtMVvyu.exe
  C:\Windows\System\rtMVvyu.exe
  2⤵
  PID:11456
- C:\Windows\System\OFeBaYW.exe
  C:\Windows\System\OFeBaYW.exe
  2⤵
  PID:11484
- C:\Windows\System\kcMYugp.exe
  C:\Windows\System\kcMYugp.exe
  2⤵
  PID:11512
- C:\Windows\System\diSkMma.exe
  C:\Windows\System\diSkMma.exe
  2⤵
  PID:11540
- C:\Windows\System\yEiIyen.exe
  C:\Windows\System\yEiIyen.exe
  2⤵
  PID:11568
- C:\Windows\System\SOTAigG.exe
  C:\Windows\System\SOTAigG.exe
  2⤵
  PID:11596
- C:\Windows\System\jSREAJU.exe
  C:\Windows\System\jSREAJU.exe
  2⤵
  PID:11624
- C:\Windows\System\JMfwjJp.exe
  C:\Windows\System\JMfwjJp.exe
  2⤵
  PID:11652
- C:\Windows\System\ugHWNdh.exe
  C:\Windows\System\ugHWNdh.exe
  2⤵
  PID:11680
- C:\Windows\System\bMdTZJB.exe
  C:\Windows\System\bMdTZJB.exe
  2⤵
  PID:11708
- C:\Windows\System\tqewpLc.exe
  C:\Windows\System\tqewpLc.exe
  2⤵
  PID:11736
- C:\Windows\System\ZVMhiLp.exe
  C:\Windows\System\ZVMhiLp.exe
  2⤵
  PID:11764
- C:\Windows\System\DhJpnGD.exe
  C:\Windows\System\DhJpnGD.exe
  2⤵
  PID:11792
- C:\Windows\System\gmuFOcv.exe
  C:\Windows\System\gmuFOcv.exe
  2⤵
  PID:11820
- C:\Windows\System\LSJtLXc.exe
  C:\Windows\System\LSJtLXc.exe
  2⤵
  PID:11848
- C:\Windows\System\SNZNwKw.exe
  C:\Windows\System\SNZNwKw.exe
  2⤵
  PID:11876
- C:\Windows\System\EpftwAh.exe
  C:\Windows\System\EpftwAh.exe
  2⤵
  PID:11904
- C:\Windows\System\feEtbJD.exe
  C:\Windows\System\feEtbJD.exe
  2⤵
  PID:11932
- C:\Windows\System\iqkWjNR.exe
  C:\Windows\System\iqkWjNR.exe
  2⤵
  PID:11960
- C:\Windows\System\xCcQRZU.exe
  C:\Windows\System\xCcQRZU.exe
  2⤵
  PID:11988
- C:\Windows\System\vhiVBhO.exe
  C:\Windows\System\vhiVBhO.exe
  2⤵
  PID:12020
- C:\Windows\System\wZYgiAR.exe
  C:\Windows\System\wZYgiAR.exe
  2⤵
  PID:12044
- C:\Windows\System\TERRpgQ.exe
  C:\Windows\System\TERRpgQ.exe
  2⤵
  PID:12068
- C:\Windows\System\ahPPDwD.exe
  C:\Windows\System\ahPPDwD.exe
  2⤵
  PID:12112
- C:\Windows\System\uPVMEgD.exe
  C:\Windows\System\uPVMEgD.exe
  2⤵
  PID:12128
- C:\Windows\System\MWQXmCZ.exe
  C:\Windows\System\MWQXmCZ.exe
  2⤵
  PID:12168
- C:\Windows\System\enjFZWK.exe
  C:\Windows\System\enjFZWK.exe
  2⤵
  PID:12184
- C:\Windows\System\abbtWzK.exe
  C:\Windows\System\abbtWzK.exe
  2⤵
  PID:12216
- C:\Windows\System\sBZXQdZ.exe
  C:\Windows\System\sBZXQdZ.exe
  2⤵
  PID:12256
- C:\Windows\System\aheBNhA.exe
  C:\Windows\System\aheBNhA.exe
  2⤵
  PID:12284
- C:\Windows\System\QHICbLx.exe
  C:\Windows\System\QHICbLx.exe
  2⤵
  PID:11328
- C:\Windows\System\LCEOxcf.exe
  C:\Windows\System\LCEOxcf.exe
  2⤵
  PID:11416
- C:\Windows\System\NQGmGBG.exe
  C:\Windows\System\NQGmGBG.exe
  2⤵
  PID:11452
- C:\Windows\System\rSEazFo.exe
  C:\Windows\System\rSEazFo.exe
  2⤵
  PID:11496
- C:\Windows\System\xsDbKKc.exe
  C:\Windows\System\xsDbKKc.exe
  2⤵
  PID:11560
- C:\Windows\System\BzfYkYZ.exe
  C:\Windows\System\BzfYkYZ.exe
  2⤵
  PID:11620
- C:\Windows\System\NvXklwW.exe
  C:\Windows\System\NvXklwW.exe
  2⤵
  PID:11672
- C:\Windows\System\DmedByQ.exe
  C:\Windows\System\DmedByQ.exe
  2⤵
  PID:11732
- C:\Windows\System\WXnmbQv.exe
  C:\Windows\System\WXnmbQv.exe
  2⤵
  PID:11804
- C:\Windows\System\ncoRMpn.exe
  C:\Windows\System\ncoRMpn.exe
  2⤵
  PID:11868
- C:\Windows\System\akXsJhg.exe
  C:\Windows\System\akXsJhg.exe
  2⤵
  PID:11924
- C:\Windows\System\BHJdJfm.exe
  C:\Windows\System\BHJdJfm.exe
  2⤵
  PID:11984
- C:\Windows\System\lASJdAy.exe
  C:\Windows\System\lASJdAy.exe
  2⤵
  PID:12036
- C:\Windows\System\EQTMNqy.exe
  C:\Windows\System\EQTMNqy.exe
  2⤵
  PID:12104
- C:\Windows\System\szmeYNw.exe
  C:\Windows\System\szmeYNw.exe
  2⤵
  PID:12152
- C:\Windows\System\MrTspjq.exe
  C:\Windows\System\MrTspjq.exe
  2⤵
  PID:12040
- C:\Windows\System\SzirhMy.exe
  C:\Windows\System\SzirhMy.exe
  2⤵
  PID:12252
- C:\Windows\System\HmJfUcE.exe
  C:\Windows\System\HmJfUcE.exe
  2⤵
  PID:11364
- C:\Windows\System\nUpbyQm.exe
  C:\Windows\System\nUpbyQm.exe
  2⤵
  PID:4924
- C:\Windows\System\DgPdacb.exe
  C:\Windows\System\DgPdacb.exe
  2⤵
  PID:11532
- C:\Windows\System\IPBsaAO.exe
  C:\Windows\System\IPBsaAO.exe
  2⤵
  PID:11648
- C:\Windows\System\yxJmMWy.exe
  C:\Windows\System\yxJmMWy.exe
  2⤵
  PID:11788
- C:\Windows\System\TMdITlr.exe
  C:\Windows\System\TMdITlr.exe
  2⤵
  PID:11948
- C:\Windows\System\SPdxMaZ.exe
  C:\Windows\System\SPdxMaZ.exe
  2⤵
  PID:12092
- C:\Windows\System\WpSOrgv.exe
  C:\Windows\System\WpSOrgv.exe
  2⤵
  PID:12004
- C:\Windows\System\XvZsqPq.exe
  C:\Windows\System\XvZsqPq.exe
  2⤵
  PID:3644
- C:\Windows\System\UWpRFbi.exe
  C:\Windows\System\UWpRFbi.exe
  2⤵
  PID:11616
- C:\Windows\System\wymcQNE.exe
  C:\Windows\System\wymcQNE.exe
  2⤵
  PID:11916
- C:\Windows\System\CgwnQCy.exe
  C:\Windows\System\CgwnQCy.exe
  2⤵
  PID:12280
- C:\Windows\System\JgYqWNl.exe
  C:\Windows\System\JgYqWNl.exe
  2⤵
  PID:11900
- C:\Windows\System\oVvwYGP.exe
  C:\Windows\System\oVvwYGP.exe
  2⤵
  PID:11784
- C:\Windows\System\IUtsIzl.exe
  C:\Windows\System\IUtsIzl.exe
  2⤵
  PID:12296
- C:\Windows\System\tCBDiAc.exe
  C:\Windows\System\tCBDiAc.exe
  2⤵
  PID:12324
- C:\Windows\System\EDCKwDE.exe
  C:\Windows\System\EDCKwDE.exe
  2⤵
  PID:12352
- C:\Windows\System\eLURhrX.exe
  C:\Windows\System\eLURhrX.exe
  2⤵
  PID:12380
- C:\Windows\System\yBQnPea.exe
  C:\Windows\System\yBQnPea.exe
  2⤵
  PID:12408
- C:\Windows\System\iNMGkiK.exe
  C:\Windows\System\iNMGkiK.exe
  2⤵
  PID:12436
- C:\Windows\System\sAxUHNN.exe
  C:\Windows\System\sAxUHNN.exe
  2⤵
  PID:12464
- C:\Windows\System\bAsXsTC.exe
  C:\Windows\System\bAsXsTC.exe
  2⤵
  PID:12492
- C:\Windows\System\YZnJKdB.exe
  C:\Windows\System\YZnJKdB.exe
  2⤵
  PID:12520
- C:\Windows\System\ASdtCoV.exe
  C:\Windows\System\ASdtCoV.exe
  2⤵
  PID:12548
- C:\Windows\System\hcDNdif.exe
  C:\Windows\System\hcDNdif.exe
  2⤵
  PID:12576
- C:\Windows\System\CutIyxh.exe
  C:\Windows\System\CutIyxh.exe
  2⤵
  PID:12596
- C:\Windows\System\bdANblN.exe
  C:\Windows\System\bdANblN.exe
  2⤵
  PID:12648
- C:\Windows\System\dWKfSCG.exe
  C:\Windows\System\dWKfSCG.exe
  2⤵
  PID:12664
- C:\Windows\System\ThnYwxI.exe
  C:\Windows\System\ThnYwxI.exe
  2⤵
  PID:12692
- C:\Windows\System\gtlMbRs.exe
  C:\Windows\System\gtlMbRs.exe
  2⤵
  PID:12720
- C:\Windows\System\zWsywjZ.exe
  C:\Windows\System\zWsywjZ.exe
  2⤵
  PID:12748
- C:\Windows\System\QUeePAJ.exe
  C:\Windows\System\QUeePAJ.exe
  2⤵
  PID:12776
- C:\Windows\System\MccCmNP.exe
  C:\Windows\System\MccCmNP.exe
  2⤵
  PID:12804
- C:\Windows\System\opNovGB.exe
  C:\Windows\System\opNovGB.exe
  2⤵
  PID:12832
- C:\Windows\System\EogFxvh.exe
  C:\Windows\System\EogFxvh.exe
  2⤵
  PID:12860
- C:\Windows\System\ZuSRCFw.exe
  C:\Windows\System\ZuSRCFw.exe
  2⤵
  PID:12888
- C:\Windows\System\QODtZjQ.exe
  C:\Windows\System\QODtZjQ.exe
  2⤵
  PID:12916
- C:\Windows\System\kghXXEi.exe
  C:\Windows\System\kghXXEi.exe
  2⤵
  PID:12944
- C:\Windows\System\KPRbpDp.exe
  C:\Windows\System\KPRbpDp.exe
  2⤵
  PID:12972
- C:\Windows\System\jsGeDdF.exe
  C:\Windows\System\jsGeDdF.exe
  2⤵
  PID:13000
- C:\Windows\System\jxCafph.exe
  C:\Windows\System\jxCafph.exe
  2⤵
  PID:13028
- C:\Windows\System\INZOYlK.exe
  C:\Windows\System\INZOYlK.exe
  2⤵
  PID:13056
- C:\Windows\System\nhUylmz.exe
  C:\Windows\System\nhUylmz.exe
  2⤵
  PID:13084
- C:\Windows\System\ROwbGuR.exe
  C:\Windows\System\ROwbGuR.exe
  2⤵
  PID:13112
- C:\Windows\System\FRoDhgQ.exe
  C:\Windows\System\FRoDhgQ.exe
  2⤵
  PID:13140
- C:\Windows\System\aeMTunx.exe
  C:\Windows\System\aeMTunx.exe
  2⤵
  PID:13168
- C:\Windows\System\jzvYdcZ.exe
  C:\Windows\System\jzvYdcZ.exe
  2⤵
  PID:13196
- C:\Windows\System\OvQeKuR.exe
  C:\Windows\System\OvQeKuR.exe
  2⤵
  PID:13224
- C:\Windows\System\TzXxeXa.exe
  C:\Windows\System\TzXxeXa.exe
  2⤵
  PID:13252
- C:\Windows\System\HznYgZy.exe
  C:\Windows\System\HznYgZy.exe
  2⤵
  PID:13280
- C:\Windows\System\iMkTliT.exe
  C:\Windows\System\iMkTliT.exe
  2⤵
  PID:13308
- C:\Windows\System\dOEjYNP.exe
  C:\Windows\System\dOEjYNP.exe
  2⤵
  PID:12344
- C:\Windows\System\BNaQGso.exe
  C:\Windows\System\BNaQGso.exe
  2⤵
  PID:12404
- C:\Windows\System\FElQSPG.exe
  C:\Windows\System\FElQSPG.exe
  2⤵
  PID:12476
- C:\Windows\System\WwlduPD.exe
  C:\Windows\System\WwlduPD.exe
  2⤵
  PID:12540
- C:\Windows\System\aahlSuz.exe
  C:\Windows\System\aahlSuz.exe
  2⤵
  PID:12592
- C:\Windows\System\kbPSTaV.exe
  C:\Windows\System\kbPSTaV.exe
  2⤵
  PID:12656
- C:\Windows\System\LftHcZg.exe
  C:\Windows\System\LftHcZg.exe
  2⤵
  PID:12716
- C:\Windows\System\OZkHCEj.exe
  C:\Windows\System\OZkHCEj.exe
  2⤵
  PID:12788
- C:\Windows\System\twpUYGH.exe
  C:\Windows\System\twpUYGH.exe
  2⤵
  PID:12852
- C:\Windows\System\GGQtSyA.exe
  C:\Windows\System\GGQtSyA.exe
  2⤵
  PID:12912
- C:\Windows\System\tTxBKbJ.exe
  C:\Windows\System\tTxBKbJ.exe
  2⤵
  PID:12988
- C:\Windows\System\lEGvWAN.exe
  C:\Windows\System\lEGvWAN.exe
  2⤵
  PID:13052
- C:\Windows\System\kRbkAbM.exe
  C:\Windows\System\kRbkAbM.exe
  2⤵
  PID:13108
- C:\Windows\System\LjmKWdN.exe
  C:\Windows\System\LjmKWdN.exe
  2⤵
  PID:13184
- C:\Windows\System\rmdbuFQ.exe
  C:\Windows\System\rmdbuFQ.exe
  2⤵
  PID:13244
- C:\Windows\System\TIpTsml.exe
  C:\Windows\System\TIpTsml.exe
  2⤵
  PID:12316
- C:\Windows\System\doIQgGD.exe
  C:\Windows\System\doIQgGD.exe
  2⤵
  PID:12456
- C:\Windows\System\CNMTOhj.exe
  C:\Windows\System\CNMTOhj.exe
  2⤵
  PID:12568
- C:\Windows\System\OFgQFLV.exe
  C:\Windows\System\OFgQFLV.exe
  2⤵
  PID:12712
- C:\Windows\System\kwgUpwo.exe
  C:\Windows\System\kwgUpwo.exe
  2⤵
  PID:12844
- C:\Windows\System\NjMausD.exe
  C:\Windows\System\NjMausD.exe
  2⤵
  PID:13020
- C:\Windows\System\RuWpfbv.exe
  C:\Windows\System\RuWpfbv.exe
  2⤵
  PID:13164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uxpxrb2c.wr3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABAeFVx.exe

Filesize
3.1MB

MD5
861e15f5fe4c61425fbef84f9eb516fa

SHA1
b4eaf0620000bd38fb679cb0ef69bab3e0275b01

SHA256
687ad589c1528b6fbe2b6b512e29af18dd3e2ccd140c280679dbd6ab6ccf9fc1

SHA512
5e3051c08692911fa33834a0c9c503c3d3cf1800e2faaa3ac7ea3bf0faab1d8d383a25850ca8c305c4a8d4d5ace4d151c19d1832419ad2df9033f44e0f74b433

Download Submit
C:\Windows\System\ArTytdG.exe

Filesize
3.1MB

MD5
aaddf03414b4d68b368059cc97007613

SHA1
8357243ce8eb11bf59d24e8f21b836c487f5353d

SHA256
0d1f994aabaeeda0fd228d7b85fd14b66860bac5e5425ef9fbd85a293d676dfb

SHA512
de25eb81b0354b72689bcf3fffe922154210fa520b5a0ff75433336a24f992c3ed1c37dea4e5de4c5eff4ec7d52434b5f9ad73e98797ed825d9c90e4e48f42dd

Download Submit
C:\Windows\System\CpiVZVd.exe

Filesize
3.1MB

MD5
33befb344ecc9e03fcdda70acbb462e0

SHA1
23414d489078155cc2e052228f7bea82e66deed5

SHA256
485b3846b9bc2bef826fb58c0f3d59fa71d77379e20fb6c3950d1ee81a6cacc5

SHA512
a68f736282558f191b324ad82267d4f74200ffa4f5393f0a60bfbd77e131e6a36625166b7aa00c126ef8abace9751531c068e979723e8513d1d37ae79f168e57

Download Submit
C:\Windows\System\DEEXcuA.exe

Filesize
3.1MB

MD5
d511014cfc8b4af72e05844c016ce904

SHA1
263b593997130354ec7f59150373de4cc959b113

SHA256
85633704c81bafc67bab11760b580dfa067ab827641c29339758d2d0c78b59bc

SHA512
fe06c7aa095f100bbfadf941d04ef1619abac3d09912161557775fa717210438e395de3788d60e7e0292f1c149788e60ce6cfbfd3c5cbe61442642af9bf1a13d

Download Submit
C:\Windows\System\FPbryvb.exe

Filesize
3.1MB

MD5
a69291f6ee1899b26901afdfd08dd230

SHA1
954ad88f7d2ca725b2064058b6ec642c54f9e866

SHA256
80ca7e7512e77f4ee72482f11e5d0877883a4dc827f08e2a189234951eea4957

SHA512
a0296d54bb15b5f5ab6cf0932d663a9e8282fa2cc7a951c16b138985f7c03ccfc35fa1949b22b224ad7b3be0e4d1686e314dad2664b678850afaab9874b9b85c

Download Submit
C:\Windows\System\FtyatZH.exe

Filesize
3.1MB

MD5
cd4cc587df4e920a5c2c54938a20da54

SHA1
cd72c1a1f4b0358adff2dd3387b266143a65e0a6

SHA256
79d75333eb09464c9de34e4e5140474ca1872c8cc4c5b406563d5a76452aa605

SHA512
b9a7d4e204d59e5db55d3552da612739850677b4ebc8c7dff2ddc5059801c915f28fa4412adc6f02c12f4288afc9fdf6e5eede487889ede29d673c32183c0018

Download Submit
C:\Windows\System\HIaEakX.exe

Filesize
3.1MB

MD5
069124921ba999a73f41a46824734460

SHA1
e41b3df645e29a981a2e72c57f0fd08c9b04303a

SHA256
c20e80246b55d43929fe275b8f8ab299af98b25aa42493e97b4281d3c44e3078

SHA512
268243d44ec99ca47370e9d439eb991aff34d2b7d47d8356a29e7575025011e50c4a8aef2c6f77d964d303729041f0312e9abe49336b686bc360b4c34210cc53

Download Submit
C:\Windows\System\IOwfoIA.exe

Filesize
3.1MB

MD5
2c028d2ccc837df514ecf4fac36ee857

SHA1
ab0871772886adf7972f03032689d69a47e41721

SHA256
f65bf817067772322876638f3814e8b3ac4666f6e19fd634433a3690e9c9cebe

SHA512
0080079e8bd2c7da932acdfedbf285a74501210e846a06a5cb40008d1bc1c8dd449d1ae3364c15988d64fbcfc0ceaf4bef36a85398263b0c397ec8e3ac4513b7

Download Submit
C:\Windows\System\IvzlUTg.exe

Filesize
3.1MB

MD5
d6ff11f5397d96171777136b62f5682a

SHA1
873b8d23e75370b1ecd84cedf7a6238fc494cdf7

SHA256
c5484f179d88f3d76b27e9a1cb349e48bf85dd7c8edd84431c99c4740733838d

SHA512
5a78ba68c6dc6528eb5c04aa5660dfd5e0ed4e5dbe2ab5600895f39b3046e5872b382d042e92c6dae5dbb73d06600a58db173e7e7a800a03e022ceb1f857b99a

Download Submit
C:\Windows\System\JDpxQlc.exe

Filesize
3.1MB

MD5
8cc3a89307d2de600236173bd4c716d2

SHA1
6ff7ef8a97e69b1569b8ea2c3dc0562455be8935

SHA256
ebf9730082376d035b3bd1075a96be0ce78db7455f602df7b819f0387bcaa688

SHA512
4b9f3d3049238a286cea7a5fb0f5d53c75f007863f4330bff9222e8e4189b8734b5acaf5dbb2b95893fb1d18e9fbc17df0bdb8ff27285d784ba3c4dfa167bb36

Download Submit
C:\Windows\System\JUYdpQf.exe

Filesize
3.1MB

MD5
897ad9c8bf29b2037443b588f2720c17

SHA1
f48a74fed73e5235464aee04e4f112031ca1e141

SHA256
e8247a053fd7cd331e0aaf431c44c9b2c0758b226fd9f0ea34855da83af7810a

SHA512
5d66a1a984252d0c7026863d90bd6cbdcac0365499746dd355f10d271ba7d9d92336b1e31f270fdb60f4943133de6577e3f4dda2ecfac69df880b3aaff2f64ee

Download Submit
C:\Windows\System\LDiKmCJ.exe

Filesize
3.0MB

MD5
98d143551c5c3a3f932123b1f651b205

SHA1
1d3a2102ba6a80d8a01f8a70b866431529ecbbcd

SHA256
852629b092bcec5cb01d745137e31d515d29d8bc4e4f4689a4f390009da36fc0

SHA512
125557ef19bd75f9fc05c10561d5aed115cf1b813197dd18890a2d41af0a5960f3e9655985194901eeffa7835efa1a6654da0eaadb4fc2fffe77dcdb09e9545b

Download Submit
C:\Windows\System\MoVKLyg.exe

Filesize
3.1MB

MD5
7640dc4f0d5aef36624208f2842dd151

SHA1
5923ba0c4c09cc445dbdb371971ad3d4de8b4d8c

SHA256
74ffdf6a7d9b2d3d2b1ae337a45ca091beeb4a2156c47dc101c9d360cebccec0

SHA512
199a2dbe62ef69db0c4052b822a7e09e8d043c38f0d18d09d581522c78e5d664da86c55c09c07d1a4cf354a3974a8dcdeeee79c93d214cd826c9c127e7af93eb

Download Submit
C:\Windows\System\NWOvkJl.exe

Filesize
3.1MB

MD5
4603222e12d39e6e968e03f1da396a81

SHA1
b77a99cd1977cc89e01acf824ce9f635035efd39

SHA256
81180506f828000f82732171a680cc845c02b1f9c7bc6adb87fe69f507391e09

SHA512
6ac0868316f4da80463533a4abb18db217926006924dc616a64c179b45c18c57d2cf5787113403ae6828237a067cbdb1ef74965ac0627dfa2773848cdeed30da

Download Submit
C:\Windows\System\QrnBbUN.exe

Filesize
3.1MB

MD5
d7c6b4904d42ad60443de11469aa8d60

SHA1
d95d8cd466ab9b851ab9435739fbf96a8b90ad82

SHA256
19a563045081e6aabcf9b4fa5ccfdc617dbb813377b5257cb3160acc3abdf4c2

SHA512
a83519a1f104acf50b874fff3279f2fc436e07d87a9e58f6d40894318a26135c24dc310d85e947ad1f0f6a1570f63b29e82aebeb099150fa51165b16b678cb46

Download Submit
C:\Windows\System\RBbCKuS.exe

Filesize
3.1MB

MD5
840b1441cd87ac00e7899c6b1cd1d5c0

SHA1
0dd659cd0570ff2f36441c8999af4c87b625ceab

SHA256
2e191384da271f9ff5b95757b860963f543857aa9364288cdecd2d73b947e022

SHA512
4f99fba413b731317b62ddd354bfd694ba05dfa1b09bfb91085bb6d27fe387c6d7e87327727582f1baf5814284b618c87c73703db40529bf9e7f535f4ab4ab95

Download Submit
C:\Windows\System\THnyyQs.exe

Filesize
3.1MB

MD5
6cfe7916528655af979524b99e5b8922

SHA1
6523b3ec35f563a4b93cb4f476bcd83fc37f13d3

SHA256
e94a2e3f067edf07527ef618e1dd31c97a4a7ceafd2e88d3c6ffef25720c607e

SHA512
ff12d67e9d2079833571d4ab15ace286c4759bf7f11da2e4dd8173a68dd792ae0b83375ae8073540df8eb20edcd46487a142c60d619596b8c32fde4424ca6371

Download Submit
C:\Windows\System\WImtZzT.exe

Filesize
3.1MB

MD5
2f9ce0b2e1cc9b67ee55740ce8c49db3

SHA1
8335979db93d8222360a73382e1bfa7cf043bea0

SHA256
5ce4d1eefb564f630f6a7ed87764299442fad4aa73968cec523593978f9c198e

SHA512
4a63c9ce0f5752a679c9a1c9358b56163d77bc42efab14ebd81de1cb08fd6b78b2732b1ec3b8c170ee2abab57f13673fcf619775b26a66c3599a5fa15e7ec020

Download Submit
C:\Windows\System\WdvVZfg.exe

Filesize
3.1MB

MD5
92513e77e4ba6a3afbeb6bdc982c6eaa

SHA1
5b037312f636d3af5c0a66a5101bb89b97f36d4f

SHA256
caf6b247fb08ac530ab090a3470dac1a2f84b4730d6cc07e548c831faeb3644b

SHA512
03a00cefa0834217d73e332a088011d55fd0cf4ab8e5b8675a3605601ee7594488e82db88160f84e4c404b1ac6471a4f12ebc11e9bf4dc00995ab23be105fe46

Download Submit
C:\Windows\System\XFvYsyz.exe

Filesize
3.0MB

MD5
711617268805d67cb7cdf5d388ce82c3

SHA1
d7902791e97267df6b92ba1405c80a27272dba63

SHA256
ce61833484762d2372de495e5301fa141ac3802c70f77d9be1a88f819ebf3a95

SHA512
5c5e90c74ade12a0be48eb9aeef452701e60c790d2c7647395501e4dc6391a65499cffcf62e77fca3e1ebc1e5b650cc2ad8fa91e311f8857efabbb1238f867e5

Download Submit
C:\Windows\System\ZTgoCAI.exe

Filesize
3.1MB

MD5
8441e7696b2b9ac33fbe0b4b80031fef

SHA1
d7f68c4bfb091a97cf0a168954c574a94ba82944

SHA256
7d18dac7606253651b0b62e00de4bb8f9f09c3f75b76888501867124cd52d746

SHA512
39ec5ccdcf6bf03bc6e9cd99727bc58be7c785dd46ebccfe2cd7145bac717708793a14f5adba3024d40dc1e585abcd69f213b298ef369b31573148d0d416e1b5

Download Submit
C:\Windows\System\ZqLXtYq.exe

Filesize
3.1MB

MD5
7215ea2d2aab31bd3d29d72fe4851270

SHA1
93bac1ac0ac5b569a19bcb9818f083d82705d74f

SHA256
a52b593dbfd087ac12c6c7be29e934b3ebd49e616d30db5fbe1003159028d2d4

SHA512
85e2524f1775466f6dccfbac68f4af291b350380590c0e546c2073c2821ba329dd6f42f17b550f25b618f0a817cc5f4fedbedd7781fa625b2f468ae94ff267f7

Download Submit
C:\Windows\System\ewWBaMt.exe

Filesize
3.1MB

MD5
9adadf7a497ea74125ba31274bd59687

SHA1
29a9620ad15ad78b0fab1b53746e560ffc4282b8

SHA256
0997af0faced7a63019c4ff87ee75bcc91d3cbf1f4de2226e48921513a4c9e3a

SHA512
9403f97250a836d35b6a6619b36901e11f9594fceb08da9298ea16b9e719d583caf911e143f9f4cceea3f8112f5809ee1a28e5b4219a9e9f27fe7bbad2d930e0

Download Submit
C:\Windows\System\fEmHwql.exe

Filesize
3.0MB

MD5
9d31a531d2d5297fb315842069173518

SHA1
c13a0146a16996a2e70b82766b7a132c956fb9ad

SHA256
7754992682ccbf3c691974d30ce52afe308930a8c70f3d165fd77e8f26871d05

SHA512
23c9fa5c4467165af50e6d6807a8f784cce5967b6f923b09251af290f2ecb966f6e342c8139a5cea19705bf79bd628c242500bb28518aab8fedcc12a803e0d05

Download Submit
C:\Windows\System\lETGEuS.exe

Filesize
3.0MB

MD5
8724c3aceb95ddb4245a7faacc8614db

SHA1
359f2cfc43dda26935eb0aaf394f064d6aef883d

SHA256
6ec810e6745e2188b2ea73631509698f825dbb717d819a2c3cf0a019337aca3c

SHA512
5b125e38caec7e344839f24c02abb5831f250a2e18b0f8308359b7f1658ea74ec83bcad63e7b5283234b87c77eb49924dff238c033dc62015801f1787e5f2eb0

Download Submit
C:\Windows\System\lawgivo.exe

Filesize
3.1MB

MD5
19ea8ca410334474787ca0830bfbcffc

SHA1
a016bf6469840b7be3e61472f63bdd0eedb2696d

SHA256
533a8d749535e986babee057565fefc62d9297933ffc061fc5432961032a9868

SHA512
dd349f335a2af1a35dc3de10bdb67d8db63df61f50369e222617cf392dabca4b78be79f0c8f2430c6fbb90ad06ddc596825f462543a63910bc3516e474c2abac

Download Submit
C:\Windows\System\qFovwMN.exe

Filesize
3.1MB

MD5
9f3c6b6ef4ebcac3467d3a932a2c576c

SHA1
2f62196d89e392bda3b93aeb0960f94b39e46c32

SHA256
8e232d55dcfe83aecfbbbded3f88efda142d4e6b1868e8d4ea46508c7b862a82

SHA512
d9567025139e1e02582df187e7a18ee7589aef48ea797de2b9f397aae860e6cdfc211762808c18daab448207f86b8a4c95b4f6bfa59ef0e4425ef2f20320e235

Download Submit
C:\Windows\System\qIUXalC.exe

Filesize
3.1MB

MD5
35ac7df0df47f3b4937b418e05cb72fe

SHA1
4ef77916ccafa04edadf4cce155594ac85237db6

SHA256
5400e92196fb64159ed33854b85bb5eaa2624952db443d3ed26f1f5584c31dc5

SHA512
f75d6353c6a0ce5438765aa4925a35365900ac60738e6d9b57ee822e9c7d24488958254046b2499b539ab9aa68ad0b1b2df2f3b9b8c1928e35183d1ecaf9c69c

Download Submit
C:\Windows\System\sBFFoEA.exe

Filesize
3.1MB

MD5
7d82fe18b0a08d4fd09834bf9d6f9b9e

SHA1
85b6eeb75d2cc6765c4d69ed18df84d6d0b4ed16

SHA256
76f64fcd950e5110d09aa216105b21f6e19cbee6a2345f0bbcf8eb184c95ada8

SHA512
738acbb0b27b70fd538b3a30e72268f641aead8d299a09b0ce8c03091a5e246b2e8875fb786909008671d98d15ec1573f42732c9fdc6439dd6ded2d71da6c59a

Download Submit
C:\Windows\System\siAWyky.exe

Filesize
3.1MB

MD5
c6e4aba7a46d15ebf233da3172446cac

SHA1
2134476e58cec59a70c6a3ba2fafd62f76e7000f

SHA256
a59175e810303e6035a6d29243ecdfc685541dc075583edd32fbf282d609e255

SHA512
d61297d8c03c38a41c79d837bf1e4e32d0afbba79cba9fed55e4696f9d696de1d8b3c478b683e7c91cfc9b3b030d6fe5fd62487d5b33171b623927e94042dfe0

Download Submit
C:\Windows\System\sjHmDUA.exe

Filesize
3.1MB

MD5
a84f47f24f36b413457d754aff096064

SHA1
0e37b797fa8dbee0583bccc384d620aee2706090

SHA256
090c0e2c450c28f4f8ca6530a5ae378c98c7cfde84acd6b2b184cf7de9362a9e

SHA512
1782d94cfd4da1fea9be36eaa3264a2178ad48c4645b28b029140bd304e26ed58a3dc468b558db1420e82eb1de5c3a398aea4b70bb9c435c7650930bd7d3cdd5

Download Submit
C:\Windows\System\xKdgzGi.exe

Filesize
3.1MB

MD5
43490e95c9b54a61a39bcec0f84c4718

SHA1
4b7278cc89656efd742b3b1bf8e6aebac8bc5f56

SHA256
dee4dea66a94f01c1b9778d5dfed64572087668cd5b08a5b8cf3946f31f91018

SHA512
9147f45b0291b11f4f8393e292d1b07e1fc210f6d967b5294680673534d5facab4a619d3a0bd3621e39a795b2efdf913ae47232196ba8c7c5141830d2454765a

Download Submit
C:\Windows\System\yuqyHci.exe

Filesize
3.1MB

MD5
e05787d545f7814da508a22007d67693

SHA1
f303dd22554b6ef03928c7a63d5e2f368442b148

SHA256
715f3193e2790a9d2be76bb4383458eabbd732cae801642764ab728dceff7a11

SHA512
ff4029909701622667f1b4d1819ea68266a248cbcf0509a6877c7209760fffaec5a1d7b0d2f934ece96d7192c71bbecde922d7c1c2861a3168fc31b151d35d9a

Download Submit
memory/908-238-0x00007FF7B3E00000-0x00007FF7B41F6000-memory.dmp

Filesize
4.0MB

Download
memory/908-2300-0x00007FF7B3E00000-0x00007FF7B41F6000-memory.dmp

Filesize
4.0MB

Download
memory/1016-2280-0x00007FF74C720000-0x00007FF74CB16000-memory.dmp

Filesize
4.0MB

Download
memory/1016-59-0x00007FF74C720000-0x00007FF74CB16000-memory.dmp

Filesize
4.0MB

Download
memory/1104-2283-0x00007FF6A6420000-0x00007FF6A6816000-memory.dmp

Filesize
4.0MB

Download
memory/1104-85-0x00007FF6A6420000-0x00007FF6A6816000-memory.dmp

Filesize
4.0MB

Download
memory/1116-68-0x00007FF746B20000-0x00007FF746F16000-memory.dmp

Filesize
4.0MB

Download
memory/1116-2282-0x00007FF746B20000-0x00007FF746F16000-memory.dmp

Filesize
4.0MB

Download
memory/1524-2276-0x00007FF7FD5A0000-0x00007FF7FD996000-memory.dmp

Filesize
4.0MB

Download
memory/1524-2299-0x00007FF7FD5A0000-0x00007FF7FD996000-memory.dmp

Filesize
4.0MB

Download
memory/1524-151-0x00007FF7FD5A0000-0x00007FF7FD996000-memory.dmp

Filesize
4.0MB

Download
memory/1840-2297-0x00007FF6748B0000-0x00007FF674CA6000-memory.dmp

Filesize
4.0MB

Download
memory/1840-147-0x00007FF6748B0000-0x00007FF674CA6000-memory.dmp

Filesize
4.0MB

Download
memory/2304-149-0x00007FF7FA8C0000-0x00007FF7FACB6000-memory.dmp

Filesize
4.0MB

Download
memory/2304-2296-0x00007FF7FA8C0000-0x00007FF7FACB6000-memory.dmp

Filesize
4.0MB

Download
memory/2668-106-0x00007FF775880000-0x00007FF775C76000-memory.dmp

Filesize
4.0MB

Download
memory/2668-2289-0x00007FF775880000-0x00007FF775C76000-memory.dmp

Filesize
4.0MB

Download
memory/2672-2278-0x00007FF6A99E0000-0x00007FF6A9DD6000-memory.dmp

Filesize
4.0MB

Download
memory/2672-53-0x00007FF6A99E0000-0x00007FF6A9DD6000-memory.dmp

Filesize
4.0MB

Download
memory/2776-84-0x00007FF681150000-0x00007FF681546000-memory.dmp

Filesize
4.0MB

Download
memory/2776-2285-0x00007FF681150000-0x00007FF681546000-memory.dmp

Filesize
4.0MB

Download
memory/3016-2288-0x00007FF706E80000-0x00007FF707276000-memory.dmp

Filesize
4.0MB

Download
memory/3016-87-0x00007FF706E80000-0x00007FF707276000-memory.dmp

Filesize
4.0MB

Download
memory/3096-2287-0x00007FF725170000-0x00007FF725566000-memory.dmp

Filesize
4.0MB

Download
memory/3096-86-0x00007FF725170000-0x00007FF725566000-memory.dmp

Filesize
4.0MB

Download
memory/3376-2290-0x00007FF757140000-0x00007FF757536000-memory.dmp

Filesize
4.0MB

Download
memory/3376-110-0x00007FF757140000-0x00007FF757536000-memory.dmp

Filesize
4.0MB

Download
memory/3604-32-0x00007FF91BA50000-0x00007FF91C511000-memory.dmp

Filesize
10.8MB

Download
memory/3604-78-0x00007FF91BA50000-0x00007FF91C511000-memory.dmp

Filesize
10.8MB

Download
memory/3604-5-0x00007FF91BA53000-0x00007FF91BA55000-memory.dmp

Filesize
8KB

Download
memory/3604-88-0x000002CE2F9F0000-0x000002CE30196000-memory.dmp

Filesize
7.6MB

Download
memory/3604-714-0x00007FF91BA50000-0x00007FF91C511000-memory.dmp

Filesize
10.8MB

Download
memory/3604-986-0x00007FF91BA53000-0x00007FF91BA55000-memory.dmp

Filesize
8KB

Download
memory/3604-999-0x00007FF91BA50000-0x00007FF91C511000-memory.dmp

Filesize
10.8MB

Download
memory/3604-15-0x000002CE2ED80000-0x000002CE2EDA2000-memory.dmp

Filesize
136KB

Download
memory/3804-126-0x00007FF756910000-0x00007FF756D06000-memory.dmp

Filesize
4.0MB

Download
memory/3804-1830-0x00007FF756910000-0x00007FF756D06000-memory.dmp

Filesize
4.0MB

Download
memory/3804-2294-0x00007FF756910000-0x00007FF756D06000-memory.dmp

Filesize
4.0MB

Download
memory/3888-57-0x00007FF69D830000-0x00007FF69DC26000-memory.dmp

Filesize
4.0MB

Download
memory/3888-2279-0x00007FF69D830000-0x00007FF69DC26000-memory.dmp

Filesize
4.0MB

Download
memory/3988-73-0x00007FF70E320000-0x00007FF70E716000-memory.dmp

Filesize
4.0MB

Download
memory/3988-2284-0x00007FF70E320000-0x00007FF70E716000-memory.dmp

Filesize
4.0MB

Download
memory/4208-38-0x00007FF6E5350000-0x00007FF6E5746000-memory.dmp

Filesize
4.0MB

Download
memory/4208-2277-0x00007FF6E5350000-0x00007FF6E5746000-memory.dmp

Filesize
4.0MB

Download
memory/4272-143-0x00007FF6D95B0000-0x00007FF6D99A6000-memory.dmp

Filesize
4.0MB

Download
memory/4272-2295-0x00007FF6D95B0000-0x00007FF6D99A6000-memory.dmp

Filesize
4.0MB

Download
memory/4592-119-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp

Filesize
4.0MB

Download
memory/4592-1827-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp

Filesize
4.0MB

Download
memory/4592-2292-0x00007FF736BE0000-0x00007FF736FD6000-memory.dmp

Filesize
4.0MB

Download
memory/4624-0-0x00007FF66BC10000-0x00007FF66C006000-memory.dmp

Filesize
4.0MB

Download
memory/4624-1-0x0000025696B50000-0x0000025696B60000-memory.dmp

Filesize
64KB

Download
memory/4624-232-0x00007FF66BC10000-0x00007FF66C006000-memory.dmp

Filesize
4.0MB

Download
memory/4644-107-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp

Filesize
4.0MB

Download
memory/4644-2291-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp

Filesize
4.0MB

Download
memory/4644-1824-0x00007FF615CB0000-0x00007FF6160A6000-memory.dmp

Filesize
4.0MB

Download
memory/4728-2293-0x00007FF6EA1F0000-0x00007FF6EA5E6000-memory.dmp

Filesize
4.0MB

Download
memory/4728-140-0x00007FF6EA1F0000-0x00007FF6EA5E6000-memory.dmp

Filesize
4.0MB

Download
memory/4844-81-0x00007FF7244A0000-0x00007FF724896000-memory.dmp

Filesize
4.0MB

Download
memory/4844-2281-0x00007FF7244A0000-0x00007FF724896000-memory.dmp

Filesize
4.0MB

Download
memory/5032-991-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp

Filesize
4.0MB

Download
memory/5032-2286-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp

Filesize
4.0MB

Download
memory/5032-74-0x00007FF77F730000-0x00007FF77FB26000-memory.dmp

Filesize
4.0MB

Download
memory/5088-150-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp

Filesize
4.0MB

Download
memory/5088-2275-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp

Filesize
4.0MB

Download
memory/5088-2298-0x00007FF6FF920000-0x00007FF6FFD16000-memory.dmp

Filesize
4.0MB

Download