xmrig | 29fa3d619899c30d01b83d5c24955ada28e6420645672b1fcf31c94f886d706d

Analysis

max time kernel
61s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
Size

2.8MB
MD5

a7e86fb65bb3a5a014350918cfcca8a0
SHA1

e0b97a4883bf4535b26a1251042355efd8b4af07
SHA256

29fa3d619899c30d01b83d5c24955ada28e6420645672b1fcf31c94f886d706d
SHA512

a7acc5fe8df8431f3a167f0c77f2030131aaa57796f8ed3e15e5b4e96cd9b40937b324bce9a3f866cb054729df38a319679f1f9c1b86ab4ff88713930c236590
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1948-0-0x00007FF7A4B50000-0x00007FF7A4F46000-memory.dmp	xmrig
behavioral2/files/0x000900000002343b-6.dat	xmrig
behavioral2/files/0x0007000000023444-10.dat	xmrig
behavioral2/files/0x0007000000023446-38.dat	xmrig
behavioral2/files/0x0007000000023449-46.dat	xmrig
behavioral2/files/0x0008000000023447-56.dat	xmrig
behavioral2/files/0x000700000002344a-61.dat	xmrig
behavioral2/files/0x000700000002344d-82.dat	xmrig
behavioral2/files/0x0007000000023454-117.dat	xmrig
behavioral2/files/0x000700000002345a-141.dat	xmrig
behavioral2/files/0x000700000002345d-156.dat	xmrig
behavioral2/files/0x000700000002345f-171.dat	xmrig
behavioral2/memory/2708-672-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp	xmrig
behavioral2/memory/2400-673-0x00007FF6BD830000-0x00007FF6BDC26000-memory.dmp	xmrig
behavioral2/memory/716-674-0x00007FF6949F0000-0x00007FF694DE6000-memory.dmp	xmrig
behavioral2/memory/3020-675-0x00007FF740160000-0x00007FF740556000-memory.dmp	xmrig
behavioral2/memory/1588-676-0x00007FF657210000-0x00007FF657606000-memory.dmp	xmrig
behavioral2/memory/1720-677-0x00007FF60BC00000-0x00007FF60BFF6000-memory.dmp	xmrig
behavioral2/memory/4252-691-0x00007FF682F80000-0x00007FF683376000-memory.dmp	xmrig
behavioral2/memory/4056-707-0x00007FF7F4C50000-0x00007FF7F5046000-memory.dmp	xmrig
behavioral2/memory/5056-714-0x00007FF657B80000-0x00007FF657F76000-memory.dmp	xmrig
behavioral2/memory/1928-728-0x00007FF61C9E0000-0x00007FF61CDD6000-memory.dmp	xmrig
behavioral2/memory/560-734-0x00007FF7D42B0000-0x00007FF7D46A6000-memory.dmp	xmrig
behavioral2/memory/4016-747-0x00007FF690F70000-0x00007FF691366000-memory.dmp	xmrig
behavioral2/memory/2784-740-0x00007FF75CF80000-0x00007FF75D376000-memory.dmp	xmrig
behavioral2/memory/2964-722-0x00007FF76B730000-0x00007FF76BB26000-memory.dmp	xmrig
behavioral2/memory/1964-700-0x00007FF69FAD0000-0x00007FF69FEC6000-memory.dmp	xmrig
behavioral2/memory/4568-688-0x00007FF7187F0000-0x00007FF718BE6000-memory.dmp	xmrig
behavioral2/memory/1608-679-0x00007FF7D7C50000-0x00007FF7D8046000-memory.dmp	xmrig
behavioral2/memory/4848-678-0x00007FF643AC0000-0x00007FF643EB6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023461-181.dat	xmrig
behavioral2/files/0x0007000000023460-177.dat	xmrig
behavioral2/files/0x000700000002345e-167.dat	xmrig
behavioral2/files/0x000700000002345c-157.dat	xmrig
behavioral2/files/0x000700000002345b-152.dat	xmrig
behavioral2/files/0x0007000000023459-144.dat	xmrig
behavioral2/files/0x0007000000023458-139.dat	xmrig
behavioral2/files/0x0007000000023457-134.dat	xmrig
behavioral2/files/0x0007000000023456-127.dat	xmrig
behavioral2/files/0x0007000000023455-122.dat	xmrig
behavioral2/files/0x0007000000023453-112.dat	xmrig
behavioral2/files/0x0007000000023452-107.dat	xmrig
behavioral2/files/0x0007000000023451-102.dat	xmrig
behavioral2/files/0x0007000000023450-97.dat	xmrig
behavioral2/files/0x000700000002344f-92.dat	xmrig
behavioral2/files/0x000700000002344e-86.dat	xmrig
behavioral2/files/0x000700000002344b-74.dat	xmrig
behavioral2/files/0x000700000002344c-72.dat	xmrig
behavioral2/memory/2528-65-0x00007FF765A10000-0x00007FF765E06000-memory.dmp	xmrig
behavioral2/memory/1676-60-0x00007FF61E510000-0x00007FF61E906000-memory.dmp	xmrig
behavioral2/files/0x0008000000023448-54.dat	xmrig
behavioral2/memory/4656-53-0x00007FF61FD00000-0x00007FF6200F6000-memory.dmp	xmrig
behavioral2/memory/3524-44-0x00007FF704B20000-0x00007FF704F16000-memory.dmp	xmrig
behavioral2/memory/4876-40-0x00007FF697000000-0x00007FF6973F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-24.dat	xmrig
behavioral2/files/0x0007000000023443-16.dat	xmrig
behavioral2/memory/2728-12-0x00007FF7B8D60000-0x00007FF7B9156000-memory.dmp	xmrig
behavioral2/memory/2708-2088-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp	xmrig
behavioral2/memory/2528-2089-0x00007FF765A10000-0x00007FF765E06000-memory.dmp	xmrig
behavioral2/memory/2728-2090-0x00007FF7B8D60000-0x00007FF7B9156000-memory.dmp	xmrig
behavioral2/memory/3524-2091-0x00007FF704B20000-0x00007FF704F16000-memory.dmp	xmrig
behavioral2/memory/4656-2092-0x00007FF61FD00000-0x00007FF6200F6000-memory.dmp	xmrig
behavioral2/memory/4876-2093-0x00007FF697000000-0x00007FF6973F6000-memory.dmp	xmrig
behavioral2/memory/1676-2094-0x00007FF61E510000-0x00007FF61E906000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4384	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2728	OPiRNPO.exe
3524	oxXVBcx.exe
4656	FsAuigz.exe
4876	vatikix.exe
1676	bisabHA.exe
560	jbKvnVC.exe
2784	SAsCIOn.exe
2528	iRxDqqO.exe
2708	BntkTke.exe
4016	tqpqwpL.exe
2400	JqJBxxw.exe
716	GCXtGtE.exe
3020	sQPSsIs.exe
1588	znTTMht.exe
1720	oFKJihd.exe
4848	ikchufb.exe
1608	dCkEnmu.exe
4568	blzsGbY.exe
4252	TZGewJM.exe
1964	JckgvLv.exe
4056	vUKkkYH.exe
5056	QcpxZoP.exe
2964	RlPiGdh.exe
1928	vgQNVck.exe
4912	iHiszzM.exe
4536	jFjHLyu.exe
4704	YilMneF.exe
1004	EPjcqZI.exe
1616	mYwarCY.exe
4136	ISkdWrI.exe
1244	nhyWIMc.exe
3216	guSdDlp.exe
2164	DaxOMxm.exe
2256	OpvbcgW.exe
2468	mHmTuPD.exe
4580	WaJIMKT.exe
436	OqitSEw.exe
4772	AFVBMxD.exe
4500	AYmfiwI.exe
4740	YmVlzLR.exe
3720	qXckjLw.exe
1496	MurrEzL.exe
3328	snwDhPJ.exe
2836	CIOfkvH.exe
5116	wTNhXIX.exe
4844	LkJmyTY.exe
4008	YEeQAki.exe
924	jXGgihF.exe
3628	KCSBdBt.exe
2156	AOuPetO.exe
4092	AAphjsK.exe
4412	dyPETwy.exe
684	BRLpFFz.exe
3000	pLKfUAQ.exe
3276	zhYabla.exe
4660	EZYQIgP.exe
2680	RFyRNix.exe
3992	EyQfaaJ.exe
2456	sirtgjv.exe
1844	dnrrmgi.exe
1564	ZDeegWh.exe
756	gLZyTbY.exe
2416	iRFaAoV.exe
1748	YLTuYqL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1948-0-0x00007FF7A4B50000-0x00007FF7A4F46000-memory.dmp	upx
behavioral2/files/0x000900000002343b-6.dat	upx
behavioral2/files/0x0007000000023444-10.dat	upx
behavioral2/files/0x0007000000023446-38.dat	upx
behavioral2/files/0x0007000000023449-46.dat	upx
behavioral2/files/0x0008000000023447-56.dat	upx
behavioral2/files/0x000700000002344a-61.dat	upx
behavioral2/files/0x000700000002344d-82.dat	upx
behavioral2/files/0x0007000000023454-117.dat	upx
behavioral2/files/0x000700000002345a-141.dat	upx
behavioral2/files/0x000700000002345d-156.dat	upx
behavioral2/files/0x000700000002345f-171.dat	upx
behavioral2/memory/2708-672-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp	upx
behavioral2/memory/2400-673-0x00007FF6BD830000-0x00007FF6BDC26000-memory.dmp	upx
behavioral2/memory/716-674-0x00007FF6949F0000-0x00007FF694DE6000-memory.dmp	upx
behavioral2/memory/3020-675-0x00007FF740160000-0x00007FF740556000-memory.dmp	upx
behavioral2/memory/1588-676-0x00007FF657210000-0x00007FF657606000-memory.dmp	upx
behavioral2/memory/1720-677-0x00007FF60BC00000-0x00007FF60BFF6000-memory.dmp	upx
behavioral2/memory/4252-691-0x00007FF682F80000-0x00007FF683376000-memory.dmp	upx
behavioral2/memory/4056-707-0x00007FF7F4C50000-0x00007FF7F5046000-memory.dmp	upx
behavioral2/memory/5056-714-0x00007FF657B80000-0x00007FF657F76000-memory.dmp	upx
behavioral2/memory/1928-728-0x00007FF61C9E0000-0x00007FF61CDD6000-memory.dmp	upx
behavioral2/memory/560-734-0x00007FF7D42B0000-0x00007FF7D46A6000-memory.dmp	upx
behavioral2/memory/4016-747-0x00007FF690F70000-0x00007FF691366000-memory.dmp	upx
behavioral2/memory/2784-740-0x00007FF75CF80000-0x00007FF75D376000-memory.dmp	upx
behavioral2/memory/2964-722-0x00007FF76B730000-0x00007FF76BB26000-memory.dmp	upx
behavioral2/memory/1964-700-0x00007FF69FAD0000-0x00007FF69FEC6000-memory.dmp	upx
behavioral2/memory/4568-688-0x00007FF7187F0000-0x00007FF718BE6000-memory.dmp	upx
behavioral2/memory/1608-679-0x00007FF7D7C50000-0x00007FF7D8046000-memory.dmp	upx
behavioral2/memory/4848-678-0x00007FF643AC0000-0x00007FF643EB6000-memory.dmp	upx
behavioral2/files/0x0007000000023461-181.dat	upx
behavioral2/files/0x0007000000023460-177.dat	upx
behavioral2/files/0x000700000002345e-167.dat	upx
behavioral2/files/0x000700000002345c-157.dat	upx
behavioral2/files/0x000700000002345b-152.dat	upx
behavioral2/files/0x0007000000023459-144.dat	upx
behavioral2/files/0x0007000000023458-139.dat	upx
behavioral2/files/0x0007000000023457-134.dat	upx
behavioral2/files/0x0007000000023456-127.dat	upx
behavioral2/files/0x0007000000023455-122.dat	upx
behavioral2/files/0x0007000000023453-112.dat	upx
behavioral2/files/0x0007000000023452-107.dat	upx
behavioral2/files/0x0007000000023451-102.dat	upx
behavioral2/files/0x0007000000023450-97.dat	upx
behavioral2/files/0x000700000002344f-92.dat	upx
behavioral2/files/0x000700000002344e-86.dat	upx
behavioral2/files/0x000700000002344b-74.dat	upx
behavioral2/files/0x000700000002344c-72.dat	upx
behavioral2/memory/2528-65-0x00007FF765A10000-0x00007FF765E06000-memory.dmp	upx
behavioral2/memory/1676-60-0x00007FF61E510000-0x00007FF61E906000-memory.dmp	upx
behavioral2/files/0x0008000000023448-54.dat	upx
behavioral2/memory/4656-53-0x00007FF61FD00000-0x00007FF6200F6000-memory.dmp	upx
behavioral2/memory/3524-44-0x00007FF704B20000-0x00007FF704F16000-memory.dmp	upx
behavioral2/memory/4876-40-0x00007FF697000000-0x00007FF6973F6000-memory.dmp	upx
behavioral2/files/0x0007000000023445-24.dat	upx
behavioral2/files/0x0007000000023443-16.dat	upx
behavioral2/memory/2728-12-0x00007FF7B8D60000-0x00007FF7B9156000-memory.dmp	upx
behavioral2/memory/2708-2088-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp	upx
behavioral2/memory/2528-2089-0x00007FF765A10000-0x00007FF765E06000-memory.dmp	upx
behavioral2/memory/2728-2090-0x00007FF7B8D60000-0x00007FF7B9156000-memory.dmp	upx
behavioral2/memory/3524-2091-0x00007FF704B20000-0x00007FF704F16000-memory.dmp	upx
behavioral2/memory/4656-2092-0x00007FF61FD00000-0x00007FF6200F6000-memory.dmp	upx
behavioral2/memory/4876-2093-0x00007FF697000000-0x00007FF6973F6000-memory.dmp	upx
behavioral2/memory/1676-2094-0x00007FF61E510000-0x00007FF61E906000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mAEsvLI.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\OsFfUPJ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\oWAABPU.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\LxLAaXX.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMrEttf.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\atgGgeI.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\RNiEhAG.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\kLZKBlD.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\tcRxQbo.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\uYjmZUi.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZObpVzU.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\iJJClbN.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\YefJTMT.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\aZNFfAc.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\UepiZVI.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\bOnPdHQ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\PeQDLKe.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\JHdoiYA.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\wUfkZsX.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\sNMLfrm.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\vgtcQbp.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\tUOpVkA.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\DCCWGrK.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\aHtZWSY.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\dCYXpOP.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\BmQoAav.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\sQBojjx.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\VeFOPno.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\OUXYHYT.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ObLdofR.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\QmDHDaY.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\KtksQRx.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\DDeyQnp.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\aVbngTX.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\vZwxmgF.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\zHlsIlU.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\OpvbcgW.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\sNFiNpc.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\hLgKStI.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\HwelapJ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\EPJVeZF.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\WDcxHgw.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\FvvdjSq.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\jTGXIoZ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\LOkOisp.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\gtbTbQp.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\VGfQqLx.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\qFgMUgO.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\PLKLknK.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\oKncBlA.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\SRWoDyz.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\RLRqUmK.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\xthlGix.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\UBOwfDB.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\vbbedBP.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\vXnDJyx.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\objMHJw.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\cqcGmlK.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\jJyzDUc.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\upYUHvq.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\SZrbZLG.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\uprEsLX.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\hyhmJNT.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\xnhnGsC.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4384	powershell.exe
4384	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4384	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4384	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	82
PID 1948 wrote to memory of 4384	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	82
PID 1948 wrote to memory of 2728	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	83
PID 1948 wrote to memory of 2728	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	83
PID 1948 wrote to memory of 3524	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	84
PID 1948 wrote to memory of 3524	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	84
PID 1948 wrote to memory of 4656	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 4656	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 4876	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	86
PID 1948 wrote to memory of 4876	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	86
PID 1948 wrote to memory of 1676	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	87
PID 1948 wrote to memory of 1676	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	87
PID 1948 wrote to memory of 560	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	88
PID 1948 wrote to memory of 560	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	88
PID 1948 wrote to memory of 2784	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	89
PID 1948 wrote to memory of 2784	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	89
PID 1948 wrote to memory of 2528	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	90
PID 1948 wrote to memory of 2528	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	90
PID 1948 wrote to memory of 2708	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	91
PID 1948 wrote to memory of 2708	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	91
PID 1948 wrote to memory of 2400	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	92
PID 1948 wrote to memory of 2400	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	92
PID 1948 wrote to memory of 4016	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	93
PID 1948 wrote to memory of 4016	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	93
PID 1948 wrote to memory of 716	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	94
PID 1948 wrote to memory of 716	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	94
PID 1948 wrote to memory of 3020	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	95
PID 1948 wrote to memory of 3020	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	95
PID 1948 wrote to memory of 1588	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	96
PID 1948 wrote to memory of 1588	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	96
PID 1948 wrote to memory of 1720	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	97
PID 1948 wrote to memory of 1720	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	97
PID 1948 wrote to memory of 4848	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	98
PID 1948 wrote to memory of 4848	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	98
PID 1948 wrote to memory of 1608	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	99
PID 1948 wrote to memory of 1608	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	99
PID 1948 wrote to memory of 4568	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	100
PID 1948 wrote to memory of 4568	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	100
PID 1948 wrote to memory of 4252	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	101
PID 1948 wrote to memory of 4252	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	101
PID 1948 wrote to memory of 1964	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	102
PID 1948 wrote to memory of 1964	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	102
PID 1948 wrote to memory of 4056	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	103
PID 1948 wrote to memory of 4056	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	103
PID 1948 wrote to memory of 5056	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	104
PID 1948 wrote to memory of 5056	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	104
PID 1948 wrote to memory of 2964	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	105
PID 1948 wrote to memory of 2964	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	105
PID 1948 wrote to memory of 1928	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	106
PID 1948 wrote to memory of 1928	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	106
PID 1948 wrote to memory of 4912	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	107
PID 1948 wrote to memory of 4912	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	107
PID 1948 wrote to memory of 4536	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	108
PID 1948 wrote to memory of 4536	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	108
PID 1948 wrote to memory of 4704	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	109
PID 1948 wrote to memory of 4704	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	109
PID 1948 wrote to memory of 1004	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	110
PID 1948 wrote to memory of 1004	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	110
PID 1948 wrote to memory of 1616	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	111
PID 1948 wrote to memory of 1616	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	111
PID 1948 wrote to memory of 4136	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	112
PID 1948 wrote to memory of 4136	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	112
PID 1948 wrote to memory of 1244	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	113
PID 1948 wrote to memory of 1244	1948	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4384" "2520" "2444" "2524" "0" "0" "2528" "0" "0" "0" "0" "0"
    3⤵
    PID:13284
- C:\Windows\System\OPiRNPO.exe
  C:\Windows\System\OPiRNPO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\oxXVBcx.exe
  C:\Windows\System\oxXVBcx.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\FsAuigz.exe
  C:\Windows\System\FsAuigz.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\vatikix.exe
  C:\Windows\System\vatikix.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\bisabHA.exe
  C:\Windows\System\bisabHA.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\jbKvnVC.exe
  C:\Windows\System\jbKvnVC.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\SAsCIOn.exe
  C:\Windows\System\SAsCIOn.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\iRxDqqO.exe
  C:\Windows\System\iRxDqqO.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\BntkTke.exe
  C:\Windows\System\BntkTke.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JqJBxxw.exe
  C:\Windows\System\JqJBxxw.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\tqpqwpL.exe
  C:\Windows\System\tqpqwpL.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\GCXtGtE.exe
  C:\Windows\System\GCXtGtE.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\sQPSsIs.exe
  C:\Windows\System\sQPSsIs.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\znTTMht.exe
  C:\Windows\System\znTTMht.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\oFKJihd.exe
  C:\Windows\System\oFKJihd.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ikchufb.exe
  C:\Windows\System\ikchufb.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\dCkEnmu.exe
  C:\Windows\System\dCkEnmu.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\blzsGbY.exe
  C:\Windows\System\blzsGbY.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\TZGewJM.exe
  C:\Windows\System\TZGewJM.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\JckgvLv.exe
  C:\Windows\System\JckgvLv.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\vUKkkYH.exe
  C:\Windows\System\vUKkkYH.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\QcpxZoP.exe
  C:\Windows\System\QcpxZoP.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\RlPiGdh.exe
  C:\Windows\System\RlPiGdh.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\vgQNVck.exe
  C:\Windows\System\vgQNVck.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\iHiszzM.exe
  C:\Windows\System\iHiszzM.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\jFjHLyu.exe
  C:\Windows\System\jFjHLyu.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\YilMneF.exe
  C:\Windows\System\YilMneF.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\EPjcqZI.exe
  C:\Windows\System\EPjcqZI.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\mYwarCY.exe
  C:\Windows\System\mYwarCY.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ISkdWrI.exe
  C:\Windows\System\ISkdWrI.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\nhyWIMc.exe
  C:\Windows\System\nhyWIMc.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\guSdDlp.exe
  C:\Windows\System\guSdDlp.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\DaxOMxm.exe
  C:\Windows\System\DaxOMxm.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\OpvbcgW.exe
  C:\Windows\System\OpvbcgW.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\mHmTuPD.exe
  C:\Windows\System\mHmTuPD.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\WaJIMKT.exe
  C:\Windows\System\WaJIMKT.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\OqitSEw.exe
  C:\Windows\System\OqitSEw.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\AFVBMxD.exe
  C:\Windows\System\AFVBMxD.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\AYmfiwI.exe
  C:\Windows\System\AYmfiwI.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\YmVlzLR.exe
  C:\Windows\System\YmVlzLR.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\qXckjLw.exe
  C:\Windows\System\qXckjLw.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\MurrEzL.exe
  C:\Windows\System\MurrEzL.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\snwDhPJ.exe
  C:\Windows\System\snwDhPJ.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\CIOfkvH.exe
  C:\Windows\System\CIOfkvH.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\wTNhXIX.exe
  C:\Windows\System\wTNhXIX.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\LkJmyTY.exe
  C:\Windows\System\LkJmyTY.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\YEeQAki.exe
  C:\Windows\System\YEeQAki.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\jXGgihF.exe
  C:\Windows\System\jXGgihF.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\KCSBdBt.exe
  C:\Windows\System\KCSBdBt.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\AOuPetO.exe
  C:\Windows\System\AOuPetO.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\AAphjsK.exe
  C:\Windows\System\AAphjsK.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\dyPETwy.exe
  C:\Windows\System\dyPETwy.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\BRLpFFz.exe
  C:\Windows\System\BRLpFFz.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\pLKfUAQ.exe
  C:\Windows\System\pLKfUAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\zhYabla.exe
  C:\Windows\System\zhYabla.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\EZYQIgP.exe
  C:\Windows\System\EZYQIgP.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\RFyRNix.exe
  C:\Windows\System\RFyRNix.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\EyQfaaJ.exe
  C:\Windows\System\EyQfaaJ.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\sirtgjv.exe
  C:\Windows\System\sirtgjv.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\dnrrmgi.exe
  C:\Windows\System\dnrrmgi.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ZDeegWh.exe
  C:\Windows\System\ZDeegWh.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\gLZyTbY.exe
  C:\Windows\System\gLZyTbY.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\iRFaAoV.exe
  C:\Windows\System\iRFaAoV.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\YLTuYqL.exe
  C:\Windows\System\YLTuYqL.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\RNiEhAG.exe
  C:\Windows\System\RNiEhAG.exe
  2⤵
  PID:1556
- C:\Windows\System\HubMrVV.exe
  C:\Windows\System\HubMrVV.exe
  2⤵
  PID:892
- C:\Windows\System\uydOGYi.exe
  C:\Windows\System\uydOGYi.exe
  2⤵
  PID:2516
- C:\Windows\System\dePcjfa.exe
  C:\Windows\System\dePcjfa.exe
  2⤵
  PID:2380
- C:\Windows\System\jiAuiux.exe
  C:\Windows\System\jiAuiux.exe
  2⤵
  PID:996
- C:\Windows\System\qMNYPlQ.exe
  C:\Windows\System\qMNYPlQ.exe
  2⤵
  PID:3256
- C:\Windows\System\RrdJyBk.exe
  C:\Windows\System\RrdJyBk.exe
  2⤵
  PID:3032
- C:\Windows\System\vaEfDoM.exe
  C:\Windows\System\vaEfDoM.exe
  2⤵
  PID:1048
- C:\Windows\System\MkWrevD.exe
  C:\Windows\System\MkWrevD.exe
  2⤵
  PID:1736
- C:\Windows\System\HpHohfH.exe
  C:\Windows\System\HpHohfH.exe
  2⤵
  PID:2252
- C:\Windows\System\QzDlxqp.exe
  C:\Windows\System\QzDlxqp.exe
  2⤵
  PID:1660
- C:\Windows\System\MWqGfdi.exe
  C:\Windows\System\MWqGfdi.exe
  2⤵
  PID:3872
- C:\Windows\System\GPMGELW.exe
  C:\Windows\System\GPMGELW.exe
  2⤵
  PID:3356
- C:\Windows\System\JeyrTOd.exe
  C:\Windows\System\JeyrTOd.exe
  2⤵
  PID:3324
- C:\Windows\System\FpGvePq.exe
  C:\Windows\System\FpGvePq.exe
  2⤵
  PID:3824
- C:\Windows\System\Ulnqfty.exe
  C:\Windows\System\Ulnqfty.exe
  2⤵
  PID:4632
- C:\Windows\System\EdDmueX.exe
  C:\Windows\System\EdDmueX.exe
  2⤵
  PID:4564
- C:\Windows\System\BBYGhDo.exe
  C:\Windows\System\BBYGhDo.exe
  2⤵
  PID:4752
- C:\Windows\System\FSKAkNt.exe
  C:\Windows\System\FSKAkNt.exe
  2⤵
  PID:4820
- C:\Windows\System\auXEPIL.exe
  C:\Windows\System\auXEPIL.exe
  2⤵
  PID:3684
- C:\Windows\System\uxyZDoP.exe
  C:\Windows\System\uxyZDoP.exe
  2⤵
  PID:5148
- C:\Windows\System\MeedACn.exe
  C:\Windows\System\MeedACn.exe
  2⤵
  PID:5176
- C:\Windows\System\WOUBdXs.exe
  C:\Windows\System\WOUBdXs.exe
  2⤵
  PID:5204
- C:\Windows\System\Mbppsdt.exe
  C:\Windows\System\Mbppsdt.exe
  2⤵
  PID:5232
- C:\Windows\System\bfIPfJM.exe
  C:\Windows\System\bfIPfJM.exe
  2⤵
  PID:5260
- C:\Windows\System\dQknaPG.exe
  C:\Windows\System\dQknaPG.exe
  2⤵
  PID:5284
- C:\Windows\System\rlSejnw.exe
  C:\Windows\System\rlSejnw.exe
  2⤵
  PID:5316
- C:\Windows\System\TpiIUwV.exe
  C:\Windows\System\TpiIUwV.exe
  2⤵
  PID:5344
- C:\Windows\System\sUqukkb.exe
  C:\Windows\System\sUqukkb.exe
  2⤵
  PID:5372
- C:\Windows\System\kPPhtgn.exe
  C:\Windows\System\kPPhtgn.exe
  2⤵
  PID:5400
- C:\Windows\System\IuiDTtj.exe
  C:\Windows\System\IuiDTtj.exe
  2⤵
  PID:5428
- C:\Windows\System\FhtgJIn.exe
  C:\Windows\System\FhtgJIn.exe
  2⤵
  PID:5456
- C:\Windows\System\KdBwtpe.exe
  C:\Windows\System\KdBwtpe.exe
  2⤵
  PID:5484
- C:\Windows\System\tlfgHUf.exe
  C:\Windows\System\tlfgHUf.exe
  2⤵
  PID:5512
- C:\Windows\System\vykgbej.exe
  C:\Windows\System\vykgbej.exe
  2⤵
  PID:5540
- C:\Windows\System\sKPbgNB.exe
  C:\Windows\System\sKPbgNB.exe
  2⤵
  PID:5564
- C:\Windows\System\OCRIhsw.exe
  C:\Windows\System\OCRIhsw.exe
  2⤵
  PID:5592
- C:\Windows\System\nfwyJfm.exe
  C:\Windows\System\nfwyJfm.exe
  2⤵
  PID:5624
- C:\Windows\System\UGOEATQ.exe
  C:\Windows\System\UGOEATQ.exe
  2⤵
  PID:5652
- C:\Windows\System\zEpuCpc.exe
  C:\Windows\System\zEpuCpc.exe
  2⤵
  PID:5680
- C:\Windows\System\GXPdZuQ.exe
  C:\Windows\System\GXPdZuQ.exe
  2⤵
  PID:5704
- C:\Windows\System\lesuchm.exe
  C:\Windows\System\lesuchm.exe
  2⤵
  PID:5736
- C:\Windows\System\lnikWqT.exe
  C:\Windows\System\lnikWqT.exe
  2⤵
  PID:5764
- C:\Windows\System\FHLFQTh.exe
  C:\Windows\System\FHLFQTh.exe
  2⤵
  PID:5792
- C:\Windows\System\nETiNTw.exe
  C:\Windows\System\nETiNTw.exe
  2⤵
  PID:5820
- C:\Windows\System\vmOoPor.exe
  C:\Windows\System\vmOoPor.exe
  2⤵
  PID:5844
- C:\Windows\System\ElGBltR.exe
  C:\Windows\System\ElGBltR.exe
  2⤵
  PID:5876
- C:\Windows\System\IxEIKsn.exe
  C:\Windows\System\IxEIKsn.exe
  2⤵
  PID:5904
- C:\Windows\System\hGFuVDT.exe
  C:\Windows\System\hGFuVDT.exe
  2⤵
  PID:5928
- C:\Windows\System\jbUSbMT.exe
  C:\Windows\System\jbUSbMT.exe
  2⤵
  PID:5956
- C:\Windows\System\ezWLkbJ.exe
  C:\Windows\System\ezWLkbJ.exe
  2⤵
  PID:5988
- C:\Windows\System\aKvfofP.exe
  C:\Windows\System\aKvfofP.exe
  2⤵
  PID:6016
- C:\Windows\System\KbjBYun.exe
  C:\Windows\System\KbjBYun.exe
  2⤵
  PID:6044
- C:\Windows\System\xPjfNAJ.exe
  C:\Windows\System\xPjfNAJ.exe
  2⤵
  PID:6068
- C:\Windows\System\ZBnbRnM.exe
  C:\Windows\System\ZBnbRnM.exe
  2⤵
  PID:6100
- C:\Windows\System\WOKBtcu.exe
  C:\Windows\System\WOKBtcu.exe
  2⤵
  PID:6128
- C:\Windows\System\jUquzZo.exe
  C:\Windows\System\jUquzZo.exe
  2⤵
  PID:208
- C:\Windows\System\BtTWZAJ.exe
  C:\Windows\System\BtTWZAJ.exe
  2⤵
  PID:3572
- C:\Windows\System\GHzXUFC.exe
  C:\Windows\System\GHzXUFC.exe
  2⤵
  PID:3220
- C:\Windows\System\WRcJmXW.exe
  C:\Windows\System\WRcJmXW.exe
  2⤵
  PID:2916
- C:\Windows\System\HyNavTW.exe
  C:\Windows\System\HyNavTW.exe
  2⤵
  PID:5140
- C:\Windows\System\uLaAwQx.exe
  C:\Windows\System\uLaAwQx.exe
  2⤵
  PID:5216
- C:\Windows\System\TsBScPl.exe
  C:\Windows\System\TsBScPl.exe
  2⤵
  PID:5276
- C:\Windows\System\kOmwZrp.exe
  C:\Windows\System\kOmwZrp.exe
  2⤵
  PID:5332
- C:\Windows\System\DNKmvvn.exe
  C:\Windows\System\DNKmvvn.exe
  2⤵
  PID:5392
- C:\Windows\System\mkYhnVo.exe
  C:\Windows\System\mkYhnVo.exe
  2⤵
  PID:5468
- C:\Windows\System\jQAEZKc.exe
  C:\Windows\System\jQAEZKc.exe
  2⤵
  PID:5524
- C:\Windows\System\bjlHfkN.exe
  C:\Windows\System\bjlHfkN.exe
  2⤵
  PID:5584
- C:\Windows\System\Rzenrvu.exe
  C:\Windows\System\Rzenrvu.exe
  2⤵
  PID:5640
- C:\Windows\System\gCQNNul.exe
  C:\Windows\System\gCQNNul.exe
  2⤵
  PID:5700
- C:\Windows\System\CYDsKIz.exe
  C:\Windows\System\CYDsKIz.exe
  2⤵
  PID:5776
- C:\Windows\System\KuZqDhN.exe
  C:\Windows\System\KuZqDhN.exe
  2⤵
  PID:5836
- C:\Windows\System\KUDyjsH.exe
  C:\Windows\System\KUDyjsH.exe
  2⤵
  PID:5896
- C:\Windows\System\mtTSNbC.exe
  C:\Windows\System\mtTSNbC.exe
  2⤵
  PID:5972
- C:\Windows\System\UAoUauj.exe
  C:\Windows\System\UAoUauj.exe
  2⤵
  PID:6032
- C:\Windows\System\ZxBiuiv.exe
  C:\Windows\System\ZxBiuiv.exe
  2⤵
  PID:6084
- C:\Windows\System\mibUfpa.exe
  C:\Windows\System\mibUfpa.exe
  2⤵
  PID:3504
- C:\Windows\System\yodHjMr.exe
  C:\Windows\System\yodHjMr.exe
  2⤵
  PID:3616
- C:\Windows\System\NAKUbCF.exe
  C:\Windows\System\NAKUbCF.exe
  2⤵
  PID:5188
- C:\Windows\System\YnkRPtw.exe
  C:\Windows\System\YnkRPtw.exe
  2⤵
  PID:5328
- C:\Windows\System\zHGHLDi.exe
  C:\Windows\System\zHGHLDi.exe
  2⤵
  PID:5444
- C:\Windows\System\NBTzMxX.exe
  C:\Windows\System\NBTzMxX.exe
  2⤵
  PID:5612
- C:\Windows\System\folLioW.exe
  C:\Windows\System\folLioW.exe
  2⤵
  PID:5748
- C:\Windows\System\msWrlNa.exe
  C:\Windows\System\msWrlNa.exe
  2⤵
  PID:5868
- C:\Windows\System\ejZRqrv.exe
  C:\Windows\System\ejZRqrv.exe
  2⤵
  PID:6008
- C:\Windows\System\raQUxtR.exe
  C:\Windows\System\raQUxtR.exe
  2⤵
  PID:1812
- C:\Windows\System\BqlAtxp.exe
  C:\Windows\System\BqlAtxp.exe
  2⤵
  PID:5136
- C:\Windows\System\iKbjqAa.exe
  C:\Windows\System\iKbjqAa.exe
  2⤵
  PID:5440
- C:\Windows\System\LtZOkxD.exe
  C:\Windows\System\LtZOkxD.exe
  2⤵
  PID:6148
- C:\Windows\System\dfyBcvy.exe
  C:\Windows\System\dfyBcvy.exe
  2⤵
  PID:6172
- C:\Windows\System\kepKjOr.exe
  C:\Windows\System\kepKjOr.exe
  2⤵
  PID:6204
- C:\Windows\System\qrZdMkd.exe
  C:\Windows\System\qrZdMkd.exe
  2⤵
  PID:6232
- C:\Windows\System\LKbbhxi.exe
  C:\Windows\System\LKbbhxi.exe
  2⤵
  PID:6260
- C:\Windows\System\jDuFVxg.exe
  C:\Windows\System\jDuFVxg.exe
  2⤵
  PID:6288
- C:\Windows\System\dHdPjiY.exe
  C:\Windows\System\dHdPjiY.exe
  2⤵
  PID:6316
- C:\Windows\System\zYnJqWk.exe
  C:\Windows\System\zYnJqWk.exe
  2⤵
  PID:6344
- C:\Windows\System\bCliLeA.exe
  C:\Windows\System\bCliLeA.exe
  2⤵
  PID:6372
- C:\Windows\System\CRWVtrh.exe
  C:\Windows\System\CRWVtrh.exe
  2⤵
  PID:6400
- C:\Windows\System\WKYXUfg.exe
  C:\Windows\System\WKYXUfg.exe
  2⤵
  PID:6428
- C:\Windows\System\BhltwhW.exe
  C:\Windows\System\BhltwhW.exe
  2⤵
  PID:6456
- C:\Windows\System\ysafqPJ.exe
  C:\Windows\System\ysafqPJ.exe
  2⤵
  PID:6480
- C:\Windows\System\dLDCfWo.exe
  C:\Windows\System\dLDCfWo.exe
  2⤵
  PID:6508
- C:\Windows\System\DehFiip.exe
  C:\Windows\System\DehFiip.exe
  2⤵
  PID:6540
- C:\Windows\System\WsDKnZP.exe
  C:\Windows\System\WsDKnZP.exe
  2⤵
  PID:6568
- C:\Windows\System\SiHVEnT.exe
  C:\Windows\System\SiHVEnT.exe
  2⤵
  PID:6596
- C:\Windows\System\CCbiLPi.exe
  C:\Windows\System\CCbiLPi.exe
  2⤵
  PID:6624
- C:\Windows\System\MBWKnuV.exe
  C:\Windows\System\MBWKnuV.exe
  2⤵
  PID:6652
- C:\Windows\System\EeIjKod.exe
  C:\Windows\System\EeIjKod.exe
  2⤵
  PID:6680
- C:\Windows\System\INDRlIO.exe
  C:\Windows\System\INDRlIO.exe
  2⤵
  PID:6708
- C:\Windows\System\OjTtBuF.exe
  C:\Windows\System\OjTtBuF.exe
  2⤵
  PID:6736
- C:\Windows\System\whXSqeF.exe
  C:\Windows\System\whXSqeF.exe
  2⤵
  PID:6764
- C:\Windows\System\fEMVupu.exe
  C:\Windows\System\fEMVupu.exe
  2⤵
  PID:6792
- C:\Windows\System\TmELOOr.exe
  C:\Windows\System\TmELOOr.exe
  2⤵
  PID:6820
- C:\Windows\System\LiUgLOl.exe
  C:\Windows\System\LiUgLOl.exe
  2⤵
  PID:6848
- C:\Windows\System\tYWbUJk.exe
  C:\Windows\System\tYWbUJk.exe
  2⤵
  PID:6876
- C:\Windows\System\dQSzqfL.exe
  C:\Windows\System\dQSzqfL.exe
  2⤵
  PID:6904
- C:\Windows\System\hJAXGPD.exe
  C:\Windows\System\hJAXGPD.exe
  2⤵
  PID:6932
- C:\Windows\System\zYluiKU.exe
  C:\Windows\System\zYluiKU.exe
  2⤵
  PID:6960
- C:\Windows\System\GwOwbCg.exe
  C:\Windows\System\GwOwbCg.exe
  2⤵
  PID:6988
- C:\Windows\System\sXFkImJ.exe
  C:\Windows\System\sXFkImJ.exe
  2⤵
  PID:7016
- C:\Windows\System\lmdKXxp.exe
  C:\Windows\System\lmdKXxp.exe
  2⤵
  PID:7040
- C:\Windows\System\bAVGOtq.exe
  C:\Windows\System\bAVGOtq.exe
  2⤵
  PID:7072
- C:\Windows\System\FTtqkxN.exe
  C:\Windows\System\FTtqkxN.exe
  2⤵
  PID:7100
- C:\Windows\System\KqpXooB.exe
  C:\Windows\System\KqpXooB.exe
  2⤵
  PID:7128
- C:\Windows\System\TlbsZWn.exe
  C:\Windows\System\TlbsZWn.exe
  2⤵
  PID:7156
- C:\Windows\System\XPXyHRx.exe
  C:\Windows\System\XPXyHRx.exe
  2⤵
  PID:5948
- C:\Windows\System\raQqFmf.exe
  C:\Windows\System\raQqFmf.exe
  2⤵
  PID:3696
- C:\Windows\System\UOXQeeq.exe
  C:\Windows\System\UOXQeeq.exe
  2⤵
  PID:5672
- C:\Windows\System\UwaMxOy.exe
  C:\Windows\System\UwaMxOy.exe
  2⤵
  PID:6216
- C:\Windows\System\jzQIrEc.exe
  C:\Windows\System\jzQIrEc.exe
  2⤵
  PID:6276
- C:\Windows\System\eqFTDOH.exe
  C:\Windows\System\eqFTDOH.exe
  2⤵
  PID:6336
- C:\Windows\System\vgkhwKC.exe
  C:\Windows\System\vgkhwKC.exe
  2⤵
  PID:6412
- C:\Windows\System\EgmRgnr.exe
  C:\Windows\System\EgmRgnr.exe
  2⤵
  PID:6468
- C:\Windows\System\tMDtcgk.exe
  C:\Windows\System\tMDtcgk.exe
  2⤵
  PID:6644
- C:\Windows\System\rcQTPoc.exe
  C:\Windows\System\rcQTPoc.exe
  2⤵
  PID:6728
- C:\Windows\System\GcQKPUW.exe
  C:\Windows\System\GcQKPUW.exe
  2⤵
  PID:6784
- C:\Windows\System\PyFgpAF.exe
  C:\Windows\System\PyFgpAF.exe
  2⤵
  PID:6832
- C:\Windows\System\CFJxrJO.exe
  C:\Windows\System\CFJxrJO.exe
  2⤵
  PID:6864
- C:\Windows\System\iOfSTUF.exe
  C:\Windows\System\iOfSTUF.exe
  2⤵
  PID:6924
- C:\Windows\System\VSEGeXf.exe
  C:\Windows\System\VSEGeXf.exe
  2⤵
  PID:632
- C:\Windows\System\zqsjNZl.exe
  C:\Windows\System\zqsjNZl.exe
  2⤵
  PID:7028
- C:\Windows\System\zUwzQig.exe
  C:\Windows\System\zUwzQig.exe
  2⤵
  PID:7056
- C:\Windows\System\odXIWqD.exe
  C:\Windows\System\odXIWqD.exe
  2⤵
  PID:7092
- C:\Windows\System\RaLRDYX.exe
  C:\Windows\System\RaLRDYX.exe
  2⤵
  PID:5804
- C:\Windows\System\VzVwNcX.exe
  C:\Windows\System\VzVwNcX.exe
  2⤵
  PID:1872
- C:\Windows\System\JCcRJLD.exe
  C:\Windows\System\JCcRJLD.exe
  2⤵
  PID:6388
- C:\Windows\System\rHJYcBj.exe
  C:\Windows\System\rHJYcBj.exe
  2⤵
  PID:6384
- C:\Windows\System\iYCurAz.exe
  C:\Windows\System\iYCurAz.exe
  2⤵
  PID:6444
- C:\Windows\System\PSxVsRf.exe
  C:\Windows\System\PSxVsRf.exe
  2⤵
  PID:1796
- C:\Windows\System\JNvQnRq.exe
  C:\Windows\System\JNvQnRq.exe
  2⤵
  PID:3708
- C:\Windows\System\EEbSidZ.exe
  C:\Windows\System\EEbSidZ.exe
  2⤵
  PID:6724
- C:\Windows\System\lporjuI.exe
  C:\Windows\System\lporjuI.exe
  2⤵
  PID:3272
- C:\Windows\System\OmyszVb.exe
  C:\Windows\System\OmyszVb.exe
  2⤵
  PID:5020
- C:\Windows\System\OmjlRxn.exe
  C:\Windows\System\OmjlRxn.exe
  2⤵
  PID:4560
- C:\Windows\System\yfvEOUu.exe
  C:\Windows\System\yfvEOUu.exe
  2⤵
  PID:6892
- C:\Windows\System\knJsodu.exe
  C:\Windows\System\knJsodu.exe
  2⤵
  PID:7144
- C:\Windows\System\TcJKVwR.exe
  C:\Windows\System\TcJKVwR.exe
  2⤵
  PID:6440
- C:\Windows\System\tuZguim.exe
  C:\Windows\System\tuZguim.exe
  2⤵
  PID:2816
- C:\Windows\System\JCZClwW.exe
  C:\Windows\System\JCZClwW.exe
  2⤵
  PID:2760
- C:\Windows\System\OIaLWXG.exe
  C:\Windows\System\OIaLWXG.exe
  2⤵
  PID:944
- C:\Windows\System\UaVIinZ.exe
  C:\Windows\System\UaVIinZ.exe
  2⤵
  PID:1828
- C:\Windows\System\fOyJGFD.exe
  C:\Windows\System\fOyJGFD.exe
  2⤵
  PID:6252
- C:\Windows\System\FfGXfDV.exe
  C:\Windows\System\FfGXfDV.exe
  2⤵
  PID:4596
- C:\Windows\System\RbQbSFE.exe
  C:\Windows\System\RbQbSFE.exe
  2⤵
  PID:6168
- C:\Windows\System\YxhhyYO.exe
  C:\Windows\System\YxhhyYO.exe
  2⤵
  PID:7172
- C:\Windows\System\eqWeWyQ.exe
  C:\Windows\System\eqWeWyQ.exe
  2⤵
  PID:7208
- C:\Windows\System\yBUJBKB.exe
  C:\Windows\System\yBUJBKB.exe
  2⤵
  PID:7232
- C:\Windows\System\zbXicbr.exe
  C:\Windows\System\zbXicbr.exe
  2⤵
  PID:7276
- C:\Windows\System\tUOpVkA.exe
  C:\Windows\System\tUOpVkA.exe
  2⤵
  PID:7328
- C:\Windows\System\lfUcNTV.exe
  C:\Windows\System\lfUcNTV.exe
  2⤵
  PID:7364
- C:\Windows\System\RjIjiWA.exe
  C:\Windows\System\RjIjiWA.exe
  2⤵
  PID:7400
- C:\Windows\System\ZSKZAaH.exe
  C:\Windows\System\ZSKZAaH.exe
  2⤵
  PID:7428
- C:\Windows\System\hYZpBwP.exe
  C:\Windows\System\hYZpBwP.exe
  2⤵
  PID:7460
- C:\Windows\System\EGhjVhw.exe
  C:\Windows\System\EGhjVhw.exe
  2⤵
  PID:7484
- C:\Windows\System\mQHjdYP.exe
  C:\Windows\System\mQHjdYP.exe
  2⤵
  PID:7524
- C:\Windows\System\ufXAZKF.exe
  C:\Windows\System\ufXAZKF.exe
  2⤵
  PID:7548
- C:\Windows\System\RPfUktB.exe
  C:\Windows\System\RPfUktB.exe
  2⤵
  PID:7592
- C:\Windows\System\bhfKSDL.exe
  C:\Windows\System\bhfKSDL.exe
  2⤵
  PID:7616
- C:\Windows\System\WRPJPBn.exe
  C:\Windows\System\WRPJPBn.exe
  2⤵
  PID:7644
- C:\Windows\System\AaihhcR.exe
  C:\Windows\System\AaihhcR.exe
  2⤵
  PID:7672
- C:\Windows\System\NsoHjxX.exe
  C:\Windows\System\NsoHjxX.exe
  2⤵
  PID:7724
- C:\Windows\System\NhABEIG.exe
  C:\Windows\System\NhABEIG.exe
  2⤵
  PID:7752
- C:\Windows\System\riGEjhz.exe
  C:\Windows\System\riGEjhz.exe
  2⤵
  PID:7780
- C:\Windows\System\oJLYvIt.exe
  C:\Windows\System\oJLYvIt.exe
  2⤵
  PID:7824
- C:\Windows\System\GuNKcdZ.exe
  C:\Windows\System\GuNKcdZ.exe
  2⤵
  PID:7860
- C:\Windows\System\eUNFzNS.exe
  C:\Windows\System\eUNFzNS.exe
  2⤵
  PID:7892
- C:\Windows\System\GkCOqQo.exe
  C:\Windows\System\GkCOqQo.exe
  2⤵
  PID:7924
- C:\Windows\System\CeHRjFh.exe
  C:\Windows\System\CeHRjFh.exe
  2⤵
  PID:7956
- C:\Windows\System\UmuIPlg.exe
  C:\Windows\System\UmuIPlg.exe
  2⤵
  PID:7972
- C:\Windows\System\SJJvTTD.exe
  C:\Windows\System\SJJvTTD.exe
  2⤵
  PID:8012
- C:\Windows\System\qWkpHrz.exe
  C:\Windows\System\qWkpHrz.exe
  2⤵
  PID:8044
- C:\Windows\System\CedJeMI.exe
  C:\Windows\System\CedJeMI.exe
  2⤵
  PID:8076
- C:\Windows\System\cdXuJRI.exe
  C:\Windows\System\cdXuJRI.exe
  2⤵
  PID:8108
- C:\Windows\System\eSZoqJY.exe
  C:\Windows\System\eSZoqJY.exe
  2⤵
  PID:8144
- C:\Windows\System\CVMJABi.exe
  C:\Windows\System\CVMJABi.exe
  2⤵
  PID:8164
- C:\Windows\System\SXqrGli.exe
  C:\Windows\System\SXqrGli.exe
  2⤵
  PID:4664
- C:\Windows\System\gzohYCI.exe
  C:\Windows\System\gzohYCI.exe
  2⤵
  PID:7216
- C:\Windows\System\iEeZLiF.exe
  C:\Windows\System\iEeZLiF.exe
  2⤵
  PID:7268
- C:\Windows\System\fudRtlz.exe
  C:\Windows\System\fudRtlz.exe
  2⤵
  PID:7424
- C:\Windows\System\LqNLNus.exe
  C:\Windows\System\LqNLNus.exe
  2⤵
  PID:7476
- C:\Windows\System\wnOaouh.exe
  C:\Windows\System\wnOaouh.exe
  2⤵
  PID:7436
- C:\Windows\System\UeJGILF.exe
  C:\Windows\System\UeJGILF.exe
  2⤵
  PID:1104
- C:\Windows\System\IsApytw.exe
  C:\Windows\System\IsApytw.exe
  2⤵
  PID:7560
- C:\Windows\System\cmgBzlU.exe
  C:\Windows\System\cmgBzlU.exe
  2⤵
  PID:7600
- C:\Windows\System\pqXdiQM.exe
  C:\Windows\System\pqXdiQM.exe
  2⤵
  PID:7660
- C:\Windows\System\aWoSWpa.exe
  C:\Windows\System\aWoSWpa.exe
  2⤵
  PID:7736
- C:\Windows\System\KVkppWW.exe
  C:\Windows\System\KVkppWW.exe
  2⤵
  PID:7812
- C:\Windows\System\TZQOCKS.exe
  C:\Windows\System\TZQOCKS.exe
  2⤵
  PID:7944
- C:\Windows\System\aGlMcGa.exe
  C:\Windows\System\aGlMcGa.exe
  2⤵
  PID:8032
- C:\Windows\System\KvHkWyX.exe
  C:\Windows\System\KvHkWyX.exe
  2⤵
  PID:8100
- C:\Windows\System\wqoDths.exe
  C:\Windows\System\wqoDths.exe
  2⤵
  PID:1336
- C:\Windows\System\MydxaHa.exe
  C:\Windows\System\MydxaHa.exe
  2⤵
  PID:7260
- C:\Windows\System\WNEskZz.exe
  C:\Windows\System\WNEskZz.exe
  2⤵
  PID:2124
- C:\Windows\System\jzRyuWg.exe
  C:\Windows\System\jzRyuWg.exe
  2⤵
  PID:7244
- C:\Windows\System\GpMUUwq.exe
  C:\Windows\System\GpMUUwq.exe
  2⤵
  PID:7908
- C:\Windows\System\aCXooDZ.exe
  C:\Windows\System\aCXooDZ.exe
  2⤵
  PID:8152
- C:\Windows\System\cqcGmlK.exe
  C:\Windows\System\cqcGmlK.exe
  2⤵
  PID:7416
- C:\Windows\System\LHeaFOX.exe
  C:\Windows\System\LHeaFOX.exe
  2⤵
  PID:7640
- C:\Windows\System\xAHYMsa.exe
  C:\Windows\System\xAHYMsa.exe
  2⤵
  PID:8156
- C:\Windows\System\JWoQZOy.exe
  C:\Windows\System\JWoQZOy.exe
  2⤵
  PID:7884
- C:\Windows\System\giObEqt.exe
  C:\Windows\System\giObEqt.exe
  2⤵
  PID:8220
- C:\Windows\System\iDRTxsL.exe
  C:\Windows\System\iDRTxsL.exe
  2⤵
  PID:8248
- C:\Windows\System\ADtWUuD.exe
  C:\Windows\System\ADtWUuD.exe
  2⤵
  PID:8276
- C:\Windows\System\bIcfmWw.exe
  C:\Windows\System\bIcfmWw.exe
  2⤵
  PID:8304
- C:\Windows\System\wxWiyVw.exe
  C:\Windows\System\wxWiyVw.exe
  2⤵
  PID:8332
- C:\Windows\System\qrtWiKt.exe
  C:\Windows\System\qrtWiKt.exe
  2⤵
  PID:8364
- C:\Windows\System\txCButi.exe
  C:\Windows\System\txCButi.exe
  2⤵
  PID:8380
- C:\Windows\System\kXzdBus.exe
  C:\Windows\System\kXzdBus.exe
  2⤵
  PID:8420
- C:\Windows\System\uUWcGkz.exe
  C:\Windows\System\uUWcGkz.exe
  2⤵
  PID:8444
- C:\Windows\System\WHlenLC.exe
  C:\Windows\System\WHlenLC.exe
  2⤵
  PID:8476
- C:\Windows\System\kbYVOXL.exe
  C:\Windows\System\kbYVOXL.exe
  2⤵
  PID:8504
- C:\Windows\System\UEmlExK.exe
  C:\Windows\System\UEmlExK.exe
  2⤵
  PID:8532
- C:\Windows\System\vMKhSOw.exe
  C:\Windows\System\vMKhSOw.exe
  2⤵
  PID:8560
- C:\Windows\System\tEHzmZx.exe
  C:\Windows\System\tEHzmZx.exe
  2⤵
  PID:8588
- C:\Windows\System\uKcZVYy.exe
  C:\Windows\System\uKcZVYy.exe
  2⤵
  PID:8616
- C:\Windows\System\CunSAVk.exe
  C:\Windows\System\CunSAVk.exe
  2⤵
  PID:8644
- C:\Windows\System\AyNXDes.exe
  C:\Windows\System\AyNXDes.exe
  2⤵
  PID:8672
- C:\Windows\System\xgmUqcW.exe
  C:\Windows\System\xgmUqcW.exe
  2⤵
  PID:8700
- C:\Windows\System\IxUjhnU.exe
  C:\Windows\System\IxUjhnU.exe
  2⤵
  PID:8728
- C:\Windows\System\LabckNH.exe
  C:\Windows\System\LabckNH.exe
  2⤵
  PID:8756
- C:\Windows\System\moeIElt.exe
  C:\Windows\System\moeIElt.exe
  2⤵
  PID:8784
- C:\Windows\System\hZXDkip.exe
  C:\Windows\System\hZXDkip.exe
  2⤵
  PID:8812
- C:\Windows\System\rOLtKYi.exe
  C:\Windows\System\rOLtKYi.exe
  2⤵
  PID:8840
- C:\Windows\System\CCxoxRJ.exe
  C:\Windows\System\CCxoxRJ.exe
  2⤵
  PID:8868
- C:\Windows\System\mQRonbn.exe
  C:\Windows\System\mQRonbn.exe
  2⤵
  PID:8896
- C:\Windows\System\CwGAgOR.exe
  C:\Windows\System\CwGAgOR.exe
  2⤵
  PID:8924
- C:\Windows\System\OedUolH.exe
  C:\Windows\System\OedUolH.exe
  2⤵
  PID:8952
- C:\Windows\System\JkTytoZ.exe
  C:\Windows\System\JkTytoZ.exe
  2⤵
  PID:8980
- C:\Windows\System\exIKBeb.exe
  C:\Windows\System\exIKBeb.exe
  2⤵
  PID:9012
- C:\Windows\System\WJeAXzH.exe
  C:\Windows\System\WJeAXzH.exe
  2⤵
  PID:9040
- C:\Windows\System\HGldoqH.exe
  C:\Windows\System\HGldoqH.exe
  2⤵
  PID:9068
- C:\Windows\System\wYkebeA.exe
  C:\Windows\System\wYkebeA.exe
  2⤵
  PID:9100
- C:\Windows\System\dugdPqS.exe
  C:\Windows\System\dugdPqS.exe
  2⤵
  PID:9128
- C:\Windows\System\BmegIaP.exe
  C:\Windows\System\BmegIaP.exe
  2⤵
  PID:9144
- C:\Windows\System\NlEcuHR.exe
  C:\Windows\System\NlEcuHR.exe
  2⤵
  PID:9160
- C:\Windows\System\hPSkNRS.exe
  C:\Windows\System\hPSkNRS.exe
  2⤵
  PID:9184
- C:\Windows\System\gdfTRuE.exe
  C:\Windows\System\gdfTRuE.exe
  2⤵
  PID:8244
- C:\Windows\System\FyFCHxY.exe
  C:\Windows\System\FyFCHxY.exe
  2⤵
  PID:8320
- C:\Windows\System\fBNTcXR.exe
  C:\Windows\System\fBNTcXR.exe
  2⤵
  PID:8376
- C:\Windows\System\tsRcSwn.exe
  C:\Windows\System\tsRcSwn.exe
  2⤵
  PID:8432
- C:\Windows\System\OhczfDd.exe
  C:\Windows\System\OhczfDd.exe
  2⤵
  PID:8500
- C:\Windows\System\pzqNslA.exe
  C:\Windows\System\pzqNslA.exe
  2⤵
  PID:8556
- C:\Windows\System\OjHDsms.exe
  C:\Windows\System\OjHDsms.exe
  2⤵
  PID:8612
- C:\Windows\System\qJITPDe.exe
  C:\Windows\System\qJITPDe.exe
  2⤵
  PID:8664
- C:\Windows\System\rbQTYEg.exe
  C:\Windows\System\rbQTYEg.exe
  2⤵
  PID:8724
- C:\Windows\System\WUXgFnp.exe
  C:\Windows\System\WUXgFnp.exe
  2⤵
  PID:8796
- C:\Windows\System\wrYukcW.exe
  C:\Windows\System\wrYukcW.exe
  2⤵
  PID:912
- C:\Windows\System\fRHEWkv.exe
  C:\Windows\System\fRHEWkv.exe
  2⤵
  PID:8912
- C:\Windows\System\IbcPKyX.exe
  C:\Windows\System\IbcPKyX.exe
  2⤵
  PID:8972
- C:\Windows\System\pcoEpxD.exe
  C:\Windows\System\pcoEpxD.exe
  2⤵
  PID:6580
- C:\Windows\System\sLdhJjw.exe
  C:\Windows\System\sLdhJjw.exe
  2⤵
  PID:6608
- C:\Windows\System\SZbVfqt.exe
  C:\Windows\System\SZbVfqt.exe
  2⤵
  PID:9140
- C:\Windows\System\HkUoggf.exe
  C:\Windows\System\HkUoggf.exe
  2⤵
  PID:9180
- C:\Windows\System\xRhWtNn.exe
  C:\Windows\System\xRhWtNn.exe
  2⤵
  PID:8300
- C:\Windows\System\XCZLxPZ.exe
  C:\Windows\System\XCZLxPZ.exe
  2⤵
  PID:8440
- C:\Windows\System\hEFXfey.exe
  C:\Windows\System\hEFXfey.exe
  2⤵
  PID:8544
- C:\Windows\System\xxFwsoj.exe
  C:\Windows\System\xxFwsoj.exe
  2⤵
  PID:8668
- C:\Windows\System\rYzFmuB.exe
  C:\Windows\System\rYzFmuB.exe
  2⤵
  PID:8824
- C:\Windows\System\rBuWfkW.exe
  C:\Windows\System\rBuWfkW.exe
  2⤵
  PID:8948
- C:\Windows\System\bHQnzyD.exe
  C:\Windows\System\bHQnzyD.exe
  2⤵
  PID:9088
- C:\Windows\System\eganabf.exe
  C:\Windows\System\eganabf.exe
  2⤵
  PID:9172
- C:\Windows\System\SbLkotk.exe
  C:\Windows\System\SbLkotk.exe
  2⤵
  PID:8416
- C:\Windows\System\JnEtRXR.exe
  C:\Windows\System\JnEtRXR.exe
  2⤵
  PID:8776
- C:\Windows\System\NrHLkwE.exe
  C:\Windows\System\NrHLkwE.exe
  2⤵
  PID:9064
- C:\Windows\System\LKFtyqE.exe
  C:\Windows\System\LKFtyqE.exe
  2⤵
  PID:8372
- C:\Windows\System\fjRuQTj.exe
  C:\Windows\System\fjRuQTj.exe
  2⤵
  PID:9156
- C:\Windows\System\KwNRvOj.exe
  C:\Windows\System\KwNRvOj.exe
  2⤵
  PID:9060
- C:\Windows\System\kuoNcEe.exe
  C:\Windows\System\kuoNcEe.exe
  2⤵
  PID:9244
- C:\Windows\System\rayHTEQ.exe
  C:\Windows\System\rayHTEQ.exe
  2⤵
  PID:9272
- C:\Windows\System\OSSxSxT.exe
  C:\Windows\System\OSSxSxT.exe
  2⤵
  PID:9300
- C:\Windows\System\TzNgAPr.exe
  C:\Windows\System\TzNgAPr.exe
  2⤵
  PID:9328
- C:\Windows\System\SKlWNkG.exe
  C:\Windows\System\SKlWNkG.exe
  2⤵
  PID:9356
- C:\Windows\System\ubmglGp.exe
  C:\Windows\System\ubmglGp.exe
  2⤵
  PID:9384
- C:\Windows\System\dfYZMUm.exe
  C:\Windows\System\dfYZMUm.exe
  2⤵
  PID:9412
- C:\Windows\System\gvrRUZj.exe
  C:\Windows\System\gvrRUZj.exe
  2⤵
  PID:9440
- C:\Windows\System\rNiBIdK.exe
  C:\Windows\System\rNiBIdK.exe
  2⤵
  PID:9468
- C:\Windows\System\czqcdQB.exe
  C:\Windows\System\czqcdQB.exe
  2⤵
  PID:9496
- C:\Windows\System\niNoGrZ.exe
  C:\Windows\System\niNoGrZ.exe
  2⤵
  PID:9524
- C:\Windows\System\oVHMHFg.exe
  C:\Windows\System\oVHMHFg.exe
  2⤵
  PID:9552
- C:\Windows\System\GcpnNEG.exe
  C:\Windows\System\GcpnNEG.exe
  2⤵
  PID:9580
- C:\Windows\System\PqUSBHS.exe
  C:\Windows\System\PqUSBHS.exe
  2⤵
  PID:9608
- C:\Windows\System\OJEYEMB.exe
  C:\Windows\System\OJEYEMB.exe
  2⤵
  PID:9636
- C:\Windows\System\dtlfmem.exe
  C:\Windows\System\dtlfmem.exe
  2⤵
  PID:9664
- C:\Windows\System\RbtOpOT.exe
  C:\Windows\System\RbtOpOT.exe
  2⤵
  PID:9692
- C:\Windows\System\SjKkoSs.exe
  C:\Windows\System\SjKkoSs.exe
  2⤵
  PID:9720
- C:\Windows\System\wtdJBkz.exe
  C:\Windows\System\wtdJBkz.exe
  2⤵
  PID:9748
- C:\Windows\System\eVhJjWJ.exe
  C:\Windows\System\eVhJjWJ.exe
  2⤵
  PID:9776
- C:\Windows\System\fsNCOvD.exe
  C:\Windows\System\fsNCOvD.exe
  2⤵
  PID:9804
- C:\Windows\System\ckFTjHD.exe
  C:\Windows\System\ckFTjHD.exe
  2⤵
  PID:9832
- C:\Windows\System\WmUCRuX.exe
  C:\Windows\System\WmUCRuX.exe
  2⤵
  PID:9860
- C:\Windows\System\YlBvOKa.exe
  C:\Windows\System\YlBvOKa.exe
  2⤵
  PID:9888
- C:\Windows\System\PfNxGOU.exe
  C:\Windows\System\PfNxGOU.exe
  2⤵
  PID:9916
- C:\Windows\System\ResJkrT.exe
  C:\Windows\System\ResJkrT.exe
  2⤵
  PID:9944
- C:\Windows\System\kKuyKYE.exe
  C:\Windows\System\kKuyKYE.exe
  2⤵
  PID:9972
- C:\Windows\System\WxupRSL.exe
  C:\Windows\System\WxupRSL.exe
  2⤵
  PID:10000
- C:\Windows\System\ugCTkcB.exe
  C:\Windows\System\ugCTkcB.exe
  2⤵
  PID:10028
- C:\Windows\System\ccwcreD.exe
  C:\Windows\System\ccwcreD.exe
  2⤵
  PID:10056
- C:\Windows\System\XNQkaJl.exe
  C:\Windows\System\XNQkaJl.exe
  2⤵
  PID:10088
- C:\Windows\System\bLDbDFR.exe
  C:\Windows\System\bLDbDFR.exe
  2⤵
  PID:10116
- C:\Windows\System\ZcBwXgw.exe
  C:\Windows\System\ZcBwXgw.exe
  2⤵
  PID:10144
- C:\Windows\System\SIjoLXy.exe
  C:\Windows\System\SIjoLXy.exe
  2⤵
  PID:10172
- C:\Windows\System\ZObpVzU.exe
  C:\Windows\System\ZObpVzU.exe
  2⤵
  PID:10200
- C:\Windows\System\hFBsIsZ.exe
  C:\Windows\System\hFBsIsZ.exe
  2⤵
  PID:10228
- C:\Windows\System\PkkBWcr.exe
  C:\Windows\System\PkkBWcr.exe
  2⤵
  PID:9260
- C:\Windows\System\MpmrSSW.exe
  C:\Windows\System\MpmrSSW.exe
  2⤵
  PID:9320
- C:\Windows\System\IYVYGEJ.exe
  C:\Windows\System\IYVYGEJ.exe
  2⤵
  PID:9376
- C:\Windows\System\tfJkEUL.exe
  C:\Windows\System\tfJkEUL.exe
  2⤵
  PID:9436
- C:\Windows\System\VEucfKU.exe
  C:\Windows\System\VEucfKU.exe
  2⤵
  PID:9516
- C:\Windows\System\WZyEdLM.exe
  C:\Windows\System\WZyEdLM.exe
  2⤵
  PID:9576
- C:\Windows\System\GWkAkFt.exe
  C:\Windows\System\GWkAkFt.exe
  2⤵
  PID:9648
- C:\Windows\System\xfBcaSp.exe
  C:\Windows\System\xfBcaSp.exe
  2⤵
  PID:9708
- C:\Windows\System\oWPXJnt.exe
  C:\Windows\System\oWPXJnt.exe
  2⤵
  PID:9768
- C:\Windows\System\txccRCn.exe
  C:\Windows\System\txccRCn.exe
  2⤵
  PID:9828
- C:\Windows\System\LkjvSlR.exe
  C:\Windows\System\LkjvSlR.exe
  2⤵
  PID:9904
- C:\Windows\System\sZZMvFY.exe
  C:\Windows\System\sZZMvFY.exe
  2⤵
  PID:9964
- C:\Windows\System\SiNyYhk.exe
  C:\Windows\System\SiNyYhk.exe
  2⤵
  PID:10024
- C:\Windows\System\OIoQdTX.exe
  C:\Windows\System\OIoQdTX.exe
  2⤵
  PID:10104
- C:\Windows\System\cIEtcev.exe
  C:\Windows\System\cIEtcev.exe
  2⤵
  PID:10164
- C:\Windows\System\eCExwYW.exe
  C:\Windows\System\eCExwYW.exe
  2⤵
  PID:10224
- C:\Windows\System\CoRlRmN.exe
  C:\Windows\System\CoRlRmN.exe
  2⤵
  PID:9352
- C:\Windows\System\GJcarBs.exe
  C:\Windows\System\GJcarBs.exe
  2⤵
  PID:9492
- C:\Windows\System\ybqTcYv.exe
  C:\Windows\System\ybqTcYv.exe
  2⤵
  PID:9632
- C:\Windows\System\THjfkFQ.exe
  C:\Windows\System\THjfkFQ.exe
  2⤵
  PID:9796
- C:\Windows\System\WUrDSEp.exe
  C:\Windows\System\WUrDSEp.exe
  2⤵
  PID:9928
- C:\Windows\System\mtQgsIq.exe
  C:\Windows\System\mtQgsIq.exe
  2⤵
  PID:10080
- C:\Windows\System\GtqdbIt.exe
  C:\Windows\System\GtqdbIt.exe
  2⤵
  PID:9240
- C:\Windows\System\eBsUOpV.exe
  C:\Windows\System\eBsUOpV.exe
  2⤵
  PID:9604
- C:\Windows\System\oPnlULY.exe
  C:\Windows\System\oPnlULY.exe
  2⤵
  PID:9940
- C:\Windows\System\qGpxPdQ.exe
  C:\Windows\System\qGpxPdQ.exe
  2⤵
  PID:9432
- C:\Windows\System\jmYApjw.exe
  C:\Windows\System\jmYApjw.exe
  2⤵
  PID:10216
- C:\Windows\System\LeATQxg.exe
  C:\Windows\System\LeATQxg.exe
  2⤵
  PID:9884
- C:\Windows\System\vTOwWcc.exe
  C:\Windows\System\vTOwWcc.exe
  2⤵
  PID:10268
- C:\Windows\System\FyDnSHX.exe
  C:\Windows\System\FyDnSHX.exe
  2⤵
  PID:10296
- C:\Windows\System\jEpFsLR.exe
  C:\Windows\System\jEpFsLR.exe
  2⤵
  PID:10324
- C:\Windows\System\NZtaVSB.exe
  C:\Windows\System\NZtaVSB.exe
  2⤵
  PID:10352
- C:\Windows\System\TbAXCaf.exe
  C:\Windows\System\TbAXCaf.exe
  2⤵
  PID:10380
- C:\Windows\System\PHTiWjq.exe
  C:\Windows\System\PHTiWjq.exe
  2⤵
  PID:10408
- C:\Windows\System\bqIADKk.exe
  C:\Windows\System\bqIADKk.exe
  2⤵
  PID:10436
- C:\Windows\System\oybAGPO.exe
  C:\Windows\System\oybAGPO.exe
  2⤵
  PID:10464
- C:\Windows\System\netfefm.exe
  C:\Windows\System\netfefm.exe
  2⤵
  PID:10492
- C:\Windows\System\VAdLhrc.exe
  C:\Windows\System\VAdLhrc.exe
  2⤵
  PID:10520
- C:\Windows\System\FtQLVSl.exe
  C:\Windows\System\FtQLVSl.exe
  2⤵
  PID:10540
- C:\Windows\System\MRLhUsn.exe
  C:\Windows\System\MRLhUsn.exe
  2⤵
  PID:10576
- C:\Windows\System\FgGXHrP.exe
  C:\Windows\System\FgGXHrP.exe
  2⤵
  PID:10604
- C:\Windows\System\AKITaHH.exe
  C:\Windows\System\AKITaHH.exe
  2⤵
  PID:10632
- C:\Windows\System\dQqcTpX.exe
  C:\Windows\System\dQqcTpX.exe
  2⤵
  PID:10660
- C:\Windows\System\hrCqQKz.exe
  C:\Windows\System\hrCqQKz.exe
  2⤵
  PID:10688
- C:\Windows\System\vESmRWS.exe
  C:\Windows\System\vESmRWS.exe
  2⤵
  PID:10716
- C:\Windows\System\EkBsCUs.exe
  C:\Windows\System\EkBsCUs.exe
  2⤵
  PID:10744
- C:\Windows\System\BSKJmMZ.exe
  C:\Windows\System\BSKJmMZ.exe
  2⤵
  PID:10776
- C:\Windows\System\KnZcQrc.exe
  C:\Windows\System\KnZcQrc.exe
  2⤵
  PID:10812
- C:\Windows\System\vKdEANv.exe
  C:\Windows\System\vKdEANv.exe
  2⤵
  PID:10852
- C:\Windows\System\LdPUtaw.exe
  C:\Windows\System\LdPUtaw.exe
  2⤵
  PID:10868
- C:\Windows\System\hSDAvum.exe
  C:\Windows\System\hSDAvum.exe
  2⤵
  PID:10896
- C:\Windows\System\uHduhnb.exe
  C:\Windows\System\uHduhnb.exe
  2⤵
  PID:10924
- C:\Windows\System\rSdbOfs.exe
  C:\Windows\System\rSdbOfs.exe
  2⤵
  PID:10952
- C:\Windows\System\vjgMBqF.exe
  C:\Windows\System\vjgMBqF.exe
  2⤵
  PID:10980
- C:\Windows\System\iIxhskV.exe
  C:\Windows\System\iIxhskV.exe
  2⤵
  PID:11008
- C:\Windows\System\uktCENX.exe
  C:\Windows\System\uktCENX.exe
  2⤵
  PID:11036
- C:\Windows\System\fzHjOvM.exe
  C:\Windows\System\fzHjOvM.exe
  2⤵
  PID:11064
- C:\Windows\System\sSuBekZ.exe
  C:\Windows\System\sSuBekZ.exe
  2⤵
  PID:11092
- C:\Windows\System\hHCoVRG.exe
  C:\Windows\System\hHCoVRG.exe
  2⤵
  PID:11120
- C:\Windows\System\PjUhYjL.exe
  C:\Windows\System\PjUhYjL.exe
  2⤵
  PID:11148
- C:\Windows\System\OCSigWy.exe
  C:\Windows\System\OCSigWy.exe
  2⤵
  PID:11176
- C:\Windows\System\URQdmQy.exe
  C:\Windows\System\URQdmQy.exe
  2⤵
  PID:11204
- C:\Windows\System\jIPPpEw.exe
  C:\Windows\System\jIPPpEw.exe
  2⤵
  PID:11232
- C:\Windows\System\QOySyDw.exe
  C:\Windows\System\QOySyDw.exe
  2⤵
  PID:11260
- C:\Windows\System\oXjCcBM.exe
  C:\Windows\System\oXjCcBM.exe
  2⤵
  PID:10308
- C:\Windows\System\AhDEXdA.exe
  C:\Windows\System\AhDEXdA.exe
  2⤵
  PID:10364
- C:\Windows\System\KoFiRQg.exe
  C:\Windows\System\KoFiRQg.exe
  2⤵
  PID:10428
- C:\Windows\System\uhuVyOc.exe
  C:\Windows\System\uhuVyOc.exe
  2⤵
  PID:10488
- C:\Windows\System\uwyGLQu.exe
  C:\Windows\System\uwyGLQu.exe
  2⤵
  PID:10564
- C:\Windows\System\IugJYya.exe
  C:\Windows\System\IugJYya.exe
  2⤵
  PID:10624
- C:\Windows\System\DJnuvGB.exe
  C:\Windows\System\DJnuvGB.exe
  2⤵
  PID:10684
- C:\Windows\System\zgFwijL.exe
  C:\Windows\System\zgFwijL.exe
  2⤵
  PID:10760
- C:\Windows\System\YuPVGvU.exe
  C:\Windows\System\YuPVGvU.exe
  2⤵
  PID:4428
- C:\Windows\System\ezRKYtr.exe
  C:\Windows\System\ezRKYtr.exe
  2⤵
  PID:1892
- C:\Windows\System\gabRPGy.exe
  C:\Windows\System\gabRPGy.exe
  2⤵
  PID:2720
- C:\Windows\System\QsnUWPp.exe
  C:\Windows\System\QsnUWPp.exe
  2⤵
  PID:10916
- C:\Windows\System\UbRhUCD.exe
  C:\Windows\System\UbRhUCD.exe
  2⤵
  PID:10976
- C:\Windows\System\ZXLAfbQ.exe
  C:\Windows\System\ZXLAfbQ.exe
  2⤵
  PID:11052
- C:\Windows\System\dvWJyyc.exe
  C:\Windows\System\dvWJyyc.exe
  2⤵
  PID:11112
- C:\Windows\System\SghsDkH.exe
  C:\Windows\System\SghsDkH.exe
  2⤵
  PID:11172
- C:\Windows\System\GSROEPj.exe
  C:\Windows\System\GSROEPj.exe
  2⤵
  PID:11248
- C:\Windows\System\oXRShZw.exe
  C:\Windows\System\oXRShZw.exe
  2⤵
  PID:10344
- C:\Windows\System\dYwBymw.exe
  C:\Windows\System\dYwBymw.exe
  2⤵
  PID:10484
- C:\Windows\System\SYNwiPr.exe
  C:\Windows\System\SYNwiPr.exe
  2⤵
  PID:10656
- C:\Windows\System\WiwBXoT.exe
  C:\Windows\System\WiwBXoT.exe
  2⤵
  PID:10808
- C:\Windows\System\WcxJfnT.exe
  C:\Windows\System\WcxJfnT.exe
  2⤵
  PID:7568
- C:\Windows\System\LnTTcpC.exe
  C:\Windows\System\LnTTcpC.exe
  2⤵
  PID:11004
- C:\Windows\System\ohyUNRY.exe
  C:\Windows\System\ohyUNRY.exe
  2⤵
  PID:11160
- C:\Windows\System\OuPEkGW.exe
  C:\Windows\System\OuPEkGW.exe
  2⤵
  PID:10084
- C:\Windows\System\jqUmDSD.exe
  C:\Windows\System\jqUmDSD.exe
  2⤵
  PID:10736
- C:\Windows\System\RrIyDXj.exe
  C:\Windows\System\RrIyDXj.exe
  2⤵
  PID:10944
- C:\Windows\System\AYRReir.exe
  C:\Windows\System\AYRReir.exe
  2⤵
  PID:10280
- C:\Windows\System\GyyBLjy.exe
  C:\Windows\System\GyyBLjy.exe
  2⤵
  PID:10764
- C:\Windows\System\XFoQhvA.exe
  C:\Windows\System\XFoQhvA.exe
  2⤵
  PID:10620
- C:\Windows\System\lwCbibr.exe
  C:\Windows\System\lwCbibr.exe
  2⤵
  PID:11284
- C:\Windows\System\hhkYpBe.exe
  C:\Windows\System\hhkYpBe.exe
  2⤵
  PID:11312
- C:\Windows\System\cQTrMpS.exe
  C:\Windows\System\cQTrMpS.exe
  2⤵
  PID:11340
- C:\Windows\System\tTCunzb.exe
  C:\Windows\System\tTCunzb.exe
  2⤵
  PID:11368
- C:\Windows\System\dzEHacZ.exe
  C:\Windows\System\dzEHacZ.exe
  2⤵
  PID:11396
- C:\Windows\System\zbPLexK.exe
  C:\Windows\System\zbPLexK.exe
  2⤵
  PID:11424
- C:\Windows\System\sJpKbMW.exe
  C:\Windows\System\sJpKbMW.exe
  2⤵
  PID:11456
- C:\Windows\System\UJxmCXy.exe
  C:\Windows\System\UJxmCXy.exe
  2⤵
  PID:11484
- C:\Windows\System\McWDzNh.exe
  C:\Windows\System\McWDzNh.exe
  2⤵
  PID:11512
- C:\Windows\System\IyWsMKW.exe
  C:\Windows\System\IyWsMKW.exe
  2⤵
  PID:11540
- C:\Windows\System\DQcsWwO.exe
  C:\Windows\System\DQcsWwO.exe
  2⤵
  PID:11568
- C:\Windows\System\CuXaaZp.exe
  C:\Windows\System\CuXaaZp.exe
  2⤵
  PID:11596
- C:\Windows\System\kuwMPyD.exe
  C:\Windows\System\kuwMPyD.exe
  2⤵
  PID:11624
- C:\Windows\System\csrFIHW.exe
  C:\Windows\System\csrFIHW.exe
  2⤵
  PID:11652
- C:\Windows\System\fhtvZhF.exe
  C:\Windows\System\fhtvZhF.exe
  2⤵
  PID:11700
- C:\Windows\System\XtxbxOn.exe
  C:\Windows\System\XtxbxOn.exe
  2⤵
  PID:11716
- C:\Windows\System\SYluJXX.exe
  C:\Windows\System\SYluJXX.exe
  2⤵
  PID:11744
- C:\Windows\System\vHzUAeI.exe
  C:\Windows\System\vHzUAeI.exe
  2⤵
  PID:11772
- C:\Windows\System\WdVJcEB.exe
  C:\Windows\System\WdVJcEB.exe
  2⤵
  PID:11800
- C:\Windows\System\DOreTbU.exe
  C:\Windows\System\DOreTbU.exe
  2⤵
  PID:11828
- C:\Windows\System\TdKpKWU.exe
  C:\Windows\System\TdKpKWU.exe
  2⤵
  PID:11856
- C:\Windows\System\rbZNNJa.exe
  C:\Windows\System\rbZNNJa.exe
  2⤵
  PID:11884
- C:\Windows\System\zLbRlvo.exe
  C:\Windows\System\zLbRlvo.exe
  2⤵
  PID:11912
- C:\Windows\System\kZciewt.exe
  C:\Windows\System\kZciewt.exe
  2⤵
  PID:11940
- C:\Windows\System\emxituq.exe
  C:\Windows\System\emxituq.exe
  2⤵
  PID:11968
- C:\Windows\System\ScOZvHW.exe
  C:\Windows\System\ScOZvHW.exe
  2⤵
  PID:11996
- C:\Windows\System\mJxHCmO.exe
  C:\Windows\System\mJxHCmO.exe
  2⤵
  PID:12024
- C:\Windows\System\qFOvAhX.exe
  C:\Windows\System\qFOvAhX.exe
  2⤵
  PID:12052
- C:\Windows\System\JjsQqFY.exe
  C:\Windows\System\JjsQqFY.exe
  2⤵
  PID:12080
- C:\Windows\System\viwTXWY.exe
  C:\Windows\System\viwTXWY.exe
  2⤵
  PID:12108
- C:\Windows\System\IBWmZOJ.exe
  C:\Windows\System\IBWmZOJ.exe
  2⤵
  PID:12136
- C:\Windows\System\RFtVKSQ.exe
  C:\Windows\System\RFtVKSQ.exe
  2⤵
  PID:12152
- C:\Windows\System\RlWJwsV.exe
  C:\Windows\System\RlWJwsV.exe
  2⤵
  PID:12188
- C:\Windows\System\osKFUwQ.exe
  C:\Windows\System\osKFUwQ.exe
  2⤵
  PID:12220
- C:\Windows\System\AdWmSiQ.exe
  C:\Windows\System\AdWmSiQ.exe
  2⤵
  PID:12248
- C:\Windows\System\YNKODOZ.exe
  C:\Windows\System\YNKODOZ.exe
  2⤵
  PID:12276
- C:\Windows\System\jfQBGdW.exe
  C:\Windows\System\jfQBGdW.exe
  2⤵
  PID:11304
- C:\Windows\System\jCwuEps.exe
  C:\Windows\System\jCwuEps.exe
  2⤵
  PID:11364
- C:\Windows\System\fQniKQA.exe
  C:\Windows\System\fQniKQA.exe
  2⤵
  PID:11440
- C:\Windows\System\pledruL.exe
  C:\Windows\System\pledruL.exe
  2⤵
  PID:11504
- C:\Windows\System\pNXZVyV.exe
  C:\Windows\System\pNXZVyV.exe
  2⤵
  PID:11564
- C:\Windows\System\aoShCOq.exe
  C:\Windows\System\aoShCOq.exe
  2⤵
  PID:11636
- C:\Windows\System\oROLLIu.exe
  C:\Windows\System\oROLLIu.exe
  2⤵
  PID:2300
- C:\Windows\System\oqlReGf.exe
  C:\Windows\System\oqlReGf.exe
  2⤵
  PID:11740
- C:\Windows\System\ATreiox.exe
  C:\Windows\System\ATreiox.exe
  2⤵
  PID:11812
- C:\Windows\System\ObkXaih.exe
  C:\Windows\System\ObkXaih.exe
  2⤵
  PID:11876
- C:\Windows\System\qBidTGL.exe
  C:\Windows\System\qBidTGL.exe
  2⤵
  PID:11936
- C:\Windows\System\OxnjzPg.exe
  C:\Windows\System\OxnjzPg.exe
  2⤵
  PID:12012
- C:\Windows\System\nHiXnoQ.exe
  C:\Windows\System\nHiXnoQ.exe
  2⤵
  PID:12072
- C:\Windows\System\opcxUzV.exe
  C:\Windows\System\opcxUzV.exe
  2⤵
  PID:12132
- C:\Windows\System\cfpEUku.exe
  C:\Windows\System\cfpEUku.exe
  2⤵
  PID:12204
- C:\Windows\System\aMcTjop.exe
  C:\Windows\System\aMcTjop.exe
  2⤵
  PID:12240
- C:\Windows\System\LIvOZFX.exe
  C:\Windows\System\LIvOZFX.exe
  2⤵
  PID:11300
- C:\Windows\System\cbnNgZh.exe
  C:\Windows\System\cbnNgZh.exe
  2⤵
  PID:11420
- C:\Windows\System\rJfUIQV.exe
  C:\Windows\System\rJfUIQV.exe
  2⤵
  PID:11592
- C:\Windows\System\lOwlqOu.exe
  C:\Windows\System\lOwlqOu.exe
  2⤵
  PID:11732
- C:\Windows\System\CiSKxIL.exe
  C:\Windows\System\CiSKxIL.exe
  2⤵
  PID:11868
- C:\Windows\System\QRHSgUQ.exe
  C:\Windows\System\QRHSgUQ.exe
  2⤵
  PID:12040
- C:\Windows\System\gbDJSxf.exe
  C:\Windows\System\gbDJSxf.exe
  2⤵
  PID:12164
- C:\Windows\System\RnmdvPT.exe
  C:\Windows\System\RnmdvPT.exe
  2⤵
  PID:11280
- C:\Windows\System\TzgXyHV.exe
  C:\Windows\System\TzgXyHV.exe
  2⤵
  PID:11668
- C:\Windows\System\DUBrCHZ.exe
  C:\Windows\System\DUBrCHZ.exe
  2⤵
  PID:11852
- C:\Windows\System\rhhMrJR.exe
  C:\Windows\System\rhhMrJR.exe
  2⤵
  PID:12144
- C:\Windows\System\DewcerY.exe
  C:\Windows\System\DewcerY.exe
  2⤵
  PID:608
- C:\Windows\System\kAWODWG.exe
  C:\Windows\System\kAWODWG.exe
  2⤵
  PID:11556
- C:\Windows\System\GBoxMmc.exe
  C:\Windows\System\GBoxMmc.exe
  2⤵
  PID:12296
- C:\Windows\System\XSWTTRn.exe
  C:\Windows\System\XSWTTRn.exe
  2⤵
  PID:12324
- C:\Windows\System\AgIsvJh.exe
  C:\Windows\System\AgIsvJh.exe
  2⤵
  PID:12352
- C:\Windows\System\xPPlbHP.exe
  C:\Windows\System\xPPlbHP.exe
  2⤵
  PID:12380
- C:\Windows\System\BwXKHJp.exe
  C:\Windows\System\BwXKHJp.exe
  2⤵
  PID:12408
- C:\Windows\System\mnwXkYm.exe
  C:\Windows\System\mnwXkYm.exe
  2⤵
  PID:12436
- C:\Windows\System\HHNsMDq.exe
  C:\Windows\System\HHNsMDq.exe
  2⤵
  PID:12464
- C:\Windows\System\VEyJhSd.exe
  C:\Windows\System\VEyJhSd.exe
  2⤵
  PID:12492
- C:\Windows\System\ejaEASI.exe
  C:\Windows\System\ejaEASI.exe
  2⤵
  PID:12520
- C:\Windows\System\MhmzCse.exe
  C:\Windows\System\MhmzCse.exe
  2⤵
  PID:12548
- C:\Windows\System\dEDTSaT.exe
  C:\Windows\System\dEDTSaT.exe
  2⤵
  PID:12576
- C:\Windows\System\NyisoUR.exe
  C:\Windows\System\NyisoUR.exe
  2⤵
  PID:12604
- C:\Windows\System\WkgsIgn.exe
  C:\Windows\System\WkgsIgn.exe
  2⤵
  PID:12632
- C:\Windows\System\xvGyYiE.exe
  C:\Windows\System\xvGyYiE.exe
  2⤵
  PID:12648
- C:\Windows\System\AnNudUP.exe
  C:\Windows\System\AnNudUP.exe
  2⤵
  PID:12688
- C:\Windows\System\QmyZkNa.exe
  C:\Windows\System\QmyZkNa.exe
  2⤵
  PID:12716
- C:\Windows\System\BXjqTXz.exe
  C:\Windows\System\BXjqTXz.exe
  2⤵
  PID:12744
- C:\Windows\System\EspuMAJ.exe
  C:\Windows\System\EspuMAJ.exe
  2⤵
  PID:12772
- C:\Windows\System\ZkiCgbd.exe
  C:\Windows\System\ZkiCgbd.exe
  2⤵
  PID:12800
- C:\Windows\System\gTwyiXo.exe
  C:\Windows\System\gTwyiXo.exe
  2⤵
  PID:12828
- C:\Windows\System\jyZobrT.exe
  C:\Windows\System\jyZobrT.exe
  2⤵
  PID:12856
- C:\Windows\System\QMsOQCd.exe
  C:\Windows\System\QMsOQCd.exe
  2⤵
  PID:12884
- C:\Windows\System\gjgYkIn.exe
  C:\Windows\System\gjgYkIn.exe
  2⤵
  PID:12912
- C:\Windows\System\TZPUZXz.exe
  C:\Windows\System\TZPUZXz.exe
  2⤵
  PID:12940
- C:\Windows\System\UsJKKPG.exe
  C:\Windows\System\UsJKKPG.exe
  2⤵
  PID:12960
- C:\Windows\System\tuPTuWR.exe
  C:\Windows\System\tuPTuWR.exe
  2⤵
  PID:12996
- C:\Windows\System\UeITnSl.exe
  C:\Windows\System\UeITnSl.exe
  2⤵
  PID:13232
- C:\Windows\System\wJnOnTW.exe
  C:\Windows\System\wJnOnTW.exe
  2⤵
  PID:1500
- C:\Windows\System\Epnoyoy.exe
  C:\Windows\System\Epnoyoy.exe
  2⤵
  PID:12400
- C:\Windows\System\aLJwYnC.exe
  C:\Windows\System\aLJwYnC.exe
  2⤵
  PID:12432
- C:\Windows\System\ENvagsn.exe
  C:\Windows\System\ENvagsn.exe
  2⤵
  PID:12536
- C:\Windows\System\BgUpvvi.exe
  C:\Windows\System\BgUpvvi.exe
  2⤵
  PID:12588
- C:\Windows\System\BcpoWEh.exe
  C:\Windows\System\BcpoWEh.exe
  2⤵
  PID:12628
- C:\Windows\System\eIMBSAj.exe
  C:\Windows\System\eIMBSAj.exe
  2⤵
  PID:12696
- C:\Windows\System\JTxixlB.exe
  C:\Windows\System\JTxixlB.exe
  2⤵
  PID:12784
- C:\Windows\System\irZUWdA.exe
  C:\Windows\System\irZUWdA.exe
  2⤵
  PID:12868
- C:\Windows\System\VUCliQL.exe
  C:\Windows\System\VUCliQL.exe
  2⤵
  PID:12904
- C:\Windows\System\UijUyKy.exe
  C:\Windows\System\UijUyKy.exe
  2⤵
  PID:12988
- C:\Windows\System\wEMSjMk.exe
  C:\Windows\System\wEMSjMk.exe
  2⤵
  PID:13024
- C:\Windows\System\JuqiCXA.exe
  C:\Windows\System\JuqiCXA.exe
  2⤵
  PID:13064
- C:\Windows\System\VemZqlP.exe
  C:\Windows\System\VemZqlP.exe
  2⤵
  PID:13096
- C:\Windows\System\qmTQKZh.exe
  C:\Windows\System\qmTQKZh.exe
  2⤵
  PID:13112
- C:\Windows\System\tkjTtdg.exe
  C:\Windows\System\tkjTtdg.exe
  2⤵
  PID:13152
- C:\Windows\System\nLEajWy.exe
  C:\Windows\System\nLEajWy.exe
  2⤵
  PID:13176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nwycdvt5.xog.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BntkTke.exe

Filesize
2.8MB

MD5
26fb4dfcadab32ccbd7746e3890fef08

SHA1
16ca65b884a71793011120b79d088aeb1765ce38

SHA256
733d1b1ce60760e24bb48fa766bfe70c6ecdcc440356b3f78a83edf5fc0fce0a

SHA512
a656253f32260e1e67c23e7fc9a3fd99e7f79db7a991c67129931daaa2cbacbe4dbf062fe3bac72af5425cc67bbbb172e95d6d2208a02a4e8618fd96d9e03946

Download Submit
C:\Windows\System\EPjcqZI.exe

Filesize
2.8MB

MD5
dd3509508b94995d630822eea8a0fbf6

SHA1
ef6756d46fe85cad371dc76f8b3f53437aad44cc

SHA256
64bea3398681e9c551a99682408ceccf7272e6981af8b2941425f60f43eae679

SHA512
9e73407c89a31c04d3d9ec95794b3e46114d307bb8ad07fbb5beeb135c3bbbf21797a876bd2da5d95fd5ba183ebeeb19c6353cd6854aa0eaaa1eb50cabf1adb1

Download Submit
C:\Windows\System\FsAuigz.exe

Filesize
2.8MB

MD5
290f08518f20d32edc98b386826b6096

SHA1
8db4689686d560e71f0e1e319972b9d47d996990

SHA256
7ce357c6f2853aa3c524d32deda216bf57b052e9df8b98b5874a114184998f79

SHA512
d4eba4a9239576b3b42f63c20123e92ecbd3d499b26c0bd1dc38bda2fb0ccf3acce38dc778abb9146d3d60c65bb6b9388d5b0284d506b9de5ba59464ebbc275d

Download Submit
C:\Windows\System\GCXtGtE.exe

Filesize
2.8MB

MD5
2f7807c7e41f9a33884fa03f5eca475b

SHA1
5583f5425b31004407707917756de2d12b1bd940

SHA256
3b82b27cc0d183ff04690a07bc4b4b991ee5106849a9318678378bf1b77cd357

SHA512
4d87bb072118c110f348d99cfeac8605bea19bf3bf1fc8c88236797d33fa4b5a426cd9ad07e32841545dc2d6ee9e856a0c9f7f82a1fed9a52752a44d7be0b16a

Download Submit
C:\Windows\System\ISkdWrI.exe

Filesize
2.8MB

MD5
c0cb42b320a4bd800cd691dbca62e58c

SHA1
54ee542f2eb9101786968484a8fddab5d78c362c

SHA256
0a1750e1205128be09b6af1f73647dabe424fb188af9010d4b2ad2446c73d1ad

SHA512
7deb72f0b42a9949faf9b9fa87ce621174cf79d7b4cfa78ef99dd2c8b127ba731802623c082e6bf1f2246d7383346a22b2c7b9404f67236319d4e1a9fbc98044

Download Submit
C:\Windows\System\JckgvLv.exe

Filesize
2.8MB

MD5
4a250afac83d924ac01f825d5465e1f1

SHA1
5d92723b75e18757867f9cc5bb53d039631512e1

SHA256
3ac282ad6eb928a8eee908fe2286bd01c6ca46eea5f04270cf85e36476c2b350

SHA512
d83b8c479131bfe77b5ecd0410820572a60504d2a8df83a6810c4b00ae9d572076ea6d5638a1c5d5b088f519f7654e265ea9b541c9d97d3ef3985e602153295b

Download Submit
C:\Windows\System\JqJBxxw.exe

Filesize
2.8MB

MD5
378c8acaee6f10bbc427a259e9557c70

SHA1
77b7cd7c7a581d6c5457ccd2e5bceeaa087a8c16

SHA256
deadc263aeff3995292a677821cf93d9906a45f1c4769773d455a31c69efabd3

SHA512
8aa26d36cb3d81530e920e94eafe7e63291af718720850e6670a4d9c91d09d30973fe102d85453f9318cff5fe9101009623875a0e33027eb0bb1e70337166790

Download Submit
C:\Windows\System\OPiRNPO.exe

Filesize
2.8MB

MD5
7eb760fe50191dc8d329ace3827c5545

SHA1
5fb03c144e13094564dc80dc2b1cf712dc5768bf

SHA256
34af5ad41ba1a7987db410147d94b4bbfd515406f16710aa72d5666e350a89d3

SHA512
69b8461ff47ed0d93c0c1acc932da551cbef13329f5bf9cdc321860227e901970a6a12c16e9ff8fccb704341de123389096e387b562c7a9a2dfa5ceda893a0c2

Download Submit
C:\Windows\System\QcpxZoP.exe

Filesize
2.8MB

MD5
78889bdd040b5af84e0449513e3f0f6b

SHA1
f197a674ad70135efafd78a59a65b524e0cae879

SHA256
b4f0f3969cf5d0ee98a776ec6d4a0c58cc679faa7973e3a3b5df73887b05d1fb

SHA512
d83d4d4414a4afaba395141aa5ec109b64c4425f2f1c762665ed08cf34300c4a17e43f062c5e5ae6ff92f865e1ecf0c78fe5ad5b43c2409be94545803eec6097

Download Submit
C:\Windows\System\RlPiGdh.exe

Filesize
2.8MB

MD5
9b254152a22636ef9527831a9baddc3e

SHA1
c90de82c72599fffc85e4cce86fd6ed232a08069

SHA256
c495c87415d1d62dab4f6b215c0f46a5f01afb044b64933ed7f29cd97ca7cb11

SHA512
f9afd047831e0f6e156eeadefd7f9d769f82b1578373445f4d6b87dd321e657229cdbe3fe0fab09e2cfdf9f5880563ab1fb2938bcaa3bda093143d5c9ce7e456

Download Submit
C:\Windows\System\SAsCIOn.exe

Filesize
2.8MB

MD5
37babe3afc487cc6adb92442ae06877c

SHA1
4c91d92008bbc73cee4ac70491472c444b45153f

SHA256
a031ded589611e95d737f393772abfb3f091655ae843bc78911fb4b57e843f7e

SHA512
f64b17c2f8e20b5ca4b049d9f5593630db53312aaad5b556b30d6525de4f2bab2447c9b903d78c81d746b7f0d1b139fe701e6a22960be463d5406b2a70c44b11

Download Submit
C:\Windows\System\TZGewJM.exe

Filesize
2.8MB

MD5
3c75bbb1b875621f72ffe08e1770907d

SHA1
7e652b19ef60a0b0ac780f6cff5f0947aebe73cf

SHA256
0d8ce9fd5640e08f1534e0187eef265a97f98f38e99e9de03124668454a9e655

SHA512
c4c5372468a9eeea16d518724f35dfade5bc260d1b085b9e988964b3930f96d84b1b60a73224c6767ccdaee0195152bcf5f3ceb8ca6f4d484b40efd467a7ffd9

Download Submit
C:\Windows\System\YilMneF.exe

Filesize
2.8MB

MD5
b0bddaef79abe9fc881f863a2178783d

SHA1
b2ef2ac69b0db12daaf7218e87999db6f4144f43

SHA256
f23fa973c24d4a5f244b2457544bdf2eafb3ff4b04208cf18b42839ca874f2a3

SHA512
6988e9035be2eeb676658da2f5ff31e3cb3862b3299c507832e0143a33b08310081e2eb4f610dc00d2f28108581f56bbb5a35889a70fecd3eaa0c875fe4d4312

Download Submit
C:\Windows\System\bisabHA.exe

Filesize
2.8MB

MD5
2a4c7fe27ed4eb0367f3338752f33f31

SHA1
afddee6d5ea7e547b55111eb7baead8c54934526

SHA256
0617e9958ae4a1d722f8c802380b286f1407322b92d1ed09491de42185781417

SHA512
462289c219e4cf1375a3bfa23a69b893b010ab80fa0539ee9905d26945afa999623cbef6ea5f968c4b8647d9cc10e41faf4fba977d8e844781d0e2d761fd3c5e

Download Submit
C:\Windows\System\blzsGbY.exe

Filesize
2.8MB

MD5
6932f981b865e65e10d7e54abafd99c5

SHA1
651590aefaa7bfdc836e597c5d94be529668766b

SHA256
df7c5fee9770ac14c61d311bf8e155100abcbfb562feab09ac7e9c116998023a

SHA512
cd432ee2fd1eb0eaa3ed89507e688346bb1601f4ef6cc417d27ef3532b3e5d14d2aea988cf1229bb816998a49a638cdc05875417dbc7666a3d8cd64f445cd7e2

Download Submit
C:\Windows\System\dCkEnmu.exe

Filesize
2.8MB

MD5
da42e30e4d87e511154ccd309588cfb2

SHA1
253a52c92b8b17090cc44feb3a3195cd117c84c8

SHA256
558b61b400239751f58eaf7d1b355254a1880059d434e31164ffbf7da772b440

SHA512
7c1a772ae0c4fd67e42dbab954b913253f11e30a6cb4bbf8a0781f98dae47c466340b391550be3803d729a84fd12e9ed5b959b1b28c22847e24a1fe328f369d7

Download Submit
C:\Windows\System\guSdDlp.exe

Filesize
2.8MB

MD5
5506f1d432abd9705788e88434c30489

SHA1
0224f7835c0c8e7257d8ea8edad6219f3c76c82d

SHA256
8999d1f3f6403aaa66335ff6da8d4304f2526c00c0b73d2a690d5f9bbf214ad7

SHA512
ac9cbbf9d9d86088680568d4760cb8b6ce3638c3802f01fefe56c4c430689f3d4594f5397bd18b8a7f91d7006d465cb2b65b3b97ca4c8741d4634b5b07c87725

Download Submit
C:\Windows\System\iHiszzM.exe

Filesize
2.8MB

MD5
94d12c994c4d022dbccd4e1a19baf194

SHA1
c45c34359b23d768ed2ac777549c5485eacec1cf

SHA256
e8ed72b6c217b151d53a2f85378e08a75fef8d95a78eb92ad3852282933727d4

SHA512
31b0e30618e22cdabb94c662d610c765e973960e5aa30dcc274a1a944dad79924a2e863c622c2b2e016d5e9f66e09c607bee240295ee46921b4d68b20aaf17c1

Download Submit
C:\Windows\System\iRxDqqO.exe

Filesize
2.8MB

MD5
90d8f3091c95e85e7584c8d4f8057461

SHA1
073261dd0c4ceb68ffad3bd68e71cbbe661920a1

SHA256
8caa5ade197c2eee45a99eb0125c6817b52aafd7584740113e420289d88afd2b

SHA512
e6619ae435e68a761cba0d6dc2f55319b9d2727ec2023b635d548e61c6e7142fe336bd8257a53be8b78db1737c55c0e38592efb2a7e11be6915d5a31c1983208

Download Submit
C:\Windows\System\ikchufb.exe

Filesize
2.8MB

MD5
d2532905c4a579a0fcaee08b67ecfa64

SHA1
19aad73d4ed61d8b5f9d785f63e3b68d37030592

SHA256
16fd4cd4afba4e472b025cd732acbe52252c7029fa981377759231e1710734ad

SHA512
c1ac9f9f5b28ad6bc1c8b6f834f4e12189bd5dca1f692cc238673cdcd09858d9efdeb97726bbfc62db27132b00442bf55aee15a7e512dcaa2454873ed9d53835

Download Submit
C:\Windows\System\jFjHLyu.exe

Filesize
2.8MB

MD5
a34f2567fef6225259da5623a772d5c6

SHA1
789d0e71d0675e41679311b6331fea1c380b38ad

SHA256
3f2d2fbbec39812e75ca3007077d88505e247dd2e70a8ef92846f7b67dd63dba

SHA512
0fccdd9cdfaa68158f421746e29080d190b06e140f8612bcbc5436f2e25eb68c31b90fa8a45520b47e460f9310bfefb19398ac7c4317cfee56c1651add271748

Download Submit
C:\Windows\System\jbKvnVC.exe

Filesize
2.8MB

MD5
c86e6862d79318c1be21a6bd9604c723

SHA1
3267ec267140cff85a16fec8347ff4815b9b3ce3

SHA256
16137cc61fb5b07588f4474a4e06bace98d602eef189c7b88f15d325f2542b2b

SHA512
42d284c1a6120a015a077116cc7db1327f0d8a294e872cb478288a274e5940c6e46b1e9353ac759bc04c568a6650abd90d6befecfd069fb172af9ea61a0d8b27

Download Submit
C:\Windows\System\kqwdIen.exe

Filesize
8B

MD5
fbef424b1922acb531e69f596a8b8921

SHA1
584ada3a02d95facb3db59252be930cc2019a07e

SHA256
9ba99dfe86f586665444906d4d6c065235a1faa079a57e34597feec2870450c4

SHA512
b7c856eeb52f1f5b978a86cc276964a598136109586a3999d60402c0885755b7f0a6e5ca90b5856e8f2e8d74fc885b0d7e257ea62c297369572d765724b94880

Download Submit
C:\Windows\System\mYwarCY.exe

Filesize
2.8MB

MD5
fd7bb31808040f506dec32d957b5b332

SHA1
7438680d7a759b008bb9f70b70855f1fdfc5ec51

SHA256
a1dff9b82df4eb273efecee9bd72d269708e1bd6e8fa06f6901e2b56758b173c

SHA512
79ded3448d5c05b10e0befeebb1a2c799212fcd7a86175baa421f45dafb261c6852a777c95ee67e460198dcd478da4f198405416d175cff4f8515b4846a77a5b

Download Submit
C:\Windows\System\nhyWIMc.exe

Filesize
2.8MB

MD5
d8c7ebc5a74cbda3eed6200bd58161db

SHA1
8482b88731242720deb4b1c8855a95a37729775b

SHA256
04250fe44cc20a774393b68f155bdea97ffc9ac86d1f800b79253a7c95078e78

SHA512
723fa00bc975179a56cabff09fbff6868312dbd4c04e1d51a2b9b65d1e2a0c95fefde00bb56e94d56a8a84cee6ab2d6b85090d3cfe31278561f745b926b7f79a

Download Submit
C:\Windows\System\oFKJihd.exe

Filesize
2.8MB

MD5
c94139ce3077f7cc38c92f98e9e58e8a

SHA1
422b11c6ddf5ba9f2eebe590f3751087e10bb334

SHA256
36cb308d2e8b13051edea5db419e7aa80a6845427d4ecec612ec07afcd01232d

SHA512
59ba09ebdfcbf4641f963595959c288a8a6c5f4a594e2e3946f7139fa6796563413c13968c043c82333ed860ea0b0c1559dd879f1a96c15434e6cac6267b8f38

Download Submit
C:\Windows\System\oxXVBcx.exe

Filesize
2.8MB

MD5
3d65e1a1e4f85b01709abe28de582af3

SHA1
217051dfc18568f7616afebda439ae1db37cf23e

SHA256
b734a6b7a64bac0dbe5f82cb5b987c7b2d4a9e59455452cc87393422e9256c55

SHA512
11ecaed30cc1dd88906f1744589a987ae7397af3d443fed72b893ef2f96cebc9c335114ddd8e09d9f562ecd05e81993a4622c7846b23b79ee7a818259ca59899

Download Submit
C:\Windows\System\sQPSsIs.exe

Filesize
2.8MB

MD5
fe4a1f67fbea2164f856d3b19eac25bc

SHA1
384e08b7e3c0c71a868d3a67656d385320e3103a

SHA256
f5cc7e0d49fe3f8100f12e3ff8db5e6eed7c7a03651fcfa1e80c8f3dcb142fde

SHA512
ed72dabbc04dd60218a5c3aab4711eb9b1012798b2a2765a77abe2dce4eec9bfd8c75787f49f5472a1be24e6d2035f8ea8f88f5165fabdfc27a751d072692cfb

Download Submit
C:\Windows\System\tqpqwpL.exe

Filesize
2.8MB

MD5
50444cca6eda07003ad3743923684206

SHA1
41f748a2e5b451d0da3e60e8bdd05371f019afee

SHA256
6c6cbc0d7dacca935a6b401991d656898ab14ac10b0154f184fe8351994ae86c

SHA512
4855028fc3a903e529c42fcdb7ba50d25937f49283e7ee78e446922ec552d2ac7b9c654696b5ae837dfe22193e34a7be1277a403fb2f907589af5ccc040ed79c

Download Submit
C:\Windows\System\vUKkkYH.exe

Filesize
2.8MB

MD5
0aef36a821bca3c6aa7ddbcd1a961333

SHA1
51b791431aa446149a71a90c109abeafe3ccff64

SHA256
52c51e2768371b2e1926a3093dcdf71fb3af19e682a2fa2f7092f163c3029b30

SHA512
0e57b271d22e3db6da403d2b2df2c931dc65110204b618295c93ca301a6e61c27d0ae714a2056185ca15c11c53bb1a7c63989ae837c94c3a3f36e4fa1a400dec

Download Submit
C:\Windows\System\vatikix.exe

Filesize
2.8MB

MD5
5f2f2447ecdf77abbc3525faac1c8ed1

SHA1
e35604701d006775cb75bb2393c99e5107aec036

SHA256
969dd64415ae4816d7daf207fb8a236702eaea2c917c60ab8c58e7befda9f614

SHA512
2aca343a2c5909ef13991befd7ec5075d87a848645325dbed3cc6b7a5507665ef84ab7a4ed1c65927094bbc4193174e5837b6ff9d0a6d15744a32cf2841beaf2

Download Submit
C:\Windows\System\vgQNVck.exe

Filesize
2.8MB

MD5
05611cffb18ed0a4b3bdf7f4ca32af0c

SHA1
fa743000a125fe0a214ba56b8ac388e7154c1094

SHA256
e86915f8e2bc63998e05c7feaa4828fb34d8c8a524883ba563e8e883ca3f6252

SHA512
4c2432efb0f9316470e454dc07574f39a0d0016dcb026f758b87dde905c76a7115e39002bb27c91dfa82584a0c134c652d1316a403fa9e765fb76e01bb7689d1

Download Submit
C:\Windows\System\znTTMht.exe

Filesize
2.8MB

MD5
7b492f76c70eabb1db416d84ed85299f

SHA1
f455a60b8c626701fa2e14d00e003d7c8e89bac4

SHA256
6c9988de4ec7153f0230d2dba14b210d0271a5092a9e9ff71bf5535eef03c48b

SHA512
7fafef91ccf10413744ded553323a70d9a04efb0b59411101a1a2faf8a93bb55168e215346d0448bb39b2fdb47eb43bb3352ffadae2aec0d8e5ffa3242099660

Download Submit
memory/560-2095-0x00007FF7D42B0000-0x00007FF7D46A6000-memory.dmp

Filesize
4.0MB

Download
memory/560-734-0x00007FF7D42B0000-0x00007FF7D46A6000-memory.dmp

Filesize
4.0MB

Download
memory/716-2102-0x00007FF6949F0000-0x00007FF694DE6000-memory.dmp

Filesize
4.0MB

Download
memory/716-674-0x00007FF6949F0000-0x00007FF694DE6000-memory.dmp

Filesize
4.0MB

Download
memory/1588-676-0x00007FF657210000-0x00007FF657606000-memory.dmp

Filesize
4.0MB

Download
memory/1588-2100-0x00007FF657210000-0x00007FF657606000-memory.dmp

Filesize
4.0MB

Download
memory/1608-679-0x00007FF7D7C50000-0x00007FF7D8046000-memory.dmp

Filesize
4.0MB

Download
memory/1608-2107-0x00007FF7D7C50000-0x00007FF7D8046000-memory.dmp

Filesize
4.0MB

Download
memory/1676-60-0x00007FF61E510000-0x00007FF61E906000-memory.dmp

Filesize
4.0MB

Download
memory/1676-2094-0x00007FF61E510000-0x00007FF61E906000-memory.dmp

Filesize
4.0MB

Download
memory/1720-2104-0x00007FF60BC00000-0x00007FF60BFF6000-memory.dmp

Filesize
4.0MB

Download
memory/1720-677-0x00007FF60BC00000-0x00007FF60BFF6000-memory.dmp

Filesize
4.0MB

Download
memory/1928-2113-0x00007FF61C9E0000-0x00007FF61CDD6000-memory.dmp

Filesize
4.0MB

Download
memory/1928-728-0x00007FF61C9E0000-0x00007FF61CDD6000-memory.dmp

Filesize
4.0MB

Download
memory/1948-1-0x0000022C12D80000-0x0000022C12D90000-memory.dmp

Filesize
64KB

Download
memory/1948-0-0x00007FF7A4B50000-0x00007FF7A4F46000-memory.dmp

Filesize
4.0MB

Download
memory/1964-700-0x00007FF69FAD0000-0x00007FF69FEC6000-memory.dmp

Filesize
4.0MB

Download
memory/1964-2105-0x00007FF69FAD0000-0x00007FF69FEC6000-memory.dmp

Filesize
4.0MB

Download
memory/2400-2103-0x00007FF6BD830000-0x00007FF6BDC26000-memory.dmp

Filesize
4.0MB

Download
memory/2400-673-0x00007FF6BD830000-0x00007FF6BDC26000-memory.dmp

Filesize
4.0MB

Download
memory/2528-2097-0x00007FF765A10000-0x00007FF765E06000-memory.dmp

Filesize
4.0MB

Download
memory/2528-65-0x00007FF765A10000-0x00007FF765E06000-memory.dmp

Filesize
4.0MB

Download
memory/2528-2089-0x00007FF765A10000-0x00007FF765E06000-memory.dmp

Filesize
4.0MB

Download
memory/2708-672-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp

Filesize
4.0MB

Download
memory/2708-2088-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp

Filesize
4.0MB

Download
memory/2708-2098-0x00007FF6197B0000-0x00007FF619BA6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-12-0x00007FF7B8D60000-0x00007FF7B9156000-memory.dmp

Filesize
4.0MB

Download
memory/2728-2090-0x00007FF7B8D60000-0x00007FF7B9156000-memory.dmp

Filesize
4.0MB

Download
memory/2784-2096-0x00007FF75CF80000-0x00007FF75D376000-memory.dmp

Filesize
4.0MB

Download
memory/2784-740-0x00007FF75CF80000-0x00007FF75D376000-memory.dmp

Filesize
4.0MB

Download
memory/2964-2112-0x00007FF76B730000-0x00007FF76BB26000-memory.dmp

Filesize
4.0MB

Download
memory/2964-722-0x00007FF76B730000-0x00007FF76BB26000-memory.dmp

Filesize
4.0MB

Download
memory/3020-675-0x00007FF740160000-0x00007FF740556000-memory.dmp

Filesize
4.0MB

Download
memory/3020-2101-0x00007FF740160000-0x00007FF740556000-memory.dmp

Filesize
4.0MB

Download
memory/3524-2091-0x00007FF704B20000-0x00007FF704F16000-memory.dmp

Filesize
4.0MB

Download
memory/3524-44-0x00007FF704B20000-0x00007FF704F16000-memory.dmp

Filesize
4.0MB

Download
memory/4016-2099-0x00007FF690F70000-0x00007FF691366000-memory.dmp

Filesize
4.0MB

Download
memory/4016-747-0x00007FF690F70000-0x00007FF691366000-memory.dmp

Filesize
4.0MB

Download
memory/4056-707-0x00007FF7F4C50000-0x00007FF7F5046000-memory.dmp

Filesize
4.0MB

Download
memory/4056-2109-0x00007FF7F4C50000-0x00007FF7F5046000-memory.dmp

Filesize
4.0MB

Download
memory/4252-691-0x00007FF682F80000-0x00007FF683376000-memory.dmp

Filesize
4.0MB

Download
memory/4252-2106-0x00007FF682F80000-0x00007FF683376000-memory.dmp

Filesize
4.0MB

Download
memory/4384-23-0x00007FFF4ABA0000-0x00007FFF4B661000-memory.dmp

Filesize
10.8MB

Download
memory/4384-5-0x00007FFF4ABA3000-0x00007FFF4ABA5000-memory.dmp

Filesize
8KB

Download
memory/4384-37-0x000001CC70590000-0x000001CC705B2000-memory.dmp

Filesize
136KB

Download
memory/4568-688-0x00007FF7187F0000-0x00007FF718BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4568-2108-0x00007FF7187F0000-0x00007FF718BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4656-53-0x00007FF61FD00000-0x00007FF6200F6000-memory.dmp

Filesize
4.0MB

Download
memory/4656-2092-0x00007FF61FD00000-0x00007FF6200F6000-memory.dmp

Filesize
4.0MB

Download
memory/4848-2111-0x00007FF643AC0000-0x00007FF643EB6000-memory.dmp

Filesize
4.0MB

Download
memory/4848-678-0x00007FF643AC0000-0x00007FF643EB6000-memory.dmp

Filesize
4.0MB

Download
memory/4876-40-0x00007FF697000000-0x00007FF6973F6000-memory.dmp

Filesize
4.0MB

Download
memory/4876-2093-0x00007FF697000000-0x00007FF6973F6000-memory.dmp

Filesize
4.0MB

Download
memory/5056-2110-0x00007FF657B80000-0x00007FF657F76000-memory.dmp

Filesize
4.0MB

Download
memory/5056-714-0x00007FF657B80000-0x00007FF657F76000-memory.dmp

Filesize
4.0MB

Download