xmrig | ded2b5766bfe9b314b6c1da2d8a75b0a13a0ee279973da270429fb61f4170b37

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
Size 2.8MB
Sample240524-hmqf2agh85
SHA256 ded2b5766bfe9b314b6c1da2d8a75b0a13a0ee279973da270429fb61f4170b37
MD5 fae043dcd7e98784332b393160214260
SHA1 b5a26552cad5d5693eff7892ae9772e0a54d5a99
SHA512 a1ae5f06461802b50e1bf94d51bddd67ceb3f19e635abbaa5221b0d2282966c08b8c6558c56d326d5ae4dc3b2348cd740f7bd333f4ed5c1a7a24ee62d3c6c793
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5004-0-0x00007FF7A5720000-0x00007FF7A5B16000-memory.dmp	xmrig
behavioral2/files/0x000800000002340d-6.dat	xmrig
behavioral2/files/0x0007000000023414-9.dat	xmrig
behavioral2/files/0x0007000000023415-21.dat	xmrig
behavioral2/files/0x0007000000023418-38.dat	xmrig
behavioral2/files/0x0007000000023422-74.dat	xmrig
behavioral2/files/0x000700000002341d-88.dat	xmrig
behavioral2/memory/4924-92-0x00007FF62E660000-0x00007FF62EA56000-memory.dmp	xmrig
behavioral2/memory/4524-97-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-105.dat	xmrig
behavioral2/files/0x0007000000023425-124.dat	xmrig
behavioral2/memory/1624-135-0x00007FF6B36D0000-0x00007FF6B3AC6000-memory.dmp	xmrig
behavioral2/memory/3720-138-0x00007FF75C030000-0x00007FF75C426000-memory.dmp	xmrig
behavioral2/memory/3724-141-0x00007FF73D620000-0x00007FF73DA16000-memory.dmp	xmrig
behavioral2/memory/4132-144-0x00007FF7EB1A0000-0x00007FF7EB596000-memory.dmp	xmrig
behavioral2/memory/4396-146-0x00007FF66C340000-0x00007FF66C736000-memory.dmp	xmrig
behavioral2/memory/3280-145-0x00007FF7ECBE0000-0x00007FF7ECFD6000-memory.dmp	xmrig
behavioral2/memory/4236-143-0x00007FF60EA80000-0x00007FF60EE76000-memory.dmp	xmrig
behavioral2/memory/1280-142-0x00007FF614290000-0x00007FF614686000-memory.dmp	xmrig
behavioral2/memory/720-140-0x00007FF75D320000-0x00007FF75D716000-memory.dmp	xmrig
behavioral2/memory/1336-137-0x00007FF6A01E0000-0x00007FF6A05D6000-memory.dmp	xmrig
behavioral2/memory/2228-136-0x00007FF687F00000-0x00007FF6882F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-133.dat	xmrig
behavioral2/files/0x0007000000023426-131.dat	xmrig
behavioral2/files/0x0008000000023420-129.dat	xmrig
behavioral2/files/0x000800000002341f-127.dat	xmrig
behavioral2/memory/1440-126-0x00007FF728190000-0x00007FF728586000-memory.dmp	xmrig
behavioral2/memory/3516-123-0x00007FF6CC360000-0x00007FF6CC756000-memory.dmp	xmrig
behavioral2/memory/2008-122-0x00007FF6E23D0000-0x00007FF6E27C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-116.dat	xmrig
behavioral2/memory/4356-114-0x00007FF674A10000-0x00007FF674E06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-95.dat	xmrig
behavioral2/memory/4324-93-0x00007FF62DD00000-0x00007FF62E0F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-94.dat	xmrig
behavioral2/memory/620-90-0x00007FF776040000-0x00007FF776436000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-82.dat	xmrig
behavioral2/files/0x000700000002341a-81.dat	xmrig
behavioral2/files/0x000700000002341b-80.dat	xmrig
behavioral2/memory/5000-77-0x00007FF607650000-0x00007FF607A46000-memory.dmp	xmrig
behavioral2/memory/4852-65-0x00007FF7C4A50000-0x00007FF7C4E46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-55.dat	xmrig
behavioral2/files/0x0007000000023416-39.dat	xmrig
behavioral2/files/0x0007000000023417-54.dat	xmrig
behavioral2/files/0x0008000000023410-22.dat	xmrig
behavioral2/memory/4372-178-0x00007FF7147F0000-0x00007FF714BE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-192.dat	xmrig
behavioral2/files/0x0007000000023431-213.dat	xmrig
behavioral2/files/0x0007000000023437-231.dat	xmrig
behavioral2/files/0x0007000000023434-227.dat	xmrig
behavioral2/files/0x0007000000023433-221.dat	xmrig
behavioral2/files/0x0007000000023438-219.dat	xmrig
behavioral2/files/0x000700000002343c-230.dat	xmrig
behavioral2/files/0x000700000002343b-228.dat	xmrig
behavioral2/files/0x0007000000023432-215.dat	xmrig
behavioral2/memory/2144-211-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-208.dat	xmrig
behavioral2/files/0x0007000000023428-171.dat	xmrig
behavioral2/memory/3244-18-0x00007FF6E6330000-0x00007FF6E6726000-memory.dmp	xmrig
behavioral2/memory/4524-2045-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp	xmrig
behavioral2/memory/2144-2046-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp	xmrig
behavioral2/memory/3244-2047-0x00007FF6E6330000-0x00007FF6E6726000-memory.dmp	xmrig
behavioral2/memory/4852-2048-0x00007FF7C4A50000-0x00007FF7C4E46000-memory.dmp	xmrig
behavioral2/memory/720-2049-0x00007FF75D320000-0x00007FF75D716000-memory.dmp	xmrig
behavioral2/memory/3724-2050-0x00007FF73D620000-0x00007FF73DA16000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	4552	powershell.exe
11	4552	powershell.exe
13	4552	powershell.exe
14	4552	powershell.exe
16	4552	powershell.exe
28	4552	powershell.exe
29	4552	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3244	bNfLlEA.exe
720	mpEqTXC.exe
4852	zuQxipk.exe
3724	wuDgBbU.exe
5000	hHTBBIb.exe
620	gVTzFws.exe
4924	IKsJmII.exe
4324	mHTIOoR.exe
4524	ymXoDpi.exe
1280	vmNqjiE.exe
4356	GaNUgJc.exe
2008	PHAfMgE.exe
4236	VKbWIcY.exe
3516	TKdjJDs.exe
1440	LyvhuuU.exe
1624	WNiYMOq.exe
4132	fiAbmRu.exe
3280	kLjowie.exe
4396	tjjcRZb.exe
2228	eECaRgY.exe
1336	ADzmTwD.exe
3720	SfwTXqE.exe
4372	SjvSeJQ.exe
2144	ZgYaHdM.exe
332	AlRmwrG.exe
1752	JmEjDLk.exe
4092	hPmfgXa.exe
4912	TvEdUwk.exe
5060	JyvvTek.exe
4540	AeqQElu.exe
3448	kzKhnZp.exe
1380	xMDsDrE.exe
3100	wrWOdKA.exe
4820	FTPGcdl.exe
2644	djdFMrD.exe
4804	hGlpzIQ.exe
2212	CPOiIyb.exe
1824	MlRluyA.exe
8	BhCRZrn.exe
3656	sDjsNWN.exe
2780	qOPkKff.exe
3672	MShjaEu.exe
2560	dBLGzls.exe
2364	RrOWVuM.exe
4916	tcUcWrW.exe
1340	CtDwUBB.exe
4440	CqLIeKe.exe
4696	cjAVtOV.exe
4568	DkvOQCL.exe
4684	AxzyDbh.exe
4556	LMGJtyT.exe
4088	kxFkaIG.exe
4256	nOOWzgS.exe
2376	sOiVtpJ.exe
4940	rhRRkZp.exe
964	QSKfwfe.exe
1504	GeMwfHS.exe
3440	iKhmqyw.exe
2692	Fplreop.exe
3496	lockZwY.exe
3444	qCJOjmp.exe
4472	WYpERos.exe
2556	VTShJkF.exe
3528	NKKjVBl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5004-0-0x00007FF7A5720000-0x00007FF7A5B16000-memory.dmp	upx
behavioral2/files/0x000800000002340d-6.dat	upx
behavioral2/files/0x0007000000023414-9.dat	upx
behavioral2/files/0x0007000000023415-21.dat	upx
behavioral2/files/0x0007000000023418-38.dat	upx
behavioral2/files/0x0007000000023422-74.dat	upx
behavioral2/files/0x000700000002341d-88.dat	upx
behavioral2/memory/4924-92-0x00007FF62E660000-0x00007FF62EA56000-memory.dmp	upx
behavioral2/memory/4524-97-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp	upx
behavioral2/files/0x0007000000023423-105.dat	upx
behavioral2/files/0x0007000000023425-124.dat	upx
behavioral2/memory/1624-135-0x00007FF6B36D0000-0x00007FF6B3AC6000-memory.dmp	upx
behavioral2/memory/3720-138-0x00007FF75C030000-0x00007FF75C426000-memory.dmp	upx
behavioral2/memory/3724-141-0x00007FF73D620000-0x00007FF73DA16000-memory.dmp	upx
behavioral2/memory/4132-144-0x00007FF7EB1A0000-0x00007FF7EB596000-memory.dmp	upx
behavioral2/memory/4396-146-0x00007FF66C340000-0x00007FF66C736000-memory.dmp	upx
behavioral2/memory/3280-145-0x00007FF7ECBE0000-0x00007FF7ECFD6000-memory.dmp	upx
behavioral2/memory/4236-143-0x00007FF60EA80000-0x00007FF60EE76000-memory.dmp	upx
behavioral2/memory/1280-142-0x00007FF614290000-0x00007FF614686000-memory.dmp	upx
behavioral2/memory/720-140-0x00007FF75D320000-0x00007FF75D716000-memory.dmp	upx
behavioral2/memory/1336-137-0x00007FF6A01E0000-0x00007FF6A05D6000-memory.dmp	upx
behavioral2/memory/2228-136-0x00007FF687F00000-0x00007FF6882F6000-memory.dmp	upx
behavioral2/files/0x0007000000023427-133.dat	upx
behavioral2/files/0x0007000000023426-131.dat	upx
behavioral2/files/0x0008000000023420-129.dat	upx
behavioral2/files/0x000800000002341f-127.dat	upx
behavioral2/memory/1440-126-0x00007FF728190000-0x00007FF728586000-memory.dmp	upx
behavioral2/memory/3516-123-0x00007FF6CC360000-0x00007FF6CC756000-memory.dmp	upx
behavioral2/memory/2008-122-0x00007FF6E23D0000-0x00007FF6E27C6000-memory.dmp	upx
behavioral2/files/0x0007000000023424-116.dat	upx
behavioral2/memory/4356-114-0x00007FF674A10000-0x00007FF674E06000-memory.dmp	upx
behavioral2/files/0x0007000000023421-95.dat	upx
behavioral2/memory/4324-93-0x00007FF62DD00000-0x00007FF62E0F6000-memory.dmp	upx
behavioral2/files/0x000700000002341e-94.dat	upx
behavioral2/memory/620-90-0x00007FF776040000-0x00007FF776436000-memory.dmp	upx
behavioral2/files/0x000700000002341c-82.dat	upx
behavioral2/files/0x000700000002341a-81.dat	upx
behavioral2/files/0x000700000002341b-80.dat	upx
behavioral2/memory/5000-77-0x00007FF607650000-0x00007FF607A46000-memory.dmp	upx
behavioral2/memory/4852-65-0x00007FF7C4A50000-0x00007FF7C4E46000-memory.dmp	upx
behavioral2/files/0x0007000000023419-55.dat	upx
behavioral2/files/0x0007000000023416-39.dat	upx
behavioral2/files/0x0007000000023417-54.dat	upx
behavioral2/files/0x0008000000023410-22.dat	upx
behavioral2/memory/4372-178-0x00007FF7147F0000-0x00007FF714BE6000-memory.dmp	upx
behavioral2/files/0x0007000000023430-192.dat	upx
behavioral2/files/0x0007000000023431-213.dat	upx
behavioral2/files/0x0007000000023437-231.dat	upx
behavioral2/files/0x0007000000023434-227.dat	upx
behavioral2/files/0x0007000000023433-221.dat	upx
behavioral2/files/0x0007000000023438-219.dat	upx
behavioral2/files/0x000700000002343c-230.dat	upx
behavioral2/files/0x000700000002343b-228.dat	upx
behavioral2/files/0x0007000000023432-215.dat	upx
behavioral2/memory/2144-211-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp	upx
behavioral2/files/0x0007000000023436-208.dat	upx
behavioral2/files/0x0007000000023428-171.dat	upx
behavioral2/memory/3244-18-0x00007FF6E6330000-0x00007FF6E6726000-memory.dmp	upx
behavioral2/memory/4524-2045-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp	upx
behavioral2/memory/2144-2046-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp	upx
behavioral2/memory/3244-2047-0x00007FF6E6330000-0x00007FF6E6726000-memory.dmp	upx
behavioral2/memory/4852-2048-0x00007FF7C4A50000-0x00007FF7C4E46000-memory.dmp	upx
behavioral2/memory/720-2049-0x00007FF75D320000-0x00007FF75D716000-memory.dmp	upx
behavioral2/memory/3724-2050-0x00007FF73D620000-0x00007FF73DA16000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AMvllZg.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\yHCOhRo.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\CbkuDip.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\JPEEuBf.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\aoPNmRr.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\HbKtzyv.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\JyvvTek.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\xcQdGbJ.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\rzyLujw.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\GNhxvUk.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\ZyZJHFe.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\IhDfuxR.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\vJUBzRA.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\UcTYyWA.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\GBnbHFm.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\XkBrcFh.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\NczPqZz.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\MlDrDZp.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\lynxYwZ.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\xMDsDrE.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\BhCRZrn.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\GeMwfHS.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\MTqYHnA.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\UdtyNuN.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\BGBLtYi.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\HDMeJKb.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\tjbODjQ.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\HiBPNfx.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\IVYbSph.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\nOOWzgS.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\lVEwsMV.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\ItPTztb.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\NZvkTHr.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\BAQliIo.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\eRnWwor.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\eVMZnZe.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\HTekdIF.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\bBgUvTR.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\fmfVnCm.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\EltjhOx.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\ZIXYZkR.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\RrOWVuM.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\sOiVtpJ.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\yGazZUR.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\tCRYbOi.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\EmXMYqd.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\WYpERos.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\kLRwOML.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\LMNkWYP.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\YriOKEG.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\QdLriPo.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\vdzOffe.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\qBvkbMY.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\HNVoJMQ.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\IkpDpRG.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\hPmfgXa.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\stdwlBW.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\FlYKUIb.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\kzIeqVA.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\kPdGKPT.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\mktgmQt.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\TTJwWqN.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\teDjSfE.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
File created	C:\Windows\System\BPFdpnK.exe	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
Token: SeDebugPrivilege	4552	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4552	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	83
PID 5004 wrote to memory of 4552	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	83
PID 5004 wrote to memory of 3244	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	84
PID 5004 wrote to memory of 3244	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	84
PID 5004 wrote to memory of 4852	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	85
PID 5004 wrote to memory of 4852	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	85
PID 5004 wrote to memory of 720	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	86
PID 5004 wrote to memory of 720	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	86
PID 5004 wrote to memory of 3724	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	87
PID 5004 wrote to memory of 3724	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	87
PID 5004 wrote to memory of 5000	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	88
PID 5004 wrote to memory of 5000	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	88
PID 5004 wrote to memory of 620	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	89
PID 5004 wrote to memory of 620	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	89
PID 5004 wrote to memory of 4924	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	90
PID 5004 wrote to memory of 4924	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	90
PID 5004 wrote to memory of 4324	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	91
PID 5004 wrote to memory of 4324	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	91
PID 5004 wrote to memory of 4524	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	92
PID 5004 wrote to memory of 4524	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	92
PID 5004 wrote to memory of 1280	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	93
PID 5004 wrote to memory of 1280	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	93
PID 5004 wrote to memory of 4356	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	94
PID 5004 wrote to memory of 4356	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	94
PID 5004 wrote to memory of 2008	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	95
PID 5004 wrote to memory of 2008	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	95
PID 5004 wrote to memory of 4236	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	96
PID 5004 wrote to memory of 4236	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	96
PID 5004 wrote to memory of 3516	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	97
PID 5004 wrote to memory of 3516	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	97
PID 5004 wrote to memory of 1440	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	98
PID 5004 wrote to memory of 1440	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	98
PID 5004 wrote to memory of 1624	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	99
PID 5004 wrote to memory of 1624	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	99
PID 5004 wrote to memory of 4132	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	100
PID 5004 wrote to memory of 4132	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	100
PID 5004 wrote to memory of 3280	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	101
PID 5004 wrote to memory of 3280	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	101
PID 5004 wrote to memory of 4396	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	102
PID 5004 wrote to memory of 4396	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	102
PID 5004 wrote to memory of 2228	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	103
PID 5004 wrote to memory of 2228	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	103
PID 5004 wrote to memory of 1336	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	104
PID 5004 wrote to memory of 1336	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	104
PID 5004 wrote to memory of 3720	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	105
PID 5004 wrote to memory of 3720	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	105
PID 5004 wrote to memory of 4372	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	106
PID 5004 wrote to memory of 4372	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	106
PID 5004 wrote to memory of 2144	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	107
PID 5004 wrote to memory of 2144	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	107
PID 5004 wrote to memory of 332	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	108
PID 5004 wrote to memory of 332	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	108
PID 5004 wrote to memory of 4092	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	109
PID 5004 wrote to memory of 4092	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	109
PID 5004 wrote to memory of 1752	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	110
PID 5004 wrote to memory of 1752	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	110
PID 5004 wrote to memory of 4912	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	111
PID 5004 wrote to memory of 4912	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	111
PID 5004 wrote to memory of 5060	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	112
PID 5004 wrote to memory of 5060	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	112
PID 5004 wrote to memory of 4540	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	113
PID 5004 wrote to memory of 4540	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	113
PID 5004 wrote to memory of 3448	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	114
PID 5004 wrote to memory of 3448	5004	fae043dcd7e98784332b393160214260_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\fae043dcd7e98784332b393160214260_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\fae043dcd7e98784332b393160214260_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\System\bNfLlEA.exe
  C:\Windows\System\bNfLlEA.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\zuQxipk.exe
  C:\Windows\System\zuQxipk.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\mpEqTXC.exe
  C:\Windows\System\mpEqTXC.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\wuDgBbU.exe
  C:\Windows\System\wuDgBbU.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\hHTBBIb.exe
  C:\Windows\System\hHTBBIb.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\gVTzFws.exe
  C:\Windows\System\gVTzFws.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\IKsJmII.exe
  C:\Windows\System\IKsJmII.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\mHTIOoR.exe
  C:\Windows\System\mHTIOoR.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\ymXoDpi.exe
  C:\Windows\System\ymXoDpi.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\vmNqjiE.exe
  C:\Windows\System\vmNqjiE.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\GaNUgJc.exe
  C:\Windows\System\GaNUgJc.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\PHAfMgE.exe
  C:\Windows\System\PHAfMgE.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\VKbWIcY.exe
  C:\Windows\System\VKbWIcY.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\TKdjJDs.exe
  C:\Windows\System\TKdjJDs.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\LyvhuuU.exe
  C:\Windows\System\LyvhuuU.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\WNiYMOq.exe
  C:\Windows\System\WNiYMOq.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\fiAbmRu.exe
  C:\Windows\System\fiAbmRu.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\kLjowie.exe
  C:\Windows\System\kLjowie.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\tjjcRZb.exe
  C:\Windows\System\tjjcRZb.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\eECaRgY.exe
  C:\Windows\System\eECaRgY.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\ADzmTwD.exe
  C:\Windows\System\ADzmTwD.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\SfwTXqE.exe
  C:\Windows\System\SfwTXqE.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\SjvSeJQ.exe
  C:\Windows\System\SjvSeJQ.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ZgYaHdM.exe
  C:\Windows\System\ZgYaHdM.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\AlRmwrG.exe
  C:\Windows\System\AlRmwrG.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\hPmfgXa.exe
  C:\Windows\System\hPmfgXa.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\JmEjDLk.exe
  C:\Windows\System\JmEjDLk.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\TvEdUwk.exe
  C:\Windows\System\TvEdUwk.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\JyvvTek.exe
  C:\Windows\System\JyvvTek.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\AeqQElu.exe
  C:\Windows\System\AeqQElu.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\kzKhnZp.exe
  C:\Windows\System\kzKhnZp.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\xMDsDrE.exe
  C:\Windows\System\xMDsDrE.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\wrWOdKA.exe
  C:\Windows\System\wrWOdKA.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\FTPGcdl.exe
  C:\Windows\System\FTPGcdl.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\djdFMrD.exe
  C:\Windows\System\djdFMrD.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\hGlpzIQ.exe
  C:\Windows\System\hGlpzIQ.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\CPOiIyb.exe
  C:\Windows\System\CPOiIyb.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\MlRluyA.exe
  C:\Windows\System\MlRluyA.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\BhCRZrn.exe
  C:\Windows\System\BhCRZrn.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\sDjsNWN.exe
  C:\Windows\System\sDjsNWN.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\qOPkKff.exe
  C:\Windows\System\qOPkKff.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\MShjaEu.exe
  C:\Windows\System\MShjaEu.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\dBLGzls.exe
  C:\Windows\System\dBLGzls.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\RrOWVuM.exe
  C:\Windows\System\RrOWVuM.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\tcUcWrW.exe
  C:\Windows\System\tcUcWrW.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\CtDwUBB.exe
  C:\Windows\System\CtDwUBB.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\CqLIeKe.exe
  C:\Windows\System\CqLIeKe.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\cjAVtOV.exe
  C:\Windows\System\cjAVtOV.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\DkvOQCL.exe
  C:\Windows\System\DkvOQCL.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\AxzyDbh.exe
  C:\Windows\System\AxzyDbh.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\LMGJtyT.exe
  C:\Windows\System\LMGJtyT.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\kxFkaIG.exe
  C:\Windows\System\kxFkaIG.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\nOOWzgS.exe
  C:\Windows\System\nOOWzgS.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\sOiVtpJ.exe
  C:\Windows\System\sOiVtpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\rhRRkZp.exe
  C:\Windows\System\rhRRkZp.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\QSKfwfe.exe
  C:\Windows\System\QSKfwfe.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\GeMwfHS.exe
  C:\Windows\System\GeMwfHS.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\iKhmqyw.exe
  C:\Windows\System\iKhmqyw.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\Fplreop.exe
  C:\Windows\System\Fplreop.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\lockZwY.exe
  C:\Windows\System\lockZwY.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\qCJOjmp.exe
  C:\Windows\System\qCJOjmp.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\WYpERos.exe
  C:\Windows\System\WYpERos.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\VTShJkF.exe
  C:\Windows\System\VTShJkF.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\NKKjVBl.exe
  C:\Windows\System\NKKjVBl.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\wbePTOT.exe
  C:\Windows\System\wbePTOT.exe
  2⤵
  PID:2404
- C:\Windows\System\otIeyHz.exe
  C:\Windows\System\otIeyHz.exe
  2⤵
  PID:1784
- C:\Windows\System\eLeeOMK.exe
  C:\Windows\System\eLeeOMK.exe
  2⤵
  PID:220
- C:\Windows\System\xfEUpGD.exe
  C:\Windows\System\xfEUpGD.exe
  2⤵
  PID:940
- C:\Windows\System\nECaJtw.exe
  C:\Windows\System\nECaJtw.exe
  2⤵
  PID:2824
- C:\Windows\System\eVMZnZe.exe
  C:\Windows\System\eVMZnZe.exe
  2⤵
  PID:844
- C:\Windows\System\hpeKMTg.exe
  C:\Windows\System\hpeKMTg.exe
  2⤵
  PID:3248
- C:\Windows\System\AzFNeEk.exe
  C:\Windows\System\AzFNeEk.exe
  2⤵
  PID:2064
- C:\Windows\System\DZtcffs.exe
  C:\Windows\System\DZtcffs.exe
  2⤵
  PID:1344
- C:\Windows\System\zcYoxRZ.exe
  C:\Windows\System\zcYoxRZ.exe
  2⤵
  PID:4996
- C:\Windows\System\IJvvcKR.exe
  C:\Windows\System\IJvvcKR.exe
  2⤵
  PID:5088
- C:\Windows\System\EfTRtwK.exe
  C:\Windows\System\EfTRtwK.exe
  2⤵
  PID:4100
- C:\Windows\System\tPZBMcq.exe
  C:\Windows\System\tPZBMcq.exe
  2⤵
  PID:2392
- C:\Windows\System\ovrERep.exe
  C:\Windows\System\ovrERep.exe
  2⤵
  PID:5124
- C:\Windows\System\NyBYZTi.exe
  C:\Windows\System\NyBYZTi.exe
  2⤵
  PID:5172
- C:\Windows\System\sVmmrEQ.exe
  C:\Windows\System\sVmmrEQ.exe
  2⤵
  PID:5220
- C:\Windows\System\UdtyNuN.exe
  C:\Windows\System\UdtyNuN.exe
  2⤵
  PID:5252
- C:\Windows\System\roLxAfI.exe
  C:\Windows\System\roLxAfI.exe
  2⤵
  PID:5288
- C:\Windows\System\teDjSfE.exe
  C:\Windows\System\teDjSfE.exe
  2⤵
  PID:5320
- C:\Windows\System\NBejFnW.exe
  C:\Windows\System\NBejFnW.exe
  2⤵
  PID:5352
- C:\Windows\System\PdhqrrG.exe
  C:\Windows\System\PdhqrrG.exe
  2⤵
  PID:5384
- C:\Windows\System\nZbQGZT.exe
  C:\Windows\System\nZbQGZT.exe
  2⤵
  PID:5416
- C:\Windows\System\PaoHfgB.exe
  C:\Windows\System\PaoHfgB.exe
  2⤵
  PID:5448
- C:\Windows\System\pqTLEkm.exe
  C:\Windows\System\pqTLEkm.exe
  2⤵
  PID:5484
- C:\Windows\System\VHCzzYJ.exe
  C:\Windows\System\VHCzzYJ.exe
  2⤵
  PID:5516
- C:\Windows\System\vdzOffe.exe
  C:\Windows\System\vdzOffe.exe
  2⤵
  PID:5540
- C:\Windows\System\yGazZUR.exe
  C:\Windows\System\yGazZUR.exe
  2⤵
  PID:5568
- C:\Windows\System\zjiHkHY.exe
  C:\Windows\System\zjiHkHY.exe
  2⤵
  PID:5628
- C:\Windows\System\yKROcls.exe
  C:\Windows\System\yKROcls.exe
  2⤵
  PID:5660
- C:\Windows\System\VOwhCwc.exe
  C:\Windows\System\VOwhCwc.exe
  2⤵
  PID:5708
- C:\Windows\System\JhmjMtj.exe
  C:\Windows\System\JhmjMtj.exe
  2⤵
  PID:5732
- C:\Windows\System\UtmYCnf.exe
  C:\Windows\System\UtmYCnf.exe
  2⤵
  PID:5768
- C:\Windows\System\SrzicEt.exe
  C:\Windows\System\SrzicEt.exe
  2⤵
  PID:5796
- C:\Windows\System\fBpBHGj.exe
  C:\Windows\System\fBpBHGj.exe
  2⤵
  PID:5828
- C:\Windows\System\btJXCAn.exe
  C:\Windows\System\btJXCAn.exe
  2⤵
  PID:5852
- C:\Windows\System\HxvKAuh.exe
  C:\Windows\System\HxvKAuh.exe
  2⤵
  PID:5888
- C:\Windows\System\stdwlBW.exe
  C:\Windows\System\stdwlBW.exe
  2⤵
  PID:5908
- C:\Windows\System\WmYrNZw.exe
  C:\Windows\System\WmYrNZw.exe
  2⤵
  PID:5936
- C:\Windows\System\NZvkTHr.exe
  C:\Windows\System\NZvkTHr.exe
  2⤵
  PID:5964
- C:\Windows\System\HzgTcyn.exe
  C:\Windows\System\HzgTcyn.exe
  2⤵
  PID:6000
- C:\Windows\System\qyAzuSx.exe
  C:\Windows\System\qyAzuSx.exe
  2⤵
  PID:6040
- C:\Windows\System\MygZlSb.exe
  C:\Windows\System\MygZlSb.exe
  2⤵
  PID:6068
- C:\Windows\System\TWEFwNG.exe
  C:\Windows\System\TWEFwNG.exe
  2⤵
  PID:6092
- C:\Windows\System\IMQeOjP.exe
  C:\Windows\System\IMQeOjP.exe
  2⤵
  PID:6136
- C:\Windows\System\NckVSvC.exe
  C:\Windows\System\NckVSvC.exe
  2⤵
  PID:5156
- C:\Windows\System\tCRYbOi.exe
  C:\Windows\System\tCRYbOi.exe
  2⤵
  PID:5196
- C:\Windows\System\FUeILze.exe
  C:\Windows\System\FUeILze.exe
  2⤵
  PID:5240
- C:\Windows\System\uZsKSup.exe
  C:\Windows\System\uZsKSup.exe
  2⤵
  PID:5280
- C:\Windows\System\FipSFin.exe
  C:\Windows\System\FipSFin.exe
  2⤵
  PID:5396
- C:\Windows\System\JedtujS.exe
  C:\Windows\System\JedtujS.exe
  2⤵
  PID:5480
- C:\Windows\System\ZbgpBdo.exe
  C:\Windows\System\ZbgpBdo.exe
  2⤵
  PID:5552
- C:\Windows\System\PJOKHGq.exe
  C:\Windows\System\PJOKHGq.exe
  2⤵
  PID:5596
- C:\Windows\System\VWcqrNy.exe
  C:\Windows\System\VWcqrNy.exe
  2⤵
  PID:5652
- C:\Windows\System\eeyTuQt.exe
  C:\Windows\System\eeyTuQt.exe
  2⤵
  PID:5692
- C:\Windows\System\vUkFxha.exe
  C:\Windows\System\vUkFxha.exe
  2⤵
  PID:5760
- C:\Windows\System\yobqYLT.exe
  C:\Windows\System\yobqYLT.exe
  2⤵
  PID:5816
- C:\Windows\System\KNAPSee.exe
  C:\Windows\System\KNAPSee.exe
  2⤵
  PID:5880
- C:\Windows\System\whCsmgZ.exe
  C:\Windows\System\whCsmgZ.exe
  2⤵
  PID:6048
- C:\Windows\System\FlYKUIb.exe
  C:\Windows\System\FlYKUIb.exe
  2⤵
  PID:6104
- C:\Windows\System\REcZVNU.exe
  C:\Windows\System\REcZVNU.exe
  2⤵
  PID:4868
- C:\Windows\System\BhJKDtn.exe
  C:\Windows\System\BhJKDtn.exe
  2⤵
  PID:5188
- C:\Windows\System\hAaQfIu.exe
  C:\Windows\System\hAaQfIu.exe
  2⤵
  PID:5340
- C:\Windows\System\gzfEwHM.exe
  C:\Windows\System\gzfEwHM.exe
  2⤵
  PID:5464
- C:\Windows\System\rVNHdHS.exe
  C:\Windows\System\rVNHdHS.exe
  2⤵
  PID:5524
- C:\Windows\System\bBgUvTR.exe
  C:\Windows\System\bBgUvTR.exe
  2⤵
  PID:5728
- C:\Windows\System\IaQjXoN.exe
  C:\Windows\System\IaQjXoN.exe
  2⤵
  PID:5680
- C:\Windows\System\VAgOSSZ.exe
  C:\Windows\System\VAgOSSZ.exe
  2⤵
  PID:5988
- C:\Windows\System\QZnyILz.exe
  C:\Windows\System\QZnyILz.exe
  2⤵
  PID:6132
- C:\Windows\System\MzqnzXo.exe
  C:\Windows\System\MzqnzXo.exe
  2⤵
  PID:5264
- C:\Windows\System\lVEwsMV.exe
  C:\Windows\System\lVEwsMV.exe
  2⤵
  PID:5564
- C:\Windows\System\zBWIiYs.exe
  C:\Windows\System\zBWIiYs.exe
  2⤵
  PID:5688
- C:\Windows\System\hGsNEVa.exe
  C:\Windows\System\hGsNEVa.exe
  2⤵
  PID:3592
- C:\Windows\System\BxNlzcb.exe
  C:\Windows\System\BxNlzcb.exe
  2⤵
  PID:5724
- C:\Windows\System\qeEOEFA.exe
  C:\Windows\System\qeEOEFA.exe
  2⤵
  PID:6168
- C:\Windows\System\tYgleEs.exe
  C:\Windows\System\tYgleEs.exe
  2⤵
  PID:6200
- C:\Windows\System\xcQdGbJ.exe
  C:\Windows\System\xcQdGbJ.exe
  2⤵
  PID:6228
- C:\Windows\System\jHCDWwV.exe
  C:\Windows\System\jHCDWwV.exe
  2⤵
  PID:6264
- C:\Windows\System\xjkDTsn.exe
  C:\Windows\System\xjkDTsn.exe
  2⤵
  PID:6292
- C:\Windows\System\keeJrOE.exe
  C:\Windows\System\keeJrOE.exe
  2⤵
  PID:6320
- C:\Windows\System\BLOugHQ.exe
  C:\Windows\System\BLOugHQ.exe
  2⤵
  PID:6348
- C:\Windows\System\COUvItv.exe
  C:\Windows\System\COUvItv.exe
  2⤵
  PID:6376
- C:\Windows\System\BAQliIo.exe
  C:\Windows\System\BAQliIo.exe
  2⤵
  PID:6404
- C:\Windows\System\YHLhdrf.exe
  C:\Windows\System\YHLhdrf.exe
  2⤵
  PID:6432
- C:\Windows\System\ZDwSTVv.exe
  C:\Windows\System\ZDwSTVv.exe
  2⤵
  PID:6448
- C:\Windows\System\NtnCQrM.exe
  C:\Windows\System\NtnCQrM.exe
  2⤵
  PID:6476
- C:\Windows\System\anATpOh.exe
  C:\Windows\System\anATpOh.exe
  2⤵
  PID:6516
- C:\Windows\System\aFGykFj.exe
  C:\Windows\System\aFGykFj.exe
  2⤵
  PID:6544
- C:\Windows\System\PcaYGAO.exe
  C:\Windows\System\PcaYGAO.exe
  2⤵
  PID:6572
- C:\Windows\System\gepdlRU.exe
  C:\Windows\System\gepdlRU.exe
  2⤵
  PID:6604
- C:\Windows\System\VCMskXo.exe
  C:\Windows\System\VCMskXo.exe
  2⤵
  PID:6628
- C:\Windows\System\CcVSwOH.exe
  C:\Windows\System\CcVSwOH.exe
  2⤵
  PID:6664
- C:\Windows\System\lrJLwec.exe
  C:\Windows\System\lrJLwec.exe
  2⤵
  PID:6688
- C:\Windows\System\ykOsXhS.exe
  C:\Windows\System\ykOsXhS.exe
  2⤵
  PID:6724
- C:\Windows\System\fmfVnCm.exe
  C:\Windows\System\fmfVnCm.exe
  2⤵
  PID:6752
- C:\Windows\System\IPcrojh.exe
  C:\Windows\System\IPcrojh.exe
  2⤵
  PID:6788
- C:\Windows\System\OKycigB.exe
  C:\Windows\System\OKycigB.exe
  2⤵
  PID:6812
- C:\Windows\System\SkKMnAV.exe
  C:\Windows\System\SkKMnAV.exe
  2⤵
  PID:6836
- C:\Windows\System\htnjPFw.exe
  C:\Windows\System\htnjPFw.exe
  2⤵
  PID:6872
- C:\Windows\System\cFBNZTh.exe
  C:\Windows\System\cFBNZTh.exe
  2⤵
  PID:6904
- C:\Windows\System\ehDMkOz.exe
  C:\Windows\System\ehDMkOz.exe
  2⤵
  PID:6948
- C:\Windows\System\BuIkbRr.exe
  C:\Windows\System\BuIkbRr.exe
  2⤵
  PID:6980
- C:\Windows\System\CRwUwQp.exe
  C:\Windows\System\CRwUwQp.exe
  2⤵
  PID:7012
- C:\Windows\System\qumRIyX.exe
  C:\Windows\System\qumRIyX.exe
  2⤵
  PID:7032
- C:\Windows\System\CZJZcfI.exe
  C:\Windows\System\CZJZcfI.exe
  2⤵
  PID:7064
- C:\Windows\System\jHHbpAU.exe
  C:\Windows\System\jHHbpAU.exe
  2⤵
  PID:7088
- C:\Windows\System\aopOYkH.exe
  C:\Windows\System\aopOYkH.exe
  2⤵
  PID:7124
- C:\Windows\System\YGiTqpv.exe
  C:\Windows\System\YGiTqpv.exe
  2⤵
  PID:7152
- C:\Windows\System\QRXVmTu.exe
  C:\Windows\System\QRXVmTu.exe
  2⤵
  PID:6176
- C:\Windows\System\dnPdWQx.exe
  C:\Windows\System\dnPdWQx.exe
  2⤵
  PID:6224
- C:\Windows\System\tnpyhhv.exe
  C:\Windows\System\tnpyhhv.exe
  2⤵
  PID:6304
- C:\Windows\System\pqIaPhe.exe
  C:\Windows\System\pqIaPhe.exe
  2⤵
  PID:6372
- C:\Windows\System\yAgXrGW.exe
  C:\Windows\System\yAgXrGW.exe
  2⤵
  PID:6424
- C:\Windows\System\TFJIJIA.exe
  C:\Windows\System\TFJIJIA.exe
  2⤵
  PID:6444
- C:\Windows\System\IhDfuxR.exe
  C:\Windows\System\IhDfuxR.exe
  2⤵
  PID:6564
- C:\Windows\System\drHJicm.exe
  C:\Windows\System\drHJicm.exe
  2⤵
  PID:6640
- C:\Windows\System\PBhyDwy.exe
  C:\Windows\System\PBhyDwy.exe
  2⤵
  PID:5332
- C:\Windows\System\OwjGQTQ.exe
  C:\Windows\System\OwjGQTQ.exe
  2⤵
  PID:6760
- C:\Windows\System\pzkrqpq.exe
  C:\Windows\System\pzkrqpq.exe
  2⤵
  PID:6828
- C:\Windows\System\QoKGlbb.exe
  C:\Windows\System\QoKGlbb.exe
  2⤵
  PID:6940
- C:\Windows\System\eRQwwnK.exe
  C:\Windows\System\eRQwwnK.exe
  2⤵
  PID:7020
- C:\Windows\System\jQVwbYp.exe
  C:\Windows\System\jQVwbYp.exe
  2⤵
  PID:7164
- C:\Windows\System\tjbODjQ.exe
  C:\Windows\System\tjbODjQ.exe
  2⤵
  PID:6360
- C:\Windows\System\pZWWUcK.exe
  C:\Windows\System\pZWWUcK.exe
  2⤵
  PID:6536
- C:\Windows\System\lYbAxVE.exe
  C:\Windows\System\lYbAxVE.exe
  2⤵
  PID:6740
- C:\Windows\System\qXAKABo.exe
  C:\Windows\System\qXAKABo.exe
  2⤵
  PID:6996
- C:\Windows\System\SUAnzDs.exe
  C:\Windows\System\SUAnzDs.exe
  2⤵
  PID:6624
- C:\Windows\System\nQWRRFl.exe
  C:\Windows\System\nQWRRFl.exe
  2⤵
  PID:7208
- C:\Windows\System\orQnCmc.exe
  C:\Windows\System\orQnCmc.exe
  2⤵
  PID:7248
- C:\Windows\System\HUMjXGU.exe
  C:\Windows\System\HUMjXGU.exe
  2⤵
  PID:7276
- C:\Windows\System\HiBPNfx.exe
  C:\Windows\System\HiBPNfx.exe
  2⤵
  PID:7292
- C:\Windows\System\MIaWvhS.exe
  C:\Windows\System\MIaWvhS.exe
  2⤵
  PID:7324
- C:\Windows\System\HrXJmXP.exe
  C:\Windows\System\HrXJmXP.exe
  2⤵
  PID:7360
- C:\Windows\System\xtpseFW.exe
  C:\Windows\System\xtpseFW.exe
  2⤵
  PID:7392
- C:\Windows\System\NWhuAhT.exe
  C:\Windows\System\NWhuAhT.exe
  2⤵
  PID:7424
- C:\Windows\System\uKBkPcs.exe
  C:\Windows\System\uKBkPcs.exe
  2⤵
  PID:7456
- C:\Windows\System\xUTuSSK.exe
  C:\Windows\System\xUTuSSK.exe
  2⤵
  PID:7500
- C:\Windows\System\YejNpHd.exe
  C:\Windows\System\YejNpHd.exe
  2⤵
  PID:7520
- C:\Windows\System\EltjhOx.exe
  C:\Windows\System\EltjhOx.exe
  2⤵
  PID:7552
- C:\Windows\System\edZTAaK.exe
  C:\Windows\System\edZTAaK.exe
  2⤵
  PID:7580
- C:\Windows\System\wiyKulA.exe
  C:\Windows\System\wiyKulA.exe
  2⤵
  PID:7612
- C:\Windows\System\sxkZyde.exe
  C:\Windows\System\sxkZyde.exe
  2⤵
  PID:7644
- C:\Windows\System\cBbIlVE.exe
  C:\Windows\System\cBbIlVE.exe
  2⤵
  PID:7668
- C:\Windows\System\BGBLtYi.exe
  C:\Windows\System\BGBLtYi.exe
  2⤵
  PID:7696
- C:\Windows\System\BMbznWS.exe
  C:\Windows\System\BMbznWS.exe
  2⤵
  PID:7720
- C:\Windows\System\BPFdpnK.exe
  C:\Windows\System\BPFdpnK.exe
  2⤵
  PID:7756
- C:\Windows\System\myEqUai.exe
  C:\Windows\System\myEqUai.exe
  2⤵
  PID:7792
- C:\Windows\System\CbPasiM.exe
  C:\Windows\System\CbPasiM.exe
  2⤵
  PID:7812
- C:\Windows\System\qllzVel.exe
  C:\Windows\System\qllzVel.exe
  2⤵
  PID:7844
- C:\Windows\System\OhmWuTT.exe
  C:\Windows\System\OhmWuTT.exe
  2⤵
  PID:7872
- C:\Windows\System\RqnkzHA.exe
  C:\Windows\System\RqnkzHA.exe
  2⤵
  PID:7896
- C:\Windows\System\hxTasps.exe
  C:\Windows\System\hxTasps.exe
  2⤵
  PID:7924
- C:\Windows\System\FQNctAY.exe
  C:\Windows\System\FQNctAY.exe
  2⤵
  PID:7940
- C:\Windows\System\bauYegE.exe
  C:\Windows\System\bauYegE.exe
  2⤵
  PID:7980
- C:\Windows\System\WhxGNwx.exe
  C:\Windows\System\WhxGNwx.exe
  2⤵
  PID:8008
- C:\Windows\System\iYLNspQ.exe
  C:\Windows\System\iYLNspQ.exe
  2⤵
  PID:8044
- C:\Windows\System\MTqYHnA.exe
  C:\Windows\System\MTqYHnA.exe
  2⤵
  PID:8076
- C:\Windows\System\NdkReVi.exe
  C:\Windows\System\NdkReVi.exe
  2⤵
  PID:8096
- C:\Windows\System\meBizqB.exe
  C:\Windows\System\meBizqB.exe
  2⤵
  PID:8112
- C:\Windows\System\oiVxDUT.exe
  C:\Windows\System\oiVxDUT.exe
  2⤵
  PID:8152
- C:\Windows\System\XkBrcFh.exe
  C:\Windows\System\XkBrcFh.exe
  2⤵
  PID:8184
- C:\Windows\System\WhbIIae.exe
  C:\Windows\System\WhbIIae.exe
  2⤵
  PID:7240
- C:\Windows\System\KAaGnzD.exe
  C:\Windows\System\KAaGnzD.exe
  2⤵
  PID:7288
- C:\Windows\System\QQiSJuY.exe
  C:\Windows\System\QQiSJuY.exe
  2⤵
  PID:7372
- C:\Windows\System\raFYQBF.exe
  C:\Windows\System\raFYQBF.exe
  2⤵
  PID:7412
- C:\Windows\System\EBYJDWO.exe
  C:\Windows\System\EBYJDWO.exe
  2⤵
  PID:7528
- C:\Windows\System\PYbatJV.exe
  C:\Windows\System\PYbatJV.exe
  2⤵
  PID:7600
- C:\Windows\System\nvXsZDA.exe
  C:\Windows\System\nvXsZDA.exe
  2⤵
  PID:7652
- C:\Windows\System\rKjbGJr.exe
  C:\Windows\System\rKjbGJr.exe
  2⤵
  PID:7716
- C:\Windows\System\xgFCbNa.exe
  C:\Windows\System\xgFCbNa.exe
  2⤵
  PID:7800
- C:\Windows\System\blJjBnF.exe
  C:\Windows\System\blJjBnF.exe
  2⤵
  PID:7860
- C:\Windows\System\YArdRpR.exe
  C:\Windows\System\YArdRpR.exe
  2⤵
  PID:7908
- C:\Windows\System\tvRlCGV.exe
  C:\Windows\System\tvRlCGV.exe
  2⤵
  PID:7976
- C:\Windows\System\MtrEolJ.exe
  C:\Windows\System\MtrEolJ.exe
  2⤵
  PID:8032
- C:\Windows\System\mVnpOTB.exe
  C:\Windows\System\mVnpOTB.exe
  2⤵
  PID:8088
- C:\Windows\System\uFMdabS.exe
  C:\Windows\System\uFMdabS.exe
  2⤵
  PID:8136
- C:\Windows\System\OLZbqgB.exe
  C:\Windows\System\OLZbqgB.exe
  2⤵
  PID:2424
- C:\Windows\System\vssvsWd.exe
  C:\Windows\System\vssvsWd.exe
  2⤵
  PID:7488
- C:\Windows\System\HrOhkfz.exe
  C:\Windows\System\HrOhkfz.exe
  2⤵
  PID:7660
- C:\Windows\System\dzRkQIe.exe
  C:\Windows\System\dzRkQIe.exe
  2⤵
  PID:7832
- C:\Windows\System\FxbAmHi.exe
  C:\Windows\System\FxbAmHi.exe
  2⤵
  PID:7932
- C:\Windows\System\jgpdjid.exe
  C:\Windows\System\jgpdjid.exe
  2⤵
  PID:8124
- C:\Windows\System\dkgteoi.exe
  C:\Windows\System\dkgteoi.exe
  2⤵
  PID:7420
- C:\Windows\System\GEaVsIB.exe
  C:\Windows\System\GEaVsIB.exe
  2⤵
  PID:7620
- C:\Windows\System\dRhuioQ.exe
  C:\Windows\System\dRhuioQ.exe
  2⤵
  PID:8004
- C:\Windows\System\FRdOYId.exe
  C:\Windows\System\FRdOYId.exe
  2⤵
  PID:7964
- C:\Windows\System\mwtQBzm.exe
  C:\Windows\System\mwtQBzm.exe
  2⤵
  PID:7744
- C:\Windows\System\QTNgAZM.exe
  C:\Windows\System\QTNgAZM.exe
  2⤵
  PID:8216
- C:\Windows\System\qBvkbMY.exe
  C:\Windows\System\qBvkbMY.exe
  2⤵
  PID:8244
- C:\Windows\System\fHwymxn.exe
  C:\Windows\System\fHwymxn.exe
  2⤵
  PID:8272
- C:\Windows\System\bldyvZz.exe
  C:\Windows\System\bldyvZz.exe
  2⤵
  PID:8300
- C:\Windows\System\IVYbSph.exe
  C:\Windows\System\IVYbSph.exe
  2⤵
  PID:8328
- C:\Windows\System\prgiwlR.exe
  C:\Windows\System\prgiwlR.exe
  2⤵
  PID:8356
- C:\Windows\System\AzWIuYv.exe
  C:\Windows\System\AzWIuYv.exe
  2⤵
  PID:8384
- C:\Windows\System\OsJvpWz.exe
  C:\Windows\System\OsJvpWz.exe
  2⤵
  PID:8412
- C:\Windows\System\VacuJwl.exe
  C:\Windows\System\VacuJwl.exe
  2⤵
  PID:8432
- C:\Windows\System\AGSGbtn.exe
  C:\Windows\System\AGSGbtn.exe
  2⤵
  PID:8460
- C:\Windows\System\gpYQSkG.exe
  C:\Windows\System\gpYQSkG.exe
  2⤵
  PID:8480
- C:\Windows\System\vzVwziG.exe
  C:\Windows\System\vzVwziG.exe
  2⤵
  PID:8516
- C:\Windows\System\akRdnvB.exe
  C:\Windows\System\akRdnvB.exe
  2⤵
  PID:8556
- C:\Windows\System\sAXWiww.exe
  C:\Windows\System\sAXWiww.exe
  2⤵
  PID:8584
- C:\Windows\System\kzIeqVA.exe
  C:\Windows\System\kzIeqVA.exe
  2⤵
  PID:8612
- C:\Windows\System\dwtQCMo.exe
  C:\Windows\System\dwtQCMo.exe
  2⤵
  PID:8628
- C:\Windows\System\xEftEJd.exe
  C:\Windows\System\xEftEJd.exe
  2⤵
  PID:8656
- C:\Windows\System\AMvllZg.exe
  C:\Windows\System\AMvllZg.exe
  2⤵
  PID:8696
- C:\Windows\System\hKlSGbS.exe
  C:\Windows\System\hKlSGbS.exe
  2⤵
  PID:8724
- C:\Windows\System\sncmBAN.exe
  C:\Windows\System\sncmBAN.exe
  2⤵
  PID:8752
- C:\Windows\System\XzanJBo.exe
  C:\Windows\System\XzanJBo.exe
  2⤵
  PID:8780
- C:\Windows\System\NczPqZz.exe
  C:\Windows\System\NczPqZz.exe
  2⤵
  PID:8808
- C:\Windows\System\RZJRGgt.exe
  C:\Windows\System\RZJRGgt.exe
  2⤵
  PID:8836
- C:\Windows\System\azdWwgb.exe
  C:\Windows\System\azdWwgb.exe
  2⤵
  PID:8864
- C:\Windows\System\bWMHVDg.exe
  C:\Windows\System\bWMHVDg.exe
  2⤵
  PID:8892
- C:\Windows\System\gYXxmFb.exe
  C:\Windows\System\gYXxmFb.exe
  2⤵
  PID:8920
- C:\Windows\System\STQtVox.exe
  C:\Windows\System\STQtVox.exe
  2⤵
  PID:8952
- C:\Windows\System\SNcOsBW.exe
  C:\Windows\System\SNcOsBW.exe
  2⤵
  PID:8984
- C:\Windows\System\KxywCLV.exe
  C:\Windows\System\KxywCLV.exe
  2⤵
  PID:9012
- C:\Windows\System\eLsMBNJ.exe
  C:\Windows\System\eLsMBNJ.exe
  2⤵
  PID:9040
- C:\Windows\System\IbJGeJQ.exe
  C:\Windows\System\IbJGeJQ.exe
  2⤵
  PID:9068
- C:\Windows\System\xTuYkiP.exe
  C:\Windows\System\xTuYkiP.exe
  2⤵
  PID:9096
- C:\Windows\System\UMCDFUP.exe
  C:\Windows\System\UMCDFUP.exe
  2⤵
  PID:9124
- C:\Windows\System\kpZQhbs.exe
  C:\Windows\System\kpZQhbs.exe
  2⤵
  PID:9152
- C:\Windows\System\cFJXXyo.exe
  C:\Windows\System\cFJXXyo.exe
  2⤵
  PID:9172
- C:\Windows\System\CEIRXxf.exe
  C:\Windows\System\CEIRXxf.exe
  2⤵
  PID:9208
- C:\Windows\System\RZXwOrx.exe
  C:\Windows\System\RZXwOrx.exe
  2⤵
  PID:8236
- C:\Windows\System\HywKKnX.exe
  C:\Windows\System\HywKKnX.exe
  2⤵
  PID:8296
- C:\Windows\System\QLaZgvL.exe
  C:\Windows\System\QLaZgvL.exe
  2⤵
  PID:8368
- C:\Windows\System\SeIntjQ.exe
  C:\Windows\System\SeIntjQ.exe
  2⤵
  PID:8424
- C:\Windows\System\vVmUWFK.exe
  C:\Windows\System\vVmUWFK.exe
  2⤵
  PID:8496
- C:\Windows\System\kPdGKPT.exe
  C:\Windows\System\kPdGKPT.exe
  2⤵
  PID:8568
- C:\Windows\System\TSbVPLr.exe
  C:\Windows\System\TSbVPLr.exe
  2⤵
  PID:8624
- C:\Windows\System\BfDJyou.exe
  C:\Windows\System\BfDJyou.exe
  2⤵
  PID:8688
- C:\Windows\System\iNqcEHs.exe
  C:\Windows\System\iNqcEHs.exe
  2⤵
  PID:8772
- C:\Windows\System\whAZAjs.exe
  C:\Windows\System\whAZAjs.exe
  2⤵
  PID:8848
- C:\Windows\System\zxIVcUN.exe
  C:\Windows\System\zxIVcUN.exe
  2⤵
  PID:8912
- C:\Windows\System\slBkjPV.exe
  C:\Windows\System\slBkjPV.exe
  2⤵
  PID:5104
- C:\Windows\System\HlBSmDm.exe
  C:\Windows\System\HlBSmDm.exe
  2⤵
  PID:8972
- C:\Windows\System\fZpWVcI.exe
  C:\Windows\System\fZpWVcI.exe
  2⤵
  PID:9144
- C:\Windows\System\yVHbnvk.exe
  C:\Windows\System\yVHbnvk.exe
  2⤵
  PID:8212
- C:\Windows\System\IHXSeQG.exe
  C:\Windows\System\IHXSeQG.exe
  2⤵
  PID:8396
- C:\Windows\System\gtaWQrn.exe
  C:\Windows\System\gtaWQrn.exe
  2⤵
  PID:8552
- C:\Windows\System\tslHqiz.exe
  C:\Windows\System\tslHqiz.exe
  2⤵
  PID:8680
- C:\Windows\System\kowUqVG.exe
  C:\Windows\System\kowUqVG.exe
  2⤵
  PID:8832
- C:\Windows\System\ZbITGhr.exe
  C:\Windows\System\ZbITGhr.exe
  2⤵
  PID:9036
- C:\Windows\System\MlDrDZp.exe
  C:\Windows\System\MlDrDZp.exe
  2⤵
  PID:9204
- C:\Windows\System\ozaTgKC.exe
  C:\Windows\System\ozaTgKC.exe
  2⤵
  PID:3000
- C:\Windows\System\PovYblL.exe
  C:\Windows\System\PovYblL.exe
  2⤵
  PID:8748
- C:\Windows\System\XWCMUeb.exe
  C:\Windows\System\XWCMUeb.exe
  2⤵
  PID:8980
- C:\Windows\System\tBYGyQa.exe
  C:\Windows\System\tBYGyQa.exe
  2⤵
  PID:2184
- C:\Windows\System\wXfQcZv.exe
  C:\Windows\System\wXfQcZv.exe
  2⤵
  PID:8976
- C:\Windows\System\sVPbsTR.exe
  C:\Windows\System\sVPbsTR.exe
  2⤵
  PID:8352
- C:\Windows\System\pbqCcCx.exe
  C:\Windows\System\pbqCcCx.exe
  2⤵
  PID:9244
- C:\Windows\System\ezrOaaA.exe
  C:\Windows\System\ezrOaaA.exe
  2⤵
  PID:9276
- C:\Windows\System\VXFOwto.exe
  C:\Windows\System\VXFOwto.exe
  2⤵
  PID:9304
- C:\Windows\System\jiERpGo.exe
  C:\Windows\System\jiERpGo.exe
  2⤵
  PID:9336
- C:\Windows\System\CjfweZJ.exe
  C:\Windows\System\CjfweZJ.exe
  2⤵
  PID:9364
- C:\Windows\System\VGjQKLJ.exe
  C:\Windows\System\VGjQKLJ.exe
  2⤵
  PID:9396
- C:\Windows\System\JRDZLys.exe
  C:\Windows\System\JRDZLys.exe
  2⤵
  PID:9432
- C:\Windows\System\qjGWQQC.exe
  C:\Windows\System\qjGWQQC.exe
  2⤵
  PID:9460
- C:\Windows\System\XhaPxiD.exe
  C:\Windows\System\XhaPxiD.exe
  2⤵
  PID:9488
- C:\Windows\System\ueHBFoi.exe
  C:\Windows\System\ueHBFoi.exe
  2⤵
  PID:9516
- C:\Windows\System\mdrcHnb.exe
  C:\Windows\System\mdrcHnb.exe
  2⤵
  PID:9544
- C:\Windows\System\XkUQPDw.exe
  C:\Windows\System\XkUQPDw.exe
  2⤵
  PID:9572
- C:\Windows\System\ZxuRJVR.exe
  C:\Windows\System\ZxuRJVR.exe
  2⤵
  PID:9604
- C:\Windows\System\gqXgqYd.exe
  C:\Windows\System\gqXgqYd.exe
  2⤵
  PID:9632
- C:\Windows\System\uWKRPKs.exe
  C:\Windows\System\uWKRPKs.exe
  2⤵
  PID:9648
- C:\Windows\System\CFykTxX.exe
  C:\Windows\System\CFykTxX.exe
  2⤵
  PID:9692
- C:\Windows\System\txpcgyt.exe
  C:\Windows\System\txpcgyt.exe
  2⤵
  PID:9724
- C:\Windows\System\EzhOBRj.exe
  C:\Windows\System\EzhOBRj.exe
  2⤵
  PID:9768
- C:\Windows\System\tLqZkvT.exe
  C:\Windows\System\tLqZkvT.exe
  2⤵
  PID:9808
- C:\Windows\System\ItPTztb.exe
  C:\Windows\System\ItPTztb.exe
  2⤵
  PID:9844
- C:\Windows\System\VanKpmf.exe
  C:\Windows\System\VanKpmf.exe
  2⤵
  PID:9872
- C:\Windows\System\uZxFhgC.exe
  C:\Windows\System\uZxFhgC.exe
  2⤵
  PID:9900
- C:\Windows\System\POQnqGB.exe
  C:\Windows\System\POQnqGB.exe
  2⤵
  PID:9928
- C:\Windows\System\rzyLujw.exe
  C:\Windows\System\rzyLujw.exe
  2⤵
  PID:9956
- C:\Windows\System\ujpFdrK.exe
  C:\Windows\System\ujpFdrK.exe
  2⤵
  PID:9984
- C:\Windows\System\vbEQDUR.exe
  C:\Windows\System\vbEQDUR.exe
  2⤵
  PID:10016
- C:\Windows\System\jwYJOXF.exe
  C:\Windows\System\jwYJOXF.exe
  2⤵
  PID:10044
- C:\Windows\System\VznPxOo.exe
  C:\Windows\System\VznPxOo.exe
  2⤵
  PID:10076
- C:\Windows\System\ERTGknp.exe
  C:\Windows\System\ERTGknp.exe
  2⤵
  PID:10108
- C:\Windows\System\wGTvwkX.exe
  C:\Windows\System\wGTvwkX.exe
  2⤵
  PID:10136
- C:\Windows\System\aUofDLj.exe
  C:\Windows\System\aUofDLj.exe
  2⤵
  PID:10164
- C:\Windows\System\yAyFuCw.exe
  C:\Windows\System\yAyFuCw.exe
  2⤵
  PID:10204
- C:\Windows\System\EkIhHMY.exe
  C:\Windows\System\EkIhHMY.exe
  2⤵
  PID:10220
- C:\Windows\System\GNhxvUk.exe
  C:\Windows\System\GNhxvUk.exe
  2⤵
  PID:9240
- C:\Windows\System\pbDsKZA.exe
  C:\Windows\System\pbDsKZA.exe
  2⤵
  PID:9288
- C:\Windows\System\dHbgMzk.exe
  C:\Windows\System\dHbgMzk.exe
  2⤵
  PID:9356
- C:\Windows\System\faqBqnq.exe
  C:\Windows\System\faqBqnq.exe
  2⤵
  PID:9420
- C:\Windows\System\vJUBzRA.exe
  C:\Windows\System\vJUBzRA.exe
  2⤵
  PID:9508
- C:\Windows\System\mmAJGJX.exe
  C:\Windows\System\mmAJGJX.exe
  2⤵
  PID:9564
- C:\Windows\System\CNnQQjw.exe
  C:\Windows\System\CNnQQjw.exe
  2⤵
  PID:9640
- C:\Windows\System\lCzJBjL.exe
  C:\Windows\System\lCzJBjL.exe
  2⤵
  PID:9708
- C:\Windows\System\xlfsoda.exe
  C:\Windows\System\xlfsoda.exe
  2⤵
  PID:9804
- C:\Windows\System\fVLBgcF.exe
  C:\Windows\System\fVLBgcF.exe
  2⤵
  PID:9892
- C:\Windows\System\yLPYdJW.exe
  C:\Windows\System\yLPYdJW.exe
  2⤵
  PID:9996
- C:\Windows\System\UYGPyWj.exe
  C:\Windows\System\UYGPyWj.exe
  2⤵
  PID:10056
- C:\Windows\System\CbkuDip.exe
  C:\Windows\System\CbkuDip.exe
  2⤵
  PID:10132
- C:\Windows\System\gLJWwmX.exe
  C:\Windows\System\gLJWwmX.exe
  2⤵
  PID:10196
- C:\Windows\System\wgefgKw.exe
  C:\Windows\System\wgefgKw.exe
  2⤵
  PID:8800
- C:\Windows\System\kLRwOML.exe
  C:\Windows\System\kLRwOML.exe
  2⤵
  PID:9328
- C:\Windows\System\JRLLXlI.exe
  C:\Windows\System\JRLLXlI.exe
  2⤵
  PID:9008
- C:\Windows\System\XEXtmcw.exe
  C:\Windows\System\XEXtmcw.exe
  2⤵
  PID:9820
- C:\Windows\System\LsbWHZd.exe
  C:\Windows\System\LsbWHZd.exe
  2⤵
  PID:9500
- C:\Windows\System\oDNlCDM.exe
  C:\Windows\System\oDNlCDM.exe
  2⤵
  PID:9600
- C:\Windows\System\EFmgBCH.exe
  C:\Windows\System\EFmgBCH.exe
  2⤵
  PID:9856
- C:\Windows\System\fvSyjpy.exe
  C:\Windows\System\fvSyjpy.exe
  2⤵
  PID:10036
- C:\Windows\System\eRnWwor.exe
  C:\Windows\System\eRnWwor.exe
  2⤵
  PID:10188
- C:\Windows\System\FWPwtFI.exe
  C:\Windows\System\FWPwtFI.exe
  2⤵
  PID:9840
- C:\Windows\System\yhaqEed.exe
  C:\Windows\System\yhaqEed.exe
  2⤵
  PID:9316
- C:\Windows\System\UBgrena.exe
  C:\Windows\System\UBgrena.exe
  2⤵
  PID:9384
- C:\Windows\System\eGCjwts.exe
  C:\Windows\System\eGCjwts.exe
  2⤵
  PID:9748
- C:\Windows\System\xEqAqXU.exe
  C:\Windows\System\xEqAqXU.exe
  2⤵
  PID:10128
- C:\Windows\System\WuUokiE.exe
  C:\Windows\System\WuUokiE.exe
  2⤵
  PID:9968
- C:\Windows\System\lXMtgDF.exe
  C:\Windows\System\lXMtgDF.exe
  2⤵
  PID:4956
- C:\Windows\System\AvkBzdh.exe
  C:\Windows\System\AvkBzdh.exe
  2⤵
  PID:10004
- C:\Windows\System\UpvPxfT.exe
  C:\Windows\System\UpvPxfT.exe
  2⤵
  PID:10100
- C:\Windows\System\LKmUxti.exe
  C:\Windows\System\LKmUxti.exe
  2⤵
  PID:10244
- C:\Windows\System\FdOyhEZ.exe
  C:\Windows\System\FdOyhEZ.exe
  2⤵
  PID:10284
- C:\Windows\System\OoMwNMn.exe
  C:\Windows\System\OoMwNMn.exe
  2⤵
  PID:10312
- C:\Windows\System\KJsLZMY.exe
  C:\Windows\System\KJsLZMY.exe
  2⤵
  PID:10340
- C:\Windows\System\odRRlZW.exe
  C:\Windows\System\odRRlZW.exe
  2⤵
  PID:10384
- C:\Windows\System\HrvXrqF.exe
  C:\Windows\System\HrvXrqF.exe
  2⤵
  PID:10400
- C:\Windows\System\hQQORkB.exe
  C:\Windows\System\hQQORkB.exe
  2⤵
  PID:10428
- C:\Windows\System\kNHWDid.exe
  C:\Windows\System\kNHWDid.exe
  2⤵
  PID:10456
- C:\Windows\System\hGSjqUB.exe
  C:\Windows\System\hGSjqUB.exe
  2⤵
  PID:10484
- C:\Windows\System\tNeROCT.exe
  C:\Windows\System\tNeROCT.exe
  2⤵
  PID:10512
- C:\Windows\System\keszhPF.exe
  C:\Windows\System\keszhPF.exe
  2⤵
  PID:10540
- C:\Windows\System\ZbSjPyE.exe
  C:\Windows\System\ZbSjPyE.exe
  2⤵
  PID:10568
- C:\Windows\System\GgAZQUS.exe
  C:\Windows\System\GgAZQUS.exe
  2⤵
  PID:10596
- C:\Windows\System\IcNsRxy.exe
  C:\Windows\System\IcNsRxy.exe
  2⤵
  PID:10624
- C:\Windows\System\ooHdDVW.exe
  C:\Windows\System\ooHdDVW.exe
  2⤵
  PID:10652
- C:\Windows\System\cdikolQ.exe
  C:\Windows\System\cdikolQ.exe
  2⤵
  PID:10680
- C:\Windows\System\WAffjRS.exe
  C:\Windows\System\WAffjRS.exe
  2⤵
  PID:10708
- C:\Windows\System\TKDfVFu.exe
  C:\Windows\System\TKDfVFu.exe
  2⤵
  PID:10736
- C:\Windows\System\LMNkWYP.exe
  C:\Windows\System\LMNkWYP.exe
  2⤵
  PID:10764
- C:\Windows\System\XplXQnZ.exe
  C:\Windows\System\XplXQnZ.exe
  2⤵
  PID:10792
- C:\Windows\System\KkOUouZ.exe
  C:\Windows\System\KkOUouZ.exe
  2⤵
  PID:10820
- C:\Windows\System\lPsOMfW.exe
  C:\Windows\System\lPsOMfW.exe
  2⤵
  PID:10848
- C:\Windows\System\ReaKApX.exe
  C:\Windows\System\ReaKApX.exe
  2⤵
  PID:10876
- C:\Windows\System\IJugfrG.exe
  C:\Windows\System\IJugfrG.exe
  2⤵
  PID:10904
- C:\Windows\System\fLFtmNh.exe
  C:\Windows\System\fLFtmNh.exe
  2⤵
  PID:10940
- C:\Windows\System\UkGGNTA.exe
  C:\Windows\System\UkGGNTA.exe
  2⤵
  PID:10960
- C:\Windows\System\YriOKEG.exe
  C:\Windows\System\YriOKEG.exe
  2⤵
  PID:10988
- C:\Windows\System\iKgfXzI.exe
  C:\Windows\System\iKgfXzI.exe
  2⤵
  PID:11016
- C:\Windows\System\XMqRdPd.exe
  C:\Windows\System\XMqRdPd.exe
  2⤵
  PID:11044
- C:\Windows\System\xsTaJBA.exe
  C:\Windows\System\xsTaJBA.exe
  2⤵
  PID:11072
- C:\Windows\System\EShWAYc.exe
  C:\Windows\System\EShWAYc.exe
  2⤵
  PID:11100
- C:\Windows\System\enNCoXf.exe
  C:\Windows\System\enNCoXf.exe
  2⤵
  PID:11128
- C:\Windows\System\KeIHuEn.exe
  C:\Windows\System\KeIHuEn.exe
  2⤵
  PID:11156
- C:\Windows\System\EpHHOOJ.exe
  C:\Windows\System\EpHHOOJ.exe
  2⤵
  PID:11184
- C:\Windows\System\CoBIXJG.exe
  C:\Windows\System\CoBIXJG.exe
  2⤵
  PID:11212
- C:\Windows\System\xMeTTvQ.exe
  C:\Windows\System\xMeTTvQ.exe
  2⤵
  PID:11240
- C:\Windows\System\XKGQAWS.exe
  C:\Windows\System\XKGQAWS.exe
  2⤵
  PID:9952
- C:\Windows\System\IkELjNZ.exe
  C:\Windows\System\IkELjNZ.exe
  2⤵
  PID:10336
- C:\Windows\System\KwSRfWO.exe
  C:\Windows\System\KwSRfWO.exe
  2⤵
  PID:10352
- C:\Windows\System\ztuiFEp.exe
  C:\Windows\System\ztuiFEp.exe
  2⤵
  PID:4428
- C:\Windows\System\GArFziF.exe
  C:\Windows\System\GArFziF.exe
  2⤵
  PID:5152
- C:\Windows\System\CvPKZrj.exe
  C:\Windows\System\CvPKZrj.exe
  2⤵
  PID:2508
- C:\Windows\System\HFaobzP.exe
  C:\Windows\System\HFaobzP.exe
  2⤵
  PID:10392
- C:\Windows\System\sZPSYbo.exe
  C:\Windows\System\sZPSYbo.exe
  2⤵
  PID:10452
- C:\Windows\System\EeICxrS.exe
  C:\Windows\System\EeICxrS.exe
  2⤵
  PID:10524
- C:\Windows\System\zUrXYxU.exe
  C:\Windows\System\zUrXYxU.exe
  2⤵
  PID:10588
- C:\Windows\System\FKSGnef.exe
  C:\Windows\System\FKSGnef.exe
  2⤵
  PID:10648
- C:\Windows\System\bQyUCdI.exe
  C:\Windows\System\bQyUCdI.exe
  2⤵
  PID:10720
- C:\Windows\System\jHVUSLl.exe
  C:\Windows\System\jHVUSLl.exe
  2⤵
  PID:10784
- C:\Windows\System\rkbezar.exe
  C:\Windows\System\rkbezar.exe
  2⤵
  PID:10844
- C:\Windows\System\MJrVIJT.exe
  C:\Windows\System\MJrVIJT.exe
  2⤵
  PID:10916
- C:\Windows\System\IyCxUZW.exe
  C:\Windows\System\IyCxUZW.exe
  2⤵
  PID:10980
- C:\Windows\System\MyUouDQ.exe
  C:\Windows\System\MyUouDQ.exe
  2⤵
  PID:11040
- C:\Windows\System\cpLSpgE.exe
  C:\Windows\System\cpLSpgE.exe
  2⤵
  PID:11112
- C:\Windows\System\NesmsVF.exe
  C:\Windows\System\NesmsVF.exe
  2⤵
  PID:11176
- C:\Windows\System\RPOdWpY.exe
  C:\Windows\System\RPOdWpY.exe
  2⤵
  PID:11236
- C:\Windows\System\HNVoJMQ.exe
  C:\Windows\System\HNVoJMQ.exe
  2⤵
  PID:10332
- C:\Windows\System\BHXWerm.exe
  C:\Windows\System\BHXWerm.exe
  2⤵
  PID:5432
- C:\Windows\System\witpSaj.exe
  C:\Windows\System\witpSaj.exe
  2⤵
  PID:4608
- C:\Windows\System\MLBaqTN.exe
  C:\Windows\System\MLBaqTN.exe
  2⤵
  PID:10556
- C:\Windows\System\nEewMrm.exe
  C:\Windows\System\nEewMrm.exe
  2⤵
  PID:10700
- C:\Windows\System\yHCOhRo.exe
  C:\Windows\System\yHCOhRo.exe
  2⤵
  PID:10840
- C:\Windows\System\iVWUVRZ.exe
  C:\Windows\System\iVWUVRZ.exe
  2⤵
  PID:10972
- C:\Windows\System\dutzOIT.exe
  C:\Windows\System\dutzOIT.exe
  2⤵
  PID:11140
- C:\Windows\System\bQxeZvT.exe
  C:\Windows\System\bQxeZvT.exe
  2⤵
  PID:10296
- C:\Windows\System\ikxTpbZ.exe
  C:\Windows\System\ikxTpbZ.exe
  2⤵
  PID:10364
- C:\Windows\System\cIsSjTR.exe
  C:\Windows\System\cIsSjTR.exe
  2⤵
  PID:10812
- C:\Windows\System\CoTYeaT.exe
  C:\Windows\System\CoTYeaT.exe
  2⤵
  PID:11096
- C:\Windows\System\QcApnFy.exe
  C:\Windows\System\QcApnFy.exe
  2⤵
  PID:10508
- C:\Windows\System\lynxYwZ.exe
  C:\Windows\System\lynxYwZ.exe
  2⤵
  PID:2260
- C:\Windows\System\CRgLdNd.exe
  C:\Windows\System\CRgLdNd.exe
  2⤵
  PID:11272
- C:\Windows\System\jvcNSzp.exe
  C:\Windows\System\jvcNSzp.exe
  2⤵
  PID:11300
- C:\Windows\System\MYsZsai.exe
  C:\Windows\System\MYsZsai.exe
  2⤵
  PID:11328
- C:\Windows\System\yCsqMhz.exe
  C:\Windows\System\yCsqMhz.exe
  2⤵
  PID:11356
- C:\Windows\System\FiTGEcD.exe
  C:\Windows\System\FiTGEcD.exe
  2⤵
  PID:11384
- C:\Windows\System\aXMnPKz.exe
  C:\Windows\System\aXMnPKz.exe
  2⤵
  PID:11412
- C:\Windows\System\OIzIZPT.exe
  C:\Windows\System\OIzIZPT.exe
  2⤵
  PID:11452
- C:\Windows\System\IkpDpRG.exe
  C:\Windows\System\IkpDpRG.exe
  2⤵
  PID:11468
- C:\Windows\System\oTyuCGV.exe
  C:\Windows\System\oTyuCGV.exe
  2⤵
  PID:11496
- C:\Windows\System\HTekdIF.exe
  C:\Windows\System\HTekdIF.exe
  2⤵
  PID:11532
- C:\Windows\System\rXFXueU.exe
  C:\Windows\System\rXFXueU.exe
  2⤵
  PID:11584
- C:\Windows\System\umTjxdm.exe
  C:\Windows\System\umTjxdm.exe
  2⤵
  PID:11636
- C:\Windows\System\ZIXYZkR.exe
  C:\Windows\System\ZIXYZkR.exe
  2⤵
  PID:11672
- C:\Windows\System\GhgfyGq.exe
  C:\Windows\System\GhgfyGq.exe
  2⤵
  PID:11696
- C:\Windows\System\LfRZmTf.exe
  C:\Windows\System\LfRZmTf.exe
  2⤵
  PID:11788
- C:\Windows\System\pbFdeQl.exe
  C:\Windows\System\pbFdeQl.exe
  2⤵
  PID:11804
- C:\Windows\System\VRkLHxj.exe
  C:\Windows\System\VRkLHxj.exe
  2⤵
  PID:11820
- C:\Windows\System\aiDbWXp.exe
  C:\Windows\System\aiDbWXp.exe
  2⤵
  PID:11840
- C:\Windows\System\iCOFmfT.exe
  C:\Windows\System\iCOFmfT.exe
  2⤵
  PID:11868
- C:\Windows\System\ZJPZfOa.exe
  C:\Windows\System\ZJPZfOa.exe
  2⤵
  PID:11904
- C:\Windows\System\NtEQhDa.exe
  C:\Windows\System\NtEQhDa.exe
  2⤵
  PID:11952
- C:\Windows\System\HDMeJKb.exe
  C:\Windows\System\HDMeJKb.exe
  2⤵
  PID:11992
- C:\Windows\System\fPDjJCv.exe
  C:\Windows\System\fPDjJCv.exe
  2⤵
  PID:12008
- C:\Windows\System\jTrhlEz.exe
  C:\Windows\System\jTrhlEz.exe
  2⤵
  PID:12036
- C:\Windows\System\UcTYyWA.exe
  C:\Windows\System\UcTYyWA.exe
  2⤵
  PID:12064
- C:\Windows\System\QdLriPo.exe
  C:\Windows\System\QdLriPo.exe
  2⤵
  PID:12092
- C:\Windows\System\GJHpnpB.exe
  C:\Windows\System\GJHpnpB.exe
  2⤵
  PID:12120
- C:\Windows\System\LBVTBGx.exe
  C:\Windows\System\LBVTBGx.exe
  2⤵
  PID:12148
- C:\Windows\System\NnzIrIv.exe
  C:\Windows\System\NnzIrIv.exe
  2⤵
  PID:12176
- C:\Windows\System\FHQygWb.exe
  C:\Windows\System\FHQygWb.exe
  2⤵
  PID:12204
- C:\Windows\System\vXzkbFN.exe
  C:\Windows\System\vXzkbFN.exe
  2⤵
  PID:12232
- C:\Windows\System\yVkptoF.exe
  C:\Windows\System\yVkptoF.exe
  2⤵
  PID:12260
- C:\Windows\System\jsfLRTb.exe
  C:\Windows\System\jsfLRTb.exe
  2⤵
  PID:12276
- C:\Windows\System\kudXONI.exe
  C:\Windows\System\kudXONI.exe
  2⤵
  PID:11324
- C:\Windows\System\jVMRLfN.exe
  C:\Windows\System\jVMRLfN.exe
  2⤵
  PID:11396
- C:\Windows\System\fGNddcG.exe
  C:\Windows\System\fGNddcG.exe
  2⤵
  PID:11460
- C:\Windows\System\jPqHTev.exe
  C:\Windows\System\jPqHTev.exe
  2⤵
  PID:11528
- C:\Windows\System\RmuKmbN.exe
  C:\Windows\System\RmuKmbN.exe
  2⤵
  PID:11656
- C:\Windows\System\alNrmzC.exe
  C:\Windows\System\alNrmzC.exe
  2⤵
  PID:11724
- C:\Windows\System\JPEEuBf.exe
  C:\Windows\System\JPEEuBf.exe
  2⤵
  PID:11816
- C:\Windows\System\PqUTOpy.exe
  C:\Windows\System\PqUTOpy.exe
  2⤵
  PID:11888
- C:\Windows\System\BIjDfuG.exe
  C:\Windows\System\BIjDfuG.exe
  2⤵
  PID:11964
- C:\Windows\System\DgbQpeE.exe
  C:\Windows\System\DgbQpeE.exe
  2⤵
  PID:12048
- C:\Windows\System\FoSxnQr.exe
  C:\Windows\System\FoSxnQr.exe
  2⤵
  PID:12088
- C:\Windows\System\PxvfOtw.exe
  C:\Windows\System\PxvfOtw.exe
  2⤵
  PID:12160
- C:\Windows\System\WbozmmH.exe
  C:\Windows\System\WbozmmH.exe
  2⤵
  PID:12228
- C:\Windows\System\WPAyxvU.exe
  C:\Windows\System\WPAyxvU.exe
  2⤵
  PID:11296
- C:\Windows\System\UGAQkoU.exe
  C:\Windows\System\UGAQkoU.exe
  2⤵
  PID:11436
- C:\Windows\System\VYrEQdu.exe
  C:\Windows\System\VYrEQdu.exe
  2⤵
  PID:11632
- C:\Windows\System\tcdyvVq.exe
  C:\Windows\System\tcdyvVq.exe
  2⤵
  PID:11832
- C:\Windows\System\TrkaYLl.exe
  C:\Windows\System\TrkaYLl.exe
  2⤵
  PID:11976
- C:\Windows\System\fuVailb.exe
  C:\Windows\System\fuVailb.exe
  2⤵
  PID:12140
- C:\Windows\System\RGMLVjE.exe
  C:\Windows\System\RGMLVjE.exe
  2⤵
  PID:11352
- C:\Windows\System\xPFimVC.exe
  C:\Windows\System\xPFimVC.exe
  2⤵
  PID:4320
- C:\Windows\System\qnmWALI.exe
  C:\Windows\System\qnmWALI.exe
  2⤵
  PID:11692
- C:\Windows\System\GBnbHFm.exe
  C:\Windows\System\GBnbHFm.exe
  2⤵
  PID:12084
- C:\Windows\System\sHPhyYx.exe
  C:\Windows\System\sHPhyYx.exe
  2⤵
  PID:892
- C:\Windows\System\GhjsxqF.exe
  C:\Windows\System\GhjsxqF.exe
  2⤵
  PID:12268
- C:\Windows\System\XJQDqft.exe
  C:\Windows\System\XJQDqft.exe
  2⤵
  PID:12292
- C:\Windows\System\UPqaskG.exe
  C:\Windows\System\UPqaskG.exe
  2⤵
  PID:12320
- C:\Windows\System\FDEARyM.exe
  C:\Windows\System\FDEARyM.exe
  2⤵
  PID:12348
- C:\Windows\System\cDoGyqq.exe
  C:\Windows\System\cDoGyqq.exe
  2⤵
  PID:12376
- C:\Windows\System\Jbuiwzj.exe
  C:\Windows\System\Jbuiwzj.exe
  2⤵
  PID:12404
- C:\Windows\System\ylbbveG.exe
  C:\Windows\System\ylbbveG.exe
  2⤵
  PID:12432
- C:\Windows\System\nknaxqc.exe
  C:\Windows\System\nknaxqc.exe
  2⤵
  PID:12460
- C:\Windows\System\asJPCdM.exe
  C:\Windows\System\asJPCdM.exe
  2⤵
  PID:12488
- C:\Windows\System\mszXGzB.exe
  C:\Windows\System\mszXGzB.exe
  2⤵
  PID:12516
- C:\Windows\System\DvHqeyk.exe
  C:\Windows\System\DvHqeyk.exe
  2⤵
  PID:12544
- C:\Windows\System\FtbpMpn.exe
  C:\Windows\System\FtbpMpn.exe
  2⤵
  PID:12572
- C:\Windows\System\gWMAjdC.exe
  C:\Windows\System\gWMAjdC.exe
  2⤵
  PID:12600
- C:\Windows\System\nXoYikU.exe
  C:\Windows\System\nXoYikU.exe
  2⤵
  PID:12628
- C:\Windows\System\ESppdeQ.exe
  C:\Windows\System\ESppdeQ.exe
  2⤵
  PID:12656
- C:\Windows\System\JbreYbo.exe
  C:\Windows\System\JbreYbo.exe
  2⤵
  PID:12688
- C:\Windows\System\okbTyMN.exe
  C:\Windows\System\okbTyMN.exe
  2⤵
  PID:12716
- C:\Windows\System\bxnrfsU.exe
  C:\Windows\System\bxnrfsU.exe
  2⤵
  PID:12736
- C:\Windows\System\ybYEFPC.exe
  C:\Windows\System\ybYEFPC.exe
  2⤵
  PID:12772
- C:\Windows\System\mktgmQt.exe
  C:\Windows\System\mktgmQt.exe
  2⤵
  PID:12800
- C:\Windows\System\emibksg.exe
  C:\Windows\System\emibksg.exe
  2⤵
  PID:12828
- C:\Windows\System\NziTHaK.exe
  C:\Windows\System\NziTHaK.exe
  2⤵
  PID:12856
- C:\Windows\System\pNGYCap.exe
  C:\Windows\System\pNGYCap.exe
  2⤵
  PID:12884
- C:\Windows\System\mZUBcoa.exe
  C:\Windows\System\mZUBcoa.exe
  2⤵
  PID:12912
- C:\Windows\System\yFYGqMe.exe
  C:\Windows\System\yFYGqMe.exe
  2⤵
  PID:12940
- C:\Windows\System\LLnVDCS.exe
  C:\Windows\System\LLnVDCS.exe
  2⤵
  PID:12968
- C:\Windows\System\oLCKEkA.exe
  C:\Windows\System\oLCKEkA.exe
  2⤵
  PID:12996
- C:\Windows\System\SBTtpCA.exe
  C:\Windows\System\SBTtpCA.exe
  2⤵
  PID:13024
- C:\Windows\System\UhJfOnC.exe
  C:\Windows\System\UhJfOnC.exe
  2⤵
  PID:13052
- C:\Windows\System\EmXMYqd.exe
  C:\Windows\System\EmXMYqd.exe
  2⤵
  PID:13080
- C:\Windows\System\ZkDPdzP.exe
  C:\Windows\System\ZkDPdzP.exe
  2⤵
  PID:13108
- C:\Windows\System\CvSIHqw.exe
  C:\Windows\System\CvSIHqw.exe
  2⤵
  PID:13140
- C:\Windows\System\oyRLNTL.exe
  C:\Windows\System\oyRLNTL.exe
  2⤵
  PID:13164
- C:\Windows\System\BvSZAbQ.exe
  C:\Windows\System\BvSZAbQ.exe
  2⤵
  PID:13192
- C:\Windows\System\QIQRgMu.exe
  C:\Windows\System\QIQRgMu.exe
  2⤵
  PID:13220
- C:\Windows\System\wytAcDV.exe
  C:\Windows\System\wytAcDV.exe
  2⤵
  PID:13248
- C:\Windows\System\hPErYbC.exe
  C:\Windows\System\hPErYbC.exe
  2⤵
  PID:13276
- C:\Windows\System\tNyyGnQ.exe
  C:\Windows\System\tNyyGnQ.exe
  2⤵
  PID:13304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_z4afw5em.kfr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4afw5em.kfr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ADzmTwD.exe

Path C:\Windows\System\ADzmTwD.exe
Size 2.8MB
SHA256 99dde95fcb27a03a079cc697b0550c58dd5cc5052bb3f887a2a200ba50fbc10e
MD5 eec9b78f32877f5ebe9024aba2991740
SHA1 733f2f141f5972f436cfa554862bbe3e9d552e34
SHA512 f8dd29982e1edb96315b19caa454cc02ddb5d44fe5c83a9ff447fffe44d15d6a9aa9398f1e377995296aad95b002db2c91fe43ecf949c78f45d9c6c42521c8a1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetx:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AeqQElu.exe

Path C:\Windows\System\AeqQElu.exe
Size 2.8MB
SHA256 4d8ff9eac1e8c9fbf5535c3a3e86da95a68ed2543563eac73166a162c5a72eae
MD5 9f91e18bb1a33eb2c11deb1b9537fa77
SHA1 7f61b247119b93244470fa520a7de0cfbda6d292
SHA512 074960aa41f77891a9780727f956cb453b42abb526fecd2e3e1cde64875a34f9e885987153f5d8f266dc566c9d17df46a5fb6111ac1ea32e82f284d4732ed715
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlRmwrG.exe

Path C:\Windows\System\AlRmwrG.exe
Size 2.8MB
SHA256 0424fa112502607f08400a0343629d073533c6fd35995e5d6e9b43784210d8b4
MD5 01ef347fa3082bb13ba822baab9ae047
SHA1 40aca9dab4b11bf7d73a162a805e24e68b415e96
SHA512 63c1f6b1b46037ae41c6f4fef6a72028eca5375974dee48d3faeebefca62d24cd12c2403da4ae5a9b978f9c21a8e770319efb51002eb68ff66f31a66b7098e7d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

GaNUgJc.exe

Path C:\Windows\System\GaNUgJc.exe
Size 2.8MB
SHA256 eac64a4c012fafab142a9b8b73a455b1a8259519bd07cb4ddc9737826a5ddee4
MD5 f7b8e48d5f9c9e002c3a4109d94b7ac0
SHA1 3440f4dab30e00c4f5d1e203640fb53b24fbe41d
SHA512 2533873972f75b98c18d44f17d5efe72326ba271100f2729ba59746b6a0f0db060eba2968735409bac6a41eadd248a010bd53326832071ca9a7f325c888c7e37
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset6:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

IKsJmII.exe

Path C:\Windows\System\IKsJmII.exe
Size 2.8MB
SHA256 b16cb68ffb239501f2495b79e0d81fd9914e6248b40163a1dd0fd7ac1a3f4e07
MD5 49c576fe77a4ea3a20e67d584cd0a875
SHA1 c0ccd9c3c3d4636b05a312459528067edeaace6b
SHA512 0108b045583272352633d3bbff10435e310253e6373d355bdd85dc49b25db47b5e0420d030e466a72cc0f0091f748138116abd26cb05e205af11ae99bdfcd94e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetU:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

JmEjDLk.exe

Path C:\Windows\System\JmEjDLk.exe
Size 2.8MB
SHA256 63d5d09d7d9599b0f9e4b0133b9365f7ddaae8f74ad2557375ffe1c33bb07acb
MD5 3103978a10c37a20e4d719650c8e7864
SHA1 d7d78fd9084f02586cfe80f099fbe4a7218b1e63
SHA512 06f490fed92e270027a35d98821432bb181bb6b0d81e063bef59be16219b490182ead36074435f8e1e673b951da1b9655396a4fe5e5d4881c58f1c66a3facec1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetR:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyvvTek.exe

Path C:\Windows\System\JyvvTek.exe
Size 2.8MB
SHA256 581774fcf061d609e2c43e010ceb2be9279f037b8b52363c31ef3433b8203885
MD5 ebafd50ae6bc1a4ac8cd08223a7173f1
SHA1 34b7362e669824d59f30c26785c7dc5674d770f0
SHA512 2bf015a5ece07e696992ada1fc857016a85c044f9aa09047e4d2b05f3c2e2494036a65869a5fdd397be1077008cf1954ced9dfd8dd198ab369d4dad6709483f4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

LyvhuuU.exe

Path C:\Windows\System\LyvhuuU.exe
Size 2.8MB
SHA256 00c273ac08f14d999d1c67cf620fed2ec0455aee4c701962e727e0a06a71ba14
MD5 27f771e5786e2f8bea3cd92557e843fb
SHA1 1384c80aa730e8f08550a85fabcf34336cd560b6
SHA512 0ad7aa0dbc8ef8e4ec36d6e35f764a6f942860c9ecb94ab0226f0b35163bf1f7fef79ec1be952b5ca4739104671bc8708ca97e5be67c4594d67ac6616c8cde64
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset1:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHAfMgE.exe

Path C:\Windows\System\PHAfMgE.exe
Size 2.8MB
SHA256 c5097fb42ce43cfb712d08876a932ac1e8da7a7a0cbdb0f667894e56ea013e17
MD5 d8afd0c494df5c46a843fa18d6be3d64
SHA1 777ff68627479c2d1f7b146bc42651a5e05c0c69
SHA512 52ea8a01cb05550339e5798709bf612818d5f427619d19079730bdb22ec855ba4d149539655514d678231329fed93d6c8435eb400d1cf6406b47635fd1c507be
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nseti:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

SfwTXqE.exe

Path C:\Windows\System\SfwTXqE.exe
Size 2.8MB
SHA256 37db02df88a62234bf263c6ef189c0d64c5701800d3281820fb6d78ab9a2a89f
MD5 ba992413240c11444acf33c5fea78a4c
SHA1 7c51586890c794fc3f0eae879cc5e341134c1b63
SHA512 a62e2b4c5f7dc50ccaae8d92ebc32227c87d588afdf417cdb052d974a3d94e6bcc0b19ee60b518dafbcd1c9c5dc54ab1a82c415b0e0d4cc089d9f64e7937c1a9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjvSeJQ.exe

Path C:\Windows\System\SjvSeJQ.exe
Size 2.8MB
SHA256 c6a579527162f2b80633e77a65ce522a5b93147662f84d63fe19b9eb51eba953
MD5 fffd895165254e937e78d937f9ce98f4
SHA1 e2cfa14d7c49306dd90f22051ac3b34b2f197d63
SHA512 51e9f0c99af5f68391f73ceeac9a144dde3437cac5124eb6d55b7e44d558ace2e97b24aa0e49226b82ed460a6b91a4cb26776ec5c99f75c0f2e3eea0539a99d5
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TKdjJDs.exe

Path C:\Windows\System\TKdjJDs.exe
Size 2.8MB
SHA256 a8af1b294e72eb0e47e83fded4ff766f3a164b1b3cc400cd85ad572e6fe8e979
MD5 0cd8b4cc81f98f373ac5a1354b3914e9
SHA1 e0ab77f45657d42405d389f34d5e309500773ff1
SHA512 11be35f3ef47470d952acb2e28e48e56c191748ef2307dc837f533b9341f2448123f08440ebdc6296abad8c6ef6b4836fd2544aa8148240dee670823aa54627b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetA:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TvEdUwk.exe

Path C:\Windows\System\TvEdUwk.exe
Size 2.8MB
SHA256 8ac0f2f767a054020d4fde1ba8070c3ee057a5fbc948703ed4995a2c42ebd108
MD5 6156725501447cdbc78a0055e72314a5
SHA1 6b7df3584a09bd71ab34498d8bf6502ffa247bbf
SHA512 11b70ba700babdfe0f52a07a9bd57e8282fc18350b457763732b1c19d0eb3fb38cdea7952665d4ca283c7b990653aa6c74e5e5a1d9ed90d448e839cc5e842406
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

VKbWIcY.exe

Path C:\Windows\System\VKbWIcY.exe
Size 2.8MB
SHA256 247687761dbfa705964fd5f521351f6e1bcc5b84502bbec2707a8dc82ea35f01
MD5 ff719289d86d05db8bae4d7066756a6d
SHA1 8e70ff1611aec4374e1db910926b5fd75ef6e2e2
SHA512 b8e9c14163370143e15e1641d665022469fddc4ad9a218e41abc1c55caae174313c6b11ed2e6ad7578fd810a89aa7f428697db02d4e391af28f85e684dfe18c3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetC:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

WNiYMOq.exe

Path C:\Windows\System\WNiYMOq.exe
Size 2.8MB
SHA256 0f9e2df2ddd791794e91848c5bdca521a1f48a6cbf759cf4bce852ea6d516ff4
MD5 746afff3192d994123cca8a0c251ffee
SHA1 b1063e4894f4bd1aa77e88bd48653955dfc28b11
SHA512 96e04f89acace1c6133c625ed834e57394c1af59eb844e4d6869a461f8ea91e32ad31d55df6398586395a6ce21afd357c54b0a842e09517819d88f3a44a3f28d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nseta:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZgYaHdM.exe

Path C:\Windows\System\ZgYaHdM.exe
Size 2.8MB
SHA256 7c401f50c1f4d15b2e9d51783be5ede928e35c5be043ee8004984686003f08f7
MD5 437db355d0ca0f10744ec0bdc3927c1e
SHA1 1b6e4f1948723b1c4f6a025156c4548a553cb6c7
SHA512 f737bd46a76d43f44de9ad6cbc1876eaf54cd6f382c0def5a7042eae3c1d47fbcd8bd97d4f9231ebb9d5af2e9d07d4918cef691b2193cff94aeea3e766a9173d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset8:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

bNfLlEA.exe

Path C:\Windows\System\bNfLlEA.exe
Size 2.8MB
SHA256 0024ea97d230c386e3204e6aa8590cac5a2d566e612dfadd5f80385fca42fabd
MD5 86fdb92ae51d3cef2eb52e42f892e012
SHA1 337ccbc3f0f6dd881abc5510a60128f11db914f7
SHA512 816321874ac88a195d2e963e8df9629b9d0cc643ea2a910c86fefb23813441e02c42668c6f13f93a1b42da8b31a28798d3f82c568a6252bdcc7bd42436a324be
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetB:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

eECaRgY.exe

Path C:\Windows\System\eECaRgY.exe
Size 2.8MB
SHA256 9df555775bfce67d8924a805b76c9879c131cb6dd9597c1ecfb40f43f5333987
MD5 efd10a82a13acdd06c42a1a165e79c0a
SHA1 ba0c4f603d576795508cea4002c469b37ffd94e2
SHA512 ac7c8ffda825732d9c3aa1709ad0cbe72f31fd97d7d5a31a6499f6d257aee90a7416267ffd1143d4127af6e96ea1931d4370fd98d4bc7db65db396068946f126
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiAbmRu.exe

Path C:\Windows\System\fiAbmRu.exe
Size 2.8MB
SHA256 94e1e3d41dc7868295fdf9295850a99042f18221695a81950fdc2dff224c9f76
MD5 4a8ce11bb7e279966b7535412415f2e9
SHA1 d6add406c73f72d43eeb1158bab4105eaacaeb9d
SHA512 eb2aaad9204a7e27935c8a776f3760ab90cc55bee823e87f667faf10e67e19ec504b3f4bb49f6769462fdd59d8131306eb3afc1283cb290dec612b9675e427db
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetk:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

gVTzFws.exe

Path C:\Windows\System\gVTzFws.exe
Size 2.8MB
SHA256 4db419f22ea1e561e03917b27ad0d6b93c0a22fac3911d78e193e357313449aa
MD5 c49ac7219a7a96d792ca2bcbfc654045
SHA1 8afb2d13f34f4a3d120d97553c1e732cd50711fb
SHA512 c2397c6828894013bcc69931f89800379d2cd99a4efb5e49e6169819d727550eef3ec5336ebb355c4b49277fefa637b93938623e2e11bab3070421861226ad72
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

hHTBBIb.exe

Path C:\Windows\System\hHTBBIb.exe
Size 2.8MB
SHA256 f222418a9c173d72480e3d2a39e79e944a71db84347d0d27be90f4540102ce06
MD5 03f92e84c9430952e3790a41189b3c29
SHA1 67072cc400de3f76a6636cfe9a015d323f9e3bc4
SHA512 33fb07837e065f47d49edd17f0192bf04f6899d18745d61a7e5498b612b85a211300286bc1e03bd42cd50f24dc2a05f2cadb34745ec6e2a41c14183850c039ae
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetc:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

hPmfgXa.exe

Path C:\Windows\System\hPmfgXa.exe
Size 2.8MB
SHA256 7e4631d00aaf84c6d03cab8de411a12b8ae5500e86d06c1b4baae574efc037de
MD5 0f23224f9edcba0dbdc0f4d0c83fabc6
SHA1 17eb045cb303f9e8097894e34cb088c73d813180
SHA512 542b0e77c839929e3fd1c4b77334da858f18131892dc5506d9916c5ed2daa87daf3b1682853d355e1f004dae0fe314910f43ede925a80fbbd4803b959f40026c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kLjowie.exe

Path C:\Windows\System\kLjowie.exe
Size 2.8MB
SHA256 867c2fca60e9d7b69af987e3a48fc98fb5b27d42ec7119e79ef24a03c4845e1e
MD5 fadaefb20559b7c58b40fbe4472b0ad9
SHA1 f0e80bda6dace37fb27f27e8ffc4e3a7c0fe14a3
SHA512 05a175362dcc225701f4b1ce213a32f98d3e987369df4e1a94fadbe0d853a01b84b8d36a406153b99cd3df4e0db8a8f523cfd4f975dec52e2842eb8d2d8521af
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

kzKhnZp.exe

Path C:\Windows\System\kzKhnZp.exe
Size 2.8MB
SHA256 a273d7d2fe973f862d43a5b06ca1776ee690b85baba36a6f141586bb8ca96c79
MD5 78253433ee976ac9d2bd34e726fd3098
SHA1 0373ce2058da76a5d4b4cef7761afff5040043c0
SHA512 7f2f1276d326f6ab7756997816b6d627739a3bb6fe21f83cd3d3eede1e8d263387c0bde680b6795dda1458dd88ae52d730526c88d0abf4feca92c18d5a71e9b0
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset2:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mHTIOoR.exe

Path C:\Windows\System\mHTIOoR.exe
Size 2.8MB
SHA256 15d9be5f2f23c991b64e54dc2fd670ded371f3ff6cf83bcc49a9ac3499c4f166
MD5 44383204c5c6bdf39a95e5dce580edac
SHA1 bd8287aefc5ea13734953baa240cfe1852ae72dc
SHA512 3730f4fe00b4bcb45441f8324a8d692180c3d366370f1216909f307c9add25879601e36d265af02e3891af229744816d11b173e5fd7796934bd0afcd25fca74d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetc:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpEqTXC.exe

Path C:\Windows\System\mpEqTXC.exe
Size 2.8MB
SHA256 5864d76902e852cffdf7be27af22bf92189979b0c4b9e0c5f7c217d5865766ef
MD5 993dd3abbccf38dce037f793080abcf9
SHA1 43c02ee04fcbb015edaf4d7ca3d37050c0e059de
SHA512 bf0d777b633d736f136d1427749287a57baad339c4478f63b3fd81bd22a32bf7142e1df8fef46d9650eebadc5c6d56183ffd7300809a12a6bebf03933e669f80
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjjcRZb.exe

Path C:\Windows\System\tjjcRZb.exe
Size 2.8MB
SHA256 a58196ae1f430fb6e6940b5a72d3a315fa54ab4ce19bf695b94f4ef3cc0e463c
MD5 596e0f923358da8ac6fc5d24fbf11f11
SHA1 f94cb522a2e784f77a743c85d95fc7ae0d4931d5
SHA512 06e2e1f325f81d069490cd7052da540dd9ed0acdc2eb5b02fb08a42341e5139abfbb96f92f141333f69d89120030189a6f9b3913b7ae96db4fed84f53286db75
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetx:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

vmNqjiE.exe

Path C:\Windows\System\vmNqjiE.exe
Size 2.8MB
SHA256 b2e1942886613f1c25437ea311d4562241d0ad5d2be2cdc393f9ff7e9f217dee
MD5 d34caa2bca8a427fa75ddc31c5e69e37
SHA1 10ecb3d2139a5aa8803ee725d9764c72eb49d616
SHA512 8ea5e9301218cb3ed93a3c242db50f6bbcf669581fd4e81ece182f3477857d704170b65c53fc408b0de63f4fc1863bdae9daccb11e3e2f361a687fcb05267ec3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetm:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrWOdKA.exe

Path C:\Windows\System\wrWOdKA.exe
Size 2.8MB
SHA256 3ede91ee6c62d4ca1aa9ec498dc6ac5e18f6fede3f064751b6c3ac4cdcaa9592
MD5 5c39a01ec9c15cc6a9fb5b45944c3642
SHA1 2ea192661b894bc7e4fbd455d695967a10468c7d
SHA512 b189f45258b20b0d42a280756cabac707cf0a69e57024bcd45f3dac7e0bbbb2fb06d2a28f73230e8a1e1e513da5eb3530f31eb1073afbe477dc7e4aa9400606a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

wuDgBbU.exe

Path C:\Windows\System\wuDgBbU.exe
Size 2.8MB
SHA256 6003140d55d8d79512660c6efc99d0439bb9143cff86375876fc8654d1751a82
MD5 d16f9cba4c1e538f446f7c311c7afff2
SHA1 a38c2e7fcb2987f19c24292d97dbea6f35951b8b
SHA512 d8775ecb8447c961c80ca9ef463ab225938bec480234a73315b375deffa13bdd86bd1074d9c3568e63dd02028fe95c4cacb93caf3859eb2ecd4b634ed735e3b9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nset0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

xMDsDrE.exe

Path C:\Windows\System\xMDsDrE.exe
Size 2.8MB
SHA256 cc071926232ab57869ae0a842254c2ed01d53d76071e5f010ed509f94434ecc6
MD5 4706f6a4b0d027f1ce274d407bcd5dda
SHA1 6c3371c729c62153fc62800beee0b8f32bb6f358
SHA512 4f0752c1e7e100e54cdc9ea08e36461b3ceddddbfa550b831ca42be65e44f8e00432b154ee7ccf3ad0bf04e4dad64e9720903dfecc2d06b464b9faebdaeb674b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6Nsetc:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ymXoDpi.exe

Path C:\Windows\System\ymXoDpi.exe
Size 2.8MB
SHA256 b1c637f5451dfbc2e37995c89b0aa32717f9bb46eccade9e323f7ff8790021d6
MD5 2ce96db6a2024854b02864af006fd1e4
SHA1 4906ce595c1364a3c065cd2ded56614586052a14
SHA512 d5eea17f44f4b31e0ccd2093b7f3a40b3050c159f27ae43c5b2288ec13eb6a1b46bf4442833c7b0a7e135950c1c1149553e8c47e19c80e4a4db7f6f789803340
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetD:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

zuQxipk.exe

Path C:\Windows\System\zuQxipk.exe
Size 2.8MB
SHA256 1d6e9965130887947f409ccc152b43d0f41d015ad8dcc63b99f0b7db38c86e53
MD5 7604b7be8fa2ed47ae25aedc0b25d53d
SHA1 838621cc7b5ddf8fcaba2297d39f0f1111022d35
SHA512 4ca1f38967dc3cf37ad1a92bf4997a9104c47a6dd1b8084a7c31331ad3fbcc9cdcb975c6298fedf14ce00f182bc3c0a07d1972842131570650bf6aac8d953208
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsetV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-2054-0x00007FF776040000-0x00007FF776436000-memory.dmp

Download

memory/620-90-0x00007FF776040000-0x00007FF776436000-memory.dmp

Download

memory/720-140-0x00007FF75D320000-0x00007FF75D716000-memory.dmp

Download

memory/720-2049-0x00007FF75D320000-0x00007FF75D716000-memory.dmp

Download

memory/1280-142-0x00007FF614290000-0x00007FF614686000-memory.dmp

Download

memory/1280-2058-0x00007FF614290000-0x00007FF614686000-memory.dmp

Download

memory/1336-137-0x00007FF6A01E0000-0x00007FF6A05D6000-memory.dmp

Download

memory/1336-2068-0x00007FF6A01E0000-0x00007FF6A05D6000-memory.dmp

Download

memory/1440-2060-0x00007FF728190000-0x00007FF728586000-memory.dmp

Download

memory/1440-126-0x00007FF728190000-0x00007FF728586000-memory.dmp

Download

memory/1624-135-0x00007FF6B36D0000-0x00007FF6B3AC6000-memory.dmp

Download

memory/1624-2062-0x00007FF6B36D0000-0x00007FF6B3AC6000-memory.dmp

Download

memory/2008-2056-0x00007FF6E23D0000-0x00007FF6E27C6000-memory.dmp

Download

memory/2008-122-0x00007FF6E23D0000-0x00007FF6E27C6000-memory.dmp

Download

memory/2144-2046-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp

Download

memory/2144-211-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp

Download

memory/2144-2070-0x00007FF6669F0000-0x00007FF666DE6000-memory.dmp

Download

memory/2228-2065-0x00007FF687F00000-0x00007FF6882F6000-memory.dmp

Download

memory/2228-136-0x00007FF687F00000-0x00007FF6882F6000-memory.dmp

Download

memory/3244-2047-0x00007FF6E6330000-0x00007FF6E6726000-memory.dmp

Download

memory/3244-18-0x00007FF6E6330000-0x00007FF6E6726000-memory.dmp

Download

memory/3280-2064-0x00007FF7ECBE0000-0x00007FF7ECFD6000-memory.dmp

Download

memory/3280-145-0x00007FF7ECBE0000-0x00007FF7ECFD6000-memory.dmp

Download

memory/3516-2061-0x00007FF6CC360000-0x00007FF6CC756000-memory.dmp

Download

memory/3516-123-0x00007FF6CC360000-0x00007FF6CC756000-memory.dmp

Download

memory/3720-138-0x00007FF75C030000-0x00007FF75C426000-memory.dmp

Download

memory/3720-2067-0x00007FF75C030000-0x00007FF75C426000-memory.dmp

Download

memory/3724-141-0x00007FF73D620000-0x00007FF73DA16000-memory.dmp

Download

memory/3724-2050-0x00007FF73D620000-0x00007FF73DA16000-memory.dmp

Download

memory/4132-144-0x00007FF7EB1A0000-0x00007FF7EB596000-memory.dmp

Download

memory/4132-2063-0x00007FF7EB1A0000-0x00007FF7EB596000-memory.dmp

Download

memory/4236-2059-0x00007FF60EA80000-0x00007FF60EE76000-memory.dmp

Download

memory/4236-143-0x00007FF60EA80000-0x00007FF60EE76000-memory.dmp

Download

memory/4324-2053-0x00007FF62DD00000-0x00007FF62E0F6000-memory.dmp

Download

memory/4324-93-0x00007FF62DD00000-0x00007FF62E0F6000-memory.dmp

Download

memory/4356-114-0x00007FF674A10000-0x00007FF674E06000-memory.dmp

Download

memory/4356-2055-0x00007FF674A10000-0x00007FF674E06000-memory.dmp

Download

memory/4372-2069-0x00007FF7147F0000-0x00007FF714BE6000-memory.dmp

Download

memory/4372-178-0x00007FF7147F0000-0x00007FF714BE6000-memory.dmp

Download

memory/4396-2066-0x00007FF66C340000-0x00007FF66C736000-memory.dmp

Download

memory/4396-146-0x00007FF66C340000-0x00007FF66C736000-memory.dmp

Download

memory/4524-97-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp

Download

memory/4524-2057-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp

Download

memory/4524-2045-0x00007FF6DD940000-0x00007FF6DDD36000-memory.dmp

Download

memory/4552-19-0x00007FFD30853000-0x00007FFD30855000-memory.dmp

Download

memory/4552-53-0x000002477D2D0000-0x000002477D2F2000-memory.dmp

Download

memory/4552-2043-0x00007FFD30850000-0x00007FFD31311000-memory.dmp

Download

memory/4552-2044-0x00007FFD30853000-0x00007FFD30855000-memory.dmp

Download

memory/4552-139-0x00007FFD30850000-0x00007FFD31311000-memory.dmp

Download

memory/4552-147-0x000002477E840000-0x000002477EFE6000-memory.dmp

Download

memory/4552-46-0x00007FFD30850000-0x00007FFD31311000-memory.dmp

Download

memory/4852-2048-0x00007FF7C4A50000-0x00007FF7C4E46000-memory.dmp

Download

memory/4852-65-0x00007FF7C4A50000-0x00007FF7C4E46000-memory.dmp

Download

memory/4924-92-0x00007FF62E660000-0x00007FF62EA56000-memory.dmp

Download

memory/4924-2052-0x00007FF62E660000-0x00007FF62EA56000-memory.dmp

Download

memory/5000-2051-0x00007FF607650000-0x00007FF607A46000-memory.dmp

Download

memory/5000-77-0x00007FF607650000-0x00007FF607A46000-memory.dmp

Download

memory/5004-0-0x00007FF7A5720000-0x00007FF7A5B16000-memory.dmp

Download

memory/5004-1-0x000001A99C8F0000-0x000001A99C900000-memory.dmp

Download