xmrig | c96e6598ad2948b20abd2bcc187b83f4c76eb54231489eb578703a16f2f35321

Analysis

max time kernel
66s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
Size

3.1MB
MD5

41a51ade978ff76a1a749a6bcab39d00
SHA1

dc29efc01cba0252cac216b5a12aa184ede41741
SHA256

c96e6598ad2948b20abd2bcc187b83f4c76eb54231489eb578703a16f2f35321
SHA512

fe3822aa8d6435f67ee497f0426bc2889a069f23f0047d066fc9962be03288f195cd637f47ac5ccf09e0b0fa12047167d8fdbdec52627a9cc0c6b1d684efd71f
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3204-0-0x00007FF6A96D0000-0x00007FF6A9AC6000-memory.dmp	xmrig
behavioral2/files/0x000a000000023419-7.dat	xmrig
behavioral2/memory/3592-13-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-20.dat	xmrig
behavioral2/memory/224-42-0x00007FF6474D0000-0x00007FF6478C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-53.dat	xmrig
behavioral2/files/0x0007000000023429-64.dat	xmrig
behavioral2/files/0x000700000002342f-112.dat	xmrig
behavioral2/files/0x0007000000023431-116.dat	xmrig
behavioral2/files/0x0007000000023435-136.dat	xmrig
behavioral2/files/0x0007000000023439-183.dat	xmrig
behavioral2/memory/2872-190-0x00007FF7BC630000-0x00007FF7BCA26000-memory.dmp	xmrig
behavioral2/memory/4404-198-0x00007FF6CEFE0000-0x00007FF6CF3D6000-memory.dmp	xmrig
behavioral2/memory/2780-202-0x00007FF79E330000-0x00007FF79E726000-memory.dmp	xmrig
behavioral2/memory/4456-201-0x00007FF6C2230000-0x00007FF6C2626000-memory.dmp	xmrig
behavioral2/memory/2924-200-0x00007FF74DA90000-0x00007FF74DE86000-memory.dmp	xmrig
behavioral2/memory/2752-199-0x00007FF6B4A60000-0x00007FF6B4E56000-memory.dmp	xmrig
behavioral2/memory/1580-195-0x00007FF684F20000-0x00007FF685316000-memory.dmp	xmrig
behavioral2/memory/1300-194-0x00007FF6FCE80000-0x00007FF6FD276000-memory.dmp	xmrig
behavioral2/memory/2232-193-0x00007FF680630000-0x00007FF680A26000-memory.dmp	xmrig
behavioral2/memory/3196-192-0x00007FF686720000-0x00007FF686B16000-memory.dmp	xmrig
behavioral2/memory/3232-191-0x00007FF676D50000-0x00007FF677146000-memory.dmp	xmrig
behavioral2/memory/624-189-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp	xmrig
behavioral2/memory/2416-188-0x00007FF666920000-0x00007FF666D16000-memory.dmp	xmrig
behavioral2/memory/2720-186-0x00007FF6C6400000-0x00007FF6C67F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-181.dat	xmrig
behavioral2/memory/452-180-0x00007FF78B850000-0x00007FF78BC46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-178.dat	xmrig
behavioral2/files/0x0007000000023436-176.dat	xmrig
behavioral2/files/0x000700000002343d-175.dat	xmrig
behavioral2/memory/2328-174-0x00007FF6F1F40000-0x00007FF6F2336000-memory.dmp	xmrig
behavioral2/memory/4408-173-0x00007FF6D7280000-0x00007FF6D7676000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-171.dat	xmrig
behavioral2/files/0x000700000002343a-170.dat	xmrig
behavioral2/files/0x000800000002341a-164.dat	xmrig
behavioral2/files/0x0007000000023433-162.dat	xmrig
behavioral2/files/0x0007000000023432-160.dat	xmrig
behavioral2/memory/960-153-0x00007FF721540000-0x00007FF721936000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-137.dat	xmrig
behavioral2/files/0x000700000002342d-134.dat	xmrig
behavioral2/files/0x000700000002342e-126.dat	xmrig
behavioral2/files/0x000700000002342c-128.dat	xmrig
behavioral2/memory/4264-103-0x00007FF654FA0000-0x00007FF655396000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-96.dat	xmrig
behavioral2/files/0x0007000000023428-88.dat	xmrig
behavioral2/files/0x0007000000023425-81.dat	xmrig
behavioral2/memory/4104-80-0x00007FF6871C0000-0x00007FF6875B6000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-86.dat	xmrig
behavioral2/files/0x0007000000023426-68.dat	xmrig
behavioral2/memory/4036-67-0x00007FF72CD40000-0x00007FF72D136000-memory.dmp	xmrig
behavioral2/memory/388-65-0x00007FF626170000-0x00007FF626566000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-61.dat	xmrig
behavioral2/files/0x0007000000023421-51.dat	xmrig
behavioral2/files/0x0007000000023423-49.dat	xmrig
behavioral2/files/0x0007000000023422-46.dat	xmrig
behavioral2/files/0x000700000002341e-34.dat	xmrig
behavioral2/files/0x0007000000023420-25.dat	xmrig
behavioral2/files/0x000700000002341d-11.dat	xmrig
behavioral2/memory/3592-1972-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp	xmrig
behavioral2/memory/224-1973-0x00007FF6474D0000-0x00007FF6478C6000-memory.dmp	xmrig
behavioral2/memory/3592-1974-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp	xmrig
behavioral2/memory/4104-1975-0x00007FF6871C0000-0x00007FF6875B6000-memory.dmp	xmrig
behavioral2/memory/388-1976-0x00007FF626170000-0x00007FF626566000-memory.dmp	xmrig
behavioral2/memory/4036-1977-0x00007FF72CD40000-0x00007FF72D136000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3592	dzbPgIa.exe
224	EhrQvXA.exe
388	uEmddGz.exe
4036	ydlkxrY.exe
4104	SYQJZNJ.exe
4264	KHSFyGe.exe
960	etRmftZ.exe
4408	MUOGAgU.exe
2328	qAQrrOX.exe
4404	hKnWmjq.exe
452	bZMVXPM.exe
2720	NuiTEAT.exe
2416	sxhdjNW.exe
624	mOwJFMI.exe
2752	OutvjJx.exe
2924	AHJaTGe.exe
2872	LBwzoYg.exe
3232	tyObhGQ.exe
4456	bzXgzLG.exe
2780	QGwbFyv.exe
3196	WSexyOh.exe
2232	tzafzjX.exe
1300	hkWMEwc.exe
1580	awBLzzK.exe
4328	LVFqiAc.exe
3128	scLbARG.exe
1016	XVvljyi.exe
1216	fFafBCQ.exe
1532	vsKoQNf.exe
4236	ruAKWgg.exe
4224	ABCbLbA.exe
908	LHObqnZ.exe
1792	xcXiZRI.exe
4120	mbulZrI.exe
556	yBtFdKk.exe
1480	UvKDmZv.exe
5112	rdjYmqS.exe
3120	yoaYLHp.exe
992	CsAWVgt.exe
3568	TSxRYNX.exe
3476	EvQxoqw.exe
4368	myLjyLo.exe
4668	yKfvnql.exe
3896	DhjjMQU.exe
1988	iISAkUO.exe
4412	ijqTXUU.exe
1672	OcaxQdG.exe
3428	QadzsvY.exe
2384	lhwkEeQ.exe
2696	IhOrFMw.exe
2184	KPwnzto.exe
1736	OELbWAz.exe
1524	hRrJiPB.exe
4660	vbaUpmU.exe
1932	hHminCU.exe
4116	fYNhNJQ.exe
4380	zpIpiov.exe
1212	opuIpAL.exe
4636	mOJXLCW.exe
5020	WVRCgoO.exe
3248	BwIVpRG.exe
2616	XbTLpmP.exe
4240	dierCJD.exe
4892	TAaiiZQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3204-0-0x00007FF6A96D0000-0x00007FF6A9AC6000-memory.dmp	upx
behavioral2/files/0x000a000000023419-7.dat	upx
behavioral2/memory/3592-13-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp	upx
behavioral2/files/0x000700000002341f-20.dat	upx
behavioral2/memory/224-42-0x00007FF6474D0000-0x00007FF6478C6000-memory.dmp	upx
behavioral2/files/0x0007000000023427-53.dat	upx
behavioral2/files/0x0007000000023429-64.dat	upx
behavioral2/files/0x000700000002342f-112.dat	upx
behavioral2/files/0x0007000000023431-116.dat	upx
behavioral2/files/0x0007000000023435-136.dat	upx
behavioral2/files/0x0007000000023439-183.dat	upx
behavioral2/memory/2872-190-0x00007FF7BC630000-0x00007FF7BCA26000-memory.dmp	upx
behavioral2/memory/4404-198-0x00007FF6CEFE0000-0x00007FF6CF3D6000-memory.dmp	upx
behavioral2/memory/2780-202-0x00007FF79E330000-0x00007FF79E726000-memory.dmp	upx
behavioral2/memory/4456-201-0x00007FF6C2230000-0x00007FF6C2626000-memory.dmp	upx
behavioral2/memory/2924-200-0x00007FF74DA90000-0x00007FF74DE86000-memory.dmp	upx
behavioral2/memory/2752-199-0x00007FF6B4A60000-0x00007FF6B4E56000-memory.dmp	upx
behavioral2/memory/1580-195-0x00007FF684F20000-0x00007FF685316000-memory.dmp	upx
behavioral2/memory/1300-194-0x00007FF6FCE80000-0x00007FF6FD276000-memory.dmp	upx
behavioral2/memory/2232-193-0x00007FF680630000-0x00007FF680A26000-memory.dmp	upx
behavioral2/memory/3196-192-0x00007FF686720000-0x00007FF686B16000-memory.dmp	upx
behavioral2/memory/3232-191-0x00007FF676D50000-0x00007FF677146000-memory.dmp	upx
behavioral2/memory/624-189-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp	upx
behavioral2/memory/2416-188-0x00007FF666920000-0x00007FF666D16000-memory.dmp	upx
behavioral2/memory/2720-186-0x00007FF6C6400000-0x00007FF6C67F6000-memory.dmp	upx
behavioral2/files/0x0007000000023438-181.dat	upx
behavioral2/memory/452-180-0x00007FF78B850000-0x00007FF78BC46000-memory.dmp	upx
behavioral2/files/0x0007000000023437-178.dat	upx
behavioral2/files/0x0007000000023436-176.dat	upx
behavioral2/files/0x000700000002343d-175.dat	upx
behavioral2/memory/2328-174-0x00007FF6F1F40000-0x00007FF6F2336000-memory.dmp	upx
behavioral2/memory/4408-173-0x00007FF6D7280000-0x00007FF6D7676000-memory.dmp	upx
behavioral2/files/0x0007000000023434-171.dat	upx
behavioral2/files/0x000700000002343a-170.dat	upx
behavioral2/files/0x000800000002341a-164.dat	upx
behavioral2/files/0x0007000000023433-162.dat	upx
behavioral2/files/0x0007000000023432-160.dat	upx
behavioral2/memory/960-153-0x00007FF721540000-0x00007FF721936000-memory.dmp	upx
behavioral2/files/0x0007000000023430-137.dat	upx
behavioral2/files/0x000700000002342d-134.dat	upx
behavioral2/files/0x000700000002342e-126.dat	upx
behavioral2/files/0x000700000002342c-128.dat	upx
behavioral2/memory/4264-103-0x00007FF654FA0000-0x00007FF655396000-memory.dmp	upx
behavioral2/files/0x000700000002342b-96.dat	upx
behavioral2/files/0x0007000000023428-88.dat	upx
behavioral2/files/0x0007000000023425-81.dat	upx
behavioral2/memory/4104-80-0x00007FF6871C0000-0x00007FF6875B6000-memory.dmp	upx
behavioral2/files/0x000700000002342a-86.dat	upx
behavioral2/files/0x0007000000023426-68.dat	upx
behavioral2/memory/4036-67-0x00007FF72CD40000-0x00007FF72D136000-memory.dmp	upx
behavioral2/memory/388-65-0x00007FF626170000-0x00007FF626566000-memory.dmp	upx
behavioral2/files/0x0007000000023424-61.dat	upx
behavioral2/files/0x0007000000023421-51.dat	upx
behavioral2/files/0x0007000000023423-49.dat	upx
behavioral2/files/0x0007000000023422-46.dat	upx
behavioral2/files/0x000700000002341e-34.dat	upx
behavioral2/files/0x0007000000023420-25.dat	upx
behavioral2/files/0x000700000002341d-11.dat	upx
behavioral2/memory/3592-1972-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp	upx
behavioral2/memory/224-1973-0x00007FF6474D0000-0x00007FF6478C6000-memory.dmp	upx
behavioral2/memory/3592-1974-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp	upx
behavioral2/memory/4104-1975-0x00007FF6871C0000-0x00007FF6875B6000-memory.dmp	upx
behavioral2/memory/388-1976-0x00007FF626170000-0x00007FF626566000-memory.dmp	upx
behavioral2/memory/4036-1977-0x00007FF72CD40000-0x00007FF72D136000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PLbdGCF.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\RnoQVDz.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\TaypxxJ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\NfUVoAH.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\nePZJFm.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\GwzTQLs.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\xrcVvwn.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ccVAzSq.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\GmIZOqy.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\osKWudK.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\zcEUzHe.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\nauIYBa.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\Vzqgcuk.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\AFfiCAe.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\SMdSgWe.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\VgAvCjY.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\moAuwYL.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\qAWXaQx.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\HqLfsbU.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\DqdgNDd.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\YElEJFk.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\uoUAOmk.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\GYVrcot.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\EYUmloJ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\eUcfzHi.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\UKkthMp.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\NTDWpjz.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\OVLTWHJ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\kIPukCh.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ExkPOuz.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\gFCyFyF.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\sKYAdhu.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\zWaCuUO.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\RrIgUct.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\xScTwvX.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\rzLUMOk.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ijqTXUU.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\hVUpqWm.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\vsKoQNf.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\NoGZuEs.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\HZvHYbt.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\NXYpXMv.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\EdyMtXB.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\uVKjSGK.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\vPbLfUW.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\idgvLMN.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\TksFAFw.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\UmJPrjG.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\tcWFpOi.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\LVFqiAc.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\gzckSFQ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\jIVnqKd.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\vzkxNDs.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\rwZIFre.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\yoFQucv.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\fwkZIcj.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\bXFtZXh.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\VmxVgSX.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\QxevBbY.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\KLUEfrT.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\vNZXnZJ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\OvSbrRW.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\eYeepsb.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\reYnSDa.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeLockMemoryPrivilege	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4908	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	84
PID 3204 wrote to memory of 4908	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	84
PID 3204 wrote to memory of 3592	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	85
PID 3204 wrote to memory of 3592	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	85
PID 3204 wrote to memory of 224	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	86
PID 3204 wrote to memory of 224	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	86
PID 3204 wrote to memory of 388	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	87
PID 3204 wrote to memory of 388	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	87
PID 3204 wrote to memory of 4036	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	88
PID 3204 wrote to memory of 4036	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	88
PID 3204 wrote to memory of 4104	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	89
PID 3204 wrote to memory of 4104	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	89
PID 3204 wrote to memory of 4264	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	90
PID 3204 wrote to memory of 4264	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	90
PID 3204 wrote to memory of 960	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	91
PID 3204 wrote to memory of 960	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	91
PID 3204 wrote to memory of 4408	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	92
PID 3204 wrote to memory of 4408	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	92
PID 3204 wrote to memory of 2328	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	93
PID 3204 wrote to memory of 2328	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	93
PID 3204 wrote to memory of 2720	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	94
PID 3204 wrote to memory of 2720	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	94
PID 3204 wrote to memory of 4404	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	95
PID 3204 wrote to memory of 4404	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	95
PID 3204 wrote to memory of 452	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	96
PID 3204 wrote to memory of 452	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	96
PID 3204 wrote to memory of 2416	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	97
PID 3204 wrote to memory of 2416	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	97
PID 3204 wrote to memory of 624	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	98
PID 3204 wrote to memory of 624	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	98
PID 3204 wrote to memory of 2752	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	99
PID 3204 wrote to memory of 2752	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	99
PID 3204 wrote to memory of 2924	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	100
PID 3204 wrote to memory of 2924	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	100
PID 3204 wrote to memory of 2872	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	101
PID 3204 wrote to memory of 2872	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	101
PID 3204 wrote to memory of 3232	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	102
PID 3204 wrote to memory of 3232	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	102
PID 3204 wrote to memory of 4456	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	103
PID 3204 wrote to memory of 4456	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	103
PID 3204 wrote to memory of 3196	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	104
PID 3204 wrote to memory of 3196	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	104
PID 3204 wrote to memory of 2780	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	105
PID 3204 wrote to memory of 2780	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	105
PID 3204 wrote to memory of 2232	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	106
PID 3204 wrote to memory of 2232	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	106
PID 3204 wrote to memory of 1300	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	107
PID 3204 wrote to memory of 1300	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	107
PID 3204 wrote to memory of 1580	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	108
PID 3204 wrote to memory of 1580	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	108
PID 3204 wrote to memory of 4328	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	109
PID 3204 wrote to memory of 4328	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	109
PID 3204 wrote to memory of 3128	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	110
PID 3204 wrote to memory of 3128	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	110
PID 3204 wrote to memory of 1016	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	111
PID 3204 wrote to memory of 1016	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	111
PID 3204 wrote to memory of 1216	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	112
PID 3204 wrote to memory of 1216	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	112
PID 3204 wrote to memory of 1532	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	113
PID 3204 wrote to memory of 1532	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	113
PID 3204 wrote to memory of 4236	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	114
PID 3204 wrote to memory of 4236	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	114
PID 3204 wrote to memory of 4224	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	115
PID 3204 wrote to memory of 4224	3204	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\System\dzbPgIa.exe
  C:\Windows\System\dzbPgIa.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\EhrQvXA.exe
  C:\Windows\System\EhrQvXA.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\uEmddGz.exe
  C:\Windows\System\uEmddGz.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\ydlkxrY.exe
  C:\Windows\System\ydlkxrY.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\SYQJZNJ.exe
  C:\Windows\System\SYQJZNJ.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\KHSFyGe.exe
  C:\Windows\System\KHSFyGe.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\etRmftZ.exe
  C:\Windows\System\etRmftZ.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\MUOGAgU.exe
  C:\Windows\System\MUOGAgU.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\qAQrrOX.exe
  C:\Windows\System\qAQrrOX.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\NuiTEAT.exe
  C:\Windows\System\NuiTEAT.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\hKnWmjq.exe
  C:\Windows\System\hKnWmjq.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\bZMVXPM.exe
  C:\Windows\System\bZMVXPM.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\sxhdjNW.exe
  C:\Windows\System\sxhdjNW.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\mOwJFMI.exe
  C:\Windows\System\mOwJFMI.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\OutvjJx.exe
  C:\Windows\System\OutvjJx.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\AHJaTGe.exe
  C:\Windows\System\AHJaTGe.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\LBwzoYg.exe
  C:\Windows\System\LBwzoYg.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\tyObhGQ.exe
  C:\Windows\System\tyObhGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\bzXgzLG.exe
  C:\Windows\System\bzXgzLG.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\WSexyOh.exe
  C:\Windows\System\WSexyOh.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\QGwbFyv.exe
  C:\Windows\System\QGwbFyv.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\tzafzjX.exe
  C:\Windows\System\tzafzjX.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\hkWMEwc.exe
  C:\Windows\System\hkWMEwc.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\awBLzzK.exe
  C:\Windows\System\awBLzzK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\LVFqiAc.exe
  C:\Windows\System\LVFqiAc.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\scLbARG.exe
  C:\Windows\System\scLbARG.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\XVvljyi.exe
  C:\Windows\System\XVvljyi.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\fFafBCQ.exe
  C:\Windows\System\fFafBCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\vsKoQNf.exe
  C:\Windows\System\vsKoQNf.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ruAKWgg.exe
  C:\Windows\System\ruAKWgg.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\ABCbLbA.exe
  C:\Windows\System\ABCbLbA.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\LHObqnZ.exe
  C:\Windows\System\LHObqnZ.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\xcXiZRI.exe
  C:\Windows\System\xcXiZRI.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\mbulZrI.exe
  C:\Windows\System\mbulZrI.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\yBtFdKk.exe
  C:\Windows\System\yBtFdKk.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\UvKDmZv.exe
  C:\Windows\System\UvKDmZv.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\rdjYmqS.exe
  C:\Windows\System\rdjYmqS.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\yoaYLHp.exe
  C:\Windows\System\yoaYLHp.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\CsAWVgt.exe
  C:\Windows\System\CsAWVgt.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\TSxRYNX.exe
  C:\Windows\System\TSxRYNX.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\EvQxoqw.exe
  C:\Windows\System\EvQxoqw.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\myLjyLo.exe
  C:\Windows\System\myLjyLo.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\yKfvnql.exe
  C:\Windows\System\yKfvnql.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\DhjjMQU.exe
  C:\Windows\System\DhjjMQU.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\iISAkUO.exe
  C:\Windows\System\iISAkUO.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ijqTXUU.exe
  C:\Windows\System\ijqTXUU.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\OcaxQdG.exe
  C:\Windows\System\OcaxQdG.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\QadzsvY.exe
  C:\Windows\System\QadzsvY.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\lhwkEeQ.exe
  C:\Windows\System\lhwkEeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\IhOrFMw.exe
  C:\Windows\System\IhOrFMw.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\KPwnzto.exe
  C:\Windows\System\KPwnzto.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\OELbWAz.exe
  C:\Windows\System\OELbWAz.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\hRrJiPB.exe
  C:\Windows\System\hRrJiPB.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\vbaUpmU.exe
  C:\Windows\System\vbaUpmU.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\hHminCU.exe
  C:\Windows\System\hHminCU.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\fYNhNJQ.exe
  C:\Windows\System\fYNhNJQ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\zpIpiov.exe
  C:\Windows\System\zpIpiov.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\opuIpAL.exe
  C:\Windows\System\opuIpAL.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\mOJXLCW.exe
  C:\Windows\System\mOJXLCW.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\BwIVpRG.exe
  C:\Windows\System\BwIVpRG.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\WVRCgoO.exe
  C:\Windows\System\WVRCgoO.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\XbTLpmP.exe
  C:\Windows\System\XbTLpmP.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\dierCJD.exe
  C:\Windows\System\dierCJD.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\TAaiiZQ.exe
  C:\Windows\System\TAaiiZQ.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\hECKLea.exe
  C:\Windows\System\hECKLea.exe
  2⤵
  PID:3044
- C:\Windows\System\sVoSoEm.exe
  C:\Windows\System\sVoSoEm.exe
  2⤵
  PID:3580
- C:\Windows\System\YHYowBS.exe
  C:\Windows\System\YHYowBS.exe
  2⤵
  PID:4728
- C:\Windows\System\KJeczZG.exe
  C:\Windows\System\KJeczZG.exe
  2⤵
  PID:1000
- C:\Windows\System\YfmFIlb.exe
  C:\Windows\System\YfmFIlb.exe
  2⤵
  PID:4112
- C:\Windows\System\XfiwICQ.exe
  C:\Windows\System\XfiwICQ.exe
  2⤵
  PID:2792
- C:\Windows\System\ZqtKbsY.exe
  C:\Windows\System\ZqtKbsY.exe
  2⤵
  PID:1028
- C:\Windows\System\ZfdJfTF.exe
  C:\Windows\System\ZfdJfTF.exe
  2⤵
  PID:3608
- C:\Windows\System\vhNSsjv.exe
  C:\Windows\System\vhNSsjv.exe
  2⤵
  PID:4640
- C:\Windows\System\qJSbLov.exe
  C:\Windows\System\qJSbLov.exe
  2⤵
  PID:4696
- C:\Windows\System\OTKCYck.exe
  C:\Windows\System\OTKCYck.exe
  2⤵
  PID:4868
- C:\Windows\System\KYARJCj.exe
  C:\Windows\System\KYARJCj.exe
  2⤵
  PID:2940
- C:\Windows\System\EZQGoSy.exe
  C:\Windows\System\EZQGoSy.exe
  2⤵
  PID:1924
- C:\Windows\System\YZQvXmk.exe
  C:\Windows\System\YZQvXmk.exe
  2⤵
  PID:1256
- C:\Windows\System\IQQevAR.exe
  C:\Windows\System\IQQevAR.exe
  2⤵
  PID:4444
- C:\Windows\System\bnPcflc.exe
  C:\Windows\System\bnPcflc.exe
  2⤵
  PID:4876
- C:\Windows\System\JlAoKQG.exe
  C:\Windows\System\JlAoKQG.exe
  2⤵
  PID:2440
- C:\Windows\System\fwkZIcj.exe
  C:\Windows\System\fwkZIcj.exe
  2⤵
  PID:4556
- C:\Windows\System\oSwxSSB.exe
  C:\Windows\System\oSwxSSB.exe
  2⤵
  PID:2272
- C:\Windows\System\hQyhgIv.exe
  C:\Windows\System\hQyhgIv.exe
  2⤵
  PID:2248
- C:\Windows\System\LSPjlOd.exe
  C:\Windows\System\LSPjlOd.exe
  2⤵
  PID:868
- C:\Windows\System\XoTQqBe.exe
  C:\Windows\System\XoTQqBe.exe
  2⤵
  PID:4524
- C:\Windows\System\OqUHcOJ.exe
  C:\Windows\System\OqUHcOJ.exe
  2⤵
  PID:1920
- C:\Windows\System\JuhaIrw.exe
  C:\Windows\System\JuhaIrw.exe
  2⤵
  PID:1900
- C:\Windows\System\rbzkGsO.exe
  C:\Windows\System\rbzkGsO.exe
  2⤵
  PID:4632
- C:\Windows\System\MXdMyus.exe
  C:\Windows\System\MXdMyus.exe
  2⤵
  PID:5144
- C:\Windows\System\LBQWRST.exe
  C:\Windows\System\LBQWRST.exe
  2⤵
  PID:5184
- C:\Windows\System\wNDyOVd.exe
  C:\Windows\System\wNDyOVd.exe
  2⤵
  PID:5208
- C:\Windows\System\VCiBgKV.exe
  C:\Windows\System\VCiBgKV.exe
  2⤵
  PID:5236
- C:\Windows\System\maSwfJW.exe
  C:\Windows\System\maSwfJW.exe
  2⤵
  PID:5256
- C:\Windows\System\nXuopFR.exe
  C:\Windows\System\nXuopFR.exe
  2⤵
  PID:5272
- C:\Windows\System\LpIQTVr.exe
  C:\Windows\System\LpIQTVr.exe
  2⤵
  PID:5316
- C:\Windows\System\SWhayRR.exe
  C:\Windows\System\SWhayRR.exe
  2⤵
  PID:5356
- C:\Windows\System\farSAQs.exe
  C:\Windows\System\farSAQs.exe
  2⤵
  PID:5388
- C:\Windows\System\yDPKfBZ.exe
  C:\Windows\System\yDPKfBZ.exe
  2⤵
  PID:5412
- C:\Windows\System\gxWJOBS.exe
  C:\Windows\System\gxWJOBS.exe
  2⤵
  PID:5432
- C:\Windows\System\NERxeTk.exe
  C:\Windows\System\NERxeTk.exe
  2⤵
  PID:5460
- C:\Windows\System\MWaQauf.exe
  C:\Windows\System\MWaQauf.exe
  2⤵
  PID:5476
- C:\Windows\System\zNprFjS.exe
  C:\Windows\System\zNprFjS.exe
  2⤵
  PID:5516
- C:\Windows\System\yUwKpIV.exe
  C:\Windows\System\yUwKpIV.exe
  2⤵
  PID:5532
- C:\Windows\System\AbywFTq.exe
  C:\Windows\System\AbywFTq.exe
  2⤵
  PID:5552
- C:\Windows\System\UGxniMj.exe
  C:\Windows\System\UGxniMj.exe
  2⤵
  PID:5596
- C:\Windows\System\LIEIWJv.exe
  C:\Windows\System\LIEIWJv.exe
  2⤵
  PID:5640
- C:\Windows\System\AgkHpZZ.exe
  C:\Windows\System\AgkHpZZ.exe
  2⤵
  PID:5684
- C:\Windows\System\wrNzRsj.exe
  C:\Windows\System\wrNzRsj.exe
  2⤵
  PID:5712
- C:\Windows\System\jCcmhuO.exe
  C:\Windows\System\jCcmhuO.exe
  2⤵
  PID:5752
- C:\Windows\System\tkIjSfX.exe
  C:\Windows\System\tkIjSfX.exe
  2⤵
  PID:5768
- C:\Windows\System\TueFlTx.exe
  C:\Windows\System\TueFlTx.exe
  2⤵
  PID:5784
- C:\Windows\System\LHfqHdq.exe
  C:\Windows\System\LHfqHdq.exe
  2⤵
  PID:5832
- C:\Windows\System\MyoZrOV.exe
  C:\Windows\System\MyoZrOV.exe
  2⤵
  PID:5864
- C:\Windows\System\OgaYRAg.exe
  C:\Windows\System\OgaYRAg.exe
  2⤵
  PID:5888
- C:\Windows\System\eUeNKvx.exe
  C:\Windows\System\eUeNKvx.exe
  2⤵
  PID:5908
- C:\Windows\System\kRoZzNv.exe
  C:\Windows\System\kRoZzNv.exe
  2⤵
  PID:5940
- C:\Windows\System\ShCDiPz.exe
  C:\Windows\System\ShCDiPz.exe
  2⤵
  PID:5984
- C:\Windows\System\ZcBSvVv.exe
  C:\Windows\System\ZcBSvVv.exe
  2⤵
  PID:6004
- C:\Windows\System\YEavREs.exe
  C:\Windows\System\YEavREs.exe
  2⤵
  PID:6020
- C:\Windows\System\FaELGtX.exe
  C:\Windows\System\FaELGtX.exe
  2⤵
  PID:6060
- C:\Windows\System\AMeWMXp.exe
  C:\Windows\System\AMeWMXp.exe
  2⤵
  PID:6100
- C:\Windows\System\WbECJmF.exe
  C:\Windows\System\WbECJmF.exe
  2⤵
  PID:6128
- C:\Windows\System\hbPINoR.exe
  C:\Windows\System\hbPINoR.exe
  2⤵
  PID:5128
- C:\Windows\System\aCNOLWx.exe
  C:\Windows\System\aCNOLWx.exe
  2⤵
  PID:5164
- C:\Windows\System\BDvwpwk.exe
  C:\Windows\System\BDvwpwk.exe
  2⤵
  PID:5196
- C:\Windows\System\NqOrixw.exe
  C:\Windows\System\NqOrixw.exe
  2⤵
  PID:5248
- C:\Windows\System\uKiNNhp.exe
  C:\Windows\System\uKiNNhp.exe
  2⤵
  PID:5292
- C:\Windows\System\fgMwSBP.exe
  C:\Windows\System\fgMwSBP.exe
  2⤵
  PID:5380
- C:\Windows\System\LPZaGAm.exe
  C:\Windows\System\LPZaGAm.exe
  2⤵
  PID:5448
- C:\Windows\System\ZnCcMEY.exe
  C:\Windows\System\ZnCcMEY.exe
  2⤵
  PID:5468
- C:\Windows\System\XMyAdfd.exe
  C:\Windows\System\XMyAdfd.exe
  2⤵
  PID:5540
- C:\Windows\System\leCnMoU.exe
  C:\Windows\System\leCnMoU.exe
  2⤵
  PID:5652
- C:\Windows\System\iLZuAzW.exe
  C:\Windows\System\iLZuAzW.exe
  2⤵
  PID:5724
- C:\Windows\System\dSYbfvc.exe
  C:\Windows\System\dSYbfvc.exe
  2⤵
  PID:5804
- C:\Windows\System\KEZhzOM.exe
  C:\Windows\System\KEZhzOM.exe
  2⤵
  PID:5848
- C:\Windows\System\elQBhJz.exe
  C:\Windows\System\elQBhJz.exe
  2⤵
  PID:5920
- C:\Windows\System\PNuZvCd.exe
  C:\Windows\System\PNuZvCd.exe
  2⤵
  PID:5992
- C:\Windows\System\rxNYgtN.exe
  C:\Windows\System\rxNYgtN.exe
  2⤵
  PID:6092
- C:\Windows\System\CCjpqLL.exe
  C:\Windows\System\CCjpqLL.exe
  2⤵
  PID:6136
- C:\Windows\System\QCbALqZ.exe
  C:\Windows\System\QCbALqZ.exe
  2⤵
  PID:1040
- C:\Windows\System\vLbeNlp.exe
  C:\Windows\System\vLbeNlp.exe
  2⤵
  PID:5304
- C:\Windows\System\YySSblC.exe
  C:\Windows\System\YySSblC.exe
  2⤵
  PID:5408
- C:\Windows\System\JkJwNvs.exe
  C:\Windows\System\JkJwNvs.exe
  2⤵
  PID:5632
- C:\Windows\System\AtXAjqw.exe
  C:\Windows\System\AtXAjqw.exe
  2⤵
  PID:5872
- C:\Windows\System\IACVZlZ.exe
  C:\Windows\System\IACVZlZ.exe
  2⤵
  PID:6040
- C:\Windows\System\muuwTXO.exe
  C:\Windows\System\muuwTXO.exe
  2⤵
  PID:5168
- C:\Windows\System\mpElaWN.exe
  C:\Windows\System\mpElaWN.exe
  2⤵
  PID:3324
- C:\Windows\System\irHwjJO.exe
  C:\Windows\System\irHwjJO.exe
  2⤵
  PID:5696
- C:\Windows\System\HbLlhAF.exe
  C:\Windows\System\HbLlhAF.exe
  2⤵
  PID:6124
- C:\Windows\System\RusbXdf.exe
  C:\Windows\System\RusbXdf.exe
  2⤵
  PID:5796
- C:\Windows\System\IAOTXaQ.exe
  C:\Windows\System\IAOTXaQ.exe
  2⤵
  PID:6156
- C:\Windows\System\goUGdyQ.exe
  C:\Windows\System\goUGdyQ.exe
  2⤵
  PID:6184
- C:\Windows\System\wqrDimZ.exe
  C:\Windows\System\wqrDimZ.exe
  2⤵
  PID:6220
- C:\Windows\System\ffxSkoK.exe
  C:\Windows\System\ffxSkoK.exe
  2⤵
  PID:6236
- C:\Windows\System\PlUVyln.exe
  C:\Windows\System\PlUVyln.exe
  2⤵
  PID:6280
- C:\Windows\System\axnMBrt.exe
  C:\Windows\System\axnMBrt.exe
  2⤵
  PID:6304
- C:\Windows\System\AZqlXvR.exe
  C:\Windows\System\AZqlXvR.exe
  2⤵
  PID:6324
- C:\Windows\System\cQkufnj.exe
  C:\Windows\System\cQkufnj.exe
  2⤵
  PID:6348
- C:\Windows\System\ijDYfXP.exe
  C:\Windows\System\ijDYfXP.exe
  2⤵
  PID:6388
- C:\Windows\System\kEzjbXW.exe
  C:\Windows\System\kEzjbXW.exe
  2⤵
  PID:6404
- C:\Windows\System\UKkthMp.exe
  C:\Windows\System\UKkthMp.exe
  2⤵
  PID:6420
- C:\Windows\System\NBaqSgH.exe
  C:\Windows\System\NBaqSgH.exe
  2⤵
  PID:6436
- C:\Windows\System\PaSXhux.exe
  C:\Windows\System\PaSXhux.exe
  2⤵
  PID:6476
- C:\Windows\System\yhyYTwI.exe
  C:\Windows\System\yhyYTwI.exe
  2⤵
  PID:6492
- C:\Windows\System\QDANYBl.exe
  C:\Windows\System\QDANYBl.exe
  2⤵
  PID:6516
- C:\Windows\System\mUtrNYQ.exe
  C:\Windows\System\mUtrNYQ.exe
  2⤵
  PID:6536
- C:\Windows\System\tvoWlpF.exe
  C:\Windows\System\tvoWlpF.exe
  2⤵
  PID:6564
- C:\Windows\System\iDKgaKV.exe
  C:\Windows\System\iDKgaKV.exe
  2⤵
  PID:6628
- C:\Windows\System\hbAKXoY.exe
  C:\Windows\System\hbAKXoY.exe
  2⤵
  PID:6648
- C:\Windows\System\DzivTju.exe
  C:\Windows\System\DzivTju.exe
  2⤵
  PID:6672
- C:\Windows\System\UCYrOyr.exe
  C:\Windows\System\UCYrOyr.exe
  2⤵
  PID:6688
- C:\Windows\System\xGFpafn.exe
  C:\Windows\System\xGFpafn.exe
  2⤵
  PID:6716
- C:\Windows\System\lcwUmaJ.exe
  C:\Windows\System\lcwUmaJ.exe
  2⤵
  PID:6756
- C:\Windows\System\JAtAEyo.exe
  C:\Windows\System\JAtAEyo.exe
  2⤵
  PID:6780
- C:\Windows\System\hcuSwno.exe
  C:\Windows\System\hcuSwno.exe
  2⤵
  PID:6800
- C:\Windows\System\rpZVqdA.exe
  C:\Windows\System\rpZVqdA.exe
  2⤵
  PID:6840
- C:\Windows\System\HBqUmSA.exe
  C:\Windows\System\HBqUmSA.exe
  2⤵
  PID:6868
- C:\Windows\System\RXcmIpy.exe
  C:\Windows\System\RXcmIpy.exe
  2⤵
  PID:6908
- C:\Windows\System\kSgztoH.exe
  C:\Windows\System\kSgztoH.exe
  2⤵
  PID:6936
- C:\Windows\System\SjuwVts.exe
  C:\Windows\System\SjuwVts.exe
  2⤵
  PID:6976
- C:\Windows\System\XWNqXli.exe
  C:\Windows\System\XWNqXli.exe
  2⤵
  PID:7004
- C:\Windows\System\CATyeUL.exe
  C:\Windows\System\CATyeUL.exe
  2⤵
  PID:7032
- C:\Windows\System\VqTzvvN.exe
  C:\Windows\System\VqTzvvN.exe
  2⤵
  PID:7048
- C:\Windows\System\OWKtVHg.exe
  C:\Windows\System\OWKtVHg.exe
  2⤵
  PID:7080
- C:\Windows\System\Esgettd.exe
  C:\Windows\System\Esgettd.exe
  2⤵
  PID:7108
- C:\Windows\System\NVYfpWw.exe
  C:\Windows\System\NVYfpWw.exe
  2⤵
  PID:7136
- C:\Windows\System\KWFsAsu.exe
  C:\Windows\System\KWFsAsu.exe
  2⤵
  PID:7164
- C:\Windows\System\mUGknWD.exe
  C:\Windows\System\mUGknWD.exe
  2⤵
  PID:6204
- C:\Windows\System\WZdqtXN.exe
  C:\Windows\System\WZdqtXN.exe
  2⤵
  PID:6248
- C:\Windows\System\zJDiVrH.exe
  C:\Windows\System\zJDiVrH.exe
  2⤵
  PID:6272
- C:\Windows\System\RofZZsp.exe
  C:\Windows\System\RofZZsp.exe
  2⤵
  PID:6396
- C:\Windows\System\ObRvBat.exe
  C:\Windows\System\ObRvBat.exe
  2⤵
  PID:6416
- C:\Windows\System\qdHXKYd.exe
  C:\Windows\System\qdHXKYd.exe
  2⤵
  PID:6512
- C:\Windows\System\qESnmvA.exe
  C:\Windows\System\qESnmvA.exe
  2⤵
  PID:6608
- C:\Windows\System\KaJQiuJ.exe
  C:\Windows\System\KaJQiuJ.exe
  2⤵
  PID:6604
- C:\Windows\System\HHirajz.exe
  C:\Windows\System\HHirajz.exe
  2⤵
  PID:6740
- C:\Windows\System\yqyNltp.exe
  C:\Windows\System\yqyNltp.exe
  2⤵
  PID:6812
- C:\Windows\System\nhVIjIk.exe
  C:\Windows\System\nhVIjIk.exe
  2⤵
  PID:6848
- C:\Windows\System\DqdgNDd.exe
  C:\Windows\System\DqdgNDd.exe
  2⤵
  PID:6928
- C:\Windows\System\bYNYlZk.exe
  C:\Windows\System\bYNYlZk.exe
  2⤵
  PID:6972
- C:\Windows\System\kfcMlEJ.exe
  C:\Windows\System\kfcMlEJ.exe
  2⤵
  PID:7040
- C:\Windows\System\LRNwqJs.exe
  C:\Windows\System\LRNwqJs.exe
  2⤵
  PID:7088
- C:\Windows\System\skIpKxv.exe
  C:\Windows\System\skIpKxv.exe
  2⤵
  PID:7156
- C:\Windows\System\IgvhDpu.exe
  C:\Windows\System\IgvhDpu.exe
  2⤵
  PID:6260
- C:\Windows\System\gYthSRK.exe
  C:\Windows\System\gYthSRK.exe
  2⤵
  PID:6384
- C:\Windows\System\BSGmvfE.exe
  C:\Windows\System\BSGmvfE.exe
  2⤵
  PID:6524
- C:\Windows\System\CWZKJIu.exe
  C:\Windows\System\CWZKJIu.exe
  2⤵
  PID:6684
- C:\Windows\System\gMYxXQn.exe
  C:\Windows\System\gMYxXQn.exe
  2⤵
  PID:6860
- C:\Windows\System\hBhQHFO.exe
  C:\Windows\System\hBhQHFO.exe
  2⤵
  PID:7000
- C:\Windows\System\DkUpJgZ.exe
  C:\Windows\System\DkUpJgZ.exe
  2⤵
  PID:7100
- C:\Windows\System\QZRRXGE.exe
  C:\Windows\System\QZRRXGE.exe
  2⤵
  PID:6596
- C:\Windows\System\cJvQiTa.exe
  C:\Windows\System\cJvQiTa.exe
  2⤵
  PID:6968
- C:\Windows\System\tBxSDBt.exe
  C:\Windows\System\tBxSDBt.exe
  2⤵
  PID:7068
- C:\Windows\System\xabXehx.exe
  C:\Windows\System\xabXehx.exe
  2⤵
  PID:6732
- C:\Windows\System\moAuwYL.exe
  C:\Windows\System\moAuwYL.exe
  2⤵
  PID:7180
- C:\Windows\System\fTnFtgv.exe
  C:\Windows\System\fTnFtgv.exe
  2⤵
  PID:7224
- C:\Windows\System\rzLUMOk.exe
  C:\Windows\System\rzLUMOk.exe
  2⤵
  PID:7244
- C:\Windows\System\manghiQ.exe
  C:\Windows\System\manghiQ.exe
  2⤵
  PID:7268
- C:\Windows\System\vPeIdCR.exe
  C:\Windows\System\vPeIdCR.exe
  2⤵
  PID:7312
- C:\Windows\System\YWIFMXA.exe
  C:\Windows\System\YWIFMXA.exe
  2⤵
  PID:7340
- C:\Windows\System\bDNTfjs.exe
  C:\Windows\System\bDNTfjs.exe
  2⤵
  PID:7356
- C:\Windows\System\rpFMhzS.exe
  C:\Windows\System\rpFMhzS.exe
  2⤵
  PID:7372
- C:\Windows\System\AKyZDIj.exe
  C:\Windows\System\AKyZDIj.exe
  2⤵
  PID:7400
- C:\Windows\System\MRPAYiQ.exe
  C:\Windows\System\MRPAYiQ.exe
  2⤵
  PID:7420
- C:\Windows\System\tDayYji.exe
  C:\Windows\System\tDayYji.exe
  2⤵
  PID:7456
- C:\Windows\System\AttgPlR.exe
  C:\Windows\System\AttgPlR.exe
  2⤵
  PID:7496
- C:\Windows\System\TGrdZwV.exe
  C:\Windows\System\TGrdZwV.exe
  2⤵
  PID:7528
- C:\Windows\System\TaBdSMi.exe
  C:\Windows\System\TaBdSMi.exe
  2⤵
  PID:7564
- C:\Windows\System\FfZWqic.exe
  C:\Windows\System\FfZWqic.exe
  2⤵
  PID:7596
- C:\Windows\System\nzMwZFD.exe
  C:\Windows\System\nzMwZFD.exe
  2⤵
  PID:7624
- C:\Windows\System\LXBjSuw.exe
  C:\Windows\System\LXBjSuw.exe
  2⤵
  PID:7644
- C:\Windows\System\JJNzKWE.exe
  C:\Windows\System\JJNzKWE.exe
  2⤵
  PID:7680
- C:\Windows\System\dlcjSss.exe
  C:\Windows\System\dlcjSss.exe
  2⤵
  PID:7708
- C:\Windows\System\jPcohRF.exe
  C:\Windows\System\jPcohRF.exe
  2⤵
  PID:7724
- C:\Windows\System\MTCIKkK.exe
  C:\Windows\System\MTCIKkK.exe
  2⤵
  PID:7752
- C:\Windows\System\jHRAlOZ.exe
  C:\Windows\System\jHRAlOZ.exe
  2⤵
  PID:7796
- C:\Windows\System\IArjrCs.exe
  C:\Windows\System\IArjrCs.exe
  2⤵
  PID:7820
- C:\Windows\System\buNOlyi.exe
  C:\Windows\System\buNOlyi.exe
  2⤵
  PID:7840
- C:\Windows\System\mrgFYlK.exe
  C:\Windows\System\mrgFYlK.exe
  2⤵
  PID:7864
- C:\Windows\System\AVekQrf.exe
  C:\Windows\System\AVekQrf.exe
  2⤵
  PID:7904
- C:\Windows\System\mcCBEqT.exe
  C:\Windows\System\mcCBEqT.exe
  2⤵
  PID:7920
- C:\Windows\System\MXrOClb.exe
  C:\Windows\System\MXrOClb.exe
  2⤵
  PID:7944
- C:\Windows\System\DQotUfe.exe
  C:\Windows\System\DQotUfe.exe
  2⤵
  PID:7968
- C:\Windows\System\EdNpZFj.exe
  C:\Windows\System\EdNpZFj.exe
  2⤵
  PID:8008
- C:\Windows\System\KmixPUb.exe
  C:\Windows\System\KmixPUb.exe
  2⤵
  PID:8032
- C:\Windows\System\pUjWYxM.exe
  C:\Windows\System\pUjWYxM.exe
  2⤵
  PID:8072
- C:\Windows\System\tQhtGkK.exe
  C:\Windows\System\tQhtGkK.exe
  2⤵
  PID:8092
- C:\Windows\System\bqPIMql.exe
  C:\Windows\System\bqPIMql.exe
  2⤵
  PID:8128
- C:\Windows\System\nGJFPGj.exe
  C:\Windows\System\nGJFPGj.exe
  2⤵
  PID:8156
- C:\Windows\System\EQQavOB.exe
  C:\Windows\System\EQQavOB.exe
  2⤵
  PID:8172
- C:\Windows\System\tgJvwue.exe
  C:\Windows\System\tgJvwue.exe
  2⤵
  PID:6316
- C:\Windows\System\hrogAFD.exe
  C:\Windows\System\hrogAFD.exe
  2⤵
  PID:7236
- C:\Windows\System\cbdQBDy.exe
  C:\Windows\System\cbdQBDy.exe
  2⤵
  PID:7348
- C:\Windows\System\HXLiJlS.exe
  C:\Windows\System\HXLiJlS.exe
  2⤵
  PID:7384
- C:\Windows\System\wgxEjGg.exe
  C:\Windows\System\wgxEjGg.exe
  2⤵
  PID:7096
- C:\Windows\System\emMFnzb.exe
  C:\Windows\System\emMFnzb.exe
  2⤵
  PID:7468
- C:\Windows\System\BRCDYSv.exe
  C:\Windows\System\BRCDYSv.exe
  2⤵
  PID:7556
- C:\Windows\System\LqOEOYq.exe
  C:\Windows\System\LqOEOYq.exe
  2⤵
  PID:7636
- C:\Windows\System\PIqgjDJ.exe
  C:\Windows\System\PIqgjDJ.exe
  2⤵
  PID:7704
- C:\Windows\System\zlDluQp.exe
  C:\Windows\System\zlDluQp.exe
  2⤵
  PID:7776
- C:\Windows\System\UrDxZok.exe
  C:\Windows\System\UrDxZok.exe
  2⤵
  PID:7860
- C:\Windows\System\ajxVPad.exe
  C:\Windows\System\ajxVPad.exe
  2⤵
  PID:7896
- C:\Windows\System\jtuIpnV.exe
  C:\Windows\System\jtuIpnV.exe
  2⤵
  PID:7988
- C:\Windows\System\JmqcthR.exe
  C:\Windows\System\JmqcthR.exe
  2⤵
  PID:8024
- C:\Windows\System\gVhWpoJ.exe
  C:\Windows\System\gVhWpoJ.exe
  2⤵
  PID:8100
- C:\Windows\System\HxazBUt.exe
  C:\Windows\System\HxazBUt.exe
  2⤵
  PID:8184
- C:\Windows\System\QALOuUo.exe
  C:\Windows\System\QALOuUo.exe
  2⤵
  PID:7252
- C:\Windows\System\rbocJbq.exe
  C:\Windows\System\rbocJbq.exe
  2⤵
  PID:7440
- C:\Windows\System\qdlUWag.exe
  C:\Windows\System\qdlUWag.exe
  2⤵
  PID:7620
- C:\Windows\System\wmdZOaq.exe
  C:\Windows\System\wmdZOaq.exe
  2⤵
  PID:7608
- C:\Windows\System\kJcWqUz.exe
  C:\Windows\System\kJcWqUz.exe
  2⤵
  PID:7888
- C:\Windows\System\anIFMUO.exe
  C:\Windows\System\anIFMUO.exe
  2⤵
  PID:8056
- C:\Windows\System\hLNovBu.exe
  C:\Windows\System\hLNovBu.exe
  2⤵
  PID:7300
- C:\Windows\System\LCDFCQY.exe
  C:\Windows\System\LCDFCQY.exe
  2⤵
  PID:7612
- C:\Windows\System\kgVFITr.exe
  C:\Windows\System\kgVFITr.exe
  2⤵
  PID:7676
- C:\Windows\System\WgoOLgN.exe
  C:\Windows\System\WgoOLgN.exe
  2⤵
  PID:8168
- C:\Windows\System\cjWbxmq.exe
  C:\Windows\System\cjWbxmq.exe
  2⤵
  PID:7984
- C:\Windows\System\HRsTcrg.exe
  C:\Windows\System\HRsTcrg.exe
  2⤵
  PID:8224
- C:\Windows\System\AWyrOVt.exe
  C:\Windows\System\AWyrOVt.exe
  2⤵
  PID:8240
- C:\Windows\System\vWJTUsP.exe
  C:\Windows\System\vWJTUsP.exe
  2⤵
  PID:8268
- C:\Windows\System\HNronMy.exe
  C:\Windows\System\HNronMy.exe
  2⤵
  PID:8308
- C:\Windows\System\diGsgec.exe
  C:\Windows\System\diGsgec.exe
  2⤵
  PID:8336
- C:\Windows\System\dAYUYQN.exe
  C:\Windows\System\dAYUYQN.exe
  2⤵
  PID:8352
- C:\Windows\System\FLeBgql.exe
  C:\Windows\System\FLeBgql.exe
  2⤵
  PID:8372
- C:\Windows\System\EMzZrzA.exe
  C:\Windows\System\EMzZrzA.exe
  2⤵
  PID:8396
- C:\Windows\System\DwxtWVd.exe
  C:\Windows\System\DwxtWVd.exe
  2⤵
  PID:8440
- C:\Windows\System\fjGFevp.exe
  C:\Windows\System\fjGFevp.exe
  2⤵
  PID:8468
- C:\Windows\System\ltBMMae.exe
  C:\Windows\System\ltBMMae.exe
  2⤵
  PID:8492
- C:\Windows\System\JNVpRNJ.exe
  C:\Windows\System\JNVpRNJ.exe
  2⤵
  PID:8520
- C:\Windows\System\nuiwyup.exe
  C:\Windows\System\nuiwyup.exe
  2⤵
  PID:8560
- C:\Windows\System\UJEIDTN.exe
  C:\Windows\System\UJEIDTN.exe
  2⤵
  PID:8576
- C:\Windows\System\AYMEufj.exe
  C:\Windows\System\AYMEufj.exe
  2⤵
  PID:8608
- C:\Windows\System\kfQUMAo.exe
  C:\Windows\System\kfQUMAo.exe
  2⤵
  PID:8652
- C:\Windows\System\hpRxNna.exe
  C:\Windows\System\hpRxNna.exe
  2⤵
  PID:8680
- C:\Windows\System\ZRWHYmx.exe
  C:\Windows\System\ZRWHYmx.exe
  2⤵
  PID:8700
- C:\Windows\System\yfbXqbE.exe
  C:\Windows\System\yfbXqbE.exe
  2⤵
  PID:8724
- C:\Windows\System\ZUcmOGT.exe
  C:\Windows\System\ZUcmOGT.exe
  2⤵
  PID:8756
- C:\Windows\System\PUrEVhC.exe
  C:\Windows\System\PUrEVhC.exe
  2⤵
  PID:8792
- C:\Windows\System\TvTUqvJ.exe
  C:\Windows\System\TvTUqvJ.exe
  2⤵
  PID:8820
- C:\Windows\System\QByqukr.exe
  C:\Windows\System\QByqukr.exe
  2⤵
  PID:8848
- C:\Windows\System\FwsWccY.exe
  C:\Windows\System\FwsWccY.exe
  2⤵
  PID:8876
- C:\Windows\System\THjASwk.exe
  C:\Windows\System\THjASwk.exe
  2⤵
  PID:8904
- C:\Windows\System\HOCXyDT.exe
  C:\Windows\System\HOCXyDT.exe
  2⤵
  PID:8932
- C:\Windows\System\nthOmdf.exe
  C:\Windows\System\nthOmdf.exe
  2⤵
  PID:8960
- C:\Windows\System\gMuJqpv.exe
  C:\Windows\System\gMuJqpv.exe
  2⤵
  PID:8988
- C:\Windows\System\KAOhdNr.exe
  C:\Windows\System\KAOhdNr.exe
  2⤵
  PID:9016
- C:\Windows\System\klzYfaW.exe
  C:\Windows\System\klzYfaW.exe
  2⤵
  PID:9044
- C:\Windows\System\idgvLMN.exe
  C:\Windows\System\idgvLMN.exe
  2⤵
  PID:9072
- C:\Windows\System\eZecvYs.exe
  C:\Windows\System\eZecvYs.exe
  2⤵
  PID:9100
- C:\Windows\System\miGCPXZ.exe
  C:\Windows\System\miGCPXZ.exe
  2⤵
  PID:9128
- C:\Windows\System\xMPNfhZ.exe
  C:\Windows\System\xMPNfhZ.exe
  2⤵
  PID:9156
- C:\Windows\System\LUeKbGL.exe
  C:\Windows\System\LUeKbGL.exe
  2⤵
  PID:9184
- C:\Windows\System\OUMBLWJ.exe
  C:\Windows\System\OUMBLWJ.exe
  2⤵
  PID:9212
- C:\Windows\System\DlFffgx.exe
  C:\Windows\System\DlFffgx.exe
  2⤵
  PID:8236
- C:\Windows\System\mhHLblI.exe
  C:\Windows\System\mhHLblI.exe
  2⤵
  PID:8300
- C:\Windows\System\Ejejosy.exe
  C:\Windows\System\Ejejosy.exe
  2⤵
  PID:8360
- C:\Windows\System\zQgmhkJ.exe
  C:\Windows\System\zQgmhkJ.exe
  2⤵
  PID:8428
- C:\Windows\System\MYCCgdZ.exe
  C:\Windows\System\MYCCgdZ.exe
  2⤵
  PID:8460
- C:\Windows\System\iRzcKMF.exe
  C:\Windows\System\iRzcKMF.exe
  2⤵
  PID:8556
- C:\Windows\System\BzqwBCC.exe
  C:\Windows\System\BzqwBCC.exe
  2⤵
  PID:8616
- C:\Windows\System\XalRPkX.exe
  C:\Windows\System\XalRPkX.exe
  2⤵
  PID:8672
- C:\Windows\System\bmSHvQX.exe
  C:\Windows\System\bmSHvQX.exe
  2⤵
  PID:8744
- C:\Windows\System\pgxAcYe.exe
  C:\Windows\System\pgxAcYe.exe
  2⤵
  PID:8804
- C:\Windows\System\csYOLhF.exe
  C:\Windows\System\csYOLhF.exe
  2⤵
  PID:8872
- C:\Windows\System\YElEJFk.exe
  C:\Windows\System\YElEJFk.exe
  2⤵
  PID:8944
- C:\Windows\System\PMTqGZS.exe
  C:\Windows\System\PMTqGZS.exe
  2⤵
  PID:8996
- C:\Windows\System\bNwnOHY.exe
  C:\Windows\System\bNwnOHY.exe
  2⤵
  PID:9084
- C:\Windows\System\Afhblmc.exe
  C:\Windows\System\Afhblmc.exe
  2⤵
  PID:9148
- C:\Windows\System\oFAGaYm.exe
  C:\Windows\System\oFAGaYm.exe
  2⤵
  PID:9208
- C:\Windows\System\TrzHWae.exe
  C:\Windows\System\TrzHWae.exe
  2⤵
  PID:8332
- C:\Windows\System\psWmKTi.exe
  C:\Windows\System\psWmKTi.exe
  2⤵
  PID:4648
- C:\Windows\System\lQhFNAw.exe
  C:\Windows\System\lQhFNAw.exe
  2⤵
  PID:8536
- C:\Windows\System\WwELDZC.exe
  C:\Windows\System\WwELDZC.exe
  2⤵
  PID:8720
- C:\Windows\System\tVrNlZo.exe
  C:\Windows\System\tVrNlZo.exe
  2⤵
  PID:8860
- C:\Windows\System\xmRshnX.exe
  C:\Windows\System\xmRshnX.exe
  2⤵
  PID:9004
- C:\Windows\System\SQbeAFG.exe
  C:\Windows\System\SQbeAFG.exe
  2⤵
  PID:9176
- C:\Windows\System\FCJXJrs.exe
  C:\Windows\System\FCJXJrs.exe
  2⤵
  PID:8408
- C:\Windows\System\oGjqvUg.exe
  C:\Windows\System\oGjqvUg.exe
  2⤵
  PID:8588
- C:\Windows\System\WmXJFBr.exe
  C:\Windows\System\WmXJFBr.exe
  2⤵
  PID:8972
- C:\Windows\System\XYxaaRm.exe
  C:\Windows\System\XYxaaRm.exe
  2⤵
  PID:8392
- C:\Windows\System\pYVVPRH.exe
  C:\Windows\System\pYVVPRH.exe
  2⤵
  PID:8836
- C:\Windows\System\urMzjdw.exe
  C:\Windows\System\urMzjdw.exe
  2⤵
  PID:8264
- C:\Windows\System\SwIyCpt.exe
  C:\Windows\System\SwIyCpt.exe
  2⤵
  PID:9236
- C:\Windows\System\KkCyWEP.exe
  C:\Windows\System\KkCyWEP.exe
  2⤵
  PID:9264
- C:\Windows\System\mkrSLar.exe
  C:\Windows\System\mkrSLar.exe
  2⤵
  PID:9292
- C:\Windows\System\vbGykmP.exe
  C:\Windows\System\vbGykmP.exe
  2⤵
  PID:9320
- C:\Windows\System\NVgzDnU.exe
  C:\Windows\System\NVgzDnU.exe
  2⤵
  PID:9348
- C:\Windows\System\VKESToq.exe
  C:\Windows\System\VKESToq.exe
  2⤵
  PID:9376
- C:\Windows\System\ORcvmZB.exe
  C:\Windows\System\ORcvmZB.exe
  2⤵
  PID:9404
- C:\Windows\System\djrjajh.exe
  C:\Windows\System\djrjajh.exe
  2⤵
  PID:9432
- C:\Windows\System\hIfHauB.exe
  C:\Windows\System\hIfHauB.exe
  2⤵
  PID:9460
- C:\Windows\System\RsOpErS.exe
  C:\Windows\System\RsOpErS.exe
  2⤵
  PID:9488
- C:\Windows\System\OAFizjj.exe
  C:\Windows\System\OAFizjj.exe
  2⤵
  PID:9516
- C:\Windows\System\ZfuKiSP.exe
  C:\Windows\System\ZfuKiSP.exe
  2⤵
  PID:9544
- C:\Windows\System\PvDmGfa.exe
  C:\Windows\System\PvDmGfa.exe
  2⤵
  PID:9572
- C:\Windows\System\skEGkaf.exe
  C:\Windows\System\skEGkaf.exe
  2⤵
  PID:9600
- C:\Windows\System\UBOtGnR.exe
  C:\Windows\System\UBOtGnR.exe
  2⤵
  PID:9628
- C:\Windows\System\lesHHTZ.exe
  C:\Windows\System\lesHHTZ.exe
  2⤵
  PID:9656
- C:\Windows\System\fvsRkNh.exe
  C:\Windows\System\fvsRkNh.exe
  2⤵
  PID:9684
- C:\Windows\System\wLHqSRU.exe
  C:\Windows\System\wLHqSRU.exe
  2⤵
  PID:9716
- C:\Windows\System\hARToLM.exe
  C:\Windows\System\hARToLM.exe
  2⤵
  PID:9744
- C:\Windows\System\CGfCnth.exe
  C:\Windows\System\CGfCnth.exe
  2⤵
  PID:9772
- C:\Windows\System\faHhGcR.exe
  C:\Windows\System\faHhGcR.exe
  2⤵
  PID:9800
- C:\Windows\System\kkEipRL.exe
  C:\Windows\System\kkEipRL.exe
  2⤵
  PID:9828
- C:\Windows\System\gMktIHx.exe
  C:\Windows\System\gMktIHx.exe
  2⤵
  PID:9856
- C:\Windows\System\sIYOLuP.exe
  C:\Windows\System\sIYOLuP.exe
  2⤵
  PID:9884
- C:\Windows\System\ErdWCsG.exe
  C:\Windows\System\ErdWCsG.exe
  2⤵
  PID:9912
- C:\Windows\System\nsXVMIn.exe
  C:\Windows\System\nsXVMIn.exe
  2⤵
  PID:9948
- C:\Windows\System\SSaXvDH.exe
  C:\Windows\System\SSaXvDH.exe
  2⤵
  PID:9976
- C:\Windows\System\wWSFVoV.exe
  C:\Windows\System\wWSFVoV.exe
  2⤵
  PID:10004
- C:\Windows\System\athmBue.exe
  C:\Windows\System\athmBue.exe
  2⤵
  PID:10032
- C:\Windows\System\HOIQvSh.exe
  C:\Windows\System\HOIQvSh.exe
  2⤵
  PID:10056
- C:\Windows\System\HfFcexl.exe
  C:\Windows\System\HfFcexl.exe
  2⤵
  PID:10088
- C:\Windows\System\cIPCUBn.exe
  C:\Windows\System\cIPCUBn.exe
  2⤵
  PID:10116
- C:\Windows\System\YFmrehT.exe
  C:\Windows\System\YFmrehT.exe
  2⤵
  PID:10144
- C:\Windows\System\AOodmrC.exe
  C:\Windows\System\AOodmrC.exe
  2⤵
  PID:10172
- C:\Windows\System\FwqYotd.exe
  C:\Windows\System\FwqYotd.exe
  2⤵
  PID:10200
- C:\Windows\System\tujuUNT.exe
  C:\Windows\System\tujuUNT.exe
  2⤵
  PID:10228
- C:\Windows\System\BBNCNIu.exe
  C:\Windows\System\BBNCNIu.exe
  2⤵
  PID:9256
- C:\Windows\System\iIArVyI.exe
  C:\Windows\System\iIArVyI.exe
  2⤵
  PID:9316
- C:\Windows\System\Vzqgcuk.exe
  C:\Windows\System\Vzqgcuk.exe
  2⤵
  PID:9388
- C:\Windows\System\bdguymp.exe
  C:\Windows\System\bdguymp.exe
  2⤵
  PID:9452
- C:\Windows\System\bIOfPkB.exe
  C:\Windows\System\bIOfPkB.exe
  2⤵
  PID:9500
- C:\Windows\System\VECDPRZ.exe
  C:\Windows\System\VECDPRZ.exe
  2⤵
  PID:9564
- C:\Windows\System\RwJKsJO.exe
  C:\Windows\System\RwJKsJO.exe
  2⤵
  PID:9624
- C:\Windows\System\DOTcCMX.exe
  C:\Windows\System\DOTcCMX.exe
  2⤵
  PID:9696
- C:\Windows\System\REkRcDb.exe
  C:\Windows\System\REkRcDb.exe
  2⤵
  PID:9764
- C:\Windows\System\cIGUSNs.exe
  C:\Windows\System\cIGUSNs.exe
  2⤵
  PID:9824
- C:\Windows\System\tQvLsHF.exe
  C:\Windows\System\tQvLsHF.exe
  2⤵
  PID:9880
- C:\Windows\System\WFgHVFc.exe
  C:\Windows\System\WFgHVFc.exe
  2⤵
  PID:9960
- C:\Windows\System\yWaAtmx.exe
  C:\Windows\System\yWaAtmx.exe
  2⤵
  PID:10024
- C:\Windows\System\efCPgtK.exe
  C:\Windows\System\efCPgtK.exe
  2⤵
  PID:10084
- C:\Windows\System\gyrNBjP.exe
  C:\Windows\System\gyrNBjP.exe
  2⤵
  PID:10164
- C:\Windows\System\OSdusTJ.exe
  C:\Windows\System\OSdusTJ.exe
  2⤵
  PID:10224
- C:\Windows\System\obfHWxA.exe
  C:\Windows\System\obfHWxA.exe
  2⤵
  PID:9344
- C:\Windows\System\kVfcuJZ.exe
  C:\Windows\System\kVfcuJZ.exe
  2⤵
  PID:2864
- C:\Windows\System\sbRufwB.exe
  C:\Windows\System\sbRufwB.exe
  2⤵
  PID:9620
- C:\Windows\System\vrTVQbM.exe
  C:\Windows\System\vrTVQbM.exe
  2⤵
  PID:9792
- C:\Windows\System\GzOMltS.exe
  C:\Windows\System\GzOMltS.exe
  2⤵
  PID:9940
- C:\Windows\System\TcUDjbv.exe
  C:\Windows\System\TcUDjbv.exe
  2⤵
  PID:10072
- C:\Windows\System\BSecUZM.exe
  C:\Windows\System\BSecUZM.exe
  2⤵
  PID:3716
- C:\Windows\System\kajWvmg.exe
  C:\Windows\System\kajWvmg.exe
  2⤵
  PID:4964
- C:\Windows\System\VoouVgH.exe
  C:\Windows\System\VoouVgH.exe
  2⤵
  PID:9592
- C:\Windows\System\wqTsGwu.exe
  C:\Windows\System\wqTsGwu.exe
  2⤵
  PID:9908
- C:\Windows\System\MTHaoNh.exe
  C:\Windows\System\MTHaoNh.exe
  2⤵
  PID:2420
- C:\Windows\System\vZzrcEo.exe
  C:\Windows\System\vZzrcEo.exe
  2⤵
  PID:9852
- C:\Windows\System\IDsgbBw.exe
  C:\Windows\System\IDsgbBw.exe
  2⤵
  PID:9480
- C:\Windows\System\BxJRRuE.exe
  C:\Windows\System\BxJRRuE.exe
  2⤵
  PID:10256
- C:\Windows\System\QExNdny.exe
  C:\Windows\System\QExNdny.exe
  2⤵
  PID:10284
- C:\Windows\System\lpaKKhV.exe
  C:\Windows\System\lpaKKhV.exe
  2⤵
  PID:10312
- C:\Windows\System\iIuzRIR.exe
  C:\Windows\System\iIuzRIR.exe
  2⤵
  PID:10340
- C:\Windows\System\uqjSmxM.exe
  C:\Windows\System\uqjSmxM.exe
  2⤵
  PID:10368
- C:\Windows\System\eoDdhom.exe
  C:\Windows\System\eoDdhom.exe
  2⤵
  PID:10396
- C:\Windows\System\ZdIJXKS.exe
  C:\Windows\System\ZdIJXKS.exe
  2⤵
  PID:10424
- C:\Windows\System\aTczcRI.exe
  C:\Windows\System\aTczcRI.exe
  2⤵
  PID:10452
- C:\Windows\System\VSqynJh.exe
  C:\Windows\System\VSqynJh.exe
  2⤵
  PID:10480
- C:\Windows\System\pFVRzHf.exe
  C:\Windows\System\pFVRzHf.exe
  2⤵
  PID:10508
- C:\Windows\System\HGkSQdA.exe
  C:\Windows\System\HGkSQdA.exe
  2⤵
  PID:10536
- C:\Windows\System\UUVYMkg.exe
  C:\Windows\System\UUVYMkg.exe
  2⤵
  PID:10564
- C:\Windows\System\MxoJwfp.exe
  C:\Windows\System\MxoJwfp.exe
  2⤵
  PID:10592
- C:\Windows\System\OvPLjDC.exe
  C:\Windows\System\OvPLjDC.exe
  2⤵
  PID:10620
- C:\Windows\System\POfwSkq.exe
  C:\Windows\System\POfwSkq.exe
  2⤵
  PID:10648
- C:\Windows\System\obzoeok.exe
  C:\Windows\System\obzoeok.exe
  2⤵
  PID:10680
- C:\Windows\System\dfeKJkC.exe
  C:\Windows\System\dfeKJkC.exe
  2⤵
  PID:10708
- C:\Windows\System\AeWTQoc.exe
  C:\Windows\System\AeWTQoc.exe
  2⤵
  PID:10736
- C:\Windows\System\BWntiAA.exe
  C:\Windows\System\BWntiAA.exe
  2⤵
  PID:10764
- C:\Windows\System\RRZSNKu.exe
  C:\Windows\System\RRZSNKu.exe
  2⤵
  PID:10792
- C:\Windows\System\ksWcVdh.exe
  C:\Windows\System\ksWcVdh.exe
  2⤵
  PID:10820
- C:\Windows\System\pyrRYvq.exe
  C:\Windows\System\pyrRYvq.exe
  2⤵
  PID:10848
- C:\Windows\System\PQzUvyf.exe
  C:\Windows\System\PQzUvyf.exe
  2⤵
  PID:10876
- C:\Windows\System\xBczLkL.exe
  C:\Windows\System\xBczLkL.exe
  2⤵
  PID:10904
- C:\Windows\System\hCLEhdk.exe
  C:\Windows\System\hCLEhdk.exe
  2⤵
  PID:10932
- C:\Windows\System\bhUiJUR.exe
  C:\Windows\System\bhUiJUR.exe
  2⤵
  PID:10960
- C:\Windows\System\KejInCi.exe
  C:\Windows\System\KejInCi.exe
  2⤵
  PID:10988
- C:\Windows\System\foFEXor.exe
  C:\Windows\System\foFEXor.exe
  2⤵
  PID:11016
- C:\Windows\System\oUEsQHI.exe
  C:\Windows\System\oUEsQHI.exe
  2⤵
  PID:11044
- C:\Windows\System\XRDftwz.exe
  C:\Windows\System\XRDftwz.exe
  2⤵
  PID:11072
- C:\Windows\System\wpDaudW.exe
  C:\Windows\System\wpDaudW.exe
  2⤵
  PID:11100
- C:\Windows\System\AbmIGUP.exe
  C:\Windows\System\AbmIGUP.exe
  2⤵
  PID:11128
- C:\Windows\System\GmcMUKV.exe
  C:\Windows\System\GmcMUKV.exe
  2⤵
  PID:11156
- C:\Windows\System\XsmpbPj.exe
  C:\Windows\System\XsmpbPj.exe
  2⤵
  PID:11184
- C:\Windows\System\TpujCSk.exe
  C:\Windows\System\TpujCSk.exe
  2⤵
  PID:11212
- C:\Windows\System\dYIiXNt.exe
  C:\Windows\System\dYIiXNt.exe
  2⤵
  PID:11240
- C:\Windows\System\cHwWPSE.exe
  C:\Windows\System\cHwWPSE.exe
  2⤵
  PID:10248
- C:\Windows\System\vaqmzhr.exe
  C:\Windows\System\vaqmzhr.exe
  2⤵
  PID:10304
- C:\Windows\System\vQgKwUK.exe
  C:\Windows\System\vQgKwUK.exe
  2⤵
  PID:10364
- C:\Windows\System\RrVgpIz.exe
  C:\Windows\System\RrVgpIz.exe
  2⤵
  PID:10448
- C:\Windows\System\iQNWoWO.exe
  C:\Windows\System\iQNWoWO.exe
  2⤵
  PID:10500
- C:\Windows\System\yHxUCdw.exe
  C:\Windows\System\yHxUCdw.exe
  2⤵
  PID:10560
- C:\Windows\System\jAdbfbK.exe
  C:\Windows\System\jAdbfbK.exe
  2⤵
  PID:10632
- C:\Windows\System\DjBZMLx.exe
  C:\Windows\System\DjBZMLx.exe
  2⤵
  PID:10700
- C:\Windows\System\AetpWwG.exe
  C:\Windows\System\AetpWwG.exe
  2⤵
  PID:10760
- C:\Windows\System\PMHPnlG.exe
  C:\Windows\System\PMHPnlG.exe
  2⤵
  PID:10832
- C:\Windows\System\KwcdTbL.exe
  C:\Windows\System\KwcdTbL.exe
  2⤵
  PID:10896
- C:\Windows\System\NMdjKIB.exe
  C:\Windows\System\NMdjKIB.exe
  2⤵
  PID:10956
- C:\Windows\System\prarrxu.exe
  C:\Windows\System\prarrxu.exe
  2⤵
  PID:11028
- C:\Windows\System\rcXpVJC.exe
  C:\Windows\System\rcXpVJC.exe
  2⤵
  PID:11092
- C:\Windows\System\RGEbYDW.exe
  C:\Windows\System\RGEbYDW.exe
  2⤵
  PID:11152
- C:\Windows\System\dtmApff.exe
  C:\Windows\System\dtmApff.exe
  2⤵
  PID:11224
- C:\Windows\System\KEhpdIp.exe
  C:\Windows\System\KEhpdIp.exe
  2⤵
  PID:10296
- C:\Windows\System\jtBtmVl.exe
  C:\Windows\System\jtBtmVl.exe
  2⤵
  PID:10420
- C:\Windows\System\yhJJqxc.exe
  C:\Windows\System\yhJJqxc.exe
  2⤵
  PID:10528
- C:\Windows\System\qOvrfvn.exe
  C:\Windows\System\qOvrfvn.exe
  2⤵
  PID:10612
- C:\Windows\System\uoUAOmk.exe
  C:\Windows\System\uoUAOmk.exe
  2⤵
  PID:10756
- C:\Windows\System\ZjnuhVX.exe
  C:\Windows\System\ZjnuhVX.exe
  2⤵
  PID:10924
- C:\Windows\System\TQccsHm.exe
  C:\Windows\System\TQccsHm.exe
  2⤵
  PID:11068
- C:\Windows\System\GoQuhsk.exe
  C:\Windows\System\GoQuhsk.exe
  2⤵
  PID:11208
- C:\Windows\System\RguAsrU.exe
  C:\Windows\System\RguAsrU.exe
  2⤵
  PID:10392
- C:\Windows\System\YCMYVes.exe
  C:\Windows\System\YCMYVes.exe
  2⤵
  PID:10588
- C:\Windows\System\CBIUKZA.exe
  C:\Windows\System\CBIUKZA.exe
  2⤵
  PID:10816
- C:\Windows\System\tAIjaTW.exe
  C:\Windows\System\tAIjaTW.exe
  2⤵
  PID:10408
- C:\Windows\System\PhfHOVy.exe
  C:\Windows\System\PhfHOVy.exe
  2⤵
  PID:3096
- C:\Windows\System\iVHPZfM.exe
  C:\Windows\System\iVHPZfM.exe
  2⤵
  PID:11284
- C:\Windows\System\bcDFBDN.exe
  C:\Windows\System\bcDFBDN.exe
  2⤵
  PID:11312
- C:\Windows\System\dbjzPFK.exe
  C:\Windows\System\dbjzPFK.exe
  2⤵
  PID:11356
- C:\Windows\System\VfKosBW.exe
  C:\Windows\System\VfKosBW.exe
  2⤵
  PID:11372
- C:\Windows\System\QbpUAoU.exe
  C:\Windows\System\QbpUAoU.exe
  2⤵
  PID:11400
- C:\Windows\System\qWTYXHr.exe
  C:\Windows\System\qWTYXHr.exe
  2⤵
  PID:11424
- C:\Windows\System\fTSlbuC.exe
  C:\Windows\System\fTSlbuC.exe
  2⤵
  PID:11472
- C:\Windows\System\oUhHWES.exe
  C:\Windows\System\oUhHWES.exe
  2⤵
  PID:11496
- C:\Windows\System\UqBCoPy.exe
  C:\Windows\System\UqBCoPy.exe
  2⤵
  PID:11524
- C:\Windows\System\knGoLcM.exe
  C:\Windows\System\knGoLcM.exe
  2⤵
  PID:11552
- C:\Windows\System\SsBfCui.exe
  C:\Windows\System\SsBfCui.exe
  2⤵
  PID:11592
- C:\Windows\System\LvVLtbO.exe
  C:\Windows\System\LvVLtbO.exe
  2⤵
  PID:11608
- C:\Windows\System\RzioIVb.exe
  C:\Windows\System\RzioIVb.exe
  2⤵
  PID:11648
- C:\Windows\System\alYRIeH.exe
  C:\Windows\System\alYRIeH.exe
  2⤵
  PID:11688
- C:\Windows\System\lweDhJJ.exe
  C:\Windows\System\lweDhJJ.exe
  2⤵
  PID:11716
- C:\Windows\System\KiYywgv.exe
  C:\Windows\System\KiYywgv.exe
  2⤵
  PID:11732
- C:\Windows\System\TgkQlQa.exe
  C:\Windows\System\TgkQlQa.exe
  2⤵
  PID:11760
- C:\Windows\System\EewXftB.exe
  C:\Windows\System\EewXftB.exe
  2⤵
  PID:11780
- C:\Windows\System\ISWGAgP.exe
  C:\Windows\System\ISWGAgP.exe
  2⤵
  PID:11824
- C:\Windows\System\wNApXcK.exe
  C:\Windows\System\wNApXcK.exe
  2⤵
  PID:11844
- C:\Windows\System\LbooXok.exe
  C:\Windows\System\LbooXok.exe
  2⤵
  PID:11872
- C:\Windows\System\cmNCbzr.exe
  C:\Windows\System\cmNCbzr.exe
  2⤵
  PID:11896
- C:\Windows\System\VgAvCjY.exe
  C:\Windows\System\VgAvCjY.exe
  2⤵
  PID:11932
- C:\Windows\System\djqMuiq.exe
  C:\Windows\System\djqMuiq.exe
  2⤵
  PID:11968
- C:\Windows\System\dpZMVpp.exe
  C:\Windows\System\dpZMVpp.exe
  2⤵
  PID:11984
- C:\Windows\System\bactzTp.exe
  C:\Windows\System\bactzTp.exe
  2⤵
  PID:12036
- C:\Windows\System\YekDBbs.exe
  C:\Windows\System\YekDBbs.exe
  2⤵
  PID:12060
- C:\Windows\System\sTRtbca.exe
  C:\Windows\System\sTRtbca.exe
  2⤵
  PID:12076
- C:\Windows\System\sRKfYzm.exe
  C:\Windows\System\sRKfYzm.exe
  2⤵
  PID:12096
- C:\Windows\System\lhunzjx.exe
  C:\Windows\System\lhunzjx.exe
  2⤵
  PID:12136
- C:\Windows\System\yWmeTiO.exe
  C:\Windows\System\yWmeTiO.exe
  2⤵
  PID:12168
- C:\Windows\System\DmcHdhJ.exe
  C:\Windows\System\DmcHdhJ.exe
  2⤵
  PID:12192
- C:\Windows\System\JSeQgNE.exe
  C:\Windows\System\JSeQgNE.exe
  2⤵
  PID:12212
- C:\Windows\System\phNCzVf.exe
  C:\Windows\System\phNCzVf.exe
  2⤵
  PID:12232
- C:\Windows\System\DKnKRbs.exe
  C:\Windows\System\DKnKRbs.exe
  2⤵
  PID:12272
- C:\Windows\System\GaAXfSv.exe
  C:\Windows\System\GaAXfSv.exe
  2⤵
  PID:10556
- C:\Windows\System\AFFNJGr.exe
  C:\Windows\System\AFFNJGr.exe
  2⤵
  PID:11296
- C:\Windows\System\ZzHiebo.exe
  C:\Windows\System\ZzHiebo.exe
  2⤵
  PID:11304
- C:\Windows\System\iPtrCzk.exe
  C:\Windows\System\iPtrCzk.exe
  2⤵
  PID:11388
- C:\Windows\System\dWTlVca.exe
  C:\Windows\System\dWTlVca.exe
  2⤵
  PID:4044
- C:\Windows\System\HvuQDIY.exe
  C:\Windows\System\HvuQDIY.exe
  2⤵
  PID:11576
- C:\Windows\System\KHbhpcn.exe
  C:\Windows\System\KHbhpcn.exe
  2⤵
  PID:11676
- C:\Windows\System\KVEKssg.exe
  C:\Windows\System\KVEKssg.exe
  2⤵
  PID:11744
- C:\Windows\System\fUkMNim.exe
  C:\Windows\System\fUkMNim.exe
  2⤵
  PID:11788
- C:\Windows\System\AaBWNpg.exe
  C:\Windows\System\AaBWNpg.exe
  2⤵
  PID:11864
- C:\Windows\System\oHKuNRa.exe
  C:\Windows\System\oHKuNRa.exe
  2⤵
  PID:11952
- C:\Windows\System\MzsEshs.exe
  C:\Windows\System\MzsEshs.exe
  2⤵
  PID:4220
- C:\Windows\System\yRpTadO.exe
  C:\Windows\System\yRpTadO.exe
  2⤵
  PID:11980
- C:\Windows\System\eDvncfo.exe
  C:\Windows\System\eDvncfo.exe
  2⤵
  PID:10668
- C:\Windows\System\DXTGanH.exe
  C:\Windows\System\DXTGanH.exe
  2⤵
  PID:12072
- C:\Windows\System\LmgZMKy.exe
  C:\Windows\System\LmgZMKy.exe
  2⤵
  PID:12092
- C:\Windows\System\jQgwiPs.exe
  C:\Windows\System\jQgwiPs.exe
  2⤵
  PID:3028
- C:\Windows\System\siUVWiB.exe
  C:\Windows\System\siUVWiB.exe
  2⤵
  PID:3600
- C:\Windows\System\IBXurgI.exe
  C:\Windows\System\IBXurgI.exe
  2⤵
  PID:12108
- C:\Windows\System\GRaDzHa.exe
  C:\Windows\System\GRaDzHa.exe
  2⤵
  PID:12280
- C:\Windows\System\vXOqxim.exe
  C:\Windows\System\vXOqxim.exe
  2⤵
  PID:11324
- C:\Windows\System\QSeLUtl.exe
  C:\Windows\System\QSeLUtl.exe
  2⤵
  PID:11444
- C:\Windows\System\qvmMKgz.exe
  C:\Windows\System\qvmMKgz.exe
  2⤵
  PID:11628
- C:\Windows\System\xsOTkNK.exe
  C:\Windows\System\xsOTkNK.exe
  2⤵
  PID:11748
- C:\Windows\System\lkCaEJF.exe
  C:\Windows\System\lkCaEJF.exe
  2⤵
  PID:11816
- C:\Windows\System\iMvVdMf.exe
  C:\Windows\System\iMvVdMf.exe
  2⤵
  PID:2860
- C:\Windows\System\iBoYmne.exe
  C:\Windows\System\iBoYmne.exe
  2⤵
  PID:12000
- C:\Windows\System\ZRMJmpG.exe
  C:\Windows\System\ZRMJmpG.exe
  2⤵
  PID:12124
- C:\Windows\System\CdvmERs.exe
  C:\Windows\System\CdvmERs.exe
  2⤵
  PID:12184
- C:\Windows\System\AThrfKk.exe
  C:\Windows\System\AThrfKk.exe
  2⤵
  PID:12252
- C:\Windows\System\xEcpSQE.exe
  C:\Windows\System\xEcpSQE.exe
  2⤵
  PID:11540
- C:\Windows\System\GlPrBMz.exe
  C:\Windows\System\GlPrBMz.exe
  2⤵
  PID:11964
- C:\Windows\System\NtfrnJG.exe
  C:\Windows\System\NtfrnJG.exe
  2⤵
  PID:12068
- C:\Windows\System\folCyBK.exe
  C:\Windows\System\folCyBK.exe
  2⤵
  PID:11392
- C:\Windows\System\cWmamok.exe
  C:\Windows\System\cWmamok.exe
  2⤵
  PID:12084
- C:\Windows\System\MkEtoqa.exe
  C:\Windows\System\MkEtoqa.exe
  2⤵
  PID:11996
- C:\Windows\System\ssWhxpP.exe
  C:\Windows\System\ssWhxpP.exe
  2⤵
  PID:12304
- C:\Windows\System\XdLSfFD.exe
  C:\Windows\System\XdLSfFD.exe
  2⤵
  PID:12332
- C:\Windows\System\xIhRIRP.exe
  C:\Windows\System\xIhRIRP.exe
  2⤵
  PID:12360
- C:\Windows\System\GEQeLyd.exe
  C:\Windows\System\GEQeLyd.exe
  2⤵
  PID:12388
- C:\Windows\System\nCOfgjK.exe
  C:\Windows\System\nCOfgjK.exe
  2⤵
  PID:12416
- C:\Windows\System\LLQqYjC.exe
  C:\Windows\System\LLQqYjC.exe
  2⤵
  PID:12444
- C:\Windows\System\afwfedw.exe
  C:\Windows\System\afwfedw.exe
  2⤵
  PID:12472
- C:\Windows\System\eOpLCKl.exe
  C:\Windows\System\eOpLCKl.exe
  2⤵
  PID:12500
- C:\Windows\System\yYAKupq.exe
  C:\Windows\System\yYAKupq.exe
  2⤵
  PID:12528
- C:\Windows\System\WEjYAmD.exe
  C:\Windows\System\WEjYAmD.exe
  2⤵
  PID:12556
- C:\Windows\System\igtfVeg.exe
  C:\Windows\System\igtfVeg.exe
  2⤵
  PID:12584
- C:\Windows\System\NPBrzYd.exe
  C:\Windows\System\NPBrzYd.exe
  2⤵
  PID:12612
- C:\Windows\System\HQEvCaS.exe
  C:\Windows\System\HQEvCaS.exe
  2⤵
  PID:12640
- C:\Windows\System\qMcfOPH.exe
  C:\Windows\System\qMcfOPH.exe
  2⤵
  PID:12668
- C:\Windows\System\moSYjhk.exe
  C:\Windows\System\moSYjhk.exe
  2⤵
  PID:12696
- C:\Windows\System\xtFxSpb.exe
  C:\Windows\System\xtFxSpb.exe
  2⤵
  PID:12724
- C:\Windows\System\LPMzXNg.exe
  C:\Windows\System\LPMzXNg.exe
  2⤵
  PID:12752
- C:\Windows\System\VasgygM.exe
  C:\Windows\System\VasgygM.exe
  2⤵
  PID:12780
- C:\Windows\System\cAOQNXD.exe
  C:\Windows\System\cAOQNXD.exe
  2⤵
  PID:12808
- C:\Windows\System\szmmGiS.exe
  C:\Windows\System\szmmGiS.exe
  2⤵
  PID:12836
- C:\Windows\System\UPvEDvu.exe
  C:\Windows\System\UPvEDvu.exe
  2⤵
  PID:12864
- C:\Windows\System\mpdHmAR.exe
  C:\Windows\System\mpdHmAR.exe
  2⤵
  PID:12892
- C:\Windows\System\QEPYoNM.exe
  C:\Windows\System\QEPYoNM.exe
  2⤵
  PID:12920
- C:\Windows\System\tGzbLIr.exe
  C:\Windows\System\tGzbLIr.exe
  2⤵
  PID:12948
- C:\Windows\System\YVRGvyS.exe
  C:\Windows\System\YVRGvyS.exe
  2⤵
  PID:12980
- C:\Windows\System\bJztqpA.exe
  C:\Windows\System\bJztqpA.exe
  2⤵
  PID:13008
- C:\Windows\System\GOgwZUC.exe
  C:\Windows\System\GOgwZUC.exe
  2⤵
  PID:13036
- C:\Windows\System\WgQCrTU.exe
  C:\Windows\System\WgQCrTU.exe
  2⤵
  PID:13064
- C:\Windows\System\nHcepdA.exe
  C:\Windows\System\nHcepdA.exe
  2⤵
  PID:13092
- C:\Windows\System\yyLHLnI.exe
  C:\Windows\System\yyLHLnI.exe
  2⤵
  PID:13120
- C:\Windows\System\AwcLIfi.exe
  C:\Windows\System\AwcLIfi.exe
  2⤵
  PID:13148
- C:\Windows\System\DtKRYZM.exe
  C:\Windows\System\DtKRYZM.exe
  2⤵
  PID:13176
- C:\Windows\System\yZQlZLM.exe
  C:\Windows\System\yZQlZLM.exe
  2⤵
  PID:13204
- C:\Windows\System\AcEjQqj.exe
  C:\Windows\System\AcEjQqj.exe
  2⤵
  PID:13232
- C:\Windows\System\JyKkFdb.exe
  C:\Windows\System\JyKkFdb.exe
  2⤵
  PID:13260
- C:\Windows\System\bGDnTuv.exe
  C:\Windows\System\bGDnTuv.exe
  2⤵
  PID:13288
- C:\Windows\System\ibUpsbV.exe
  C:\Windows\System\ibUpsbV.exe
  2⤵
  PID:12296
- C:\Windows\System\SXGiIOb.exe
  C:\Windows\System\SXGiIOb.exe
  2⤵
  PID:12356
- C:\Windows\System\sBzEzpS.exe
  C:\Windows\System\sBzEzpS.exe
  2⤵
  PID:12428
- C:\Windows\System\CMNLMhR.exe
  C:\Windows\System\CMNLMhR.exe
  2⤵
  PID:12492
- C:\Windows\System\ovfLoLj.exe
  C:\Windows\System\ovfLoLj.exe
  2⤵
  PID:12552
- C:\Windows\System\wzcQzPU.exe
  C:\Windows\System\wzcQzPU.exe
  2⤵
  PID:12624
- C:\Windows\System\ZlrDFNR.exe
  C:\Windows\System\ZlrDFNR.exe
  2⤵
  PID:12688
- C:\Windows\System\qqtGCHK.exe
  C:\Windows\System\qqtGCHK.exe
  2⤵
  PID:12744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1gakitbu.0ro.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABCbLbA.exe

Filesize
3.1MB

MD5
2a3c58233218f5b35d9ba7836e5f83de

SHA1
23a4af3381801160b310f8a1fc78215bf3ce78b5

SHA256
17656fccf2ce2fff29880a35cc0bdbdc715766fa8ea8509a327af20455c2edac

SHA512
a70ce40c1422e541ed91c96379eb04279a0068ff31024c848afc5729a908c35cdac780edd8b3185be628076ed0f5cbeee28b576c90afdcdf1141d9b007deb1ef

Download Submit
C:\Windows\System\AHJaTGe.exe

Filesize
3.1MB

MD5
fdfc14dd9522f429af9913e4dc4426da

SHA1
4162f1cc5dececebadf1ec7ed73b77e07f08716d

SHA256
536dc88eaa27ea4f98d14d069875c3502554c2a597183962bf03ddd39d1e8dbb

SHA512
de53efa7e0015834174580bb145f31afe0f33b3060323308cadf70eb22287b6720196759e3928c97b52802f2fd1b31a4003da948637ffe4382b522d65d6ec835

Download Submit
C:\Windows\System\EhrQvXA.exe

Filesize
3.1MB

MD5
02baca72d255d67a7986ca79f4cf75c9

SHA1
7f36002c6542dcf94438e55d9f50d1ce33c81c99

SHA256
e1c5b681274886ae053d14a2b9cd12951e1448b825b40a4910f68673319ed596

SHA512
1c726cd8febb4523dfc73e4f27205e0d742294e3900986fd15ee46e0fada60d8b33e567cf231435bb73dd68f61078777d8395515400af1990e364bd00f28700b

Download Submit
C:\Windows\System\KHSFyGe.exe

Filesize
3.1MB

MD5
0ae87fb9fddbc1bcb23eff3a96395c9b

SHA1
77ac91941cd3905aab56fe881078a5145a86ba50

SHA256
ce044c5a4cafe5226d321b0abf54f7e07744a0f5af601daa5fb15cfdd24e0e32

SHA512
e8deb4d0280f9e2f5077cac0240a33c406ce340c0a240274abef2fc7218f0966463cb1678c7a23de9d099f978dbc1339dbb8f55d3e57b52bb3977312294cbd2c

Download Submit
C:\Windows\System\LBwzoYg.exe

Filesize
3.1MB

MD5
7a849396b9938827e310c915200fa996

SHA1
2e7c968e7df3dbf4a89afde64af98aa13886d41e

SHA256
ebd3c7b3b9f7c9fbbd5cf4223861d8b3d6eae32e13405c3980d04dfcf83f5567

SHA512
b308ff171eb275f116c0c0fbe430876b9e5b3647aef0440ad4bc0e62cba61c0ad05b947e2d18f1162d6bb2dc189534a2707d4e575054ea514a06b4f62903db6e

Download Submit
C:\Windows\System\LHObqnZ.exe

Filesize
3.1MB

MD5
7e468a51e1834066e7da258a98805bf8

SHA1
5c1ef7597e1d96f5b92c7563c9d2341166c9427a

SHA256
ad04ae7155ab85c0e0d42842472285431a3ae6b6140f859b59b3ec7bb3300ef9

SHA512
07beb6ab7748a2a9bda30c927ac63b710f226149b74629dea9b7fb17d12af1b9a599d0ee22eb65c92bd9940d4f9e873913eb9656d51026b03d23a675012ec1b3

Download Submit
C:\Windows\System\LVFqiAc.exe

Filesize
3.1MB

MD5
1d114782f759e005aac30c44f243f938

SHA1
fa8f6bd4ff7667d5a5cbb4bb76496233fe63146b

SHA256
cfccc892ab00429bb4adbbd617aa456210d3dacfc6aee25bba1796d3e8545137

SHA512
18e4591263548fb7fd616b2ab67eee324d93dd344f2c501ece251e4c978fb54c3d378d8708fd70652097b05c18a790910c3709b1c58bba15414c8690f2fe2a9e

Download Submit
C:\Windows\System\MUOGAgU.exe

Filesize
3.1MB

MD5
8f2f94282aecb418ec4792c8082ade6c

SHA1
40c91f04de72500476431601be1e41c7a0a9578a

SHA256
2b847d683cff1aa33ffa3f7d3b65982e55664d65283a74a3da261d7d9a3e085c

SHA512
4982186ce739346a5bebac5697e3471acf9309edbecce1e573d5d92de1d8d9ef40652b8108bf283cb607a8a60b96a76c579af4d923c6ef8a2450e309c625751f

Download Submit
C:\Windows\System\NuiTEAT.exe

Filesize
3.1MB

MD5
7a4dc289357b5cf73657afea5d18342c

SHA1
c57b689680110a70594eb898ff7e8f85ca72f33b

SHA256
ae81afde8da2e38cfb38e8ab43eacf9ab5851f1df81239413de3d671a7d68e6f

SHA512
fbaceb7a5a765cb538295df7395b5e613c748a63901d961ce02a85457e6dfd765ffe409b546f0742308c0db0951f6921252947f3647c8d890a918c33fc2abae0

Download Submit
C:\Windows\System\OutvjJx.exe

Filesize
3.1MB

MD5
32962d8bbe60de19ad34057e76a432bd

SHA1
06f7ae870f9b1484e49c0dab897b797591fc8d8e

SHA256
3e90ec99946b9a4cda510ee33d1dd3e86cb90194854d30c9959d23ca419be5c8

SHA512
ba6fb34da1faa2dea59470e306ea4186d1f59f879f4e3a2549793fc36f599edc7609d24b127b599a726ce733119c785bba3d1efad239aebd1d464afd1b63ce12

Download Submit
C:\Windows\System\QGwbFyv.exe

Filesize
3.1MB

MD5
98d3d7e59fcd96d3635e77efa2850113

SHA1
aff8b2ce25db0c3346a8f12d6fd43fdca6d95b3b

SHA256
bc3b3906a2bf7ca96f3e79729e64fcb7ad949fc9b1fc74e46be1feb0233c1567

SHA512
afed77f6dfb969c03911dd39753e7bfacdf70f6587cc502a3f409cedbd680b15ff847fa953af7ff358779017ed154761455e79f205afa09d139c63528f5017a2

Download Submit
C:\Windows\System\SYQJZNJ.exe

Filesize
3.1MB

MD5
82fda496d7b8ab44b338f0a3626bdfee

SHA1
5eed34c87aad78724aab97ed348d4a27189ac26b

SHA256
02fd9a20fbedc205e39cf616b9df570c054e7da5a1af4dd3e22fb613de864f3d

SHA512
45812aa74eeae768a63885ec6beac6d0a9c2f537c0e12e82f14bbd4734fbfdf4a83376d2bde113204c88b9ba727cb041443ffa17483ae7a6e5fd958011b75144

Download Submit
C:\Windows\System\WSexyOh.exe

Filesize
3.1MB

MD5
87ce73344e048d6df4257174a35d8613

SHA1
fdb04d60b27938d9d06f63b10800f3a4c3db1d0a

SHA256
48489755a91479f5542dccb17b2b9c8fc4d59146f3889d055f51d1e61c4953e5

SHA512
ba00fc9d5decf693247cc2ce54b9d00ad617105ce29224ca189b1e690c2affc8a13b72869ce8c935674897e92261c080b31b79d44d97d5caf719a1df55016b0d

Download Submit
C:\Windows\System\XVvljyi.exe

Filesize
3.1MB

MD5
db07cc722401ee7b0cc4c6331a0e16bc

SHA1
9a327350d09ce488afd6e8ff83698c5748b1c4f5

SHA256
abe1f3ab08b1d4c4b5cc37aaedbe3a7bb8b1c74a1822daa29fced86f95bb55ea

SHA512
7904d7eb70b3dcff9d4e773846c5e356178e8d2c31fc670d1d4a9ddd80690a2bd8883123142a626ca98b7b499f12c1441bf770248442d4db237a939a3e77e47e

Download Submit
C:\Windows\System\aLCQaRm.exe

Filesize
8B

MD5
b51f4f6ea566c7181d4d1f715615a414

SHA1
5f5d2057c3e793a449fbedd304d5084c92db621c

SHA256
efa8a7a6952ccabd712273da0ab5538682fcdaff585ff7604e7a4346286e9320

SHA512
cf70e5addae3f1995c350d8ead332088224d80c10cffe6e3f241ed79cc752dc79ee18c102b4cce11ffe47af43c22c4887cb7ff11f4d8c7bdc4456269c5638b1a

Download Submit
C:\Windows\System\awBLzzK.exe

Filesize
3.1MB

MD5
231f7c770fbefba488bec039e5f2a36e

SHA1
5f1d5b920477292f043cc5dc78a8ac87e59878cd

SHA256
5c649d46eae0b902bb854e47a84ff354800800b4b64db0e4c1ec908c02eb7301

SHA512
04d20c5147f9cf0b0af3491727d6d9047145418964b0da461e706d248bed7da7a46ce7677ea3e0b1217571ba649242d5a55cbd346b0fb5a0c9ac6ba6d8954201

Download Submit
C:\Windows\System\bZMVXPM.exe

Filesize
3.1MB

MD5
9d6193f6d8325f226555c4403adca011

SHA1
f7e91fe9673d95339245c8697d31f19ce54785c9

SHA256
e1a9883a07610d59258144a29d8f6c60e8d0f3f7faa19dd35a4cb33dcf116c26

SHA512
8353a8e1f2b14041276a23dbccfd143f8517b19ece267f01cdd439ade8c533a23ebde322158747975447fd9391af958b15254811f47b0d1c62af796f14b8d9c2

Download Submit
C:\Windows\System\bzXgzLG.exe

Filesize
3.1MB

MD5
363280d0d31bd0e5b42315ad1cab0cfd

SHA1
4b891502e5aec3427dac42f238423d0b396f9532

SHA256
d0c04fc741e409f4d25b04ac319be2f252c865236bbb4c91dc7420bc0f103db2

SHA512
41dbce76f8767dd4a25dce542d0de8d7d6490474eec35cc77b78790761c7874e517665b568413111e605ed37bf1994c72d576d59d1868375d4940c6f297420bb

Download Submit
C:\Windows\System\dzbPgIa.exe

Filesize
3.1MB

MD5
36980db58ca1ee973447e8fab5827509

SHA1
f11d3f89a58646b563df10d908001c7f888f2394

SHA256
42bbce8208c7fae545b4786edcca38dcfaa5463c5a7f449dbc0f5edfbc880fc5

SHA512
7962215af8f30cb3aa0438d2f5f34b7fbb5386391b95a4f0a2a71143813e5ae2aafabac0078e8dd4866594e1fb2de74b79e70f54d417910031715a1d1b54ca0c

Download Submit
C:\Windows\System\etRmftZ.exe

Filesize
3.1MB

MD5
ecbe2f6659dbeae6c80ddd659c4bd410

SHA1
452b4dc28427ad5dc5f10172167f98890f12c339

SHA256
a7aaec5ec1aa64ee8f86c0b5aff12859b91d092a64222ca30725ca7c0112733e

SHA512
5348cb1a7e073ffab91d4386d21c33ed99b5b29fab0432bfb9cb31b1b27f73a0cbcd1670929e1dbea83dfc99b0d6a21c5b7d319a700a23dcb1e2b2a6644fa6a2

Download Submit
C:\Windows\System\fFafBCQ.exe

Filesize
3.1MB

MD5
23d8a9dd44cdea2ee560479291b442d2

SHA1
c29cd2464406b353eac0e54eabe0968c8f42b49d

SHA256
f32b189662cb04d3c8ce130522a8ae8effff071966c2b7d1f7f8f88acc28857d

SHA512
ed9ece9062a40feabcbd46fa69412e18b769682e9a6b4b7fc0f765583edba046246857791c51f3c3eb4eba50c35ff7684807af068c8d782ef681ecf9631bdb67

Download Submit
C:\Windows\System\hKnWmjq.exe

Filesize
3.1MB

MD5
6671558d2c9342e8fcd58bccbfc2d2d2

SHA1
bbb8be9b3a4ed4808851bcd9b35702dcdc9cbe37

SHA256
ec0df6ffe7e22efe3622e299a09fc3d78a6c37cf338015da0d623b217927657b

SHA512
3d1a14cb4fc618dd925d103009c829bb14fc5ad6f82a8a559241f9def67dfe0923520bea609534fdbae4222d46d9972c3522f9acf7f191b45727b5ab8e722f5a

Download Submit
C:\Windows\System\hkWMEwc.exe

Filesize
3.1MB

MD5
490fbfc4427c35279e66fef847dc85bd

SHA1
018ad1f00ca8d9712d3af416dc2b01a35c50cf9e

SHA256
af5ae12123f25f8658e49a83cc4b69194d0da6b11aa9b4912253974277c21dc6

SHA512
fedc970473312811a1bbacb2166dbfe6e864a9cc471cdecdad75c9d303965258fc9fb25c776212743127053ee7dfb83b1ae5f9aff415b43581c63f56e31d691f

Download Submit
C:\Windows\System\mOwJFMI.exe

Filesize
3.1MB

MD5
dc38f1603bec0bc0ee6d0fd6d1390920

SHA1
0d4eece496b9bc017704bdce8145a28e5e506381

SHA256
73c1cef8d397daa04264516e012da8d3e2f54892960dca3e107a552339d652e1

SHA512
5e6d9c2543e876497a806fdc42893aea19f744d4361600a8d1b8bff39a08fdc9c1485ce44a109aab7d76a2e8e36ec6f2c00a788d6b57b2ec49dc3321ff78d634

Download Submit
C:\Windows\System\qAQrrOX.exe

Filesize
3.1MB

MD5
b8031e07d6df67d2f2309bc6d1818ee7

SHA1
f4124cdbc6db52dfbb85d0dffdfe811ba2a19722

SHA256
657c8556b4532f39f3887e6304332c5303997af8f9232366ddfe3d2691264598

SHA512
2fd355bd15a6f5a3efc6faac8a57e5f2c234674ff4d64ddb9a69db307f21960ef4c4697f897c85da9924d2cab7e77cdaf2a563e6a6e19c1497716fc373adbf13

Download Submit
C:\Windows\System\ruAKWgg.exe

Filesize
3.1MB

MD5
7d625a11dd82f0a81dca97de2538686b

SHA1
0b4e3b063097f236d08ec427d1c71fa454631bce

SHA256
3678c9239648076f157f1b5610ca6840dc906e3d458148b4a5d1ec5045c04c31

SHA512
985e7bdf5dbc515af9bef0385298097d3863a49e2f31d07e7c461bff92b469848461a74dd4217fb235aea4bba2748b4057740b0e2638455425c8b972fe2a2cd4

Download Submit
C:\Windows\System\scLbARG.exe

Filesize
3.1MB

MD5
bc4940b8f810cbecfbf2c69f49fe660d

SHA1
7ac14639c8ffc3584ef57739197c4cb7c44d9ee0

SHA256
50259abe5efc8be5b65425129ca6b2b2ae397e64bcdcc0e121198af42df6bc78

SHA512
0df6596e230b220275f80d002a5ee0b453270078bbd418ab3119a20afa6ce294d1c876e2c8ab9bb5a287abb287c38c1f6c0e9efef08bdbd45b061e5274c1b362

Download Submit
C:\Windows\System\sxhdjNW.exe

Filesize
3.1MB

MD5
ee68c90acf6006be90b0df278e218c2e

SHA1
f33e88d95962d74f70a76fff53e26e290a931e92

SHA256
ff655d03fd78d6d6405ee59c9c90b90c60f120d79033a731bf5bf7e6a3d26c9c

SHA512
feae0e8ccfa69cbb37473a0e9aa0f407bd184e5178bfa6d615101d6651985365fde5f3956e42031693818d185278d31a8a517044e71a5ea1eb0db3a148131c37

Download Submit
C:\Windows\System\tyObhGQ.exe

Filesize
3.1MB

MD5
fc2a92fddeb0b46e5f59f55690b9ba7b

SHA1
95529de15428cd9264d5eab4bad099ce1333aa52

SHA256
e30ab48442e2ba9deeb5a19ae24c09498b5e8aa74ed768767b779cef55e2c0fd

SHA512
c9e698e598f3810a5c0652a81d115ddc13d4d74ea3fb44a3496483eaf47a864b495ab400787a3fe1394a8fae0c09ae8c2d8bd021b210d2d02b2dfc464bab7503

Download Submit
C:\Windows\System\tzafzjX.exe

Filesize
3.1MB

MD5
1744a4a8cc51a86151278fa97f98dd83

SHA1
cdeba026d7c72df77448b67f2e7b5f897c95ec9f

SHA256
69c19b40db0e7a8a85e70fcbc70e53fa939ba77d3c4b764cfebcd01916b92bec

SHA512
8cba435c1b014d5384ac16ac042a7195a666fa7d7ec56ed2bc60022217d92396da20f3e3d465dcd036b42fe20395f47151946ecfd52d6dd6b816535d4ec220b7

Download Submit
C:\Windows\System\uEmddGz.exe

Filesize
3.1MB

MD5
59dc311051093e0f9a2821f1bc29ef82

SHA1
fdbaa5c2c22feb8dd4cf41e068ab234b0c0d1265

SHA256
99ba58297cb17c924f4dc8fa77fc6b387a2987fc76cc82e84367bfa470c30f13

SHA512
b7375d22c8f577ff23defad6afe807266bad32e2b3cfed8088a10c1c4763148baf4eee45f0d4b8d53d8e583623d8420a931df4d19cf83c821948231e78711137

Download Submit
C:\Windows\System\vsKoQNf.exe

Filesize
3.1MB

MD5
22ec93bcd70c5bdcabd363cd4a2ee673

SHA1
35314d5821bb437041f3ba7ab0b7ac303fe285fc

SHA256
d570265c8922294dd9056aad9fd517f7f8493393c5f4cf8593eb612f9b43b670

SHA512
e58babec5e5d394bb3f35fe8ba99d935ffc2d66efb8b7f13f632f036f5e781c9613195ed1c3f806a07ff7e2f7a0359b7f9bab0d38754fed640119a7fa77bc222

Download Submit
C:\Windows\System\xcXiZRI.exe

Filesize
3.1MB

MD5
74ddf65408cc949000c27c29cb9985db

SHA1
1b3d36dff27beb95f37e8d6d712d80d871a86939

SHA256
5f13a6f6fd165b2f656de65256b7519ce6f147f8e90f0b1684ab3ceffa321cce

SHA512
e5a0e2d631810d361f2065f81f8eee374cf9f88732936f624655bc76880a6ed1c240b999d1275f41c753742dcedf856f8bf809fb58077e328a8c5b7fd35c0eca

Download Submit
C:\Windows\System\ydlkxrY.exe

Filesize
3.1MB

MD5
5919153ac29cd122b757359a27f88d98

SHA1
9fceda03f9e7139226a2edc64cd38ac57174c485

SHA256
4f484ebea478055ca964c88044880b10c332ef61e41d14b7ee7e31a3f453dfe4

SHA512
2fc82135cd88cc5d378631370722e1cb36f8902f723f6b21c28e5790ab22332596c171a2cdddcdb727239841c6650a79c927c87accf321a7b20705b4f36fac95

Download Submit
memory/224-1973-0x00007FF6474D0000-0x00007FF6478C6000-memory.dmp

Filesize
4.0MB

Download
memory/224-42-0x00007FF6474D0000-0x00007FF6478C6000-memory.dmp

Filesize
4.0MB

Download
memory/388-65-0x00007FF626170000-0x00007FF626566000-memory.dmp

Filesize
4.0MB

Download
memory/388-1976-0x00007FF626170000-0x00007FF626566000-memory.dmp

Filesize
4.0MB

Download
memory/452-180-0x00007FF78B850000-0x00007FF78BC46000-memory.dmp

Filesize
4.0MB

Download
memory/452-1988-0x00007FF78B850000-0x00007FF78BC46000-memory.dmp

Filesize
4.0MB

Download
memory/624-189-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp

Filesize
4.0MB

Download
memory/624-1984-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp

Filesize
4.0MB

Download
memory/960-1979-0x00007FF721540000-0x00007FF721936000-memory.dmp

Filesize
4.0MB

Download
memory/960-153-0x00007FF721540000-0x00007FF721936000-memory.dmp

Filesize
4.0MB

Download
memory/1300-1992-0x00007FF6FCE80000-0x00007FF6FD276000-memory.dmp

Filesize
4.0MB

Download
memory/1300-194-0x00007FF6FCE80000-0x00007FF6FD276000-memory.dmp

Filesize
4.0MB

Download
memory/1580-195-0x00007FF684F20000-0x00007FF685316000-memory.dmp

Filesize
4.0MB

Download
memory/1580-1991-0x00007FF684F20000-0x00007FF685316000-memory.dmp

Filesize
4.0MB

Download
memory/2232-193-0x00007FF680630000-0x00007FF680A26000-memory.dmp

Filesize
4.0MB

Download
memory/2232-1994-0x00007FF680630000-0x00007FF680A26000-memory.dmp

Filesize
4.0MB

Download
memory/2328-1982-0x00007FF6F1F40000-0x00007FF6F2336000-memory.dmp

Filesize
4.0MB

Download
memory/2328-174-0x00007FF6F1F40000-0x00007FF6F2336000-memory.dmp

Filesize
4.0MB

Download
memory/2416-188-0x00007FF666920000-0x00007FF666D16000-memory.dmp

Filesize
4.0MB

Download
memory/2416-1985-0x00007FF666920000-0x00007FF666D16000-memory.dmp

Filesize
4.0MB

Download
memory/2720-1983-0x00007FF6C6400000-0x00007FF6C67F6000-memory.dmp

Filesize
4.0MB

Download
memory/2720-186-0x00007FF6C6400000-0x00007FF6C67F6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-199-0x00007FF6B4A60000-0x00007FF6B4E56000-memory.dmp

Filesize
4.0MB

Download
memory/2752-1989-0x00007FF6B4A60000-0x00007FF6B4E56000-memory.dmp

Filesize
4.0MB

Download
memory/2780-202-0x00007FF79E330000-0x00007FF79E726000-memory.dmp

Filesize
4.0MB

Download
memory/2780-1996-0x00007FF79E330000-0x00007FF79E726000-memory.dmp

Filesize
4.0MB

Download
memory/2872-190-0x00007FF7BC630000-0x00007FF7BCA26000-memory.dmp

Filesize
4.0MB

Download
memory/2872-1986-0x00007FF7BC630000-0x00007FF7BCA26000-memory.dmp

Filesize
4.0MB

Download
memory/2924-1990-0x00007FF74DA90000-0x00007FF74DE86000-memory.dmp

Filesize
4.0MB

Download
memory/2924-200-0x00007FF74DA90000-0x00007FF74DE86000-memory.dmp

Filesize
4.0MB

Download
memory/3196-1993-0x00007FF686720000-0x00007FF686B16000-memory.dmp

Filesize
4.0MB

Download
memory/3196-192-0x00007FF686720000-0x00007FF686B16000-memory.dmp

Filesize
4.0MB

Download
memory/3204-1-0x000001C72A7B0000-0x000001C72A7C0000-memory.dmp

Filesize
64KB

Download
memory/3204-0-0x00007FF6A96D0000-0x00007FF6A9AC6000-memory.dmp

Filesize
4.0MB

Download
memory/3232-1995-0x00007FF676D50000-0x00007FF677146000-memory.dmp

Filesize
4.0MB

Download
memory/3232-191-0x00007FF676D50000-0x00007FF677146000-memory.dmp

Filesize
4.0MB

Download
memory/3592-1974-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp

Filesize
4.0MB

Download
memory/3592-1972-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp

Filesize
4.0MB

Download
memory/3592-13-0x00007FF7C3430000-0x00007FF7C3826000-memory.dmp

Filesize
4.0MB

Download
memory/4036-1977-0x00007FF72CD40000-0x00007FF72D136000-memory.dmp

Filesize
4.0MB

Download
memory/4036-67-0x00007FF72CD40000-0x00007FF72D136000-memory.dmp

Filesize
4.0MB

Download
memory/4104-1975-0x00007FF6871C0000-0x00007FF6875B6000-memory.dmp

Filesize
4.0MB

Download
memory/4104-80-0x00007FF6871C0000-0x00007FF6875B6000-memory.dmp

Filesize
4.0MB

Download
memory/4264-1978-0x00007FF654FA0000-0x00007FF655396000-memory.dmp

Filesize
4.0MB

Download
memory/4264-103-0x00007FF654FA0000-0x00007FF655396000-memory.dmp

Filesize
4.0MB

Download
memory/4404-1980-0x00007FF6CEFE0000-0x00007FF6CF3D6000-memory.dmp

Filesize
4.0MB

Download
memory/4404-198-0x00007FF6CEFE0000-0x00007FF6CF3D6000-memory.dmp

Filesize
4.0MB

Download
memory/4408-173-0x00007FF6D7280000-0x00007FF6D7676000-memory.dmp

Filesize
4.0MB

Download
memory/4408-1981-0x00007FF6D7280000-0x00007FF6D7676000-memory.dmp

Filesize
4.0MB

Download
memory/4456-1987-0x00007FF6C2230000-0x00007FF6C2626000-memory.dmp

Filesize
4.0MB

Download
memory/4456-201-0x00007FF6C2230000-0x00007FF6C2626000-memory.dmp

Filesize
4.0MB

Download
memory/4908-79-0x000001A77DDC0000-0x000001A77DDD0000-memory.dmp

Filesize
64KB

Download
memory/4908-197-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-196-0x00007FFA19513000-0x00007FFA19515000-memory.dmp

Filesize
8KB

Download
memory/4908-1605-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-150-0x000001A77DCF0000-0x000001A77DD12000-memory.dmp

Filesize
136KB

Download