xmrig | afc5e93fd5fb15dc6541c5dd1b04b66de4d7b5fa134bc4a3a7419b45020ed69d

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
Size 2.7MB
Sample240518-vt7p4sed49
SHA256 afc5e93fd5fb15dc6541c5dd1b04b66de4d7b5fa134bc4a3a7419b45020ed69d
MD5 198cbf3560d34f2b387139fdaf593c20
SHA1 aac3581d8a57a77250dc3ba321723ee43304ff77
SHA512 1efba27fe1b9b277f7356286dcdfaef64aa925336f53128d0a016ac132d85c32104ba0bf6d0ad8b79993a460dc9273549c8dc5dc9dd2afbf2f8e66d65a3dada8
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1652-0-0x00007FF7C0A10000-0x00007FF7C0E06000-memory.dmp	xmrig
behavioral2/files/0x00090000000233f3-5.dat	xmrig
behavioral2/files/0x00070000000233fb-15.dat	xmrig
behavioral2/files/0x00070000000233fd-24.dat	xmrig
behavioral2/files/0x0007000000023400-49.dat	xmrig
behavioral2/files/0x0008000000023403-69.dat	xmrig
behavioral2/memory/1448-109-0x00007FF6B9690000-0x00007FF6B9A86000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-124.dat	xmrig
behavioral2/files/0x0007000000023415-151.dat	xmrig
behavioral2/files/0x0007000000023411-174.dat	xmrig
behavioral2/memory/3340-191-0x00007FF6A6C50000-0x00007FF6A7046000-memory.dmp	xmrig
behavioral2/memory/4644-199-0x00007FF6899F0000-0x00007FF689DE6000-memory.dmp	xmrig
behavioral2/memory/4604-203-0x00007FF6FB400000-0x00007FF6FB7F6000-memory.dmp	xmrig
behavioral2/memory/4788-207-0x00007FF7893C0000-0x00007FF7897B6000-memory.dmp	xmrig
behavioral2/memory/2420-211-0x00007FF7A2460000-0x00007FF7A2856000-memory.dmp	xmrig
behavioral2/memory/3616-213-0x00007FF770480000-0x00007FF770876000-memory.dmp	xmrig
behavioral2/memory/620-212-0x00007FF73CF80000-0x00007FF73D376000-memory.dmp	xmrig
behavioral2/memory/4608-210-0x00007FF7D7320000-0x00007FF7D7716000-memory.dmp	xmrig
behavioral2/memory/1304-209-0x00007FF6E9BE0000-0x00007FF6E9FD6000-memory.dmp	xmrig
behavioral2/memory/2116-208-0x00007FF631ED0000-0x00007FF6322C6000-memory.dmp	xmrig
behavioral2/memory/540-206-0x00007FF7A3F30000-0x00007FF7A4326000-memory.dmp	xmrig
behavioral2/memory/4364-205-0x00007FF7AA2C0000-0x00007FF7AA6B6000-memory.dmp	xmrig
behavioral2/memory/400-204-0x00007FF754CA0000-0x00007FF755096000-memory.dmp	xmrig
behavioral2/memory/8-202-0x00007FF6BA6F0000-0x00007FF6BAAE6000-memory.dmp	xmrig
behavioral2/memory/5052-201-0x00007FF603CC0000-0x00007FF6040B6000-memory.dmp	xmrig
behavioral2/memory/3040-200-0x00007FF6A21F0000-0x00007FF6A25E6000-memory.dmp	xmrig
behavioral2/memory/2688-198-0x00007FF71C610000-0x00007FF71CA06000-memory.dmp	xmrig
behavioral2/memory/848-197-0x00007FF759010000-0x00007FF759406000-memory.dmp	xmrig
behavioral2/memory/2800-187-0x00007FF6DC3A0000-0x00007FF6DC796000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-184.dat	xmrig
behavioral2/files/0x0007000000023413-182.dat	xmrig
behavioral2/files/0x0007000000023419-181.dat	xmrig
behavioral2/files/0x0007000000023418-180.dat	xmrig
behavioral2/memory/2848-178-0x00007FF6BC540000-0x00007FF6BC936000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-172.dat	xmrig
behavioral2/files/0x0007000000023410-170.dat	xmrig
behavioral2/files/0x00080000000233f7-169.dat	xmrig
behavioral2/files/0x000700000002340f-167.dat	xmrig
behavioral2/files/0x0007000000023417-163.dat	xmrig
behavioral2/files/0x0007000000023416-160.dat	xmrig
behavioral2/files/0x000700000002340e-158.dat	xmrig
behavioral2/files/0x000700000002340d-156.dat	xmrig
behavioral2/files/0x0008000000023402-153.dat	xmrig
behavioral2/memory/3492-152-0x00007FF790380000-0x00007FF790776000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-148.dat	xmrig
behavioral2/files/0x000700000002340b-144.dat	xmrig
behavioral2/files/0x0007000000023412-139.dat	xmrig
behavioral2/memory/4316-135-0x00007FF7A6E50000-0x00007FF7A7246000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-120.dat	xmrig
behavioral2/files/0x0007000000023408-114.dat	xmrig
behavioral2/files/0x0007000000023407-102.dat	xmrig
behavioral2/files/0x0007000000023406-99.dat	xmrig
behavioral2/files/0x0007000000023405-93.dat	xmrig
behavioral2/files/0x0007000000023404-88.dat	xmrig
behavioral2/files/0x0007000000023401-74.dat	xmrig
behavioral2/files/0x00070000000233ff-60.dat	xmrig
behavioral2/files/0x00070000000233fe-33.dat	xmrig
behavioral2/files/0x00070000000233fc-31.dat	xmrig
behavioral2/files/0x00070000000233fa-18.dat	xmrig
behavioral2/memory/3632-13-0x00007FF74A830000-0x00007FF74AC26000-memory.dmp	xmrig
behavioral2/memory/3632-2424-0x00007FF74A830000-0x00007FF74AC26000-memory.dmp	xmrig
behavioral2/memory/4608-2426-0x00007FF7D7320000-0x00007FF7D7716000-memory.dmp	xmrig
behavioral2/memory/1448-2425-0x00007FF6B9690000-0x00007FF6B9A86000-memory.dmp	xmrig
behavioral2/memory/2848-2428-0x00007FF6BC540000-0x00007FF6BC936000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	4104	powershell.exe
11	4104	powershell.exe
13	4104	powershell.exe
14	4104	powershell.exe
16	4104	powershell.exe
17	4104	powershell.exe
18	4104	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4104	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3632	LNOtkTh.exe
4608	mqnchKQ.exe
1448	QUnIiDo.exe
4316	dTYzYPQ.exe
3492	GbTOSet.exe
2848	SquRkym.exe
2800	ZkOffMU.exe
3340	blVsNkh.exe
848	ZZwxOim.exe
2420	eNAvHWZ.exe
2688	yCpFANr.exe
4644	GWYpSxz.exe
3040	qsOtIHw.exe
5052	qkvDYCl.exe
8	jjNbjBH.exe
4604	QxkjwDG.exe
400	PqeJFJm.exe
4364	tFBNfZo.exe
620	WOhXyhP.exe
3616	KZETMWq.exe
540	FoGmpoG.exe
4788	iMXcONX.exe
2116	aatfyar.exe
1304	fTgptqp.exe
624	DOjpTTR.exe
4064	FsMPlWy.exe
548	uZUbkrs.exe
1924	dqoQuyK.exe
1276	TxEUCvZ.exe
1768	PvCUoLQ.exe
2976	ZMwLkuk.exe
2948	FzTrwZW.exe
5100	sbIWhPm.exe
4212	XQqHpZU.exe
3780	Oatapux.exe
2636	maRIiDe.exe
3644	gisvSkv.exe
4800	RhVrGBd.exe
2292	oRNlsdg.exe
4908	ADAcJyH.exe
4516	bEbjJyX.exe
1480	hMKcpEY.exe
1936	kvFjieb.exe
3516	GAmAUsk.exe
1272	VQqtMBO.exe
2532	vfvudVY.exe
2684	tcGAxCk.exe
4312	uhEZLXw.exe
1908	refyiIy.exe
3992	eGvealW.exe
3220	ecDBkOo.exe
4028	ajYVAGd.exe
1528	thoRluN.exe
4480	HJQiMvN.exe
3328	KUscLAY.exe
1644	QpjZmsf.exe
2124	IcpmrdN.exe
3128	BAxyizB.exe
2260	yYTbBDT.exe
3520	nlYpDOX.exe
4336	dFjfIAv.exe
3568	eiOEqSm.exe
1796	ASFdbuv.exe
1784	NeXcnqr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1652-0-0x00007FF7C0A10000-0x00007FF7C0E06000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-5.dat	upx
behavioral2/files/0x00070000000233fb-15.dat	upx
behavioral2/files/0x00070000000233fd-24.dat	upx
behavioral2/files/0x0007000000023400-49.dat	upx
behavioral2/files/0x0008000000023403-69.dat	upx
behavioral2/memory/1448-109-0x00007FF6B9690000-0x00007FF6B9A86000-memory.dmp	upx
behavioral2/files/0x000700000002340a-124.dat	upx
behavioral2/files/0x0007000000023415-151.dat	upx
behavioral2/files/0x0007000000023411-174.dat	upx
behavioral2/memory/3340-191-0x00007FF6A6C50000-0x00007FF6A7046000-memory.dmp	upx
behavioral2/memory/4644-199-0x00007FF6899F0000-0x00007FF689DE6000-memory.dmp	upx
behavioral2/memory/4604-203-0x00007FF6FB400000-0x00007FF6FB7F6000-memory.dmp	upx
behavioral2/memory/4788-207-0x00007FF7893C0000-0x00007FF7897B6000-memory.dmp	upx
behavioral2/memory/2420-211-0x00007FF7A2460000-0x00007FF7A2856000-memory.dmp	upx
behavioral2/memory/3616-213-0x00007FF770480000-0x00007FF770876000-memory.dmp	upx
behavioral2/memory/620-212-0x00007FF73CF80000-0x00007FF73D376000-memory.dmp	upx
behavioral2/memory/4608-210-0x00007FF7D7320000-0x00007FF7D7716000-memory.dmp	upx
behavioral2/memory/1304-209-0x00007FF6E9BE0000-0x00007FF6E9FD6000-memory.dmp	upx
behavioral2/memory/2116-208-0x00007FF631ED0000-0x00007FF6322C6000-memory.dmp	upx
behavioral2/memory/540-206-0x00007FF7A3F30000-0x00007FF7A4326000-memory.dmp	upx
behavioral2/memory/4364-205-0x00007FF7AA2C0000-0x00007FF7AA6B6000-memory.dmp	upx
behavioral2/memory/400-204-0x00007FF754CA0000-0x00007FF755096000-memory.dmp	upx
behavioral2/memory/8-202-0x00007FF6BA6F0000-0x00007FF6BAAE6000-memory.dmp	upx
behavioral2/memory/5052-201-0x00007FF603CC0000-0x00007FF6040B6000-memory.dmp	upx
behavioral2/memory/3040-200-0x00007FF6A21F0000-0x00007FF6A25E6000-memory.dmp	upx
behavioral2/memory/2688-198-0x00007FF71C610000-0x00007FF71CA06000-memory.dmp	upx
behavioral2/memory/848-197-0x00007FF759010000-0x00007FF759406000-memory.dmp	upx
behavioral2/memory/2800-187-0x00007FF6DC3A0000-0x00007FF6DC796000-memory.dmp	upx
behavioral2/files/0x000700000002341a-184.dat	upx
behavioral2/files/0x0007000000023413-182.dat	upx
behavioral2/files/0x0007000000023419-181.dat	upx
behavioral2/files/0x0007000000023418-180.dat	upx
behavioral2/memory/2848-178-0x00007FF6BC540000-0x00007FF6BC936000-memory.dmp	upx
behavioral2/files/0x0007000000023414-172.dat	upx
behavioral2/files/0x0007000000023410-170.dat	upx
behavioral2/files/0x00080000000233f7-169.dat	upx
behavioral2/files/0x000700000002340f-167.dat	upx
behavioral2/files/0x0007000000023417-163.dat	upx
behavioral2/files/0x0007000000023416-160.dat	upx
behavioral2/files/0x000700000002340e-158.dat	upx
behavioral2/files/0x000700000002340d-156.dat	upx
behavioral2/files/0x0008000000023402-153.dat	upx
behavioral2/memory/3492-152-0x00007FF790380000-0x00007FF790776000-memory.dmp	upx
behavioral2/files/0x000700000002340c-148.dat	upx
behavioral2/files/0x000700000002340b-144.dat	upx
behavioral2/files/0x0007000000023412-139.dat	upx
behavioral2/memory/4316-135-0x00007FF7A6E50000-0x00007FF7A7246000-memory.dmp	upx
behavioral2/files/0x0007000000023409-120.dat	upx
behavioral2/files/0x0007000000023408-114.dat	upx
behavioral2/files/0x0007000000023407-102.dat	upx
behavioral2/files/0x0007000000023406-99.dat	upx
behavioral2/files/0x0007000000023405-93.dat	upx
behavioral2/files/0x0007000000023404-88.dat	upx
behavioral2/files/0x0007000000023401-74.dat	upx
behavioral2/files/0x00070000000233ff-60.dat	upx
behavioral2/files/0x00070000000233fe-33.dat	upx
behavioral2/files/0x00070000000233fc-31.dat	upx
behavioral2/files/0x00070000000233fa-18.dat	upx
behavioral2/memory/3632-13-0x00007FF74A830000-0x00007FF74AC26000-memory.dmp	upx
behavioral2/memory/3632-2424-0x00007FF74A830000-0x00007FF74AC26000-memory.dmp	upx
behavioral2/memory/4608-2426-0x00007FF7D7320000-0x00007FF7D7716000-memory.dmp	upx
behavioral2/memory/1448-2425-0x00007FF6B9690000-0x00007FF6B9A86000-memory.dmp	upx
behavioral2/memory/2848-2428-0x00007FF6BC540000-0x00007FF6BC936000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xGuGgeV.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ejqiXqx.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\shimNUq.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\NnqLgVh.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ivJFTDT.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\qQpgykn.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\HgwyErL.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\bolYqEc.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\xNfAChz.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\IqiiYgk.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\tPvIOIy.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\fhiqOqd.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\hlFKyYP.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\KRehlSI.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\HtrnsZZ.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\yuQngJN.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\UDhMAIn.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\jWjsuYl.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\cMOtIJa.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\GSfxJVk.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ZtsmVna.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\TTxBUWs.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ndhvddA.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\uufYPHp.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\PRCbDne.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\tCTqLvX.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\srQwjrx.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\dSAbFPb.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\vybuHYP.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\JhjDsdq.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ZtqniMp.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\mgBlNaj.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\DOmnpwd.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\daVBsNC.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\RNlgcFS.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ldNooqr.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\LMvRhwH.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\VTmjKtZ.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\LbXSqDT.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\cMxoINo.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\FBffdDI.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\ZGrEmgE.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\zJrXCqI.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\wanmiUl.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\WhLpXML.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\haWXrlz.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\cnPuRZe.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\WCpUSEH.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\cmJgQoK.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\QPUxpjb.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\yURYjrN.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\EtMNAbX.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\lADOdMG.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\lmScoXJ.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\vFIrAkb.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\kOjluld.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\OEchscP.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\fjpYLNP.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\VOwwdUy.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\aDIOEWn.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\SmtpEME.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\SQWmCRC.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\zZbGQhD.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
File created	C:\Windows\System\CdooqLL.exe	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
Token: SeDebugPrivilege	4104	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4104	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	84
PID 1652 wrote to memory of 4104	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	84
PID 1652 wrote to memory of 3632	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	85
PID 1652 wrote to memory of 3632	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	85
PID 1652 wrote to memory of 4608	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	86
PID 1652 wrote to memory of 4608	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	86
PID 1652 wrote to memory of 1448	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	87
PID 1652 wrote to memory of 1448	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	87
PID 1652 wrote to memory of 4316	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	88
PID 1652 wrote to memory of 4316	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	88
PID 1652 wrote to memory of 3492	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	89
PID 1652 wrote to memory of 3492	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	89
PID 1652 wrote to memory of 2848	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	90
PID 1652 wrote to memory of 2848	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	90
PID 1652 wrote to memory of 2800	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	91
PID 1652 wrote to memory of 2800	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	91
PID 1652 wrote to memory of 3340	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	92
PID 1652 wrote to memory of 3340	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	92
PID 1652 wrote to memory of 848	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	93
PID 1652 wrote to memory of 848	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	93
PID 1652 wrote to memory of 2420	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	94
PID 1652 wrote to memory of 2420	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	94
PID 1652 wrote to memory of 2688	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	95
PID 1652 wrote to memory of 2688	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	95
PID 1652 wrote to memory of 4644	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	96
PID 1652 wrote to memory of 4644	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	96
PID 1652 wrote to memory of 3040	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	97
PID 1652 wrote to memory of 3040	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	97
PID 1652 wrote to memory of 5052	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	98
PID 1652 wrote to memory of 5052	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	98
PID 1652 wrote to memory of 8	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	99
PID 1652 wrote to memory of 8	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	99
PID 1652 wrote to memory of 4604	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	100
PID 1652 wrote to memory of 4604	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	100
PID 1652 wrote to memory of 400	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	101
PID 1652 wrote to memory of 400	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	101
PID 1652 wrote to memory of 4364	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	102
PID 1652 wrote to memory of 4364	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	102
PID 1652 wrote to memory of 620	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	103
PID 1652 wrote to memory of 620	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	103
PID 1652 wrote to memory of 3616	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	104
PID 1652 wrote to memory of 3616	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	104
PID 1652 wrote to memory of 540	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	105
PID 1652 wrote to memory of 540	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	105
PID 1652 wrote to memory of 4788	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	106
PID 1652 wrote to memory of 4788	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	106
PID 1652 wrote to memory of 2116	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	107
PID 1652 wrote to memory of 2116	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	107
PID 1652 wrote to memory of 1304	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	108
PID 1652 wrote to memory of 1304	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	108
PID 1652 wrote to memory of 624	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	109
PID 1652 wrote to memory of 624	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	109
PID 1652 wrote to memory of 4064	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	110
PID 1652 wrote to memory of 4064	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	110
PID 1652 wrote to memory of 548	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	111
PID 1652 wrote to memory of 548	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	111
PID 1652 wrote to memory of 2948	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	112
PID 1652 wrote to memory of 2948	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	112
PID 1652 wrote to memory of 1924	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	113
PID 1652 wrote to memory of 1924	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	113
PID 1652 wrote to memory of 1276	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	114
PID 1652 wrote to memory of 1276	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	114
PID 1652 wrote to memory of 1768	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	115
PID 1652 wrote to memory of 1768	1652	198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\198cbf3560d34f2b387139fdaf593c20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\System\LNOtkTh.exe
  C:\Windows\System\LNOtkTh.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\mqnchKQ.exe
  C:\Windows\System\mqnchKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\QUnIiDo.exe
  C:\Windows\System\QUnIiDo.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\dTYzYPQ.exe
  C:\Windows\System\dTYzYPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\GbTOSet.exe
  C:\Windows\System\GbTOSet.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\SquRkym.exe
  C:\Windows\System\SquRkym.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ZkOffMU.exe
  C:\Windows\System\ZkOffMU.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\blVsNkh.exe
  C:\Windows\System\blVsNkh.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\ZZwxOim.exe
  C:\Windows\System\ZZwxOim.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\eNAvHWZ.exe
  C:\Windows\System\eNAvHWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\yCpFANr.exe
  C:\Windows\System\yCpFANr.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\GWYpSxz.exe
  C:\Windows\System\GWYpSxz.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\qsOtIHw.exe
  C:\Windows\System\qsOtIHw.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\qkvDYCl.exe
  C:\Windows\System\qkvDYCl.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\jjNbjBH.exe
  C:\Windows\System\jjNbjBH.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\QxkjwDG.exe
  C:\Windows\System\QxkjwDG.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\PqeJFJm.exe
  C:\Windows\System\PqeJFJm.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\tFBNfZo.exe
  C:\Windows\System\tFBNfZo.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\WOhXyhP.exe
  C:\Windows\System\WOhXyhP.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\KZETMWq.exe
  C:\Windows\System\KZETMWq.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\FoGmpoG.exe
  C:\Windows\System\FoGmpoG.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\iMXcONX.exe
  C:\Windows\System\iMXcONX.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\aatfyar.exe
  C:\Windows\System\aatfyar.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\fTgptqp.exe
  C:\Windows\System\fTgptqp.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\DOjpTTR.exe
  C:\Windows\System\DOjpTTR.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\FsMPlWy.exe
  C:\Windows\System\FsMPlWy.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\uZUbkrs.exe
  C:\Windows\System\uZUbkrs.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\FzTrwZW.exe
  C:\Windows\System\FzTrwZW.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\dqoQuyK.exe
  C:\Windows\System\dqoQuyK.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\TxEUCvZ.exe
  C:\Windows\System\TxEUCvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\PvCUoLQ.exe
  C:\Windows\System\PvCUoLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\ZMwLkuk.exe
  C:\Windows\System\ZMwLkuk.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\sbIWhPm.exe
  C:\Windows\System\sbIWhPm.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\XQqHpZU.exe
  C:\Windows\System\XQqHpZU.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\Oatapux.exe
  C:\Windows\System\Oatapux.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\maRIiDe.exe
  C:\Windows\System\maRIiDe.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\gisvSkv.exe
  C:\Windows\System\gisvSkv.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\RhVrGBd.exe
  C:\Windows\System\RhVrGBd.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\ADAcJyH.exe
  C:\Windows\System\ADAcJyH.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\oRNlsdg.exe
  C:\Windows\System\oRNlsdg.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\bEbjJyX.exe
  C:\Windows\System\bEbjJyX.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\hMKcpEY.exe
  C:\Windows\System\hMKcpEY.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\kvFjieb.exe
  C:\Windows\System\kvFjieb.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\GAmAUsk.exe
  C:\Windows\System\GAmAUsk.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\VQqtMBO.exe
  C:\Windows\System\VQqtMBO.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\vfvudVY.exe
  C:\Windows\System\vfvudVY.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\tcGAxCk.exe
  C:\Windows\System\tcGAxCk.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\uhEZLXw.exe
  C:\Windows\System\uhEZLXw.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\refyiIy.exe
  C:\Windows\System\refyiIy.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\eGvealW.exe
  C:\Windows\System\eGvealW.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\ecDBkOo.exe
  C:\Windows\System\ecDBkOo.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\ajYVAGd.exe
  C:\Windows\System\ajYVAGd.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\thoRluN.exe
  C:\Windows\System\thoRluN.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\HJQiMvN.exe
  C:\Windows\System\HJQiMvN.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\KUscLAY.exe
  C:\Windows\System\KUscLAY.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\QpjZmsf.exe
  C:\Windows\System\QpjZmsf.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\IcpmrdN.exe
  C:\Windows\System\IcpmrdN.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\BAxyizB.exe
  C:\Windows\System\BAxyizB.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\yYTbBDT.exe
  C:\Windows\System\yYTbBDT.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\nlYpDOX.exe
  C:\Windows\System\nlYpDOX.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\dFjfIAv.exe
  C:\Windows\System\dFjfIAv.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\eiOEqSm.exe
  C:\Windows\System\eiOEqSm.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ASFdbuv.exe
  C:\Windows\System\ASFdbuv.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\NeXcnqr.exe
  C:\Windows\System\NeXcnqr.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\uOtYMCK.exe
  C:\Windows\System\uOtYMCK.exe
  2⤵
  PID:3576
- C:\Windows\System\dRXIAJC.exe
  C:\Windows\System\dRXIAJC.exe
  2⤵
  PID:2568
- C:\Windows\System\mXtsqPZ.exe
  C:\Windows\System\mXtsqPZ.exe
  2⤵
  PID:4692
- C:\Windows\System\AqEuCaY.exe
  C:\Windows\System\AqEuCaY.exe
  2⤵
  PID:1188
- C:\Windows\System\QLHTzLE.exe
  C:\Windows\System\QLHTzLE.exe
  2⤵
  PID:4956
- C:\Windows\System\JFSyRrH.exe
  C:\Windows\System\JFSyRrH.exe
  2⤵
  PID:60
- C:\Windows\System\DuvRUTt.exe
  C:\Windows\System\DuvRUTt.exe
  2⤵
  PID:4476
- C:\Windows\System\wiOXHGk.exe
  C:\Windows\System\wiOXHGk.exe
  2⤵
  PID:412
- C:\Windows\System\oXyIbyz.exe
  C:\Windows\System\oXyIbyz.exe
  2⤵
  PID:3900
- C:\Windows\System\TyXySVr.exe
  C:\Windows\System\TyXySVr.exe
  2⤵
  PID:1952
- C:\Windows\System\PqzMGgd.exe
  C:\Windows\System\PqzMGgd.exe
  2⤵
  PID:3488
- C:\Windows\System\WVkUDeb.exe
  C:\Windows\System\WVkUDeb.exe
  2⤵
  PID:3216
- C:\Windows\System\OIlYaFD.exe
  C:\Windows\System\OIlYaFD.exe
  2⤵
  PID:4084
- C:\Windows\System\fzIXWII.exe
  C:\Windows\System\fzIXWII.exe
  2⤵
  PID:2468
- C:\Windows\System\bDzfEgB.exe
  C:\Windows\System\bDzfEgB.exe
  2⤵
  PID:5084
- C:\Windows\System\eJnveab.exe
  C:\Windows\System\eJnveab.exe
  2⤵
  PID:4240
- C:\Windows\System\lIwlXIs.exe
  C:\Windows\System\lIwlXIs.exe
  2⤵
  PID:3096
- C:\Windows\System\LohtRsG.exe
  C:\Windows\System\LohtRsG.exe
  2⤵
  PID:3840
- C:\Windows\System\JfNtnGv.exe
  C:\Windows\System\JfNtnGv.exe
  2⤵
  PID:5112
- C:\Windows\System\dXppKfY.exe
  C:\Windows\System\dXppKfY.exe
  2⤵
  PID:2220
- C:\Windows\System\wWhtQat.exe
  C:\Windows\System\wWhtQat.exe
  2⤵
  PID:1704
- C:\Windows\System\DlqKtKI.exe
  C:\Windows\System\DlqKtKI.exe
  2⤵
  PID:4704
- C:\Windows\System\UHWMHzl.exe
  C:\Windows\System\UHWMHzl.exe
  2⤵
  PID:2404
- C:\Windows\System\qPlkOjU.exe
  C:\Windows\System\qPlkOjU.exe
  2⤵
  PID:1200
- C:\Windows\System\iSdPAJC.exe
  C:\Windows\System\iSdPAJC.exe
  2⤵
  PID:1352
- C:\Windows\System\iuYowdx.exe
  C:\Windows\System\iuYowdx.exe
  2⤵
  PID:3828
- C:\Windows\System\vGfjiWD.exe
  C:\Windows\System\vGfjiWD.exe
  2⤵
  PID:3260
- C:\Windows\System\gwQQBDv.exe
  C:\Windows\System\gwQQBDv.exe
  2⤵
  PID:5140
- C:\Windows\System\IqnXzjS.exe
  C:\Windows\System\IqnXzjS.exe
  2⤵
  PID:5176
- C:\Windows\System\sihrzjp.exe
  C:\Windows\System\sihrzjp.exe
  2⤵
  PID:5220
- C:\Windows\System\GxfPnBq.exe
  C:\Windows\System\GxfPnBq.exe
  2⤵
  PID:5260
- C:\Windows\System\VixajeZ.exe
  C:\Windows\System\VixajeZ.exe
  2⤵
  PID:5288
- C:\Windows\System\SRgSIYh.exe
  C:\Windows\System\SRgSIYh.exe
  2⤵
  PID:5308
- C:\Windows\System\tJzhAEN.exe
  C:\Windows\System\tJzhAEN.exe
  2⤵
  PID:5348
- C:\Windows\System\vfocVmh.exe
  C:\Windows\System\vfocVmh.exe
  2⤵
  PID:5380
- C:\Windows\System\HSCMLBY.exe
  C:\Windows\System\HSCMLBY.exe
  2⤵
  PID:5412
- C:\Windows\System\DNAENSr.exe
  C:\Windows\System\DNAENSr.exe
  2⤵
  PID:5428
- C:\Windows\System\GWVBqJA.exe
  C:\Windows\System\GWVBqJA.exe
  2⤵
  PID:5472
- C:\Windows\System\zcwaHVJ.exe
  C:\Windows\System\zcwaHVJ.exe
  2⤵
  PID:5488
- C:\Windows\System\MvfiKLK.exe
  C:\Windows\System\MvfiKLK.exe
  2⤵
  PID:5512
- C:\Windows\System\HgwyErL.exe
  C:\Windows\System\HgwyErL.exe
  2⤵
  PID:5536
- C:\Windows\System\YZIwmoq.exe
  C:\Windows\System\YZIwmoq.exe
  2⤵
  PID:5580
- C:\Windows\System\LXvPzqN.exe
  C:\Windows\System\LXvPzqN.exe
  2⤵
  PID:5604
- C:\Windows\System\fCBHWZQ.exe
  C:\Windows\System\fCBHWZQ.exe
  2⤵
  PID:5636
- C:\Windows\System\cWDqCno.exe
  C:\Windows\System\cWDqCno.exe
  2⤵
  PID:5668
- C:\Windows\System\BpnacDf.exe
  C:\Windows\System\BpnacDf.exe
  2⤵
  PID:5696
- C:\Windows\System\IRIOVzM.exe
  C:\Windows\System\IRIOVzM.exe
  2⤵
  PID:5732
- C:\Windows\System\hBiWPTX.exe
  C:\Windows\System\hBiWPTX.exe
  2⤵
  PID:5756
- C:\Windows\System\ztqMYhm.exe
  C:\Windows\System\ztqMYhm.exe
  2⤵
  PID:5796
- C:\Windows\System\HIoRYSw.exe
  C:\Windows\System\HIoRYSw.exe
  2⤵
  PID:5828
- C:\Windows\System\frgqKOi.exe
  C:\Windows\System\frgqKOi.exe
  2⤵
  PID:5856
- C:\Windows\System\fKrlpSN.exe
  C:\Windows\System\fKrlpSN.exe
  2⤵
  PID:5892
- C:\Windows\System\SjvOfJR.exe
  C:\Windows\System\SjvOfJR.exe
  2⤵
  PID:5932
- C:\Windows\System\HvIteGI.exe
  C:\Windows\System\HvIteGI.exe
  2⤵
  PID:5964
- C:\Windows\System\sDMlFNi.exe
  C:\Windows\System\sDMlFNi.exe
  2⤵
  PID:5992
- C:\Windows\System\TMRWcDV.exe
  C:\Windows\System\TMRWcDV.exe
  2⤵
  PID:6028
- C:\Windows\System\HDqUSfC.exe
  C:\Windows\System\HDqUSfC.exe
  2⤵
  PID:6052
- C:\Windows\System\XmAsXHU.exe
  C:\Windows\System\XmAsXHU.exe
  2⤵
  PID:6072
- C:\Windows\System\cBGHOvr.exe
  C:\Windows\System\cBGHOvr.exe
  2⤵
  PID:6112
- C:\Windows\System\zFTqdDc.exe
  C:\Windows\System\zFTqdDc.exe
  2⤵
  PID:6140
- C:\Windows\System\rToFqJZ.exe
  C:\Windows\System\rToFqJZ.exe
  2⤵
  PID:5164
- C:\Windows\System\LuquJNe.exe
  C:\Windows\System\LuquJNe.exe
  2⤵
  PID:5208
- C:\Windows\System\sFqRRrn.exe
  C:\Windows\System\sFqRRrn.exe
  2⤵
  PID:5244
- C:\Windows\System\KpxflfB.exe
  C:\Windows\System\KpxflfB.exe
  2⤵
  PID:5344
- C:\Windows\System\zFmBBtv.exe
  C:\Windows\System\zFmBBtv.exe
  2⤵
  PID:5400
- C:\Windows\System\zUPRfXz.exe
  C:\Windows\System\zUPRfXz.exe
  2⤵
  PID:5484
- C:\Windows\System\iaOovSQ.exe
  C:\Windows\System\iaOovSQ.exe
  2⤵
  PID:5496
- C:\Windows\System\HvOHmuf.exe
  C:\Windows\System\HvOHmuf.exe
  2⤵
  PID:5616
- C:\Windows\System\wimshCt.exe
  C:\Windows\System\wimshCt.exe
  2⤵
  PID:5648
- C:\Windows\System\FfPxQxM.exe
  C:\Windows\System\FfPxQxM.exe
  2⤵
  PID:5712
- C:\Windows\System\GCWuTGm.exe
  C:\Windows\System\GCWuTGm.exe
  2⤵
  PID:5748
- C:\Windows\System\AKGvqmp.exe
  C:\Windows\System\AKGvqmp.exe
  2⤵
  PID:5844
- C:\Windows\System\tDtWbjK.exe
  C:\Windows\System\tDtWbjK.exe
  2⤵
  PID:5920
- C:\Windows\System\DnRXNJy.exe
  C:\Windows\System\DnRXNJy.exe
  2⤵
  PID:5988
- C:\Windows\System\bbtcMRo.exe
  C:\Windows\System\bbtcMRo.exe
  2⤵
  PID:6060
- C:\Windows\System\zWyVfyT.exe
  C:\Windows\System\zWyVfyT.exe
  2⤵
  PID:6124
- C:\Windows\System\VEsMZef.exe
  C:\Windows\System\VEsMZef.exe
  2⤵
  PID:5200
- C:\Windows\System\tonKKWf.exe
  C:\Windows\System\tonKKWf.exe
  2⤵
  PID:5372
- C:\Windows\System\sSWHLrT.exe
  C:\Windows\System\sSWHLrT.exe
  2⤵
  PID:5444
- C:\Windows\System\nxVAgvn.exe
  C:\Windows\System\nxVAgvn.exe
  2⤵
  PID:5592
- C:\Windows\System\MtpdkAV.exe
  C:\Windows\System\MtpdkAV.exe
  2⤵
  PID:5688
- C:\Windows\System\bENunoP.exe
  C:\Windows\System\bENunoP.exe
  2⤵
  PID:5792
- C:\Windows\System\ewQsBVc.exe
  C:\Windows\System\ewQsBVc.exe
  2⤵
  PID:5884
- C:\Windows\System\QUNnHBu.exe
  C:\Windows\System\QUNnHBu.exe
  2⤵
  PID:5976
- C:\Windows\System\epUiULx.exe
  C:\Windows\System\epUiULx.exe
  2⤵
  PID:5160
- C:\Windows\System\ZjrfTnV.exe
  C:\Windows\System\ZjrfTnV.exe
  2⤵
  PID:5480
- C:\Windows\System\uptkdXr.exe
  C:\Windows\System\uptkdXr.exe
  2⤵
  PID:5848
- C:\Windows\System\xUooMdO.exe
  C:\Windows\System\xUooMdO.exe
  2⤵
  PID:6172
- C:\Windows\System\FMhAQjT.exe
  C:\Windows\System\FMhAQjT.exe
  2⤵
  PID:6208
- C:\Windows\System\xMHqMBC.exe
  C:\Windows\System\xMHqMBC.exe
  2⤵
  PID:6248
- C:\Windows\System\fQxsAXY.exe
  C:\Windows\System\fQxsAXY.exe
  2⤵
  PID:6276
- C:\Windows\System\koKlsMo.exe
  C:\Windows\System\koKlsMo.exe
  2⤵
  PID:6312
- C:\Windows\System\GCyjRuG.exe
  C:\Windows\System\GCyjRuG.exe
  2⤵
  PID:6340
- C:\Windows\System\hWBxrmV.exe
  C:\Windows\System\hWBxrmV.exe
  2⤵
  PID:6356
- C:\Windows\System\sZNElwj.exe
  C:\Windows\System\sZNElwj.exe
  2⤵
  PID:6392
- C:\Windows\System\kRyPIgk.exe
  C:\Windows\System\kRyPIgk.exe
  2⤵
  PID:6424
- C:\Windows\System\lKGlZxs.exe
  C:\Windows\System\lKGlZxs.exe
  2⤵
  PID:6452
- C:\Windows\System\yqdMEQM.exe
  C:\Windows\System\yqdMEQM.exe
  2⤵
  PID:6488
- C:\Windows\System\LZDzGML.exe
  C:\Windows\System\LZDzGML.exe
  2⤵
  PID:6504
- C:\Windows\System\MVcfKGu.exe
  C:\Windows\System\MVcfKGu.exe
  2⤵
  PID:6524
- C:\Windows\System\VtPClip.exe
  C:\Windows\System\VtPClip.exe
  2⤵
  PID:6540
- C:\Windows\System\IQYuEMX.exe
  C:\Windows\System\IQYuEMX.exe
  2⤵
  PID:6568
- C:\Windows\System\OftmjZR.exe
  C:\Windows\System\OftmjZR.exe
  2⤵
  PID:6604
- C:\Windows\System\nGhAtuS.exe
  C:\Windows\System\nGhAtuS.exe
  2⤵
  PID:6636
- C:\Windows\System\EHeoFAe.exe
  C:\Windows\System\EHeoFAe.exe
  2⤵
  PID:6676
- C:\Windows\System\oCeqkyK.exe
  C:\Windows\System\oCeqkyK.exe
  2⤵
  PID:6692
- C:\Windows\System\kMcbrAt.exe
  C:\Windows\System\kMcbrAt.exe
  2⤵
  PID:6712
- C:\Windows\System\oKNYPVA.exe
  C:\Windows\System\oKNYPVA.exe
  2⤵
  PID:6748
- C:\Windows\System\vQAtZXn.exe
  C:\Windows\System\vQAtZXn.exe
  2⤵
  PID:6796
- C:\Windows\System\QVRVqWa.exe
  C:\Windows\System\QVRVqWa.exe
  2⤵
  PID:6816
- C:\Windows\System\XFInokT.exe
  C:\Windows\System\XFInokT.exe
  2⤵
  PID:6844
- C:\Windows\System\Etgnspr.exe
  C:\Windows\System\Etgnspr.exe
  2⤵
  PID:6872
- C:\Windows\System\oXcsPfs.exe
  C:\Windows\System\oXcsPfs.exe
  2⤵
  PID:6888
- C:\Windows\System\qFyMXdj.exe
  C:\Windows\System\qFyMXdj.exe
  2⤵
  PID:6920
- C:\Windows\System\sepPYYK.exe
  C:\Windows\System\sepPYYK.exe
  2⤵
  PID:6948
- C:\Windows\System\NsnYJhk.exe
  C:\Windows\System\NsnYJhk.exe
  2⤵
  PID:6980
- C:\Windows\System\BKVDtrK.exe
  C:\Windows\System\BKVDtrK.exe
  2⤵
  PID:7020
- C:\Windows\System\ODyUsmn.exe
  C:\Windows\System\ODyUsmn.exe
  2⤵
  PID:7048
- C:\Windows\System\ehBIlFs.exe
  C:\Windows\System\ehBIlFs.exe
  2⤵
  PID:7068
- C:\Windows\System\kOjluld.exe
  C:\Windows\System\kOjluld.exe
  2⤵
  PID:7112
- C:\Windows\System\PQZESRq.exe
  C:\Windows\System\PQZESRq.exe
  2⤵
  PID:7136
- C:\Windows\System\XQXiZoh.exe
  C:\Windows\System\XQXiZoh.exe
  2⤵
  PID:6044
- C:\Windows\System\xuEBGpl.exe
  C:\Windows\System\xuEBGpl.exe
  2⤵
  PID:5556
- C:\Windows\System\jEhuyFc.exe
  C:\Windows\System\jEhuyFc.exe
  2⤵
  PID:6180
- C:\Windows\System\Yxpbsjh.exe
  C:\Windows\System\Yxpbsjh.exe
  2⤵
  PID:6232
- C:\Windows\System\YRwgyhi.exe
  C:\Windows\System\YRwgyhi.exe
  2⤵
  PID:6308
- C:\Windows\System\uqyALcW.exe
  C:\Windows\System\uqyALcW.exe
  2⤵
  PID:6380
- C:\Windows\System\vACMsut.exe
  C:\Windows\System\vACMsut.exe
  2⤵
  PID:6412
- C:\Windows\System\QGUyqgg.exe
  C:\Windows\System\QGUyqgg.exe
  2⤵
  PID:6476
- C:\Windows\System\fECbbfY.exe
  C:\Windows\System\fECbbfY.exe
  2⤵
  PID:6552
- C:\Windows\System\ueHaMTZ.exe
  C:\Windows\System\ueHaMTZ.exe
  2⤵
  PID:6620
- C:\Windows\System\LCZwxNL.exe
  C:\Windows\System\LCZwxNL.exe
  2⤵
  PID:6700
- C:\Windows\System\zmuXbbU.exe
  C:\Windows\System\zmuXbbU.exe
  2⤵
  PID:6744
- C:\Windows\System\tOGAWvp.exe
  C:\Windows\System\tOGAWvp.exe
  2⤵
  PID:6812
- C:\Windows\System\qwyShVD.exe
  C:\Windows\System\qwyShVD.exe
  2⤵
  PID:6880
- C:\Windows\System\evZHVpk.exe
  C:\Windows\System\evZHVpk.exe
  2⤵
  PID:6908
- C:\Windows\System\dNrrKAe.exe
  C:\Windows\System\dNrrKAe.exe
  2⤵
  PID:6996
- C:\Windows\System\hAfJGMb.exe
  C:\Windows\System\hAfJGMb.exe
  2⤵
  PID:7084
- C:\Windows\System\qveBrIh.exe
  C:\Windows\System\qveBrIh.exe
  2⤵
  PID:5276
- C:\Windows\System\USOjdzf.exe
  C:\Windows\System\USOjdzf.exe
  2⤵
  PID:6244
- C:\Windows\System\mQmpMpp.exe
  C:\Windows\System\mQmpMpp.exe
  2⤵
  PID:6464
- C:\Windows\System\cjjEZZJ.exe
  C:\Windows\System\cjjEZZJ.exe
  2⤵
  PID:6600
- C:\Windows\System\NueaZOk.exe
  C:\Windows\System\NueaZOk.exe
  2⤵
  PID:6720
- C:\Windows\System\TUbvfBU.exe
  C:\Windows\System\TUbvfBU.exe
  2⤵
  PID:6928
- C:\Windows\System\nYnLbHt.exe
  C:\Windows\System\nYnLbHt.exe
  2⤵
  PID:7108
- C:\Windows\System\ZPcQWah.exe
  C:\Windows\System\ZPcQWah.exe
  2⤵
  PID:6556
- C:\Windows\System\OmbsfLa.exe
  C:\Windows\System\OmbsfLa.exe
  2⤵
  PID:3012
- C:\Windows\System\wfKgbmL.exe
  C:\Windows\System\wfKgbmL.exe
  2⤵
  PID:6828
- C:\Windows\System\jHGkNGz.exe
  C:\Windows\System\jHGkNGz.exe
  2⤵
  PID:6532
- C:\Windows\System\nxhbAxe.exe
  C:\Windows\System\nxhbAxe.exe
  2⤵
  PID:7196
- C:\Windows\System\IqJPPPJ.exe
  C:\Windows\System\IqJPPPJ.exe
  2⤵
  PID:7228
- C:\Windows\System\RYAVeml.exe
  C:\Windows\System\RYAVeml.exe
  2⤵
  PID:7260
- C:\Windows\System\FAGcuRv.exe
  C:\Windows\System\FAGcuRv.exe
  2⤵
  PID:7288
- C:\Windows\System\zyGNorQ.exe
  C:\Windows\System\zyGNorQ.exe
  2⤵
  PID:7336
- C:\Windows\System\JhjDsdq.exe
  C:\Windows\System\JhjDsdq.exe
  2⤵
  PID:7360
- C:\Windows\System\pSaZeyk.exe
  C:\Windows\System\pSaZeyk.exe
  2⤵
  PID:7384
- C:\Windows\System\iiEFHHF.exe
  C:\Windows\System\iiEFHHF.exe
  2⤵
  PID:7400
- C:\Windows\System\TnWuaJk.exe
  C:\Windows\System\TnWuaJk.exe
  2⤵
  PID:7428
- C:\Windows\System\gfFFGTd.exe
  C:\Windows\System\gfFFGTd.exe
  2⤵
  PID:7464
- C:\Windows\System\uYvwhEk.exe
  C:\Windows\System\uYvwhEk.exe
  2⤵
  PID:7500
- C:\Windows\System\wQtAdHz.exe
  C:\Windows\System\wQtAdHz.exe
  2⤵
  PID:7548
- C:\Windows\System\lkeBwzw.exe
  C:\Windows\System\lkeBwzw.exe
  2⤵
  PID:7564
- C:\Windows\System\mKCIUPO.exe
  C:\Windows\System\mKCIUPO.exe
  2⤵
  PID:7596
- C:\Windows\System\XpJKUTn.exe
  C:\Windows\System\XpJKUTn.exe
  2⤵
  PID:7648
- C:\Windows\System\pxCiedM.exe
  C:\Windows\System\pxCiedM.exe
  2⤵
  PID:7680
- C:\Windows\System\GRrqCIO.exe
  C:\Windows\System\GRrqCIO.exe
  2⤵
  PID:7716
- C:\Windows\System\qUsamgy.exe
  C:\Windows\System\qUsamgy.exe
  2⤵
  PID:7740
- C:\Windows\System\RBKUInD.exe
  C:\Windows\System\RBKUInD.exe
  2⤵
  PID:7764
- C:\Windows\System\NYeQRxu.exe
  C:\Windows\System\NYeQRxu.exe
  2⤵
  PID:7796
- C:\Windows\System\gzwEqqT.exe
  C:\Windows\System\gzwEqqT.exe
  2⤵
  PID:7816
- C:\Windows\System\kIlFZsj.exe
  C:\Windows\System\kIlFZsj.exe
  2⤵
  PID:7852
- C:\Windows\System\ZVgNfmL.exe
  C:\Windows\System\ZVgNfmL.exe
  2⤵
  PID:7884
- C:\Windows\System\fqAJdVY.exe
  C:\Windows\System\fqAJdVY.exe
  2⤵
  PID:7920
- C:\Windows\System\XPYafYU.exe
  C:\Windows\System\XPYafYU.exe
  2⤵
  PID:7952
- C:\Windows\System\WCRMBlO.exe
  C:\Windows\System\WCRMBlO.exe
  2⤵
  PID:8000
- C:\Windows\System\NElOZtB.exe
  C:\Windows\System\NElOZtB.exe
  2⤵
  PID:8052
- C:\Windows\System\GbCJywD.exe
  C:\Windows\System\GbCJywD.exe
  2⤵
  PID:8084
- C:\Windows\System\UTrVyDg.exe
  C:\Windows\System\UTrVyDg.exe
  2⤵
  PID:8116
- C:\Windows\System\zCCmbkc.exe
  C:\Windows\System\zCCmbkc.exe
  2⤵
  PID:8144
- C:\Windows\System\TgBqUEb.exe
  C:\Windows\System\TgBqUEb.exe
  2⤵
  PID:8176
- C:\Windows\System\TtzSULg.exe
  C:\Windows\System\TtzSULg.exe
  2⤵
  PID:7188
- C:\Windows\System\rxNKkhl.exe
  C:\Windows\System\rxNKkhl.exe
  2⤵
  PID:7300
- C:\Windows\System\lIFzDpO.exe
  C:\Windows\System\lIFzDpO.exe
  2⤵
  PID:4304
- C:\Windows\System\YpslIxf.exe
  C:\Windows\System\YpslIxf.exe
  2⤵
  PID:7412
- C:\Windows\System\EspQafD.exe
  C:\Windows\System\EspQafD.exe
  2⤵
  PID:7508
- C:\Windows\System\CbyOAsg.exe
  C:\Windows\System\CbyOAsg.exe
  2⤵
  PID:2232
- C:\Windows\System\FcCsEYE.exe
  C:\Windows\System\FcCsEYE.exe
  2⤵
  PID:7588
- C:\Windows\System\kxfidbN.exe
  C:\Windows\System\kxfidbN.exe
  2⤵
  PID:7748
- C:\Windows\System\XrlDaHG.exe
  C:\Windows\System\XrlDaHG.exe
  2⤵
  PID:7828
- C:\Windows\System\XFkUrEF.exe
  C:\Windows\System\XFkUrEF.exe
  2⤵
  PID:7864
- C:\Windows\System\zBazCxO.exe
  C:\Windows\System\zBazCxO.exe
  2⤵
  PID:7936
- C:\Windows\System\dLmGHXe.exe
  C:\Windows\System\dLmGHXe.exe
  2⤵
  PID:8016
- C:\Windows\System\iypqlsU.exe
  C:\Windows\System\iypqlsU.exe
  2⤵
  PID:8136
- C:\Windows\System\ZvxOrtk.exe
  C:\Windows\System\ZvxOrtk.exe
  2⤵
  PID:7344
- C:\Windows\System\rFUdWGH.exe
  C:\Windows\System\rFUdWGH.exe
  2⤵
  PID:7448
- C:\Windows\System\gwncidi.exe
  C:\Windows\System\gwncidi.exe
  2⤵
  PID:2508
- C:\Windows\System\IiVfOzM.exe
  C:\Windows\System\IiVfOzM.exe
  2⤵
  PID:7788
- C:\Windows\System\lkLNvEJ.exe
  C:\Windows\System\lkLNvEJ.exe
  2⤵
  PID:8064
- C:\Windows\System\CYjytNL.exe
  C:\Windows\System\CYjytNL.exe
  2⤵
  PID:7216
- C:\Windows\System\XIcRwJY.exe
  C:\Windows\System\XIcRwJY.exe
  2⤵
  PID:7660
- C:\Windows\System\fZpQfFN.exe
  C:\Windows\System\fZpQfFN.exe
  2⤵
  PID:7976
- C:\Windows\System\dyxnqZl.exe
  C:\Windows\System\dyxnqZl.exe
  2⤵
  PID:8196
- C:\Windows\System\TwvfLBn.exe
  C:\Windows\System\TwvfLBn.exe
  2⤵
  PID:8224
- C:\Windows\System\uTbTKwi.exe
  C:\Windows\System\uTbTKwi.exe
  2⤵
  PID:8260
- C:\Windows\System\KMwrQWp.exe
  C:\Windows\System\KMwrQWp.exe
  2⤵
  PID:8284
- C:\Windows\System\QkJSLHv.exe
  C:\Windows\System\QkJSLHv.exe
  2⤵
  PID:8300
- C:\Windows\System\jBocpxJ.exe
  C:\Windows\System\jBocpxJ.exe
  2⤵
  PID:8320
- C:\Windows\System\CNMqvCK.exe
  C:\Windows\System\CNMqvCK.exe
  2⤵
  PID:8348
- C:\Windows\System\TlHpMqm.exe
  C:\Windows\System\TlHpMqm.exe
  2⤵
  PID:8384
- C:\Windows\System\HvKrmvx.exe
  C:\Windows\System\HvKrmvx.exe
  2⤵
  PID:8420
- C:\Windows\System\sHhBaiD.exe
  C:\Windows\System\sHhBaiD.exe
  2⤵
  PID:8452
- C:\Windows\System\RIwQFsk.exe
  C:\Windows\System\RIwQFsk.exe
  2⤵
  PID:8484
- C:\Windows\System\SGoDurS.exe
  C:\Windows\System\SGoDurS.exe
  2⤵
  PID:8528
- C:\Windows\System\qAlTDPS.exe
  C:\Windows\System\qAlTDPS.exe
  2⤵
  PID:8556
- C:\Windows\System\sVEFjzS.exe
  C:\Windows\System\sVEFjzS.exe
  2⤵
  PID:8584
- C:\Windows\System\hlzDNFN.exe
  C:\Windows\System\hlzDNFN.exe
  2⤵
  PID:8620
- C:\Windows\System\qThMjTz.exe
  C:\Windows\System\qThMjTz.exe
  2⤵
  PID:8648
- C:\Windows\System\HlQZNkn.exe
  C:\Windows\System\HlQZNkn.exe
  2⤵
  PID:8688
- C:\Windows\System\efhykqi.exe
  C:\Windows\System\efhykqi.exe
  2⤵
  PID:8716
- C:\Windows\System\GGEEHoR.exe
  C:\Windows\System\GGEEHoR.exe
  2⤵
  PID:8736
- C:\Windows\System\diOLabN.exe
  C:\Windows\System\diOLabN.exe
  2⤵
  PID:8760
- C:\Windows\System\mnwezZn.exe
  C:\Windows\System\mnwezZn.exe
  2⤵
  PID:8784
- C:\Windows\System\AkKVJLd.exe
  C:\Windows\System\AkKVJLd.exe
  2⤵
  PID:8816
- C:\Windows\System\CjrnDfu.exe
  C:\Windows\System\CjrnDfu.exe
  2⤵
  PID:8840
- C:\Windows\System\MUiZfst.exe
  C:\Windows\System\MUiZfst.exe
  2⤵
  PID:8876
- C:\Windows\System\jGmWhgK.exe
  C:\Windows\System\jGmWhgK.exe
  2⤵
  PID:8904
- C:\Windows\System\zXMRqNb.exe
  C:\Windows\System\zXMRqNb.exe
  2⤵
  PID:8936
- C:\Windows\System\yLnUlRU.exe
  C:\Windows\System\yLnUlRU.exe
  2⤵
  PID:8976
- C:\Windows\System\QhZyvJx.exe
  C:\Windows\System\QhZyvJx.exe
  2⤵
  PID:8996
- C:\Windows\System\NrlBhEE.exe
  C:\Windows\System\NrlBhEE.exe
  2⤵
  PID:9028
- C:\Windows\System\isQJUrK.exe
  C:\Windows\System\isQJUrK.exe
  2⤵
  PID:9056
- C:\Windows\System\pzXYQjS.exe
  C:\Windows\System\pzXYQjS.exe
  2⤵
  PID:9084
- C:\Windows\System\fDUNPKQ.exe
  C:\Windows\System\fDUNPKQ.exe
  2⤵
  PID:9120
- C:\Windows\System\WIGrGAT.exe
  C:\Windows\System\WIGrGAT.exe
  2⤵
  PID:9144
- C:\Windows\System\DZeoPrS.exe
  C:\Windows\System\DZeoPrS.exe
  2⤵
  PID:9164
- C:\Windows\System\EtvNlXG.exe
  C:\Windows\System\EtvNlXG.exe
  2⤵
  PID:9196
- C:\Windows\System\TQghhFa.exe
  C:\Windows\System\TQghhFa.exe
  2⤵
  PID:7908
- C:\Windows\System\fnlDJvS.exe
  C:\Windows\System\fnlDJvS.exe
  2⤵
  PID:8248
- C:\Windows\System\WSgfdbZ.exe
  C:\Windows\System\WSgfdbZ.exe
  2⤵
  PID:8268
- C:\Windows\System\ZhTGvLE.exe
  C:\Windows\System\ZhTGvLE.exe
  2⤵
  PID:8396
- C:\Windows\System\MFbIHaF.exe
  C:\Windows\System\MFbIHaF.exe
  2⤵
  PID:8408
- C:\Windows\System\pwPrOqn.exe
  C:\Windows\System\pwPrOqn.exe
  2⤵
  PID:8512
- C:\Windows\System\VBGtSXH.exe
  C:\Windows\System\VBGtSXH.exe
  2⤵
  PID:8572
- C:\Windows\System\myYwlsu.exe
  C:\Windows\System\myYwlsu.exe
  2⤵
  PID:8636
- C:\Windows\System\nwpxDxB.exe
  C:\Windows\System\nwpxDxB.exe
  2⤵
  PID:8704
- C:\Windows\System\wxyDuBP.exe
  C:\Windows\System\wxyDuBP.exe
  2⤵
  PID:8756
- C:\Windows\System\gSqxhSP.exe
  C:\Windows\System\gSqxhSP.exe
  2⤵
  PID:8792
- C:\Windows\System\LoppHXz.exe
  C:\Windows\System\LoppHXz.exe
  2⤵
  PID:8892
- C:\Windows\System\BhrLAue.exe
  C:\Windows\System\BhrLAue.exe
  2⤵
  PID:8960
- C:\Windows\System\gdcnnVh.exe
  C:\Windows\System\gdcnnVh.exe
  2⤵
  PID:9068
- C:\Windows\System\TmjsOSF.exe
  C:\Windows\System\TmjsOSF.exe
  2⤵
  PID:3612
- C:\Windows\System\awoMflU.exe
  C:\Windows\System\awoMflU.exe
  2⤵
  PID:9136
- C:\Windows\System\BCtoOeJ.exe
  C:\Windows\System\BCtoOeJ.exe
  2⤵
  PID:9184
- C:\Windows\System\OEBQpoD.exe
  C:\Windows\System\OEBQpoD.exe
  2⤵
  PID:8308
- C:\Windows\System\mThklrc.exe
  C:\Windows\System\mThklrc.exe
  2⤵
  PID:2460
- C:\Windows\System\zWiJnDt.exe
  C:\Windows\System\zWiJnDt.exe
  2⤵
  PID:8548
- C:\Windows\System\ojLhLzA.exe
  C:\Windows\System\ojLhLzA.exe
  2⤵
  PID:8564
- C:\Windows\System\OfPqQFt.exe
  C:\Windows\System\OfPqQFt.exe
  2⤵
  PID:8800
- C:\Windows\System\IkkNoaK.exe
  C:\Windows\System\IkkNoaK.exe
  2⤵
  PID:9012
- C:\Windows\System\lgVjeYI.exe
  C:\Windows\System\lgVjeYI.exe
  2⤵
  PID:1356
- C:\Windows\System\NiPkeIR.exe
  C:\Windows\System\NiPkeIR.exe
  2⤵
  PID:8476
- C:\Windows\System\GDhaSeB.exe
  C:\Windows\System\GDhaSeB.exe
  2⤵
  PID:8680
- C:\Windows\System\GaDUIQP.exe
  C:\Windows\System\GaDUIQP.exe
  2⤵
  PID:9092
- C:\Windows\System\vAXcJsS.exe
  C:\Windows\System\vAXcJsS.exe
  2⤵
  PID:8460
- C:\Windows\System\VbdnnDA.exe
  C:\Windows\System\VbdnnDA.exe
  2⤵
  PID:8164
- C:\Windows\System\tXisQJl.exe
  C:\Windows\System\tXisQJl.exe
  2⤵
  PID:9228
- C:\Windows\System\vEzDcZz.exe
  C:\Windows\System\vEzDcZz.exe
  2⤵
  PID:9304
- C:\Windows\System\VLBGBQN.exe
  C:\Windows\System\VLBGBQN.exe
  2⤵
  PID:9324
- C:\Windows\System\pMWbYVm.exe
  C:\Windows\System\pMWbYVm.exe
  2⤵
  PID:9352
- C:\Windows\System\UcFSfyx.exe
  C:\Windows\System\UcFSfyx.exe
  2⤵
  PID:9380
- C:\Windows\System\FCkVkda.exe
  C:\Windows\System\FCkVkda.exe
  2⤵
  PID:9408
- C:\Windows\System\fhJiHVe.exe
  C:\Windows\System\fhJiHVe.exe
  2⤵
  PID:9436
- C:\Windows\System\oAghhSJ.exe
  C:\Windows\System\oAghhSJ.exe
  2⤵
  PID:9456
- C:\Windows\System\HHZUCOO.exe
  C:\Windows\System\HHZUCOO.exe
  2⤵
  PID:9484
- C:\Windows\System\pMDnWjZ.exe
  C:\Windows\System\pMDnWjZ.exe
  2⤵
  PID:9508
- C:\Windows\System\vTInFFd.exe
  C:\Windows\System\vTInFFd.exe
  2⤵
  PID:9536
- C:\Windows\System\UllwQWY.exe
  C:\Windows\System\UllwQWY.exe
  2⤵
  PID:9564
- C:\Windows\System\BVDhZly.exe
  C:\Windows\System\BVDhZly.exe
  2⤵
  PID:9600
- C:\Windows\System\nivadkD.exe
  C:\Windows\System\nivadkD.exe
  2⤵
  PID:9628
- C:\Windows\System\HaqzcWz.exe
  C:\Windows\System\HaqzcWz.exe
  2⤵
  PID:9652
- C:\Windows\System\jDCKuOz.exe
  C:\Windows\System\jDCKuOz.exe
  2⤵
  PID:9688
- C:\Windows\System\OPWOiDR.exe
  C:\Windows\System\OPWOiDR.exe
  2⤵
  PID:9708
- C:\Windows\System\CMKjYxP.exe
  C:\Windows\System\CMKjYxP.exe
  2⤵
  PID:9744
- C:\Windows\System\MEHimeg.exe
  C:\Windows\System\MEHimeg.exe
  2⤵
  PID:9772
- C:\Windows\System\qukjeUC.exe
  C:\Windows\System\qukjeUC.exe
  2⤵
  PID:9800
- C:\Windows\System\ZdgxDAS.exe
  C:\Windows\System\ZdgxDAS.exe
  2⤵
  PID:9816
- C:\Windows\System\FCaMSqK.exe
  C:\Windows\System\FCaMSqK.exe
  2⤵
  PID:9844
- C:\Windows\System\hCfqJEy.exe
  C:\Windows\System\hCfqJEy.exe
  2⤵
  PID:9868
- C:\Windows\System\NDRCYCv.exe
  C:\Windows\System\NDRCYCv.exe
  2⤵
  PID:9900
- C:\Windows\System\kfrBqEa.exe
  C:\Windows\System\kfrBqEa.exe
  2⤵
  PID:9936
- C:\Windows\System\axqQdhx.exe
  C:\Windows\System\axqQdhx.exe
  2⤵
  PID:9956
- C:\Windows\System\xsCwUHg.exe
  C:\Windows\System\xsCwUHg.exe
  2⤵
  PID:9984
- C:\Windows\System\WVrsRAA.exe
  C:\Windows\System\WVrsRAA.exe
  2⤵
  PID:10024
- C:\Windows\System\FQMMUAp.exe
  C:\Windows\System\FQMMUAp.exe
  2⤵
  PID:10052
- C:\Windows\System\nBHnwTC.exe
  C:\Windows\System\nBHnwTC.exe
  2⤵
  PID:10068
- C:\Windows\System\oWAeFYz.exe
  C:\Windows\System\oWAeFYz.exe
  2⤵
  PID:10084
- C:\Windows\System\pIbYtLr.exe
  C:\Windows\System\pIbYtLr.exe
  2⤵
  PID:10104
- C:\Windows\System\uWGwVQP.exe
  C:\Windows\System\uWGwVQP.exe
  2⤵
  PID:10144
- C:\Windows\System\AmisZTf.exe
  C:\Windows\System\AmisZTf.exe
  2⤵
  PID:10184
- C:\Windows\System\zEVTaQV.exe
  C:\Windows\System\zEVTaQV.exe
  2⤵
  PID:10220
- C:\Windows\System\xDHzCbu.exe
  C:\Windows\System\xDHzCbu.exe
  2⤵
  PID:9276
- C:\Windows\System\HOQnTpH.exe
  C:\Windows\System\HOQnTpH.exe
  2⤵
  PID:9316
- C:\Windows\System\PcxOLMA.exe
  C:\Windows\System\PcxOLMA.exe
  2⤵
  PID:9348
- C:\Windows\System\fFTThrd.exe
  C:\Windows\System\fFTThrd.exe
  2⤵
  PID:9428
- C:\Windows\System\zxBGafz.exe
  C:\Windows\System\zxBGafz.exe
  2⤵
  PID:9504
- C:\Windows\System\YqnKfIr.exe
  C:\Windows\System\YqnKfIr.exe
  2⤵
  PID:9584
- C:\Windows\System\ZNSmifs.exe
  C:\Windows\System\ZNSmifs.exe
  2⤵
  PID:9660
- C:\Windows\System\CWhQhcQ.exe
  C:\Windows\System\CWhQhcQ.exe
  2⤵
  PID:9764
- C:\Windows\System\HXOaTpD.exe
  C:\Windows\System\HXOaTpD.exe
  2⤵
  PID:9808
- C:\Windows\System\iHIfrVB.exe
  C:\Windows\System\iHIfrVB.exe
  2⤵
  PID:9888
- C:\Windows\System\ZKstpej.exe
  C:\Windows\System\ZKstpej.exe
  2⤵
  PID:9968
- C:\Windows\System\VfVfjDY.exe
  C:\Windows\System\VfVfjDY.exe
  2⤵
  PID:10080
- C:\Windows\System\qxKNNIi.exe
  C:\Windows\System\qxKNNIi.exe
  2⤵
  PID:10152
- C:\Windows\System\tHmNbBv.exe
  C:\Windows\System\tHmNbBv.exe
  2⤵
  PID:10172
- C:\Windows\System\crRylGb.exe
  C:\Windows\System\crRylGb.exe
  2⤵
  PID:10216
- C:\Windows\System\kBFGHjk.exe
  C:\Windows\System\kBFGHjk.exe
  2⤵
  PID:7312
- C:\Windows\System\GUsbOOh.exe
  C:\Windows\System\GUsbOOh.exe
  2⤵
  PID:7612
- C:\Windows\System\tBAeavO.exe
  C:\Windows\System\tBAeavO.exe
  2⤵
  PID:9404
- C:\Windows\System\tqtIqAH.exe
  C:\Windows\System\tqtIqAH.exe
  2⤵
  PID:9684
- C:\Windows\System\PRWGYRt.exe
  C:\Windows\System\PRWGYRt.exe
  2⤵
  PID:9892
- C:\Windows\System\vXKTLXY.exe
  C:\Windows\System\vXKTLXY.exe
  2⤵
  PID:10004
- C:\Windows\System\enRXWAz.exe
  C:\Windows\System\enRXWAz.exe
  2⤵
  PID:10092
- C:\Windows\System\rgAeXGT.exe
  C:\Windows\System\rgAeXGT.exe
  2⤵
  PID:10212
- C:\Windows\System\rxOaZYD.exe
  C:\Windows\System\rxOaZYD.exe
  2⤵
  PID:3252
- C:\Windows\System\jqRCywx.exe
  C:\Windows\System\jqRCywx.exe
  2⤵
  PID:9560
- C:\Windows\System\QdZassF.exe
  C:\Windows\System\QdZassF.exe
  2⤵
  PID:9976
- C:\Windows\System\kXgyCsL.exe
  C:\Windows\System\kXgyCsL.exe
  2⤵
  PID:3240
- C:\Windows\System\RtypmdB.exe
  C:\Windows\System\RtypmdB.exe
  2⤵
  PID:9860
- C:\Windows\System\oLfihUm.exe
  C:\Windows\System\oLfihUm.exe
  2⤵
  PID:10048
- C:\Windows\System\TxXxaGW.exe
  C:\Windows\System\TxXxaGW.exe
  2⤵
  PID:10284
- C:\Windows\System\yFHTwKx.exe
  C:\Windows\System\yFHTwKx.exe
  2⤵
  PID:10312
- C:\Windows\System\EgitERf.exe
  C:\Windows\System\EgitERf.exe
  2⤵
  PID:10328
- C:\Windows\System\KkLDSyl.exe
  C:\Windows\System\KkLDSyl.exe
  2⤵
  PID:10368
- C:\Windows\System\QxiGWVy.exe
  C:\Windows\System\QxiGWVy.exe
  2⤵
  PID:10396
- C:\Windows\System\YJRdakK.exe
  C:\Windows\System\YJRdakK.exe
  2⤵
  PID:10424
- C:\Windows\System\nNyUPzM.exe
  C:\Windows\System\nNyUPzM.exe
  2⤵
  PID:10452
- C:\Windows\System\ZhPdQpJ.exe
  C:\Windows\System\ZhPdQpJ.exe
  2⤵
  PID:10476
- C:\Windows\System\lKTFXKN.exe
  C:\Windows\System\lKTFXKN.exe
  2⤵
  PID:10492
- C:\Windows\System\FyVzKvl.exe
  C:\Windows\System\FyVzKvl.exe
  2⤵
  PID:10512
- C:\Windows\System\RAGBEXp.exe
  C:\Windows\System\RAGBEXp.exe
  2⤵
  PID:10540
- C:\Windows\System\sNSBebP.exe
  C:\Windows\System\sNSBebP.exe
  2⤵
  PID:10568
- C:\Windows\System\BwqTObh.exe
  C:\Windows\System\BwqTObh.exe
  2⤵
  PID:10600
- C:\Windows\System\cVNDvZf.exe
  C:\Windows\System\cVNDvZf.exe
  2⤵
  PID:10648
- C:\Windows\System\ETcHYaD.exe
  C:\Windows\System\ETcHYaD.exe
  2⤵
  PID:10664
- C:\Windows\System\ZqcnUgy.exe
  C:\Windows\System\ZqcnUgy.exe
  2⤵
  PID:10692
- C:\Windows\System\gGUptsc.exe
  C:\Windows\System\gGUptsc.exe
  2⤵
  PID:10708
- C:\Windows\System\YqDRVmH.exe
  C:\Windows\System\YqDRVmH.exe
  2⤵
  PID:10752
- C:\Windows\System\yUQbggQ.exe
  C:\Windows\System\yUQbggQ.exe
  2⤵
  PID:10776
- C:\Windows\System\qDdsCkW.exe
  C:\Windows\System\qDdsCkW.exe
  2⤵
  PID:10804
- C:\Windows\System\tJOTOIU.exe
  C:\Windows\System\tJOTOIU.exe
  2⤵
  PID:10828
- C:\Windows\System\CLeyfhO.exe
  C:\Windows\System\CLeyfhO.exe
  2⤵
  PID:10860
- C:\Windows\System\KCDPcyb.exe
  C:\Windows\System\KCDPcyb.exe
  2⤵
  PID:10888
- C:\Windows\System\qsFpQTs.exe
  C:\Windows\System\qsFpQTs.exe
  2⤵
  PID:10904
- C:\Windows\System\PNjtwZc.exe
  C:\Windows\System\PNjtwZc.exe
  2⤵
  PID:10940
- C:\Windows\System\NOszgzN.exe
  C:\Windows\System\NOszgzN.exe
  2⤵
  PID:10980
- C:\Windows\System\eDkYyUU.exe
  C:\Windows\System\eDkYyUU.exe
  2⤵
  PID:11000
- C:\Windows\System\OFFmkBo.exe
  C:\Windows\System\OFFmkBo.exe
  2⤵
  PID:11036
- C:\Windows\System\VvMdFAD.exe
  C:\Windows\System\VvMdFAD.exe
  2⤵
  PID:11080
- C:\Windows\System\JhOcXHZ.exe
  C:\Windows\System\JhOcXHZ.exe
  2⤵
  PID:11096
- C:\Windows\System\uGgFiAl.exe
  C:\Windows\System\uGgFiAl.exe
  2⤵
  PID:11124
- C:\Windows\System\tTUWQNt.exe
  C:\Windows\System\tTUWQNt.exe
  2⤵
  PID:11144
- C:\Windows\System\KTvmOaC.exe
  C:\Windows\System\KTvmOaC.exe
  2⤵
  PID:11180
- C:\Windows\System\EviBtmh.exe
  C:\Windows\System\EviBtmh.exe
  2⤵
  PID:11208
- C:\Windows\System\GFMxGBr.exe
  C:\Windows\System\GFMxGBr.exe
  2⤵
  PID:11240
- C:\Windows\System\iNmyvjQ.exe
  C:\Windows\System\iNmyvjQ.exe
  2⤵
  PID:9344
- C:\Windows\System\USoeHgk.exe
  C:\Windows\System\USoeHgk.exe
  2⤵
  PID:10268
- C:\Windows\System\tADwgVC.exe
  C:\Windows\System\tADwgVC.exe
  2⤵
  PID:10352
- C:\Windows\System\kNgdRlI.exe
  C:\Windows\System\kNgdRlI.exe
  2⤵
  PID:10420
- C:\Windows\System\KwZvNxU.exe
  C:\Windows\System\KwZvNxU.exe
  2⤵
  PID:10524
- C:\Windows\System\uoTWAAd.exe
  C:\Windows\System\uoTWAAd.exe
  2⤵
  PID:10528
- C:\Windows\System\YIRszGz.exe
  C:\Windows\System\YIRszGz.exe
  2⤵
  PID:10584
- C:\Windows\System\PhAIgsu.exe
  C:\Windows\System\PhAIgsu.exe
  2⤵
  PID:10660
- C:\Windows\System\oaTEsbv.exe
  C:\Windows\System\oaTEsbv.exe
  2⤵
  PID:10768
- C:\Windows\System\sAwCzli.exe
  C:\Windows\System\sAwCzli.exe
  2⤵
  PID:10800
- C:\Windows\System\JIYZzPU.exe
  C:\Windows\System\JIYZzPU.exe
  2⤵
  PID:10876
- C:\Windows\System\ZqOyQaq.exe
  C:\Windows\System\ZqOyQaq.exe
  2⤵
  PID:10896
- C:\Windows\System\InwGEel.exe
  C:\Windows\System\InwGEel.exe
  2⤵
  PID:10928
- C:\Windows\System\rGTgLrn.exe
  C:\Windows\System\rGTgLrn.exe
  2⤵
  PID:11052
- C:\Windows\System\bFRscxL.exe
  C:\Windows\System\bFRscxL.exe
  2⤵
  PID:11108
- C:\Windows\System\KJtPDJL.exe
  C:\Windows\System\KJtPDJL.exe
  2⤵
  PID:11152
- C:\Windows\System\eefamNc.exe
  C:\Windows\System\eefamNc.exe
  2⤵
  PID:9336
- C:\Windows\System\NkVwmPc.exe
  C:\Windows\System\NkVwmPc.exe
  2⤵
  PID:10308
- C:\Windows\System\EoSYBuR.exe
  C:\Windows\System\EoSYBuR.exe
  2⤵
  PID:10488
- C:\Windows\System\mZVLBlv.exe
  C:\Windows\System\mZVLBlv.exe
  2⤵
  PID:10620
- C:\Windows\System\DJrwGLz.exe
  C:\Windows\System\DJrwGLz.exe
  2⤵
  PID:10836
- C:\Windows\System\trLBEQH.exe
  C:\Windows\System\trLBEQH.exe
  2⤵
  PID:11020
- C:\Windows\System\QMjonXe.exe
  C:\Windows\System\QMjonXe.exe
  2⤵
  PID:11120
- C:\Windows\System\VNQTOwB.exe
  C:\Windows\System\VNQTOwB.exe
  2⤵
  PID:10320
- C:\Windows\System\BSXlnem.exe
  C:\Windows\System\BSXlnem.exe
  2⤵
  PID:10552
- C:\Windows\System\XlahMmA.exe
  C:\Windows\System\XlahMmA.exe
  2⤵
  PID:10920
- C:\Windows\System\muazyzC.exe
  C:\Windows\System\muazyzC.exe
  2⤵
  PID:11140
- C:\Windows\System\GTQSHnq.exe
  C:\Windows\System\GTQSHnq.exe
  2⤵
  PID:10900
- C:\Windows\System\nRDYetI.exe
  C:\Windows\System\nRDYetI.exe
  2⤵
  PID:11288
- C:\Windows\System\DeXXtBl.exe
  C:\Windows\System\DeXXtBl.exe
  2⤵
  PID:11304
- C:\Windows\System\fOLxOas.exe
  C:\Windows\System\fOLxOas.exe
  2⤵
  PID:11336
- C:\Windows\System\wYguYTR.exe
  C:\Windows\System\wYguYTR.exe
  2⤵
  PID:11360
- C:\Windows\System\SlMhXBa.exe
  C:\Windows\System\SlMhXBa.exe
  2⤵
  PID:11396
- C:\Windows\System\mMFgfor.exe
  C:\Windows\System\mMFgfor.exe
  2⤵
  PID:11428
- C:\Windows\System\YKVxWci.exe
  C:\Windows\System\YKVxWci.exe
  2⤵
  PID:11456
- C:\Windows\System\FZyXhuI.exe
  C:\Windows\System\FZyXhuI.exe
  2⤵
  PID:11484
- C:\Windows\System\GsPYpBs.exe
  C:\Windows\System\GsPYpBs.exe
  2⤵
  PID:11512
- C:\Windows\System\mqYktZi.exe
  C:\Windows\System\mqYktZi.exe
  2⤵
  PID:11552
- C:\Windows\System\LAubLBu.exe
  C:\Windows\System\LAubLBu.exe
  2⤵
  PID:11568
- C:\Windows\System\YMyWCJx.exe
  C:\Windows\System\YMyWCJx.exe
  2⤵
  PID:11596
- C:\Windows\System\XczbJmz.exe
  C:\Windows\System\XczbJmz.exe
  2⤵
  PID:11624
- C:\Windows\System\uWbIJVQ.exe
  C:\Windows\System\uWbIJVQ.exe
  2⤵
  PID:11652
- C:\Windows\System\dSQCTFk.exe
  C:\Windows\System\dSQCTFk.exe
  2⤵
  PID:11680
- C:\Windows\System\UAuZxDZ.exe
  C:\Windows\System\UAuZxDZ.exe
  2⤵
  PID:11700
- C:\Windows\System\YnEwtfx.exe
  C:\Windows\System\YnEwtfx.exe
  2⤵
  PID:11744
- C:\Windows\System\UZNMLzQ.exe
  C:\Windows\System\UZNMLzQ.exe
  2⤵
  PID:11764
- C:\Windows\System\RIzgPeX.exe
  C:\Windows\System\RIzgPeX.exe
  2⤵
  PID:11780
- C:\Windows\System\ZXekoSP.exe
  C:\Windows\System\ZXekoSP.exe
  2⤵
  PID:11812
- C:\Windows\System\ZjGRraX.exe
  C:\Windows\System\ZjGRraX.exe
  2⤵
  PID:11840
- C:\Windows\System\KTptLEi.exe
  C:\Windows\System\KTptLEi.exe
  2⤵
  PID:11864
- C:\Windows\System\oVVvCBq.exe
  C:\Windows\System\oVVvCBq.exe
  2⤵
  PID:11904
- C:\Windows\System\yNaFTvC.exe
  C:\Windows\System\yNaFTvC.exe
  2⤵
  PID:11932
- C:\Windows\System\gLDgOpd.exe
  C:\Windows\System\gLDgOpd.exe
  2⤵
  PID:11960
- C:\Windows\System\lLWmnRX.exe
  C:\Windows\System\lLWmnRX.exe
  2⤵
  PID:11988
- C:\Windows\System\ewZMAIX.exe
  C:\Windows\System\ewZMAIX.exe
  2⤵
  PID:12016
- C:\Windows\System\esKvnOA.exe
  C:\Windows\System\esKvnOA.exe
  2⤵
  PID:12048
- C:\Windows\System\EtHSbUO.exe
  C:\Windows\System\EtHSbUO.exe
  2⤵
  PID:12064
- C:\Windows\System\msniVUg.exe
  C:\Windows\System\msniVUg.exe
  2⤵
  PID:12100
- C:\Windows\System\LSYRxyU.exe
  C:\Windows\System\LSYRxyU.exe
  2⤵
  PID:12132
- C:\Windows\System\axkIMap.exe
  C:\Windows\System\axkIMap.exe
  2⤵
  PID:12160
- C:\Windows\System\ohOXPWr.exe
  C:\Windows\System\ohOXPWr.exe
  2⤵
  PID:12188
- C:\Windows\System\kZHIbre.exe
  C:\Windows\System\kZHIbre.exe
  2⤵
  PID:12208
- C:\Windows\System\TIxLRzS.exe
  C:\Windows\System\TIxLRzS.exe
  2⤵
  PID:12232
- C:\Windows\System\uvdvsSd.exe
  C:\Windows\System\uvdvsSd.exe
  2⤵
  PID:12272
- C:\Windows\System\JAZGhdL.exe
  C:\Windows\System\JAZGhdL.exe
  2⤵
  PID:10580
- C:\Windows\System\yxKIODZ.exe
  C:\Windows\System\yxKIODZ.exe
  2⤵
  PID:11300
- C:\Windows\System\jDfdwzH.exe
  C:\Windows\System\jDfdwzH.exe
  2⤵
  PID:11372
- C:\Windows\System\MecYouI.exe
  C:\Windows\System\MecYouI.exe
  2⤵
  PID:11412
- C:\Windows\System\aguUqzx.exe
  C:\Windows\System\aguUqzx.exe
  2⤵
  PID:11496
- C:\Windows\System\SWbrWWc.exe
  C:\Windows\System\SWbrWWc.exe
  2⤵
  PID:11588
- C:\Windows\System\OkwzsrD.exe
  C:\Windows\System\OkwzsrD.exe
  2⤵
  PID:11636
- C:\Windows\System\QhAjBco.exe
  C:\Windows\System\QhAjBco.exe
  2⤵
  PID:11708
- C:\Windows\System\VKXPBYA.exe
  C:\Windows\System\VKXPBYA.exe
  2⤵
  PID:11772
- C:\Windows\System\HKCwWWX.exe
  C:\Windows\System\HKCwWWX.exe
  2⤵
  PID:11832
- C:\Windows\System\vlCEQMX.exe
  C:\Windows\System\vlCEQMX.exe
  2⤵
  PID:11888
- C:\Windows\System\spZCxWm.exe
  C:\Windows\System\spZCxWm.exe
  2⤵
  PID:11948
- C:\Windows\System\jzSGqdo.exe
  C:\Windows\System\jzSGqdo.exe
  2⤵
  PID:12012
- C:\Windows\System\xpVEJzw.exe
  C:\Windows\System\xpVEJzw.exe
  2⤵
  PID:12092
- C:\Windows\System\pjuDZNY.exe
  C:\Windows\System\pjuDZNY.exe
  2⤵
  PID:12172
- C:\Windows\System\eCqeQLm.exe
  C:\Windows\System\eCqeQLm.exe
  2⤵
  PID:12260
- C:\Windows\System\LtqWXKr.exe
  C:\Windows\System\LtqWXKr.exe
  2⤵
  PID:11320
- C:\Windows\System\CZrRZDd.exe
  C:\Windows\System\CZrRZDd.exe
  2⤵
  PID:11352
- C:\Windows\System\dHSrkLy.exe
  C:\Windows\System\dHSrkLy.exe
  2⤵
  PID:3156
- C:\Windows\System\TMsCHqn.exe
  C:\Windows\System\TMsCHqn.exe
  2⤵
  PID:11696
- C:\Windows\System\vleFPja.exe
  C:\Windows\System\vleFPja.exe
  2⤵
  PID:11752
- C:\Windows\System\WnkxPTt.exe
  C:\Windows\System\WnkxPTt.exe
  2⤵
  PID:11856
- C:\Windows\System\YTSgMiL.exe
  C:\Windows\System\YTSgMiL.exe
  2⤵
  PID:12116
- C:\Windows\System\NTDIuIG.exe
  C:\Windows\System\NTDIuIG.exe
  2⤵
  PID:11392
- C:\Windows\System\RvAlwyl.exe
  C:\Windows\System\RvAlwyl.exe
  2⤵
  PID:11804
- C:\Windows\System\OvaXnRK.exe
  C:\Windows\System\OvaXnRK.exe
  2⤵
  PID:11860
- C:\Windows\System\kGPTZfN.exe
  C:\Windows\System\kGPTZfN.exe
  2⤵
  PID:12040
- C:\Windows\System\VclMxUJ.exe
  C:\Windows\System\VclMxUJ.exe
  2⤵
  PID:12308
- C:\Windows\System\nespaDa.exe
  C:\Windows\System\nespaDa.exe
  2⤵
  PID:12328
- C:\Windows\System\TgvaAji.exe
  C:\Windows\System\TgvaAji.exe
  2⤵
  PID:12356
- C:\Windows\System\DnSMUAR.exe
  C:\Windows\System\DnSMUAR.exe
  2⤵
  PID:12388
- C:\Windows\System\VuLrAEH.exe
  C:\Windows\System\VuLrAEH.exe
  2⤵
  PID:12432
- C:\Windows\System\dKNHmTo.exe
  C:\Windows\System\dKNHmTo.exe
  2⤵
  PID:12452
- C:\Windows\System\AyaaoXL.exe
  C:\Windows\System\AyaaoXL.exe
  2⤵
  PID:12488
- C:\Windows\System\lVNvpnW.exe
  C:\Windows\System\lVNvpnW.exe
  2⤵
  PID:12520
- C:\Windows\System\ymuvvAp.exe
  C:\Windows\System\ymuvvAp.exe
  2⤵
  PID:12548
- C:\Windows\System\BqZGypv.exe
  C:\Windows\System\BqZGypv.exe
  2⤵
  PID:12576
- C:\Windows\System\OGaMLio.exe
  C:\Windows\System\OGaMLio.exe
  2⤵
  PID:12592
- C:\Windows\System\sabFBVh.exe
  C:\Windows\System\sabFBVh.exe
  2⤵
  PID:12620
- C:\Windows\System\vZjmXTM.exe
  C:\Windows\System\vZjmXTM.exe
  2⤵
  PID:12660
- C:\Windows\System\lXvvpUR.exe
  C:\Windows\System\lXvvpUR.exe
  2⤵
  PID:12676
- C:\Windows\System\nOKguHL.exe
  C:\Windows\System\nOKguHL.exe
  2⤵
  PID:12708
- C:\Windows\System\PdQhluz.exe
  C:\Windows\System\PdQhluz.exe
  2⤵
  PID:12744
- C:\Windows\System\KiAzWPA.exe
  C:\Windows\System\KiAzWPA.exe
  2⤵
  PID:12764
- C:\Windows\System\zWaMExo.exe
  C:\Windows\System\zWaMExo.exe
  2⤵
  PID:12800
- C:\Windows\System\rzqdfIu.exe
  C:\Windows\System\rzqdfIu.exe
  2⤵
  PID:12828
- C:\Windows\System\dWkgBrC.exe
  C:\Windows\System\dWkgBrC.exe
  2⤵
  PID:12844
- C:\Windows\System\VbSzTAl.exe
  C:\Windows\System\VbSzTAl.exe
  2⤵
  PID:12872
- C:\Windows\System\qQfwcWh.exe
  C:\Windows\System\qQfwcWh.exe
  2⤵
  PID:12900
- C:\Windows\System\jvaVPof.exe
  C:\Windows\System\jvaVPof.exe
  2⤵
  PID:12924
- C:\Windows\System\GONLfBh.exe
  C:\Windows\System\GONLfBh.exe
  2⤵
  PID:12944
- C:\Windows\System\lRlEQCe.exe
  C:\Windows\System\lRlEQCe.exe
  2⤵
  PID:12976
- C:\Windows\System\zcvKXbe.exe
  C:\Windows\System\zcvKXbe.exe
  2⤵
  PID:13000
- C:\Windows\System\JRpYWqX.exe
  C:\Windows\System\JRpYWqX.exe
  2⤵
  PID:13032
- C:\Windows\System\VyiWtWe.exe
  C:\Windows\System\VyiWtWe.exe
  2⤵
  PID:13048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_y2fx1lbm.vdk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2fx1lbm.vdk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

DOjpTTR.exe

Path C:\Windows\System\DOjpTTR.exe
Size 2.7MB
SHA256 6ba058402cf8f8cc785a6857de82359b148cebfd491f7cf7c51dbea3eff41bdf
MD5 899cf6d59b87b04070fc86bbbf0229d7
SHA1 485ad353890b8a984181798441bdea0d1bf5adf3
SHA512 6bb4e0f1d04a8c0c9226573a57f5968b6d61fd0d2c1912eb1ecb93cb1a89e04fd9788f5a0d2d924f49c76d068de6d46c5a485ff45bfcc8e118dcbe67721d8222
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2av:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FoGmpoG.exe

Path C:\Windows\System\FoGmpoG.exe
Size 2.7MB
SHA256 30d29902bbf50fc4e09bf8e530f7b0a876790bfae9f681975194d714e1e57cb9
MD5 0b45e3fb0778570e9e1986bba2e76211
SHA1 f43a949bbfe02eb7ba9fee0f825f433089007dcd
SHA512 03493b3c572616ef8e67c73dd4fa24e0919859389fad69a597ed12e29730ed480127def8984550ff5cedb9c05162ec89990c7c62b910df9bb82af0904fe9f472
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aL:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FsMPlWy.exe

Path C:\Windows\System\FsMPlWy.exe
Size 2.7MB
SHA256 287ff248ee113502ad2631289c5914ff17fde31cfb4d5c72d93a61be3acfd6c0
MD5 a2ad02b6b590c0f7f0ec2816d181e13f
SHA1 8bb8148f0ab11d1c1946c90d12f3cc3a61fc8a66
SHA512 2d563479839f9095006068b6e124b676028f09bd3051071e3c94b8fa8538c241b8af7887b159d54756017bc3b6a0adf5d65b9d46658ab367041d363d91e225ac
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a1:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

FzTrwZW.exe

Path C:\Windows\System\FzTrwZW.exe
Size 2.7MB
SHA256 bf96cf1183d336ca5d95b994e19455669f3d139404524439b04b6eb80bac56d5
MD5 be8574325a67cc9d5d000fc09539e9b8
SHA1 39744fa5c5921f258b842e122d173af28e17484e
SHA512 2426cea9f54d5af795e75ef8cb277d5c731d8f83bac9b5985621085006dda669fdb194b41710aaff1bd89d767ffdcd4cec75fcb72182d480f913ec0212c77fc7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aHr:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

GWYpSxz.exe

Path C:\Windows\System\GWYpSxz.exe
Size 2.7MB
SHA256 51843bfca547bb9e210077bb8572c2dc57ea55730cc02689d90956b9bf152c21
MD5 aff98fbab8aa39aee71af1115156e388
SHA1 7179fe7dfafd83c5dea4c9afe9678e64e1de02a1
SHA512 88c087e33ef60324a44bcc470fe8b6047f549b3b986780aef522107afb1fb912295eaa3db3df98f7681a9e47945bc18975ac3fb1301e3cf6a7c7202178001134
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

GbTOSet.exe

Path C:\Windows\System\GbTOSet.exe
Size 2.7MB
SHA256 6e89766b683e294bb11520beed54525cdac406be5eb676cda57b4e09b1e5bb23
MD5 aac8b7eacfba7c06631c6aefe1599578
SHA1 a34c32e1705d6768dc81596ffefaf500309aa9c3
SHA512 78519f960871a595f21e709a53a14711057387ffcd9d629fb90e1edc7e9a071232f9b264bf8fbfe3bc0f338756b97be08a7ff4833d4396c1846ea9b0f5f270f3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ai:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

KZETMWq.exe

Path C:\Windows\System\KZETMWq.exe
Size 2.7MB
SHA256 1e7f2e1d3a09e1a7c5e3cefc52e6af22d2eabffeb6c0391fe192774b6223cfa2
MD5 abdbdf89a3f38f621ed5fe36dfec4250
SHA1 d5a0927d6954287440b302d1932e2b5fb8b4648b
SHA512 f68f8507b57b0cf8b37bbbd514308b1dc3096ab3a2801cee420c6de09ce78b37ad1532c55c9dfc1c4800bfc7fa42cfdea71432bd6b1274c605606df00132d8e3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a5:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

LNOtkTh.exe

Path C:\Windows\System\LNOtkTh.exe
Size 2.7MB
SHA256 6ca30a80905a608b0066abfe62cf1db09d7b35f0507b0bf5ab0b58a7a37bef71
MD5 b943e86db9d643ad376f8e1ec8e49d36
SHA1 50a2d9c3436334cf2b34fbb43da0d7427a31652f
SHA512 c99848b41e99042a584f7f9b7988c62b7c8c5f430558e4d4e12d1a42b4ff3c9094d0708f1afd0b408b206abd508851f5ada437b3e4171d84518e5ad6661c320b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oatapux.exe

Path C:\Windows\System\Oatapux.exe
Size 2.7MB
SHA256 d566f70d903c2c1ef059c0f4de67295236acba0e85015a34dc7e51a92ed94ae0
MD5 587bdbf3b42350d33a20d2ee739357c9
SHA1 113d3cb3009a197d276205be0e2db19eda94cae7
SHA512 c833a6e22e3dae6de3128c27fcacd71f0bb69e17b9f9684012d2b4b928b01eb417bb225f302c02261da1cf7fc18ae1ed22a084edf192cbe8ed4034ee70e3d967
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

PqeJFJm.exe

Path C:\Windows\System\PqeJFJm.exe
Size 2.7MB
SHA256 1c9c9a6b248c606ab0690e4314dff7cfbfd8c3b9028fc6a1c44ff4f21fa1d412
MD5 4bc573f79116f318c864f1724fb49f94
SHA1 13674b3603eeda2fde7925d63f5cb3b3a9d0e270
SHA512 99824ef8b00d4a9631e714fd0a43e07339dac13e8e397edf909b1dbadd8eecedd8a02e65ad34cdb769da37c9fdb7782a01215ed59d8578ff474a47684b69ce28
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

PvCUoLQ.exe

Path C:\Windows\System\PvCUoLQ.exe
Size 2.7MB
SHA256 ece2b8f291c6d017b46ef3301a9fc94e5dd50cee8c252d505e78ad1bd0b2cadf
MD5 5e69b8ff5a81a6d138d409f1d2c6198c
SHA1 01f37c5d0c346dad3f9a19815059115682aeaada
SHA512 8ff2728a411c9d5e65f79608e41341c004c74eaf512cbc357eca153b0eebf8fe012ded6546a4cc7a309710025b457fef1a32a651359e88587ff5151b46d3e125
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUnIiDo.exe

Path C:\Windows\System\QUnIiDo.exe
Size 2.7MB
SHA256 3a65f72a423ea82d57d0b9e68a14b85000b6e9e3c635ba7f3aeeb3be31b1182c
MD5 862e12349a8df0a06e43d840a99761bd
SHA1 fcbcc6357f4068cf7f082726f1c418380dc18e3c
SHA512 4f26c5364a274fef07a0841dfa899f6b3913113462b6a7688714ef96065282024299ae30be91cb0f24297990cc9851a7bfaf63c9d5a18b120fb6b3fa6bbd428f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ab:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

QxkjwDG.exe

Path C:\Windows\System\QxkjwDG.exe
Size 2.7MB
SHA256 abbde347085e07714dba3471ac57b90e4c02f7086610a4462a3b171de00ee482
MD5 da5f647c0d553a13eb345939f7cc94dd
SHA1 8311b24466b2130dcffd3859b73ce8b9bd9567db
SHA512 40183ceb921856022a9c97a049fefbc5672bc8c8959fc5d900ba74af208ea8d1a431a541d92ccc0491cc50383c67e3715162665e56e805de9582671a0ece6bfd
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

SquRkym.exe

Path C:\Windows\System\SquRkym.exe
Size 2.7MB
SHA256 b250d190f0b42b5e6bccc5cc3e2cf204cd36ee363aeff775f1362a52aae06462
MD5 c0c18a23206179f441e3e09cda41b05a
SHA1 de548e5aafe0bc5ef60e8bb359cb1cf5e6f70182
SHA512 dcbea99b6edc1ffb406f3ad96742d3bb92beac866aea3cb5304f5cdbdc061cf36b2c1ae998d2a34aba17f417b8c17e811c175564da5c404e907f6214504d8496
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aQ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

TxEUCvZ.exe

Path C:\Windows\System\TxEUCvZ.exe
Size 2.7MB
SHA256 2dff028f802d607ba43e2cb150ed25e718f2cb1e13775e7d95f9dcf6b033c096
MD5 667844f090ade2b4582ad57338dc7038
SHA1 280527bde9d821df538a129d5db7d6c3d12638bc
SHA512 5a7120d1666e0cbc7b9f699bf445749566868012d8698275513df4b90ffa84747fa4fa151b731d1ce7a3639ce8c5040814eb45ecc3a7f69e9dd9bc920a19f421
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ah:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WOhXyhP.exe

Path C:\Windows\System\WOhXyhP.exe
Size 2.7MB
SHA256 6dbb42971e5721ef9af48095b640ddb03954aa1c5ca7f2996e7a191d72efc90f
MD5 24b81c7a0f0db30a632b7cb6d4676ad2
SHA1 360c1e2f27ff97ccbf8e9902f700c134df701abf
SHA512 7a516f15cc77ffccb6889b77ad24424784957cb5ca6976c1cd8d61d9747cbd1d1638d9a56fe179615314a2a16cde5d624733e2adf3ffbe9be99e5d491662b862
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ab:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQqHpZU.exe

Path C:\Windows\System\XQqHpZU.exe
Size 2.7MB
SHA256 8f0b614c9558e0c82648ca5617902f4f92ffb7cee4816a7e5ab2769a08290a4c
MD5 ccf485330156f677b4e79b22ea145a2e
SHA1 3967642db30d7d627d8f936b576343b86b182c33
SHA512 88a956a84850161646c3030ae4e42ef5c16d97050a3bdfa452b5cecdc8fae19ee3d3453e18110bcca2f0895bbea8ff8abc493211b5794a84c2e04f543e31fe34
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZMwLkuk.exe

Path C:\Windows\System\ZMwLkuk.exe
Size 2.7MB
SHA256 7f2d9bbca6423c9bfdf80a36ba36833f385e69fee331401f3be309e726bf8005
MD5 837f0359ca4c65ea2ea8c3b8b29c5484
SHA1 1aedeeeea65155047cc9024840a0df1227aa5cbf
SHA512 b22b6165af571a30903289fb68b73050a12acaf11e73711c6c14f69784b5e2a415d5f144fee544793624ac9bb96a52448108155151c9c0ca94325aca8705ce0a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ai:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZwxOim.exe

Path C:\Windows\System\ZZwxOim.exe
Size 2.7MB
SHA256 4147c1768ee90fbe1cbd258cda2b341631e8236171602e97306005bcec93e3f7
MD5 f106e3191e791f0deac819686558468a
SHA1 eab1fc0c197af868e9c4cf02ee5bc96deb83dadc
SHA512 b6078353159e9b01e15cf33531a8dad87d708bd1c56626d58cad0c7f429a982ff6ecac8016eaf4e709015e38b126af2d3d8d8e1b0c049f1e208422290ea9b017
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aG:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZkOffMU.exe

Path C:\Windows\System\ZkOffMU.exe
Size 2.7MB
SHA256 bebf02697cd8491f3d444ad0f1d08a22a8592a2e6976527ab1be8ecbf6aaa8ca
MD5 a6deed762ae139d6e43bd3dea057ef1a
SHA1 045f86cc642657bb408c4e03d5905919abe0e03f
SHA512 fd36198d69cb6a7b97cd464cb09b76cadae5b0317de49c7bc165a4b1f24ec59c73190026a1825085dcc442908bd0dd0f7448a9c57dc03235baee3b952de51d44
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aS:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

aatfyar.exe

Path C:\Windows\System\aatfyar.exe
Size 2.7MB
SHA256 6aecdc57d5016c9265f0121af05319aa682b9dcffaca30bcdf6d44de28eb26df
MD5 85c2b48d002b405619c149ea89a45e61
SHA1 457da2e88d65052044db2f5814307d72b8293c65
SHA512 2b3153f1e13c917f67bf36116b874a9f393caec8b474f695cbb34a4dabb4f06bd72aaca63709ccedb768f6b4e54ec15ada65e214afd8589def9431103aa5db37
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2al:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

blVsNkh.exe

Path C:\Windows\System\blVsNkh.exe
Size 2.7MB
SHA256 2f399915aecda52d7302e6b2c93c9af3b396340eba4e7c3c7c6588f62ca97229
MD5 b203fe8a00a6c240d81fe33ec5801e17
SHA1 7be1f313e028f25d606810718967ee3dbef99a0a
SHA512 4592fbfe9c4c86a746c7dc902df3bf17ccab2c87fab645e02bf127ceb9180ab342fd9bbfc47092f1cd6c3f4832fc88550826c2f8018a7041de43a09cc34db238
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2au:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

dTYzYPQ.exe

Path C:\Windows\System\dTYzYPQ.exe
Size 2.7MB
SHA256 b9d129a44af43160156438144e5c88dbb69b5870df4ec4734b7382d0667cbebc
MD5 215115d513842d66a16def4ed9a3b858
SHA1 58fcbe4230bb3f03394a1f5ec17468970758d722
SHA512 ed5cf159724ee3a13a59be3158deaafc0a85df181d6186c773f5b3e3ed546558a247f609fc12b31321a490e33deac80c3b3a62f62ef90097735f01555d70c7e3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

dqoQuyK.exe

Path C:\Windows\System\dqoQuyK.exe
Size 2.7MB
SHA256 e4931aac8a8e448f8291cb2cfa117e6890c51243cc6cec502d4f01ed3a053ab0
MD5 fce01de8496caa0ca8dff4e2fd163751
SHA1 53ce174066351de332f8fa741f476b85d28f938f
SHA512 2c49b6e82ce08f9cbf2815ee1b0a6dd82344f8301a2c346e2fd2cacf88cc4af764387ef522e9dc7670834557c7c064a21aeba2f2183905548197e67a43059150
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aKf:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

eNAvHWZ.exe

Path C:\Windows\System\eNAvHWZ.exe
Size 2.7MB
SHA256 91b2f5f6f4bc43e94bf08c51fe295c130d394b76f88559ee1dc030ffd7765b9c
MD5 e7467f1430850b1e00b4197ddd12e168
SHA1 f8a68dfba56b93df520d8b15a7deb4cbc5843db0
SHA512 66f4c07d7e9838d4a19027ff7ded5b04c11958a3414d9de993e74759bf7ad0229c297c2e804f438569ca59587f999631e96e946f8d98e27d2eb9af39a0e0e63c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fTgptqp.exe

Path C:\Windows\System\fTgptqp.exe
Size 2.7MB
SHA256 c88ac553aa6fa40b82116feaf4a1f072f3e21d6425f2be10f7c07ab4419f180a
MD5 987ba7177d88025aad5cc26f25f20878
SHA1 7aede04a8bc3703cbdf27771719a7d3115451d57
SHA512 814c26d6c7b30a048de5dce38019b111f3446acc2e236feb94d1d20b747493cfcaf9d33a5c3424d618c6e6614298366cc6151bad818ad1f5b9de419bb3e7e485
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a7:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

iMXcONX.exe

Path C:\Windows\System\iMXcONX.exe
Size 2.7MB
SHA256 732042e9d068f911fbf6b1675d0dd99eba3c736410175131bd15508fa2a173b6
MD5 0580a88ed0f21dcf572c010d764c0808
SHA1 93b0204ec42cc326ec5e991d7fd28e9a866d2718
SHA512 10c34c01199a4724e42fea4525632664a68a6e56b1fa7a2c3fb7cc03b1d7f5f97a69928e0dc6330eea23fef3e2af7f4533aac78f714dd91407f51af78c7715e2
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ai:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjNbjBH.exe

Path C:\Windows\System\jjNbjBH.exe
Size 2.7MB
SHA256 232fddb0e59a196e2b3dfcac37608dfaff6e298d0be68b448a663eba0192eaa6
MD5 6c2e0d27e95bcf8a541e27ebf3fffc54
SHA1 3f310b9804fe5b4176eeecb157d012a335fd6040
SHA512 b0c246f351c3adda69fc842a4188ba6705791aaeff6ab679432f6b5322eb1c5eb13168186f438ca738264417bd5fb766ba8edb73ab6791d0b0527065260f5446
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2as:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mqnchKQ.exe

Path C:\Windows\System\mqnchKQ.exe
Size 2.7MB
SHA256 eae49c5157402805b7e94fa9d4fc1890865891bdc77a3d9181e5f1b099efbfc5
MD5 ed2086cc061d99a00a890b0d75c699ca
SHA1 9992b9bc5b4b9bb9ca175c9168afdb1a7bda816f
SHA512 d1f84efc94e0196aa3f23e3b3c4a0f82a320d245b7d6724fdcbefe05524b5390507d3c0bd3071caafaae2b90e5363422a5223458c1d6261209c952a048350630
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ae:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkvDYCl.exe

Path C:\Windows\System\qkvDYCl.exe
Size 2.7MB
SHA256 733f4b9e4e0f603500a9c3c9f5881e1a5bdf36a3f3fba899a723b9b4ce1a27be
MD5 6790b892249647ea5634ecdc74feab47
SHA1 a4051fa4158b12a7b7612e86f0750c13323bc094
SHA512 dc2ada474966371f66c96b0269df32df4d306c94c8902914e41ec94330ba37d121d7a9720a10cc398b774c5097d2dd8b0c88fdd03f83630d7c18e14f131a6861
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsOtIHw.exe

Path C:\Windows\System\qsOtIHw.exe
Size 2.7MB
SHA256 c62c7cb28933ae117b34281e546b4423b4a469abb352ab92ecc4c9c37bcf8d6a
MD5 0a4605f311d564d8f958b2af39d26ccc
SHA1 297dc3788955db1b5f7fe63bf4f7ae0c83bb26a2
SHA512 ead3dc3080193059096b86d0954ca35ba4ff5589bd3272a6d9281e0ceade5c88de63d723b9907b3518864b870e8b4cc4061da7fb06bd10e189dbe7302ab23806
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ay:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbIWhPm.exe

Path C:\Windows\System\sbIWhPm.exe
Size 2.7MB
SHA256 582b5166769feb308de1cf1e7b63972b50826c9741633749aae18d1bc6f4cc02
MD5 0748a84f76d86525c10b2f73a296e5e2
SHA1 11218a20c937ab4c360a23e861624c35f4b9ffd4
SHA512 9d42ba80576e98bf33fb8ce8c6fedef25a69e26eb4de35c506a923744981e54217401c92976c535d96ad657b0a3bee0108038e458a57a675166170bba3584268
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a4:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

tFBNfZo.exe

Path C:\Windows\System\tFBNfZo.exe
Size 2.7MB
SHA256 008eac8b6ff62858de6ef7fb1851b586700e8d9a3051022deff3e7df7d3b0846
MD5 e6e0809a6cea14610b46e3de30997440
SHA1 65bafeb15a8be50cdb3b0c8dc8b8f3cdc4c67077
SHA512 677aa96b1c0b5a7e1caac76e99d79053d5d58c10262e4b2b9e67fc263ebd78df4895df6dbcadcad2afface5c60e0f144326dd2fd16e57a398129be120ed634f7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2aJ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

uZUbkrs.exe

Path C:\Windows\System\uZUbkrs.exe
Size 2.7MB
SHA256 ee362a1073e379117f88692840d8bff65398a9d7482a09e7a54e0f6026db17aa
MD5 67fe88990ef0fd90620450d2b5b5af8a
SHA1 0b4bea463068e8b2c81e815e785458e9640be013
SHA512 2b48141d19536da6a0c52480e9a560c2c1a3d6ddc4d015c0b58ee570d129948aa8f4e761e0850c3979c8af14fdcb4700209ba033f23417ae6b4ab4e227bb86bd
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2ae:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

yCpFANr.exe

Path C:\Windows\System\yCpFANr.exe
Size 2.7MB
SHA256 8a5295d404ffa53878bcf7f90e88551f9277636d99f4a105bfda44bdc6f0666a
MD5 a0f8023bc052574709c7d455963de991
SHA1 7226cb5e45b117fc1e6ca4bd272da8235af2cef2
SHA512 dc092b4dcd1ddad650326cc781a279ff13aaaa20cd45220be5ce60f703f99d820ab1b0808cd3eb4a8d30cdf56808c4c3ca353eae5918db9ddb7aa980c134bc4f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2am:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-202-0x00007FF6BA6F0000-0x00007FF6BAAE6000-memory.dmp

Download

memory/8-2437-0x00007FF6BA6F0000-0x00007FF6BAAE6000-memory.dmp

Download

memory/400-204-0x00007FF754CA0000-0x00007FF755096000-memory.dmp

Download

memory/400-2444-0x00007FF754CA0000-0x00007FF755096000-memory.dmp

Download

memory/540-206-0x00007FF7A3F30000-0x00007FF7A4326000-memory.dmp

Download

memory/540-2441-0x00007FF7A3F30000-0x00007FF7A4326000-memory.dmp

Download

memory/620-212-0x00007FF73CF80000-0x00007FF73D376000-memory.dmp

Download

memory/620-2442-0x00007FF73CF80000-0x00007FF73D376000-memory.dmp

Download

memory/848-197-0x00007FF759010000-0x00007FF759406000-memory.dmp

Download

memory/848-2433-0x00007FF759010000-0x00007FF759406000-memory.dmp

Download

memory/1304-2446-0x00007FF6E9BE0000-0x00007FF6E9FD6000-memory.dmp

Download

memory/1304-209-0x00007FF6E9BE0000-0x00007FF6E9FD6000-memory.dmp

Download

memory/1448-2425-0x00007FF6B9690000-0x00007FF6B9A86000-memory.dmp

Download

memory/1448-109-0x00007FF6B9690000-0x00007FF6B9A86000-memory.dmp

Download

memory/1652-0-0x00007FF7C0A10000-0x00007FF7C0E06000-memory.dmp

Download

memory/1652-1-0x0000026D43900000-0x0000026D43910000-memory.dmp

Download

memory/2116-208-0x00007FF631ED0000-0x00007FF6322C6000-memory.dmp

Download

memory/2116-2439-0x00007FF631ED0000-0x00007FF6322C6000-memory.dmp

Download

memory/2420-211-0x00007FF7A2460000-0x00007FF7A2856000-memory.dmp

Download

memory/2420-2432-0x00007FF7A2460000-0x00007FF7A2856000-memory.dmp

Download

memory/2688-198-0x00007FF71C610000-0x00007FF71CA06000-memory.dmp

Download

memory/2688-2434-0x00007FF71C610000-0x00007FF71CA06000-memory.dmp

Download

memory/2800-2436-0x00007FF6DC3A0000-0x00007FF6DC796000-memory.dmp

Download

memory/2800-187-0x00007FF6DC3A0000-0x00007FF6DC796000-memory.dmp

Download

memory/2848-178-0x00007FF6BC540000-0x00007FF6BC936000-memory.dmp

Download

memory/2848-2428-0x00007FF6BC540000-0x00007FF6BC936000-memory.dmp

Download

memory/3040-2447-0x00007FF6A21F0000-0x00007FF6A25E6000-memory.dmp

Download

memory/3040-200-0x00007FF6A21F0000-0x00007FF6A25E6000-memory.dmp

Download

memory/3340-2435-0x00007FF6A6C50000-0x00007FF6A7046000-memory.dmp

Download

memory/3340-191-0x00007FF6A6C50000-0x00007FF6A7046000-memory.dmp

Download

memory/3492-152-0x00007FF790380000-0x00007FF790776000-memory.dmp

Download

memory/3492-2427-0x00007FF790380000-0x00007FF790776000-memory.dmp

Download

memory/3616-213-0x00007FF770480000-0x00007FF770876000-memory.dmp

Download

memory/3616-2440-0x00007FF770480000-0x00007FF770876000-memory.dmp

Download

memory/3632-2424-0x00007FF74A830000-0x00007FF74AC26000-memory.dmp

Download

memory/3632-13-0x00007FF74A830000-0x00007FF74AC26000-memory.dmp

Download

memory/4104-214-0x0000017AB68B0000-0x0000017AB7056000-memory.dmp

Download

memory/4104-2423-0x00007FF816413000-0x00007FF816415000-memory.dmp

Download

memory/4104-2422-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Download

memory/4104-47-0x0000017AB5AE0000-0x0000017AB5B02000-memory.dmp

Download

memory/4104-56-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Download

memory/4104-84-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Download

memory/4104-9-0x00007FF816413000-0x00007FF816415000-memory.dmp

Download

memory/4316-135-0x00007FF7A6E50000-0x00007FF7A7246000-memory.dmp

Download

memory/4316-2429-0x00007FF7A6E50000-0x00007FF7A7246000-memory.dmp

Download

memory/4364-2443-0x00007FF7AA2C0000-0x00007FF7AA6B6000-memory.dmp

Download

memory/4364-205-0x00007FF7AA2C0000-0x00007FF7AA6B6000-memory.dmp

Download

memory/4604-2445-0x00007FF6FB400000-0x00007FF6FB7F6000-memory.dmp

Download

memory/4604-203-0x00007FF6FB400000-0x00007FF6FB7F6000-memory.dmp

Download

memory/4608-210-0x00007FF7D7320000-0x00007FF7D7716000-memory.dmp

Download

memory/4608-2426-0x00007FF7D7320000-0x00007FF7D7716000-memory.dmp

Download

memory/4644-2431-0x00007FF6899F0000-0x00007FF689DE6000-memory.dmp

Download

memory/4644-199-0x00007FF6899F0000-0x00007FF689DE6000-memory.dmp

Download

memory/4788-207-0x00007FF7893C0000-0x00007FF7897B6000-memory.dmp

Download

memory/4788-2438-0x00007FF7893C0000-0x00007FF7897B6000-memory.dmp

Download

memory/5052-2430-0x00007FF603CC0000-0x00007FF6040B6000-memory.dmp

Download

memory/5052-201-0x00007FF603CC0000-0x00007FF6040B6000-memory.dmp

Download