xmrig | 7008334bb5fd5dc6afafde8e8a56e71b0fdf94da762365a88d2fb79c2f8402e8

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
Size 3.1MB
Sample240613-p47j7stdqj
SHA256 7008334bb5fd5dc6afafde8e8a56e71b0fdf94da762365a88d2fb79c2f8402e8
MD5 7de62f58e44ca6926bc0203afa16c9b0
SHA1 79dca3620d95aa5aca5204c98a282bfb0804ce7d
SHA512 eb6058770b5f19a2c0c775db1a7c2950369614b2c72f85cd190f412a9967a1e3f68c8c4c739b36838a660ae10a20fd61eeaa41125dff1e1706612ffcba32fbfe
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:7bBeSFkT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4404-0-0x00007FF719ED0000-0x00007FF71A2C6000-memory.dmp	xmrig
behavioral2/files/0x000800000002340a-6.dat	xmrig
behavioral2/files/0x000700000002340f-8.dat	xmrig
behavioral2/files/0x000700000002340e-10.dat	xmrig
behavioral2/files/0x0007000000023415-43.dat	xmrig
behavioral2/memory/1636-57-0x00007FF7E9BB0000-0x00007FF7E9FA6000-memory.dmp	xmrig
behavioral2/files/0x000800000002341d-92.dat	xmrig
behavioral2/files/0x000700000002341f-103.dat	xmrig
behavioral2/memory/3616-127-0x00007FF673670000-0x00007FF673A66000-memory.dmp	xmrig
behavioral2/memory/1340-141-0x00007FF787640000-0x00007FF787A36000-memory.dmp	xmrig
behavioral2/memory/2900-143-0x00007FF68C500000-0x00007FF68C8F6000-memory.dmp	xmrig
behavioral2/memory/3720-147-0x00007FF6A0270000-0x00007FF6A0666000-memory.dmp	xmrig
behavioral2/memory/2564-151-0x00007FF6E9D40000-0x00007FF6EA136000-memory.dmp	xmrig
behavioral2/memory/3236-155-0x00007FF74C7F0000-0x00007FF74CBE6000-memory.dmp	xmrig
behavioral2/memory/3228-158-0x00007FF7E7920000-0x00007FF7E7D16000-memory.dmp	xmrig
behavioral2/memory/3964-157-0x00007FF6E3720000-0x00007FF6E3B16000-memory.dmp	xmrig
behavioral2/memory/2536-156-0x00007FF6BCD60000-0x00007FF6BD156000-memory.dmp	xmrig
behavioral2/memory/4408-154-0x00007FF7F2C30000-0x00007FF7F3026000-memory.dmp	xmrig
behavioral2/memory/1304-153-0x00007FF7909B0000-0x00007FF790DA6000-memory.dmp	xmrig
behavioral2/memory/2584-152-0x00007FF7C4A10000-0x00007FF7C4E06000-memory.dmp	xmrig
behavioral2/memory/2432-150-0x00007FF616B40000-0x00007FF616F36000-memory.dmp	xmrig
behavioral2/memory/3684-149-0x00007FF7227A0000-0x00007FF722B96000-memory.dmp	xmrig
behavioral2/memory/836-148-0x00007FF7742D0000-0x00007FF7746C6000-memory.dmp	xmrig
behavioral2/memory/4876-146-0x00007FF776440000-0x00007FF776836000-memory.dmp	xmrig
behavioral2/memory/2672-145-0x00007FF7D8040000-0x00007FF7D8436000-memory.dmp	xmrig
behavioral2/memory/2288-144-0x00007FF6B6A80000-0x00007FF6B6E76000-memory.dmp	xmrig
behavioral2/memory/2576-142-0x00007FF757EC0000-0x00007FF7582B6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-138.dat	xmrig
behavioral2/files/0x0007000000023423-136.dat	xmrig
behavioral2/files/0x0007000000023422-134.dat	xmrig
behavioral2/files/0x000800000002341c-132.dat	xmrig
behavioral2/files/0x0007000000023421-130.dat	xmrig
behavioral2/memory/1524-129-0x00007FF717C80000-0x00007FF718076000-memory.dmp	xmrig
behavioral2/memory/456-128-0x00007FF671990000-0x00007FF671D86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-121.dat	xmrig
behavioral2/memory/2088-115-0x00007FF7B6650000-0x00007FF7B6A46000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-101.dat	xmrig
behavioral2/files/0x000700000002341e-99.dat	xmrig
behavioral2/files/0x0007000000023418-90.dat	xmrig
behavioral2/files/0x000700000002341a-88.dat	xmrig
behavioral2/files/0x0007000000023419-87.dat	xmrig
behavioral2/memory/2384-82-0x00007FF6100E0000-0x00007FF6104D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-79.dat	xmrig
behavioral2/files/0x0007000000023416-60.dat	xmrig
behavioral2/files/0x0007000000023414-54.dat	xmrig
behavioral2/files/0x0007000000023413-51.dat	xmrig
behavioral2/files/0x0007000000023412-47.dat	xmrig
behavioral2/files/0x0007000000023410-40.dat	xmrig
behavioral2/files/0x0007000000023411-38.dat	xmrig
behavioral2/files/0x0007000000023425-163.dat	xmrig
behavioral2/files/0x000800000002340b-164.dat	xmrig
behavioral2/files/0x0007000000023428-177.dat	xmrig
behavioral2/files/0x0007000000023427-174.dat	xmrig
behavioral2/files/0x0007000000023429-184.dat	xmrig
behavioral2/files/0x000700000002342a-191.dat	xmrig
behavioral2/files/0x0007000000023426-178.dat	xmrig
behavioral2/files/0x000700000002342b-196.dat	xmrig
behavioral2/memory/1304-2049-0x00007FF7909B0000-0x00007FF790DA6000-memory.dmp	xmrig
behavioral2/memory/1636-2050-0x00007FF7E9BB0000-0x00007FF7E9FA6000-memory.dmp	xmrig
behavioral2/memory/2384-2051-0x00007FF6100E0000-0x00007FF6104D6000-memory.dmp	xmrig
behavioral2/memory/4408-2052-0x00007FF7F2C30000-0x00007FF7F3026000-memory.dmp	xmrig
behavioral2/memory/2576-2054-0x00007FF757EC0000-0x00007FF7582B6000-memory.dmp	xmrig
behavioral2/memory/2088-2053-0x00007FF7B6650000-0x00007FF7B6A46000-memory.dmp	xmrig
behavioral2/memory/1340-2057-0x00007FF787640000-0x00007FF787A36000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3988	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1304	mtCslXO.exe
1636	UHyfeYF.exe
2384	nWyyZlZ.exe
4408	ThOYCWg.exe
2088	fvnZGUe.exe
3616	CIzlxGT.exe
456	NHVmnum.exe
1524	fzIzWIQ.exe
1340	gllidtK.exe
2576	aTiPqJw.exe
3236	XyNJFyf.exe
2536	WMkNGjS.exe
2900	MqKHjPZ.exe
2288	TInqWjZ.exe
3964	TzgysOg.exe
2672	FxGuVmf.exe
4876	ojleLlY.exe
3720	npcVvck.exe
836	aotaaGu.exe
3228	HMCyAbc.exe
3684	LhDSgMe.exe
2432	NdyLuVc.exe
2564	DQKkZcL.exe
2584	iwhAJnK.exe
1652	NETOICk.exe
4396	gInZijq.exe
4588	AAVfxUJ.exe
2304	QZXldCb.exe
688	AWupcwx.exe
2704	KeIjSqT.exe
4112	zRUbHOi.exe
1720	dmrOMpP.exe
3756	jiuRWiZ.exe
2056	dLjzdve.exe
400	TVuRGes.exe
1440	EZhzHVw.exe
4360	LYvidQX.exe
4364	FLRgUyu.exe
4848	wxUmrov.exe
1620	sXqpOQl.exe
5052	YsBZCSE.exe
5024	VRKmjQR.exe
2532	vCpAmWX.exe
3816	OrGsORG.exe
2716	ENDhsNA.exe
1016	JEjmfpr.exe
1900	edQObTB.exe
4996	WExniSK.exe
100	sgpqDgK.exe
4500	FWuQowm.exe
4040	TlNURVY.exe
2804	dbklWii.exe
2192	FGVEwgV.exe
1084	XUPKxZB.exe
4928	hlMmqBj.exe
3788	iVVleng.exe
3292	pUISkkz.exe
4856	QDnkerf.exe
4264	CeWuCqd.exe
1844	kFvIsNB.exe
1136	ZMafcHU.exe
4252	ivdwlET.exe
4784	szbHGtN.exe
4108	lLjbxAW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4404-0-0x00007FF719ED0000-0x00007FF71A2C6000-memory.dmp	upx
behavioral2/files/0x000800000002340a-6.dat	upx
behavioral2/files/0x000700000002340f-8.dat	upx
behavioral2/files/0x000700000002340e-10.dat	upx
behavioral2/files/0x0007000000023415-43.dat	upx
behavioral2/memory/1636-57-0x00007FF7E9BB0000-0x00007FF7E9FA6000-memory.dmp	upx
behavioral2/files/0x000800000002341d-92.dat	upx
behavioral2/files/0x000700000002341f-103.dat	upx
behavioral2/memory/3616-127-0x00007FF673670000-0x00007FF673A66000-memory.dmp	upx
behavioral2/memory/1340-141-0x00007FF787640000-0x00007FF787A36000-memory.dmp	upx
behavioral2/memory/2900-143-0x00007FF68C500000-0x00007FF68C8F6000-memory.dmp	upx
behavioral2/memory/3720-147-0x00007FF6A0270000-0x00007FF6A0666000-memory.dmp	upx
behavioral2/memory/2564-151-0x00007FF6E9D40000-0x00007FF6EA136000-memory.dmp	upx
behavioral2/memory/3236-155-0x00007FF74C7F0000-0x00007FF74CBE6000-memory.dmp	upx
behavioral2/memory/3228-158-0x00007FF7E7920000-0x00007FF7E7D16000-memory.dmp	upx
behavioral2/memory/3964-157-0x00007FF6E3720000-0x00007FF6E3B16000-memory.dmp	upx
behavioral2/memory/2536-156-0x00007FF6BCD60000-0x00007FF6BD156000-memory.dmp	upx
behavioral2/memory/4408-154-0x00007FF7F2C30000-0x00007FF7F3026000-memory.dmp	upx
behavioral2/memory/1304-153-0x00007FF7909B0000-0x00007FF790DA6000-memory.dmp	upx
behavioral2/memory/2584-152-0x00007FF7C4A10000-0x00007FF7C4E06000-memory.dmp	upx
behavioral2/memory/2432-150-0x00007FF616B40000-0x00007FF616F36000-memory.dmp	upx
behavioral2/memory/3684-149-0x00007FF7227A0000-0x00007FF722B96000-memory.dmp	upx
behavioral2/memory/836-148-0x00007FF7742D0000-0x00007FF7746C6000-memory.dmp	upx
behavioral2/memory/4876-146-0x00007FF776440000-0x00007FF776836000-memory.dmp	upx
behavioral2/memory/2672-145-0x00007FF7D8040000-0x00007FF7D8436000-memory.dmp	upx
behavioral2/memory/2288-144-0x00007FF6B6A80000-0x00007FF6B6E76000-memory.dmp	upx
behavioral2/memory/2576-142-0x00007FF757EC0000-0x00007FF7582B6000-memory.dmp	upx
behavioral2/files/0x0007000000023424-138.dat	upx
behavioral2/files/0x0007000000023423-136.dat	upx
behavioral2/files/0x0007000000023422-134.dat	upx
behavioral2/files/0x000800000002341c-132.dat	upx
behavioral2/files/0x0007000000023421-130.dat	upx
behavioral2/memory/1524-129-0x00007FF717C80000-0x00007FF718076000-memory.dmp	upx
behavioral2/memory/456-128-0x00007FF671990000-0x00007FF671D86000-memory.dmp	upx
behavioral2/files/0x0007000000023420-121.dat	upx
behavioral2/memory/2088-115-0x00007FF7B6650000-0x00007FF7B6A46000-memory.dmp	upx
behavioral2/files/0x000700000002341b-101.dat	upx
behavioral2/files/0x000700000002341e-99.dat	upx
behavioral2/files/0x0007000000023418-90.dat	upx
behavioral2/files/0x000700000002341a-88.dat	upx
behavioral2/files/0x0007000000023419-87.dat	upx
behavioral2/memory/2384-82-0x00007FF6100E0000-0x00007FF6104D6000-memory.dmp	upx
behavioral2/files/0x0007000000023417-79.dat	upx
behavioral2/files/0x0007000000023416-60.dat	upx
behavioral2/files/0x0007000000023414-54.dat	upx
behavioral2/files/0x0007000000023413-51.dat	upx
behavioral2/files/0x0007000000023412-47.dat	upx
behavioral2/files/0x0007000000023410-40.dat	upx
behavioral2/files/0x0007000000023411-38.dat	upx
behavioral2/files/0x0007000000023425-163.dat	upx
behavioral2/files/0x000800000002340b-164.dat	upx
behavioral2/files/0x0007000000023428-177.dat	upx
behavioral2/files/0x0007000000023427-174.dat	upx
behavioral2/files/0x0007000000023429-184.dat	upx
behavioral2/files/0x000700000002342a-191.dat	upx
behavioral2/files/0x0007000000023426-178.dat	upx
behavioral2/files/0x000700000002342b-196.dat	upx
behavioral2/memory/1304-2049-0x00007FF7909B0000-0x00007FF790DA6000-memory.dmp	upx
behavioral2/memory/1636-2050-0x00007FF7E9BB0000-0x00007FF7E9FA6000-memory.dmp	upx
behavioral2/memory/2384-2051-0x00007FF6100E0000-0x00007FF6104D6000-memory.dmp	upx
behavioral2/memory/4408-2052-0x00007FF7F2C30000-0x00007FF7F3026000-memory.dmp	upx
behavioral2/memory/2576-2054-0x00007FF757EC0000-0x00007FF7582B6000-memory.dmp	upx
behavioral2/memory/2088-2053-0x00007FF7B6650000-0x00007FF7B6A46000-memory.dmp	upx
behavioral2/memory/1340-2057-0x00007FF787640000-0x00007FF787A36000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SZLkmpq.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bzQbSYb.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\sBQAsmr.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\sMqdCKq.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\jmldDGz.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\MkXikjH.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\ribBiBU.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\HtvADXF.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\zRTppyP.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\ILSOMEQ.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\EggfkfQ.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\kRJnSBC.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\FxxTHrd.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\gSzLXFS.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\yDbFzow.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\rRwpRtu.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\eexPUWo.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\xSFygLJ.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\AUBfTjH.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\KwhuJZa.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bGOABRO.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\cOzyRQH.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\lQUPgRp.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\NrEKaYQ.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\BKnuSGu.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\UxQvzib.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\iGacObT.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\cyPsqad.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bucQFKg.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\pCQwkNI.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\mcmGvqU.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\PVwBMJF.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\paPmRRN.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\kXRBNtO.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\zOTwMrE.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\kpLnVYY.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\nmLcZpG.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\SzdeZPj.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\dqEuzxn.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\cZXlvtN.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\IguQxGu.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\xITLagr.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\XNUElqI.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\CRPktTl.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\cSjkKdt.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\GpEEGEm.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\utoFYJS.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\sxwdnZV.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\qltIMcS.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\GEMJwVy.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\FAlkPYp.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\QSbuBUa.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\OksMHBn.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\UDZKjro.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\YIBHMho.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bnACJee.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\NBSECxY.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\zshdyQj.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\WRlrGbo.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\cWKsvMA.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\LFFvBfn.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bLaNSSq.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\USUdnXT.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
File created	C:\Windows\System\MezJlRW.exe	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeLockMemoryPrivilege	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3988	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	83
PID 4404 wrote to memory of 3988	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	83
PID 4404 wrote to memory of 1304	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	84
PID 4404 wrote to memory of 1304	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	84
PID 4404 wrote to memory of 1636	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	85
PID 4404 wrote to memory of 1636	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	85
PID 4404 wrote to memory of 2384	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	86
PID 4404 wrote to memory of 2384	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	86
PID 4404 wrote to memory of 2088	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	87
PID 4404 wrote to memory of 2088	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	87
PID 4404 wrote to memory of 4408	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	88
PID 4404 wrote to memory of 4408	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	88
PID 4404 wrote to memory of 3616	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	89
PID 4404 wrote to memory of 3616	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	89
PID 4404 wrote to memory of 456	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	90
PID 4404 wrote to memory of 456	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	90
PID 4404 wrote to memory of 1524	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	91
PID 4404 wrote to memory of 1524	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	91
PID 4404 wrote to memory of 1340	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	92
PID 4404 wrote to memory of 1340	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	92
PID 4404 wrote to memory of 2576	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	93
PID 4404 wrote to memory of 2576	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	93
PID 4404 wrote to memory of 3236	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	94
PID 4404 wrote to memory of 3236	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	94
PID 4404 wrote to memory of 2288	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	95
PID 4404 wrote to memory of 2288	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	95
PID 4404 wrote to memory of 2536	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	96
PID 4404 wrote to memory of 2536	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	96
PID 4404 wrote to memory of 2900	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	97
PID 4404 wrote to memory of 2900	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	97
PID 4404 wrote to memory of 3964	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	98
PID 4404 wrote to memory of 3964	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	98
PID 4404 wrote to memory of 2672	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	99
PID 4404 wrote to memory of 2672	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	99
PID 4404 wrote to memory of 4876	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	100
PID 4404 wrote to memory of 4876	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	100
PID 4404 wrote to memory of 3720	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	101
PID 4404 wrote to memory of 3720	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	101
PID 4404 wrote to memory of 836	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	102
PID 4404 wrote to memory of 836	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	102
PID 4404 wrote to memory of 3228	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	103
PID 4404 wrote to memory of 3228	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	103
PID 4404 wrote to memory of 3684	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	104
PID 4404 wrote to memory of 3684	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	104
PID 4404 wrote to memory of 2432	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	105
PID 4404 wrote to memory of 2432	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	105
PID 4404 wrote to memory of 2564	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	106
PID 4404 wrote to memory of 2564	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	106
PID 4404 wrote to memory of 2584	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	107
PID 4404 wrote to memory of 2584	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	107
PID 4404 wrote to memory of 1652	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	108
PID 4404 wrote to memory of 1652	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	108
PID 4404 wrote to memory of 4396	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	109
PID 4404 wrote to memory of 4396	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	109
PID 4404 wrote to memory of 4588	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	110
PID 4404 wrote to memory of 4588	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	110
PID 4404 wrote to memory of 2304	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	111
PID 4404 wrote to memory of 2304	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	111
PID 4404 wrote to memory of 688	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	112
PID 4404 wrote to memory of 688	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	112
PID 4404 wrote to memory of 2704	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	113
PID 4404 wrote to memory of 2704	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	113
PID 4404 wrote to memory of 4112	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	116
PID 4404 wrote to memory of 4112	4404	7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7de62f58e44ca6926bc0203afa16c9b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\System\mtCslXO.exe
  C:\Windows\System\mtCslXO.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\UHyfeYF.exe
  C:\Windows\System\UHyfeYF.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\nWyyZlZ.exe
  C:\Windows\System\nWyyZlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\fvnZGUe.exe
  C:\Windows\System\fvnZGUe.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ThOYCWg.exe
  C:\Windows\System\ThOYCWg.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\CIzlxGT.exe
  C:\Windows\System\CIzlxGT.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\NHVmnum.exe
  C:\Windows\System\NHVmnum.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\fzIzWIQ.exe
  C:\Windows\System\fzIzWIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\gllidtK.exe
  C:\Windows\System\gllidtK.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\aTiPqJw.exe
  C:\Windows\System\aTiPqJw.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\XyNJFyf.exe
  C:\Windows\System\XyNJFyf.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\TInqWjZ.exe
  C:\Windows\System\TInqWjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\WMkNGjS.exe
  C:\Windows\System\WMkNGjS.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\MqKHjPZ.exe
  C:\Windows\System\MqKHjPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\TzgysOg.exe
  C:\Windows\System\TzgysOg.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\FxGuVmf.exe
  C:\Windows\System\FxGuVmf.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ojleLlY.exe
  C:\Windows\System\ojleLlY.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\npcVvck.exe
  C:\Windows\System\npcVvck.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\aotaaGu.exe
  C:\Windows\System\aotaaGu.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\HMCyAbc.exe
  C:\Windows\System\HMCyAbc.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\LhDSgMe.exe
  C:\Windows\System\LhDSgMe.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\NdyLuVc.exe
  C:\Windows\System\NdyLuVc.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\DQKkZcL.exe
  C:\Windows\System\DQKkZcL.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\iwhAJnK.exe
  C:\Windows\System\iwhAJnK.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\NETOICk.exe
  C:\Windows\System\NETOICk.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\gInZijq.exe
  C:\Windows\System\gInZijq.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\AAVfxUJ.exe
  C:\Windows\System\AAVfxUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\QZXldCb.exe
  C:\Windows\System\QZXldCb.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\AWupcwx.exe
  C:\Windows\System\AWupcwx.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\KeIjSqT.exe
  C:\Windows\System\KeIjSqT.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\zRUbHOi.exe
  C:\Windows\System\zRUbHOi.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\dmrOMpP.exe
  C:\Windows\System\dmrOMpP.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\jiuRWiZ.exe
  C:\Windows\System\jiuRWiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\dLjzdve.exe
  C:\Windows\System\dLjzdve.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\TVuRGes.exe
  C:\Windows\System\TVuRGes.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\EZhzHVw.exe
  C:\Windows\System\EZhzHVw.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\LYvidQX.exe
  C:\Windows\System\LYvidQX.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\FLRgUyu.exe
  C:\Windows\System\FLRgUyu.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\wxUmrov.exe
  C:\Windows\System\wxUmrov.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\sXqpOQl.exe
  C:\Windows\System\sXqpOQl.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\YsBZCSE.exe
  C:\Windows\System\YsBZCSE.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\VRKmjQR.exe
  C:\Windows\System\VRKmjQR.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\vCpAmWX.exe
  C:\Windows\System\vCpAmWX.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\OrGsORG.exe
  C:\Windows\System\OrGsORG.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\ENDhsNA.exe
  C:\Windows\System\ENDhsNA.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\JEjmfpr.exe
  C:\Windows\System\JEjmfpr.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\edQObTB.exe
  C:\Windows\System\edQObTB.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\WExniSK.exe
  C:\Windows\System\WExniSK.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\sgpqDgK.exe
  C:\Windows\System\sgpqDgK.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\FWuQowm.exe
  C:\Windows\System\FWuQowm.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\TlNURVY.exe
  C:\Windows\System\TlNURVY.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\dbklWii.exe
  C:\Windows\System\dbklWii.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\FGVEwgV.exe
  C:\Windows\System\FGVEwgV.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\XUPKxZB.exe
  C:\Windows\System\XUPKxZB.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\hlMmqBj.exe
  C:\Windows\System\hlMmqBj.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\iVVleng.exe
  C:\Windows\System\iVVleng.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\pUISkkz.exe
  C:\Windows\System\pUISkkz.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\QDnkerf.exe
  C:\Windows\System\QDnkerf.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\CeWuCqd.exe
  C:\Windows\System\CeWuCqd.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\kFvIsNB.exe
  C:\Windows\System\kFvIsNB.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ZMafcHU.exe
  C:\Windows\System\ZMafcHU.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ivdwlET.exe
  C:\Windows\System\ivdwlET.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\szbHGtN.exe
  C:\Windows\System\szbHGtN.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\lLjbxAW.exe
  C:\Windows\System\lLjbxAW.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\TlqSHXm.exe
  C:\Windows\System\TlqSHXm.exe
  2⤵
  PID:2544
- C:\Windows\System\DaFBrRS.exe
  C:\Windows\System\DaFBrRS.exe
  2⤵
  PID:872
- C:\Windows\System\zqwdGif.exe
  C:\Windows\System\zqwdGif.exe
  2⤵
  PID:3996
- C:\Windows\System\gdCOIEz.exe
  C:\Windows\System\gdCOIEz.exe
  2⤵
  PID:1972
- C:\Windows\System\GUrpLoj.exe
  C:\Windows\System\GUrpLoj.exe
  2⤵
  PID:3008
- C:\Windows\System\PjacDQq.exe
  C:\Windows\System\PjacDQq.exe
  2⤵
  PID:5016
- C:\Windows\System\McYybbP.exe
  C:\Windows\System\McYybbP.exe
  2⤵
  PID:1076
- C:\Windows\System\TEnDXBW.exe
  C:\Windows\System\TEnDXBW.exe
  2⤵
  PID:320
- C:\Windows\System\mSBCZKk.exe
  C:\Windows\System\mSBCZKk.exe
  2⤵
  PID:4048
- C:\Windows\System\YiftEuv.exe
  C:\Windows\System\YiftEuv.exe
  2⤵
  PID:2768
- C:\Windows\System\qUiNMNS.exe
  C:\Windows\System\qUiNMNS.exe
  2⤵
  PID:3712
- C:\Windows\System\xDhWOIc.exe
  C:\Windows\System\xDhWOIc.exe
  2⤵
  PID:3240
- C:\Windows\System\esunaGF.exe
  C:\Windows\System\esunaGF.exe
  2⤵
  PID:2040
- C:\Windows\System\hMIDXAi.exe
  C:\Windows\System\hMIDXAi.exe
  2⤵
  PID:2528
- C:\Windows\System\OfJWxla.exe
  C:\Windows\System\OfJWxla.exe
  2⤵
  PID:3376
- C:\Windows\System\lTZOXut.exe
  C:\Windows\System\lTZOXut.exe
  2⤵
  PID:3304
- C:\Windows\System\USNqHIK.exe
  C:\Windows\System\USNqHIK.exe
  2⤵
  PID:2552
- C:\Windows\System\hQgmFcu.exe
  C:\Windows\System\hQgmFcu.exe
  2⤵
  PID:2108
- C:\Windows\System\iCgVRhG.exe
  C:\Windows\System\iCgVRhG.exe
  2⤵
  PID:4484
- C:\Windows\System\GKavGAh.exe
  C:\Windows\System\GKavGAh.exe
  2⤵
  PID:2680
- C:\Windows\System\SOgVkcE.exe
  C:\Windows\System\SOgVkcE.exe
  2⤵
  PID:4416
- C:\Windows\System\JLJkWSF.exe
  C:\Windows\System\JLJkWSF.exe
  2⤵
  PID:4700
- C:\Windows\System\SiqngGX.exe
  C:\Windows\System\SiqngGX.exe
  2⤵
  PID:4688
- C:\Windows\System\jNKHmDN.exe
  C:\Windows\System\jNKHmDN.exe
  2⤵
  PID:2736
- C:\Windows\System\PovGnbd.exe
  C:\Windows\System\PovGnbd.exe
  2⤵
  PID:3564
- C:\Windows\System\RcvTEpz.exe
  C:\Windows\System\RcvTEpz.exe
  2⤵
  PID:2504
- C:\Windows\System\BbUHmUl.exe
  C:\Windows\System\BbUHmUl.exe
  2⤵
  PID:3160
- C:\Windows\System\ekNQkQx.exe
  C:\Windows\System\ekNQkQx.exe
  2⤵
  PID:3320
- C:\Windows\System\ldVNAPR.exe
  C:\Windows\System\ldVNAPR.exe
  2⤵
  PID:5128
- C:\Windows\System\DQWikgn.exe
  C:\Windows\System\DQWikgn.exe
  2⤵
  PID:5148
- C:\Windows\System\IfUxexN.exe
  C:\Windows\System\IfUxexN.exe
  2⤵
  PID:5184
- C:\Windows\System\FarPdVI.exe
  C:\Windows\System\FarPdVI.exe
  2⤵
  PID:5208
- C:\Windows\System\oKLhlbj.exe
  C:\Windows\System\oKLhlbj.exe
  2⤵
  PID:5240
- C:\Windows\System\WzvZJFe.exe
  C:\Windows\System\WzvZJFe.exe
  2⤵
  PID:5268
- C:\Windows\System\Iyvfpdl.exe
  C:\Windows\System\Iyvfpdl.exe
  2⤵
  PID:5288
- C:\Windows\System\qiYyKZb.exe
  C:\Windows\System\qiYyKZb.exe
  2⤵
  PID:5312
- C:\Windows\System\IFjkzOa.exe
  C:\Windows\System\IFjkzOa.exe
  2⤵
  PID:5352
- C:\Windows\System\SFNJLgD.exe
  C:\Windows\System\SFNJLgD.exe
  2⤵
  PID:5372
- C:\Windows\System\VtWTjQw.exe
  C:\Windows\System\VtWTjQw.exe
  2⤵
  PID:5404
- C:\Windows\System\lGToUqh.exe
  C:\Windows\System\lGToUqh.exe
  2⤵
  PID:5428
- C:\Windows\System\QOgSKpG.exe
  C:\Windows\System\QOgSKpG.exe
  2⤵
  PID:5472
- C:\Windows\System\yTWyJRV.exe
  C:\Windows\System\yTWyJRV.exe
  2⤵
  PID:5496
- C:\Windows\System\UkGiZhX.exe
  C:\Windows\System\UkGiZhX.exe
  2⤵
  PID:5524
- C:\Windows\System\msSoZtd.exe
  C:\Windows\System\msSoZtd.exe
  2⤵
  PID:5544
- C:\Windows\System\IBOyimO.exe
  C:\Windows\System\IBOyimO.exe
  2⤵
  PID:5584
- C:\Windows\System\dLgaWdL.exe
  C:\Windows\System\dLgaWdL.exe
  2⤵
  PID:5608
- C:\Windows\System\BcmgZgp.exe
  C:\Windows\System\BcmgZgp.exe
  2⤵
  PID:5636
- C:\Windows\System\FMYnwbY.exe
  C:\Windows\System\FMYnwbY.exe
  2⤵
  PID:5656
- C:\Windows\System\IDBRoph.exe
  C:\Windows\System\IDBRoph.exe
  2⤵
  PID:5692
- C:\Windows\System\jmIwPWn.exe
  C:\Windows\System\jmIwPWn.exe
  2⤵
  PID:5720
- C:\Windows\System\QsdudSK.exe
  C:\Windows\System\QsdudSK.exe
  2⤵
  PID:5748
- C:\Windows\System\ThlsEjo.exe
  C:\Windows\System\ThlsEjo.exe
  2⤵
  PID:5776
- C:\Windows\System\sStoFdw.exe
  C:\Windows\System\sStoFdw.exe
  2⤵
  PID:5804
- C:\Windows\System\HObdiLf.exe
  C:\Windows\System\HObdiLf.exe
  2⤵
  PID:5832
- C:\Windows\System\qVSekKS.exe
  C:\Windows\System\qVSekKS.exe
  2⤵
  PID:5860
- C:\Windows\System\NDMzoKF.exe
  C:\Windows\System\NDMzoKF.exe
  2⤵
  PID:5888
- C:\Windows\System\xijxKEk.exe
  C:\Windows\System\xijxKEk.exe
  2⤵
  PID:5920
- C:\Windows\System\EWCXNlg.exe
  C:\Windows\System\EWCXNlg.exe
  2⤵
  PID:5968
- C:\Windows\System\SQBreKq.exe
  C:\Windows\System\SQBreKq.exe
  2⤵
  PID:5984
- C:\Windows\System\YiDzZif.exe
  C:\Windows\System\YiDzZif.exe
  2⤵
  PID:6016
- C:\Windows\System\PXLOSgj.exe
  C:\Windows\System\PXLOSgj.exe
  2⤵
  PID:6048
- C:\Windows\System\xCtvPgG.exe
  C:\Windows\System\xCtvPgG.exe
  2⤵
  PID:6072
- C:\Windows\System\SmMcmEG.exe
  C:\Windows\System\SmMcmEG.exe
  2⤵
  PID:6088
- C:\Windows\System\RSLBWQD.exe
  C:\Windows\System\RSLBWQD.exe
  2⤵
  PID:6108
- C:\Windows\System\cpTFgFd.exe
  C:\Windows\System\cpTFgFd.exe
  2⤵
  PID:6128
- C:\Windows\System\paPmRRN.exe
  C:\Windows\System\paPmRRN.exe
  2⤵
  PID:2568
- C:\Windows\System\ShSGuTS.exe
  C:\Windows\System\ShSGuTS.exe
  2⤵
  PID:5232
- C:\Windows\System\deWbstY.exe
  C:\Windows\System\deWbstY.exe
  2⤵
  PID:5304
- C:\Windows\System\SUTpVyr.exe
  C:\Windows\System\SUTpVyr.exe
  2⤵
  PID:5360
- C:\Windows\System\YJvPozM.exe
  C:\Windows\System\YJvPozM.exe
  2⤵
  PID:5456
- C:\Windows\System\naRneqc.exe
  C:\Windows\System\naRneqc.exe
  2⤵
  PID:5512
- C:\Windows\System\pbtVvtd.exe
  C:\Windows\System\pbtVvtd.exe
  2⤵
  PID:5576
- C:\Windows\System\saZvwsK.exe
  C:\Windows\System\saZvwsK.exe
  2⤵
  PID:5644
- C:\Windows\System\obflBfw.exe
  C:\Windows\System\obflBfw.exe
  2⤵
  PID:5704
- C:\Windows\System\jshocEy.exe
  C:\Windows\System\jshocEy.exe
  2⤵
  PID:5772
- C:\Windows\System\zeknkHy.exe
  C:\Windows\System\zeknkHy.exe
  2⤵
  PID:5852
- C:\Windows\System\DxrTJxS.exe
  C:\Windows\System\DxrTJxS.exe
  2⤵
  PID:5916
- C:\Windows\System\XhbbSiu.exe
  C:\Windows\System\XhbbSiu.exe
  2⤵
  PID:5996
- C:\Windows\System\ASPuADO.exe
  C:\Windows\System\ASPuADO.exe
  2⤵
  PID:6056
- C:\Windows\System\PykYRjb.exe
  C:\Windows\System\PykYRjb.exe
  2⤵
  PID:6104
- C:\Windows\System\kgFbEqX.exe
  C:\Windows\System\kgFbEqX.exe
  2⤵
  PID:5168
- C:\Windows\System\UIftHUR.exe
  C:\Windows\System\UIftHUR.exe
  2⤵
  PID:5364
- C:\Windows\System\ZeBDzYf.exe
  C:\Windows\System\ZeBDzYf.exe
  2⤵
  PID:5508
- C:\Windows\System\MQvcavR.exe
  C:\Windows\System\MQvcavR.exe
  2⤵
  PID:5664
- C:\Windows\System\fJJqlRo.exe
  C:\Windows\System\fJJqlRo.exe
  2⤵
  PID:5844
- C:\Windows\System\CspBIYl.exe
  C:\Windows\System\CspBIYl.exe
  2⤵
  PID:5976
- C:\Windows\System\prDfBly.exe
  C:\Windows\System\prDfBly.exe
  2⤵
  PID:6140
- C:\Windows\System\rbeEWfk.exe
  C:\Windows\System\rbeEWfk.exe
  2⤵
  PID:5440
- C:\Windows\System\BQUVQOG.exe
  C:\Windows\System\BQUVQOG.exe
  2⤵
  PID:5884
- C:\Windows\System\XxyTTzo.exe
  C:\Windows\System\XxyTTzo.exe
  2⤵
  PID:5276
- C:\Windows\System\VYvubsa.exe
  C:\Windows\System\VYvubsa.exe
  2⤵
  PID:5532
- C:\Windows\System\MTVIVLi.exe
  C:\Windows\System\MTVIVLi.exe
  2⤵
  PID:6152
- C:\Windows\System\gCMoMRK.exe
  C:\Windows\System\gCMoMRK.exe
  2⤵
  PID:6180
- C:\Windows\System\khSddnO.exe
  C:\Windows\System\khSddnO.exe
  2⤵
  PID:6208
- C:\Windows\System\RmZcySc.exe
  C:\Windows\System\RmZcySc.exe
  2⤵
  PID:6236
- C:\Windows\System\wXrXVYJ.exe
  C:\Windows\System\wXrXVYJ.exe
  2⤵
  PID:6268
- C:\Windows\System\hZpCXFg.exe
  C:\Windows\System\hZpCXFg.exe
  2⤵
  PID:6292
- C:\Windows\System\AwLBxzj.exe
  C:\Windows\System\AwLBxzj.exe
  2⤵
  PID:6316
- C:\Windows\System\sBifbDm.exe
  C:\Windows\System\sBifbDm.exe
  2⤵
  PID:6348
- C:\Windows\System\XPxlHvR.exe
  C:\Windows\System\XPxlHvR.exe
  2⤵
  PID:6380
- C:\Windows\System\EAixlnL.exe
  C:\Windows\System\EAixlnL.exe
  2⤵
  PID:6404
- C:\Windows\System\jnLXNYH.exe
  C:\Windows\System\jnLXNYH.exe
  2⤵
  PID:6428
- C:\Windows\System\yQhsUCj.exe
  C:\Windows\System\yQhsUCj.exe
  2⤵
  PID:6464
- C:\Windows\System\oVPWTUD.exe
  C:\Windows\System\oVPWTUD.exe
  2⤵
  PID:6484
- C:\Windows\System\AgXjcqg.exe
  C:\Windows\System\AgXjcqg.exe
  2⤵
  PID:6520
- C:\Windows\System\VHKcKmP.exe
  C:\Windows\System\VHKcKmP.exe
  2⤵
  PID:6544
- C:\Windows\System\cLVChID.exe
  C:\Windows\System\cLVChID.exe
  2⤵
  PID:6568
- C:\Windows\System\aJwlCHP.exe
  C:\Windows\System\aJwlCHP.exe
  2⤵
  PID:6604
- C:\Windows\System\vXkxcSZ.exe
  C:\Windows\System\vXkxcSZ.exe
  2⤵
  PID:6628
- C:\Windows\System\EuFiDWr.exe
  C:\Windows\System\EuFiDWr.exe
  2⤵
  PID:6656
- C:\Windows\System\LEAfxOv.exe
  C:\Windows\System\LEAfxOv.exe
  2⤵
  PID:6688
- C:\Windows\System\OyCOeDL.exe
  C:\Windows\System\OyCOeDL.exe
  2⤵
  PID:6708
- C:\Windows\System\AKeoXfY.exe
  C:\Windows\System\AKeoXfY.exe
  2⤵
  PID:6736
- C:\Windows\System\TSRurMA.exe
  C:\Windows\System\TSRurMA.exe
  2⤵
  PID:6768
- C:\Windows\System\cosYyWV.exe
  C:\Windows\System\cosYyWV.exe
  2⤵
  PID:6796
- C:\Windows\System\hDGXZzS.exe
  C:\Windows\System\hDGXZzS.exe
  2⤵
  PID:6828
- C:\Windows\System\UzhHaFs.exe
  C:\Windows\System\UzhHaFs.exe
  2⤵
  PID:6852
- C:\Windows\System\gTbdJWF.exe
  C:\Windows\System\gTbdJWF.exe
  2⤵
  PID:6880
- C:\Windows\System\DUOaMIs.exe
  C:\Windows\System\DUOaMIs.exe
  2⤵
  PID:6912
- C:\Windows\System\aOdvzQD.exe
  C:\Windows\System\aOdvzQD.exe
  2⤵
  PID:6936
- C:\Windows\System\KMSJKNo.exe
  C:\Windows\System\KMSJKNo.exe
  2⤵
  PID:6964
- C:\Windows\System\WWpZvzr.exe
  C:\Windows\System\WWpZvzr.exe
  2⤵
  PID:6992
- C:\Windows\System\FvfrrKc.exe
  C:\Windows\System\FvfrrKc.exe
  2⤵
  PID:7020
- C:\Windows\System\AmRbZsw.exe
  C:\Windows\System\AmRbZsw.exe
  2⤵
  PID:7048
- C:\Windows\System\vJbtYUS.exe
  C:\Windows\System\vJbtYUS.exe
  2⤵
  PID:7076
- C:\Windows\System\IxfHruh.exe
  C:\Windows\System\IxfHruh.exe
  2⤵
  PID:7108
- C:\Windows\System\vAdVrSS.exe
  C:\Windows\System\vAdVrSS.exe
  2⤵
  PID:7132
- C:\Windows\System\jSCWrja.exe
  C:\Windows\System\jSCWrja.exe
  2⤵
  PID:7160
- C:\Windows\System\pYVkacz.exe
  C:\Windows\System\pYVkacz.exe
  2⤵
  PID:6196
- C:\Windows\System\IBbVrtx.exe
  C:\Windows\System\IBbVrtx.exe
  2⤵
  PID:6276
- C:\Windows\System\HZTSPLt.exe
  C:\Windows\System\HZTSPLt.exe
  2⤵
  PID:6336
- C:\Windows\System\bOfMXvf.exe
  C:\Windows\System\bOfMXvf.exe
  2⤵
  PID:6412
- C:\Windows\System\lyBPvLd.exe
  C:\Windows\System\lyBPvLd.exe
  2⤵
  PID:6452
- C:\Windows\System\tfdQHcG.exe
  C:\Windows\System\tfdQHcG.exe
  2⤵
  PID:6532
- C:\Windows\System\uPjAaiv.exe
  C:\Windows\System\uPjAaiv.exe
  2⤵
  PID:6592
- C:\Windows\System\NcbuQta.exe
  C:\Windows\System\NcbuQta.exe
  2⤵
  PID:6664
- C:\Windows\System\XpncFMX.exe
  C:\Windows\System\XpncFMX.exe
  2⤵
  PID:6732
- C:\Windows\System\LSLxfkS.exe
  C:\Windows\System\LSLxfkS.exe
  2⤵
  PID:6804
- C:\Windows\System\GCMZoqn.exe
  C:\Windows\System\GCMZoqn.exe
  2⤵
  PID:6860
- C:\Windows\System\ukpoAMk.exe
  C:\Windows\System\ukpoAMk.exe
  2⤵
  PID:6920
- C:\Windows\System\LMjSivP.exe
  C:\Windows\System\LMjSivP.exe
  2⤵
  PID:6972
- C:\Windows\System\UiPYCal.exe
  C:\Windows\System\UiPYCal.exe
  2⤵
  PID:7036
- C:\Windows\System\GRmzRdW.exe
  C:\Windows\System\GRmzRdW.exe
  2⤵
  PID:7116
- C:\Windows\System\bWxAfvf.exe
  C:\Windows\System\bWxAfvf.exe
  2⤵
  PID:6224
- C:\Windows\System\kvPxQQf.exe
  C:\Windows\System\kvPxQQf.exe
  2⤵
  PID:6368
- C:\Windows\System\RlGflEJ.exe
  C:\Windows\System\RlGflEJ.exe
  2⤵
  PID:6508
- C:\Windows\System\BPaYqaF.exe
  C:\Windows\System\BPaYqaF.exe
  2⤵
  PID:6676
- C:\Windows\System\PqiWfrl.exe
  C:\Windows\System\PqiWfrl.exe
  2⤵
  PID:6816
- C:\Windows\System\GtweuBs.exe
  C:\Windows\System\GtweuBs.exe
  2⤵
  PID:6956
- C:\Windows\System\uheohpo.exe
  C:\Windows\System\uheohpo.exe
  2⤵
  PID:7124
- C:\Windows\System\JAhLpag.exe
  C:\Windows\System\JAhLpag.exe
  2⤵
  PID:6308
- C:\Windows\System\lLdjTzZ.exe
  C:\Windows\System\lLdjTzZ.exe
  2⤵
  PID:6720
- C:\Windows\System\LkGSYyS.exe
  C:\Windows\System\LkGSYyS.exe
  2⤵
  PID:7012
- C:\Windows\System\ohUyykv.exe
  C:\Windows\System\ohUyykv.exe
  2⤵
  PID:6552
- C:\Windows\System\yqRXgTB.exe
  C:\Windows\System\yqRXgTB.exe
  2⤵
  PID:1192
- C:\Windows\System\jJtEjoX.exe
  C:\Windows\System\jJtEjoX.exe
  2⤵
  PID:1928
- C:\Windows\System\xoFlIgM.exe
  C:\Windows\System\xoFlIgM.exe
  2⤵
  PID:1240
- C:\Windows\System\eCKJUHP.exe
  C:\Windows\System\eCKJUHP.exe
  2⤵
  PID:1604
- C:\Windows\System\zQszFAB.exe
  C:\Windows\System\zQszFAB.exe
  2⤵
  PID:5944
- C:\Windows\System\pGFdyDI.exe
  C:\Windows\System\pGFdyDI.exe
  2⤵
  PID:884
- C:\Windows\System\GkAgKeQ.exe
  C:\Windows\System\GkAgKeQ.exe
  2⤵
  PID:7192
- C:\Windows\System\NXdvIVa.exe
  C:\Windows\System\NXdvIVa.exe
  2⤵
  PID:7220
- C:\Windows\System\uWcqupU.exe
  C:\Windows\System\uWcqupU.exe
  2⤵
  PID:7248
- C:\Windows\System\dYvlfCm.exe
  C:\Windows\System\dYvlfCm.exe
  2⤵
  PID:7276
- C:\Windows\System\WZUxHEZ.exe
  C:\Windows\System\WZUxHEZ.exe
  2⤵
  PID:7300
- C:\Windows\System\JFVONSq.exe
  C:\Windows\System\JFVONSq.exe
  2⤵
  PID:7332
- C:\Windows\System\jKNNMNq.exe
  C:\Windows\System\jKNNMNq.exe
  2⤵
  PID:7360
- C:\Windows\System\ZjKuiCy.exe
  C:\Windows\System\ZjKuiCy.exe
  2⤵
  PID:7392
- C:\Windows\System\cJDsIxI.exe
  C:\Windows\System\cJDsIxI.exe
  2⤵
  PID:7420
- C:\Windows\System\mYFUAWJ.exe
  C:\Windows\System\mYFUAWJ.exe
  2⤵
  PID:7448
- C:\Windows\System\GfoNdut.exe
  C:\Windows\System\GfoNdut.exe
  2⤵
  PID:7472
- C:\Windows\System\KJnWWbk.exe
  C:\Windows\System\KJnWWbk.exe
  2⤵
  PID:7500
- C:\Windows\System\cXOQyLF.exe
  C:\Windows\System\cXOQyLF.exe
  2⤵
  PID:7528
- C:\Windows\System\zZkgrxa.exe
  C:\Windows\System\zZkgrxa.exe
  2⤵
  PID:7560
- C:\Windows\System\ibwvMeV.exe
  C:\Windows\System\ibwvMeV.exe
  2⤵
  PID:7584
- C:\Windows\System\CGHsovf.exe
  C:\Windows\System\CGHsovf.exe
  2⤵
  PID:7612
- C:\Windows\System\QsgssWh.exe
  C:\Windows\System\QsgssWh.exe
  2⤵
  PID:7644
- C:\Windows\System\ZhVDXpr.exe
  C:\Windows\System\ZhVDXpr.exe
  2⤵
  PID:7672
- C:\Windows\System\FrCzTCS.exe
  C:\Windows\System\FrCzTCS.exe
  2⤵
  PID:7700
- C:\Windows\System\gxacgTq.exe
  C:\Windows\System\gxacgTq.exe
  2⤵
  PID:7728
- C:\Windows\System\euJkXZJ.exe
  C:\Windows\System\euJkXZJ.exe
  2⤵
  PID:7756
- C:\Windows\System\krNWHLe.exe
  C:\Windows\System\krNWHLe.exe
  2⤵
  PID:7784
- C:\Windows\System\tWDWOXC.exe
  C:\Windows\System\tWDWOXC.exe
  2⤵
  PID:7808
- C:\Windows\System\xXqamJi.exe
  C:\Windows\System\xXqamJi.exe
  2⤵
  PID:7840
- C:\Windows\System\yxDmFIL.exe
  C:\Windows\System\yxDmFIL.exe
  2⤵
  PID:7864
- C:\Windows\System\SgDVawW.exe
  C:\Windows\System\SgDVawW.exe
  2⤵
  PID:7896
- C:\Windows\System\JUIBNZv.exe
  C:\Windows\System\JUIBNZv.exe
  2⤵
  PID:7924
- C:\Windows\System\UGoQfgf.exe
  C:\Windows\System\UGoQfgf.exe
  2⤵
  PID:7952
- C:\Windows\System\ukyJaQi.exe
  C:\Windows\System\ukyJaQi.exe
  2⤵
  PID:7976
- C:\Windows\System\oAekdqW.exe
  C:\Windows\System\oAekdqW.exe
  2⤵
  PID:8008
- C:\Windows\System\pekODVV.exe
  C:\Windows\System\pekODVV.exe
  2⤵
  PID:8032
- C:\Windows\System\bokFUdF.exe
  C:\Windows\System\bokFUdF.exe
  2⤵
  PID:8060
- C:\Windows\System\WjhkjZp.exe
  C:\Windows\System\WjhkjZp.exe
  2⤵
  PID:8092
- C:\Windows\System\WxbXdEq.exe
  C:\Windows\System\WxbXdEq.exe
  2⤵
  PID:8120
- C:\Windows\System\WCTMgbe.exe
  C:\Windows\System\WCTMgbe.exe
  2⤵
  PID:8148
- C:\Windows\System\ZrlDDQl.exe
  C:\Windows\System\ZrlDDQl.exe
  2⤵
  PID:8172
- C:\Windows\System\qFXklvD.exe
  C:\Windows\System\qFXklvD.exe
  2⤵
  PID:7184
- C:\Windows\System\aVkoYua.exe
  C:\Windows\System\aVkoYua.exe
  2⤵
  PID:2052
- C:\Windows\System\enhqJMl.exe
  C:\Windows\System\enhqJMl.exe
  2⤵
  PID:7320
- C:\Windows\System\giwmNIP.exe
  C:\Windows\System\giwmNIP.exe
  2⤵
  PID:7376
- C:\Windows\System\tMWuciD.exe
  C:\Windows\System\tMWuciD.exe
  2⤵
  PID:7436
- C:\Windows\System\zeRXBoo.exe
  C:\Windows\System\zeRXBoo.exe
  2⤵
  PID:7492
- C:\Windows\System\HmXhJYp.exe
  C:\Windows\System\HmXhJYp.exe
  2⤵
  PID:7568
- C:\Windows\System\ojuZfmM.exe
  C:\Windows\System\ojuZfmM.exe
  2⤵
  PID:7632
- C:\Windows\System\dAqPSVG.exe
  C:\Windows\System\dAqPSVG.exe
  2⤵
  PID:7692
- C:\Windows\System\OfcmRMs.exe
  C:\Windows\System\OfcmRMs.exe
  2⤵
  PID:7764
- C:\Windows\System\VgGxpmR.exe
  C:\Windows\System\VgGxpmR.exe
  2⤵
  PID:7804
- C:\Windows\System\aEqzJKA.exe
  C:\Windows\System\aEqzJKA.exe
  2⤵
  PID:7860
- C:\Windows\System\oZqDWpO.exe
  C:\Windows\System\oZqDWpO.exe
  2⤵
  PID:7932
- C:\Windows\System\MBrMfcS.exe
  C:\Windows\System\MBrMfcS.exe
  2⤵
  PID:7996
- C:\Windows\System\kmxXlgo.exe
  C:\Windows\System\kmxXlgo.exe
  2⤵
  PID:2556
- C:\Windows\System\qviAzBX.exe
  C:\Windows\System\qviAzBX.exe
  2⤵
  PID:8108
- C:\Windows\System\wLDdPUC.exe
  C:\Windows\System\wLDdPUC.exe
  2⤵
  PID:8168
- C:\Windows\System\KBoTYWe.exe
  C:\Windows\System\KBoTYWe.exe
  2⤵
  PID:7284
- C:\Windows\System\YAIAqQm.exe
  C:\Windows\System\YAIAqQm.exe
  2⤵
  PID:7404
- C:\Windows\System\xFsmoiq.exe
  C:\Windows\System\xFsmoiq.exe
  2⤵
  PID:7540
- C:\Windows\System\WzljtIc.exe
  C:\Windows\System\WzljtIc.exe
  2⤵
  PID:7680
- C:\Windows\System\jdBYoxP.exe
  C:\Windows\System\jdBYoxP.exe
  2⤵
  PID:4460
- C:\Windows\System\euyyFax.exe
  C:\Windows\System\euyyFax.exe
  2⤵
  PID:7972
- C:\Windows\System\ZXbdgvC.exe
  C:\Windows\System\ZXbdgvC.exe
  2⤵
  PID:8100
- C:\Windows\System\RYKFUxD.exe
  C:\Windows\System\RYKFUxD.exe
  2⤵
  PID:7340
- C:\Windows\System\bPEmtdU.exe
  C:\Windows\System\bPEmtdU.exe
  2⤵
  PID:7652
- C:\Windows\System\ohvnWIu.exe
  C:\Windows\System\ohvnWIu.exe
  2⤵
  PID:7960
- C:\Windows\System\YLXKTlg.exe
  C:\Windows\System\YLXKTlg.exe
  2⤵
  PID:7456
- C:\Windows\System\ALcmUzm.exe
  C:\Windows\System\ALcmUzm.exe
  2⤵
  PID:7236
- C:\Windows\System\cACoIyR.exe
  C:\Windows\System\cACoIyR.exe
  2⤵
  PID:7800
- C:\Windows\System\SUyYVLA.exe
  C:\Windows\System\SUyYVLA.exe
  2⤵
  PID:1312
- C:\Windows\System\PEuuUsq.exe
  C:\Windows\System\PEuuUsq.exe
  2⤵
  PID:8220
- C:\Windows\System\qrunJRA.exe
  C:\Windows\System\qrunJRA.exe
  2⤵
  PID:8248
- C:\Windows\System\yusVLFU.exe
  C:\Windows\System\yusVLFU.exe
  2⤵
  PID:8276
- C:\Windows\System\BZjPiew.exe
  C:\Windows\System\BZjPiew.exe
  2⤵
  PID:8304
- C:\Windows\System\RGgJkLG.exe
  C:\Windows\System\RGgJkLG.exe
  2⤵
  PID:8332
- C:\Windows\System\lSsmaNM.exe
  C:\Windows\System\lSsmaNM.exe
  2⤵
  PID:8360
- C:\Windows\System\eIbXiWM.exe
  C:\Windows\System\eIbXiWM.exe
  2⤵
  PID:8388
- C:\Windows\System\uNRCSEM.exe
  C:\Windows\System\uNRCSEM.exe
  2⤵
  PID:8416
- C:\Windows\System\rFmgPws.exe
  C:\Windows\System\rFmgPws.exe
  2⤵
  PID:8444
- C:\Windows\System\bcKcEqq.exe
  C:\Windows\System\bcKcEqq.exe
  2⤵
  PID:8472
- C:\Windows\System\HccawSv.exe
  C:\Windows\System\HccawSv.exe
  2⤵
  PID:8500
- C:\Windows\System\shVPAvN.exe
  C:\Windows\System\shVPAvN.exe
  2⤵
  PID:8528
- C:\Windows\System\nrjFyuB.exe
  C:\Windows\System\nrjFyuB.exe
  2⤵
  PID:8556
- C:\Windows\System\QVAtjwK.exe
  C:\Windows\System\QVAtjwK.exe
  2⤵
  PID:8584
- C:\Windows\System\yNojrTT.exe
  C:\Windows\System\yNojrTT.exe
  2⤵
  PID:8612
- C:\Windows\System\dKoqYiU.exe
  C:\Windows\System\dKoqYiU.exe
  2⤵
  PID:8640
- C:\Windows\System\PiuUNWK.exe
  C:\Windows\System\PiuUNWK.exe
  2⤵
  PID:8668
- C:\Windows\System\fLPAokn.exe
  C:\Windows\System\fLPAokn.exe
  2⤵
  PID:8696
- C:\Windows\System\grDzzSG.exe
  C:\Windows\System\grDzzSG.exe
  2⤵
  PID:8724
- C:\Windows\System\mhEoTUb.exe
  C:\Windows\System\mhEoTUb.exe
  2⤵
  PID:8752
- C:\Windows\System\GdGnoWq.exe
  C:\Windows\System\GdGnoWq.exe
  2⤵
  PID:8780
- C:\Windows\System\DWtXlZB.exe
  C:\Windows\System\DWtXlZB.exe
  2⤵
  PID:8808
- C:\Windows\System\QYgUhpD.exe
  C:\Windows\System\QYgUhpD.exe
  2⤵
  PID:8836
- C:\Windows\System\UjpKKHP.exe
  C:\Windows\System\UjpKKHP.exe
  2⤵
  PID:8864
- C:\Windows\System\RGAdDaW.exe
  C:\Windows\System\RGAdDaW.exe
  2⤵
  PID:8892
- C:\Windows\System\CZlZUUQ.exe
  C:\Windows\System\CZlZUUQ.exe
  2⤵
  PID:8920
- C:\Windows\System\QfqFpHn.exe
  C:\Windows\System\QfqFpHn.exe
  2⤵
  PID:8948
- C:\Windows\System\OncsNGA.exe
  C:\Windows\System\OncsNGA.exe
  2⤵
  PID:8988
- C:\Windows\System\ZfRzBgm.exe
  C:\Windows\System\ZfRzBgm.exe
  2⤵
  PID:9004
- C:\Windows\System\reFpRst.exe
  C:\Windows\System\reFpRst.exe
  2⤵
  PID:9032
- C:\Windows\System\qGubLDo.exe
  C:\Windows\System\qGubLDo.exe
  2⤵
  PID:9060
- C:\Windows\System\PhySFKM.exe
  C:\Windows\System\PhySFKM.exe
  2⤵
  PID:9088
- C:\Windows\System\KvRuyaz.exe
  C:\Windows\System\KvRuyaz.exe
  2⤵
  PID:9116
- C:\Windows\System\NvgnzEb.exe
  C:\Windows\System\NvgnzEb.exe
  2⤵
  PID:9144
- C:\Windows\System\QiYuXya.exe
  C:\Windows\System\QiYuXya.exe
  2⤵
  PID:9176
- C:\Windows\System\pnBZiID.exe
  C:\Windows\System\pnBZiID.exe
  2⤵
  PID:9204
- C:\Windows\System\oSfMRLN.exe
  C:\Windows\System\oSfMRLN.exe
  2⤵
  PID:8212
- C:\Windows\System\YnatRxi.exe
  C:\Windows\System\YnatRxi.exe
  2⤵
  PID:8272
- C:\Windows\System\qQfzrMk.exe
  C:\Windows\System\qQfzrMk.exe
  2⤵
  PID:8344
- C:\Windows\System\mfIklOJ.exe
  C:\Windows\System\mfIklOJ.exe
  2⤵
  PID:8408
- C:\Windows\System\nUkkXac.exe
  C:\Windows\System\nUkkXac.exe
  2⤵
  PID:8468
- C:\Windows\System\NKEDGqK.exe
  C:\Windows\System\NKEDGqK.exe
  2⤵
  PID:8540
- C:\Windows\System\DoLoSvd.exe
  C:\Windows\System\DoLoSvd.exe
  2⤵
  PID:8604
- C:\Windows\System\gGkvukE.exe
  C:\Windows\System\gGkvukE.exe
  2⤵
  PID:8664
- C:\Windows\System\WEulXCO.exe
  C:\Windows\System\WEulXCO.exe
  2⤵
  PID:8736
- C:\Windows\System\hqqSabU.exe
  C:\Windows\System\hqqSabU.exe
  2⤵
  PID:8800
- C:\Windows\System\uqAbNXp.exe
  C:\Windows\System\uqAbNXp.exe
  2⤵
  PID:8856
- C:\Windows\System\QrMNolR.exe
  C:\Windows\System\QrMNolR.exe
  2⤵
  PID:8932
- C:\Windows\System\kwWgFcQ.exe
  C:\Windows\System\kwWgFcQ.exe
  2⤵
  PID:8972
- C:\Windows\System\kqZisUN.exe
  C:\Windows\System\kqZisUN.exe
  2⤵
  PID:9052
- C:\Windows\System\PBvKgGY.exe
  C:\Windows\System\PBvKgGY.exe
  2⤵
  PID:9112
- C:\Windows\System\DkwixAu.exe
  C:\Windows\System\DkwixAu.exe
  2⤵
  PID:9188
- C:\Windows\System\bMtbUJh.exe
  C:\Windows\System\bMtbUJh.exe
  2⤵
  PID:8260
- C:\Windows\System\MyJolXm.exe
  C:\Windows\System\MyJolXm.exe
  2⤵
  PID:8400
- C:\Windows\System\ssGIvCl.exe
  C:\Windows\System\ssGIvCl.exe
  2⤵
  PID:8568
- C:\Windows\System\DDypuNZ.exe
  C:\Windows\System\DDypuNZ.exe
  2⤵
  PID:8716
- C:\Windows\System\whRTDDp.exe
  C:\Windows\System\whRTDDp.exe
  2⤵
  PID:8848
- C:\Windows\System\jaGEdbf.exe
  C:\Windows\System\jaGEdbf.exe
  2⤵
  PID:9080
- C:\Windows\System\xLCkwpx.exe
  C:\Windows\System\xLCkwpx.exe
  2⤵
  PID:9168
- C:\Windows\System\ObYbZuu.exe
  C:\Windows\System\ObYbZuu.exe
  2⤵
  PID:8372
- C:\Windows\System\ldjpwIt.exe
  C:\Windows\System\ldjpwIt.exe
  2⤵
  PID:8524
- C:\Windows\System\NGpVnHh.exe
  C:\Windows\System\NGpVnHh.exe
  2⤵
  PID:8828
- C:\Windows\System\NiPElDe.exe
  C:\Windows\System\NiPElDe.exe
  2⤵
  PID:9044
- C:\Windows\System\goLlUsE.exe
  C:\Windows\System\goLlUsE.exe
  2⤵
  PID:8464
- C:\Windows\System\IQmzImx.exe
  C:\Windows\System\IQmzImx.exe
  2⤵
  PID:9236
- C:\Windows\System\UPikvVM.exe
  C:\Windows\System\UPikvVM.exe
  2⤵
  PID:9260
- C:\Windows\System\DvdEUtJ.exe
  C:\Windows\System\DvdEUtJ.exe
  2⤵
  PID:9304
- C:\Windows\System\qnVmqQF.exe
  C:\Windows\System\qnVmqQF.exe
  2⤵
  PID:9344
- C:\Windows\System\WjdbHkD.exe
  C:\Windows\System\WjdbHkD.exe
  2⤵
  PID:9384
- C:\Windows\System\SLDxqbe.exe
  C:\Windows\System\SLDxqbe.exe
  2⤵
  PID:9412
- C:\Windows\System\bkkRQaZ.exe
  C:\Windows\System\bkkRQaZ.exe
  2⤵
  PID:9440
- C:\Windows\System\FRySGiY.exe
  C:\Windows\System\FRySGiY.exe
  2⤵
  PID:9480
- C:\Windows\System\cMjrXqs.exe
  C:\Windows\System\cMjrXqs.exe
  2⤵
  PID:9516
- C:\Windows\System\onOAvuV.exe
  C:\Windows\System\onOAvuV.exe
  2⤵
  PID:9532
- C:\Windows\System\TGpMgss.exe
  C:\Windows\System\TGpMgss.exe
  2⤵
  PID:9572
- C:\Windows\System\DbzfLSF.exe
  C:\Windows\System\DbzfLSF.exe
  2⤵
  PID:9600
- C:\Windows\System\bBjsklf.exe
  C:\Windows\System\bBjsklf.exe
  2⤵
  PID:9628
- C:\Windows\System\hTkGkDG.exe
  C:\Windows\System\hTkGkDG.exe
  2⤵
  PID:9656
- C:\Windows\System\AbjOrEA.exe
  C:\Windows\System\AbjOrEA.exe
  2⤵
  PID:9672
- C:\Windows\System\CwszVZb.exe
  C:\Windows\System\CwszVZb.exe
  2⤵
  PID:9700
- C:\Windows\System\mPbqMWp.exe
  C:\Windows\System\mPbqMWp.exe
  2⤵
  PID:9732
- C:\Windows\System\GVQihDW.exe
  C:\Windows\System\GVQihDW.exe
  2⤵
  PID:9768
- C:\Windows\System\JjjtcmN.exe
  C:\Windows\System\JjjtcmN.exe
  2⤵
  PID:9796
- C:\Windows\System\wXLqFbn.exe
  C:\Windows\System\wXLqFbn.exe
  2⤵
  PID:9824
- C:\Windows\System\xxNYvnb.exe
  C:\Windows\System\xxNYvnb.exe
  2⤵
  PID:9860
- C:\Windows\System\XyAxIvL.exe
  C:\Windows\System\XyAxIvL.exe
  2⤵
  PID:9876
- C:\Windows\System\UJQlsNJ.exe
  C:\Windows\System\UJQlsNJ.exe
  2⤵
  PID:9892
- C:\Windows\System\NfMKnmw.exe
  C:\Windows\System\NfMKnmw.exe
  2⤵
  PID:9920
- C:\Windows\System\euqPRll.exe
  C:\Windows\System\euqPRll.exe
  2⤵
  PID:9940
- C:\Windows\System\NfyLOvL.exe
  C:\Windows\System\NfyLOvL.exe
  2⤵
  PID:9960
- C:\Windows\System\jpoWLhC.exe
  C:\Windows\System\jpoWLhC.exe
  2⤵
  PID:10000
- C:\Windows\System\cAuDhwp.exe
  C:\Windows\System\cAuDhwp.exe
  2⤵
  PID:10036
- C:\Windows\System\RAZkylQ.exe
  C:\Windows\System\RAZkylQ.exe
  2⤵
  PID:10072
- C:\Windows\System\JkjySER.exe
  C:\Windows\System\JkjySER.exe
  2⤵
  PID:10112
- C:\Windows\System\ItEuxqr.exe
  C:\Windows\System\ItEuxqr.exe
  2⤵
  PID:10152
- C:\Windows\System\GagRyNI.exe
  C:\Windows\System\GagRyNI.exe
  2⤵
  PID:10176
- C:\Windows\System\cyFFGZU.exe
  C:\Windows\System\cyFFGZU.exe
  2⤵
  PID:10208
- C:\Windows\System\DFIRlIr.exe
  C:\Windows\System\DFIRlIr.exe
  2⤵
  PID:10228
- C:\Windows\System\ljRkRbx.exe
  C:\Windows\System\ljRkRbx.exe
  2⤵
  PID:8692
- C:\Windows\System\FrfMtVQ.exe
  C:\Windows\System\FrfMtVQ.exe
  2⤵
  PID:9224
- C:\Windows\System\HgSNuGh.exe
  C:\Windows\System\HgSNuGh.exe
  2⤵
  PID:9280
- C:\Windows\System\OOPAsRc.exe
  C:\Windows\System\OOPAsRc.exe
  2⤵
  PID:9372
- C:\Windows\System\akcKBvR.exe
  C:\Windows\System\akcKBvR.exe
  2⤵
  PID:9460
- C:\Windows\System\TNsdFDB.exe
  C:\Windows\System\TNsdFDB.exe
  2⤵
  PID:9528
- C:\Windows\System\ymwPaQj.exe
  C:\Windows\System\ymwPaQj.exe
  2⤵
  PID:9612
- C:\Windows\System\ceVCyQT.exe
  C:\Windows\System\ceVCyQT.exe
  2⤵
  PID:9664
- C:\Windows\System\lYqzwoZ.exe
  C:\Windows\System\lYqzwoZ.exe
  2⤵
  PID:9720
- C:\Windows\System\GoOWygh.exe
  C:\Windows\System\GoOWygh.exe
  2⤵
  PID:9788
- C:\Windows\System\dSVlJgB.exe
  C:\Windows\System\dSVlJgB.exe
  2⤵
  PID:4508
- C:\Windows\System\RzrFdTC.exe
  C:\Windows\System\RzrFdTC.exe
  2⤵
  PID:9868
- C:\Windows\System\qMMYvdY.exe
  C:\Windows\System\qMMYvdY.exe
  2⤵
  PID:9904
- C:\Windows\System\DputLaq.exe
  C:\Windows\System\DputLaq.exe
  2⤵
  PID:528
- C:\Windows\System\DNwPBlt.exe
  C:\Windows\System\DNwPBlt.exe
  2⤵
  PID:1924
- C:\Windows\System\VAJJhTR.exe
  C:\Windows\System\VAJJhTR.exe
  2⤵
  PID:3136
- C:\Windows\System\DpsWjjA.exe
  C:\Windows\System\DpsWjjA.exe
  2⤵
  PID:10020
- C:\Windows\System\nYJMfOt.exe
  C:\Windows\System\nYJMfOt.exe
  2⤵
  PID:10124
- C:\Windows\System\nRSuJwt.exe
  C:\Windows\System\nRSuJwt.exe
  2⤵
  PID:10192
- C:\Windows\System\nYzCjkf.exe
  C:\Windows\System\nYzCjkf.exe
  2⤵
  PID:8324
- C:\Windows\System\PAVTuSj.exe
  C:\Windows\System\PAVTuSj.exe
  2⤵
  PID:9328
- C:\Windows\System\TidKAHP.exe
  C:\Windows\System\TidKAHP.exe
  2⤵
  PID:9464
- C:\Windows\System\HylVhNW.exe
  C:\Windows\System\HylVhNW.exe
  2⤵
  PID:9596
- C:\Windows\System\WRddFwY.exe
  C:\Windows\System\WRddFwY.exe
  2⤵
  PID:9164
- C:\Windows\System\XPqySXc.exe
  C:\Windows\System\XPqySXc.exe
  2⤵
  PID:9844
- C:\Windows\System\oomgKNZ.exe
  C:\Windows\System\oomgKNZ.exe
  2⤵
  PID:9972
- C:\Windows\System\sxPbKhY.exe
  C:\Windows\System\sxPbKhY.exe
  2⤵
  PID:10060
- C:\Windows\System\KUzpNIy.exe
  C:\Windows\System\KUzpNIy.exe
  2⤵
  PID:10184
- C:\Windows\System\cOzyRQH.exe
  C:\Windows\System\cOzyRQH.exe
  2⤵
  PID:9364
- C:\Windows\System\dCOQPRW.exe
  C:\Windows\System\dCOQPRW.exe
  2⤵
  PID:9592
- C:\Windows\System\SjrBNHD.exe
  C:\Windows\System\SjrBNHD.exe
  2⤵
  PID:3592
- C:\Windows\System\gFeXNAl.exe
  C:\Windows\System\gFeXNAl.exe
  2⤵
  PID:8776
- C:\Windows\System\dQzxaEG.exe
  C:\Windows\System\dQzxaEG.exe
  2⤵
  PID:9888
- C:\Windows\System\sopGgQK.exe
  C:\Windows\System\sopGgQK.exe
  2⤵
  PID:9912
- C:\Windows\System\yJObGkd.exe
  C:\Windows\System\yJObGkd.exe
  2⤵
  PID:10256
- C:\Windows\System\evnowfU.exe
  C:\Windows\System\evnowfU.exe
  2⤵
  PID:10284
- C:\Windows\System\rnFqqBy.exe
  C:\Windows\System\rnFqqBy.exe
  2⤵
  PID:10312
- C:\Windows\System\dfmZCjl.exe
  C:\Windows\System\dfmZCjl.exe
  2⤵
  PID:10340
- C:\Windows\System\AgBaNvW.exe
  C:\Windows\System\AgBaNvW.exe
  2⤵
  PID:10368
- C:\Windows\System\wwdyNdw.exe
  C:\Windows\System\wwdyNdw.exe
  2⤵
  PID:10396
- C:\Windows\System\fYDrCcw.exe
  C:\Windows\System\fYDrCcw.exe
  2⤵
  PID:10424
- C:\Windows\System\WpSRzqI.exe
  C:\Windows\System\WpSRzqI.exe
  2⤵
  PID:10452
- C:\Windows\System\NiJiOsP.exe
  C:\Windows\System\NiJiOsP.exe
  2⤵
  PID:10480
- C:\Windows\System\ZIObYTp.exe
  C:\Windows\System\ZIObYTp.exe
  2⤵
  PID:10508
- C:\Windows\System\BqEvoIS.exe
  C:\Windows\System\BqEvoIS.exe
  2⤵
  PID:10536
- C:\Windows\System\mDMbycn.exe
  C:\Windows\System\mDMbycn.exe
  2⤵
  PID:10564
- C:\Windows\System\xPKsRUf.exe
  C:\Windows\System\xPKsRUf.exe
  2⤵
  PID:10592
- C:\Windows\System\iVhjmCv.exe
  C:\Windows\System\iVhjmCv.exe
  2⤵
  PID:10620
- C:\Windows\System\SDUvoAz.exe
  C:\Windows\System\SDUvoAz.exe
  2⤵
  PID:10648
- C:\Windows\System\BYnEqcG.exe
  C:\Windows\System\BYnEqcG.exe
  2⤵
  PID:10676
- C:\Windows\System\qTLCKbe.exe
  C:\Windows\System\qTLCKbe.exe
  2⤵
  PID:10704
- C:\Windows\System\EXbsxnY.exe
  C:\Windows\System\EXbsxnY.exe
  2⤵
  PID:10732
- C:\Windows\System\iMTVrOI.exe
  C:\Windows\System\iMTVrOI.exe
  2⤵
  PID:10760
- C:\Windows\System\XpLIFAi.exe
  C:\Windows\System\XpLIFAi.exe
  2⤵
  PID:10788
- C:\Windows\System\rRwpRtu.exe
  C:\Windows\System\rRwpRtu.exe
  2⤵
  PID:10816
- C:\Windows\System\CXnDpiv.exe
  C:\Windows\System\CXnDpiv.exe
  2⤵
  PID:10844
- C:\Windows\System\DqCFMpZ.exe
  C:\Windows\System\DqCFMpZ.exe
  2⤵
  PID:10872
- C:\Windows\System\iRMvzca.exe
  C:\Windows\System\iRMvzca.exe
  2⤵
  PID:10900
- C:\Windows\System\TfBYzfa.exe
  C:\Windows\System\TfBYzfa.exe
  2⤵
  PID:10928
- C:\Windows\System\SGGUJug.exe
  C:\Windows\System\SGGUJug.exe
  2⤵
  PID:10956
- C:\Windows\System\puagwwb.exe
  C:\Windows\System\puagwwb.exe
  2⤵
  PID:10984
- C:\Windows\System\MwdYwgk.exe
  C:\Windows\System\MwdYwgk.exe
  2⤵
  PID:11012
- C:\Windows\System\GSHWZqE.exe
  C:\Windows\System\GSHWZqE.exe
  2⤵
  PID:11040
- C:\Windows\System\SWgqXvt.exe
  C:\Windows\System\SWgqXvt.exe
  2⤵
  PID:11068
- C:\Windows\System\nvvnMLz.exe
  C:\Windows\System\nvvnMLz.exe
  2⤵
  PID:11096
- C:\Windows\System\EjlMSAP.exe
  C:\Windows\System\EjlMSAP.exe
  2⤵
  PID:11124
- C:\Windows\System\gbkQDEW.exe
  C:\Windows\System\gbkQDEW.exe
  2⤵
  PID:11152
- C:\Windows\System\RYqHmYK.exe
  C:\Windows\System\RYqHmYK.exe
  2⤵
  PID:11180
- C:\Windows\System\VZcknLg.exe
  C:\Windows\System\VZcknLg.exe
  2⤵
  PID:11208
- C:\Windows\System\yGMdqgL.exe
  C:\Windows\System\yGMdqgL.exe
  2⤵
  PID:11236
- C:\Windows\System\AbMqnfN.exe
  C:\Windows\System\AbMqnfN.exe
  2⤵
  PID:9884
- C:\Windows\System\UbhzDQV.exe
  C:\Windows\System\UbhzDQV.exe
  2⤵
  PID:10304
- C:\Windows\System\Hbbqtnd.exe
  C:\Windows\System\Hbbqtnd.exe
  2⤵
  PID:10364
- C:\Windows\System\JCuCHJJ.exe
  C:\Windows\System\JCuCHJJ.exe
  2⤵
  PID:10436
- C:\Windows\System\aNzFHjx.exe
  C:\Windows\System\aNzFHjx.exe
  2⤵
  PID:10500
- C:\Windows\System\eolVpMa.exe
  C:\Windows\System\eolVpMa.exe
  2⤵
  PID:10560
- C:\Windows\System\jgbVxYp.exe
  C:\Windows\System\jgbVxYp.exe
  2⤵
  PID:10632
- C:\Windows\System\MFAUCPl.exe
  C:\Windows\System\MFAUCPl.exe
  2⤵
  PID:10696
- C:\Windows\System\bxvIwMc.exe
  C:\Windows\System\bxvIwMc.exe
  2⤵
  PID:10752
- C:\Windows\System\pOqAHRu.exe
  C:\Windows\System\pOqAHRu.exe
  2⤵
  PID:10828
- C:\Windows\System\YIBHMho.exe
  C:\Windows\System\YIBHMho.exe
  2⤵
  PID:10892
- C:\Windows\System\rHQXrhM.exe
  C:\Windows\System\rHQXrhM.exe
  2⤵
  PID:10952
- C:\Windows\System\hMWwnmq.exe
  C:\Windows\System\hMWwnmq.exe
  2⤵
  PID:11024
- C:\Windows\System\WmxZnfI.exe
  C:\Windows\System\WmxZnfI.exe
  2⤵
  PID:11088
- C:\Windows\System\YxgwmSX.exe
  C:\Windows\System\YxgwmSX.exe
  2⤵
  PID:11148
- C:\Windows\System\VfTCFtK.exe
  C:\Windows\System\VfTCFtK.exe
  2⤵
  PID:11220
- C:\Windows\System\SLKTAdr.exe
  C:\Windows\System\SLKTAdr.exe
  2⤵
  PID:10280
- C:\Windows\System\MGjRaNX.exe
  C:\Windows\System\MGjRaNX.exe
  2⤵
  PID:10420
- C:\Windows\System\tTLshyi.exe
  C:\Windows\System\tTLshyi.exe
  2⤵
  PID:10588
- C:\Windows\System\OsVGtRU.exe
  C:\Windows\System\OsVGtRU.exe
  2⤵
  PID:10744
- C:\Windows\System\iqGgPrT.exe
  C:\Windows\System\iqGgPrT.exe
  2⤵
  PID:10884
- C:\Windows\System\MBLZJXG.exe
  C:\Windows\System\MBLZJXG.exe
  2⤵
  PID:11052
- C:\Windows\System\mwhfNgK.exe
  C:\Windows\System\mwhfNgK.exe
  2⤵
  PID:11200
- C:\Windows\System\zBFdDeR.exe
  C:\Windows\System\zBFdDeR.exe
  2⤵
  PID:10416
- C:\Windows\System\pqdcBNx.exe
  C:\Windows\System\pqdcBNx.exe
  2⤵
  PID:10808
- C:\Windows\System\botNbsv.exe
  C:\Windows\System\botNbsv.exe
  2⤵
  PID:11144
- C:\Windows\System\DkCKvcV.exe
  C:\Windows\System\DkCKvcV.exe
  2⤵
  PID:10724
- C:\Windows\System\CCOCAut.exe
  C:\Windows\System\CCOCAut.exe
  2⤵
  PID:11116
- C:\Windows\System\EhlCpYs.exe
  C:\Windows\System\EhlCpYs.exe
  2⤵
  PID:11284
- C:\Windows\System\XPAQxUx.exe
  C:\Windows\System\XPAQxUx.exe
  2⤵
  PID:11312
- C:\Windows\System\BjURggR.exe
  C:\Windows\System\BjURggR.exe
  2⤵
  PID:11340
- C:\Windows\System\XKVKfPD.exe
  C:\Windows\System\XKVKfPD.exe
  2⤵
  PID:11368
- C:\Windows\System\VGNGsFc.exe
  C:\Windows\System\VGNGsFc.exe
  2⤵
  PID:11396
- C:\Windows\System\VybiAfB.exe
  C:\Windows\System\VybiAfB.exe
  2⤵
  PID:11424
- C:\Windows\System\HZmDuRL.exe
  C:\Windows\System\HZmDuRL.exe
  2⤵
  PID:11452
- C:\Windows\System\FvqqKUa.exe
  C:\Windows\System\FvqqKUa.exe
  2⤵
  PID:11480
- C:\Windows\System\sEnyMuL.exe
  C:\Windows\System\sEnyMuL.exe
  2⤵
  PID:11508
- C:\Windows\System\CAcCNhv.exe
  C:\Windows\System\CAcCNhv.exe
  2⤵
  PID:11536
- C:\Windows\System\IHlqMgV.exe
  C:\Windows\System\IHlqMgV.exe
  2⤵
  PID:11564
- C:\Windows\System\cHiBMmA.exe
  C:\Windows\System\cHiBMmA.exe
  2⤵
  PID:11592
- C:\Windows\System\cTxvxzQ.exe
  C:\Windows\System\cTxvxzQ.exe
  2⤵
  PID:11620
- C:\Windows\System\NXMffkV.exe
  C:\Windows\System\NXMffkV.exe
  2⤵
  PID:11648
- C:\Windows\System\SyaWWvg.exe
  C:\Windows\System\SyaWWvg.exe
  2⤵
  PID:11676
- C:\Windows\System\fRQYtyI.exe
  C:\Windows\System\fRQYtyI.exe
  2⤵
  PID:11704
- C:\Windows\System\ZvpUyLi.exe
  C:\Windows\System\ZvpUyLi.exe
  2⤵
  PID:11732
- C:\Windows\System\RedLkhn.exe
  C:\Windows\System\RedLkhn.exe
  2⤵
  PID:11760
- C:\Windows\System\ikVgeho.exe
  C:\Windows\System\ikVgeho.exe
  2⤵
  PID:11788
- C:\Windows\System\QodFCKa.exe
  C:\Windows\System\QodFCKa.exe
  2⤵
  PID:11816
- C:\Windows\System\TvbkUAy.exe
  C:\Windows\System\TvbkUAy.exe
  2⤵
  PID:11844
- C:\Windows\System\pVzXMAA.exe
  C:\Windows\System\pVzXMAA.exe
  2⤵
  PID:11872
- C:\Windows\System\HYCsGDj.exe
  C:\Windows\System\HYCsGDj.exe
  2⤵
  PID:11900
- C:\Windows\System\MtYrQpC.exe
  C:\Windows\System\MtYrQpC.exe
  2⤵
  PID:11928
- C:\Windows\System\EfzqtoG.exe
  C:\Windows\System\EfzqtoG.exe
  2⤵
  PID:11956
- C:\Windows\System\MriPqiR.exe
  C:\Windows\System\MriPqiR.exe
  2⤵
  PID:11984
- C:\Windows\System\HYKwKHF.exe
  C:\Windows\System\HYKwKHF.exe
  2⤵
  PID:12012
- C:\Windows\System\fsmFNiF.exe
  C:\Windows\System\fsmFNiF.exe
  2⤵
  PID:12040
- C:\Windows\System\JlGzmFn.exe
  C:\Windows\System\JlGzmFn.exe
  2⤵
  PID:12060
- C:\Windows\System\XsONtOU.exe
  C:\Windows\System\XsONtOU.exe
  2⤵
  PID:12092
- C:\Windows\System\ZrOyKXo.exe
  C:\Windows\System\ZrOyKXo.exe
  2⤵
  PID:12120
- C:\Windows\System\wiEwqNC.exe
  C:\Windows\System\wiEwqNC.exe
  2⤵
  PID:12140
- C:\Windows\System\PINmtyM.exe
  C:\Windows\System\PINmtyM.exe
  2⤵
  PID:12176
- C:\Windows\System\cuJQJIW.exe
  C:\Windows\System\cuJQJIW.exe
  2⤵
  PID:12208
- C:\Windows\System\esvEppj.exe
  C:\Windows\System\esvEppj.exe
  2⤵
  PID:12232
- C:\Windows\System\oIqQehS.exe
  C:\Windows\System\oIqQehS.exe
  2⤵
  PID:12264
- C:\Windows\System\nLuyyMK.exe
  C:\Windows\System\nLuyyMK.exe
  2⤵
  PID:11276
- C:\Windows\System\vCNvwRA.exe
  C:\Windows\System\vCNvwRA.exe
  2⤵
  PID:11336
- C:\Windows\System\RqJSgfQ.exe
  C:\Windows\System\RqJSgfQ.exe
  2⤵
  PID:11408
- C:\Windows\System\VbjqrcB.exe
  C:\Windows\System\VbjqrcB.exe
  2⤵
  PID:11472
- C:\Windows\System\JScOOtK.exe
  C:\Windows\System\JScOOtK.exe
  2⤵
  PID:11532
- C:\Windows\System\yhsyone.exe
  C:\Windows\System\yhsyone.exe
  2⤵
  PID:11604
- C:\Windows\System\rqFQUOS.exe
  C:\Windows\System\rqFQUOS.exe
  2⤵
  PID:11668
- C:\Windows\System\DycKOfk.exe
  C:\Windows\System\DycKOfk.exe
  2⤵
  PID:11728
- C:\Windows\System\yhHJkIf.exe
  C:\Windows\System\yhHJkIf.exe
  2⤵
  PID:11808
- C:\Windows\System\DnBBEPI.exe
  C:\Windows\System\DnBBEPI.exe
  2⤵
  PID:11868
- C:\Windows\System\hrMJXdr.exe
  C:\Windows\System\hrMJXdr.exe
  2⤵
  PID:11940
- C:\Windows\System\jyQmpaa.exe
  C:\Windows\System\jyQmpaa.exe
  2⤵
  PID:12004
- C:\Windows\System\CEJNkDk.exe
  C:\Windows\System\CEJNkDk.exe
  2⤵
  PID:12068
- C:\Windows\System\RcxdBon.exe
  C:\Windows\System\RcxdBon.exe
  2⤵
  PID:12136
- C:\Windows\System\IEWsVyn.exe
  C:\Windows\System\IEWsVyn.exe
  2⤵
  PID:12224
- C:\Windows\System\NBVIrSm.exe
  C:\Windows\System\NBVIrSm.exe
  2⤵
  PID:12256
- C:\Windows\System\FrQrZuf.exe
  C:\Windows\System\FrQrZuf.exe
  2⤵
  PID:11332
- C:\Windows\System\cEJMnla.exe
  C:\Windows\System\cEJMnla.exe
  2⤵
  PID:11500
- C:\Windows\System\vOtQTiM.exe
  C:\Windows\System\vOtQTiM.exe
  2⤵
  PID:11644
- C:\Windows\System\IgRITop.exe
  C:\Windows\System\IgRITop.exe
  2⤵
  PID:11800
- C:\Windows\System\xmYApos.exe
  C:\Windows\System\xmYApos.exe
  2⤵
  PID:11968
- C:\Windows\System\yjbWnvi.exe
  C:\Windows\System\yjbWnvi.exe
  2⤵
  PID:12112
- C:\Windows\System\dXnHiQe.exe
  C:\Windows\System\dXnHiQe.exe
  2⤵
  PID:12248
- C:\Windows\System\kKXiCuR.exe
  C:\Windows\System\kKXiCuR.exe
  2⤵
  PID:11560
- C:\Windows\System\XRJrjch.exe
  C:\Windows\System\XRJrjch.exe
  2⤵
  PID:11920
- C:\Windows\System\vZDWqLf.exe
  C:\Windows\System\vZDWqLf.exe
  2⤵
  PID:12244
- C:\Windows\System\VUOzxho.exe
  C:\Windows\System\VUOzxho.exe
  2⤵
  PID:11864
- C:\Windows\System\wqwWztY.exe
  C:\Windows\System\wqwWztY.exe
  2⤵
  PID:12296
- C:\Windows\System\QLAPJIV.exe
  C:\Windows\System\QLAPJIV.exe
  2⤵
  PID:12324
- C:\Windows\System\oPWFjzF.exe
  C:\Windows\System\oPWFjzF.exe
  2⤵
  PID:12352
- C:\Windows\System\xoHLqiV.exe
  C:\Windows\System\xoHLqiV.exe
  2⤵
  PID:12380
- C:\Windows\System\wXjqsEP.exe
  C:\Windows\System\wXjqsEP.exe
  2⤵
  PID:12408
- C:\Windows\System\yVpXiIg.exe
  C:\Windows\System\yVpXiIg.exe
  2⤵
  PID:12436
- C:\Windows\System\dqEuzxn.exe
  C:\Windows\System\dqEuzxn.exe
  2⤵
  PID:12464
- C:\Windows\System\byCQMtW.exe
  C:\Windows\System\byCQMtW.exe
  2⤵
  PID:12480
- C:\Windows\System\Agrdvcz.exe
  C:\Windows\System\Agrdvcz.exe
  2⤵
  PID:12516
- C:\Windows\System\GzINPEt.exe
  C:\Windows\System\GzINPEt.exe
  2⤵
  PID:12536
- C:\Windows\System\TtohRJA.exe
  C:\Windows\System\TtohRJA.exe
  2⤵
  PID:12576
- C:\Windows\System\lWhxZEB.exe
  C:\Windows\System\lWhxZEB.exe
  2⤵
  PID:12604
- C:\Windows\System\UFAidEm.exe
  C:\Windows\System\UFAidEm.exe
  2⤵
  PID:12632
- C:\Windows\System\TWOyilx.exe
  C:\Windows\System\TWOyilx.exe
  2⤵
  PID:12660
- C:\Windows\System\zKTRxOn.exe
  C:\Windows\System\zKTRxOn.exe
  2⤵
  PID:12688
- C:\Windows\System\zFyyCYx.exe
  C:\Windows\System\zFyyCYx.exe
  2⤵
  PID:12716
- C:\Windows\System\BKqPKCd.exe
  C:\Windows\System\BKqPKCd.exe
  2⤵
  PID:12744
- C:\Windows\System\nEZkxHC.exe
  C:\Windows\System\nEZkxHC.exe
  2⤵
  PID:12772
- C:\Windows\System\yurnFgK.exe
  C:\Windows\System\yurnFgK.exe
  2⤵
  PID:12812
- C:\Windows\System\lWmBulZ.exe
  C:\Windows\System\lWmBulZ.exe
  2⤵
  PID:12828
- C:\Windows\System\IKWlUnD.exe
  C:\Windows\System\IKWlUnD.exe
  2⤵
  PID:12856
- C:\Windows\System\xaEMEIW.exe
  C:\Windows\System\xaEMEIW.exe
  2⤵
  PID:12884
- C:\Windows\System\uoZxmTm.exe
  C:\Windows\System\uoZxmTm.exe
  2⤵
  PID:12912
- C:\Windows\System\QpGfvfI.exe
  C:\Windows\System\QpGfvfI.exe
  2⤵
  PID:12940
- C:\Windows\System\Ohkbylt.exe
  C:\Windows\System\Ohkbylt.exe
  2⤵
  PID:12972
- C:\Windows\System\WxFCKVj.exe
  C:\Windows\System\WxFCKVj.exe
  2⤵
  PID:13000
- C:\Windows\System\mkLedrq.exe
  C:\Windows\System\mkLedrq.exe
  2⤵
  PID:13028
- C:\Windows\System\AkavdQj.exe
  C:\Windows\System\AkavdQj.exe
  2⤵
  PID:13056
- C:\Windows\System\BOeRGIM.exe
  C:\Windows\System\BOeRGIM.exe
  2⤵
  PID:13084
- C:\Windows\System\PzyEhaN.exe
  C:\Windows\System\PzyEhaN.exe
  2⤵
  PID:13112
- C:\Windows\System\DLjbchM.exe
  C:\Windows\System\DLjbchM.exe
  2⤵
  PID:13140
- C:\Windows\System\bXruVuU.exe
  C:\Windows\System\bXruVuU.exe
  2⤵
  PID:13168
- C:\Windows\System\YItZrjA.exe
  C:\Windows\System\YItZrjA.exe
  2⤵
  PID:13196
- C:\Windows\System\ECOrevD.exe
  C:\Windows\System\ECOrevD.exe
  2⤵
  PID:13224
- C:\Windows\System\fPxVTpW.exe
  C:\Windows\System\fPxVTpW.exe
  2⤵
  PID:13252
- C:\Windows\System\hMpTLYT.exe
  C:\Windows\System\hMpTLYT.exe
  2⤵
  PID:13280
- C:\Windows\System\Xnoxrdu.exe
  C:\Windows\System\Xnoxrdu.exe
  2⤵
  PID:13308
- C:\Windows\System\qXFnbOy.exe
  C:\Windows\System\qXFnbOy.exe
  2⤵
  PID:12336
- C:\Windows\System\XPwKFtx.exe
  C:\Windows\System\XPwKFtx.exe
  2⤵
  PID:12400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2o4bgazp.a1v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2o4bgazp.a1v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AAVfxUJ.exe

Path C:\Windows\System\AAVfxUJ.exe
Size 3.1MB
SHA256 73935be832ccc18f6f847781783070c6ae52c9573c1ab07db55b7502a02e5280
MD5 dd335b4f45deed7669f8b73f88031634
SHA1 6ca114af5091d2c0ddf73ba08733c4b8d18dabca
SHA512 49aa55a25a1a7367c910e1f648a85e3f97ee31df7ac5a4e07a0422df4fd4c5747dd21fd875c9d564887369bd7d6d1f39cf98d532703d0faf0578d9da236c15ad
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AWupcwx.exe

Path C:\Windows\System\AWupcwx.exe
Size 3.1MB
SHA256 8574083df74b75bb4b8d88ec7c03e75718d5ebfc45742352a2d2455cef0e37d5
MD5 567b43823479d28630ec214385a88e35
SHA1 aa385c09235c26e768e829f03395f9df9d465046
SHA512 cf15cadb2e3b66da1cef1bdf173a9d19e615257d28bb44e2604234344263b05e0ea5fb22817ccd361af98b92d87d5c2a50c62bc0ae271d7a5ed19706f8ae7c5e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

CIzlxGT.exe

Path C:\Windows\System\CIzlxGT.exe
Size 3.1MB
SHA256 f07dc614f2002c1dc28591f78687abd5732d31cfeb50dd2392a76a0f592afaa8
MD5 f8fdd88fb87db683ef0f9cbccb20b061
SHA1 478a0adbbb64b7c7f4b870e14f34862831bc35b0
SHA512 68ca50cc90e9f8d22668e6b11396521702800dddf14f3232289238edf9fc8498cdbc58fd98a93e50c712ab6ae1dd0c8f9cc433ec91c791f4b47613bbfeb16c08
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

DQKkZcL.exe

Path C:\Windows\System\DQKkZcL.exe
Size 3.1MB
SHA256 68f646d01194104fe7009f8049a9ebdc55646d8f3335e9097d6eac3403ac11ca
MD5 dfdc02966615dc2d7d35c9935ef59f72
SHA1 83064792bdcfefa39dfd82a762b542e61d74721a
SHA512 5aa5cf5e5bf52399cd4da1e096498af55fa3d730c55692579477fccbb02381bdf47526a2bfac4f0d6d04962d42fb0533b7c38883b82343752c60f2610cba8711
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:7bBeSFk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

FxGuVmf.exe

Path C:\Windows\System\FxGuVmf.exe
Size 3.1MB
SHA256 4a50b5f8f7b3f6a236a8dd87e2dad4e2681bdc93290ff161ee63d2f46e139fff
MD5 f59d84fda5debf236364a04f9a6ab9c8
SHA1 de9ccd270b1ce73d8a367f69250a059a6b15af94
SHA512 692f77aaa207b9093d78a452e14c01d17e476fd19fd6e2fcd38bfc00301305163957c42fe459e348e275089155369a0da5b99195761544e74f8cb89c0327045f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFkR
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMCyAbc.exe

Path C:\Windows\System\HMCyAbc.exe
Size 3.1MB
SHA256 8a831dd1cd9bbbe607e98a87318f6a79b5448850be240ff721978648427c790a
MD5 6ff18b112225195e455bd626f4fbf108
SHA1 c13414a87bed0337c92cfb0651db590cef331963
SHA512 978b10e66730ef2bb6f0d7c8774b4f7ece87fca0548ee8d05b354fbd7f6654ae0738c66e5a183bd4258a50a48c830b213bb7052b4998f2f7510c2ca130f4ac5b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeIjSqT.exe

Path C:\Windows\System\KeIjSqT.exe
Size 3.1MB
SHA256 a99f2eb126e5e9eba8fcf2a40c89d41ead3a24230ee968ad4fa0b796680fe8f4
MD5 7918fc6209a28d2c693d99b62824094e
SHA1 66438c5fb8829c8754619f2669b498f64dd80d48
SHA512 7b61ca0bca9a1f2d007e7b8dc503844a563f40e2491221ce7d01fe7cd8a7dc960931767a78e92f63aa118b4609b801a4dd9b0f6aff355f193502b22094659658
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:7bBeSFkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LhDSgMe.exe

Path C:\Windows\System\LhDSgMe.exe
Size 3.1MB
SHA256 fd731f19549377d8f282528477d93cffa40bb3f7cd02724da442c1119cff7eff
MD5 307aec2338a76926850704c8c096d983
SHA1 626005cea42b044c9948032da2008c95c32d4a40
SHA512 2a666454a3fa038e2a5ccee4814ade01c8fbedc019cb7a5effdc49114d17d004bc6cb43677a74017c8ce48bd15d9ecf113a651a8e18529d8ea918c2c87ac73ab
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MqKHjPZ.exe

Path C:\Windows\System\MqKHjPZ.exe
Size 3.1MB
SHA256 3dea676aea403931b5456e8b9bad9a8f8669768d74b3e8b2b5315dab842cd7ef
MD5 4dc50b97e8601b4386b3dcd431753cbd
SHA1 3f3c30f783a165333c545511520067a4c0190a75
SHA512 01f33e48dc2121f9bce18a747937845863a867ea9f80a5b9e05c1533d569001a456b6d9c807a57a589674090ba88dbbd3b0f17f1bdff5ab3609e9e83c8f9bf22
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

NETOICk.exe

Path C:\Windows\System\NETOICk.exe
Size 3.1MB
SHA256 9aaf922fcb142080a62b5f0a8e4697dfc36c4a3f4fd8d33bdf13a3676638e33f
MD5 7067a4e6645ca77e91843aa25141f536
SHA1 c182f01c8e98b83e1cbf807b69d5b63307e83f1f
SHA512 dd13c9989220d904582966502b293f711fc544c2674690194ad7dab2795de9876ad8b81118491cfbcf952cde70f5cc9e8ceefc3899713fedb741fb8b20890903
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:7bBeSFkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

NHVmnum.exe

Path C:\Windows\System\NHVmnum.exe
Size 3.1MB
SHA256 fc55f3bdd08e0cfec2dde806c99cc20dcfd31d4399f500ec6b342734f82e47ee
MD5 6a04e88d9cc89a2bb7fab92e0196154f
SHA1 3b9278d2aec741e99df2a94f798b93556577f7d8
SHA512 2b271bb01c4dd3606ea2a035a2635ba15e57c26cf1d8dac88daf823766c9fa7c4b15f2344716bf55a5386d9120ce330040ab18300f69ae0cae54fc63af26116b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

NdyLuVc.exe

Path C:\Windows\System\NdyLuVc.exe
Size 3.1MB
SHA256 7a3d5640bc9ef09879f5cf886c08614c3e295290ef1712e528c4807df042770e
MD5 54a5c735672e2cc8a48bbecea7696d9a
SHA1 74ab10a613be7b1b087a96d9811a2ea874a94a26
SHA512 5cd041ecddfc0d07b06ccbca8c02aa0866021270a9a1ad0fdbea1e64ada0e542a95fec124edb7b48c8f616eacf17e4c3cefe79c20b7d3a5d11f77a82710a47c9
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

QZXldCb.exe

Path C:\Windows\System\QZXldCb.exe
Size 3.1MB
SHA256 c350b9771fb8224c6084d17790d5062e9c363ad76e4b383dfd9d0cb0d0bf7655
MD5 768d068466452b221dc28c8c5d231da0
SHA1 df743cbc0ce270b7aea8e7ec1bf52a0780ba98cf
SHA512 c7ed71891939d6adfc826a8346090f496891900e651db71c020d5d4859cb0689bf7c428457e46e675a22fee200ffbec0d0e3cb9ae10aa44a9d8d0d963d5bdf23
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TInqWjZ.exe

Path C:\Windows\System\TInqWjZ.exe
Size 3.1MB
SHA256 a050b4d665681178b98ccfad7a504dfeef42ad8f65100ef05ac06825185356b3
MD5 9b89e018b92000bbc975c32eb4eead2b
SHA1 55671e18282c0292c25e297f9066e1a2d15608b6
SHA512 ea9ce6ace4050a3aa72643a8509fcd23df38774a8a94db46e1c44c3276e6236c31feea42cd06eab732369202bba0fe2be21dc33b089dedcd3160565db8542b80
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ThOYCWg.exe

Path C:\Windows\System\ThOYCWg.exe
Size 3.1MB
SHA256 5cffb3ae0765cf8e4dd91b28ecff3f5d9b5b6c3a5c0e8d05545def9c94603951
MD5 aa87a6db4c2e3718f65661e4141ba2b3
SHA1 2644e5a4263cf809c2a7fb4bfbb0616d117b76e0
SHA512 3715f7e261fd21e651c2ada8b39d4ca33f136d82de8d9b88ba724433a42edf272cc8750939dca6f51f68d723e293ac06ff28014bb47c0313b9060cb5b0342d28
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWt:7bBeSFkR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TzgysOg.exe

Path C:\Windows\System\TzgysOg.exe
Size 3.1MB
SHA256 f9d90fecc29d83794d29279c0b44d79139440cfdfc2eb24920e7183e6dba9d17
MD5 79c56419569d1c36856fec09b21236da
SHA1 958a31d860afab6525b54f6bab842b4893a4d884
SHA512 16ae2a4bc7a6a136c1abe5c178ceb6c60cffb827c9ce6d4119d3e32fe578a862ad94e679875c7e36015c830be605f2594e11fbbe19ce40d71e97f7f3f8c5de8d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:7bBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

UHyfeYF.exe

Path C:\Windows\System\UHyfeYF.exe
Size 3.1MB
SHA256 2fd20dde47bc145f5a0f790d5cc034ffc743157b0910aeb9c0e88816ea59b453
MD5 424a0f3a7154d94a3a3a847e5d6d1f12
SHA1 41a1120b13b94ed9d14070b1d461967f93b11ee6
SHA512 bc37828d3d9841055739bd2b1a4c29f5b41b74529db43434bcc47d2ed73f5995ce1a1a108ded09678933fde3d1b1a0c28e5218f4feb9ba20ba86e2981a9a7d20
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWI:7bBeSFkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMkNGjS.exe

Path C:\Windows\System\WMkNGjS.exe
Size 3.1MB
SHA256 43b2f65034bfd4bd764acf5e0cfb8d9f5ba8482348809f2f70bfb93b09ff99bc
MD5 32cd9f9ff504eed6d61750cfe2595ead
SHA1 18c96b9c8b872235d88b7db71c4f01f81fdcdfb5
SHA512 493d742ff5d003183f35282fc177da40209e057caec3baa5a696ebe43772c25719faec75fe7c2ff471c5682eeef997a47864ba6bced75408a73172e43813735a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWK:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

XyNJFyf.exe

Path C:\Windows\System\XyNJFyf.exe
Size 3.1MB
SHA256 bf1cf987911ef778896802ecc13b7ae599a1dbdf4739f6192d41247fc3698dd1
MD5 dbe4c9335887dbdbe43c9e5979561448
SHA1 9ac5a2acfc14a591f5c9671b40706c162b5849d3
SHA512 803c9685b2426c66cb908848a50347880123328d9a0a3b2e349074922cd17e40604da35519081d713c8c9f0d8312721e9762c8bcea08bf287863d2ba16ed90ec
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aTiPqJw.exe

Path C:\Windows\System\aTiPqJw.exe
Size 3.1MB
SHA256 61e2bb7a3432374a33ac02a501745fd490eca38d452c35445eedec2c04a8c93c
MD5 69efa902e26f8ab080d4d050cdb0290a
SHA1 b3ac0cc7941a18aa7ddbc484748359c7a173213e
SHA512 fd5087299b24dc03dd1f295c31fa7c05a0edc3774fca13d2f017c2283d18590f89b9c4929a62c38449ffcf0b59d5f29157c857e5a75710f787a9babbdb0e1be0
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:7bBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

aotaaGu.exe

Path C:\Windows\System\aotaaGu.exe
Size 3.1MB
SHA256 90a40861548b8e005f64a4f5c365ca399101e2e32d517f7bc4529b68808ae64e
MD5 6f92d3bd4bb976643038160187344082
SHA1 964b998388cc973c42e34405d34bcd007e1a6ae8
SHA512 2e4d60387b342f5adbe2dca3e1f9994888f505e8c816f29e64bb266587ea5fe0d40ea0f587ff3c9dc4a721fc553419ae523c5e780a3c171ff71fbe24d78d3d08
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

dmrOMpP.exe

Path C:\Windows\System\dmrOMpP.exe
Size 3.1MB
SHA256 3a1fb9e716d8d945d114c48ca5773a189627ee84705b842b90bc7052ace8de20
MD5 7903f66884862ef89db94dd64cc4a9fd
SHA1 b54832b4408f97d43405fe4e65809af3476f6183
SHA512 d85546d243efcdd4cc23cf43bebca231bddc22958401da706235856e7b35de97e7bc191afa69d974de1167da1a3bf6164e6c802cbc41d42736b8d1ceb451d0a6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

fvnZGUe.exe

Path C:\Windows\System\fvnZGUe.exe
Size 3.1MB
SHA256 ec64272c1e99de21acc090851fd4bde125673d2a7924c38cde6db9d9fc64ee49
MD5 b26c30d019b64093d37ee386200068dc
SHA1 dab3ef12a9699590087ccb076e906931f44d0264
SHA512 4dba936524c248b89e2c881c9e006630e2df403675fca7932dd22919021bc4776422c3a7efbde40a10fa501f55c3ee36683c67194825c25fe604457c07df42fc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:7bBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

fzIzWIQ.exe

Path C:\Windows\System\fzIzWIQ.exe
Size 3.1MB
SHA256 d48dcfbe29538636f8fc656780041385a270c0e955cf3a7dff8049cf2151a592
MD5 277613d7a3db45b86592a7589df31088
SHA1 6ae41ee8faf539aaacdaee47bb2e64620e666024
SHA512 6316b32ad5fa3c30a97f848c10aa5d77077911d7d6d39e1ef01e996d5f18ea0b019d20fb21615e163a29c5ecb7ed3a93b5408aa61468afc491a69fad32e8b9f7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gInZijq.exe

Path C:\Windows\System\gInZijq.exe
Size 3.1MB
SHA256 b29fd63a2c180940c2578a2aabb897e0c3b499bf4d0d4c22dea173f5e807b3a2
MD5 253c592cebaa5c120d6f955c4a75c0f2
SHA1 c693b7749518eac9a8f2dc6e3e7cad3eaa2f57a7
SHA512 f608b5428cacc30a0735a010b764c9e8a26fe2f249e633bf7ff75b94e547e424bb8eb06aeedd843b886423ad9e36196f82b6a2a2e30fe06b88ffd1acd5f3e43c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gllidtK.exe

Path C:\Windows\System\gllidtK.exe
Size 3.1MB
SHA256 1d4e6391eafc1b0f295218a3116c01315365ca0041d73c315c7c08a4c9fc828d
MD5 f12e5cdbacc0fe0855b40da98ce1a6c3
SHA1 d261890fe3b91046d0b786b428b0d54f0afde590
SHA512 babd3985c98476230fe7bde7235d7ea14d6c2f44e0a2f463dcf18f3fac776131da506ac25eb718cb5bbdec03c2202bf21c61cd555fd0b4362ba15e7ee811b470
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

iwhAJnK.exe

Path C:\Windows\System\iwhAJnK.exe
Size 3.1MB
SHA256 fa282009211bb2182cd3a6266ebb91575863e1a7d3e832c2c70e277ee9a377da
MD5 341380992bc64cd9d2a2a8dc96a3632e
SHA1 bddb5494920b0090bcc432ec6df6a8da0f2d49e2
SHA512 dbc1ec60117c6a96cb26e2e831da561cd3a24a701b3d0698826b3ea53453ff8a6ba2e4629639cd629100412a50c606070dfa77eb284b2a311369a1c819466393
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtCslXO.exe

Path C:\Windows\System\mtCslXO.exe
Size 3.1MB
SHA256 9354a464a6dffa6b74c805b51a0bfbe2df469fd92700b705d18d0221c2edb9f1
MD5 efcae947293ff748b7c5a0a6ac06d7a3
SHA1 563518623817ffc4b00ecef4aaceda628c8bc27e
SHA512 11bac91d593c26d158469d0178c664faa0e20e219847629a95edc5c84d4df158d75e1fe14ba65b46dd0573c0b4b71108d27e830387fdc46ebdb0b6bbb6b9ba8c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWyyZlZ.exe

Path C:\Windows\System\nWyyZlZ.exe
Size 3.1MB
SHA256 1461c38979b4b1724444a14a4b694befe533bec9f3d8eb4f086c72ecccd2ad2a
MD5 d7ee6b57680435505b3059922a71a109
SHA1 11ce1cadf06034ce28e0bf70e10778ce13592f58
SHA512 552c4a9161bc2276a90c08f4c95e577f8953c0ae5f021e29ed96907a65d1e62c0696a68a2cc90febf6dbf1848d81046266517934872f8c869151297b44034307
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:7bBeSFkt
MD5 SHA1 SHA512 SSDEEP

Submit Download

npcVvck.exe

Path C:\Windows\System\npcVvck.exe
Size 3.1MB
SHA256 991a1e8f11a2c18dd3cd5ebe118db03bee82ed10107a715588d79d72ab4e4655
MD5 5fa417ce3169dc9cb156aba46bf4215f
SHA1 48c5af45217565718e0fbe64aaf3501260c1d191
SHA512 c8a534506533385a203b821b48d47e4ab1b2e68d5ca5b3d4ec008fa3003a5160493b64ea46ae03fbfebead0748a70b1c591ba3468ce2242561b013662274e9bb
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ojleLlY.exe

Path C:\Windows\System\ojleLlY.exe
Size 3.1MB
SHA256 d1fa8f3b99834066cb0d9f73494fa9a6faa5e6b4454786a9ddb8415efd663d17
MD5 03aca04d3ecc4e32e2feab2b38329e0a
SHA1 0a9ac89cf8f01c1660428bd43a1289cd5e8a31af
SHA512 3016e5e4a8a12bee418abb5efcb060d75ea09c94064dfedfa5d59c6fa32e65c5064fc2e108d90b0967d5f172a487c5cc7540bda6f4a422150e12fa0e65e4a050
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

tgQdHxB.exe

Path C:\Windows\System\tgQdHxB.exe
Size 8B
SHA256 cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce
MD5 67d893d1a2095d39d451d08ee1cc05e9
SHA1 dad7ef4487e41ff3c3e600250e691ed16832dc94
SHA512 7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d
MD5 SHA1 SHA512

Submit Download

zRUbHOi.exe

Path C:\Windows\System\zRUbHOi.exe
Size 3.1MB
SHA256 6aedfc7ae6a2c473ea7843e06d62ded77963ad9947d5f1d3369f4dceaaecc328
MD5 758b54dd553fef2ed0ffd39c9a906d89
SHA1 e42d8bffab96d55bffe277ef5c6753508f7bc597
SHA512 c8196c2c1bf76f5d5f247e4574b2bd479a8b872855d514529502a6f6286b4f317e7225e372eeac19378a0655b1b02b90a4921e5375d883ae10070401c7dbbbb2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-128-0x00007FF671990000-0x00007FF671D86000-memory.dmp

Download

memory/456-2055-0x00007FF671990000-0x00007FF671D86000-memory.dmp

Download

memory/836-2067-0x00007FF7742D0000-0x00007FF7746C6000-memory.dmp

Download

memory/836-148-0x00007FF7742D0000-0x00007FF7746C6000-memory.dmp

Download

memory/1304-2049-0x00007FF7909B0000-0x00007FF790DA6000-memory.dmp

Download

memory/1304-153-0x00007FF7909B0000-0x00007FF790DA6000-memory.dmp

Download

memory/1340-2057-0x00007FF787640000-0x00007FF787A36000-memory.dmp

Download

memory/1340-141-0x00007FF787640000-0x00007FF787A36000-memory.dmp

Download

memory/1524-2058-0x00007FF717C80000-0x00007FF718076000-memory.dmp

Download

memory/1524-129-0x00007FF717C80000-0x00007FF718076000-memory.dmp

Download

memory/1636-2050-0x00007FF7E9BB0000-0x00007FF7E9FA6000-memory.dmp

Download

memory/1636-57-0x00007FF7E9BB0000-0x00007FF7E9FA6000-memory.dmp

Download

memory/2088-2053-0x00007FF7B6650000-0x00007FF7B6A46000-memory.dmp

Download

memory/2088-115-0x00007FF7B6650000-0x00007FF7B6A46000-memory.dmp

Download

memory/2288-144-0x00007FF6B6A80000-0x00007FF6B6E76000-memory.dmp

Download

memory/2288-2071-0x00007FF6B6A80000-0x00007FF6B6E76000-memory.dmp

Download

memory/2384-2051-0x00007FF6100E0000-0x00007FF6104D6000-memory.dmp

Download

memory/2384-82-0x00007FF6100E0000-0x00007FF6104D6000-memory.dmp

Download

memory/2432-2063-0x00007FF616B40000-0x00007FF616F36000-memory.dmp

Download

memory/2432-150-0x00007FF616B40000-0x00007FF616F36000-memory.dmp

Download

memory/2536-2072-0x00007FF6BCD60000-0x00007FF6BD156000-memory.dmp

Download

memory/2536-156-0x00007FF6BCD60000-0x00007FF6BD156000-memory.dmp

Download

memory/2564-151-0x00007FF6E9D40000-0x00007FF6EA136000-memory.dmp

Download

memory/2564-2061-0x00007FF6E9D40000-0x00007FF6EA136000-memory.dmp

Download

memory/2576-142-0x00007FF757EC0000-0x00007FF7582B6000-memory.dmp

Download

memory/2576-2054-0x00007FF757EC0000-0x00007FF7582B6000-memory.dmp

Download

memory/2584-2060-0x00007FF7C4A10000-0x00007FF7C4E06000-memory.dmp

Download

memory/2584-152-0x00007FF7C4A10000-0x00007FF7C4E06000-memory.dmp

Download

memory/2672-2070-0x00007FF7D8040000-0x00007FF7D8436000-memory.dmp

Download

memory/2672-145-0x00007FF7D8040000-0x00007FF7D8436000-memory.dmp

Download

memory/2900-143-0x00007FF68C500000-0x00007FF68C8F6000-memory.dmp

Download

memory/2900-2066-0x00007FF68C500000-0x00007FF68C8F6000-memory.dmp

Download

memory/3228-158-0x00007FF7E7920000-0x00007FF7E7D16000-memory.dmp

Download

memory/3228-2068-0x00007FF7E7920000-0x00007FF7E7D16000-memory.dmp

Download

memory/3236-155-0x00007FF74C7F0000-0x00007FF74CBE6000-memory.dmp

Download

memory/3236-2059-0x00007FF74C7F0000-0x00007FF74CBE6000-memory.dmp

Download

memory/3616-127-0x00007FF673670000-0x00007FF673A66000-memory.dmp

Download

memory/3616-2056-0x00007FF673670000-0x00007FF673A66000-memory.dmp

Download

memory/3684-2062-0x00007FF7227A0000-0x00007FF722B96000-memory.dmp

Download

memory/3684-149-0x00007FF7227A0000-0x00007FF722B96000-memory.dmp

Download

memory/3720-147-0x00007FF6A0270000-0x00007FF6A0666000-memory.dmp

Download

memory/3720-2064-0x00007FF6A0270000-0x00007FF6A0666000-memory.dmp

Download

memory/3964-157-0x00007FF6E3720000-0x00007FF6E3B16000-memory.dmp

Download

memory/3964-2069-0x00007FF6E3720000-0x00007FF6E3B16000-memory.dmp

Download

memory/3988-5-0x00007FFDB7033000-0x00007FFDB7035000-memory.dmp

Download

memory/3988-21-0x00007FFDB7030000-0x00007FFDB7AF1000-memory.dmp

Download

memory/3988-75-0x00000208DD160000-0x00000208DD182000-memory.dmp

Download

memory/3988-1236-0x00007FFDB7030000-0x00007FFDB7AF1000-memory.dmp

Download

memory/4404-1-0x0000016330DA0000-0x0000016330DB0000-memory.dmp

Download

memory/4404-0-0x00007FF719ED0000-0x00007FF71A2C6000-memory.dmp

Download

memory/4408-2052-0x00007FF7F2C30000-0x00007FF7F3026000-memory.dmp

Download

memory/4408-154-0x00007FF7F2C30000-0x00007FF7F3026000-memory.dmp

Download

memory/4876-2065-0x00007FF776440000-0x00007FF776836000-memory.dmp

Download

memory/4876-146-0x00007FF776440000-0x00007FF776836000-memory.dmp

Download