xmrig | eec6badcc1dcdf4fb378368950d9523715a4e6680013470366598a116a9540dc

Analysis

max time kernel
128s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
Size 3.0MB
Sample240527-a8zb3abc84
SHA256 eec6badcc1dcdf4fb378368950d9523715a4e6680013470366598a116a9540dc
MD5 12355e736d20f10fdcc6a675dee69ac0
SHA1 9f5fbda0d34717e46c0615c0b0128baafd8ca4fe
SHA512 49b6f62067f3cb29741f81c42007b34bd7fbe86d6e7af27c829d65bfd4d1271edbaa04e1c134066689c7a995baedee93423256ea079d52fa58314f966cb931bc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2172-0-0x00007FF7E47F0000-0x00007FF7E4BE6000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-5.dat	xmrig
behavioral2/files/0x0007000000023410-9.dat	xmrig
behavioral2/files/0x0007000000023411-16.dat	xmrig
behavioral2/files/0x0007000000023412-20.dat	xmrig
behavioral2/files/0x0007000000023413-31.dat	xmrig
behavioral2/files/0x0007000000023415-36.dat	xmrig
behavioral2/memory/4028-63-0x00007FF740770000-0x00007FF740B66000-memory.dmp	xmrig
behavioral2/files/0x000800000002340d-89.dat	xmrig
behavioral2/files/0x0007000000023424-139.dat	xmrig
behavioral2/files/0x000700000002342c-179.dat	xmrig
behavioral2/memory/3760-830-0x00007FF7ECD00000-0x00007FF7ED0F6000-memory.dmp	xmrig
behavioral2/memory/1532-858-0x00007FF6025B0000-0x00007FF6029A6000-memory.dmp	xmrig
behavioral2/memory/5036-852-0x00007FF6C25E0000-0x00007FF6C29D6000-memory.dmp	xmrig
behavioral2/memory/1112-847-0x00007FF7B6990000-0x00007FF7B6D86000-memory.dmp	xmrig
behavioral2/memory/4576-871-0x00007FF784540000-0x00007FF784936000-memory.dmp	xmrig
behavioral2/memory/4604-874-0x00007FF6D7CC0000-0x00007FF6D80B6000-memory.dmp	xmrig
behavioral2/memory/2184-879-0x00007FF7B8310000-0x00007FF7B8706000-memory.dmp	xmrig
behavioral2/memory/2212-884-0x00007FF611B00000-0x00007FF611EF6000-memory.dmp	xmrig
behavioral2/memory/1028-868-0x00007FF705E70000-0x00007FF706266000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-181.dat	xmrig
behavioral2/files/0x000700000002342d-176.dat	xmrig
behavioral2/files/0x000700000002342b-174.dat	xmrig
behavioral2/memory/2600-902-0x00007FF6E2810000-0x00007FF6E2C06000-memory.dmp	xmrig
behavioral2/memory/4224-916-0x00007FF6BF7F0000-0x00007FF6BFBE6000-memory.dmp	xmrig
behavioral2/memory/3536-918-0x00007FF68C7E0000-0x00007FF68CBD6000-memory.dmp	xmrig
behavioral2/memory/2140-911-0x00007FF77B440000-0x00007FF77B836000-memory.dmp	xmrig
behavioral2/memory/860-893-0x00007FF648630000-0x00007FF648A26000-memory.dmp	xmrig
behavioral2/memory/1964-894-0x00007FF7446C0000-0x00007FF744AB6000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-169.dat	xmrig
behavioral2/files/0x0007000000023429-164.dat	xmrig
behavioral2/files/0x0007000000023428-159.dat	xmrig
behavioral2/files/0x0007000000023427-154.dat	xmrig
behavioral2/files/0x0007000000023426-149.dat	xmrig
behavioral2/files/0x0007000000023425-144.dat	xmrig
behavioral2/files/0x0007000000023423-134.dat	xmrig
behavioral2/files/0x0007000000023422-129.dat	xmrig
behavioral2/files/0x0007000000023421-124.dat	xmrig
behavioral2/files/0x0007000000023420-119.dat	xmrig
behavioral2/files/0x000700000002341f-114.dat	xmrig
behavioral2/files/0x000700000002341e-106.dat	xmrig
behavioral2/files/0x000700000002341d-102.dat	xmrig
behavioral2/files/0x000700000002341c-99.dat	xmrig
behavioral2/files/0x0008000000023417-91.dat	xmrig
behavioral2/memory/4608-929-0x00007FF6A2CB0000-0x00007FF6A30A6000-memory.dmp	xmrig
behavioral2/memory/4660-931-0x00007FF7BA990000-0x00007FF7BAD86000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-85.dat	xmrig
behavioral2/files/0x0008000000023418-80.dat	xmrig
behavioral2/memory/3144-75-0x00007FF699BD0000-0x00007FF699FC6000-memory.dmp	xmrig
behavioral2/memory/4560-71-0x00007FF679B40000-0x00007FF679F36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-69.dat	xmrig
behavioral2/files/0x000700000002341a-67.dat	xmrig
behavioral2/memory/3556-66-0x00007FF68A3D0000-0x00007FF68A7C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-57.dat	xmrig
behavioral2/files/0x0007000000023419-56.dat	xmrig
behavioral2/memory/3908-12-0x00007FF6289D0000-0x00007FF628DC6000-memory.dmp	xmrig
behavioral2/memory/1716-938-0x00007FF681240000-0x00007FF681636000-memory.dmp	xmrig
behavioral2/memory/3352-936-0x00007FF6E6A80000-0x00007FF6E6E76000-memory.dmp	xmrig
behavioral2/memory/3908-2199-0x00007FF6289D0000-0x00007FF628DC6000-memory.dmp	xmrig
behavioral2/memory/4224-2200-0x00007FF6BF7F0000-0x00007FF6BFBE6000-memory.dmp	xmrig
behavioral2/memory/4028-2201-0x00007FF740770000-0x00007FF740B66000-memory.dmp	xmrig
behavioral2/memory/3536-2202-0x00007FF68C7E0000-0x00007FF68CBD6000-memory.dmp	xmrig
behavioral2/memory/3556-2205-0x00007FF68A3D0000-0x00007FF68A7C6000-memory.dmp	xmrig
behavioral2/memory/4560-2204-0x00007FF679B40000-0x00007FF679F36000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
9	3376	powershell.exe
11	3376	powershell.exe
16	3376	powershell.exe
17	3376	powershell.exe
19	3376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3908	ctgyZKc.exe
4224	GlvyXLd.exe
4028	uZAOZfo.exe
3536	GpwyErX.exe
3556	fDGxgiA.exe
4608	IfDVghu.exe
4560	rBEsbGt.exe
3144	hUJOtvR.exe
3760	CslVaga.exe
4660	EOIVwiH.exe
3352	nZAshhP.exe
1716	pYthoKE.exe
1112	ynWzKhX.exe
5036	hkclHzn.exe
1532	OsjIGsf.exe
1028	WltjsPl.exe
4576	pyGCzkv.exe
4604	GgiiZRv.exe
2184	UWZfXAp.exe
2212	RcQuDRU.exe
860	XDGAAPl.exe
1964	tJLjBLg.exe
2600	MKQVUjx.exe
2140	DgzzRUn.exe
2824	dUTNPoz.exe
1192	fLpfrSP.exe
4348	jpcIkNM.exe
392	MTfnvyg.exe
2424	oxwkBjK.exe
696	AsjQYDh.exe
4672	XbHuRyd.exe
4124	IvuLsTa.exe
544	lkYDJTP.exe
5008	VkTZqMA.exe
956	zxanbdr.exe
4284	lDdGtxu.exe
3804	wDouksD.exe
5096	LWGeknG.exe
640	MuqDqly.exe
2112	bnDSSTt.exe
4176	JyliCHN.exe
4372	EKkzEgN.exe
4336	yaqFvnI.exe
2520	wQKRscz.exe
612	WGRSPaM.exe
1064	zOVlOCZ.exe
3552	zDQBUSi.exe
3740	keUESkD.exe
3744	lQrnkFX.exe
4980	OHjcXMA.exe
3024	nlaEKxT.exe
2200	MebuOOG.exe
3080	SzEDRHv.exe
2064	bHoTanO.exe
3060	ePOQrwe.exe
1276	GYWeJVI.exe
3768	PIRYUdA.exe
2684	hqUXgpL.exe
3276	dwUHukU.exe
1724	ukWOoMJ.exe
4528	dwxfBiG.exe
3656	clTMuMU.exe
3228	upRnkiK.exe
3576	APICuCA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2172-0-0x00007FF7E47F0000-0x00007FF7E4BE6000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/files/0x0007000000023410-9.dat	upx
behavioral2/files/0x0007000000023411-16.dat	upx
behavioral2/files/0x0007000000023412-20.dat	upx
behavioral2/files/0x0007000000023413-31.dat	upx
behavioral2/files/0x0007000000023415-36.dat	upx
behavioral2/memory/4028-63-0x00007FF740770000-0x00007FF740B66000-memory.dmp	upx
behavioral2/files/0x000800000002340d-89.dat	upx
behavioral2/files/0x0007000000023424-139.dat	upx
behavioral2/files/0x000700000002342c-179.dat	upx
behavioral2/memory/3760-830-0x00007FF7ECD00000-0x00007FF7ED0F6000-memory.dmp	upx
behavioral2/memory/1532-858-0x00007FF6025B0000-0x00007FF6029A6000-memory.dmp	upx
behavioral2/memory/5036-852-0x00007FF6C25E0000-0x00007FF6C29D6000-memory.dmp	upx
behavioral2/memory/1112-847-0x00007FF7B6990000-0x00007FF7B6D86000-memory.dmp	upx
behavioral2/memory/4576-871-0x00007FF784540000-0x00007FF784936000-memory.dmp	upx
behavioral2/memory/4604-874-0x00007FF6D7CC0000-0x00007FF6D80B6000-memory.dmp	upx
behavioral2/memory/2184-879-0x00007FF7B8310000-0x00007FF7B8706000-memory.dmp	upx
behavioral2/memory/2212-884-0x00007FF611B00000-0x00007FF611EF6000-memory.dmp	upx
behavioral2/memory/1028-868-0x00007FF705E70000-0x00007FF706266000-memory.dmp	upx
behavioral2/files/0x000700000002342e-181.dat	upx
behavioral2/files/0x000700000002342d-176.dat	upx
behavioral2/files/0x000700000002342b-174.dat	upx
behavioral2/memory/2600-902-0x00007FF6E2810000-0x00007FF6E2C06000-memory.dmp	upx
behavioral2/memory/4224-916-0x00007FF6BF7F0000-0x00007FF6BFBE6000-memory.dmp	upx
behavioral2/memory/3536-918-0x00007FF68C7E0000-0x00007FF68CBD6000-memory.dmp	upx
behavioral2/memory/2140-911-0x00007FF77B440000-0x00007FF77B836000-memory.dmp	upx
behavioral2/memory/860-893-0x00007FF648630000-0x00007FF648A26000-memory.dmp	upx
behavioral2/memory/1964-894-0x00007FF7446C0000-0x00007FF744AB6000-memory.dmp	upx
behavioral2/files/0x000700000002342a-169.dat	upx
behavioral2/files/0x0007000000023429-164.dat	upx
behavioral2/files/0x0007000000023428-159.dat	upx
behavioral2/files/0x0007000000023427-154.dat	upx
behavioral2/files/0x0007000000023426-149.dat	upx
behavioral2/files/0x0007000000023425-144.dat	upx
behavioral2/files/0x0007000000023423-134.dat	upx
behavioral2/files/0x0007000000023422-129.dat	upx
behavioral2/files/0x0007000000023421-124.dat	upx
behavioral2/files/0x0007000000023420-119.dat	upx
behavioral2/files/0x000700000002341f-114.dat	upx
behavioral2/files/0x000700000002341e-106.dat	upx
behavioral2/files/0x000700000002341d-102.dat	upx
behavioral2/files/0x000700000002341c-99.dat	upx
behavioral2/files/0x0008000000023417-91.dat	upx
behavioral2/memory/4608-929-0x00007FF6A2CB0000-0x00007FF6A30A6000-memory.dmp	upx
behavioral2/memory/4660-931-0x00007FF7BA990000-0x00007FF7BAD86000-memory.dmp	upx
behavioral2/files/0x000700000002341b-85.dat	upx
behavioral2/files/0x0008000000023418-80.dat	upx
behavioral2/memory/3144-75-0x00007FF699BD0000-0x00007FF699FC6000-memory.dmp	upx
behavioral2/memory/4560-71-0x00007FF679B40000-0x00007FF679F36000-memory.dmp	upx
behavioral2/files/0x0007000000023416-69.dat	upx
behavioral2/files/0x000700000002341a-67.dat	upx
behavioral2/memory/3556-66-0x00007FF68A3D0000-0x00007FF68A7C6000-memory.dmp	upx
behavioral2/files/0x0007000000023414-57.dat	upx
behavioral2/files/0x0007000000023419-56.dat	upx
behavioral2/memory/3908-12-0x00007FF6289D0000-0x00007FF628DC6000-memory.dmp	upx
behavioral2/memory/1716-938-0x00007FF681240000-0x00007FF681636000-memory.dmp	upx
behavioral2/memory/3352-936-0x00007FF6E6A80000-0x00007FF6E6E76000-memory.dmp	upx
behavioral2/memory/3908-2199-0x00007FF6289D0000-0x00007FF628DC6000-memory.dmp	upx
behavioral2/memory/4224-2200-0x00007FF6BF7F0000-0x00007FF6BFBE6000-memory.dmp	upx
behavioral2/memory/4028-2201-0x00007FF740770000-0x00007FF740B66000-memory.dmp	upx
behavioral2/memory/3536-2202-0x00007FF68C7E0000-0x00007FF68CBD6000-memory.dmp	upx
behavioral2/memory/3556-2205-0x00007FF68A3D0000-0x00007FF68A7C6000-memory.dmp	upx
behavioral2/memory/4560-2204-0x00007FF679B40000-0x00007FF679F36000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sEthiVw.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MgpjXar.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\bnXScBC.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\DvrhTVD.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\RcQuDRU.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\aBDSRyN.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\asqnwqN.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\bSxHGUT.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\CsAZkAW.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\eAjqlCR.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\qRhjLNR.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\PlIgQAs.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JyliCHN.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JOCtrjI.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\UvmdPxz.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\gTkgYqZ.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HdivpfC.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\wGTTXHR.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MebuOOG.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\bpNEXpZ.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\SBQeYVi.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\cyVrkoo.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\TXGSKFk.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MgBkKtI.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MxFsTvN.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\LGcMbHe.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\UAwUyoT.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\kOellRI.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\LkPwRKB.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\cmkbDDB.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\GbjmCJG.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\IxPMrXG.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HeevwcA.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\lwZiPcV.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\VSqFHrC.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HavhIrn.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\iiXLFSS.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\fSCQltw.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\RACUjAX.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ZvGGkXx.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\BTKEzJn.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\wWoovva.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\YXDWVfX.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\UEXEUVC.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\bDWNcCT.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\bvpQndS.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\okMgryy.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\UboDung.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HpNnkGO.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\NhSwpWh.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\odgDuoB.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\nmpbqyK.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ogBxmTw.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ZJbNBNG.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\Kdrmtzl.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\OsjIGsf.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\tJLjBLg.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\sGjXCko.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ksmxXwW.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\IkXUnLH.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\rgpWPJW.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\EBLeelN.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\IfDVghu.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
File created	C:\Windows\System\FIxWoZH.exe	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3376	powershell.exe
3376	powershell.exe
3376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeLockMemoryPrivilege	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3376	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	85
PID 2172 wrote to memory of 3376	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	85
PID 2172 wrote to memory of 3908	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	86
PID 2172 wrote to memory of 3908	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	86
PID 2172 wrote to memory of 4224	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	87
PID 2172 wrote to memory of 4224	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	87
PID 2172 wrote to memory of 4028	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	88
PID 2172 wrote to memory of 4028	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	88
PID 2172 wrote to memory of 3536	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	89
PID 2172 wrote to memory of 3536	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	89
PID 2172 wrote to memory of 3556	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	90
PID 2172 wrote to memory of 3556	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	90
PID 2172 wrote to memory of 4608	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	91
PID 2172 wrote to memory of 4608	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	91
PID 2172 wrote to memory of 4560	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	92
PID 2172 wrote to memory of 4560	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	92
PID 2172 wrote to memory of 3144	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	93
PID 2172 wrote to memory of 3144	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	93
PID 2172 wrote to memory of 3760	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	94
PID 2172 wrote to memory of 3760	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	94
PID 2172 wrote to memory of 4660	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	95
PID 2172 wrote to memory of 4660	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	95
PID 2172 wrote to memory of 3352	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	96
PID 2172 wrote to memory of 3352	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	96
PID 2172 wrote to memory of 1716	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	97
PID 2172 wrote to memory of 1716	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	97
PID 2172 wrote to memory of 1112	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	98
PID 2172 wrote to memory of 1112	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	98
PID 2172 wrote to memory of 5036	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	99
PID 2172 wrote to memory of 5036	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	99
PID 2172 wrote to memory of 1532	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	100
PID 2172 wrote to memory of 1532	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	100
PID 2172 wrote to memory of 1028	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	101
PID 2172 wrote to memory of 1028	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	101
PID 2172 wrote to memory of 4576	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	102
PID 2172 wrote to memory of 4576	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	102
PID 2172 wrote to memory of 4604	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	103
PID 2172 wrote to memory of 4604	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	103
PID 2172 wrote to memory of 2184	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	104
PID 2172 wrote to memory of 2184	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	104
PID 2172 wrote to memory of 2212	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	105
PID 2172 wrote to memory of 2212	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	105
PID 2172 wrote to memory of 860	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	106
PID 2172 wrote to memory of 860	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	106
PID 2172 wrote to memory of 1964	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	107
PID 2172 wrote to memory of 1964	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	107
PID 2172 wrote to memory of 2600	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	108
PID 2172 wrote to memory of 2600	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	108
PID 2172 wrote to memory of 2140	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	109
PID 2172 wrote to memory of 2140	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	109
PID 2172 wrote to memory of 2824	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	110
PID 2172 wrote to memory of 2824	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	110
PID 2172 wrote to memory of 1192	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	111
PID 2172 wrote to memory of 1192	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	111
PID 2172 wrote to memory of 4348	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	112
PID 2172 wrote to memory of 4348	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	112
PID 2172 wrote to memory of 392	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	113
PID 2172 wrote to memory of 392	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	113
PID 2172 wrote to memory of 2424	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	114
PID 2172 wrote to memory of 2424	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	114
PID 2172 wrote to memory of 696	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	115
PID 2172 wrote to memory of 696	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	115
PID 2172 wrote to memory of 4672	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	116
PID 2172 wrote to memory of 4672	2172	12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\12355e736d20f10fdcc6a675dee69ac0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\System\ctgyZKc.exe
  C:\Windows\System\ctgyZKc.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\GlvyXLd.exe
  C:\Windows\System\GlvyXLd.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\uZAOZfo.exe
  C:\Windows\System\uZAOZfo.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\GpwyErX.exe
  C:\Windows\System\GpwyErX.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\fDGxgiA.exe
  C:\Windows\System\fDGxgiA.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\IfDVghu.exe
  C:\Windows\System\IfDVghu.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\rBEsbGt.exe
  C:\Windows\System\rBEsbGt.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\hUJOtvR.exe
  C:\Windows\System\hUJOtvR.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\CslVaga.exe
  C:\Windows\System\CslVaga.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\EOIVwiH.exe
  C:\Windows\System\EOIVwiH.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\nZAshhP.exe
  C:\Windows\System\nZAshhP.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\pYthoKE.exe
  C:\Windows\System\pYthoKE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\ynWzKhX.exe
  C:\Windows\System\ynWzKhX.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\hkclHzn.exe
  C:\Windows\System\hkclHzn.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\OsjIGsf.exe
  C:\Windows\System\OsjIGsf.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\WltjsPl.exe
  C:\Windows\System\WltjsPl.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\pyGCzkv.exe
  C:\Windows\System\pyGCzkv.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\GgiiZRv.exe
  C:\Windows\System\GgiiZRv.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\UWZfXAp.exe
  C:\Windows\System\UWZfXAp.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\RcQuDRU.exe
  C:\Windows\System\RcQuDRU.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\XDGAAPl.exe
  C:\Windows\System\XDGAAPl.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\tJLjBLg.exe
  C:\Windows\System\tJLjBLg.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\MKQVUjx.exe
  C:\Windows\System\MKQVUjx.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\DgzzRUn.exe
  C:\Windows\System\DgzzRUn.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\dUTNPoz.exe
  C:\Windows\System\dUTNPoz.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\fLpfrSP.exe
  C:\Windows\System\fLpfrSP.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\jpcIkNM.exe
  C:\Windows\System\jpcIkNM.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\MTfnvyg.exe
  C:\Windows\System\MTfnvyg.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\oxwkBjK.exe
  C:\Windows\System\oxwkBjK.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\AsjQYDh.exe
  C:\Windows\System\AsjQYDh.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\XbHuRyd.exe
  C:\Windows\System\XbHuRyd.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\IvuLsTa.exe
  C:\Windows\System\IvuLsTa.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\lkYDJTP.exe
  C:\Windows\System\lkYDJTP.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\VkTZqMA.exe
  C:\Windows\System\VkTZqMA.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\zxanbdr.exe
  C:\Windows\System\zxanbdr.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\lDdGtxu.exe
  C:\Windows\System\lDdGtxu.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\wDouksD.exe
  C:\Windows\System\wDouksD.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\LWGeknG.exe
  C:\Windows\System\LWGeknG.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\MuqDqly.exe
  C:\Windows\System\MuqDqly.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\bnDSSTt.exe
  C:\Windows\System\bnDSSTt.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\JyliCHN.exe
  C:\Windows\System\JyliCHN.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\EKkzEgN.exe
  C:\Windows\System\EKkzEgN.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\yaqFvnI.exe
  C:\Windows\System\yaqFvnI.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\wQKRscz.exe
  C:\Windows\System\wQKRscz.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\WGRSPaM.exe
  C:\Windows\System\WGRSPaM.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\zOVlOCZ.exe
  C:\Windows\System\zOVlOCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\zDQBUSi.exe
  C:\Windows\System\zDQBUSi.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\keUESkD.exe
  C:\Windows\System\keUESkD.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\lQrnkFX.exe
  C:\Windows\System\lQrnkFX.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\OHjcXMA.exe
  C:\Windows\System\OHjcXMA.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\nlaEKxT.exe
  C:\Windows\System\nlaEKxT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\MebuOOG.exe
  C:\Windows\System\MebuOOG.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\SzEDRHv.exe
  C:\Windows\System\SzEDRHv.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\bHoTanO.exe
  C:\Windows\System\bHoTanO.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ePOQrwe.exe
  C:\Windows\System\ePOQrwe.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\GYWeJVI.exe
  C:\Windows\System\GYWeJVI.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\PIRYUdA.exe
  C:\Windows\System\PIRYUdA.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\hqUXgpL.exe
  C:\Windows\System\hqUXgpL.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\dwUHukU.exe
  C:\Windows\System\dwUHukU.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\ukWOoMJ.exe
  C:\Windows\System\ukWOoMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\dwxfBiG.exe
  C:\Windows\System\dwxfBiG.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\clTMuMU.exe
  C:\Windows\System\clTMuMU.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\upRnkiK.exe
  C:\Windows\System\upRnkiK.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\APICuCA.exe
  C:\Windows\System\APICuCA.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\UPrpfrS.exe
  C:\Windows\System\UPrpfrS.exe
  2⤵
  PID:4712
- C:\Windows\System\vqzqclc.exe
  C:\Windows\System\vqzqclc.exe
  2⤵
  PID:2052
- C:\Windows\System\soIKdDn.exe
  C:\Windows\System\soIKdDn.exe
  2⤵
  PID:2928
- C:\Windows\System\Kdrmtzl.exe
  C:\Windows\System\Kdrmtzl.exe
  2⤵
  PID:5124
- C:\Windows\System\fAKxWGy.exe
  C:\Windows\System\fAKxWGy.exe
  2⤵
  PID:5152
- C:\Windows\System\cyVrkoo.exe
  C:\Windows\System\cyVrkoo.exe
  2⤵
  PID:5184
- C:\Windows\System\OXvKbyK.exe
  C:\Windows\System\OXvKbyK.exe
  2⤵
  PID:5212
- C:\Windows\System\PbyDkJj.exe
  C:\Windows\System\PbyDkJj.exe
  2⤵
  PID:5244
- C:\Windows\System\HleoSId.exe
  C:\Windows\System\HleoSId.exe
  2⤵
  PID:5272
- C:\Windows\System\kOellRI.exe
  C:\Windows\System\kOellRI.exe
  2⤵
  PID:5304
- C:\Windows\System\ZMXEENV.exe
  C:\Windows\System\ZMXEENV.exe
  2⤵
  PID:5328
- C:\Windows\System\HiyNaAl.exe
  C:\Windows\System\HiyNaAl.exe
  2⤵
  PID:5356
- C:\Windows\System\CuoFnZP.exe
  C:\Windows\System\CuoFnZP.exe
  2⤵
  PID:5384
- C:\Windows\System\hUXeZFp.exe
  C:\Windows\System\hUXeZFp.exe
  2⤵
  PID:5416
- C:\Windows\System\UvmdPxz.exe
  C:\Windows\System\UvmdPxz.exe
  2⤵
  PID:5444
- C:\Windows\System\GVfJMUj.exe
  C:\Windows\System\GVfJMUj.exe
  2⤵
  PID:5472
- C:\Windows\System\uRGuhHu.exe
  C:\Windows\System\uRGuhHu.exe
  2⤵
  PID:5500
- C:\Windows\System\rYDmPNw.exe
  C:\Windows\System\rYDmPNw.exe
  2⤵
  PID:5532
- C:\Windows\System\fPECygc.exe
  C:\Windows\System\fPECygc.exe
  2⤵
  PID:5556
- C:\Windows\System\HGFxDbB.exe
  C:\Windows\System\HGFxDbB.exe
  2⤵
  PID:5584
- C:\Windows\System\mqbziAY.exe
  C:\Windows\System\mqbziAY.exe
  2⤵
  PID:5612
- C:\Windows\System\lIieJjr.exe
  C:\Windows\System\lIieJjr.exe
  2⤵
  PID:5640
- C:\Windows\System\oixJNQx.exe
  C:\Windows\System\oixJNQx.exe
  2⤵
  PID:5668
- C:\Windows\System\wqqIUIK.exe
  C:\Windows\System\wqqIUIK.exe
  2⤵
  PID:5696
- C:\Windows\System\nXaXoYU.exe
  C:\Windows\System\nXaXoYU.exe
  2⤵
  PID:5724
- C:\Windows\System\EHVonkX.exe
  C:\Windows\System\EHVonkX.exe
  2⤵
  PID:5752
- C:\Windows\System\LIJVAJh.exe
  C:\Windows\System\LIJVAJh.exe
  2⤵
  PID:5784
- C:\Windows\System\TXGSKFk.exe
  C:\Windows\System\TXGSKFk.exe
  2⤵
  PID:5812
- C:\Windows\System\cLoquQI.exe
  C:\Windows\System\cLoquQI.exe
  2⤵
  PID:5840
- C:\Windows\System\BiTMiWa.exe
  C:\Windows\System\BiTMiWa.exe
  2⤵
  PID:5868
- C:\Windows\System\ZbrIqHL.exe
  C:\Windows\System\ZbrIqHL.exe
  2⤵
  PID:5896
- C:\Windows\System\bpNEXpZ.exe
  C:\Windows\System\bpNEXpZ.exe
  2⤵
  PID:5924
- C:\Windows\System\LLDTUgl.exe
  C:\Windows\System\LLDTUgl.exe
  2⤵
  PID:5952
- C:\Windows\System\sGjXCko.exe
  C:\Windows\System\sGjXCko.exe
  2⤵
  PID:5980
- C:\Windows\System\PWXBfro.exe
  C:\Windows\System\PWXBfro.exe
  2⤵
  PID:6008
- C:\Windows\System\eykDxyB.exe
  C:\Windows\System\eykDxyB.exe
  2⤵
  PID:6036
- C:\Windows\System\ELrGscd.exe
  C:\Windows\System\ELrGscd.exe
  2⤵
  PID:6064
- C:\Windows\System\VBEEeYl.exe
  C:\Windows\System\VBEEeYl.exe
  2⤵
  PID:6092
- C:\Windows\System\iPLUKgG.exe
  C:\Windows\System\iPLUKgG.exe
  2⤵
  PID:6120
- C:\Windows\System\jHsUojI.exe
  C:\Windows\System\jHsUojI.exe
  2⤵
  PID:2444
- C:\Windows\System\ZZrEyVD.exe
  C:\Windows\System\ZZrEyVD.exe
  2⤵
  PID:3852
- C:\Windows\System\YakbrAh.exe
  C:\Windows\System\YakbrAh.exe
  2⤵
  PID:848
- C:\Windows\System\tvAZrXC.exe
  C:\Windows\System\tvAZrXC.exe
  2⤵
  PID:4420
- C:\Windows\System\RvVAOuO.exe
  C:\Windows\System\RvVAOuO.exe
  2⤵
  PID:4488
- C:\Windows\System\gtsaOQG.exe
  C:\Windows\System\gtsaOQG.exe
  2⤵
  PID:964
- C:\Windows\System\vMFlAgr.exe
  C:\Windows\System\vMFlAgr.exe
  2⤵
  PID:2836
- C:\Windows\System\qJGjTdv.exe
  C:\Windows\System\qJGjTdv.exe
  2⤵
  PID:5196
- C:\Windows\System\kxMdbVx.exe
  C:\Windows\System\kxMdbVx.exe
  2⤵
  PID:5260
- C:\Windows\System\fAbsnOn.exe
  C:\Windows\System\fAbsnOn.exe
  2⤵
  PID:5324
- C:\Windows\System\tJlNUGn.exe
  C:\Windows\System\tJlNUGn.exe
  2⤵
  PID:5396
- C:\Windows\System\dTuAYPs.exe
  C:\Windows\System\dTuAYPs.exe
  2⤵
  PID:5460
- C:\Windows\System\zRgSwYI.exe
  C:\Windows\System\zRgSwYI.exe
  2⤵
  PID:5524
- C:\Windows\System\FpvWIAq.exe
  C:\Windows\System\FpvWIAq.exe
  2⤵
  PID:5596
- C:\Windows\System\IXWXtnj.exe
  C:\Windows\System\IXWXtnj.exe
  2⤵
  PID:5656
- C:\Windows\System\BaFLUYB.exe
  C:\Windows\System\BaFLUYB.exe
  2⤵
  PID:5716
- C:\Windows\System\azRBkYR.exe
  C:\Windows\System\azRBkYR.exe
  2⤵
  PID:5776
- C:\Windows\System\sEthiVw.exe
  C:\Windows\System\sEthiVw.exe
  2⤵
  PID:5852
- C:\Windows\System\iCaPULa.exe
  C:\Windows\System\iCaPULa.exe
  2⤵
  PID:5912
- C:\Windows\System\YDEXHXk.exe
  C:\Windows\System\YDEXHXk.exe
  2⤵
  PID:5972
- C:\Windows\System\IivjHCz.exe
  C:\Windows\System\IivjHCz.exe
  2⤵
  PID:6052
- C:\Windows\System\bTlKxSm.exe
  C:\Windows\System\bTlKxSm.exe
  2⤵
  PID:6112
- C:\Windows\System\kZFLVeQ.exe
  C:\Windows\System\kZFLVeQ.exe
  2⤵
  PID:2152
- C:\Windows\System\JYMZzAt.exe
  C:\Windows\System\JYMZzAt.exe
  2⤵
  PID:536
- C:\Windows\System\vNpjagH.exe
  C:\Windows\System\vNpjagH.exe
  2⤵
  PID:5164
- C:\Windows\System\YamJJlp.exe
  C:\Windows\System\YamJJlp.exe
  2⤵
  PID:5312
- C:\Windows\System\IJwOHIi.exe
  C:\Windows\System\IJwOHIi.exe
  2⤵
  PID:5492
- C:\Windows\System\miWSsvx.exe
  C:\Windows\System\miWSsvx.exe
  2⤵
  PID:5632
- C:\Windows\System\lcVgrpd.exe
  C:\Windows\System\lcVgrpd.exe
  2⤵
  PID:5828
- C:\Windows\System\HDsUouA.exe
  C:\Windows\System\HDsUouA.exe
  2⤵
  PID:5964
- C:\Windows\System\LMGKkeo.exe
  C:\Windows\System\LMGKkeo.exe
  2⤵
  PID:6104
- C:\Windows\System\YVatLgl.exe
  C:\Windows\System\YVatLgl.exe
  2⤵
  PID:6152
- C:\Windows\System\FcxLaAI.exe
  C:\Windows\System\FcxLaAI.exe
  2⤵
  PID:6180
- C:\Windows\System\DWmhfqO.exe
  C:\Windows\System\DWmhfqO.exe
  2⤵
  PID:6208
- C:\Windows\System\AdIEZAE.exe
  C:\Windows\System\AdIEZAE.exe
  2⤵
  PID:6236
- C:\Windows\System\TdAPmFT.exe
  C:\Windows\System\TdAPmFT.exe
  2⤵
  PID:6264
- C:\Windows\System\QvTKcNb.exe
  C:\Windows\System\QvTKcNb.exe
  2⤵
  PID:6292
- C:\Windows\System\ZToGSkb.exe
  C:\Windows\System\ZToGSkb.exe
  2⤵
  PID:6320
- C:\Windows\System\okMgryy.exe
  C:\Windows\System\okMgryy.exe
  2⤵
  PID:6348
- C:\Windows\System\xCYPBpS.exe
  C:\Windows\System\xCYPBpS.exe
  2⤵
  PID:6376
- C:\Windows\System\jnzyqJF.exe
  C:\Windows\System\jnzyqJF.exe
  2⤵
  PID:6404
- C:\Windows\System\pZmXTdX.exe
  C:\Windows\System\pZmXTdX.exe
  2⤵
  PID:6432
- C:\Windows\System\BOWVCyU.exe
  C:\Windows\System\BOWVCyU.exe
  2⤵
  PID:6460
- C:\Windows\System\YPpzUoa.exe
  C:\Windows\System\YPpzUoa.exe
  2⤵
  PID:6488
- C:\Windows\System\zdSOPOs.exe
  C:\Windows\System\zdSOPOs.exe
  2⤵
  PID:6516
- C:\Windows\System\hgFsfaS.exe
  C:\Windows\System\hgFsfaS.exe
  2⤵
  PID:6544
- C:\Windows\System\kUEOmck.exe
  C:\Windows\System\kUEOmck.exe
  2⤵
  PID:6572
- C:\Windows\System\OXWfffW.exe
  C:\Windows\System\OXWfffW.exe
  2⤵
  PID:6600
- C:\Windows\System\rPGEfVJ.exe
  C:\Windows\System\rPGEfVJ.exe
  2⤵
  PID:6628
- C:\Windows\System\zdbKqzv.exe
  C:\Windows\System\zdbKqzv.exe
  2⤵
  PID:6656
- C:\Windows\System\mmeoEuu.exe
  C:\Windows\System\mmeoEuu.exe
  2⤵
  PID:6684
- C:\Windows\System\GRwtnMW.exe
  C:\Windows\System\GRwtnMW.exe
  2⤵
  PID:6712
- C:\Windows\System\QWVBFbY.exe
  C:\Windows\System\QWVBFbY.exe
  2⤵
  PID:6740
- C:\Windows\System\ocpblim.exe
  C:\Windows\System\ocpblim.exe
  2⤵
  PID:6768
- C:\Windows\System\gIuhSTt.exe
  C:\Windows\System\gIuhSTt.exe
  2⤵
  PID:6796
- C:\Windows\System\dSKvbHf.exe
  C:\Windows\System\dSKvbHf.exe
  2⤵
  PID:6832
- C:\Windows\System\GGtsNTs.exe
  C:\Windows\System\GGtsNTs.exe
  2⤵
  PID:6852
- C:\Windows\System\LFifdsC.exe
  C:\Windows\System\LFifdsC.exe
  2⤵
  PID:6880
- C:\Windows\System\QOdIwAZ.exe
  C:\Windows\System\QOdIwAZ.exe
  2⤵
  PID:6908
- C:\Windows\System\IpVKVdQ.exe
  C:\Windows\System\IpVKVdQ.exe
  2⤵
  PID:6936
- C:\Windows\System\qOqVJdp.exe
  C:\Windows\System\qOqVJdp.exe
  2⤵
  PID:6964
- C:\Windows\System\tFMALMi.exe
  C:\Windows\System\tFMALMi.exe
  2⤵
  PID:6992
- C:\Windows\System\NIxkhHS.exe
  C:\Windows\System\NIxkhHS.exe
  2⤵
  PID:7020
- C:\Windows\System\AHIeryc.exe
  C:\Windows\System\AHIeryc.exe
  2⤵
  PID:7048
- C:\Windows\System\ztwShwT.exe
  C:\Windows\System\ztwShwT.exe
  2⤵
  PID:7076
- C:\Windows\System\MgpjXar.exe
  C:\Windows\System\MgpjXar.exe
  2⤵
  PID:7104
- C:\Windows\System\ZvGGkXx.exe
  C:\Windows\System\ZvGGkXx.exe
  2⤵
  PID:7132
- C:\Windows\System\IPjfePz.exe
  C:\Windows\System\IPjfePz.exe
  2⤵
  PID:7160
- C:\Windows\System\RPDgEuk.exe
  C:\Windows\System\RPDgEuk.exe
  2⤵
  PID:3344
- C:\Windows\System\SHZldSU.exe
  C:\Windows\System\SHZldSU.exe
  2⤵
  PID:5432
- C:\Windows\System\lKUtOLq.exe
  C:\Windows\System\lKUtOLq.exe
  2⤵
  PID:5824
- C:\Windows\System\UEYtHmn.exe
  C:\Windows\System\UEYtHmn.exe
  2⤵
  PID:3616
- C:\Windows\System\BqWKSmP.exe
  C:\Windows\System\BqWKSmP.exe
  2⤵
  PID:6196
- C:\Windows\System\PMfqMlJ.exe
  C:\Windows\System\PMfqMlJ.exe
  2⤵
  PID:6252
- C:\Windows\System\lwZiPcV.exe
  C:\Windows\System\lwZiPcV.exe
  2⤵
  PID:6308
- C:\Windows\System\QvzTJdc.exe
  C:\Windows\System\QvzTJdc.exe
  2⤵
  PID:6368
- C:\Windows\System\MgBkKtI.exe
  C:\Windows\System\MgBkKtI.exe
  2⤵
  PID:6444
- C:\Windows\System\FeonjdI.exe
  C:\Windows\System\FeonjdI.exe
  2⤵
  PID:6504
- C:\Windows\System\gTkgYqZ.exe
  C:\Windows\System\gTkgYqZ.exe
  2⤵
  PID:6564
- C:\Windows\System\LgoTaOR.exe
  C:\Windows\System\LgoTaOR.exe
  2⤵
  PID:6620
- C:\Windows\System\fRuiZDO.exe
  C:\Windows\System\fRuiZDO.exe
  2⤵
  PID:6696
- C:\Windows\System\wFRmlGG.exe
  C:\Windows\System\wFRmlGG.exe
  2⤵
  PID:6756
- C:\Windows\System\QIGOnqV.exe
  C:\Windows\System\QIGOnqV.exe
  2⤵
  PID:6824
- C:\Windows\System\MfieYzh.exe
  C:\Windows\System\MfieYzh.exe
  2⤵
  PID:6892
- C:\Windows\System\IsYJnnz.exe
  C:\Windows\System\IsYJnnz.exe
  2⤵
  PID:6952
- C:\Windows\System\hNDBgFt.exe
  C:\Windows\System\hNDBgFt.exe
  2⤵
  PID:7008
- C:\Windows\System\aBDSRyN.exe
  C:\Windows\System\aBDSRyN.exe
  2⤵
  PID:7068
- C:\Windows\System\PoLdzZB.exe
  C:\Windows\System\PoLdzZB.exe
  2⤵
  PID:7124
- C:\Windows\System\bogaaTm.exe
  C:\Windows\System\bogaaTm.exe
  2⤵
  PID:5288
- C:\Windows\System\eNNGERK.exe
  C:\Windows\System\eNNGERK.exe
  2⤵
  PID:6028
- C:\Windows\System\vFnhtyQ.exe
  C:\Windows\System\vFnhtyQ.exe
  2⤵
  PID:6280
- C:\Windows\System\VadNlnn.exe
  C:\Windows\System\VadNlnn.exe
  2⤵
  PID:6420
- C:\Windows\System\CYWyClq.exe
  C:\Windows\System\CYWyClq.exe
  2⤵
  PID:6536
- C:\Windows\System\YYfWwnl.exe
  C:\Windows\System\YYfWwnl.exe
  2⤵
  PID:6668
- C:\Windows\System\RrbmduJ.exe
  C:\Windows\System\RrbmduJ.exe
  2⤵
  PID:6808
- C:\Windows\System\JYlFtdW.exe
  C:\Windows\System\JYlFtdW.exe
  2⤵
  PID:6980
- C:\Windows\System\LHBGWHR.exe
  C:\Windows\System\LHBGWHR.exe
  2⤵
  PID:7060
- C:\Windows\System\NfFzkyZ.exe
  C:\Windows\System\NfFzkyZ.exe
  2⤵
  PID:7188
- C:\Windows\System\FZFPQnU.exe
  C:\Windows\System\FZFPQnU.exe
  2⤵
  PID:7216
- C:\Windows\System\SjuViiY.exe
  C:\Windows\System\SjuViiY.exe
  2⤵
  PID:7244
- C:\Windows\System\HJPEnFU.exe
  C:\Windows\System\HJPEnFU.exe
  2⤵
  PID:7272
- C:\Windows\System\WmCWPoa.exe
  C:\Windows\System\WmCWPoa.exe
  2⤵
  PID:7300
- C:\Windows\System\FAeESgU.exe
  C:\Windows\System\FAeESgU.exe
  2⤵
  PID:7324
- C:\Windows\System\ksmxXwW.exe
  C:\Windows\System\ksmxXwW.exe
  2⤵
  PID:7356
- C:\Windows\System\YbYybOn.exe
  C:\Windows\System\YbYybOn.exe
  2⤵
  PID:7384
- C:\Windows\System\GEBSqVF.exe
  C:\Windows\System\GEBSqVF.exe
  2⤵
  PID:7412
- C:\Windows\System\LeywZaZ.exe
  C:\Windows\System\LeywZaZ.exe
  2⤵
  PID:7440
- C:\Windows\System\NEkcgEE.exe
  C:\Windows\System\NEkcgEE.exe
  2⤵
  PID:7468
- C:\Windows\System\eMXDjsR.exe
  C:\Windows\System\eMXDjsR.exe
  2⤵
  PID:7496
- C:\Windows\System\eTpdfLo.exe
  C:\Windows\System\eTpdfLo.exe
  2⤵
  PID:7524
- C:\Windows\System\RACUjAX.exe
  C:\Windows\System\RACUjAX.exe
  2⤵
  PID:7552
- C:\Windows\System\AzPNaUN.exe
  C:\Windows\System\AzPNaUN.exe
  2⤵
  PID:7580
- C:\Windows\System\CiDnUic.exe
  C:\Windows\System\CiDnUic.exe
  2⤵
  PID:7608
- C:\Windows\System\bIFadTY.exe
  C:\Windows\System\bIFadTY.exe
  2⤵
  PID:7636
- C:\Windows\System\MLZXRBY.exe
  C:\Windows\System\MLZXRBY.exe
  2⤵
  PID:7664
- C:\Windows\System\LEVENXO.exe
  C:\Windows\System\LEVENXO.exe
  2⤵
  PID:7692
- C:\Windows\System\smDWZnf.exe
  C:\Windows\System\smDWZnf.exe
  2⤵
  PID:7720
- C:\Windows\System\IyMTIIn.exe
  C:\Windows\System\IyMTIIn.exe
  2⤵
  PID:7748
- C:\Windows\System\maSCSKN.exe
  C:\Windows\System\maSCSKN.exe
  2⤵
  PID:7776
- C:\Windows\System\IehXCxc.exe
  C:\Windows\System\IehXCxc.exe
  2⤵
  PID:7804
- C:\Windows\System\yAmzhqH.exe
  C:\Windows\System\yAmzhqH.exe
  2⤵
  PID:7832
- C:\Windows\System\ToMxiav.exe
  C:\Windows\System\ToMxiav.exe
  2⤵
  PID:7860
- C:\Windows\System\goNwldR.exe
  C:\Windows\System\goNwldR.exe
  2⤵
  PID:7888
- C:\Windows\System\pFtrhng.exe
  C:\Windows\System\pFtrhng.exe
  2⤵
  PID:7916
- C:\Windows\System\BGPUFGv.exe
  C:\Windows\System\BGPUFGv.exe
  2⤵
  PID:7944
- C:\Windows\System\aFayoxv.exe
  C:\Windows\System\aFayoxv.exe
  2⤵
  PID:7972
- C:\Windows\System\cjCgtsc.exe
  C:\Windows\System\cjCgtsc.exe
  2⤵
  PID:8000
- C:\Windows\System\UUVZNyT.exe
  C:\Windows\System\UUVZNyT.exe
  2⤵
  PID:8028
- C:\Windows\System\ZucCttJ.exe
  C:\Windows\System\ZucCttJ.exe
  2⤵
  PID:8056
- C:\Windows\System\KziLdFA.exe
  C:\Windows\System\KziLdFA.exe
  2⤵
  PID:8084
- C:\Windows\System\emJgQKt.exe
  C:\Windows\System\emJgQKt.exe
  2⤵
  PID:8112
- C:\Windows\System\rpUBMUs.exe
  C:\Windows\System\rpUBMUs.exe
  2⤵
  PID:8140
- C:\Windows\System\beykbQr.exe
  C:\Windows\System\beykbQr.exe
  2⤵
  PID:8168
- C:\Windows\System\dTfTCnd.exe
  C:\Windows\System\dTfTCnd.exe
  2⤵
  PID:7120
- C:\Windows\System\tgAcmBP.exe
  C:\Windows\System\tgAcmBP.exe
  2⤵
  PID:6172
- C:\Windows\System\VHSULNI.exe
  C:\Windows\System\VHSULNI.exe
  2⤵
  PID:3320
- C:\Windows\System\bhWewTF.exe
  C:\Windows\System\bhWewTF.exe
  2⤵
  PID:6784
- C:\Windows\System\yzCVdeg.exe
  C:\Windows\System\yzCVdeg.exe
  2⤵
  PID:3724
- C:\Windows\System\SFWSozP.exe
  C:\Windows\System\SFWSozP.exe
  2⤵
  PID:7228
- C:\Windows\System\rRPOQLI.exe
  C:\Windows\System\rRPOQLI.exe
  2⤵
  PID:7284
- C:\Windows\System\oHayZEN.exe
  C:\Windows\System\oHayZEN.exe
  2⤵
  PID:7340
- C:\Windows\System\iMnjQDu.exe
  C:\Windows\System\iMnjQDu.exe
  2⤵
  PID:7396
- C:\Windows\System\KrmizmQ.exe
  C:\Windows\System\KrmizmQ.exe
  2⤵
  PID:3684
- C:\Windows\System\gXupViL.exe
  C:\Windows\System\gXupViL.exe
  2⤵
  PID:7484
- C:\Windows\System\cBQqRme.exe
  C:\Windows\System\cBQqRme.exe
  2⤵
  PID:7544
- C:\Windows\System\vasVDqO.exe
  C:\Windows\System\vasVDqO.exe
  2⤵
  PID:2292
- C:\Windows\System\KoctRoc.exe
  C:\Windows\System\KoctRoc.exe
  2⤵
  PID:7796
- C:\Windows\System\JlJBfWl.exe
  C:\Windows\System\JlJBfWl.exe
  2⤵
  PID:7880
- C:\Windows\System\zBcQrSA.exe
  C:\Windows\System\zBcQrSA.exe
  2⤵
  PID:7932
- C:\Windows\System\gMXaxVk.exe
  C:\Windows\System\gMXaxVk.exe
  2⤵
  PID:7964
- C:\Windows\System\fRoqFYo.exe
  C:\Windows\System\fRoqFYo.exe
  2⤵
  PID:8044
- C:\Windows\System\PcKyQXg.exe
  C:\Windows\System\PcKyQXg.exe
  2⤵
  PID:8076
- C:\Windows\System\QeoNDBd.exe
  C:\Windows\System\QeoNDBd.exe
  2⤵
  PID:8132
- C:\Windows\System\uLXZfMp.exe
  C:\Windows\System\uLXZfMp.exe
  2⤵
  PID:8184
- C:\Windows\System\xwMmtZS.exe
  C:\Windows\System\xwMmtZS.exe
  2⤵
  PID:5624
- C:\Windows\System\UcOApIR.exe
  C:\Windows\System\UcOApIR.exe
  2⤵
  PID:6612
- C:\Windows\System\CwMJRLJ.exe
  C:\Windows\System\CwMJRLJ.exe
  2⤵
  PID:7260
- C:\Windows\System\WnIcXvt.exe
  C:\Windows\System\WnIcXvt.exe
  2⤵
  PID:4772
- C:\Windows\System\xKojjFY.exe
  C:\Windows\System\xKojjFY.exe
  2⤵
  PID:4700
- C:\Windows\System\UTLzXEg.exe
  C:\Windows\System\UTLzXEg.exe
  2⤵
  PID:7480
- C:\Windows\System\LkPwRKB.exe
  C:\Windows\System\LkPwRKB.exe
  2⤵
  PID:684
- C:\Windows\System\TEwRGwV.exe
  C:\Windows\System\TEwRGwV.exe
  2⤵
  PID:7572
- C:\Windows\System\zXngpHP.exe
  C:\Windows\System\zXngpHP.exe
  2⤵
  PID:4344
- C:\Windows\System\asqnwqN.exe
  C:\Windows\System\asqnwqN.exe
  2⤵
  PID:2012
- C:\Windows\System\lPvceGp.exe
  C:\Windows\System\lPvceGp.exe
  2⤵
  PID:7908
- C:\Windows\System\nzBmfsp.exe
  C:\Windows\System\nzBmfsp.exe
  2⤵
  PID:7844
- C:\Windows\System\ZQbpOJn.exe
  C:\Windows\System\ZQbpOJn.exe
  2⤵
  PID:7960
- C:\Windows\System\GbMZhUY.exe
  C:\Windows\System\GbMZhUY.exe
  2⤵
  PID:8040
- C:\Windows\System\qCatGzV.exe
  C:\Windows\System\qCatGzV.exe
  2⤵
  PID:624
- C:\Windows\System\OYgClUh.exe
  C:\Windows\System\OYgClUh.exe
  2⤵
  PID:2652
- C:\Windows\System\idUFyDo.exe
  C:\Windows\System\idUFyDo.exe
  2⤵
  PID:4936
- C:\Windows\System\rzYseNG.exe
  C:\Windows\System\rzYseNG.exe
  2⤵
  PID:7872
- C:\Windows\System\XfnOpEH.exe
  C:\Windows\System\XfnOpEH.exe
  2⤵
  PID:7516
- C:\Windows\System\DtyNZtC.exe
  C:\Windows\System\DtyNZtC.exe
  2⤵
  PID:3188
- C:\Windows\System\tUcyhdg.exe
  C:\Windows\System\tUcyhdg.exe
  2⤵
  PID:1252
- C:\Windows\System\ogDthIq.exe
  C:\Windows\System\ogDthIq.exe
  2⤵
  PID:8204
- C:\Windows\System\VSqFHrC.exe
  C:\Windows\System\VSqFHrC.exe
  2⤵
  PID:8236
- C:\Windows\System\UwSDoaD.exe
  C:\Windows\System\UwSDoaD.exe
  2⤵
  PID:8416
- C:\Windows\System\rWtRwzj.exe
  C:\Windows\System\rWtRwzj.exe
  2⤵
  PID:8464
- C:\Windows\System\cGPeNXi.exe
  C:\Windows\System\cGPeNXi.exe
  2⤵
  PID:8484
- C:\Windows\System\bSxHGUT.exe
  C:\Windows\System\bSxHGUT.exe
  2⤵
  PID:8572
- C:\Windows\System\pPEOlmc.exe
  C:\Windows\System\pPEOlmc.exe
  2⤵
  PID:8624
- C:\Windows\System\acJJnXf.exe
  C:\Windows\System\acJJnXf.exe
  2⤵
  PID:8692
- C:\Windows\System\NOTUZEM.exe
  C:\Windows\System\NOTUZEM.exe
  2⤵
  PID:8756
- C:\Windows\System\XBtNUQa.exe
  C:\Windows\System\XBtNUQa.exe
  2⤵
  PID:8808
- C:\Windows\System\BTKEzJn.exe
  C:\Windows\System\BTKEzJn.exe
  2⤵
  PID:8908
- C:\Windows\System\iwDHxKE.exe
  C:\Windows\System\iwDHxKE.exe
  2⤵
  PID:8948
- C:\Windows\System\DEfjZlP.exe
  C:\Windows\System\DEfjZlP.exe
  2⤵
  PID:9000
- C:\Windows\System\GuwcfqP.exe
  C:\Windows\System\GuwcfqP.exe
  2⤵
  PID:9056
- C:\Windows\System\wnaHoao.exe
  C:\Windows\System\wnaHoao.exe
  2⤵
  PID:9120
- C:\Windows\System\pqiWZrM.exe
  C:\Windows\System\pqiWZrM.exe
  2⤵
  PID:9180
- C:\Windows\System\ChFdvLg.exe
  C:\Windows\System\ChFdvLg.exe
  2⤵
  PID:7512
- C:\Windows\System\SQvqvGg.exe
  C:\Windows\System\SQvqvGg.exe
  2⤵
  PID:4624
- C:\Windows\System\HavhIrn.exe
  C:\Windows\System\HavhIrn.exe
  2⤵
  PID:8368
- C:\Windows\System\EEGMnFI.exe
  C:\Windows\System\EEGMnFI.exe
  2⤵
  PID:8400
- C:\Windows\System\ntfGcgl.exe
  C:\Windows\System\ntfGcgl.exe
  2⤵
  PID:8508
- C:\Windows\System\BaLyPFj.exe
  C:\Windows\System\BaLyPFj.exe
  2⤵
  PID:8532
- C:\Windows\System\siTvZda.exe
  C:\Windows\System\siTvZda.exe
  2⤵
  PID:8632
- C:\Windows\System\YimfuVF.exe
  C:\Windows\System\YimfuVF.exe
  2⤵
  PID:8764
- C:\Windows\System\AGHhNnG.exe
  C:\Windows\System\AGHhNnG.exe
  2⤵
  PID:8804
- C:\Windows\System\VCIxNVL.exe
  C:\Windows\System\VCIxNVL.exe
  2⤵
  PID:8840
- C:\Windows\System\nDxprNl.exe
  C:\Windows\System\nDxprNl.exe
  2⤵
  PID:8924
- C:\Windows\System\jBFJJig.exe
  C:\Windows\System\jBFJJig.exe
  2⤵
  PID:8980
- C:\Windows\System\HqATudH.exe
  C:\Windows\System\HqATudH.exe
  2⤵
  PID:8220
- C:\Windows\System\biWxtwk.exe
  C:\Windows\System\biWxtwk.exe
  2⤵
  PID:9072
- C:\Windows\System\fdjXnMT.exe
  C:\Windows\System\fdjXnMT.exe
  2⤵
  PID:9104
- C:\Windows\System\QropfxS.exe
  C:\Windows\System\QropfxS.exe
  2⤵
  PID:9148
- C:\Windows\System\faFLFJC.exe
  C:\Windows\System\faFLFJC.exe
  2⤵
  PID:7956
- C:\Windows\System\unQucde.exe
  C:\Windows\System\unQucde.exe
  2⤵
  PID:2116
- C:\Windows\System\IkXUnLH.exe
  C:\Windows\System\IkXUnLH.exe
  2⤵
  PID:4084
- C:\Windows\System\iiXLFSS.exe
  C:\Windows\System\iiXLFSS.exe
  2⤵
  PID:8308
- C:\Windows\System\rSinkWg.exe
  C:\Windows\System\rSinkWg.exe
  2⤵
  PID:8408
- C:\Windows\System\BfToMDz.exe
  C:\Windows\System\BfToMDz.exe
  2⤵
  PID:8448
- C:\Windows\System\MKwfeBb.exe
  C:\Windows\System\MKwfeBb.exe
  2⤵
  PID:8552
- C:\Windows\System\jGMsiEF.exe
  C:\Windows\System\jGMsiEF.exe
  2⤵
  PID:8660
- C:\Windows\System\SocnpAc.exe
  C:\Windows\System\SocnpAc.exe
  2⤵
  PID:8740
- C:\Windows\System\VieSAXz.exe
  C:\Windows\System\VieSAXz.exe
  2⤵
  PID:8772
- C:\Windows\System\lCAMDth.exe
  C:\Windows\System\lCAMDth.exe
  2⤵
  PID:8796
- C:\Windows\System\JVezwwz.exe
  C:\Windows\System\JVezwwz.exe
  2⤵
  PID:8904
- C:\Windows\System\xYsJAYK.exe
  C:\Windows\System\xYsJAYK.exe
  2⤵
  PID:4088
- C:\Windows\System\sZJqsPF.exe
  C:\Windows\System\sZJqsPF.exe
  2⤵
  PID:9044
- C:\Windows\System\tRbccIK.exe
  C:\Windows\System\tRbccIK.exe
  2⤵
  PID:9140
- C:\Windows\System\MZtBqhp.exe
  C:\Windows\System\MZtBqhp.exe
  2⤵
  PID:1268
- C:\Windows\System\WONatFI.exe
  C:\Windows\System\WONatFI.exe
  2⤵
  PID:8360
- C:\Windows\System\jwmVGxV.exe
  C:\Windows\System\jwmVGxV.exe
  2⤵
  PID:8216
- C:\Windows\System\mZvVphy.exe
  C:\Windows\System\mZvVphy.exe
  2⤵
  PID:8340
- C:\Windows\System\dYyNtOG.exe
  C:\Windows\System\dYyNtOG.exe
  2⤵
  PID:8388
- C:\Windows\System\PDjHRjl.exe
  C:\Windows\System\PDjHRjl.exe
  2⤵
  PID:8616
- C:\Windows\System\GBTAqJd.exe
  C:\Windows\System\GBTAqJd.exe
  2⤵
  PID:8644
- C:\Windows\System\hjpMqoL.exe
  C:\Windows\System\hjpMqoL.exe
  2⤵
  PID:8732
- C:\Windows\System\jpjmWQY.exe
  C:\Windows\System\jpjmWQY.exe
  2⤵
  PID:8792
- C:\Windows\System\bfZWRSD.exe
  C:\Windows\System\bfZWRSD.exe
  2⤵
  PID:8936
- C:\Windows\System\keTQYRe.exe
  C:\Windows\System\keTQYRe.exe
  2⤵
  PID:9092
- C:\Windows\System\hATiBUb.exe
  C:\Windows\System\hATiBUb.exe
  2⤵
  PID:1248
- C:\Windows\System\eSoilQH.exe
  C:\Windows\System\eSoilQH.exe
  2⤵
  PID:8500
- C:\Windows\System\BBCvEpj.exe
  C:\Windows\System\BBCvEpj.exe
  2⤵
  PID:4156
- C:\Windows\System\LeXayKL.exe
  C:\Windows\System\LeXayKL.exe
  2⤵
  PID:8492
- C:\Windows\System\EBKdqWP.exe
  C:\Windows\System\EBKdqWP.exe
  2⤵
  PID:8848
- C:\Windows\System\rgpWPJW.exe
  C:\Windows\System\rgpWPJW.exe
  2⤵
  PID:9100
- C:\Windows\System\SlPGgBg.exe
  C:\Windows\System\SlPGgBg.exe
  2⤵
  PID:8528
- C:\Windows\System\BBPixII.exe
  C:\Windows\System\BBPixII.exe
  2⤵
  PID:5088
- C:\Windows\System\hvjVcPT.exe
  C:\Windows\System\hvjVcPT.exe
  2⤵
  PID:8412
- C:\Windows\System\CLgelSt.exe
  C:\Windows\System\CLgelSt.exe
  2⤵
  PID:5064
- C:\Windows\System\lFvbwHF.exe
  C:\Windows\System\lFvbwHF.exe
  2⤵
  PID:9240
- C:\Windows\System\sKPSXsh.exe
  C:\Windows\System\sKPSXsh.exe
  2⤵
  PID:9272
- C:\Windows\System\zGSxwks.exe
  C:\Windows\System\zGSxwks.exe
  2⤵
  PID:9288
- C:\Windows\System\BaPJwKG.exe
  C:\Windows\System\BaPJwKG.exe
  2⤵
  PID:9316
- C:\Windows\System\ReRjwKI.exe
  C:\Windows\System\ReRjwKI.exe
  2⤵
  PID:9344
- C:\Windows\System\RQSiyyU.exe
  C:\Windows\System\RQSiyyU.exe
  2⤵
  PID:9372
- C:\Windows\System\tGHAJnA.exe
  C:\Windows\System\tGHAJnA.exe
  2⤵
  PID:9412
- C:\Windows\System\DqemrCH.exe
  C:\Windows\System\DqemrCH.exe
  2⤵
  PID:9436
- C:\Windows\System\BdmmXcC.exe
  C:\Windows\System\BdmmXcC.exe
  2⤵
  PID:9468
- C:\Windows\System\iHJNxHc.exe
  C:\Windows\System\iHJNxHc.exe
  2⤵
  PID:9496
- C:\Windows\System\fIjXGuc.exe
  C:\Windows\System\fIjXGuc.exe
  2⤵
  PID:9516
- C:\Windows\System\ZJbNBNG.exe
  C:\Windows\System\ZJbNBNG.exe
  2⤵
  PID:9548
- C:\Windows\System\HltCKDP.exe
  C:\Windows\System\HltCKDP.exe
  2⤵
  PID:9584
- C:\Windows\System\xoDRYIF.exe
  C:\Windows\System\xoDRYIF.exe
  2⤵
  PID:9600
- C:\Windows\System\WRUTbKX.exe
  C:\Windows\System\WRUTbKX.exe
  2⤵
  PID:9644
- C:\Windows\System\XkcJQRb.exe
  C:\Windows\System\XkcJQRb.exe
  2⤵
  PID:9672
- C:\Windows\System\YnTuWdp.exe
  C:\Windows\System\YnTuWdp.exe
  2⤵
  PID:9700
- C:\Windows\System\tuVZDri.exe
  C:\Windows\System\tuVZDri.exe
  2⤵
  PID:9728
- C:\Windows\System\wWoovva.exe
  C:\Windows\System\wWoovva.exe
  2⤵
  PID:9744
- C:\Windows\System\qsJHCGh.exe
  C:\Windows\System\qsJHCGh.exe
  2⤵
  PID:9776
- C:\Windows\System\eRUyGaK.exe
  C:\Windows\System\eRUyGaK.exe
  2⤵
  PID:9804
- C:\Windows\System\XCzPICc.exe
  C:\Windows\System\XCzPICc.exe
  2⤵
  PID:9848
- C:\Windows\System\YXDWVfX.exe
  C:\Windows\System\YXDWVfX.exe
  2⤵
  PID:9876
- C:\Windows\System\NPRbnYl.exe
  C:\Windows\System\NPRbnYl.exe
  2⤵
  PID:9896
- C:\Windows\System\EFWUfcu.exe
  C:\Windows\System\EFWUfcu.exe
  2⤵
  PID:9936
- C:\Windows\System\IBJVhXN.exe
  C:\Windows\System\IBJVhXN.exe
  2⤵
  PID:9952
- C:\Windows\System\BYxixuB.exe
  C:\Windows\System\BYxixuB.exe
  2⤵
  PID:9992
- C:\Windows\System\DnRlUms.exe
  C:\Windows\System\DnRlUms.exe
  2⤵
  PID:10008
- C:\Windows\System\hJSfpNU.exe
  C:\Windows\System\hJSfpNU.exe
  2⤵
  PID:10028
- C:\Windows\System\UfmByYS.exe
  C:\Windows\System\UfmByYS.exe
  2⤵
  PID:10080
- C:\Windows\System\cFKZnXu.exe
  C:\Windows\System\cFKZnXu.exe
  2⤵
  PID:10108
- C:\Windows\System\xSAUUVI.exe
  C:\Windows\System\xSAUUVI.exe
  2⤵
  PID:10132
- C:\Windows\System\AMJrVKH.exe
  C:\Windows\System\AMJrVKH.exe
  2⤵
  PID:10164
- C:\Windows\System\Otvhqmw.exe
  C:\Windows\System\Otvhqmw.exe
  2⤵
  PID:10192
- C:\Windows\System\QinXIFF.exe
  C:\Windows\System\QinXIFF.exe
  2⤵
  PID:10220
- C:\Windows\System\tylaYir.exe
  C:\Windows\System\tylaYir.exe
  2⤵
  PID:9236
- C:\Windows\System\bcCCvnN.exe
  C:\Windows\System\bcCCvnN.exe
  2⤵
  PID:9308
- C:\Windows\System\LkFDzyV.exe
  C:\Windows\System\LkFDzyV.exe
  2⤵
  PID:9360
- C:\Windows\System\rVqxjQv.exe
  C:\Windows\System\rVqxjQv.exe
  2⤵
  PID:9408
- C:\Windows\System\Fpmrtio.exe
  C:\Windows\System\Fpmrtio.exe
  2⤵
  PID:9484
- C:\Windows\System\VuARxlL.exe
  C:\Windows\System\VuARxlL.exe
  2⤵
  PID:9576
- C:\Windows\System\FVRExen.exe
  C:\Windows\System\FVRExen.exe
  2⤵
  PID:9624
- C:\Windows\System\UEXEUVC.exe
  C:\Windows\System\UEXEUVC.exe
  2⤵
  PID:9684
- C:\Windows\System\xwhxBbf.exe
  C:\Windows\System\xwhxBbf.exe
  2⤵
  PID:9736
- C:\Windows\System\qcDZsct.exe
  C:\Windows\System\qcDZsct.exe
  2⤵
  PID:9844
- C:\Windows\System\EBLeelN.exe
  C:\Windows\System\EBLeelN.exe
  2⤵
  PID:9920
- C:\Windows\System\hKeCEDK.exe
  C:\Windows\System\hKeCEDK.exe
  2⤵
  PID:9968
- C:\Windows\System\MzswsSx.exe
  C:\Windows\System\MzswsSx.exe
  2⤵
  PID:10024
- C:\Windows\System\YIKjpMp.exe
  C:\Windows\System\YIKjpMp.exe
  2⤵
  PID:10100
- C:\Windows\System\dDuijvq.exe
  C:\Windows\System\dDuijvq.exe
  2⤵
  PID:10160
- C:\Windows\System\XQoSccW.exe
  C:\Windows\System\XQoSccW.exe
  2⤵
  PID:432
- C:\Windows\System\MJjFvtT.exe
  C:\Windows\System\MJjFvtT.exe
  2⤵
  PID:9284
- C:\Windows\System\CyuQVzA.exe
  C:\Windows\System\CyuQVzA.exe
  2⤵
  PID:9384
- C:\Windows\System\bRlxpmr.exe
  C:\Windows\System\bRlxpmr.exe
  2⤵
  PID:9596
- C:\Windows\System\TIhUWaO.exe
  C:\Windows\System\TIhUWaO.exe
  2⤵
  PID:9660
- C:\Windows\System\KAharAm.exe
  C:\Windows\System\KAharAm.exe
  2⤵
  PID:9752
- C:\Windows\System\sNxhcmQ.exe
  C:\Windows\System\sNxhcmQ.exe
  2⤵
  PID:10004
- C:\Windows\System\SiabVuJ.exe
  C:\Windows\System\SiabVuJ.exe
  2⤵
  PID:3560
- C:\Windows\System\afeXSoY.exe
  C:\Windows\System\afeXSoY.exe
  2⤵
  PID:9328
- C:\Windows\System\scSfXzx.exe
  C:\Windows\System\scSfXzx.exe
  2⤵
  PID:9716
- C:\Windows\System\fSCQltw.exe
  C:\Windows\System\fSCQltw.exe
  2⤵
  PID:9944
- C:\Windows\System\iidCOWN.exe
  C:\Windows\System\iidCOWN.exe
  2⤵
  PID:9488
- C:\Windows\System\MqzUVOY.exe
  C:\Windows\System\MqzUVOY.exe
  2⤵
  PID:10236
- C:\Windows\System\qSPbCEK.exe
  C:\Windows\System\qSPbCEK.exe
  2⤵
  PID:10252
- C:\Windows\System\UboDung.exe
  C:\Windows\System\UboDung.exe
  2⤵
  PID:10276
- C:\Windows\System\rGUaJeI.exe
  C:\Windows\System\rGUaJeI.exe
  2⤵
  PID:10316
- C:\Windows\System\mnSiGSQ.exe
  C:\Windows\System\mnSiGSQ.exe
  2⤵
  PID:10348
- C:\Windows\System\zltKioo.exe
  C:\Windows\System\zltKioo.exe
  2⤵
  PID:10364
- C:\Windows\System\gTPaMOL.exe
  C:\Windows\System\gTPaMOL.exe
  2⤵
  PID:10404
- C:\Windows\System\nNwyCJu.exe
  C:\Windows\System\nNwyCJu.exe
  2⤵
  PID:10424
- C:\Windows\System\wtUGgra.exe
  C:\Windows\System\wtUGgra.exe
  2⤵
  PID:10460
- C:\Windows\System\eqGzgni.exe
  C:\Windows\System\eqGzgni.exe
  2⤵
  PID:10492
- C:\Windows\System\wBDcTGR.exe
  C:\Windows\System\wBDcTGR.exe
  2⤵
  PID:10516
- C:\Windows\System\InePgzL.exe
  C:\Windows\System\InePgzL.exe
  2⤵
  PID:10536
- C:\Windows\System\CajKsrI.exe
  C:\Windows\System\CajKsrI.exe
  2⤵
  PID:10576
- C:\Windows\System\sEeNngx.exe
  C:\Windows\System\sEeNngx.exe
  2⤵
  PID:10604
- C:\Windows\System\PvAAVdv.exe
  C:\Windows\System\PvAAVdv.exe
  2⤵
  PID:10632
- C:\Windows\System\MfNfDVP.exe
  C:\Windows\System\MfNfDVP.exe
  2⤵
  PID:10660
- C:\Windows\System\ndAvyjl.exe
  C:\Windows\System\ndAvyjl.exe
  2⤵
  PID:10684
- C:\Windows\System\aVBcgRV.exe
  C:\Windows\System\aVBcgRV.exe
  2⤵
  PID:10716
- C:\Windows\System\aTlRrul.exe
  C:\Windows\System\aTlRrul.exe
  2⤵
  PID:10744
- C:\Windows\System\nqehQQh.exe
  C:\Windows\System\nqehQQh.exe
  2⤵
  PID:10772
- C:\Windows\System\tQXLkSu.exe
  C:\Windows\System\tQXLkSu.exe
  2⤵
  PID:10788
- C:\Windows\System\yzrtnaW.exe
  C:\Windows\System\yzrtnaW.exe
  2⤵
  PID:10816
- C:\Windows\System\OIZVZwM.exe
  C:\Windows\System\OIZVZwM.exe
  2⤵
  PID:10848
- C:\Windows\System\TnQkeMs.exe
  C:\Windows\System\TnQkeMs.exe
  2⤵
  PID:10884
- C:\Windows\System\OoVJsaL.exe
  C:\Windows\System\OoVJsaL.exe
  2⤵
  PID:10912
- C:\Windows\System\sqjldXK.exe
  C:\Windows\System\sqjldXK.exe
  2⤵
  PID:10928
- C:\Windows\System\RpjoqTV.exe
  C:\Windows\System\RpjoqTV.exe
  2⤵
  PID:10968
- C:\Windows\System\UcxrqIL.exe
  C:\Windows\System\UcxrqIL.exe
  2⤵
  PID:10996
- C:\Windows\System\MVREaox.exe
  C:\Windows\System\MVREaox.exe
  2⤵
  PID:11024
- C:\Windows\System\WrqXaVt.exe
  C:\Windows\System\WrqXaVt.exe
  2⤵
  PID:11040
- C:\Windows\System\hEHPRkO.exe
  C:\Windows\System\hEHPRkO.exe
  2⤵
  PID:11080
- C:\Windows\System\TxBqSMN.exe
  C:\Windows\System\TxBqSMN.exe
  2⤵
  PID:11108
- C:\Windows\System\ayUrshS.exe
  C:\Windows\System\ayUrshS.exe
  2⤵
  PID:11136
- C:\Windows\System\OMGIuoF.exe
  C:\Windows\System\OMGIuoF.exe
  2⤵
  PID:11160
- C:\Windows\System\HpNnkGO.exe
  C:\Windows\System\HpNnkGO.exe
  2⤵
  PID:11188
- C:\Windows\System\BMWQIHq.exe
  C:\Windows\System\BMWQIHq.exe
  2⤵
  PID:11208
- C:\Windows\System\lsgGGNj.exe
  C:\Windows\System\lsgGGNj.exe
  2⤵
  PID:11240
- C:\Windows\System\eKtaPPT.exe
  C:\Windows\System\eKtaPPT.exe
  2⤵
  PID:10260
- C:\Windows\System\btYStUd.exe
  C:\Windows\System\btYStUd.exe
  2⤵
  PID:10344
- C:\Windows\System\hMXjccO.exe
  C:\Windows\System\hMXjccO.exe
  2⤵
  PID:10396
- C:\Windows\System\ghPHctW.exe
  C:\Windows\System\ghPHctW.exe
  2⤵
  PID:10444
- C:\Windows\System\GefOudZ.exe
  C:\Windows\System\GefOudZ.exe
  2⤵
  PID:10508
- C:\Windows\System\vyudNRQ.exe
  C:\Windows\System\vyudNRQ.exe
  2⤵
  PID:10572
- C:\Windows\System\lxCfSWj.exe
  C:\Windows\System\lxCfSWj.exe
  2⤵
  PID:10672
- C:\Windows\System\fVVSyGd.exe
  C:\Windows\System\fVVSyGd.exe
  2⤵
  PID:10736
- C:\Windows\System\pQEKoAf.exe
  C:\Windows\System\pQEKoAf.exe
  2⤵
  PID:10800
- C:\Windows\System\CYAeIdZ.exe
  C:\Windows\System\CYAeIdZ.exe
  2⤵
  PID:10876
- C:\Windows\System\xNKBdwY.exe
  C:\Windows\System\xNKBdwY.exe
  2⤵
  PID:10980
- C:\Windows\System\CsAZkAW.exe
  C:\Windows\System\CsAZkAW.exe
  2⤵
  PID:11012
- C:\Windows\System\EgLPRNX.exe
  C:\Windows\System\EgLPRNX.exe
  2⤵
  PID:11076
- C:\Windows\System\igbhwRp.exe
  C:\Windows\System\igbhwRp.exe
  2⤵
  PID:11120
- C:\Windows\System\DlxoUqw.exe
  C:\Windows\System\DlxoUqw.exe
  2⤵
  PID:11144
- C:\Windows\System\GYgzwkH.exe
  C:\Windows\System\GYgzwkH.exe
  2⤵
  PID:9820
- C:\Windows\System\gOjpwgj.exe
  C:\Windows\System\gOjpwgj.exe
  2⤵
  PID:10384
- C:\Windows\System\zpiYVJn.exe
  C:\Windows\System\zpiYVJn.exe
  2⤵
  PID:10528
- C:\Windows\System\nNEOAof.exe
  C:\Windows\System\nNEOAof.exe
  2⤵
  PID:10700
- C:\Windows\System\XtvTnTr.exe
  C:\Windows\System\XtvTnTr.exe
  2⤵
  PID:10840
- C:\Windows\System\HZgxcpV.exe
  C:\Windows\System\HZgxcpV.exe
  2⤵
  PID:10896
- C:\Windows\System\bmqjmiw.exe
  C:\Windows\System\bmqjmiw.exe
  2⤵
  PID:11152
- C:\Windows\System\vNtpcwk.exe
  C:\Windows\System\vNtpcwk.exe
  2⤵
  PID:10376
- C:\Windows\System\lnhUEGw.exe
  C:\Windows\System\lnhUEGw.exe
  2⤵
  PID:10764
- C:\Windows\System\YsPhWzH.exe
  C:\Windows\System\YsPhWzH.exe
  2⤵
  PID:11032
- C:\Windows\System\HrlniWy.exe
  C:\Windows\System\HrlniWy.exe
  2⤵
  PID:10704
- C:\Windows\System\IlJppjm.exe
  C:\Windows\System\IlJppjm.exe
  2⤵
  PID:10656
- C:\Windows\System\aOXFuDM.exe
  C:\Windows\System\aOXFuDM.exe
  2⤵
  PID:11288
- C:\Windows\System\TQhSlbv.exe
  C:\Windows\System\TQhSlbv.exe
  2⤵
  PID:11304
- C:\Windows\System\zjDPqjf.exe
  C:\Windows\System\zjDPqjf.exe
  2⤵
  PID:11332
- C:\Windows\System\GmdfbqN.exe
  C:\Windows\System\GmdfbqN.exe
  2⤵
  PID:11372
- C:\Windows\System\FiPrHAg.exe
  C:\Windows\System\FiPrHAg.exe
  2⤵
  PID:11400
- C:\Windows\System\HzjhRjW.exe
  C:\Windows\System\HzjhRjW.exe
  2⤵
  PID:11416
- C:\Windows\System\ljIvRtn.exe
  C:\Windows\System\ljIvRtn.exe
  2⤵
  PID:11456
- C:\Windows\System\yUQudUv.exe
  C:\Windows\System\yUQudUv.exe
  2⤵
  PID:11492
- C:\Windows\System\acRMkNz.exe
  C:\Windows\System\acRMkNz.exe
  2⤵
  PID:11516
- C:\Windows\System\NgYgLUt.exe
  C:\Windows\System\NgYgLUt.exe
  2⤵
  PID:11572
- C:\Windows\System\ASVlbJT.exe
  C:\Windows\System\ASVlbJT.exe
  2⤵
  PID:11608
- C:\Windows\System\pYKCrMj.exe
  C:\Windows\System\pYKCrMj.exe
  2⤵
  PID:11628
- C:\Windows\System\KnTAPsz.exe
  C:\Windows\System\KnTAPsz.exe
  2⤵
  PID:11668
- C:\Windows\System\KfeaBCp.exe
  C:\Windows\System\KfeaBCp.exe
  2⤵
  PID:11692
- C:\Windows\System\ioTIRiJ.exe
  C:\Windows\System\ioTIRiJ.exe
  2⤵
  PID:11712
- C:\Windows\System\fgAsBSU.exe
  C:\Windows\System\fgAsBSU.exe
  2⤵
  PID:11752
- C:\Windows\System\Ikckfbt.exe
  C:\Windows\System\Ikckfbt.exe
  2⤵
  PID:11780
- C:\Windows\System\eFqOHsD.exe
  C:\Windows\System\eFqOHsD.exe
  2⤵
  PID:11808
- C:\Windows\System\cmkbDDB.exe
  C:\Windows\System\cmkbDDB.exe
  2⤵
  PID:11836
- C:\Windows\System\kPvbqar.exe
  C:\Windows\System\kPvbqar.exe
  2⤵
  PID:11864
- C:\Windows\System\WRQJfcu.exe
  C:\Windows\System\WRQJfcu.exe
  2⤵
  PID:11896
- C:\Windows\System\pKEftxl.exe
  C:\Windows\System\pKEftxl.exe
  2⤵
  PID:11924
- C:\Windows\System\JcZFDng.exe
  C:\Windows\System\JcZFDng.exe
  2⤵
  PID:11952
- C:\Windows\System\jTeAruU.exe
  C:\Windows\System\jTeAruU.exe
  2⤵
  PID:11980
- C:\Windows\System\gcDAYkZ.exe
  C:\Windows\System\gcDAYkZ.exe
  2⤵
  PID:12008
- C:\Windows\System\LszJlWK.exe
  C:\Windows\System\LszJlWK.exe
  2⤵
  PID:12036
- C:\Windows\System\PglGMlD.exe
  C:\Windows\System\PglGMlD.exe
  2⤵
  PID:12056
- C:\Windows\System\TokqrMr.exe
  C:\Windows\System\TokqrMr.exe
  2⤵
  PID:12080
- C:\Windows\System\LkGJGaS.exe
  C:\Windows\System\LkGJGaS.exe
  2⤵
  PID:12108
- C:\Windows\System\bDWNcCT.exe
  C:\Windows\System\bDWNcCT.exe
  2⤵
  PID:12136
- C:\Windows\System\gLgBikz.exe
  C:\Windows\System\gLgBikz.exe
  2⤵
  PID:12176
- C:\Windows\System\btqfQnI.exe
  C:\Windows\System\btqfQnI.exe
  2⤵
  PID:12208
- C:\Windows\System\bAKCGlR.exe
  C:\Windows\System\bAKCGlR.exe
  2⤵
  PID:12236
- C:\Windows\System\fRybmKS.exe
  C:\Windows\System\fRybmKS.exe
  2⤵
  PID:12268
- C:\Windows\System\eAjqlCR.exe
  C:\Windows\System\eAjqlCR.exe
  2⤵
  PID:11284
- C:\Windows\System\nqgjuqW.exe
  C:\Windows\System\nqgjuqW.exe
  2⤵
  PID:11344
- C:\Windows\System\KQiIuKo.exe
  C:\Windows\System\KQiIuKo.exe
  2⤵
  PID:11412
- C:\Windows\System\qTEHxOJ.exe
  C:\Windows\System\qTEHxOJ.exe
  2⤵
  PID:11508
- C:\Windows\System\OtlbQzB.exe
  C:\Windows\System\OtlbQzB.exe
  2⤵
  PID:11536
- C:\Windows\System\sqVORDn.exe
  C:\Windows\System\sqVORDn.exe
  2⤵
  PID:11640
- C:\Windows\System\XwfaaQz.exe
  C:\Windows\System\XwfaaQz.exe
  2⤵
  PID:11724
- C:\Windows\System\fhqcwYp.exe
  C:\Windows\System\fhqcwYp.exe
  2⤵
  PID:11800
- C:\Windows\System\RwdfMyQ.exe
  C:\Windows\System\RwdfMyQ.exe
  2⤵
  PID:11884
- C:\Windows\System\vOpnXRg.exe
  C:\Windows\System\vOpnXRg.exe
  2⤵
  PID:11944
- C:\Windows\System\MxFsTvN.exe
  C:\Windows\System\MxFsTvN.exe
  2⤵
  PID:12020
- C:\Windows\System\cfvbsqo.exe
  C:\Windows\System\cfvbsqo.exe
  2⤵
  PID:12072
- C:\Windows\System\PPJUJcp.exe
  C:\Windows\System\PPJUJcp.exe
  2⤵
  PID:12228
- C:\Windows\System\LbWYPwH.exe
  C:\Windows\System\LbWYPwH.exe
  2⤵
  PID:8016
- C:\Windows\System\NhSwpWh.exe
  C:\Windows\System\NhSwpWh.exe
  2⤵
  PID:11392
- C:\Windows\System\IfjZhhl.exe
  C:\Windows\System\IfjZhhl.exe
  2⤵
  PID:11532
- C:\Windows\System\AZZvJWI.exe
  C:\Windows\System\AZZvJWI.exe
  2⤵
  PID:11748
- C:\Windows\System\vTjUyUB.exe
  C:\Windows\System\vTjUyUB.exe
  2⤵
  PID:12068
- C:\Windows\System\qRhjLNR.exe
  C:\Windows\System\qRhjLNR.exe
  2⤵
  PID:11504
- C:\Windows\System\SuHCelh.exe
  C:\Windows\System\SuHCelh.exe
  2⤵
  PID:11396
- C:\Windows\System\whCYzWv.exe
  C:\Windows\System\whCYzWv.exe
  2⤵
  PID:12300
- C:\Windows\System\TcpiyeL.exe
  C:\Windows\System\TcpiyeL.exe
  2⤵
  PID:12320
- C:\Windows\System\hxQQRCh.exe
  C:\Windows\System\hxQQRCh.exe
  2⤵
  PID:12352
- C:\Windows\System\gQEroLH.exe
  C:\Windows\System\gQEroLH.exe
  2⤵
  PID:12380
- C:\Windows\System\wKtrsTo.exe
  C:\Windows\System\wKtrsTo.exe
  2⤵
  PID:12420
- C:\Windows\System\PlIgQAs.exe
  C:\Windows\System\PlIgQAs.exe
  2⤵
  PID:12448
- C:\Windows\System\BFNxlQx.exe
  C:\Windows\System\BFNxlQx.exe
  2⤵
  PID:12468
- C:\Windows\System\yhHIfxC.exe
  C:\Windows\System\yhHIfxC.exe
  2⤵
  PID:12508
- C:\Windows\System\JkEUTCh.exe
  C:\Windows\System\JkEUTCh.exe
  2⤵
  PID:12548
- C:\Windows\System\uDHEXdf.exe
  C:\Windows\System\uDHEXdf.exe
  2⤵
  PID:12564
- C:\Windows\System\SZfuQKp.exe
  C:\Windows\System\SZfuQKp.exe
  2⤵
  PID:12604
- C:\Windows\System\gXwBOWA.exe
  C:\Windows\System\gXwBOWA.exe
  2⤵
  PID:12628
- C:\Windows\System\yhsFBLt.exe
  C:\Windows\System\yhsFBLt.exe
  2⤵
  PID:12660
- C:\Windows\System\PftpiVw.exe
  C:\Windows\System\PftpiVw.exe
  2⤵
  PID:12688
- C:\Windows\System\tHOnaqQ.exe
  C:\Windows\System\tHOnaqQ.exe
  2⤵
  PID:12716
- C:\Windows\System\CukMERn.exe
  C:\Windows\System\CukMERn.exe
  2⤵
  PID:12744
- C:\Windows\System\lsdkCtQ.exe
  C:\Windows\System\lsdkCtQ.exe
  2⤵
  PID:12772
- C:\Windows\System\JOCtrjI.exe
  C:\Windows\System\JOCtrjI.exe
  2⤵
  PID:12796
- C:\Windows\System\SsBPMJl.exe
  C:\Windows\System\SsBPMJl.exe
  2⤵
  PID:12828
- C:\Windows\System\hVAkVJf.exe
  C:\Windows\System\hVAkVJf.exe
  2⤵
  PID:12844
- C:\Windows\System\BZOlNUp.exe
  C:\Windows\System\BZOlNUp.exe
  2⤵
  PID:12884
- C:\Windows\System\JkJzzwV.exe
  C:\Windows\System\JkJzzwV.exe
  2⤵
  PID:12920
- C:\Windows\System\bhaeWJe.exe
  C:\Windows\System\bhaeWJe.exe
  2⤵
  PID:12948
- C:\Windows\System\erJFXyY.exe
  C:\Windows\System\erJFXyY.exe
  2⤵
  PID:12972
- C:\Windows\System\bZGQGYp.exe
  C:\Windows\System\bZGQGYp.exe
  2⤵
  PID:13000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_0eaz02y4.uux.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0eaz02y4.uux.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AsjQYDh.exe

Path C:\Windows\System\AsjQYDh.exe
Size 3.0MB
SHA256 9a3749a8d51e56afaaad90278e540c9063eb26f97b759c04e36308f4d05b2c43
MD5 7d9570263977b412f5f8739e04fa915a
SHA1 97b58fa7c0241d94b442741390124633302c2f38
SHA512 c2a5c102b48ae6af83c41e9209663ca0e26ff2acf2f984c8da7462234912b735814498c88ac364d0b22500a492b59e708c28d9224ff76ed131555a9bd8b9ad6d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz8:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CslVaga.exe

Path C:\Windows\System\CslVaga.exe
Size 3.0MB
SHA256 ae8de9bf67dfb1a45cf2d475adcc791d7f8e22b6098ece88442fccc32bd43096
MD5 d31cc4d217cdf8792e737982b8850027
SHA1 db2f2b79eb76497fb4c1628fdd7d13ad86151bfd
SHA512 ffbc414f78c1103f0deb4e1666cf9823faf71d7f15791db06d30445de453e320d19f9834ce3eecf7bd4eada31fb15f787a97917c93107f94102096047c670499
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzc:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

DgzzRUn.exe

Path C:\Windows\System\DgzzRUn.exe
Size 3.0MB
SHA256 b1f482fa81a854e95a1937c102679424e5130a40e6c7705695965979516ade90
MD5 05fe3bee9230830d8a2433ea58550f47
SHA1 1de0b9fb2f0bf2d8c909c353c0e0b82936809628
SHA512 d6006d671de3d5b7084b9f07cc997c80aec20783ce53568fecc6e2127dcffb58f7b582c648d0a136f8a22b2b309568e19bf368bc2d98e762b35edca65ed0ec21
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

EOIVwiH.exe

Path C:\Windows\System\EOIVwiH.exe
Size 3.0MB
SHA256 f580e8f072e5a329b790253986d5e3fee4bb75a4a21a92c0f2a31f7a4a013b30
MD5 aff44f797be7980e8b3fb8e3410cc91e
SHA1 ff60672758ee97fb1edc40395e1a83d253bb531d
SHA512 5215c308ab48dcdeed0c9f1e6906dc7f90aebe11eb22688d5711ad3ff4a3c424e7381198de37008d9a1e8e7ad91188a5938ed2158d171c3a9329af23f7149672
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

GgiiZRv.exe

Path C:\Windows\System\GgiiZRv.exe
Size 3.0MB
SHA256 6d03ddfc80e58f21f90717c98be5bb590c90c6b913714438e44e015adf5e35ab
MD5 7a4299279115c53c549d3f7bc50fd85c
SHA1 06e54253d6ec2cdcf55118503ac0aff72210ed33
SHA512 eb96603ee32b3d19ec5b508d24345163617cb22fd85c8c7bf6f5b031ae4f1837f26cf6f35283378ea2776c857ff87ffb8a75d2db07a6d2bb5bedc417713495df
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

GlvyXLd.exe

Path C:\Windows\System\GlvyXLd.exe
Size 3.0MB
SHA256 d3c198c22fc46b8dd0de61a4c36289e5865e9a6bda09b6c15be916841ce1cfcf
MD5 a7590685a4a1683de665806ffc2edb1b
SHA1 24da1b6fb65afe9f4d4aa9933b882c8c5267fd9e
SHA512 fd6454a16110eaebfd842b72804b0228f9b88dee0059ac4cef75ede57e64738d06bf22b9a558ec604132d61be39eaa4caabc42fdbff9cd7b5ef626824280ce06
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzU:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

GpwyErX.exe

Path C:\Windows\System\GpwyErX.exe
Size 3.0MB
SHA256 2c5ea02a1c810aaf56e93acad543a58dc54d3272ff9b390ca36e8253d23770af
MD5 c480b126d44b36e828018762a5a91dca
SHA1 be3cc935193dd401f95def480e5001f699346716
SHA512 9b5e4ad411bcd6a201634a306602ee3d6d81c0894d8dfbed7562dd5dc6b968829cee68dabdb062fd07ec68bc07dfd34bd344e1f75806f08bfe02308a35b91772
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

IfDVghu.exe

Path C:\Windows\System\IfDVghu.exe
Size 3.0MB
SHA256 a2f23a68551357d51b0ee9dd67219e4e0ec5b53bbb742b5bee5df74abc20fea2
MD5 0841d7161ffbbe0655c6cde5e4e73f06
SHA1 9c9054c3aa4c938038a28c99ea7ab56ca9d03b50
SHA512 ff46096e2980204ad13cb0a034bfe4fe2fb24bb7bd268263d8e8fd47269167fa838ce01500e6d343ff46d257567ac53db8a783993f3671d3c98a13856a795939
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzc:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

IvuLsTa.exe

Path C:\Windows\System\IvuLsTa.exe
Size 3.0MB
SHA256 4d827ac8dd374cfc0eca45a5d53b58c2ca9b22c81ab7b3908bdd3a36bb742684
MD5 7c6a3eed1fbd4e75848c0dc1258a4eeb
SHA1 cda7d88a57829b0bc0a21a4b86f5b08239a10a18
SHA512 854a378c96c2c83f7676836b59b81038221858c876dead91d4fe5367a90bbd834fc9969dc813df0aab949e89d42d28b3be40b576591ff06da4cc73f0b00bd530
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MKQVUjx.exe

Path C:\Windows\System\MKQVUjx.exe
Size 3.0MB
SHA256 79df093a3d09ca45accd4c9cbd55eb24d5cd374a3f8370ba8d13f4c568ebd9cc
MD5 61ad257c92738799741300daac416720
SHA1 8211e6018d9ce94eb30089e4c07c7ba1510bcea4
SHA512 99a68a6b70ab3ede3abef5f2524eb5c1488490096b64f2b259e70e87452fab1244a2a63e8439e0dfd615347371eed89ebbd8779105c7e1a2684456f3f096a179
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz7:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

MTfnvyg.exe

Path C:\Windows\System\MTfnvyg.exe
Size 3.0MB
SHA256 55a9e3efbdc4a308c8a6509f73d97b94ec5cb85c9eb6456f22a9c890831d43fa
MD5 17db491223f875dc046f57b71dc02faa
SHA1 ca406e0d6eb99195f402ba35918cf1731d71f0c2
SHA512 9fbcad5a7724fae8a3b7d4e4390c7e74057a5c3d5e6f43b392a6f9bb513f12f4257146929baa89ebcd2afbcb12ff7a0fa9e1f1ff76ff1d486dc3f0832540f7b1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzH:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

OsjIGsf.exe

Path C:\Windows\System\OsjIGsf.exe
Size 3.0MB
SHA256 9ea327a034cee29c20f9bcd03fa84c924b7e3bf70bb5b19da84436e200742830
MD5 0f3fcf83180a8ce6ed8f254e3aeaa2ad
SHA1 2903b0edc38be4d9fc17af2da4d31cb89c28814f
SHA512 97cc1fbeb6494a034c1622c962df616e7b1c1472bf2f8bb674ab4747391ce6b0cc8a2842116a46a80cc83f23aaeb400d24cf89f0bdad31ec043fe509d54dcbe0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzG:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

RcQuDRU.exe

Path C:\Windows\System\RcQuDRU.exe
Size 3.0MB
SHA256 849898786f69ebe51a3cabf1532b063ad7fb20789c0dfc542b5bc18985b59393
MD5 8f3b681ab7767c1af4a9bdb706e97b23
SHA1 0fdebd89d430e939b7ff0bea7b446681a5d8bef2
SHA512 6b41575a2df9a09767ccec5364ab494d32954dd5b190802bb1c5c4f167e6adb25c29089892efad741fb17e930f74778c6b6bab75cf59b46aeeb23cd9f21d5baa
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

UWZfXAp.exe

Path C:\Windows\System\UWZfXAp.exe
Size 3.0MB
SHA256 32e7265c2caadae11f82bb31af4a0134fe616749282fc0e423ec6e511d6f0c85
MD5 11f305767f1865a3b13dd97a37ab2881
SHA1 75d9b17736ed05d711be2af57c678ce700807b6d
SHA512 e33cdd057a18c848fc8180b2338e72e816b057bc801b69772eab6b2c5ece0f62ac1c4d5cf4b80f80e195469854a8b7f809b4939b4e26772acf0e57de0b92fbee
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzQ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

WltjsPl.exe

Path C:\Windows\System\WltjsPl.exe
Size 3.0MB
SHA256 cda4e7ad6d0513eef902ecacdb8ef9e649d5044a1dd13edfdf81bec28fcfd292
MD5 9699d84596c9c782c281a0f32c3341f5
SHA1 23279040bf81004b543cc35bee27f7f5be401784
SHA512 4a59a0730d68d80192e90621187c93e472832519c933cf43d7b53121b09123a41957c3f24102416c2a5d08aac3aab341978a23ae7659bcf50b8c493efb690b00
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz2:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

XDGAAPl.exe

Path C:\Windows\System\XDGAAPl.exe
Size 3.0MB
SHA256 376f756a9b3b393e60207e9e6523e69489f934e9bce2ea1721c403b08070b330
MD5 d84de964f206f4c3b98e3b6cd7592d8e
SHA1 8310565ebc40f61c113626693a0483d0d5084a69
SHA512 0a0737cb29fe6841d4931b97ba8807fe64faaf44cda27cd8c8d2681c69de3e99f59772e06168db64fed23c2a72e6702a31c4ae7429c921f0a214d9d2d0008183
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzl:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

XbHuRyd.exe

Path C:\Windows\System\XbHuRyd.exe
Size 3.0MB
SHA256 a6aaffbe5c1be3891d3315f2efe7df8b4cdbb3414bf5a3832c758550867989aa
MD5 76ca8389c7844451a0a2f1e8a9bf3e84
SHA1 06bc06d27d7ac524da9148c992d341dd3ec9d6e4
SHA512 7e632116e481c993477bc98322e84b2f6ac3953489b1c21119f1665608a4cd039c2bd66428e8c312989dac87b55d26148859da7b69dac9af860d8d51b381763d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzI:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ctgyZKc.exe

Path C:\Windows\System\ctgyZKc.exe
Size 3.0MB
SHA256 1cc3b6eb47000f6e32d12d09c5f25976853fedaea3ca24b8519814aea9d7639e
MD5 5dde238ebde798f4048c464e75055756
SHA1 fcc4e7a89703bdad0dc3187747c72aceba216a15
SHA512 5afbdf36054af9c51c6f686e38922129cf7b96f1908c5fc93e800f972c5360663ec88af09ef8bd5b2631014202654fac85e0d4bcea88227f9f88265c545e0313
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz8:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

dUTNPoz.exe

Path C:\Windows\System\dUTNPoz.exe
Size 3.0MB
SHA256 2c66e2a2f356e19fafd1a9c3bd79ddd029e6a11cf769de0389c925175675d4de
MD5 f8d41cfd43d7366bb55d312b9f58a770
SHA1 1d2755d754048b211ac66be569f9ffc68a7a760a
SHA512 2161973e1b0148b7c6fac7e2c08d2bbf88b33162a63f5e76fb62a5c03e613b2568e941f1478d945570364792ce7d72cb21ee6a69ca8a963bd3d0f991095e2e61
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzb:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

fDGxgiA.exe

Path C:\Windows\System\fDGxgiA.exe
Size 3.0MB
SHA256 0a053918c29884f9a4863d63906f53538cc047fb4237d19b601b0e1659e8b341
MD5 f55d917884ba9af6d438f0cd32b71232
SHA1 fac3ec87afb92f099082724f8322bbbbd0a63520
SHA512 d96cfb22b33295cff37247436b54e8da1607ad643cc9aca990272ffee91e076674d340f48cd9a947c007504db59e48a64949cad90a69cf785b318b30f660e887
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzo:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

fLpfrSP.exe

Path C:\Windows\System\fLpfrSP.exe
Size 3.0MB
SHA256 8f2cfdba1c19ed46b69179ecdd1e16ac1efddf2e560d2fc16ba8dde6160718e7
MD5 6422aeb8a2f2828a94f1a3d51ddf243c
SHA1 58c9623feea10978028219952a87aa1edbc34c86
SHA512 4b4391574d849c9a4ff8d8943ac915c20ab1a43791f54c464106c77fd6b3356e446b7dd5f6ac8e2ef01925f5411284bf812dbf97bd26017a5cbf62bb51f83e44
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzB:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

hUJOtvR.exe

Path C:\Windows\System\hUJOtvR.exe
Size 3.0MB
SHA256 8e009442183afd6964327588cf2c1fcbf6d0a0569604182c283a594d054e3937
MD5 358fbddfb3da1d452882645bdf6cc3e9
SHA1 59e82658ae0e5eb356a7d62e159f916668d0c965
SHA512 01c27623e0f90b7dba5f27d6df2c6fe26f79de68e37dd1eb18b1b2eaa0642d0ba9796ae0da816d2646975c1e9249f7f53fdd1a635f8dee22ae86b11530887d06
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzz:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

hkclHzn.exe

Path C:\Windows\System\hkclHzn.exe
Size 3.0MB
SHA256 3cb24a02ac4ddea533927a1e6850977ad6398b9191d1974f16fb217f0934c675
MD5 cec1c64ba4f1a33c9304d200b621ef8c
SHA1 147a52a2ac8f1ad60511dd6e07a590929d2e0a4a
SHA512 f60f1cc8b807f02f5a11e5ca1e751c3cab764993112e0321a644cc3c539bfcce4846717114008b3a2db9a4758aed848f6c006840842c692082a40bfe04534e14
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzy:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

iOvBdJC.exe

Path C:\Windows\System\iOvBdJC.exe
Size 8B
SHA256 c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473
MD5 b2496acc5e17e2c67abf0e50b34299c5
SHA1 e4d3a01a7b24014db52a37c4589da1d759e5cc01
SHA512 ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251
MD5 SHA1 SHA512

Submit Download

jpcIkNM.exe

Path C:\Windows\System\jpcIkNM.exe
Size 3.0MB
SHA256 34d48b0ed6e964c966ad928c471aa2a8573d8ea218f6f347927c5ef47b1c5e6e
MD5 b45d65566ad6a81509abfcd9f8233a15
SHA1 29ad0fd15f85e323b84ace9dea70db2cc069f66c
SHA512 691f6f23c81f14dfa4cbb0c28be24b8300a60bb0513c1abe15f07fde25adb9dfd7b84731de3bfd566d07b76e5853630496d8b751b5dd2a0c0f940997e3e3401a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzW:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

lkYDJTP.exe

Path C:\Windows\System\lkYDJTP.exe
Size 3.0MB
SHA256 f9a7431d912aa25f68a459875e9c163211f2d0155feef19d344449d9aed6753a
MD5 a608dfbea37be7d39d1be99a28ea1797
SHA1 4c5daf8aa6d7020b131d3c215eb542943da74d7a
SHA512 4a14d161bdd49ec38f1def800ae3c06c35457153f9cf5cc8ddaba69d746076df618727f5912eb4fbda4e79219966441eda20e9748347e81d874a48763f4c91d2
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzW:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

nZAshhP.exe

Path C:\Windows\System\nZAshhP.exe
Size 3.0MB
SHA256 b560d8d83523430b6b4c6f5e92dbf7c0bd03df8b06794e77eebcb7e04d1cddf9
MD5 904ee0ced6e798dfadb1656ab3f6d6c0
SHA1 c82ef1338c0c8a3a3183c845b78dd6f4514f367d
SHA512 29296c4a2c2532477d4942fe13a68a92180718b2337bbb817bd53618240a5a822e07b17e62e2466dbc334edd084cd15a42a5b0d1124acbf2994306079f246fa9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxwkBjK.exe

Path C:\Windows\System\oxwkBjK.exe
Size 3.0MB
SHA256 f0498dcfffc2342d341990ef80e77f1cfe73ac68a3102bbd53d53178d4cf3490
MD5 90a6bf21fd999a04635e1e5e38837167
SHA1 398f0f9a3aee985df4410034132ea794841d1272
SHA512 0075249376b6839ad06033bdcfad3fd9b5cceceb1c3642645c885aa4e75bcdecc2ac3cf036560da235324d29fb30ff1ca60d800709c3a425ba21795e44652319
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzQ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

pYthoKE.exe

Path C:\Windows\System\pYthoKE.exe
Size 3.0MB
SHA256 766a88b6326931fec7a6cfdc852f60a3702c81089c954d77c45624a1a160756b
MD5 a49fabf5bcc90b89a5d26a105c039e45
SHA1 e3e43d9533d287d0700fa1071430cc8a0cb6f3b5
SHA512 13dfd20d9912683762bb536ec8572ac6235672845b84f70b3ff6053bf9170d4d15dc54d2fbd42c1aaaf2a5c34e17417b59196696bd4cf766e350b205b26c6e68
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzX:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyGCzkv.exe

Path C:\Windows\System\pyGCzkv.exe
Size 3.0MB
SHA256 172079a9853584a6aa94dd84dddda2bc31067da22267b8e80e99813df4035d00
MD5 47a4eeebb7018f4d371353cd5747019e
SHA1 4036cb06d774a02de6c0f7f13066bebda67f0cdd
SHA512 f0e05babc492ff3ec7d3c2d6dd6f5bfdfa8d57ef0d33a1495d15dbe63b033df69f40e01387cce4335930339b05532386ec1a2d9448ae3e015e4991971dd3f080
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

rBEsbGt.exe

Path C:\Windows\System\rBEsbGt.exe
Size 3.0MB
SHA256 ca30d4c24a55d506a767da9dd5b183c434420c092f4f9a8576054a961d7b9f21
MD5 2322e2d6dc2c230ce8d5fca2b95713ce
SHA1 a6f05cadbf7f21d46b0054d550f799af40982ffe
SHA512 415c87cd381355b43eea73e1739a88fcc1955fc0c9f54fc09b4a2b6b4120a7eaf08a2f9e25cf16cfd0fae7491be9f6006bd306f45bb7b175a3bcab9fcb76d0ff
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz7:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tJLjBLg.exe

Path C:\Windows\System\tJLjBLg.exe
Size 3.0MB
SHA256 c94a32ac5fb3410f9f5b8cb2be492724f5835e459cce948aa89f404b652ce09c
MD5 c757d449d9bbd269cdf53bcb02b28e39
SHA1 4fd1cc13cc9756553ddb474014b514bcea846662
SHA512 3b23bb7f03199133461f0251dd5c66330b73b6318010e12eb4d3a3a5c1fa4c094ff242b7f6ffe52232f19e0b750ae367780120553de99fcc7138bc206ff7bfff
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzp:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

uZAOZfo.exe

Path C:\Windows\System\uZAOZfo.exe
Size 3.0MB
SHA256 83a262332713e70ad323633e5525b288c011dfe7e603865f8744c3248e43b79d
MD5 88493d97c98cdb689fb8aefcdf1d7bf6
SHA1 284750c63304d92adefea707e400642e389a02b4
SHA512 a90404985d798efcd5a27f9ee521f827c00ca4355315b3fe54d9f0634dbc33f5262e933920b0c7844fa2fc541ea77db9baff53dbacf2202fc7355af937da48ac
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzs:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ynWzKhX.exe

Path C:\Windows\System\ynWzKhX.exe
Size 3.0MB
SHA256 ff063f51a06eece0c22143f69037d67887333c1ef34395b0ca1aee68d245a21b
MD5 a12a0952cbd049c36b1ca1b944b2ffcc
SHA1 53d6c6e4b073e82b53e792221c4978efce9b7332
SHA512 94527f2c17731a20dc4c59899b703c95546f6488dce04227749e8d7c8ccf2e45a461767e942521956938e6db84c5792cecde2676ac80adb12418d3e2e4d6bbd7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOz4:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-2219-0x00007FF648630000-0x00007FF648A26000-memory.dmp

Download

memory/860-893-0x00007FF648630000-0x00007FF648A26000-memory.dmp

Download

memory/1028-2206-0x00007FF705E70000-0x00007FF706266000-memory.dmp

Download

memory/1028-868-0x00007FF705E70000-0x00007FF706266000-memory.dmp

Download

memory/1112-2208-0x00007FF7B6990000-0x00007FF7B6D86000-memory.dmp

Download

memory/1112-847-0x00007FF7B6990000-0x00007FF7B6D86000-memory.dmp

Download

memory/1532-858-0x00007FF6025B0000-0x00007FF6029A6000-memory.dmp

Download

memory/1532-2213-0x00007FF6025B0000-0x00007FF6029A6000-memory.dmp

Download

memory/1716-2209-0x00007FF681240000-0x00007FF681636000-memory.dmp

Download

memory/1716-938-0x00007FF681240000-0x00007FF681636000-memory.dmp

Download

memory/1964-894-0x00007FF7446C0000-0x00007FF744AB6000-memory.dmp

Download

memory/1964-2220-0x00007FF7446C0000-0x00007FF744AB6000-memory.dmp

Download

memory/2140-911-0x00007FF77B440000-0x00007FF77B836000-memory.dmp

Download

memory/2140-2222-0x00007FF77B440000-0x00007FF77B836000-memory.dmp

Download

memory/2172-1-0x000001F7AD690000-0x000001F7AD6A0000-memory.dmp

Download

memory/2172-0-0x00007FF7E47F0000-0x00007FF7E4BE6000-memory.dmp

Download

memory/2184-879-0x00007FF7B8310000-0x00007FF7B8706000-memory.dmp

Download

memory/2184-2216-0x00007FF7B8310000-0x00007FF7B8706000-memory.dmp

Download

memory/2212-884-0x00007FF611B00000-0x00007FF611EF6000-memory.dmp

Download

memory/2212-2215-0x00007FF611B00000-0x00007FF611EF6000-memory.dmp

Download

memory/2600-902-0x00007FF6E2810000-0x00007FF6E2C06000-memory.dmp

Download

memory/2600-2221-0x00007FF6E2810000-0x00007FF6E2C06000-memory.dmp

Download

memory/3144-75-0x00007FF699BD0000-0x00007FF699FC6000-memory.dmp

Download

memory/3144-2211-0x00007FF699BD0000-0x00007FF699FC6000-memory.dmp

Download

memory/3352-936-0x00007FF6E6A80000-0x00007FF6E6E76000-memory.dmp

Download

memory/3352-2210-0x00007FF6E6A80000-0x00007FF6E6E76000-memory.dmp

Download

memory/3376-30-0x00007FFE57C20000-0x00007FFE586E1000-memory.dmp

Download

memory/3376-17-0x00007FFE57C23000-0x00007FFE57C25000-memory.dmp

Download

memory/3376-55-0x00007FFE57C20000-0x00007FFE586E1000-memory.dmp

Download

memory/3376-458-0x000001C769810000-0x000001C769FB6000-memory.dmp

Download

memory/3376-43-0x000001C768C60000-0x000001C768C82000-memory.dmp

Download

memory/3376-2223-0x00007FFE57C23000-0x00007FFE57C25000-memory.dmp

Download

memory/3536-918-0x00007FF68C7E0000-0x00007FF68CBD6000-memory.dmp

Download

memory/3536-2202-0x00007FF68C7E0000-0x00007FF68CBD6000-memory.dmp

Download

memory/3556-2205-0x00007FF68A3D0000-0x00007FF68A7C6000-memory.dmp

Download

memory/3556-66-0x00007FF68A3D0000-0x00007FF68A7C6000-memory.dmp

Download

memory/3760-2203-0x00007FF7ECD00000-0x00007FF7ED0F6000-memory.dmp

Download

memory/3760-830-0x00007FF7ECD00000-0x00007FF7ED0F6000-memory.dmp

Download

memory/3908-2199-0x00007FF6289D0000-0x00007FF628DC6000-memory.dmp

Download

memory/3908-12-0x00007FF6289D0000-0x00007FF628DC6000-memory.dmp

Download

memory/4028-63-0x00007FF740770000-0x00007FF740B66000-memory.dmp

Download

memory/4028-2201-0x00007FF740770000-0x00007FF740B66000-memory.dmp

Download

memory/4224-2200-0x00007FF6BF7F0000-0x00007FF6BFBE6000-memory.dmp

Download

memory/4224-916-0x00007FF6BF7F0000-0x00007FF6BFBE6000-memory.dmp

Download

memory/4560-71-0x00007FF679B40000-0x00007FF679F36000-memory.dmp

Download

memory/4560-2204-0x00007FF679B40000-0x00007FF679F36000-memory.dmp

Download

memory/4576-871-0x00007FF784540000-0x00007FF784936000-memory.dmp

Download

memory/4576-2218-0x00007FF784540000-0x00007FF784936000-memory.dmp

Download

memory/4604-874-0x00007FF6D7CC0000-0x00007FF6D80B6000-memory.dmp

Download

memory/4604-2217-0x00007FF6D7CC0000-0x00007FF6D80B6000-memory.dmp

Download

memory/4608-2214-0x00007FF6A2CB0000-0x00007FF6A30A6000-memory.dmp

Download

memory/4608-929-0x00007FF6A2CB0000-0x00007FF6A30A6000-memory.dmp

Download

memory/4660-2212-0x00007FF7BA990000-0x00007FF7BAD86000-memory.dmp

Download

memory/4660-931-0x00007FF7BA990000-0x00007FF7BAD86000-memory.dmp

Download

memory/5036-852-0x00007FF6C25E0000-0x00007FF6C29D6000-memory.dmp

Download

memory/5036-2207-0x00007FF6C25E0000-0x00007FF6C29D6000-memory.dmp

Download