xmrig | 3a1a9f23f943e677d99dc03fff280c6a3968d9fb523f5ca8ff46f6794d5cfb60

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
Size

1.5MB
MD5

c99450738a5bbdc656f9b34cc3297ad0
SHA1

14b4c34c219f74ab807f818af995ab08e5c34f6a
SHA256

3a1a9f23f943e677d99dc03fff280c6a3968d9fb523f5ca8ff46f6794d5cfb60
SHA512

8d386e679f0f609ba9910caf34bee8d18ef2c9c570cb93661ac481113bb3bcfc526073dba782b02085240895b34bd6803071c2516e74e958969c2761f13a2cc7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkiptb8q33F1QeQthKJAgY866bRS14:Lz071uv4BPMkivwSbakfn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1500-75-0x00007FF69D3F0000-0x00007FF69D7E2000-memory.dmp	xmrig
behavioral2/memory/2756-80-0x00007FF780D30000-0x00007FF781122000-memory.dmp	xmrig
behavioral2/memory/4800-131-0x00007FF70E710000-0x00007FF70EB02000-memory.dmp	xmrig
behavioral2/memory/1968-132-0x00007FF71B740000-0x00007FF71BB32000-memory.dmp	xmrig
behavioral2/memory/2316-130-0x00007FF67D680000-0x00007FF67DA72000-memory.dmp	xmrig
behavioral2/memory/3704-128-0x00007FF6A9090000-0x00007FF6A9482000-memory.dmp	xmrig
behavioral2/memory/3984-125-0x00007FF67CEB0000-0x00007FF67D2A2000-memory.dmp	xmrig
behavioral2/memory/2100-119-0x00007FF7E5F90000-0x00007FF7E6382000-memory.dmp	xmrig
behavioral2/memory/2200-118-0x00007FF685AC0000-0x00007FF685EB2000-memory.dmp	xmrig
behavioral2/memory/1444-105-0x00007FF71A040000-0x00007FF71A432000-memory.dmp	xmrig
behavioral2/memory/3624-98-0x00007FF7C5B10000-0x00007FF7C5F02000-memory.dmp	xmrig
behavioral2/memory/3968-91-0x00007FF6D83E0000-0x00007FF6D87D2000-memory.dmp	xmrig
behavioral2/memory/4276-90-0x00007FF68BAF0000-0x00007FF68BEE2000-memory.dmp	xmrig
behavioral2/memory/64-86-0x00007FF731260000-0x00007FF731652000-memory.dmp	xmrig
behavioral2/memory/4976-81-0x00007FF766A20000-0x00007FF766E12000-memory.dmp	xmrig
behavioral2/memory/412-204-0x00007FF629520000-0x00007FF629912000-memory.dmp	xmrig
behavioral2/memory/3428-174-0x00007FF749710000-0x00007FF749B02000-memory.dmp	xmrig
behavioral2/memory/3620-157-0x00007FF6DEED0000-0x00007FF6DF2C2000-memory.dmp	xmrig
behavioral2/memory/1120-1957-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp	xmrig
behavioral2/memory/4732-1959-0x00007FF647140000-0x00007FF647532000-memory.dmp	xmrig
behavioral2/memory/1152-1960-0x00007FF601C80000-0x00007FF602072000-memory.dmp	xmrig
behavioral2/memory/892-1961-0x00007FF631620000-0x00007FF631A12000-memory.dmp	xmrig
behavioral2/memory/4616-1983-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp	xmrig
behavioral2/memory/4756-2007-0x00007FF6225E0000-0x00007FF6229D2000-memory.dmp	xmrig
behavioral2/memory/2200-2009-0x00007FF685AC0000-0x00007FF685EB2000-memory.dmp	xmrig
behavioral2/memory/1120-2011-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp	xmrig
behavioral2/memory/1500-2013-0x00007FF69D3F0000-0x00007FF69D7E2000-memory.dmp	xmrig
behavioral2/memory/2100-2015-0x00007FF7E5F90000-0x00007FF7E6382000-memory.dmp	xmrig
behavioral2/memory/4976-2019-0x00007FF766A20000-0x00007FF766E12000-memory.dmp	xmrig
behavioral2/memory/64-2018-0x00007FF731260000-0x00007FF731652000-memory.dmp	xmrig
behavioral2/memory/4276-2022-0x00007FF68BAF0000-0x00007FF68BEE2000-memory.dmp	xmrig
behavioral2/memory/2756-2023-0x00007FF780D30000-0x00007FF781122000-memory.dmp	xmrig
behavioral2/memory/3968-2025-0x00007FF6D83E0000-0x00007FF6D87D2000-memory.dmp	xmrig
behavioral2/memory/3624-2029-0x00007FF7C5B10000-0x00007FF7C5F02000-memory.dmp	xmrig
behavioral2/memory/1444-2027-0x00007FF71A040000-0x00007FF71A432000-memory.dmp	xmrig
behavioral2/memory/3704-2033-0x00007FF6A9090000-0x00007FF6A9482000-memory.dmp	xmrig
behavioral2/memory/3984-2032-0x00007FF67CEB0000-0x00007FF67D2A2000-memory.dmp	xmrig
behavioral2/memory/2316-2035-0x00007FF67D680000-0x00007FF67DA72000-memory.dmp	xmrig
behavioral2/memory/4800-2037-0x00007FF70E710000-0x00007FF70EB02000-memory.dmp	xmrig
behavioral2/memory/4732-2046-0x00007FF647140000-0x00007FF647532000-memory.dmp	xmrig
behavioral2/memory/892-2062-0x00007FF631620000-0x00007FF631A12000-memory.dmp	xmrig
behavioral2/memory/1968-2064-0x00007FF71B740000-0x00007FF71BB32000-memory.dmp	xmrig
behavioral2/memory/1152-2066-0x00007FF601C80000-0x00007FF602072000-memory.dmp	xmrig
behavioral2/memory/4616-2068-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp	xmrig
behavioral2/memory/3620-2070-0x00007FF6DEED0000-0x00007FF6DF2C2000-memory.dmp	xmrig
behavioral2/memory/3428-2072-0x00007FF749710000-0x00007FF749B02000-memory.dmp	xmrig
behavioral2/memory/412-2076-0x00007FF629520000-0x00007FF629912000-memory.dmp	xmrig
behavioral2/memory/4756-2078-0x00007FF6225E0000-0x00007FF6229D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1860	powershell.exe
10	1860	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1860	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1120	noYybJe.exe
2200	CfhyXPY.exe
1500	lyQqyuD.exe
2100	qnCBato.exe
2756	ZCxKrkL.exe
4976	kAHSoWZ.exe
64	JZdALGg.exe
4276	evBwFwM.exe
3968	HUBhuZi.exe
3984	CnakWIn.exe
3624	kmiLQhf.exe
1444	QjPgfFO.exe
3704	DuGXaFg.exe
2316	SnamPac.exe
4800	cNwTLmo.exe
4732	fLKlRci.exe
1152	dweAJjr.exe
1968	YIdxbqI.exe
892	fALMZZn.exe
4616	qSWfjTM.exe
3620	JiPShew.exe
3428	UxfDvud.exe
412	xOfinLB.exe
4756	RBWvmYe.exe
4928	AoHKMBo.exe
1652	ULTYYZn.exe
3988	qaXMwui.exe
4316	MaqkFCT.exe
3236	rxDunFk.exe
3768	aTRnVko.exe
4004	RpixAYK.exe
1072	DBfCWJE.exe
4468	WSHaNBN.exe
1276	DCESGDF.exe
876	IEFrytF.exe
2616	BrKMwkq.exe
4180	phLzfMK.exe
4996	GfNPylr.exe
5108	YHGllSr.exe
5076	RphVIPc.exe
3544	dXYTJqs.exe
2380	okTfelU.exe
4524	BnvoqIG.exe
3376	pnJkvvj.exe
1820	qbUCAeu.exe
1980	ReiEfbT.exe
3276	xmDzjCD.exe
1744	JTxyqeC.exe
4948	mCACQUh.exe
4340	CJXDqNR.exe
2276	LQWIxQk.exe
4576	GUwNWPW.exe
4816	YRyoVEQ.exe
4284	tswvtXj.exe
1344	mVhvUhh.exe
2300	gBpefFa.exe
3488	xGjAUep.exe
3264	nAYCLjz.exe
208	dEZBmqe.exe
1528	lRguiwY.exe
4656	XUdCgtm.exe
380	miyMUnA.exe
400	RmQMFVx.exe
956	sSjFwFx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3720-0-0x00007FF670770000-0x00007FF670B62000-memory.dmp	upx
behavioral2/files/0x0007000000023447-8.dat	upx
behavioral2/files/0x0007000000023446-10.dat	upx
behavioral2/files/0x000a00000002342c-17.dat	upx
behavioral2/files/0x0007000000023448-18.dat	upx
behavioral2/files/0x000700000002344d-38.dat	upx
behavioral2/files/0x000700000002344e-44.dat	upx
behavioral2/files/0x000700000002344f-67.dat	upx
behavioral2/memory/1500-75-0x00007FF69D3F0000-0x00007FF69D7E2000-memory.dmp	upx
behavioral2/memory/2756-80-0x00007FF780D30000-0x00007FF781122000-memory.dmp	upx
behavioral2/files/0x0007000000023452-93.dat	upx
behavioral2/files/0x0009000000023443-101.dat	upx
behavioral2/files/0x0007000000023455-108.dat	upx
behavioral2/files/0x0007000000023454-116.dat	upx
behavioral2/files/0x0007000000023456-124.dat	upx
behavioral2/files/0x0007000000023457-126.dat	upx
behavioral2/memory/4800-131-0x00007FF70E710000-0x00007FF70EB02000-memory.dmp	upx
behavioral2/memory/4616-133-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp	upx
behavioral2/memory/1968-132-0x00007FF71B740000-0x00007FF71BB32000-memory.dmp	upx
behavioral2/memory/2316-130-0x00007FF67D680000-0x00007FF67DA72000-memory.dmp	upx
behavioral2/memory/3704-128-0x00007FF6A9090000-0x00007FF6A9482000-memory.dmp	upx
behavioral2/memory/3984-125-0x00007FF67CEB0000-0x00007FF67D2A2000-memory.dmp	upx
behavioral2/memory/2100-119-0x00007FF7E5F90000-0x00007FF7E6382000-memory.dmp	upx
behavioral2/memory/2200-118-0x00007FF685AC0000-0x00007FF685EB2000-memory.dmp	upx
behavioral2/memory/892-115-0x00007FF631620000-0x00007FF631A12000-memory.dmp	upx
behavioral2/memory/1152-114-0x00007FF601C80000-0x00007FF602072000-memory.dmp	upx
behavioral2/files/0x0007000000023453-111.dat	upx
behavioral2/memory/4732-110-0x00007FF647140000-0x00007FF647532000-memory.dmp	upx
behavioral2/memory/1444-105-0x00007FF71A040000-0x00007FF71A432000-memory.dmp	upx
behavioral2/memory/3624-98-0x00007FF7C5B10000-0x00007FF7C5F02000-memory.dmp	upx
behavioral2/memory/3968-91-0x00007FF6D83E0000-0x00007FF6D87D2000-memory.dmp	upx
behavioral2/files/0x0007000000023458-140.dat	upx
behavioral2/memory/4276-90-0x00007FF68BAF0000-0x00007FF68BEE2000-memory.dmp	upx
behavioral2/files/0x000800000002344a-88.dat	upx
behavioral2/memory/64-86-0x00007FF731260000-0x00007FF731652000-memory.dmp	upx
behavioral2/memory/4976-81-0x00007FF766A20000-0x00007FF766E12000-memory.dmp	upx
behavioral2/files/0x000700000002345c-160.dat	upx
behavioral2/files/0x0007000000023460-171.dat	upx
behavioral2/files/0x0007000000023463-198.dat	upx
behavioral2/memory/412-204-0x00007FF629520000-0x00007FF629912000-memory.dmp	upx
behavioral2/files/0x0007000000023465-202.dat	upx
behavioral2/files/0x0007000000023464-199.dat	upx
behavioral2/files/0x0007000000023462-194.dat	upx
behavioral2/files/0x0007000000023461-193.dat	upx
behavioral2/files/0x000700000002345e-185.dat	upx
behavioral2/files/0x000700000002345d-183.dat	upx
behavioral2/files/0x000700000002345b-177.dat	upx
behavioral2/memory/3428-174-0x00007FF749710000-0x00007FF749B02000-memory.dmp	upx
behavioral2/files/0x000700000002345f-170.dat	upx
behavioral2/files/0x000700000002345a-175.dat	upx
behavioral2/memory/4756-166-0x00007FF6225E0000-0x00007FF6229D2000-memory.dmp	upx
behavioral2/memory/3620-157-0x00007FF6DEED0000-0x00007FF6DF2C2000-memory.dmp	upx
behavioral2/files/0x0007000000023459-154.dat	upx
behavioral2/files/0x0007000000023451-82.dat	upx
behavioral2/files/0x0007000000023450-77.dat	upx
behavioral2/files/0x000800000002344b-71.dat	upx
behavioral2/files/0x000700000002344c-55.dat	upx
behavioral2/files/0x0007000000023449-46.dat	upx
behavioral2/memory/1120-14-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp	upx
behavioral2/memory/1120-1957-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp	upx
behavioral2/memory/4732-1959-0x00007FF647140000-0x00007FF647532000-memory.dmp	upx
behavioral2/memory/1152-1960-0x00007FF601C80000-0x00007FF602072000-memory.dmp	upx
behavioral2/memory/892-1961-0x00007FF631620000-0x00007FF631A12000-memory.dmp	upx
behavioral2/memory/4616-1983-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NuDxHXa.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\fEaxIcj.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\mpASLtY.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\pLxUnps.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\VlOWMgf.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\iRQMfcG.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\xcpahwB.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\WDDigWJ.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\JjaDMjb.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\hVCxgJD.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\hANpzqn.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\CnakWIn.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\DuGXaFg.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\bkFELQP.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\tGQfgEG.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\dIpTLvx.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\GUwNWPW.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\DFVVBvl.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\KFarPEV.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\mPEXADw.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\byrwwUL.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\iLHqCDF.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\poLsusf.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\LNzjSsF.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\hCbOTSS.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\RFxbDNq.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\BbINhVN.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\kVWZasy.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\cFIoHta.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\gmzgCob.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\UdCSvtz.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\xTOTXhm.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\feXCbIg.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\ckAcxlc.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\qePJGPK.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\KeuQdxm.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\pMJRmiB.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\YggpkAr.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\zAHxbtM.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\CTHiyRH.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\GMFOoDH.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\crrENQZ.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\rPWXGqZ.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\oYfpaPU.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\SvdBlYK.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\kTCvxUE.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\thFdqqE.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\zcYAJHZ.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\gPDzVux.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\yFhNcpI.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\yJghxvQ.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\hmXjjiH.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\PWcQOqD.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\mLwVDPO.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\qbUCAeu.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\xribvoA.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\HHSkYGd.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\QxZmwfl.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\QwLAUXt.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\CSyhlbI.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\yeWAeUp.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\iaHhxTe.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\KPynMSR.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
File created	C:\Windows\System\xqBVOoO.exe	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1860	powershell.exe
1860	powershell.exe
1860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1860	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1860	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	83
PID 3720 wrote to memory of 1860	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	83
PID 3720 wrote to memory of 1120	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	84
PID 3720 wrote to memory of 1120	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	84
PID 3720 wrote to memory of 2200	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	85
PID 3720 wrote to memory of 2200	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	85
PID 3720 wrote to memory of 2100	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	86
PID 3720 wrote to memory of 2100	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	86
PID 3720 wrote to memory of 1500	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	87
PID 3720 wrote to memory of 1500	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	87
PID 3720 wrote to memory of 2756	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	88
PID 3720 wrote to memory of 2756	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	88
PID 3720 wrote to memory of 4976	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	90
PID 3720 wrote to memory of 4976	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	90
PID 3720 wrote to memory of 64	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	91
PID 3720 wrote to memory of 64	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	91
PID 3720 wrote to memory of 4276	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	92
PID 3720 wrote to memory of 4276	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	92
PID 3720 wrote to memory of 3968	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	93
PID 3720 wrote to memory of 3968	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	93
PID 3720 wrote to memory of 3984	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	94
PID 3720 wrote to memory of 3984	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	94
PID 3720 wrote to memory of 3624	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	95
PID 3720 wrote to memory of 3624	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	95
PID 3720 wrote to memory of 1444	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	96
PID 3720 wrote to memory of 1444	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	96
PID 3720 wrote to memory of 3704	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	97
PID 3720 wrote to memory of 3704	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	97
PID 3720 wrote to memory of 2316	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	98
PID 3720 wrote to memory of 2316	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	98
PID 3720 wrote to memory of 4800	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	99
PID 3720 wrote to memory of 4800	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	99
PID 3720 wrote to memory of 4732	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	100
PID 3720 wrote to memory of 4732	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	100
PID 3720 wrote to memory of 1152	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	101
PID 3720 wrote to memory of 1152	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	101
PID 3720 wrote to memory of 1968	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	102
PID 3720 wrote to memory of 1968	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	102
PID 3720 wrote to memory of 892	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	103
PID 3720 wrote to memory of 892	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	103
PID 3720 wrote to memory of 4616	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	104
PID 3720 wrote to memory of 4616	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	104
PID 3720 wrote to memory of 3620	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	105
PID 3720 wrote to memory of 3620	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	105
PID 3720 wrote to memory of 3428	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	106
PID 3720 wrote to memory of 3428	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	106
PID 3720 wrote to memory of 412	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	107
PID 3720 wrote to memory of 412	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	107
PID 3720 wrote to memory of 4756	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	108
PID 3720 wrote to memory of 4756	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	108
PID 3720 wrote to memory of 4928	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	109
PID 3720 wrote to memory of 4928	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	109
PID 3720 wrote to memory of 1652	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	110
PID 3720 wrote to memory of 1652	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	110
PID 3720 wrote to memory of 3988	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	111
PID 3720 wrote to memory of 3988	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	111
PID 3720 wrote to memory of 4316	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	112
PID 3720 wrote to memory of 4316	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	112
PID 3720 wrote to memory of 3236	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	113
PID 3720 wrote to memory of 3236	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	113
PID 3720 wrote to memory of 3768	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	114
PID 3720 wrote to memory of 3768	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	114
PID 3720 wrote to memory of 4004	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	115
PID 3720 wrote to memory of 4004	3720	c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c99450738a5bbdc656f9b34cc3297ad0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1860" "2952" "2884" "2956" "0" "0" "2960" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:624
- C:\Windows\System\noYybJe.exe
  C:\Windows\System\noYybJe.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\CfhyXPY.exe
  C:\Windows\System\CfhyXPY.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\qnCBato.exe
  C:\Windows\System\qnCBato.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\lyQqyuD.exe
  C:\Windows\System\lyQqyuD.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ZCxKrkL.exe
  C:\Windows\System\ZCxKrkL.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\kAHSoWZ.exe
  C:\Windows\System\kAHSoWZ.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\JZdALGg.exe
  C:\Windows\System\JZdALGg.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\evBwFwM.exe
  C:\Windows\System\evBwFwM.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\HUBhuZi.exe
  C:\Windows\System\HUBhuZi.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\CnakWIn.exe
  C:\Windows\System\CnakWIn.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\kmiLQhf.exe
  C:\Windows\System\kmiLQhf.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\QjPgfFO.exe
  C:\Windows\System\QjPgfFO.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\DuGXaFg.exe
  C:\Windows\System\DuGXaFg.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\SnamPac.exe
  C:\Windows\System\SnamPac.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\cNwTLmo.exe
  C:\Windows\System\cNwTLmo.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\fLKlRci.exe
  C:\Windows\System\fLKlRci.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\dweAJjr.exe
  C:\Windows\System\dweAJjr.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\YIdxbqI.exe
  C:\Windows\System\YIdxbqI.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\fALMZZn.exe
  C:\Windows\System\fALMZZn.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\qSWfjTM.exe
  C:\Windows\System\qSWfjTM.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\JiPShew.exe
  C:\Windows\System\JiPShew.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\UxfDvud.exe
  C:\Windows\System\UxfDvud.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\xOfinLB.exe
  C:\Windows\System\xOfinLB.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\RBWvmYe.exe
  C:\Windows\System\RBWvmYe.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\AoHKMBo.exe
  C:\Windows\System\AoHKMBo.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\ULTYYZn.exe
  C:\Windows\System\ULTYYZn.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\qaXMwui.exe
  C:\Windows\System\qaXMwui.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\MaqkFCT.exe
  C:\Windows\System\MaqkFCT.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\rxDunFk.exe
  C:\Windows\System\rxDunFk.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\aTRnVko.exe
  C:\Windows\System\aTRnVko.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\RpixAYK.exe
  C:\Windows\System\RpixAYK.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\DBfCWJE.exe
  C:\Windows\System\DBfCWJE.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\WSHaNBN.exe
  C:\Windows\System\WSHaNBN.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\DCESGDF.exe
  C:\Windows\System\DCESGDF.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\IEFrytF.exe
  C:\Windows\System\IEFrytF.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\BrKMwkq.exe
  C:\Windows\System\BrKMwkq.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\phLzfMK.exe
  C:\Windows\System\phLzfMK.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\GfNPylr.exe
  C:\Windows\System\GfNPylr.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\YHGllSr.exe
  C:\Windows\System\YHGllSr.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\RphVIPc.exe
  C:\Windows\System\RphVIPc.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\dXYTJqs.exe
  C:\Windows\System\dXYTJqs.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\okTfelU.exe
  C:\Windows\System\okTfelU.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\BnvoqIG.exe
  C:\Windows\System\BnvoqIG.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\pnJkvvj.exe
  C:\Windows\System\pnJkvvj.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\qbUCAeu.exe
  C:\Windows\System\qbUCAeu.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\ReiEfbT.exe
  C:\Windows\System\ReiEfbT.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\xmDzjCD.exe
  C:\Windows\System\xmDzjCD.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\JTxyqeC.exe
  C:\Windows\System\JTxyqeC.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\mCACQUh.exe
  C:\Windows\System\mCACQUh.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\CJXDqNR.exe
  C:\Windows\System\CJXDqNR.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\LQWIxQk.exe
  C:\Windows\System\LQWIxQk.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\GUwNWPW.exe
  C:\Windows\System\GUwNWPW.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\YRyoVEQ.exe
  C:\Windows\System\YRyoVEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\tswvtXj.exe
  C:\Windows\System\tswvtXj.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\mVhvUhh.exe
  C:\Windows\System\mVhvUhh.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\gBpefFa.exe
  C:\Windows\System\gBpefFa.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\xGjAUep.exe
  C:\Windows\System\xGjAUep.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\nAYCLjz.exe
  C:\Windows\System\nAYCLjz.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\dEZBmqe.exe
  C:\Windows\System\dEZBmqe.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\lRguiwY.exe
  C:\Windows\System\lRguiwY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\XUdCgtm.exe
  C:\Windows\System\XUdCgtm.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\miyMUnA.exe
  C:\Windows\System\miyMUnA.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\RmQMFVx.exe
  C:\Windows\System\RmQMFVx.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\sSjFwFx.exe
  C:\Windows\System\sSjFwFx.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\iyVoOgU.exe
  C:\Windows\System\iyVoOgU.exe
  2⤵
  PID:2988
- C:\Windows\System\raBRWtC.exe
  C:\Windows\System\raBRWtC.exe
  2⤵
  PID:4456
- C:\Windows\System\lSTpRDC.exe
  C:\Windows\System\lSTpRDC.exe
  2⤵
  PID:4872
- C:\Windows\System\MoTpwds.exe
  C:\Windows\System\MoTpwds.exe
  2⤵
  PID:3144
- C:\Windows\System\nyIYQVQ.exe
  C:\Windows\System\nyIYQVQ.exe
  2⤵
  PID:1040
- C:\Windows\System\inprWpl.exe
  C:\Windows\System\inprWpl.exe
  2⤵
  PID:3532
- C:\Windows\System\NWwIwaE.exe
  C:\Windows\System\NWwIwaE.exe
  2⤵
  PID:5044
- C:\Windows\System\YyOkQKa.exe
  C:\Windows\System\YyOkQKa.exe
  2⤵
  PID:516
- C:\Windows\System\DZQTENm.exe
  C:\Windows\System\DZQTENm.exe
  2⤵
  PID:3476
- C:\Windows\System\GmdKaMt.exe
  C:\Windows\System\GmdKaMt.exe
  2⤵
  PID:4136
- C:\Windows\System\jggACQR.exe
  C:\Windows\System\jggACQR.exe
  2⤵
  PID:2776
- C:\Windows\System\RHittof.exe
  C:\Windows\System\RHittof.exe
  2⤵
  PID:3548
- C:\Windows\System\EwaRJuh.exe
  C:\Windows\System\EwaRJuh.exe
  2⤵
  PID:860
- C:\Windows\System\DPuhCBi.exe
  C:\Windows\System\DPuhCBi.exe
  2⤵
  PID:5056
- C:\Windows\System\DrggcUN.exe
  C:\Windows\System\DrggcUN.exe
  2⤵
  PID:4012
- C:\Windows\System\bkFELQP.exe
  C:\Windows\System\bkFELQP.exe
  2⤵
  PID:428
- C:\Windows\System\oMDBQXZ.exe
  C:\Windows\System\oMDBQXZ.exe
  2⤵
  PID:1560
- C:\Windows\System\VgmyDQA.exe
  C:\Windows\System\VgmyDQA.exe
  2⤵
  PID:880
- C:\Windows\System\cCnXfcv.exe
  C:\Windows\System\cCnXfcv.exe
  2⤵
  PID:368
- C:\Windows\System\vxMHiNX.exe
  C:\Windows\System\vxMHiNX.exe
  2⤵
  PID:5084
- C:\Windows\System\KeuQdxm.exe
  C:\Windows\System\KeuQdxm.exe
  2⤵
  PID:4744
- C:\Windows\System\JmWHcOi.exe
  C:\Windows\System\JmWHcOi.exe
  2⤵
  PID:4396
- C:\Windows\System\lnHecNX.exe
  C:\Windows\System\lnHecNX.exe
  2⤵
  PID:2796
- C:\Windows\System\aNowEhe.exe
  C:\Windows\System\aNowEhe.exe
  2⤵
  PID:2460
- C:\Windows\System\QRADCiq.exe
  C:\Windows\System\QRADCiq.exe
  2⤵
  PID:5136
- C:\Windows\System\gIQgJqD.exe
  C:\Windows\System\gIQgJqD.exe
  2⤵
  PID:5164
- C:\Windows\System\GrHEDJP.exe
  C:\Windows\System\GrHEDJP.exe
  2⤵
  PID:5216
- C:\Windows\System\NuDxHXa.exe
  C:\Windows\System\NuDxHXa.exe
  2⤵
  PID:5232
- C:\Windows\System\ElYlmhX.exe
  C:\Windows\System\ElYlmhX.exe
  2⤵
  PID:5256
- C:\Windows\System\TjCOxgI.exe
  C:\Windows\System\TjCOxgI.exe
  2⤵
  PID:5276
- C:\Windows\System\epeQoXU.exe
  C:\Windows\System\epeQoXU.exe
  2⤵
  PID:5304
- C:\Windows\System\mWvyIHu.exe
  C:\Windows\System\mWvyIHu.exe
  2⤵
  PID:5336
- C:\Windows\System\lfuIRgm.exe
  C:\Windows\System\lfuIRgm.exe
  2⤵
  PID:5356
- C:\Windows\System\WCTCAes.exe
  C:\Windows\System\WCTCAes.exe
  2⤵
  PID:5376
- C:\Windows\System\BzazsEj.exe
  C:\Windows\System\BzazsEj.exe
  2⤵
  PID:5400
- C:\Windows\System\sosXnvG.exe
  C:\Windows\System\sosXnvG.exe
  2⤵
  PID:5416
- C:\Windows\System\GqQzkTm.exe
  C:\Windows\System\GqQzkTm.exe
  2⤵
  PID:5436
- C:\Windows\System\cYJEJRm.exe
  C:\Windows\System\cYJEJRm.exe
  2⤵
  PID:5452
- C:\Windows\System\qlZWMod.exe
  C:\Windows\System\qlZWMod.exe
  2⤵
  PID:5476
- C:\Windows\System\TQuFQdj.exe
  C:\Windows\System\TQuFQdj.exe
  2⤵
  PID:5492
- C:\Windows\System\bxJGacW.exe
  C:\Windows\System\bxJGacW.exe
  2⤵
  PID:5516
- C:\Windows\System\QWoDmoQ.exe
  C:\Windows\System\QWoDmoQ.exe
  2⤵
  PID:5540
- C:\Windows\System\fAMMsJP.exe
  C:\Windows\System\fAMMsJP.exe
  2⤵
  PID:5564
- C:\Windows\System\xptDQwy.exe
  C:\Windows\System\xptDQwy.exe
  2⤵
  PID:5588
- C:\Windows\System\AtHFlsA.exe
  C:\Windows\System\AtHFlsA.exe
  2⤵
  PID:5608
- C:\Windows\System\tLbxhUi.exe
  C:\Windows\System\tLbxhUi.exe
  2⤵
  PID:5664
- C:\Windows\System\kTCvxUE.exe
  C:\Windows\System\kTCvxUE.exe
  2⤵
  PID:5712
- C:\Windows\System\QynUpJh.exe
  C:\Windows\System\QynUpJh.exe
  2⤵
  PID:5736
- C:\Windows\System\tGQfgEG.exe
  C:\Windows\System\tGQfgEG.exe
  2⤵
  PID:5756
- C:\Windows\System\FaHEoUB.exe
  C:\Windows\System\FaHEoUB.exe
  2⤵
  PID:5784
- C:\Windows\System\hCqIuNd.exe
  C:\Windows\System\hCqIuNd.exe
  2⤵
  PID:5804
- C:\Windows\System\DBsEPty.exe
  C:\Windows\System\DBsEPty.exe
  2⤵
  PID:5828
- C:\Windows\System\bHfNyqp.exe
  C:\Windows\System\bHfNyqp.exe
  2⤵
  PID:5848
- C:\Windows\System\GMFOoDH.exe
  C:\Windows\System\GMFOoDH.exe
  2⤵
  PID:5864
- C:\Windows\System\wHavwtd.exe
  C:\Windows\System\wHavwtd.exe
  2⤵
  PID:5888
- C:\Windows\System\HpnfAHO.exe
  C:\Windows\System\HpnfAHO.exe
  2⤵
  PID:5952
- C:\Windows\System\UQgjGOV.exe
  C:\Windows\System\UQgjGOV.exe
  2⤵
  PID:5984
- C:\Windows\System\jrnhoCq.exe
  C:\Windows\System\jrnhoCq.exe
  2⤵
  PID:6012
- C:\Windows\System\crrENQZ.exe
  C:\Windows\System\crrENQZ.exe
  2⤵
  PID:6036
- C:\Windows\System\FiOwQXR.exe
  C:\Windows\System\FiOwQXR.exe
  2⤵
  PID:6140
- C:\Windows\System\VYtvZqh.exe
  C:\Windows\System\VYtvZqh.exe
  2⤵
  PID:1880
- C:\Windows\System\lDtNPlK.exe
  C:\Windows\System\lDtNPlK.exe
  2⤵
  PID:3424
- C:\Windows\System\iaHDrgT.exe
  C:\Windows\System\iaHDrgT.exe
  2⤵
  PID:5156
- C:\Windows\System\txpzWTF.exe
  C:\Windows\System\txpzWTF.exe
  2⤵
  PID:5240
- C:\Windows\System\WmPeIko.exe
  C:\Windows\System\WmPeIko.exe
  2⤵
  PID:5224
- C:\Windows\System\TxNGNOe.exe
  C:\Windows\System\TxNGNOe.exe
  2⤵
  PID:5300
- C:\Windows\System\DFVVBvl.exe
  C:\Windows\System\DFVVBvl.exe
  2⤵
  PID:5460
- C:\Windows\System\zRMKoAw.exe
  C:\Windows\System\zRMKoAw.exe
  2⤵
  PID:3668
- C:\Windows\System\DKneGHL.exe
  C:\Windows\System\DKneGHL.exe
  2⤵
  PID:5528
- C:\Windows\System\wzxAmUw.exe
  C:\Windows\System\wzxAmUw.exe
  2⤵
  PID:5604
- C:\Windows\System\VJdejdk.exe
  C:\Windows\System\VJdejdk.exe
  2⤵
  PID:5560
- C:\Windows\System\UVfdatq.exe
  C:\Windows\System\UVfdatq.exe
  2⤵
  PID:5648
- C:\Windows\System\XYCrgYu.exe
  C:\Windows\System\XYCrgYu.exe
  2⤵
  PID:5652
- C:\Windows\System\pKMVquY.exe
  C:\Windows\System\pKMVquY.exe
  2⤵
  PID:5720
- C:\Windows\System\ZXOvUFV.exe
  C:\Windows\System\ZXOvUFV.exe
  2⤵
  PID:5916
- C:\Windows\System\eqzJBPU.exe
  C:\Windows\System\eqzJBPU.exe
  2⤵
  PID:5992
- C:\Windows\System\vDYtMhL.exe
  C:\Windows\System\vDYtMhL.exe
  2⤵
  PID:6028
- C:\Windows\System\ROMIsMT.exe
  C:\Windows\System\ROMIsMT.exe
  2⤵
  PID:6064
- C:\Windows\System\lnJPsim.exe
  C:\Windows\System\lnJPsim.exe
  2⤵
  PID:3232
- C:\Windows\System\pMJRmiB.exe
  C:\Windows\System\pMJRmiB.exe
  2⤵
  PID:5248
- C:\Windows\System\HLOdSbW.exe
  C:\Windows\System\HLOdSbW.exe
  2⤵
  PID:2720
- C:\Windows\System\VFLQawN.exe
  C:\Windows\System\VFLQawN.exe
  2⤵
  PID:5432
- C:\Windows\System\vAXfFqK.exe
  C:\Windows\System\vAXfFqK.exe
  2⤵
  PID:5764
- C:\Windows\System\zSHhUfC.exe
  C:\Windows\System\zSHhUfC.exe
  2⤵
  PID:5704
- C:\Windows\System\dxFXuqd.exe
  C:\Windows\System\dxFXuqd.exe
  2⤵
  PID:5844
- C:\Windows\System\KxiOIPO.exe
  C:\Windows\System\KxiOIPO.exe
  2⤵
  PID:5932
- C:\Windows\System\SyVUsek.exe
  C:\Windows\System\SyVUsek.exe
  2⤵
  PID:6156
- C:\Windows\System\WFyuLEr.exe
  C:\Windows\System\WFyuLEr.exe
  2⤵
  PID:6176
- C:\Windows\System\UHXcvgg.exe
  C:\Windows\System\UHXcvgg.exe
  2⤵
  PID:6200
- C:\Windows\System\sqdVGQl.exe
  C:\Windows\System\sqdVGQl.exe
  2⤵
  PID:6220
- C:\Windows\System\BMbZjPp.exe
  C:\Windows\System\BMbZjPp.exe
  2⤵
  PID:6240
- C:\Windows\System\XVBeoUh.exe
  C:\Windows\System\XVBeoUh.exe
  2⤵
  PID:6268
- C:\Windows\System\XAXXyjb.exe
  C:\Windows\System\XAXXyjb.exe
  2⤵
  PID:6288
- C:\Windows\System\tNNBXln.exe
  C:\Windows\System\tNNBXln.exe
  2⤵
  PID:6308
- C:\Windows\System\ckUPAmp.exe
  C:\Windows\System\ckUPAmp.exe
  2⤵
  PID:6328
- C:\Windows\System\yeWAeUp.exe
  C:\Windows\System\yeWAeUp.exe
  2⤵
  PID:6344
- C:\Windows\System\iaHhxTe.exe
  C:\Windows\System\iaHhxTe.exe
  2⤵
  PID:6372
- C:\Windows\System\LNzjSsF.exe
  C:\Windows\System\LNzjSsF.exe
  2⤵
  PID:6456
- C:\Windows\System\oWDMqJn.exe
  C:\Windows\System\oWDMqJn.exe
  2⤵
  PID:6532
- C:\Windows\System\lnjUQeu.exe
  C:\Windows\System\lnjUQeu.exe
  2⤵
  PID:6560
- C:\Windows\System\ZwBVXlH.exe
  C:\Windows\System\ZwBVXlH.exe
  2⤵
  PID:6580
- C:\Windows\System\usYUWUp.exe
  C:\Windows\System\usYUWUp.exe
  2⤵
  PID:6604
- C:\Windows\System\hCbOTSS.exe
  C:\Windows\System\hCbOTSS.exe
  2⤵
  PID:6640
- C:\Windows\System\FLXGBtT.exe
  C:\Windows\System\FLXGBtT.exe
  2⤵
  PID:6660
- C:\Windows\System\aeXkqZk.exe
  C:\Windows\System\aeXkqZk.exe
  2⤵
  PID:6680
- C:\Windows\System\WTFlLha.exe
  C:\Windows\System\WTFlLha.exe
  2⤵
  PID:6704
- C:\Windows\System\RNrBvty.exe
  C:\Windows\System\RNrBvty.exe
  2⤵
  PID:6776
- C:\Windows\System\lUztbph.exe
  C:\Windows\System\lUztbph.exe
  2⤵
  PID:6792
- C:\Windows\System\xwWheMr.exe
  C:\Windows\System\xwWheMr.exe
  2⤵
  PID:6864
- C:\Windows\System\BrpGqJN.exe
  C:\Windows\System\BrpGqJN.exe
  2⤵
  PID:6880
- C:\Windows\System\rPWXGqZ.exe
  C:\Windows\System\rPWXGqZ.exe
  2⤵
  PID:6900
- C:\Windows\System\hQkMIHn.exe
  C:\Windows\System\hQkMIHn.exe
  2⤵
  PID:6928
- C:\Windows\System\xribvoA.exe
  C:\Windows\System\xribvoA.exe
  2⤵
  PID:6952
- C:\Windows\System\aqwuSBD.exe
  C:\Windows\System\aqwuSBD.exe
  2⤵
  PID:6972
- C:\Windows\System\uQuAGjt.exe
  C:\Windows\System\uQuAGjt.exe
  2⤵
  PID:6992
- C:\Windows\System\olemGst.exe
  C:\Windows\System\olemGst.exe
  2⤵
  PID:7020
- C:\Windows\System\GVQiLKn.exe
  C:\Windows\System\GVQiLKn.exe
  2⤵
  PID:7044
- C:\Windows\System\vGsJBgT.exe
  C:\Windows\System\vGsJBgT.exe
  2⤵
  PID:7116
- C:\Windows\System\LrlrHZg.exe
  C:\Windows\System\LrlrHZg.exe
  2⤵
  PID:7140
- C:\Windows\System\shZyVzo.exe
  C:\Windows\System\shZyVzo.exe
  2⤵
  PID:7160
- C:\Windows\System\rTghSpl.exe
  C:\Windows\System\rTghSpl.exe
  2⤵
  PID:6088
- C:\Windows\System\KHqhScr.exe
  C:\Windows\System\KHqhScr.exe
  2⤵
  PID:5816
- C:\Windows\System\CWMDllG.exe
  C:\Windows\System\CWMDllG.exe
  2⤵
  PID:6152
- C:\Windows\System\lSVSQOd.exe
  C:\Windows\System\lSVSQOd.exe
  2⤵
  PID:6236
- C:\Windows\System\VrEoLRq.exe
  C:\Windows\System\VrEoLRq.exe
  2⤵
  PID:3876
- C:\Windows\System\NnYJtMb.exe
  C:\Windows\System\NnYJtMb.exe
  2⤵
  PID:6212
- C:\Windows\System\YYIFDjo.exe
  C:\Windows\System\YYIFDjo.exe
  2⤵
  PID:6284
- C:\Windows\System\JjaDMjb.exe
  C:\Windows\System\JjaDMjb.exe
  2⤵
  PID:6320
- C:\Windows\System\foHnYTR.exe
  C:\Windows\System\foHnYTR.exe
  2⤵
  PID:6416
- C:\Windows\System\mVYkxkw.exe
  C:\Windows\System\mVYkxkw.exe
  2⤵
  PID:6524
- C:\Windows\System\XoWHqFN.exe
  C:\Windows\System\XoWHqFN.exe
  2⤵
  PID:6592
- C:\Windows\System\kDmLnkw.exe
  C:\Windows\System\kDmLnkw.exe
  2⤵
  PID:6500
- C:\Windows\System\GeqGVET.exe
  C:\Windows\System\GeqGVET.exe
  2⤵
  PID:6788
- C:\Windows\System\XKabVYi.exe
  C:\Windows\System\XKabVYi.exe
  2⤵
  PID:6844
- C:\Windows\System\iTfUIFn.exe
  C:\Windows\System\iTfUIFn.exe
  2⤵
  PID:6896
- C:\Windows\System\fQkfaiz.exe
  C:\Windows\System\fQkfaiz.exe
  2⤵
  PID:6936
- C:\Windows\System\wdpjHIS.exe
  C:\Windows\System\wdpjHIS.exe
  2⤵
  PID:7012
- C:\Windows\System\CGjBvOR.exe
  C:\Windows\System\CGjBvOR.exe
  2⤵
  PID:7112
- C:\Windows\System\aqYbHkP.exe
  C:\Windows\System\aqYbHkP.exe
  2⤵
  PID:6060
- C:\Windows\System\IDeRMiU.exe
  C:\Windows\System\IDeRMiU.exe
  2⤵
  PID:5752
- C:\Windows\System\ZZveQRE.exe
  C:\Windows\System\ZZveQRE.exe
  2⤵
  PID:6336
- C:\Windows\System\XHPicbI.exe
  C:\Windows\System\XHPicbI.exe
  2⤵
  PID:6304
- C:\Windows\System\pBZSOAq.exe
  C:\Windows\System\pBZSOAq.exe
  2⤵
  PID:6528
- C:\Windows\System\uhofCvV.exe
  C:\Windows\System\uhofCvV.exe
  2⤵
  PID:6624
- C:\Windows\System\XgaxKIv.exe
  C:\Windows\System\XgaxKIv.exe
  2⤵
  PID:6616
- C:\Windows\System\bBjzfWY.exe
  C:\Windows\System\bBjzfWY.exe
  2⤵
  PID:6876
- C:\Windows\System\xWbgklC.exe
  C:\Windows\System\xWbgklC.exe
  2⤵
  PID:6980
- C:\Windows\System\thLXoed.exe
  C:\Windows\System\thLXoed.exe
  2⤵
  PID:7152
- C:\Windows\System\ahsrcFe.exe
  C:\Windows\System\ahsrcFe.exe
  2⤵
  PID:6324
- C:\Windows\System\deLsivJ.exe
  C:\Windows\System\deLsivJ.exe
  2⤵
  PID:6276
- C:\Windows\System\PnZpaAp.exe
  C:\Windows\System\PnZpaAp.exe
  2⤵
  PID:6736
- C:\Windows\System\NJbOSNx.exe
  C:\Windows\System\NJbOSNx.exe
  2⤵
  PID:6856
- C:\Windows\System\ioXrLKx.exe
  C:\Windows\System\ioXrLKx.exe
  2⤵
  PID:7172
- C:\Windows\System\hnOLRRk.exe
  C:\Windows\System\hnOLRRk.exe
  2⤵
  PID:7188
- C:\Windows\System\KxvHLmp.exe
  C:\Windows\System\KxvHLmp.exe
  2⤵
  PID:7224
- C:\Windows\System\hVCxgJD.exe
  C:\Windows\System\hVCxgJD.exe
  2⤵
  PID:7244
- C:\Windows\System\oYfpaPU.exe
  C:\Windows\System\oYfpaPU.exe
  2⤵
  PID:7268
- C:\Windows\System\TdSWUem.exe
  C:\Windows\System\TdSWUem.exe
  2⤵
  PID:7340
- C:\Windows\System\vlwgJln.exe
  C:\Windows\System\vlwgJln.exe
  2⤵
  PID:7380
- C:\Windows\System\CXtGRPV.exe
  C:\Windows\System\CXtGRPV.exe
  2⤵
  PID:7428
- C:\Windows\System\fPuWGfr.exe
  C:\Windows\System\fPuWGfr.exe
  2⤵
  PID:7444
- C:\Windows\System\fEaxIcj.exe
  C:\Windows\System\fEaxIcj.exe
  2⤵
  PID:7468
- C:\Windows\System\yekfxQI.exe
  C:\Windows\System\yekfxQI.exe
  2⤵
  PID:7488
- C:\Windows\System\dxURwRK.exe
  C:\Windows\System\dxURwRK.exe
  2⤵
  PID:7512
- C:\Windows\System\YeSLlxb.exe
  C:\Windows\System\YeSLlxb.exe
  2⤵
  PID:7552
- C:\Windows\System\BmwQWUs.exe
  C:\Windows\System\BmwQWUs.exe
  2⤵
  PID:7580
- C:\Windows\System\EgySHAf.exe
  C:\Windows\System\EgySHAf.exe
  2⤵
  PID:7632
- C:\Windows\System\JWPxfcl.exe
  C:\Windows\System\JWPxfcl.exe
  2⤵
  PID:7668
- C:\Windows\System\uUbFsDt.exe
  C:\Windows\System\uUbFsDt.exe
  2⤵
  PID:7696
- C:\Windows\System\GBlLoIK.exe
  C:\Windows\System\GBlLoIK.exe
  2⤵
  PID:7732
- C:\Windows\System\wyHfSHS.exe
  C:\Windows\System\wyHfSHS.exe
  2⤵
  PID:7752
- C:\Windows\System\NWnmCCX.exe
  C:\Windows\System\NWnmCCX.exe
  2⤵
  PID:7772
- C:\Windows\System\AnULxFl.exe
  C:\Windows\System\AnULxFl.exe
  2⤵
  PID:7792
- C:\Windows\System\thFdqqE.exe
  C:\Windows\System\thFdqqE.exe
  2⤵
  PID:7832
- C:\Windows\System\HgIVikl.exe
  C:\Windows\System\HgIVikl.exe
  2⤵
  PID:7856
- C:\Windows\System\KHNEkWW.exe
  C:\Windows\System\KHNEkWW.exe
  2⤵
  PID:7876
- C:\Windows\System\JrBKZdF.exe
  C:\Windows\System\JrBKZdF.exe
  2⤵
  PID:7908
- C:\Windows\System\VyEGNMD.exe
  C:\Windows\System\VyEGNMD.exe
  2⤵
  PID:7924
- C:\Windows\System\dmCqcEB.exe
  C:\Windows\System\dmCqcEB.exe
  2⤵
  PID:7948
- C:\Windows\System\CvCgMqH.exe
  C:\Windows\System\CvCgMqH.exe
  2⤵
  PID:7964
- C:\Windows\System\WvddlAi.exe
  C:\Windows\System\WvddlAi.exe
  2⤵
  PID:7988
- C:\Windows\System\OusLQJe.exe
  C:\Windows\System\OusLQJe.exe
  2⤵
  PID:8052
- C:\Windows\System\SluuMZL.exe
  C:\Windows\System\SluuMZL.exe
  2⤵
  PID:8080
- C:\Windows\System\UdCSvtz.exe
  C:\Windows\System\UdCSvtz.exe
  2⤵
  PID:8100
- C:\Windows\System\uhdixdY.exe
  C:\Windows\System\uhdixdY.exe
  2⤵
  PID:8124
- C:\Windows\System\DrgGlsx.exe
  C:\Windows\System\DrgGlsx.exe
  2⤵
  PID:8184
- C:\Windows\System\eNyUqnF.exe
  C:\Windows\System\eNyUqnF.exe
  2⤵
  PID:6812
- C:\Windows\System\xTOTXhm.exe
  C:\Windows\System\xTOTXhm.exe
  2⤵
  PID:7264
- C:\Windows\System\gPDzVux.exe
  C:\Windows\System\gPDzVux.exe
  2⤵
  PID:7208
- C:\Windows\System\SwugFfn.exe
  C:\Windows\System\SwugFfn.exe
  2⤵
  PID:7320
- C:\Windows\System\HkzSyeB.exe
  C:\Windows\System\HkzSyeB.exe
  2⤵
  PID:7476
- C:\Windows\System\QyfAvdP.exe
  C:\Windows\System\QyfAvdP.exe
  2⤵
  PID:7440
- C:\Windows\System\dIpTLvx.exe
  C:\Windows\System\dIpTLvx.exe
  2⤵
  PID:7544
- C:\Windows\System\zwDbitP.exe
  C:\Windows\System\zwDbitP.exe
  2⤵
  PID:7688
- C:\Windows\System\CzqywxT.exe
  C:\Windows\System\CzqywxT.exe
  2⤵
  PID:7768
- C:\Windows\System\hkOzcrb.exe
  C:\Windows\System\hkOzcrb.exe
  2⤵
  PID:7864
- C:\Windows\System\fiVEUnl.exe
  C:\Windows\System\fiVEUnl.exe
  2⤵
  PID:7916
- C:\Windows\System\OLVGuwZ.exe
  C:\Windows\System\OLVGuwZ.exe
  2⤵
  PID:7956
- C:\Windows\System\YqbYsBm.exe
  C:\Windows\System\YqbYsBm.exe
  2⤵
  PID:7976
- C:\Windows\System\UHcqeiu.exe
  C:\Windows\System\UHcqeiu.exe
  2⤵
  PID:8044
- C:\Windows\System\GpVCdcR.exe
  C:\Windows\System\GpVCdcR.exe
  2⤵
  PID:8120
- C:\Windows\System\uxpvpZs.exe
  C:\Windows\System\uxpvpZs.exe
  2⤵
  PID:6964
- C:\Windows\System\RFxbDNq.exe
  C:\Windows\System\RFxbDNq.exe
  2⤵
  PID:7300
- C:\Windows\System\XuOwxRF.exe
  C:\Windows\System\XuOwxRF.exe
  2⤵
  PID:7464
- C:\Windows\System\OQNcNIm.exe
  C:\Windows\System\OQNcNIm.exe
  2⤵
  PID:7640
- C:\Windows\System\GdkvjaB.exe
  C:\Windows\System\GdkvjaB.exe
  2⤵
  PID:7784
- C:\Windows\System\VKCcOGG.exe
  C:\Windows\System\VKCcOGG.exe
  2⤵
  PID:7896
- C:\Windows\System\hanyCJb.exe
  C:\Windows\System\hanyCJb.exe
  2⤵
  PID:7980
- C:\Windows\System\MugXUss.exe
  C:\Windows\System\MugXUss.exe
  2⤵
  PID:8140
- C:\Windows\System\sivbcTg.exe
  C:\Windows\System\sivbcTg.exe
  2⤵
  PID:8180
- C:\Windows\System\SYiScDP.exe
  C:\Windows\System\SYiScDP.exe
  2⤵
  PID:7500
- C:\Windows\System\ziNsbUf.exe
  C:\Windows\System\ziNsbUf.exe
  2⤵
  PID:7764
- C:\Windows\System\ytSJzLM.exe
  C:\Windows\System\ytSJzLM.exe
  2⤵
  PID:7944
- C:\Windows\System\feXCbIg.exe
  C:\Windows\System\feXCbIg.exe
  2⤵
  PID:8200
- C:\Windows\System\xWiSPSS.exe
  C:\Windows\System\xWiSPSS.exe
  2⤵
  PID:8252
- C:\Windows\System\SJAGPYJ.exe
  C:\Windows\System\SJAGPYJ.exe
  2⤵
  PID:8284
- C:\Windows\System\oPtehnO.exe
  C:\Windows\System\oPtehnO.exe
  2⤵
  PID:8300
- C:\Windows\System\KFarPEV.exe
  C:\Windows\System\KFarPEV.exe
  2⤵
  PID:8320
- C:\Windows\System\KyCGgAi.exe
  C:\Windows\System\KyCGgAi.exe
  2⤵
  PID:8340
- C:\Windows\System\QIfjmOJ.exe
  C:\Windows\System\QIfjmOJ.exe
  2⤵
  PID:8400
- C:\Windows\System\JkKoiWI.exe
  C:\Windows\System\JkKoiWI.exe
  2⤵
  PID:8432
- C:\Windows\System\mPEXADw.exe
  C:\Windows\System\mPEXADw.exe
  2⤵
  PID:8452
- C:\Windows\System\qotdiAD.exe
  C:\Windows\System\qotdiAD.exe
  2⤵
  PID:8472
- C:\Windows\System\YggpkAr.exe
  C:\Windows\System\YggpkAr.exe
  2⤵
  PID:8500
- C:\Windows\System\dXaZfGG.exe
  C:\Windows\System\dXaZfGG.exe
  2⤵
  PID:8524
- C:\Windows\System\espcgZf.exe
  C:\Windows\System\espcgZf.exe
  2⤵
  PID:8544
- C:\Windows\System\qFwiphr.exe
  C:\Windows\System\qFwiphr.exe
  2⤵
  PID:8568
- C:\Windows\System\mUvQTJp.exe
  C:\Windows\System\mUvQTJp.exe
  2⤵
  PID:8604
- C:\Windows\System\UcuvVmg.exe
  C:\Windows\System\UcuvVmg.exe
  2⤵
  PID:8664
- C:\Windows\System\BayeMsy.exe
  C:\Windows\System\BayeMsy.exe
  2⤵
  PID:8716
- C:\Windows\System\cxjIPub.exe
  C:\Windows\System\cxjIPub.exe
  2⤵
  PID:8764
- C:\Windows\System\cWXFJAh.exe
  C:\Windows\System\cWXFJAh.exe
  2⤵
  PID:8788
- C:\Windows\System\iQsyBlu.exe
  C:\Windows\System\iQsyBlu.exe
  2⤵
  PID:8812
- C:\Windows\System\FzxjCJD.exe
  C:\Windows\System\FzxjCJD.exe
  2⤵
  PID:8832
- C:\Windows\System\jryDCUY.exe
  C:\Windows\System\jryDCUY.exe
  2⤵
  PID:8860
- C:\Windows\System\uTgOOTF.exe
  C:\Windows\System\uTgOOTF.exe
  2⤵
  PID:8876
- C:\Windows\System\WdiZgFH.exe
  C:\Windows\System\WdiZgFH.exe
  2⤵
  PID:8900
- C:\Windows\System\OxvvEnC.exe
  C:\Windows\System\OxvvEnC.exe
  2⤵
  PID:8920
- C:\Windows\System\HIkGYSN.exe
  C:\Windows\System\HIkGYSN.exe
  2⤵
  PID:8944
- C:\Windows\System\ZGSCNMS.exe
  C:\Windows\System\ZGSCNMS.exe
  2⤵
  PID:8976
- C:\Windows\System\yhFsweG.exe
  C:\Windows\System\yhFsweG.exe
  2⤵
  PID:9012
- C:\Windows\System\cHrvAOk.exe
  C:\Windows\System\cHrvAOk.exe
  2⤵
  PID:9048
- C:\Windows\System\jllhhak.exe
  C:\Windows\System\jllhhak.exe
  2⤵
  PID:9068
- C:\Windows\System\gjbgcYh.exe
  C:\Windows\System\gjbgcYh.exe
  2⤵
  PID:9092
- C:\Windows\System\yFhNcpI.exe
  C:\Windows\System\yFhNcpI.exe
  2⤵
  PID:9108
- C:\Windows\System\VRzoGBd.exe
  C:\Windows\System\VRzoGBd.exe
  2⤵
  PID:9124
- C:\Windows\System\SxoUdlW.exe
  C:\Windows\System\SxoUdlW.exe
  2⤵
  PID:9140
- C:\Windows\System\mdXTRRU.exe
  C:\Windows\System\mdXTRRU.exe
  2⤵
  PID:9160
- C:\Windows\System\qZobPZb.exe
  C:\Windows\System\qZobPZb.exe
  2⤵
  PID:9176
- C:\Windows\System\HHSkYGd.exe
  C:\Windows\System\HHSkYGd.exe
  2⤵
  PID:9192
- C:\Windows\System\dAfqDIV.exe
  C:\Windows\System\dAfqDIV.exe
  2⤵
  PID:9208
- C:\Windows\System\CPBvEIJ.exe
  C:\Windows\System\CPBvEIJ.exe
  2⤵
  PID:7900
- C:\Windows\System\KPynMSR.exe
  C:\Windows\System\KPynMSR.exe
  2⤵
  PID:7548
- C:\Windows\System\PfBioaI.exe
  C:\Windows\System\PfBioaI.exe
  2⤵
  PID:7028
- C:\Windows\System\LaLGQmy.exe
  C:\Windows\System\LaLGQmy.exe
  2⤵
  PID:8296
- C:\Windows\System\mpASLtY.exe
  C:\Windows\System\mpASLtY.exe
  2⤵
  PID:8332
- C:\Windows\System\nfIZRyw.exe
  C:\Windows\System\nfIZRyw.exe
  2⤵
  PID:8468
- C:\Windows\System\vwunUoT.exe
  C:\Windows\System\vwunUoT.exe
  2⤵
  PID:8672
- C:\Windows\System\IHWemvL.exe
  C:\Windows\System\IHWemvL.exe
  2⤵
  PID:8708
- C:\Windows\System\yaHjsnO.exe
  C:\Windows\System\yaHjsnO.exe
  2⤵
  PID:8760
- C:\Windows\System\PqLiAkp.exe
  C:\Windows\System\PqLiAkp.exe
  2⤵
  PID:9188
- C:\Windows\System\CGyMOMf.exe
  C:\Windows\System\CGyMOMf.exe
  2⤵
  PID:8196
- C:\Windows\System\ioRczJg.exe
  C:\Windows\System\ioRczJg.exe
  2⤵
  PID:8412
- C:\Windows\System\oaYGOMG.exe
  C:\Windows\System\oaYGOMG.exe
  2⤵
  PID:9008
- C:\Windows\System\ouPUFHI.exe
  C:\Windows\System\ouPUFHI.exe
  2⤵
  PID:8212
- C:\Windows\System\tRGZslY.exe
  C:\Windows\System\tRGZslY.exe
  2⤵
  PID:9076
- C:\Windows\System\LcOBYMf.exe
  C:\Windows\System\LcOBYMf.exe
  2⤵
  PID:8896
- C:\Windows\System\zvYxxss.exe
  C:\Windows\System\zvYxxss.exe
  2⤵
  PID:8488
- C:\Windows\System\ZfXzexp.exe
  C:\Windows\System\ZfXzexp.exe
  2⤵
  PID:8980
- C:\Windows\System\aqmToJh.exe
  C:\Windows\System\aqmToJh.exe
  2⤵
  PID:9020
- C:\Windows\System\pJUlmcq.exe
  C:\Windows\System\pJUlmcq.exe
  2⤵
  PID:8264
- C:\Windows\System\znxyjSb.exe
  C:\Windows\System\znxyjSb.exe
  2⤵
  PID:8756
- C:\Windows\System\BbINhVN.exe
  C:\Windows\System\BbINhVN.exe
  2⤵
  PID:8996
- C:\Windows\System\ISulCFr.exe
  C:\Windows\System\ISulCFr.exe
  2⤵
  PID:8868
- C:\Windows\System\BXxasDP.exe
  C:\Windows\System\BXxasDP.exe
  2⤵
  PID:9240
- C:\Windows\System\eJNUpnR.exe
  C:\Windows\System\eJNUpnR.exe
  2⤵
  PID:9260
- C:\Windows\System\NSgTmCg.exe
  C:\Windows\System\NSgTmCg.exe
  2⤵
  PID:9300
- C:\Windows\System\rLMrbpD.exe
  C:\Windows\System\rLMrbpD.exe
  2⤵
  PID:9324
- C:\Windows\System\nfBauAK.exe
  C:\Windows\System\nfBauAK.exe
  2⤵
  PID:9348
- C:\Windows\System\BdNQjBv.exe
  C:\Windows\System\BdNQjBv.exe
  2⤵
  PID:9372
- C:\Windows\System\uMFUuJH.exe
  C:\Windows\System\uMFUuJH.exe
  2⤵
  PID:9412
- C:\Windows\System\pLxUnps.exe
  C:\Windows\System\pLxUnps.exe
  2⤵
  PID:9432
- C:\Windows\System\MzouujW.exe
  C:\Windows\System\MzouujW.exe
  2⤵
  PID:9456
- C:\Windows\System\Msjtabv.exe
  C:\Windows\System\Msjtabv.exe
  2⤵
  PID:9472
- C:\Windows\System\LYVIIGR.exe
  C:\Windows\System\LYVIIGR.exe
  2⤵
  PID:9516
- C:\Windows\System\SMcPWsS.exe
  C:\Windows\System\SMcPWsS.exe
  2⤵
  PID:9544
- C:\Windows\System\yJghxvQ.exe
  C:\Windows\System\yJghxvQ.exe
  2⤵
  PID:9568
- C:\Windows\System\VlOWMgf.exe
  C:\Windows\System\VlOWMgf.exe
  2⤵
  PID:9588
- C:\Windows\System\jsYsByW.exe
  C:\Windows\System\jsYsByW.exe
  2⤵
  PID:9628
- C:\Windows\System\zAHxbtM.exe
  C:\Windows\System\zAHxbtM.exe
  2⤵
  PID:9652
- C:\Windows\System\dgcvGMQ.exe
  C:\Windows\System\dgcvGMQ.exe
  2⤵
  PID:9672
- C:\Windows\System\sqjXskc.exe
  C:\Windows\System\sqjXskc.exe
  2⤵
  PID:9692
- C:\Windows\System\gGOARTW.exe
  C:\Windows\System\gGOARTW.exe
  2⤵
  PID:9712
- C:\Windows\System\WwVnWcj.exe
  C:\Windows\System\WwVnWcj.exe
  2⤵
  PID:9732
- C:\Windows\System\tIxNtkM.exe
  C:\Windows\System\tIxNtkM.exe
  2⤵
  PID:9752
- C:\Windows\System\xhieAHy.exe
  C:\Windows\System\xhieAHy.exe
  2⤵
  PID:9772
- C:\Windows\System\yffGszf.exe
  C:\Windows\System\yffGszf.exe
  2⤵
  PID:9820
- C:\Windows\System\LttsZJv.exe
  C:\Windows\System\LttsZJv.exe
  2⤵
  PID:9844
- C:\Windows\System\AFkXLGM.exe
  C:\Windows\System\AFkXLGM.exe
  2⤵
  PID:9888
- C:\Windows\System\kVWZasy.exe
  C:\Windows\System\kVWZasy.exe
  2⤵
  PID:9916
- C:\Windows\System\KQQtbPM.exe
  C:\Windows\System\KQQtbPM.exe
  2⤵
  PID:9936
- C:\Windows\System\kfixIsM.exe
  C:\Windows\System\kfixIsM.exe
  2⤵
  PID:9956
- C:\Windows\System\YpZLlwM.exe
  C:\Windows\System\YpZLlwM.exe
  2⤵
  PID:9996
- C:\Windows\System\OpCcKkk.exe
  C:\Windows\System\OpCcKkk.exe
  2⤵
  PID:10012
- C:\Windows\System\YdsWTCi.exe
  C:\Windows\System\YdsWTCi.exe
  2⤵
  PID:10036
- C:\Windows\System\tETpsVf.exe
  C:\Windows\System\tETpsVf.exe
  2⤵
  PID:10084
- C:\Windows\System\cfIZILI.exe
  C:\Windows\System\cfIZILI.exe
  2⤵
  PID:10124
- C:\Windows\System\nSdjHPr.exe
  C:\Windows\System\nSdjHPr.exe
  2⤵
  PID:10168
- C:\Windows\System\cPpGHPW.exe
  C:\Windows\System\cPpGHPW.exe
  2⤵
  PID:10192
- C:\Windows\System\AlOFrCE.exe
  C:\Windows\System\AlOFrCE.exe
  2⤵
  PID:10208
- C:\Windows\System\zjrSjFY.exe
  C:\Windows\System\zjrSjFY.exe
  2⤵
  PID:10232
- C:\Windows\System\HqrVkHX.exe
  C:\Windows\System\HqrVkHX.exe
  2⤵
  PID:9228
- C:\Windows\System\jnEqjFV.exe
  C:\Windows\System\jnEqjFV.exe
  2⤵
  PID:9292
- C:\Windows\System\BPjvMqO.exe
  C:\Windows\System\BPjvMqO.exe
  2⤵
  PID:9392
- C:\Windows\System\LQTotXr.exe
  C:\Windows\System\LQTotXr.exe
  2⤵
  PID:9488
- C:\Windows\System\QxZmwfl.exe
  C:\Windows\System\QxZmwfl.exe
  2⤵
  PID:9536
- C:\Windows\System\uXVcwLn.exe
  C:\Windows\System\uXVcwLn.exe
  2⤵
  PID:9584
- C:\Windows\System\hpqsdtQ.exe
  C:\Windows\System\hpqsdtQ.exe
  2⤵
  PID:9640
- C:\Windows\System\XuIJolG.exe
  C:\Windows\System\XuIJolG.exe
  2⤵
  PID:9768
- C:\Windows\System\ucMpIAu.exe
  C:\Windows\System\ucMpIAu.exe
  2⤵
  PID:9708
- C:\Windows\System\ZTdUtiz.exe
  C:\Windows\System\ZTdUtiz.exe
  2⤵
  PID:9748
- C:\Windows\System\WwsgGBy.exe
  C:\Windows\System\WwsgGBy.exe
  2⤵
  PID:9884
- C:\Windows\System\wCaEJvt.exe
  C:\Windows\System\wCaEJvt.exe
  2⤵
  PID:9924
- C:\Windows\System\xDqNzah.exe
  C:\Windows\System\xDqNzah.exe
  2⤵
  PID:10004
- C:\Windows\System\SWMdcPO.exe
  C:\Windows\System\SWMdcPO.exe
  2⤵
  PID:9988
- C:\Windows\System\jbgJkoM.exe
  C:\Windows\System\jbgJkoM.exe
  2⤵
  PID:10160
- C:\Windows\System\lAIfBpe.exe
  C:\Windows\System\lAIfBpe.exe
  2⤵
  PID:10216
- C:\Windows\System\rCbvbPQ.exe
  C:\Windows\System\rCbvbPQ.exe
  2⤵
  PID:7420
- C:\Windows\System\fCvmwDS.exe
  C:\Windows\System\fCvmwDS.exe
  2⤵
  PID:9368
- C:\Windows\System\iRQMfcG.exe
  C:\Windows\System\iRQMfcG.exe
  2⤵
  PID:9560
- C:\Windows\System\fIChxdl.exe
  C:\Windows\System\fIChxdl.exe
  2⤵
  PID:9836
- C:\Windows\System\vXfCYbw.exe
  C:\Windows\System\vXfCYbw.exe
  2⤵
  PID:9828
- C:\Windows\System\bWkTwUv.exe
  C:\Windows\System\bWkTwUv.exe
  2⤵
  PID:9976
- C:\Windows\System\qavGEwJ.exe
  C:\Windows\System\qavGEwJ.exe
  2⤵
  PID:10136
- C:\Windows\System\iGwVont.exe
  C:\Windows\System\iGwVont.exe
  2⤵
  PID:9868
- C:\Windows\System\ckAcxlc.exe
  C:\Windows\System\ckAcxlc.exe
  2⤵
  PID:9952
- C:\Windows\System\rilCNKp.exe
  C:\Windows\System\rilCNKp.exe
  2⤵
  PID:3792
- C:\Windows\System\KzFjYiu.exe
  C:\Windows\System\KzFjYiu.exe
  2⤵
  PID:10264
- C:\Windows\System\LxwiJMc.exe
  C:\Windows\System\LxwiJMc.exe
  2⤵
  PID:10284
- C:\Windows\System\BWXTtlP.exe
  C:\Windows\System\BWXTtlP.exe
  2⤵
  PID:10300
- C:\Windows\System\mOizlcy.exe
  C:\Windows\System\mOizlcy.exe
  2⤵
  PID:10340
- C:\Windows\System\nruOZeW.exe
  C:\Windows\System\nruOZeW.exe
  2⤵
  PID:10372
- C:\Windows\System\iKuUgWi.exe
  C:\Windows\System\iKuUgWi.exe
  2⤵
  PID:10392
- C:\Windows\System\gudDxoP.exe
  C:\Windows\System\gudDxoP.exe
  2⤵
  PID:10416
- C:\Windows\System\hvGBVbv.exe
  C:\Windows\System\hvGBVbv.exe
  2⤵
  PID:10440
- C:\Windows\System\fpsVDAw.exe
  C:\Windows\System\fpsVDAw.exe
  2⤵
  PID:10456
- C:\Windows\System\VhngodW.exe
  C:\Windows\System\VhngodW.exe
  2⤵
  PID:10476
- C:\Windows\System\YXzGyUs.exe
  C:\Windows\System\YXzGyUs.exe
  2⤵
  PID:10500
- C:\Windows\System\hwziCBP.exe
  C:\Windows\System\hwziCBP.exe
  2⤵
  PID:10540
- C:\Windows\System\mzaauWk.exe
  C:\Windows\System\mzaauWk.exe
  2⤵
  PID:10604
- C:\Windows\System\CJcsLbQ.exe
  C:\Windows\System\CJcsLbQ.exe
  2⤵
  PID:10628
- C:\Windows\System\sKIfdhV.exe
  C:\Windows\System\sKIfdhV.exe
  2⤵
  PID:10652
- C:\Windows\System\ukoZnSR.exe
  C:\Windows\System\ukoZnSR.exe
  2⤵
  PID:10668
- C:\Windows\System\TgpPgXo.exe
  C:\Windows\System\TgpPgXo.exe
  2⤵
  PID:10720
- C:\Windows\System\HEwtHtS.exe
  C:\Windows\System\HEwtHtS.exe
  2⤵
  PID:10744
- C:\Windows\System\HGVRgYq.exe
  C:\Windows\System\HGVRgYq.exe
  2⤵
  PID:10772
- C:\Windows\System\ORmqGZa.exe
  C:\Windows\System\ORmqGZa.exe
  2⤵
  PID:10792
- C:\Windows\System\zQSklop.exe
  C:\Windows\System\zQSklop.exe
  2⤵
  PID:10816
- C:\Windows\System\GQhyOan.exe
  C:\Windows\System\GQhyOan.exe
  2⤵
  PID:10848
- C:\Windows\System\FcugkEl.exe
  C:\Windows\System\FcugkEl.exe
  2⤵
  PID:10864
- C:\Windows\System\QLrsSlT.exe
  C:\Windows\System\QLrsSlT.exe
  2⤵
  PID:10892
- C:\Windows\System\ALYOcCL.exe
  C:\Windows\System\ALYOcCL.exe
  2⤵
  PID:10920
- C:\Windows\System\kKDFMah.exe
  C:\Windows\System\kKDFMah.exe
  2⤵
  PID:10952
- C:\Windows\System\mBfkEKs.exe
  C:\Windows\System\mBfkEKs.exe
  2⤵
  PID:10996
- C:\Windows\System\RDluHQG.exe
  C:\Windows\System\RDluHQG.exe
  2⤵
  PID:11024
- C:\Windows\System\rzTuMtG.exe
  C:\Windows\System\rzTuMtG.exe
  2⤵
  PID:11044
- C:\Windows\System\ZFkvQbr.exe
  C:\Windows\System\ZFkvQbr.exe
  2⤵
  PID:11084
- C:\Windows\System\usSkQag.exe
  C:\Windows\System\usSkQag.exe
  2⤵
  PID:11108
- C:\Windows\System\ijsqAzK.exe
  C:\Windows\System\ijsqAzK.exe
  2⤵
  PID:11128
- C:\Windows\System\wdlkRTA.exe
  C:\Windows\System\wdlkRTA.exe
  2⤵
  PID:11152
- C:\Windows\System\zWiufCK.exe
  C:\Windows\System\zWiufCK.exe
  2⤵
  PID:11172
- C:\Windows\System\PiOelKA.exe
  C:\Windows\System\PiOelKA.exe
  2⤵
  PID:11192
- C:\Windows\System\dyEAvID.exe
  C:\Windows\System\dyEAvID.exe
  2⤵
  PID:11216
- C:\Windows\System\JQYIvPe.exe
  C:\Windows\System\JQYIvPe.exe
  2⤵
  PID:11232
- C:\Windows\System\hslqxpF.exe
  C:\Windows\System\hslqxpF.exe
  2⤵
  PID:10120
- C:\Windows\System\byrwwUL.exe
  C:\Windows\System\byrwwUL.exe
  2⤵
  PID:10296
- C:\Windows\System\JbmBmdo.exe
  C:\Windows\System\JbmBmdo.exe
  2⤵
  PID:10328
- C:\Windows\System\WXgHIsZ.exe
  C:\Windows\System\WXgHIsZ.exe
  2⤵
  PID:10408
- C:\Windows\System\fXPkfwf.exe
  C:\Windows\System\fXPkfwf.exe
  2⤵
  PID:10488
- C:\Windows\System\nUnYjzQ.exe
  C:\Windows\System\nUnYjzQ.exe
  2⤵
  PID:10584
- C:\Windows\System\ZDXGUbq.exe
  C:\Windows\System\ZDXGUbq.exe
  2⤵
  PID:10664
- C:\Windows\System\cNsApZz.exe
  C:\Windows\System\cNsApZz.exe
  2⤵
  PID:10692
- C:\Windows\System\cFIoHta.exe
  C:\Windows\System\cFIoHta.exe
  2⤵
  PID:10804
- C:\Windows\System\JosNlIe.exe
  C:\Windows\System\JosNlIe.exe
  2⤵
  PID:10840
- C:\Windows\System\dKbhMKC.exe
  C:\Windows\System\dKbhMKC.exe
  2⤵
  PID:10932
- C:\Windows\System\zEauVUe.exe
  C:\Windows\System\zEauVUe.exe
  2⤵
  PID:11004
- C:\Windows\System\TetmIaQ.exe
  C:\Windows\System\TetmIaQ.exe
  2⤵
  PID:11032
- C:\Windows\System\nSbGkGv.exe
  C:\Windows\System\nSbGkGv.exe
  2⤵
  PID:11124
- C:\Windows\System\fnquWwR.exe
  C:\Windows\System\fnquWwR.exe
  2⤵
  PID:11160
- C:\Windows\System\JGsRNYR.exe
  C:\Windows\System\JGsRNYR.exe
  2⤵
  PID:11200
- C:\Windows\System\liBqtag.exe
  C:\Windows\System\liBqtag.exe
  2⤵
  PID:10272
- C:\Windows\System\Idayppk.exe
  C:\Windows\System\Idayppk.exe
  2⤵
  PID:10320
- C:\Windows\System\HUUClsI.exe
  C:\Windows\System\HUUClsI.exe
  2⤵
  PID:10384
- C:\Windows\System\xqBVOoO.exe
  C:\Windows\System\xqBVOoO.exe
  2⤵
  PID:10468
- C:\Windows\System\GvaRaRp.exe
  C:\Windows\System\GvaRaRp.exe
  2⤵
  PID:10752
- C:\Windows\System\jokSJfX.exe
  C:\Windows\System\jokSJfX.exe
  2⤵
  PID:10944
- C:\Windows\System\jVdFeRx.exe
  C:\Windows\System\jVdFeRx.exe
  2⤵
  PID:11096
- C:\Windows\System\ufIUHjA.exe
  C:\Windows\System\ufIUHjA.exe
  2⤵
  PID:11260
- C:\Windows\System\wUmwFlg.exe
  C:\Windows\System\wUmwFlg.exe
  2⤵
  PID:10516
- C:\Windows\System\IqhuDqC.exe
  C:\Windows\System\IqhuDqC.exe
  2⤵
  PID:10812
- C:\Windows\System\NgQycbV.exe
  C:\Windows\System\NgQycbV.exe
  2⤵
  PID:11280
- C:\Windows\System\XcoOngw.exe
  C:\Windows\System\XcoOngw.exe
  2⤵
  PID:11300
- C:\Windows\System\sUSQDYS.exe
  C:\Windows\System\sUSQDYS.exe
  2⤵
  PID:11320
- C:\Windows\System\RCmRkAU.exe
  C:\Windows\System\RCmRkAU.exe
  2⤵
  PID:11344
- C:\Windows\System\amvfVYF.exe
  C:\Windows\System\amvfVYF.exe
  2⤵
  PID:11364
- C:\Windows\System\jJmZJLA.exe
  C:\Windows\System\jJmZJLA.exe
  2⤵
  PID:11400
- C:\Windows\System\yocGlpe.exe
  C:\Windows\System\yocGlpe.exe
  2⤵
  PID:11428
- C:\Windows\System\ZyBuzeQ.exe
  C:\Windows\System\ZyBuzeQ.exe
  2⤵
  PID:11468
- C:\Windows\System\hANpzqn.exe
  C:\Windows\System\hANpzqn.exe
  2⤵
  PID:11492
- C:\Windows\System\PzfsYta.exe
  C:\Windows\System\PzfsYta.exe
  2⤵
  PID:11512
- C:\Windows\System\xqpKPBd.exe
  C:\Windows\System\xqpKPBd.exe
  2⤵
  PID:11544
- C:\Windows\System\tIGKEWd.exe
  C:\Windows\System\tIGKEWd.exe
  2⤵
  PID:11568
- C:\Windows\System\hURkouc.exe
  C:\Windows\System\hURkouc.exe
  2⤵
  PID:11588
- C:\Windows\System\rTVUOvh.exe
  C:\Windows\System\rTVUOvh.exe
  2⤵
  PID:11616
- C:\Windows\System\XyuSLuY.exe
  C:\Windows\System\XyuSLuY.exe
  2⤵
  PID:11636
- C:\Windows\System\vcKWyYc.exe
  C:\Windows\System\vcKWyYc.exe
  2⤵
  PID:11676
- C:\Windows\System\xlFOTeM.exe
  C:\Windows\System\xlFOTeM.exe
  2⤵
  PID:11700
- C:\Windows\System\WouylAU.exe
  C:\Windows\System\WouylAU.exe
  2⤵
  PID:11724
- C:\Windows\System\fkLoYVS.exe
  C:\Windows\System\fkLoYVS.exe
  2⤵
  PID:11748
- C:\Windows\System\GAACrwk.exe
  C:\Windows\System\GAACrwk.exe
  2⤵
  PID:11784
- C:\Windows\System\ffFlDJQ.exe
  C:\Windows\System\ffFlDJQ.exe
  2⤵
  PID:11812
- C:\Windows\System\xSJcMUa.exe
  C:\Windows\System\xSJcMUa.exe
  2⤵
  PID:11840
- C:\Windows\System\kLfeNgv.exe
  C:\Windows\System\kLfeNgv.exe
  2⤵
  PID:11856
- C:\Windows\System\UQYLMjC.exe
  C:\Windows\System\UQYLMjC.exe
  2⤵
  PID:11884
- C:\Windows\System\teambPP.exe
  C:\Windows\System\teambPP.exe
  2⤵
  PID:11920
- C:\Windows\System\rlrRcmx.exe
  C:\Windows\System\rlrRcmx.exe
  2⤵
  PID:11960
- C:\Windows\System\aIxUKBQ.exe
  C:\Windows\System\aIxUKBQ.exe
  2⤵
  PID:11988
- C:\Windows\System\lQlCkHk.exe
  C:\Windows\System\lQlCkHk.exe
  2⤵
  PID:12004
- C:\Windows\System\fPeYQux.exe
  C:\Windows\System\fPeYQux.exe
  2⤵
  PID:12040
- C:\Windows\System\OlaViWX.exe
  C:\Windows\System\OlaViWX.exe
  2⤵
  PID:12068
- C:\Windows\System\LfpOymC.exe
  C:\Windows\System\LfpOymC.exe
  2⤵
  PID:12108
- C:\Windows\System\lUxJWaK.exe
  C:\Windows\System\lUxJWaK.exe
  2⤵
  PID:12132
- C:\Windows\System\QIiqcsF.exe
  C:\Windows\System\QIiqcsF.exe
  2⤵
  PID:12160
- C:\Windows\System\WOooKLK.exe
  C:\Windows\System\WOooKLK.exe
  2⤵
  PID:12208
- C:\Windows\System\JZIovzJ.exe
  C:\Windows\System\JZIovzJ.exe
  2⤵
  PID:12256
- C:\Windows\System\MhMEFZB.exe
  C:\Windows\System\MhMEFZB.exe
  2⤵
  PID:12272
- C:\Windows\System\QwLAUXt.exe
  C:\Windows\System\QwLAUXt.exe
  2⤵
  PID:10712
- C:\Windows\System\ORnWVNc.exe
  C:\Windows\System\ORnWVNc.exe
  2⤵
  PID:11296
- C:\Windows\System\vCcVxpX.exe
  C:\Windows\System\vCcVxpX.exe
  2⤵
  PID:11268
- C:\Windows\System\tnLtQyV.exe
  C:\Windows\System\tnLtQyV.exe
  2⤵
  PID:11336
- C:\Windows\System\PiKeTVt.exe
  C:\Windows\System\PiKeTVt.exe
  2⤵
  PID:11420
- C:\Windows\System\SvdBlYK.exe
  C:\Windows\System\SvdBlYK.exe
  2⤵
  PID:11476
- C:\Windows\System\qTfZTDY.exe
  C:\Windows\System\qTfZTDY.exe
  2⤵
  PID:11580
- C:\Windows\System\WaOeESL.exe
  C:\Windows\System\WaOeESL.exe
  2⤵
  PID:11660
- C:\Windows\System\yPJhhpv.exe
  C:\Windows\System\yPJhhpv.exe
  2⤵
  PID:11696
- C:\Windows\System\TvoQIkq.exe
  C:\Windows\System\TvoQIkq.exe
  2⤵
  PID:11720
- C:\Windows\System\plRNpkC.exe
  C:\Windows\System\plRNpkC.exe
  2⤵
  PID:11792
- C:\Windows\System\ajrOSek.exe
  C:\Windows\System\ajrOSek.exe
  2⤵
  PID:11824
- C:\Windows\System\QDXBNat.exe
  C:\Windows\System\QDXBNat.exe
  2⤵
  PID:11880
- C:\Windows\System\Dsntwqs.exe
  C:\Windows\System\Dsntwqs.exe
  2⤵
  PID:11944
- C:\Windows\System\RSQNQDh.exe
  C:\Windows\System\RSQNQDh.exe
  2⤵
  PID:11972
- C:\Windows\System\zfBPEaZ.exe
  C:\Windows\System\zfBPEaZ.exe
  2⤵
  PID:12020
- C:\Windows\System\rjzHjjW.exe
  C:\Windows\System\rjzHjjW.exe
  2⤵
  PID:12048
- C:\Windows\System\fQxopoy.exe
  C:\Windows\System\fQxopoy.exe
  2⤵
  PID:12084
- C:\Windows\System\xqXnbeV.exe
  C:\Windows\System\xqXnbeV.exe
  2⤵
  PID:12140
- C:\Windows\System\glNaohF.exe
  C:\Windows\System\glNaohF.exe
  2⤵
  PID:12204
- C:\Windows\System\jvzBNwK.exe
  C:\Windows\System\jvzBNwK.exe
  2⤵
  PID:12284
- C:\Windows\System\sGVLWDb.exe
  C:\Windows\System\sGVLWDb.exe
  2⤵
  PID:11684
- C:\Windows\System\UfySZSn.exe
  C:\Windows\System\UfySZSn.exe
  2⤵
  PID:4112
- C:\Windows\System\NgHeFvF.exe
  C:\Windows\System\NgHeFvF.exe
  2⤵
  PID:11864
- C:\Windows\System\iQuHpJS.exe
  C:\Windows\System\iQuHpJS.exe
  2⤵
  PID:11708
- C:\Windows\System\kKsScXj.exe
  C:\Windows\System\kKsScXj.exe
  2⤵
  PID:12000
- C:\Windows\System\PNJvcku.exe
  C:\Windows\System\PNJvcku.exe
  2⤵
  PID:12184
- C:\Windows\System\CTHiyRH.exe
  C:\Windows\System\CTHiyRH.exe
  2⤵
  PID:12264
- C:\Windows\System\EDQVloM.exe
  C:\Windows\System\EDQVloM.exe
  2⤵
  PID:11312
- C:\Windows\System\ipiPOhX.exe
  C:\Windows\System\ipiPOhX.exe
  2⤵
  PID:11656
- C:\Windows\System\jHgrdDi.exe
  C:\Windows\System\jHgrdDi.exe
  2⤵
  PID:12312
- C:\Windows\System\iLHqCDF.exe
  C:\Windows\System\iLHqCDF.exe
  2⤵
  PID:12352
- C:\Windows\System\tzIhqVC.exe
  C:\Windows\System\tzIhqVC.exe
  2⤵
  PID:12396
- C:\Windows\System\cJojJwO.exe
  C:\Windows\System\cJojJwO.exe
  2⤵
  PID:12420
- C:\Windows\System\WrQDgPh.exe
  C:\Windows\System\WrQDgPh.exe
  2⤵
  PID:12440
- C:\Windows\System\UbVXZVu.exe
  C:\Windows\System\UbVXZVu.exe
  2⤵
  PID:12456
- C:\Windows\System\NcVscYj.exe
  C:\Windows\System\NcVscYj.exe
  2⤵
  PID:12496
- C:\Windows\System\DGysRsK.exe
  C:\Windows\System\DGysRsK.exe
  2⤵
  PID:12568
- C:\Windows\System\nYCeeod.exe
  C:\Windows\System\nYCeeod.exe
  2⤵
  PID:12588
- C:\Windows\System\yHWVYoF.exe
  C:\Windows\System\yHWVYoF.exe
  2⤵
  PID:12608
- C:\Windows\System\AIqkLAR.exe
  C:\Windows\System\AIqkLAR.exe
  2⤵
  PID:12628
- C:\Windows\System\IKKxQBe.exe
  C:\Windows\System\IKKxQBe.exe
  2⤵
  PID:12668
- C:\Windows\System\lmmDOKH.exe
  C:\Windows\System\lmmDOKH.exe
  2⤵
  PID:12716
- C:\Windows\System\PBnKQKg.exe
  C:\Windows\System\PBnKQKg.exe
  2⤵
  PID:12744
- C:\Windows\System\ehwmyWa.exe
  C:\Windows\System\ehwmyWa.exe
  2⤵
  PID:12764
- C:\Windows\System\jIklTCr.exe
  C:\Windows\System\jIklTCr.exe
  2⤵
  PID:12784
- C:\Windows\System\esqEnbg.exe
  C:\Windows\System\esqEnbg.exe
  2⤵
  PID:12828
- C:\Windows\System\SoFugQu.exe
  C:\Windows\System\SoFugQu.exe
  2⤵
  PID:12848
- C:\Windows\System\KqEltbX.exe
  C:\Windows\System\KqEltbX.exe
  2⤵
  PID:12884
- C:\Windows\System\vjFmlIe.exe
  C:\Windows\System\vjFmlIe.exe
  2⤵
  PID:12916
- C:\Windows\System\bIiBDnW.exe
  C:\Windows\System\bIiBDnW.exe
  2⤵
  PID:12948
- C:\Windows\System\NwHPJoA.exe
  C:\Windows\System\NwHPJoA.exe
  2⤵
  PID:12980
- C:\Windows\System\wbdvPWK.exe
  C:\Windows\System\wbdvPWK.exe
  2⤵
  PID:13008
- C:\Windows\System\xcpahwB.exe
  C:\Windows\System\xcpahwB.exe
  2⤵
  PID:13028
- C:\Windows\System\XBCcROp.exe
  C:\Windows\System\XBCcROp.exe
  2⤵
  PID:13044
- C:\Windows\System\pEoacFx.exe
  C:\Windows\System\pEoacFx.exe
  2⤵
  PID:13068
- C:\Windows\System\ouKPFKT.exe
  C:\Windows\System\ouKPFKT.exe
  2⤵
  PID:13088
- C:\Windows\System\NqucPck.exe
  C:\Windows\System\NqucPck.exe
  2⤵
  PID:13108
- C:\Windows\System\CffQWAc.exe
  C:\Windows\System\CffQWAc.exe
  2⤵
  PID:13136
- C:\Windows\System\inRLVMZ.exe
  C:\Windows\System\inRLVMZ.exe
  2⤵
  PID:13164
- C:\Windows\System\UCZsPhZ.exe
  C:\Windows\System\UCZsPhZ.exe
  2⤵
  PID:13180
- C:\Windows\System\ffOBsUW.exe
  C:\Windows\System\ffOBsUW.exe
  2⤵
  PID:13232
- C:\Windows\System\ijaYfiC.exe
  C:\Windows\System\ijaYfiC.exe
  2⤵
  PID:13280
- C:\Windows\System\stPpoLa.exe
  C:\Windows\System\stPpoLa.exe
  2⤵
  PID:12124
- C:\Windows\System\OLSwlYR.exe
  C:\Windows\System\OLSwlYR.exe
  2⤵
  PID:11740
- C:\Windows\System\LEDMSCV.exe
  C:\Windows\System\LEDMSCV.exe
  2⤵
  PID:11820
- C:\Windows\System\JPYAMCw.exe
  C:\Windows\System\JPYAMCw.exe
  2⤵
  PID:12380
- C:\Windows\System\ejSiljs.exe
  C:\Windows\System\ejSiljs.exe
  2⤵
  PID:12448
- C:\Windows\System\hmXjjiH.exe
  C:\Windows\System\hmXjjiH.exe
  2⤵
  PID:12488
- C:\Windows\System\fHJbuOp.exe
  C:\Windows\System\fHJbuOp.exe
  2⤵
  PID:12908
- C:\Windows\System\SfxUstN.exe
  C:\Windows\System\SfxUstN.exe
  2⤵
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqtniyix.zzw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AoHKMBo.exe

Filesize
1.5MB

MD5
2674a74cab95b40f6284b50998a81b76

SHA1
dd1b2db3f19e06f4437314cdf8cf9c1b62c97190

SHA256
8c298cc234191981e9d60a363b98e349859d1f28b5950a22b79ec663fbf732c7

SHA512
5a6e0b80548cdbae61487a1fe81bd0a9a987477d855cb6810fcb7fb425b323d4f8b006e31bb15d91b6687de901b0816f54f82974ea584d29582c5197701268e7

Download Submit
C:\Windows\System\CfhyXPY.exe

Filesize
1.5MB

MD5
103c4e402c6de2e858766a47da5df1b6

SHA1
0850e0d1b13bd3982a3dbb73a869e71f7098c83e

SHA256
09f23552c646478cd09c79de2213bb0639daed001376ee7d6d2bcba5e515ec0c

SHA512
e71bfd7cf1307c67a637d3db55cc9662a651aab50713421a11ce527709a4175b2ca3a3e5b03a29a1a306754701e7d00d28449b7d020765d12d4f130e11721892

Download Submit
C:\Windows\System\CnakWIn.exe

Filesize
1.5MB

MD5
09a0a39e7e33b25a67b21f7b59cb917b

SHA1
a4ed9d8d189a248c44b738280af30273600228d5

SHA256
3d5bf3ec37c84f215aaf668524f9386f3cf6ed4f277f8fb7dd650d8011d632c0

SHA512
9581f4b0c5f89e057a44d4053f5452ae809394e87f3251bcea3aca09d3fce4c8a28eb1a95acacd13ab817208d8b1d6eb55182b3a7a6b9806140f4abd5d7e7268

Download Submit
C:\Windows\System\DBfCWJE.exe

Filesize
1.5MB

MD5
2d5b6df2ab32cb4ac257247584b73fd4

SHA1
eb2a9a2af1f02fd847bbcf9e0d163fc67ece15c9

SHA256
40802bfeea6f510a6cf8eae56cb1bd4473b93601c404030d12b4a8faec9ac49d

SHA512
80f5dc9f166d8501bc24aea8392437074b0b05d494f1758c06de6365e8ba19f3ecd8c03d195c1b141324c6c0770b2c0f0978fb9ecd02f85ef4273d26b4bc95c0

Download Submit
C:\Windows\System\DCESGDF.exe

Filesize
1.5MB

MD5
7b0df69aeef49d98dceb18a80e187b9f

SHA1
eea2414ac7140bc40b1f5d3d1671af6d3764e000

SHA256
6ed59408a577a946179be0d00f47ebfdd71341e727cf4d00d68a2a4f61cbc719

SHA512
bf94136f765235f78b76588d37ef74faecb4816606cb35eaff48a330085cc5b51744f366fd3614c92408295d747fcca66b25261ace6e624ae79b19d90e852bef

Download Submit
C:\Windows\System\DuGXaFg.exe

Filesize
1.5MB

MD5
1a85a89ad52ce4ad54181a19634d9a6f

SHA1
c08d85bf403f7247b802eb10ab767130010bd37f

SHA256
5dc8a4f424912b201fd746b5478b1c6dcece3c6684b859ac640426b937206580

SHA512
5c846e95fd1eba566fae399c604a802f1a52e60201f7aa5ab32ca13f9a90db26570e2e3b28587558628446fe1d2883891a287fd8fc253ea31067f2aa013cd52d

Download Submit
C:\Windows\System\HUBhuZi.exe

Filesize
1.5MB

MD5
8f47dd0769e9eaf4038c9bbac66c04a1

SHA1
5667eb7f51f751e249ee36ce01c876f59ee3ca7a

SHA256
bbb7e27224bedbf0240103f9abc08ed712468af204638d00633c23646fc92f85

SHA512
c198473d857fb75bc4693a8c4d377159d56d9b55686360c33e0a8e9253df91fcef1ab02deee3ecc2e38caeb7138063fec246b3932ad6bcc9fd01845677d32dbc

Download Submit
C:\Windows\System\JZdALGg.exe

Filesize
1.5MB

MD5
6e366fbde710ee5ee53c23f7373e9c4d

SHA1
1ec64232e6c0ad42091df611d2dc1219a4f0d5c3

SHA256
9f2a5274b84e723d77df0feeddb3187c3468569c614295c8dca5cd60935a90b9

SHA512
07636027f68ad2df64e72bd38bb22d014be97b1c508e67e7a8a2980c48d041eef4a9ec5b8e3d4ccb9bef37bd96a8d0e8140a2c8e33e5a38de0f7694548542f18

Download Submit
C:\Windows\System\JiPShew.exe

Filesize
1.5MB

MD5
cfc231caf2b7914adfb19586b210a42d

SHA1
45ddf56d525b7a321cf0dbe8b098bf965cc0e0df

SHA256
5bc2645a41831e83374f4c9d0c08c7f021f1a8b217f15a90b0c0bf9103804be2

SHA512
533f74af3b18d4a15ff7ab4b64a6b4dbca7513408baf370e6c745d74bb5d645cf1d9177f97ebf2d38bf309d8151734e6c4bbaa8a031dd20c971954bfcca2561c

Download Submit
C:\Windows\System\MaqkFCT.exe

Filesize
1.5MB

MD5
a61cb18798e5177d9d6a16797950592f

SHA1
e45693a54bdbf274927d52141524a9c7ca48a42d

SHA256
69016fbbd4ceedb709d845983c7cafb9f57baca1c8419a8faccd1832994bcd9b

SHA512
44c9386cd7fc31560467db27b9ec30ff297e711da35b3fcb4d61cfc909f3dc9d2e7282f92aa2bdf8071e8249b4d3ab1bc50f78b25b6f84cf3c76f852fdb2d084

Download Submit
C:\Windows\System\QjPgfFO.exe

Filesize
1.5MB

MD5
ad0973e3ace95c5a7a5bce6d39b33781

SHA1
d5ade4d4c9c878c162e83bd087c4fb5fa7f25a55

SHA256
01d838678f052eab5b360fb1c24fd753b2a09a1cfd91baf8b95398cd9b834443

SHA512
101aacb65c371b896274790aa6017d1644ed91169ab136ac2436eda1cbab3966c9330391a605c7fa4778d9f9575ff18b34f2c6a1be849dae7f3ccca84430c08d

Download Submit
C:\Windows\System\RBWvmYe.exe

Filesize
1.5MB

MD5
56e0aa74268bee7be1360d7ba9ad1b03

SHA1
43c23ee037cce0901607826acba6b6d377a11c98

SHA256
62064fc40c35ce624d90c225a5d2b964d7f7c45242ed73bf6a198ec92b85c736

SHA512
376afe23e275705e58cb5e45f945e042005edd919000fb099801490b25f1dd6f43b27d0140649227d60150fe73b0374bb3be1ae9a4715f493b56a6eb9d890842

Download Submit
C:\Windows\System\RpixAYK.exe

Filesize
1.5MB

MD5
a00881eccf16e43e3514ea505ec74ad8

SHA1
15af514b9e7deb8c298a9b467837abed830e2c74

SHA256
84eccd6fde36420112a1099ab6fbfa3f27d5feac5d2f697f5fbb87343424deee

SHA512
8382deafe3939893a5d4b0a38a299f8997dc651858fa9df67bc68d46b62da110ddd2c3bad9d8825e64a43c06aaa23c249909581a569393d9abae14fd52ae2075

Download Submit
C:\Windows\System\SnamPac.exe

Filesize
1.5MB

MD5
b303c920799f37218ef1c320196cf18f

SHA1
aafa226fc25a9ab942d64d3241a81dff082aee76

SHA256
9ba1d7d3f59928d290af8717f6db3f63f51d84cba79d75273f883c2191673ce4

SHA512
1d17664763868ad5b970be52e7201b711b3ec9fa9eb9d4cc4adf29cc0182aaa5b8ba33f8e3281a29ca99489766bbd189ebfb19539060348455fde3a22151afaf

Download Submit
C:\Windows\System\ULTYYZn.exe

Filesize
1.5MB

MD5
5a5feb586f29f02253c5d335c68c5084

SHA1
3393ea57fdefd6d58de1701f9ef3456e9d495ed7

SHA256
8c8afff0ba1838e0d47cc2359a3bf05fd2700702e69aa4e2e8f5421d3ccb7186

SHA512
6692f55a33ecd2921dd8fe67ca95ded61cc781125b09371ccf019953c37f7c820504d1ac0b8af573dbb2154d05fcda7e4a31ec40d95f3b2072fdc3632036b9b3

Download Submit
C:\Windows\System\UxfDvud.exe

Filesize
1.5MB

MD5
f34177f2293ebcb6cfe423a7f2aed185

SHA1
e07151120d5645a00813f836387b5fed05d3e23b

SHA256
14c6f6cdf390d228dbe7b3472381cb8939fdd4ff0a9569acd8de2daf89423967

SHA512
625b2f2d38f55ebb1ceea256f46b023a22b67ba8b1ef5baaf607964a64fe37ba1daa794a631ad000bd6d77fbcba25cd123fc966ff15222218eece94271aef4b6

Download Submit
C:\Windows\System\WSHaNBN.exe

Filesize
1.5MB

MD5
03dcc34476a7ae1bbce8afd02d9a8f1b

SHA1
91078c7c24ad0b5f999bd428742b52f91f014a27

SHA256
150a56faf7fb863942e5d01ac33c48797bb054664dc31a257bab76d353121b19

SHA512
b7ff88addc5a34fca3df93a5aff14c8a407450d7b43aa0fbd29b5e8144b7aa6f63ee4a767004174e68c7f993808b5810f0edd9b070960b661044aa2cd5b7489b

Download Submit
C:\Windows\System\YIdxbqI.exe

Filesize
1.5MB

MD5
ae3a3833dad313b76c97d37e97f71879

SHA1
a7ba6d9caf87ec940ea59ff3cc86de9d99387225

SHA256
c864bdfac9b60e36b9cf8ed9fde032f3a65f43de372a77d438e998df00b4cd03

SHA512
8e2b5d1bac923d0925b9c40b49ff25da43ac72b731b112a5ae7c3cc9b406a4ae3d0ef412ab52819eefc15c83eb486774c5b92e1f4ca3214c8b8c319a0e959309

Download Submit
C:\Windows\System\ZCxKrkL.exe

Filesize
1.5MB

MD5
4affc75b0f98447cfaef42728166ebb6

SHA1
55674ac2a6e4437520049564f899ac8c8097d42d

SHA256
c476cdf8c3e79b319838885e80af628f58a32e114edf5ca58f461c9a92e816cf

SHA512
199624e5956368d24fc0ed0e8207f7b28df9255ee09367eb2baa8b90b3607aa6869ea4203892d4561480bec168ed6aa4121ccf8badb419bb1e4f1b0cfd677d1a

Download Submit
C:\Windows\System\aTRnVko.exe

Filesize
1.5MB

MD5
4e7767762b483f17bfeb6ab009cb1a42

SHA1
590279617d002f5909dca44495656b66fb042a59

SHA256
f518456aff934bb5cba2a7f5ecd0a11c7a40596ef30a83b40d2a01daa9345a96

SHA512
aaab95421345f616d62ba195d7a9f4c2537dc58b2bf6e5fbaedb1cbfbb86d23685a2e1a60cdd12da4abbb27fd8484914557df55e882f3588cdf408034ffb84cf

Download Submit
C:\Windows\System\cNwTLmo.exe

Filesize
1.5MB

MD5
dfb6ae59718d706ce587e35cd006c6e7

SHA1
4cae4a6735b6443e5f69d3a0993d469af8dfc839

SHA256
26fcad77f74e2b9f94057b75dfcc9d79206719ea6d4cbf00f81e292cc2ae4b8c

SHA512
8edd774f2a72d2dcc30a0fecba0985c32b14adfb0cad01459553c5cba509de76680da590f8ee4cdf4efeebbb38004cee0513dd697c375b9ab72112796541fcb7

Download Submit
C:\Windows\System\dweAJjr.exe

Filesize
1.5MB

MD5
eb6ae17857531ba968a63d5f894edc22

SHA1
61dc5fba561d3afb2ae5153ac8fc34989ee34581

SHA256
fba4d16dd31a7b35335d079d3e612ce2751cdde0f8a9a99c01d8e0ad1097f86f

SHA512
a02dd34f0e4f27c0c24b35fe77479987f3d0d93175ab23b631203c9cfdffe58267eca129303d2c256a3720c7f9072024a9043516890840628a90f4d5b00e77ba

Download Submit
C:\Windows\System\evBwFwM.exe

Filesize
1.5MB

MD5
4a5de28e2e0a4004da29437537b82834

SHA1
42141ac478aa4d1c9080c4909fa9c2c8daf002d1

SHA256
79129022a6552c887ba8ed9499384de1a9f1b9b4b2c7c48c7465849192aa867d

SHA512
37bbd7491238d574f2b3c05dd2c1c06678de0b9224e797bc55389e57d69626b5f76b7a9250c1043dc457db6e8955520dc244da7421f2d1191dfde48836f75c3b

Download Submit
C:\Windows\System\fALMZZn.exe

Filesize
1.5MB

MD5
544b39fc492e34dc4cd0963e5957c51c

SHA1
1c178bd558a93bd469b9c30ec7e5f76a8e1dff39

SHA256
73fb1bd3cde068cf7151d01120c703a424a36559791975f475acea85cb6dea28

SHA512
f5973cdc8881927ee0cb81fb3572d3324b83fecfa139217a17a0ec8845b8a71a0ffa76654e3295202c08c23f7a98f2b7d65d165124af37796a651641161d65db

Download Submit
C:\Windows\System\fLKlRci.exe

Filesize
1.5MB

MD5
74f1d45ad8da26c6e3db6a400f6f5582

SHA1
c2c0c43546c87ee870a1a31e47ab7a6ba484d072

SHA256
410c376aee584869d45733cd0ea212b3c67ef3f5a619e5fdd7c92c85619aec60

SHA512
397a57a14869a854da3d21728b3eebd71fd49b16602a50dd405413ec13f1c600da83b2cb78759a7f23367ad601c379bd51795195d9fd4af42a0b7e811b2d82a7

Download Submit
C:\Windows\System\kAHSoWZ.exe

Filesize
1.5MB

MD5
85053c01cd61995e195d406a52ccd618

SHA1
371f040c6287c86af5a3988d02577f19a0bcb778

SHA256
b7c3d2048ceb6c750afe84e5834564cc8f03f167564eeb1ed4a88171e0e3b056

SHA512
6c61c10ca4f93491e01314c2136cdc4b010468b507e4c5225e8e08c741452a376b26b578196c8a8555b6d80cb9234abc2d615d9c06bb0deb74311df77f25e12a

Download Submit
C:\Windows\System\kmiLQhf.exe

Filesize
1.5MB

MD5
a2d26b4c68788987f1aeea23c2d447b1

SHA1
e6971d89ef6bdab68f392713dd9721486e633f13

SHA256
8b061ceb55427559bc26cf52d94d3626209c9a4e425c1e53e4104d2e46a48437

SHA512
6f8ad7c65343f7b765eff665428c5900dafb607ae0b127b11d66ef1abaa228ccbc4e548544b3014b99c0dbda2254a64132f6184e2da1c68d2e63890f968b4fcd

Download Submit
C:\Windows\System\lyQqyuD.exe

Filesize
1.5MB

MD5
f011fad2234f2d62d4516ee97f0f0ea7

SHA1
3ec84876882504f0b337e1a01bf909f0d383b618

SHA256
ca1ada12ac6c45d51aca28eab559464ecd6613fa3959c04ea97e83b147c38661

SHA512
be99b638e6123e89d60a02dd8492ce460a76e1d3d4300f1e43f2a4cfccbe38a141195d9b6a5ea86e1047f51aa44571b2bb8884470ce4d75214dfc4475292bd8f

Download Submit
C:\Windows\System\noYybJe.exe

Filesize
1.5MB

MD5
14bcd038e0247d385cecffba227e2e62

SHA1
304975936616f953e4048ed234e82c09e64a55ad

SHA256
38af614bc26a87f241f5a39b4ca9005e1618098c7b44bc6af399424fc470bf74

SHA512
7309fda845d9f183ae7e5a899f7eb5fffe6cf235cda455acd444ce8ea957cc19c00e60b546ba9f4793342faeece21d02a9c69b614cab5e057aef40dbb17183d6

Download Submit
C:\Windows\System\qSWfjTM.exe

Filesize
1.5MB

MD5
63daf67a1b097cafe86107b65e0f0d76

SHA1
ae9f75ea9ba78f11c8932a2ec6145260b0cb3e9f

SHA256
2a7d8eaa1d0e8897b7c654e79ad5d1d4b5c83722940222841fe344049e065232

SHA512
7bec4d3e0e163767ad415875cbe79cc33130a214451ec131d941eb820a5320e863263a984e2ed34210bf59d2ed287b6cecf983f32d262acc565bef09e005607f

Download Submit
C:\Windows\System\qaXMwui.exe

Filesize
1.5MB

MD5
16a2f5431305abb7c6949d13b19d3d8b

SHA1
16f37f2e87b7c1d61ecaa8ce31a86893ae124706

SHA256
adb7f71dfb46e1a7ed597fb8a972af5d624590cc75ed5643f1c0fa548adaca66

SHA512
a9177bd90154b54d829ffa369a3d87e298eda32aa994e76330e8f81c8e967b11f357ce6879a93ef8c0c2e665a092864b8f64a7139fca64284de63c0c3060f995

Download Submit
C:\Windows\System\qnCBato.exe

Filesize
1.5MB

MD5
bf6172795cb35fd2b01fe4817d6c53cc

SHA1
0b2387a72cc9622537ef5a6b09666d2a9b03272b

SHA256
9aa876dfbda75d71bf590699f1eb6f0f5530f2f71ff91c3c0e0f23678f213cdb

SHA512
fb5234fc1428285f5fbcf37f0204a3103f1867db0ed5e83d5bca09afa030c567e60d35dc34fb0b36e5c1ee5aac8f9da591995ea9d5675c5e8ff2b7c76547e2c4

Download Submit
C:\Windows\System\rxDunFk.exe

Filesize
1.5MB

MD5
c4f210c659681f12ef1c83a6ebecebdd

SHA1
588152fb80287470b9f91660e63cf6dd2973f4fc

SHA256
e75b4497558f069db72b62318cb5915a9e0c8830cb72b9c2d929e79fec204c23

SHA512
bb663331a68c657fa6afb8720bd241b766613c6086000bd1292b46819530f562ea93621ae67b21b528206fed245d50403c47106d8461d12a98d5874300f7a620

Download Submit
C:\Windows\System\xOfinLB.exe

Filesize
1.5MB

MD5
36b43ab61efd2aa4d9af5cfed48c73e5

SHA1
31e69caf55a2873d0ed7a6f8e862b356ca53d2b4

SHA256
da4d63f2937d5c051b0535906a8ecc3c5260a7d7b97caf15ae8f846473ba5468

SHA512
d9a44c1488446f3bfb47361faed9705ce7fdca81e4401eb58ee6e6d17846e4d238f3ef345ef75e7bcba4dddd1fdedf2912137cd85dedc9246d19d377a1926df8

Download Submit
memory/64-86-0x00007FF731260000-0x00007FF731652000-memory.dmp

Filesize
3.9MB

Download
memory/64-2018-0x00007FF731260000-0x00007FF731652000-memory.dmp

Filesize
3.9MB

Download
memory/412-204-0x00007FF629520000-0x00007FF629912000-memory.dmp

Filesize
3.9MB

Download
memory/412-2076-0x00007FF629520000-0x00007FF629912000-memory.dmp

Filesize
3.9MB

Download
memory/892-1961-0x00007FF631620000-0x00007FF631A12000-memory.dmp

Filesize
3.9MB

Download
memory/892-115-0x00007FF631620000-0x00007FF631A12000-memory.dmp

Filesize
3.9MB

Download
memory/892-2062-0x00007FF631620000-0x00007FF631A12000-memory.dmp

Filesize
3.9MB

Download
memory/1120-14-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-1957-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-2011-0x00007FF6E4FC0000-0x00007FF6E53B2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-1960-0x00007FF601C80000-0x00007FF602072000-memory.dmp

Filesize
3.9MB

Download
memory/1152-114-0x00007FF601C80000-0x00007FF602072000-memory.dmp

Filesize
3.9MB

Download
memory/1152-2066-0x00007FF601C80000-0x00007FF602072000-memory.dmp

Filesize
3.9MB

Download
memory/1444-2027-0x00007FF71A040000-0x00007FF71A432000-memory.dmp

Filesize
3.9MB

Download
memory/1444-105-0x00007FF71A040000-0x00007FF71A432000-memory.dmp

Filesize
3.9MB

Download
memory/1500-75-0x00007FF69D3F0000-0x00007FF69D7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-2013-0x00007FF69D3F0000-0x00007FF69D7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-1993-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1860-41-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1860-1958-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1860-1956-0x00007FFE778F3000-0x00007FFE778F5000-memory.dmp

Filesize
8KB

Download
memory/1860-136-0x00000174007B0000-0x0000017400F56000-memory.dmp

Filesize
7.6MB

Download
memory/1860-53-0x00000173FF900000-0x00000173FF922000-memory.dmp

Filesize
136KB

Download
memory/1860-5-0x00007FFE778F3000-0x00007FFE778F5000-memory.dmp

Filesize
8KB

Download
memory/1860-69-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1968-132-0x00007FF71B740000-0x00007FF71BB32000-memory.dmp

Filesize
3.9MB

Download
memory/1968-2064-0x00007FF71B740000-0x00007FF71BB32000-memory.dmp

Filesize
3.9MB

Download
memory/2100-2015-0x00007FF7E5F90000-0x00007FF7E6382000-memory.dmp

Filesize
3.9MB

Download
memory/2100-119-0x00007FF7E5F90000-0x00007FF7E6382000-memory.dmp

Filesize
3.9MB

Download
memory/2200-2009-0x00007FF685AC0000-0x00007FF685EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-118-0x00007FF685AC0000-0x00007FF685EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2035-0x00007FF67D680000-0x00007FF67DA72000-memory.dmp

Filesize
3.9MB

Download
memory/2316-130-0x00007FF67D680000-0x00007FF67DA72000-memory.dmp

Filesize
3.9MB

Download
memory/2756-2023-0x00007FF780D30000-0x00007FF781122000-memory.dmp

Filesize
3.9MB

Download
memory/2756-80-0x00007FF780D30000-0x00007FF781122000-memory.dmp

Filesize
3.9MB

Download
memory/3428-174-0x00007FF749710000-0x00007FF749B02000-memory.dmp

Filesize
3.9MB

Download
memory/3428-2072-0x00007FF749710000-0x00007FF749B02000-memory.dmp

Filesize
3.9MB

Download
memory/3620-157-0x00007FF6DEED0000-0x00007FF6DF2C2000-memory.dmp

Filesize
3.9MB

Download
memory/3620-2070-0x00007FF6DEED0000-0x00007FF6DF2C2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-2029-0x00007FF7C5B10000-0x00007FF7C5F02000-memory.dmp

Filesize
3.9MB

Download
memory/3624-98-0x00007FF7C5B10000-0x00007FF7C5F02000-memory.dmp

Filesize
3.9MB

Download
memory/3704-2033-0x00007FF6A9090000-0x00007FF6A9482000-memory.dmp

Filesize
3.9MB

Download
memory/3704-128-0x00007FF6A9090000-0x00007FF6A9482000-memory.dmp

Filesize
3.9MB

Download
memory/3720-0-0x00007FF670770000-0x00007FF670B62000-memory.dmp

Filesize
3.9MB

Download
memory/3720-1-0x000001DA5C940000-0x000001DA5C950000-memory.dmp

Filesize
64KB

Download
memory/3968-91-0x00007FF6D83E0000-0x00007FF6D87D2000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2025-0x00007FF6D83E0000-0x00007FF6D87D2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-2032-0x00007FF67CEB0000-0x00007FF67D2A2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-125-0x00007FF67CEB0000-0x00007FF67D2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4276-90-0x00007FF68BAF0000-0x00007FF68BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4276-2022-0x00007FF68BAF0000-0x00007FF68BEE2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-1983-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2068-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-133-0x00007FF6562D0000-0x00007FF6566C2000-memory.dmp

Filesize
3.9MB

Download
memory/4732-2046-0x00007FF647140000-0x00007FF647532000-memory.dmp

Filesize
3.9MB

Download
memory/4732-1959-0x00007FF647140000-0x00007FF647532000-memory.dmp

Filesize
3.9MB

Download
memory/4732-110-0x00007FF647140000-0x00007FF647532000-memory.dmp

Filesize
3.9MB

Download
memory/4756-166-0x00007FF6225E0000-0x00007FF6229D2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-2007-0x00007FF6225E0000-0x00007FF6229D2000-memory.dmp

Filesize
3.9MB

Download
memory/4756-2078-0x00007FF6225E0000-0x00007FF6229D2000-memory.dmp

Filesize
3.9MB

Download
memory/4800-131-0x00007FF70E710000-0x00007FF70EB02000-memory.dmp

Filesize
3.9MB

Download
memory/4800-2037-0x00007FF70E710000-0x00007FF70EB02000-memory.dmp

Filesize
3.9MB

Download
memory/4976-81-0x00007FF766A20000-0x00007FF766E12000-memory.dmp

Filesize
3.9MB

Download
memory/4976-2019-0x00007FF766A20000-0x00007FF766E12000-memory.dmp

Filesize
3.9MB

Download