xmrig | b79fcf6bdb4e551986cad188e2845b4da6d027e223ecb64f5262a9c9c011d39e

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
Size 4.2MB
Sample240522-zckapsfg23
SHA256 b79fcf6bdb4e551986cad188e2845b4da6d027e223ecb64f5262a9c9c011d39e
MD5 352667279e7528eb349a2d98375a4fe0
SHA1 10617a740cba4bba2cf2966551f6a2929776759a
SHA512 1095c36101528251c4d20812d9e16bcaeaec6fc69c71eeef931f0cdb9c866589ea0eec7a6dbdc3f67c906dfe3c229ad882afb765e478ea9b54844cd38b280ada
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:SbBeSFkt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4160-0-0x00007FF79B6A0000-0x00007FF79BA96000-memory.dmp	xmrig
behavioral2/files/0x00070000000235e3-7.dat	xmrig
behavioral2/memory/1920-17-0x00007FF61C260000-0x00007FF61C656000-memory.dmp	xmrig
behavioral2/memory/4656-24-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235e5-28.dat	xmrig
behavioral2/memory/1416-29-0x00007FF683540000-0x00007FF683936000-memory.dmp	xmrig
behavioral2/files/0x00070000000235e8-45.dat	xmrig
behavioral2/files/0x00070000000235ea-55.dat	xmrig
behavioral2/files/0x00070000000235ed-70.dat	xmrig
behavioral2/files/0x00070000000235f7-118.dat	xmrig
behavioral2/files/0x00070000000235fb-144.dat	xmrig
behavioral2/files/0x00070000000235fe-159.dat	xmrig
behavioral2/files/0x0007000000023601-168.dat	xmrig
behavioral2/files/0x00070000000235ff-164.dat	xmrig
behavioral2/files/0x0007000000023600-163.dat	xmrig
behavioral2/files/0x00070000000235fd-154.dat	xmrig
behavioral2/files/0x00070000000235fc-149.dat	xmrig
behavioral2/files/0x00070000000235fa-139.dat	xmrig
behavioral2/files/0x00070000000235f9-133.dat	xmrig
behavioral2/files/0x00070000000235f8-129.dat	xmrig
behavioral2/files/0x00070000000235f6-119.dat	xmrig
behavioral2/files/0x00070000000235f5-113.dat	xmrig
behavioral2/files/0x00070000000235f4-109.dat	xmrig
behavioral2/files/0x00070000000235f3-104.dat	xmrig
behavioral2/files/0x00070000000235f2-99.dat	xmrig
behavioral2/files/0x00070000000235f1-94.dat	xmrig
behavioral2/files/0x00070000000235f0-86.dat	xmrig
behavioral2/files/0x00070000000235ef-83.dat	xmrig
behavioral2/files/0x00070000000235ee-79.dat	xmrig
behavioral2/files/0x00070000000235ec-68.dat	xmrig
behavioral2/files/0x00070000000235eb-61.dat	xmrig
behavioral2/files/0x00070000000235e9-53.dat	xmrig
behavioral2/files/0x00070000000235e7-43.dat	xmrig
behavioral2/files/0x00070000000235e6-39.dat	xmrig
behavioral2/memory/3496-32-0x00007FF7FD090000-0x00007FF7FD486000-memory.dmp	xmrig
behavioral2/files/0x00070000000235e4-23.dat	xmrig
behavioral2/files/0x00070000000235e2-15.dat	xmrig
behavioral2/memory/4480-11-0x00007FF7CCBF0000-0x00007FF7CCFE6000-memory.dmp	xmrig
behavioral2/files/0x00080000000235de-8.dat	xmrig
behavioral2/memory/1004-897-0x00007FF739420000-0x00007FF739816000-memory.dmp	xmrig
behavioral2/memory/1604-904-0x00007FF75CEA0000-0x00007FF75D296000-memory.dmp	xmrig
behavioral2/memory/412-911-0x00007FF653400000-0x00007FF6537F6000-memory.dmp	xmrig
behavioral2/memory/1888-952-0x00007FF7FEDE0000-0x00007FF7FF1D6000-memory.dmp	xmrig
behavioral2/memory/1548-951-0x00007FF77CF70000-0x00007FF77D366000-memory.dmp	xmrig
behavioral2/memory/3836-941-0x00007FF621E60000-0x00007FF622256000-memory.dmp	xmrig
behavioral2/memory/3616-926-0x00007FF6F29E0000-0x00007FF6F2DD6000-memory.dmp	xmrig
behavioral2/memory/1836-925-0x00007FF6E3450000-0x00007FF6E3846000-memory.dmp	xmrig
behavioral2/memory/1996-922-0x00007FF6812B0000-0x00007FF6816A6000-memory.dmp	xmrig
behavioral2/memory/4436-921-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp	xmrig
behavioral2/memory/1492-914-0x00007FF681F20000-0x00007FF682316000-memory.dmp	xmrig
behavioral2/memory/5088-905-0x00007FF68AA70000-0x00007FF68AE66000-memory.dmp	xmrig
behavioral2/memory/2588-959-0x00007FF704E00000-0x00007FF7051F6000-memory.dmp	xmrig
behavioral2/memory/1860-962-0x00007FF61CD50000-0x00007FF61D146000-memory.dmp	xmrig
behavioral2/memory/1756-967-0x00007FF73A0A0000-0x00007FF73A496000-memory.dmp	xmrig
behavioral2/memory/3628-966-0x00007FF686950000-0x00007FF686D46000-memory.dmp	xmrig
behavioral2/memory/2744-961-0x00007FF6A4D80000-0x00007FF6A5176000-memory.dmp	xmrig
behavioral2/memory/4304-893-0x00007FF7593D0000-0x00007FF7597C6000-memory.dmp	xmrig
behavioral2/memory/3152-892-0x00007FF6AB920000-0x00007FF6ABD16000-memory.dmp	xmrig
behavioral2/memory/1920-1892-0x00007FF61C260000-0x00007FF61C656000-memory.dmp	xmrig
behavioral2/memory/4656-1947-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp	xmrig
behavioral2/memory/4480-2129-0x00007FF7CCBF0000-0x00007FF7CCFE6000-memory.dmp	xmrig
behavioral2/memory/1920-2130-0x00007FF61C260000-0x00007FF61C656000-memory.dmp	xmrig
behavioral2/memory/4656-2131-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp	xmrig
behavioral2/memory/1416-2132-0x00007FF683540000-0x00007FF683936000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	552	powershell.exe
12	552	powershell.exe
22	552	powershell.exe
23	552	powershell.exe
26	552	powershell.exe
27	552	powershell.exe
28	552	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
552	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4480	mbGMAYA.exe
1920	JxuabVM.exe
4656	ceiWnQM.exe
1416	vvEjkUX.exe
3496	DYqkZym.exe
3152	VxwHFux.exe
4304	FhMBbAn.exe
1004	NhrHuWA.exe
1604	TKeQwqX.exe
5088	JfCWCis.exe
412	VMLjTyg.exe
1492	HpNbvij.exe
4436	ZZEEqDY.exe
1996	FguPvjf.exe
1836	FbelNZl.exe
3616	UxCBWtW.exe
3836	fFkZYih.exe
1548	SQLDMQh.exe
1888	zGwfarj.exe
2588	oqeCJtp.exe
2744	hciMMxR.exe
1860	gcymRua.exe
3628	KEBqTFK.exe
1756	zCZUNYN.exe
768	COZXWxt.exe
4540	UrgXHfM.exe
728	gWcqhBP.exe
1780	FrwIXkE.exe
4532	gDVGRzF.exe
3724	gapwotm.exe
4288	QjtqjXe.exe
2376	GwHLrzW.exe
2820	cXgkNdH.exe
3148	ZDdgrUA.exe
5012	wCGkTxo.exe
3484	ALZhktL.exe
3720	kWkGkCR.exe
4952	SZJbzGU.exe
1132	iZAyjfu.exe
1892	LdAaeUz.exe
3024	KwoJqoz.exe
4004	SDSqWEY.exe
1616	muuuqfT.exe
5124	VjUurhW.exe
5152	jDpZkZa.exe
5180	YeQXzLF.exe
5208	svQJcDT.exe
5236	dcaRJfk.exe
5264	YZhaMVx.exe
5296	tFGPImw.exe
5320	QqSMnTg.exe
5348	FySJJFf.exe
5376	usBXLqd.exe
5404	LXauiZa.exe
5432	IUiswDd.exe
5460	JgbUccf.exe
5488	RievvIX.exe
5516	goRAPtb.exe
5556	tBptcWx.exe
5584	LrGdPkg.exe
5612	tDTYWfO.exe
5640	gzwpOEL.exe
5668	eyVTZcq.exe
5696	DQSsTDY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4160-0-0x00007FF79B6A0000-0x00007FF79BA96000-memory.dmp	upx
behavioral2/files/0x00070000000235e3-7.dat	upx
behavioral2/memory/1920-17-0x00007FF61C260000-0x00007FF61C656000-memory.dmp	upx
behavioral2/memory/4656-24-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp	upx
behavioral2/files/0x00070000000235e5-28.dat	upx
behavioral2/memory/1416-29-0x00007FF683540000-0x00007FF683936000-memory.dmp	upx
behavioral2/files/0x00070000000235e8-45.dat	upx
behavioral2/files/0x00070000000235ea-55.dat	upx
behavioral2/files/0x00070000000235ed-70.dat	upx
behavioral2/files/0x00070000000235f7-118.dat	upx
behavioral2/files/0x00070000000235fb-144.dat	upx
behavioral2/files/0x00070000000235fe-159.dat	upx
behavioral2/files/0x0007000000023601-168.dat	upx
behavioral2/files/0x00070000000235ff-164.dat	upx
behavioral2/files/0x0007000000023600-163.dat	upx
behavioral2/files/0x00070000000235fd-154.dat	upx
behavioral2/files/0x00070000000235fc-149.dat	upx
behavioral2/files/0x00070000000235fa-139.dat	upx
behavioral2/files/0x00070000000235f9-133.dat	upx
behavioral2/files/0x00070000000235f8-129.dat	upx
behavioral2/files/0x00070000000235f6-119.dat	upx
behavioral2/files/0x00070000000235f5-113.dat	upx
behavioral2/files/0x00070000000235f4-109.dat	upx
behavioral2/files/0x00070000000235f3-104.dat	upx
behavioral2/files/0x00070000000235f2-99.dat	upx
behavioral2/files/0x00070000000235f1-94.dat	upx
behavioral2/files/0x00070000000235f0-86.dat	upx
behavioral2/files/0x00070000000235ef-83.dat	upx
behavioral2/files/0x00070000000235ee-79.dat	upx
behavioral2/files/0x00070000000235ec-68.dat	upx
behavioral2/files/0x00070000000235eb-61.dat	upx
behavioral2/files/0x00070000000235e9-53.dat	upx
behavioral2/files/0x00070000000235e7-43.dat	upx
behavioral2/files/0x00070000000235e6-39.dat	upx
behavioral2/memory/3496-32-0x00007FF7FD090000-0x00007FF7FD486000-memory.dmp	upx
behavioral2/files/0x00070000000235e4-23.dat	upx
behavioral2/files/0x00070000000235e2-15.dat	upx
behavioral2/memory/4480-11-0x00007FF7CCBF0000-0x00007FF7CCFE6000-memory.dmp	upx
behavioral2/files/0x00080000000235de-8.dat	upx
behavioral2/memory/1004-897-0x00007FF739420000-0x00007FF739816000-memory.dmp	upx
behavioral2/memory/1604-904-0x00007FF75CEA0000-0x00007FF75D296000-memory.dmp	upx
behavioral2/memory/412-911-0x00007FF653400000-0x00007FF6537F6000-memory.dmp	upx
behavioral2/memory/1888-952-0x00007FF7FEDE0000-0x00007FF7FF1D6000-memory.dmp	upx
behavioral2/memory/1548-951-0x00007FF77CF70000-0x00007FF77D366000-memory.dmp	upx
behavioral2/memory/3836-941-0x00007FF621E60000-0x00007FF622256000-memory.dmp	upx
behavioral2/memory/3616-926-0x00007FF6F29E0000-0x00007FF6F2DD6000-memory.dmp	upx
behavioral2/memory/1836-925-0x00007FF6E3450000-0x00007FF6E3846000-memory.dmp	upx
behavioral2/memory/1996-922-0x00007FF6812B0000-0x00007FF6816A6000-memory.dmp	upx
behavioral2/memory/4436-921-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp	upx
behavioral2/memory/1492-914-0x00007FF681F20000-0x00007FF682316000-memory.dmp	upx
behavioral2/memory/5088-905-0x00007FF68AA70000-0x00007FF68AE66000-memory.dmp	upx
behavioral2/memory/2588-959-0x00007FF704E00000-0x00007FF7051F6000-memory.dmp	upx
behavioral2/memory/1860-962-0x00007FF61CD50000-0x00007FF61D146000-memory.dmp	upx
behavioral2/memory/1756-967-0x00007FF73A0A0000-0x00007FF73A496000-memory.dmp	upx
behavioral2/memory/3628-966-0x00007FF686950000-0x00007FF686D46000-memory.dmp	upx
behavioral2/memory/2744-961-0x00007FF6A4D80000-0x00007FF6A5176000-memory.dmp	upx
behavioral2/memory/4304-893-0x00007FF7593D0000-0x00007FF7597C6000-memory.dmp	upx
behavioral2/memory/3152-892-0x00007FF6AB920000-0x00007FF6ABD16000-memory.dmp	upx
behavioral2/memory/1920-1892-0x00007FF61C260000-0x00007FF61C656000-memory.dmp	upx
behavioral2/memory/4656-1947-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp	upx
behavioral2/memory/4480-2129-0x00007FF7CCBF0000-0x00007FF7CCFE6000-memory.dmp	upx
behavioral2/memory/1920-2130-0x00007FF61C260000-0x00007FF61C656000-memory.dmp	upx
behavioral2/memory/4656-2131-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp	upx
behavioral2/memory/1416-2132-0x00007FF683540000-0x00007FF683936000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bmgfxDW.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\dECTkqy.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\agvzYfn.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\zXUBDMz.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\lRXTReK.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\gvxoEzy.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\YBVYHed.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\mknIKww.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\uRLAIGW.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcXzZwJ.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\dNiaOUM.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\NgClIuz.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\jdWxYbu.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\JDLboCW.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\UYNzWUn.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\bdmeaac.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\npzeMIT.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\igxYCYL.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\doPSZPO.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\HZWCgPc.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\VTWaVnW.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\WMnySdu.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ywmtucZ.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\eHbZysz.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\XRZhDeP.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\GzmLhMr.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vdWwyVg.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\fYGUhIo.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\hshksun.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\taLIBKV.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\TAqTHzm.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ALZhktL.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\tLQqnYD.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\zQYZDGn.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\yvjfmbb.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\slECOmm.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\BIiuBHF.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\svQJcDT.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\wobVVwX.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\BuguARc.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\HAaZMEL.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vVLJdnI.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\DGcPxgc.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\tFxrCWU.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vAWbNmC.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\IkSuEKF.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\XzgyPlk.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\huKGDyc.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\UbZhyxK.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\rPfvGII.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\nlZsnIQ.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\pdWKlkg.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\JfCWCis.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\MPnKOWo.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\vWTcinw.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\TJyEYhq.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\ZkezekB.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\fNvBauM.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\LCozTdD.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\TvundfW.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\CHWuFvR.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\suQUZLz.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\BqeAQrQ.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
File created	C:\Windows\System\FhMBbAn.exe	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
552	powershell.exe
552	powershell.exe
552	powershell.exe
552	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
Token: SeDebugPrivilege	552	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 552	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	93
PID 4160 wrote to memory of 552	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	93
PID 4160 wrote to memory of 4480	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	94
PID 4160 wrote to memory of 4480	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	94
PID 4160 wrote to memory of 1920	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	95
PID 4160 wrote to memory of 1920	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	95
PID 4160 wrote to memory of 4656	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	96
PID 4160 wrote to memory of 4656	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	96
PID 4160 wrote to memory of 1416	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	97
PID 4160 wrote to memory of 1416	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	97
PID 4160 wrote to memory of 3496	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	98
PID 4160 wrote to memory of 3496	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	98
PID 4160 wrote to memory of 3152	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	99
PID 4160 wrote to memory of 3152	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	99
PID 4160 wrote to memory of 4304	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	100
PID 4160 wrote to memory of 4304	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	100
PID 4160 wrote to memory of 1004	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	101
PID 4160 wrote to memory of 1004	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	101
PID 4160 wrote to memory of 1604	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	102
PID 4160 wrote to memory of 1604	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	102
PID 4160 wrote to memory of 5088	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	103
PID 4160 wrote to memory of 5088	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	103
PID 4160 wrote to memory of 412	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	104
PID 4160 wrote to memory of 412	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	104
PID 4160 wrote to memory of 1492	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	105
PID 4160 wrote to memory of 1492	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	105
PID 4160 wrote to memory of 4436	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	106
PID 4160 wrote to memory of 4436	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	106
PID 4160 wrote to memory of 1996	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	107
PID 4160 wrote to memory of 1996	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	107
PID 4160 wrote to memory of 1836	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	108
PID 4160 wrote to memory of 1836	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	108
PID 4160 wrote to memory of 3616	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	109
PID 4160 wrote to memory of 3616	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	109
PID 4160 wrote to memory of 3836	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	110
PID 4160 wrote to memory of 3836	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	110
PID 4160 wrote to memory of 1548	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	111
PID 4160 wrote to memory of 1548	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	111
PID 4160 wrote to memory of 1888	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	112
PID 4160 wrote to memory of 1888	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	112
PID 4160 wrote to memory of 2588	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	113
PID 4160 wrote to memory of 2588	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	113
PID 4160 wrote to memory of 2744	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	114
PID 4160 wrote to memory of 2744	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	114
PID 4160 wrote to memory of 1860	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	115
PID 4160 wrote to memory of 1860	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	115
PID 4160 wrote to memory of 3628	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	116
PID 4160 wrote to memory of 3628	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	116
PID 4160 wrote to memory of 1756	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	117
PID 4160 wrote to memory of 1756	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	117
PID 4160 wrote to memory of 768	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	118
PID 4160 wrote to memory of 768	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	118
PID 4160 wrote to memory of 4540	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	119
PID 4160 wrote to memory of 4540	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	119
PID 4160 wrote to memory of 728	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	120
PID 4160 wrote to memory of 728	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	120
PID 4160 wrote to memory of 1780	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	121
PID 4160 wrote to memory of 1780	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	121
PID 4160 wrote to memory of 4532	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	122
PID 4160 wrote to memory of 4532	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	122
PID 4160 wrote to memory of 3724	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	123
PID 4160 wrote to memory of 3724	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	123
PID 4160 wrote to memory of 4288	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	124
PID 4160 wrote to memory of 4288	4160	352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\352667279e7528eb349a2d98375a4fe0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System\mbGMAYA.exe
  C:\Windows\System\mbGMAYA.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\JxuabVM.exe
  C:\Windows\System\JxuabVM.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\ceiWnQM.exe
  C:\Windows\System\ceiWnQM.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\vvEjkUX.exe
  C:\Windows\System\vvEjkUX.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\DYqkZym.exe
  C:\Windows\System\DYqkZym.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\VxwHFux.exe
  C:\Windows\System\VxwHFux.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\FhMBbAn.exe
  C:\Windows\System\FhMBbAn.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\NhrHuWA.exe
  C:\Windows\System\NhrHuWA.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\TKeQwqX.exe
  C:\Windows\System\TKeQwqX.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\JfCWCis.exe
  C:\Windows\System\JfCWCis.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\VMLjTyg.exe
  C:\Windows\System\VMLjTyg.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\HpNbvij.exe
  C:\Windows\System\HpNbvij.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ZZEEqDY.exe
  C:\Windows\System\ZZEEqDY.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\FguPvjf.exe
  C:\Windows\System\FguPvjf.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FbelNZl.exe
  C:\Windows\System\FbelNZl.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\UxCBWtW.exe
  C:\Windows\System\UxCBWtW.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\fFkZYih.exe
  C:\Windows\System\fFkZYih.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\SQLDMQh.exe
  C:\Windows\System\SQLDMQh.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\zGwfarj.exe
  C:\Windows\System\zGwfarj.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\oqeCJtp.exe
  C:\Windows\System\oqeCJtp.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\hciMMxR.exe
  C:\Windows\System\hciMMxR.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\gcymRua.exe
  C:\Windows\System\gcymRua.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\KEBqTFK.exe
  C:\Windows\System\KEBqTFK.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\zCZUNYN.exe
  C:\Windows\System\zCZUNYN.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\COZXWxt.exe
  C:\Windows\System\COZXWxt.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\UrgXHfM.exe
  C:\Windows\System\UrgXHfM.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\gWcqhBP.exe
  C:\Windows\System\gWcqhBP.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\FrwIXkE.exe
  C:\Windows\System\FrwIXkE.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\gDVGRzF.exe
  C:\Windows\System\gDVGRzF.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\gapwotm.exe
  C:\Windows\System\gapwotm.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\QjtqjXe.exe
  C:\Windows\System\QjtqjXe.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\GwHLrzW.exe
  C:\Windows\System\GwHLrzW.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\cXgkNdH.exe
  C:\Windows\System\cXgkNdH.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ZDdgrUA.exe
  C:\Windows\System\ZDdgrUA.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\wCGkTxo.exe
  C:\Windows\System\wCGkTxo.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\ALZhktL.exe
  C:\Windows\System\ALZhktL.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\kWkGkCR.exe
  C:\Windows\System\kWkGkCR.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\SZJbzGU.exe
  C:\Windows\System\SZJbzGU.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\iZAyjfu.exe
  C:\Windows\System\iZAyjfu.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\LdAaeUz.exe
  C:\Windows\System\LdAaeUz.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\KwoJqoz.exe
  C:\Windows\System\KwoJqoz.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\SDSqWEY.exe
  C:\Windows\System\SDSqWEY.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\muuuqfT.exe
  C:\Windows\System\muuuqfT.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\VjUurhW.exe
  C:\Windows\System\VjUurhW.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\jDpZkZa.exe
  C:\Windows\System\jDpZkZa.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\YeQXzLF.exe
  C:\Windows\System\YeQXzLF.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\svQJcDT.exe
  C:\Windows\System\svQJcDT.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\dcaRJfk.exe
  C:\Windows\System\dcaRJfk.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\YZhaMVx.exe
  C:\Windows\System\YZhaMVx.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\tFGPImw.exe
  C:\Windows\System\tFGPImw.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\QqSMnTg.exe
  C:\Windows\System\QqSMnTg.exe
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Windows\System\FySJJFf.exe
  C:\Windows\System\FySJJFf.exe
  2⤵
  - Executes dropped EXE
  PID:5348
- C:\Windows\System\usBXLqd.exe
  C:\Windows\System\usBXLqd.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\LXauiZa.exe
  C:\Windows\System\LXauiZa.exe
  2⤵
  - Executes dropped EXE
  PID:5404
- C:\Windows\System\IUiswDd.exe
  C:\Windows\System\IUiswDd.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\JgbUccf.exe
  C:\Windows\System\JgbUccf.exe
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Windows\System\RievvIX.exe
  C:\Windows\System\RievvIX.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System\goRAPtb.exe
  C:\Windows\System\goRAPtb.exe
  2⤵
  - Executes dropped EXE
  PID:5516
- C:\Windows\System\tBptcWx.exe
  C:\Windows\System\tBptcWx.exe
  2⤵
  - Executes dropped EXE
  PID:5556
- C:\Windows\System\LrGdPkg.exe
  C:\Windows\System\LrGdPkg.exe
  2⤵
  - Executes dropped EXE
  PID:5584
- C:\Windows\System\tDTYWfO.exe
  C:\Windows\System\tDTYWfO.exe
  2⤵
  - Executes dropped EXE
  PID:5612
- C:\Windows\System\gzwpOEL.exe
  C:\Windows\System\gzwpOEL.exe
  2⤵
  - Executes dropped EXE
  PID:5640
- C:\Windows\System\eyVTZcq.exe
  C:\Windows\System\eyVTZcq.exe
  2⤵
  - Executes dropped EXE
  PID:5668
- C:\Windows\System\DQSsTDY.exe
  C:\Windows\System\DQSsTDY.exe
  2⤵
  - Executes dropped EXE
  PID:5696
- C:\Windows\System\iDkeucG.exe
  C:\Windows\System\iDkeucG.exe
  2⤵
  PID:5724
- C:\Windows\System\MYCDowT.exe
  C:\Windows\System\MYCDowT.exe
  2⤵
  PID:5752
- C:\Windows\System\AkamDTs.exe
  C:\Windows\System\AkamDTs.exe
  2⤵
  PID:5780
- C:\Windows\System\EucZitC.exe
  C:\Windows\System\EucZitC.exe
  2⤵
  PID:5808
- C:\Windows\System\HIHQahW.exe
  C:\Windows\System\HIHQahW.exe
  2⤵
  PID:5836
- C:\Windows\System\VBFEsgB.exe
  C:\Windows\System\VBFEsgB.exe
  2⤵
  PID:5864
- C:\Windows\System\EQRUFrE.exe
  C:\Windows\System\EQRUFrE.exe
  2⤵
  PID:5892
- C:\Windows\System\fhiyzUH.exe
  C:\Windows\System\fhiyzUH.exe
  2⤵
  PID:5920
- C:\Windows\System\WexVUNL.exe
  C:\Windows\System\WexVUNL.exe
  2⤵
  PID:5944
- C:\Windows\System\XZdQvcj.exe
  C:\Windows\System\XZdQvcj.exe
  2⤵
  PID:5976
- C:\Windows\System\eFnoUfH.exe
  C:\Windows\System\eFnoUfH.exe
  2⤵
  PID:6004
- C:\Windows\System\ULUkxpe.exe
  C:\Windows\System\ULUkxpe.exe
  2⤵
  PID:6032
- C:\Windows\System\EHwquDC.exe
  C:\Windows\System\EHwquDC.exe
  2⤵
  PID:6060
- C:\Windows\System\azeiQGy.exe
  C:\Windows\System\azeiQGy.exe
  2⤵
  PID:6088
- C:\Windows\System\ZoBVEtS.exe
  C:\Windows\System\ZoBVEtS.exe
  2⤵
  PID:6116
- C:\Windows\System\JqfGlfG.exe
  C:\Windows\System\JqfGlfG.exe
  2⤵
  PID:1268
- C:\Windows\System\fZJSFpD.exe
  C:\Windows\System\fZJSFpD.exe
  2⤵
  PID:4432
- C:\Windows\System\FBndCNv.exe
  C:\Windows\System\FBndCNv.exe
  2⤵
  PID:4028
- C:\Windows\System\ChVfuJi.exe
  C:\Windows\System\ChVfuJi.exe
  2⤵
  PID:960
- C:\Windows\System\bDbRiCm.exe
  C:\Windows\System\bDbRiCm.exe
  2⤵
  PID:5192
- C:\Windows\System\wKxDIhZ.exe
  C:\Windows\System\wKxDIhZ.exe
  2⤵
  PID:5252
- C:\Windows\System\gkmShna.exe
  C:\Windows\System\gkmShna.exe
  2⤵
  PID:5316
- C:\Windows\System\igxYCYL.exe
  C:\Windows\System\igxYCYL.exe
  2⤵
  PID:5368
- C:\Windows\System\mknIKww.exe
  C:\Windows\System\mknIKww.exe
  2⤵
  PID:5444
- C:\Windows\System\eDUnbQm.exe
  C:\Windows\System\eDUnbQm.exe
  2⤵
  PID:5504
- C:\Windows\System\XdAzdXE.exe
  C:\Windows\System\XdAzdXE.exe
  2⤵
  PID:5572
- C:\Windows\System\KCNlAxD.exe
  C:\Windows\System\KCNlAxD.exe
  2⤵
  PID:5632
- C:\Windows\System\YLbsbLc.exe
  C:\Windows\System\YLbsbLc.exe
  2⤵
  PID:5716
- C:\Windows\System\EcsJSxn.exe
  C:\Windows\System\EcsJSxn.exe
  2⤵
  PID:5768
- C:\Windows\System\OWBieYt.exe
  C:\Windows\System\OWBieYt.exe
  2⤵
  PID:5828
- C:\Windows\System\rhTpOSQ.exe
  C:\Windows\System\rhTpOSQ.exe
  2⤵
  PID:5884
- C:\Windows\System\zebcitx.exe
  C:\Windows\System\zebcitx.exe
  2⤵
  PID:5960
- C:\Windows\System\CmDBhNf.exe
  C:\Windows\System\CmDBhNf.exe
  2⤵
  PID:6020
- C:\Windows\System\HqvWIRR.exe
  C:\Windows\System\HqvWIRR.exe
  2⤵
  PID:6080
- C:\Windows\System\cAkdLlL.exe
  C:\Windows\System\cAkdLlL.exe
  2⤵
  PID:1716
- C:\Windows\System\HZtXxOc.exe
  C:\Windows\System\HZtXxOc.exe
  2⤵
  PID:4460
- C:\Windows\System\JsHgmkZ.exe
  C:\Windows\System\JsHgmkZ.exe
  2⤵
  PID:5232
- C:\Windows\System\rIyOdbW.exe
  C:\Windows\System\rIyOdbW.exe
  2⤵
  PID:5416
- C:\Windows\System\EdbaKMb.exe
  C:\Windows\System\EdbaKMb.exe
  2⤵
  PID:5548
- C:\Windows\System\xEQpOXx.exe
  C:\Windows\System\xEQpOXx.exe
  2⤵
  PID:5688
- C:\Windows\System\hdJjbBv.exe
  C:\Windows\System\hdJjbBv.exe
  2⤵
  PID:5876
- C:\Windows\System\sfgaEtX.exe
  C:\Windows\System\sfgaEtX.exe
  2⤵
  PID:6164
- C:\Windows\System\AEtpFzG.exe
  C:\Windows\System\AEtpFzG.exe
  2⤵
  PID:6192
- C:\Windows\System\GeYkiaI.exe
  C:\Windows\System\GeYkiaI.exe
  2⤵
  PID:6220
- C:\Windows\System\BVpbkCp.exe
  C:\Windows\System\BVpbkCp.exe
  2⤵
  PID:6248
- C:\Windows\System\hRrDdEC.exe
  C:\Windows\System\hRrDdEC.exe
  2⤵
  PID:6276
- C:\Windows\System\aeLEKLe.exe
  C:\Windows\System\aeLEKLe.exe
  2⤵
  PID:6304
- C:\Windows\System\Waewigc.exe
  C:\Windows\System\Waewigc.exe
  2⤵
  PID:6332
- C:\Windows\System\WsCxAAo.exe
  C:\Windows\System\WsCxAAo.exe
  2⤵
  PID:6360
- C:\Windows\System\bOEmWDg.exe
  C:\Windows\System\bOEmWDg.exe
  2⤵
  PID:6388
- C:\Windows\System\mMdwiGZ.exe
  C:\Windows\System\mMdwiGZ.exe
  2⤵
  PID:6416
- C:\Windows\System\qKMfQXl.exe
  C:\Windows\System\qKMfQXl.exe
  2⤵
  PID:6444
- C:\Windows\System\KkYQVsZ.exe
  C:\Windows\System\KkYQVsZ.exe
  2⤵
  PID:6472
- C:\Windows\System\liKRxgQ.exe
  C:\Windows\System\liKRxgQ.exe
  2⤵
  PID:6500
- C:\Windows\System\YVxrkLm.exe
  C:\Windows\System\YVxrkLm.exe
  2⤵
  PID:6528
- C:\Windows\System\XODEdgF.exe
  C:\Windows\System\XODEdgF.exe
  2⤵
  PID:6556
- C:\Windows\System\lnDsaAz.exe
  C:\Windows\System\lnDsaAz.exe
  2⤵
  PID:6584
- C:\Windows\System\tLQqnYD.exe
  C:\Windows\System\tLQqnYD.exe
  2⤵
  PID:6612
- C:\Windows\System\MbViwMx.exe
  C:\Windows\System\MbViwMx.exe
  2⤵
  PID:6640
- C:\Windows\System\pbyGUVD.exe
  C:\Windows\System\pbyGUVD.exe
  2⤵
  PID:6668
- C:\Windows\System\sQnXDpd.exe
  C:\Windows\System\sQnXDpd.exe
  2⤵
  PID:6696
- C:\Windows\System\OcTUNRF.exe
  C:\Windows\System\OcTUNRF.exe
  2⤵
  PID:6724
- C:\Windows\System\kWMsnbw.exe
  C:\Windows\System\kWMsnbw.exe
  2⤵
  PID:6752
- C:\Windows\System\oYFDETb.exe
  C:\Windows\System\oYFDETb.exe
  2⤵
  PID:6780
- C:\Windows\System\doPSZPO.exe
  C:\Windows\System\doPSZPO.exe
  2⤵
  PID:6808
- C:\Windows\System\pieJlRK.exe
  C:\Windows\System\pieJlRK.exe
  2⤵
  PID:6836
- C:\Windows\System\baUTvvZ.exe
  C:\Windows\System\baUTvvZ.exe
  2⤵
  PID:6864
- C:\Windows\System\RzVeuRQ.exe
  C:\Windows\System\RzVeuRQ.exe
  2⤵
  PID:6892
- C:\Windows\System\xQqjaKX.exe
  C:\Windows\System\xQqjaKX.exe
  2⤵
  PID:6920
- C:\Windows\System\oaKrZZB.exe
  C:\Windows\System\oaKrZZB.exe
  2⤵
  PID:6948
- C:\Windows\System\PtadhRv.exe
  C:\Windows\System\PtadhRv.exe
  2⤵
  PID:6976
- C:\Windows\System\rkbiLbj.exe
  C:\Windows\System\rkbiLbj.exe
  2⤵
  PID:7004
- C:\Windows\System\gzQjSru.exe
  C:\Windows\System\gzQjSru.exe
  2⤵
  PID:7032
- C:\Windows\System\OjTObPr.exe
  C:\Windows\System\OjTObPr.exe
  2⤵
  PID:7060
- C:\Windows\System\VRdMkRW.exe
  C:\Windows\System\VRdMkRW.exe
  2⤵
  PID:7088
- C:\Windows\System\GzmLhMr.exe
  C:\Windows\System\GzmLhMr.exe
  2⤵
  PID:7116
- C:\Windows\System\JYmAhlk.exe
  C:\Windows\System\JYmAhlk.exe
  2⤵
  PID:7144
- C:\Windows\System\ngrzbRy.exe
  C:\Windows\System\ngrzbRy.exe
  2⤵
  PID:5936
- C:\Windows\System\wSxjkou.exe
  C:\Windows\System\wSxjkou.exe
  2⤵
  PID:6108
- C:\Windows\System\IZqTYOW.exe
  C:\Windows\System\IZqTYOW.exe
  2⤵
  PID:5168
- C:\Windows\System\SXDsJnL.exe
  C:\Windows\System\SXDsJnL.exe
  2⤵
  PID:5480
- C:\Windows\System\GuKMEPT.exe
  C:\Windows\System\GuKMEPT.exe
  2⤵
  PID:6148
- C:\Windows\System\vLeLkFp.exe
  C:\Windows\System\vLeLkFp.exe
  2⤵
  PID:6208
- C:\Windows\System\aGdOonZ.exe
  C:\Windows\System\aGdOonZ.exe
  2⤵
  PID:6268
- C:\Windows\System\dACvYuZ.exe
  C:\Windows\System\dACvYuZ.exe
  2⤵
  PID:6344
- C:\Windows\System\jWjDmCt.exe
  C:\Windows\System\jWjDmCt.exe
  2⤵
  PID:6404
- C:\Windows\System\VWPhjuE.exe
  C:\Windows\System\VWPhjuE.exe
  2⤵
  PID:6464
- C:\Windows\System\LeZwnIg.exe
  C:\Windows\System\LeZwnIg.exe
  2⤵
  PID:6540
- C:\Windows\System\eGjpDyu.exe
  C:\Windows\System\eGjpDyu.exe
  2⤵
  PID:6600
- C:\Windows\System\gqeHbdx.exe
  C:\Windows\System\gqeHbdx.exe
  2⤵
  PID:6660
- C:\Windows\System\nWoIexv.exe
  C:\Windows\System\nWoIexv.exe
  2⤵
  PID:6736
- C:\Windows\System\yAmLZKq.exe
  C:\Windows\System\yAmLZKq.exe
  2⤵
  PID:6824
- C:\Windows\System\JouUaHh.exe
  C:\Windows\System\JouUaHh.exe
  2⤵
  PID:6884
- C:\Windows\System\QQSeDzL.exe
  C:\Windows\System\QQSeDzL.exe
  2⤵
  PID:6960
- C:\Windows\System\zbmZrlM.exe
  C:\Windows\System\zbmZrlM.exe
  2⤵
  PID:7020
- C:\Windows\System\FvJhtVc.exe
  C:\Windows\System\FvJhtVc.exe
  2⤵
  PID:7052
- C:\Windows\System\YJmAvDY.exe
  C:\Windows\System\YJmAvDY.exe
  2⤵
  PID:7128
- C:\Windows\System\qUvfFGm.exe
  C:\Windows\System\qUvfFGm.exe
  2⤵
  PID:6048
- C:\Windows\System\RdXanuO.exe
  C:\Windows\System\RdXanuO.exe
  2⤵
  PID:5476
- C:\Windows\System\ygzbrxm.exe
  C:\Windows\System\ygzbrxm.exe
  2⤵
  PID:6236
- C:\Windows\System\jdWxYbu.exe
  C:\Windows\System\jdWxYbu.exe
  2⤵
  PID:6376
- C:\Windows\System\AMoIRkK.exe
  C:\Windows\System\AMoIRkK.exe
  2⤵
  PID:6516
- C:\Windows\System\ruuoeve.exe
  C:\Windows\System\ruuoeve.exe
  2⤵
  PID:6688
- C:\Windows\System\MTbQuOT.exe
  C:\Windows\System\MTbQuOT.exe
  2⤵
  PID:6852
- C:\Windows\System\vaWDShF.exe
  C:\Windows\System\vaWDShF.exe
  2⤵
  PID:6988
- C:\Windows\System\pxhiGfX.exe
  C:\Windows\System\pxhiGfX.exe
  2⤵
  PID:7104
- C:\Windows\System\suzTrUF.exe
  C:\Windows\System\suzTrUF.exe
  2⤵
  PID:5800
- C:\Windows\System\zSewHet.exe
  C:\Windows\System\zSewHet.exe
  2⤵
  PID:7196
- C:\Windows\System\ViBNvkW.exe
  C:\Windows\System\ViBNvkW.exe
  2⤵
  PID:7224
- C:\Windows\System\OueZBJK.exe
  C:\Windows\System\OueZBJK.exe
  2⤵
  PID:7252
- C:\Windows\System\HjbBlWI.exe
  C:\Windows\System\HjbBlWI.exe
  2⤵
  PID:7280
- C:\Windows\System\uvdnHRQ.exe
  C:\Windows\System\uvdnHRQ.exe
  2⤵
  PID:7308
- C:\Windows\System\IsFaHmC.exe
  C:\Windows\System\IsFaHmC.exe
  2⤵
  PID:7336
- C:\Windows\System\byswHWq.exe
  C:\Windows\System\byswHWq.exe
  2⤵
  PID:7364
- C:\Windows\System\ySbUVOG.exe
  C:\Windows\System\ySbUVOG.exe
  2⤵
  PID:7392
- C:\Windows\System\HfbIBrd.exe
  C:\Windows\System\HfbIBrd.exe
  2⤵
  PID:7420
- C:\Windows\System\IPpqLkt.exe
  C:\Windows\System\IPpqLkt.exe
  2⤵
  PID:7448
- C:\Windows\System\OLjNhYY.exe
  C:\Windows\System\OLjNhYY.exe
  2⤵
  PID:7476
- C:\Windows\System\HLcFejN.exe
  C:\Windows\System\HLcFejN.exe
  2⤵
  PID:7504
- C:\Windows\System\qLBQaxT.exe
  C:\Windows\System\qLBQaxT.exe
  2⤵
  PID:7532
- C:\Windows\System\cepvWQu.exe
  C:\Windows\System\cepvWQu.exe
  2⤵
  PID:7564
- C:\Windows\System\uCWXzVd.exe
  C:\Windows\System\uCWXzVd.exe
  2⤵
  PID:7588
- C:\Windows\System\JYPqJUa.exe
  C:\Windows\System\JYPqJUa.exe
  2⤵
  PID:7616
- C:\Windows\System\ztMOqNZ.exe
  C:\Windows\System\ztMOqNZ.exe
  2⤵
  PID:7644
- C:\Windows\System\UoqPocS.exe
  C:\Windows\System\UoqPocS.exe
  2⤵
  PID:7672
- C:\Windows\System\wyWRehK.exe
  C:\Windows\System\wyWRehK.exe
  2⤵
  PID:7700
- C:\Windows\System\lMKYSom.exe
  C:\Windows\System\lMKYSom.exe
  2⤵
  PID:7728
- C:\Windows\System\rSriNZz.exe
  C:\Windows\System\rSriNZz.exe
  2⤵
  PID:7756
- C:\Windows\System\taLIBKV.exe
  C:\Windows\System\taLIBKV.exe
  2⤵
  PID:7784
- C:\Windows\System\XfgSVLN.exe
  C:\Windows\System\XfgSVLN.exe
  2⤵
  PID:7812
- C:\Windows\System\LutkjFW.exe
  C:\Windows\System\LutkjFW.exe
  2⤵
  PID:7840
- C:\Windows\System\OkPpoQM.exe
  C:\Windows\System\OkPpoQM.exe
  2⤵
  PID:7868
- C:\Windows\System\YjnnZDs.exe
  C:\Windows\System\YjnnZDs.exe
  2⤵
  PID:7896
- C:\Windows\System\zdEosoS.exe
  C:\Windows\System\zdEosoS.exe
  2⤵
  PID:7924
- C:\Windows\System\lWkUKKC.exe
  C:\Windows\System\lWkUKKC.exe
  2⤵
  PID:7952
- C:\Windows\System\tFfJTkg.exe
  C:\Windows\System\tFfJTkg.exe
  2⤵
  PID:7980
- C:\Windows\System\GeoYKNQ.exe
  C:\Windows\System\GeoYKNQ.exe
  2⤵
  PID:8008
- C:\Windows\System\jnjUrrT.exe
  C:\Windows\System\jnjUrrT.exe
  2⤵
  PID:8036
- C:\Windows\System\hcHpNlK.exe
  C:\Windows\System\hcHpNlK.exe
  2⤵
  PID:8064
- C:\Windows\System\jYadLic.exe
  C:\Windows\System\jYadLic.exe
  2⤵
  PID:8092
- C:\Windows\System\INSHRnz.exe
  C:\Windows\System\INSHRnz.exe
  2⤵
  PID:8120
- C:\Windows\System\kdQSTLu.exe
  C:\Windows\System\kdQSTLu.exe
  2⤵
  PID:8148
- C:\Windows\System\vChPund.exe
  C:\Windows\System\vChPund.exe
  2⤵
  PID:8176
- C:\Windows\System\MnEoPaH.exe
  C:\Windows\System\MnEoPaH.exe
  2⤵
  PID:6316
- C:\Windows\System\KCSsSgN.exe
  C:\Windows\System\KCSsSgN.exe
  2⤵
  PID:6632
- C:\Windows\System\hqjvNbm.exe
  C:\Windows\System\hqjvNbm.exe
  2⤵
  PID:7044
- C:\Windows\System\SpBDfGR.exe
  C:\Windows\System\SpBDfGR.exe
  2⤵
  PID:7184
- C:\Windows\System\ZpwdcTS.exe
  C:\Windows\System\ZpwdcTS.exe
  2⤵
  PID:7244
- C:\Windows\System\ItmqPMJ.exe
  C:\Windows\System\ItmqPMJ.exe
  2⤵
  PID:7320
- C:\Windows\System\mRgbZVf.exe
  C:\Windows\System\mRgbZVf.exe
  2⤵
  PID:7380
- C:\Windows\System\NttbVjj.exe
  C:\Windows\System\NttbVjj.exe
  2⤵
  PID:7440
- C:\Windows\System\pykoUGp.exe
  C:\Windows\System\pykoUGp.exe
  2⤵
  PID:7516
- C:\Windows\System\JxbSUDY.exe
  C:\Windows\System\JxbSUDY.exe
  2⤵
  PID:7572
- C:\Windows\System\bmgfxDW.exe
  C:\Windows\System\bmgfxDW.exe
  2⤵
  PID:7632
- C:\Windows\System\oZuyYrs.exe
  C:\Windows\System\oZuyYrs.exe
  2⤵
  PID:7692
- C:\Windows\System\gipHkXf.exe
  C:\Windows\System\gipHkXf.exe
  2⤵
  PID:7748
- C:\Windows\System\YwPoXPo.exe
  C:\Windows\System\YwPoXPo.exe
  2⤵
  PID:7824
- C:\Windows\System\KqEhYpj.exe
  C:\Windows\System\KqEhYpj.exe
  2⤵
  PID:7884
- C:\Windows\System\aPdEhKa.exe
  C:\Windows\System\aPdEhKa.exe
  2⤵
  PID:7944
- C:\Windows\System\szCKDRM.exe
  C:\Windows\System\szCKDRM.exe
  2⤵
  PID:8020
- C:\Windows\System\FSqVzON.exe
  C:\Windows\System\FSqVzON.exe
  2⤵
  PID:8076
- C:\Windows\System\jsjFZBY.exe
  C:\Windows\System\jsjFZBY.exe
  2⤵
  PID:8136
- C:\Windows\System\kZmfTEe.exe
  C:\Windows\System\kZmfTEe.exe
  2⤵
  PID:6180
- C:\Windows\System\BHlEroU.exe
  C:\Windows\System\BHlEroU.exe
  2⤵
  PID:7164
- C:\Windows\System\LSXrFzU.exe
  C:\Windows\System\LSXrFzU.exe
  2⤵
  PID:7236
- C:\Windows\System\JBbMurR.exe
  C:\Windows\System\JBbMurR.exe
  2⤵
  PID:7408
- C:\Windows\System\xsagUSL.exe
  C:\Windows\System\xsagUSL.exe
  2⤵
  PID:764
- C:\Windows\System\MQUnRPq.exe
  C:\Windows\System\MQUnRPq.exe
  2⤵
  PID:7664
- C:\Windows\System\lJtpOQW.exe
  C:\Windows\System\lJtpOQW.exe
  2⤵
  PID:7776
- C:\Windows\System\eThqstQ.exe
  C:\Windows\System\eThqstQ.exe
  2⤵
  PID:7860
- C:\Windows\System\BTEiZmN.exe
  C:\Windows\System\BTEiZmN.exe
  2⤵
  PID:7996
- C:\Windows\System\MPnKOWo.exe
  C:\Windows\System\MPnKOWo.exe
  2⤵
  PID:8164
- C:\Windows\System\yCLAenv.exe
  C:\Windows\System\yCLAenv.exe
  2⤵
  PID:4388
- C:\Windows\System\ywmtucZ.exe
  C:\Windows\System\ywmtucZ.exe
  2⤵
  PID:7468
- C:\Windows\System\wZfoFoQ.exe
  C:\Windows\System\wZfoFoQ.exe
  2⤵
  PID:8196
- C:\Windows\System\PnjmPAW.exe
  C:\Windows\System\PnjmPAW.exe
  2⤵
  PID:8224
- C:\Windows\System\dlMCrmy.exe
  C:\Windows\System\dlMCrmy.exe
  2⤵
  PID:8252
- C:\Windows\System\gaTrtaM.exe
  C:\Windows\System\gaTrtaM.exe
  2⤵
  PID:8280
- C:\Windows\System\XvnQPYQ.exe
  C:\Windows\System\XvnQPYQ.exe
  2⤵
  PID:8308
- C:\Windows\System\HZWCgPc.exe
  C:\Windows\System\HZWCgPc.exe
  2⤵
  PID:8336
- C:\Windows\System\ENIosoS.exe
  C:\Windows\System\ENIosoS.exe
  2⤵
  PID:8364
- C:\Windows\System\HABIjSX.exe
  C:\Windows\System\HABIjSX.exe
  2⤵
  PID:8392
- C:\Windows\System\CHIwNmY.exe
  C:\Windows\System\CHIwNmY.exe
  2⤵
  PID:8420
- C:\Windows\System\nLyQqXO.exe
  C:\Windows\System\nLyQqXO.exe
  2⤵
  PID:8448
- C:\Windows\System\zOHRIvY.exe
  C:\Windows\System\zOHRIvY.exe
  2⤵
  PID:8476
- C:\Windows\System\hHTFWqG.exe
  C:\Windows\System\hHTFWqG.exe
  2⤵
  PID:8504
- C:\Windows\System\UEFrtAn.exe
  C:\Windows\System\UEFrtAn.exe
  2⤵
  PID:8532
- C:\Windows\System\hbCMuwt.exe
  C:\Windows\System\hbCMuwt.exe
  2⤵
  PID:8560
- C:\Windows\System\yTMSAdz.exe
  C:\Windows\System\yTMSAdz.exe
  2⤵
  PID:8588
- C:\Windows\System\yZmxFld.exe
  C:\Windows\System\yZmxFld.exe
  2⤵
  PID:8616
- C:\Windows\System\eeSizlN.exe
  C:\Windows\System\eeSizlN.exe
  2⤵
  PID:8644
- C:\Windows\System\wobVVwX.exe
  C:\Windows\System\wobVVwX.exe
  2⤵
  PID:8672
- C:\Windows\System\QyLAsTn.exe
  C:\Windows\System\QyLAsTn.exe
  2⤵
  PID:8700
- C:\Windows\System\LLIoJqh.exe
  C:\Windows\System\LLIoJqh.exe
  2⤵
  PID:8732
- C:\Windows\System\cuRtSIJ.exe
  C:\Windows\System\cuRtSIJ.exe
  2⤵
  PID:8756
- C:\Windows\System\SuNVHuW.exe
  C:\Windows\System\SuNVHuW.exe
  2⤵
  PID:8784
- C:\Windows\System\VVoqoSO.exe
  C:\Windows\System\VVoqoSO.exe
  2⤵
  PID:8812
- C:\Windows\System\agvzYfn.exe
  C:\Windows\System\agvzYfn.exe
  2⤵
  PID:8840
- C:\Windows\System\vFWhInr.exe
  C:\Windows\System\vFWhInr.exe
  2⤵
  PID:8868
- C:\Windows\System\VmOwKpB.exe
  C:\Windows\System\VmOwKpB.exe
  2⤵
  PID:8896
- C:\Windows\System\IhAjrmY.exe
  C:\Windows\System\IhAjrmY.exe
  2⤵
  PID:8924
- C:\Windows\System\WWPCaho.exe
  C:\Windows\System\WWPCaho.exe
  2⤵
  PID:8952
- C:\Windows\System\bmHelaH.exe
  C:\Windows\System\bmHelaH.exe
  2⤵
  PID:8980
- C:\Windows\System\HBqQffS.exe
  C:\Windows\System\HBqQffS.exe
  2⤵
  PID:9008
- C:\Windows\System\MBKJQvy.exe
  C:\Windows\System\MBKJQvy.exe
  2⤵
  PID:9036
- C:\Windows\System\kDarNIk.exe
  C:\Windows\System\kDarNIk.exe
  2⤵
  PID:9064
- C:\Windows\System\umKtWMf.exe
  C:\Windows\System\umKtWMf.exe
  2⤵
  PID:9092
- C:\Windows\System\GZRtpfl.exe
  C:\Windows\System\GZRtpfl.exe
  2⤵
  PID:9120
- C:\Windows\System\ZpJfdYT.exe
  C:\Windows\System\ZpJfdYT.exe
  2⤵
  PID:9152
- C:\Windows\System\ZRMdObj.exe
  C:\Windows\System\ZRMdObj.exe
  2⤵
  PID:9176
- C:\Windows\System\SFCTBIl.exe
  C:\Windows\System\SFCTBIl.exe
  2⤵
  PID:4948
- C:\Windows\System\fWgyhyH.exe
  C:\Windows\System\fWgyhyH.exe
  2⤵
  PID:8236
- C:\Windows\System\AxtyyDy.exe
  C:\Windows\System\AxtyyDy.exe
  2⤵
  PID:3740
- C:\Windows\System\AYKsmnv.exe
  C:\Windows\System\AYKsmnv.exe
  2⤵
  PID:8328
- C:\Windows\System\vxjopfc.exe
  C:\Windows\System\vxjopfc.exe
  2⤵
  PID:8412
- C:\Windows\System\tOnpkMj.exe
  C:\Windows\System\tOnpkMj.exe
  2⤵
  PID:8468
- C:\Windows\System\DSkUPQx.exe
  C:\Windows\System\DSkUPQx.exe
  2⤵
  PID:8548
- C:\Windows\System\btXbyzZ.exe
  C:\Windows\System\btXbyzZ.exe
  2⤵
  PID:8600
- C:\Windows\System\InDFauG.exe
  C:\Windows\System\InDFauG.exe
  2⤵
  PID:8632
- C:\Windows\System\hJFaFQC.exe
  C:\Windows\System\hJFaFQC.exe
  2⤵
  PID:8772
- C:\Windows\System\RiCjKYb.exe
  C:\Windows\System\RiCjKYb.exe
  2⤵
  PID:8856
- C:\Windows\System\bWOecuu.exe
  C:\Windows\System\bWOecuu.exe
  2⤵
  PID:8912
- C:\Windows\System\IgFVhyz.exe
  C:\Windows\System\IgFVhyz.exe
  2⤵
  PID:8972
- C:\Windows\System\OqxDBTF.exe
  C:\Windows\System\OqxDBTF.exe
  2⤵
  PID:9028
- C:\Windows\System\KEiIALU.exe
  C:\Windows\System\KEiIALU.exe
  2⤵
  PID:2644
- C:\Windows\System\GUEHpIW.exe
  C:\Windows\System\GUEHpIW.exe
  2⤵
  PID:4448
- C:\Windows\System\gQroGQz.exe
  C:\Windows\System\gQroGQz.exe
  2⤵
  PID:9116
- C:\Windows\System\DwPApKr.exe
  C:\Windows\System\DwPApKr.exe
  2⤵
  PID:3532
- C:\Windows\System\xNaxuxu.exe
  C:\Windows\System\xNaxuxu.exe
  2⤵
  PID:4996
- C:\Windows\System\yXKHtOz.exe
  C:\Windows\System\yXKHtOz.exe
  2⤵
  PID:8324
- C:\Windows\System\vgTvjIc.exe
  C:\Windows\System\vgTvjIc.exe
  2⤵
  PID:8300
- C:\Windows\System\noMzlpC.exe
  C:\Windows\System\noMzlpC.exe
  2⤵
  PID:8580
- C:\Windows\System\zRLNsOK.exe
  C:\Windows\System\zRLNsOK.exe
  2⤵
  PID:876
- C:\Windows\System\SQMKZul.exe
  C:\Windows\System\SQMKZul.exe
  2⤵
  PID:8692
- C:\Windows\System\UOPxrhC.exe
  C:\Windows\System\UOPxrhC.exe
  2⤵
  PID:8832
- C:\Windows\System\gWeumcm.exe
  C:\Windows\System\gWeumcm.exe
  2⤵
  PID:8884
- C:\Windows\System\RdDndXk.exe
  C:\Windows\System\RdDndXk.exe
  2⤵
  PID:4916
- C:\Windows\System\TvundfW.exe
  C:\Windows\System\TvundfW.exe
  2⤵
  PID:4032
- C:\Windows\System\QdUSgJT.exe
  C:\Windows\System\QdUSgJT.exe
  2⤵
  PID:9132
- C:\Windows\System\SeLhjMw.exe
  C:\Windows\System\SeLhjMw.exe
  2⤵
  PID:3504
- C:\Windows\System\prvkkKN.exe
  C:\Windows\System\prvkkKN.exe
  2⤵
  PID:4224
- C:\Windows\System\Ltdilba.exe
  C:\Windows\System\Ltdilba.exe
  2⤵
  PID:1120
- C:\Windows\System\WLSAlar.exe
  C:\Windows\System\WLSAlar.exe
  2⤵
  PID:3304
- C:\Windows\System\ncxmApa.exe
  C:\Windows\System\ncxmApa.exe
  2⤵
  PID:8272
- C:\Windows\System\tzqetSD.exe
  C:\Windows\System\tzqetSD.exe
  2⤵
  PID:840
- C:\Windows\System\vWTcinw.exe
  C:\Windows\System\vWTcinw.exe
  2⤵
  PID:1688
- C:\Windows\System\BTBeegc.exe
  C:\Windows\System\BTBeegc.exe
  2⤵
  PID:1140
- C:\Windows\System\uzqBGqK.exe
  C:\Windows\System\uzqBGqK.exe
  2⤵
  PID:9172
- C:\Windows\System\NAGVfZY.exe
  C:\Windows\System\NAGVfZY.exe
  2⤵
  PID:4560
- C:\Windows\System\WkKYhEB.exe
  C:\Windows\System\WkKYhEB.exe
  2⤵
  PID:8052
- C:\Windows\System\QAxgNFh.exe
  C:\Windows\System\QAxgNFh.exe
  2⤵
  PID:2696
- C:\Windows\System\SPQYkfT.exe
  C:\Windows\System\SPQYkfT.exe
  2⤵
  PID:9148
- C:\Windows\System\RxgSXGl.exe
  C:\Windows\System\RxgSXGl.exe
  2⤵
  PID:3324
- C:\Windows\System\DZzHFbn.exe
  C:\Windows\System\DZzHFbn.exe
  2⤵
  PID:9244
- C:\Windows\System\CZmpKVc.exe
  C:\Windows\System\CZmpKVc.exe
  2⤵
  PID:9272
- C:\Windows\System\axREdVY.exe
  C:\Windows\System\axREdVY.exe
  2⤵
  PID:9300
- C:\Windows\System\CiMaMsz.exe
  C:\Windows\System\CiMaMsz.exe
  2⤵
  PID:9320
- C:\Windows\System\cbveFbG.exe
  C:\Windows\System\cbveFbG.exe
  2⤵
  PID:9356
- C:\Windows\System\wQsKRcc.exe
  C:\Windows\System\wQsKRcc.exe
  2⤵
  PID:9384
- C:\Windows\System\qyIQrIz.exe
  C:\Windows\System\qyIQrIz.exe
  2⤵
  PID:9416
- C:\Windows\System\TqSazKV.exe
  C:\Windows\System\TqSazKV.exe
  2⤵
  PID:9444
- C:\Windows\System\wpKIKKC.exe
  C:\Windows\System\wpKIKKC.exe
  2⤵
  PID:9472
- C:\Windows\System\dpZZpPm.exe
  C:\Windows\System\dpZZpPm.exe
  2⤵
  PID:9492
- C:\Windows\System\GeHgNsT.exe
  C:\Windows\System\GeHgNsT.exe
  2⤵
  PID:9512
- C:\Windows\System\RKKRWaj.exe
  C:\Windows\System\RKKRWaj.exe
  2⤵
  PID:9568
- C:\Windows\System\uhwwZbq.exe
  C:\Windows\System\uhwwZbq.exe
  2⤵
  PID:9608
- C:\Windows\System\LPdDsjo.exe
  C:\Windows\System\LPdDsjo.exe
  2⤵
  PID:9636
- C:\Windows\System\jgXhEPA.exe
  C:\Windows\System\jgXhEPA.exe
  2⤵
  PID:9664
- C:\Windows\System\WMsQWoq.exe
  C:\Windows\System\WMsQWoq.exe
  2⤵
  PID:9688
- C:\Windows\System\QbhWllh.exe
  C:\Windows\System\QbhWllh.exe
  2⤵
  PID:9728
- C:\Windows\System\AkfGndv.exe
  C:\Windows\System\AkfGndv.exe
  2⤵
  PID:9756
- C:\Windows\System\SGUaCCb.exe
  C:\Windows\System\SGUaCCb.exe
  2⤵
  PID:9784
- C:\Windows\System\PiZoxkX.exe
  C:\Windows\System\PiZoxkX.exe
  2⤵
  PID:9812
- C:\Windows\System\fQjkDtf.exe
  C:\Windows\System\fQjkDtf.exe
  2⤵
  PID:9840
- C:\Windows\System\TAqTHzm.exe
  C:\Windows\System\TAqTHzm.exe
  2⤵
  PID:9868
- C:\Windows\System\psYSQYm.exe
  C:\Windows\System\psYSQYm.exe
  2⤵
  PID:9896
- C:\Windows\System\KITGFnI.exe
  C:\Windows\System\KITGFnI.exe
  2⤵
  PID:9920
- C:\Windows\System\OlogsXy.exe
  C:\Windows\System\OlogsXy.exe
  2⤵
  PID:9952
- C:\Windows\System\CiWjjvY.exe
  C:\Windows\System\CiWjjvY.exe
  2⤵
  PID:9976
- C:\Windows\System\mRQBYYR.exe
  C:\Windows\System\mRQBYYR.exe
  2⤵
  PID:10036
- C:\Windows\System\JcNVvTd.exe
  C:\Windows\System\JcNVvTd.exe
  2⤵
  PID:10072
- C:\Windows\System\MISDjMb.exe
  C:\Windows\System\MISDjMb.exe
  2⤵
  PID:10116
- C:\Windows\System\hYWggiU.exe
  C:\Windows\System\hYWggiU.exe
  2⤵
  PID:10144
- C:\Windows\System\alKvUYQ.exe
  C:\Windows\System\alKvUYQ.exe
  2⤵
  PID:10172
- C:\Windows\System\nsrzSSc.exe
  C:\Windows\System\nsrzSSc.exe
  2⤵
  PID:10192
- C:\Windows\System\onxkdWD.exe
  C:\Windows\System\onxkdWD.exe
  2⤵
  PID:10228
- C:\Windows\System\uSqsPqr.exe
  C:\Windows\System\uSqsPqr.exe
  2⤵
  PID:1864
- C:\Windows\System\pJforqe.exe
  C:\Windows\System\pJforqe.exe
  2⤵
  PID:9264
- C:\Windows\System\iDLdjji.exe
  C:\Windows\System\iDLdjji.exe
  2⤵
  PID:9328
- C:\Windows\System\GrFNVFd.exe
  C:\Windows\System\GrFNVFd.exe
  2⤵
  PID:9400
- C:\Windows\System\umvVcgg.exe
  C:\Windows\System\umvVcgg.exe
  2⤵
  PID:9480
- C:\Windows\System\VTWaVnW.exe
  C:\Windows\System\VTWaVnW.exe
  2⤵
  PID:9604
- C:\Windows\System\gYsbzjB.exe
  C:\Windows\System\gYsbzjB.exe
  2⤵
  PID:9660
- C:\Windows\System\iONTmXo.exe
  C:\Windows\System\iONTmXo.exe
  2⤵
  PID:9520
- C:\Windows\System\QQkjcyD.exe
  C:\Windows\System\QQkjcyD.exe
  2⤵
  PID:9772
- C:\Windows\System\rkPKjIa.exe
  C:\Windows\System\rkPKjIa.exe
  2⤵
  PID:9852
- C:\Windows\System\sKvvIYk.exe
  C:\Windows\System\sKvvIYk.exe
  2⤵
  PID:9912
- C:\Windows\System\DQJySHL.exe
  C:\Windows\System\DQJySHL.exe
  2⤵
  PID:9996
- C:\Windows\System\UpJcIxE.exe
  C:\Windows\System\UpJcIxE.exe
  2⤵
  PID:10080
- C:\Windows\System\ABBRQCX.exe
  C:\Windows\System\ABBRQCX.exe
  2⤵
  PID:10164
- C:\Windows\System\eAPZbhz.exe
  C:\Windows\System\eAPZbhz.exe
  2⤵
  PID:10224
- C:\Windows\System\ufDwWRT.exe
  C:\Windows\System\ufDwWRT.exe
  2⤵
  PID:9268
- C:\Windows\System\ZxGNwpE.exe
  C:\Windows\System\ZxGNwpE.exe
  2⤵
  PID:9464
- C:\Windows\System\mMCEvNG.exe
  C:\Windows\System\mMCEvNG.exe
  2⤵
  PID:9624
- C:\Windows\System\ezwznFm.exe
  C:\Windows\System\ezwznFm.exe
  2⤵
  PID:9768
- C:\Windows\System\gqRpyxq.exe
  C:\Windows\System\gqRpyxq.exe
  2⤵
  PID:9916
- C:\Windows\System\uqbEzSG.exe
  C:\Windows\System\uqbEzSG.exe
  2⤵
  PID:9396
- C:\Windows\System\jFeByju.exe
  C:\Windows\System\jFeByju.exe
  2⤵
  PID:10236
- C:\Windows\System\nvznOlN.exe
  C:\Windows\System\nvznOlN.exe
  2⤵
  PID:9620
- C:\Windows\System\bCirDAM.exe
  C:\Windows\System\bCirDAM.exe
  2⤵
  PID:9892
- C:\Windows\System\HZTywVc.exe
  C:\Windows\System\HZTywVc.exe
  2⤵
  PID:9428
- C:\Windows\System\WxsRiKW.exe
  C:\Windows\System\WxsRiKW.exe
  2⤵
  PID:9888
- C:\Windows\System\HeBCBeH.exe
  C:\Windows\System\HeBCBeH.exe
  2⤵
  PID:10248
- C:\Windows\System\lUIWEIw.exe
  C:\Windows\System\lUIWEIw.exe
  2⤵
  PID:10280
- C:\Windows\System\SDPdgwY.exe
  C:\Windows\System\SDPdgwY.exe
  2⤵
  PID:10340
- C:\Windows\System\nUjmzwx.exe
  C:\Windows\System\nUjmzwx.exe
  2⤵
  PID:10356
- C:\Windows\System\fyPqTRj.exe
  C:\Windows\System\fyPqTRj.exe
  2⤵
  PID:10372
- C:\Windows\System\XzgyPlk.exe
  C:\Windows\System\XzgyPlk.exe
  2⤵
  PID:10412
- C:\Windows\System\uqnrbkB.exe
  C:\Windows\System\uqnrbkB.exe
  2⤵
  PID:10440
- C:\Windows\System\uRLAIGW.exe
  C:\Windows\System\uRLAIGW.exe
  2⤵
  PID:10460
- C:\Windows\System\hQxSNoO.exe
  C:\Windows\System\hQxSNoO.exe
  2⤵
  PID:10496
- C:\Windows\System\HlBcsYn.exe
  C:\Windows\System\HlBcsYn.exe
  2⤵
  PID:10524
- C:\Windows\System\pGhIYNr.exe
  C:\Windows\System\pGhIYNr.exe
  2⤵
  PID:10552
- C:\Windows\System\eHbZysz.exe
  C:\Windows\System\eHbZysz.exe
  2⤵
  PID:10580
- C:\Windows\System\HnEyCbY.exe
  C:\Windows\System\HnEyCbY.exe
  2⤵
  PID:10608
- C:\Windows\System\OzyzNDo.exe
  C:\Windows\System\OzyzNDo.exe
  2⤵
  PID:10636
- C:\Windows\System\CCNuyts.exe
  C:\Windows\System\CCNuyts.exe
  2⤵
  PID:10664
- C:\Windows\System\JJrXUPy.exe
  C:\Windows\System\JJrXUPy.exe
  2⤵
  PID:10692
- C:\Windows\System\qnfIrgd.exe
  C:\Windows\System\qnfIrgd.exe
  2⤵
  PID:10720
- C:\Windows\System\AzFKQfw.exe
  C:\Windows\System\AzFKQfw.exe
  2⤵
  PID:10744
- C:\Windows\System\osyAEGS.exe
  C:\Windows\System\osyAEGS.exe
  2⤵
  PID:10776
- C:\Windows\System\zQYZDGn.exe
  C:\Windows\System\zQYZDGn.exe
  2⤵
  PID:10808
- C:\Windows\System\tGQbsmi.exe
  C:\Windows\System\tGQbsmi.exe
  2⤵
  PID:10836
- C:\Windows\System\wwkAHsM.exe
  C:\Windows\System\wwkAHsM.exe
  2⤵
  PID:10860
- C:\Windows\System\WXFUKZC.exe
  C:\Windows\System\WXFUKZC.exe
  2⤵
  PID:10892
- C:\Windows\System\TJyEYhq.exe
  C:\Windows\System\TJyEYhq.exe
  2⤵
  PID:10920
- C:\Windows\System\xcKXTDm.exe
  C:\Windows\System\xcKXTDm.exe
  2⤵
  PID:10948
- C:\Windows\System\qJkvzDl.exe
  C:\Windows\System\qJkvzDl.exe
  2⤵
  PID:10964
- C:\Windows\System\PvZvkPk.exe
  C:\Windows\System\PvZvkPk.exe
  2⤵
  PID:11004
- C:\Windows\System\GvEzdij.exe
  C:\Windows\System\GvEzdij.exe
  2⤵
  PID:11032
- C:\Windows\System\NSrODMK.exe
  C:\Windows\System\NSrODMK.exe
  2⤵
  PID:11060
- C:\Windows\System\IgAWUML.exe
  C:\Windows\System\IgAWUML.exe
  2⤵
  PID:11088
- C:\Windows\System\EgGoOxr.exe
  C:\Windows\System\EgGoOxr.exe
  2⤵
  PID:11116
- C:\Windows\System\OTPWchD.exe
  C:\Windows\System\OTPWchD.exe
  2⤵
  PID:11144
- C:\Windows\System\zOvEpqT.exe
  C:\Windows\System\zOvEpqT.exe
  2⤵
  PID:11160
- C:\Windows\System\olTsvWD.exe
  C:\Windows\System\olTsvWD.exe
  2⤵
  PID:11200
- C:\Windows\System\UUYDRnv.exe
  C:\Windows\System\UUYDRnv.exe
  2⤵
  PID:11216
- C:\Windows\System\bPcuEfZ.exe
  C:\Windows\System\bPcuEfZ.exe
  2⤵
  PID:11256
- C:\Windows\System\vkXnVeo.exe
  C:\Windows\System\vkXnVeo.exe
  2⤵
  PID:10272
- C:\Windows\System\VlsxMBT.exe
  C:\Windows\System\VlsxMBT.exe
  2⤵
  PID:10348
- C:\Windows\System\IpnlmZG.exe
  C:\Windows\System\IpnlmZG.exe
  2⤵
  PID:10408
- C:\Windows\System\BuguARc.exe
  C:\Windows\System\BuguARc.exe
  2⤵
  PID:10488
- C:\Windows\System\qcRdvmO.exe
  C:\Windows\System\qcRdvmO.exe
  2⤵
  PID:10548
- C:\Windows\System\fNQHgLh.exe
  C:\Windows\System\fNQHgLh.exe
  2⤵
  PID:10620
- C:\Windows\System\SExiryh.exe
  C:\Windows\System\SExiryh.exe
  2⤵
  PID:10688
- C:\Windows\System\eaOyyff.exe
  C:\Windows\System\eaOyyff.exe
  2⤵
  PID:10740
- C:\Windows\System\JClpLnp.exe
  C:\Windows\System\JClpLnp.exe
  2⤵
  PID:10852
- C:\Windows\System\eLeREID.exe
  C:\Windows\System\eLeREID.exe
  2⤵
  PID:10912
- C:\Windows\System\huKGDyc.exe
  C:\Windows\System\huKGDyc.exe
  2⤵
  PID:10976
- C:\Windows\System\AnYqONn.exe
  C:\Windows\System\AnYqONn.exe
  2⤵
  PID:11028
- C:\Windows\System\ZcXzZwJ.exe
  C:\Windows\System\ZcXzZwJ.exe
  2⤵
  PID:11108
- C:\Windows\System\qowPadK.exe
  C:\Windows\System\qowPadK.exe
  2⤵
  PID:11156
- C:\Windows\System\nHVrVva.exe
  C:\Windows\System\nHVrVva.exe
  2⤵
  PID:11244
- C:\Windows\System\oqMCQHa.exe
  C:\Windows\System\oqMCQHa.exe
  2⤵
  PID:10328
- C:\Windows\System\MRRMNLF.exe
  C:\Windows\System\MRRMNLF.exe
  2⤵
  PID:10456
- C:\Windows\System\mElisuh.exe
  C:\Windows\System\mElisuh.exe
  2⤵
  PID:10676
- C:\Windows\System\UycfWJg.exe
  C:\Windows\System\UycfWJg.exe
  2⤵
  PID:10832
- C:\Windows\System\EiTUWvl.exe
  C:\Windows\System\EiTUWvl.exe
  2⤵
  PID:10996
- C:\Windows\System\yDYxcYu.exe
  C:\Windows\System\yDYxcYu.exe
  2⤵
  PID:11056
- C:\Windows\System\CzQcWge.exe
  C:\Windows\System\CzQcWge.exe
  2⤵
  PID:10220
- C:\Windows\System\wwTZIni.exe
  C:\Windows\System\wwTZIni.exe
  2⤵
  PID:10592
- C:\Windows\System\eanJqQB.exe
  C:\Windows\System\eanJqQB.exe
  2⤵
  PID:10960
- C:\Windows\System\PHjWSxk.exe
  C:\Windows\System\PHjWSxk.exe
  2⤵
  PID:10388
- C:\Windows\System\fHlgKHn.exe
  C:\Windows\System\fHlgKHn.exe
  2⤵
  PID:11208
- C:\Windows\System\NANMAxK.exe
  C:\Windows\System\NANMAxK.exe
  2⤵
  PID:11272
- C:\Windows\System\EjFKFIP.exe
  C:\Windows\System\EjFKFIP.exe
  2⤵
  PID:11300
- C:\Windows\System\htiOLvl.exe
  C:\Windows\System\htiOLvl.exe
  2⤵
  PID:11328
- C:\Windows\System\JHIoqIM.exe
  C:\Windows\System\JHIoqIM.exe
  2⤵
  PID:11356
- C:\Windows\System\iYIDToT.exe
  C:\Windows\System\iYIDToT.exe
  2⤵
  PID:11384
- C:\Windows\System\TejSEgR.exe
  C:\Windows\System\TejSEgR.exe
  2⤵
  PID:11412
- C:\Windows\System\FrgytRu.exe
  C:\Windows\System\FrgytRu.exe
  2⤵
  PID:11440
- C:\Windows\System\UFmYbuf.exe
  C:\Windows\System\UFmYbuf.exe
  2⤵
  PID:11468
- C:\Windows\System\VIRoBnV.exe
  C:\Windows\System\VIRoBnV.exe
  2⤵
  PID:11496
- C:\Windows\System\Psnvrgw.exe
  C:\Windows\System\Psnvrgw.exe
  2⤵
  PID:11524
- C:\Windows\System\rPLlkzE.exe
  C:\Windows\System\rPLlkzE.exe
  2⤵
  PID:11552
- C:\Windows\System\PfmmLaS.exe
  C:\Windows\System\PfmmLaS.exe
  2⤵
  PID:11580
- C:\Windows\System\TPopirv.exe
  C:\Windows\System\TPopirv.exe
  2⤵
  PID:11608
- C:\Windows\System\FwjJywO.exe
  C:\Windows\System\FwjJywO.exe
  2⤵
  PID:11636
- C:\Windows\System\xiMbgBw.exe
  C:\Windows\System\xiMbgBw.exe
  2⤵
  PID:11664
- C:\Windows\System\kSPdCDg.exe
  C:\Windows\System\kSPdCDg.exe
  2⤵
  PID:11692
- C:\Windows\System\DsBaivR.exe
  C:\Windows\System\DsBaivR.exe
  2⤵
  PID:11720
- C:\Windows\System\ZkezekB.exe
  C:\Windows\System\ZkezekB.exe
  2⤵
  PID:11736
- C:\Windows\System\zaClpDZ.exe
  C:\Windows\System\zaClpDZ.exe
  2⤵
  PID:11776
- C:\Windows\System\kQUZWgP.exe
  C:\Windows\System\kQUZWgP.exe
  2⤵
  PID:11804
- C:\Windows\System\TjKhaWM.exe
  C:\Windows\System\TjKhaWM.exe
  2⤵
  PID:11832
- C:\Windows\System\PuOTfIG.exe
  C:\Windows\System\PuOTfIG.exe
  2⤵
  PID:11860
- C:\Windows\System\LHIaCFQ.exe
  C:\Windows\System\LHIaCFQ.exe
  2⤵
  PID:11888
- C:\Windows\System\vmwHeLW.exe
  C:\Windows\System\vmwHeLW.exe
  2⤵
  PID:11916
- C:\Windows\System\zXUBDMz.exe
  C:\Windows\System\zXUBDMz.exe
  2⤵
  PID:11944
- C:\Windows\System\aIzxBCl.exe
  C:\Windows\System\aIzxBCl.exe
  2⤵
  PID:11972
- C:\Windows\System\PTrAvYn.exe
  C:\Windows\System\PTrAvYn.exe
  2⤵
  PID:12004
- C:\Windows\System\nNAXjfX.exe
  C:\Windows\System\nNAXjfX.exe
  2⤵
  PID:12036
- C:\Windows\System\UVuIFRK.exe
  C:\Windows\System\UVuIFRK.exe
  2⤵
  PID:12064
- C:\Windows\System\gXVfceb.exe
  C:\Windows\System\gXVfceb.exe
  2⤵
  PID:12092
- C:\Windows\System\CHWuFvR.exe
  C:\Windows\System\CHWuFvR.exe
  2⤵
  PID:12120
- C:\Windows\System\WfvmVLj.exe
  C:\Windows\System\WfvmVLj.exe
  2⤵
  PID:12148
- C:\Windows\System\SEjrHnx.exe
  C:\Windows\System\SEjrHnx.exe
  2⤵
  PID:12176
- C:\Windows\System\aEBnHje.exe
  C:\Windows\System\aEBnHje.exe
  2⤵
  PID:12192
- C:\Windows\System\JKRdcAE.exe
  C:\Windows\System\JKRdcAE.exe
  2⤵
  PID:12216
- C:\Windows\System\NWXMIVL.exe
  C:\Windows\System\NWXMIVL.exe
  2⤵
  PID:12236
- C:\Windows\System\sTAzeqv.exe
  C:\Windows\System\sTAzeqv.exe
  2⤵
  PID:12284
- C:\Windows\System\vdWwyVg.exe
  C:\Windows\System\vdWwyVg.exe
  2⤵
  PID:11340
- C:\Windows\System\dECTkqy.exe
  C:\Windows\System\dECTkqy.exe
  2⤵
  PID:11404
- C:\Windows\System\VkBcwvV.exe
  C:\Windows\System\VkBcwvV.exe
  2⤵
  PID:11460
- C:\Windows\System\OVxAXKH.exe
  C:\Windows\System\OVxAXKH.exe
  2⤵
  PID:11508
- C:\Windows\System\UXXnlyL.exe
  C:\Windows\System\UXXnlyL.exe
  2⤵
  PID:11544
- C:\Windows\System\uBzGRRF.exe
  C:\Windows\System\uBzGRRF.exe
  2⤵
  PID:11680
- C:\Windows\System\fHSNrid.exe
  C:\Windows\System\fHSNrid.exe
  2⤵
  PID:11748
- C:\Windows\System\fYGUhIo.exe
  C:\Windows\System\fYGUhIo.exe
  2⤵
  PID:11800
- C:\Windows\System\TmPJpOP.exe
  C:\Windows\System\TmPJpOP.exe
  2⤵
  PID:11856
- C:\Windows\System\srFzbPV.exe
  C:\Windows\System\srFzbPV.exe
  2⤵
  PID:11928
- C:\Windows\System\VwfiEgY.exe
  C:\Windows\System\VwfiEgY.exe
  2⤵
  PID:11996
- C:\Windows\System\KUpurdc.exe
  C:\Windows\System\KUpurdc.exe
  2⤵
  PID:12060
- C:\Windows\System\sdMKgWs.exe
  C:\Windows\System\sdMKgWs.exe
  2⤵
  PID:12132
- C:\Windows\System\hskiUol.exe
  C:\Windows\System\hskiUol.exe
  2⤵
  PID:12212
- C:\Windows\System\eyHviIt.exe
  C:\Windows\System\eyHviIt.exe
  2⤵
  PID:11428
- C:\Windows\System\uccKWxZ.exe
  C:\Windows\System\uccKWxZ.exe
  2⤵
  PID:11596
- C:\Windows\System\rgkANCk.exe
  C:\Windows\System\rgkANCk.exe
  2⤵
  PID:11788
- C:\Windows\System\suJjDnB.exe
  C:\Windows\System\suJjDnB.exe
  2⤵
  PID:11984
- C:\Windows\System\JDLboCW.exe
  C:\Windows\System\JDLboCW.exe
  2⤵
  PID:12116
- C:\Windows\System\whXaBDn.exe
  C:\Windows\System\whXaBDn.exe
  2⤵
  PID:11396
- C:\Windows\System\AijrIOp.exe
  C:\Windows\System\AijrIOp.exe
  2⤵
  PID:11956
- C:\Windows\System\NJWxipY.exe
  C:\Windows\System\NJWxipY.exe
  2⤵
  PID:12308
- C:\Windows\System\aDxLSEy.exe
  C:\Windows\System\aDxLSEy.exe
  2⤵
  PID:12340
- C:\Windows\System\cdiVdNn.exe
  C:\Windows\System\cdiVdNn.exe
  2⤵
  PID:12368
- C:\Windows\System\NhcAnkq.exe
  C:\Windows\System\NhcAnkq.exe
  2⤵
  PID:12400
- C:\Windows\System\RGlgeCT.exe
  C:\Windows\System\RGlgeCT.exe
  2⤵
  PID:12428
- C:\Windows\System\esSnSWg.exe
  C:\Windows\System\esSnSWg.exe
  2⤵
  PID:12456
- C:\Windows\System\WUwxmUL.exe
  C:\Windows\System\WUwxmUL.exe
  2⤵
  PID:12484
- C:\Windows\System\cPRLQjJ.exe
  C:\Windows\System\cPRLQjJ.exe
  2⤵
  PID:12516
- C:\Windows\System\GWmAwiZ.exe
  C:\Windows\System\GWmAwiZ.exe
  2⤵
  PID:12552
- C:\Windows\System\XVPvQqI.exe
  C:\Windows\System\XVPvQqI.exe
  2⤵
  PID:12572
- C:\Windows\System\PJcEJxb.exe
  C:\Windows\System\PJcEJxb.exe
  2⤵
  PID:12608
- C:\Windows\System\YhAwLEv.exe
  C:\Windows\System\YhAwLEv.exe
  2⤵
  PID:12660
- C:\Windows\System\CGlCQCW.exe
  C:\Windows\System\CGlCQCW.exe
  2⤵
  PID:12696
- C:\Windows\System\MRotIVF.exe
  C:\Windows\System\MRotIVF.exe
  2⤵
  PID:12724
- C:\Windows\System\FObewAP.exe
  C:\Windows\System\FObewAP.exe
  2⤵
  PID:12752
- C:\Windows\System\qjxrqsj.exe
  C:\Windows\System\qjxrqsj.exe
  2⤵
  PID:12780
- C:\Windows\System\wrSNlJI.exe
  C:\Windows\System\wrSNlJI.exe
  2⤵
  PID:12824
- C:\Windows\System\WgtlumQ.exe
  C:\Windows\System\WgtlumQ.exe
  2⤵
  PID:12852
- C:\Windows\System\bzDjfuQ.exe
  C:\Windows\System\bzDjfuQ.exe
  2⤵
  PID:12884
- C:\Windows\System\gHcaTzr.exe
  C:\Windows\System\gHcaTzr.exe
  2⤵
  PID:12932
- C:\Windows\System\IpzPGZw.exe
  C:\Windows\System\IpzPGZw.exe
  2⤵
  PID:12980
- C:\Windows\System\RWAsxzb.exe
  C:\Windows\System\RWAsxzb.exe
  2⤵
  PID:13016
- C:\Windows\System\bbCEfoN.exe
  C:\Windows\System\bbCEfoN.exe
  2⤵
  PID:13048
- C:\Windows\System\rBXHgiI.exe
  C:\Windows\System\rBXHgiI.exe
  2⤵
  PID:13076
- C:\Windows\System\fqdpoks.exe
  C:\Windows\System\fqdpoks.exe
  2⤵
  PID:13128
- C:\Windows\System\ljNjEOT.exe
  C:\Windows\System\ljNjEOT.exe
  2⤵
  PID:13196
- C:\Windows\System\YKYjtDj.exe
  C:\Windows\System\YKYjtDj.exe
  2⤵
  PID:13236
- C:\Windows\System\mEcmBZH.exe
  C:\Windows\System\mEcmBZH.exe
  2⤵
  PID:13256
- C:\Windows\System\RDxxExJ.exe
  C:\Windows\System\RDxxExJ.exe
  2⤵
  PID:13284
- C:\Windows\System\KdBRGUv.exe
  C:\Windows\System\KdBRGUv.exe
  2⤵
  PID:12304
- C:\Windows\System\lkvQZiH.exe
  C:\Windows\System\lkvQZiH.exe
  2⤵
  PID:12380
- C:\Windows\System\iOWTlQV.exe
  C:\Windows\System\iOWTlQV.exe
  2⤵
  PID:12448
- C:\Windows\System\VDNDsVT.exe
  C:\Windows\System\VDNDsVT.exe
  2⤵
  PID:3080
- C:\Windows\System\qFzySYi.exe
  C:\Windows\System\qFzySYi.exe
  2⤵
  PID:12532
- C:\Windows\System\miuUqjN.exe
  C:\Windows\System\miuUqjN.exe
  2⤵
  PID:12540
- C:\Windows\System\gsbJAeW.exe
  C:\Windows\System\gsbJAeW.exe
  2⤵
  PID:12584
- C:\Windows\System\VDLiLSJ.exe
  C:\Windows\System\VDLiLSJ.exe
  2⤵
  PID:12688
- C:\Windows\System\LHkEQty.exe
  C:\Windows\System\LHkEQty.exe
  2⤵
  PID:12748
- C:\Windows\System\zMMJSgB.exe
  C:\Windows\System\zMMJSgB.exe
  2⤵
  PID:12836
- C:\Windows\System\dMiXmyG.exe
  C:\Windows\System\dMiXmyG.exe
  2⤵
  PID:12900
- C:\Windows\System\ywtEhRA.exe
  C:\Windows\System\ywtEhRA.exe
  2⤵
  PID:13008
- C:\Windows\System\XRZhDeP.exe
  C:\Windows\System\XRZhDeP.exe
  2⤵
  PID:13072
- C:\Windows\System\eqDaWBf.exe
  C:\Windows\System\eqDaWBf.exe
  2⤵
  PID:13208
- C:\Windows\System\XVwLZOO.exe
  C:\Windows\System\XVwLZOO.exe
  2⤵
  PID:13296
- C:\Windows\System\wnYDiUk.exe
  C:\Windows\System\wnYDiUk.exe
  2⤵
  PID:12416
- C:\Windows\System\xstRaRT.exe
  C:\Windows\System\xstRaRT.exe
  2⤵
  PID:10660
- C:\Windows\System\jfHFNza.exe
  C:\Windows\System\jfHFNza.exe
  2⤵
  PID:11964
- C:\Windows\System\UbZhyxK.exe
  C:\Windows\System\UbZhyxK.exe
  2⤵
  PID:12776
- C:\Windows\System\FYqmhmy.exe
  C:\Windows\System\FYqmhmy.exe
  2⤵
  PID:12964
- C:\Windows\System\cPiEtWa.exe
  C:\Windows\System\cPiEtWa.exe
  2⤵
  PID:13184
- C:\Windows\System\SYyaqwj.exe
  C:\Windows\System\SYyaqwj.exe
  2⤵
  PID:596
- C:\Windows\System\UIUhVZd.exe
  C:\Windows\System\UIUhVZd.exe
  2⤵
  PID:12736
- C:\Windows\System\YfrBjVS.exe
  C:\Windows\System\YfrBjVS.exe
  2⤵
  PID:13144
- C:\Windows\System\QvcItLN.exe
  C:\Windows\System\QvcItLN.exe
  2⤵
  PID:12672
- C:\Windows\System\GEANxgb.exe
  C:\Windows\System\GEANxgb.exe
  2⤵
  PID:232
- C:\Windows\System\oiGOiNO.exe
  C:\Windows\System\oiGOiNO.exe
  2⤵
  PID:13340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:7740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ozdnpael.hig.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozdnpael.hig.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

COZXWxt.exe

Path C:\Windows\System\COZXWxt.exe
Size 4.2MB
SHA256 65d981f715bc24d26f6ad8ca53542cf6e9e684ec9c402dd02115d74da20fa699
MD5 b52c1ff6ddd84d79bf450ea97abacd39
SHA1 209196186c71e06317e324f178ee8e48fdbc8210
SHA512 c4ccae7cccd03d0ac8a256ca46dc88f1ca90626560d94c08fb7ddc9bf9f3dc2d5130476ddf2c1ec02779de27237e4c1f163a21c78665856d450962d786a54201
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:SbBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

DYqkZym.exe

Path C:\Windows\System\DYqkZym.exe
Size 4.2MB
SHA256 8b55b6b812f240b18e4ef8e4dbd3bf43d9a790b2b91da6c255653d9ff1634431
MD5 9dce94af6bb2ce65f54c3430e0e2891e
SHA1 adebc141610b8cf010a8c065971844d4700bc64b
SHA512 b85b84e9b93227376520e25301c7801820b668cdcacf1b782da3c0862e024c631d57764538b76d7043024f36262e7957ceb6b60d9a864b53cc195535a8874616
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:SbBeSFkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

FbelNZl.exe

Path C:\Windows\System\FbelNZl.exe
Size 4.2MB
SHA256 4f44ca6357e428d723ce65d2926c75d4e06061ca62ec424bd755d4c70c7e83a9
MD5 40bd04c6d6e8556c674b8f64349c3dc0
SHA1 366695cedf963e287669a40235cb02e4a7ab2932
SHA512 a11704284e3a9a27269a673bb7f8cda8884f4b0dbf981ef6843eae4fda5489896ade468a3061bdfa1d2323b52469dc875c36ae4da6c9205351b57ec2e5d98529
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:SbBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

FguPvjf.exe

Path C:\Windows\System\FguPvjf.exe
Size 4.2MB
SHA256 94078ec6fe91a331fe1ef5c15e6e1cd25098b953cbf5d1b84aedfba0c788e113
MD5 fe81c33c989d0bfd46ce75a327fd965e
SHA1 8572fb8604f27a5ac365ff64653adb0cf8bfd97c
SHA512 68f879b1a1bd6f94f44ecb75043602d0c59deeeacdac7da5fb294e350233677959e56a2233dd2ff6016a34fc0a2c557e79553be0ba2b446313ff2bf832bbe8fb
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:SbBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

FhMBbAn.exe

Path C:\Windows\System\FhMBbAn.exe
Size 4.2MB
SHA256 311dcd130837237b175e00783b97c5a22259e08258ab5b77830ca73984963cc8
MD5 ffba7625b9d3e89ddd3dc9891019164d
SHA1 2de2c182b8e0cddd10e187672597e130875a8430
SHA512 062f983ec99cab24c26300cafb4d07d9f559cd43e169de4cc1681ac0abb3cb663c5af0acf2b16b4e0b143309d2436173e0eb6505e5b241e4af4f0e2202ed3cf4
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW6:SbBeSFkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FrwIXkE.exe

Path C:\Windows\System\FrwIXkE.exe
Size 4.2MB
SHA256 3967734b1b784d4007a5cd2046eeedf768296160bca088d3e254b8447910ab57
MD5 3cf1588fb1c24658d87a1ab395613293
SHA1 34193b4fb15c165040b6ec025effb46dd757bc8b
SHA512 bdce7f9eeeb85cba297b2c9443e809b86df095150dd07136bc12e1534c24519e23535c319a4a12051e39108fc9fb79264f0822479f8e72e28b3cd4424420ee21
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:SbBeSFk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

GwHLrzW.exe

Path C:\Windows\System\GwHLrzW.exe
Size 4.2MB
SHA256 68a0fc65d03134b9e9ad37e429f454b536167ee9bbb4a4911818f1be4a8d085d
MD5 82114716eb4d20ed84bdba8c569d8931
SHA1 0567f2167e670b7f0c6ceec6f6b6d35378ee724c
SHA512 ef170868702af65fa2c7595708dab23ccd12587a226a2534ecf96aaef38860597747e1a8456d4d9bde752c1f8f357388b9c97558d63ad6765010a46cbf3e7598
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:SbBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

HpNbvij.exe

Path C:\Windows\System\HpNbvij.exe
Size 4.2MB
SHA256 cc3dddaa4cc111a2bcfa9c5b9317d3bc73f25ccedb4231dcf071594f08c63270
MD5 5952493dd997cb8c8361b493f724780e
SHA1 a828eb55ed94d74c97786958988397257f17dcb6
SHA512 217532a1d2b75353e64eeac8883ab39cffa955629d9c7213dc6e6894ffb8409da90b31ed768429fceacfa142519c402018e00e74cbf51f9389507b49b0721a81
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:SbBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

JfCWCis.exe

Path C:\Windows\System\JfCWCis.exe
Size 4.2MB
SHA256 e363c46dd82e4deecea0bd2fac2f1a5a52e954f57175e07d784211a160d39e6e
MD5 958c1a8f40f8fc016d7991319dec95e9
SHA1 0ce2e42b421a11040bf113f8f653dd3ffaea4e10
SHA512 a419bb6815f9eef9079554b9d0bba60818b931b5d77c230ff5158711527664129f6285923ece30373cbae6d388eb6f0b251e09ca7412cd98b00181e18310c100
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW8:SbBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxuabVM.exe

Path C:\Windows\System\JxuabVM.exe
Size 4.2MB
SHA256 80f34df65c9f34e66fb22b162ad8b3961e36c1a0d0b86e51a5075a139c09dbf5
MD5 85c3148ed95f597754960fb3c247dba4
SHA1 585b4f541ecc0b8fc088400b2339a639d343d057
SHA512 52e8e6bbcd0b22092d6a8fe709ba5ce3c81b8df64b01a0a8c665d6ee95dbda7c4775af829e4bd977264b506aca70ff179834a02d52827ebc3e67aac704cbfdb1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:SbBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

KEBqTFK.exe

Path C:\Windows\System\KEBqTFK.exe
Size 4.2MB
SHA256 84944edf68c67e1c3f88d2466f44c3fb7f6ec482202096c4810f258be4760382
MD5 ed39adf1f548cfbb596782c5b8d47859
SHA1 7d498e49572288107a46b3d611fa85ffcfaa2f22
SHA512 966be4f8af6a463fab739f573de1beaa7954527ea4c27edd00b89ee2b216c02f729ba0fdc91d157dd171bea302bc9d75c84ea2ec0f871c20a2177a98c8585318
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:SbBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

NhrHuWA.exe

Path C:\Windows\System\NhrHuWA.exe
Size 4.2MB
SHA256 09766352a1f15cf920b432de4c8c9e210cbba85e32f0426be2f08b253e0ab186
MD5 8a2e56232ef65003e67ea2b6368d03a6
SHA1 71d6bbaecf86350dac1edbcdaa37a53d3dc0d872
SHA512 b78bcb0a2417ea5c2587c35067f7e143d8c666a31db6b6312b4678879092abe2da513b2d024e6a208e09c949777503937a8320257d253fcfae47d9acd9227925
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:SbBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QjtqjXe.exe

Path C:\Windows\System\QjtqjXe.exe
Size 4.2MB
SHA256 dc9067dce68e94ad89671386b48462c7fee0eb18d5615b28cae906d93d78f578
MD5 18b73b10ff38784f0f17e8b949d7073c
SHA1 b3d9786635adc6380c778a36d725f9d9bbbd4b01
SHA512 0106aaac17e578e3b1477ccecca192f6ae5f3fc99d01ae21c5ac5b99d7a0572f9fa9562bba1ad1444c19477ff392be9159d56c8c8e85430da36e71b263277d3d
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:SbBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQLDMQh.exe

Path C:\Windows\System\SQLDMQh.exe
Size 4.2MB
SHA256 65e4bdc647ab1169cc0bb4c1291ffe1d26db3207ba8ee925994b3a50476a056f
MD5 49677012bef4808db92a58cbbf793254
SHA1 386ede49d5cc6e08a21c796fe0dd0a31dea56d6b
SHA512 e6ea3df9ef6768ddf1394d6597a8f5ce59568c6b7dd654e7d94559ce302e5892256bc7513b04893ec19c1f7f263f4b7c3c530e1f57fa043dafb58ba272e23a3c
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWI:SbBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TKeQwqX.exe

Path C:\Windows\System\TKeQwqX.exe
Size 4.2MB
SHA256 5474c1f56d8e7aa838d4fd3aabf13fa6fc16e51e54d07c78aa7185f95f6fe421
MD5 6a7e8b631c7cfc6712f439ae9f62daf0
SHA1 bfc442e89c2afaea95c0d8d23af08853c8c27a27
SHA512 c4e24fcf4a4abee67f590d563a5f9af29bf10e59def2460631b2d10d30ad393d55541dda9a11f86fbf27e0d8e186182cea25bbfd50c048a2647f73877fdbbfe8
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:SbBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

UrgXHfM.exe

Path C:\Windows\System\UrgXHfM.exe
Size 4.2MB
SHA256 a11502241ea1cf734b5cba42d1dbcede627e0022716c1737791e29ce148fe129
MD5 9aad6b9c9788ae09301dfbc9255ca2e9
SHA1 326528d92b9a1bcf3bbf6975a17d64c3fa6754e5
SHA512 da6bc95419ea083e07020495617cc4a6eb74c426c98e9570a150db64730cea31bd373bd4197847c02e3959c70adcafcc8e923deec539d8150858f44ad743ce6a
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:SbBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

UxCBWtW.exe

Path C:\Windows\System\UxCBWtW.exe
Size 4.2MB
SHA256 824b8e959caf1ddc4775fe204dba73dda5a88aea23866d7b1e97f806570a2fb8
MD5 e329e1e414c8cfb632ab7a6237d5f2ac
SHA1 eff55d5237b607a2ba51b8605c5d7b06ab74a343
SHA512 adc6ac2abb1e3908b4b70ca9b5dfd65966e6eccb71a461ded0893d347d5b03e921a2ba436024d969639756e8956c9a1874eec1e18f033bf8e56bbc5afb34c275
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:SbBeSFkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMLjTyg.exe

Path C:\Windows\System\VMLjTyg.exe
Size 4.2MB
SHA256 cab066b5e7c93a0c98590a28b5303c31a4c7f46cd399fde524eb6f7f35b97fba
MD5 2bb6ab31e334f97c337eacca1acd48db
SHA1 a45724f799e03b2d0ed57375a3bc42a79d2f5a35
SHA512 e25b1ccab21927140e8f54693ee1b50c31f53e8f38c7d80a58dd3b9fb884df042c63b94b9d14ea4795b2c6b6369d2d0759267976fb5e0adbd7d3610721395de4
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:SbBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

VxwHFux.exe

Path C:\Windows\System\VxwHFux.exe
Size 4.2MB
SHA256 5ae728833ac6f6a470e66b13ef465de9da53c7cd577f17c880b3eaf2b91772ca
MD5 f0ac4651c75b6ace434c286560e9ec29
SHA1 d7ab8d69603ade53bbac911aac2947ab3f1a5cf4
SHA512 cb8c9c894b35d8e6255e5d9acc402b084d8c125347a2d5821f8e09f9a6426fde594df891c5bb747c276c795eafb28113723085572806886fa2370c8f6030a87d
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:SbBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZEEqDY.exe

Path C:\Windows\System\ZZEEqDY.exe
Size 4.2MB
SHA256 b84c680bd87f5124c7e3dedaaff20a0bd20f4cbfe072dfd081cb420e558680a6
MD5 cd5bf7a7934da781a576c7b3723d63a3
SHA1 4cc478d88ed1690447f72c98f8929472b44fbfef
SHA512 ad0d6ef903a889d17e627081d3b1dcd67af41118af7f0cc1f40ae5e1a42da28a1590eb877f307c33e6d6bcec2b193eead343f732a9b99d179c745a88a76ae7ba
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:SbBeSFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

cXgkNdH.exe

Path C:\Windows\System\cXgkNdH.exe
Size 4.2MB
SHA256 1e2200d716444bd75ca76866b1e4d7e95a73f223ec260e08d0d493228c552315
MD5 8c61596fe9dfb8b178fd2ba1a7a57d41
SHA1 e21e1344d98b8d21c721770b1547db910ebc58bc
SHA512 3488036e3bf0a37e8e54fedb663493eaf7ebdeddd28c5ff1890420a9afa512975f506c77e1b8129c834c3e339ae9d6787124d4c7d84d2df512ebf2dbe46e08e7
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:SbBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ceiWnQM.exe

Path C:\Windows\System\ceiWnQM.exe
Size 4.2MB
SHA256 bcfe5c939eb2a5695450b37022095ddacb77b5f3b83c8e4c4d5841f5b257cb31
MD5 3fffd48df2d8490a70b13b6149fc6c9e
SHA1 a3302ada7ea7b0fa2b8efd290b92fa4d426614f0
SHA512 ccf7a893ca86ac536974f2c39c1465c3cf6f07153d0effdef58ef2d0a10c7fb9eac8e4d483c5c0bc48a70aa09b2262402d1a4ff200b1a179f6767358643439a0
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:SbBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

fFkZYih.exe

Path C:\Windows\System\fFkZYih.exe
Size 4.2MB
SHA256 da6fce071f9350818a37e1502efcfef0d6d9a960e785a598a084719f0a3bbb0f
MD5 15a54606b690988b634a3769085668c0
SHA1 ca28663ae1bf0452e977e1f4aecfa01187b200bd
SHA512 66382964b4f9bbb9572496ce35b95ae27f3a630354232c14a8c71287c31c6db966557da8ade7ec68287fb67795b61495a6213c1b4b3b9d1993a23ba41d6d3200
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:SbBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gDVGRzF.exe

Path C:\Windows\System\gDVGRzF.exe
Size 4.2MB
SHA256 38f91c437de1cd314c73ebbdaac6553a028870f3525dc24601d21a645be332e1
MD5 ad19605ffad6c7113f2e9fddcd08a68d
SHA1 f998da3afbf3cacd78d6177be28471e12644f8a5
SHA512 6c65fd49000170471cea3baa7f9be0e769bbe8a86b6a363290d16bc4af230c431203ec93a05ee28a7809dca26e281b9048355a28fec058558fac9eb0f0d7a622
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:SbBeSFkZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gWcqhBP.exe

Path C:\Windows\System\gWcqhBP.exe
Size 4.2MB
SHA256 54cfbb21940f01c3a00afc9ce76097ba18701b0ab99675755f6b765c040bc438
MD5 dfbfeaab4f87c148d6037a5362b212db
SHA1 d5a7a7ada97548ad0aefdaa07e174937c2fd0190
SHA512 429327ee54efdbcf97bba72e8cda048bbf864ce82699bab3ff969c9cf0507f8f61167ca362ef34ca57b44dc712f2f89791c6203cdc47b231de3d255888727ef0
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:SbBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gapwotm.exe

Path C:\Windows\System\gapwotm.exe
Size 4.2MB
SHA256 d50bd64374078e476cc1e33ad31fcdeba0eb63185803bcd58cb0c05b04142e8b
MD5 b41b96d9cda454916f265f2cb97c64be
SHA1 e541dc4bb49d1a76027c84f018007a672394c1f8
SHA512 a2b3da2a8099ba49f9f84d6b7124f12851bf95fe42b670f5cca1ab9d9e1c7581b5edea4325fa1e5025a914b56c966ba0bf8db4e6cb8280e8b3f5667921f890ed
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:SbBeSFkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcymRua.exe

Path C:\Windows\System\gcymRua.exe
Size 4.2MB
SHA256 7c4e9f9a30ca82dd8cc3f0f72361185b22cfd2405fd950fe2eaa9bf4b8862b22
MD5 6c6cf07b215e4f95c68326f5ddde023e
SHA1 1bf39a639bfd3a0ca03a715bf57dc40eeb8663b9
SHA512 aab122c6e9859b253b04f07b03800147eace022b47d4f2cdbf6ab61ec36914de10be570f482e0140c7fd750fe9705f56e543e8fc454bb7740b473f2f900b384b
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hciMMxR.exe

Path C:\Windows\System\hciMMxR.exe
Size 4.2MB
SHA256 abf22b379c7c966485b41ec19069040b476fe15aface96c22f4af39b8a15ce6c
MD5 c91365dbd22243601c254ca354bb1190
SHA1 b12dcccffe34c7cfc16b90d3022f02be2eafa4fc
SHA512 d3b46e1c89af2b4248abe8502b1d79d92b59f5bf7ba461fc13df7846d4c85be5619356da893091a1d8769f53ceca20ef250172e14338f2ad8eb6a0fd4ad04430
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:SbBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

mbGMAYA.exe

Path C:\Windows\System\mbGMAYA.exe
Size 4.2MB
SHA256 d798315ed1a05006964ff84ea65f7de40219cd9eb4eb1cdef6bb6f83d77ab0e5
MD5 21bd0865b814ae335ce46ea288d06bea
SHA1 100b2594796430a00772ec344206741289639187
SHA512 ff7296623124139f0ebe3d5283cc2b2ba589d361d4a756c7a5aa379e3a74c70ff2846a48478b0bf05ba1977fd55c401d3a476775d818325c189271bd681c9962
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:SbBeSFkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqeCJtp.exe

Path C:\Windows\System\oqeCJtp.exe
Size 4.2MB
SHA256 a58d4d5f6051fd5ee6e224122d6e3281305574229f70fedd2e00c24c3eb4baee
MD5 487302d8bf720404cee8cc9d7bbbae81
SHA1 fcb07cb4dc7fa5413492ab7a1b86d727560047c2
SHA512 8bb431d77a9e30bc513ce893577c4feb7c68f9648592f642777a9b4a17d27e315398d920cf6534e2d242f1461a15a031c6bd4513e97bae2279184fffcd7728da
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:SbBeSFkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

qZTkOAM.exe

Path C:\Windows\System\qZTkOAM.exe
Size 8B
SHA256 755fd52af881e52d8581734deed65b261324bea5979dbb6c3cb63a484774b291
MD5 bb619ca80177568a9850ff8d7dc139bc
SHA1 39598cf7a1b2d3ae37699a3d204bcb3b9a800338
SHA512 77a78bba51b6f52cc6161f41e26d3b06c03e53c642da1fce66ee01b29a74a58b514da40bb12a8dbaffc02d45dc730672ed991bf1ba6f8df90e20af812fc0abd2
MD5 SHA1 SHA512

Submit Download

vvEjkUX.exe

Path C:\Windows\System\vvEjkUX.exe
Size 4.2MB
SHA256 550aaf8b564dc8a85f20aeb500d0e6cc88fefce1dff1fd770ea13f2049f8eed2
MD5 1c2c998c6c83e0f3e1f4348113599fb0
SHA1 b265ced30d74e6ea13787bc5fab1c96578464bec
SHA512 2a3436f2aa632fe06cd35a0394f16117cb29b818e89f18607518c965c0663f5fe77eb9dc764ab97f128175f94cbd88a0c12d9532eeb88fafca5f5b19050503f9
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:SbBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

zCZUNYN.exe

Path C:\Windows\System\zCZUNYN.exe
Size 4.2MB
SHA256 237e8cba46e14ed3bc861527e8c6c58a40bcf3e1cdef03b26124ec2ccd52f821
MD5 eb65e3e017e1bebb9f39b7f138d437d7
SHA1 3c7c8fda89e73ee9f35fe7e0cd29e4e0ed28a6f1
SHA512 486e609bcbe53e9ad5839f51d9beb2b7c0efd8f5fc2976b044baa8389bfb5ebfc1cdc5c635ca5877f02e7e7836a1d1f1c84fa371ff290c190059ce3b0fe08003
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWk:SbBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGwfarj.exe

Path C:\Windows\System\zGwfarj.exe
Size 4.2MB
SHA256 d68e6f3808f0a9a52df4ca221ef90cd099a6ea629247694967f54cd28decc883
MD5 8a371570a0f69010af9b521c51bde7af
SHA1 a511903a7fd05a04c6e6e2b604ab92b2147a2ea0
SHA512 cd724cdc26ad27944ab75527b1bdd93f1f1e91a19da324041938f7ad8313c3e4f90866fd3c4019567b7add190738362105832a7f2cacb0edd333b7a7604a584b
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW8:SbBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-2144-0x00007FF653400000-0x00007FF6537F6000-memory.dmp

Download

memory/412-911-0x00007FF653400000-0x00007FF6537F6000-memory.dmp

Download

memory/552-1078-0x0000016DCC2E0000-0x0000016DCCA86000-memory.dmp

Download

memory/552-927-0x0000016DC9150000-0x0000016DC9172000-memory.dmp

Download

memory/1004-2136-0x00007FF739420000-0x00007FF739816000-memory.dmp

Download

memory/1004-897-0x00007FF739420000-0x00007FF739816000-memory.dmp

Download

memory/1416-29-0x00007FF683540000-0x00007FF683936000-memory.dmp

Download

memory/1416-2132-0x00007FF683540000-0x00007FF683936000-memory.dmp

Download

memory/1492-914-0x00007FF681F20000-0x00007FF682316000-memory.dmp

Download

memory/1492-2143-0x00007FF681F20000-0x00007FF682316000-memory.dmp

Download

memory/1548-951-0x00007FF77CF70000-0x00007FF77D366000-memory.dmp

Download

memory/1548-2140-0x00007FF77CF70000-0x00007FF77D366000-memory.dmp

Download

memory/1604-904-0x00007FF75CEA0000-0x00007FF75D296000-memory.dmp

Download

memory/1604-2137-0x00007FF75CEA0000-0x00007FF75D296000-memory.dmp

Download

memory/1756-2152-0x00007FF73A0A0000-0x00007FF73A496000-memory.dmp

Download

memory/1756-967-0x00007FF73A0A0000-0x00007FF73A496000-memory.dmp

Download

memory/1836-2138-0x00007FF6E3450000-0x00007FF6E3846000-memory.dmp

Download

memory/1836-925-0x00007FF6E3450000-0x00007FF6E3846000-memory.dmp

Download

memory/1860-962-0x00007FF61CD50000-0x00007FF61D146000-memory.dmp

Download

memory/1860-2150-0x00007FF61CD50000-0x00007FF61D146000-memory.dmp

Download

memory/1888-952-0x00007FF7FEDE0000-0x00007FF7FF1D6000-memory.dmp

Download

memory/1888-2139-0x00007FF7FEDE0000-0x00007FF7FF1D6000-memory.dmp

Download

memory/1920-1892-0x00007FF61C260000-0x00007FF61C656000-memory.dmp

Download

memory/1920-2130-0x00007FF61C260000-0x00007FF61C656000-memory.dmp

Download

memory/1920-17-0x00007FF61C260000-0x00007FF61C656000-memory.dmp

Download

memory/1996-2148-0x00007FF6812B0000-0x00007FF6816A6000-memory.dmp

Download

memory/1996-922-0x00007FF6812B0000-0x00007FF6816A6000-memory.dmp

Download

memory/2588-2147-0x00007FF704E00000-0x00007FF7051F6000-memory.dmp

Download

memory/2588-959-0x00007FF704E00000-0x00007FF7051F6000-memory.dmp

Download

memory/2744-2149-0x00007FF6A4D80000-0x00007FF6A5176000-memory.dmp

Download

memory/2744-961-0x00007FF6A4D80000-0x00007FF6A5176000-memory.dmp

Download

memory/3152-892-0x00007FF6AB920000-0x00007FF6ABD16000-memory.dmp

Download

memory/3152-2134-0x00007FF6AB920000-0x00007FF6ABD16000-memory.dmp

Download

memory/3496-32-0x00007FF7FD090000-0x00007FF7FD486000-memory.dmp

Download

memory/3496-2133-0x00007FF7FD090000-0x00007FF7FD486000-memory.dmp

Download

memory/3616-926-0x00007FF6F29E0000-0x00007FF6F2DD6000-memory.dmp

Download

memory/3616-2141-0x00007FF6F29E0000-0x00007FF6F2DD6000-memory.dmp

Download

memory/3628-966-0x00007FF686950000-0x00007FF686D46000-memory.dmp

Download

memory/3628-2151-0x00007FF686950000-0x00007FF686D46000-memory.dmp

Download

memory/3836-941-0x00007FF621E60000-0x00007FF622256000-memory.dmp

Download

memory/3836-2146-0x00007FF621E60000-0x00007FF622256000-memory.dmp

Download

memory/4160-1-0x0000020EE1AA0000-0x0000020EE1AB0000-memory.dmp

Download

memory/4160-0-0x00007FF79B6A0000-0x00007FF79BA96000-memory.dmp

Download

memory/4304-2135-0x00007FF7593D0000-0x00007FF7597C6000-memory.dmp

Download

memory/4304-893-0x00007FF7593D0000-0x00007FF7597C6000-memory.dmp

Download

memory/4436-2142-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp

Download

memory/4436-921-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp

Download

memory/4480-11-0x00007FF7CCBF0000-0x00007FF7CCFE6000-memory.dmp

Download

memory/4480-2129-0x00007FF7CCBF0000-0x00007FF7CCFE6000-memory.dmp

Download

memory/4656-24-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp

Download

memory/4656-1947-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp

Download

memory/4656-2131-0x00007FF615CC0000-0x00007FF6160B6000-memory.dmp

Download

memory/5088-2145-0x00007FF68AA70000-0x00007FF68AE66000-memory.dmp

Download

memory/5088-905-0x00007FF68AA70000-0x00007FF68AE66000-memory.dmp

Download