xmrig | 9b5153ee8ce30de0323236f816b2f8795bbfa6e62f5823249b53ef4310036eed

Analysis

max time kernel
92s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
Size 3.0MB
Sample240609-hzdb8sfd2y
SHA256 9b5153ee8ce30de0323236f816b2f8795bbfa6e62f5823249b53ef4310036eed
MD5 15461571e9bc0102900c1574fd746de0
SHA1 23386992c0ec406f9547b9d769e591407487a781
SHA512 a59770bc59dbdfff2566e76e0decee09bf6b1f35147694435a67c25a2e6f3c44fca89dde751621eab73b13247ec70ba1af139a4f7419c0b95ba67018e3c9a2d8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW3:7bBeSFk7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3916-0-0x00007FF753310000-0x00007FF753706000-memory.dmp	xmrig
behavioral2/files/0x000c0000000233da-6.dat	xmrig
behavioral2/files/0x0007000000023427-16.dat	xmrig
behavioral2/files/0x0007000000023429-19.dat	xmrig
behavioral2/files/0x000700000002342a-37.dat	xmrig
behavioral2/files/0x0007000000023430-71.dat	xmrig
behavioral2/files/0x0007000000023433-75.dat	xmrig
behavioral2/files/0x000700000002342f-82.dat	xmrig
behavioral2/files/0x000700000002342e-95.dat	xmrig
behavioral2/memory/4820-114-0x00007FF7071D0000-0x00007FF7075C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-121.dat	xmrig
behavioral2/memory/2080-132-0x00007FF613D30000-0x00007FF614126000-memory.dmp	xmrig
behavioral2/memory/5020-135-0x00007FF778720000-0x00007FF778B16000-memory.dmp	xmrig
behavioral2/memory/4148-138-0x00007FF73A810000-0x00007FF73AC06000-memory.dmp	xmrig
behavioral2/memory/2712-141-0x00007FF640650000-0x00007FF640A46000-memory.dmp	xmrig
behavioral2/memory/3448-145-0x00007FF74BA80000-0x00007FF74BE76000-memory.dmp	xmrig
behavioral2/memory/3392-146-0x00007FF6BAF50000-0x00007FF6BB346000-memory.dmp	xmrig
behavioral2/memory/4140-144-0x00007FF753A90000-0x00007FF753E86000-memory.dmp	xmrig
behavioral2/memory/3160-143-0x00007FF687020000-0x00007FF687416000-memory.dmp	xmrig
behavioral2/memory/4768-142-0x00007FF7467A0000-0x00007FF746B96000-memory.dmp	xmrig
behavioral2/memory/2816-140-0x00007FF6FB4B0000-0x00007FF6FB8A6000-memory.dmp	xmrig
behavioral2/memory/1868-139-0x00007FF7B4AD0000-0x00007FF7B4EC6000-memory.dmp	xmrig
behavioral2/memory/3924-137-0x00007FF7332E0000-0x00007FF7336D6000-memory.dmp	xmrig
behavioral2/memory/3544-136-0x00007FF7400C0000-0x00007FF7404B6000-memory.dmp	xmrig
behavioral2/memory/3236-134-0x00007FF66B6C0000-0x00007FF66BAB6000-memory.dmp	xmrig
behavioral2/memory/3484-133-0x00007FF69FA80000-0x00007FF69FE76000-memory.dmp	xmrig
behavioral2/memory/2484-131-0x00007FF60B260000-0x00007FF60B656000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-129.dat	xmrig
behavioral2/files/0x000700000002343a-127.dat	xmrig
behavioral2/files/0x0007000000023436-125.dat	xmrig
behavioral2/files/0x0007000000023439-123.dat	xmrig
behavioral2/files/0x0007000000023437-119.dat	xmrig
behavioral2/memory/3528-118-0x00007FF6FFD20000-0x00007FF700116000-memory.dmp	xmrig
behavioral2/memory/3532-117-0x00007FF6B2330000-0x00007FF6B2726000-memory.dmp	xmrig
behavioral2/files/0x0008000000023432-115.dat	xmrig
behavioral2/files/0x0007000000023435-108.dat	xmrig
behavioral2/memory/1532-102-0x00007FF610110000-0x00007FF610506000-memory.dmp	xmrig
behavioral2/memory/2904-86-0x00007FF7C2B90000-0x00007FF7C2F86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-84.dat	xmrig
behavioral2/memory/516-77-0x00007FF75CFD0000-0x00007FF75D3C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-69.dat	xmrig
behavioral2/files/0x000700000002342c-62.dat	xmrig
behavioral2/files/0x000700000002342d-60.dat	xmrig
behavioral2/files/0x000700000002342b-55.dat	xmrig
behavioral2/files/0x0008000000023423-27.dat	xmrig
behavioral2/files/0x000700000002346a-329.dat	xmrig
behavioral2/files/0x0007000000023477-378.dat	xmrig
behavioral2/files/0x000700000002347e-386.dat	xmrig
behavioral2/files/0x0007000000023471-394.dat	xmrig
behavioral2/files/0x0007000000023480-400.dat	xmrig
behavioral2/files/0x0007000000023479-398.dat	xmrig
behavioral2/files/0x000700000002347c-389.dat	xmrig
behavioral2/files/0x000700000002347a-387.dat	xmrig
behavioral2/files/0x0007000000023474-372.dat	xmrig
behavioral2/files/0x000700000002346d-376.dat	xmrig
behavioral2/memory/4692-363-0x00007FF6F8690000-0x00007FF6F8A86000-memory.dmp	xmrig
behavioral2/memory/3268-367-0x00007FF641D50000-0x00007FF642146000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-330.dat	xmrig
behavioral2/memory/2712-2612-0x00007FF640650000-0x00007FF640A46000-memory.dmp	xmrig
behavioral2/memory/1532-2613-0x00007FF610110000-0x00007FF610506000-memory.dmp	xmrig
behavioral2/memory/516-2614-0x00007FF75CFD0000-0x00007FF75D3C6000-memory.dmp	xmrig
behavioral2/memory/2904-2615-0x00007FF7C2B90000-0x00007FF7C2F86000-memory.dmp	xmrig
behavioral2/memory/2484-2616-0x00007FF60B260000-0x00007FF60B656000-memory.dmp	xmrig
behavioral2/memory/4820-2620-0x00007FF7071D0000-0x00007FF7075C6000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	1008	powershell.exe
10	1008	powershell.exe
12	1008	powershell.exe
13	1008	powershell.exe
15	1008	powershell.exe
21	1008	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1008	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2712	vndQDHF.exe
516	znOLAZx.exe
2904	YAdfpvY.exe
1532	wUYAMhJ.exe
4768	zfkEwXk.exe
4820	NpBWsuh.exe
3532	POrCXbL.exe
3528	dWEflpM.exe
2484	nwmGsdT.exe
2080	HJFageL.exe
3160	LmCvXwb.exe
3484	DJsYVfk.exe
3236	eZxUpPv.exe
5020	IhqwVWi.exe
4140	MGwImbV.exe
3448	KxatJVD.exe
3544	YcyiYRd.exe
3392	UbWHCyX.exe
3924	wSdZCPw.exe
4148	TaJugCY.exe
1868	zdmBNPF.exe
2816	trHpNAI.exe
4692	OyEwian.exe
3268	VHWchEz.exe
1420	UPRfjRQ.exe
468	oTuwJUk.exe
2112	BZBqCha.exe
2416	pkjcjkm.exe
1940	MaDlOqF.exe
3180	zENMdyY.exe
2520	tyLOeTs.exe
404	ICJmjhK.exe
4180	oMXRsLy.exe
4972	gaCuUFd.exe
1688	NitWqVf.exe
4504	WuLZaMY.exe
3012	eOAOyZy.exe
1884	PGUtJxQ.exe
4528	TXEcOLG.exe
4812	jElAgWR.exe
4344	HxUJFJF.exe
3604	ZaAjrAZ.exe
2972	eUoncXL.exe
4080	XpFVGrt.exe
4660	MPWlPga.exe
3296	hjKTzTR.exe
1152	WuiPKML.exe
1516	gnphRMd.exe
5108	jsqNjPV.exe
1864	cXRUzJI.exe
816	YnNrJyQ.exe
4352	OmciIJM.exe
2212	DKJTwRd.exe
1968	yUUexUS.exe
1020	KvEfxHS.exe
1004	WncXnhZ.exe
3536	JKSMFRE.exe
100	wCYGaEm.exe
2696	LeHMLrC.exe
1376	ZVwCCIi.exe
4900	vvNrljY.exe
2540	VPevnJd.exe
1992	pJVKFsr.exe
1168	VopmTTW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3916-0-0x00007FF753310000-0x00007FF753706000-memory.dmp	upx
behavioral2/files/0x000c0000000233da-6.dat	upx
behavioral2/files/0x0007000000023427-16.dat	upx
behavioral2/files/0x0007000000023429-19.dat	upx
behavioral2/files/0x000700000002342a-37.dat	upx
behavioral2/files/0x0007000000023430-71.dat	upx
behavioral2/files/0x0007000000023433-75.dat	upx
behavioral2/files/0x000700000002342f-82.dat	upx
behavioral2/files/0x000700000002342e-95.dat	upx
behavioral2/memory/4820-114-0x00007FF7071D0000-0x00007FF7075C6000-memory.dmp	upx
behavioral2/files/0x0007000000023438-121.dat	upx
behavioral2/memory/2080-132-0x00007FF613D30000-0x00007FF614126000-memory.dmp	upx
behavioral2/memory/5020-135-0x00007FF778720000-0x00007FF778B16000-memory.dmp	upx
behavioral2/memory/4148-138-0x00007FF73A810000-0x00007FF73AC06000-memory.dmp	upx
behavioral2/memory/2712-141-0x00007FF640650000-0x00007FF640A46000-memory.dmp	upx
behavioral2/memory/3448-145-0x00007FF74BA80000-0x00007FF74BE76000-memory.dmp	upx
behavioral2/memory/3392-146-0x00007FF6BAF50000-0x00007FF6BB346000-memory.dmp	upx
behavioral2/memory/4140-144-0x00007FF753A90000-0x00007FF753E86000-memory.dmp	upx
behavioral2/memory/3160-143-0x00007FF687020000-0x00007FF687416000-memory.dmp	upx
behavioral2/memory/4768-142-0x00007FF7467A0000-0x00007FF746B96000-memory.dmp	upx
behavioral2/memory/2816-140-0x00007FF6FB4B0000-0x00007FF6FB8A6000-memory.dmp	upx
behavioral2/memory/1868-139-0x00007FF7B4AD0000-0x00007FF7B4EC6000-memory.dmp	upx
behavioral2/memory/3924-137-0x00007FF7332E0000-0x00007FF7336D6000-memory.dmp	upx
behavioral2/memory/3544-136-0x00007FF7400C0000-0x00007FF7404B6000-memory.dmp	upx
behavioral2/memory/3236-134-0x00007FF66B6C0000-0x00007FF66BAB6000-memory.dmp	upx
behavioral2/memory/3484-133-0x00007FF69FA80000-0x00007FF69FE76000-memory.dmp	upx
behavioral2/memory/2484-131-0x00007FF60B260000-0x00007FF60B656000-memory.dmp	upx
behavioral2/files/0x000700000002343b-129.dat	upx
behavioral2/files/0x000700000002343a-127.dat	upx
behavioral2/files/0x0007000000023436-125.dat	upx
behavioral2/files/0x0007000000023439-123.dat	upx
behavioral2/files/0x0007000000023437-119.dat	upx
behavioral2/memory/3528-118-0x00007FF6FFD20000-0x00007FF700116000-memory.dmp	upx
behavioral2/memory/3532-117-0x00007FF6B2330000-0x00007FF6B2726000-memory.dmp	upx
behavioral2/files/0x0008000000023432-115.dat	upx
behavioral2/files/0x0007000000023435-108.dat	upx
behavioral2/memory/1532-102-0x00007FF610110000-0x00007FF610506000-memory.dmp	upx
behavioral2/memory/2904-86-0x00007FF7C2B90000-0x00007FF7C2F86000-memory.dmp	upx
behavioral2/files/0x0007000000023434-84.dat	upx
behavioral2/memory/516-77-0x00007FF75CFD0000-0x00007FF75D3C6000-memory.dmp	upx
behavioral2/files/0x0007000000023428-69.dat	upx
behavioral2/files/0x000700000002342c-62.dat	upx
behavioral2/files/0x000700000002342d-60.dat	upx
behavioral2/files/0x000700000002342b-55.dat	upx
behavioral2/files/0x0008000000023423-27.dat	upx
behavioral2/files/0x000700000002346a-329.dat	upx
behavioral2/files/0x0007000000023477-378.dat	upx
behavioral2/files/0x000700000002347e-386.dat	upx
behavioral2/files/0x0007000000023471-394.dat	upx
behavioral2/files/0x0007000000023480-400.dat	upx
behavioral2/files/0x0007000000023479-398.dat	upx
behavioral2/files/0x000700000002347c-389.dat	upx
behavioral2/files/0x000700000002347a-387.dat	upx
behavioral2/files/0x0007000000023474-372.dat	upx
behavioral2/files/0x000700000002346d-376.dat	upx
behavioral2/memory/4692-363-0x00007FF6F8690000-0x00007FF6F8A86000-memory.dmp	upx
behavioral2/memory/3268-367-0x00007FF641D50000-0x00007FF642146000-memory.dmp	upx
behavioral2/files/0x000700000002343c-330.dat	upx
behavioral2/memory/2712-2612-0x00007FF640650000-0x00007FF640A46000-memory.dmp	upx
behavioral2/memory/1532-2613-0x00007FF610110000-0x00007FF610506000-memory.dmp	upx
behavioral2/memory/516-2614-0x00007FF75CFD0000-0x00007FF75D3C6000-memory.dmp	upx
behavioral2/memory/2904-2615-0x00007FF7C2B90000-0x00007FF7C2F86000-memory.dmp	upx
behavioral2/memory/2484-2616-0x00007FF60B260000-0x00007FF60B656000-memory.dmp	upx
behavioral2/memory/4820-2620-0x00007FF7071D0000-0x00007FF7075C6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yPZsXKw.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\WwMEMiJ.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\dYxJIBF.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\qCTxGRo.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\GSPTEKF.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\kvlTiAT.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\jOEehnJ.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\FFHuTOx.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\yPCHfSg.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\MrpSNKk.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\MUhTvKm.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\nvkTQuR.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\TuYvgCc.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\sojUvFp.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\TCQGEKF.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\XTgXnoB.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\BCrkJmF.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\bHGfMdU.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\YfFNHrT.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\mORnJMG.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\vtZPywC.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\fwawVOy.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\PzpzaSm.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\hrGPQZf.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\iJPeLNX.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\SKpjkHi.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\eAmpejg.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\VEJjopo.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\kemUHDD.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\wtjWlVB.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\sbSOSJd.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\HFxBbLI.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\KaalvQN.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\CxVMCuw.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\nmbEwWk.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\IGkDQgQ.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\kjHclMH.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\NYZsOhE.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\sICOPve.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\BiDRkqN.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\lceOElm.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\eZqnhIa.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\RKhVcsb.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\WJtFJOb.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\SzBfclk.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\xwoMwpt.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\OBVsTlv.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\AmnskMX.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\FYlmMwF.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\YtBLQit.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\GjfvCGI.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\QZzfGkW.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\vBOnczh.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\sqOLZJQ.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\EjXgtWD.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\mNwPCWw.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\yjNpBvP.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\TerLgQY.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\XwVlkoO.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\HxUJFJF.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\kMWINyV.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\tOMNPhk.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\MFGUqDB.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
File created	C:\Windows\System\BRdmFXu.exe	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1008	powershell.exe
1008	powershell.exe
1008	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeLockMemoryPrivilege	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1008	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	83
PID 3916 wrote to memory of 1008	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	83
PID 3916 wrote to memory of 2712	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	84
PID 3916 wrote to memory of 2712	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	84
PID 3916 wrote to memory of 516	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	85
PID 3916 wrote to memory of 516	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	85
PID 3916 wrote to memory of 2904	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	86
PID 3916 wrote to memory of 2904	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	86
PID 3916 wrote to memory of 4768	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	87
PID 3916 wrote to memory of 4768	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	87
PID 3916 wrote to memory of 1532	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	88
PID 3916 wrote to memory of 1532	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	88
PID 3916 wrote to memory of 4820	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	89
PID 3916 wrote to memory of 4820	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	89
PID 3916 wrote to memory of 2484	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	90
PID 3916 wrote to memory of 2484	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	90
PID 3916 wrote to memory of 3160	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	91
PID 3916 wrote to memory of 3160	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	91
PID 3916 wrote to memory of 3532	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	92
PID 3916 wrote to memory of 3532	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	92
PID 3916 wrote to memory of 3528	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	93
PID 3916 wrote to memory of 3528	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	93
PID 3916 wrote to memory of 2080	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	94
PID 3916 wrote to memory of 2080	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	94
PID 3916 wrote to memory of 3484	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	95
PID 3916 wrote to memory of 3484	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	95
PID 3916 wrote to memory of 3236	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	96
PID 3916 wrote to memory of 3236	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	96
PID 3916 wrote to memory of 5020	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	97
PID 3916 wrote to memory of 5020	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	97
PID 3916 wrote to memory of 4140	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	98
PID 3916 wrote to memory of 4140	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	98
PID 3916 wrote to memory of 3448	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	99
PID 3916 wrote to memory of 3448	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	99
PID 3916 wrote to memory of 3544	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	100
PID 3916 wrote to memory of 3544	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	100
PID 3916 wrote to memory of 3392	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	101
PID 3916 wrote to memory of 3392	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	101
PID 3916 wrote to memory of 3924	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	102
PID 3916 wrote to memory of 3924	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	102
PID 3916 wrote to memory of 4148	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	103
PID 3916 wrote to memory of 4148	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	103
PID 3916 wrote to memory of 1868	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	104
PID 3916 wrote to memory of 1868	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	104
PID 3916 wrote to memory of 2816	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	105
PID 3916 wrote to memory of 2816	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	105
PID 3916 wrote to memory of 4692	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	106
PID 3916 wrote to memory of 4692	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	106
PID 3916 wrote to memory of 3268	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	107
PID 3916 wrote to memory of 3268	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	107
PID 3916 wrote to memory of 1420	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	108
PID 3916 wrote to memory of 1420	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	108
PID 3916 wrote to memory of 2112	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	109
PID 3916 wrote to memory of 2112	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	109
PID 3916 wrote to memory of 468	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	110
PID 3916 wrote to memory of 468	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	110
PID 3916 wrote to memory of 1940	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	111
PID 3916 wrote to memory of 1940	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	111
PID 3916 wrote to memory of 3180	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	112
PID 3916 wrote to memory of 3180	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	112
PID 3916 wrote to memory of 2416	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	113
PID 3916 wrote to memory of 2416	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	113
PID 3916 wrote to memory of 404	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	114
PID 3916 wrote to memory of 404	3916	15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15461571e9bc0102900c1574fd746de0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System\vndQDHF.exe
  C:\Windows\System\vndQDHF.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\znOLAZx.exe
  C:\Windows\System\znOLAZx.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\YAdfpvY.exe
  C:\Windows\System\YAdfpvY.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\zfkEwXk.exe
  C:\Windows\System\zfkEwXk.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\wUYAMhJ.exe
  C:\Windows\System\wUYAMhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\NpBWsuh.exe
  C:\Windows\System\NpBWsuh.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\nwmGsdT.exe
  C:\Windows\System\nwmGsdT.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\LmCvXwb.exe
  C:\Windows\System\LmCvXwb.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\POrCXbL.exe
  C:\Windows\System\POrCXbL.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\dWEflpM.exe
  C:\Windows\System\dWEflpM.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\HJFageL.exe
  C:\Windows\System\HJFageL.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\DJsYVfk.exe
  C:\Windows\System\DJsYVfk.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\eZxUpPv.exe
  C:\Windows\System\eZxUpPv.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\IhqwVWi.exe
  C:\Windows\System\IhqwVWi.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\MGwImbV.exe
  C:\Windows\System\MGwImbV.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\KxatJVD.exe
  C:\Windows\System\KxatJVD.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\YcyiYRd.exe
  C:\Windows\System\YcyiYRd.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\UbWHCyX.exe
  C:\Windows\System\UbWHCyX.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\wSdZCPw.exe
  C:\Windows\System\wSdZCPw.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\TaJugCY.exe
  C:\Windows\System\TaJugCY.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\zdmBNPF.exe
  C:\Windows\System\zdmBNPF.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\trHpNAI.exe
  C:\Windows\System\trHpNAI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\OyEwian.exe
  C:\Windows\System\OyEwian.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\VHWchEz.exe
  C:\Windows\System\VHWchEz.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\UPRfjRQ.exe
  C:\Windows\System\UPRfjRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\BZBqCha.exe
  C:\Windows\System\BZBqCha.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\oTuwJUk.exe
  C:\Windows\System\oTuwJUk.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\MaDlOqF.exe
  C:\Windows\System\MaDlOqF.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\zENMdyY.exe
  C:\Windows\System\zENMdyY.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\pkjcjkm.exe
  C:\Windows\System\pkjcjkm.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ICJmjhK.exe
  C:\Windows\System\ICJmjhK.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\tyLOeTs.exe
  C:\Windows\System\tyLOeTs.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\oMXRsLy.exe
  C:\Windows\System\oMXRsLy.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\gaCuUFd.exe
  C:\Windows\System\gaCuUFd.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\NitWqVf.exe
  C:\Windows\System\NitWqVf.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\WuLZaMY.exe
  C:\Windows\System\WuLZaMY.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\eOAOyZy.exe
  C:\Windows\System\eOAOyZy.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\PGUtJxQ.exe
  C:\Windows\System\PGUtJxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\TXEcOLG.exe
  C:\Windows\System\TXEcOLG.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\jElAgWR.exe
  C:\Windows\System\jElAgWR.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\HxUJFJF.exe
  C:\Windows\System\HxUJFJF.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\XpFVGrt.exe
  C:\Windows\System\XpFVGrt.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ZaAjrAZ.exe
  C:\Windows\System\ZaAjrAZ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\eUoncXL.exe
  C:\Windows\System\eUoncXL.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\MPWlPga.exe
  C:\Windows\System\MPWlPga.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\hjKTzTR.exe
  C:\Windows\System\hjKTzTR.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\WuiPKML.exe
  C:\Windows\System\WuiPKML.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\gnphRMd.exe
  C:\Windows\System\gnphRMd.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\jsqNjPV.exe
  C:\Windows\System\jsqNjPV.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\cXRUzJI.exe
  C:\Windows\System\cXRUzJI.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\YnNrJyQ.exe
  C:\Windows\System\YnNrJyQ.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\OmciIJM.exe
  C:\Windows\System\OmciIJM.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\DKJTwRd.exe
  C:\Windows\System\DKJTwRd.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\yUUexUS.exe
  C:\Windows\System\yUUexUS.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\KvEfxHS.exe
  C:\Windows\System\KvEfxHS.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\WncXnhZ.exe
  C:\Windows\System\WncXnhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\JKSMFRE.exe
  C:\Windows\System\JKSMFRE.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\wCYGaEm.exe
  C:\Windows\System\wCYGaEm.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\LeHMLrC.exe
  C:\Windows\System\LeHMLrC.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ZVwCCIi.exe
  C:\Windows\System\ZVwCCIi.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\vvNrljY.exe
  C:\Windows\System\vvNrljY.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\VPevnJd.exe
  C:\Windows\System\VPevnJd.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\pJVKFsr.exe
  C:\Windows\System\pJVKFsr.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\VopmTTW.exe
  C:\Windows\System\VopmTTW.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\vtLzegz.exe
  C:\Windows\System\vtLzegz.exe
  2⤵
  PID:1612
- C:\Windows\System\bcWbntD.exe
  C:\Windows\System\bcWbntD.exe
  2⤵
  PID:4416
- C:\Windows\System\LtAKzDv.exe
  C:\Windows\System\LtAKzDv.exe
  2⤵
  PID:2544
- C:\Windows\System\QSTSIsL.exe
  C:\Windows\System\QSTSIsL.exe
  2⤵
  PID:1104
- C:\Windows\System\MguhbJg.exe
  C:\Windows\System\MguhbJg.exe
  2⤵
  PID:4120
- C:\Windows\System\rLNJAIW.exe
  C:\Windows\System\rLNJAIW.exe
  2⤵
  PID:808
- C:\Windows\System\OGuNzvY.exe
  C:\Windows\System\OGuNzvY.exe
  2⤵
  PID:4564
- C:\Windows\System\KgCRzWS.exe
  C:\Windows\System\KgCRzWS.exe
  2⤵
  PID:4488
- C:\Windows\System\rpLfBIP.exe
  C:\Windows\System\rpLfBIP.exe
  2⤵
  PID:3152
- C:\Windows\System\YmWFfiu.exe
  C:\Windows\System\YmWFfiu.exe
  2⤵
  PID:2936
- C:\Windows\System\QbeRAGB.exe
  C:\Windows\System\QbeRAGB.exe
  2⤵
  PID:4940
- C:\Windows\System\ryMmHyU.exe
  C:\Windows\System\ryMmHyU.exe
  2⤵
  PID:1788
- C:\Windows\System\DRnrtes.exe
  C:\Windows\System\DRnrtes.exe
  2⤵
  PID:1648
- C:\Windows\System\JwVfjSt.exe
  C:\Windows\System\JwVfjSt.exe
  2⤵
  PID:3184
- C:\Windows\System\NffDtHy.exe
  C:\Windows\System\NffDtHy.exe
  2⤵
  PID:944
- C:\Windows\System\dTtIxcK.exe
  C:\Windows\System\dTtIxcK.exe
  2⤵
  PID:1652
- C:\Windows\System\knWvtTL.exe
  C:\Windows\System\knWvtTL.exe
  2⤵
  PID:2256
- C:\Windows\System\nxapJkd.exe
  C:\Windows\System\nxapJkd.exe
  2⤵
  PID:3076
- C:\Windows\System\nmrtqLw.exe
  C:\Windows\System\nmrtqLw.exe
  2⤵
  PID:3084
- C:\Windows\System\ejpwMHd.exe
  C:\Windows\System\ejpwMHd.exe
  2⤵
  PID:2100
- C:\Windows\System\cQMXMoR.exe
  C:\Windows\System\cQMXMoR.exe
  2⤵
  PID:1436
- C:\Windows\System\vCZCIna.exe
  C:\Windows\System\vCZCIna.exe
  2⤵
  PID:2348
- C:\Windows\System\lhzDwCZ.exe
  C:\Windows\System\lhzDwCZ.exe
  2⤵
  PID:2488
- C:\Windows\System\VjrQqjV.exe
  C:\Windows\System\VjrQqjV.exe
  2⤵
  PID:3884
- C:\Windows\System\wwXqcUm.exe
  C:\Windows\System\wwXqcUm.exe
  2⤵
  PID:5148
- C:\Windows\System\rLtXdGk.exe
  C:\Windows\System\rLtXdGk.exe
  2⤵
  PID:5176
- C:\Windows\System\UbheiHO.exe
  C:\Windows\System\UbheiHO.exe
  2⤵
  PID:5192
- C:\Windows\System\hFONALb.exe
  C:\Windows\System\hFONALb.exe
  2⤵
  PID:5212
- C:\Windows\System\vgsWOWs.exe
  C:\Windows\System\vgsWOWs.exe
  2⤵
  PID:5228
- C:\Windows\System\fIhyIaS.exe
  C:\Windows\System\fIhyIaS.exe
  2⤵
  PID:5288
- C:\Windows\System\IfCThar.exe
  C:\Windows\System\IfCThar.exe
  2⤵
  PID:5316
- C:\Windows\System\VEuWCeu.exe
  C:\Windows\System\VEuWCeu.exe
  2⤵
  PID:5336
- C:\Windows\System\dFMSiUz.exe
  C:\Windows\System\dFMSiUz.exe
  2⤵
  PID:5372
- C:\Windows\System\zPmJqjo.exe
  C:\Windows\System\zPmJqjo.exe
  2⤵
  PID:5404
- C:\Windows\System\iMYwzKe.exe
  C:\Windows\System\iMYwzKe.exe
  2⤵
  PID:5436
- C:\Windows\System\dwpRsqt.exe
  C:\Windows\System\dwpRsqt.exe
  2⤵
  PID:5464
- C:\Windows\System\aEvnnxT.exe
  C:\Windows\System\aEvnnxT.exe
  2⤵
  PID:5496
- C:\Windows\System\vMWJjDA.exe
  C:\Windows\System\vMWJjDA.exe
  2⤵
  PID:5540
- C:\Windows\System\GaMzdvE.exe
  C:\Windows\System\GaMzdvE.exe
  2⤵
  PID:5580
- C:\Windows\System\QCYYglL.exe
  C:\Windows\System\QCYYglL.exe
  2⤵
  PID:5612
- C:\Windows\System\elTqPwh.exe
  C:\Windows\System\elTqPwh.exe
  2⤵
  PID:5640
- C:\Windows\System\noBMkgJ.exe
  C:\Windows\System\noBMkgJ.exe
  2⤵
  PID:5680
- C:\Windows\System\zrHDEfC.exe
  C:\Windows\System\zrHDEfC.exe
  2⤵
  PID:5704
- C:\Windows\System\aLIVzYw.exe
  C:\Windows\System\aLIVzYw.exe
  2⤵
  PID:5736
- C:\Windows\System\wnQXScz.exe
  C:\Windows\System\wnQXScz.exe
  2⤵
  PID:5764
- C:\Windows\System\xvSeZeB.exe
  C:\Windows\System\xvSeZeB.exe
  2⤵
  PID:5784
- C:\Windows\System\ECvXwwX.exe
  C:\Windows\System\ECvXwwX.exe
  2⤵
  PID:5820
- C:\Windows\System\LvGVaKq.exe
  C:\Windows\System\LvGVaKq.exe
  2⤵
  PID:5844
- C:\Windows\System\hqNULBm.exe
  C:\Windows\System\hqNULBm.exe
  2⤵
  PID:5880
- C:\Windows\System\dxVGSpW.exe
  C:\Windows\System\dxVGSpW.exe
  2⤵
  PID:5900
- C:\Windows\System\BsaqJvk.exe
  C:\Windows\System\BsaqJvk.exe
  2⤵
  PID:5932
- C:\Windows\System\TSNSPGI.exe
  C:\Windows\System\TSNSPGI.exe
  2⤵
  PID:5956
- C:\Windows\System\MoDuYRo.exe
  C:\Windows\System\MoDuYRo.exe
  2⤵
  PID:5984
- C:\Windows\System\pOoAOII.exe
  C:\Windows\System\pOoAOII.exe
  2⤵
  PID:6020
- C:\Windows\System\VAHdEqd.exe
  C:\Windows\System\VAHdEqd.exe
  2⤵
  PID:6048
- C:\Windows\System\qDIaEWj.exe
  C:\Windows\System\qDIaEWj.exe
  2⤵
  PID:6072
- C:\Windows\System\BAAUDmO.exe
  C:\Windows\System\BAAUDmO.exe
  2⤵
  PID:6104
- C:\Windows\System\vfVVyje.exe
  C:\Windows\System\vfVVyje.exe
  2⤵
  PID:6132
- C:\Windows\System\QZzfGkW.exe
  C:\Windows\System\QZzfGkW.exe
  2⤵
  PID:5156
- C:\Windows\System\JdHKojM.exe
  C:\Windows\System\JdHKojM.exe
  2⤵
  PID:5204
- C:\Windows\System\pUfrNFn.exe
  C:\Windows\System\pUfrNFn.exe
  2⤵
  PID:5280
- C:\Windows\System\OERxZqa.exe
  C:\Windows\System\OERxZqa.exe
  2⤵
  PID:5348
- C:\Windows\System\qCTxGRo.exe
  C:\Windows\System\qCTxGRo.exe
  2⤵
  PID:5416
- C:\Windows\System\RribAWe.exe
  C:\Windows\System\RribAWe.exe
  2⤵
  PID:5484
- C:\Windows\System\GBCOWJm.exe
  C:\Windows\System\GBCOWJm.exe
  2⤵
  PID:5576
- C:\Windows\System\sidNNkO.exe
  C:\Windows\System\sidNNkO.exe
  2⤵
  PID:5636
- C:\Windows\System\zTivsCz.exe
  C:\Windows\System\zTivsCz.exe
  2⤵
  PID:5724
- C:\Windows\System\wnDJdfk.exe
  C:\Windows\System\wnDJdfk.exe
  2⤵
  PID:5796
- C:\Windows\System\JEWLSRP.exe
  C:\Windows\System\JEWLSRP.exe
  2⤵
  PID:5864
- C:\Windows\System\NFdrcGq.exe
  C:\Windows\System\NFdrcGq.exe
  2⤵
  PID:5920
- C:\Windows\System\kemUHDD.exe
  C:\Windows\System\kemUHDD.exe
  2⤵
  PID:5980
- C:\Windows\System\dDsDCeJ.exe
  C:\Windows\System\dDsDCeJ.exe
  2⤵
  PID:6056
- C:\Windows\System\iqizgNI.exe
  C:\Windows\System\iqizgNI.exe
  2⤵
  PID:6112
- C:\Windows\System\ofnFnTE.exe
  C:\Windows\System\ofnFnTE.exe
  2⤵
  PID:5200
- C:\Windows\System\rCVNnUX.exe
  C:\Windows\System\rCVNnUX.exe
  2⤵
  PID:5360
- C:\Windows\System\buAnDxa.exe
  C:\Windows\System\buAnDxa.exe
  2⤵
  PID:5524
- C:\Windows\System\WRgEETk.exe
  C:\Windows\System\WRgEETk.exe
  2⤵
  PID:5748
- C:\Windows\System\VyNKWTZ.exe
  C:\Windows\System\VyNKWTZ.exe
  2⤵
  PID:2056
- C:\Windows\System\sqBOiYu.exe
  C:\Windows\System\sqBOiYu.exe
  2⤵
  PID:5240
- C:\Windows\System\dZncwJq.exe
  C:\Windows\System\dZncwJq.exe
  2⤵
  PID:5840
- C:\Windows\System\zAXAUSP.exe
  C:\Windows\System\zAXAUSP.exe
  2⤵
  PID:6148
- C:\Windows\System\esCVUYX.exe
  C:\Windows\System\esCVUYX.exe
  2⤵
  PID:6188
- C:\Windows\System\jgPSWyl.exe
  C:\Windows\System\jgPSWyl.exe
  2⤵
  PID:6240
- C:\Windows\System\YPFGGEs.exe
  C:\Windows\System\YPFGGEs.exe
  2⤵
  PID:6284
- C:\Windows\System\ipbryUK.exe
  C:\Windows\System\ipbryUK.exe
  2⤵
  PID:6336
- C:\Windows\System\sICOPve.exe
  C:\Windows\System\sICOPve.exe
  2⤵
  PID:6372
- C:\Windows\System\AHyYfsy.exe
  C:\Windows\System\AHyYfsy.exe
  2⤵
  PID:6400
- C:\Windows\System\nTFletn.exe
  C:\Windows\System\nTFletn.exe
  2⤵
  PID:6416
- C:\Windows\System\srBeKPx.exe
  C:\Windows\System\srBeKPx.exe
  2⤵
  PID:6464
- C:\Windows\System\bGHSLVy.exe
  C:\Windows\System\bGHSLVy.exe
  2⤵
  PID:6484
- C:\Windows\System\qwOSLzN.exe
  C:\Windows\System\qwOSLzN.exe
  2⤵
  PID:6516
- C:\Windows\System\tOlhiky.exe
  C:\Windows\System\tOlhiky.exe
  2⤵
  PID:6548
- C:\Windows\System\jCxIClj.exe
  C:\Windows\System\jCxIClj.exe
  2⤵
  PID:6600
- C:\Windows\System\gnccWtd.exe
  C:\Windows\System\gnccWtd.exe
  2⤵
  PID:6624
- C:\Windows\System\gPGbMgD.exe
  C:\Windows\System\gPGbMgD.exe
  2⤵
  PID:6652
- C:\Windows\System\OqQIwcL.exe
  C:\Windows\System\OqQIwcL.exe
  2⤵
  PID:6680
- C:\Windows\System\mpRHtep.exe
  C:\Windows\System\mpRHtep.exe
  2⤵
  PID:6708
- C:\Windows\System\HRkWAfT.exe
  C:\Windows\System\HRkWAfT.exe
  2⤵
  PID:6736
- C:\Windows\System\pPYcwLh.exe
  C:\Windows\System\pPYcwLh.exe
  2⤵
  PID:6764
- C:\Windows\System\StCVcYl.exe
  C:\Windows\System\StCVcYl.exe
  2⤵
  PID:6792
- C:\Windows\System\rHAuDok.exe
  C:\Windows\System\rHAuDok.exe
  2⤵
  PID:6820
- C:\Windows\System\iZUFfSD.exe
  C:\Windows\System\iZUFfSD.exe
  2⤵
  PID:6848
- C:\Windows\System\AUUllxs.exe
  C:\Windows\System\AUUllxs.exe
  2⤵
  PID:6872
- C:\Windows\System\GGJKPei.exe
  C:\Windows\System\GGJKPei.exe
  2⤵
  PID:6904
- C:\Windows\System\xcbaDzM.exe
  C:\Windows\System\xcbaDzM.exe
  2⤵
  PID:6932
- C:\Windows\System\YjeAOfC.exe
  C:\Windows\System\YjeAOfC.exe
  2⤵
  PID:6964
- C:\Windows\System\GBnYcYi.exe
  C:\Windows\System\GBnYcYi.exe
  2⤵
  PID:6988
- C:\Windows\System\ZUwCrZL.exe
  C:\Windows\System\ZUwCrZL.exe
  2⤵
  PID:7020
- C:\Windows\System\tfoCVTT.exe
  C:\Windows\System\tfoCVTT.exe
  2⤵
  PID:7044
- C:\Windows\System\ldJIJdD.exe
  C:\Windows\System\ldJIJdD.exe
  2⤵
  PID:7064
- C:\Windows\System\RkjcPJN.exe
  C:\Windows\System\RkjcPJN.exe
  2⤵
  PID:7104
- C:\Windows\System\oPpSOOU.exe
  C:\Windows\System\oPpSOOU.exe
  2⤵
  PID:7132
- C:\Windows\System\KPwKoBm.exe
  C:\Windows\System\KPwKoBm.exe
  2⤵
  PID:7160
- C:\Windows\System\bgDVFmI.exe
  C:\Windows\System\bgDVFmI.exe
  2⤵
  PID:6196
- C:\Windows\System\IqaGtDR.exe
  C:\Windows\System\IqaGtDR.exe
  2⤵
  PID:6332
- C:\Windows\System\OmfOLgO.exe
  C:\Windows\System\OmfOLgO.exe
  2⤵
  PID:6396
- C:\Windows\System\zekiYsn.exe
  C:\Windows\System\zekiYsn.exe
  2⤵
  PID:6472
- C:\Windows\System\sfUmrkn.exe
  C:\Windows\System\sfUmrkn.exe
  2⤵
  PID:6512
- C:\Windows\System\DnOScKL.exe
  C:\Windows\System\DnOScKL.exe
  2⤵
  PID:6596
- C:\Windows\System\aHGmfBV.exe
  C:\Windows\System\aHGmfBV.exe
  2⤵
  PID:6660
- C:\Windows\System\tlbjevO.exe
  C:\Windows\System\tlbjevO.exe
  2⤵
  PID:6700
- C:\Windows\System\fZUtiSn.exe
  C:\Windows\System\fZUtiSn.exe
  2⤵
  PID:6784
- C:\Windows\System\SFhEIwW.exe
  C:\Windows\System\SFhEIwW.exe
  2⤵
  PID:6856
- C:\Windows\System\lomOPKx.exe
  C:\Windows\System\lomOPKx.exe
  2⤵
  PID:6916
- C:\Windows\System\IRsFsxD.exe
  C:\Windows\System\IRsFsxD.exe
  2⤵
  PID:6996
- C:\Windows\System\zkjTwoq.exe
  C:\Windows\System\zkjTwoq.exe
  2⤵
  PID:7056
- C:\Windows\System\AhqPzjS.exe
  C:\Windows\System\AhqPzjS.exe
  2⤵
  PID:7120
- C:\Windows\System\zowtInu.exe
  C:\Windows\System\zowtInu.exe
  2⤵
  PID:6172
- C:\Windows\System\JcgtQbM.exe
  C:\Windows\System\JcgtQbM.exe
  2⤵
  PID:4524
- C:\Windows\System\boWQfCl.exe
  C:\Windows\System\boWQfCl.exe
  2⤵
  PID:6436
- C:\Windows\System\cKqWYIe.exe
  C:\Windows\System\cKqWYIe.exe
  2⤵
  PID:6584
- C:\Windows\System\LvHGHSu.exe
  C:\Windows\System\LvHGHSu.exe
  2⤵
  PID:6804
- C:\Windows\System\rNRCnym.exe
  C:\Windows\System\rNRCnym.exe
  2⤵
  PID:6944
- C:\Windows\System\BwsZrtU.exe
  C:\Windows\System\BwsZrtU.exe
  2⤵
  PID:7092
- C:\Windows\System\RNarkOc.exe
  C:\Windows\System\RNarkOc.exe
  2⤵
  PID:2188
- C:\Windows\System\WvQkBNs.exe
  C:\Windows\System\WvQkBNs.exe
  2⤵
  PID:2180
- C:\Windows\System\APRHASU.exe
  C:\Windows\System\APRHASU.exe
  2⤵
  PID:6252
- C:\Windows\System\hNuqyqG.exe
  C:\Windows\System\hNuqyqG.exe
  2⤵
  PID:6428
- C:\Windows\System\SiHTtcp.exe
  C:\Windows\System\SiHTtcp.exe
  2⤵
  PID:6832
- C:\Windows\System\JQwsnFb.exe
  C:\Windows\System\JQwsnFb.exe
  2⤵
  PID:5696
- C:\Windows\System\lpneOzh.exe
  C:\Windows\System\lpneOzh.exe
  2⤵
  PID:1328
- C:\Windows\System\MtgEiZo.exe
  C:\Windows\System\MtgEiZo.exe
  2⤵
  PID:6880
- C:\Windows\System\vUMwAxH.exe
  C:\Windows\System\vUMwAxH.exe
  2⤵
  PID:932
- C:\Windows\System\OvHiuRp.exe
  C:\Windows\System\OvHiuRp.exe
  2⤵
  PID:7028
- C:\Windows\System\xwoMwpt.exe
  C:\Windows\System\xwoMwpt.exe
  2⤵
  PID:7196
- C:\Windows\System\XTbjrTN.exe
  C:\Windows\System\XTbjrTN.exe
  2⤵
  PID:7224
- C:\Windows\System\piyJFDx.exe
  C:\Windows\System\piyJFDx.exe
  2⤵
  PID:7252
- C:\Windows\System\tatocSW.exe
  C:\Windows\System\tatocSW.exe
  2⤵
  PID:7280
- C:\Windows\System\KNZEjGL.exe
  C:\Windows\System\KNZEjGL.exe
  2⤵
  PID:7308
- C:\Windows\System\IgYJfrN.exe
  C:\Windows\System\IgYJfrN.exe
  2⤵
  PID:7328
- C:\Windows\System\GolWzpF.exe
  C:\Windows\System\GolWzpF.exe
  2⤵
  PID:7364
- C:\Windows\System\CYagYip.exe
  C:\Windows\System\CYagYip.exe
  2⤵
  PID:7392
- C:\Windows\System\fJYFSTO.exe
  C:\Windows\System\fJYFSTO.exe
  2⤵
  PID:7424
- C:\Windows\System\TuYvgCc.exe
  C:\Windows\System\TuYvgCc.exe
  2⤵
  PID:7448
- C:\Windows\System\BONUqPL.exe
  C:\Windows\System\BONUqPL.exe
  2⤵
  PID:7468
- C:\Windows\System\ErNhiSk.exe
  C:\Windows\System\ErNhiSk.exe
  2⤵
  PID:7504
- C:\Windows\System\lzQFdLP.exe
  C:\Windows\System\lzQFdLP.exe
  2⤵
  PID:7532
- C:\Windows\System\wtjWlVB.exe
  C:\Windows\System\wtjWlVB.exe
  2⤵
  PID:7560
- C:\Windows\System\GSPTEKF.exe
  C:\Windows\System\GSPTEKF.exe
  2⤵
  PID:7588
- C:\Windows\System\YpvjKRR.exe
  C:\Windows\System\YpvjKRR.exe
  2⤵
  PID:7616
- C:\Windows\System\iINzkRa.exe
  C:\Windows\System\iINzkRa.exe
  2⤵
  PID:7644
- C:\Windows\System\MzHMdCe.exe
  C:\Windows\System\MzHMdCe.exe
  2⤵
  PID:7672
- C:\Windows\System\BiDRkqN.exe
  C:\Windows\System\BiDRkqN.exe
  2⤵
  PID:7700
- C:\Windows\System\rcIxUDf.exe
  C:\Windows\System\rcIxUDf.exe
  2⤵
  PID:7728
- C:\Windows\System\eakzaFd.exe
  C:\Windows\System\eakzaFd.exe
  2⤵
  PID:7756
- C:\Windows\System\Ysydclo.exe
  C:\Windows\System\Ysydclo.exe
  2⤵
  PID:7784
- C:\Windows\System\gUYATvv.exe
  C:\Windows\System\gUYATvv.exe
  2⤵
  PID:7812
- C:\Windows\System\xyRxguB.exe
  C:\Windows\System\xyRxguB.exe
  2⤵
  PID:7840
- C:\Windows\System\OCqmcPB.exe
  C:\Windows\System\OCqmcPB.exe
  2⤵
  PID:7868
- C:\Windows\System\OLWGbKS.exe
  C:\Windows\System\OLWGbKS.exe
  2⤵
  PID:7896
- C:\Windows\System\evZnsgq.exe
  C:\Windows\System\evZnsgq.exe
  2⤵
  PID:7924
- C:\Windows\System\HQEjYfJ.exe
  C:\Windows\System\HQEjYfJ.exe
  2⤵
  PID:7952
- C:\Windows\System\bAaLXgI.exe
  C:\Windows\System\bAaLXgI.exe
  2⤵
  PID:7984
- C:\Windows\System\YKNXNVm.exe
  C:\Windows\System\YKNXNVm.exe
  2⤵
  PID:8004
- C:\Windows\System\OqoMwHC.exe
  C:\Windows\System\OqoMwHC.exe
  2⤵
  PID:8040
- C:\Windows\System\xYqUGCq.exe
  C:\Windows\System\xYqUGCq.exe
  2⤵
  PID:8064
- C:\Windows\System\tquoHQb.exe
  C:\Windows\System\tquoHQb.exe
  2⤵
  PID:8096
- C:\Windows\System\WYQlCDu.exe
  C:\Windows\System\WYQlCDu.exe
  2⤵
  PID:8124
- C:\Windows\System\AALwQKd.exe
  C:\Windows\System\AALwQKd.exe
  2⤵
  PID:8144
- C:\Windows\System\FDRZcGb.exe
  C:\Windows\System\FDRZcGb.exe
  2⤵
  PID:8172
- C:\Windows\System\XWfwruG.exe
  C:\Windows\System\XWfwruG.exe
  2⤵
  PID:7188
- C:\Windows\System\qHwYWwk.exe
  C:\Windows\System\qHwYWwk.exe
  2⤵
  PID:1356
- C:\Windows\System\BtlHsaP.exe
  C:\Windows\System\BtlHsaP.exe
  2⤵
  PID:7260
- C:\Windows\System\rMevujX.exe
  C:\Windows\System\rMevujX.exe
  2⤵
  PID:7324
- C:\Windows\System\PohSGVJ.exe
  C:\Windows\System\PohSGVJ.exe
  2⤵
  PID:7384
- C:\Windows\System\kPNyNfX.exe
  C:\Windows\System\kPNyNfX.exe
  2⤵
  PID:7456
- C:\Windows\System\uZxOFrz.exe
  C:\Windows\System\uZxOFrz.exe
  2⤵
  PID:7516
- C:\Windows\System\cihecWY.exe
  C:\Windows\System\cihecWY.exe
  2⤵
  PID:7576
- C:\Windows\System\FzOYrMj.exe
  C:\Windows\System\FzOYrMj.exe
  2⤵
  PID:7628
- C:\Windows\System\evqULGX.exe
  C:\Windows\System\evqULGX.exe
  2⤵
  PID:7712
- C:\Windows\System\wbRdGZr.exe
  C:\Windows\System\wbRdGZr.exe
  2⤵
  PID:7804
- C:\Windows\System\ihNBHPJ.exe
  C:\Windows\System\ihNBHPJ.exe
  2⤵
  PID:7908
- C:\Windows\System\aSzbeSg.exe
  C:\Windows\System\aSzbeSg.exe
  2⤵
  PID:7972
- C:\Windows\System\OPdtnGJ.exe
  C:\Windows\System\OPdtnGJ.exe
  2⤵
  PID:8048
- C:\Windows\System\DSoKYsy.exe
  C:\Windows\System\DSoKYsy.exe
  2⤵
  PID:8108
- C:\Windows\System\idjMDFz.exe
  C:\Windows\System\idjMDFz.exe
  2⤵
  PID:8168
- C:\Windows\System\aSZwYHp.exe
  C:\Windows\System\aSZwYHp.exe
  2⤵
  PID:1220
- C:\Windows\System\lbZKWVA.exe
  C:\Windows\System\lbZKWVA.exe
  2⤵
  PID:7348
- C:\Windows\System\FqGdKjc.exe
  C:\Windows\System\FqGdKjc.exe
  2⤵
  PID:7492
- C:\Windows\System\rzjKavn.exe
  C:\Windows\System\rzjKavn.exe
  2⤵
  PID:2092
- C:\Windows\System\pqhjyIe.exe
  C:\Windows\System\pqhjyIe.exe
  2⤵
  PID:7832
- C:\Windows\System\szjplUF.exe
  C:\Windows\System\szjplUF.exe
  2⤵
  PID:8000
- C:\Windows\System\zquHmYM.exe
  C:\Windows\System\zquHmYM.exe
  2⤵
  PID:8156
- C:\Windows\System\WqUlJtp.exe
  C:\Windows\System\WqUlJtp.exe
  2⤵
  PID:1416
- C:\Windows\System\NWwlvey.exe
  C:\Windows\System\NWwlvey.exe
  2⤵
  PID:7688
- C:\Windows\System\TYEjbvx.exe
  C:\Windows\System\TYEjbvx.exe
  2⤵
  PID:8104
- C:\Windows\System\VtfWTWy.exe
  C:\Windows\System\VtfWTWy.exe
  2⤵
  PID:6980
- C:\Windows\System\siVFbMx.exe
  C:\Windows\System\siVFbMx.exe
  2⤵
  PID:8072
- C:\Windows\System\CGgIVpa.exe
  C:\Windows\System\CGgIVpa.exe
  2⤵
  PID:8212
- C:\Windows\System\hrGPQZf.exe
  C:\Windows\System\hrGPQZf.exe
  2⤵
  PID:8240
- C:\Windows\System\XwymMnO.exe
  C:\Windows\System\XwymMnO.exe
  2⤵
  PID:8268
- C:\Windows\System\xXRtIdV.exe
  C:\Windows\System\xXRtIdV.exe
  2⤵
  PID:8304
- C:\Windows\System\KPhescM.exe
  C:\Windows\System\KPhescM.exe
  2⤵
  PID:8324
- C:\Windows\System\okCRRsB.exe
  C:\Windows\System\okCRRsB.exe
  2⤵
  PID:8352
- C:\Windows\System\bfIzsoi.exe
  C:\Windows\System\bfIzsoi.exe
  2⤵
  PID:8380
- C:\Windows\System\OBVsTlv.exe
  C:\Windows\System\OBVsTlv.exe
  2⤵
  PID:8408
- C:\Windows\System\puCHrbW.exe
  C:\Windows\System\puCHrbW.exe
  2⤵
  PID:8436
- C:\Windows\System\hKCCMXz.exe
  C:\Windows\System\hKCCMXz.exe
  2⤵
  PID:8464
- C:\Windows\System\dVqndhd.exe
  C:\Windows\System\dVqndhd.exe
  2⤵
  PID:8492
- C:\Windows\System\npYdjMs.exe
  C:\Windows\System\npYdjMs.exe
  2⤵
  PID:8520
- C:\Windows\System\QmCnzzT.exe
  C:\Windows\System\QmCnzzT.exe
  2⤵
  PID:8548
- C:\Windows\System\vRKnWxc.exe
  C:\Windows\System\vRKnWxc.exe
  2⤵
  PID:8576
- C:\Windows\System\EDwLBhl.exe
  C:\Windows\System\EDwLBhl.exe
  2⤵
  PID:8604
- C:\Windows\System\gABMjUz.exe
  C:\Windows\System\gABMjUz.exe
  2⤵
  PID:8632
- C:\Windows\System\lBCPegF.exe
  C:\Windows\System\lBCPegF.exe
  2⤵
  PID:8660
- C:\Windows\System\yzhAZrd.exe
  C:\Windows\System\yzhAZrd.exe
  2⤵
  PID:8696
- C:\Windows\System\OKsJPDd.exe
  C:\Windows\System\OKsJPDd.exe
  2⤵
  PID:8724
- C:\Windows\System\zWKkenn.exe
  C:\Windows\System\zWKkenn.exe
  2⤵
  PID:8752
- C:\Windows\System\KJdFZpe.exe
  C:\Windows\System\KJdFZpe.exe
  2⤵
  PID:8780
- C:\Windows\System\FmwgNdr.exe
  C:\Windows\System\FmwgNdr.exe
  2⤵
  PID:8808
- C:\Windows\System\gvouFSP.exe
  C:\Windows\System\gvouFSP.exe
  2⤵
  PID:8836
- C:\Windows\System\tzSqFJA.exe
  C:\Windows\System\tzSqFJA.exe
  2⤵
  PID:8868
- C:\Windows\System\bOupyfE.exe
  C:\Windows\System\bOupyfE.exe
  2⤵
  PID:8896
- C:\Windows\System\pMECUHK.exe
  C:\Windows\System\pMECUHK.exe
  2⤵
  PID:8924
- C:\Windows\System\stWcHvH.exe
  C:\Windows\System\stWcHvH.exe
  2⤵
  PID:8952
- C:\Windows\System\cicrmSQ.exe
  C:\Windows\System\cicrmSQ.exe
  2⤵
  PID:8980
- C:\Windows\System\WBiNAgh.exe
  C:\Windows\System\WBiNAgh.exe
  2⤵
  PID:9008
- C:\Windows\System\tyFlHKh.exe
  C:\Windows\System\tyFlHKh.exe
  2⤵
  PID:9036
- C:\Windows\System\NSRTltA.exe
  C:\Windows\System\NSRTltA.exe
  2⤵
  PID:9064
- C:\Windows\System\EKlZwMw.exe
  C:\Windows\System\EKlZwMw.exe
  2⤵
  PID:9092
- C:\Windows\System\EkteSpS.exe
  C:\Windows\System\EkteSpS.exe
  2⤵
  PID:9120
- C:\Windows\System\rYynXCY.exe
  C:\Windows\System\rYynXCY.exe
  2⤵
  PID:9148
- C:\Windows\System\GbjgNzq.exe
  C:\Windows\System\GbjgNzq.exe
  2⤵
  PID:9176
- C:\Windows\System\eYXYmVV.exe
  C:\Windows\System\eYXYmVV.exe
  2⤵
  PID:9204
- C:\Windows\System\zVYTFjZ.exe
  C:\Windows\System\zVYTFjZ.exe
  2⤵
  PID:8232
- C:\Windows\System\zuIlmWw.exe
  C:\Windows\System\zuIlmWw.exe
  2⤵
  PID:8292
- C:\Windows\System\KZEguDB.exe
  C:\Windows\System\KZEguDB.exe
  2⤵
  PID:8364
- C:\Windows\System\myAXrTt.exe
  C:\Windows\System\myAXrTt.exe
  2⤵
  PID:8400
- C:\Windows\System\xqUknMp.exe
  C:\Windows\System\xqUknMp.exe
  2⤵
  PID:8456
- C:\Windows\System\GpJpTqU.exe
  C:\Windows\System\GpJpTqU.exe
  2⤵
  PID:8516
- C:\Windows\System\XyLWykX.exe
  C:\Windows\System\XyLWykX.exe
  2⤵
  PID:8588
- C:\Windows\System\pmRFhHV.exe
  C:\Windows\System\pmRFhHV.exe
  2⤵
  PID:8652
- C:\Windows\System\OynVxZr.exe
  C:\Windows\System\OynVxZr.exe
  2⤵
  PID:8720
- C:\Windows\System\ZNdVsIr.exe
  C:\Windows\System\ZNdVsIr.exe
  2⤵
  PID:8792
- C:\Windows\System\fXwmtlS.exe
  C:\Windows\System\fXwmtlS.exe
  2⤵
  PID:8860
- C:\Windows\System\WKPbZBB.exe
  C:\Windows\System\WKPbZBB.exe
  2⤵
  PID:8920
- C:\Windows\System\PbmciGG.exe
  C:\Windows\System\PbmciGG.exe
  2⤵
  PID:8964
- C:\Windows\System\XmhkftU.exe
  C:\Windows\System\XmhkftU.exe
  2⤵
  PID:9056
- C:\Windows\System\maYYqzq.exe
  C:\Windows\System\maYYqzq.exe
  2⤵
  PID:9116
- C:\Windows\System\XWDtHJe.exe
  C:\Windows\System\XWDtHJe.exe
  2⤵
  PID:9188
- C:\Windows\System\yoIucSI.exe
  C:\Windows\System\yoIucSI.exe
  2⤵
  PID:8280
- C:\Windows\System\oEFDOyC.exe
  C:\Windows\System\oEFDOyC.exe
  2⤵
  PID:2424
- C:\Windows\System\FCWepER.exe
  C:\Windows\System\FCWepER.exe
  2⤵
  PID:8512
- C:\Windows\System\WwHeWrO.exe
  C:\Windows\System\WwHeWrO.exe
  2⤵
  PID:8688
- C:\Windows\System\FvdWMze.exe
  C:\Windows\System\FvdWMze.exe
  2⤵
  PID:8848
- C:\Windows\System\remGjsb.exe
  C:\Windows\System\remGjsb.exe
  2⤵
  PID:9020
- C:\Windows\System\JPkZGqq.exe
  C:\Windows\System\JPkZGqq.exe
  2⤵
  PID:9168
- C:\Windows\System\DRcdQmq.exe
  C:\Windows\System\DRcdQmq.exe
  2⤵
  PID:3932
- C:\Windows\System\HQLnsLH.exe
  C:\Windows\System\HQLnsLH.exe
  2⤵
  PID:8572
- C:\Windows\System\EVcsFSA.exe
  C:\Windows\System\EVcsFSA.exe
  2⤵
  PID:8948
- C:\Windows\System\qcuoHFI.exe
  C:\Windows\System\qcuoHFI.exe
  2⤵
  PID:8484
- C:\Windows\System\nWdGHBd.exe
  C:\Windows\System\nWdGHBd.exe
  2⤵
  PID:8392
- C:\Windows\System\PzRzPag.exe
  C:\Windows\System\PzRzPag.exe
  2⤵
  PID:9240
- C:\Windows\System\YoAgoBl.exe
  C:\Windows\System\YoAgoBl.exe
  2⤵
  PID:9268
- C:\Windows\System\bsZghxH.exe
  C:\Windows\System\bsZghxH.exe
  2⤵
  PID:9296
- C:\Windows\System\UfxaMgv.exe
  C:\Windows\System\UfxaMgv.exe
  2⤵
  PID:9328
- C:\Windows\System\LZTvLTq.exe
  C:\Windows\System\LZTvLTq.exe
  2⤵
  PID:9356
- C:\Windows\System\vRRMzKM.exe
  C:\Windows\System\vRRMzKM.exe
  2⤵
  PID:9384
- C:\Windows\System\kRnMXbh.exe
  C:\Windows\System\kRnMXbh.exe
  2⤵
  PID:9412
- C:\Windows\System\nDKuQPd.exe
  C:\Windows\System\nDKuQPd.exe
  2⤵
  PID:9440
- C:\Windows\System\eVJtQAT.exe
  C:\Windows\System\eVJtQAT.exe
  2⤵
  PID:9468
- C:\Windows\System\MnWGQGW.exe
  C:\Windows\System\MnWGQGW.exe
  2⤵
  PID:9496
- C:\Windows\System\KcJIDBM.exe
  C:\Windows\System\KcJIDBM.exe
  2⤵
  PID:9524
- C:\Windows\System\AnvgVDa.exe
  C:\Windows\System\AnvgVDa.exe
  2⤵
  PID:9548
- C:\Windows\System\bVtTkmX.exe
  C:\Windows\System\bVtTkmX.exe
  2⤵
  PID:9580
- C:\Windows\System\FMJrDGE.exe
  C:\Windows\System\FMJrDGE.exe
  2⤵
  PID:9608
- C:\Windows\System\BTZDfAn.exe
  C:\Windows\System\BTZDfAn.exe
  2⤵
  PID:9636
- C:\Windows\System\UkYbGWh.exe
  C:\Windows\System\UkYbGWh.exe
  2⤵
  PID:9664
- C:\Windows\System\AdfOcEK.exe
  C:\Windows\System\AdfOcEK.exe
  2⤵
  PID:9704
- C:\Windows\System\xaBtQHJ.exe
  C:\Windows\System\xaBtQHJ.exe
  2⤵
  PID:9720
- C:\Windows\System\UeMpdLh.exe
  C:\Windows\System\UeMpdLh.exe
  2⤵
  PID:9756
- C:\Windows\System\SGJjhAh.exe
  C:\Windows\System\SGJjhAh.exe
  2⤵
  PID:9784
- C:\Windows\System\CKtRODM.exe
  C:\Windows\System\CKtRODM.exe
  2⤵
  PID:9816
- C:\Windows\System\pamTsSB.exe
  C:\Windows\System\pamTsSB.exe
  2⤵
  PID:9848
- C:\Windows\System\jwAXJdG.exe
  C:\Windows\System\jwAXJdG.exe
  2⤵
  PID:9876
- C:\Windows\System\eoOJtTr.exe
  C:\Windows\System\eoOJtTr.exe
  2⤵
  PID:9932
- C:\Windows\System\fpGFJQN.exe
  C:\Windows\System\fpGFJQN.exe
  2⤵
  PID:9980
- C:\Windows\System\JpwsXSP.exe
  C:\Windows\System\JpwsXSP.exe
  2⤵
  PID:9996
- C:\Windows\System\KgFKosb.exe
  C:\Windows\System\KgFKosb.exe
  2⤵
  PID:10028
- C:\Windows\System\AXBPuNe.exe
  C:\Windows\System\AXBPuNe.exe
  2⤵
  PID:10100
- C:\Windows\System\KfwygTi.exe
  C:\Windows\System\KfwygTi.exe
  2⤵
  PID:10132
- C:\Windows\System\exBqiTp.exe
  C:\Windows\System\exBqiTp.exe
  2⤵
  PID:10160
- C:\Windows\System\sMmTwDR.exe
  C:\Windows\System\sMmTwDR.exe
  2⤵
  PID:10192
- C:\Windows\System\cYCjeAy.exe
  C:\Windows\System\cYCjeAy.exe
  2⤵
  PID:10224
- C:\Windows\System\mNwPCWw.exe
  C:\Windows\System\mNwPCWw.exe
  2⤵
  PID:9280
- C:\Windows\System\QhrzLcK.exe
  C:\Windows\System\QhrzLcK.exe
  2⤵
  PID:9320
- C:\Windows\System\cfotefD.exe
  C:\Windows\System\cfotefD.exe
  2⤵
  PID:9368
- C:\Windows\System\bnWDGtW.exe
  C:\Windows\System\bnWDGtW.exe
  2⤵
  PID:9404
- C:\Windows\System\xGjUuSZ.exe
  C:\Windows\System\xGjUuSZ.exe
  2⤵
  PID:9460
- C:\Windows\System\rHUugou.exe
  C:\Windows\System\rHUugou.exe
  2⤵
  PID:9536
- C:\Windows\System\BQcFxEJ.exe
  C:\Windows\System\BQcFxEJ.exe
  2⤵
  PID:9592
- C:\Windows\System\aJckcGX.exe
  C:\Windows\System\aJckcGX.exe
  2⤵
  PID:9716
- C:\Windows\System\pCTWizo.exe
  C:\Windows\System\pCTWizo.exe
  2⤵
  PID:9776
- C:\Windows\System\iRLuYNs.exe
  C:\Windows\System\iRLuYNs.exe
  2⤵
  PID:9908
- C:\Windows\System\AzDsxkM.exe
  C:\Windows\System\AzDsxkM.exe
  2⤵
  PID:9992
- C:\Windows\System\qkUwMxA.exe
  C:\Windows\System\qkUwMxA.exe
  2⤵
  PID:10128
- C:\Windows\System\YVxclZb.exe
  C:\Windows\System\YVxclZb.exe
  2⤵
  PID:10204
- C:\Windows\System\rtsJDzI.exe
  C:\Windows\System\rtsJDzI.exe
  2⤵
  PID:9488
- C:\Windows\System\GGrsegf.exe
  C:\Windows\System\GGrsegf.exe
  2⤵
  PID:9396
- C:\Windows\System\PZUaDjp.exe
  C:\Windows\System\PZUaDjp.exe
  2⤵
  PID:9572
- C:\Windows\System\rexhPGK.exe
  C:\Windows\System\rexhPGK.exe
  2⤵
  PID:9676
- C:\Windows\System\NTlIJSn.exe
  C:\Windows\System\NTlIJSn.exe
  2⤵
  PID:10020
- C:\Windows\System\bDXkwdG.exe
  C:\Windows\System\bDXkwdG.exe
  2⤵
  PID:10180
- C:\Windows\System\MSnpFKk.exe
  C:\Windows\System\MSnpFKk.exe
  2⤵
  PID:9352
- C:\Windows\System\TrELbcE.exe
  C:\Windows\System\TrELbcE.exe
  2⤵
  PID:9944
- C:\Windows\System\iMpAovq.exe
  C:\Windows\System\iMpAovq.exe
  2⤵
  PID:10144
- C:\Windows\System\jRjwhNZ.exe
  C:\Windows\System\jRjwhNZ.exe
  2⤵
  PID:10176
- C:\Windows\System\OKqfGdp.exe
  C:\Windows\System\OKqfGdp.exe
  2⤵
  PID:10272
- C:\Windows\System\VztRAPc.exe
  C:\Windows\System\VztRAPc.exe
  2⤵
  PID:10288
- C:\Windows\System\oRjIojy.exe
  C:\Windows\System\oRjIojy.exe
  2⤵
  PID:10328
- C:\Windows\System\wVYcBGh.exe
  C:\Windows\System\wVYcBGh.exe
  2⤵
  PID:10356
- C:\Windows\System\rwhtwgh.exe
  C:\Windows\System\rwhtwgh.exe
  2⤵
  PID:10384
- C:\Windows\System\uvEiTjA.exe
  C:\Windows\System\uvEiTjA.exe
  2⤵
  PID:10400
- C:\Windows\System\dRYeAty.exe
  C:\Windows\System\dRYeAty.exe
  2⤵
  PID:10428
- C:\Windows\System\TqNBkQr.exe
  C:\Windows\System\TqNBkQr.exe
  2⤵
  PID:10468
- C:\Windows\System\zyrVOtF.exe
  C:\Windows\System\zyrVOtF.exe
  2⤵
  PID:10496
- C:\Windows\System\qDHKSvp.exe
  C:\Windows\System\qDHKSvp.exe
  2⤵
  PID:10512
- C:\Windows\System\QJnScgA.exe
  C:\Windows\System\QJnScgA.exe
  2⤵
  PID:10540
- C:\Windows\System\sImVZnE.exe
  C:\Windows\System\sImVZnE.exe
  2⤵
  PID:10580
- C:\Windows\System\vtZPywC.exe
  C:\Windows\System\vtZPywC.exe
  2⤵
  PID:10608
- C:\Windows\System\CIDJqqP.exe
  C:\Windows\System\CIDJqqP.exe
  2⤵
  PID:10636
- C:\Windows\System\MqvOnkt.exe
  C:\Windows\System\MqvOnkt.exe
  2⤵
  PID:10664
- C:\Windows\System\ztCwyXO.exe
  C:\Windows\System\ztCwyXO.exe
  2⤵
  PID:10692
- C:\Windows\System\JeiKIrz.exe
  C:\Windows\System\JeiKIrz.exe
  2⤵
  PID:10720
- C:\Windows\System\OPIrDaT.exe
  C:\Windows\System\OPIrDaT.exe
  2⤵
  PID:10748
- C:\Windows\System\QhZXvzs.exe
  C:\Windows\System\QhZXvzs.exe
  2⤵
  PID:10776
- C:\Windows\System\MTSKQZb.exe
  C:\Windows\System\MTSKQZb.exe
  2⤵
  PID:10804
- C:\Windows\System\tbvDpzb.exe
  C:\Windows\System\tbvDpzb.exe
  2⤵
  PID:10832
- C:\Windows\System\ksXEAHL.exe
  C:\Windows\System\ksXEAHL.exe
  2⤵
  PID:10852
- C:\Windows\System\iFcUGYL.exe
  C:\Windows\System\iFcUGYL.exe
  2⤵
  PID:10888
- C:\Windows\System\FdGmzVv.exe
  C:\Windows\System\FdGmzVv.exe
  2⤵
  PID:10908
- C:\Windows\System\yhOrFzX.exe
  C:\Windows\System\yhOrFzX.exe
  2⤵
  PID:10948
- C:\Windows\System\tjwxzQS.exe
  C:\Windows\System\tjwxzQS.exe
  2⤵
  PID:10976
- C:\Windows\System\iznwaiA.exe
  C:\Windows\System\iznwaiA.exe
  2⤵
  PID:10996
- C:\Windows\System\LDNwWKd.exe
  C:\Windows\System\LDNwWKd.exe
  2⤵
  PID:11020
- C:\Windows\System\wdzVeBK.exe
  C:\Windows\System\wdzVeBK.exe
  2⤵
  PID:11060
- C:\Windows\System\YPSSyMF.exe
  C:\Windows\System\YPSSyMF.exe
  2⤵
  PID:11076
- C:\Windows\System\lVFWIzo.exe
  C:\Windows\System\lVFWIzo.exe
  2⤵
  PID:11096
- C:\Windows\System\JcNIOxa.exe
  C:\Windows\System\JcNIOxa.exe
  2⤵
  PID:11144
- C:\Windows\System\tSUtEnf.exe
  C:\Windows\System\tSUtEnf.exe
  2⤵
  PID:11172
- C:\Windows\System\GXqbdGg.exe
  C:\Windows\System\GXqbdGg.exe
  2⤵
  PID:11200
- C:\Windows\System\GXyjNZQ.exe
  C:\Windows\System\GXyjNZQ.exe
  2⤵
  PID:11216
- C:\Windows\System\KcaSdIc.exe
  C:\Windows\System\KcaSdIc.exe
  2⤵
  PID:11248
- C:\Windows\System\HPFTOhi.exe
  C:\Windows\System\HPFTOhi.exe
  2⤵
  PID:10244
- C:\Windows\System\DusTbMb.exe
  C:\Windows\System\DusTbMb.exe
  2⤵
  PID:10324
- C:\Windows\System\vOZnOIb.exe
  C:\Windows\System\vOZnOIb.exe
  2⤵
  PID:10380
- C:\Windows\System\KJvmkis.exe
  C:\Windows\System\KJvmkis.exe
  2⤵
  PID:10424
- C:\Windows\System\ZyRyzvQ.exe
  C:\Windows\System\ZyRyzvQ.exe
  2⤵
  PID:10492
- C:\Windows\System\vMQIcbQ.exe
  C:\Windows\System\vMQIcbQ.exe
  2⤵
  PID:10576
- C:\Windows\System\vThhKUl.exe
  C:\Windows\System\vThhKUl.exe
  2⤵
  PID:10660
- C:\Windows\System\XHgwiBo.exe
  C:\Windows\System\XHgwiBo.exe
  2⤵
  PID:10712
- C:\Windows\System\bNwpalx.exe
  C:\Windows\System\bNwpalx.exe
  2⤵
  PID:10788
- C:\Windows\System\FXYfXDE.exe
  C:\Windows\System\FXYfXDE.exe
  2⤵
  PID:10840
- C:\Windows\System\yetKCSG.exe
  C:\Windows\System\yetKCSG.exe
  2⤵
  PID:10900
- C:\Windows\System\EKPFpPv.exe
  C:\Windows\System\EKPFpPv.exe
  2⤵
  PID:10972
- C:\Windows\System\uULigAx.exe
  C:\Windows\System\uULigAx.exe
  2⤵
  PID:11048
- C:\Windows\System\JmGENXY.exe
  C:\Windows\System\JmGENXY.exe
  2⤵
  PID:11104
- C:\Windows\System\yJGRwOZ.exe
  C:\Windows\System\yJGRwOZ.exe
  2⤵
  PID:11156
- C:\Windows\System\vBOnczh.exe
  C:\Windows\System\vBOnczh.exe
  2⤵
  PID:11236
- C:\Windows\System\OekjgLu.exe
  C:\Windows\System\OekjgLu.exe
  2⤵
  PID:10280
- C:\Windows\System\EtWExUr.exe
  C:\Windows\System\EtWExUr.exe
  2⤵
  PID:10488
- C:\Windows\System\YArqufI.exe
  C:\Windows\System\YArqufI.exe
  2⤵
  PID:10572
- C:\Windows\System\bsqAEBy.exe
  C:\Windows\System\bsqAEBy.exe
  2⤵
  PID:10772
- C:\Windows\System\JkTzLql.exe
  C:\Windows\System\JkTzLql.exe
  2⤵
  PID:10880
- C:\Windows\System\GUVetfw.exe
  C:\Windows\System\GUVetfw.exe
  2⤵
  PID:11032
- C:\Windows\System\wbSCjKz.exe
  C:\Windows\System\wbSCjKz.exe
  2⤵
  PID:11184
- C:\Windows\System\ckvhddS.exe
  C:\Windows\System\ckvhddS.exe
  2⤵
  PID:10552
- C:\Windows\System\fgACgjf.exe
  C:\Windows\System\fgACgjf.exe
  2⤵
  PID:10740
- C:\Windows\System\SCvlJkv.exe
  C:\Windows\System\SCvlJkv.exe
  2⤵
  PID:11004
- C:\Windows\System\HutouIh.exe
  C:\Windows\System\HutouIh.exe
  2⤵
  PID:10652
- C:\Windows\System\tOnFjEu.exe
  C:\Windows\System\tOnFjEu.exe
  2⤵
  PID:11084
- C:\Windows\System\bYvKpLU.exe
  C:\Windows\System\bYvKpLU.exe
  2⤵
  PID:11276
- C:\Windows\System\fadIBzt.exe
  C:\Windows\System\fadIBzt.exe
  2⤵
  PID:11304
- C:\Windows\System\mVmkood.exe
  C:\Windows\System\mVmkood.exe
  2⤵
  PID:11332
- C:\Windows\System\IfGoIyU.exe
  C:\Windows\System\IfGoIyU.exe
  2⤵
  PID:11372
- C:\Windows\System\uZqpJuO.exe
  C:\Windows\System\uZqpJuO.exe
  2⤵
  PID:11392
- C:\Windows\System\VuPemxV.exe
  C:\Windows\System\VuPemxV.exe
  2⤵
  PID:11412
- C:\Windows\System\sXUvxll.exe
  C:\Windows\System\sXUvxll.exe
  2⤵
  PID:11460
- C:\Windows\System\GictKTV.exe
  C:\Windows\System\GictKTV.exe
  2⤵
  PID:11480
- C:\Windows\System\JXgiMrB.exe
  C:\Windows\System\JXgiMrB.exe
  2⤵
  PID:11516
- C:\Windows\System\pSIZKhI.exe
  C:\Windows\System\pSIZKhI.exe
  2⤵
  PID:11532
- C:\Windows\System\pfpHOKO.exe
  C:\Windows\System\pfpHOKO.exe
  2⤵
  PID:11560
- C:\Windows\System\awhKVCR.exe
  C:\Windows\System\awhKVCR.exe
  2⤵
  PID:11596
- C:\Windows\System\sqOLZJQ.exe
  C:\Windows\System\sqOLZJQ.exe
  2⤵
  PID:11616
- C:\Windows\System\uzykcTE.exe
  C:\Windows\System\uzykcTE.exe
  2⤵
  PID:11632
- C:\Windows\System\pFVdoPY.exe
  C:\Windows\System\pFVdoPY.exe
  2⤵
  PID:11664
- C:\Windows\System\hoOsfzh.exe
  C:\Windows\System\hoOsfzh.exe
  2⤵
  PID:11700
- C:\Windows\System\lKHzkuS.exe
  C:\Windows\System\lKHzkuS.exe
  2⤵
  PID:11720
- C:\Windows\System\JDnxYsV.exe
  C:\Windows\System\JDnxYsV.exe
  2⤵
  PID:11752
- C:\Windows\System\dDSGQXT.exe
  C:\Windows\System\dDSGQXT.exe
  2⤵
  PID:11796
- C:\Windows\System\EAKfcyO.exe
  C:\Windows\System\EAKfcyO.exe
  2⤵
  PID:11820
- C:\Windows\System\QNbBRQp.exe
  C:\Windows\System\QNbBRQp.exe
  2⤵
  PID:11840
- C:\Windows\System\eIbDsIv.exe
  C:\Windows\System\eIbDsIv.exe
  2⤵
  PID:11868
- C:\Windows\System\DtHTCGA.exe
  C:\Windows\System\DtHTCGA.exe
  2⤵
  PID:11896
- C:\Windows\System\gXLUndp.exe
  C:\Windows\System\gXLUndp.exe
  2⤵
  PID:11932
- C:\Windows\System\tiWgwSB.exe
  C:\Windows\System\tiWgwSB.exe
  2⤵
  PID:11952
- C:\Windows\System\NYqAkdH.exe
  C:\Windows\System\NYqAkdH.exe
  2⤵
  PID:11984
- C:\Windows\System\nIQJMLA.exe
  C:\Windows\System\nIQJMLA.exe
  2⤵
  PID:12008
- C:\Windows\System\LRxITYB.exe
  C:\Windows\System\LRxITYB.exe
  2⤵
  PID:12036
- C:\Windows\System\xPabnCc.exe
  C:\Windows\System\xPabnCc.exe
  2⤵
  PID:12076
- C:\Windows\System\jMaRegL.exe
  C:\Windows\System\jMaRegL.exe
  2⤵
  PID:12120
- C:\Windows\System\jrDctxp.exe
  C:\Windows\System\jrDctxp.exe
  2⤵
  PID:12136
- C:\Windows\System\PXxxUhJ.exe
  C:\Windows\System\PXxxUhJ.exe
  2⤵
  PID:12156
- C:\Windows\System\NwUCfti.exe
  C:\Windows\System\NwUCfti.exe
  2⤵
  PID:12192
- C:\Windows\System\sbSOSJd.exe
  C:\Windows\System\sbSOSJd.exe
  2⤵
  PID:12208
- C:\Windows\System\cNiXDyB.exe
  C:\Windows\System\cNiXDyB.exe
  2⤵
  PID:12240
- C:\Windows\System\mlhLxDl.exe
  C:\Windows\System\mlhLxDl.exe
  2⤵
  PID:12264
- C:\Windows\System\exKeAyA.exe
  C:\Windows\System\exKeAyA.exe
  2⤵
  PID:11268
- C:\Windows\System\BOOnVrx.exe
  C:\Windows\System\BOOnVrx.exe
  2⤵
  PID:11324
- C:\Windows\System\KedUPfc.exe
  C:\Windows\System\KedUPfc.exe
  2⤵
  PID:11368
- C:\Windows\System\vhBclCw.exe
  C:\Windows\System\vhBclCw.exe
  2⤵
  PID:11476
- C:\Windows\System\rarbrBS.exe
  C:\Windows\System\rarbrBS.exe
  2⤵
  PID:11528
- C:\Windows\System\slnhXlK.exe
  C:\Windows\System\slnhXlK.exe
  2⤵
  PID:11624
- C:\Windows\System\GZqswzE.exe
  C:\Windows\System\GZqswzE.exe
  2⤵
  PID:11648
- C:\Windows\System\kMWINyV.exe
  C:\Windows\System\kMWINyV.exe
  2⤵
  PID:11732
- C:\Windows\System\KVXHMGG.exe
  C:\Windows\System\KVXHMGG.exe
  2⤵
  PID:11764
- C:\Windows\System\dlwYCEw.exe
  C:\Windows\System\dlwYCEw.exe
  2⤵
  PID:11836
- C:\Windows\System\pVxCphc.exe
  C:\Windows\System\pVxCphc.exe
  2⤵
  PID:11944
- C:\Windows\System\CaPJblg.exe
  C:\Windows\System\CaPJblg.exe
  2⤵
  PID:11992
- C:\Windows\System\gvrarRk.exe
  C:\Windows\System\gvrarRk.exe
  2⤵
  PID:12084
- C:\Windows\System\MrVxCkj.exe
  C:\Windows\System\MrVxCkj.exe
  2⤵
  PID:12144
- C:\Windows\System\gZQpzhu.exe
  C:\Windows\System\gZQpzhu.exe
  2⤵
  PID:12204
- C:\Windows\System\LUKACEi.exe
  C:\Windows\System\LUKACEi.exe
  2⤵
  PID:12252
- C:\Windows\System\KpIRphF.exe
  C:\Windows\System\KpIRphF.exe
  2⤵
  PID:11400
- C:\Windows\System\UGteImY.exe
  C:\Windows\System\UGteImY.exe
  2⤵
  PID:11612
- C:\Windows\System\YpitSYq.exe
  C:\Windows\System\YpitSYq.exe
  2⤵
  PID:11708
- C:\Windows\System\ctupguo.exe
  C:\Windows\System\ctupguo.exe
  2⤵
  PID:11804
- C:\Windows\System\xnwubFC.exe
  C:\Windows\System\xnwubFC.exe
  2⤵
  PID:12072
- C:\Windows\System\sEAzIwt.exe
  C:\Windows\System\sEAzIwt.exe
  2⤵
  PID:12132
- C:\Windows\System\oBRmMBT.exe
  C:\Windows\System\oBRmMBT.exe
  2⤵
  PID:11288
- C:\Windows\System\biKgdjO.exe
  C:\Windows\System\biKgdjO.exe
  2⤵
  PID:11572
- C:\Windows\System\udwWDts.exe
  C:\Windows\System\udwWDts.exe
  2⤵
  PID:11964
- C:\Windows\System\dqUtujD.exe
  C:\Windows\System\dqUtujD.exe
  2⤵
  PID:5596
- C:\Windows\System\vTKkiHt.exe
  C:\Windows\System\vTKkiHt.exe
  2⤵
  PID:12236
- C:\Windows\System\qGkyFym.exe
  C:\Windows\System\qGkyFym.exe
  2⤵
  PID:11880
- C:\Windows\System\NrCuzvQ.exe
  C:\Windows\System\NrCuzvQ.exe
  2⤵
  PID:12176
- C:\Windows\System\BgVeHPb.exe
  C:\Windows\System\BgVeHPb.exe
  2⤵
  PID:5528
- C:\Windows\System\RGPFLgE.exe
  C:\Windows\System\RGPFLgE.exe
  2⤵
  PID:4676
- C:\Windows\System\puKTNbv.exe
  C:\Windows\System\puKTNbv.exe
  2⤵
  PID:12308
- C:\Windows\System\sojUvFp.exe
  C:\Windows\System\sojUvFp.exe
  2⤵
  PID:12344
- C:\Windows\System\WiRJUOS.exe
  C:\Windows\System\WiRJUOS.exe
  2⤵
  PID:12368
- C:\Windows\System\LNdfnqn.exe
  C:\Windows\System\LNdfnqn.exe
  2⤵
  PID:12396
- C:\Windows\System\gRMWiMh.exe
  C:\Windows\System\gRMWiMh.exe
  2⤵
  PID:12424
- C:\Windows\System\bdOIykK.exe
  C:\Windows\System\bdOIykK.exe
  2⤵
  PID:12456
- C:\Windows\System\DPJUzgp.exe
  C:\Windows\System\DPJUzgp.exe
  2⤵
  PID:12492
- C:\Windows\System\TdJxUKd.exe
  C:\Windows\System\TdJxUKd.exe
  2⤵
  PID:12508
- C:\Windows\System\xFCNARu.exe
  C:\Windows\System\xFCNARu.exe
  2⤵
  PID:12536
- C:\Windows\System\FyCjhiU.exe
  C:\Windows\System\FyCjhiU.exe
  2⤵
  PID:12556
- C:\Windows\System\KnyNxGO.exe
  C:\Windows\System\KnyNxGO.exe
  2⤵
  PID:12584
- C:\Windows\System\BiMOGqh.exe
  C:\Windows\System\BiMOGqh.exe
  2⤵
  PID:12608
- C:\Windows\System\bauXZUf.exe
  C:\Windows\System\bauXZUf.exe
  2⤵
  PID:12636
- C:\Windows\System\diHiekU.exe
  C:\Windows\System\diHiekU.exe
  2⤵
  PID:12668
- C:\Windows\System\AmGaljN.exe
  C:\Windows\System\AmGaljN.exe
  2⤵
  PID:12708
- C:\Windows\System\vWpfNOu.exe
  C:\Windows\System\vWpfNOu.exe
  2⤵
  PID:12740
- C:\Windows\System\opXgkbF.exe
  C:\Windows\System\opXgkbF.exe
  2⤵
  PID:12760
- C:\Windows\System\vuKvrxm.exe
  C:\Windows\System\vuKvrxm.exe
  2⤵
  PID:12800
- C:\Windows\System\CxVMCuw.exe
  C:\Windows\System\CxVMCuw.exe
  2⤵
  PID:12824
- C:\Windows\System\uoSTnZX.exe
  C:\Windows\System\uoSTnZX.exe
  2⤵
  PID:12856
- C:\Windows\System\KidWtfe.exe
  C:\Windows\System\KidWtfe.exe
  2⤵
  PID:12884
- C:\Windows\System\FYgkNbL.exe
  C:\Windows\System\FYgkNbL.exe
  2⤵
  PID:12900
- C:\Windows\System\pIvqVbq.exe
  C:\Windows\System\pIvqVbq.exe
  2⤵
  PID:12928
- C:\Windows\System\CWmbALc.exe
  C:\Windows\System\CWmbALc.exe
  2⤵
  PID:12968
- C:\Windows\System\tfemKEt.exe
  C:\Windows\System\tfemKEt.exe
  2⤵
  PID:12988
- C:\Windows\System\yzsRdhZ.exe
  C:\Windows\System\yzsRdhZ.exe
  2⤵
  PID:13020
- C:\Windows\System\jmMVJGs.exe
  C:\Windows\System\jmMVJGs.exe
  2⤵
  PID:13052
- C:\Windows\System\ffjJuju.exe
  C:\Windows\System\ffjJuju.exe
  2⤵
  PID:13136
- C:\Windows\System\MVCXCnA.exe
  C:\Windows\System\MVCXCnA.exe
  2⤵
  PID:13148
- C:\Windows\System\fPMkYqC.exe
  C:\Windows\System\fPMkYqC.exe
  2⤵
  PID:13188
- C:\Windows\System\kidYxnM.exe
  C:\Windows\System\kidYxnM.exe
  2⤵
  PID:13200
- C:\Windows\System\GKlKRze.exe
  C:\Windows\System\GKlKRze.exe
  2⤵
  PID:13232
- C:\Windows\System\zpuJdRA.exe
  C:\Windows\System\zpuJdRA.exe
  2⤵
  PID:10124
- C:\Windows\System\toIWUwv.exe
  C:\Windows\System\toIWUwv.exe
  2⤵
  PID:13292
- C:\Windows\System\YYUHlug.exe
  C:\Windows\System\YYUHlug.exe
  2⤵
  PID:12152
- C:\Windows\System\ZlfTDhg.exe
  C:\Windows\System\ZlfTDhg.exe
  2⤵
  PID:12364
- C:\Windows\System\ykKDISe.exe
  C:\Windows\System\ykKDISe.exe
  2⤵
  PID:12436
- C:\Windows\System\LsHKHeo.exe
  C:\Windows\System\LsHKHeo.exe
  2⤵
  PID:12484
- C:\Windows\System\ebWqDKI.exe
  C:\Windows\System\ebWqDKI.exe
  2⤵
  PID:12544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_exhoi22q.zrq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exhoi22q.zrq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BZBqCha.exe

Path C:\Windows\System\BZBqCha.exe
Size 3.0MB
SHA256 647900ad237c68f6bbad47541ea825d4e4fbea4015603e9183302c96a0bf7abb
MD5 fde68ae1aaf702f9213eab63c82e7582
SHA1 b6e4c35d9190770a21ce056d2ad90abd021ac931
SHA512 7eb38e45ed6a086307c7efb4c117f3a4d01feff34bb7e8ffb56f37443ce19918c5c279b8986d8f68be1457b3e068c289a97c71cd16c6b9bdb0408014dffc50e7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DJsYVfk.exe

Path C:\Windows\System\DJsYVfk.exe
Size 3.0MB
SHA256 586f0295da6b4cd1d4d3951c55082ec4d0c793162f0628270a7332b93cf068e2
MD5 3e2edf17c0d276198a50dc8bc04f68e7
SHA1 7a4861c3e4cf62d49be5588c2219e11def4cc58f
SHA512 f28d1bb521771ce908bfd3a7b362a66910a15dca15f79d583b5ae43b9b45641aab1701381ad2a10292f1d6b46eb04c20c06606f3794d5f808afacef54cf8ee8e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

HJFageL.exe

Path C:\Windows\System\HJFageL.exe
Size 3.0MB
SHA256 1799fbd5e9ea62fdf6bb89b89246c42c9be37059711b54eb910bd1523c8e441d
MD5 f2ce167029d1d833dadb2d9f2a94f865
SHA1 f29f48b482c76ed64848c054e6d447045191362b
SHA512 70442ce994f027d149f0545958eea468742932eec28772b8a33ac9fbea5a0c58b9d327ae321feba831d78bad0a8752581b3abf77005546135511f2367df66259
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

HvsIfvU.exe

Path C:\Windows\System\HvsIfvU.exe
Size 8B
SHA256 ada8e0c66fd35906bd1beeda81d420b6e5f6b475841d10e62bd6374afbeacb69
MD5 69a2459cf267ca53a07e1000877ec5f5
SHA1 6180fdab39e41b082a5f032106ea0881035fc630
SHA512 856cc19353d1aa3d8ce28f9d4a1fe10bf85ecb48b19883b3993f89b4192a7bd4dbaf2f158bd3e246dfcbb6a46252185b62c3e867aadc7a9e5bf0721b6b86c55b
MD5 SHA1 SHA512

Submit Download

ICJmjhK.exe

Path C:\Windows\System\ICJmjhK.exe
Size 3.0MB
SHA256 67960f489507a23b01c93bbf796ae9b7ade2d2c0905382970d82ea02a8352426
MD5 68d6d93d2615784a2bd5097b7ae9965f
SHA1 a1c8179907db948eb29461517e5c5342748c7070
SHA512 5f58782541b2aec9fe6e404b480baa4fca4a9d6ae2430bc470d8444d471aa230b26508f0d5159a02dbb3d5c33ebdabe4adef5eb3ec17891bb523aa521eaefbb5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

IhqwVWi.exe

Path C:\Windows\System\IhqwVWi.exe
Size 3.0MB
SHA256 41b89f8c65540ebd09070e4745dc601b5788f953c2d3507b06c53fdd9bf8445a
MD5 d84c453a694109204a9dc4f7e36e27ff
SHA1 89e2383c2736150df0d83a1a3f60921d0aee3953
SHA512 27d172fe2398c1b58ee1670c5ee3e32b1b160a50349b5a5fd09f781757241e24d36e104a57ff8d8e10a7093ea6124f57590c0829b7841fb6a3eadd881021b39b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWe:7bBeSFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

KxatJVD.exe

Path C:\Windows\System\KxatJVD.exe
Size 3.0MB
SHA256 2fae3f8cb752d4ca74dac897294ce1f8bf651763c9c6aa21da66156375a8c355
MD5 7795a80f5b4a5cec4a310a10f35ef5c5
SHA1 31e3e80f4b3652634ede61652f1917299457b2c4
SHA512 624138145b406aea2563f26c6fc38f2fd92d0617ebe67cb3f3b33cb436fbc3378f0193dbda82edae108b5439961803c0a424d7805918ff1d724521fb5b195aba
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW8:7bBeSFkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LmCvXwb.exe

Path C:\Windows\System\LmCvXwb.exe
Size 3.0MB
SHA256 4cb1d4a2d4da5dce81333b653c0080a504f1dce308f072d14a9e1dbac4a7e0ff
MD5 25b3f317682161b950e506ee10379b6d
SHA1 e0665d1130ff6d802d56346a949c9ae32e0ed3db
SHA512 8a090af4383cc869da933a0268c7d670ed4f3eb7824de3ed2c5b26cd9a1fb49d54ce8680adfefcdcc46b7d7223f87737e2a821cf14627988bf1b21d45946983a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MGwImbV.exe

Path C:\Windows\System\MGwImbV.exe
Size 3.0MB
SHA256 ffe0467fbf87a38b8e46504251d6c19704360a2217e6fdc8dc252584b4f8e865
MD5 54d4938188c5f22adac50943d006dbed
SHA1 d312cfc23a179b6fac650f992bea76aaf49c6439
SHA512 04a84a45f29948a58c42fef2f654e585b15fb3677a337cf85aab260f1763227bf21767f0e442d11df569255ed5ca9673ffe6f8aab17a72bf466fbdc72034eda5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MaDlOqF.exe

Path C:\Windows\System\MaDlOqF.exe
Size 3.0MB
SHA256 4845620156bd944c7eb0e65c9a15b377f907a02d36e78e203d6be28cdb27e225
MD5 2357ae46405a6d7d207052cd0ba9a97e
SHA1 be9ad49819da5db1e95af4a2c8b78f29604c8b05
SHA512 b870bde5b285110ff17672f80674d45e7886a589ea28b90aae62291d54ebcc3b1974709f6d9ab317df6f978ac38c29d123009844b1a00c0f05068a547dd2cccc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

NpBWsuh.exe

Path C:\Windows\System\NpBWsuh.exe
Size 3.0MB
SHA256 e3cbb7d84a825aab8c2fd926ce246aedcf1d71bc477a04ffb3420ce228d60b1b
MD5 3695eadfe2fa031785c8382b134c4b5b
SHA1 eaf07d0a19bfb3df9890e50feb207fb59481b836
SHA512 0f645c56d1b18d7a860d6abab7a1eeb54585d724d07c6cef90a0e2faf80b87b7a044f7799b224b0bbac5a8ab2e107464a5e92dff67d54dea4191d314dbb59bde
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

OyEwian.exe

Path C:\Windows\System\OyEwian.exe
Size 3.0MB
SHA256 09864b37448770254f326287f9caa2c466f4744294bfa7f6f12678499a501b5b
MD5 cce3c91bbe6e08d3a3cd1df542f9e1cb
SHA1 4c37024acfd7bae6d85288e3dfbd51f8d09489c4
SHA512 33d9df93d35366ef3b4ed9bdd6ee6e18e5bff25b9fbc27de0fc8cbfd91b660f55853e83bf4a153d906fa5613434aee89e987774c602516316385117f663f7478
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

POrCXbL.exe

Path C:\Windows\System\POrCXbL.exe
Size 3.0MB
SHA256 1607a524e1743071d3d40d4f6ff0d5fb59e040ee359510f421770ad8879e0caa
MD5 8fbdc2f840a125ee3077d8259247f60b
SHA1 de6d7bafae04b0d39e31047f6e6fe79483b0871d
SHA512 cba6e0c217a4a486e502856c77d3b821477fbb6e15c765818c98e663629f89b5052325372a9c5f8d3c1f8cbecc0615959666b060dc4183af2fc543ce9a95ae5a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW8:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TaJugCY.exe

Path C:\Windows\System\TaJugCY.exe
Size 3.0MB
SHA256 17c3819dff13e74255eff342a1f8d41010ef5a939a3a68a1ab778219ce983bfc
MD5 632bfd46dd4937c324a79280049c0baa
SHA1 5d6e277c6e01d4cff1f8e80585ae05cc97f1954e
SHA512 8528d273fffe0f550855f069d3343bd3b86a93417737f7fff14b9781e4aa679289a1f841569a6702bd3fb003af22bc593ff9c05594830a242eff4108e5386ad5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

UPRfjRQ.exe

Path C:\Windows\System\UPRfjRQ.exe
Size 3.0MB
SHA256 374458e841a5ec2d1db43d84cef1670073c7e57cd63d9dfbd19adae8cc882875
MD5 501fa90a1f223207200bb0b04d26147d
SHA1 bcbbb2a6325232519dc0127f7770cdc071a21624
SHA512 6b3593320ed1449c9538d89858a9460ebc3c46d213bbf53fa0f8b4878e0e975100f8ea315456828ff05bc6a270bc20e7ded724ba26c5e8df6049a167f14428cd
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW6:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbWHCyX.exe

Path C:\Windows\System\UbWHCyX.exe
Size 3.0MB
SHA256 e53ec1d76498cd37e7f7a8de5b49fc3f2d2ce1f52363efdc934481282aaa693f
MD5 7c9d49060119e44a95b69e7c6f518c6f
SHA1 537f5bdc8909cae4f844140ed9a3f947cfeed6d7
SHA512 2902137fae092f7518c55f16a35d389ecf46c5c5f59e3d7ee40d49e424c5b8cf229941368114a4d9c7e7c42beb57e2c51b8b9a246901d0809739dcae7ac53304
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VHWchEz.exe

Path C:\Windows\System\VHWchEz.exe
Size 3.0MB
SHA256 ddb4bf5149a29b3c423f104be51502481ef84b38f7fa3e6026e55d5d4a58c07e
MD5 8124d3a899bc60f3a61ab32588d5a30d
SHA1 a4d5c3fc9a963e21960559e7bdfa2af267e45307
SHA512 d7bdf4a15e2e883270da2aef7fa517d4b699ea9a665aa115df48ec9e97b286ab28a9d61d2d86da67a840a8fa3c34a4ba7a75d7e6dbb9da211b3ff0a52663de16
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:7bBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

YAdfpvY.exe

Path C:\Windows\System\YAdfpvY.exe
Size 3.0MB
SHA256 b867747a3a61c32a9084c8b69f91ac9a04c951977b9068e556fdb2bd13a34f83
MD5 322097cad4bd8514b8428f080c3a62f7
SHA1 400e24190b1b62e2264289fdb6f61dbf2e11e5de
SHA512 1ef4038bc1705d172bf8aa4ccbcb1dd20777c44719696e2f5c459710c93c77f5516bd301da27f6e35d1f6a40291768f366970e37b7715d9a5f1c8cb628b3fdf1
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFke
MD5 SHA1 SHA512 SSDEEP

Submit Download

YcyiYRd.exe

Path C:\Windows\System\YcyiYRd.exe
Size 3.0MB
SHA256 8da3fd5a1b8d3b0f041ce318fbb4aeb676d490eb588ffb74649562bb9bd9f883
MD5 fb049563293cf8aff13987f75a4bc8e7
SHA1 fb27b46fa1e6b2f899d6bc36b62f8d380b35377f
SHA512 3ad22310efbf2d73217bee278ebbebe93f6dd39d5397af43328bc6d9da106c1f83c38ba1bad99531b7461003c46de8254d091b533a58a8a4d914c60650297e67
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

dWEflpM.exe

Path C:\Windows\System\dWEflpM.exe
Size 3.0MB
SHA256 bc221a1fcfa1abfdc3209f9c53413024be4394eab25ba3e329a58dd18af337c0
MD5 3eca3e5e3d26f1ca282139bffc0e0a6a
SHA1 0e7810620b65cc6700852813fbccebbdfc1f8479
SHA512 34e1b87372e8f24ae5de15b11360b4bb881b508a1528952e1b2203942397abfa4516b742a4dc7b0b5ffe9fa09fe5a04509e16564449cb9a641be7296afe6367d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

eZxUpPv.exe

Path C:\Windows\System\eZxUpPv.exe
Size 3.0MB
SHA256 041e22b34d35030561d8c2a645b3367da78197a33a78cd2dbbad2aed2b5dc634
MD5 4cbc0eeb81c3cbf604ebfdb8d6835227
SHA1 e145640cd7f298d4fef52b9261dc69fa47bd7c22
SHA512 623e88c756cb48c1b2271cf3ec698a168372c8a6ccbffdaa4473264d0030542022833be5a2ea6caf21c40b6d37bff1d856cec93dac9c264f8a715768cb086580
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWn:7bBeSFk7
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwmGsdT.exe

Path C:\Windows\System\nwmGsdT.exe
Size 3.0MB
SHA256 ee5b14c493ca7f7105d2be648a4e52a246f9981c8cdbacdd6e80233f34ecd646
MD5 11a4f127f1e7968511da59fd3a74f19c
SHA1 40f18680ece43859e3ed6c726e2c01c2d0c59035
SHA512 15cc53c3f3960c87b5ea7abd914fb285a0545a4257ac8d007645d3ec05db606ed40f2adda270d90c3a58cab5a3a89fb55a3b425f98f4293dbe6d765afed92719
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

oMXRsLy.exe

Path C:\Windows\System\oMXRsLy.exe
Size 3.0MB
SHA256 0e10529fb1d3230b894ffdeddb6c93f147ed487c9d25476c0f296dcf1c52d477
MD5 8f67db0a5531850504e20d32a20a1981
SHA1 ec6410a3ddf21197ed87278560007d4ff4292340
SHA512 747603056774c549442e49b412a74f39ea1f1d0287063204fc63aa0e62c90f9195a28a6039e8423dd983e0ec7eff8be57c0f95887bb5b2b1f6b0251898bedad1
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

oTuwJUk.exe

Path C:\Windows\System\oTuwJUk.exe
Size 3.0MB
SHA256 64267b14b5d4bb0a12b605be08f7674f3240a5205514380e154caee580f8df2b
MD5 6390be221b3450c617f84d65dfe3ab41
SHA1 d9af3fac75a36650eab3820fd20afa599f7609a5
SHA512 2bc653cbce22104f1b467e4fbf983f49a0c2c21f3ab3224569ea8aadd06bbe9646ed7d0c2150c19fef5cc411e3f11b8bd04053c5daaee7403b58ac52499e3afb
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:7bBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkjcjkm.exe

Path C:\Windows\System\pkjcjkm.exe
Size 3.0MB
SHA256 79b9f9128c182e438c51589023b346858d77ceb866985d0e83d99e08eb723a49
MD5 b9a17eb45edb38c4a935a6ac2b01135c
SHA1 9518d1611384170892e0e7f2542768a15a74fd2e
SHA512 5bd67e8d826eacb0beb02c5ed58fc02a42bfd1e0889fcabf030baf8e38d07185b5547fa6aeecfb4e14624b7f6f2789c67a13f6989c41a7a7c62ade29d80ac0c4
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

trHpNAI.exe

Path C:\Windows\System\trHpNAI.exe
Size 3.0MB
SHA256 106a13e9ec656f52742d5e9075f183bab957640a5aef58c186383ceea809559b
MD5 27eff51ce2ee8aba8a6dde42bcca12d1
SHA1 94789a7b84e32d3c0bd617ea869017dd89738b71
SHA512 bfee2676e790743a636797abe2c90c0365433ee1b54cda92a9f10d90738adc2d08e8615224b3d68d132ebdf92438c863b9ed8d71d1facff82b73ed682b63275e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:7bBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

tyLOeTs.exe

Path C:\Windows\System\tyLOeTs.exe
Size 3.0MB
SHA256 a8b389eb2d9bbdfd7bf66bde64c5a789c59c08110883a2796506fcb50a7dcb8f
MD5 04eaf2a18168a3eea8b01dd9ee53f3f2
SHA1 095ee3486839c6d833d7e8930bbf74d483b500ac
SHA512 4ddbbab207da1c0663055b74367873ba97fd5169a8827c10219204d9dfeff12a54039aa930ebb0e29df949c862a1e9eebad08872592c5295899c4eb7333461d8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:7bBeSFk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

vndQDHF.exe

Path C:\Windows\System\vndQDHF.exe
Size 3.0MB
SHA256 a4722fdfae9b1f5b194f57e2e40ebe9ef7b5e65ead5ef9840f7dcce0d863cd6d
MD5 13a29aabaf5b1a729f5e3050c1058292
SHA1 d49bc3946a21b8b04869494fd35319ffc78b04b3
SHA512 1db236da6ef9be1fac0817df972885645a1b2729a83e6cc0502e15e42e18189765255afa4b7c6c2a486a594a848952789f9f3a3365f58a871df8c64327a9df55
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:7bBeSFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

wSdZCPw.exe

Path C:\Windows\System\wSdZCPw.exe
Size 3.0MB
SHA256 9d3a4d92ada7e1a5c8d3269bb3a05c490030afcca5bc7c7713d051b01712f6a9
MD5 305336ad9da884c1fe4e743ce543bbe6
SHA1 ab3dd88c27b1c97c593908d690390f56dddcb535
SHA512 2451f583ddd2d8586b63b12f91f5a4dadce86c949979fc5295604892e1382e371613dd737e822bb829b96f7609aaf883da90f32f5849a7f605244c67d0b454b9
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUYAMhJ.exe

Path C:\Windows\System\wUYAMhJ.exe
Size 3.0MB
SHA256 c08efcfbf602e53d554dd6e2a289ad3eafed44cbaad202adff4f63314710bfa7
MD5 0826da0c377c18a0c6961b222b839cba
SHA1 44644171a10003dc6c72e9d8a3ad4ed2562de498
SHA512 d1a92feefed7a44965d07de1b1ccd17256a527b0e6c3da8ca3ee738788cc4efb4f7b7c6a4d340cba8df59a7e88db69bc250d75dff5be15627d35da9053a530bd
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWe:7bBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

zENMdyY.exe

Path C:\Windows\System\zENMdyY.exe
Size 3.0MB
SHA256 b69e814e1e0b9670f42c2c965ee62c9a0cf603c989b87647d5444b015ee69c40
MD5 b8ed37426364700dea8eb6d602053565
SHA1 a65457295d1f110c956727c4b038b42de9e56b6a
SHA512 a2fdc5ff9cb946815bc8563044e49aca9bb52243b50e353145177f11bdfa90fa04116df4262998602901ca8d2f2996417494b5b03e7d225d8703f40099b655dc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:7bBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

zdmBNPF.exe

Path C:\Windows\System\zdmBNPF.exe
Size 3.0MB
SHA256 40d73c1b70896ba3b9b0ef20c2ffb19a8aab6ab9ddacd5f0de4f45aada43d4b4
MD5 0c051d1de3ae88483f95dd492dd843d1
SHA1 76a33bf69d47cf1123000c124349c9461de0d028
SHA512 67f0302a9346b9563e14d055988048785e36bcdb99f80e4478869573d3b8625c1d8896137cee3975a1e25b8525f60cdcb2c3b4ecf9aca82a19e73d0d79ac7d5a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:7bBeSFkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

zfkEwXk.exe

Path C:\Windows\System\zfkEwXk.exe
Size 3.0MB
SHA256 c426a45d198dd177ef25d9a72bbae26b70c8bc4a94eaae733e99b2125c17e74b
MD5 2dc91e4df100f66322b8b743e3d73bba
SHA1 512136a52626933809f2712840a97fd3660e2621
SHA512 75eee887d2e57b7ec7dff3cd7832c32a1b92d1f1864843abb4783180b750fb85de40ea130469b2a49f5460bd4957f5e3bd2706e84e6cf083a75b7d8f475ac392
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

znOLAZx.exe

Path C:\Windows\System\znOLAZx.exe
Size 3.0MB
SHA256 dcb861fc58a94aedad38f5cc8914da55c0df99460f8a3fab7be23256c2a97ed7
MD5 12e0eef7840527a7ab7f27e3b628e4eb
SHA1 654107f12331d27d1562f18e06417a9bf296abee
SHA512 844565f4ec0731051b52ff170ab24b79a10f576143d19b496a7f723b27f50a51f9a778ecb278ea08dee95bb4ee41161dc2cce5065010774a67233403f2f7f581
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWL:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/516-2614-0x00007FF75CFD0000-0x00007FF75D3C6000-memory.dmp

Download

memory/516-77-0x00007FF75CFD0000-0x00007FF75D3C6000-memory.dmp

Download

memory/1008-2611-0x00007FFA2B193000-0x00007FFA2B195000-memory.dmp

Download

memory/1008-5-0x00007FFA2B193000-0x00007FFA2B195000-memory.dmp

Download

memory/1008-147-0x000001A4D27A0000-0x000001A4D2F46000-memory.dmp

Download

memory/1008-20-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

Download

memory/1008-40-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

Download

memory/1008-30-0x000001A4D1220000-0x000001A4D1242000-memory.dmp

Download

memory/1532-102-0x00007FF610110000-0x00007FF610506000-memory.dmp

Download

memory/1532-2613-0x00007FF610110000-0x00007FF610506000-memory.dmp

Download

memory/1868-139-0x00007FF7B4AD0000-0x00007FF7B4EC6000-memory.dmp

Download

memory/1868-2627-0x00007FF7B4AD0000-0x00007FF7B4EC6000-memory.dmp

Download

memory/2080-132-0x00007FF613D30000-0x00007FF614126000-memory.dmp

Download

memory/2080-2622-0x00007FF613D30000-0x00007FF614126000-memory.dmp

Download

memory/2484-131-0x00007FF60B260000-0x00007FF60B656000-memory.dmp

Download

memory/2484-2616-0x00007FF60B260000-0x00007FF60B656000-memory.dmp

Download

memory/2712-141-0x00007FF640650000-0x00007FF640A46000-memory.dmp

Download

memory/2712-2612-0x00007FF640650000-0x00007FF640A46000-memory.dmp

Download

memory/2816-140-0x00007FF6FB4B0000-0x00007FF6FB8A6000-memory.dmp

Download

memory/2816-2626-0x00007FF6FB4B0000-0x00007FF6FB8A6000-memory.dmp

Download

memory/2904-2615-0x00007FF7C2B90000-0x00007FF7C2F86000-memory.dmp

Download

memory/2904-86-0x00007FF7C2B90000-0x00007FF7C2F86000-memory.dmp

Download

memory/3160-2619-0x00007FF687020000-0x00007FF687416000-memory.dmp

Download

memory/3160-143-0x00007FF687020000-0x00007FF687416000-memory.dmp

Download

memory/3236-2623-0x00007FF66B6C0000-0x00007FF66BAB6000-memory.dmp

Download

memory/3236-134-0x00007FF66B6C0000-0x00007FF66BAB6000-memory.dmp

Download

memory/3268-367-0x00007FF641D50000-0x00007FF642146000-memory.dmp

Download

memory/3268-2635-0x00007FF641D50000-0x00007FF642146000-memory.dmp

Download

memory/3392-2629-0x00007FF6BAF50000-0x00007FF6BB346000-memory.dmp

Download

memory/3392-146-0x00007FF6BAF50000-0x00007FF6BB346000-memory.dmp

Download

memory/3448-2633-0x00007FF74BA80000-0x00007FF74BE76000-memory.dmp

Download

memory/3448-145-0x00007FF74BA80000-0x00007FF74BE76000-memory.dmp

Download

memory/3484-133-0x00007FF69FA80000-0x00007FF69FE76000-memory.dmp

Download

memory/3484-2624-0x00007FF69FA80000-0x00007FF69FE76000-memory.dmp

Download

memory/3528-2625-0x00007FF6FFD20000-0x00007FF700116000-memory.dmp

Download

memory/3528-118-0x00007FF6FFD20000-0x00007FF700116000-memory.dmp

Download

memory/3532-2618-0x00007FF6B2330000-0x00007FF6B2726000-memory.dmp

Download

memory/3532-117-0x00007FF6B2330000-0x00007FF6B2726000-memory.dmp

Download

memory/3544-2628-0x00007FF7400C0000-0x00007FF7404B6000-memory.dmp

Download

memory/3544-136-0x00007FF7400C0000-0x00007FF7404B6000-memory.dmp

Download

memory/3916-1-0x0000014AFB510000-0x0000014AFB520000-memory.dmp

Download

memory/3916-0-0x00007FF753310000-0x00007FF753706000-memory.dmp

Download

memory/3924-2632-0x00007FF7332E0000-0x00007FF7336D6000-memory.dmp

Download

memory/3924-137-0x00007FF7332E0000-0x00007FF7336D6000-memory.dmp

Download

memory/4140-2630-0x00007FF753A90000-0x00007FF753E86000-memory.dmp

Download

memory/4140-144-0x00007FF753A90000-0x00007FF753E86000-memory.dmp

Download

memory/4148-2631-0x00007FF73A810000-0x00007FF73AC06000-memory.dmp

Download

memory/4148-138-0x00007FF73A810000-0x00007FF73AC06000-memory.dmp

Download

memory/4692-363-0x00007FF6F8690000-0x00007FF6F8A86000-memory.dmp

Download

memory/4692-2634-0x00007FF6F8690000-0x00007FF6F8A86000-memory.dmp

Download

memory/4768-2617-0x00007FF7467A0000-0x00007FF746B96000-memory.dmp

Download

memory/4768-142-0x00007FF7467A0000-0x00007FF746B96000-memory.dmp

Download

memory/4820-2620-0x00007FF7071D0000-0x00007FF7075C6000-memory.dmp

Download

memory/4820-114-0x00007FF7071D0000-0x00007FF7075C6000-memory.dmp

Download

memory/5020-2621-0x00007FF778720000-0x00007FF778B16000-memory.dmp

Download

memory/5020-135-0x00007FF778720000-0x00007FF778B16000-memory.dmp

Download