xmrig | 59b9195faa2b111a7a3052003487c9ccf130fe8ebaed5f857481384d2034a20b

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
Size 2.8MB
Sample240523-zhpsdaff4w
SHA256 59b9195faa2b111a7a3052003487c9ccf130fe8ebaed5f857481384d2034a20b
MD5 84906b5c4a1719a9eb17d4d4c5f5c800
SHA1 9b2825d9c8362a347f178fe36ec82b20ff0a23f8
SHA512 854d7109ea27f85417e1b7f30cf3d6bb75594332ce4ba1e7611370e6bdfcc6bc2b735a69346c27ad1c5d44eb2b26e29d4f2552ba02f752a8c2d5071c56bcdee9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/672-0-0x00007FF60F820000-0x00007FF60FC16000-memory.dmp	xmrig
behavioral2/files/0x00080000000235b0-8.dat	xmrig
behavioral2/files/0x00090000000235ad-9.dat	xmrig
behavioral2/files/0x00070000000235b4-6.dat	xmrig
behavioral2/files/0x00070000000235b8-29.dat	xmrig
behavioral2/files/0x00070000000235b7-41.dat	xmrig
behavioral2/files/0x00070000000235ba-42.dat	xmrig
behavioral2/files/0x00070000000235bd-57.dat	xmrig
behavioral2/files/0x00070000000235c0-66.dat	xmrig
behavioral2/files/0x00070000000235cb-131.dat	xmrig
behavioral2/files/0x00070000000235d2-162.dat	xmrig
behavioral2/files/0x00070000000235d0-181.dat	xmrig
behavioral2/memory/3440-189-0x00007FF626BC0000-0x00007FF626FB6000-memory.dmp	xmrig
behavioral2/memory/1996-194-0x00007FF6B0120000-0x00007FF6B0516000-memory.dmp	xmrig
behavioral2/memory/1512-200-0x00007FF618390000-0x00007FF618786000-memory.dmp	xmrig
behavioral2/memory/468-201-0x00007FF7D9810000-0x00007FF7D9C06000-memory.dmp	xmrig
behavioral2/memory/1240-199-0x00007FF789730000-0x00007FF789B26000-memory.dmp	xmrig
behavioral2/memory/1784-198-0x00007FF7C37E0000-0x00007FF7C3BD6000-memory.dmp	xmrig
behavioral2/memory/3332-197-0x00007FF6F8D10000-0x00007FF6F9106000-memory.dmp	xmrig
behavioral2/memory/4820-196-0x00007FF6D5EE0000-0x00007FF6D62D6000-memory.dmp	xmrig
behavioral2/memory/2856-195-0x00007FF7B92E0000-0x00007FF7B96D6000-memory.dmp	xmrig
behavioral2/memory/4596-193-0x00007FF70DD50000-0x00007FF70E146000-memory.dmp	xmrig
behavioral2/memory/4992-192-0x00007FF7E1BE0000-0x00007FF7E1FD6000-memory.dmp	xmrig
behavioral2/memory/1828-191-0x00007FF706230000-0x00007FF706626000-memory.dmp	xmrig
behavioral2/memory/2304-190-0x00007FF6D87E0000-0x00007FF6D8BD6000-memory.dmp	xmrig
behavioral2/memory/3792-188-0x00007FF7CC130000-0x00007FF7CC526000-memory.dmp	xmrig
behavioral2/memory/3356-187-0x00007FF6DA3F0000-0x00007FF6DA7E6000-memory.dmp	xmrig
behavioral2/memory/2680-186-0x00007FF610720000-0x00007FF610B16000-memory.dmp	xmrig
behavioral2/memory/3992-185-0x00007FF72B370000-0x00007FF72B766000-memory.dmp	xmrig
behavioral2/files/0x00070000000235cf-179.dat	xmrig
behavioral2/files/0x00070000000235ce-177.dat	xmrig
behavioral2/memory/4816-176-0x00007FF6540B0000-0x00007FF6544A6000-memory.dmp	xmrig
behavioral2/files/0x00080000000235b1-174.dat	xmrig
behavioral2/files/0x00070000000235c6-172.dat	xmrig
behavioral2/files/0x00070000000235cc-170.dat	xmrig
behavioral2/files/0x00080000000235c9-166.dat	xmrig
behavioral2/files/0x00070000000235cd-164.dat	xmrig
behavioral2/memory/4744-163-0x00007FF60BD60000-0x00007FF60C156000-memory.dmp	xmrig
behavioral2/files/0x00070000000235d1-161.dat	xmrig
behavioral2/files/0x00070000000235c7-159.dat	xmrig
behavioral2/files/0x00070000000235ca-154.dat	xmrig
behavioral2/files/0x00070000000235c5-152.dat	xmrig
behavioral2/memory/4588-148-0x00007FF6BC5F0000-0x00007FF6BC9E6000-memory.dmp	xmrig
behavioral2/memory/2980-145-0x00007FF7661D0000-0x00007FF7665C6000-memory.dmp	xmrig
behavioral2/memory/372-126-0x00007FF7153F0000-0x00007FF7157E6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c4-125.dat	xmrig
behavioral2/files/0x00070000000235c1-120.dat	xmrig
behavioral2/files/0x00070000000235c3-97.dat	xmrig
behavioral2/files/0x00070000000235bf-91.dat	xmrig
behavioral2/files/0x00070000000235c2-93.dat	xmrig
behavioral2/files/0x00070000000235be-85.dat	xmrig
behavioral2/files/0x00070000000235bc-75.dat	xmrig
behavioral2/files/0x00070000000235bb-58.dat	xmrig
behavioral2/files/0x00070000000235b9-50.dat	xmrig
behavioral2/files/0x00070000000235b6-45.dat	xmrig
behavioral2/files/0x00070000000235b5-37.dat	xmrig
behavioral2/memory/4828-32-0x00007FF74F8E0000-0x00007FF74FCD6000-memory.dmp	xmrig
behavioral2/memory/4256-20-0x00007FF6F1130000-0x00007FF6F1526000-memory.dmp	xmrig
behavioral2/memory/4256-2010-0x00007FF6F1130000-0x00007FF6F1526000-memory.dmp	xmrig
behavioral2/memory/4828-2011-0x00007FF74F8E0000-0x00007FF74FCD6000-memory.dmp	xmrig
behavioral2/memory/3332-2012-0x00007FF6F8D10000-0x00007FF6F9106000-memory.dmp	xmrig
behavioral2/memory/372-2013-0x00007FF7153F0000-0x00007FF7157E6000-memory.dmp	xmrig
behavioral2/memory/4820-2014-0x00007FF6D5EE0000-0x00007FF6D62D6000-memory.dmp	xmrig
behavioral2/memory/4588-2022-0x00007FF6BC5F0000-0x00007FF6BC9E6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	4072	powershell.exe
10	4072	powershell.exe
12	4072	powershell.exe
13	4072	powershell.exe
15	4072	powershell.exe
16	4072	powershell.exe
17	4072	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4072	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4256	ASPghJa.exe
4828	sqgOZhs.exe
4820	iKdPbLV.exe
3332	FfoZzFc.exe
372	AKaPvgo.exe
2980	GTUXawG.exe
1784	efxkzbz.exe
4588	FOOAkIM.exe
4744	GpuncHc.exe
4816	ifIJeCf.exe
3992	OYKoiPc.exe
2680	HCJXSOp.exe
3356	mGJbAdZ.exe
3792	fAehMYg.exe
3440	DyVHTZT.exe
2304	zuZrsHZ.exe
1828	HdnbKRA.exe
4992	SsQssop.exe
1240	yXamArU.exe
1512	qCzDaZH.exe
4596	yyuUqRV.exe
468	yiceHad.exe
1996	icEJzYl.exe
2856	OafZKqe.exe
696	otITiNq.exe
4264	qxwECvU.exe
2444	ObSOdDH.exe
3912	EMDIVEL.exe
1324	fcvvUhZ.exe
2900	cbDuzGE.exe
3712	ZWOUxcB.exe
3448	ARDrnSQ.exe
3144	WkKYgGa.exe
2928	QhYcbFD.exe
1980	RXpSdfX.exe
464	ayhSvcM.exe
2792	xVescbf.exe
3908	KqEhBoY.exe
5108	XqnRtyy.exe
2516	anfKmUx.exe
3080	xYCGrAQ.exe
3608	xggvCie.exe
4320	VldAEpF.exe
1268	wFcBzGI.exe
4632	BwRDaGg.exe
2404	kVYpLNS.exe
1552	tssmkvM.exe
4020	BaRjSiw.exe
1144	AwIFOFO.exe
1632	ooBbKGA.exe
3040	kmUWPBE.exe
2000	ceGrMnR.exe
4856	PGXNjXT.exe
2044	nCZlKaT.exe
3600	WkGVTgM.exe
4728	gDJMZSC.exe
1736	UGauYqr.exe
4524	FNdRbLA.exe
4720	lzbZlCn.exe
2380	tiiyJTH.exe
3524	kjbhDfG.exe
3504	EEsxCBp.exe
2092	HoZIIfb.exe
4688	xbcUVJe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/672-0-0x00007FF60F820000-0x00007FF60FC16000-memory.dmp	upx
behavioral2/files/0x00080000000235b0-8.dat	upx
behavioral2/files/0x00090000000235ad-9.dat	upx
behavioral2/files/0x00070000000235b4-6.dat	upx
behavioral2/files/0x00070000000235b8-29.dat	upx
behavioral2/files/0x00070000000235b7-41.dat	upx
behavioral2/files/0x00070000000235ba-42.dat	upx
behavioral2/files/0x00070000000235bd-57.dat	upx
behavioral2/files/0x00070000000235c0-66.dat	upx
behavioral2/files/0x00070000000235cb-131.dat	upx
behavioral2/files/0x00070000000235d2-162.dat	upx
behavioral2/files/0x00070000000235d0-181.dat	upx
behavioral2/memory/3440-189-0x00007FF626BC0000-0x00007FF626FB6000-memory.dmp	upx
behavioral2/memory/1996-194-0x00007FF6B0120000-0x00007FF6B0516000-memory.dmp	upx
behavioral2/memory/1512-200-0x00007FF618390000-0x00007FF618786000-memory.dmp	upx
behavioral2/memory/468-201-0x00007FF7D9810000-0x00007FF7D9C06000-memory.dmp	upx
behavioral2/memory/1240-199-0x00007FF789730000-0x00007FF789B26000-memory.dmp	upx
behavioral2/memory/1784-198-0x00007FF7C37E0000-0x00007FF7C3BD6000-memory.dmp	upx
behavioral2/memory/3332-197-0x00007FF6F8D10000-0x00007FF6F9106000-memory.dmp	upx
behavioral2/memory/4820-196-0x00007FF6D5EE0000-0x00007FF6D62D6000-memory.dmp	upx
behavioral2/memory/2856-195-0x00007FF7B92E0000-0x00007FF7B96D6000-memory.dmp	upx
behavioral2/memory/4596-193-0x00007FF70DD50000-0x00007FF70E146000-memory.dmp	upx
behavioral2/memory/4992-192-0x00007FF7E1BE0000-0x00007FF7E1FD6000-memory.dmp	upx
behavioral2/memory/1828-191-0x00007FF706230000-0x00007FF706626000-memory.dmp	upx
behavioral2/memory/2304-190-0x00007FF6D87E0000-0x00007FF6D8BD6000-memory.dmp	upx
behavioral2/memory/3792-188-0x00007FF7CC130000-0x00007FF7CC526000-memory.dmp	upx
behavioral2/memory/3356-187-0x00007FF6DA3F0000-0x00007FF6DA7E6000-memory.dmp	upx
behavioral2/memory/2680-186-0x00007FF610720000-0x00007FF610B16000-memory.dmp	upx
behavioral2/memory/3992-185-0x00007FF72B370000-0x00007FF72B766000-memory.dmp	upx
behavioral2/files/0x00070000000235cf-179.dat	upx
behavioral2/files/0x00070000000235ce-177.dat	upx
behavioral2/memory/4816-176-0x00007FF6540B0000-0x00007FF6544A6000-memory.dmp	upx
behavioral2/files/0x00080000000235b1-174.dat	upx
behavioral2/files/0x00070000000235c6-172.dat	upx
behavioral2/files/0x00070000000235cc-170.dat	upx
behavioral2/files/0x00080000000235c9-166.dat	upx
behavioral2/files/0x00070000000235cd-164.dat	upx
behavioral2/memory/4744-163-0x00007FF60BD60000-0x00007FF60C156000-memory.dmp	upx
behavioral2/files/0x00070000000235d1-161.dat	upx
behavioral2/files/0x00070000000235c7-159.dat	upx
behavioral2/files/0x00070000000235ca-154.dat	upx
behavioral2/files/0x00070000000235c5-152.dat	upx
behavioral2/memory/4588-148-0x00007FF6BC5F0000-0x00007FF6BC9E6000-memory.dmp	upx
behavioral2/memory/2980-145-0x00007FF7661D0000-0x00007FF7665C6000-memory.dmp	upx
behavioral2/memory/372-126-0x00007FF7153F0000-0x00007FF7157E6000-memory.dmp	upx
behavioral2/files/0x00070000000235c4-125.dat	upx
behavioral2/files/0x00070000000235c1-120.dat	upx
behavioral2/files/0x00070000000235c3-97.dat	upx
behavioral2/files/0x00070000000235bf-91.dat	upx
behavioral2/files/0x00070000000235c2-93.dat	upx
behavioral2/files/0x00070000000235be-85.dat	upx
behavioral2/files/0x00070000000235bc-75.dat	upx
behavioral2/files/0x00070000000235bb-58.dat	upx
behavioral2/files/0x00070000000235b9-50.dat	upx
behavioral2/files/0x00070000000235b6-45.dat	upx
behavioral2/files/0x00070000000235b5-37.dat	upx
behavioral2/memory/4828-32-0x00007FF74F8E0000-0x00007FF74FCD6000-memory.dmp	upx
behavioral2/memory/4256-20-0x00007FF6F1130000-0x00007FF6F1526000-memory.dmp	upx
behavioral2/memory/4256-2010-0x00007FF6F1130000-0x00007FF6F1526000-memory.dmp	upx
behavioral2/memory/4828-2011-0x00007FF74F8E0000-0x00007FF74FCD6000-memory.dmp	upx
behavioral2/memory/3332-2012-0x00007FF6F8D10000-0x00007FF6F9106000-memory.dmp	upx
behavioral2/memory/372-2013-0x00007FF7153F0000-0x00007FF7157E6000-memory.dmp	upx
behavioral2/memory/4820-2014-0x00007FF6D5EE0000-0x00007FF6D62D6000-memory.dmp	upx
behavioral2/memory/4588-2022-0x00007FF6BC5F0000-0x00007FF6BC9E6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MYWpVNY.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\PGXNjXT.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\iiamYKc.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\kJoOGFW.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\fUHYbsT.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\ABwwxHD.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\mbPbljK.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\msLHdgq.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\KqEhBoY.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\puoHfZl.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\lKeheYG.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\wWHxKQK.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\VPvhBUS.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\AdUdhNB.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\PwBBQQP.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\MmWCjkR.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\ZlYrlHQ.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\CQioYxR.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\YftEUwN.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\NIDSbYo.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\xbcUVJe.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\lfYPJfF.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\VTONeog.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\rbwbrAz.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\ZUqTFyD.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\RgWVqda.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\mApaHFv.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\KWZCzaF.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\HozyAOx.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\iFyNjtV.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\AXQdSbY.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\BTmPGtu.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\tKXcdcR.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\gyhiOSl.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\ygPYbpd.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\CTNwWGX.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\ePrFhNZ.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\bUtulXn.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\vjzhFAp.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\tZVyNDV.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\YobUsBo.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\icEJzYl.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\dEovWkE.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\xMpmIMK.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\xggvCie.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\tWFROiT.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\FTGmViQ.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\QFLMeHu.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\VldAEpF.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\YXksDVb.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\EpIkGKf.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\nhUckQK.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\VelpaJM.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\JYVAFTs.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\FxFjtuK.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\QQwEghV.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\BwRDaGg.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\aLSuErT.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\gflctjY.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\BIhubJw.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\HNrdFtw.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\MQszRBa.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\pjXedpG.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
File created	C:\Windows\System\REPGSag.exe	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
Token: SeDebugPrivilege	4072	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4072	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	91
PID 672 wrote to memory of 4072	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	91
PID 672 wrote to memory of 4256	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	92
PID 672 wrote to memory of 4256	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	92
PID 672 wrote to memory of 4828	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	93
PID 672 wrote to memory of 4828	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	93
PID 672 wrote to memory of 4820	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	94
PID 672 wrote to memory of 4820	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	94
PID 672 wrote to memory of 3332	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	95
PID 672 wrote to memory of 3332	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	95
PID 672 wrote to memory of 372	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	96
PID 672 wrote to memory of 372	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	96
PID 672 wrote to memory of 4588	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	97
PID 672 wrote to memory of 4588	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	97
PID 672 wrote to memory of 2980	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	98
PID 672 wrote to memory of 2980	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	98
PID 672 wrote to memory of 1784	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	99
PID 672 wrote to memory of 1784	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	99
PID 672 wrote to memory of 4744	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	100
PID 672 wrote to memory of 4744	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	100
PID 672 wrote to memory of 4816	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	101
PID 672 wrote to memory of 4816	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	101
PID 672 wrote to memory of 3992	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	102
PID 672 wrote to memory of 3992	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	102
PID 672 wrote to memory of 2680	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	103
PID 672 wrote to memory of 2680	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	103
PID 672 wrote to memory of 3356	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	104
PID 672 wrote to memory of 3356	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	104
PID 672 wrote to memory of 3792	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	105
PID 672 wrote to memory of 3792	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	105
PID 672 wrote to memory of 3440	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	106
PID 672 wrote to memory of 3440	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	106
PID 672 wrote to memory of 1828	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	107
PID 672 wrote to memory of 1828	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	107
PID 672 wrote to memory of 2304	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	108
PID 672 wrote to memory of 2304	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	108
PID 672 wrote to memory of 4992	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	109
PID 672 wrote to memory of 4992	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	109
PID 672 wrote to memory of 1240	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	110
PID 672 wrote to memory of 1240	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	110
PID 672 wrote to memory of 1512	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	111
PID 672 wrote to memory of 1512	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	111
PID 672 wrote to memory of 4596	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	112
PID 672 wrote to memory of 4596	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	112
PID 672 wrote to memory of 468	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	113
PID 672 wrote to memory of 468	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	113
PID 672 wrote to memory of 1996	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	114
PID 672 wrote to memory of 1996	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	114
PID 672 wrote to memory of 2856	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	115
PID 672 wrote to memory of 2856	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	115
PID 672 wrote to memory of 696	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	116
PID 672 wrote to memory of 696	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	116
PID 672 wrote to memory of 4264	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	117
PID 672 wrote to memory of 4264	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	117
PID 672 wrote to memory of 2444	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	118
PID 672 wrote to memory of 2444	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	118
PID 672 wrote to memory of 3912	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	119
PID 672 wrote to memory of 3912	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	119
PID 672 wrote to memory of 1324	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	120
PID 672 wrote to memory of 1324	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	120
PID 672 wrote to memory of 2900	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	121
PID 672 wrote to memory of 2900	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	121
PID 672 wrote to memory of 3712	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	122
PID 672 wrote to memory of 3712	672	84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\84906b5c4a1719a9eb17d4d4c5f5c800_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4072
- C:\Windows\System\ASPghJa.exe
  C:\Windows\System\ASPghJa.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\sqgOZhs.exe
  C:\Windows\System\sqgOZhs.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\iKdPbLV.exe
  C:\Windows\System\iKdPbLV.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\FfoZzFc.exe
  C:\Windows\System\FfoZzFc.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\AKaPvgo.exe
  C:\Windows\System\AKaPvgo.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\FOOAkIM.exe
  C:\Windows\System\FOOAkIM.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\GTUXawG.exe
  C:\Windows\System\GTUXawG.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\efxkzbz.exe
  C:\Windows\System\efxkzbz.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\GpuncHc.exe
  C:\Windows\System\GpuncHc.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\ifIJeCf.exe
  C:\Windows\System\ifIJeCf.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\OYKoiPc.exe
  C:\Windows\System\OYKoiPc.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\HCJXSOp.exe
  C:\Windows\System\HCJXSOp.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\mGJbAdZ.exe
  C:\Windows\System\mGJbAdZ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\fAehMYg.exe
  C:\Windows\System\fAehMYg.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\DyVHTZT.exe
  C:\Windows\System\DyVHTZT.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\HdnbKRA.exe
  C:\Windows\System\HdnbKRA.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\zuZrsHZ.exe
  C:\Windows\System\zuZrsHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\SsQssop.exe
  C:\Windows\System\SsQssop.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\yXamArU.exe
  C:\Windows\System\yXamArU.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\qCzDaZH.exe
  C:\Windows\System\qCzDaZH.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\yyuUqRV.exe
  C:\Windows\System\yyuUqRV.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\yiceHad.exe
  C:\Windows\System\yiceHad.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\icEJzYl.exe
  C:\Windows\System\icEJzYl.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\OafZKqe.exe
  C:\Windows\System\OafZKqe.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\otITiNq.exe
  C:\Windows\System\otITiNq.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\qxwECvU.exe
  C:\Windows\System\qxwECvU.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\ObSOdDH.exe
  C:\Windows\System\ObSOdDH.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\EMDIVEL.exe
  C:\Windows\System\EMDIVEL.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\fcvvUhZ.exe
  C:\Windows\System\fcvvUhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\cbDuzGE.exe
  C:\Windows\System\cbDuzGE.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ZWOUxcB.exe
  C:\Windows\System\ZWOUxcB.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\ARDrnSQ.exe
  C:\Windows\System\ARDrnSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\WkKYgGa.exe
  C:\Windows\System\WkKYgGa.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\QhYcbFD.exe
  C:\Windows\System\QhYcbFD.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\RXpSdfX.exe
  C:\Windows\System\RXpSdfX.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\ayhSvcM.exe
  C:\Windows\System\ayhSvcM.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\xVescbf.exe
  C:\Windows\System\xVescbf.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\KqEhBoY.exe
  C:\Windows\System\KqEhBoY.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\XqnRtyy.exe
  C:\Windows\System\XqnRtyy.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\anfKmUx.exe
  C:\Windows\System\anfKmUx.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\xYCGrAQ.exe
  C:\Windows\System\xYCGrAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\xggvCie.exe
  C:\Windows\System\xggvCie.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\VldAEpF.exe
  C:\Windows\System\VldAEpF.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\wFcBzGI.exe
  C:\Windows\System\wFcBzGI.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\BwRDaGg.exe
  C:\Windows\System\BwRDaGg.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\kVYpLNS.exe
  C:\Windows\System\kVYpLNS.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\tssmkvM.exe
  C:\Windows\System\tssmkvM.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\BaRjSiw.exe
  C:\Windows\System\BaRjSiw.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\AwIFOFO.exe
  C:\Windows\System\AwIFOFO.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ooBbKGA.exe
  C:\Windows\System\ooBbKGA.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\kmUWPBE.exe
  C:\Windows\System\kmUWPBE.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ceGrMnR.exe
  C:\Windows\System\ceGrMnR.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\nCZlKaT.exe
  C:\Windows\System\nCZlKaT.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\PGXNjXT.exe
  C:\Windows\System\PGXNjXT.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\WkGVTgM.exe
  C:\Windows\System\WkGVTgM.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\gDJMZSC.exe
  C:\Windows\System\gDJMZSC.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\UGauYqr.exe
  C:\Windows\System\UGauYqr.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\FNdRbLA.exe
  C:\Windows\System\FNdRbLA.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\lzbZlCn.exe
  C:\Windows\System\lzbZlCn.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\tiiyJTH.exe
  C:\Windows\System\tiiyJTH.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\kjbhDfG.exe
  C:\Windows\System\kjbhDfG.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\EEsxCBp.exe
  C:\Windows\System\EEsxCBp.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\HoZIIfb.exe
  C:\Windows\System\HoZIIfb.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\xbcUVJe.exe
  C:\Windows\System\xbcUVJe.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\YDHtBpN.exe
  C:\Windows\System\YDHtBpN.exe
  2⤵
  PID:3248
- C:\Windows\System\ubjJuGt.exe
  C:\Windows\System\ubjJuGt.exe
  2⤵
  PID:2088
- C:\Windows\System\lfYPJfF.exe
  C:\Windows\System\lfYPJfF.exe
  2⤵
  PID:5140
- C:\Windows\System\IOgVwfD.exe
  C:\Windows\System\IOgVwfD.exe
  2⤵
  PID:5172
- C:\Windows\System\fDYrWHN.exe
  C:\Windows\System\fDYrWHN.exe
  2⤵
  PID:5196
- C:\Windows\System\VgFsIjE.exe
  C:\Windows\System\VgFsIjE.exe
  2⤵
  PID:5228
- C:\Windows\System\BgHXBfn.exe
  C:\Windows\System\BgHXBfn.exe
  2⤵
  PID:5264
- C:\Windows\System\IwyRpxR.exe
  C:\Windows\System\IwyRpxR.exe
  2⤵
  PID:5280
- C:\Windows\System\jFqeASc.exe
  C:\Windows\System\jFqeASc.exe
  2⤵
  PID:5312
- C:\Windows\System\gQbmxIV.exe
  C:\Windows\System\gQbmxIV.exe
  2⤵
  PID:5348
- C:\Windows\System\loDKgPJ.exe
  C:\Windows\System\loDKgPJ.exe
  2⤵
  PID:5376
- C:\Windows\System\BjrGAYK.exe
  C:\Windows\System\BjrGAYK.exe
  2⤵
  PID:5404
- C:\Windows\System\dEovWkE.exe
  C:\Windows\System\dEovWkE.exe
  2⤵
  PID:5428
- C:\Windows\System\XYRjcOU.exe
  C:\Windows\System\XYRjcOU.exe
  2⤵
  PID:5448
- C:\Windows\System\HsHYseS.exe
  C:\Windows\System\HsHYseS.exe
  2⤵
  PID:5476
- C:\Windows\System\trAYBGH.exe
  C:\Windows\System\trAYBGH.exe
  2⤵
  PID:5504
- C:\Windows\System\dRcJTbc.exe
  C:\Windows\System\dRcJTbc.exe
  2⤵
  PID:5544
- C:\Windows\System\HlDXQbW.exe
  C:\Windows\System\HlDXQbW.exe
  2⤵
  PID:5572
- C:\Windows\System\VmzorTe.exe
  C:\Windows\System\VmzorTe.exe
  2⤵
  PID:5588
- C:\Windows\System\VVMXjVv.exe
  C:\Windows\System\VVMXjVv.exe
  2⤵
  PID:5628
- C:\Windows\System\iaPfAaG.exe
  C:\Windows\System\iaPfAaG.exe
  2⤵
  PID:5652
- C:\Windows\System\TFnUGRF.exe
  C:\Windows\System\TFnUGRF.exe
  2⤵
  PID:5692
- C:\Windows\System\dckraYm.exe
  C:\Windows\System\dckraYm.exe
  2⤵
  PID:5716
- C:\Windows\System\LUzrrnR.exe
  C:\Windows\System\LUzrrnR.exe
  2⤵
  PID:5736
- C:\Windows\System\hLJBOdv.exe
  C:\Windows\System\hLJBOdv.exe
  2⤵
  PID:5768
- C:\Windows\System\ozIGGMD.exe
  C:\Windows\System\ozIGGMD.exe
  2⤵
  PID:5792
- C:\Windows\System\SoYlHXC.exe
  C:\Windows\System\SoYlHXC.exe
  2⤵
  PID:5820
- C:\Windows\System\VcpdHHc.exe
  C:\Windows\System\VcpdHHc.exe
  2⤵
  PID:5848
- C:\Windows\System\hHtABWF.exe
  C:\Windows\System\hHtABWF.exe
  2⤵
  PID:5876
- C:\Windows\System\LRzfxhF.exe
  C:\Windows\System\LRzfxhF.exe
  2⤵
  PID:5908
- C:\Windows\System\HmnKlRs.exe
  C:\Windows\System\HmnKlRs.exe
  2⤵
  PID:5928
- C:\Windows\System\nbXLtgL.exe
  C:\Windows\System\nbXLtgL.exe
  2⤵
  PID:5960
- C:\Windows\System\oKyDjcD.exe
  C:\Windows\System\oKyDjcD.exe
  2⤵
  PID:5984
- C:\Windows\System\xMpmIMK.exe
  C:\Windows\System\xMpmIMK.exe
  2⤵
  PID:6000
- C:\Windows\System\jCtpDJZ.exe
  C:\Windows\System\jCtpDJZ.exe
  2⤵
  PID:6040
- C:\Windows\System\nnZUndc.exe
  C:\Windows\System\nnZUndc.exe
  2⤵
  PID:6076
- C:\Windows\System\pmfsKvm.exe
  C:\Windows\System\pmfsKvm.exe
  2⤵
  PID:6112
- C:\Windows\System\whlUcFf.exe
  C:\Windows\System\whlUcFf.exe
  2⤵
  PID:6140
- C:\Windows\System\QqYUyuO.exe
  C:\Windows\System\QqYUyuO.exe
  2⤵
  PID:5136
- C:\Windows\System\XPBiAlf.exe
  C:\Windows\System\XPBiAlf.exe
  2⤵
  PID:5208
- C:\Windows\System\njhJIIL.exe
  C:\Windows\System\njhJIIL.exe
  2⤵
  PID:5256
- C:\Windows\System\xkbJLYY.exe
  C:\Windows\System\xkbJLYY.exe
  2⤵
  PID:5320
- C:\Windows\System\iiamYKc.exe
  C:\Windows\System\iiamYKc.exe
  2⤵
  PID:5372
- C:\Windows\System\CJkTKXl.exe
  C:\Windows\System\CJkTKXl.exe
  2⤵
  PID:5444
- C:\Windows\System\bUtulXn.exe
  C:\Windows\System\bUtulXn.exe
  2⤵
  PID:5532
- C:\Windows\System\QgynXbu.exe
  C:\Windows\System\QgynXbu.exe
  2⤵
  PID:5564
- C:\Windows\System\THyMBOZ.exe
  C:\Windows\System\THyMBOZ.exe
  2⤵
  PID:5660
- C:\Windows\System\YZqUEwY.exe
  C:\Windows\System\YZqUEwY.exe
  2⤵
  PID:5728
- C:\Windows\System\pwUNkXu.exe
  C:\Windows\System\pwUNkXu.exe
  2⤵
  PID:5780
- C:\Windows\System\VTONeog.exe
  C:\Windows\System\VTONeog.exe
  2⤵
  PID:5836
- C:\Windows\System\KvKEipd.exe
  C:\Windows\System\KvKEipd.exe
  2⤵
  PID:5900
- C:\Windows\System\RCQVBNT.exe
  C:\Windows\System\RCQVBNT.exe
  2⤵
  PID:5972
- C:\Windows\System\dthZFoh.exe
  C:\Windows\System\dthZFoh.exe
  2⤵
  PID:6052
- C:\Windows\System\vjzhFAp.exe
  C:\Windows\System\vjzhFAp.exe
  2⤵
  PID:6096
- C:\Windows\System\puoHfZl.exe
  C:\Windows\System\puoHfZl.exe
  2⤵
  PID:5188
- C:\Windows\System\YXksDVb.exe
  C:\Windows\System\YXksDVb.exe
  2⤵
  PID:5360
- C:\Windows\System\uTxYBXg.exe
  C:\Windows\System\uTxYBXg.exe
  2⤵
  PID:5556
- C:\Windows\System\MWqUFBc.exe
  C:\Windows\System\MWqUFBc.exe
  2⤵
  PID:5700
- C:\Windows\System\ZVYJovy.exe
  C:\Windows\System\ZVYJovy.exe
  2⤵
  PID:5800
- C:\Windows\System\HozyAOx.exe
  C:\Windows\System\HozyAOx.exe
  2⤵
  PID:5864
- C:\Windows\System\JnIcsDd.exe
  C:\Windows\System\JnIcsDd.exe
  2⤵
  PID:5948
- C:\Windows\System\bdTlefW.exe
  C:\Windows\System\bdTlefW.exe
  2⤵
  PID:6084
- C:\Windows\System\UwHgzKQ.exe
  C:\Windows\System\UwHgzKQ.exe
  2⤵
  PID:6128
- C:\Windows\System\GJIxWAC.exe
  C:\Windows\System\GJIxWAC.exe
  2⤵
  PID:5724
- C:\Windows\System\RCwpAVc.exe
  C:\Windows\System\RCwpAVc.exe
  2⤵
  PID:5996
- C:\Windows\System\PwBBQQP.exe
  C:\Windows\System\PwBBQQP.exe
  2⤵
  PID:6152
- C:\Windows\System\iFyNjtV.exe
  C:\Windows\System\iFyNjtV.exe
  2⤵
  PID:6192
- C:\Windows\System\kcRtvVl.exe
  C:\Windows\System\kcRtvVl.exe
  2⤵
  PID:6228
- C:\Windows\System\QbVkOAR.exe
  C:\Windows\System\QbVkOAR.exe
  2⤵
  PID:6252
- C:\Windows\System\MMqQnKE.exe
  C:\Windows\System\MMqQnKE.exe
  2⤵
  PID:6280
- C:\Windows\System\STfKfOf.exe
  C:\Windows\System\STfKfOf.exe
  2⤵
  PID:6300
- C:\Windows\System\dWOsHZa.exe
  C:\Windows\System\dWOsHZa.exe
  2⤵
  PID:6328
- C:\Windows\System\eSQBPSH.exe
  C:\Windows\System\eSQBPSH.exe
  2⤵
  PID:6360
- C:\Windows\System\hdbolDE.exe
  C:\Windows\System\hdbolDE.exe
  2⤵
  PID:6384
- C:\Windows\System\ElfcuxI.exe
  C:\Windows\System\ElfcuxI.exe
  2⤵
  PID:6412
- C:\Windows\System\IqmMNJy.exe
  C:\Windows\System\IqmMNJy.exe
  2⤵
  PID:6432
- C:\Windows\System\PjqgdYN.exe
  C:\Windows\System\PjqgdYN.exe
  2⤵
  PID:6456
- C:\Windows\System\wVSRiYs.exe
  C:\Windows\System\wVSRiYs.exe
  2⤵
  PID:6496
- C:\Windows\System\noeHwvF.exe
  C:\Windows\System\noeHwvF.exe
  2⤵
  PID:6520
- C:\Windows\System\heotiZo.exe
  C:\Windows\System\heotiZo.exe
  2⤵
  PID:6556
- C:\Windows\System\vFtndbO.exe
  C:\Windows\System\vFtndbO.exe
  2⤵
  PID:6572
- C:\Windows\System\GGiHhIs.exe
  C:\Windows\System\GGiHhIs.exe
  2⤵
  PID:6604
- C:\Windows\System\TWPsuuR.exe
  C:\Windows\System\TWPsuuR.exe
  2⤵
  PID:6640
- C:\Windows\System\cubaKaU.exe
  C:\Windows\System\cubaKaU.exe
  2⤵
  PID:6680
- C:\Windows\System\VtrbKgd.exe
  C:\Windows\System\VtrbKgd.exe
  2⤵
  PID:6696
- C:\Windows\System\hfQRvgh.exe
  C:\Windows\System\hfQRvgh.exe
  2⤵
  PID:6736
- C:\Windows\System\UeBlHNf.exe
  C:\Windows\System\UeBlHNf.exe
  2⤵
  PID:6764
- C:\Windows\System\OFTxEem.exe
  C:\Windows\System\OFTxEem.exe
  2⤵
  PID:6788
- C:\Windows\System\yvznxGv.exe
  C:\Windows\System\yvznxGv.exe
  2⤵
  PID:6804
- C:\Windows\System\pwFRmXv.exe
  C:\Windows\System\pwFRmXv.exe
  2⤵
  PID:6824
- C:\Windows\System\wWRNBJb.exe
  C:\Windows\System\wWRNBJb.exe
  2⤵
  PID:6856
- C:\Windows\System\LGEGTNx.exe
  C:\Windows\System\LGEGTNx.exe
  2⤵
  PID:6876
- C:\Windows\System\lFQlTxu.exe
  C:\Windows\System\lFQlTxu.exe
  2⤵
  PID:6904
- C:\Windows\System\PJYPToR.exe
  C:\Windows\System\PJYPToR.exe
  2⤵
  PID:6948
- C:\Windows\System\NDVrPXH.exe
  C:\Windows\System\NDVrPXH.exe
  2⤵
  PID:6968
- C:\Windows\System\pFycjIj.exe
  C:\Windows\System\pFycjIj.exe
  2⤵
  PID:7008
- C:\Windows\System\zqVAmeM.exe
  C:\Windows\System\zqVAmeM.exe
  2⤵
  PID:7040
- C:\Windows\System\CTNwWGX.exe
  C:\Windows\System\CTNwWGX.exe
  2⤵
  PID:7076
- C:\Windows\System\DumNJSR.exe
  C:\Windows\System\DumNJSR.exe
  2⤵
  PID:7104
- C:\Windows\System\htbRNdg.exe
  C:\Windows\System\htbRNdg.exe
  2⤵
  PID:7128
- C:\Windows\System\wWoKEdK.exe
  C:\Windows\System\wWoKEdK.exe
  2⤵
  PID:7160
- C:\Windows\System\mqnNrqw.exe
  C:\Windows\System\mqnNrqw.exe
  2⤵
  PID:6172
- C:\Windows\System\MQszRBa.exe
  C:\Windows\System\MQszRBa.exe
  2⤵
  PID:6248
- C:\Windows\System\jvMjCFC.exe
  C:\Windows\System\jvMjCFC.exe
  2⤵
  PID:6320
- C:\Windows\System\SjSfpMa.exe
  C:\Windows\System\SjSfpMa.exe
  2⤵
  PID:6400
- C:\Windows\System\TpuPCZI.exe
  C:\Windows\System\TpuPCZI.exe
  2⤵
  PID:6404
- C:\Windows\System\qzftoZs.exe
  C:\Windows\System\qzftoZs.exe
  2⤵
  PID:6564
- C:\Windows\System\NDugERN.exe
  C:\Windows\System\NDugERN.exe
  2⤵
  PID:6664
- C:\Windows\System\glVqDrK.exe
  C:\Windows\System\glVqDrK.exe
  2⤵
  PID:6724
- C:\Windows\System\tIJoORO.exe
  C:\Windows\System\tIJoORO.exe
  2⤵
  PID:6820
- C:\Windows\System\WAmNsSq.exe
  C:\Windows\System\WAmNsSq.exe
  2⤵
  PID:6896
- C:\Windows\System\ZkyveAN.exe
  C:\Windows\System\ZkyveAN.exe
  2⤵
  PID:3512
- C:\Windows\System\eZawpBL.exe
  C:\Windows\System\eZawpBL.exe
  2⤵
  PID:7032
- C:\Windows\System\TOOMHYV.exe
  C:\Windows\System\TOOMHYV.exe
  2⤵
  PID:7100
- C:\Windows\System\LJMimmf.exe
  C:\Windows\System\LJMimmf.exe
  2⤵
  PID:5636
- C:\Windows\System\PgnCgPJ.exe
  C:\Windows\System\PgnCgPJ.exe
  2⤵
  PID:6264
- C:\Windows\System\tZVyNDV.exe
  C:\Windows\System\tZVyNDV.exe
  2⤵
  PID:6368
- C:\Windows\System\nJhglFi.exe
  C:\Windows\System\nJhglFi.exe
  2⤵
  PID:6568
- C:\Windows\System\NDQJWxm.exe
  C:\Windows\System\NDQJWxm.exe
  2⤵
  PID:6796
- C:\Windows\System\aLSuErT.exe
  C:\Windows\System\aLSuErT.exe
  2⤵
  PID:7020
- C:\Windows\System\nWTVFbc.exe
  C:\Windows\System\nWTVFbc.exe
  2⤵
  PID:7148
- C:\Windows\System\CQioYxR.exe
  C:\Windows\System\CQioYxR.exe
  2⤵
  PID:6688
- C:\Windows\System\tPWlpiI.exe
  C:\Windows\System\tPWlpiI.exe
  2⤵
  PID:6916
- C:\Windows\System\JxdGVZK.exe
  C:\Windows\System\JxdGVZK.exe
  2⤵
  PID:6708
- C:\Windows\System\BEYgyKR.exe
  C:\Windows\System\BEYgyKR.exe
  2⤵
  PID:7192
- C:\Windows\System\jRnddXe.exe
  C:\Windows\System\jRnddXe.exe
  2⤵
  PID:7212
- C:\Windows\System\MLGrZyd.exe
  C:\Windows\System\MLGrZyd.exe
  2⤵
  PID:7236
- C:\Windows\System\dHDmWVr.exe
  C:\Windows\System\dHDmWVr.exe
  2⤵
  PID:7284
- C:\Windows\System\ePLcFdu.exe
  C:\Windows\System\ePLcFdu.exe
  2⤵
  PID:7324
- C:\Windows\System\iJbCqpK.exe
  C:\Windows\System\iJbCqpK.exe
  2⤵
  PID:7352
- C:\Windows\System\WmcLOdE.exe
  C:\Windows\System\WmcLOdE.exe
  2⤵
  PID:7376
- C:\Windows\System\EjcDpEj.exe
  C:\Windows\System\EjcDpEj.exe
  2⤵
  PID:7408
- C:\Windows\System\EsaWXjm.exe
  C:\Windows\System\EsaWXjm.exe
  2⤵
  PID:7436
- C:\Windows\System\RGVCABU.exe
  C:\Windows\System\RGVCABU.exe
  2⤵
  PID:7460
- C:\Windows\System\ntZETaH.exe
  C:\Windows\System\ntZETaH.exe
  2⤵
  PID:7492
- C:\Windows\System\UwqXWcQ.exe
  C:\Windows\System\UwqXWcQ.exe
  2⤵
  PID:7516
- C:\Windows\System\JOkeJyy.exe
  C:\Windows\System\JOkeJyy.exe
  2⤵
  PID:7544
- C:\Windows\System\kKdvqJg.exe
  C:\Windows\System\kKdvqJg.exe
  2⤵
  PID:7560
- C:\Windows\System\JOQMwWh.exe
  C:\Windows\System\JOQMwWh.exe
  2⤵
  PID:7592
- C:\Windows\System\fsnwILS.exe
  C:\Windows\System\fsnwILS.exe
  2⤵
  PID:7628
- C:\Windows\System\wWgzAPH.exe
  C:\Windows\System\wWgzAPH.exe
  2⤵
  PID:7660
- C:\Windows\System\tRolKKv.exe
  C:\Windows\System\tRolKKv.exe
  2⤵
  PID:7684
- C:\Windows\System\geyujtr.exe
  C:\Windows\System\geyujtr.exe
  2⤵
  PID:7716
- C:\Windows\System\EpIkGKf.exe
  C:\Windows\System\EpIkGKf.exe
  2⤵
  PID:7740
- C:\Windows\System\jsncFDQ.exe
  C:\Windows\System\jsncFDQ.exe
  2⤵
  PID:7760
- C:\Windows\System\AXQdSbY.exe
  C:\Windows\System\AXQdSbY.exe
  2⤵
  PID:7800
- C:\Windows\System\vlXNamO.exe
  C:\Windows\System\vlXNamO.exe
  2⤵
  PID:7824
- C:\Windows\System\BBvVlmz.exe
  C:\Windows\System\BBvVlmz.exe
  2⤵
  PID:7852
- C:\Windows\System\XNfIERO.exe
  C:\Windows\System\XNfIERO.exe
  2⤵
  PID:7876
- C:\Windows\System\MmWCjkR.exe
  C:\Windows\System\MmWCjkR.exe
  2⤵
  PID:7908
- C:\Windows\System\kqPmfRI.exe
  C:\Windows\System\kqPmfRI.exe
  2⤵
  PID:7928
- C:\Windows\System\wjXlDrY.exe
  C:\Windows\System\wjXlDrY.exe
  2⤵
  PID:7968
- C:\Windows\System\IxLviPP.exe
  C:\Windows\System\IxLviPP.exe
  2⤵
  PID:8000
- C:\Windows\System\MSchnsB.exe
  C:\Windows\System\MSchnsB.exe
  2⤵
  PID:8036
- C:\Windows\System\VkSWEZh.exe
  C:\Windows\System\VkSWEZh.exe
  2⤵
  PID:8052
- C:\Windows\System\lKeheYG.exe
  C:\Windows\System\lKeheYG.exe
  2⤵
  PID:8092
- C:\Windows\System\sASseOt.exe
  C:\Windows\System\sASseOt.exe
  2⤵
  PID:8108
- C:\Windows\System\zYjyLzx.exe
  C:\Windows\System\zYjyLzx.exe
  2⤵
  PID:8136
- C:\Windows\System\YftEUwN.exe
  C:\Windows\System\YftEUwN.exe
  2⤵
  PID:8156
- C:\Windows\System\tnybGbB.exe
  C:\Windows\System\tnybGbB.exe
  2⤵
  PID:6316
- C:\Windows\System\CwllaMQ.exe
  C:\Windows\System\CwllaMQ.exe
  2⤵
  PID:7176
- C:\Windows\System\EGZkxFF.exe
  C:\Windows\System\EGZkxFF.exe
  2⤵
  PID:7272
- C:\Windows\System\iVFOdpe.exe
  C:\Windows\System\iVFOdpe.exe
  2⤵
  PID:7360
- C:\Windows\System\jSTiCGM.exe
  C:\Windows\System\jSTiCGM.exe
  2⤵
  PID:7424
- C:\Windows\System\hrpAbhw.exe
  C:\Windows\System\hrpAbhw.exe
  2⤵
  PID:7508
- C:\Windows\System\NKXJjjK.exe
  C:\Windows\System\NKXJjjK.exe
  2⤵
  PID:7576
- C:\Windows\System\ORNZiZt.exe
  C:\Windows\System\ORNZiZt.exe
  2⤵
  PID:7620
- C:\Windows\System\tWFROiT.exe
  C:\Windows\System\tWFROiT.exe
  2⤵
  PID:7732
- C:\Windows\System\JqxwYgR.exe
  C:\Windows\System\JqxwYgR.exe
  2⤵
  PID:7724
- C:\Windows\System\MudXRHx.exe
  C:\Windows\System\MudXRHx.exe
  2⤵
  PID:7776
- C:\Windows\System\lHbCdvh.exe
  C:\Windows\System\lHbCdvh.exe
  2⤵
  PID:7896
- C:\Windows\System\dQuMdLt.exe
  C:\Windows\System\dQuMdLt.exe
  2⤵
  PID:7872
- C:\Windows\System\UOFbDVc.exe
  C:\Windows\System\UOFbDVc.exe
  2⤵
  PID:7948
- C:\Windows\System\bfngAjR.exe
  C:\Windows\System\bfngAjR.exe
  2⤵
  PID:7984
- C:\Windows\System\pjXedpG.exe
  C:\Windows\System\pjXedpG.exe
  2⤵
  PID:8080
- C:\Windows\System\FTGmViQ.exe
  C:\Windows\System\FTGmViQ.exe
  2⤵
  PID:8180
- C:\Windows\System\PpxCQrX.exe
  C:\Windows\System\PpxCQrX.exe
  2⤵
  PID:8168
- C:\Windows\System\RpmrxyI.exe
  C:\Windows\System\RpmrxyI.exe
  2⤵
  PID:7232
- C:\Windows\System\POGhyGS.exe
  C:\Windows\System\POGhyGS.exe
  2⤵
  PID:4012
- C:\Windows\System\BMEGJCq.exe
  C:\Windows\System\BMEGJCq.exe
  2⤵
  PID:3436
- C:\Windows\System\opEQGZa.exe
  C:\Windows\System\opEQGZa.exe
  2⤵
  PID:7820
- C:\Windows\System\sikuBLQ.exe
  C:\Windows\System\sikuBLQ.exe
  2⤵
  PID:7888
- C:\Windows\System\iGiNvGm.exe
  C:\Windows\System\iGiNvGm.exe
  2⤵
  PID:7924
- C:\Windows\System\zbAUnwY.exe
  C:\Windows\System\zbAUnwY.exe
  2⤵
  PID:8176
- C:\Windows\System\aIOxAsE.exe
  C:\Windows\System\aIOxAsE.exe
  2⤵
  PID:2552
- C:\Windows\System\TeZwTbY.exe
  C:\Windows\System\TeZwTbY.exe
  2⤵
  PID:7648
- C:\Windows\System\bRPbaPr.exe
  C:\Windows\System\bRPbaPr.exe
  2⤵
  PID:8120
- C:\Windows\System\QNpGiUP.exe
  C:\Windows\System\QNpGiUP.exe
  2⤵
  PID:7864
- C:\Windows\System\ARwtVqH.exe
  C:\Windows\System\ARwtVqH.exe
  2⤵
  PID:7572
- C:\Windows\System\kCcoSOS.exe
  C:\Windows\System\kCcoSOS.exe
  2⤵
  PID:8216
- C:\Windows\System\ePrFhNZ.exe
  C:\Windows\System\ePrFhNZ.exe
  2⤵
  PID:8240
- C:\Windows\System\fmipHZF.exe
  C:\Windows\System\fmipHZF.exe
  2⤵
  PID:8272
- C:\Windows\System\cKYyJdU.exe
  C:\Windows\System\cKYyJdU.exe
  2⤵
  PID:8300
- C:\Windows\System\gflctjY.exe
  C:\Windows\System\gflctjY.exe
  2⤵
  PID:8328
- C:\Windows\System\wEOzVjM.exe
  C:\Windows\System\wEOzVjM.exe
  2⤵
  PID:8352
- C:\Windows\System\sNtlNfw.exe
  C:\Windows\System\sNtlNfw.exe
  2⤵
  PID:8384
- C:\Windows\System\LEaJAYd.exe
  C:\Windows\System\LEaJAYd.exe
  2⤵
  PID:8412
- C:\Windows\System\aqmwwVb.exe
  C:\Windows\System\aqmwwVb.exe
  2⤵
  PID:8440
- C:\Windows\System\UIBpeWG.exe
  C:\Windows\System\UIBpeWG.exe
  2⤵
  PID:8468
- C:\Windows\System\qyqouIv.exe
  C:\Windows\System\qyqouIv.exe
  2⤵
  PID:8496
- C:\Windows\System\QDRzlON.exe
  C:\Windows\System\QDRzlON.exe
  2⤵
  PID:8512
- C:\Windows\System\rbwbrAz.exe
  C:\Windows\System\rbwbrAz.exe
  2⤵
  PID:8544
- C:\Windows\System\BnLdUtA.exe
  C:\Windows\System\BnLdUtA.exe
  2⤵
  PID:8580
- C:\Windows\System\XMGkqVy.exe
  C:\Windows\System\XMGkqVy.exe
  2⤵
  PID:8608
- C:\Windows\System\zVCKMwk.exe
  C:\Windows\System\zVCKMwk.exe
  2⤵
  PID:8624
- C:\Windows\System\vLEwVIa.exe
  C:\Windows\System\vLEwVIa.exe
  2⤵
  PID:8640
- C:\Windows\System\lCsswOh.exe
  C:\Windows\System\lCsswOh.exe
  2⤵
  PID:8672
- C:\Windows\System\JxUgwtv.exe
  C:\Windows\System\JxUgwtv.exe
  2⤵
  PID:8692
- C:\Windows\System\nhUckQK.exe
  C:\Windows\System\nhUckQK.exe
  2⤵
  PID:8724
- C:\Windows\System\JgtHUdW.exe
  C:\Windows\System\JgtHUdW.exe
  2⤵
  PID:8768
- C:\Windows\System\iZavjJM.exe
  C:\Windows\System\iZavjJM.exe
  2⤵
  PID:8796
- C:\Windows\System\JWBWefX.exe
  C:\Windows\System\JWBWefX.exe
  2⤵
  PID:8824
- C:\Windows\System\LgefwMU.exe
  C:\Windows\System\LgefwMU.exe
  2⤵
  PID:8852
- C:\Windows\System\rECNKnY.exe
  C:\Windows\System\rECNKnY.exe
  2⤵
  PID:8880
- C:\Windows\System\REPGSag.exe
  C:\Windows\System\REPGSag.exe
  2⤵
  PID:8908
- C:\Windows\System\IVvmteI.exe
  C:\Windows\System\IVvmteI.exe
  2⤵
  PID:8940
- C:\Windows\System\DiJnSwC.exe
  C:\Windows\System\DiJnSwC.exe
  2⤵
  PID:8956
- C:\Windows\System\iEIKsDx.exe
  C:\Windows\System\iEIKsDx.exe
  2⤵
  PID:8988
- C:\Windows\System\IerIrvx.exe
  C:\Windows\System\IerIrvx.exe
  2⤵
  PID:9036
- C:\Windows\System\IgVsIzz.exe
  C:\Windows\System\IgVsIzz.exe
  2⤵
  PID:9052
- C:\Windows\System\WrLgRhO.exe
  C:\Windows\System\WrLgRhO.exe
  2⤵
  PID:9084
- C:\Windows\System\poXVqWh.exe
  C:\Windows\System\poXVqWh.exe
  2⤵
  PID:9120
- C:\Windows\System\YEPzgaL.exe
  C:\Windows\System\YEPzgaL.exe
  2⤵
  PID:9140
- C:\Windows\System\QOcmSYs.exe
  C:\Windows\System\QOcmSYs.exe
  2⤵
  PID:9176
- C:\Windows\System\eRKoGGr.exe
  C:\Windows\System\eRKoGGr.exe
  2⤵
  PID:9204
- C:\Windows\System\quQEYbB.exe
  C:\Windows\System\quQEYbB.exe
  2⤵
  PID:8208
- C:\Windows\System\AVdMwjN.exe
  C:\Windows\System\AVdMwjN.exe
  2⤵
  PID:8260
- C:\Windows\System\WoAZZrP.exe
  C:\Windows\System\WoAZZrP.exe
  2⤵
  PID:8320
- C:\Windows\System\NERgiPo.exe
  C:\Windows\System\NERgiPo.exe
  2⤵
  PID:8372
- C:\Windows\System\QbkEntL.exe
  C:\Windows\System\QbkEntL.exe
  2⤵
  PID:8460
- C:\Windows\System\IbDdXNF.exe
  C:\Windows\System\IbDdXNF.exe
  2⤵
  PID:8524
- C:\Windows\System\iGLQOuF.exe
  C:\Windows\System\iGLQOuF.exe
  2⤵
  PID:8600
- C:\Windows\System\RXdsdYo.exe
  C:\Windows\System\RXdsdYo.exe
  2⤵
  PID:8680
- C:\Windows\System\kPfjgUk.exe
  C:\Windows\System\kPfjgUk.exe
  2⤵
  PID:8752
- C:\Windows\System\KQmLLrh.exe
  C:\Windows\System\KQmLLrh.exe
  2⤵
  PID:8784
- C:\Windows\System\NjLMQJA.exe
  C:\Windows\System\NjLMQJA.exe
  2⤵
  PID:8836
- C:\Windows\System\rHVxjQn.exe
  C:\Windows\System\rHVxjQn.exe
  2⤵
  PID:8928
- C:\Windows\System\ZUqTFyD.exe
  C:\Windows\System\ZUqTFyD.exe
  2⤵
  PID:8976
- C:\Windows\System\RgWVqda.exe
  C:\Windows\System\RgWVqda.exe
  2⤵
  PID:9020
- C:\Windows\System\AemvxiF.exe
  C:\Windows\System\AemvxiF.exe
  2⤵
  PID:9044
- C:\Windows\System\lXWkSBL.exe
  C:\Windows\System\lXWkSBL.exe
  2⤵
  PID:9132
- C:\Windows\System\dcpYLvV.exe
  C:\Windows\System\dcpYLvV.exe
  2⤵
  PID:8224
- C:\Windows\System\NIDSbYo.exe
  C:\Windows\System\NIDSbYo.exe
  2⤵
  PID:8344
- C:\Windows\System\EvflulY.exe
  C:\Windows\System\EvflulY.exe
  2⤵
  PID:8616
- C:\Windows\System\eAgSUZp.exe
  C:\Windows\System\eAgSUZp.exe
  2⤵
  PID:8700
- C:\Windows\System\NRAnTQJ.exe
  C:\Windows\System\NRAnTQJ.exe
  2⤵
  PID:8904
- C:\Windows\System\HUlxnfK.exe
  C:\Windows\System\HUlxnfK.exe
  2⤵
  PID:9016
- C:\Windows\System\bbhLKyb.exe
  C:\Windows\System\bbhLKyb.exe
  2⤵
  PID:9168
- C:\Windows\System\JnmIppn.exe
  C:\Windows\System\JnmIppn.exe
  2⤵
  PID:8656
- C:\Windows\System\GEYOWEE.exe
  C:\Windows\System\GEYOWEE.exe
  2⤵
  PID:8864
- C:\Windows\System\cbvuUWA.exe
  C:\Windows\System\cbvuUWA.exe
  2⤵
  PID:8292
- C:\Windows\System\rOPgYfr.exe
  C:\Windows\System\rOPgYfr.exe
  2⤵
  PID:8736
- C:\Windows\System\NSfEkMy.exe
  C:\Windows\System\NSfEkMy.exe
  2⤵
  PID:9236
- C:\Windows\System\ZVopGZK.exe
  C:\Windows\System\ZVopGZK.exe
  2⤵
  PID:9272
- C:\Windows\System\XqZWcBp.exe
  C:\Windows\System\XqZWcBp.exe
  2⤵
  PID:9300
- C:\Windows\System\bMpJJPG.exe
  C:\Windows\System\bMpJJPG.exe
  2⤵
  PID:9332
- C:\Windows\System\iorLUiK.exe
  C:\Windows\System\iorLUiK.exe
  2⤵
  PID:9348
- C:\Windows\System\hYfcFIG.exe
  C:\Windows\System\hYfcFIG.exe
  2⤵
  PID:9376
- C:\Windows\System\hOPwtLO.exe
  C:\Windows\System\hOPwtLO.exe
  2⤵
  PID:9396
- C:\Windows\System\BNbegmt.exe
  C:\Windows\System\BNbegmt.exe
  2⤵
  PID:9428
- C:\Windows\System\UZSBmLp.exe
  C:\Windows\System\UZSBmLp.exe
  2⤵
  PID:9460
- C:\Windows\System\IhwdfEC.exe
  C:\Windows\System\IhwdfEC.exe
  2⤵
  PID:9500
- C:\Windows\System\bOnJMCl.exe
  C:\Windows\System\bOnJMCl.exe
  2⤵
  PID:9520
- C:\Windows\System\SEhtinF.exe
  C:\Windows\System\SEhtinF.exe
  2⤵
  PID:9552
- C:\Windows\System\AXAnQyD.exe
  C:\Windows\System\AXAnQyD.exe
  2⤵
  PID:9584
- C:\Windows\System\bAKsleO.exe
  C:\Windows\System\bAKsleO.exe
  2⤵
  PID:9604
- C:\Windows\System\YobUsBo.exe
  C:\Windows\System\YobUsBo.exe
  2⤵
  PID:9640
- C:\Windows\System\cleTTTF.exe
  C:\Windows\System\cleTTTF.exe
  2⤵
  PID:9668
- C:\Windows\System\dkzPpfp.exe
  C:\Windows\System\dkzPpfp.exe
  2⤵
  PID:9684
- C:\Windows\System\dzmTnfF.exe
  C:\Windows\System\dzmTnfF.exe
  2⤵
  PID:9712
- C:\Windows\System\fIQJXIf.exe
  C:\Windows\System\fIQJXIf.exe
  2⤵
  PID:9752
- C:\Windows\System\BsQeuyA.exe
  C:\Windows\System\BsQeuyA.exe
  2⤵
  PID:9772
- C:\Windows\System\LoFnpIY.exe
  C:\Windows\System\LoFnpIY.exe
  2⤵
  PID:9808
- C:\Windows\System\QpzXrAx.exe
  C:\Windows\System\QpzXrAx.exe
  2⤵
  PID:9840
- C:\Windows\System\ctBecKc.exe
  C:\Windows\System\ctBecKc.exe
  2⤵
  PID:9856
- C:\Windows\System\XStDBwh.exe
  C:\Windows\System\XStDBwh.exe
  2⤵
  PID:9884
- C:\Windows\System\mApaHFv.exe
  C:\Windows\System\mApaHFv.exe
  2⤵
  PID:9912
- C:\Windows\System\nkLkPHC.exe
  C:\Windows\System\nkLkPHC.exe
  2⤵
  PID:9944
- C:\Windows\System\TIpVPDU.exe
  C:\Windows\System\TIpVPDU.exe
  2⤵
  PID:9968
- C:\Windows\System\UPuEFDN.exe
  C:\Windows\System\UPuEFDN.exe
  2⤵
  PID:10008
- C:\Windows\System\jUsJwxW.exe
  C:\Windows\System\jUsJwxW.exe
  2⤵
  PID:10036
- C:\Windows\System\WGPFmZW.exe
  C:\Windows\System\WGPFmZW.exe
  2⤵
  PID:10064
- C:\Windows\System\fUHYbsT.exe
  C:\Windows\System\fUHYbsT.exe
  2⤵
  PID:10084
- C:\Windows\System\URxOAaz.exe
  C:\Windows\System\URxOAaz.exe
  2⤵
  PID:10120
- C:\Windows\System\TysZsjA.exe
  C:\Windows\System\TysZsjA.exe
  2⤵
  PID:10136
- C:\Windows\System\KWZCzaF.exe
  C:\Windows\System\KWZCzaF.exe
  2⤵
  PID:10168
- C:\Windows\System\cgyOaHF.exe
  C:\Windows\System\cgyOaHF.exe
  2⤵
  PID:10208
- C:\Windows\System\iAreKDd.exe
  C:\Windows\System\iAreKDd.exe
  2⤵
  PID:10236
- C:\Windows\System\TTVPEED.exe
  C:\Windows\System\TTVPEED.exe
  2⤵
  PID:9256
- C:\Windows\System\eZECQHL.exe
  C:\Windows\System\eZECQHL.exe
  2⤵
  PID:9324
- C:\Windows\System\gFkPpWy.exe
  C:\Windows\System\gFkPpWy.exe
  2⤵
  PID:9412
- C:\Windows\System\KlsHADa.exe
  C:\Windows\System\KlsHADa.exe
  2⤵
  PID:9444
- C:\Windows\System\ABdtekN.exe
  C:\Windows\System\ABdtekN.exe
  2⤵
  PID:9536
- C:\Windows\System\MHXbdub.exe
  C:\Windows\System\MHXbdub.exe
  2⤵
  PID:9576
- C:\Windows\System\esjdRtb.exe
  C:\Windows\System\esjdRtb.exe
  2⤵
  PID:9648
- C:\Windows\System\KjEMuoF.exe
  C:\Windows\System\KjEMuoF.exe
  2⤵
  PID:9704
- C:\Windows\System\CmmwZIO.exe
  C:\Windows\System\CmmwZIO.exe
  2⤵
  PID:9792
- C:\Windows\System\GxVFoPN.exe
  C:\Windows\System\GxVFoPN.exe
  2⤵
  PID:9900
- C:\Windows\System\GVxONEy.exe
  C:\Windows\System\GVxONEy.exe
  2⤵
  PID:9956
- C:\Windows\System\OkWmSTD.exe
  C:\Windows\System\OkWmSTD.exe
  2⤵
  PID:10000
- C:\Windows\System\oUEQQOz.exe
  C:\Windows\System\oUEQQOz.exe
  2⤵
  PID:10080
- C:\Windows\System\oLiVcwK.exe
  C:\Windows\System\oLiVcwK.exe
  2⤵
  PID:10132
- C:\Windows\System\przQZwt.exe
  C:\Windows\System\przQZwt.exe
  2⤵
  PID:10228
- C:\Windows\System\VelpaJM.exe
  C:\Windows\System\VelpaJM.exe
  2⤵
  PID:9292
- C:\Windows\System\UHtZfIK.exe
  C:\Windows\System\UHtZfIK.exe
  2⤵
  PID:9360
- C:\Windows\System\cQlHmZD.exe
  C:\Windows\System\cQlHmZD.exe
  2⤵
  PID:9568
- C:\Windows\System\imErFvr.exe
  C:\Windows\System\imErFvr.exe
  2⤵
  PID:9700
- C:\Windows\System\QTIvQYE.exe
  C:\Windows\System\QTIvQYE.exe
  2⤵
  PID:9924
- C:\Windows\System\GwKHGjC.exe
  C:\Windows\System\GwKHGjC.exe
  2⤵
  PID:10028
- C:\Windows\System\cGPsLqx.exe
  C:\Windows\System\cGPsLqx.exe
  2⤵
  PID:10192
- C:\Windows\System\VjNDmUO.exe
  C:\Windows\System\VjNDmUO.exe
  2⤵
  PID:9480
- C:\Windows\System\OnWgqqL.exe
  C:\Windows\System\OnWgqqL.exe
  2⤵
  PID:9632
- C:\Windows\System\IEwqlbS.exe
  C:\Windows\System\IEwqlbS.exe
  2⤵
  PID:10108
- C:\Windows\System\kHLRPWW.exe
  C:\Windows\System\kHLRPWW.exe
  2⤵
  PID:8312
- C:\Windows\System\QRDqeIm.exe
  C:\Windows\System\QRDqeIm.exe
  2⤵
  PID:10072
- C:\Windows\System\jNTJmaz.exe
  C:\Windows\System\jNTJmaz.exe
  2⤵
  PID:10264
- C:\Windows\System\JTCDIBH.exe
  C:\Windows\System\JTCDIBH.exe
  2⤵
  PID:10304
- C:\Windows\System\nDEmZYt.exe
  C:\Windows\System\nDEmZYt.exe
  2⤵
  PID:10320
- C:\Windows\System\uTCnSMA.exe
  C:\Windows\System\uTCnSMA.exe
  2⤵
  PID:10344
- C:\Windows\System\WaPuYnL.exe
  C:\Windows\System\WaPuYnL.exe
  2⤵
  PID:10364
- C:\Windows\System\JfbAhyH.exe
  C:\Windows\System\JfbAhyH.exe
  2⤵
  PID:10396
- C:\Windows\System\ABwwxHD.exe
  C:\Windows\System\ABwwxHD.exe
  2⤵
  PID:10444
- C:\Windows\System\QXkWqyJ.exe
  C:\Windows\System\QXkWqyJ.exe
  2⤵
  PID:10472
- C:\Windows\System\nefKxIy.exe
  C:\Windows\System\nefKxIy.exe
  2⤵
  PID:10500
- C:\Windows\System\ciOzYNX.exe
  C:\Windows\System\ciOzYNX.exe
  2⤵
  PID:10520
- C:\Windows\System\GtkNIMo.exe
  C:\Windows\System\GtkNIMo.exe
  2⤵
  PID:10552
- C:\Windows\System\eCulMmU.exe
  C:\Windows\System\eCulMmU.exe
  2⤵
  PID:10572
- C:\Windows\System\qaYoPEf.exe
  C:\Windows\System\qaYoPEf.exe
  2⤵
  PID:10612
- C:\Windows\System\llAGpSl.exe
  C:\Windows\System\llAGpSl.exe
  2⤵
  PID:10632
- C:\Windows\System\rdQinaA.exe
  C:\Windows\System\rdQinaA.exe
  2⤵
  PID:10668
- C:\Windows\System\BNyDgsK.exe
  C:\Windows\System\BNyDgsK.exe
  2⤵
  PID:10696
- C:\Windows\System\lhIxqps.exe
  C:\Windows\System\lhIxqps.exe
  2⤵
  PID:10712
- C:\Windows\System\xTURuEB.exe
  C:\Windows\System\xTURuEB.exe
  2⤵
  PID:10752
- C:\Windows\System\ZdlNPpf.exe
  C:\Windows\System\ZdlNPpf.exe
  2⤵
  PID:10768
- C:\Windows\System\OwexGOY.exe
  C:\Windows\System\OwexGOY.exe
  2⤵
  PID:10808
- C:\Windows\System\ckDENqA.exe
  C:\Windows\System\ckDENqA.exe
  2⤵
  PID:10824
- C:\Windows\System\wZllRYV.exe
  C:\Windows\System\wZllRYV.exe
  2⤵
  PID:10860
- C:\Windows\System\arXkWOK.exe
  C:\Windows\System\arXkWOK.exe
  2⤵
  PID:10892
- C:\Windows\System\kJoOGFW.exe
  C:\Windows\System\kJoOGFW.exe
  2⤵
  PID:10908
- C:\Windows\System\pvaGvBE.exe
  C:\Windows\System\pvaGvBE.exe
  2⤵
  PID:10936
- C:\Windows\System\cUUrgUh.exe
  C:\Windows\System\cUUrgUh.exe
  2⤵
  PID:10976
- C:\Windows\System\vCXunGF.exe
  C:\Windows\System\vCXunGF.exe
  2⤵
  PID:10992
- C:\Windows\System\pjdXvck.exe
  C:\Windows\System\pjdXvck.exe
  2⤵
  PID:11024
- C:\Windows\System\JuBbxDB.exe
  C:\Windows\System\JuBbxDB.exe
  2⤵
  PID:11064
- C:\Windows\System\nhBHhCA.exe
  C:\Windows\System\nhBHhCA.exe
  2⤵
  PID:11080
- C:\Windows\System\RNdcFQt.exe
  C:\Windows\System\RNdcFQt.exe
  2⤵
  PID:11112
- C:\Windows\System\fmPAkuW.exe
  C:\Windows\System\fmPAkuW.exe
  2⤵
  PID:11132
- C:\Windows\System\NrHOPxz.exe
  C:\Windows\System\NrHOPxz.exe
  2⤵
  PID:11176
- C:\Windows\System\qGFbReg.exe
  C:\Windows\System\qGFbReg.exe
  2⤵
  PID:11192
- C:\Windows\System\MrJXDNs.exe
  C:\Windows\System\MrJXDNs.exe
  2⤵
  PID:11232
- C:\Windows\System\NuvgbRW.exe
  C:\Windows\System\NuvgbRW.exe
  2⤵
  PID:11260
- C:\Windows\System\HftUnDc.exe
  C:\Windows\System\HftUnDc.exe
  2⤵
  PID:10248
- C:\Windows\System\oMetEXO.exe
  C:\Windows\System\oMetEXO.exe
  2⤵
  PID:10332
- C:\Windows\System\YNPxwdC.exe
  C:\Windows\System\YNPxwdC.exe
  2⤵
  PID:10376
- C:\Windows\System\LtvgWjE.exe
  C:\Windows\System\LtvgWjE.exe
  2⤵
  PID:10456
- C:\Windows\System\WoIZcsN.exe
  C:\Windows\System\WoIZcsN.exe
  2⤵
  PID:10508
- C:\Windows\System\ZaoDTak.exe
  C:\Windows\System\ZaoDTak.exe
  2⤵
  PID:10608
- C:\Windows\System\lIPYNcc.exe
  C:\Windows\System\lIPYNcc.exe
  2⤵
  PID:10664
- C:\Windows\System\BXJEjVG.exe
  C:\Windows\System\BXJEjVG.exe
  2⤵
  PID:10704
- C:\Windows\System\RPJqbAb.exe
  C:\Windows\System\RPJqbAb.exe
  2⤵
  PID:10792
- C:\Windows\System\rfOaUcA.exe
  C:\Windows\System\rfOaUcA.exe
  2⤵
  PID:10880
- C:\Windows\System\SmusJcH.exe
  C:\Windows\System\SmusJcH.exe
  2⤵
  PID:10924
- C:\Windows\System\ArYywIA.exe
  C:\Windows\System\ArYywIA.exe
  2⤵
  PID:11008
- C:\Windows\System\ArXgyme.exe
  C:\Windows\System\ArXgyme.exe
  2⤵
  PID:11076
- C:\Windows\System\QFLMeHu.exe
  C:\Windows\System\QFLMeHu.exe
  2⤵
  PID:11124
- C:\Windows\System\PoYWxnw.exe
  C:\Windows\System\PoYWxnw.exe
  2⤵
  PID:11172
- C:\Windows\System\mcpVuoI.exe
  C:\Windows\System\mcpVuoI.exe
  2⤵
  PID:11220
- C:\Windows\System\RxgLDho.exe
  C:\Windows\System\RxgLDho.exe
  2⤵
  PID:10300
- C:\Windows\System\QZlQmax.exe
  C:\Windows\System\QZlQmax.exe
  2⤵
  PID:10548
- C:\Windows\System\dXXieGL.exe
  C:\Windows\System\dXXieGL.exe
  2⤵
  PID:10688
- C:\Windows\System\CIlurxP.exe
  C:\Windows\System\CIlurxP.exe
  2⤵
  PID:10800
- C:\Windows\System\lJaxWLp.exe
  C:\Windows\System\lJaxWLp.exe
  2⤵
  PID:10900
- C:\Windows\System\JYVAFTs.exe
  C:\Windows\System\JYVAFTs.exe
  2⤵
  PID:11120
- C:\Windows\System\WJTDTYZ.exe
  C:\Windows\System\WJTDTYZ.exe
  2⤵
  PID:11252
- C:\Windows\System\nEnhTdN.exe
  C:\Windows\System\nEnhTdN.exe
  2⤵
  PID:10496
- C:\Windows\System\XTPGKZB.exe
  C:\Windows\System\XTPGKZB.exe
  2⤵
  PID:10840
- C:\Windows\System\RwssHcJ.exe
  C:\Windows\System\RwssHcJ.exe
  2⤵
  PID:10352
- C:\Windows\System\IhuecjS.exe
  C:\Windows\System\IhuecjS.exe
  2⤵
  PID:10424
- C:\Windows\System\mbPbljK.exe
  C:\Windows\System\mbPbljK.exe
  2⤵
  PID:11292
- C:\Windows\System\ULcuGxP.exe
  C:\Windows\System\ULcuGxP.exe
  2⤵
  PID:11320
- C:\Windows\System\jxpgNHe.exe
  C:\Windows\System\jxpgNHe.exe
  2⤵
  PID:11336
- C:\Windows\System\GHDGeks.exe
  C:\Windows\System\GHDGeks.exe
  2⤵
  PID:11352
- C:\Windows\System\habyaoD.exe
  C:\Windows\System\habyaoD.exe
  2⤵
  PID:11376
- C:\Windows\System\MdgULZr.exe
  C:\Windows\System\MdgULZr.exe
  2⤵
  PID:11408
- C:\Windows\System\ZlYrlHQ.exe
  C:\Windows\System\ZlYrlHQ.exe
  2⤵
  PID:11444
- C:\Windows\System\Cjcimkl.exe
  C:\Windows\System\Cjcimkl.exe
  2⤵
  PID:11476
- C:\Windows\System\WdAFzqu.exe
  C:\Windows\System\WdAFzqu.exe
  2⤵
  PID:11512
- C:\Windows\System\yOcJJsS.exe
  C:\Windows\System\yOcJJsS.exe
  2⤵
  PID:11532
- C:\Windows\System\HjxxnMr.exe
  C:\Windows\System\HjxxnMr.exe
  2⤵
  PID:11560
- C:\Windows\System\REdMMci.exe
  C:\Windows\System\REdMMci.exe
  2⤵
  PID:11584
- C:\Windows\System\JMSHPyy.exe
  C:\Windows\System\JMSHPyy.exe
  2⤵
  PID:11616
- C:\Windows\System\XhWssDI.exe
  C:\Windows\System\XhWssDI.exe
  2⤵
  PID:11644
- C:\Windows\System\TdmgZGm.exe
  C:\Windows\System\TdmgZGm.exe
  2⤵
  PID:11672
- C:\Windows\System\NnNaWUr.exe
  C:\Windows\System\NnNaWUr.exe
  2⤵
  PID:11704
- C:\Windows\System\NedDltp.exe
  C:\Windows\System\NedDltp.exe
  2⤵
  PID:11740
- C:\Windows\System\XnDPfAO.exe
  C:\Windows\System\XnDPfAO.exe
  2⤵
  PID:11756
- C:\Windows\System\sSgHszK.exe
  C:\Windows\System\sSgHszK.exe
  2⤵
  PID:11796
- C:\Windows\System\spumCoR.exe
  C:\Windows\System\spumCoR.exe
  2⤵
  PID:11816
- C:\Windows\System\pHVEKTB.exe
  C:\Windows\System\pHVEKTB.exe
  2⤵
  PID:11840
- C:\Windows\System\dHFfgjN.exe
  C:\Windows\System\dHFfgjN.exe
  2⤵
  PID:11868
- C:\Windows\System\mgKGMtK.exe
  C:\Windows\System\mgKGMtK.exe
  2⤵
  PID:11900
- C:\Windows\System\HJgBOBh.exe
  C:\Windows\System\HJgBOBh.exe
  2⤵
  PID:11920
- C:\Windows\System\nJWTMSC.exe
  C:\Windows\System\nJWTMSC.exe
  2⤵
  PID:11948
- C:\Windows\System\bTthceu.exe
  C:\Windows\System\bTthceu.exe
  2⤵
  PID:11996
- C:\Windows\System\MYWpVNY.exe
  C:\Windows\System\MYWpVNY.exe
  2⤵
  PID:12024
- C:\Windows\System\grYPyGf.exe
  C:\Windows\System\grYPyGf.exe
  2⤵
  PID:12052
- C:\Windows\System\DPKtxBf.exe
  C:\Windows\System\DPKtxBf.exe
  2⤵
  PID:12076
- C:\Windows\System\msLHdgq.exe
  C:\Windows\System\msLHdgq.exe
  2⤵
  PID:12096
- C:\Windows\System\LfAMZIz.exe
  C:\Windows\System\LfAMZIz.exe
  2⤵
  PID:12128
- C:\Windows\System\vDElAml.exe
  C:\Windows\System\vDElAml.exe
  2⤵
  PID:12160
- C:\Windows\System\XUTmVLX.exe
  C:\Windows\System\XUTmVLX.exe
  2⤵
  PID:12192
- C:\Windows\System\KwPOslC.exe
  C:\Windows\System\KwPOslC.exe
  2⤵
  PID:12212
- C:\Windows\System\IRquekO.exe
  C:\Windows\System\IRquekO.exe
  2⤵
  PID:12232
- C:\Windows\System\zmSyGdW.exe
  C:\Windows\System\zmSyGdW.exe
  2⤵
  PID:12260
- C:\Windows\System\nOGRnbP.exe
  C:\Windows\System\nOGRnbP.exe
  2⤵
  PID:12280
- C:\Windows\System\BFSSYXo.exe
  C:\Windows\System\BFSSYXo.exe
  2⤵
  PID:11312
- C:\Windows\System\KOJOYtZ.exe
  C:\Windows\System\KOJOYtZ.exe
  2⤵
  PID:11396
- C:\Windows\System\mgxZZRj.exe
  C:\Windows\System\mgxZZRj.exe
  2⤵
  PID:11492
- C:\Windows\System\AtRNHrE.exe
  C:\Windows\System\AtRNHrE.exe
  2⤵
  PID:11524
- C:\Windows\System\DBOiYeP.exe
  C:\Windows\System\DBOiYeP.exe
  2⤵
  PID:11580
- C:\Windows\System\BTMekns.exe
  C:\Windows\System\BTMekns.exe
  2⤵
  PID:11696
- C:\Windows\System\mUCFUyg.exe
  C:\Windows\System\mUCFUyg.exe
  2⤵
  PID:11728
- C:\Windows\System\BIhubJw.exe
  C:\Windows\System\BIhubJw.exe
  2⤵
  PID:11824
- C:\Windows\System\qvpQxmq.exe
  C:\Windows\System\qvpQxmq.exe
  2⤵
  PID:3028
- C:\Windows\System\tKXcdcR.exe
  C:\Windows\System\tKXcdcR.exe
  2⤵
  PID:4064
- C:\Windows\System\qLYQvHT.exe
  C:\Windows\System\qLYQvHT.exe
  2⤵
  PID:1420
- C:\Windows\System\NwbfQbx.exe
  C:\Windows\System\NwbfQbx.exe
  2⤵
  PID:12044
- C:\Windows\System\iYxdxMk.exe
  C:\Windows\System\iYxdxMk.exe
  2⤵
  PID:12084
- C:\Windows\System\enhywdi.exe
  C:\Windows\System\enhywdi.exe
  2⤵
  PID:12108
- C:\Windows\System\vTwnmpx.exe
  C:\Windows\System\vTwnmpx.exe
  2⤵
  PID:10960
- C:\Windows\System\YkBuqIz.exe
  C:\Windows\System\YkBuqIz.exe
  2⤵
  PID:12256
- C:\Windows\System\ghrPsMO.exe
  C:\Windows\System\ghrPsMO.exe
  2⤵
  PID:11280
- C:\Windows\System\YtzbUJv.exe
  C:\Windows\System\YtzbUJv.exe
  2⤵
  PID:11464
- C:\Windows\System\hbOGKoQ.exe
  C:\Windows\System\hbOGKoQ.exe
  2⤵
  PID:11544
- C:\Windows\System\gyhiOSl.exe
  C:\Windows\System\gyhiOSl.exe
  2⤵
  PID:11780
- C:\Windows\System\eyFdmqB.exe
  C:\Windows\System\eyFdmqB.exe
  2⤵
  PID:11928
- C:\Windows\System\SETiIlY.exe
  C:\Windows\System\SETiIlY.exe
  2⤵
  PID:12068
- C:\Windows\System\ampqwGx.exe
  C:\Windows\System\ampqwGx.exe
  2⤵
  PID:12248
- C:\Windows\System\OMrGPCI.exe
  C:\Windows\System\OMrGPCI.exe
  2⤵
  PID:11572
- C:\Windows\System\ygPYbpd.exe
  C:\Windows\System\ygPYbpd.exe
  2⤵
  PID:11712
- C:\Windows\System\iqVsMlL.exe
  C:\Windows\System\iqVsMlL.exe
  2⤵
  PID:12088
- C:\Windows\System\XbEjJdf.exe
  C:\Windows\System\XbEjJdf.exe
  2⤵
  PID:11488
- C:\Windows\System\mRCiZtQ.exe
  C:\Windows\System\mRCiZtQ.exe
  2⤵
  PID:11984
- C:\Windows\System\RamFNRS.exe
  C:\Windows\System\RamFNRS.exe
  2⤵
  PID:11812
- C:\Windows\System\wWHxKQK.exe
  C:\Windows\System\wWHxKQK.exe
  2⤵
  PID:12320
- C:\Windows\System\xIDaCse.exe
  C:\Windows\System\xIDaCse.exe
  2⤵
  PID:12348
- C:\Windows\System\VPvhBUS.exe
  C:\Windows\System\VPvhBUS.exe
  2⤵
  PID:12380
- C:\Windows\System\owebrFM.exe
  C:\Windows\System\owebrFM.exe
  2⤵
  PID:12408
- C:\Windows\System\NcsWIXQ.exe
  C:\Windows\System\NcsWIXQ.exe
  2⤵
  PID:12428
- C:\Windows\System\fNVMXUh.exe
  C:\Windows\System\fNVMXUh.exe
  2⤵
  PID:12468
- C:\Windows\System\zkIhFRV.exe
  C:\Windows\System\zkIhFRV.exe
  2⤵
  PID:12496
- C:\Windows\System\dFvfkHO.exe
  C:\Windows\System\dFvfkHO.exe
  2⤵
  PID:12516
- C:\Windows\System\AskhKuk.exe
  C:\Windows\System\AskhKuk.exe
  2⤵
  PID:12544
- C:\Windows\System\YlMviwM.exe
  C:\Windows\System\YlMviwM.exe
  2⤵
  PID:12572
- C:\Windows\System\ZQNVQug.exe
  C:\Windows\System\ZQNVQug.exe
  2⤵
  PID:12600
- C:\Windows\System\AbgZyYO.exe
  C:\Windows\System\AbgZyYO.exe
  2⤵
  PID:12628
- C:\Windows\System\JQWRkXM.exe
  C:\Windows\System\JQWRkXM.exe
  2⤵
  PID:12660
- C:\Windows\System\BEGeCRU.exe
  C:\Windows\System\BEGeCRU.exe
  2⤵
  PID:12684
- C:\Windows\System\bonVPwC.exe
  C:\Windows\System\bonVPwC.exe
  2⤵
  PID:12716
- C:\Windows\System\RfUDsKc.exe
  C:\Windows\System\RfUDsKc.exe
  2⤵
  PID:12740
- C:\Windows\System\SOVbawh.exe
  C:\Windows\System\SOVbawh.exe
  2⤵
  PID:12760
- C:\Windows\System\tLVOEne.exe
  C:\Windows\System\tLVOEne.exe
  2⤵
  PID:12796
- C:\Windows\System\BTmPGtu.exe
  C:\Windows\System\BTmPGtu.exe
  2⤵
  PID:12816
- C:\Windows\System\pDUcsnP.exe
  C:\Windows\System\pDUcsnP.exe
  2⤵
  PID:12852
- C:\Windows\System\FxFjtuK.exe
  C:\Windows\System\FxFjtuK.exe
  2⤵
  PID:12880
- C:\Windows\System\yuIYrPV.exe
  C:\Windows\System\yuIYrPV.exe
  2⤵
  PID:12916
- C:\Windows\System\sNIqPtf.exe
  C:\Windows\System\sNIqPtf.exe
  2⤵
  PID:12936
- C:\Windows\System\PcyPMnA.exe
  C:\Windows\System\PcyPMnA.exe
  2⤵
  PID:12964
- C:\Windows\System\HpIQHIF.exe
  C:\Windows\System\HpIQHIF.exe
  2⤵
  PID:12992
- C:\Windows\System\qNuDLmw.exe
  C:\Windows\System\qNuDLmw.exe
  2⤵
  PID:13032
- C:\Windows\System\DWAFfiC.exe
  C:\Windows\System\DWAFfiC.exe
  2⤵
  PID:13052
- C:\Windows\System\dDlpzUg.exe
  C:\Windows\System\dDlpzUg.exe
  2⤵
  PID:13084
- C:\Windows\System\PXFhfEN.exe
  C:\Windows\System\PXFhfEN.exe
  2⤵
  PID:13144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_4k3fdrlv.dg0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4k3fdrlv.dg0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AKaPvgo.exe

Path C:\Windows\System\AKaPvgo.exe
Size 2.8MB
SHA256 ccfc8d2377c22cf25c08deb575e05ef9ad64b4608902a4db1780e69bf572dca5
MD5 1492298b25a9cf33af07589f79d93f94
SHA1 aae78581f01c02776f84034501d84079cca83455
SHA512 b99a65359e5dc0dbbf1dbd5db6d95e942101cd6e118a126ce149e360ad01ae7ec291773fd7e8e068a0aa45e44272b7bbda155811e55ed394835076615f3d752e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rix:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARDrnSQ.exe

Path C:\Windows\System\ARDrnSQ.exe
Size 2.8MB
SHA256 1b1d2b0f449e30f50e15ca5be4be91e972db64dd67d8acf6db1704987c8b1813
MD5 c2629f0dc0fdef8dc83109fd6de1e3fc
SHA1 577b4710cd810bbfa5e6230d289d8effe2ec4e5f
SHA512 d60df70e3cb526a9420321bc8ad97ce90e496b59a2eac517a3aa2a5f63be8147fef2ef7c23746c46f232609b3ccdfb35ae9b0a5c0f63c4b04b649dc7ed56e2bf
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ric:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASPghJa.exe

Path C:\Windows\System\ASPghJa.exe
Size 2.8MB
SHA256 37daa520550baae790824e5b66ee36236191a7879cb804afc65f5a10008b7698
MD5 dd9325b55cbc4849cf42574121428326
SHA1 2a6b5d306be256e03237d03c4216d60e34c39346
SHA512 5a46a843a3eb8d74f2611a0263f7eade36078fa652c36774218803c9098825d705338302da7782766e266663760b29e532c7379589bc99aa2a5fefcba064a146
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiQ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

DyVHTZT.exe

Path C:\Windows\System\DyVHTZT.exe
Size 2.8MB
SHA256 beaecc1469496733ac765e8cc1461d246a755fcc703d3c44235c0e4f37e13b0f
MD5 4fe89c0884a035a1de4d67e612456450
SHA1 1b5a44583073564d77987ab6dab78aba20e9683f
SHA512 78dfbdd3ce120c456842b075bb82dc0d1b7afb5d02c97fc7de63a47d941d166d8d149a165b7d9fa9888d568fd5961f7a6ce993eb66163e6477db37704eb4289a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiC:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

EMDIVEL.exe

Path C:\Windows\System\EMDIVEL.exe
Size 2.8MB
SHA256 8ad877e548d0115b6bb023ea92ce965df0813d8ba8762bda091af1134e529305
MD5 b66bb7cbdf673d1e2c75b77cbf0f886c
SHA1 2c7b785143734da93c80f14d643ac7f4f92b179c
SHA512 024c93e5c955239474405359de04b0c730a263d21a1af02a629e63b4d51399e83c7b79eb7ceb4e3375cd39db7ed1c2963ae7a73064305aa621c2759be418d5f0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiS:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOOAkIM.exe

Path C:\Windows\System\FOOAkIM.exe
Size 2.8MB
SHA256 b0850588c4094c835688390c9a2cd4bd8e0bf1f4279f67b2a0ad4ea3e3b3a5f1
MD5 de2db89f52490f3b4734b4049e2a1ad8
SHA1 97757311258a5f18b9a2f71635c2b049fabdb743
SHA512 fdb92be3856ee62c39713e39f0461eeb5208fbfb302398ef183e0278fe6d555763f075997d6a846234d0fbd45f5eef4834f277fa527a8a66a614155567a69baf
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfoZzFc.exe

Path C:\Windows\System\FfoZzFc.exe
Size 2.8MB
SHA256 f1dcbe3df1a9c66f6c17748445f4cc09763fce583fd2e5bb64839039f3038823
MD5 4d613b5b704da2fb648941f783056da0
SHA1 3fb23f06abe1776acc9c2b2e64370e50ebbbe069
SHA512 e96c971d0899108600db9bffe617113422dadc2c78ad34e9523e659482effb873205599ad1beac6c2ea1a76a9f44864f528fa78c68e40160e14261ec09f09be4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTUXawG.exe

Path C:\Windows\System\GTUXawG.exe
Size 2.8MB
SHA256 f5da72eeb9be343f271593f5fddea499c9ae1ebff89ca8d8c0423c8b14135f2d
MD5 3266c79ac5e5df8c230eaaacefddcc43
SHA1 b6256c4486b6d7fdda3882d7599beb06d827f47e
SHA512 3356ae55aec7578d369bf8aaa82cfe4e40c7136c7c11260cb36f6e8971de960c3abf4a0f62bd1abf6196e7aceb30e1e9e2842a2317d201491e1979328eb37f11
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rit:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

GpuncHc.exe

Path C:\Windows\System\GpuncHc.exe
Size 2.8MB
SHA256 faade6a7e9e5ab778274e97865dd507e8eb91b1eb0e289d49a1172f82d942129
MD5 e79b93a6719032948676775346878544
SHA1 855c854582adb7785d845a84ed870b95f054e078
SHA512 3741e8747bb4cec0b21385cc487b2ae347aa6f03f07d2dc610df50bdfd303e50853be9a81f0233931e708c23cd0a107085b09cd6f7f445df6271763d9406887a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri2:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

HCJXSOp.exe

Path C:\Windows\System\HCJXSOp.exe
Size 2.8MB
SHA256 118b372050511e67e1d4bc5194194d07eeff357c2959d019689b0a07703b1e1c
MD5 5c10f3aaca2caa205ceb6f2ba5b77586
SHA1 230e3bafd18179ec52beaf993f97f755525641c1
SHA512 656ad1dc96478d2ea0cf31aceef236f7685a1800d7398b5e58958309682911e67ae2ade0b422d1aa09c6bf94bc8caf2af5d58506d09db4c5dc23b675e7a360c9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiI:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

HdnbKRA.exe

Path C:\Windows\System\HdnbKRA.exe
Size 2.8MB
SHA256 80416854e1d7cc131032382b4371a8846bec1d85c08e0b0dc2933cce41feda17
MD5 8981967ff840c556f1b70b0dda5e39b4
SHA1 75a59b46700bd8e163fae6938df23ddf51e61649
SHA512 6d6ef3d2eb97c5765af1c96a8045118e8e96611da915d41d20a892aebfe2539b8fff9ce9537081ee42ca0dcb8fa9aaa1f0c9b697b6401ab0307819d34eb13b35
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OYKoiPc.exe

Path C:\Windows\System\OYKoiPc.exe
Size 2.8MB
SHA256 ab9226a48c31ccac5d5d070e1e9ef918efd4a73b69c660359f6004ffdb44b0af
MD5 09e6d14c87e6292b518f4ab85b8a2933
SHA1 036c9a2d7925a7870ae427ab44f307daf679f292
SHA512 3d27f36329269875030f136dd106332d68e4ca97254e77aa53f2749cac04d0d7a01fafb946966a6890b143e728b4a7f8720f41a39a9fb7201799bca412acfadf
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

OafZKqe.exe

Path C:\Windows\System\OafZKqe.exe
Size 2.8MB
SHA256 1b696ee8ca5f6a89d517ec40ff5cc8b48638d9d7245d62391e00c5d4534ef52e
MD5 54deb2539ed36628cb4e62dfd203bb89
SHA1 417477bff54093dbea4d182f5b06a303f041332e
SHA512 41a0315d905475f111974b09d0cdb106b332531edb915b0e0c57097a2d0249ea55d056643412baff0d72dd111e23637291ac030b3a28f01c8bea28d1cdd4c654
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rii:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ObSOdDH.exe

Path C:\Windows\System\ObSOdDH.exe
Size 2.8MB
SHA256 d591ca4d056a1d38ae431df3bbec2f18419e178ac47fd1a86615f5820701bfe3
MD5 53e90c2a29a5628426425a43f8383941
SHA1 189a19f92b9c19791a31608099734588fc9bd047
SHA512 9132c3d0aa180cebe3669e3d4bd296163a1e95dff81f1bd91ade8cc56cb96e73b2e728315467295c11ccea8c185f7b04ac421a4df7894f3afb8328d15a59cf21
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SsQssop.exe

Path C:\Windows\System\SsQssop.exe
Size 2.8MB
SHA256 0d34d0eae4d2c76fb68f8e3e04c82446dc5f9b65e204228c67c9eb5f2b0d95e8
MD5 cbf01619f1094d1bc524e793957d1f6b
SHA1 f8377f282cbca5ec2e018bc9b79cd7a842892758
SHA512 59b61a6c8bb2a44d5074b8581bb415d80ad8dbee7b47db4a35b225515b8846b5345de90b66395cba8c7ca25efc0bc6538643127d599f30727456593e0e6d6bfe
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rit:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

WkKYgGa.exe

Path C:\Windows\System\WkKYgGa.exe
Size 2.8MB
SHA256 69c6db0a3f0d831bc1f9ec35a32f2a6a12e3bbc3cc11a91d951e723882bd5beb
MD5 47f0ac993213207c043c610b6b3d9d72
SHA1 821a47ebe048a8b7f30225218325330326d15801
SHA512 505054c0335bfb89b88c5e529a65b01e4b0df1f892cbe28070f62071804bda6d14fc88013b4387ca40ff616af3b80658b42c95d764e38bfe36bb67b0f334f1c4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rip:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XpmmCci.exe

Path C:\Windows\System\XpmmCci.exe
Size 8B
SHA256 c376b4c1019dfb02d31ea3137efb150405ef95ba0305dcf5e026248ffc8d7cc2
MD5 f249cce64f1edf5dc7bee5be6e2d5ad9
SHA1 0d569e38ec2ee4118bd367894784a63582261e47
SHA512 fdeb5b006eba899c911e624dadfb6c7b2eb030236757e187df8ba8d194a5a42df30b590d0fcf3f859b2532e60fc00c33154f75c1e6481913447ff2fa15b08be2
MD5 SHA1 SHA512

Submit Download

ZWOUxcB.exe

Path C:\Windows\System\ZWOUxcB.exe
Size 2.8MB
SHA256 7ba9ee4eaf31741c49999fc226e83ed5406ca2d0a736775120e26ee5c229ca90
MD5 5ec099804b6ea3fa54352319557b4365
SHA1 16848f866f9cbe55cea3c66a733665d7b4b1ae9e
SHA512 df85cf4ebe9df31051005493566d5c0b13a2e10824d3bf79a60d1df224292a9aa2dcea990e722a04e746b8f416eee218e6e35ff4da07d16a8fdefc718ac04930
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

cbDuzGE.exe

Path C:\Windows\System\cbDuzGE.exe
Size 2.8MB
SHA256 83090d78adeddcb02efa0df74547959532b057ad1ceeffdcdb4e0ab33b25b545
MD5 97402f80e1b163490b18c21e86e6a240
SHA1 2d4888310c016fb324eff99c34be85bb2a57d94a
SHA512 588d7ecd177708ef7f73228c63a8728f4bc73068df76065131b7ec7eb23e799ff60101f7e53b2dc20caf269210364a01a72b77853fafcf1df7c60ee3aa9a8fac
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

efxkzbz.exe

Path C:\Windows\System\efxkzbz.exe
Size 2.8MB
SHA256 0638eb5bc7853c57f8ead8007770f3e0ff0e66e3d34c20a6d4ad9698814c1e04
MD5 c3068b4ab43ba7e86f3d1a6f4bb13165
SHA1 378614a25a8a2fd49f42d8854ea45c2d99ebb65b
SHA512 6a33b0139a48dbf463da50e6e02708aadcaf49440dc1be537a43568c37ee89276fd1dabf9c1f493a1a006f14fc0f0ae53a8f1ebfd34ebbab7ab167b7e6b3035d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

fAehMYg.exe

Path C:\Windows\System\fAehMYg.exe
Size 2.8MB
SHA256 d069f5738ef41d3e4836fa29373facd1990ab7180fc1ee164aac2b65c381e1ba
MD5 259f7d5951b910030ad1778e25116d0d
SHA1 89ae47608a67e96d6b0f975afd7ed301797cc071
SHA512 5c65c3a74ca6bfce7d4d85cdeaab16d3a21403b38c4b4197e3537a153a7f6cbf85033348b374382220419d8079f746cdc3d4c3480fd573dbb492885e8d748fff
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

fcvvUhZ.exe

Path C:\Windows\System\fcvvUhZ.exe
Size 2.8MB
SHA256 abba7d6f5316a40b94cc21ceda50807d2328d71af781c14732bb78eecf8cedc8
MD5 43f331c3c9528c1771faa7cff9c08001
SHA1 a6028e52f378defe7457dc93436fbd7f0c0e604d
SHA512 ee5ae76ba33188ac235ff6f3d724f081ed1b52b5ba98db91dc74ddba78e72fbf4b7e7ec2b7541da3b570bc6b43f5ddb1bda9ca5a3246e380be4784fbecdf65df
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

iKdPbLV.exe

Path C:\Windows\System\iKdPbLV.exe
Size 2.8MB
SHA256 484f68deb7605ba571293e816f52703e950d9e29cedf699b3680e344cbe93abe
MD5 4db16b417791931c0242cbee51daa082
SHA1 31ebeab2acf1640e8e4df359a8f72fe89e31c469
SHA512 2bb6e2ca1a76accdc5c5807746ba513f42cc01dd7ce2c9bce6f2071562b393e3d258b772ce7a853c77682096e0df31b331e678ba41169a17edc5098ea0265f43
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiJ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

icEJzYl.exe

Path C:\Windows\System\icEJzYl.exe
Size 2.8MB
SHA256 f9dcb57b3e4a4966a6991504b069c141f7c7d409f39ab8f587289dc72f868304
MD5 bf48c603323e270bdeb1bd1ad4be3ab2
SHA1 23d9fe35398d7a466c81220b006d6131f4e8f9e4
SHA512 e8a638d0b25a38e2d33906940e5389a292552be53e83a7793351332fce692a55ef2604016a3ea0dc0f017e1ced0f6dec690125dd4ca1cde047c0e793af26d46a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Ri5:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ifIJeCf.exe

Path C:\Windows\System\ifIJeCf.exe
Size 2.8MB
SHA256 f34050b81d5a2b799e81ddc43e7db8e1f31d7f6b94d991ea215ba3a82f865c32
MD5 6e41ec7437f410a920db3373ae1739b2
SHA1 c306a5824b66b87ae9b4fbaefc4eca4cbeb24844
SHA512 ea8f4d6fa8643e2aa9e16c5fc2a138f73c2d5f37b8e023454bd4e87f2fe5a8edf9f55505e455b1838c8c84f66a0a0399ef2484ee420acc62619a91cba46cd4f0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiC:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mGJbAdZ.exe

Path C:\Windows\System\mGJbAdZ.exe
Size 2.8MB
SHA256 40972ac82df46262212368d54a7178662220e2fa0e39af5260fe532208b9606f
MD5 86d8a938d84746a89082fd277f28be4a
SHA1 de3c9c3c7a8358bf94ce961a79c6e8bc8ccce5f4
SHA512 c355e640427b88f4525e69321ea41b9fb14d26f4051bb0afcb88b09e59a3770883809898ce000c87d9a803f1c708469092540d31be2e41f22dfe630e2ead48e8
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rim:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

otITiNq.exe

Path C:\Windows\System\otITiNq.exe
Size 2.8MB
SHA256 fb37902af9b004a8f729ffa5185078c685f366886b89034e1ce85f7f16e48910
MD5 045da6ed7e987d1bdfa7300a17e20f31
SHA1 400d24247383e25fb752af1d8c39c46e479f6b4a
SHA512 eae2ede91eece45aecac52a696f5dd463135ab1a2eadc1a796b9dddc38c3095a501bc68a0284442ba1c607301f4c16d8f34b87f68725b1672525bb518e9d5e14
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Riu:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

qCzDaZH.exe

Path C:\Windows\System\qCzDaZH.exe
Size 2.8MB
SHA256 835a865ad7b41319bae56f535c87a20acfae1be9d794103071da8348b34a8b62
MD5 cc41e13dc51d5e1772f6926b9aad8c78
SHA1 bde3ba8fbfdfe8cf95a785843c23fd30e9e949da
SHA512 fe8f74ec4b1b7fd1eb8390c0fe3da2a3eb7c711c6ecbe86f0240951f8897da421c068927979ff2a810b6eb14f44b4d569edb21c33ff1d6473aa5cef76a68e8cb
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiM:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxwECvU.exe

Path C:\Windows\System\qxwECvU.exe
Size 2.8MB
SHA256 b6ee6436f41527b5f00aca374139e727ec2831c9d1508840a6d0191e06b76122
MD5 34d83d5354813a6aa74670735d34abb5
SHA1 20ad38011b323b0b35c8cf13d5d15cd91e75897d
SHA512 10c73125b41b631ace813cd03f7c24df6b526f6cf9eef2f76f5263b1a44ea7a5cb93302d0f8d6e19976d138178f1845c270488298971a39336ce0103b5d0ff99
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Riq:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqgOZhs.exe

Path C:\Windows\System\sqgOZhs.exe
Size 2.8MB
SHA256 917eaf0774ca974e58f9ef71ff97f52cef08eae5e9f1e23571e9d415b36dd96c
MD5 13be65e470b7dc1e7dd036d64599f39e
SHA1 3fa7adc2546b544fa9ff8d99fe52ae0d581a535e
SHA512 bb0d7664d39d5f3843e12382628fccad1829e12367b5fa02fdb03bee4d04c424d63f98ccde1434fdaac3d24982f322f2d02637e0a84a1c18d65ac5f662518bc1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rie:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

yXamArU.exe

Path C:\Windows\System\yXamArU.exe
Size 2.8MB
SHA256 7e6011f8f9faa57df5bd0f090790586c955746c8a28f3dba41ebb70c8168dddd
MD5 2b1b33e27468e4a78beeca92fb298878
SHA1 e1a37d78080ce97a490156cb6baba9d960b0139b
SHA512 6367cc6ccc6b34792a1fc1ad1831d0284a75ded0b5a9161343ebf85398afbb0e9c9987a21bf2824411ffe814092467db41563ea2ea261a6d519624c075a6a41f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rii:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

yiceHad.exe

Path C:\Windows\System\yiceHad.exe
Size 2.8MB
SHA256 36d4e200f3e51115df2afdf11397a3a71f54aefca140a95329c05d2043914521
MD5 9b48a487b9cb9d1ed90a570b3562a5dc
SHA1 85100b4601405fe99be7c2f055b99538b775f5c3
SHA512 0e1867ca29960fc3db7f2483391abffde8eaba9f4a3bdfa5c9bb7c66dae40236c85dca8798dd71a7d1cdac110b20dedf0164e873509cb235690dc510b7e02076
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiZ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

yyuUqRV.exe

Path C:\Windows\System\yyuUqRV.exe
Size 2.8MB
SHA256 a484951871ed688b01206ebad29e361a9b279f9c7c389f2f8bd1924ec288d5d6
MD5 bc44d1d6e15473916b1a6135c81daa5a
SHA1 ef0772cdce752846f9c63804a4f14d9635fe63c4
SHA512 24a1b05b2b87c5290bf8fa0fa7c40432e99abaaab8ef868f4f01ee7cd3ff92be83cc01360ede667fe73588c9ade68cfc0dfa73423da5b512ea981822ce686304
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rid:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

zuZrsHZ.exe

Path C:\Windows\System\zuZrsHZ.exe
Size 2.8MB
SHA256 d081fb2f3831097370e83e8609a7e5768746fcc090d849f161f454a5b886f925
MD5 dbe5ff6b52288d0dbe239904403596ca
SHA1 d451e74d10cc59ddf7e6b9ba2005caf0275a7019
SHA512 bae2c2b6d750c05d461d8d789394ca35a601225463c1ef38fe08dc295bc0c0dc2f9daff2bbda7148c313831afb7169e4aac386cd7ec42cbcfd14121e4e1a4784
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RiE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/372-2013-0x00007FF7153F0000-0x00007FF7157E6000-memory.dmp

Download

memory/372-126-0x00007FF7153F0000-0x00007FF7157E6000-memory.dmp

Download

memory/468-201-0x00007FF7D9810000-0x00007FF7D9C06000-memory.dmp

Download

memory/468-2032-0x00007FF7D9810000-0x00007FF7D9C06000-memory.dmp

Download

memory/672-1-0x0000016E679B0000-0x0000016E679C0000-memory.dmp

Download

memory/672-0-0x00007FF60F820000-0x00007FF60FC16000-memory.dmp

Download

memory/1240-199-0x00007FF789730000-0x00007FF789B26000-memory.dmp

Download

memory/1240-2027-0x00007FF789730000-0x00007FF789B26000-memory.dmp

Download

memory/1512-2030-0x00007FF618390000-0x00007FF618786000-memory.dmp

Download

memory/1512-200-0x00007FF618390000-0x00007FF618786000-memory.dmp

Download

memory/1784-2023-0x00007FF7C37E0000-0x00007FF7C3BD6000-memory.dmp

Download

memory/1784-198-0x00007FF7C37E0000-0x00007FF7C3BD6000-memory.dmp

Download

memory/1828-2028-0x00007FF706230000-0x00007FF706626000-memory.dmp

Download

memory/1828-191-0x00007FF706230000-0x00007FF706626000-memory.dmp

Download

memory/1996-194-0x00007FF6B0120000-0x00007FF6B0516000-memory.dmp

Download

memory/1996-2031-0x00007FF6B0120000-0x00007FF6B0516000-memory.dmp

Download

memory/2304-190-0x00007FF6D87E0000-0x00007FF6D8BD6000-memory.dmp

Download

memory/2304-2026-0x00007FF6D87E0000-0x00007FF6D8BD6000-memory.dmp

Download

memory/2680-186-0x00007FF610720000-0x00007FF610B16000-memory.dmp

Download

memory/2680-2016-0x00007FF610720000-0x00007FF610B16000-memory.dmp

Download

memory/2856-195-0x00007FF7B92E0000-0x00007FF7B96D6000-memory.dmp

Download

memory/2856-2029-0x00007FF7B92E0000-0x00007FF7B96D6000-memory.dmp

Download

memory/2980-2015-0x00007FF7661D0000-0x00007FF7665C6000-memory.dmp

Download

memory/2980-145-0x00007FF7661D0000-0x00007FF7665C6000-memory.dmp

Download

memory/3332-2012-0x00007FF6F8D10000-0x00007FF6F9106000-memory.dmp

Download

memory/3332-197-0x00007FF6F8D10000-0x00007FF6F9106000-memory.dmp

Download

memory/3356-187-0x00007FF6DA3F0000-0x00007FF6DA7E6000-memory.dmp

Download

memory/3356-2019-0x00007FF6DA3F0000-0x00007FF6DA7E6000-memory.dmp

Download

memory/3440-189-0x00007FF626BC0000-0x00007FF626FB6000-memory.dmp

Download

memory/3440-2020-0x00007FF626BC0000-0x00007FF626FB6000-memory.dmp

Download

memory/3792-188-0x00007FF7CC130000-0x00007FF7CC526000-memory.dmp

Download

memory/3792-2024-0x00007FF7CC130000-0x00007FF7CC526000-memory.dmp

Download

memory/3992-2021-0x00007FF72B370000-0x00007FF72B766000-memory.dmp

Download

memory/3992-185-0x00007FF72B370000-0x00007FF72B766000-memory.dmp

Download

memory/4072-2008-0x00007FFE9C4D0000-0x00007FFE9CF91000-memory.dmp

Download

memory/4072-2009-0x00007FFE9C4D3000-0x00007FFE9C4D5000-memory.dmp

Download

memory/4072-202-0x000001FBEA720000-0x000001FBEAEC6000-memory.dmp

Download

memory/4072-116-0x000001FBE9BE0000-0x000001FBE9C02000-memory.dmp

Download

memory/4072-74-0x00007FFE9C4D0000-0x00007FFE9CF91000-memory.dmp

Download

memory/4072-33-0x00007FFE9C4D3000-0x00007FFE9C4D5000-memory.dmp

Download

memory/4072-102-0x00007FFE9C4D0000-0x00007FFE9CF91000-memory.dmp

Download

memory/4256-2010-0x00007FF6F1130000-0x00007FF6F1526000-memory.dmp

Download

memory/4256-20-0x00007FF6F1130000-0x00007FF6F1526000-memory.dmp

Download

memory/4588-2022-0x00007FF6BC5F0000-0x00007FF6BC9E6000-memory.dmp

Download

memory/4588-148-0x00007FF6BC5F0000-0x00007FF6BC9E6000-memory.dmp

Download

memory/4596-193-0x00007FF70DD50000-0x00007FF70E146000-memory.dmp

Download

memory/4596-2033-0x00007FF70DD50000-0x00007FF70E146000-memory.dmp

Download

memory/4744-163-0x00007FF60BD60000-0x00007FF60C156000-memory.dmp

Download

memory/4744-2018-0x00007FF60BD60000-0x00007FF60C156000-memory.dmp

Download

memory/4816-2017-0x00007FF6540B0000-0x00007FF6544A6000-memory.dmp

Download

memory/4816-176-0x00007FF6540B0000-0x00007FF6544A6000-memory.dmp

Download

memory/4820-2014-0x00007FF6D5EE0000-0x00007FF6D62D6000-memory.dmp

Download

memory/4820-196-0x00007FF6D5EE0000-0x00007FF6D62D6000-memory.dmp

Download

memory/4828-32-0x00007FF74F8E0000-0x00007FF74FCD6000-memory.dmp

Download

memory/4828-2011-0x00007FF74F8E0000-0x00007FF74FCD6000-memory.dmp

Download

memory/4992-2025-0x00007FF7E1BE0000-0x00007FF7E1FD6000-memory.dmp

Download

memory/4992-192-0x00007FF7E1BE0000-0x00007FF7E1FD6000-memory.dmp

Download