xmrig | 0a85e18ebc638673416266e65fc5973e47e59c781938ee73c03cd3624110fc3c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
Size 2.7MB
Sample240519-b82ymacb9z
SHA256 0a85e18ebc638673416266e65fc5973e47e59c781938ee73c03cd3624110fc3c
MD5 4a9245c604a3e2a83a31959118efd420
SHA1 d65570111408075655102c47f204635440612d15
SHA512 5cb10530fa647129b4e01df28327cf4b3ffabf284a5abed799155a5216751f2cd46d37561c489015c0e09048ee45399d7b93e2bc9586a8ff9b9ab5d3138ce056
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCG:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF757F60000-0x00007FF758356000-memory.dmp	xmrig
behavioral2/files/0x0006000000023298-4.dat	xmrig
behavioral2/memory/340-23-0x00007FF71EAB0000-0x00007FF71EEA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-36.dat	xmrig
behavioral2/files/0x000700000002341a-50.dat	xmrig
behavioral2/files/0x000700000002341d-62.dat	xmrig
behavioral2/files/0x000700000002341f-64.dat	xmrig
behavioral2/files/0x000700000002341e-63.dat	xmrig
behavioral2/files/0x0007000000023424-93.dat	xmrig
behavioral2/memory/1696-112-0x00007FF64A920000-0x00007FF64AD16000-memory.dmp	xmrig
behavioral2/memory/3800-145-0x00007FF71AA00000-0x00007FF71ADF6000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-163.dat	xmrig
behavioral2/files/0x0008000000023411-183.dat	xmrig
behavioral2/memory/4628-216-0x00007FF79B9A0000-0x00007FF79BD96000-memory.dmp	xmrig
behavioral2/memory/4180-228-0x00007FF775D20000-0x00007FF776116000-memory.dmp	xmrig
behavioral2/memory/2140-233-0x00007FF77B8A0000-0x00007FF77BC96000-memory.dmp	xmrig
behavioral2/memory/856-239-0x00007FF6EC530000-0x00007FF6EC926000-memory.dmp	xmrig
behavioral2/memory/1412-241-0x00007FF7812B0000-0x00007FF7816A6000-memory.dmp	xmrig
behavioral2/memory/3140-240-0x00007FF64E070000-0x00007FF64E466000-memory.dmp	xmrig
behavioral2/memory/4112-238-0x00007FF751BE0000-0x00007FF751FD6000-memory.dmp	xmrig
behavioral2/memory/3156-237-0x00007FF6538D0000-0x00007FF653CC6000-memory.dmp	xmrig
behavioral2/memory/3848-236-0x00007FF614470000-0x00007FF614866000-memory.dmp	xmrig
behavioral2/memory/372-235-0x00007FF6C6D60000-0x00007FF6C7156000-memory.dmp	xmrig
behavioral2/memory/2096-234-0x00007FF7C1290000-0x00007FF7C1686000-memory.dmp	xmrig
behavioral2/memory/3204-232-0x00007FF6D01A0000-0x00007FF6D0596000-memory.dmp	xmrig
behavioral2/memory/4792-231-0x00007FF750650000-0x00007FF750A46000-memory.dmp	xmrig
behavioral2/memory/880-230-0x00007FF7458B0000-0x00007FF745CA6000-memory.dmp	xmrig
behavioral2/memory/2524-229-0x00007FF6BC520000-0x00007FF6BC916000-memory.dmp	xmrig
behavioral2/memory/3644-227-0x00007FF649DA0000-0x00007FF64A196000-memory.dmp	xmrig
behavioral2/memory/1344-222-0x00007FF7BC290000-0x00007FF7BC686000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-181.dat	xmrig
behavioral2/files/0x0008000000023421-179.dat	xmrig
behavioral2/files/0x0007000000023432-178.dat	xmrig
behavioral2/files/0x0007000000023431-175.dat	xmrig
behavioral2/files/0x000700000002342c-173.dat	xmrig
behavioral2/files/0x000700000002342b-171.dat	xmrig
behavioral2/files/0x0007000000023430-170.dat	xmrig
behavioral2/files/0x000700000002342f-169.dat	xmrig
behavioral2/files/0x000700000002342a-152.dat	xmrig
behavioral2/files/0x0007000000023429-150.dat	xmrig
behavioral2/files/0x0007000000023428-140.dat	xmrig
behavioral2/files/0x0007000000023427-138.dat	xmrig
behavioral2/memory/3628-131-0x00007FF78E600000-0x00007FF78E9F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-128.dat	xmrig
behavioral2/files/0x0007000000023426-132.dat	xmrig
behavioral2/memory/2484-126-0x00007FF6C6D50000-0x00007FF6C7146000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-120.dat	xmrig
behavioral2/memory/3916-94-0x00007FF69E580000-0x00007FF69E976000-memory.dmp	xmrig
behavioral2/files/0x0008000000023422-106.dat	xmrig
behavioral2/files/0x000700000002341c-103.dat	xmrig
behavioral2/files/0x0007000000023420-86.dat	xmrig
behavioral2/files/0x000700000002341b-76.dat	xmrig
behavioral2/files/0x0007000000023418-44.dat	xmrig
behavioral2/files/0x0007000000023417-39.dat	xmrig
behavioral2/files/0x0007000000023416-37.dat	xmrig
behavioral2/files/0x0007000000023415-29.dat	xmrig
behavioral2/files/0x0007000000023414-19.dat	xmrig
behavioral2/files/0x0008000000023410-21.dat	xmrig
behavioral2/memory/2840-13-0x00007FF6DF080000-0x00007FF6DF476000-memory.dmp	xmrig
behavioral2/memory/2840-2911-0x00007FF6DF080000-0x00007FF6DF476000-memory.dmp	xmrig
behavioral2/memory/3916-2912-0x00007FF69E580000-0x00007FF69E976000-memory.dmp	xmrig
behavioral2/memory/340-2913-0x00007FF71EAB0000-0x00007FF71EEA6000-memory.dmp	xmrig
behavioral2/memory/3156-2914-0x00007FF6538D0000-0x00007FF653CC6000-memory.dmp	xmrig
behavioral2/memory/3848-2916-0x00007FF614470000-0x00007FF614866000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
9	3144	powershell.exe
12	3144	powershell.exe
14	3144	powershell.exe
15	3144	powershell.exe
17	3144	powershell.exe
24	3144	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3144	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2840	PVYJEmH.exe
340	wUyqFgo.exe
3848	gVHtTbD.exe
3916	ZkilhUp.exe
3156	dTEAKDI.exe
1696	eTSkyMh.exe
2484	KBDuNHb.exe
3628	gMBSTFL.exe
3800	jIkLrvE.exe
4628	ECMLqkL.exe
1344	iSNggoL.exe
4112	ZHuYokt.exe
3644	ZtJjDSC.exe
4180	NMFsbnU.exe
2524	MVUWkWN.exe
880	ZIaTZrf.exe
4792	FWZCByZ.exe
856	ySFxvXo.exe
3204	nNwuTLD.exe
3140	IciLufU.exe
2140	khwkYTA.exe
2096	npGyzkg.exe
1412	TAUzFXI.exe
372	WsetzHg.exe
3284	WCrMVrp.exe
760	rclsqDZ.exe
2628	DDaFRse.exe
1192	cyJQixB.exe
4516	kYKDMvF.exe
2144	jVQeOwL.exe
3868	eYiWTHX.exe
4328	ipqxQSr.exe
2084	CBUspAe.exe
3808	yXuBIzT.exe
3308	GLiQnxU.exe
3056	GfHQtgf.exe
1476	cdQMgjp.exe
1008	nzrAqRY.exe
1800	VMoGdgL.exe
1068	sayNfFe.exe
5116	gQaTjIn.exe
1020	REMJPOe.exe
5008	lENNGUj.exe
4428	oBixorn.exe
4432	BZoUYFC.exe
4044	IqEudYT.exe
4296	naqJcXf.exe
2760	UySZubU.exe
5052	LwGtDmB.exe
3196	QQaiUZu.exe
2240	igwZowf.exe
1756	lBlCdgu.exe
1136	Iiskffc.exe
1740	kDgOEQX.exe
1884	CjQOOJx.exe
3008	fxwmUiG.exe
4576	noPhxYd.exe
4900	mKvxyXS.exe
1228	lQRstmH.exe
4372	TQqWUyn.exe
3884	BYVMtLh.exe
408	zfmAERV.exe
3496	FsiZwfW.exe
2164	JyqOPGH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF757F60000-0x00007FF758356000-memory.dmp	upx
behavioral2/files/0x0006000000023298-4.dat	upx
behavioral2/memory/340-23-0x00007FF71EAB0000-0x00007FF71EEA6000-memory.dmp	upx
behavioral2/files/0x0007000000023419-36.dat	upx
behavioral2/files/0x000700000002341a-50.dat	upx
behavioral2/files/0x000700000002341d-62.dat	upx
behavioral2/files/0x000700000002341f-64.dat	upx
behavioral2/files/0x000700000002341e-63.dat	upx
behavioral2/files/0x0007000000023424-93.dat	upx
behavioral2/memory/1696-112-0x00007FF64A920000-0x00007FF64AD16000-memory.dmp	upx
behavioral2/memory/3800-145-0x00007FF71AA00000-0x00007FF71ADF6000-memory.dmp	upx
behavioral2/files/0x000700000002342d-163.dat	upx
behavioral2/files/0x0008000000023411-183.dat	upx
behavioral2/memory/4628-216-0x00007FF79B9A0000-0x00007FF79BD96000-memory.dmp	upx
behavioral2/memory/4180-228-0x00007FF775D20000-0x00007FF776116000-memory.dmp	upx
behavioral2/memory/2140-233-0x00007FF77B8A0000-0x00007FF77BC96000-memory.dmp	upx
behavioral2/memory/856-239-0x00007FF6EC530000-0x00007FF6EC926000-memory.dmp	upx
behavioral2/memory/1412-241-0x00007FF7812B0000-0x00007FF7816A6000-memory.dmp	upx
behavioral2/memory/3140-240-0x00007FF64E070000-0x00007FF64E466000-memory.dmp	upx
behavioral2/memory/4112-238-0x00007FF751BE0000-0x00007FF751FD6000-memory.dmp	upx
behavioral2/memory/3156-237-0x00007FF6538D0000-0x00007FF653CC6000-memory.dmp	upx
behavioral2/memory/3848-236-0x00007FF614470000-0x00007FF614866000-memory.dmp	upx
behavioral2/memory/372-235-0x00007FF6C6D60000-0x00007FF6C7156000-memory.dmp	upx
behavioral2/memory/2096-234-0x00007FF7C1290000-0x00007FF7C1686000-memory.dmp	upx
behavioral2/memory/3204-232-0x00007FF6D01A0000-0x00007FF6D0596000-memory.dmp	upx
behavioral2/memory/4792-231-0x00007FF750650000-0x00007FF750A46000-memory.dmp	upx
behavioral2/memory/880-230-0x00007FF7458B0000-0x00007FF745CA6000-memory.dmp	upx
behavioral2/memory/2524-229-0x00007FF6BC520000-0x00007FF6BC916000-memory.dmp	upx
behavioral2/memory/3644-227-0x00007FF649DA0000-0x00007FF64A196000-memory.dmp	upx
behavioral2/memory/1344-222-0x00007FF7BC290000-0x00007FF7BC686000-memory.dmp	upx
behavioral2/files/0x000700000002342e-181.dat	upx
behavioral2/files/0x0008000000023421-179.dat	upx
behavioral2/files/0x0007000000023432-178.dat	upx
behavioral2/files/0x0007000000023431-175.dat	upx
behavioral2/files/0x000700000002342c-173.dat	upx
behavioral2/files/0x000700000002342b-171.dat	upx
behavioral2/files/0x0007000000023430-170.dat	upx
behavioral2/files/0x000700000002342f-169.dat	upx
behavioral2/files/0x000700000002342a-152.dat	upx
behavioral2/files/0x0007000000023429-150.dat	upx
behavioral2/files/0x0007000000023428-140.dat	upx
behavioral2/files/0x0007000000023427-138.dat	upx
behavioral2/memory/3628-131-0x00007FF78E600000-0x00007FF78E9F6000-memory.dmp	upx
behavioral2/files/0x0007000000023425-128.dat	upx
behavioral2/files/0x0007000000023426-132.dat	upx
behavioral2/memory/2484-126-0x00007FF6C6D50000-0x00007FF6C7146000-memory.dmp	upx
behavioral2/files/0x0007000000023423-120.dat	upx
behavioral2/memory/3916-94-0x00007FF69E580000-0x00007FF69E976000-memory.dmp	upx
behavioral2/files/0x0008000000023422-106.dat	upx
behavioral2/files/0x000700000002341c-103.dat	upx
behavioral2/files/0x0007000000023420-86.dat	upx
behavioral2/files/0x000700000002341b-76.dat	upx
behavioral2/files/0x0007000000023418-44.dat	upx
behavioral2/files/0x0007000000023417-39.dat	upx
behavioral2/files/0x0007000000023416-37.dat	upx
behavioral2/files/0x0007000000023415-29.dat	upx
behavioral2/files/0x0007000000023414-19.dat	upx
behavioral2/files/0x0008000000023410-21.dat	upx
behavioral2/memory/2840-13-0x00007FF6DF080000-0x00007FF6DF476000-memory.dmp	upx
behavioral2/memory/2840-2911-0x00007FF6DF080000-0x00007FF6DF476000-memory.dmp	upx
behavioral2/memory/3916-2912-0x00007FF69E580000-0x00007FF69E976000-memory.dmp	upx
behavioral2/memory/340-2913-0x00007FF71EAB0000-0x00007FF71EEA6000-memory.dmp	upx
behavioral2/memory/3156-2914-0x00007FF6538D0000-0x00007FF653CC6000-memory.dmp	upx
behavioral2/memory/3848-2916-0x00007FF614470000-0x00007FF614866000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lNzxMnt.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\hxMsSqk.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\NsoMrnY.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\LOntKpQ.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\PVKDWsG.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\SLRhbgo.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\fPwTBNA.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\mwQWWsR.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\sBEbkUL.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\KIjgNBR.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\AYOrAkm.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\tFXDJyv.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\aFosAwh.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\CSHYPvg.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\fCjIUCL.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\lbkFrOu.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\XixxzmY.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\QzGiddl.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\sLhhgUc.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\KdyRFDW.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\rMofvSD.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\DXYvZCW.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\qnPNyPn.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\ObVROji.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\MADjuOZ.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\JlSknGm.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\tNNBTKX.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\AfdhKDG.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\WeTnOhT.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\mCRzFyA.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\QqtyPCn.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\EFuahsr.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\MKfKnPY.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\jxQSfdz.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\PhSTmTF.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\UstYkaX.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\ymFxMTy.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\hCRNuig.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\KSVphMB.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\TAUzFXI.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\yvfiXvx.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\qcEujGo.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\JfzaHPx.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\CPLPFbK.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\onEtqNh.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\YJnZAOs.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\gjhxUND.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\QgUMZqR.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\OmSEYAI.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\OlyaHtR.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\lKUyKfy.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\WgGtOBB.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\WLpDsCz.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\KOunHUZ.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\ggQeGll.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\jcmrzfl.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\onuheSC.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\rGSxiRK.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\GfusqFu.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\fWCmHil.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\CJuUSFN.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\DFtrriO.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\jSTtmwH.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
File created	C:\Windows\System\FUIARFq.exe	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3144	powershell.exe
3144	powershell.exe
3144	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeLockMemoryPrivilege	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3144	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	83
PID 2260 wrote to memory of 3144	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	83
PID 2260 wrote to memory of 2840	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	84
PID 2260 wrote to memory of 2840	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	84
PID 2260 wrote to memory of 340	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	85
PID 2260 wrote to memory of 340	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	85
PID 2260 wrote to memory of 3916	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	86
PID 2260 wrote to memory of 3916	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	86
PID 2260 wrote to memory of 3848	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	87
PID 2260 wrote to memory of 3848	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	87
PID 2260 wrote to memory of 3156	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	88
PID 2260 wrote to memory of 3156	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	88
PID 2260 wrote to memory of 1696	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	89
PID 2260 wrote to memory of 1696	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	89
PID 2260 wrote to memory of 2484	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	90
PID 2260 wrote to memory of 2484	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	90
PID 2260 wrote to memory of 3628	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	91
PID 2260 wrote to memory of 3628	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	91
PID 2260 wrote to memory of 3800	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 3800	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	92
PID 2260 wrote to memory of 4628	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	93
PID 2260 wrote to memory of 4628	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	93
PID 2260 wrote to memory of 1344	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	94
PID 2260 wrote to memory of 1344	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	94
PID 2260 wrote to memory of 4112	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	95
PID 2260 wrote to memory of 4112	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	95
PID 2260 wrote to memory of 3644	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	96
PID 2260 wrote to memory of 3644	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	96
PID 2260 wrote to memory of 4180	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	97
PID 2260 wrote to memory of 4180	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	97
PID 2260 wrote to memory of 2524	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	98
PID 2260 wrote to memory of 2524	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	98
PID 2260 wrote to memory of 880	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	99
PID 2260 wrote to memory of 880	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	99
PID 2260 wrote to memory of 4792	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	100
PID 2260 wrote to memory of 4792	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	100
PID 2260 wrote to memory of 856	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	101
PID 2260 wrote to memory of 856	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	101
PID 2260 wrote to memory of 3204	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	102
PID 2260 wrote to memory of 3204	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	102
PID 2260 wrote to memory of 3140	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	103
PID 2260 wrote to memory of 3140	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	103
PID 2260 wrote to memory of 2140	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	104
PID 2260 wrote to memory of 2140	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	104
PID 2260 wrote to memory of 2096	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	105
PID 2260 wrote to memory of 2096	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	105
PID 2260 wrote to memory of 1412	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	106
PID 2260 wrote to memory of 1412	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	106
PID 2260 wrote to memory of 372	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	107
PID 2260 wrote to memory of 372	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	107
PID 2260 wrote to memory of 2144	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	108
PID 2260 wrote to memory of 2144	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	108
PID 2260 wrote to memory of 3284	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	109
PID 2260 wrote to memory of 3284	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	109
PID 2260 wrote to memory of 760	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	110
PID 2260 wrote to memory of 760	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	110
PID 2260 wrote to memory of 2628	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	111
PID 2260 wrote to memory of 2628	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	111
PID 2260 wrote to memory of 1192	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	112
PID 2260 wrote to memory of 1192	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	112
PID 2260 wrote to memory of 4516	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	113
PID 2260 wrote to memory of 4516	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	113
PID 2260 wrote to memory of 3868	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	114
PID 2260 wrote to memory of 3868	2260	4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a9245c604a3e2a83a31959118efd420_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\System\PVYJEmH.exe
  C:\Windows\System\PVYJEmH.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\wUyqFgo.exe
  C:\Windows\System\wUyqFgo.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\ZkilhUp.exe
  C:\Windows\System\ZkilhUp.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\gVHtTbD.exe
  C:\Windows\System\gVHtTbD.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\dTEAKDI.exe
  C:\Windows\System\dTEAKDI.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\eTSkyMh.exe
  C:\Windows\System\eTSkyMh.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\KBDuNHb.exe
  C:\Windows\System\KBDuNHb.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\gMBSTFL.exe
  C:\Windows\System\gMBSTFL.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\jIkLrvE.exe
  C:\Windows\System\jIkLrvE.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\ECMLqkL.exe
  C:\Windows\System\ECMLqkL.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\iSNggoL.exe
  C:\Windows\System\iSNggoL.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\ZHuYokt.exe
  C:\Windows\System\ZHuYokt.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ZtJjDSC.exe
  C:\Windows\System\ZtJjDSC.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\NMFsbnU.exe
  C:\Windows\System\NMFsbnU.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\MVUWkWN.exe
  C:\Windows\System\MVUWkWN.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ZIaTZrf.exe
  C:\Windows\System\ZIaTZrf.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\FWZCByZ.exe
  C:\Windows\System\FWZCByZ.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\ySFxvXo.exe
  C:\Windows\System\ySFxvXo.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\nNwuTLD.exe
  C:\Windows\System\nNwuTLD.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\IciLufU.exe
  C:\Windows\System\IciLufU.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\khwkYTA.exe
  C:\Windows\System\khwkYTA.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\npGyzkg.exe
  C:\Windows\System\npGyzkg.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\TAUzFXI.exe
  C:\Windows\System\TAUzFXI.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\WsetzHg.exe
  C:\Windows\System\WsetzHg.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\jVQeOwL.exe
  C:\Windows\System\jVQeOwL.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\WCrMVrp.exe
  C:\Windows\System\WCrMVrp.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\rclsqDZ.exe
  C:\Windows\System\rclsqDZ.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\DDaFRse.exe
  C:\Windows\System\DDaFRse.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\cyJQixB.exe
  C:\Windows\System\cyJQixB.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\kYKDMvF.exe
  C:\Windows\System\kYKDMvF.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\eYiWTHX.exe
  C:\Windows\System\eYiWTHX.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ipqxQSr.exe
  C:\Windows\System\ipqxQSr.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\CBUspAe.exe
  C:\Windows\System\CBUspAe.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\yXuBIzT.exe
  C:\Windows\System\yXuBIzT.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\GLiQnxU.exe
  C:\Windows\System\GLiQnxU.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\GfHQtgf.exe
  C:\Windows\System\GfHQtgf.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\cdQMgjp.exe
  C:\Windows\System\cdQMgjp.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\nzrAqRY.exe
  C:\Windows\System\nzrAqRY.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\VMoGdgL.exe
  C:\Windows\System\VMoGdgL.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\sayNfFe.exe
  C:\Windows\System\sayNfFe.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\gQaTjIn.exe
  C:\Windows\System\gQaTjIn.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\REMJPOe.exe
  C:\Windows\System\REMJPOe.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\lENNGUj.exe
  C:\Windows\System\lENNGUj.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\oBixorn.exe
  C:\Windows\System\oBixorn.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\BZoUYFC.exe
  C:\Windows\System\BZoUYFC.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\IqEudYT.exe
  C:\Windows\System\IqEudYT.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\naqJcXf.exe
  C:\Windows\System\naqJcXf.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\UySZubU.exe
  C:\Windows\System\UySZubU.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\LwGtDmB.exe
  C:\Windows\System\LwGtDmB.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\QQaiUZu.exe
  C:\Windows\System\QQaiUZu.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\igwZowf.exe
  C:\Windows\System\igwZowf.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\lBlCdgu.exe
  C:\Windows\System\lBlCdgu.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\Iiskffc.exe
  C:\Windows\System\Iiskffc.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\kDgOEQX.exe
  C:\Windows\System\kDgOEQX.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\CjQOOJx.exe
  C:\Windows\System\CjQOOJx.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\fxwmUiG.exe
  C:\Windows\System\fxwmUiG.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\noPhxYd.exe
  C:\Windows\System\noPhxYd.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\mKvxyXS.exe
  C:\Windows\System\mKvxyXS.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\lQRstmH.exe
  C:\Windows\System\lQRstmH.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\TQqWUyn.exe
  C:\Windows\System\TQqWUyn.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\BYVMtLh.exe
  C:\Windows\System\BYVMtLh.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\zfmAERV.exe
  C:\Windows\System\zfmAERV.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\FsiZwfW.exe
  C:\Windows\System\FsiZwfW.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\JyqOPGH.exe
  C:\Windows\System\JyqOPGH.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\tKEkQzX.exe
  C:\Windows\System\tKEkQzX.exe
  2⤵
  PID:5104
- C:\Windows\System\SUcpssC.exe
  C:\Windows\System\SUcpssC.exe
  2⤵
  PID:4132
- C:\Windows\System\uFPJthI.exe
  C:\Windows\System\uFPJthI.exe
  2⤵
  PID:1732
- C:\Windows\System\rDMfxry.exe
  C:\Windows\System\rDMfxry.exe
  2⤵
  PID:748
- C:\Windows\System\dzhQdcV.exe
  C:\Windows\System\dzhQdcV.exe
  2⤵
  PID:4704
- C:\Windows\System\sNMFsQJ.exe
  C:\Windows\System\sNMFsQJ.exe
  2⤵
  PID:4240
- C:\Windows\System\OrhihlI.exe
  C:\Windows\System\OrhihlI.exe
  2⤵
  PID:3928
- C:\Windows\System\ooYkVCj.exe
  C:\Windows\System\ooYkVCj.exe
  2⤵
  PID:3700
- C:\Windows\System\qPiszXa.exe
  C:\Windows\System\qPiszXa.exe
  2⤵
  PID:2160
- C:\Windows\System\JkQCmWe.exe
  C:\Windows\System\JkQCmWe.exe
  2⤵
  PID:556
- C:\Windows\System\BLDqBlL.exe
  C:\Windows\System\BLDqBlL.exe
  2⤵
  PID:1060
- C:\Windows\System\dkttpvx.exe
  C:\Windows\System\dkttpvx.exe
  2⤵
  PID:4972
- C:\Windows\System\cztrWaD.exe
  C:\Windows\System\cztrWaD.exe
  2⤵
  PID:2648
- C:\Windows\System\IjIdvgp.exe
  C:\Windows\System\IjIdvgp.exe
  2⤵
  PID:716
- C:\Windows\System\QzGiddl.exe
  C:\Windows\System\QzGiddl.exe
  2⤵
  PID:4440
- C:\Windows\System\nupsYzO.exe
  C:\Windows\System\nupsYzO.exe
  2⤵
  PID:2828
- C:\Windows\System\PGKzZCR.exe
  C:\Windows\System\PGKzZCR.exe
  2⤵
  PID:2512
- C:\Windows\System\HyqeMyQ.exe
  C:\Windows\System\HyqeMyQ.exe
  2⤵
  PID:3360
- C:\Windows\System\pvyKrxW.exe
  C:\Windows\System\pvyKrxW.exe
  2⤵
  PID:1840
- C:\Windows\System\tKOUFkd.exe
  C:\Windows\System\tKOUFkd.exe
  2⤵
  PID:592
- C:\Windows\System\XLTScHm.exe
  C:\Windows\System\XLTScHm.exe
  2⤵
  PID:5140
- C:\Windows\System\mdJMcfv.exe
  C:\Windows\System\mdJMcfv.exe
  2⤵
  PID:5180
- C:\Windows\System\tlYiNlq.exe
  C:\Windows\System\tlYiNlq.exe
  2⤵
  PID:5200
- C:\Windows\System\ObVROji.exe
  C:\Windows\System\ObVROji.exe
  2⤵
  PID:5256
- C:\Windows\System\sYAMFoN.exe
  C:\Windows\System\sYAMFoN.exe
  2⤵
  PID:5296
- C:\Windows\System\HcfGLJL.exe
  C:\Windows\System\HcfGLJL.exe
  2⤵
  PID:5348
- C:\Windows\System\WUTxhsP.exe
  C:\Windows\System\WUTxhsP.exe
  2⤵
  PID:5392
- C:\Windows\System\konoWMe.exe
  C:\Windows\System\konoWMe.exe
  2⤵
  PID:5472
- C:\Windows\System\lfxvqJc.exe
  C:\Windows\System\lfxvqJc.exe
  2⤵
  PID:5504
- C:\Windows\System\lHGDcoB.exe
  C:\Windows\System\lHGDcoB.exe
  2⤵
  PID:5572
- C:\Windows\System\PZFIYBD.exe
  C:\Windows\System\PZFIYBD.exe
  2⤵
  PID:5600
- C:\Windows\System\WEjfQYK.exe
  C:\Windows\System\WEjfQYK.exe
  2⤵
  PID:5652
- C:\Windows\System\rhwYVtT.exe
  C:\Windows\System\rhwYVtT.exe
  2⤵
  PID:5668
- C:\Windows\System\jPxuFzz.exe
  C:\Windows\System\jPxuFzz.exe
  2⤵
  PID:5692
- C:\Windows\System\XknKUrM.exe
  C:\Windows\System\XknKUrM.exe
  2⤵
  PID:5748
- C:\Windows\System\XUwLjEP.exe
  C:\Windows\System\XUwLjEP.exe
  2⤵
  PID:5788
- C:\Windows\System\HeDFuzu.exe
  C:\Windows\System\HeDFuzu.exe
  2⤵
  PID:5828
- C:\Windows\System\ZAtOUxk.exe
  C:\Windows\System\ZAtOUxk.exe
  2⤵
  PID:5856
- C:\Windows\System\OWkmjcH.exe
  C:\Windows\System\OWkmjcH.exe
  2⤵
  PID:5920
- C:\Windows\System\hiTRlfL.exe
  C:\Windows\System\hiTRlfL.exe
  2⤵
  PID:5952
- C:\Windows\System\NNeixlY.exe
  C:\Windows\System\NNeixlY.exe
  2⤵
  PID:6008
- C:\Windows\System\wouEOWU.exe
  C:\Windows\System\wouEOWU.exe
  2⤵
  PID:6032
- C:\Windows\System\SXSTKHa.exe
  C:\Windows\System\SXSTKHa.exe
  2⤵
  PID:6072
- C:\Windows\System\JQjlatB.exe
  C:\Windows\System\JQjlatB.exe
  2⤵
  PID:6116
- C:\Windows\System\cMRAMeY.exe
  C:\Windows\System\cMRAMeY.exe
  2⤵
  PID:4020
- C:\Windows\System\ReEurjy.exe
  C:\Windows\System\ReEurjy.exe
  2⤵
  PID:4616
- C:\Windows\System\zPsqOeY.exe
  C:\Windows\System\zPsqOeY.exe
  2⤵
  PID:5252
- C:\Windows\System\sRnOEpB.exe
  C:\Windows\System\sRnOEpB.exe
  2⤵
  PID:5448
- C:\Windows\System\gnLfaKl.exe
  C:\Windows\System\gnLfaKl.exe
  2⤵
  PID:5372
- C:\Windows\System\FPMtSUo.exe
  C:\Windows\System\FPMtSUo.exe
  2⤵
  PID:5436
- C:\Windows\System\IOjPVLr.exe
  C:\Windows\System\IOjPVLr.exe
  2⤵
  PID:5560
- C:\Windows\System\GvNNMln.exe
  C:\Windows\System\GvNNMln.exe
  2⤵
  PID:5608
- C:\Windows\System\hCOOKCi.exe
  C:\Windows\System\hCOOKCi.exe
  2⤵
  PID:5732
- C:\Windows\System\GHOJRuD.exe
  C:\Windows\System\GHOJRuD.exe
  2⤵
  PID:5760
- C:\Windows\System\MKJcQtt.exe
  C:\Windows\System\MKJcQtt.exe
  2⤵
  PID:5812
- C:\Windows\System\uUkhErm.exe
  C:\Windows\System\uUkhErm.exe
  2⤵
  PID:3784
- C:\Windows\System\dwAzfZO.exe
  C:\Windows\System\dwAzfZO.exe
  2⤵
  PID:5932
- C:\Windows\System\JjtjEYb.exe
  C:\Windows\System\JjtjEYb.exe
  2⤵
  PID:5996
- C:\Windows\System\enhgvqA.exe
  C:\Windows\System\enhgvqA.exe
  2⤵
  PID:4260
- C:\Windows\System\qCYkiYV.exe
  C:\Windows\System\qCYkiYV.exe
  2⤵
  PID:6048
- C:\Windows\System\CephBLR.exe
  C:\Windows\System\CephBLR.exe
  2⤵
  PID:6132
- C:\Windows\System\xCVLqAY.exe
  C:\Windows\System\xCVLqAY.exe
  2⤵
  PID:5128
- C:\Windows\System\NfsDVcO.exe
  C:\Windows\System\NfsDVcO.exe
  2⤵
  PID:4556
- C:\Windows\System\rXeVGrl.exe
  C:\Windows\System\rXeVGrl.exe
  2⤵
  PID:5360
- C:\Windows\System\YBfJNwU.exe
  C:\Windows\System\YBfJNwU.exe
  2⤵
  PID:5536
- C:\Windows\System\PAsQKQv.exe
  C:\Windows\System\PAsQKQv.exe
  2⤵
  PID:5592
- C:\Windows\System\ymFxMTy.exe
  C:\Windows\System\ymFxMTy.exe
  2⤵
  PID:5704
- C:\Windows\System\fjUsDHO.exe
  C:\Windows\System\fjUsDHO.exe
  2⤵
  PID:1708
- C:\Windows\System\qHitirO.exe
  C:\Windows\System\qHitirO.exe
  2⤵
  PID:2280
- C:\Windows\System\ZtdoKcm.exe
  C:\Windows\System\ZtdoKcm.exe
  2⤵
  PID:3272
- C:\Windows\System\VLuVVTK.exe
  C:\Windows\System\VLuVVTK.exe
  2⤵
  PID:1932
- C:\Windows\System\NAVqIYH.exe
  C:\Windows\System\NAVqIYH.exe
  2⤵
  PID:6108
- C:\Windows\System\MADjuOZ.exe
  C:\Windows\System\MADjuOZ.exe
  2⤵
  PID:5420
- C:\Windows\System\eDgBARo.exe
  C:\Windows\System\eDgBARo.exe
  2⤵
  PID:5660
- C:\Windows\System\RjioHvx.exe
  C:\Windows\System\RjioHvx.exe
  2⤵
  PID:5540
- C:\Windows\System\fMjhJvm.exe
  C:\Windows\System\fMjhJvm.exe
  2⤵
  PID:2652
- C:\Windows\System\qGTdmMa.exe
  C:\Windows\System\qGTdmMa.exe
  2⤵
  PID:5868
- C:\Windows\System\SkmVDpW.exe
  C:\Windows\System\SkmVDpW.exe
  2⤵
  PID:1688
- C:\Windows\System\yDcMifT.exe
  C:\Windows\System\yDcMifT.exe
  2⤵
  PID:5328
- C:\Windows\System\UztGSfj.exe
  C:\Windows\System\UztGSfj.exe
  2⤵
  PID:5624
- C:\Windows\System\rrRGoSl.exe
  C:\Windows\System\rrRGoSl.exe
  2⤵
  PID:6140
- C:\Windows\System\HZJDniu.exe
  C:\Windows\System\HZJDniu.exe
  2⤵
  PID:5900
- C:\Windows\System\CtFvFlE.exe
  C:\Windows\System\CtFvFlE.exe
  2⤵
  PID:5488
- C:\Windows\System\gDVZHha.exe
  C:\Windows\System\gDVZHha.exe
  2⤵
  PID:6168
- C:\Windows\System\WQbkZgA.exe
  C:\Windows\System\WQbkZgA.exe
  2⤵
  PID:6204
- C:\Windows\System\jDqtNlA.exe
  C:\Windows\System\jDqtNlA.exe
  2⤵
  PID:6232
- C:\Windows\System\VNjMJvM.exe
  C:\Windows\System\VNjMJvM.exe
  2⤵
  PID:6264
- C:\Windows\System\pKRCjuL.exe
  C:\Windows\System\pKRCjuL.exe
  2⤵
  PID:6304
- C:\Windows\System\YwvCxnM.exe
  C:\Windows\System\YwvCxnM.exe
  2⤵
  PID:6332
- C:\Windows\System\tSIwoxP.exe
  C:\Windows\System\tSIwoxP.exe
  2⤵
  PID:6364
- C:\Windows\System\dBWyvHU.exe
  C:\Windows\System\dBWyvHU.exe
  2⤵
  PID:6396
- C:\Windows\System\UWyaOHs.exe
  C:\Windows\System\UWyaOHs.exe
  2⤵
  PID:6412
- C:\Windows\System\jYeXIFi.exe
  C:\Windows\System\jYeXIFi.exe
  2⤵
  PID:6444
- C:\Windows\System\ICWmVAD.exe
  C:\Windows\System\ICWmVAD.exe
  2⤵
  PID:6476
- C:\Windows\System\aHDMMWQ.exe
  C:\Windows\System\aHDMMWQ.exe
  2⤵
  PID:6496
- C:\Windows\System\hrmiizM.exe
  C:\Windows\System\hrmiizM.exe
  2⤵
  PID:6512
- C:\Windows\System\OTSPmCE.exe
  C:\Windows\System\OTSPmCE.exe
  2⤵
  PID:6544
- C:\Windows\System\xjJsLIR.exe
  C:\Windows\System\xjJsLIR.exe
  2⤵
  PID:6568
- C:\Windows\System\clClsdA.exe
  C:\Windows\System\clClsdA.exe
  2⤵
  PID:6588
- C:\Windows\System\XHMpFcv.exe
  C:\Windows\System\XHMpFcv.exe
  2⤵
  PID:6620
- C:\Windows\System\GAHmaAu.exe
  C:\Windows\System\GAHmaAu.exe
  2⤵
  PID:6664
- C:\Windows\System\UDpqCca.exe
  C:\Windows\System\UDpqCca.exe
  2⤵
  PID:6708
- C:\Windows\System\CvPEZUr.exe
  C:\Windows\System\CvPEZUr.exe
  2⤵
  PID:6752
- C:\Windows\System\JVYOWCc.exe
  C:\Windows\System\JVYOWCc.exe
  2⤵
  PID:6792
- C:\Windows\System\EvJMrOd.exe
  C:\Windows\System\EvJMrOd.exe
  2⤵
  PID:6824
- C:\Windows\System\zwygPUd.exe
  C:\Windows\System\zwygPUd.exe
  2⤵
  PID:6860
- C:\Windows\System\cRrtQsk.exe
  C:\Windows\System\cRrtQsk.exe
  2⤵
  PID:6888
- C:\Windows\System\AUSchCl.exe
  C:\Windows\System\AUSchCl.exe
  2⤵
  PID:6908
- C:\Windows\System\TqPXhYF.exe
  C:\Windows\System\TqPXhYF.exe
  2⤵
  PID:6932
- C:\Windows\System\fHMhKme.exe
  C:\Windows\System\fHMhKme.exe
  2⤵
  PID:6960
- C:\Windows\System\EWRljMe.exe
  C:\Windows\System\EWRljMe.exe
  2⤵
  PID:7004
- C:\Windows\System\fcGhFtG.exe
  C:\Windows\System\fcGhFtG.exe
  2⤵
  PID:7044
- C:\Windows\System\QbibeCG.exe
  C:\Windows\System\QbibeCG.exe
  2⤵
  PID:7072
- C:\Windows\System\WCLgidU.exe
  C:\Windows\System\WCLgidU.exe
  2⤵
  PID:7088
- C:\Windows\System\pLPmUjj.exe
  C:\Windows\System\pLPmUjj.exe
  2⤵
  PID:7112
- C:\Windows\System\ACEzPNR.exe
  C:\Windows\System\ACEzPNR.exe
  2⤵
  PID:7128
- C:\Windows\System\yNcsbNz.exe
  C:\Windows\System\yNcsbNz.exe
  2⤵
  PID:7164
- C:\Windows\System\CnMICcM.exe
  C:\Windows\System\CnMICcM.exe
  2⤵
  PID:6256
- C:\Windows\System\dKyRypO.exe
  C:\Windows\System\dKyRypO.exe
  2⤵
  PID:6324
- C:\Windows\System\eaJIuWd.exe
  C:\Windows\System\eaJIuWd.exe
  2⤵
  PID:6380
- C:\Windows\System\httQYWL.exe
  C:\Windows\System\httQYWL.exe
  2⤵
  PID:6460
- C:\Windows\System\VDBVDjz.exe
  C:\Windows\System\VDBVDjz.exe
  2⤵
  PID:6492
- C:\Windows\System\kNTmYLl.exe
  C:\Windows\System\kNTmYLl.exe
  2⤵
  PID:6528
- C:\Windows\System\SxqiFhB.exe
  C:\Windows\System\SxqiFhB.exe
  2⤵
  PID:6564
- C:\Windows\System\AbvDoNd.exe
  C:\Windows\System\AbvDoNd.exe
  2⤵
  PID:6644
- C:\Windows\System\ezGMwKI.exe
  C:\Windows\System\ezGMwKI.exe
  2⤵
  PID:6700
- C:\Windows\System\KUCRJFv.exe
  C:\Windows\System\KUCRJFv.exe
  2⤵
  PID:6820
- C:\Windows\System\QYroXsn.exe
  C:\Windows\System\QYroXsn.exe
  2⤵
  PID:6884
- C:\Windows\System\CqVZFdT.exe
  C:\Windows\System\CqVZFdT.exe
  2⤵
  PID:6948
- C:\Windows\System\JIMMdbM.exe
  C:\Windows\System\JIMMdbM.exe
  2⤵
  PID:7056
- C:\Windows\System\XWcDROr.exe
  C:\Windows\System\XWcDROr.exe
  2⤵
  PID:7096
- C:\Windows\System\qAozFXH.exe
  C:\Windows\System\qAozFXH.exe
  2⤵
  PID:6180
- C:\Windows\System\jiJzCvS.exe
  C:\Windows\System\jiJzCvS.exe
  2⤵
  PID:6428
- C:\Windows\System\fSZFMbY.exe
  C:\Windows\System\fSZFMbY.exe
  2⤵
  PID:6536
- C:\Windows\System\lYumCVm.exe
  C:\Windows\System\lYumCVm.exe
  2⤵
  PID:5336
- C:\Windows\System\KPEWGpx.exe
  C:\Windows\System\KPEWGpx.exe
  2⤵
  PID:6840
- C:\Windows\System\IvPMuZQ.exe
  C:\Windows\System\IvPMuZQ.exe
  2⤵
  PID:6916
- C:\Windows\System\XhWoUmJ.exe
  C:\Windows\System\XhWoUmJ.exe
  2⤵
  PID:6220
- C:\Windows\System\AMOaMeL.exe
  C:\Windows\System\AMOaMeL.exe
  2⤵
  PID:6552
- C:\Windows\System\zQsHiSk.exe
  C:\Windows\System\zQsHiSk.exe
  2⤵
  PID:6940
- C:\Windows\System\RMuTwvZ.exe
  C:\Windows\System\RMuTwvZ.exe
  2⤵
  PID:6632
- C:\Windows\System\KuLfrdN.exe
  C:\Windows\System\KuLfrdN.exe
  2⤵
  PID:6520
- C:\Windows\System\rwYBoFB.exe
  C:\Windows\System\rwYBoFB.exe
  2⤵
  PID:7192
- C:\Windows\System\ioOtCOA.exe
  C:\Windows\System\ioOtCOA.exe
  2⤵
  PID:7224
- C:\Windows\System\KyELgmb.exe
  C:\Windows\System\KyELgmb.exe
  2⤵
  PID:7252
- C:\Windows\System\sLhhgUc.exe
  C:\Windows\System\sLhhgUc.exe
  2⤵
  PID:7280
- C:\Windows\System\kWNQWal.exe
  C:\Windows\System\kWNQWal.exe
  2⤵
  PID:7316
- C:\Windows\System\NcwHHBp.exe
  C:\Windows\System\NcwHHBp.exe
  2⤵
  PID:7352
- C:\Windows\System\dNhrVKw.exe
  C:\Windows\System\dNhrVKw.exe
  2⤵
  PID:7380
- C:\Windows\System\rHDNyvV.exe
  C:\Windows\System\rHDNyvV.exe
  2⤵
  PID:7412
- C:\Windows\System\aZlYCJc.exe
  C:\Windows\System\aZlYCJc.exe
  2⤵
  PID:7440
- C:\Windows\System\VMyruZX.exe
  C:\Windows\System\VMyruZX.exe
  2⤵
  PID:7468
- C:\Windows\System\JjJiNiY.exe
  C:\Windows\System\JjJiNiY.exe
  2⤵
  PID:7520
- C:\Windows\System\CQPHyGb.exe
  C:\Windows\System\CQPHyGb.exe
  2⤵
  PID:7548
- C:\Windows\System\hdbEGjA.exe
  C:\Windows\System\hdbEGjA.exe
  2⤵
  PID:7576
- C:\Windows\System\ijZPfua.exe
  C:\Windows\System\ijZPfua.exe
  2⤵
  PID:7608
- C:\Windows\System\hdIvUsK.exe
  C:\Windows\System\hdIvUsK.exe
  2⤵
  PID:7636
- C:\Windows\System\iYNXBNe.exe
  C:\Windows\System\iYNXBNe.exe
  2⤵
  PID:7664
- C:\Windows\System\DmBKVfW.exe
  C:\Windows\System\DmBKVfW.exe
  2⤵
  PID:7692
- C:\Windows\System\latmjXS.exe
  C:\Windows\System\latmjXS.exe
  2⤵
  PID:7720
- C:\Windows\System\rbIofmH.exe
  C:\Windows\System\rbIofmH.exe
  2⤵
  PID:7748
- C:\Windows\System\bqeeIcj.exe
  C:\Windows\System\bqeeIcj.exe
  2⤵
  PID:7776
- C:\Windows\System\ANBtCmb.exe
  C:\Windows\System\ANBtCmb.exe
  2⤵
  PID:7804
- C:\Windows\System\JfzaHPx.exe
  C:\Windows\System\JfzaHPx.exe
  2⤵
  PID:7832
- C:\Windows\System\OdBwtnF.exe
  C:\Windows\System\OdBwtnF.exe
  2⤵
  PID:7860
- C:\Windows\System\mLkpYnB.exe
  C:\Windows\System\mLkpYnB.exe
  2⤵
  PID:7900
- C:\Windows\System\XppQPbZ.exe
  C:\Windows\System\XppQPbZ.exe
  2⤵
  PID:7924
- C:\Windows\System\ioLIlMM.exe
  C:\Windows\System\ioLIlMM.exe
  2⤵
  PID:7964
- C:\Windows\System\xCHhtfP.exe
  C:\Windows\System\xCHhtfP.exe
  2⤵
  PID:7996
- C:\Windows\System\ioSYvgG.exe
  C:\Windows\System\ioSYvgG.exe
  2⤵
  PID:8024
- C:\Windows\System\JXqIMCp.exe
  C:\Windows\System\JXqIMCp.exe
  2⤵
  PID:8076
- C:\Windows\System\xRNxMXl.exe
  C:\Windows\System\xRNxMXl.exe
  2⤵
  PID:8100
- C:\Windows\System\SrnIcka.exe
  C:\Windows\System\SrnIcka.exe
  2⤵
  PID:8128
- C:\Windows\System\IWKLYkT.exe
  C:\Windows\System\IWKLYkT.exe
  2⤵
  PID:8172
- C:\Windows\System\TeRwpyh.exe
  C:\Windows\System\TeRwpyh.exe
  2⤵
  PID:7216
- C:\Windows\System\rrNrkmL.exe
  C:\Windows\System\rrNrkmL.exe
  2⤵
  PID:7276
- C:\Windows\System\xlkquBo.exe
  C:\Windows\System\xlkquBo.exe
  2⤵
  PID:7396
- C:\Windows\System\LwLJhMY.exe
  C:\Windows\System\LwLJhMY.exe
  2⤵
  PID:7480
- C:\Windows\System\HdAqGBi.exe
  C:\Windows\System\HdAqGBi.exe
  2⤵
  PID:7568
- C:\Windows\System\wCNrypA.exe
  C:\Windows\System\wCNrypA.exe
  2⤵
  PID:7660
- C:\Windows\System\XccPqjD.exe
  C:\Windows\System\XccPqjD.exe
  2⤵
  PID:7788
- C:\Windows\System\tesArei.exe
  C:\Windows\System\tesArei.exe
  2⤵
  PID:6848
- C:\Windows\System\YzioYIY.exe
  C:\Windows\System\YzioYIY.exe
  2⤵
  PID:7992
- C:\Windows\System\ScLYfHm.exe
  C:\Windows\System\ScLYfHm.exe
  2⤵
  PID:8144
- C:\Windows\System\IEIomvy.exe
  C:\Windows\System\IEIomvy.exe
  2⤵
  PID:7248
- C:\Windows\System\QWqdxja.exe
  C:\Windows\System\QWqdxja.exe
  2⤵
  PID:7424
- C:\Windows\System\NbiEGSN.exe
  C:\Windows\System\NbiEGSN.exe
  2⤵
  PID:7540
- C:\Windows\System\ROiGMiy.exe
  C:\Windows\System\ROiGMiy.exe
  2⤵
  PID:7768
- C:\Windows\System\GHJSBIP.exe
  C:\Windows\System\GHJSBIP.exe
  2⤵
  PID:7188
- C:\Windows\System\MhCZDAh.exe
  C:\Windows\System\MhCZDAh.exe
  2⤵
  PID:7308
- C:\Windows\System\qmfxmCm.exe
  C:\Windows\System\qmfxmCm.exe
  2⤵
  PID:7628
- C:\Windows\System\yNMQWoI.exe
  C:\Windows\System\yNMQWoI.exe
  2⤵
  PID:7920
- C:\Windows\System\mluYSdu.exe
  C:\Windows\System\mluYSdu.exe
  2⤵
  PID:8220
- C:\Windows\System\XTSdnHL.exe
  C:\Windows\System\XTSdnHL.exe
  2⤵
  PID:8248
- C:\Windows\System\AaxsMYA.exe
  C:\Windows\System\AaxsMYA.exe
  2⤵
  PID:8288
- C:\Windows\System\nHSJTyt.exe
  C:\Windows\System\nHSJTyt.exe
  2⤵
  PID:8328
- C:\Windows\System\FBxJfhR.exe
  C:\Windows\System\FBxJfhR.exe
  2⤵
  PID:8360
- C:\Windows\System\YdYmWlk.exe
  C:\Windows\System\YdYmWlk.exe
  2⤵
  PID:8384
- C:\Windows\System\YnKmaGW.exe
  C:\Windows\System\YnKmaGW.exe
  2⤵
  PID:8412
- C:\Windows\System\fSDeSHP.exe
  C:\Windows\System\fSDeSHP.exe
  2⤵
  PID:8440
- C:\Windows\System\CLvousB.exe
  C:\Windows\System\CLvousB.exe
  2⤵
  PID:8468
- C:\Windows\System\MCRhidd.exe
  C:\Windows\System\MCRhidd.exe
  2⤵
  PID:8496
- C:\Windows\System\AfTJfDr.exe
  C:\Windows\System\AfTJfDr.exe
  2⤵
  PID:8524
- C:\Windows\System\WPoMTVA.exe
  C:\Windows\System\WPoMTVA.exe
  2⤵
  PID:8552
- C:\Windows\System\EFuahsr.exe
  C:\Windows\System\EFuahsr.exe
  2⤵
  PID:8580
- C:\Windows\System\rKfYgFE.exe
  C:\Windows\System\rKfYgFE.exe
  2⤵
  PID:8608
- C:\Windows\System\lTkhKHt.exe
  C:\Windows\System\lTkhKHt.exe
  2⤵
  PID:8636
- C:\Windows\System\fsQQzdP.exe
  C:\Windows\System\fsQQzdP.exe
  2⤵
  PID:8664
- C:\Windows\System\WrCUMlm.exe
  C:\Windows\System\WrCUMlm.exe
  2⤵
  PID:8692
- C:\Windows\System\NlekYwG.exe
  C:\Windows\System\NlekYwG.exe
  2⤵
  PID:8720
- C:\Windows\System\qHzWQcN.exe
  C:\Windows\System\qHzWQcN.exe
  2⤵
  PID:8748
- C:\Windows\System\ckFNuBE.exe
  C:\Windows\System\ckFNuBE.exe
  2⤵
  PID:8776
- C:\Windows\System\MKfKnPY.exe
  C:\Windows\System\MKfKnPY.exe
  2⤵
  PID:8812
- C:\Windows\System\wgrrwZI.exe
  C:\Windows\System\wgrrwZI.exe
  2⤵
  PID:8832
- C:\Windows\System\WwvCuqE.exe
  C:\Windows\System\WwvCuqE.exe
  2⤵
  PID:8860
- C:\Windows\System\hBBVYfW.exe
  C:\Windows\System\hBBVYfW.exe
  2⤵
  PID:8888
- C:\Windows\System\NKilNQF.exe
  C:\Windows\System\NKilNQF.exe
  2⤵
  PID:8916
- C:\Windows\System\DuiDnZF.exe
  C:\Windows\System\DuiDnZF.exe
  2⤵
  PID:8944
- C:\Windows\System\AdoGYQw.exe
  C:\Windows\System\AdoGYQw.exe
  2⤵
  PID:8972
- C:\Windows\System\NYrfIZt.exe
  C:\Windows\System\NYrfIZt.exe
  2⤵
  PID:9000
- C:\Windows\System\ztnACQi.exe
  C:\Windows\System\ztnACQi.exe
  2⤵
  PID:9036
- C:\Windows\System\hnLqCIO.exe
  C:\Windows\System\hnLqCIO.exe
  2⤵
  PID:9056
- C:\Windows\System\CwdUBrF.exe
  C:\Windows\System\CwdUBrF.exe
  2⤵
  PID:9088
- C:\Windows\System\klVrRCi.exe
  C:\Windows\System\klVrRCi.exe
  2⤵
  PID:9116
- C:\Windows\System\mUZYXGg.exe
  C:\Windows\System\mUZYXGg.exe
  2⤵
  PID:9144
- C:\Windows\System\imcxzQM.exe
  C:\Windows\System\imcxzQM.exe
  2⤵
  PID:9176
- C:\Windows\System\xdSJSYB.exe
  C:\Windows\System\xdSJSYB.exe
  2⤵
  PID:9204
- C:\Windows\System\ZdNdNaw.exe
  C:\Windows\System\ZdNdNaw.exe
  2⤵
  PID:8240
- C:\Windows\System\NFvHRUg.exe
  C:\Windows\System\NFvHRUg.exe
  2⤵
  PID:8336
- C:\Windows\System\uEPPmCt.exe
  C:\Windows\System\uEPPmCt.exe
  2⤵
  PID:8404
- C:\Windows\System\TFKEaus.exe
  C:\Windows\System\TFKEaus.exe
  2⤵
  PID:8464
- C:\Windows\System\DfPCGCv.exe
  C:\Windows\System\DfPCGCv.exe
  2⤵
  PID:8536
- C:\Windows\System\gzctrHn.exe
  C:\Windows\System\gzctrHn.exe
  2⤵
  PID:8600
- C:\Windows\System\dHckUxl.exe
  C:\Windows\System\dHckUxl.exe
  2⤵
  PID:8660
- C:\Windows\System\LFdzKCF.exe
  C:\Windows\System\LFdzKCF.exe
  2⤵
  PID:8740
- C:\Windows\System\QVXyrEX.exe
  C:\Windows\System\QVXyrEX.exe
  2⤵
  PID:8796
- C:\Windows\System\RFTBaiG.exe
  C:\Windows\System\RFTBaiG.exe
  2⤵
  PID:8856
- C:\Windows\System\fDYzfiN.exe
  C:\Windows\System\fDYzfiN.exe
  2⤵
  PID:8932
- C:\Windows\System\NIcZCrG.exe
  C:\Windows\System\NIcZCrG.exe
  2⤵
  PID:8992
- C:\Windows\System\jBynZtu.exe
  C:\Windows\System\jBynZtu.exe
  2⤵
  PID:9052
- C:\Windows\System\BxeYSYc.exe
  C:\Windows\System\BxeYSYc.exe
  2⤵
  PID:9128
- C:\Windows\System\sadmdsS.exe
  C:\Windows\System\sadmdsS.exe
  2⤵
  PID:9196
- C:\Windows\System\BxWidcM.exe
  C:\Windows\System\BxWidcM.exe
  2⤵
  PID:8320
- C:\Windows\System\mgeKtxY.exe
  C:\Windows\System\mgeKtxY.exe
  2⤵
  PID:8492
- C:\Windows\System\NnZrTWL.exe
  C:\Windows\System\NnZrTWL.exe
  2⤵
  PID:8648
- C:\Windows\System\lSHUcsh.exe
  C:\Windows\System\lSHUcsh.exe
  2⤵
  PID:8788
- C:\Windows\System\xbciDLM.exe
  C:\Windows\System\xbciDLM.exe
  2⤵
  PID:8968
- C:\Windows\System\ORCIpNz.exe
  C:\Windows\System\ORCIpNz.exe
  2⤵
  PID:9156
- C:\Windows\System\olfisPW.exe
  C:\Windows\System\olfisPW.exe
  2⤵
  PID:8452
- C:\Windows\System\HGfBlcU.exe
  C:\Windows\System\HGfBlcU.exe
  2⤵
  PID:8768
- C:\Windows\System\PZSeXCA.exe
  C:\Windows\System\PZSeXCA.exe
  2⤵
  PID:8232
- C:\Windows\System\qplJvTY.exe
  C:\Windows\System\qplJvTY.exe
  2⤵
  PID:9108
- C:\Windows\System\ogddFVY.exe
  C:\Windows\System\ogddFVY.exe
  2⤵
  PID:9224
- C:\Windows\System\JxygpaI.exe
  C:\Windows\System\JxygpaI.exe
  2⤵
  PID:9252
- C:\Windows\System\dDbrvGe.exe
  C:\Windows\System\dDbrvGe.exe
  2⤵
  PID:9280
- C:\Windows\System\ghPxElQ.exe
  C:\Windows\System\ghPxElQ.exe
  2⤵
  PID:9308
- C:\Windows\System\BVHVftD.exe
  C:\Windows\System\BVHVftD.exe
  2⤵
  PID:9336
- C:\Windows\System\OeRajgZ.exe
  C:\Windows\System\OeRajgZ.exe
  2⤵
  PID:9364
- C:\Windows\System\piiLZPs.exe
  C:\Windows\System\piiLZPs.exe
  2⤵
  PID:9392
- C:\Windows\System\qwIlxYB.exe
  C:\Windows\System\qwIlxYB.exe
  2⤵
  PID:9420
- C:\Windows\System\WzjcvZj.exe
  C:\Windows\System\WzjcvZj.exe
  2⤵
  PID:9448
- C:\Windows\System\rBeJpwI.exe
  C:\Windows\System\rBeJpwI.exe
  2⤵
  PID:9484
- C:\Windows\System\MEwtLTs.exe
  C:\Windows\System\MEwtLTs.exe
  2⤵
  PID:9504
- C:\Windows\System\QoHuIqT.exe
  C:\Windows\System\QoHuIqT.exe
  2⤵
  PID:9528
- C:\Windows\System\atNnKSn.exe
  C:\Windows\System\atNnKSn.exe
  2⤵
  PID:9556
- C:\Windows\System\uTJmTxM.exe
  C:\Windows\System\uTJmTxM.exe
  2⤵
  PID:9588
- C:\Windows\System\jHNZVqT.exe
  C:\Windows\System\jHNZVqT.exe
  2⤵
  PID:9616
- C:\Windows\System\qjkLATY.exe
  C:\Windows\System\qjkLATY.exe
  2⤵
  PID:9644
- C:\Windows\System\PiXVQSJ.exe
  C:\Windows\System\PiXVQSJ.exe
  2⤵
  PID:9672
- C:\Windows\System\HvSEBdh.exe
  C:\Windows\System\HvSEBdh.exe
  2⤵
  PID:9700
- C:\Windows\System\mkqXPwS.exe
  C:\Windows\System\mkqXPwS.exe
  2⤵
  PID:9728
- C:\Windows\System\ZBvojHO.exe
  C:\Windows\System\ZBvojHO.exe
  2⤵
  PID:9756
- C:\Windows\System\dWEyAEu.exe
  C:\Windows\System\dWEyAEu.exe
  2⤵
  PID:9784
- C:\Windows\System\HXEHlFS.exe
  C:\Windows\System\HXEHlFS.exe
  2⤵
  PID:9812
- C:\Windows\System\gIpNFdJ.exe
  C:\Windows\System\gIpNFdJ.exe
  2⤵
  PID:9840
- C:\Windows\System\uBhVZRh.exe
  C:\Windows\System\uBhVZRh.exe
  2⤵
  PID:9868
- C:\Windows\System\UKaaQRH.exe
  C:\Windows\System\UKaaQRH.exe
  2⤵
  PID:9896
- C:\Windows\System\QLubByj.exe
  C:\Windows\System\QLubByj.exe
  2⤵
  PID:9924
- C:\Windows\System\pIjIbju.exe
  C:\Windows\System\pIjIbju.exe
  2⤵
  PID:9952
- C:\Windows\System\BPhUDWl.exe
  C:\Windows\System\BPhUDWl.exe
  2⤵
  PID:9980
- C:\Windows\System\CILTNyI.exe
  C:\Windows\System\CILTNyI.exe
  2⤵
  PID:10008
- C:\Windows\System\RDqralX.exe
  C:\Windows\System\RDqralX.exe
  2⤵
  PID:10036
- C:\Windows\System\sIXFbkW.exe
  C:\Windows\System\sIXFbkW.exe
  2⤵
  PID:10064
- C:\Windows\System\vcAJZPq.exe
  C:\Windows\System\vcAJZPq.exe
  2⤵
  PID:10096
- C:\Windows\System\pCzRiKd.exe
  C:\Windows\System\pCzRiKd.exe
  2⤵
  PID:10124
- C:\Windows\System\jsEFeEz.exe
  C:\Windows\System\jsEFeEz.exe
  2⤵
  PID:10152
- C:\Windows\System\DzYzmLR.exe
  C:\Windows\System\DzYzmLR.exe
  2⤵
  PID:10180
- C:\Windows\System\UTzQiuG.exe
  C:\Windows\System\UTzQiuG.exe
  2⤵
  PID:10208
- C:\Windows\System\fvZfsmt.exe
  C:\Windows\System\fvZfsmt.exe
  2⤵
  PID:10236
- C:\Windows\System\IoHQwDA.exe
  C:\Windows\System\IoHQwDA.exe
  2⤵
  PID:9276
- C:\Windows\System\eZYCJsX.exe
  C:\Windows\System\eZYCJsX.exe
  2⤵
  PID:9348
- C:\Windows\System\HMiSAcI.exe
  C:\Windows\System\HMiSAcI.exe
  2⤵
  PID:9412
- C:\Windows\System\UajmsiV.exe
  C:\Windows\System\UajmsiV.exe
  2⤵
  PID:9472
- C:\Windows\System\QQtrZkq.exe
  C:\Windows\System\QQtrZkq.exe
  2⤵
  PID:9548
- C:\Windows\System\QHSKYlk.exe
  C:\Windows\System\QHSKYlk.exe
  2⤵
  PID:9608
- C:\Windows\System\UZQFJTy.exe
  C:\Windows\System\UZQFJTy.exe
  2⤵
  PID:9668
- C:\Windows\System\ROwvxXz.exe
  C:\Windows\System\ROwvxXz.exe
  2⤵
  PID:9740
- C:\Windows\System\xqmWTUI.exe
  C:\Windows\System\xqmWTUI.exe
  2⤵
  PID:9804
- C:\Windows\System\JyiznMF.exe
  C:\Windows\System\JyiznMF.exe
  2⤵
  PID:9860
- C:\Windows\System\SmHIawa.exe
  C:\Windows\System\SmHIawa.exe
  2⤵
  PID:9936
- C:\Windows\System\kahSulA.exe
  C:\Windows\System\kahSulA.exe
  2⤵
  PID:10004
- C:\Windows\System\sRBetrR.exe
  C:\Windows\System\sRBetrR.exe
  2⤵
  PID:10076
- C:\Windows\System\pbGUEEX.exe
  C:\Windows\System\pbGUEEX.exe
  2⤵
  PID:10164
- C:\Windows\System\yPofYZE.exe
  C:\Windows\System\yPofYZE.exe
  2⤵
  PID:9272
- C:\Windows\System\DmjEWfE.exe
  C:\Windows\System\DmjEWfE.exe
  2⤵
  PID:9460
- C:\Windows\System\BsvMkSs.exe
  C:\Windows\System\BsvMkSs.exe
  2⤵
  PID:9600
- C:\Windows\System\TClPvad.exe
  C:\Windows\System\TClPvad.exe
  2⤵
  PID:9796
- C:\Windows\System\bcyfNJq.exe
  C:\Windows\System\bcyfNJq.exe
  2⤵
  PID:9920
- C:\Windows\System\SlvgqbZ.exe
  C:\Windows\System\SlvgqbZ.exe
  2⤵
  PID:10056
- C:\Windows\System\grGimBa.exe
  C:\Windows\System\grGimBa.exe
  2⤵
  PID:9388
- C:\Windows\System\pneHBmg.exe
  C:\Windows\System\pneHBmg.exe
  2⤵
  PID:10060
- C:\Windows\System\CeKJyFP.exe
  C:\Windows\System\CeKJyFP.exe
  2⤵
  PID:9332
- C:\Windows\System\TPtfrjb.exe
  C:\Windows\System\TPtfrjb.exe
  2⤵
  PID:10252
- C:\Windows\System\XASRHYS.exe
  C:\Windows\System\XASRHYS.exe
  2⤵
  PID:10288
- C:\Windows\System\hiTJGlu.exe
  C:\Windows\System\hiTJGlu.exe
  2⤵
  PID:10320
- C:\Windows\System\phsfSrH.exe
  C:\Windows\System\phsfSrH.exe
  2⤵
  PID:10352
- C:\Windows\System\urmRmYV.exe
  C:\Windows\System\urmRmYV.exe
  2⤵
  PID:10380
- C:\Windows\System\bHwVcfY.exe
  C:\Windows\System\bHwVcfY.exe
  2⤵
  PID:10408
- C:\Windows\System\BkaUoym.exe
  C:\Windows\System\BkaUoym.exe
  2⤵
  PID:10436
- C:\Windows\System\WFLiDQr.exe
  C:\Windows\System\WFLiDQr.exe
  2⤵
  PID:10464
- C:\Windows\System\lqaxApx.exe
  C:\Windows\System\lqaxApx.exe
  2⤵
  PID:10492
- C:\Windows\System\kJkwRMD.exe
  C:\Windows\System\kJkwRMD.exe
  2⤵
  PID:10528
- C:\Windows\System\WJgKpba.exe
  C:\Windows\System\WJgKpba.exe
  2⤵
  PID:10568
- C:\Windows\System\HmtEszl.exe
  C:\Windows\System\HmtEszl.exe
  2⤵
  PID:10608
- C:\Windows\System\ghpElio.exe
  C:\Windows\System\ghpElio.exe
  2⤵
  PID:10640
- C:\Windows\System\sXnXLyi.exe
  C:\Windows\System\sXnXLyi.exe
  2⤵
  PID:10672
- C:\Windows\System\LOGKnIW.exe
  C:\Windows\System\LOGKnIW.exe
  2⤵
  PID:10700
- C:\Windows\System\JCoLAQv.exe
  C:\Windows\System\JCoLAQv.exe
  2⤵
  PID:10728
- C:\Windows\System\lJfIfEb.exe
  C:\Windows\System\lJfIfEb.exe
  2⤵
  PID:10744
- C:\Windows\System\fETMBje.exe
  C:\Windows\System\fETMBje.exe
  2⤵
  PID:10764
- C:\Windows\System\neIVUrO.exe
  C:\Windows\System\neIVUrO.exe
  2⤵
  PID:10812
- C:\Windows\System\ldqddZN.exe
  C:\Windows\System\ldqddZN.exe
  2⤵
  PID:10840
- C:\Windows\System\zzdFcKR.exe
  C:\Windows\System\zzdFcKR.exe
  2⤵
  PID:10868
- C:\Windows\System\SipWtoD.exe
  C:\Windows\System\SipWtoD.exe
  2⤵
  PID:10896
- C:\Windows\System\ZKEwRdM.exe
  C:\Windows\System\ZKEwRdM.exe
  2⤵
  PID:10924
- C:\Windows\System\voLUWKc.exe
  C:\Windows\System\voLUWKc.exe
  2⤵
  PID:10952
- C:\Windows\System\aOYksyT.exe
  C:\Windows\System\aOYksyT.exe
  2⤵
  PID:10980
- C:\Windows\System\UhPDhTl.exe
  C:\Windows\System\UhPDhTl.exe
  2⤵
  PID:11012
- C:\Windows\System\ichgwXH.exe
  C:\Windows\System\ichgwXH.exe
  2⤵
  PID:11040
- C:\Windows\System\uHNMYkr.exe
  C:\Windows\System\uHNMYkr.exe
  2⤵
  PID:11068
- C:\Windows\System\vizzqgt.exe
  C:\Windows\System\vizzqgt.exe
  2⤵
  PID:11096
- C:\Windows\System\JXgTPbY.exe
  C:\Windows\System\JXgTPbY.exe
  2⤵
  PID:11132
- C:\Windows\System\NZrYvnV.exe
  C:\Windows\System\NZrYvnV.exe
  2⤵
  PID:11160
- C:\Windows\System\pgRDFyC.exe
  C:\Windows\System\pgRDFyC.exe
  2⤵
  PID:11188
- C:\Windows\System\ajarZcn.exe
  C:\Windows\System\ajarZcn.exe
  2⤵
  PID:11216
- C:\Windows\System\qzEgDPc.exe
  C:\Windows\System\qzEgDPc.exe
  2⤵
  PID:11244
- C:\Windows\System\QPOcpRE.exe
  C:\Windows\System\QPOcpRE.exe
  2⤵
  PID:9916
- C:\Windows\System\oRNWKxI.exe
  C:\Windows\System\oRNWKxI.exe
  2⤵
  PID:10312
- C:\Windows\System\PxxLgKL.exe
  C:\Windows\System\PxxLgKL.exe
  2⤵
  PID:10364
- C:\Windows\System\GiMdnjJ.exe
  C:\Windows\System\GiMdnjJ.exe
  2⤵
  PID:10376
- C:\Windows\System\yDHCLvu.exe
  C:\Windows\System\yDHCLvu.exe
  2⤵
  PID:10120
- C:\Windows\System\ssdpInl.exe
  C:\Windows\System\ssdpInl.exe
  2⤵
  PID:10520
- C:\Windows\System\CzIAFhr.exe
  C:\Windows\System\CzIAFhr.exe
  2⤵
  PID:10620
- C:\Windows\System\urUMrzz.exe
  C:\Windows\System\urUMrzz.exe
  2⤵
  PID:10692
- C:\Windows\System\fonrxBf.exe
  C:\Windows\System\fonrxBf.exe
  2⤵
  PID:10752
- C:\Windows\System\jBPnqDB.exe
  C:\Windows\System\jBPnqDB.exe
  2⤵
  PID:10824
- C:\Windows\System\cKkyZaO.exe
  C:\Windows\System\cKkyZaO.exe
  2⤵
  PID:10888
- C:\Windows\System\kgdSjKE.exe
  C:\Windows\System\kgdSjKE.exe
  2⤵
  PID:10948
- C:\Windows\System\oOByLwm.exe
  C:\Windows\System\oOByLwm.exe
  2⤵
  PID:11008
- C:\Windows\System\BLqkOlz.exe
  C:\Windows\System\BLqkOlz.exe
  2⤵
  PID:11088
- C:\Windows\System\VqLMjnx.exe
  C:\Windows\System\VqLMjnx.exe
  2⤵
  PID:11156
- C:\Windows\System\JhKsZZW.exe
  C:\Windows\System\JhKsZZW.exe
  2⤵
  PID:11212
- C:\Windows\System\DDYMtvj.exe
  C:\Windows\System\DDYMtvj.exe
  2⤵
  PID:10304
- C:\Windows\System\KAfSxoG.exe
  C:\Windows\System\KAfSxoG.exe
  2⤵
  PID:10400
- C:\Windows\System\HmMUMuS.exe
  C:\Windows\System\HmMUMuS.exe
  2⤵
  PID:10588
- C:\Windows\System\gtxcAkh.exe
  C:\Windows\System\gtxcAkh.exe
  2⤵
  PID:10740
- C:\Windows\System\GwUOWhC.exe
  C:\Windows\System\GwUOWhC.exe
  2⤵
  PID:10916
- C:\Windows\System\mEPAFbG.exe
  C:\Windows\System\mEPAFbG.exe
  2⤵
  PID:10600
- C:\Windows\System\bBnnCRq.exe
  C:\Windows\System\bBnnCRq.exe
  2⤵
  PID:11180
- C:\Windows\System\vhTWMth.exe
  C:\Windows\System\vhTWMth.exe
  2⤵
  PID:10136
- C:\Windows\System\ZaFMnQJ.exe
  C:\Windows\System\ZaFMnQJ.exe
  2⤵
  PID:10736
- C:\Windows\System\GeBvMIU.exe
  C:\Windows\System\GeBvMIU.exe
  2⤵
  PID:11124
- C:\Windows\System\YDmhvlD.exe
  C:\Windows\System\YDmhvlD.exe
  2⤵
  PID:10664
- C:\Windows\System\gbLWPpH.exe
  C:\Windows\System\gbLWPpH.exe
  2⤵
  PID:11000
- C:\Windows\System\uabyEgB.exe
  C:\Windows\System\uabyEgB.exe
  2⤵
  PID:10628
- C:\Windows\System\nDXLMuu.exe
  C:\Windows\System\nDXLMuu.exe
  2⤵
  PID:10504
- C:\Windows\System\QPqyxaB.exe
  C:\Windows\System\QPqyxaB.exe
  2⤵
  PID:11120
- C:\Windows\System\jzbOPZW.exe
  C:\Windows\System\jzbOPZW.exe
  2⤵
  PID:11284
- C:\Windows\System\ujRRqAM.exe
  C:\Windows\System\ujRRqAM.exe
  2⤵
  PID:11324
- C:\Windows\System\CLefOKv.exe
  C:\Windows\System\CLefOKv.exe
  2⤵
  PID:11364
- C:\Windows\System\VvYZFkV.exe
  C:\Windows\System\VvYZFkV.exe
  2⤵
  PID:11392
- C:\Windows\System\IySljwV.exe
  C:\Windows\System\IySljwV.exe
  2⤵
  PID:11420
- C:\Windows\System\foYMxCs.exe
  C:\Windows\System\foYMxCs.exe
  2⤵
  PID:11448
- C:\Windows\System\wEJsNYG.exe
  C:\Windows\System\wEJsNYG.exe
  2⤵
  PID:11480
- C:\Windows\System\XNxHJAY.exe
  C:\Windows\System\XNxHJAY.exe
  2⤵
  PID:11508
- C:\Windows\System\ifVuNVI.exe
  C:\Windows\System\ifVuNVI.exe
  2⤵
  PID:11536
- C:\Windows\System\jQISeWA.exe
  C:\Windows\System\jQISeWA.exe
  2⤵
  PID:11564
- C:\Windows\System\ySBSqBj.exe
  C:\Windows\System\ySBSqBj.exe
  2⤵
  PID:11592
- C:\Windows\System\VjkoFwE.exe
  C:\Windows\System\VjkoFwE.exe
  2⤵
  PID:11620
- C:\Windows\System\ETAnaXA.exe
  C:\Windows\System\ETAnaXA.exe
  2⤵
  PID:11652
- C:\Windows\System\gKbeAYa.exe
  C:\Windows\System\gKbeAYa.exe
  2⤵
  PID:11680
- C:\Windows\System\uMfhSqy.exe
  C:\Windows\System\uMfhSqy.exe
  2⤵
  PID:11708
- C:\Windows\System\VqsEfFz.exe
  C:\Windows\System\VqsEfFz.exe
  2⤵
  PID:11736
- C:\Windows\System\FMZGqOj.exe
  C:\Windows\System\FMZGqOj.exe
  2⤵
  PID:11764
- C:\Windows\System\LgBSplk.exe
  C:\Windows\System\LgBSplk.exe
  2⤵
  PID:11792
- C:\Windows\System\tEESGbE.exe
  C:\Windows\System\tEESGbE.exe
  2⤵
  PID:11820
- C:\Windows\System\SLRhbgo.exe
  C:\Windows\System\SLRhbgo.exe
  2⤵
  PID:11848
- C:\Windows\System\KnOPufO.exe
  C:\Windows\System\KnOPufO.exe
  2⤵
  PID:11876
- C:\Windows\System\GCJzfxv.exe
  C:\Windows\System\GCJzfxv.exe
  2⤵
  PID:11904
- C:\Windows\System\xkROKHp.exe
  C:\Windows\System\xkROKHp.exe
  2⤵
  PID:11932
- C:\Windows\System\xrLkAol.exe
  C:\Windows\System\xrLkAol.exe
  2⤵
  PID:11960
- C:\Windows\System\OOLEuIo.exe
  C:\Windows\System\OOLEuIo.exe
  2⤵
  PID:11988
- C:\Windows\System\EQKUleN.exe
  C:\Windows\System\EQKUleN.exe
  2⤵
  PID:12016
- C:\Windows\System\fMgxYXu.exe
  C:\Windows\System\fMgxYXu.exe
  2⤵
  PID:12044
- C:\Windows\System\nypEOpm.exe
  C:\Windows\System\nypEOpm.exe
  2⤵
  PID:12072
- C:\Windows\System\hulNMUe.exe
  C:\Windows\System\hulNMUe.exe
  2⤵
  PID:12100
- C:\Windows\System\DNlqYwF.exe
  C:\Windows\System\DNlqYwF.exe
  2⤵
  PID:12128
- C:\Windows\System\uIzzgFH.exe
  C:\Windows\System\uIzzgFH.exe
  2⤵
  PID:12176
- C:\Windows\System\AHxJitQ.exe
  C:\Windows\System\AHxJitQ.exe
  2⤵
  PID:12196
- C:\Windows\System\UvnNvnU.exe
  C:\Windows\System\UvnNvnU.exe
  2⤵
  PID:12224
- C:\Windows\System\ANXRpTp.exe
  C:\Windows\System\ANXRpTp.exe
  2⤵
  PID:12252
- C:\Windows\System\KIUdMnv.exe
  C:\Windows\System\KIUdMnv.exe
  2⤵
  PID:12280
- C:\Windows\System\GkwKJft.exe
  C:\Windows\System\GkwKJft.exe
  2⤵
  PID:11304
- C:\Windows\System\ArLZYqZ.exe
  C:\Windows\System\ArLZYqZ.exe
  2⤵
  PID:11376
- C:\Windows\System\IaNPkaN.exe
  C:\Windows\System\IaNPkaN.exe
  2⤵
  PID:11460
- C:\Windows\System\kRZflfK.exe
  C:\Windows\System\kRZflfK.exe
  2⤵
  PID:11532
- C:\Windows\System\cZaIWIX.exe
  C:\Windows\System\cZaIWIX.exe
  2⤵
  PID:11292
- C:\Windows\System\RZpxkRp.exe
  C:\Windows\System\RZpxkRp.exe
  2⤵
  PID:11588
- C:\Windows\System\RHHhbYK.exe
  C:\Windows\System\RHHhbYK.exe
  2⤵
  PID:11648
- C:\Windows\System\lUOCFQT.exe
  C:\Windows\System\lUOCFQT.exe
  2⤵
  PID:11720
- C:\Windows\System\TpiGIYC.exe
  C:\Windows\System\TpiGIYC.exe
  2⤵
  PID:11776
- C:\Windows\System\PLRMWTb.exe
  C:\Windows\System\PLRMWTb.exe
  2⤵
  PID:11832
- C:\Windows\System\CasyuyY.exe
  C:\Windows\System\CasyuyY.exe
  2⤵
  PID:11896
- C:\Windows\System\rAFxZUM.exe
  C:\Windows\System\rAFxZUM.exe
  2⤵
  PID:11956
- C:\Windows\System\SxhDGSE.exe
  C:\Windows\System\SxhDGSE.exe
  2⤵
  PID:12028
- C:\Windows\System\EvTuVLT.exe
  C:\Windows\System\EvTuVLT.exe
  2⤵
  PID:12092
- C:\Windows\System\JnHBlIx.exe
  C:\Windows\System\JnHBlIx.exe
  2⤵
  PID:2284
- C:\Windows\System\oAnWZLn.exe
  C:\Windows\System\oAnWZLn.exe
  2⤵
  PID:1596
- C:\Windows\System\DaQLggv.exe
  C:\Windows\System\DaQLggv.exe
  2⤵
  PID:540
- C:\Windows\System\FrgILZb.exe
  C:\Windows\System\FrgILZb.exe
  2⤵
  PID:7880
- C:\Windows\System\yPEzINx.exe
  C:\Windows\System\yPEzINx.exe
  2⤵
  PID:12148
- C:\Windows\System\TSfpczC.exe
  C:\Windows\System\TSfpczC.exe
  2⤵
  PID:1064
- C:\Windows\System\ZFmkKrx.exe
  C:\Windows\System\ZFmkKrx.exe
  2⤵
  PID:1632
- C:\Windows\System\wCMVvKV.exe
  C:\Windows\System\wCMVvKV.exe
  2⤵
  PID:12236
- C:\Windows\System\DabbBpk.exe
  C:\Windows\System\DabbBpk.exe
  2⤵
  PID:11276
- C:\Windows\System\XNUeoaQ.exe
  C:\Windows\System\XNUeoaQ.exe
  2⤵
  PID:11444
- C:\Windows\System\NcTGjNj.exe
  C:\Windows\System\NcTGjNj.exe
  2⤵
  PID:11336
- C:\Windows\System\LccyxCy.exe
  C:\Windows\System\LccyxCy.exe
  2⤵
  PID:11704
- C:\Windows\System\xeEcHiY.exe
  C:\Windows\System\xeEcHiY.exe
  2⤵
  PID:11816
- C:\Windows\System\XbZhFBp.exe
  C:\Windows\System\XbZhFBp.exe
  2⤵
  PID:12012
- C:\Windows\System\PQiQfhs.exe
  C:\Windows\System\PQiQfhs.exe
  2⤵
  PID:2336
- C:\Windows\System\qpooVHy.exe
  C:\Windows\System\qpooVHy.exe
  2⤵
  PID:1984
- C:\Windows\System\BvEiKuc.exe
  C:\Windows\System\BvEiKuc.exe
  2⤵
  PID:12220
- C:\Windows\System\WXPRVSl.exe
  C:\Windows\System\WXPRVSl.exe
  2⤵
  PID:10420
- C:\Windows\System\TKHOTSf.exe
  C:\Windows\System\TKHOTSf.exe
  2⤵
  PID:7652
- C:\Windows\System\zDLsSci.exe
  C:\Windows\System\zDLsSci.exe
  2⤵
  PID:11804
- C:\Windows\System\UJBnGZH.exe
  C:\Windows\System\UJBnGZH.exe
  2⤵
  PID:12344
- C:\Windows\System\GjTXROH.exe
  C:\Windows\System\GjTXROH.exe
  2⤵
  PID:12360
- C:\Windows\System\YeDkyXU.exe
  C:\Windows\System\YeDkyXU.exe
  2⤵
  PID:12376
- C:\Windows\System\Bogpwvk.exe
  C:\Windows\System\Bogpwvk.exe
  2⤵
  PID:12404
- C:\Windows\System\ETpeKVN.exe
  C:\Windows\System\ETpeKVN.exe
  2⤵
  PID:12428
- C:\Windows\System\zDQCdKG.exe
  C:\Windows\System\zDQCdKG.exe
  2⤵
  PID:12460
- C:\Windows\System\XoBdrRk.exe
  C:\Windows\System\XoBdrRk.exe
  2⤵
  PID:12500
- C:\Windows\System\VAzGoNw.exe
  C:\Windows\System\VAzGoNw.exe
  2⤵
  PID:12536
- C:\Windows\System\LbTxpkH.exe
  C:\Windows\System\LbTxpkH.exe
  2⤵
  PID:12584
- C:\Windows\System\AlXvKnE.exe
  C:\Windows\System\AlXvKnE.exe
  2⤵
  PID:12616
- C:\Windows\System\IlMPHWs.exe
  C:\Windows\System\IlMPHWs.exe
  2⤵
  PID:12644
- C:\Windows\System\TklFRjU.exe
  C:\Windows\System\TklFRjU.exe
  2⤵
  PID:12672
- C:\Windows\System\rnysBBB.exe
  C:\Windows\System\rnysBBB.exe
  2⤵
  PID:12700
- C:\Windows\System\cFcxkgg.exe
  C:\Windows\System\cFcxkgg.exe
  2⤵
  PID:12728
- C:\Windows\System\qDViMHn.exe
  C:\Windows\System\qDViMHn.exe
  2⤵
  PID:12756
- C:\Windows\System\MRLjbVv.exe
  C:\Windows\System\MRLjbVv.exe
  2⤵
  PID:12784
- C:\Windows\System\lDFFhtw.exe
  C:\Windows\System\lDFFhtw.exe
  2⤵
  PID:12812
- C:\Windows\System\DnoHQpZ.exe
  C:\Windows\System\DnoHQpZ.exe
  2⤵
  PID:12844
- C:\Windows\System\aPunwmR.exe
  C:\Windows\System\aPunwmR.exe
  2⤵
  PID:12872
- C:\Windows\System\XOxNKmd.exe
  C:\Windows\System\XOxNKmd.exe
  2⤵
  PID:12900
- C:\Windows\System\TLIEcoG.exe
  C:\Windows\System\TLIEcoG.exe
  2⤵
  PID:12928
- C:\Windows\System\bhOFsNm.exe
  C:\Windows\System\bhOFsNm.exe
  2⤵
  PID:12956
- C:\Windows\System\bFMqBca.exe
  C:\Windows\System\bFMqBca.exe
  2⤵
  PID:12984
- C:\Windows\System\jdRlacd.exe
  C:\Windows\System\jdRlacd.exe
  2⤵
  PID:13016
- C:\Windows\System\AWDXFjC.exe
  C:\Windows\System\AWDXFjC.exe
  2⤵
  PID:13044
- C:\Windows\System\aQqMClP.exe
  C:\Windows\System\aQqMClP.exe
  2⤵
  PID:13072
- C:\Windows\System\AaKfqai.exe
  C:\Windows\System\AaKfqai.exe
  2⤵
  PID:13100
- C:\Windows\System\yPCfINE.exe
  C:\Windows\System\yPCfINE.exe
  2⤵
  PID:13128
- C:\Windows\System\AchpDLl.exe
  C:\Windows\System\AchpDLl.exe
  2⤵
  PID:13156
- C:\Windows\System\hqxRYCk.exe
  C:\Windows\System\hqxRYCk.exe
  2⤵
  PID:12416
- C:\Windows\System\MYhgDbQ.exe
  C:\Windows\System\MYhgDbQ.exe
  2⤵
  PID:552
- C:\Windows\System\GiewFgh.exe
  C:\Windows\System\GiewFgh.exe
  2⤵
  PID:13240
- C:\Windows\System\YgMmEeP.exe
  C:\Windows\System\YgMmEeP.exe
  2⤵
  PID:12656
- C:\Windows\System\MCpPHeP.exe
  C:\Windows\System\MCpPHeP.exe
  2⤵
  PID:12692
- C:\Windows\System\EbBPUQW.exe
  C:\Windows\System\EbBPUQW.exe
  2⤵
  PID:12724
- C:\Windows\System\QwAyQMr.exe
  C:\Windows\System\QwAyQMr.exe
  2⤵
  PID:12796
- C:\Windows\System\sflxFve.exe
  C:\Windows\System\sflxFve.exe
  2⤵
  PID:12832
- C:\Windows\System\GfusqFu.exe
  C:\Windows\System\GfusqFu.exe
  2⤵
  PID:12896
- C:\Windows\System\apxBhpv.exe
  C:\Windows\System\apxBhpv.exe
  2⤵
  PID:12976
- C:\Windows\System\WgoSYkr.exe
  C:\Windows\System\WgoSYkr.exe
  2⤵
  PID:4288
- C:\Windows\System\poRcTpD.exe
  C:\Windows\System\poRcTpD.exe
  2⤵
  PID:13112
- C:\Windows\System\mXYzdxK.exe
  C:\Windows\System\mXYzdxK.exe
  2⤵
  PID:13140

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:10120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_dbg153lc.hgo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbg153lc.hgo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AfcyGUp.exe

Path C:\Windows\System\AfcyGUp.exe
Size 18B
SHA256 a4bbaafad9f7a4159a8d7ed56c5f952fd4aef992c463a9533a0b7014d7093216
MD5 ab3cbae1d66bf655a8259151bf44cc19
SHA1 c8f7a22a495716de9729a15edbbc1c408bec09cf
SHA512 0ea4b0bbba5078929f91449e0be5da09a4e2cb2343efd8d0bddc0d2e8e33bf572f1897ca950ae734c337ec204f1566d0cd38fc7acd82cd1e886a614e82b7e14d
MD5 SHA1 SHA512

Submit Download

CBUspAe.exe

Path C:\Windows\System\CBUspAe.exe
Size 2.7MB
SHA256 11340950ae0df4b17b200a0c8d3821a2ad2df1d115aa941b814b7f27fc8644d1
MD5 aff8d5dfb00511fd303798eb6fcf25ad
SHA1 e7842c000824125e3c5c13dd1ecc63a5abed7ecd
SHA512 499269e0233ff934c5140c0b63474d6fb1800a6aea45e864ee9440a029fd87fcf79b5475bc830f2aa622e8c2af81333db59117bf90e14ce691876d09266678a8
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCr:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDaFRse.exe

Path C:\Windows\System\DDaFRse.exe
Size 2.7MB
SHA256 4e5b47437a7fd3a33b77d461cc231865017a98dfbfe1cab730b3cdbfdee1ebe1
MD5 507f68730fc4f7227406c38efa84b873
SHA1 52e1a463cf9b0128b99867bd6fbf1349652bb34e
SHA512 51cf3901fc6fc34ea6f05272e201d9b9981ca53d08c513a90bceb4737c20d3e3cd8ab03dd9a9cd5ff37275f316bfaa7f8394071f158bf6e072abf662b07e69d0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC1:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECMLqkL.exe

Path C:\Windows\System\ECMLqkL.exe
Size 2.7MB
SHA256 ee48aefb217f69adb97966afb7de43c1da8d88e40a8c12f641423470ea96c2e2
MD5 4491852e646320d600d832232ab8fac0
SHA1 a601c29bd605e1e0c5cc6955809076aa8aefe4c6
SHA512 57668833aa7fdaf0765f09c29c97c194af3b9d3a714279e4ddf5f21e1b9ef98258866e2afb2fef22192c839a31f620cd362dca94f71ea1814a67686957d9d8d6
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

FWZCByZ.exe

Path C:\Windows\System\FWZCByZ.exe
Size 2.7MB
SHA256 98e99a50acd3a1532315abf361095626f8776a5d686913b7bcc501951bb93f98
MD5 edfbd3a06ee5df061be8a89e643e3295
SHA1 c5234cd38f22d9d49a3e0303d6f137eaef7d01bf
SHA512 1a14a49fcc9e8161f563bbc5c1387d8a2345c000520cef36b4b07dbdde80aeb75faba9f94cd9e47ad9bd08d0ef71182da3f45b3448ba9383043074b9b1ddd688
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC8:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

IciLufU.exe

Path C:\Windows\System\IciLufU.exe
Size 2.7MB
SHA256 550d9a68a5bc6465afc548f274beb7736150c33ee235ec046a4cca3a6d22daf2
MD5 8bc4d0562209b87167c66e24d3d1fe66
SHA1 b935c60bb2a66dc636b20d744a3fac10580b8935
SHA512 6b3077758efc431a7e8e531112c2289d7266fc114eb054eee8abc1b71afe1672145638524e7719e96e0aabde906c55563ab00ff656b3e5baf329a9afe50fff26
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

KBDuNHb.exe

Path C:\Windows\System\KBDuNHb.exe
Size 2.7MB
SHA256 17be2ad86b439dd0ca5cf09161caad1fa88606ed46a59fe3267fa5f2bc4dad70
MD5 5ab030740160fd75681b5d5697d952fa
SHA1 6b2b6dccc45ce81abe65af24e341cae1232fd46b
SHA512 4418b06b82bc9a12a17814dd61cacb573f2b288eb0a49304881201188f602b80b41cc76b4ea63f682191ac5a2350ce88e462c6f503324c7ccf2662e321fd55ce
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCK:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MVUWkWN.exe

Path C:\Windows\System\MVUWkWN.exe
Size 2.7MB
SHA256 9e4dc00e590e380bfe50dd8550a26798d75960a1f4335d69120ff3b9a16dcb35
MD5 36ab9cd1ba28d2b2e3c8f0d05bec600d
SHA1 eb9d286f0fd32e920e68cda83fbeac5761e0d2eb
SHA512 401f07486588958c7b92939a89c5f5e08d8c5d5581143e8206bad0d27048163f028abbf3307cfeabad05e6fe4bbee0d4ab750db36d5d8ee7e70e8b906b64f487
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCo:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

NMFsbnU.exe

Path C:\Windows\System\NMFsbnU.exe
Size 2.7MB
SHA256 ba1803610a3b9a0cfbd747c60dd15a886cbbe4e55d8719285106e8f23a923e25
MD5 b9368183337320af6742f9c0dbb26795
SHA1 1ae6e5549afee42e6952a3bd1751abdc3dfaf30f
SHA512 4593bcaeca7fbf02b0247b5a12732db5fee8e966f2bff4c61066fe0313c42e59f0a753f01a558752f88ba3bfed5e4883ca1e18c9dbfd235fedbfa36ca052b716
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCp:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

PVYJEmH.exe

Path C:\Windows\System\PVYJEmH.exe
Size 2.7MB
SHA256 e862cbc9d80fc6b07d214ab65e97a6dca36210bd1daa8a7d908149c411bb960c
MD5 9b6b0bdc079fc703d57446ba40aed4d9
SHA1 20f9618dd4fc366f0cf732560e1f5e6c0add55d4
SHA512 7994a4233d92f248d4b1c13393ae908ddaf9eb99ba682935b5256be835e88c46b56efcfea5fc7bdf90faa01acedae0a6f78e7106904a23f78cc9827822bf1d26
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TAUzFXI.exe

Path C:\Windows\System\TAUzFXI.exe
Size 2.7MB
SHA256 38abdd9852942fa4da1a9a90d7052733fa534bb94bfa7cc0e88fac2e5a9b3be9
MD5 7fae7ef5930cad39208a457fdb548cf0
SHA1 7440a5720bb84be73999a32a34aab4385542b30a
SHA512 3c03bcde684b1631fe244285dc60d5c9bfe1119534121341ca27affec382e087229a788c1c3bb682c072d028ae6306e0333089628f1024dcd8accb617aa231fb
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC6:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WCrMVrp.exe

Path C:\Windows\System\WCrMVrp.exe
Size 2.7MB
SHA256 b0b73921c7258927dcfe68938ca3ac5217bc94a4202fc95275f74cf038a261b7
MD5 99045c6fe82b5c03a8a148bb7b949940
SHA1 a8ab22a2f8cf79cd7e98279a4be52a2f7d95af07
SHA512 7a71f08532cdc14dbbeaf683382bd7496209942fa5a6a56688716337a73c6bb91bb4ed3a01bc836e8661a59d65e5adf1c7855b4e00f3660c753bd39dbd90d316
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCd:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WsetzHg.exe

Path C:\Windows\System\WsetzHg.exe
Size 2.7MB
SHA256 3c8ad7d9799adb1e8b79b9e053ae2e1ea76cced047b95a1d678dc7f6f426083e
MD5 fca9546e3c21d25aed09ffcb5ec42812
SHA1 b65cce8ad72e766b5c62b148f33d2ad8b0284b90
SHA512 f17b8e730ac073c0189da90739a3c05cfcba08bf2a3b7fe2a5eac8c4f318bb19271cfdc6bae1298106fdccdb75f8ee03e508e1374a9fa14d27272c097b936f21
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCl:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZHuYokt.exe

Path C:\Windows\System\ZHuYokt.exe
Size 2.7MB
SHA256 7704b471d63052fd600933ecdb1088f332eb7a70012182575fc8806675e3c020
MD5 e24551405f67f9fd0d5bf2d816d988bb
SHA1 076640642f14644ada7539d328ea2115c5a2551a
SHA512 3ab29eefce5ad0720b7118992b695812d718c5cca2bdc03390ac897f1a9accd79becf7e7e3212a3348885855235154ae2bdfba5e1fdb230e838d885c605d01ff
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCl:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZIaTZrf.exe

Path C:\Windows\System\ZIaTZrf.exe
Size 2.7MB
SHA256 bbed5db5510a05d514b59bc17f896c7e3bc653278a85777e3c5ebc7a3e739f45
MD5 415e2e3addbb7e03e34c6f0a71363d79
SHA1 cb53b9baf817a8b72b1b75b76f3ac347d9f7063d
SHA512 cdbf0e976f07bea3686ec119b8a29833fe46ca5e4ae146e2c4fc25cd06fcd35380fee915760542719b4e6e6aec98efee78976b1dd6cd36d2249f7a71d3f7f8e0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZkilhUp.exe

Path C:\Windows\System\ZkilhUp.exe
Size 2.7MB
SHA256 11ea98722a89c5af22c5e005968b0019fd210383b5194a0c0fb03896848a7ceb
MD5 c1ecee6ecc0c8ef87370ea73a4198164
SHA1 e8e84611f75562eca58c7d903dc7d5a0adaec7fb
SHA512 cc14d609f604808f1b30a15183fdce0200d83c8e72438a92a9c1f0d4519540d43fa404e453e388cfced27a470bd962f7aecf4f7509ebb73d1370b48aa21ac297
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCh:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZtJjDSC.exe

Path C:\Windows\System\ZtJjDSC.exe
Size 2.7MB
SHA256 4537422be8033c54b21a590e4b34d59f405554a044027507077c2dcd0164a3ce
MD5 ef2b786aecfdb0ca1ee23f1fc685ccda
SHA1 9b8e54404b8b9cfbed22668a7ab0a30a97b68676
SHA512 8cce2efb03bd5913e69e7e3e86479c2698ca58f15f57895beb2fcafe508fc506b40a201d718d9e560b921857132eee5eba85d5d866ebccd32002c4b6c2535334
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cyJQixB.exe

Path C:\Windows\System\cyJQixB.exe
Size 2.7MB
SHA256 228ff54c11f3774cfbb4a66cb5cfbab95f219dd5e1b22f5c93fd41c0cb85a3c6
MD5 c2f83d7a7e3b476043a0c2cfd09edf35
SHA1 66952158fefd7bcf214b7b2616843e118ab4cae0
SHA512 2112c597e8166059408c9c9b058f5be9e51510b716e3aafa120d5f0bf61b2466ffdb495a4fb3e59345516426494cbe04ea2528806d7a7c09e9d916d0cbb7d88f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCs:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

dTEAKDI.exe

Path C:\Windows\System\dTEAKDI.exe
Size 2.7MB
SHA256 28becb9caf300620e39dfe7af88ae4ee11223ae7d63b49bf2c54d6b14819bcfa
MD5 243d71b4a33d9177df5fdb2342e25f8c
SHA1 901b221a4d0e4cd9f01f997d4b61f583d5dfc9ba
SHA512 bff3414f32878d1bf2c51743d1e31c4c931f94c88ecef321210bb7b01e2634843a65607e227c8413c756c46942a8c5c9336bdec9edde0b4f28833c3ff09068d7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCe:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eTSkyMh.exe

Path C:\Windows\System\eTSkyMh.exe
Size 2.7MB
SHA256 948c5f4e9261eabcbf8dc143b296781a1e599c7d319949928137c8266aeb9850
MD5 f8be702b36c7677921616da029e2076b
SHA1 927f211084a7d8912c638c4e2de7970dc4c182ef
SHA512 e2c252fce090924854df0822e9f6e8d3d22a7748e1a5654272172b9889d01aea2957258807730902ca80e01a1f95d15ab9c56db8d960675d5bfb5cfddd542efd
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

eYiWTHX.exe

Path C:\Windows\System\eYiWTHX.exe
Size 2.7MB
SHA256 e4583429012531c93de4601ae96a13a801fd7d7124b639a15a0c49d310be5706
MD5 c6c5c41708197fdb8f61b99230931c52
SHA1 6ceec8e72f3eacdefa0eae4dfbc68d700e1a34bd
SHA512 55ea85bb1cd00fdfd08ec6312140de7669e3ca813530ef24295c7a55063b243b2e9eb2c8054015943407176a35ee012e78e3acca8d43d8e9a62e47c6664cd667
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCJ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMBSTFL.exe

Path C:\Windows\System\gMBSTFL.exe
Size 2.7MB
SHA256 46fdc0b4797e96a4e79970c0604c35074d775e83f8a940a6b624a913966192ba
MD5 f1faf14d59451884764364673b4c7323
SHA1 8a70ed4110807a629d858c570cad4541b810553e
SHA512 fb9096e61b3bef285817566a91ca17274a8d9c5fac63f1c665a1d4f2ed27926939ab836e12bc10c7c3f73bbab80ef05f29955ca6d83be00ddb953193d1599a5e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC5:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

gVHtTbD.exe

Path C:\Windows\System\gVHtTbD.exe
Size 2.7MB
SHA256 7e9a13eecf0620ce5da2cd711325a89efc0a7035c2f05564c18256cd38284463
MD5 3b8794ef809ed3aeff0b01de34fc1167
SHA1 99f1901823702f61afb28bbca010163efbe4c999
SHA512 70444ab38a1f7888277cd69173c90912a4ebe179957b1391de69eb07001a26d5604574da7c5369c645b90af0974a309ddd8da654fa7e0c3b7842b521aff5be90
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCp:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

iSNggoL.exe

Path C:\Windows\System\iSNggoL.exe
Size 2.7MB
SHA256 ad1a1ee6877e622a5dfdd450f2efae96ff39b8b0aa17b13a09c8990d775e686a
MD5 5555d93c74aadaf1586d3fa8935bf6fa
SHA1 9375a849a8a59a31d06e4774d7b71a6106ebfec4
SHA512 25b8e1732a99ebdefc12505093c4c8aff4836c3e882187a3a199fdd43c0394a5de4d15320f5665fe49bcf32fe22dbb3ed908b2651c0721aa425f6ce6b313dea1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCo:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipqxQSr.exe

Path C:\Windows\System\ipqxQSr.exe
Size 2.7MB
SHA256 22ffeb800e8525abe491dc31ee7d4ca1fb1f0d4ce0670811ff7aaf7ceaf9c959
MD5 92a2972dd6773bbd7481b67a2a39e71f
SHA1 ed1499a2ba0fab34183166b18f0adf77b2d2864b
SHA512 c4ecd2bc1046c3eb01e7a1f344e27c6a5839179043b54035cf8f785d493f8c1ae01840df94b9f9b637de0d0601620cd7e1ad080d319b6a1691d97a60998d3a1d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jIkLrvE.exe

Path C:\Windows\System\jIkLrvE.exe
Size 2.7MB
SHA256 355d4d5110c830826eccd4ce4b46e941ebc4faa79e6b3c89af0cd86d111e52ed
MD5 9fccf0efc17033288e88e5aaa11e085c
SHA1 55bb441a3292642a0804e65bf36e75b20cb7f9eb
SHA512 4736c305b9ae99056595b13591d8b5a0ed4cad09f2b4bc903d5df5677e6a80ab3ad5ec9b9fda53bb583b5d652f1415f291d2371daf96357bf102cf2d34bc96b6
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCi:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jVQeOwL.exe

Path C:\Windows\System\jVQeOwL.exe
Size 2.7MB
SHA256 54b26c3e2dae48ad3de1b8c20621c5c3fc77aac291a402cb3552bc33aa65b407
MD5 f8f98bcfb15a470d99dfe6382de7617d
SHA1 c078f4cf28a0894a5b5c4ab34b605d0fcbaf80d5
SHA512 4d94d8dfbf57e42e06d3dbb13cb733ae7fa02b26c70e55c823cb5edb48f798d72b726d29556556b6fb50a972d580ab96d966f3ae7c4c94d277ecdf3724b115d7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCx:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

kYKDMvF.exe

Path C:\Windows\System\kYKDMvF.exe
Size 2.7MB
SHA256 19236899f2411ee1de9661e0e07e3dabfe41ad337e2566341facdf0d8e08c90f
MD5 f487082bd88ac3efec420e05cf636d41
SHA1 0f8b713c8bd4d7ba03d0abca1a1604f7fdbda66b
SHA512 be1f427723ffa5dc7fe3459a186e6dfd68ac3041f2914d75a4f36ab16e5d25a26cc2cc1818b43688dc7be576f82472905df4db1709df1d7b1253aae5fa15557b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCj:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

khwkYTA.exe

Path C:\Windows\System\khwkYTA.exe
Size 2.7MB
SHA256 54e8134ad124f0aaefabc537b66a0f16572bacafa84aaef3c96e75ed5f4279ab
MD5 9928233f1681d90f0706a0ced69ead1e
SHA1 7e9e9cd306c590bee29354e0b19dac8c9681c444
SHA512 b29f1a1df4fbd9746362b0d2fc18bfe73ab1fd0f1da7b549123ab9df8dc672c5b01caea92db87acc8e133a0970294528a08b472bd9a8e5431fc871833bdfc71b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

nNwuTLD.exe

Path C:\Windows\System\nNwuTLD.exe
Size 2.7MB
SHA256 5afb3224e00175dee6f04344f3a5db5182e26d9ba7d59050f625035c98285847
MD5 1f337d132958b86aa153bebd24a0bb18
SHA1 37c148f3af94817260b910163928e9f4a713db3a
SHA512 bed9da07e62b09140d37ae0ac4c9cbc1743d62ac9d2023d40fb2733cad6d57bbe29f7f0dbdda07efdc5c4cdbf8b77d9ff8cd2063514cc7c63760b30735caded8
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCy:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

npGyzkg.exe

Path C:\Windows\System\npGyzkg.exe
Size 2.7MB
SHA256 64fb548c0e61ffeab05065c566339efee39160e4682d46031716e534cc000a78
MD5 b41b705363bae370547cf5c4692686c7
SHA1 b5514ef67134fc3ea5aa48b67a6da5fd92e4ff73
SHA512 65e7c393691275dcb5ab4d8384c3de46731c889c163b9a3e22a3239adbee6e714ec6cbe0371811cc438fb21dc9b056be39c3f4acca1ab0649c031a76ebe6352f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

pCHfrck.exe

Path C:\Windows\System\pCHfrck.exe
Size 8B
SHA256 0273bd4ea1012877e7b400db030d2a52116d78216fe44051f4de39b23dbcdc12
MD5 4c329dabe7e828c395eeb2e5a50fbbe7
SHA1 85b8304d0e8671eb6d0af76a2a446025d429a002
SHA512 26e2bc581b42ae7552c40da8f1a83178cbc8cac3272949c13faf1128fe4e2a26f3d612187dd300f3ea69f4977387012c2783f1d9f5bd76d58d0187fb3ac96e0a
MD5 SHA1 SHA512

Submit Download

rclsqDZ.exe

Path C:\Windows\System\rclsqDZ.exe
Size 2.7MB
SHA256 872293e062c4ec16691f5f7866c1fb4090605a21120033eb2d5d5775587f4bed
MD5 37ea4150f0458dfe6c7b645785877dfc
SHA1 9b93e0d19a00501e88da6c4d46acd418caba7b80
SHA512 4ea40d5895c06ab80d3a80bd50b8dbd9e9e48afa181794b8c851212656465ef45e54d36c24dc961c0c258937ebd120c8ab0da726b0baf4b685caf5642c071188
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mC9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUyqFgo.exe

Path C:\Windows\System\wUyqFgo.exe
Size 2.7MB
SHA256 6a60d2b9d7de9b3493f4fb1b3b1c153febeae0f21b197aac1e8f0ad726a02c35
MD5 1e25e21f5aba2117f0a5018ef1fa7de1
SHA1 627f1ca31f6ccffc4425543df36bccba9e52849c
SHA512 86a09ce435f99864435ef009949976061ed6eb395536be6db633c3aaecc332b04d9296dbb178391ade9aced2f5865f7b432ae7f1db15d68fb63b5d99fff1a24d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCz:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

ySFxvXo.exe

Path C:\Windows\System\ySFxvXo.exe
Size 2.7MB
SHA256 2863497d72eb271086f4c4c96b4433d78d1638680657a6b8bec0b0b747d92700
MD5 72946a2179c2f4376036739f03f2d753
SHA1 06d19e19502346c4e48797d5f06662b64978dbb0
SHA512 ddec05ae00457514a69b7860b080450212bb94e9c4264f4a4a6f748c25df763ddf24db33fae956d3c62c901b304e22179b31c64240e9437efbb35810f4b27a67
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCQ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

yXuBIzT.exe

Path C:\Windows\System\yXuBIzT.exe
Size 2.7MB
SHA256 2ab2e12ef76180c0878dd65c2d099e8255be00118129b00493ccec69b4a8e95a
MD5 ca2c9c348a69051027873b2da722224b
SHA1 907d60ac85721dca074314e51b368a84af64aeec
SHA512 fb455a45226a7c76879f41bd69e6b90a63e165ddbde88f655e0614eb6d6ecd0ab90a677aa75b553a5f7f38e905e34bc804e533f934e1d764df5e5ab925f8a133
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mCk:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/340-2913-0x00007FF71EAB0000-0x00007FF71EEA6000-memory.dmp

Download

memory/340-23-0x00007FF71EAB0000-0x00007FF71EEA6000-memory.dmp

Download

memory/372-2932-0x00007FF6C6D60000-0x00007FF6C7156000-memory.dmp

Download

memory/372-235-0x00007FF6C6D60000-0x00007FF6C7156000-memory.dmp

Download

memory/856-2929-0x00007FF6EC530000-0x00007FF6EC926000-memory.dmp

Download

memory/856-239-0x00007FF6EC530000-0x00007FF6EC926000-memory.dmp

Download

memory/880-230-0x00007FF7458B0000-0x00007FF745CA6000-memory.dmp

Download

memory/880-2927-0x00007FF7458B0000-0x00007FF745CA6000-memory.dmp

Download

memory/1344-222-0x00007FF7BC290000-0x00007FF7BC686000-memory.dmp

Download

memory/1344-2924-0x00007FF7BC290000-0x00007FF7BC686000-memory.dmp

Download

memory/1412-241-0x00007FF7812B0000-0x00007FF7816A6000-memory.dmp

Download

memory/1412-2934-0x00007FF7812B0000-0x00007FF7816A6000-memory.dmp

Download

memory/1696-2915-0x00007FF64A920000-0x00007FF64AD16000-memory.dmp

Download

memory/1696-112-0x00007FF64A920000-0x00007FF64AD16000-memory.dmp

Download

memory/2096-234-0x00007FF7C1290000-0x00007FF7C1686000-memory.dmp

Download

memory/2096-2933-0x00007FF7C1290000-0x00007FF7C1686000-memory.dmp

Download

memory/2140-233-0x00007FF77B8A0000-0x00007FF77BC96000-memory.dmp

Download

memory/2140-2931-0x00007FF77B8A0000-0x00007FF77BC96000-memory.dmp

Download

memory/2260-0-0x00007FF757F60000-0x00007FF758356000-memory.dmp

Download

memory/2260-1-0x000001B65A5A0000-0x000001B65A5B0000-memory.dmp

Download

memory/2484-126-0x00007FF6C6D50000-0x00007FF6C7146000-memory.dmp

Download

memory/2484-2917-0x00007FF6C6D50000-0x00007FF6C7146000-memory.dmp

Download

memory/2524-2925-0x00007FF6BC520000-0x00007FF6BC916000-memory.dmp

Download

memory/2524-229-0x00007FF6BC520000-0x00007FF6BC916000-memory.dmp

Download

memory/2840-2911-0x00007FF6DF080000-0x00007FF6DF476000-memory.dmp

Download

memory/2840-13-0x00007FF6DF080000-0x00007FF6DF476000-memory.dmp

Download

memory/3140-240-0x00007FF64E070000-0x00007FF64E466000-memory.dmp

Download

memory/3140-2930-0x00007FF64E070000-0x00007FF64E466000-memory.dmp

Download

memory/3144-98-0x000001F48D8D0000-0x000001F48D8F2000-memory.dmp

Download

memory/3144-79-0x00007FF950D50000-0x00007FF951811000-memory.dmp

Download

memory/3144-281-0x000001F4A6F50000-0x000001F4A76F6000-memory.dmp

Download

memory/3144-59-0x00007FF950D50000-0x00007FF951811000-memory.dmp

Download

memory/3144-14-0x00007FF950D53000-0x00007FF950D55000-memory.dmp

Download

memory/3156-2914-0x00007FF6538D0000-0x00007FF653CC6000-memory.dmp

Download

memory/3156-237-0x00007FF6538D0000-0x00007FF653CC6000-memory.dmp

Download

memory/3204-2923-0x00007FF6D01A0000-0x00007FF6D0596000-memory.dmp

Download

memory/3204-232-0x00007FF6D01A0000-0x00007FF6D0596000-memory.dmp

Download

memory/3628-131-0x00007FF78E600000-0x00007FF78E9F6000-memory.dmp

Download

memory/3628-2918-0x00007FF78E600000-0x00007FF78E9F6000-memory.dmp

Download

memory/3644-2926-0x00007FF649DA0000-0x00007FF64A196000-memory.dmp

Download

memory/3644-227-0x00007FF649DA0000-0x00007FF64A196000-memory.dmp

Download

memory/3800-145-0x00007FF71AA00000-0x00007FF71ADF6000-memory.dmp

Download

memory/3800-2920-0x00007FF71AA00000-0x00007FF71ADF6000-memory.dmp

Download

memory/3848-236-0x00007FF614470000-0x00007FF614866000-memory.dmp

Download

memory/3848-2916-0x00007FF614470000-0x00007FF614866000-memory.dmp

Download

memory/3916-2912-0x00007FF69E580000-0x00007FF69E976000-memory.dmp

Download

memory/3916-94-0x00007FF69E580000-0x00007FF69E976000-memory.dmp

Download

memory/4112-238-0x00007FF751BE0000-0x00007FF751FD6000-memory.dmp

Download

memory/4112-2919-0x00007FF751BE0000-0x00007FF751FD6000-memory.dmp

Download

memory/4180-228-0x00007FF775D20000-0x00007FF776116000-memory.dmp

Download

memory/4180-2921-0x00007FF775D20000-0x00007FF776116000-memory.dmp

Download

memory/4628-216-0x00007FF79B9A0000-0x00007FF79BD96000-memory.dmp

Download

memory/4628-2922-0x00007FF79B9A0000-0x00007FF79BD96000-memory.dmp

Download

memory/4792-2928-0x00007FF750650000-0x00007FF750A46000-memory.dmp

Download

memory/4792-231-0x00007FF750650000-0x00007FF750A46000-memory.dmp

Download