xmrig | afd9395e08f27d38df026a6d5ddebf6f97b417f70882c48467b6bdd6f1def2d5

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
Size 2.9MB
Sample240522-z7b8kshc47
SHA256 afd9395e08f27d38df026a6d5ddebf6f97b417f70882c48467b6bdd6f1def2d5
MD5 3e9631f7229f312d36bb6c94688a3d80
SHA1 0e7a96793aa06e77bbb2fcdbb13dd0dc3105addf
SHA512 cda751b63b1ffa85b65da6044fd99ff8abd0e5c61dcf223619d62587bcdc784c8c8b0d50a51d67c48a9479f84bfa3cfbfd59f2b41dd2ac10e0503a5bfddf9123
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVx:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3836-0-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023437-6.dat	xmrig
behavioral2/files/0x000700000002343b-9.dat	xmrig
behavioral2/files/0x000700000002343c-12.dat	xmrig
behavioral2/files/0x0007000000023444-52.dat	xmrig
behavioral2/files/0x0008000000023441-62.dat	xmrig
behavioral2/files/0x0007000000023443-72.dat	xmrig
behavioral2/files/0x0007000000023447-82.dat	xmrig
behavioral2/files/0x0007000000023446-92.dat	xmrig
behavioral2/files/0x0007000000023449-106.dat	xmrig
behavioral2/files/0x000700000002344c-112.dat	xmrig
behavioral2/files/0x000700000002344d-125.dat	xmrig
behavioral2/memory/4148-138-0x00007FF6DD630000-0x00007FF6DDA26000-memory.dmp	xmrig
behavioral2/files/0x0007000000023451-148.dat	xmrig
behavioral2/files/0x0007000000023452-152.dat	xmrig
behavioral2/files/0x0007000000023453-157.dat	xmrig
behavioral2/files/0x0007000000023457-174.dat	xmrig
behavioral2/files/0x000700000002345c-191.dat	xmrig
behavioral2/memory/4172-200-0x00007FF7A8670000-0x00007FF7A8A66000-memory.dmp	xmrig
behavioral2/memory/4952-203-0x00007FF688770000-0x00007FF688B66000-memory.dmp	xmrig
behavioral2/memory/3908-208-0x00007FF6ED940000-0x00007FF6EDD36000-memory.dmp	xmrig
behavioral2/memory/2112-211-0x00007FF76D920000-0x00007FF76DD16000-memory.dmp	xmrig
behavioral2/memory/1080-210-0x00007FF6E96C0000-0x00007FF6E9AB6000-memory.dmp	xmrig
behavioral2/memory/1300-209-0x00007FF6D7890000-0x00007FF6D7C86000-memory.dmp	xmrig
behavioral2/memory/5064-207-0x00007FF7C7280000-0x00007FF7C7676000-memory.dmp	xmrig
behavioral2/memory/1420-206-0x00007FF7ADC20000-0x00007FF7AE016000-memory.dmp	xmrig
behavioral2/memory/392-205-0x00007FF6B4400000-0x00007FF6B47F6000-memory.dmp	xmrig
behavioral2/memory/3100-204-0x00007FF602DF0000-0x00007FF6031E6000-memory.dmp	xmrig
behavioral2/memory/4164-202-0x00007FF7EBFA0000-0x00007FF7EC396000-memory.dmp	xmrig
behavioral2/memory/4360-195-0x00007FF6111D0000-0x00007FF6115C6000-memory.dmp	xmrig
behavioral2/memory/1516-190-0x00007FF606DD0000-0x00007FF6071C6000-memory.dmp	xmrig
behavioral2/memory/1108-189-0x00007FF79A590000-0x00007FF79A986000-memory.dmp	xmrig
behavioral2/files/0x000700000002345b-188.dat	xmrig
behavioral2/files/0x000700000002345a-187.dat	xmrig
behavioral2/files/0x0007000000023459-186.dat	xmrig
behavioral2/files/0x0007000000023458-185.dat	xmrig
behavioral2/files/0x0007000000023455-181.dat	xmrig
behavioral2/files/0x0007000000023454-179.dat	xmrig
behavioral2/memory/3656-164-0x00007FF71B7B0000-0x00007FF71BBA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023456-169.dat	xmrig
behavioral2/memory/3212-155-0x00007FF7B72A0000-0x00007FF7B7696000-memory.dmp	xmrig
behavioral2/memory/396-151-0x00007FF7FE120000-0x00007FF7FE516000-memory.dmp	xmrig
behavioral2/memory/384-150-0x00007FF619850000-0x00007FF619C46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023450-146.dat	xmrig
behavioral2/memory/4380-143-0x00007FF7DFBD0000-0x00007FF7DFFC6000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-141.dat	xmrig
behavioral2/memory/3352-139-0x00007FF62D1F0000-0x00007FF62D5E6000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-144.dat	xmrig
behavioral2/files/0x0008000000023438-134.dat	xmrig
behavioral2/files/0x000700000002344b-110.dat	xmrig
behavioral2/files/0x000700000002344a-108.dat	xmrig
behavioral2/files/0x0007000000023448-102.dat	xmrig
behavioral2/memory/3884-99-0x00007FF6863A0000-0x00007FF686796000-memory.dmp	xmrig
behavioral2/memory/2652-87-0x00007FF6ADFD0000-0x00007FF6AE3C6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023440-80.dat	xmrig
behavioral2/memory/4084-77-0x00007FF603FF0000-0x00007FF6043E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-78.dat	xmrig
behavioral2/files/0x000700000002343f-68.dat	xmrig
behavioral2/files/0x0007000000023442-60.dat	xmrig
behavioral2/files/0x000700000002343e-56.dat	xmrig
behavioral2/files/0x000700000002343d-24.dat	xmrig
behavioral2/memory/2652-2236-0x00007FF6ADFD0000-0x00007FF6AE3C6000-memory.dmp	xmrig
behavioral2/memory/1420-2237-0x00007FF7ADC20000-0x00007FF7AE016000-memory.dmp	xmrig
behavioral2/memory/4084-2238-0x00007FF603FF0000-0x00007FF6043E6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
10	4464	powershell.exe
12	4464	powershell.exe
14	4464	powershell.exe
15	4464	powershell.exe
17	4464	powershell.exe
24	4464	powershell.exe
25	4464	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4464	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1420	AnfHbgG.exe
4084	owsTsek.exe
2652	eXogIyX.exe
3884	mCNwbnq.exe
4148	zoUXHGE.exe
5064	PsTqftB.exe
3352	fHAoOSG.exe
4380	LfHGfqB.exe
384	JgTbNdc.exe
396	GujXmeB.exe
3908	EtFmAcE.exe
3212	QoMimGa.exe
3656	pCPQzdl.exe
1300	wxCpkpj.exe
1080	GQckUAj.exe
1108	FfrtHjS.exe
1516	CeemIxU.exe
2112	twBhife.exe
4360	sXmCKGJ.exe
4172	BxqKKjn.exe
4164	iDYIyrC.exe
4952	lkrNRcv.exe
3100	MbcGyDC.exe
392	HUagQUk.exe
1936	NdEjRIZ.exe
3228	wPEjBHG.exe
2872	Ylydjqo.exe
2184	FgPswQg.exe
3760	yrmfvbe.exe
4972	yMEECiQ.exe
1444	UjIBrcH.exe
2492	JGnUHnm.exe
4432	sjWpTAq.exe
972	xDaBvJd.exe
408	rRfBZuB.exe
3372	YYDrhEA.exe
5096	bsujjfH.exe
3620	CQjGAsF.exe
4276	eUPoQiD.exe
2040	ccFKPOh.exe
4140	hDBPigV.exe
4272	VzLcBEM.exe
448	UzlVdGz.exe
2320	KOXCViW.exe
3440	yYftVVC.exe
2352	ZTOLzJI.exe
4604	gCrppZa.exe
1412	AAgDeVs.exe
1956	kAGLSmM.exe
980	JFSYXbF.exe
3996	VHOFmHS.exe
1848	ayreXaa.exe
4864	JQbBOgN.exe
2292	TipIUwj.exe
2812	nfrOFFx.exe
5060	KqAsbVL.exe
1380	YNMJoSy.exe
4992	MszExGN.exe
3604	wGlbRCV.exe
2072	NKdSxoQ.exe
3380	ZbzMgRZ.exe
1016	MRpCmAM.exe
5052	oDFNSCe.exe
4280	yohaepY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3836-0-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp	upx
behavioral2/files/0x0008000000023437-6.dat	upx
behavioral2/files/0x000700000002343b-9.dat	upx
behavioral2/files/0x000700000002343c-12.dat	upx
behavioral2/files/0x0007000000023444-52.dat	upx
behavioral2/files/0x0008000000023441-62.dat	upx
behavioral2/files/0x0007000000023443-72.dat	upx
behavioral2/files/0x0007000000023447-82.dat	upx
behavioral2/files/0x0007000000023446-92.dat	upx
behavioral2/files/0x0007000000023449-106.dat	upx
behavioral2/files/0x000700000002344c-112.dat	upx
behavioral2/files/0x000700000002344d-125.dat	upx
behavioral2/memory/4148-138-0x00007FF6DD630000-0x00007FF6DDA26000-memory.dmp	upx
behavioral2/files/0x0007000000023451-148.dat	upx
behavioral2/files/0x0007000000023452-152.dat	upx
behavioral2/files/0x0007000000023453-157.dat	upx
behavioral2/files/0x0007000000023457-174.dat	upx
behavioral2/files/0x000700000002345c-191.dat	upx
behavioral2/memory/4172-200-0x00007FF7A8670000-0x00007FF7A8A66000-memory.dmp	upx
behavioral2/memory/4952-203-0x00007FF688770000-0x00007FF688B66000-memory.dmp	upx
behavioral2/memory/3908-208-0x00007FF6ED940000-0x00007FF6EDD36000-memory.dmp	upx
behavioral2/memory/2112-211-0x00007FF76D920000-0x00007FF76DD16000-memory.dmp	upx
behavioral2/memory/1080-210-0x00007FF6E96C0000-0x00007FF6E9AB6000-memory.dmp	upx
behavioral2/memory/1300-209-0x00007FF6D7890000-0x00007FF6D7C86000-memory.dmp	upx
behavioral2/memory/5064-207-0x00007FF7C7280000-0x00007FF7C7676000-memory.dmp	upx
behavioral2/memory/1420-206-0x00007FF7ADC20000-0x00007FF7AE016000-memory.dmp	upx
behavioral2/memory/392-205-0x00007FF6B4400000-0x00007FF6B47F6000-memory.dmp	upx
behavioral2/memory/3100-204-0x00007FF602DF0000-0x00007FF6031E6000-memory.dmp	upx
behavioral2/memory/4164-202-0x00007FF7EBFA0000-0x00007FF7EC396000-memory.dmp	upx
behavioral2/memory/4360-195-0x00007FF6111D0000-0x00007FF6115C6000-memory.dmp	upx
behavioral2/memory/1516-190-0x00007FF606DD0000-0x00007FF6071C6000-memory.dmp	upx
behavioral2/memory/1108-189-0x00007FF79A590000-0x00007FF79A986000-memory.dmp	upx
behavioral2/files/0x000700000002345b-188.dat	upx
behavioral2/files/0x000700000002345a-187.dat	upx
behavioral2/files/0x0007000000023459-186.dat	upx
behavioral2/files/0x0007000000023458-185.dat	upx
behavioral2/files/0x0007000000023455-181.dat	upx
behavioral2/files/0x0007000000023454-179.dat	upx
behavioral2/memory/3656-164-0x00007FF71B7B0000-0x00007FF71BBA6000-memory.dmp	upx
behavioral2/files/0x0007000000023456-169.dat	upx
behavioral2/memory/3212-155-0x00007FF7B72A0000-0x00007FF7B7696000-memory.dmp	upx
behavioral2/memory/396-151-0x00007FF7FE120000-0x00007FF7FE516000-memory.dmp	upx
behavioral2/memory/384-150-0x00007FF619850000-0x00007FF619C46000-memory.dmp	upx
behavioral2/files/0x0007000000023450-146.dat	upx
behavioral2/memory/4380-143-0x00007FF7DFBD0000-0x00007FF7DFFC6000-memory.dmp	upx
behavioral2/files/0x000700000002344e-141.dat	upx
behavioral2/memory/3352-139-0x00007FF62D1F0000-0x00007FF62D5E6000-memory.dmp	upx
behavioral2/files/0x000700000002344f-144.dat	upx
behavioral2/files/0x0008000000023438-134.dat	upx
behavioral2/files/0x000700000002344b-110.dat	upx
behavioral2/files/0x000700000002344a-108.dat	upx
behavioral2/files/0x0007000000023448-102.dat	upx
behavioral2/memory/3884-99-0x00007FF6863A0000-0x00007FF686796000-memory.dmp	upx
behavioral2/memory/2652-87-0x00007FF6ADFD0000-0x00007FF6AE3C6000-memory.dmp	upx
behavioral2/files/0x0008000000023440-80.dat	upx
behavioral2/memory/4084-77-0x00007FF603FF0000-0x00007FF6043E6000-memory.dmp	upx
behavioral2/files/0x0007000000023445-78.dat	upx
behavioral2/files/0x000700000002343f-68.dat	upx
behavioral2/files/0x0007000000023442-60.dat	upx
behavioral2/files/0x000700000002343e-56.dat	upx
behavioral2/files/0x000700000002343d-24.dat	upx
behavioral2/memory/2652-2236-0x00007FF6ADFD0000-0x00007FF6AE3C6000-memory.dmp	upx
behavioral2/memory/1420-2237-0x00007FF7ADC20000-0x00007FF7AE016000-memory.dmp	upx
behavioral2/memory/4084-2238-0x00007FF603FF0000-0x00007FF6043E6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eAVUvRx.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\lFZFODD.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\wXYAmYF.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\rDlsogt.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\KUNesOH.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\dQmBoZs.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\ymDGqzm.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\spUQZIp.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\uVMYGBc.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\WfIhvwN.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\KaEKpZW.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\YmLwkha.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\TdnBXaH.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\lTbpFIA.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\zoExuOH.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\rEuWOWx.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\sjWpTAq.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\zIyArSa.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\KtLmzjG.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\yDcEXTq.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\icoNetS.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\vBzGNPl.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\OTyoZim.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\avRMcOH.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\KScHVbv.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\TaHUosX.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\kzqKqBt.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\ZfRuGiJ.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\EDLjgvP.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\GZbcCku.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\qTbMQiN.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\RIuwUDr.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\WaSQnEH.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\SbhEvpc.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\hPZuMJe.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\kfaLwlN.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\BPeppTZ.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\WnjQHHl.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\wxCpkpj.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\JpupTHE.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\WpvyRsz.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\vjJNtQq.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\MkldbCe.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\ziWJxMQ.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\SUZmIfr.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\KFCcvoh.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\mcCPVfS.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\OxBlfKs.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\VUjdxis.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\OIxHmyV.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\TeRinFS.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\eeokekl.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\bCCnXgv.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\NzofFcZ.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\xBVryRT.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\jyaZxqN.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\CMQJTCf.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\sngkMCf.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\ebvSnss.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\WmItKti.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\NuSDExT.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\GHrvrIe.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\DqTgCCv.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
File created	C:\Windows\System\fmGKzHM.exe	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4464	powershell.exe
4464	powershell.exe
4464	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
Token: SeDebugPrivilege	4464	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 4464	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	84
PID 3836 wrote to memory of 4464	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	84
PID 3836 wrote to memory of 1420	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	85
PID 3836 wrote to memory of 1420	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	85
PID 3836 wrote to memory of 4084	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	86
PID 3836 wrote to memory of 4084	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	86
PID 3836 wrote to memory of 2652	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	87
PID 3836 wrote to memory of 2652	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	87
PID 3836 wrote to memory of 3884	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	88
PID 3836 wrote to memory of 3884	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	88
PID 3836 wrote to memory of 4148	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	89
PID 3836 wrote to memory of 4148	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	89
PID 3836 wrote to memory of 5064	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	90
PID 3836 wrote to memory of 5064	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	90
PID 3836 wrote to memory of 3352	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	91
PID 3836 wrote to memory of 3352	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	91
PID 3836 wrote to memory of 4380	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	92
PID 3836 wrote to memory of 4380	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	92
PID 3836 wrote to memory of 384	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	93
PID 3836 wrote to memory of 384	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	93
PID 3836 wrote to memory of 3908	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	94
PID 3836 wrote to memory of 3908	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	94
PID 3836 wrote to memory of 396	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	95
PID 3836 wrote to memory of 396	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	95
PID 3836 wrote to memory of 3212	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	96
PID 3836 wrote to memory of 3212	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	96
PID 3836 wrote to memory of 3656	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	97
PID 3836 wrote to memory of 3656	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	97
PID 3836 wrote to memory of 1300	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	98
PID 3836 wrote to memory of 1300	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	98
PID 3836 wrote to memory of 1080	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	99
PID 3836 wrote to memory of 1080	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	99
PID 3836 wrote to memory of 1108	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	100
PID 3836 wrote to memory of 1108	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	100
PID 3836 wrote to memory of 1516	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	101
PID 3836 wrote to memory of 1516	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	101
PID 3836 wrote to memory of 2112	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	102
PID 3836 wrote to memory of 2112	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	102
PID 3836 wrote to memory of 4360	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	103
PID 3836 wrote to memory of 4360	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	103
PID 3836 wrote to memory of 4172	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	104
PID 3836 wrote to memory of 4172	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	104
PID 3836 wrote to memory of 4164	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	105
PID 3836 wrote to memory of 4164	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	105
PID 3836 wrote to memory of 4952	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	106
PID 3836 wrote to memory of 4952	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	106
PID 3836 wrote to memory of 3100	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	107
PID 3836 wrote to memory of 3100	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	107
PID 3836 wrote to memory of 392	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	108
PID 3836 wrote to memory of 392	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	108
PID 3836 wrote to memory of 1936	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	109
PID 3836 wrote to memory of 1936	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	109
PID 3836 wrote to memory of 3228	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	110
PID 3836 wrote to memory of 3228	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	110
PID 3836 wrote to memory of 2872	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	111
PID 3836 wrote to memory of 2872	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	111
PID 3836 wrote to memory of 2184	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	112
PID 3836 wrote to memory of 2184	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	112
PID 3836 wrote to memory of 3760	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	113
PID 3836 wrote to memory of 3760	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	113
PID 3836 wrote to memory of 4972	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	114
PID 3836 wrote to memory of 4972	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	114
PID 3836 wrote to memory of 1444	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	115
PID 3836 wrote to memory of 1444	3836	3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3e9631f7229f312d36bb6c94688a3d80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System\AnfHbgG.exe
  C:\Windows\System\AnfHbgG.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\owsTsek.exe
  C:\Windows\System\owsTsek.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\eXogIyX.exe
  C:\Windows\System\eXogIyX.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\mCNwbnq.exe
  C:\Windows\System\mCNwbnq.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\zoUXHGE.exe
  C:\Windows\System\zoUXHGE.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\PsTqftB.exe
  C:\Windows\System\PsTqftB.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\fHAoOSG.exe
  C:\Windows\System\fHAoOSG.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\LfHGfqB.exe
  C:\Windows\System\LfHGfqB.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\JgTbNdc.exe
  C:\Windows\System\JgTbNdc.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\EtFmAcE.exe
  C:\Windows\System\EtFmAcE.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\GujXmeB.exe
  C:\Windows\System\GujXmeB.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\QoMimGa.exe
  C:\Windows\System\QoMimGa.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\pCPQzdl.exe
  C:\Windows\System\pCPQzdl.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\wxCpkpj.exe
  C:\Windows\System\wxCpkpj.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\GQckUAj.exe
  C:\Windows\System\GQckUAj.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\FfrtHjS.exe
  C:\Windows\System\FfrtHjS.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\CeemIxU.exe
  C:\Windows\System\CeemIxU.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\twBhife.exe
  C:\Windows\System\twBhife.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\sXmCKGJ.exe
  C:\Windows\System\sXmCKGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\BxqKKjn.exe
  C:\Windows\System\BxqKKjn.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\iDYIyrC.exe
  C:\Windows\System\iDYIyrC.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\lkrNRcv.exe
  C:\Windows\System\lkrNRcv.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\MbcGyDC.exe
  C:\Windows\System\MbcGyDC.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\HUagQUk.exe
  C:\Windows\System\HUagQUk.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\NdEjRIZ.exe
  C:\Windows\System\NdEjRIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\wPEjBHG.exe
  C:\Windows\System\wPEjBHG.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\Ylydjqo.exe
  C:\Windows\System\Ylydjqo.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\FgPswQg.exe
  C:\Windows\System\FgPswQg.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\yrmfvbe.exe
  C:\Windows\System\yrmfvbe.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\yMEECiQ.exe
  C:\Windows\System\yMEECiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\UjIBrcH.exe
  C:\Windows\System\UjIBrcH.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\JGnUHnm.exe
  C:\Windows\System\JGnUHnm.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\sjWpTAq.exe
  C:\Windows\System\sjWpTAq.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\xDaBvJd.exe
  C:\Windows\System\xDaBvJd.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\rRfBZuB.exe
  C:\Windows\System\rRfBZuB.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\YYDrhEA.exe
  C:\Windows\System\YYDrhEA.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\bsujjfH.exe
  C:\Windows\System\bsujjfH.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\CQjGAsF.exe
  C:\Windows\System\CQjGAsF.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\eUPoQiD.exe
  C:\Windows\System\eUPoQiD.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\ccFKPOh.exe
  C:\Windows\System\ccFKPOh.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\hDBPigV.exe
  C:\Windows\System\hDBPigV.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\VzLcBEM.exe
  C:\Windows\System\VzLcBEM.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\UzlVdGz.exe
  C:\Windows\System\UzlVdGz.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\KOXCViW.exe
  C:\Windows\System\KOXCViW.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\yYftVVC.exe
  C:\Windows\System\yYftVVC.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\ZTOLzJI.exe
  C:\Windows\System\ZTOLzJI.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\gCrppZa.exe
  C:\Windows\System\gCrppZa.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\AAgDeVs.exe
  C:\Windows\System\AAgDeVs.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\kAGLSmM.exe
  C:\Windows\System\kAGLSmM.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\JFSYXbF.exe
  C:\Windows\System\JFSYXbF.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\VHOFmHS.exe
  C:\Windows\System\VHOFmHS.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\ayreXaa.exe
  C:\Windows\System\ayreXaa.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\JQbBOgN.exe
  C:\Windows\System\JQbBOgN.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\TipIUwj.exe
  C:\Windows\System\TipIUwj.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\nfrOFFx.exe
  C:\Windows\System\nfrOFFx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\KqAsbVL.exe
  C:\Windows\System\KqAsbVL.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\YNMJoSy.exe
  C:\Windows\System\YNMJoSy.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\MszExGN.exe
  C:\Windows\System\MszExGN.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\wGlbRCV.exe
  C:\Windows\System\wGlbRCV.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\NKdSxoQ.exe
  C:\Windows\System\NKdSxoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\ZbzMgRZ.exe
  C:\Windows\System\ZbzMgRZ.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\MRpCmAM.exe
  C:\Windows\System\MRpCmAM.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\oDFNSCe.exe
  C:\Windows\System\oDFNSCe.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\yohaepY.exe
  C:\Windows\System\yohaepY.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\FEZacsb.exe
  C:\Windows\System\FEZacsb.exe
  2⤵
  PID:3912
- C:\Windows\System\vuMdHrX.exe
  C:\Windows\System\vuMdHrX.exe
  2⤵
  PID:1932
- C:\Windows\System\uaIYgAf.exe
  C:\Windows\System\uaIYgAf.exe
  2⤵
  PID:3988
- C:\Windows\System\WHeBlVS.exe
  C:\Windows\System\WHeBlVS.exe
  2⤵
  PID:2220
- C:\Windows\System\TccFLGT.exe
  C:\Windows\System\TccFLGT.exe
  2⤵
  PID:4908
- C:\Windows\System\PJLqnix.exe
  C:\Windows\System\PJLqnix.exe
  2⤵
  PID:4452
- C:\Windows\System\xBVryRT.exe
  C:\Windows\System\xBVryRT.exe
  2⤵
  PID:3936
- C:\Windows\System\EzWVTut.exe
  C:\Windows\System\EzWVTut.exe
  2⤵
  PID:1448
- C:\Windows\System\QYkQRzf.exe
  C:\Windows\System\QYkQRzf.exe
  2⤵
  PID:1680
- C:\Windows\System\JxngQjm.exe
  C:\Windows\System\JxngQjm.exe
  2⤵
  PID:3864
- C:\Windows\System\CPTBmpC.exe
  C:\Windows\System\CPTBmpC.exe
  2⤵
  PID:1720
- C:\Windows\System\MgJcoOl.exe
  C:\Windows\System\MgJcoOl.exe
  2⤵
  PID:3388
- C:\Windows\System\MaIEuII.exe
  C:\Windows\System\MaIEuII.exe
  2⤵
  PID:3060
- C:\Windows\System\IPsCEqb.exe
  C:\Windows\System\IPsCEqb.exe
  2⤵
  PID:3644
- C:\Windows\System\MLVjhsP.exe
  C:\Windows\System\MLVjhsP.exe
  2⤵
  PID:808
- C:\Windows\System\savBtvh.exe
  C:\Windows\System\savBtvh.exe
  2⤵
  PID:3652
- C:\Windows\System\xqNikhP.exe
  C:\Windows\System\xqNikhP.exe
  2⤵
  PID:4600
- C:\Windows\System\PrPbsHO.exe
  C:\Windows\System\PrPbsHO.exe
  2⤵
  PID:5180
- C:\Windows\System\lFCHXtS.exe
  C:\Windows\System\lFCHXtS.exe
  2⤵
  PID:5208
- C:\Windows\System\qPCKIHn.exe
  C:\Windows\System\qPCKIHn.exe
  2⤵
  PID:5252
- C:\Windows\System\jGExwlu.exe
  C:\Windows\System\jGExwlu.exe
  2⤵
  PID:5292
- C:\Windows\System\rbIVvdd.exe
  C:\Windows\System\rbIVvdd.exe
  2⤵
  PID:5336
- C:\Windows\System\xMjbKgJ.exe
  C:\Windows\System\xMjbKgJ.exe
  2⤵
  PID:5372
- C:\Windows\System\DomerIi.exe
  C:\Windows\System\DomerIi.exe
  2⤵
  PID:5420
- C:\Windows\System\rRgVELe.exe
  C:\Windows\System\rRgVELe.exe
  2⤵
  PID:5460
- C:\Windows\System\QJpBdus.exe
  C:\Windows\System\QJpBdus.exe
  2⤵
  PID:5500
- C:\Windows\System\LkgEadE.exe
  C:\Windows\System\LkgEadE.exe
  2⤵
  PID:5532
- C:\Windows\System\cXPwJWa.exe
  C:\Windows\System\cXPwJWa.exe
  2⤵
  PID:5572
- C:\Windows\System\jZCGULU.exe
  C:\Windows\System\jZCGULU.exe
  2⤵
  PID:5608
- C:\Windows\System\iiBiOBj.exe
  C:\Windows\System\iiBiOBj.exe
  2⤵
  PID:5656
- C:\Windows\System\UkPlqUN.exe
  C:\Windows\System\UkPlqUN.exe
  2⤵
  PID:5684
- C:\Windows\System\RBfmWwW.exe
  C:\Windows\System\RBfmWwW.exe
  2⤵
  PID:5728
- C:\Windows\System\PrwnLrF.exe
  C:\Windows\System\PrwnLrF.exe
  2⤵
  PID:5760
- C:\Windows\System\XIQAYbK.exe
  C:\Windows\System\XIQAYbK.exe
  2⤵
  PID:5812
- C:\Windows\System\GERFMBT.exe
  C:\Windows\System\GERFMBT.exe
  2⤵
  PID:5848
- C:\Windows\System\OIxHmyV.exe
  C:\Windows\System\OIxHmyV.exe
  2⤵
  PID:5908
- C:\Windows\System\kWRrFam.exe
  C:\Windows\System\kWRrFam.exe
  2⤵
  PID:5940
- C:\Windows\System\ALgMjwu.exe
  C:\Windows\System\ALgMjwu.exe
  2⤵
  PID:6000
- C:\Windows\System\cWFVdbb.exe
  C:\Windows\System\cWFVdbb.exe
  2⤵
  PID:6052
- C:\Windows\System\wLtBzfX.exe
  C:\Windows\System\wLtBzfX.exe
  2⤵
  PID:6108
- C:\Windows\System\YwVJSuG.exe
  C:\Windows\System\YwVJSuG.exe
  2⤵
  PID:716
- C:\Windows\System\zckvTZD.exe
  C:\Windows\System\zckvTZD.exe
  2⤵
  PID:5156
- C:\Windows\System\cGUeGkl.exe
  C:\Windows\System\cGUeGkl.exe
  2⤵
  PID:5276
- C:\Windows\System\ebvSnss.exe
  C:\Windows\System\ebvSnss.exe
  2⤵
  PID:5308
- C:\Windows\System\LMORMOg.exe
  C:\Windows\System\LMORMOg.exe
  2⤵
  PID:5400
- C:\Windows\System\pWDRUoQ.exe
  C:\Windows\System\pWDRUoQ.exe
  2⤵
  PID:2776
- C:\Windows\System\bsxbsYH.exe
  C:\Windows\System\bsxbsYH.exe
  2⤵
  PID:5468
- C:\Windows\System\PtjOGfk.exe
  C:\Windows\System\PtjOGfk.exe
  2⤵
  PID:5524
- C:\Windows\System\hvhuxuc.exe
  C:\Windows\System\hvhuxuc.exe
  2⤵
  PID:5600
- C:\Windows\System\tLmtMLL.exe
  C:\Windows\System\tLmtMLL.exe
  2⤵
  PID:5676
- C:\Windows\System\YdMhPrx.exe
  C:\Windows\System\YdMhPrx.exe
  2⤵
  PID:5724
- C:\Windows\System\wnPsYDK.exe
  C:\Windows\System\wnPsYDK.exe
  2⤵
  PID:5776
- C:\Windows\System\ANrXOFJ.exe
  C:\Windows\System\ANrXOFJ.exe
  2⤵
  PID:5800
- C:\Windows\System\armHxQa.exe
  C:\Windows\System\armHxQa.exe
  2⤵
  PID:5840
- C:\Windows\System\cAYECAv.exe
  C:\Windows\System\cAYECAv.exe
  2⤵
  PID:5896
- C:\Windows\System\RKOXJdL.exe
  C:\Windows\System\RKOXJdL.exe
  2⤵
  PID:5988
- C:\Windows\System\aVecYaq.exe
  C:\Windows\System\aVecYaq.exe
  2⤵
  PID:6076
- C:\Windows\System\VITbXLz.exe
  C:\Windows\System\VITbXLz.exe
  2⤵
  PID:6140
- C:\Windows\System\EiyTyMW.exe
  C:\Windows\System\EiyTyMW.exe
  2⤵
  PID:3608
- C:\Windows\System\QqHvHHt.exe
  C:\Windows\System\QqHvHHt.exe
  2⤵
  PID:5644
- C:\Windows\System\FQLnNlN.exe
  C:\Windows\System\FQLnNlN.exe
  2⤵
  PID:5268
- C:\Windows\System\PXwVHlz.exe
  C:\Windows\System\PXwVHlz.exe
  2⤵
  PID:5928
- C:\Windows\System\hnhsLep.exe
  C:\Windows\System\hnhsLep.exe
  2⤵
  PID:1588
- C:\Windows\System\vBxmnZZ.exe
  C:\Windows\System\vBxmnZZ.exe
  2⤵
  PID:5432
- C:\Windows\System\yTbPgGP.exe
  C:\Windows\System\yTbPgGP.exe
  2⤵
  PID:5556
- C:\Windows\System\cTPAgpW.exe
  C:\Windows\System\cTPAgpW.exe
  2⤵
  PID:5696
- C:\Windows\System\YFjsvUw.exe
  C:\Windows\System\YFjsvUw.exe
  2⤵
  PID:5792
- C:\Windows\System\fqDNcWo.exe
  C:\Windows\System\fqDNcWo.exe
  2⤵
  PID:5856
- C:\Windows\System\JmOrHrK.exe
  C:\Windows\System\JmOrHrK.exe
  2⤵
  PID:5980
- C:\Windows\System\WawvQlw.exe
  C:\Windows\System\WawvQlw.exe
  2⤵
  PID:6120
- C:\Windows\System\TsGhwUm.exe
  C:\Windows\System\TsGhwUm.exe
  2⤵
  PID:5704
- C:\Windows\System\bKzZqMt.exe
  C:\Windows\System\bKzZqMt.exe
  2⤵
  PID:5284
- C:\Windows\System\Wuajark.exe
  C:\Windows\System\Wuajark.exe
  2⤵
  PID:5484
- C:\Windows\System\IQLeQKd.exe
  C:\Windows\System\IQLeQKd.exe
  2⤵
  PID:5876
- C:\Windows\System\TQpcoBA.exe
  C:\Windows\System\TQpcoBA.exe
  2⤵
  PID:5200
- C:\Windows\System\sNYxHYO.exe
  C:\Windows\System\sNYxHYO.exe
  2⤵
  PID:2296
- C:\Windows\System\EiZUsBQ.exe
  C:\Windows\System\EiZUsBQ.exe
  2⤵
  PID:4024
- C:\Windows\System\MHvoTPP.exe
  C:\Windows\System\MHvoTPP.exe
  2⤵
  PID:5404
- C:\Windows\System\NTgZrKm.exe
  C:\Windows\System\NTgZrKm.exe
  2⤵
  PID:6156
- C:\Windows\System\VlFlaXF.exe
  C:\Windows\System\VlFlaXF.exe
  2⤵
  PID:6184
- C:\Windows\System\YDMvqUg.exe
  C:\Windows\System\YDMvqUg.exe
  2⤵
  PID:6212
- C:\Windows\System\GIHkEUM.exe
  C:\Windows\System\GIHkEUM.exe
  2⤵
  PID:6244
- C:\Windows\System\vqYUnOv.exe
  C:\Windows\System\vqYUnOv.exe
  2⤵
  PID:6272
- C:\Windows\System\WSzAYbR.exe
  C:\Windows\System\WSzAYbR.exe
  2⤵
  PID:6312
- C:\Windows\System\jdPRiFa.exe
  C:\Windows\System\jdPRiFa.exe
  2⤵
  PID:6332
- C:\Windows\System\kPizLdO.exe
  C:\Windows\System\kPizLdO.exe
  2⤵
  PID:6360
- C:\Windows\System\drCiIsf.exe
  C:\Windows\System\drCiIsf.exe
  2⤵
  PID:6396
- C:\Windows\System\MMRtJNR.exe
  C:\Windows\System\MMRtJNR.exe
  2⤵
  PID:6432
- C:\Windows\System\wywSQda.exe
  C:\Windows\System\wywSQda.exe
  2⤵
  PID:6464
- C:\Windows\System\blcnFSS.exe
  C:\Windows\System\blcnFSS.exe
  2⤵
  PID:6500
- C:\Windows\System\MeJaUSq.exe
  C:\Windows\System\MeJaUSq.exe
  2⤵
  PID:6524
- C:\Windows\System\mQrrDOm.exe
  C:\Windows\System\mQrrDOm.exe
  2⤵
  PID:6552
- C:\Windows\System\SJnVGLB.exe
  C:\Windows\System\SJnVGLB.exe
  2⤵
  PID:6572
- C:\Windows\System\sACmAkG.exe
  C:\Windows\System\sACmAkG.exe
  2⤵
  PID:6600
- C:\Windows\System\jWiPGvN.exe
  C:\Windows\System\jWiPGvN.exe
  2⤵
  PID:6640
- C:\Windows\System\ubnApzH.exe
  C:\Windows\System\ubnApzH.exe
  2⤵
  PID:6680
- C:\Windows\System\hwbHeNS.exe
  C:\Windows\System\hwbHeNS.exe
  2⤵
  PID:6712
- C:\Windows\System\PJsmemz.exe
  C:\Windows\System\PJsmemz.exe
  2⤵
  PID:6744
- C:\Windows\System\TSNNXpi.exe
  C:\Windows\System\TSNNXpi.exe
  2⤵
  PID:6780
- C:\Windows\System\wReGMyR.exe
  C:\Windows\System\wReGMyR.exe
  2⤵
  PID:6812
- C:\Windows\System\uKKDOhq.exe
  C:\Windows\System\uKKDOhq.exe
  2⤵
  PID:6840
- C:\Windows\System\tPNdXrX.exe
  C:\Windows\System\tPNdXrX.exe
  2⤵
  PID:6868
- C:\Windows\System\iqdvMDZ.exe
  C:\Windows\System\iqdvMDZ.exe
  2⤵
  PID:6904
- C:\Windows\System\WmItKti.exe
  C:\Windows\System\WmItKti.exe
  2⤵
  PID:6932
- C:\Windows\System\aOFNlUb.exe
  C:\Windows\System\aOFNlUb.exe
  2⤵
  PID:6968
- C:\Windows\System\DRsnsru.exe
  C:\Windows\System\DRsnsru.exe
  2⤵
  PID:7000
- C:\Windows\System\ngJuHTo.exe
  C:\Windows\System\ngJuHTo.exe
  2⤵
  PID:7032
- C:\Windows\System\dUnMvUp.exe
  C:\Windows\System\dUnMvUp.exe
  2⤵
  PID:7060
- C:\Windows\System\KjQxaje.exe
  C:\Windows\System\KjQxaje.exe
  2⤵
  PID:7096
- C:\Windows\System\hqQYfGb.exe
  C:\Windows\System\hqQYfGb.exe
  2⤵
  PID:7128
- C:\Windows\System\meskZKj.exe
  C:\Windows\System\meskZKj.exe
  2⤵
  PID:7160
- C:\Windows\System\UNxcYfw.exe
  C:\Windows\System\UNxcYfw.exe
  2⤵
  PID:6180
- C:\Windows\System\pGhaWkz.exe
  C:\Windows\System\pGhaWkz.exe
  2⤵
  PID:6260
- C:\Windows\System\XYIroRr.exe
  C:\Windows\System\XYIroRr.exe
  2⤵
  PID:6320
- C:\Windows\System\ZijeaEQ.exe
  C:\Windows\System\ZijeaEQ.exe
  2⤵
  PID:6384
- C:\Windows\System\ysstjue.exe
  C:\Windows\System\ysstjue.exe
  2⤵
  PID:6448
- C:\Windows\System\IVxpdne.exe
  C:\Windows\System\IVxpdne.exe
  2⤵
  PID:6536
- C:\Windows\System\NxYogwY.exe
  C:\Windows\System\NxYogwY.exe
  2⤵
  PID:6592
- C:\Windows\System\VLVQkFw.exe
  C:\Windows\System\VLVQkFw.exe
  2⤵
  PID:6672
- C:\Windows\System\JpupTHE.exe
  C:\Windows\System\JpupTHE.exe
  2⤵
  PID:6704
- C:\Windows\System\HPgaNWl.exe
  C:\Windows\System\HPgaNWl.exe
  2⤵
  PID:6792
- C:\Windows\System\gWRjwih.exe
  C:\Windows\System\gWRjwih.exe
  2⤵
  PID:6860
- C:\Windows\System\KyKAWns.exe
  C:\Windows\System\KyKAWns.exe
  2⤵
  PID:6900
- C:\Windows\System\Cbdzaxk.exe
  C:\Windows\System\Cbdzaxk.exe
  2⤵
  PID:6980
- C:\Windows\System\WYueyxR.exe
  C:\Windows\System\WYueyxR.exe
  2⤵
  PID:7024
- C:\Windows\System\aeXmZpw.exe
  C:\Windows\System\aeXmZpw.exe
  2⤵
  PID:7084
- C:\Windows\System\icoNetS.exe
  C:\Windows\System\icoNetS.exe
  2⤵
  PID:7144
- C:\Windows\System\KYAmcHa.exe
  C:\Windows\System\KYAmcHa.exe
  2⤵
  PID:6208
- C:\Windows\System\OfeaVnJ.exe
  C:\Windows\System\OfeaVnJ.exe
  2⤵
  PID:6352
- C:\Windows\System\TCtXKEe.exe
  C:\Windows\System\TCtXKEe.exe
  2⤵
  PID:6516
- C:\Windows\System\UqIUqgB.exe
  C:\Windows\System\UqIUqgB.exe
  2⤵
  PID:6620
- C:\Windows\System\LexKRml.exe
  C:\Windows\System\LexKRml.exe
  2⤵
  PID:6708
- C:\Windows\System\sUGFbRi.exe
  C:\Windows\System\sUGFbRi.exe
  2⤵
  PID:6836
- C:\Windows\System\FhKSDAe.exe
  C:\Windows\System\FhKSDAe.exe
  2⤵
  PID:6960
- C:\Windows\System\dMzEMhg.exe
  C:\Windows\System\dMzEMhg.exe
  2⤵
  PID:7136
- C:\Windows\System\ggnctPq.exe
  C:\Windows\System\ggnctPq.exe
  2⤵
  PID:6416
- C:\Windows\System\EwRoBnQ.exe
  C:\Windows\System\EwRoBnQ.exe
  2⤵
  PID:6656
- C:\Windows\System\dKKcYHx.exe
  C:\Windows\System\dKKcYHx.exe
  2⤵
  PID:6168
- C:\Windows\System\eXZKzWz.exe
  C:\Windows\System\eXZKzWz.exe
  2⤵
  PID:7072
- C:\Windows\System\zIyArSa.exe
  C:\Windows\System\zIyArSa.exe
  2⤵
  PID:6740
- C:\Windows\System\moXIGog.exe
  C:\Windows\System\moXIGog.exe
  2⤵
  PID:7200
- C:\Windows\System\knrJCrN.exe
  C:\Windows\System\knrJCrN.exe
  2⤵
  PID:7228
- C:\Windows\System\eozgqAX.exe
  C:\Windows\System\eozgqAX.exe
  2⤵
  PID:7256
- C:\Windows\System\niaFOxh.exe
  C:\Windows\System\niaFOxh.exe
  2⤵
  PID:7288
- C:\Windows\System\itxDxuE.exe
  C:\Windows\System\itxDxuE.exe
  2⤵
  PID:7320
- C:\Windows\System\vBzGNPl.exe
  C:\Windows\System\vBzGNPl.exe
  2⤵
  PID:7352
- C:\Windows\System\XjxJizw.exe
  C:\Windows\System\XjxJizw.exe
  2⤵
  PID:7372
- C:\Windows\System\uWYMhuF.exe
  C:\Windows\System\uWYMhuF.exe
  2⤵
  PID:7404
- C:\Windows\System\sCspDdn.exe
  C:\Windows\System\sCspDdn.exe
  2⤵
  PID:7436
- C:\Windows\System\ZcJfYpZ.exe
  C:\Windows\System\ZcJfYpZ.exe
  2⤵
  PID:7456
- C:\Windows\System\meGzjcH.exe
  C:\Windows\System\meGzjcH.exe
  2⤵
  PID:7488
- C:\Windows\System\virDTDo.exe
  C:\Windows\System\virDTDo.exe
  2⤵
  PID:7512
- C:\Windows\System\tggczqs.exe
  C:\Windows\System\tggczqs.exe
  2⤵
  PID:7552
- C:\Windows\System\SJSdVDs.exe
  C:\Windows\System\SJSdVDs.exe
  2⤵
  PID:7592
- C:\Windows\System\CfgtDjA.exe
  C:\Windows\System\CfgtDjA.exe
  2⤵
  PID:7632
- C:\Windows\System\IVczXqM.exe
  C:\Windows\System\IVczXqM.exe
  2⤵
  PID:7652
- C:\Windows\System\KgMorMY.exe
  C:\Windows\System\KgMorMY.exe
  2⤵
  PID:7680
- C:\Windows\System\DsksTlK.exe
  C:\Windows\System\DsksTlK.exe
  2⤵
  PID:7708
- C:\Windows\System\OambQqY.exe
  C:\Windows\System\OambQqY.exe
  2⤵
  PID:7736
- C:\Windows\System\qowSvDd.exe
  C:\Windows\System\qowSvDd.exe
  2⤵
  PID:7768
- C:\Windows\System\jyaZxqN.exe
  C:\Windows\System\jyaZxqN.exe
  2⤵
  PID:7800
- C:\Windows\System\kQvNjdl.exe
  C:\Windows\System\kQvNjdl.exe
  2⤵
  PID:7828
- C:\Windows\System\CPYJaya.exe
  C:\Windows\System\CPYJaya.exe
  2⤵
  PID:7856
- C:\Windows\System\KUNesOH.exe
  C:\Windows\System\KUNesOH.exe
  2⤵
  PID:7884
- C:\Windows\System\LGOgkGK.exe
  C:\Windows\System\LGOgkGK.exe
  2⤵
  PID:7912
- C:\Windows\System\KoqsIBy.exe
  C:\Windows\System\KoqsIBy.exe
  2⤵
  PID:7944
- C:\Windows\System\brpAMOe.exe
  C:\Windows\System\brpAMOe.exe
  2⤵
  PID:7972
- C:\Windows\System\ZXhgsNt.exe
  C:\Windows\System\ZXhgsNt.exe
  2⤵
  PID:7996
- C:\Windows\System\QNazMeC.exe
  C:\Windows\System\QNazMeC.exe
  2⤵
  PID:8024
- C:\Windows\System\gYaXSya.exe
  C:\Windows\System\gYaXSya.exe
  2⤵
  PID:8052
- C:\Windows\System\KZZnnGP.exe
  C:\Windows\System\KZZnnGP.exe
  2⤵
  PID:8080
- C:\Windows\System\sXhAIDA.exe
  C:\Windows\System\sXhAIDA.exe
  2⤵
  PID:8108
- C:\Windows\System\bdURwic.exe
  C:\Windows\System\bdURwic.exe
  2⤵
  PID:8140
- C:\Windows\System\gLGWIAp.exe
  C:\Windows\System\gLGWIAp.exe
  2⤵
  PID:8172
- C:\Windows\System\ROLiPAK.exe
  C:\Windows\System\ROLiPAK.exe
  2⤵
  PID:7196
- C:\Windows\System\PQZyrXo.exe
  C:\Windows\System\PQZyrXo.exe
  2⤵
  PID:7252
- C:\Windows\System\NDqdwaI.exe
  C:\Windows\System\NDqdwaI.exe
  2⤵
  PID:7340
- C:\Windows\System\HAMJNBD.exe
  C:\Windows\System\HAMJNBD.exe
  2⤵
  PID:7412
- C:\Windows\System\QCCrebs.exe
  C:\Windows\System\QCCrebs.exe
  2⤵
  PID:7480
- C:\Windows\System\MXiEPsH.exe
  C:\Windows\System\MXiEPsH.exe
  2⤵
  PID:7560
- C:\Windows\System\iAlggqT.exe
  C:\Windows\System\iAlggqT.exe
  2⤵
  PID:7644
- C:\Windows\System\YtTTMTY.exe
  C:\Windows\System\YtTTMTY.exe
  2⤵
  PID:7720
- C:\Windows\System\lIfSgCc.exe
  C:\Windows\System\lIfSgCc.exe
  2⤵
  PID:7764
- C:\Windows\System\mzRUltd.exe
  C:\Windows\System\mzRUltd.exe
  2⤵
  PID:7852
- C:\Windows\System\LFjmBtf.exe
  C:\Windows\System\LFjmBtf.exe
  2⤵
  PID:7932
- C:\Windows\System\hzuTuFA.exe
  C:\Windows\System\hzuTuFA.exe
  2⤵
  PID:8008
- C:\Windows\System\NAMBqra.exe
  C:\Windows\System\NAMBqra.exe
  2⤵
  PID:8068
- C:\Windows\System\IBlgrfC.exe
  C:\Windows\System\IBlgrfC.exe
  2⤵
  PID:8132
- C:\Windows\System\xOYRjHa.exe
  C:\Windows\System\xOYRjHa.exe
  2⤵
  PID:8128
- C:\Windows\System\MTDpFYo.exe
  C:\Windows\System\MTDpFYo.exe
  2⤵
  PID:7364
- C:\Windows\System\rCNEvLT.exe
  C:\Windows\System\rCNEvLT.exe
  2⤵
  PID:7524
- C:\Windows\System\WPFvcBQ.exe
  C:\Windows\System\WPFvcBQ.exe
  2⤵
  PID:7692
- C:\Windows\System\mfGvPcG.exe
  C:\Windows\System\mfGvPcG.exe
  2⤵
  PID:7880
- C:\Windows\System\TeRinFS.exe
  C:\Windows\System\TeRinFS.exe
  2⤵
  PID:7964
- C:\Windows\System\ZrQkkyc.exe
  C:\Windows\System\ZrQkkyc.exe
  2⤵
  PID:8136
- C:\Windows\System\yrgGgdp.exe
  C:\Windows\System\yrgGgdp.exe
  2⤵
  PID:7328
- C:\Windows\System\pxWEKIb.exe
  C:\Windows\System\pxWEKIb.exe
  2⤵
  PID:6328
- C:\Windows\System\AZXYvCW.exe
  C:\Windows\System\AZXYvCW.exe
  2⤵
  PID:7952
- C:\Windows\System\CWhSxWQ.exe
  C:\Windows\System\CWhSxWQ.exe
  2⤵
  PID:8092
- C:\Windows\System\ehCcIXc.exe
  C:\Windows\System\ehCcIXc.exe
  2⤵
  PID:7504
- C:\Windows\System\SAozSBu.exe
  C:\Windows\System\SAozSBu.exe
  2⤵
  PID:8212
- C:\Windows\System\rjUKXJV.exe
  C:\Windows\System\rjUKXJV.exe
  2⤵
  PID:8252
- C:\Windows\System\jpsJRkC.exe
  C:\Windows\System\jpsJRkC.exe
  2⤵
  PID:8280
- C:\Windows\System\BPeppTZ.exe
  C:\Windows\System\BPeppTZ.exe
  2⤵
  PID:8308
- C:\Windows\System\eONQMXN.exe
  C:\Windows\System\eONQMXN.exe
  2⤵
  PID:8336
- C:\Windows\System\bFHvIai.exe
  C:\Windows\System\bFHvIai.exe
  2⤵
  PID:8368
- C:\Windows\System\PveurFH.exe
  C:\Windows\System\PveurFH.exe
  2⤵
  PID:8396
- C:\Windows\System\uXCauQG.exe
  C:\Windows\System\uXCauQG.exe
  2⤵
  PID:8424
- C:\Windows\System\kYRNica.exe
  C:\Windows\System\kYRNica.exe
  2⤵
  PID:8452
- C:\Windows\System\eNgAYmw.exe
  C:\Windows\System\eNgAYmw.exe
  2⤵
  PID:8480
- C:\Windows\System\tqFShiT.exe
  C:\Windows\System\tqFShiT.exe
  2⤵
  PID:8508
- C:\Windows\System\VLhmoQA.exe
  C:\Windows\System\VLhmoQA.exe
  2⤵
  PID:8536
- C:\Windows\System\CLgacrJ.exe
  C:\Windows\System\CLgacrJ.exe
  2⤵
  PID:8564
- C:\Windows\System\RyopPvX.exe
  C:\Windows\System\RyopPvX.exe
  2⤵
  PID:8592
- C:\Windows\System\uTGGHCy.exe
  C:\Windows\System\uTGGHCy.exe
  2⤵
  PID:8620
- C:\Windows\System\XYfysaY.exe
  C:\Windows\System\XYfysaY.exe
  2⤵
  PID:8648
- C:\Windows\System\dnNtTTu.exe
  C:\Windows\System\dnNtTTu.exe
  2⤵
  PID:8676
- C:\Windows\System\EISfQxo.exe
  C:\Windows\System\EISfQxo.exe
  2⤵
  PID:8704
- C:\Windows\System\OTyoZim.exe
  C:\Windows\System\OTyoZim.exe
  2⤵
  PID:8732
- C:\Windows\System\KkuWNoe.exe
  C:\Windows\System\KkuWNoe.exe
  2⤵
  PID:8760
- C:\Windows\System\EDLjgvP.exe
  C:\Windows\System\EDLjgvP.exe
  2⤵
  PID:8788
- C:\Windows\System\JBGcciS.exe
  C:\Windows\System\JBGcciS.exe
  2⤵
  PID:8816
- C:\Windows\System\dzfdEQO.exe
  C:\Windows\System\dzfdEQO.exe
  2⤵
  PID:8844
- C:\Windows\System\bZRFKEf.exe
  C:\Windows\System\bZRFKEf.exe
  2⤵
  PID:8872
- C:\Windows\System\ViKFPWP.exe
  C:\Windows\System\ViKFPWP.exe
  2⤵
  PID:8900
- C:\Windows\System\DDwcsqI.exe
  C:\Windows\System\DDwcsqI.exe
  2⤵
  PID:8928
- C:\Windows\System\iDWlMMa.exe
  C:\Windows\System\iDWlMMa.exe
  2⤵
  PID:8956
- C:\Windows\System\TjgZOdQ.exe
  C:\Windows\System\TjgZOdQ.exe
  2⤵
  PID:8984
- C:\Windows\System\tIBkpUH.exe
  C:\Windows\System\tIBkpUH.exe
  2⤵
  PID:9012
- C:\Windows\System\avRMcOH.exe
  C:\Windows\System\avRMcOH.exe
  2⤵
  PID:9040
- C:\Windows\System\wZtfyMx.exe
  C:\Windows\System\wZtfyMx.exe
  2⤵
  PID:9068
- C:\Windows\System\eAVUvRx.exe
  C:\Windows\System\eAVUvRx.exe
  2⤵
  PID:9096
- C:\Windows\System\RCrMaug.exe
  C:\Windows\System\RCrMaug.exe
  2⤵
  PID:9124
- C:\Windows\System\fTojDOC.exe
  C:\Windows\System\fTojDOC.exe
  2⤵
  PID:9152
- C:\Windows\System\Mdcgzbq.exe
  C:\Windows\System\Mdcgzbq.exe
  2⤵
  PID:9184
- C:\Windows\System\bfWKbmW.exe
  C:\Windows\System\bfWKbmW.exe
  2⤵
  PID:9212
- C:\Windows\System\hnfdCyD.exe
  C:\Windows\System\hnfdCyD.exe
  2⤵
  PID:8224
- C:\Windows\System\ThZJuQd.exe
  C:\Windows\System\ThZJuQd.exe
  2⤵
  PID:8292
- C:\Windows\System\UTbvnYr.exe
  C:\Windows\System\UTbvnYr.exe
  2⤵
  PID:8360
- C:\Windows\System\QKghNsa.exe
  C:\Windows\System\QKghNsa.exe
  2⤵
  PID:8416
- C:\Windows\System\NxXmUnY.exe
  C:\Windows\System\NxXmUnY.exe
  2⤵
  PID:8492
- C:\Windows\System\oAXbUZw.exe
  C:\Windows\System\oAXbUZw.exe
  2⤵
  PID:8528
- C:\Windows\System\VtPQxaY.exe
  C:\Windows\System\VtPQxaY.exe
  2⤵
  PID:8560
- C:\Windows\System\tTkOFyc.exe
  C:\Windows\System\tTkOFyc.exe
  2⤵
  PID:8604
- C:\Windows\System\BTBqvGV.exe
  C:\Windows\System\BTBqvGV.exe
  2⤵
  PID:8668
- C:\Windows\System\GWfIiNM.exe
  C:\Windows\System\GWfIiNM.exe
  2⤵
  PID:8800
- C:\Windows\System\IRmyRSW.exe
  C:\Windows\System\IRmyRSW.exe
  2⤵
  PID:8884
- C:\Windows\System\yxmjqpj.exe
  C:\Windows\System\yxmjqpj.exe
  2⤵
  PID:8952
- C:\Windows\System\cNLMpnA.exe
  C:\Windows\System\cNLMpnA.exe
  2⤵
  PID:9008
- C:\Windows\System\zwmELmE.exe
  C:\Windows\System\zwmELmE.exe
  2⤵
  PID:9080
- C:\Windows\System\KSquqUN.exe
  C:\Windows\System\KSquqUN.exe
  2⤵
  PID:9148
- C:\Windows\System\JgVAZbf.exe
  C:\Windows\System\JgVAZbf.exe
  2⤵
  PID:8044
- C:\Windows\System\mQwBoOD.exe
  C:\Windows\System\mQwBoOD.exe
  2⤵
  PID:8320
- C:\Windows\System\isUWzXn.exe
  C:\Windows\System\isUWzXn.exe
  2⤵
  PID:8448
- C:\Windows\System\UZyCicS.exe
  C:\Windows\System\UZyCicS.exe
  2⤵
  PID:8640
- C:\Windows\System\sFEzUtG.exe
  C:\Windows\System\sFEzUtG.exe
  2⤵
  PID:8924
- C:\Windows\System\pFuTwHR.exe
  C:\Windows\System\pFuTwHR.exe
  2⤵
  PID:9144
- C:\Windows\System\MEMYjKj.exe
  C:\Windows\System\MEMYjKj.exe
  2⤵
  PID:8272
- C:\Windows\System\kjzQSsC.exe
  C:\Windows\System\kjzQSsC.exe
  2⤵
  PID:8864
- C:\Windows\System\ZNDgZkj.exe
  C:\Windows\System\ZNDgZkj.exe
  2⤵
  PID:8388
- C:\Windows\System\caQekNg.exe
  C:\Windows\System\caQekNg.exe
  2⤵
  PID:9208
- C:\Windows\System\qCGoirx.exe
  C:\Windows\System\qCGoirx.exe
  2⤵
  PID:9232
- C:\Windows\System\awQGYyL.exe
  C:\Windows\System\awQGYyL.exe
  2⤵
  PID:9260
- C:\Windows\System\GZbcCku.exe
  C:\Windows\System\GZbcCku.exe
  2⤵
  PID:9288
- C:\Windows\System\TJPBQPT.exe
  C:\Windows\System\TJPBQPT.exe
  2⤵
  PID:9316
- C:\Windows\System\CotMWLK.exe
  C:\Windows\System\CotMWLK.exe
  2⤵
  PID:9344
- C:\Windows\System\FTOoCEy.exe
  C:\Windows\System\FTOoCEy.exe
  2⤵
  PID:9372
- C:\Windows\System\grWtxjW.exe
  C:\Windows\System\grWtxjW.exe
  2⤵
  PID:9400
- C:\Windows\System\fHlYKTv.exe
  C:\Windows\System\fHlYKTv.exe
  2⤵
  PID:9432
- C:\Windows\System\GUQYDMZ.exe
  C:\Windows\System\GUQYDMZ.exe
  2⤵
  PID:9464
- C:\Windows\System\wSeOeBF.exe
  C:\Windows\System\wSeOeBF.exe
  2⤵
  PID:9492
- C:\Windows\System\wDUuCAM.exe
  C:\Windows\System\wDUuCAM.exe
  2⤵
  PID:9520
- C:\Windows\System\xNvVtMj.exe
  C:\Windows\System\xNvVtMj.exe
  2⤵
  PID:9548
- C:\Windows\System\SUZmIfr.exe
  C:\Windows\System\SUZmIfr.exe
  2⤵
  PID:9576
- C:\Windows\System\sVcLgud.exe
  C:\Windows\System\sVcLgud.exe
  2⤵
  PID:9604
- C:\Windows\System\otAqBWe.exe
  C:\Windows\System\otAqBWe.exe
  2⤵
  PID:9632
- C:\Windows\System\enzGFJj.exe
  C:\Windows\System\enzGFJj.exe
  2⤵
  PID:9660
- C:\Windows\System\GdkhQhP.exe
  C:\Windows\System\GdkhQhP.exe
  2⤵
  PID:9688
- C:\Windows\System\pxLHGYw.exe
  C:\Windows\System\pxLHGYw.exe
  2⤵
  PID:9716
- C:\Windows\System\eVGddiM.exe
  C:\Windows\System\eVGddiM.exe
  2⤵
  PID:9744
- C:\Windows\System\qTbMQiN.exe
  C:\Windows\System\qTbMQiN.exe
  2⤵
  PID:9772
- C:\Windows\System\ryFJPIQ.exe
  C:\Windows\System\ryFJPIQ.exe
  2⤵
  PID:9800
- C:\Windows\System\IKfPuep.exe
  C:\Windows\System\IKfPuep.exe
  2⤵
  PID:9828
- C:\Windows\System\DLMPoGe.exe
  C:\Windows\System\DLMPoGe.exe
  2⤵
  PID:9860
- C:\Windows\System\sshyIWT.exe
  C:\Windows\System\sshyIWT.exe
  2⤵
  PID:9892
- C:\Windows\System\rrdObSI.exe
  C:\Windows\System\rrdObSI.exe
  2⤵
  PID:9928
- C:\Windows\System\LwlypUq.exe
  C:\Windows\System\LwlypUq.exe
  2⤵
  PID:9960
- C:\Windows\System\mgsDnDu.exe
  C:\Windows\System\mgsDnDu.exe
  2⤵
  PID:10012
- C:\Windows\System\KibUCZg.exe
  C:\Windows\System\KibUCZg.exe
  2⤵
  PID:10044
- C:\Windows\System\XFdbFIn.exe
  C:\Windows\System\XFdbFIn.exe
  2⤵
  PID:10084
- C:\Windows\System\LXeJurP.exe
  C:\Windows\System\LXeJurP.exe
  2⤵
  PID:10116
- C:\Windows\System\koraFrz.exe
  C:\Windows\System\koraFrz.exe
  2⤵
  PID:10148
- C:\Windows\System\kyGNRbV.exe
  C:\Windows\System\kyGNRbV.exe
  2⤵
  PID:10180
- C:\Windows\System\KScHVbv.exe
  C:\Windows\System\KScHVbv.exe
  2⤵
  PID:10208
- C:\Windows\System\AcbICmw.exe
  C:\Windows\System\AcbICmw.exe
  2⤵
  PID:10236
- C:\Windows\System\ZPgElrq.exe
  C:\Windows\System\ZPgElrq.exe
  2⤵
  PID:9272
- C:\Windows\System\WnFOphI.exe
  C:\Windows\System\WnFOphI.exe
  2⤵
  PID:9336
- C:\Windows\System\cFHgUUb.exe
  C:\Windows\System\cFHgUUb.exe
  2⤵
  PID:9396
- C:\Windows\System\fYlxzBj.exe
  C:\Windows\System\fYlxzBj.exe
  2⤵
  PID:9476
- C:\Windows\System\tgNGEzW.exe
  C:\Windows\System\tgNGEzW.exe
  2⤵
  PID:9420
- C:\Windows\System\GjUGzzb.exe
  C:\Windows\System\GjUGzzb.exe
  2⤵
  PID:9568
- C:\Windows\System\aVAPCwT.exe
  C:\Windows\System\aVAPCwT.exe
  2⤵
  PID:9672
- C:\Windows\System\OhIORkT.exe
  C:\Windows\System\OhIORkT.exe
  2⤵
  PID:9736
- C:\Windows\System\iYuXjPE.exe
  C:\Windows\System\iYuXjPE.exe
  2⤵
  PID:9812
- C:\Windows\System\EAlhlXW.exe
  C:\Windows\System\EAlhlXW.exe
  2⤵
  PID:9884
- C:\Windows\System\XaVZESl.exe
  C:\Windows\System\XaVZESl.exe
  2⤵
  PID:9956
- C:\Windows\System\XbreYGG.exe
  C:\Windows\System\XbreYGG.exe
  2⤵
  PID:10076
- C:\Windows\System\OQmdFLD.exe
  C:\Windows\System\OQmdFLD.exe
  2⤵
  PID:10136
- C:\Windows\System\uUvRigc.exe
  C:\Windows\System\uUvRigc.exe
  2⤵
  PID:10192
- C:\Windows\System\MELENqB.exe
  C:\Windows\System\MELENqB.exe
  2⤵
  PID:9328
- C:\Windows\System\IXWZMuj.exe
  C:\Windows\System\IXWZMuj.exe
  2⤵
  PID:9428
- C:\Windows\System\fNDxnyG.exe
  C:\Windows\System\fNDxnyG.exe
  2⤵
  PID:9560
- C:\Windows\System\TaHUosX.exe
  C:\Windows\System\TaHUosX.exe
  2⤵
  PID:9796
- C:\Windows\System\zAAEvkI.exe
  C:\Windows\System\zAAEvkI.exe
  2⤵
  PID:10176
- C:\Windows\System\kvlzBXE.exe
  C:\Windows\System\kvlzBXE.exe
  2⤵
  PID:9532
- C:\Windows\System\mBFKliS.exe
  C:\Windows\System\mBFKliS.exe
  2⤵
  PID:9504
- C:\Windows\System\BebowHd.exe
  C:\Windows\System\BebowHd.exe
  2⤵
  PID:10264
- C:\Windows\System\sfFBPkU.exe
  C:\Windows\System\sfFBPkU.exe
  2⤵
  PID:10300
- C:\Windows\System\QNXRGov.exe
  C:\Windows\System\QNXRGov.exe
  2⤵
  PID:10356
- C:\Windows\System\senEfyR.exe
  C:\Windows\System\senEfyR.exe
  2⤵
  PID:10404
- C:\Windows\System\opzoOKj.exe
  C:\Windows\System\opzoOKj.exe
  2⤵
  PID:10432
- C:\Windows\System\sNOggts.exe
  C:\Windows\System\sNOggts.exe
  2⤵
  PID:10448
- C:\Windows\System\kGNQzAC.exe
  C:\Windows\System\kGNQzAC.exe
  2⤵
  PID:10476
- C:\Windows\System\MwXnStw.exe
  C:\Windows\System\MwXnStw.exe
  2⤵
  PID:10492
- C:\Windows\System\pZAxDGK.exe
  C:\Windows\System\pZAxDGK.exe
  2⤵
  PID:10512
- C:\Windows\System\fkZqljK.exe
  C:\Windows\System\fkZqljK.exe
  2⤵
  PID:10560
- C:\Windows\System\TggYURI.exe
  C:\Windows\System\TggYURI.exe
  2⤵
  PID:10588
- C:\Windows\System\bcPILOR.exe
  C:\Windows\System\bcPILOR.exe
  2⤵
  PID:10616
- C:\Windows\System\sbAEIUP.exe
  C:\Windows\System\sbAEIUP.exe
  2⤵
  PID:10640
- C:\Windows\System\czIGggT.exe
  C:\Windows\System\czIGggT.exe
  2⤵
  PID:10680
- C:\Windows\System\NAbnAkj.exe
  C:\Windows\System\NAbnAkj.exe
  2⤵
  PID:10716
- C:\Windows\System\mZzGyWm.exe
  C:\Windows\System\mZzGyWm.exe
  2⤵
  PID:10748
- C:\Windows\System\WHwNHYJ.exe
  C:\Windows\System\WHwNHYJ.exe
  2⤵
  PID:10780
- C:\Windows\System\IIlHQJr.exe
  C:\Windows\System\IIlHQJr.exe
  2⤵
  PID:10820
- C:\Windows\System\wLnoHEv.exe
  C:\Windows\System\wLnoHEv.exe
  2⤵
  PID:10856
- C:\Windows\System\eNFHKxu.exe
  C:\Windows\System\eNFHKxu.exe
  2⤵
  PID:10880
- C:\Windows\System\iGFTtML.exe
  C:\Windows\System\iGFTtML.exe
  2⤵
  PID:10908
- C:\Windows\System\kawQnNf.exe
  C:\Windows\System\kawQnNf.exe
  2⤵
  PID:10936
- C:\Windows\System\pTdcvTJ.exe
  C:\Windows\System\pTdcvTJ.exe
  2⤵
  PID:10964
- C:\Windows\System\HxPJUOb.exe
  C:\Windows\System\HxPJUOb.exe
  2⤵
  PID:10992
- C:\Windows\System\oyczBBG.exe
  C:\Windows\System\oyczBBG.exe
  2⤵
  PID:11020
- C:\Windows\System\hxcoOeq.exe
  C:\Windows\System\hxcoOeq.exe
  2⤵
  PID:11048
- C:\Windows\System\YUhHFEA.exe
  C:\Windows\System\YUhHFEA.exe
  2⤵
  PID:11076
- C:\Windows\System\udMQmsR.exe
  C:\Windows\System\udMQmsR.exe
  2⤵
  PID:11104
- C:\Windows\System\dQmBoZs.exe
  C:\Windows\System\dQmBoZs.exe
  2⤵
  PID:11132
- C:\Windows\System\MkXUtUc.exe
  C:\Windows\System\MkXUtUc.exe
  2⤵
  PID:11160
- C:\Windows\System\rhSafPx.exe
  C:\Windows\System\rhSafPx.exe
  2⤵
  PID:11188
- C:\Windows\System\EoHOJPU.exe
  C:\Windows\System\EoHOJPU.exe
  2⤵
  PID:11216
- C:\Windows\System\FFRyQHf.exe
  C:\Windows\System\FFRyQHf.exe
  2⤵
  PID:11244
- C:\Windows\System\ILtDPNk.exe
  C:\Windows\System\ILtDPNk.exe
  2⤵
  PID:10276
- C:\Windows\System\hLzgUUR.exe
  C:\Windows\System\hLzgUUR.exe
  2⤵
  PID:10392
- C:\Windows\System\qXdOFex.exe
  C:\Windows\System\qXdOFex.exe
  2⤵
  PID:10464
- C:\Windows\System\zcsQXDI.exe
  C:\Windows\System\zcsQXDI.exe
  2⤵
  PID:10528
- C:\Windows\System\WpvyRsz.exe
  C:\Windows\System\WpvyRsz.exe
  2⤵
  PID:10576
- C:\Windows\System\HJkazLB.exe
  C:\Windows\System\HJkazLB.exe
  2⤵
  PID:10688
- C:\Windows\System\VeTdSwV.exe
  C:\Windows\System\VeTdSwV.exe
  2⤵
  PID:10760
- C:\Windows\System\tbaCBTr.exe
  C:\Windows\System\tbaCBTr.exe
  2⤵
  PID:10840
- C:\Windows\System\qPHYHGy.exe
  C:\Windows\System\qPHYHGy.exe
  2⤵
  PID:10904
- C:\Windows\System\VEoLjeR.exe
  C:\Windows\System\VEoLjeR.exe
  2⤵
  PID:10976
- C:\Windows\System\laNIWJT.exe
  C:\Windows\System\laNIWJT.exe
  2⤵
  PID:11044
- C:\Windows\System\HGQbOAb.exe
  C:\Windows\System\HGQbOAb.exe
  2⤵
  PID:11100
- C:\Windows\System\CymUUON.exe
  C:\Windows\System\CymUUON.exe
  2⤵
  PID:11180
- C:\Windows\System\YioaGxM.exe
  C:\Windows\System\YioaGxM.exe
  2⤵
  PID:11240
- C:\Windows\System\eeokekl.exe
  C:\Windows\System\eeokekl.exe
  2⤵
  PID:10428
- C:\Windows\System\HegeMZc.exe
  C:\Windows\System\HegeMZc.exe
  2⤵
  PID:10580
- C:\Windows\System\YVsjQLt.exe
  C:\Windows\System\YVsjQLt.exe
  2⤵
  PID:10796
- C:\Windows\System\ggVHsCh.exe
  C:\Windows\System\ggVHsCh.exe
  2⤵
  PID:10956
- C:\Windows\System\VUaSgXK.exe
  C:\Windows\System\VUaSgXK.exe
  2⤵
  PID:11096
- C:\Windows\System\HIzSgmv.exe
  C:\Windows\System\HIzSgmv.exe
  2⤵
  PID:10252
- C:\Windows\System\IAWHvhH.exe
  C:\Windows\System\IAWHvhH.exe
  2⤵
  PID:10736
- C:\Windows\System\nNtXesb.exe
  C:\Windows\System\nNtXesb.exe
  2⤵
  PID:11088
- C:\Windows\System\DGumqzh.exe
  C:\Windows\System\DGumqzh.exe
  2⤵
  PID:10676
- C:\Windows\System\txTMEyL.exe
  C:\Windows\System\txTMEyL.exe
  2⤵
  PID:11068
- C:\Windows\System\ZODNufe.exe
  C:\Windows\System\ZODNufe.exe
  2⤵
  PID:11284
- C:\Windows\System\vjJNtQq.exe
  C:\Windows\System\vjJNtQq.exe
  2⤵
  PID:11312
- C:\Windows\System\KFCcvoh.exe
  C:\Windows\System\KFCcvoh.exe
  2⤵
  PID:11340
- C:\Windows\System\fvsKEpc.exe
  C:\Windows\System\fvsKEpc.exe
  2⤵
  PID:11376
- C:\Windows\System\BaFoEKx.exe
  C:\Windows\System\BaFoEKx.exe
  2⤵
  PID:11408
- C:\Windows\System\dbMkIKU.exe
  C:\Windows\System\dbMkIKU.exe
  2⤵
  PID:11428
- C:\Windows\System\zCOuHRg.exe
  C:\Windows\System\zCOuHRg.exe
  2⤵
  PID:11456
- C:\Windows\System\ROtgQUg.exe
  C:\Windows\System\ROtgQUg.exe
  2⤵
  PID:11484
- C:\Windows\System\RXbTstY.exe
  C:\Windows\System\RXbTstY.exe
  2⤵
  PID:11520
- C:\Windows\System\bCCnXgv.exe
  C:\Windows\System\bCCnXgv.exe
  2⤵
  PID:11548
- C:\Windows\System\NSkxXMV.exe
  C:\Windows\System\NSkxXMV.exe
  2⤵
  PID:11576
- C:\Windows\System\LBpUdMI.exe
  C:\Windows\System\LBpUdMI.exe
  2⤵
  PID:11592
- C:\Windows\System\NuSDExT.exe
  C:\Windows\System\NuSDExT.exe
  2⤵
  PID:11628
- C:\Windows\System\OYptxpZ.exe
  C:\Windows\System\OYptxpZ.exe
  2⤵
  PID:11660
- C:\Windows\System\uwcdGub.exe
  C:\Windows\System\uwcdGub.exe
  2⤵
  PID:11708
- C:\Windows\System\HjYsJFI.exe
  C:\Windows\System\HjYsJFI.exe
  2⤵
  PID:11740
- C:\Windows\System\xLpmfua.exe
  C:\Windows\System\xLpmfua.exe
  2⤵
  PID:11768
- C:\Windows\System\apQsiLM.exe
  C:\Windows\System\apQsiLM.exe
  2⤵
  PID:11796
- C:\Windows\System\GWpIdBY.exe
  C:\Windows\System\GWpIdBY.exe
  2⤵
  PID:11828
- C:\Windows\System\kyNupgJ.exe
  C:\Windows\System\kyNupgJ.exe
  2⤵
  PID:11856
- C:\Windows\System\LWJZStl.exe
  C:\Windows\System\LWJZStl.exe
  2⤵
  PID:11884
- C:\Windows\System\ffyChWg.exe
  C:\Windows\System\ffyChWg.exe
  2⤵
  PID:11912
- C:\Windows\System\DwsxOpd.exe
  C:\Windows\System\DwsxOpd.exe
  2⤵
  PID:11940
- C:\Windows\System\aOhFrvc.exe
  C:\Windows\System\aOhFrvc.exe
  2⤵
  PID:11968
- C:\Windows\System\uVMYGBc.exe
  C:\Windows\System\uVMYGBc.exe
  2⤵
  PID:11996
- C:\Windows\System\bshAdua.exe
  C:\Windows\System\bshAdua.exe
  2⤵
  PID:12036
- C:\Windows\System\XDpwFHV.exe
  C:\Windows\System\XDpwFHV.exe
  2⤵
  PID:12060
- C:\Windows\System\HBIDTWK.exe
  C:\Windows\System\HBIDTWK.exe
  2⤵
  PID:12080
- C:\Windows\System\znCCCQv.exe
  C:\Windows\System\znCCCQv.exe
  2⤵
  PID:12108
- C:\Windows\System\DYoGdBp.exe
  C:\Windows\System\DYoGdBp.exe
  2⤵
  PID:12140
- C:\Windows\System\lyvxoRy.exe
  C:\Windows\System\lyvxoRy.exe
  2⤵
  PID:12168
- C:\Windows\System\cEYopSS.exe
  C:\Windows\System\cEYopSS.exe
  2⤵
  PID:12196
- C:\Windows\System\pvtASaA.exe
  C:\Windows\System\pvtASaA.exe
  2⤵
  PID:12224
- C:\Windows\System\LwDNTwn.exe
  C:\Windows\System\LwDNTwn.exe
  2⤵
  PID:12252
- C:\Windows\System\bMQTCPL.exe
  C:\Windows\System\bMQTCPL.exe
  2⤵
  PID:12280
- C:\Windows\System\NfJtZXE.exe
  C:\Windows\System\NfJtZXE.exe
  2⤵
  PID:11308
- C:\Windows\System\OcvOTmN.exe
  C:\Windows\System\OcvOTmN.exe
  2⤵
  PID:11384
- C:\Windows\System\UGYNUli.exe
  C:\Windows\System\UGYNUli.exe
  2⤵
  PID:10008
- C:\Windows\System\EyPbTvZ.exe
  C:\Windows\System\EyPbTvZ.exe
  2⤵
  PID:10508
- C:\Windows\System\oJkSLVw.exe
  C:\Windows\System\oJkSLVw.exe
  2⤵
  PID:11448
- C:\Windows\System\pnFdljs.exe
  C:\Windows\System\pnFdljs.exe
  2⤵
  PID:11476
- C:\Windows\System\TjFBMDa.exe
  C:\Windows\System\TjFBMDa.exe
  2⤵
  PID:11584
- C:\Windows\System\opRNqbt.exe
  C:\Windows\System\opRNqbt.exe
  2⤵
  PID:11656
- C:\Windows\System\oruztxW.exe
  C:\Windows\System\oruztxW.exe
  2⤵
  PID:11736
- C:\Windows\System\OiRdcYz.exe
  C:\Windows\System\OiRdcYz.exe
  2⤵
  PID:11824
- C:\Windows\System\THqmQVz.exe
  C:\Windows\System\THqmQVz.exe
  2⤵
  PID:11872
- C:\Windows\System\pRAmcMa.exe
  C:\Windows\System\pRAmcMa.exe
  2⤵
  PID:11952
- C:\Windows\System\szZHVAy.exe
  C:\Windows\System\szZHVAy.exe
  2⤵
  PID:12032
- C:\Windows\System\NJnTIFv.exe
  C:\Windows\System\NJnTIFv.exe
  2⤵
  PID:4820
- C:\Windows\System\EivASaY.exe
  C:\Windows\System\EivASaY.exe
  2⤵
  PID:11684
- C:\Windows\System\jkVUvpJ.exe
  C:\Windows\System\jkVUvpJ.exe
  2⤵
  PID:12076
- C:\Windows\System\LNTOIxd.exe
  C:\Windows\System\LNTOIxd.exe
  2⤵
  PID:12180
- C:\Windows\System\iSnFQKn.exe
  C:\Windows\System\iSnFQKn.exe
  2⤵
  PID:12272
- C:\Windows\System\OzjjchB.exe
  C:\Windows\System\OzjjchB.exe
  2⤵
  PID:11364
- C:\Windows\System\opIFKsn.exe
  C:\Windows\System\opIFKsn.exe
  2⤵
  PID:11420
- C:\Windows\System\mxSHskx.exe
  C:\Windows\System\mxSHskx.exe
  2⤵
  PID:11572
- C:\Windows\System\WfIhvwN.exe
  C:\Windows\System\WfIhvwN.exe
  2⤵
  PID:11732
- C:\Windows\System\RkTyhMO.exe
  C:\Windows\System\RkTyhMO.exe
  2⤵
  PID:11908
- C:\Windows\System\zMppxXh.exe
  C:\Windows\System\zMppxXh.exe
  2⤵
  PID:2832
- C:\Windows\System\ZZCJhYb.exe
  C:\Windows\System\ZZCJhYb.exe
  2⤵
  PID:12072
- C:\Windows\System\KZRtdkC.exe
  C:\Windows\System\KZRtdkC.exe
  2⤵
  PID:12264
- C:\Windows\System\ctyxkba.exe
  C:\Windows\System\ctyxkba.exe
  2⤵
  PID:11468
- C:\Windows\System\jBaitGp.exe
  C:\Windows\System\jBaitGp.exe
  2⤵
  PID:11980
- C:\Windows\System\BhmHJqn.exe
  C:\Windows\System\BhmHJqn.exe
  2⤵
  PID:12068
- C:\Windows\System\nHFFZWt.exe
  C:\Windows\System\nHFFZWt.exe
  2⤵
  PID:11652
- C:\Windows\System\ZnKUHVg.exe
  C:\Windows\System\ZnKUHVg.exe
  2⤵
  PID:12020
- C:\Windows\System\WnjQHHl.exe
  C:\Windows\System\WnjQHHl.exe
  2⤵
  PID:12312
- C:\Windows\System\OHtmqIQ.exe
  C:\Windows\System\OHtmqIQ.exe
  2⤵
  PID:12340
- C:\Windows\System\MkldbCe.exe
  C:\Windows\System\MkldbCe.exe
  2⤵
  PID:12360
- C:\Windows\System\yuBlTvt.exe
  C:\Windows\System\yuBlTvt.exe
  2⤵
  PID:12388
- C:\Windows\System\HVQkWzI.exe
  C:\Windows\System\HVQkWzI.exe
  2⤵
  PID:12416
- C:\Windows\System\idNTLir.exe
  C:\Windows\System\idNTLir.exe
  2⤵
  PID:12444
- C:\Windows\System\ScCOKkT.exe
  C:\Windows\System\ScCOKkT.exe
  2⤵
  PID:12472
- C:\Windows\System\fZVGrmK.exe
  C:\Windows\System\fZVGrmK.exe
  2⤵
  PID:12500
- C:\Windows\System\LqXKJzl.exe
  C:\Windows\System\LqXKJzl.exe
  2⤵
  PID:12540
- C:\Windows\System\mSPiWVM.exe
  C:\Windows\System\mSPiWVM.exe
  2⤵
  PID:12556
- C:\Windows\System\gNkmvqR.exe
  C:\Windows\System\gNkmvqR.exe
  2⤵
  PID:12584
- C:\Windows\System\iGjNVrm.exe
  C:\Windows\System\iGjNVrm.exe
  2⤵
  PID:12612
- C:\Windows\System\MSNFjCp.exe
  C:\Windows\System\MSNFjCp.exe
  2⤵
  PID:12640
- C:\Windows\System\CdRzalT.exe
  C:\Windows\System\CdRzalT.exe
  2⤵
  PID:12668
- C:\Windows\System\evucmsp.exe
  C:\Windows\System\evucmsp.exe
  2⤵
  PID:12696
- C:\Windows\System\aDtymoX.exe
  C:\Windows\System\aDtymoX.exe
  2⤵
  PID:12724
- C:\Windows\System\zcmAimc.exe
  C:\Windows\System\zcmAimc.exe
  2⤵
  PID:12752
- C:\Windows\System\czuCxzS.exe
  C:\Windows\System\czuCxzS.exe
  2⤵
  PID:12780
- C:\Windows\System\DbCDUTQ.exe
  C:\Windows\System\DbCDUTQ.exe
  2⤵
  PID:12808
- C:\Windows\System\KaEKpZW.exe
  C:\Windows\System\KaEKpZW.exe
  2⤵
  PID:12836
- C:\Windows\System\EsWreWK.exe
  C:\Windows\System\EsWreWK.exe
  2⤵
  PID:12864
- C:\Windows\System\EQVKUPT.exe
  C:\Windows\System\EQVKUPT.exe
  2⤵
  PID:12892
- C:\Windows\System\cPCbuNT.exe
  C:\Windows\System\cPCbuNT.exe
  2⤵
  PID:12920
- C:\Windows\System\SPrOwUR.exe
  C:\Windows\System\SPrOwUR.exe
  2⤵
  PID:12948
- C:\Windows\System\JxnFsDQ.exe
  C:\Windows\System\JxnFsDQ.exe
  2⤵
  PID:12976
- C:\Windows\System\vAfJPoP.exe
  C:\Windows\System\vAfJPoP.exe
  2⤵
  PID:13004
- C:\Windows\System\EkKcIwY.exe
  C:\Windows\System\EkKcIwY.exe
  2⤵
  PID:13036
- C:\Windows\System\gULfHgS.exe
  C:\Windows\System\gULfHgS.exe
  2⤵
  PID:13064
- C:\Windows\System\nXTUxEb.exe
  C:\Windows\System\nXTUxEb.exe
  2⤵
  PID:13092
- C:\Windows\System\NeyJYEG.exe
  C:\Windows\System\NeyJYEG.exe
  2⤵
  PID:13120
- C:\Windows\System\EpqXHJY.exe
  C:\Windows\System\EpqXHJY.exe
  2⤵
  PID:13148
- C:\Windows\System\KVOQqns.exe
  C:\Windows\System\KVOQqns.exe
  2⤵
  PID:13176
- C:\Windows\System\eizeSyB.exe
  C:\Windows\System\eizeSyB.exe
  2⤵
  PID:13204
- C:\Windows\System\gmpGzAg.exe
  C:\Windows\System\gmpGzAg.exe
  2⤵
  PID:13232
- C:\Windows\System\OUKVBYb.exe
  C:\Windows\System\OUKVBYb.exe
  2⤵
  PID:13260
- C:\Windows\System\jXQcFob.exe
  C:\Windows\System\jXQcFob.exe
  2⤵
  PID:13288
- C:\Windows\System\AdHOrHx.exe
  C:\Windows\System\AdHOrHx.exe
  2⤵
  PID:12292
- C:\Windows\System\gUZxjwJ.exe
  C:\Windows\System\gUZxjwJ.exe
  2⤵
  PID:12352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_i2aln4lb.twf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i2aln4lb.twf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AnfHbgG.exe

Path C:\Windows\System\AnfHbgG.exe
Size 2.9MB
SHA256 ea13ee6cd7e1c9520ab7725826831fb1c3f2ca74017a4753c13b6affe59f2d06
MD5 20580dcc41f03a489efd4fb99d0d33d6
SHA1 5113f1539fd73ef9d12e40f5109d916478333013
SHA512 b5f92bb166b76619ef84575203150d3fa6d535ea4fd6f90fd70b638529e3caf21a70850027774249a96678bc1209a743726130735438a3276e04491a971d2689
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVX:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

BxqKKjn.exe

Path C:\Windows\System\BxqKKjn.exe
Size 2.9MB
SHA256 2a04222ebeb29977bbf645af7f45edb9e5c9c75e6f622942971ad8102b69ad16
MD5 b91421b817111a7ef3eb30a69f38f81d
SHA1 72265a428f6082e73c8c4edc472c0153d712749f
SHA512 dc59e3bb826c14563dc2b4bfa27d2869c98678adc06364c74e8170ca2daea69808c979f6a34d90576db2a80d844487f0b818d7aacab0c54cc41253cfbf873e8a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVq:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

CeemIxU.exe

Path C:\Windows\System\CeemIxU.exe
Size 2.9MB
SHA256 8a2abf3b8326eab9b9c826f6fa171974690dd7ec5a97d93a6d103383dc03c66e
MD5 417ba611dc3e1d83c4485db56045f3aa
SHA1 5cb2fd14237c37d095292205ea680f680f51991e
SHA512 ee91ad189610dcc51150bedfdd5671ab92d6151f0c8bab262eb21b56f862e5785b5ad040a9e0311103b9eee99c9023efbbc61fdd205f102715dc9869924be8ec
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVZ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

EtFmAcE.exe

Path C:\Windows\System\EtFmAcE.exe
Size 2.9MB
SHA256 2de9b692e4ee7f2e1c78642b1f2896db9fce663268c007ade9aaa50e1fa268df
MD5 7827942cd77096afcd0cf3c13648f81d
SHA1 80c491b660fbb11d44d5adb61b1a58938e601786
SHA512 2d475ee1941441510a15378ee678afa1815294aa21b02c73ef81fd7a4454f5e3ffe19f8b212ff0a87b00afca54ad8f1d3ee244a3a4f7219007311d760d31a4c6
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV8:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfrtHjS.exe

Path C:\Windows\System\FfrtHjS.exe
Size 2.9MB
SHA256 563a709af7166d710daf9b7b71ee71e7adfed4a89c67d5a71bfe4eed0a741f52
MD5 7e70d64eed9fc597271995361b5ced54
SHA1 c5a3cd5f632e2408085db7b05e509f4c4f78fe32
SHA512 601e600e8b3ece1f8bfbb300eedf297487748d1577f8c8b28512f693ae4252d9175b8b8ad125dbb3c2c23823bd3b77b76202abdb485bc07c992bf21673951d68
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVy:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

FgPswQg.exe

Path C:\Windows\System\FgPswQg.exe
Size 2.9MB
SHA256 5be72d3e4687bbe7e38a12843ede637837793ead1937a6526b890dcf977c8731
MD5 f11439d9b72dbad137dadace83ecf99e
SHA1 0c4e8ec96ce788cf34ae2f35b29e3b926576bc82
SHA512 52c2c382e22967bdb226b39a17d607495d9de986a4ed111c09032e8617a614d807cf7fc3efff6c28d94d7f0a25809111bc1b03a0a367b7407f0339734c00b61f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVG:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

GQckUAj.exe

Path C:\Windows\System\GQckUAj.exe
Size 2.9MB
SHA256 902fb5d2ff4dc4e053e545e0d54fc8ba327715ad89721f914e584842f2b02ccb
MD5 e958ef22bd957dbf01a0f9b14127c4ff
SHA1 8d52bd044bbba0810e91fb405ce399e7ef95eab2
SHA512 33c87fde9ad97ed40e9c23cde69855e7a70436da4eb94c51ec2570eae1ac89e3c25ce16962dab8fd0506cdce38b799a32ea03d98e1d84cf4f22c08321ede31ff
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVZ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

GujXmeB.exe

Path C:\Windows\System\GujXmeB.exe
Size 2.9MB
SHA256 7d729fbbbfd5e86b4bcc9cb853ea49b787da88bb06b2df71ff1df1aac588f841
MD5 ac8b3adc9e0c0ec5e922619b77ebdab1
SHA1 e07da1fac95e76916abfef0c6c4442b17e24f345
SHA512 dda1cc8da5e8de60b0de18de80e81d3e70acc15489ac6ba8220c79c1e8de0a644c90ca3e3a88594066f3a4e2cb6d4c79b9b480bae2ba66306b018897d8b03a5c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVy:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUagQUk.exe

Path C:\Windows\System\HUagQUk.exe
Size 2.9MB
SHA256 163dac3dd1d1ebb25994c1201803ba3ab4374e6a21b7b838579be1bde3639f89
MD5 5204291e2baec380f10753bd04d055a9
SHA1 08d5e347fed4764f9ad3acd29a4c32aaad4abd98
SHA512 8f74f7005803f437d882b5c4fd8df99b7efe441f1683bd28d483efeb043caba71c691e226b92bafe7e48c76f8b19eee2cb46e5c8e774d8d147e4d2ccb8d11302
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

JGnUHnm.exe

Path C:\Windows\System\JGnUHnm.exe
Size 2.9MB
SHA256 119f59a52279d8cbc3a39015c40ff02e30803fcc581a40fcdcb3ff098ae74e92
MD5 51e82bc3bd7d2b3de855de7aae2a98ab
SHA1 bf6aa07f819d79297f7fc3fa09cc4818f4457b31
SHA512 84e01a323d1afe07ab6c72853b4743ddc3ea1cbf200ee5aa823147a8b5bad8b8e0f7d27f66df51361ca14d860c8efec4e607ac6f367273f70333b7234a467eed
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

JgTbNdc.exe

Path C:\Windows\System\JgTbNdc.exe
Size 2.9MB
SHA256 80be7409b52f24f64105782640b3393d86498925a66adffdb527c971944df9f6
MD5 c6879d46036c1345e24f8d1ad95633aa
SHA1 02844f2f4508b0dff897e360b17c1d57dd0bb2af
SHA512 a9b2e37d5ab343d2a15161bc2c08d039b9978cf6f83268d9af76c89212bef2539ed083772df8594abc70736f53ede1fc549b0e9151f07c52450617876958439f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LfHGfqB.exe

Path C:\Windows\System\LfHGfqB.exe
Size 2.9MB
SHA256 d856a10dd96a2974271d6a1638c24e1a77add210781823ca3cece5e5be773fbd
MD5 a8105ed080a672a87bb0fd0cc9ab95e5
SHA1 6ef34be0218348f70d538087cbfb70b989303909
SHA512 626fbdd2cc4580c1e1befd9832c21581d54dc7c9ecf95f5c83fbc19eed90f3eef2c92a621f2f0e2e2af5007a7c957e9a7bba99c9fb43d0176c47f0b49ac5a046
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV3:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MbcGyDC.exe

Path C:\Windows\System\MbcGyDC.exe
Size 2.9MB
SHA256 7adc95a0d1dd04e4658b4dee50156edc3f5551483f01db294738ff1788f99fa5
MD5 3c6f0a72c2140b976716cba1e24ca2b7
SHA1 ac47deb9365c4750bf5fcd9a5561e16378ec4d66
SHA512 fe63adbc06d98c89f002b620b204f4fae00e26c60e2ea11806a4ba53186b38ed14fb86a5d6884a70ead47a5e49ecc3cfa5cd7ab733c7899dd144ff0be3c82fec
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

NdEjRIZ.exe

Path C:\Windows\System\NdEjRIZ.exe
Size 2.9MB
SHA256 ad4a819418c54fea0267c0e5709a838842f9dd0e235bd75e53300a19348cc98c
MD5 04335be3f22a7b398bff8be4335ed8e3
SHA1 9bca5e13b73eb84bdd8ffcb019a01c8f6bbbfe8d
SHA512 04e1f7e5c029ce7b2fab0480fe02a160c4cf1e5bf212f164ba292e64fd405a6b3d1315f5c233c504ae3cc9984e5458390e368ff524c1012edb9a0c245e6876da
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVl:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

PsTqftB.exe

Path C:\Windows\System\PsTqftB.exe
Size 2.9MB
SHA256 9650b65bd5b160a7d96db0197ebab8aeeade290998fdf0c242e40d5e6f4a462e
MD5 55a3a27f489da3b3df38d47a737598cc
SHA1 9b0cb6c1e57f94f5f4e825e29a85e072df01f573
SHA512 7d3d645d06362b30326e4421aa8e365ae2135d552d88569cbb65d012a1e01b0fa60618a0892fc4952ccd67fd7cc9c0bf8ae6fe64c26b9db84242cc3cf91ecb58
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

QoMimGa.exe

Path C:\Windows\System\QoMimGa.exe
Size 2.9MB
SHA256 fc3a088f444e7e9b2573bae944b0d4fd33c122904415c43c274d9e11f1fa474c
MD5 0429b47c12b14711623bc0c3458c3d72
SHA1 4707373d6c735ace33cfd2e3f6e221d43470a8e7
SHA512 2b46d3d76d3ace8f24c069036dab24b3d374baeceede967e04d294a86557ef3574bf7ed874f06bc9c97c2fcbc770d5e3d0aa0da236a95eab2bf9dd6dec4429bb
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

UjIBrcH.exe

Path C:\Windows\System\UjIBrcH.exe
Size 2.9MB
SHA256 f2e3cf074fd20624160ee22e47d6bbd8c5930d7f98de0d165ae348b122b54708
MD5 9a77167b4e69a556cb1a3ccce6361e9a
SHA1 1e279435317f349aa3d77d0ed5a733629c7eaddf
SHA512 f18a7d61441db214f6f78f13c67cbeeacbf62000f3e8f27c1ed026f73a0877d70ebd98f3a10f25bfe9d14d37528142371d13cad96c8cd3bbbcb23f4107874c85
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVL:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

YYDrhEA.exe

Path C:\Windows\System\YYDrhEA.exe
Size 2.9MB
SHA256 4fe710b4eaa41286093392fc2a7e8a4d5a766e93892dfe9b7ca8f79783d5cfca
MD5 4df797491ff8a18413e40e48e4668a79
SHA1 6ef606f8c570e6592ba6efc3a7bf696c36f2f131
SHA512 8b9a9be3c084555688c2fbf5ed2935cf336fafb4af365061c4ff8d40f0b95dd685cb5419b5aa43b92d37e1c00f2c6ef273e26782ead5c86ea321a3f013ff8696
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVt:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ylydjqo.exe

Path C:\Windows\System\Ylydjqo.exe
Size 2.9MB
SHA256 6987b730d88c826d9d81416e30e528fea8b7fbe60d1fa29286e0d102dea179db
MD5 935e702069efaacb41da6a9b3bd2f0ef
SHA1 1a7c3ed4a9e9fc03f98e3117b5441297d70dbac6
SHA512 e1a1216857de6ac824d122c680ac8fdd39da60e0f0c63f5ed8782f9013e12f08598bb4e6d773b3eb7dc6f521846cec9faf049f0a24320c520f5778cc24973c26
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVi:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXogIyX.exe

Path C:\Windows\System\eXogIyX.exe
Size 2.9MB
SHA256 5b3e57faa14e04bd31fc4cc06459aeec00dfb633fb246ebb570b02b27b4284d6
MD5 c46ad6a2d8411f0b6ea93172130e4c95
SHA1 b3004a506dfc375a7359d7957c14d422af519736
SHA512 1da16ad3aff8c4e540ba09168a21af5240e8a6d603c133ccb407883e6fc4ebb867b8b265b8f4e9e75620ebd6557cad932b93caa06861174f806f66c485dcd70c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVH:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

fHAoOSG.exe

Path C:\Windows\System\fHAoOSG.exe
Size 2.9MB
SHA256 c8cd1108598166b927581e3a025d368c3262f04a19d60148a3d68006ba0a20f5
MD5 b91c5fc32b35549b73c862ab05b6b16c
SHA1 4b2956ba12f0a30b14e7b26763b7e84f55db9a00
SHA512 c1b4307e93cd15bf2d001f55cb533e58177b55d450990570c5e8c249106f1ad7e3499bab675d7576f0406258ee4e43121e0c0b6094b50afe9c4721643284fe2e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

iDYIyrC.exe

Path C:\Windows\System\iDYIyrC.exe
Size 2.9MB
SHA256 95aeefed63adbaa3afaaf364f5a63d3d464ad914ef3b9a1c055fc2457305a0f6
MD5 cce0a6104400395297cc84afc75de202
SHA1 1ee2e0f139acb5536ef69911148c47a4ac5dccd2
SHA512 2c24be4424101067968766b9de9a2d5554b01328a8aaa198d17dd06a8e32030f84d1f68b0477a7188e3a8f73bcc00718fa35d35cd14d80806bf0cc12f67c0847
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV7:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lQwPgFN.exe

Path C:\Windows\System\lQwPgFN.exe
Size 8B
SHA256 76bc446e18daed4e6417440c778e757728762c893f014de08ffa5f0fe98668bd
MD5 68703642e5faeaf00b4b9f791a04a7f5
SHA1 2e8f5d51bda54b6b227caed2cb4535020c7a482c
SHA512 0c1919485a30576b5fdf963204dc04b356f524c23dfb4ffaecdbb8a8ea4a0993cf3ac05bee011edf07b5b637ac7455499983eac22f5cdd87cd869e7a046115a5
MD5 SHA1 SHA512

Submit Download

lkrNRcv.exe

Path C:\Windows\System\lkrNRcv.exe
Size 2.9MB
SHA256 9836b1082f2efeda7dc95d31b732025f563cb589dd93f020d583e7dd90b3d7ee
MD5 de1b30eccf9db26567e1984df22be376
SHA1 c01318c6b4823a8e1e3638cf363a919fe754d3fc
SHA512 026c1037bb02133454defbdd3ad7d4bf570e4606c4e6f2dc19863e321c4da3c5433aace8ec76d0473933482a107c9d2be52869269afe156302a43ca49ba0602f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV5:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCNwbnq.exe

Path C:\Windows\System\mCNwbnq.exe
Size 2.9MB
SHA256 18a83c7c4f125db2182ff699b6258e9535cd449f8df1a937eb8e99e56fb6a1b4
MD5 94707ca042a260b4868bc62d2f596add
SHA1 a0f8021690792b33f3bb94685ee43d806c32311e
SHA512 271044ccb77d594a2189a55b0217d55eca50819ebee86a25f41a9e52c4af495f87ef7abd309ad39a7007048e91bb50e05439db1f1849894c713b872d6669a93e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVA:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

owsTsek.exe

Path C:\Windows\System\owsTsek.exe
Size 2.9MB
SHA256 9c2d45499c60c0c9ee08eb9e7fddc8668e56e52e55950b8c89b95832b2e7260b
MD5 cb5aa066a12bc9f76d1d0bd6492d8f9e
SHA1 0ff7985d521c0285631d352dccdff29c35b6b0f8
SHA512 6c16405253e18677591646969235ec29bba357d45f831c8f0cd1f76d1bb5ea8964f14069495ef1fb8e1901d5ef5eb9810e3198ecb0f95be83c834692273dbe24
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVU:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

pCPQzdl.exe

Path C:\Windows\System\pCPQzdl.exe
Size 2.9MB
SHA256 68c3e81f4fa09acd6734af383139b9ffb50af994988da89608b610130ee312d4
MD5 400edff2bb122c0de308cff30962ef0a
SHA1 b368c54b0b3746a940907c82ce38ee874cbf0226
SHA512 8bea5fd630f633f214782396b213f5a4502fca5e370578e0b60859c6c02cf628f526d106f27834f7ea67d904199065e06dd552dc771cdd907366abf7ac38f689
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

rRfBZuB.exe

Path C:\Windows\System\rRfBZuB.exe
Size 2.9MB
SHA256 a56c317f584b678296a2bc1720159ff889e15fe6bccd4634440addeeac3a384e
MD5 c58ff3fc08fc9fbcf2afeee25259da61
SHA1 38a97841c8946f56a5f0c06d752485011e4cb9ec
SHA512 a2f8929104f2f24f30a345afa5b70eaa122ae159b391a77b96cadc1ed591efe1a6046aa8ba6732e09254828be85436ff80238cfd809957e24b070bc05c942365
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV6:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXmCKGJ.exe

Path C:\Windows\System\sXmCKGJ.exe
Size 2.9MB
SHA256 03564febf46467d27be49aa30c6264335c35ec4f3318369078623bfc9cc00055
MD5 85df39f8ebf08c38e72c9da86a06fed3
SHA1 b9ffe25d21d8d9b17aec033d4b37a87ea24c9491
SHA512 7d37378d96c1740ecd52439530006ec0255ee8a754f975ad34951b85e0ba67467c2cebc1223a3f2a3cc57e2501b237a37efec20d1b7231906ee8ca8dfc47096d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVe:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sjWpTAq.exe

Path C:\Windows\System\sjWpTAq.exe
Size 2.9MB
SHA256 f361d6a75027200499189abbd4b40fc19e5878365a8cb7d1fedeab81d5dcc493
MD5 817663d19c6f0271810e623fb823a753
SHA1 99764d61a569975026e5cc442263cfec904abad9
SHA512 4489e8955599aae712149c1c6194dc975522a8cd3edd81feadaa39238388391be14f9156de02fed0671f1dca5d8b2c93a17971f9e31354c2f13cad72395d4380
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVl:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

twBhife.exe

Path C:\Windows\System\twBhife.exe
Size 2.9MB
SHA256 55cd11e82d353855958788b15d2ad982250627ed91a67f358d3b8d4f1ff11c84
MD5 a08449c6fa606ed92b76a7196d6113d1
SHA1 85f064b6d5b2fb25556b54fdafbf641689549a97
SHA512 f3fedb70e387eab5876bcb63bb3f1f51416f7f2147973b2be527dcfc598d1f5f7b93fbae6218700e7f6192339ef0ddb2b526cc8a9ba16606f5132bd55dee2782
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVq:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

wPEjBHG.exe

Path C:\Windows\System\wPEjBHG.exe
Size 2.9MB
SHA256 6a1636c0bf449c8bf513bb2cdde039000c4335dd291b92052c59e43c1dfa98d9
MD5 386599a823edc14fb0a2d9db864f2f8c
SHA1 d70f7079d415ede6e6968a84dc93ffd926ac9a6d
SHA512 9d851cb93509713cc21f95421b806a2ac0402006dea9393d2f69b97c6ebe0c62b1e81a2df699660eb1f3f78ce5f02341938f782cdc7413f78a9c9a7597234cd9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVX:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

wxCpkpj.exe

Path C:\Windows\System\wxCpkpj.exe
Size 2.9MB
SHA256 1e8ab3bc7bed9aaf16d73bc8e09b9347ccdb8a2c811d3042366491f290475296
MD5 affbaea90b62173f7fd5f3f12604e852
SHA1 4d9e21e253a18d0bc367f3e37d44f33b89228e71
SHA512 a7f97e3bb13249134e933a0ab651de809bebff5a30d0bd8b6f87525ed4fa71041581e376b15c554d9fe67f4b49819b268c61ba1220922f64eb45a365333c776e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHV7:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xDaBvJd.exe

Path C:\Windows\System\xDaBvJd.exe
Size 2.9MB
SHA256 5cddbd431369626f4859266c8fefc0a9436e7e74dd3b3d2cbe2f98bc7cf3bd67
MD5 27386449a4cfe0c0d95c84e6725c1ba0
SHA1 acc3d74193c887c5731125ea61493eea8ef57f99
SHA512 10c11aef45b40e92bde9e3bc8cfc7d9d0ecb9bd5d650ca974d65cee5bda23c5bd949e978ce20327cfd71fbf97b6caaa2c0478bcc4dce83c45184deddad558785
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

yMEECiQ.exe

Path C:\Windows\System\yMEECiQ.exe
Size 2.9MB
SHA256 a1baa9a80e4ff007bd5be45648c20214a5422f7961e204b41c99afeb764249b4
MD5 cf96ad6edf572748137bfb490101756f
SHA1 8b44eca124f6276f372fdc5aa046411a5cccd931
SHA512 88f329a0735f91a5f4c088f84b68cb6fcdf0c92cb697ea997d17384f72876d5e1438a8d679c2ccc80f5c3d65fa64ae49f7b3c566cf9dfea28731c945b4089f2c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

yrmfvbe.exe

Path C:\Windows\System\yrmfvbe.exe
Size 2.9MB
SHA256 a3a582bc7503797fb6c2a31a0e6f73583fc6d0221b00d48374268d273aa4b734
MD5 fad8771b44b4c2023f8b3be259a1f2ab
SHA1 723d5b29c01166b2371f125210c53336b1d3054d
SHA512 edacb1d5ac4b6bd4200c5e3997f97f3ce6f6a23073d40888fd2a0dd4b87c194cbec51660e2ff3581bfa341718f67152b12ce14487a6a225da3406fcd060e8369
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVf:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

zoUXHGE.exe

Path C:\Windows\System\zoUXHGE.exe
Size 2.9MB
SHA256 60a55e92256bdd7ff80004e282279229442df7cca23bd19815c9cd2de22daabd
MD5 b51da2acd8dd7f17a6affdc46831aed7
SHA1 7969872adf41e15eca7fb2d1981c97665975ce42
SHA512 57ab12835bb460bdaa33274e134ab6ceb7818759de8c647c8f6a16d5d125a0386486a29b2d4173e69eeb9365557bb014880981df02c20ee435fb2759f8e00338
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHVs:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-150-0x00007FF619850000-0x00007FF619C46000-memory.dmp

Download

memory/384-2240-0x00007FF619850000-0x00007FF619C46000-memory.dmp

Download

memory/392-2258-0x00007FF6B4400000-0x00007FF6B47F6000-memory.dmp

Download

memory/392-205-0x00007FF6B4400000-0x00007FF6B47F6000-memory.dmp

Download

memory/396-2243-0x00007FF7FE120000-0x00007FF7FE516000-memory.dmp

Download

memory/396-151-0x00007FF7FE120000-0x00007FF7FE516000-memory.dmp

Download

memory/1080-210-0x00007FF6E96C0000-0x00007FF6E9AB6000-memory.dmp

Download

memory/1080-2250-0x00007FF6E96C0000-0x00007FF6E9AB6000-memory.dmp

Download

memory/1108-189-0x00007FF79A590000-0x00007FF79A986000-memory.dmp

Download

memory/1108-2252-0x00007FF79A590000-0x00007FF79A986000-memory.dmp

Download

memory/1300-209-0x00007FF6D7890000-0x00007FF6D7C86000-memory.dmp

Download

memory/1300-2248-0x00007FF6D7890000-0x00007FF6D7C86000-memory.dmp

Download

memory/1420-2237-0x00007FF7ADC20000-0x00007FF7AE016000-memory.dmp

Download

memory/1420-206-0x00007FF7ADC20000-0x00007FF7AE016000-memory.dmp

Download

memory/1516-190-0x00007FF606DD0000-0x00007FF6071C6000-memory.dmp

Download

memory/1516-2251-0x00007FF606DD0000-0x00007FF6071C6000-memory.dmp

Download

memory/2112-2254-0x00007FF76D920000-0x00007FF76DD16000-memory.dmp

Download

memory/2112-211-0x00007FF76D920000-0x00007FF76DD16000-memory.dmp

Download

memory/2652-2236-0x00007FF6ADFD0000-0x00007FF6AE3C6000-memory.dmp

Download

memory/2652-87-0x00007FF6ADFD0000-0x00007FF6AE3C6000-memory.dmp

Download

memory/3100-2259-0x00007FF602DF0000-0x00007FF6031E6000-memory.dmp

Download

memory/3100-204-0x00007FF602DF0000-0x00007FF6031E6000-memory.dmp

Download

memory/3212-2247-0x00007FF7B72A0000-0x00007FF7B7696000-memory.dmp

Download

memory/3212-155-0x00007FF7B72A0000-0x00007FF7B7696000-memory.dmp

Download

memory/3352-139-0x00007FF62D1F0000-0x00007FF62D5E6000-memory.dmp

Download

memory/3352-2241-0x00007FF62D1F0000-0x00007FF62D5E6000-memory.dmp

Download

memory/3656-2249-0x00007FF71B7B0000-0x00007FF71BBA6000-memory.dmp

Download

memory/3656-164-0x00007FF71B7B0000-0x00007FF71BBA6000-memory.dmp

Download

memory/3836-1-0x000001C3F2F30000-0x000001C3F2F40000-memory.dmp

Download

memory/3836-0-0x00007FF705DD0000-0x00007FF7061C6000-memory.dmp

Download

memory/3884-99-0x00007FF6863A0000-0x00007FF686796000-memory.dmp

Download

memory/3884-2239-0x00007FF6863A0000-0x00007FF686796000-memory.dmp

Download

memory/3908-208-0x00007FF6ED940000-0x00007FF6EDD36000-memory.dmp

Download

memory/3908-2246-0x00007FF6ED940000-0x00007FF6EDD36000-memory.dmp

Download

memory/4084-77-0x00007FF603FF0000-0x00007FF6043E6000-memory.dmp

Download

memory/4084-2238-0x00007FF603FF0000-0x00007FF6043E6000-memory.dmp

Download

memory/4148-138-0x00007FF6DD630000-0x00007FF6DDA26000-memory.dmp

Download

memory/4148-2242-0x00007FF6DD630000-0x00007FF6DDA26000-memory.dmp

Download

memory/4164-2255-0x00007FF7EBFA0000-0x00007FF7EC396000-memory.dmp

Download

memory/4164-202-0x00007FF7EBFA0000-0x00007FF7EC396000-memory.dmp

Download

memory/4172-200-0x00007FF7A8670000-0x00007FF7A8A66000-memory.dmp

Download

memory/4172-2256-0x00007FF7A8670000-0x00007FF7A8A66000-memory.dmp

Download

memory/4360-2253-0x00007FF6111D0000-0x00007FF6115C6000-memory.dmp

Download

memory/4360-195-0x00007FF6111D0000-0x00007FF6115C6000-memory.dmp

Download

memory/4380-2245-0x00007FF7DFBD0000-0x00007FF7DFFC6000-memory.dmp

Download

memory/4380-143-0x00007FF7DFBD0000-0x00007FF7DFFC6000-memory.dmp

Download

memory/4464-5-0x00007FFC36DE3000-0x00007FFC36DE5000-memory.dmp

Download

memory/4464-251-0x000001F6FE460000-0x000001F6FEC06000-memory.dmp

Download

memory/4464-36-0x000001F6FD330000-0x000001F6FD352000-memory.dmp

Download

memory/4464-2235-0x00007FFC36DE3000-0x00007FFC36DE5000-memory.dmp

Download

memory/4464-65-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp

Download

memory/4464-2234-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp

Download

memory/4464-43-0x00007FFC36DE0000-0x00007FFC378A1000-memory.dmp

Download

memory/4952-203-0x00007FF688770000-0x00007FF688B66000-memory.dmp

Download

memory/4952-2257-0x00007FF688770000-0x00007FF688B66000-memory.dmp

Download

memory/5064-207-0x00007FF7C7280000-0x00007FF7C7676000-memory.dmp

Download

memory/5064-2244-0x00007FF7C7280000-0x00007FF7C7676000-memory.dmp

Download