xmrig | 771523d5aad6dc719f6511d3720e8eb1aa4af139e2f11d2ae0a4f3acf7738e7f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
Size 3.2MB
Sample240519-b87h4scc2v
SHA256 771523d5aad6dc719f6511d3720e8eb1aa4af139e2f11d2ae0a4f3acf7738e7f
MD5 4abd944bd66295db019a1c592173d9e0
SHA1 327947c13b55a2c9b8745b90a8ca080993c85fa5
SHA512 4e00d7847f1127b7862c7864f4746e9bd5bf09034bcdabaab2fcb68a2492c9d72adacf034918e863ff4fe6435c82ff9cb1de482e7619aaaacd33e2c3f929d5ca
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:SbBeSFk7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/568-0-0x00007FF6D9DC0000-0x00007FF6DA1B6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-7.dat	xmrig
behavioral2/memory/3612-42-0x00007FF652F10000-0x00007FF653306000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-50.dat	xmrig
behavioral2/files/0x0007000000023414-56.dat	xmrig
behavioral2/files/0x0007000000023419-73.dat	xmrig
behavioral2/files/0x000700000002341b-93.dat	xmrig
behavioral2/memory/1184-116-0x00007FF602180000-0x00007FF602576000-memory.dmp	xmrig
behavioral2/memory/1880-131-0x00007FF641DB0000-0x00007FF6421A6000-memory.dmp	xmrig
behavioral2/memory/4500-151-0x00007FF7C2710000-0x00007FF7C2B06000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-170.dat	xmrig
behavioral2/memory/2560-176-0x00007FF6628C0000-0x00007FF662CB6000-memory.dmp	xmrig
behavioral2/memory/3288-194-0x00007FF6B9E10000-0x00007FF6BA206000-memory.dmp	xmrig
behavioral2/memory/3160-193-0x00007FF6F9970000-0x00007FF6F9D66000-memory.dmp	xmrig
behavioral2/memory/5024-192-0x00007FF7E2A40000-0x00007FF7E2E36000-memory.dmp	xmrig
behavioral2/memory/2540-191-0x00007FF639520000-0x00007FF639916000-memory.dmp	xmrig
behavioral2/memory/4380-190-0x00007FF7CC110000-0x00007FF7CC506000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-185.dat	xmrig
behavioral2/files/0x0007000000023429-183.dat	xmrig
behavioral2/files/0x0007000000023428-181.dat	xmrig
behavioral2/files/0x0008000000023427-179.dat	xmrig
behavioral2/files/0x0007000000023425-177.dat	xmrig
behavioral2/memory/1752-174-0x00007FF71C500000-0x00007FF71C8F6000-memory.dmp	xmrig
behavioral2/memory/5048-173-0x00007FF6B6500000-0x00007FF6B68F6000-memory.dmp	xmrig
behavioral2/memory/1840-172-0x00007FF6039C0000-0x00007FF603DB6000-memory.dmp	xmrig
behavioral2/memory/1444-171-0x00007FF6FF2A0000-0x00007FF6FF696000-memory.dmp	xmrig
behavioral2/memory/2436-158-0x00007FF78A470000-0x00007FF78A866000-memory.dmp	xmrig
behavioral2/memory/5076-150-0x00007FF6C51C0000-0x00007FF6C55B6000-memory.dmp	xmrig
behavioral2/files/0x000800000002340b-148.dat	xmrig
behavioral2/files/0x0007000000023424-146.dat	xmrig
behavioral2/memory/2536-140-0x00007FF6EC6F0000-0x00007FF6ECAE6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-138.dat	xmrig
behavioral2/files/0x0007000000023423-136.dat	xmrig
behavioral2/files/0x0007000000023422-134.dat	xmrig
behavioral2/files/0x0007000000023420-132.dat	xmrig
behavioral2/files/0x000700000002341f-129.dat	xmrig
behavioral2/files/0x000700000002341e-126.dat	xmrig
behavioral2/files/0x0007000000023421-123.dat	xmrig
behavioral2/memory/3508-117-0x00007FF712C20000-0x00007FF713016000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-103.dat	xmrig
behavioral2/memory/3008-102-0x00007FF694930000-0x00007FF694D26000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-89.dat	xmrig
behavioral2/files/0x0007000000023418-77.dat	xmrig
behavioral2/memory/2308-76-0x00007FF792B10000-0x00007FF792F06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-66.dat	xmrig
behavioral2/memory/512-62-0x00007FF603B10000-0x00007FF603F06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-65.dat	xmrig
behavioral2/files/0x0007000000023413-53.dat	xmrig
behavioral2/files/0x0007000000023411-52.dat	xmrig
behavioral2/files/0x0007000000023412-47.dat	xmrig
behavioral2/files/0x0007000000023410-33.dat	xmrig
behavioral2/memory/2816-28-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp	xmrig
behavioral2/memory/1636-21-0x00007FF63F020000-0x00007FF63F416000-memory.dmp	xmrig
behavioral2/memory/4924-14-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-12.dat	xmrig
behavioral2/files/0x0008000000022f51-10.dat	xmrig
behavioral2/files/0x000700000002342c-367.dat	xmrig
behavioral2/memory/4924-2191-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp	xmrig
behavioral2/memory/2816-2192-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp	xmrig
behavioral2/memory/512-2193-0x00007FF603B10000-0x00007FF603F06000-memory.dmp	xmrig
behavioral2/memory/3612-2194-0x00007FF652F10000-0x00007FF653306000-memory.dmp	xmrig
behavioral2/memory/1636-2197-0x00007FF63F020000-0x00007FF63F416000-memory.dmp	xmrig
behavioral2/memory/4924-2198-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp	xmrig
behavioral2/memory/2560-2200-0x00007FF6628C0000-0x00007FF662CB6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	3364	powershell.exe
10	3364	powershell.exe
12	3364	powershell.exe
13	3364	powershell.exe
15	3364	powershell.exe
20	3364	powershell.exe
21	3364	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3364	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4924	QmyrbcT.exe
1636	okkzamU.exe
2560	KfUizDY.exe
2816	GYQpnMe.exe
3612	dRSujmB.exe
512	cGKkhUy.exe
2308	iuMTjbw.exe
4380	wRDOzLZ.exe
3008	XuqyCem.exe
1184	LAopPWo.exe
3508	VMHvrcN.exe
1880	ikPnvyI.exe
2536	VaHihBj.exe
5076	PoFYRbP.exe
2540	uJxWETo.exe
5024	JwgORJd.exe
4500	oBPIZaN.exe
2436	nwdYOkS.exe
3160	gTFOgAO.exe
1444	GFZmPVS.exe
1840	PIQVGSr.exe
5048	SPtiRRD.exe
1752	bipOfRD.exe
3288	EHLwoCl.exe
1900	wdQiOPQ.exe
64	TokbqYi.exe
3472	dGBjSSJ.exe
3136	ZZYGKzo.exe
3300	XjUAhyk.exe
1540	KhPeUdo.exe
4936	tkcnFNh.exe
4492	phVjBKz.exe
1048	zqLiKqK.exe
1604	vgEXxDq.exe
4344	ObXScYf.exe
1664	YprsvCW.exe
3964	crFnvIq.exe
4032	aWrmmbG.exe
3216	fXLCjgq.exe
3316	eWZNsKK.exe
2204	YqcLrIE.exe
1408	IZLVHTM.exe
3928	aTJLnDm.exe
1432	cjzdzDL.exe
3816	uNRkPVy.exe
2784	vQoVIMI.exe
2988	RfXpNUE.exe
4120	mPOKyFg.exe
1016	JcZxumi.exe
2564	TcyjKgB.exe
4688	pcAIXLt.exe
4328	irMGxOi.exe
1212	pjXRByj.exe
4860	QhEgplj.exe
4756	oHqNUVS.exe
2384	bQguPKB.exe
220	UBQxMKq.exe
5016	oefkhLO.exe
4508	ejixhsW.exe
3572	OJmKzWC.exe
768	pRdRCTP.exe
4484	KojIeuz.exe
456	vdJehTa.exe
3152	nRHxqAc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/568-0-0x00007FF6D9DC0000-0x00007FF6DA1B6000-memory.dmp	upx
behavioral2/files/0x000700000002340f-7.dat	upx
behavioral2/memory/3612-42-0x00007FF652F10000-0x00007FF653306000-memory.dmp	upx
behavioral2/files/0x0007000000023417-50.dat	upx
behavioral2/files/0x0007000000023414-56.dat	upx
behavioral2/files/0x0007000000023419-73.dat	upx
behavioral2/files/0x000700000002341b-93.dat	upx
behavioral2/memory/1184-116-0x00007FF602180000-0x00007FF602576000-memory.dmp	upx
behavioral2/memory/1880-131-0x00007FF641DB0000-0x00007FF6421A6000-memory.dmp	upx
behavioral2/memory/4500-151-0x00007FF7C2710000-0x00007FF7C2B06000-memory.dmp	upx
behavioral2/files/0x000700000002342b-170.dat	upx
behavioral2/memory/2560-176-0x00007FF6628C0000-0x00007FF662CB6000-memory.dmp	upx
behavioral2/memory/3288-194-0x00007FF6B9E10000-0x00007FF6BA206000-memory.dmp	upx
behavioral2/memory/3160-193-0x00007FF6F9970000-0x00007FF6F9D66000-memory.dmp	upx
behavioral2/memory/5024-192-0x00007FF7E2A40000-0x00007FF7E2E36000-memory.dmp	upx
behavioral2/memory/2540-191-0x00007FF639520000-0x00007FF639916000-memory.dmp	upx
behavioral2/memory/4380-190-0x00007FF7CC110000-0x00007FF7CC506000-memory.dmp	upx
behavioral2/files/0x000700000002342a-185.dat	upx
behavioral2/files/0x0007000000023429-183.dat	upx
behavioral2/files/0x0007000000023428-181.dat	upx
behavioral2/files/0x0008000000023427-179.dat	upx
behavioral2/files/0x0007000000023425-177.dat	upx
behavioral2/memory/1752-174-0x00007FF71C500000-0x00007FF71C8F6000-memory.dmp	upx
behavioral2/memory/5048-173-0x00007FF6B6500000-0x00007FF6B68F6000-memory.dmp	upx
behavioral2/memory/1840-172-0x00007FF6039C0000-0x00007FF603DB6000-memory.dmp	upx
behavioral2/memory/1444-171-0x00007FF6FF2A0000-0x00007FF6FF696000-memory.dmp	upx
behavioral2/memory/2436-158-0x00007FF78A470000-0x00007FF78A866000-memory.dmp	upx
behavioral2/memory/5076-150-0x00007FF6C51C0000-0x00007FF6C55B6000-memory.dmp	upx
behavioral2/files/0x000800000002340b-148.dat	upx
behavioral2/files/0x0007000000023424-146.dat	upx
behavioral2/memory/2536-140-0x00007FF6EC6F0000-0x00007FF6ECAE6000-memory.dmp	upx
behavioral2/files/0x000700000002341d-138.dat	upx
behavioral2/files/0x0007000000023423-136.dat	upx
behavioral2/files/0x0007000000023422-134.dat	upx
behavioral2/files/0x0007000000023420-132.dat	upx
behavioral2/files/0x000700000002341f-129.dat	upx
behavioral2/files/0x000700000002341e-126.dat	upx
behavioral2/files/0x0007000000023421-123.dat	upx
behavioral2/memory/3508-117-0x00007FF712C20000-0x00007FF713016000-memory.dmp	upx
behavioral2/files/0x000700000002341c-103.dat	upx
behavioral2/memory/3008-102-0x00007FF694930000-0x00007FF694D26000-memory.dmp	upx
behavioral2/files/0x000700000002341a-89.dat	upx
behavioral2/files/0x0007000000023418-77.dat	upx
behavioral2/memory/2308-76-0x00007FF792B10000-0x00007FF792F06000-memory.dmp	upx
behavioral2/files/0x0007000000023416-66.dat	upx
behavioral2/memory/512-62-0x00007FF603B10000-0x00007FF603F06000-memory.dmp	upx
behavioral2/files/0x0007000000023415-65.dat	upx
behavioral2/files/0x0007000000023413-53.dat	upx
behavioral2/files/0x0007000000023411-52.dat	upx
behavioral2/files/0x0007000000023412-47.dat	upx
behavioral2/files/0x0007000000023410-33.dat	upx
behavioral2/memory/2816-28-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp	upx
behavioral2/memory/1636-21-0x00007FF63F020000-0x00007FF63F416000-memory.dmp	upx
behavioral2/memory/4924-14-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp	upx
behavioral2/files/0x000700000002340e-12.dat	upx
behavioral2/files/0x0008000000022f51-10.dat	upx
behavioral2/files/0x000700000002342c-367.dat	upx
behavioral2/memory/4924-2191-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp	upx
behavioral2/memory/2816-2192-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp	upx
behavioral2/memory/512-2193-0x00007FF603B10000-0x00007FF603F06000-memory.dmp	upx
behavioral2/memory/3612-2194-0x00007FF652F10000-0x00007FF653306000-memory.dmp	upx
behavioral2/memory/1636-2197-0x00007FF63F020000-0x00007FF63F416000-memory.dmp	upx
behavioral2/memory/4924-2198-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp	upx
behavioral2/memory/2560-2200-0x00007FF6628C0000-0x00007FF662CB6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eLjTHXT.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\pMQRrZe.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\dsGayej.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\scRjVIV.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\JFsxdxw.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\dbfUbhr.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\iuroati.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\aQHXLpK.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\uJxWETo.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\EHLwoCl.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\mGsaSKc.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\sHqfnNU.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\vhpxLvA.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\tDLSNKQ.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\kpoacpz.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\SiMaJfG.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\ecxHdOi.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\WtiwPlZ.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\bZfmPqm.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\WYTEAfx.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\eqGMYNL.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\DKoIGfs.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\JWBOnrc.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\XedMQPb.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\iUnRHdS.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\kvVyOsd.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\AQzhhnG.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\beyNUaI.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\NbFDrBY.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\NedSsEA.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\JcZxumi.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\kCIIpqM.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\oHqlvGb.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZZYGKzo.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\qSvuNBU.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\mUUCJOP.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\QOmERzd.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\eCZbeFD.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\HNKSdQE.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\HZSJCud.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\RYUYfkO.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\EraYaVS.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\xhKzeNh.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\lwFHnXJ.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\EGCKAvf.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\YvwsGik.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\NGqQmSX.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\UCbaBhM.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\NiJoEWE.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\eAQiMQk.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\AVDIvwq.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\LiDcWqs.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\PhuRmdd.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\daCpkdj.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\jAxByJL.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\fqXvtKA.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZiOeVun.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\juNpfFp.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\oZzefTU.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\RTYCVsw.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\gTFOgAO.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\pjXRByj.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\AvxKjAh.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
File created	C:\Windows\System\akHMYWH.exe	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3364	powershell.exe
3364	powershell.exe
3364	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeLockMemoryPrivilege	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3364	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	84
PID 568 wrote to memory of 3364	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	84
PID 568 wrote to memory of 4924	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	85
PID 568 wrote to memory of 4924	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	85
PID 568 wrote to memory of 1636	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	86
PID 568 wrote to memory of 1636	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	86
PID 568 wrote to memory of 2560	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	87
PID 568 wrote to memory of 2560	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	87
PID 568 wrote to memory of 2816	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	88
PID 568 wrote to memory of 2816	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	88
PID 568 wrote to memory of 512	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	89
PID 568 wrote to memory of 512	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	89
PID 568 wrote to memory of 3612	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	90
PID 568 wrote to memory of 3612	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	90
PID 568 wrote to memory of 2308	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	91
PID 568 wrote to memory of 2308	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	91
PID 568 wrote to memory of 4380	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	92
PID 568 wrote to memory of 4380	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	92
PID 568 wrote to memory of 3008	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	93
PID 568 wrote to memory of 3008	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	93
PID 568 wrote to memory of 1184	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	94
PID 568 wrote to memory of 1184	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	94
PID 568 wrote to memory of 3508	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	95
PID 568 wrote to memory of 3508	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	95
PID 568 wrote to memory of 1880	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	96
PID 568 wrote to memory of 1880	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	96
PID 568 wrote to memory of 2536	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	97
PID 568 wrote to memory of 2536	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	97
PID 568 wrote to memory of 5076	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	98
PID 568 wrote to memory of 5076	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	98
PID 568 wrote to memory of 5024	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	99
PID 568 wrote to memory of 5024	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	99
PID 568 wrote to memory of 2540	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	100
PID 568 wrote to memory of 2540	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	100
PID 568 wrote to memory of 1752	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	101
PID 568 wrote to memory of 1752	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	101
PID 568 wrote to memory of 4500	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	102
PID 568 wrote to memory of 4500	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	102
PID 568 wrote to memory of 2436	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	103
PID 568 wrote to memory of 2436	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	103
PID 568 wrote to memory of 3160	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	104
PID 568 wrote to memory of 3160	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	104
PID 568 wrote to memory of 1444	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	105
PID 568 wrote to memory of 1444	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	105
PID 568 wrote to memory of 1840	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	106
PID 568 wrote to memory of 1840	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	106
PID 568 wrote to memory of 5048	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	107
PID 568 wrote to memory of 5048	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	107
PID 568 wrote to memory of 3288	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	108
PID 568 wrote to memory of 3288	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	108
PID 568 wrote to memory of 1900	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	109
PID 568 wrote to memory of 1900	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	109
PID 568 wrote to memory of 64	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	110
PID 568 wrote to memory of 64	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	110
PID 568 wrote to memory of 3472	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	111
PID 568 wrote to memory of 3472	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	111
PID 568 wrote to memory of 3136	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	112
PID 568 wrote to memory of 3136	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	112
PID 568 wrote to memory of 3300	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	113
PID 568 wrote to memory of 3300	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	113
PID 568 wrote to memory of 1540	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	114
PID 568 wrote to memory of 1540	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	114
PID 568 wrote to memory of 4936	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	115
PID 568 wrote to memory of 4936	568	4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4abd944bd66295db019a1c592173d9e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\System\QmyrbcT.exe
  C:\Windows\System\QmyrbcT.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\okkzamU.exe
  C:\Windows\System\okkzamU.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\KfUizDY.exe
  C:\Windows\System\KfUizDY.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\GYQpnMe.exe
  C:\Windows\System\GYQpnMe.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\cGKkhUy.exe
  C:\Windows\System\cGKkhUy.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\dRSujmB.exe
  C:\Windows\System\dRSujmB.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\iuMTjbw.exe
  C:\Windows\System\iuMTjbw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\wRDOzLZ.exe
  C:\Windows\System\wRDOzLZ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\XuqyCem.exe
  C:\Windows\System\XuqyCem.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\LAopPWo.exe
  C:\Windows\System\LAopPWo.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\VMHvrcN.exe
  C:\Windows\System\VMHvrcN.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ikPnvyI.exe
  C:\Windows\System\ikPnvyI.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\VaHihBj.exe
  C:\Windows\System\VaHihBj.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\PoFYRbP.exe
  C:\Windows\System\PoFYRbP.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\JwgORJd.exe
  C:\Windows\System\JwgORJd.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\uJxWETo.exe
  C:\Windows\System\uJxWETo.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\bipOfRD.exe
  C:\Windows\System\bipOfRD.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\oBPIZaN.exe
  C:\Windows\System\oBPIZaN.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\nwdYOkS.exe
  C:\Windows\System\nwdYOkS.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\gTFOgAO.exe
  C:\Windows\System\gTFOgAO.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\GFZmPVS.exe
  C:\Windows\System\GFZmPVS.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\PIQVGSr.exe
  C:\Windows\System\PIQVGSr.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\SPtiRRD.exe
  C:\Windows\System\SPtiRRD.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\EHLwoCl.exe
  C:\Windows\System\EHLwoCl.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\wdQiOPQ.exe
  C:\Windows\System\wdQiOPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\TokbqYi.exe
  C:\Windows\System\TokbqYi.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\dGBjSSJ.exe
  C:\Windows\System\dGBjSSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\ZZYGKzo.exe
  C:\Windows\System\ZZYGKzo.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\XjUAhyk.exe
  C:\Windows\System\XjUAhyk.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\KhPeUdo.exe
  C:\Windows\System\KhPeUdo.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\tkcnFNh.exe
  C:\Windows\System\tkcnFNh.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\phVjBKz.exe
  C:\Windows\System\phVjBKz.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\zqLiKqK.exe
  C:\Windows\System\zqLiKqK.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\vgEXxDq.exe
  C:\Windows\System\vgEXxDq.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ObXScYf.exe
  C:\Windows\System\ObXScYf.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\YprsvCW.exe
  C:\Windows\System\YprsvCW.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\crFnvIq.exe
  C:\Windows\System\crFnvIq.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\aWrmmbG.exe
  C:\Windows\System\aWrmmbG.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\fXLCjgq.exe
  C:\Windows\System\fXLCjgq.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\eWZNsKK.exe
  C:\Windows\System\eWZNsKK.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\YqcLrIE.exe
  C:\Windows\System\YqcLrIE.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\IZLVHTM.exe
  C:\Windows\System\IZLVHTM.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\aTJLnDm.exe
  C:\Windows\System\aTJLnDm.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\cjzdzDL.exe
  C:\Windows\System\cjzdzDL.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\uNRkPVy.exe
  C:\Windows\System\uNRkPVy.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\vQoVIMI.exe
  C:\Windows\System\vQoVIMI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\RfXpNUE.exe
  C:\Windows\System\RfXpNUE.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\mPOKyFg.exe
  C:\Windows\System\mPOKyFg.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\JcZxumi.exe
  C:\Windows\System\JcZxumi.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\TcyjKgB.exe
  C:\Windows\System\TcyjKgB.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\pcAIXLt.exe
  C:\Windows\System\pcAIXLt.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\irMGxOi.exe
  C:\Windows\System\irMGxOi.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\QhEgplj.exe
  C:\Windows\System\QhEgplj.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\pjXRByj.exe
  C:\Windows\System\pjXRByj.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\oHqNUVS.exe
  C:\Windows\System\oHqNUVS.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\bQguPKB.exe
  C:\Windows\System\bQguPKB.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\UBQxMKq.exe
  C:\Windows\System\UBQxMKq.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\oefkhLO.exe
  C:\Windows\System\oefkhLO.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\ejixhsW.exe
  C:\Windows\System\ejixhsW.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\OJmKzWC.exe
  C:\Windows\System\OJmKzWC.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\pRdRCTP.exe
  C:\Windows\System\pRdRCTP.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\KojIeuz.exe
  C:\Windows\System\KojIeuz.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\vdJehTa.exe
  C:\Windows\System\vdJehTa.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\nRHxqAc.exe
  C:\Windows\System\nRHxqAc.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\zniiWbE.exe
  C:\Windows\System\zniiWbE.exe
  2⤵
  PID:1748
- C:\Windows\System\jroWphH.exe
  C:\Windows\System\jroWphH.exe
  2⤵
  PID:4260
- C:\Windows\System\oCxyjXF.exe
  C:\Windows\System\oCxyjXF.exe
  2⤵
  PID:2192
- C:\Windows\System\krprQHW.exe
  C:\Windows\System\krprQHW.exe
  2⤵
  PID:2984
- C:\Windows\System\ROKwCtR.exe
  C:\Windows\System\ROKwCtR.exe
  2⤵
  PID:3656
- C:\Windows\System\Ecyerky.exe
  C:\Windows\System\Ecyerky.exe
  2⤵
  PID:1004
- C:\Windows\System\UcJpgam.exe
  C:\Windows\System\UcJpgam.exe
  2⤵
  PID:4596
- C:\Windows\System\JFsxdxw.exe
  C:\Windows\System\JFsxdxw.exe
  2⤵
  PID:2256
- C:\Windows\System\vsMRnie.exe
  C:\Windows\System\vsMRnie.exe
  2⤵
  PID:4744
- C:\Windows\System\PhuRmdd.exe
  C:\Windows\System\PhuRmdd.exe
  2⤵
  PID:3736
- C:\Windows\System\vkByVrG.exe
  C:\Windows\System\vkByVrG.exe
  2⤵
  PID:2604
- C:\Windows\System\CPQWYfg.exe
  C:\Windows\System\CPQWYfg.exe
  2⤵
  PID:4212
- C:\Windows\System\lGmNTHl.exe
  C:\Windows\System\lGmNTHl.exe
  2⤵
  PID:1260
- C:\Windows\System\ZaaUXlO.exe
  C:\Windows\System\ZaaUXlO.exe
  2⤵
  PID:1584
- C:\Windows\System\xduDBzI.exe
  C:\Windows\System\xduDBzI.exe
  2⤵
  PID:4588
- C:\Windows\System\FhLyeFl.exe
  C:\Windows\System\FhLyeFl.exe
  2⤵
  PID:3440
- C:\Windows\System\JIEKtsZ.exe
  C:\Windows\System\JIEKtsZ.exe
  2⤵
  PID:2588
- C:\Windows\System\lUPIzUw.exe
  C:\Windows\System\lUPIzUw.exe
  2⤵
  PID:4464
- C:\Windows\System\OxAqTtO.exe
  C:\Windows\System\OxAqTtO.exe
  2⤵
  PID:3988
- C:\Windows\System\fRnwCBs.exe
  C:\Windows\System\fRnwCBs.exe
  2⤵
  PID:3272
- C:\Windows\System\ZQwqysF.exe
  C:\Windows\System\ZQwqysF.exe
  2⤵
  PID:1060
- C:\Windows\System\XUrPpnM.exe
  C:\Windows\System\XUrPpnM.exe
  2⤵
  PID:4480
- C:\Windows\System\vkCnqRl.exe
  C:\Windows\System\vkCnqRl.exe
  2⤵
  PID:976
- C:\Windows\System\rHcHlrJ.exe
  C:\Windows\System\rHcHlrJ.exe
  2⤵
  PID:5156
- C:\Windows\System\TxuwTkN.exe
  C:\Windows\System\TxuwTkN.exe
  2⤵
  PID:5184
- C:\Windows\System\LWUQlaB.exe
  C:\Windows\System\LWUQlaB.exe
  2⤵
  PID:5228
- C:\Windows\System\uPkoMEY.exe
  C:\Windows\System\uPkoMEY.exe
  2⤵
  PID:5272
- C:\Windows\System\pboQPNp.exe
  C:\Windows\System\pboQPNp.exe
  2⤵
  PID:5288
- C:\Windows\System\eLjTHXT.exe
  C:\Windows\System\eLjTHXT.exe
  2⤵
  PID:5344
- C:\Windows\System\fGRJiEM.exe
  C:\Windows\System\fGRJiEM.exe
  2⤵
  PID:5376
- C:\Windows\System\HGoZwkj.exe
  C:\Windows\System\HGoZwkj.exe
  2⤵
  PID:5404
- C:\Windows\System\tDLSNKQ.exe
  C:\Windows\System\tDLSNKQ.exe
  2⤵
  PID:5428
- C:\Windows\System\RkbKErh.exe
  C:\Windows\System\RkbKErh.exe
  2⤵
  PID:5444
- C:\Windows\System\daCpkdj.exe
  C:\Windows\System\daCpkdj.exe
  2⤵
  PID:5492
- C:\Windows\System\LkTsRYD.exe
  C:\Windows\System\LkTsRYD.exe
  2⤵
  PID:5520
- C:\Windows\System\mpQQgLU.exe
  C:\Windows\System\mpQQgLU.exe
  2⤵
  PID:5536
- C:\Windows\System\jiNsWfi.exe
  C:\Windows\System\jiNsWfi.exe
  2⤵
  PID:5584
- C:\Windows\System\jCDDGPa.exe
  C:\Windows\System\jCDDGPa.exe
  2⤵
  PID:5612
- C:\Windows\System\JMHAtLP.exe
  C:\Windows\System\JMHAtLP.exe
  2⤵
  PID:5640
- C:\Windows\System\LdHyaPA.exe
  C:\Windows\System\LdHyaPA.exe
  2⤵
  PID:5656
- C:\Windows\System\sTIxWVw.exe
  C:\Windows\System\sTIxWVw.exe
  2⤵
  PID:5700
- C:\Windows\System\SGRJAGH.exe
  C:\Windows\System\SGRJAGH.exe
  2⤵
  PID:5724
- C:\Windows\System\ULHbLPd.exe
  C:\Windows\System\ULHbLPd.exe
  2⤵
  PID:5752
- C:\Windows\System\cKKnNIL.exe
  C:\Windows\System\cKKnNIL.exe
  2⤵
  PID:5768
- C:\Windows\System\CKGRFPM.exe
  C:\Windows\System\CKGRFPM.exe
  2⤵
  PID:5796
- C:\Windows\System\tqgtUeH.exe
  C:\Windows\System\tqgtUeH.exe
  2⤵
  PID:5828
- C:\Windows\System\UlxzJEc.exe
  C:\Windows\System\UlxzJEc.exe
  2⤵
  PID:5864
- C:\Windows\System\abcSWcn.exe
  C:\Windows\System\abcSWcn.exe
  2⤵
  PID:5904
- C:\Windows\System\VEcynPx.exe
  C:\Windows\System\VEcynPx.exe
  2⤵
  PID:5932
- C:\Windows\System\kpoacpz.exe
  C:\Windows\System\kpoacpz.exe
  2⤵
  PID:5948
- C:\Windows\System\mTilkvD.exe
  C:\Windows\System\mTilkvD.exe
  2⤵
  PID:5980
- C:\Windows\System\DWPCjti.exe
  C:\Windows\System\DWPCjti.exe
  2⤵
  PID:5996
- C:\Windows\System\dbfUbhr.exe
  C:\Windows\System\dbfUbhr.exe
  2⤵
  PID:6012
- C:\Windows\System\VUbBgBi.exe
  C:\Windows\System\VUbBgBi.exe
  2⤵
  PID:6064
- C:\Windows\System\tmiCihg.exe
  C:\Windows\System\tmiCihg.exe
  2⤵
  PID:6092
- C:\Windows\System\GSuzURc.exe
  C:\Windows\System\GSuzURc.exe
  2⤵
  PID:6128
- C:\Windows\System\zBBqXYO.exe
  C:\Windows\System\zBBqXYO.exe
  2⤵
  PID:612
- C:\Windows\System\ekWiiSy.exe
  C:\Windows\System\ekWiiSy.exe
  2⤵
  PID:5240
- C:\Windows\System\cUJORvu.exe
  C:\Windows\System\cUJORvu.exe
  2⤵
  PID:5316
- C:\Windows\System\CiuDdcH.exe
  C:\Windows\System\CiuDdcH.exe
  2⤵
  PID:5352
- C:\Windows\System\njSDbHF.exe
  C:\Windows\System\njSDbHF.exe
  2⤵
  PID:5420
- C:\Windows\System\bgseRBP.exe
  C:\Windows\System\bgseRBP.exe
  2⤵
  PID:5516
- C:\Windows\System\oYSWYQm.exe
  C:\Windows\System\oYSWYQm.exe
  2⤵
  PID:5620
- C:\Windows\System\wAsBcRS.exe
  C:\Windows\System\wAsBcRS.exe
  2⤵
  PID:5744
- C:\Windows\System\YmPDoul.exe
  C:\Windows\System\YmPDoul.exe
  2⤵
  PID:5780
- C:\Windows\System\QXnHcrn.exe
  C:\Windows\System\QXnHcrn.exe
  2⤵
  PID:5892
- C:\Windows\System\QlnCMic.exe
  C:\Windows\System\QlnCMic.exe
  2⤵
  PID:5956
- C:\Windows\System\cIjtQOC.exe
  C:\Windows\System\cIjtQOC.exe
  2⤵
  PID:6056
- C:\Windows\System\mdGGsUy.exe
  C:\Windows\System\mdGGsUy.exe
  2⤵
  PID:4776
- C:\Windows\System\ExDGjFM.exe
  C:\Windows\System\ExDGjFM.exe
  2⤵
  PID:5280
- C:\Windows\System\jAbiLCT.exe
  C:\Windows\System\jAbiLCT.exe
  2⤵
  PID:4020
- C:\Windows\System\clUtPJF.exe
  C:\Windows\System\clUtPJF.exe
  2⤵
  PID:5940
- C:\Windows\System\TPMTbTK.exe
  C:\Windows\System\TPMTbTK.exe
  2⤵
  PID:4352
- C:\Windows\System\XeVyNSI.exe
  C:\Windows\System\XeVyNSI.exe
  2⤵
  PID:6008
- C:\Windows\System\nRbuLgR.exe
  C:\Windows\System\nRbuLgR.exe
  2⤵
  PID:6152
- C:\Windows\System\vwZsQvI.exe
  C:\Windows\System\vwZsQvI.exe
  2⤵
  PID:6168
- C:\Windows\System\IWhdyou.exe
  C:\Windows\System\IWhdyou.exe
  2⤵
  PID:6212
- C:\Windows\System\LXFHjHs.exe
  C:\Windows\System\LXFHjHs.exe
  2⤵
  PID:6248
- C:\Windows\System\eLcnoSh.exe
  C:\Windows\System\eLcnoSh.exe
  2⤵
  PID:6272
- C:\Windows\System\aktDkyZ.exe
  C:\Windows\System\aktDkyZ.exe
  2⤵
  PID:6296
- C:\Windows\System\YtdBJXG.exe
  C:\Windows\System\YtdBJXG.exe
  2⤵
  PID:6328
- C:\Windows\System\yfSxetM.exe
  C:\Windows\System\yfSxetM.exe
  2⤵
  PID:6352
- C:\Windows\System\vScVBsD.exe
  C:\Windows\System\vScVBsD.exe
  2⤵
  PID:6392
- C:\Windows\System\KOquvix.exe
  C:\Windows\System\KOquvix.exe
  2⤵
  PID:6436
- C:\Windows\System\HziLeUB.exe
  C:\Windows\System\HziLeUB.exe
  2⤵
  PID:6476
- C:\Windows\System\JXsVjlx.exe
  C:\Windows\System\JXsVjlx.exe
  2⤵
  PID:6512
- C:\Windows\System\hWFzkVL.exe
  C:\Windows\System\hWFzkVL.exe
  2⤵
  PID:6528
- C:\Windows\System\qcXLexe.exe
  C:\Windows\System\qcXLexe.exe
  2⤵
  PID:6552
- C:\Windows\System\DXaJfum.exe
  C:\Windows\System\DXaJfum.exe
  2⤵
  PID:6580
- C:\Windows\System\GoPSwKZ.exe
  C:\Windows\System\GoPSwKZ.exe
  2⤵
  PID:6616
- C:\Windows\System\BNWNWFo.exe
  C:\Windows\System\BNWNWFo.exe
  2⤵
  PID:6656
- C:\Windows\System\BXmkWKO.exe
  C:\Windows\System\BXmkWKO.exe
  2⤵
  PID:6672
- C:\Windows\System\ULGbwPU.exe
  C:\Windows\System\ULGbwPU.exe
  2⤵
  PID:6692
- C:\Windows\System\kaAvGIo.exe
  C:\Windows\System\kaAvGIo.exe
  2⤵
  PID:6740
- C:\Windows\System\WmjfKHJ.exe
  C:\Windows\System\WmjfKHJ.exe
  2⤵
  PID:6760
- C:\Windows\System\QqouBkC.exe
  C:\Windows\System\QqouBkC.exe
  2⤵
  PID:6776
- C:\Windows\System\YplpNUI.exe
  C:\Windows\System\YplpNUI.exe
  2⤵
  PID:6804
- C:\Windows\System\KTzgjmS.exe
  C:\Windows\System\KTzgjmS.exe
  2⤵
  PID:6844
- C:\Windows\System\HlOIVON.exe
  C:\Windows\System\HlOIVON.exe
  2⤵
  PID:6876
- C:\Windows\System\DkXjLhi.exe
  C:\Windows\System\DkXjLhi.exe
  2⤵
  PID:6892
- C:\Windows\System\JWBOnrc.exe
  C:\Windows\System\JWBOnrc.exe
  2⤵
  PID:6912
- C:\Windows\System\JxBAdCo.exe
  C:\Windows\System\JxBAdCo.exe
  2⤵
  PID:6948
- C:\Windows\System\YvwsGik.exe
  C:\Windows\System\YvwsGik.exe
  2⤵
  PID:6996
- C:\Windows\System\CLNgBfL.exe
  C:\Windows\System\CLNgBfL.exe
  2⤵
  PID:7024
- C:\Windows\System\oBvzPCI.exe
  C:\Windows\System\oBvzPCI.exe
  2⤵
  PID:7040
- C:\Windows\System\TPkqGcn.exe
  C:\Windows\System\TPkqGcn.exe
  2⤵
  PID:7088
- C:\Windows\System\WUsHQiF.exe
  C:\Windows\System\WUsHQiF.exe
  2⤵
  PID:7108
- C:\Windows\System\pGuwagD.exe
  C:\Windows\System\pGuwagD.exe
  2⤵
  PID:7124
- C:\Windows\System\sITowPz.exe
  C:\Windows\System\sITowPz.exe
  2⤵
  PID:7164
- C:\Windows\System\TuBDRcq.exe
  C:\Windows\System\TuBDRcq.exe
  2⤵
  PID:6148
- C:\Windows\System\jwEBPhU.exe
  C:\Windows\System\jwEBPhU.exe
  2⤵
  PID:6228
- C:\Windows\System\NGqQmSX.exe
  C:\Windows\System\NGqQmSX.exe
  2⤵
  PID:6304
- C:\Windows\System\itxrzcs.exe
  C:\Windows\System\itxrzcs.exe
  2⤵
  PID:6364
- C:\Windows\System\XChJPcm.exe
  C:\Windows\System\XChJPcm.exe
  2⤵
  PID:6468
- C:\Windows\System\TezaGpn.exe
  C:\Windows\System\TezaGpn.exe
  2⤵
  PID:6520
- C:\Windows\System\VIvBzoB.exe
  C:\Windows\System\VIvBzoB.exe
  2⤵
  PID:6572
- C:\Windows\System\YGVWBKY.exe
  C:\Windows\System\YGVWBKY.exe
  2⤵
  PID:4452
- C:\Windows\System\UUNXddF.exe
  C:\Windows\System\UUNXddF.exe
  2⤵
  PID:6684
- C:\Windows\System\QMwlGmq.exe
  C:\Windows\System\QMwlGmq.exe
  2⤵
  PID:6728
- C:\Windows\System\XNYGOLE.exe
  C:\Windows\System\XNYGOLE.exe
  2⤵
  PID:6788
- C:\Windows\System\ruMTXab.exe
  C:\Windows\System\ruMTXab.exe
  2⤵
  PID:6868
- C:\Windows\System\XedMQPb.exe
  C:\Windows\System\XedMQPb.exe
  2⤵
  PID:6932
- C:\Windows\System\ZZzMulf.exe
  C:\Windows\System\ZZzMulf.exe
  2⤵
  PID:7004
- C:\Windows\System\atLfapw.exe
  C:\Windows\System\atLfapw.exe
  2⤵
  PID:7032
- C:\Windows\System\UdzNhWQ.exe
  C:\Windows\System\UdzNhWQ.exe
  2⤵
  PID:7136
- C:\Windows\System\lrGDrsn.exe
  C:\Windows\System\lrGDrsn.exe
  2⤵
  PID:1668
- C:\Windows\System\JhhhpFO.exe
  C:\Windows\System\JhhhpFO.exe
  2⤵
  PID:6500
- C:\Windows\System\AvxKjAh.exe
  C:\Windows\System\AvxKjAh.exe
  2⤵
  PID:6632
- C:\Windows\System\VEdgcFG.exe
  C:\Windows\System\VEdgcFG.exe
  2⤵
  PID:6716
- C:\Windows\System\gmONIDo.exe
  C:\Windows\System\gmONIDo.exe
  2⤵
  PID:6900
- C:\Windows\System\PgoglzJ.exe
  C:\Windows\System\PgoglzJ.exe
  2⤵
  PID:6980
- C:\Windows\System\cMOKPaB.exe
  C:\Windows\System\cMOKPaB.exe
  2⤵
  PID:6268
- C:\Windows\System\BVRwOmI.exe
  C:\Windows\System\BVRwOmI.exe
  2⤵
  PID:5008
- C:\Windows\System\AdmYxHA.exe
  C:\Windows\System\AdmYxHA.exe
  2⤵
  PID:6860
- C:\Windows\System\qSvuNBU.exe
  C:\Windows\System\qSvuNBU.exe
  2⤵
  PID:7160
- C:\Windows\System\nWTNSkD.exe
  C:\Windows\System\nWTNSkD.exe
  2⤵
  PID:6596
- C:\Windows\System\kpFQOou.exe
  C:\Windows\System\kpFQOou.exe
  2⤵
  PID:7188
- C:\Windows\System\FvCLxdB.exe
  C:\Windows\System\FvCLxdB.exe
  2⤵
  PID:7216
- C:\Windows\System\ilgLubC.exe
  C:\Windows\System\ilgLubC.exe
  2⤵
  PID:7244
- C:\Windows\System\AfNNuwz.exe
  C:\Windows\System\AfNNuwz.exe
  2⤵
  PID:7272
- C:\Windows\System\FGTKlPk.exe
  C:\Windows\System\FGTKlPk.exe
  2⤵
  PID:7300
- C:\Windows\System\eidpuWb.exe
  C:\Windows\System\eidpuWb.exe
  2⤵
  PID:7328
- C:\Windows\System\jAxByJL.exe
  C:\Windows\System\jAxByJL.exe
  2⤵
  PID:7360
- C:\Windows\System\iUnRHdS.exe
  C:\Windows\System\iUnRHdS.exe
  2⤵
  PID:7400
- C:\Windows\System\zoHQcOe.exe
  C:\Windows\System\zoHQcOe.exe
  2⤵
  PID:7436
- C:\Windows\System\QjdrhHm.exe
  C:\Windows\System\QjdrhHm.exe
  2⤵
  PID:7460
- C:\Windows\System\yzGdUau.exe
  C:\Windows\System\yzGdUau.exe
  2⤵
  PID:7492
- C:\Windows\System\ChLLaMm.exe
  C:\Windows\System\ChLLaMm.exe
  2⤵
  PID:7524
- C:\Windows\System\bBIVDHn.exe
  C:\Windows\System\bBIVDHn.exe
  2⤵
  PID:7544
- C:\Windows\System\HYapISa.exe
  C:\Windows\System\HYapISa.exe
  2⤵
  PID:7580
- C:\Windows\System\MTmGSqB.exe
  C:\Windows\System\MTmGSqB.exe
  2⤵
  PID:7604
- C:\Windows\System\LBXUNKd.exe
  C:\Windows\System\LBXUNKd.exe
  2⤵
  PID:7636
- C:\Windows\System\jsTlNYK.exe
  C:\Windows\System\jsTlNYK.exe
  2⤵
  PID:7676
- C:\Windows\System\EOWRZFr.exe
  C:\Windows\System\EOWRZFr.exe
  2⤵
  PID:7724
- C:\Windows\System\UOIXqUv.exe
  C:\Windows\System\UOIXqUv.exe
  2⤵
  PID:7748
- C:\Windows\System\hNGMooW.exe
  C:\Windows\System\hNGMooW.exe
  2⤵
  PID:7776
- C:\Windows\System\EbEVfQO.exe
  C:\Windows\System\EbEVfQO.exe
  2⤵
  PID:7816
- C:\Windows\System\GndMkjv.exe
  C:\Windows\System\GndMkjv.exe
  2⤵
  PID:7840
- C:\Windows\System\NUncCKO.exe
  C:\Windows\System\NUncCKO.exe
  2⤵
  PID:7868
- C:\Windows\System\FxIsKhP.exe
  C:\Windows\System\FxIsKhP.exe
  2⤵
  PID:7900
- C:\Windows\System\PHAoRdb.exe
  C:\Windows\System\PHAoRdb.exe
  2⤵
  PID:7932
- C:\Windows\System\pMQRrZe.exe
  C:\Windows\System\pMQRrZe.exe
  2⤵
  PID:7976
- C:\Windows\System\lioAXZg.exe
  C:\Windows\System\lioAXZg.exe
  2⤵
  PID:8000
- C:\Windows\System\mUUCJOP.exe
  C:\Windows\System\mUUCJOP.exe
  2⤵
  PID:8024
- C:\Windows\System\lmIBjZf.exe
  C:\Windows\System\lmIBjZf.exe
  2⤵
  PID:8052
- C:\Windows\System\HxBQqeD.exe
  C:\Windows\System\HxBQqeD.exe
  2⤵
  PID:8076
- C:\Windows\System\EAncBGR.exe
  C:\Windows\System\EAncBGR.exe
  2⤵
  PID:8108
- C:\Windows\System\TqqAUEl.exe
  C:\Windows\System\TqqAUEl.exe
  2⤵
  PID:8140
- C:\Windows\System\KaqErbv.exe
  C:\Windows\System\KaqErbv.exe
  2⤵
  PID:8168
- C:\Windows\System\SwtdoYI.exe
  C:\Windows\System\SwtdoYI.exe
  2⤵
  PID:7172
- C:\Windows\System\OwlZmii.exe
  C:\Windows\System\OwlZmii.exe
  2⤵
  PID:7256
- C:\Windows\System\zEtJadK.exe
  C:\Windows\System\zEtJadK.exe
  2⤵
  PID:7340
- C:\Windows\System\RjXAgcA.exe
  C:\Windows\System\RjXAgcA.exe
  2⤵
  PID:7444
- C:\Windows\System\ywlFOPM.exe
  C:\Windows\System\ywlFOPM.exe
  2⤵
  PID:6316
- C:\Windows\System\uKWZhXv.exe
  C:\Windows\System\uKWZhXv.exe
  2⤵
  PID:2624
- C:\Windows\System\CKIzTyx.exe
  C:\Windows\System\CKIzTyx.exe
  2⤵
  PID:7664
- C:\Windows\System\cJAzROO.exe
  C:\Windows\System\cJAzROO.exe
  2⤵
  PID:7744
- C:\Windows\System\dsGayej.exe
  C:\Windows\System\dsGayej.exe
  2⤵
  PID:7824
- C:\Windows\System\Cdrpttp.exe
  C:\Windows\System\Cdrpttp.exe
  2⤵
  PID:7892
- C:\Windows\System\PAULlws.exe
  C:\Windows\System\PAULlws.exe
  2⤵
  PID:7968
- C:\Windows\System\KpDosSS.exe
  C:\Windows\System\KpDosSS.exe
  2⤵
  PID:8040
- C:\Windows\System\JPIFVZs.exe
  C:\Windows\System\JPIFVZs.exe
  2⤵
  PID:8104
- C:\Windows\System\akHMYWH.exe
  C:\Windows\System\akHMYWH.exe
  2⤵
  PID:8156
- C:\Windows\System\ckpKZTa.exe
  C:\Windows\System\ckpKZTa.exe
  2⤵
  PID:7284
- C:\Windows\System\zBomvAH.exe
  C:\Windows\System\zBomvAH.exe
  2⤵
  PID:7508
- C:\Windows\System\CIcIjba.exe
  C:\Windows\System\CIcIjba.exe
  2⤵
  PID:7612
- C:\Windows\System\pXVrohq.exe
  C:\Windows\System\pXVrohq.exe
  2⤵
  PID:7788
- C:\Windows\System\rGFPxjQ.exe
  C:\Windows\System\rGFPxjQ.exe
  2⤵
  PID:7964
- C:\Windows\System\krHxoam.exe
  C:\Windows\System\krHxoam.exe
  2⤵
  PID:8096
- C:\Windows\System\zbtcrsa.exe
  C:\Windows\System\zbtcrsa.exe
  2⤵
  PID:7320
- C:\Windows\System\mQSvVit.exe
  C:\Windows\System\mQSvVit.exe
  2⤵
  PID:7856
- C:\Windows\System\TmmQSGb.exe
  C:\Windows\System\TmmQSGb.exe
  2⤵
  PID:8068
- C:\Windows\System\nLVUfsb.exe
  C:\Windows\System\nLVUfsb.exe
  2⤵
  PID:7592
- C:\Windows\System\jGtoVdU.exe
  C:\Windows\System\jGtoVdU.exe
  2⤵
  PID:8200
- C:\Windows\System\ZvwvHBH.exe
  C:\Windows\System\ZvwvHBH.exe
  2⤵
  PID:8220
- C:\Windows\System\xRviolg.exe
  C:\Windows\System\xRviolg.exe
  2⤵
  PID:8248
- C:\Windows\System\eBcAhJd.exe
  C:\Windows\System\eBcAhJd.exe
  2⤵
  PID:8272
- C:\Windows\System\UCbaBhM.exe
  C:\Windows\System\UCbaBhM.exe
  2⤵
  PID:8300
- C:\Windows\System\CaZudwA.exe
  C:\Windows\System\CaZudwA.exe
  2⤵
  PID:8328
- C:\Windows\System\cniHesf.exe
  C:\Windows\System\cniHesf.exe
  2⤵
  PID:8372
- C:\Windows\System\tBjpDtZ.exe
  C:\Windows\System\tBjpDtZ.exe
  2⤵
  PID:8392
- C:\Windows\System\GBcCmGL.exe
  C:\Windows\System\GBcCmGL.exe
  2⤵
  PID:8424
- C:\Windows\System\PqNZeht.exe
  C:\Windows\System\PqNZeht.exe
  2⤵
  PID:8460
- C:\Windows\System\WVydXFX.exe
  C:\Windows\System\WVydXFX.exe
  2⤵
  PID:8488
- C:\Windows\System\RmBsBEA.exe
  C:\Windows\System\RmBsBEA.exe
  2⤵
  PID:8516
- C:\Windows\System\dIfPkUN.exe
  C:\Windows\System\dIfPkUN.exe
  2⤵
  PID:8544
- C:\Windows\System\tjDPjZk.exe
  C:\Windows\System\tjDPjZk.exe
  2⤵
  PID:8572
- C:\Windows\System\BkBRHKU.exe
  C:\Windows\System\BkBRHKU.exe
  2⤵
  PID:8600
- C:\Windows\System\zRqGGuL.exe
  C:\Windows\System\zRqGGuL.exe
  2⤵
  PID:8628
- C:\Windows\System\iKMSkMu.exe
  C:\Windows\System\iKMSkMu.exe
  2⤵
  PID:8672
- C:\Windows\System\VYVWXpG.exe
  C:\Windows\System\VYVWXpG.exe
  2⤵
  PID:8692
- C:\Windows\System\DSGGgdf.exe
  C:\Windows\System\DSGGgdf.exe
  2⤵
  PID:8720
- C:\Windows\System\jYSYski.exe
  C:\Windows\System\jYSYski.exe
  2⤵
  PID:8748
- C:\Windows\System\GnOUTMW.exe
  C:\Windows\System\GnOUTMW.exe
  2⤵
  PID:8776
- C:\Windows\System\fKgwqOO.exe
  C:\Windows\System\fKgwqOO.exe
  2⤵
  PID:8804
- C:\Windows\System\GdGGPhK.exe
  C:\Windows\System\GdGGPhK.exe
  2⤵
  PID:8832
- C:\Windows\System\TqGAeSG.exe
  C:\Windows\System\TqGAeSG.exe
  2⤵
  PID:8860
- C:\Windows\System\gJUhaST.exe
  C:\Windows\System\gJUhaST.exe
  2⤵
  PID:8888
- C:\Windows\System\BACDFxT.exe
  C:\Windows\System\BACDFxT.exe
  2⤵
  PID:8916
- C:\Windows\System\uVYvNaC.exe
  C:\Windows\System\uVYvNaC.exe
  2⤵
  PID:8944
- C:\Windows\System\XXubCYK.exe
  C:\Windows\System\XXubCYK.exe
  2⤵
  PID:8976
- C:\Windows\System\VjDoWqW.exe
  C:\Windows\System\VjDoWqW.exe
  2⤵
  PID:9004
- C:\Windows\System\psgLBlf.exe
  C:\Windows\System\psgLBlf.exe
  2⤵
  PID:9032
- C:\Windows\System\CUZasnV.exe
  C:\Windows\System\CUZasnV.exe
  2⤵
  PID:9060
- C:\Windows\System\zXJVrTV.exe
  C:\Windows\System\zXJVrTV.exe
  2⤵
  PID:9088
- C:\Windows\System\DudCESF.exe
  C:\Windows\System\DudCESF.exe
  2⤵
  PID:9116
- C:\Windows\System\TMXFlvB.exe
  C:\Windows\System\TMXFlvB.exe
  2⤵
  PID:9148
- C:\Windows\System\NzGXekY.exe
  C:\Windows\System\NzGXekY.exe
  2⤵
  PID:9176
- C:\Windows\System\sumuRCo.exe
  C:\Windows\System\sumuRCo.exe
  2⤵
  PID:9204
- C:\Windows\System\aYbcCaN.exe
  C:\Windows\System\aYbcCaN.exe
  2⤵
  PID:8212
- C:\Windows\System\lMgvytZ.exe
  C:\Windows\System\lMgvytZ.exe
  2⤵
  PID:8268
- C:\Windows\System\nVrYsgo.exe
  C:\Windows\System\nVrYsgo.exe
  2⤵
  PID:8356
- C:\Windows\System\PNMQNUu.exe
  C:\Windows\System\PNMQNUu.exe
  2⤵
  PID:8420
- C:\Windows\System\QlbQrCv.exe
  C:\Windows\System\QlbQrCv.exe
  2⤵
  PID:8484
- C:\Windows\System\whSgcwq.exe
  C:\Windows\System\whSgcwq.exe
  2⤵
  PID:8556
- C:\Windows\System\FRZFgyx.exe
  C:\Windows\System\FRZFgyx.exe
  2⤵
  PID:8620
- C:\Windows\System\INDocUa.exe
  C:\Windows\System\INDocUa.exe
  2⤵
  PID:8704
- C:\Windows\System\qASKBhS.exe
  C:\Windows\System\qASKBhS.exe
  2⤵
  PID:8768
- C:\Windows\System\bqdZcMa.exe
  C:\Windows\System\bqdZcMa.exe
  2⤵
  PID:8824
- C:\Windows\System\KipjRsA.exe
  C:\Windows\System\KipjRsA.exe
  2⤵
  PID:8900
- C:\Windows\System\mHlXazY.exe
  C:\Windows\System\mHlXazY.exe
  2⤵
  PID:8972
- C:\Windows\System\iuroati.exe
  C:\Windows\System\iuroati.exe
  2⤵
  PID:9044
- C:\Windows\System\YtgZYgE.exe
  C:\Windows\System\YtgZYgE.exe
  2⤵
  PID:9108
- C:\Windows\System\qWwhnQz.exe
  C:\Windows\System\qWwhnQz.exe
  2⤵
  PID:9160
- C:\Windows\System\OwlsTAL.exe
  C:\Windows\System\OwlsTAL.exe
  2⤵
  PID:8240
- C:\Windows\System\uXZyoxy.exe
  C:\Windows\System\uXZyoxy.exe
  2⤵
  PID:8404
- C:\Windows\System\mGsaSKc.exe
  C:\Windows\System\mGsaSKc.exe
  2⤵
  PID:8540
- C:\Windows\System\vaiKYFF.exe
  C:\Windows\System\vaiKYFF.exe
  2⤵
  PID:8688
- C:\Windows\System\cXudBnr.exe
  C:\Windows\System\cXudBnr.exe
  2⤵
  PID:8856
- C:\Windows\System\EraYaVS.exe
  C:\Windows\System\EraYaVS.exe
  2⤵
  PID:9000
- C:\Windows\System\TBPPOnT.exe
  C:\Windows\System\TBPPOnT.exe
  2⤵
  PID:9140
- C:\Windows\System\IZCdzNw.exe
  C:\Windows\System\IZCdzNw.exe
  2⤵
  PID:8324
- C:\Windows\System\uRXabtc.exe
  C:\Windows\System\uRXabtc.exe
  2⤵
  PID:8760
- C:\Windows\System\SWLgNHU.exe
  C:\Windows\System\SWLgNHU.exe
  2⤵
  PID:9100
- C:\Windows\System\ZxJMznk.exe
  C:\Windows\System\ZxJMznk.exe
  2⤵
  PID:8884
- C:\Windows\System\xhKzeNh.exe
  C:\Windows\System\xhKzeNh.exe
  2⤵
  PID:7396
- C:\Windows\System\FNznlgb.exe
  C:\Windows\System\FNznlgb.exe
  2⤵
  PID:7472
- C:\Windows\System\olsYutp.exe
  C:\Windows\System\olsYutp.exe
  2⤵
  PID:7428
- C:\Windows\System\KTMbGuK.exe
  C:\Windows\System\KTMbGuK.exe
  2⤵
  PID:8964
- C:\Windows\System\eNiVEhD.exe
  C:\Windows\System\eNiVEhD.exe
  2⤵
  PID:9236
- C:\Windows\System\axDdFLu.exe
  C:\Windows\System\axDdFLu.exe
  2⤵
  PID:9264
- C:\Windows\System\laZyNas.exe
  C:\Windows\System\laZyNas.exe
  2⤵
  PID:9292
- C:\Windows\System\TJEQMAQ.exe
  C:\Windows\System\TJEQMAQ.exe
  2⤵
  PID:9320
- C:\Windows\System\DwlmuHx.exe
  C:\Windows\System\DwlmuHx.exe
  2⤵
  PID:9356
- C:\Windows\System\ETElDvL.exe
  C:\Windows\System\ETElDvL.exe
  2⤵
  PID:9388
- C:\Windows\System\xuRmsFv.exe
  C:\Windows\System\xuRmsFv.exe
  2⤵
  PID:9416
- C:\Windows\System\TyNJeYZ.exe
  C:\Windows\System\TyNJeYZ.exe
  2⤵
  PID:9460
- C:\Windows\System\VIhcaiJ.exe
  C:\Windows\System\VIhcaiJ.exe
  2⤵
  PID:9496
- C:\Windows\System\ISvkxbN.exe
  C:\Windows\System\ISvkxbN.exe
  2⤵
  PID:9532
- C:\Windows\System\xXvzgXu.exe
  C:\Windows\System\xXvzgXu.exe
  2⤵
  PID:9560
- C:\Windows\System\fEnBGYg.exe
  C:\Windows\System\fEnBGYg.exe
  2⤵
  PID:9592
- C:\Windows\System\mhOhXBk.exe
  C:\Windows\System\mhOhXBk.exe
  2⤵
  PID:9628
- C:\Windows\System\swfaaNL.exe
  C:\Windows\System\swfaaNL.exe
  2⤵
  PID:9656
- C:\Windows\System\RWOXBPv.exe
  C:\Windows\System\RWOXBPv.exe
  2⤵
  PID:9684
- C:\Windows\System\SevcuiE.exe
  C:\Windows\System\SevcuiE.exe
  2⤵
  PID:9716
- C:\Windows\System\RtaNZzg.exe
  C:\Windows\System\RtaNZzg.exe
  2⤵
  PID:9756
- C:\Windows\System\gnYcqPA.exe
  C:\Windows\System\gnYcqPA.exe
  2⤵
  PID:9788
- C:\Windows\System\hNADFOy.exe
  C:\Windows\System\hNADFOy.exe
  2⤵
  PID:9816
- C:\Windows\System\fTQxMbH.exe
  C:\Windows\System\fTQxMbH.exe
  2⤵
  PID:9836
- C:\Windows\System\MuNibKI.exe
  C:\Windows\System\MuNibKI.exe
  2⤵
  PID:9868
- C:\Windows\System\RPfKhBe.exe
  C:\Windows\System\RPfKhBe.exe
  2⤵
  PID:9888
- C:\Windows\System\PbSCjEk.exe
  C:\Windows\System\PbSCjEk.exe
  2⤵
  PID:9920
- C:\Windows\System\AZPkCUY.exe
  C:\Windows\System\AZPkCUY.exe
  2⤵
  PID:9948
- C:\Windows\System\InHZEIO.exe
  C:\Windows\System\InHZEIO.exe
  2⤵
  PID:9992
- C:\Windows\System\YcAjdNg.exe
  C:\Windows\System\YcAjdNg.exe
  2⤵
  PID:10020
- C:\Windows\System\YdfXCed.exe
  C:\Windows\System\YdfXCed.exe
  2⤵
  PID:10052
- C:\Windows\System\enjCPEH.exe
  C:\Windows\System\enjCPEH.exe
  2⤵
  PID:10080
- C:\Windows\System\kvVyOsd.exe
  C:\Windows\System\kvVyOsd.exe
  2⤵
  PID:10100
- C:\Windows\System\EawtQkL.exe
  C:\Windows\System\EawtQkL.exe
  2⤵
  PID:10128
- C:\Windows\System\bkhZBCg.exe
  C:\Windows\System\bkhZBCg.exe
  2⤵
  PID:10168
- C:\Windows\System\WFFsknX.exe
  C:\Windows\System\WFFsknX.exe
  2⤵
  PID:10196
- C:\Windows\System\QvVkhlA.exe
  C:\Windows\System\QvVkhlA.exe
  2⤵
  PID:10212
- C:\Windows\System\BCRrfoz.exe
  C:\Windows\System\BCRrfoz.exe
  2⤵
  PID:9232
- C:\Windows\System\qFSSlKH.exe
  C:\Windows\System\qFSSlKH.exe
  2⤵
  PID:9288
- C:\Windows\System\iBqpHBB.exe
  C:\Windows\System\iBqpHBB.exe
  2⤵
  PID:9352
- C:\Windows\System\GcwiRRs.exe
  C:\Windows\System\GcwiRRs.exe
  2⤵
  PID:9468
- C:\Windows\System\iirPmFl.exe
  C:\Windows\System\iirPmFl.exe
  2⤵
  PID:9624
- C:\Windows\System\drwxPno.exe
  C:\Windows\System\drwxPno.exe
  2⤵
  PID:9676
- C:\Windows\System\Saikypa.exe
  C:\Windows\System\Saikypa.exe
  2⤵
  PID:9744
- C:\Windows\System\wXyYtfs.exe
  C:\Windows\System\wXyYtfs.exe
  2⤵
  PID:9804
- C:\Windows\System\GHSGRPv.exe
  C:\Windows\System\GHSGRPv.exe
  2⤵
  PID:9844
- C:\Windows\System\fzIuyUT.exe
  C:\Windows\System\fzIuyUT.exe
  2⤵
  PID:9936
- C:\Windows\System\LodLvBI.exe
  C:\Windows\System\LodLvBI.exe
  2⤵
  PID:10016
- C:\Windows\System\cHeQkAR.exe
  C:\Windows\System\cHeQkAR.exe
  2⤵
  PID:10076
- C:\Windows\System\gTPZChW.exe
  C:\Windows\System\gTPZChW.exe
  2⤵
  PID:10148
- C:\Windows\System\RPXTfDO.exe
  C:\Windows\System\RPXTfDO.exe
  2⤵
  PID:10208
- C:\Windows\System\koHVogJ.exe
  C:\Windows\System\koHVogJ.exe
  2⤵
  PID:9276
- C:\Windows\System\iOBFajx.exe
  C:\Windows\System\iOBFajx.exe
  2⤵
  PID:9476
- C:\Windows\System\hnGVfxV.exe
  C:\Windows\System\hnGVfxV.exe
  2⤵
  PID:9452
- C:\Windows\System\YpzORYz.exe
  C:\Windows\System\YpzORYz.exe
  2⤵
  PID:9492
- C:\Windows\System\OBfSGnV.exe
  C:\Windows\System\OBfSGnV.exe
  2⤵
  PID:9800
- C:\Windows\System\ANyYcFa.exe
  C:\Windows\System\ANyYcFa.exe
  2⤵
  PID:9940
- C:\Windows\System\CaKzKNq.exe
  C:\Windows\System\CaKzKNq.exe
  2⤵
  PID:10116
- C:\Windows\System\wxkSmYR.exe
  C:\Windows\System\wxkSmYR.exe
  2⤵
  PID:9248
- C:\Windows\System\IOEEdvB.exe
  C:\Windows\System\IOEEdvB.exe
  2⤵
  PID:9472
- C:\Windows\System\yyAXzjY.exe
  C:\Windows\System\yyAXzjY.exe
  2⤵
  PID:9856
- C:\Windows\System\uLShfZh.exe
  C:\Windows\System\uLShfZh.exe
  2⤵
  PID:10152
- C:\Windows\System\uXuierX.exe
  C:\Windows\System\uXuierX.exe
  2⤵
  PID:9708
- C:\Windows\System\sBFFYMm.exe
  C:\Windows\System\sBFFYMm.exe
  2⤵
  PID:10184
- C:\Windows\System\VQdDXLa.exe
  C:\Windows\System\VQdDXLa.exe
  2⤵
  PID:10260
- C:\Windows\System\AQzhhnG.exe
  C:\Windows\System\AQzhhnG.exe
  2⤵
  PID:10288
- C:\Windows\System\kdGpjIz.exe
  C:\Windows\System\kdGpjIz.exe
  2⤵
  PID:10316
- C:\Windows\System\kCIIpqM.exe
  C:\Windows\System\kCIIpqM.exe
  2⤵
  PID:10344
- C:\Windows\System\gqWIjdh.exe
  C:\Windows\System\gqWIjdh.exe
  2⤵
  PID:10372
- C:\Windows\System\FFhntGm.exe
  C:\Windows\System\FFhntGm.exe
  2⤵
  PID:10400
- C:\Windows\System\LEdyqMY.exe
  C:\Windows\System\LEdyqMY.exe
  2⤵
  PID:10428
- C:\Windows\System\clBSqfT.exe
  C:\Windows\System\clBSqfT.exe
  2⤵
  PID:10456
- C:\Windows\System\BBQfffF.exe
  C:\Windows\System\BBQfffF.exe
  2⤵
  PID:10484
- C:\Windows\System\CTmbpUe.exe
  C:\Windows\System\CTmbpUe.exe
  2⤵
  PID:10512
- C:\Windows\System\PcqPmSR.exe
  C:\Windows\System\PcqPmSR.exe
  2⤵
  PID:10540
- C:\Windows\System\xLNNvej.exe
  C:\Windows\System\xLNNvej.exe
  2⤵
  PID:10568
- C:\Windows\System\gaNzwDY.exe
  C:\Windows\System\gaNzwDY.exe
  2⤵
  PID:10596
- C:\Windows\System\GbsEqUM.exe
  C:\Windows\System\GbsEqUM.exe
  2⤵
  PID:10624
- C:\Windows\System\mYcDHRg.exe
  C:\Windows\System\mYcDHRg.exe
  2⤵
  PID:10652
- C:\Windows\System\bnAhnDB.exe
  C:\Windows\System\bnAhnDB.exe
  2⤵
  PID:10680
- C:\Windows\System\JdOjwSG.exe
  C:\Windows\System\JdOjwSG.exe
  2⤵
  PID:10708
- C:\Windows\System\dBGmhha.exe
  C:\Windows\System\dBGmhha.exe
  2⤵
  PID:10736
- C:\Windows\System\UekUhvW.exe
  C:\Windows\System\UekUhvW.exe
  2⤵
  PID:10764
- C:\Windows\System\ybFUXuk.exe
  C:\Windows\System\ybFUXuk.exe
  2⤵
  PID:10792
- C:\Windows\System\rqIbglo.exe
  C:\Windows\System\rqIbglo.exe
  2⤵
  PID:10820
- C:\Windows\System\JCRlkcu.exe
  C:\Windows\System\JCRlkcu.exe
  2⤵
  PID:10848
- C:\Windows\System\BsrxhoR.exe
  C:\Windows\System\BsrxhoR.exe
  2⤵
  PID:10876
- C:\Windows\System\kSRlWLX.exe
  C:\Windows\System\kSRlWLX.exe
  2⤵
  PID:10904
- C:\Windows\System\NTDyfiA.exe
  C:\Windows\System\NTDyfiA.exe
  2⤵
  PID:10936
- C:\Windows\System\fqCYHTx.exe
  C:\Windows\System\fqCYHTx.exe
  2⤵
  PID:10964
- C:\Windows\System\ZaglBFb.exe
  C:\Windows\System\ZaglBFb.exe
  2⤵
  PID:10992
- C:\Windows\System\HzgxLZX.exe
  C:\Windows\System\HzgxLZX.exe
  2⤵
  PID:11020
- C:\Windows\System\OXojaOh.exe
  C:\Windows\System\OXojaOh.exe
  2⤵
  PID:11048
- C:\Windows\System\kgJEuZX.exe
  C:\Windows\System\kgJEuZX.exe
  2⤵
  PID:11076
- C:\Windows\System\UFxxEuv.exe
  C:\Windows\System\UFxxEuv.exe
  2⤵
  PID:11104
- C:\Windows\System\XXUcDow.exe
  C:\Windows\System\XXUcDow.exe
  2⤵
  PID:11132
- C:\Windows\System\qPgbRbm.exe
  C:\Windows\System\qPgbRbm.exe
  2⤵
  PID:11160
- C:\Windows\System\xjoJEOk.exe
  C:\Windows\System\xjoJEOk.exe
  2⤵
  PID:11188
- C:\Windows\System\nmFBPje.exe
  C:\Windows\System\nmFBPje.exe
  2⤵
  PID:11216
- C:\Windows\System\QvOkUVf.exe
  C:\Windows\System\QvOkUVf.exe
  2⤵
  PID:11244
- C:\Windows\System\dWukDfs.exe
  C:\Windows\System\dWukDfs.exe
  2⤵
  PID:10256
- C:\Windows\System\FKPaJBn.exe
  C:\Windows\System\FKPaJBn.exe
  2⤵
  PID:10328
- C:\Windows\System\GsivqCQ.exe
  C:\Windows\System\GsivqCQ.exe
  2⤵
  PID:10392
- C:\Windows\System\HNKSdQE.exe
  C:\Windows\System\HNKSdQE.exe
  2⤵
  PID:10452
- C:\Windows\System\wzApiZu.exe
  C:\Windows\System\wzApiZu.exe
  2⤵
  PID:10524
- C:\Windows\System\xKAhWvr.exe
  C:\Windows\System\xKAhWvr.exe
  2⤵
  PID:10588
- C:\Windows\System\ocAqkRq.exe
  C:\Windows\System\ocAqkRq.exe
  2⤵
  PID:10648
- C:\Windows\System\STyNyXl.exe
  C:\Windows\System\STyNyXl.exe
  2⤵
  PID:1904
- C:\Windows\System\UUpKFIa.exe
  C:\Windows\System\UUpKFIa.exe
  2⤵
  PID:4400
- C:\Windows\System\bdZpqvQ.exe
  C:\Windows\System\bdZpqvQ.exe
  2⤵
  PID:4624
- C:\Windows\System\AjkZiHo.exe
  C:\Windows\System\AjkZiHo.exe
  2⤵
  PID:2492
- C:\Windows\System\BkMlYTG.exe
  C:\Windows\System\BkMlYTG.exe
  2⤵
  PID:10748
- C:\Windows\System\JTSWTeg.exe
  C:\Windows\System\JTSWTeg.exe
  2⤵
  PID:10816
- C:\Windows\System\cmiqUeb.exe
  C:\Windows\System\cmiqUeb.exe
  2⤵
  PID:10872
- C:\Windows\System\LlzbsfU.exe
  C:\Windows\System\LlzbsfU.exe
  2⤵
  PID:10948
- C:\Windows\System\HYTHhHk.exe
  C:\Windows\System\HYTHhHk.exe
  2⤵
  PID:11012
- C:\Windows\System\jlPRpvz.exe
  C:\Windows\System\jlPRpvz.exe
  2⤵
  PID:11072
- C:\Windows\System\fCnjknN.exe
  C:\Windows\System\fCnjknN.exe
  2⤵
  PID:11144
- C:\Windows\System\uqvyNBs.exe
  C:\Windows\System\uqvyNBs.exe
  2⤵
  PID:11208
- C:\Windows\System\LMvSMsZ.exe
  C:\Windows\System\LMvSMsZ.exe
  2⤵
  PID:10252
- C:\Windows\System\QhfrEvh.exe
  C:\Windows\System\QhfrEvh.exe
  2⤵
  PID:10420
- C:\Windows\System\gMjANHe.exe
  C:\Windows\System\gMjANHe.exe
  2⤵
  PID:10564
- C:\Windows\System\zUOpGek.exe
  C:\Windows\System\zUOpGek.exe
  2⤵
  PID:5140
- C:\Windows\System\wEATQFp.exe
  C:\Windows\System\wEATQFp.exe
  2⤵
  PID:7972
- C:\Windows\System\hZDMjtH.exe
  C:\Windows\System\hZDMjtH.exe
  2⤵
  PID:10788
- C:\Windows\System\emxccUj.exe
  C:\Windows\System\emxccUj.exe
  2⤵
  PID:10932
- C:\Windows\System\eKiMmzZ.exe
  C:\Windows\System\eKiMmzZ.exe
  2⤵
  PID:11100
- C:\Windows\System\beyNUaI.exe
  C:\Windows\System\beyNUaI.exe
  2⤵
  PID:11256
- C:\Windows\System\fHpBMXE.exe
  C:\Windows\System\fHpBMXE.exe
  2⤵
  PID:10552
- C:\Windows\System\zagygXm.exe
  C:\Windows\System\zagygXm.exe
  2⤵
  PID:10860
- C:\Windows\System\DdIoycw.exe
  C:\Windows\System\DdIoycw.exe
  2⤵
  PID:11060
- C:\Windows\System\SiMaJfG.exe
  C:\Windows\System\SiMaJfG.exe
  2⤵
  PID:10508
- C:\Windows\System\KaFlQAL.exe
  C:\Windows\System\KaFlQAL.exe
  2⤵
  PID:10928
- C:\Windows\System\mduyOoX.exe
  C:\Windows\System\mduyOoX.exe
  2⤵
  PID:5396
- C:\Windows\System\mgiVfaj.exe
  C:\Windows\System\mgiVfaj.exe
  2⤵
  PID:11292
- C:\Windows\System\WwsXunH.exe
  C:\Windows\System\WwsXunH.exe
  2⤵
  PID:11316
- C:\Windows\System\aqSgtuK.exe
  C:\Windows\System\aqSgtuK.exe
  2⤵
  PID:11340
- C:\Windows\System\CqJBCGU.exe
  C:\Windows\System\CqJBCGU.exe
  2⤵
  PID:11384
- C:\Windows\System\AlWiQuI.exe
  C:\Windows\System\AlWiQuI.exe
  2⤵
  PID:11436
- C:\Windows\System\ecxHdOi.exe
  C:\Windows\System\ecxHdOi.exe
  2⤵
  PID:11460
- C:\Windows\System\UOvQJMC.exe
  C:\Windows\System\UOvQJMC.exe
  2⤵
  PID:11492
- C:\Windows\System\GPpuAvk.exe
  C:\Windows\System\GPpuAvk.exe
  2⤵
  PID:11524
- C:\Windows\System\DMvZZMo.exe
  C:\Windows\System\DMvZZMo.exe
  2⤵
  PID:11560
- C:\Windows\System\WYTEAfx.exe
  C:\Windows\System\WYTEAfx.exe
  2⤵
  PID:11584
- C:\Windows\System\QZOVxBi.exe
  C:\Windows\System\QZOVxBi.exe
  2⤵
  PID:11624
- C:\Windows\System\WlzdvtV.exe
  C:\Windows\System\WlzdvtV.exe
  2⤵
  PID:11656
- C:\Windows\System\tSGfjCL.exe
  C:\Windows\System\tSGfjCL.exe
  2⤵
  PID:11672
- C:\Windows\System\ktCUgAx.exe
  C:\Windows\System\ktCUgAx.exe
  2⤵
  PID:11688
- C:\Windows\System\eSjtKno.exe
  C:\Windows\System\eSjtKno.exe
  2⤵
  PID:11704
- C:\Windows\System\QCxcPob.exe
  C:\Windows\System\QCxcPob.exe
  2⤵
  PID:11728
- C:\Windows\System\ieoRYWg.exe
  C:\Windows\System\ieoRYWg.exe
  2⤵
  PID:11752
- C:\Windows\System\VjwNCsD.exe
  C:\Windows\System\VjwNCsD.exe
  2⤵
  PID:11780
- C:\Windows\System\xddIYfB.exe
  C:\Windows\System\xddIYfB.exe
  2⤵
  PID:11832
- C:\Windows\System\NiJoEWE.exe
  C:\Windows\System\NiJoEWE.exe
  2⤵
  PID:11884
- C:\Windows\System\VEBswoo.exe
  C:\Windows\System\VEBswoo.exe
  2⤵
  PID:11908
- C:\Windows\System\HRxUlgo.exe
  C:\Windows\System\HRxUlgo.exe
  2⤵
  PID:11936
- C:\Windows\System\WBSnaIE.exe
  C:\Windows\System\WBSnaIE.exe
  2⤵
  PID:11964
- C:\Windows\System\nNqKmLo.exe
  C:\Windows\System\nNqKmLo.exe
  2⤵
  PID:11996
- C:\Windows\System\YblrJKE.exe
  C:\Windows\System\YblrJKE.exe
  2⤵
  PID:12020
- C:\Windows\System\RSbeSvL.exe
  C:\Windows\System\RSbeSvL.exe
  2⤵
  PID:12060
- C:\Windows\System\WqvxFEt.exe
  C:\Windows\System\WqvxFEt.exe
  2⤵
  PID:12076
- C:\Windows\System\XeSAWAl.exe
  C:\Windows\System\XeSAWAl.exe
  2⤵
  PID:12104
- C:\Windows\System\UAdyivN.exe
  C:\Windows\System\UAdyivN.exe
  2⤵
  PID:12144
- C:\Windows\System\pxsooKZ.exe
  C:\Windows\System\pxsooKZ.exe
  2⤵
  PID:12168
- C:\Windows\System\NbFDrBY.exe
  C:\Windows\System\NbFDrBY.exe
  2⤵
  PID:12200
- C:\Windows\System\YaEWQYN.exe
  C:\Windows\System\YaEWQYN.exe
  2⤵
  PID:12224
- C:\Windows\System\bFBkiad.exe
  C:\Windows\System\bFBkiad.exe
  2⤵
  PID:12244
- C:\Windows\System\hmPbHoT.exe
  C:\Windows\System\hmPbHoT.exe
  2⤵
  PID:12260
- C:\Windows\System\ciItkDG.exe
  C:\Windows\System\ciItkDG.exe
  2⤵
  PID:11300
- C:\Windows\System\ZnCjooh.exe
  C:\Windows\System\ZnCjooh.exe
  2⤵
  PID:11408
- C:\Windows\System\iiQtlBq.exe
  C:\Windows\System\iiQtlBq.exe
  2⤵
  PID:11456
- C:\Windows\System\scRjVIV.exe
  C:\Windows\System\scRjVIV.exe
  2⤵
  PID:11552
- C:\Windows\System\sHqfnNU.exe
  C:\Windows\System\sHqfnNU.exe
  2⤵
  PID:11636
- C:\Windows\System\uYkCUNo.exe
  C:\Windows\System\uYkCUNo.exe
  2⤵
  PID:11680
- C:\Windows\System\VuCHBmZ.exe
  C:\Windows\System\VuCHBmZ.exe
  2⤵
  PID:11768
- C:\Windows\System\XSHiDAE.exe
  C:\Windows\System\XSHiDAE.exe
  2⤵
  PID:11788
- C:\Windows\System\drmpKfI.exe
  C:\Windows\System\drmpKfI.exe
  2⤵
  PID:11904
- C:\Windows\System\gykXtAs.exe
  C:\Windows\System\gykXtAs.exe
  2⤵
  PID:11976
- C:\Windows\System\XLycitf.exe
  C:\Windows\System\XLycitf.exe
  2⤵
  PID:12040
- C:\Windows\System\skyWOsk.exe
  C:\Windows\System\skyWOsk.exe
  2⤵
  PID:12096
- C:\Windows\System\sNorqPx.exe
  C:\Windows\System\sNorqPx.exe
  2⤵
  PID:12184
- C:\Windows\System\zBAGevC.exe
  C:\Windows\System\zBAGevC.exe
  2⤵
  PID:212
- C:\Windows\System\hQtsnBh.exe
  C:\Windows\System\hQtsnBh.exe
  2⤵
  PID:11280
- C:\Windows\System\EAtxyNV.exe
  C:\Windows\System\EAtxyNV.exe
  2⤵
  PID:11448
- C:\Windows\System\LsCYlEB.exe
  C:\Windows\System\LsCYlEB.exe
  2⤵
  PID:11620
- C:\Windows\System\XUmYbqM.exe
  C:\Windows\System\XUmYbqM.exe
  2⤵
  PID:11840
- C:\Windows\System\YvHlPSO.exe
  C:\Windows\System\YvHlPSO.exe
  2⤵
  PID:12012
- C:\Windows\System\eOViUpz.exe
  C:\Windows\System\eOViUpz.exe
  2⤵
  PID:12132
- C:\Windows\System\UvIwsTe.exe
  C:\Windows\System\UvIwsTe.exe
  2⤵
  PID:11360
- C:\Windows\System\okgwxdP.exe
  C:\Windows\System\okgwxdP.exe
  2⤵
  PID:748
- C:\Windows\System\vLYRtfu.exe
  C:\Windows\System\vLYRtfu.exe
  2⤵
  PID:11696
- C:\Windows\System\AeJDuHq.exe
  C:\Windows\System\AeJDuHq.exe
  2⤵
  PID:12088
- C:\Windows\System\JrULGNY.exe
  C:\Windows\System\JrULGNY.exe
  2⤵
  PID:5300
- C:\Windows\System\EivSKfE.exe
  C:\Windows\System\EivSKfE.exe
  2⤵
  PID:5204
- C:\Windows\System\sZlXZHV.exe
  C:\Windows\System\sZlXZHV.exe
  2⤵
  PID:11476
- C:\Windows\System\yuDuVeX.exe
  C:\Windows\System\yuDuVeX.exe
  2⤵
  PID:12072
- C:\Windows\System\eAQiMQk.exe
  C:\Windows\System\eAQiMQk.exe
  2⤵
  PID:5296
- C:\Windows\System\rNcDgYK.exe
  C:\Windows\System\rNcDgYK.exe
  2⤵
  PID:11536
- C:\Windows\System\ZCdPylO.exe
  C:\Windows\System\ZCdPylO.exe
  2⤵
  PID:640
- C:\Windows\System\ZxcblfB.exe
  C:\Windows\System\ZxcblfB.exe
  2⤵
  PID:12308
- C:\Windows\System\xTbaXPU.exe
  C:\Windows\System\xTbaXPU.exe
  2⤵
  PID:12336
- C:\Windows\System\OSyaenB.exe
  C:\Windows\System\OSyaenB.exe
  2⤵
  PID:12364
- C:\Windows\System\nLONozJ.exe
  C:\Windows\System\nLONozJ.exe
  2⤵
  PID:12392
- C:\Windows\System\aVYVLHD.exe
  C:\Windows\System\aVYVLHD.exe
  2⤵
  PID:12420
- C:\Windows\System\AoLJlRY.exe
  C:\Windows\System\AoLJlRY.exe
  2⤵
  PID:12448
- C:\Windows\System\YYaZuBi.exe
  C:\Windows\System\YYaZuBi.exe
  2⤵
  PID:12476
- C:\Windows\System\hlMvxTN.exe
  C:\Windows\System\hlMvxTN.exe
  2⤵
  PID:12504
- C:\Windows\System\zTkfrXw.exe
  C:\Windows\System\zTkfrXw.exe
  2⤵
  PID:12532
- C:\Windows\System\NaGFHvf.exe
  C:\Windows\System\NaGFHvf.exe
  2⤵
  PID:12560
- C:\Windows\System\xGtfHtY.exe
  C:\Windows\System\xGtfHtY.exe
  2⤵
  PID:12588
- C:\Windows\System\JuLXBDN.exe
  C:\Windows\System\JuLXBDN.exe
  2⤵
  PID:12616
- C:\Windows\System\VXLypco.exe
  C:\Windows\System\VXLypco.exe
  2⤵
  PID:12644
- C:\Windows\System\tvwVKRb.exe
  C:\Windows\System\tvwVKRb.exe
  2⤵
  PID:12672
- C:\Windows\System\WtiwPlZ.exe
  C:\Windows\System\WtiwPlZ.exe
  2⤵
  PID:12700
- C:\Windows\System\rpSteAv.exe
  C:\Windows\System\rpSteAv.exe
  2⤵
  PID:12728
- C:\Windows\System\KGJQsdr.exe
  C:\Windows\System\KGJQsdr.exe
  2⤵
  PID:12756
- C:\Windows\System\fqXvtKA.exe
  C:\Windows\System\fqXvtKA.exe
  2⤵
  PID:12784
- C:\Windows\System\AVDIvwq.exe
  C:\Windows\System\AVDIvwq.exe
  2⤵
  PID:12812
- C:\Windows\System\YnedERa.exe
  C:\Windows\System\YnedERa.exe
  2⤵
  PID:12840
- C:\Windows\System\jbpMPZK.exe
  C:\Windows\System\jbpMPZK.exe
  2⤵
  PID:12868
- C:\Windows\System\ZiOeVun.exe
  C:\Windows\System\ZiOeVun.exe
  2⤵
  PID:12896
- C:\Windows\System\wFPFwLH.exe
  C:\Windows\System\wFPFwLH.exe
  2⤵
  PID:12924
- C:\Windows\System\NHiblCu.exe
  C:\Windows\System\NHiblCu.exe
  2⤵
  PID:12940
- C:\Windows\System\MnbewvX.exe
  C:\Windows\System\MnbewvX.exe
  2⤵
  PID:12976
- C:\Windows\System\QOmERzd.exe
  C:\Windows\System\QOmERzd.exe
  2⤵
  PID:12996
- C:\Windows\System\eXqCPGG.exe
  C:\Windows\System\eXqCPGG.exe
  2⤵
  PID:13032
- C:\Windows\System\NiMQFgt.exe
  C:\Windows\System\NiMQFgt.exe
  2⤵
  PID:13056
- C:\Windows\System\NedSsEA.exe
  C:\Windows\System\NedSsEA.exe
  2⤵
  PID:13092
- C:\Windows\System\bGOFevr.exe
  C:\Windows\System\bGOFevr.exe
  2⤵
  PID:13116
- C:\Windows\System\CbBKwVR.exe
  C:\Windows\System\CbBKwVR.exe
  2⤵
  PID:13148
- C:\Windows\System\oYVYYOK.exe
  C:\Windows\System\oYVYYOK.exe
  2⤵
  PID:13164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vew0f1gd.wqy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vew0f1gd.wqy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

EHLwoCl.exe

Path C:\Windows\System\EHLwoCl.exe
Size 3.2MB
SHA256 8d2f1d61f54b007143b2cf700380af9a986057fbe27f057b57211404a19e7df7
MD5 2704a648eb004c7a19e7c122ad9102e8
SHA1 27b7878b4b2cb3de39f6744ea3242e12bfaae67e
SHA512 8b7eb1385c9793c2f4a859c07d8b42b8e2ac74186c29e5725ae2bdc8d4c34d792085af520e8539298c4a46436ca2a3f522bd2d3fc4956d64a93084b8ce73d4b8
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:SbBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfJbPnf.exe

Path C:\Windows\System\FfJbPnf.exe
Size 8B
SHA256 197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c
MD5 1855a32bc20d82a1da2b5edf8967f4e6
SHA1 25928e56f89ec28b56047592b93000c1d36e2a23
SHA512 6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67
MD5 SHA1 SHA512

Submit Download

GFZmPVS.exe

Path C:\Windows\System\GFZmPVS.exe
Size 3.2MB
SHA256 277692fca1270103f4ba52632629be3c2d64ed5ddd4cb418c5987c3036709d12
MD5 1bcaf3a44e4fe15d5358ca97aa52b02c
SHA1 e736f7ad317257db5a4f85201f590a3606840b4b
SHA512 c8d3a75421ad13c28f06ed8a8575ef0713136155bd8f9c935e5d67a779c4788ed7a3c2401357f928d719480d607f6726b08b770296d7ebbe3c43385cb7e71400
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:SbBeSFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

GYQpnMe.exe

Path C:\Windows\System\GYQpnMe.exe
Size 3.2MB
SHA256 5d6504d9e58548ff2298fb324c23b5e0a89cb2138b6a39d457497e9d7ac5540d
MD5 06587dde2160a852aae5018907c9c217
SHA1 dd74abec1fd82fdd3547bed13c18b9a715a75d78
SHA512 058f6087e2eb7aeded755858dced687f30e116cddc65b3459a8ec3cc639f05cae41fdbcaa4ec55314b750975294eac8df0859d38bfaeaded7f85a7bc916017ec
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:SbBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

JwgORJd.exe

Path C:\Windows\System\JwgORJd.exe
Size 3.2MB
SHA256 55110386367801170416c3dfd4ab85230dd1a59df6b32e79947e29625566a9bf
MD5 0bca50343dd4a80fd5e8f41822a9f597
SHA1 4f96e0f16b5a85fe0f0cb4a8fb736311ff437c8c
SHA512 f8324069d4ff8884fb3a4ecb37dc881de57639163930051644126fd73785118f3e37e9d5d023c83e3569bcceceb5cb4b162629ebb18235345999e2871d9ed670
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:SbBeSFk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

KfUizDY.exe

Path C:\Windows\System\KfUizDY.exe
Size 3.2MB
SHA256 f35cab540b7286ba56e361247f84b9ba15029203458b5e6de6fd79f0cedc0c43
MD5 8195b6fa064905d487bf932b10eed601
SHA1 1e56f00dc43429489a1708a20c199e1f90b083d4
SHA512 b64585ea10e5a7f139f4d2faefc2732b4e1b6da5c3ab0ad8ac20f09ab5c98f98bb31b2c187495bc3690686bf826e3524fb32fefa590a44ca6fa58c3339a8b0cf
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWd:SbBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

KhPeUdo.exe

Path C:\Windows\System\KhPeUdo.exe
Size 3.2MB
SHA256 5d89800a0a3aaeb74cf44f80351690e0462c4181399bbd3cdf205527c4f07815
MD5 a2b67a37bd9487c4e8e3af5276c2b66f
SHA1 8a8a48a1d76d00e6d95db0b051e48c5b5794ecc7
SHA512 a0df0e0dbcc1267f1ed98a9ba4f7c6a98b1b62afd1444d9c275cc100c6368fd096d231a54176f2b145fe4d9c9b42594d9afbf0268189f071778ac9b2a2142352
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:SbBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

LAopPWo.exe

Path C:\Windows\System\LAopPWo.exe
Size 3.2MB
SHA256 6a1de9f123aee392d5475c6c391081935d757a68e01f09b07cdf59a1a79333cf
MD5 6b05bc1c2a2b7049398e1f17a9a680d1
SHA1 d0cb29545dd08506059abb5b6ecbffa1443b169e
SHA512 baa88b494900879a0aa1eff5e9a38bb142a44913a708f8975bb7f0068d3c7f39fe7ac549ba48630b3284a283a323cdf0a0184149824ab83a284e2c3c26daa21b
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWd:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

PIQVGSr.exe

Path C:\Windows\System\PIQVGSr.exe
Size 3.2MB
SHA256 935bcdecdc40f0197e770b09693a4f863cf2d109d4187d6e9d4d2015a527a455
MD5 dec2cdd84a0cb501b650f35e7550f974
SHA1 f45f9533494a7b6dd8f34520959fa131d6e1b092
SHA512 f6bbe8b0e056e1fa4cf1b2cccbb560957adb0dca86fc529577579e8e35512c3d886f36d84b34aed95ab89fe10433b7e743140688e6fe21e19b72629a1a4c10c8
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:SbBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

PoFYRbP.exe

Path C:\Windows\System\PoFYRbP.exe
Size 3.2MB
SHA256 576d0cda4d29ba50022e7c05283fc6704a1e014ad231a9c0b8c42c355b9ffff3
MD5 a90f8542a511567aa56d03de9f294f52
SHA1 32a37dc5f74f5521a44a38135fb49bb54a54a764
SHA512 26bca7d2b3508f73e45bfe205824bd3bb6811000e70caafc3920f8f0c6acc6cf76da58bbc98c96e57b104650f081986efe93d51bc71c38ae68a6d593c1862a14
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:SbBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

QmyrbcT.exe

Path C:\Windows\System\QmyrbcT.exe
Size 3.2MB
SHA256 d9b41c9627c0b7fc138fe894297812c0e6c6fc65aa5b0c80a78580053835d18f
MD5 f7b8e2bf7d6a9091613f2172eab82957
SHA1 c15fb9ef7321c42e2156bf4fefe0215146398e9e
SHA512 a8b6739e7eb34d3dd23ae7aaab8031bc400735e7a7d1d48f7476d4f859a7cde3a20f19fc73c45e62ba9f5911f0aa8cb2428f670006a812ad1026266753f95387
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:SbBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SPtiRRD.exe

Path C:\Windows\System\SPtiRRD.exe
Size 3.2MB
SHA256 f5c12f7ee911c1284677d743d05fc7bb3ef7a5d89c6a56849f3d2e3fe28d8994
MD5 5c683f666ba1c4bfbe03eeac2aaa9774
SHA1 58fc9fc8b7d6fa0cb94e0cc697701ce53beab1a7
SHA512 c9df22789de14ddf4358f98f4925f7c7b598e71c09867c18a4b2f00b61f3080ae9c5433e3405ea299f9f6099b202f6f0cb24f1a6a6003631b512c7e9fb0a7f72
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWt:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TokbqYi.exe

Path C:\Windows\System\TokbqYi.exe
Size 3.2MB
SHA256 d1b3246a28900154e4224abdc0885f57b6fb93ff96a7b54259a72f7f35e53c17
MD5 aaf5a43135b4f1e89158245d377c32ea
SHA1 91564ba85dde064fd4605454e5a32c6c294edc1e
SHA512 080a76a5560ee3ab8c42b6f180209ba05ba2e128582d8a2c365cc377db97d6e6eb1d57d3ea56b509c2ca902c49cb00ade0028f07d12cdf946c79c9d6c2dcf364
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWt:SbBeSFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMHvrcN.exe

Path C:\Windows\System\VMHvrcN.exe
Size 3.2MB
SHA256 a26de7666178ef77476c91f7027736e873bd8011274d3f70d2d1621c87ee4db8
MD5 ef4f8aa5052730dbcfab2b24bc12fbab
SHA1 eb839bbe49e1d8339b0cfdf9f96e8f03d2604c10
SHA512 79f51d0d281a608337154c28021ff9edfc043a92e6f1bcb6d1cc5fa9f77619d2dd3d6dee6bcfc0dc9ce677b8dfc28d33edce2f094f43aa978774e58b1227c6c1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:SbBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VaHihBj.exe

Path C:\Windows\System\VaHihBj.exe
Size 3.2MB
SHA256 83899eec9f9e6eaf69bf868e0bc9f4ed7c0dc12c464ba64fb5ffe11d81ff0d34
MD5 a246fcc66596d3aa00df23c6dd38af37
SHA1 d0f34839e6befc83a8954256cf6a7e7afdbcbd2e
SHA512 89682e3f853eaf2a94744665c2793deb0eee9c5ac09ed9a7ce9eedc770104f0f50317d3fa3edad9cd46993a64daf99ad2fe8f6c08142a3c6cd6f608fb9d1cab8
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW9:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

XjUAhyk.exe

Path C:\Windows\System\XjUAhyk.exe
Size 3.2MB
SHA256 80f2b15987eef37086f6035f6889dafba1d1ca955420a6720ec15303d9260e23
MD5 a363f2212766e6dcfd846bd4e137b0cc
SHA1 3f8072157b23c6889731a186c3efd1c414de8d3f
SHA512 2e2b65a8693175f4ce7a0546faebe1be45755c237b0038388f911bc0113486ff80fb021c7a76f27c203e98c4b1ddb3a14a4e71cb2867c401d6466f9263725930
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

XuqyCem.exe

Path C:\Windows\System\XuqyCem.exe
Size 3.2MB
SHA256 038ea1ffeaf788a273de18ac5877fb7f9850100415014c959a28b9b6eb312666
MD5 9a87b848774607a4697e7d7923b6217f
SHA1 be02764a09c9f79a52704b6fb6c8a6b5ba6af172
SHA512 f5bead7a8bbabf7f4c93e080677a1158aba3052c5357781e6e64c472263408ebed98ea99bbc2750adb76900e0d04658aa7c66f613bc613227a07049e800b5d82
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:SbBeSFkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZYGKzo.exe

Path C:\Windows\System\ZZYGKzo.exe
Size 3.2MB
SHA256 eddbf79a55576489ecd0385d1f98a4db371640ccd7e2ba65c749023d83d58ba5
MD5 b4fe1c51bfc8f7620cf2de7621ab4c89
SHA1 b7dbba6472900c09baf526556885ce90a5fb84f3
SHA512 0ff9090b6945e6a2df2e30a8254a572be29399f3ffcc70b00ee745f2947e10c6a085f164b2956470ced20fc6b6546fc3f3f035cba514ce9249f5f8d073655f69
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:SbBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

bipOfRD.exe

Path C:\Windows\System\bipOfRD.exe
Size 3.2MB
SHA256 b328ef3de6611ca4463a186727663f205e2bf452458114e9650a623474ed9471
MD5 60e5370854a55ea9fa126cb10e069c57
SHA1 59badf2468de9bba31f0eebd8255f34b936340a9
SHA512 fa78ba44cd31a54b2310c23bd0870d72f27d3e63ad22d9fde574fb747fd67d3ef01932047ae1aa19aa84d8302b7e0b8f6c597724473c1eaabab34ec158aa1251
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:SbBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cGKkhUy.exe

Path C:\Windows\System\cGKkhUy.exe
Size 3.2MB
SHA256 06645d7288d89bedda5702e2a45c4e7af13045f2946dc04f4ed03ea12bc39661
MD5 5b0f7a81f3209f0d328c075155dfa78b
SHA1 d7f74472bfb6186f3750e6c42c09e4077408f680
SHA512 fa542ba4e451d659b07183d871bb1995a0fd47984d4e9c8c54feecd9de3e418fd66099d53a00e3948ac5f17105c579d30b3021d1d65df8095ce267e421a46ce7
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:SbBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dGBjSSJ.exe

Path C:\Windows\System\dGBjSSJ.exe
Size 3.2MB
SHA256 d4b787fdeea68cdf9640fcd5280f6cb4cff11ada9c44f5cbe505b96375338578
MD5 febe476e04d8c08ef418e46f5d6350e6
SHA1 428dde011a7d563be3403a79a2bae84d37407690
SHA512 87bd86534cdc00ab329b0458143aad227de88d66d74d966cab4f075415645c744382ff95640c2b3a7de1a260cb757082ae405fe6e72cb280b9d1bae4f3d5c0bc
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:SbBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

dRSujmB.exe

Path C:\Windows\System\dRSujmB.exe
Size 3.2MB
SHA256 f6cc700871bf0b84f1578f4bae660208e7699ab33331185db12f0a0e9bdb0a2d
MD5 a8acc50ad3b0b84c4c753c71b472a0b9
SHA1 7ad80606a67170cde54c08c5848cb65a80f685c3
SHA512 65ae160b2f092568ce7ebaa171c39d7e8063e57090db44e5fc511b1d39d63b23087049364a7be282f68ca8709098b2bc726af53cc55f2a093d60aed530745e75
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:SbBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

gTFOgAO.exe

Path C:\Windows\System\gTFOgAO.exe
Size 3.2MB
SHA256 e83b99bd13f5817b0a0dde486a8a4952092f51f676051fed47327ef8532965da
MD5 c74507b235c124865e477c3ce9d20af2
SHA1 e4be90c0121917fea431611d1dae690a70d8c0e4
SHA512 4488d3fd3c12e65635eadde25d4d70411ddf6ff27931df03bd12a57652b77d3ae1525c148f721cc832f2503da34374578c03cdcf16c11e40e4fcbc455645e2ef
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:SbBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ikPnvyI.exe

Path C:\Windows\System\ikPnvyI.exe
Size 3.2MB
SHA256 83bf41ae8cf4e6712e22ad87553f5f604563ed1df4cb6d74472a3de850ea095c
MD5 cedb0f02580c9abe05341be05f407405
SHA1 2b987e5c6a0a8bc2a1bea5a33f4314b885ce2cfc
SHA512 98e45c4334a2a3fab123b5f23ff0615bb4a5b27f6363414d707cf192b8e33977f87ef817d6dcb831f812b27253f829d2579135e497fcd055c0350f820ced1ff5
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW9:SbBeSFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

iuMTjbw.exe

Path C:\Windows\System\iuMTjbw.exe
Size 3.2MB
SHA256 6d51155d91d0ef2ce0ae719eac762d2aaab8eff52f2c412ec2f8a95331a8bf8b
MD5 ab4030c6ea81c840e07cc56624ee36cd
SHA1 97d5f6a7e3fccf652a612be763d180d63a2e784c
SHA512 e2840ed6da098db704b0bf5e09be44ba2555d79b9d86e6cb7f2a66c4dd0c8e5385615f42798192fb91ffb90ee762e9a8249c22e48b976d53d1d38368802bab31
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:SbBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwdYOkS.exe

Path C:\Windows\System\nwdYOkS.exe
Size 3.2MB
SHA256 b4c4186c181ffe7ce0647fc449c9e30ebd3f1586b46ced17d9b7957a10b49a56
MD5 3da4621020e8bd73ad7d65ea39be0d38
SHA1 abfa1283cac76e625ec999ff9cf8b8c1c54d7888
SHA512 3185ada3d74910bbae20553be724ffdda30fe72e45b67d3ceeb440b1306d95b4aa85de1dd60bfbc5603ae75bb0236a588c3a96bbd67a320381ba4cbfc60544d0
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:SbBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

oBPIZaN.exe

Path C:\Windows\System\oBPIZaN.exe
Size 3.2MB
SHA256 245c305c744d1561ccf49db269818fe3b5d0b2e70042abfaed0a73f15dcae71f
MD5 a698bd38322a0b60853f9fcd4e42eba3
SHA1 9aae75b25f9d77b4df00f0504c28f90948226cd3
SHA512 014a8ceba475b0e5a8fe2398694f0616ba83e85346c968b552ef4e363c94b6a0461b74a3a1cb52e095a26668616fca7d3dc40c357be3aedaca35e4e53b67ab65
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWd:SbBeSFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

okkzamU.exe

Path C:\Windows\System\okkzamU.exe
Size 3.2MB
SHA256 4d323dfdbc92f04da06f516ecad45e380b4e9d0c75cfbc20bb423b3b903e7ec6
MD5 824be9c8371c39918c61091bb7d3935f
SHA1 fc7e2d5c214c091746ad093b1d5b368aaa19511f
SHA512 edb1e1b35bc01e9c4bd56ea4639ba14cb7013ff278127af9767f49fa3614f3e88122ca3e0410e42d66d5620a1f6f1eb032f7da37fa1682dfd1aa0ab662b56ddc
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:SbBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

phVjBKz.exe

Path C:\Windows\System\phVjBKz.exe
Size 3.2MB
SHA256 58f994271195cbd602fc6b79fb1a9f40aaa2f02f983d95fb33f60d7123937ac5
MD5 5e7790a1896b8bc992c7dfeb6913132b
SHA1 596b96f4ac1a81dcb3526e874d7bb435c0741d99
SHA512 9608b2268796a72eddffbf0999fe5182611c81028e8b5c6f6497ae3242fac0377610d7182cd987e0eb32104c32031f99ef707b399c835485ad885bd9a80ee668
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWL:SbBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkcnFNh.exe

Path C:\Windows\System\tkcnFNh.exe
Size 3.2MB
SHA256 c19848e2ec1c09138b7fb2604be420ab93b2b6721583c79d34adb869840d8fe7
MD5 ec3650a7e4fcccd8df0b3565f3e9303b
SHA1 cb698875b5f555918380c02a9201cb9ab4e1a537
SHA512 2c4f37406424dc21f3eeb430cdc9bf0428bf0e3e7e149045c32330e8270cab0106768ea87727cba1568370194705dd71754d6dcfdc8c3caa16eec6a85ef809b8
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

uJxWETo.exe

Path C:\Windows\System\uJxWETo.exe
Size 3.2MB
SHA256 1eb04a06d07e5b579fcc32143319725843acd6ff7eac97c2509ec6cf84fab89b
MD5 4a418b0b7796cd4e1b5f340701b7b2a5
SHA1 eab3a6c792dd18a026e55a714e0879b9cca39343
SHA512 031c0e69576c9ffbb0f763abd507c55d36447a6564f3a9ea68d9e24228723b726aace84b48ee7493e5b3076e72b68786414934aab427cd9c4a1edb005d8993f0
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:SbBeSFkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wRDOzLZ.exe

Path C:\Windows\System\wRDOzLZ.exe
Size 3.2MB
SHA256 b5914de856c600e1fde2c06ec8a006c32bcf4b3bbc8a3274c60098d1a649f686
MD5 c92085ee6e4d5b9711145503edf11147
SHA1 7d7dc1662c735f6fb88a8fd166652878a17770d5
SHA512 6cac9c74eda17d4071a7741e48b568104f26bbf9be21582cd83ac170300ef560af613dd73e0ada9782e72dbfe189125cd5f1a641abc25423c2547c536b9f72d6
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:SbBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wdQiOPQ.exe

Path C:\Windows\System\wdQiOPQ.exe
Size 3.2MB
SHA256 5f26e10ade665fd56aaa047e7512929372811a60c3f8d784f45bcf80cfbbda68
MD5 81e2c01632eb9af53b54f7278c95aeed
SHA1 82806378ddc6940b8c9f28a245d86393aca3b9eb
SHA512 1d4c6c2e7e9a61d3d24b08f17cd4048f21300c419c01fe365a73e2b167818a74c11624c995cb91cd72452bd58c363d9cee176a1d87044dde65a98bc88bc65267
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:SbBeSFkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-2201-0x00007FF603B10000-0x00007FF603F06000-memory.dmp

Download

memory/512-62-0x00007FF603B10000-0x00007FF603F06000-memory.dmp

Download

memory/512-2193-0x00007FF603B10000-0x00007FF603F06000-memory.dmp

Download

memory/568-1-0x00000143F6360000-0x00000143F6370000-memory.dmp

Download

memory/568-0-0x00007FF6D9DC0000-0x00007FF6DA1B6000-memory.dmp

Download

memory/1184-116-0x00007FF602180000-0x00007FF602576000-memory.dmp

Download

memory/1184-2205-0x00007FF602180000-0x00007FF602576000-memory.dmp

Download

memory/1444-171-0x00007FF6FF2A0000-0x00007FF6FF696000-memory.dmp

Download

memory/1444-2212-0x00007FF6FF2A0000-0x00007FF6FF696000-memory.dmp

Download

memory/1636-2197-0x00007FF63F020000-0x00007FF63F416000-memory.dmp

Download

memory/1636-21-0x00007FF63F020000-0x00007FF63F416000-memory.dmp

Download

memory/1752-174-0x00007FF71C500000-0x00007FF71C8F6000-memory.dmp

Download

memory/1752-2207-0x00007FF71C500000-0x00007FF71C8F6000-memory.dmp

Download

memory/1840-172-0x00007FF6039C0000-0x00007FF603DB6000-memory.dmp

Download

memory/1840-2209-0x00007FF6039C0000-0x00007FF603DB6000-memory.dmp

Download

memory/1880-2216-0x00007FF641DB0000-0x00007FF6421A6000-memory.dmp

Download

memory/1880-131-0x00007FF641DB0000-0x00007FF6421A6000-memory.dmp

Download

memory/2308-2204-0x00007FF792B10000-0x00007FF792F06000-memory.dmp

Download

memory/2308-76-0x00007FF792B10000-0x00007FF792F06000-memory.dmp

Download

memory/2436-2218-0x00007FF78A470000-0x00007FF78A866000-memory.dmp

Download

memory/2436-158-0x00007FF78A470000-0x00007FF78A866000-memory.dmp

Download

memory/2536-2215-0x00007FF6EC6F0000-0x00007FF6ECAE6000-memory.dmp

Download

memory/2536-140-0x00007FF6EC6F0000-0x00007FF6ECAE6000-memory.dmp

Download

memory/2540-191-0x00007FF639520000-0x00007FF639916000-memory.dmp

Download

memory/2540-2219-0x00007FF639520000-0x00007FF639916000-memory.dmp

Download

memory/2560-176-0x00007FF6628C0000-0x00007FF662CB6000-memory.dmp

Download

memory/2560-2200-0x00007FF6628C0000-0x00007FF662CB6000-memory.dmp

Download

memory/2816-28-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp

Download

memory/2816-2192-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp

Download

memory/2816-2199-0x00007FF77EEF0000-0x00007FF77F2E6000-memory.dmp

Download

memory/3008-102-0x00007FF694930000-0x00007FF694D26000-memory.dmp

Download

memory/3008-2206-0x00007FF694930000-0x00007FF694D26000-memory.dmp

Download

memory/3160-193-0x00007FF6F9970000-0x00007FF6F9D66000-memory.dmp

Download

memory/3160-2210-0x00007FF6F9970000-0x00007FF6F9D66000-memory.dmp

Download

memory/3288-2220-0x00007FF6B9E10000-0x00007FF6BA206000-memory.dmp

Download

memory/3288-194-0x00007FF6B9E10000-0x00007FF6BA206000-memory.dmp

Download

memory/3364-175-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmp

Download

memory/3364-2196-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Download

memory/3364-145-0x000001AA340D0000-0x000001AA340F2000-memory.dmp

Download

memory/3364-189-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Download

memory/3364-2195-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmp

Download

memory/3364-195-0x000001AA34D10000-0x000001AA354B6000-memory.dmp

Download

memory/3364-23-0x000001AA1B860000-0x000001AA1B870000-memory.dmp

Download

memory/3508-117-0x00007FF712C20000-0x00007FF713016000-memory.dmp

Download

memory/3508-2217-0x00007FF712C20000-0x00007FF713016000-memory.dmp

Download

memory/3612-2202-0x00007FF652F10000-0x00007FF653306000-memory.dmp

Download

memory/3612-42-0x00007FF652F10000-0x00007FF653306000-memory.dmp

Download

memory/3612-2194-0x00007FF652F10000-0x00007FF653306000-memory.dmp

Download

memory/4380-2203-0x00007FF7CC110000-0x00007FF7CC506000-memory.dmp

Download

memory/4380-190-0x00007FF7CC110000-0x00007FF7CC506000-memory.dmp

Download

memory/4500-2211-0x00007FF7C2710000-0x00007FF7C2B06000-memory.dmp

Download

memory/4500-151-0x00007FF7C2710000-0x00007FF7C2B06000-memory.dmp

Download

memory/4924-2198-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp

Download

memory/4924-2191-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp

Download

memory/4924-14-0x00007FF61E100000-0x00007FF61E4F6000-memory.dmp

Download

memory/5024-2213-0x00007FF7E2A40000-0x00007FF7E2E36000-memory.dmp

Download

memory/5024-192-0x00007FF7E2A40000-0x00007FF7E2E36000-memory.dmp

Download

memory/5048-173-0x00007FF6B6500000-0x00007FF6B68F6000-memory.dmp

Download

memory/5048-2208-0x00007FF6B6500000-0x00007FF6B68F6000-memory.dmp

Download

memory/5076-2214-0x00007FF6C51C0000-0x00007FF6C55B6000-memory.dmp

Download

memory/5076-150-0x00007FF6C51C0000-0x00007FF6C55B6000-memory.dmp

Download