xmrig | ece2ee2361379c0fc33411f2aa539b9cb1d6a9bbf2607a3db030e1974a3c098f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
Size 1.7MB
Sample240526-2falsaed7t
SHA256 ece2ee2361379c0fc33411f2aa539b9cb1d6a9bbf2607a3db030e1974a3c098f
MD5 0807bc3b24b934def27efdda7eb2b660
SHA1 19bce01cf7683d1ffa0e4e6be3621b4f52493a66
SHA512 5d443d144b9a676029ac48f30169f9ce0c8603cfd23b98942a83144c2e7243d0ec56fbe2705c88ae1350f254b81fcc3666b12a98f8490103ed6a63e8c7f7ad93
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw8:NABl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4884-99-0x00007FF64B9E0000-0x00007FF64BDD2000-memory.dmp	xmrig
behavioral2/memory/3104-309-0x00007FF62CF10000-0x00007FF62D302000-memory.dmp	xmrig
behavioral2/memory/3148-346-0x00007FF7B8600000-0x00007FF7B89F2000-memory.dmp	xmrig
behavioral2/memory/4212-345-0x00007FF66C1B0000-0x00007FF66C5A2000-memory.dmp	xmrig
behavioral2/memory/1568-360-0x00007FF7A0030000-0x00007FF7A0422000-memory.dmp	xmrig
behavioral2/memory/2256-369-0x00007FF76FC90000-0x00007FF770082000-memory.dmp	xmrig
behavioral2/memory/3188-378-0x00007FF711D30000-0x00007FF712122000-memory.dmp	xmrig
behavioral2/memory/860-392-0x00007FF6D6410000-0x00007FF6D6802000-memory.dmp	xmrig
behavioral2/memory/2788-399-0x00007FF7267C0000-0x00007FF726BB2000-memory.dmp	xmrig
behavioral2/memory/1148-384-0x00007FF6BD2D0000-0x00007FF6BD6C2000-memory.dmp	xmrig
behavioral2/memory/3568-342-0x00007FF68A6D0000-0x00007FF68AAC2000-memory.dmp	xmrig
behavioral2/memory/3916-325-0x00007FF7DF110000-0x00007FF7DF502000-memory.dmp	xmrig
behavioral2/memory/3776-321-0x00007FF649190000-0x00007FF649582000-memory.dmp	xmrig
behavioral2/memory/3356-317-0x00007FF7C3B30000-0x00007FF7C3F22000-memory.dmp	xmrig
behavioral2/memory/3120-313-0x00007FF7AE890000-0x00007FF7AEC82000-memory.dmp	xmrig
behavioral2/memory/4600-105-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	xmrig
behavioral2/memory/3736-96-0x00007FF668110000-0x00007FF668502000-memory.dmp	xmrig
behavioral2/memory/2496-95-0x00007FF754390000-0x00007FF754782000-memory.dmp	xmrig
behavioral2/memory/548-91-0x00007FF6AEB00000-0x00007FF6AEEF2000-memory.dmp	xmrig
behavioral2/memory/536-86-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp	xmrig
behavioral2/memory/4740-85-0x00007FF623380000-0x00007FF623772000-memory.dmp	xmrig
behavioral2/memory/2600-83-0x00007FF7532B0000-0x00007FF7536A2000-memory.dmp	xmrig
behavioral2/memory/1728-76-0x00007FF7BE960000-0x00007FF7BED52000-memory.dmp	xmrig
behavioral2/memory/1276-70-0x00007FF62F630000-0x00007FF62FA22000-memory.dmp	xmrig
behavioral2/memory/1276-2694-0x00007FF62F630000-0x00007FF62FA22000-memory.dmp	xmrig
behavioral2/memory/4600-2698-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	xmrig
behavioral2/memory/1728-2697-0x00007FF7BE960000-0x00007FF7BED52000-memory.dmp	xmrig
behavioral2/memory/2600-2701-0x00007FF7532B0000-0x00007FF7536A2000-memory.dmp	xmrig
behavioral2/memory/3104-2702-0x00007FF62CF10000-0x00007FF62D302000-memory.dmp	xmrig
behavioral2/memory/536-2704-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp	xmrig
behavioral2/memory/3356-2715-0x00007FF7C3B30000-0x00007FF7C3F22000-memory.dmp	xmrig
behavioral2/memory/2496-2711-0x00007FF754390000-0x00007FF754782000-memory.dmp	xmrig
behavioral2/memory/3120-2719-0x00007FF7AE890000-0x00007FF7AEC82000-memory.dmp	xmrig
behavioral2/memory/3916-2722-0x00007FF7DF110000-0x00007FF7DF502000-memory.dmp	xmrig
behavioral2/memory/4884-2717-0x00007FF64B9E0000-0x00007FF64BDD2000-memory.dmp	xmrig
behavioral2/memory/3736-2720-0x00007FF668110000-0x00007FF668502000-memory.dmp	xmrig
behavioral2/memory/4740-2713-0x00007FF623380000-0x00007FF623772000-memory.dmp	xmrig
behavioral2/memory/3776-2709-0x00007FF649190000-0x00007FF649582000-memory.dmp	xmrig
behavioral2/memory/548-2706-0x00007FF6AEB00000-0x00007FF6AEEF2000-memory.dmp	xmrig
behavioral2/memory/860-2743-0x00007FF6D6410000-0x00007FF6D6802000-memory.dmp	xmrig
behavioral2/memory/2788-2739-0x00007FF7267C0000-0x00007FF726BB2000-memory.dmp	xmrig
behavioral2/memory/3568-2737-0x00007FF68A6D0000-0x00007FF68AAC2000-memory.dmp	xmrig
behavioral2/memory/1568-2731-0x00007FF7A0030000-0x00007FF7A0422000-memory.dmp	xmrig
behavioral2/memory/2256-2729-0x00007FF76FC90000-0x00007FF770082000-memory.dmp	xmrig
behavioral2/memory/3188-2727-0x00007FF711D30000-0x00007FF712122000-memory.dmp	xmrig
behavioral2/memory/1148-2725-0x00007FF6BD2D0000-0x00007FF6BD6C2000-memory.dmp	xmrig
behavioral2/memory/4212-2735-0x00007FF66C1B0000-0x00007FF66C5A2000-memory.dmp	xmrig
behavioral2/memory/3148-2733-0x00007FF7B8600000-0x00007FF7B89F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	4480	powershell.exe
10	4480	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1276	ojZLMZK.exe
4600	FpqAsmY.exe
1728	WPTIlQG.exe
2600	mOolKBW.exe
4740	tKFrXhn.exe
536	IVOzBJr.exe
548	wgoBaqN.exe
3104	SMWBdOU.exe
2496	uRaPNeL.exe
3736	KmoDGSZ.exe
3120	gMBzUbc.exe
4884	xikTOKv.exe
3356	aKZmkpE.exe
3776	LESDxsa.exe
3916	rgsWXgt.exe
860	qQfFujL.exe
2788	YljWjfw.exe
3568	JJFMuRA.exe
4212	fdzEWYk.exe
3148	PCzhYKP.exe
1568	OaYMNqu.exe
2256	SruPrjD.exe
3188	bFCAMKq.exe
1148	iNixaTQ.exe
1116	yqgNXdA.exe
3204	tbTfcGF.exe
4632	wicDyJI.exe
3252	jBesayx.exe
1596	MabrmEN.exe
4008	oeTUIhb.exe
4332	PzUjYiv.exe
8	tobBgCd.exe
3968	SPgPIIp.exe
4144	DVRjhGk.exe
5116	qhhaTho.exe
3128	SKJLIho.exe
2428	WievMsX.exe
4132	aHhXecb.exe
2608	IFPvnFb.exe
392	BbLBHUf.exe
1312	VhsmFDY.exe
1108	bDBLDrk.exe
4524	rhLVdmP.exe
3272	RnmuaEt.exe
4544	RPDoOlV.exe
4424	UHdRrxZ.exe
1644	LToRBgE.exe
4932	NqFasck.exe
1492	RmzHraC.exe
1548	DhAcXMF.exe
1096	scVYJiM.exe
1172	MYrAbaC.exe
1904	sRWxNvN.exe
1976	UuKrjHy.exe
4164	OrtjDSS.exe
1144	lDuaskF.exe
1424	hdITvhl.exe
3884	PHJLdlr.exe
1972	fqPdwGi.exe
2144	kRCavPX.exe
1580	HPkXwfs.exe
4728	XqGPwzQ.exe
756	yDdOqWV.exe
4888	ZqCzjOS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3628-0-0x00007FF627800000-0x00007FF627BF2000-memory.dmp	upx
behavioral2/files/0x0008000000023403-6.dat	upx
behavioral2/files/0x0007000000023407-10.dat	upx
behavioral2/files/0x0007000000023408-19.dat	upx
behavioral2/files/0x000700000002340b-42.dat	upx
behavioral2/files/0x0007000000023409-43.dat	upx
behavioral2/files/0x000700000002340c-54.dat	upx
behavioral2/files/0x000700000002340a-59.dat	upx
behavioral2/files/0x0007000000023411-68.dat	upx
behavioral2/files/0x000800000002340e-71.dat	upx
behavioral2/files/0x000800000002340d-78.dat	upx
behavioral2/files/0x0007000000023413-84.dat	upx
behavioral2/memory/4884-99-0x00007FF64B9E0000-0x00007FF64BDD2000-memory.dmp	upx
behavioral2/files/0x0007000000023415-106.dat	upx
behavioral2/files/0x0007000000023418-121.dat	upx
behavioral2/files/0x000700000002341a-131.dat	upx
behavioral2/files/0x000700000002341d-146.dat	upx
behavioral2/files/0x000700000002341e-159.dat	upx
behavioral2/files/0x0007000000023422-179.dat	upx
behavioral2/memory/3104-309-0x00007FF62CF10000-0x00007FF62D302000-memory.dmp	upx
behavioral2/memory/3148-346-0x00007FF7B8600000-0x00007FF7B89F2000-memory.dmp	upx
behavioral2/memory/4212-345-0x00007FF66C1B0000-0x00007FF66C5A2000-memory.dmp	upx
behavioral2/memory/1568-360-0x00007FF7A0030000-0x00007FF7A0422000-memory.dmp	upx
behavioral2/memory/2256-369-0x00007FF76FC90000-0x00007FF770082000-memory.dmp	upx
behavioral2/memory/3188-378-0x00007FF711D30000-0x00007FF712122000-memory.dmp	upx
behavioral2/memory/860-392-0x00007FF6D6410000-0x00007FF6D6802000-memory.dmp	upx
behavioral2/memory/2788-399-0x00007FF7267C0000-0x00007FF726BB2000-memory.dmp	upx
behavioral2/memory/1148-384-0x00007FF6BD2D0000-0x00007FF6BD6C2000-memory.dmp	upx
behavioral2/memory/3568-342-0x00007FF68A6D0000-0x00007FF68AAC2000-memory.dmp	upx
behavioral2/memory/3916-325-0x00007FF7DF110000-0x00007FF7DF502000-memory.dmp	upx
behavioral2/memory/3776-321-0x00007FF649190000-0x00007FF649582000-memory.dmp	upx
behavioral2/memory/3356-317-0x00007FF7C3B30000-0x00007FF7C3F22000-memory.dmp	upx
behavioral2/memory/3120-313-0x00007FF7AE890000-0x00007FF7AEC82000-memory.dmp	upx
behavioral2/files/0x0007000000023425-186.dat	upx
behavioral2/files/0x0007000000023423-184.dat	upx
behavioral2/files/0x0007000000023424-181.dat	upx
behavioral2/files/0x0007000000023421-174.dat	upx
behavioral2/files/0x0007000000023420-169.dat	upx
behavioral2/files/0x000700000002341f-164.dat	upx
behavioral2/files/0x000700000002341c-149.dat	upx
behavioral2/files/0x000700000002341b-144.dat	upx
behavioral2/files/0x0007000000023419-134.dat	upx
behavioral2/files/0x0007000000023417-124.dat	upx
behavioral2/files/0x0007000000023416-119.dat	upx
behavioral2/files/0x0008000000023404-109.dat	upx
behavioral2/memory/4600-105-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	upx
behavioral2/files/0x0007000000023414-101.dat	upx
behavioral2/memory/3736-96-0x00007FF668110000-0x00007FF668502000-memory.dmp	upx
behavioral2/memory/2496-95-0x00007FF754390000-0x00007FF754782000-memory.dmp	upx
behavioral2/memory/548-91-0x00007FF6AEB00000-0x00007FF6AEEF2000-memory.dmp	upx
behavioral2/files/0x0007000000023412-87.dat	upx
behavioral2/memory/536-86-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp	upx
behavioral2/memory/4740-85-0x00007FF623380000-0x00007FF623772000-memory.dmp	upx
behavioral2/memory/2600-83-0x00007FF7532B0000-0x00007FF7536A2000-memory.dmp	upx
behavioral2/memory/1728-76-0x00007FF7BE960000-0x00007FF7BED52000-memory.dmp	upx
behavioral2/memory/1276-70-0x00007FF62F630000-0x00007FF62FA22000-memory.dmp	upx
behavioral2/files/0x0007000000023410-62.dat	upx
behavioral2/files/0x000700000002340f-49.dat	upx
behavioral2/memory/1276-2694-0x00007FF62F630000-0x00007FF62FA22000-memory.dmp	upx
behavioral2/memory/4600-2698-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp	upx
behavioral2/memory/1728-2697-0x00007FF7BE960000-0x00007FF7BED52000-memory.dmp	upx
behavioral2/memory/2600-2701-0x00007FF7532B0000-0x00007FF7536A2000-memory.dmp	upx
behavioral2/memory/3104-2702-0x00007FF62CF10000-0x00007FF62D302000-memory.dmp	upx
behavioral2/memory/536-2704-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HizkFtP.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\zhnPtme.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\mOKRafq.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\OHLVExZ.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\IitCxGo.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\MCHfMSG.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\oBqZyOq.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\YjxcnNs.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\NsAjEIh.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\AgZbiUY.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\bzsZlhe.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\EthbEje.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\FNkMbaZ.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\LCuNrXR.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\OAZnykw.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\cLNjitf.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\mdmyDgD.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\YqelAtB.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\SViNrOF.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\YvwDWOw.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\NRTKaTm.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\VgSGKpJ.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\IzjKgkV.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\WPTIlQG.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\GTIKwyJ.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\hLEbuAx.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\mYcpvDw.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\zDHSLeX.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\pZlERUo.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\GGHDzGw.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\guoaTSz.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\qsbtoFV.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\NrfLPGw.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\FyFoLTM.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\WiUFBPp.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\SMWBdOU.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\OjIipwS.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\rrVSyJd.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\YMBPOQs.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\hMHnprW.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\IXJnDgz.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\utYiXuV.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\YBKeqxN.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\RfKyEji.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\maRNwwo.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\tgkuskx.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\PRkKybd.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\qLMKxKW.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\QzZfIVB.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\QYYkhZi.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\wRlWlmb.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\VFOxEml.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\UvIPxSO.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\HoKLExO.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\TGGEFiV.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\jXEstDK.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\FqxHZJf.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\YoWTKiS.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\qXICaJm.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\muUNgrE.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\uEwkGyw.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\UWZzmJY.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\zDtaXrg.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
File created	C:\Windows\System\ucoGHfx.exe	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeLockMemoryPrivilege	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4480	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	83
PID 3628 wrote to memory of 4480	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	83
PID 3628 wrote to memory of 1276	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	84
PID 3628 wrote to memory of 1276	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	84
PID 3628 wrote to memory of 4600	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	85
PID 3628 wrote to memory of 4600	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	85
PID 3628 wrote to memory of 1728	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	86
PID 3628 wrote to memory of 1728	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	86
PID 3628 wrote to memory of 2600	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	87
PID 3628 wrote to memory of 2600	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	87
PID 3628 wrote to memory of 4740	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	88
PID 3628 wrote to memory of 4740	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	88
PID 3628 wrote to memory of 536	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	89
PID 3628 wrote to memory of 536	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	89
PID 3628 wrote to memory of 548	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	90
PID 3628 wrote to memory of 548	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	90
PID 3628 wrote to memory of 3104	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	91
PID 3628 wrote to memory of 3104	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	91
PID 3628 wrote to memory of 2496	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	92
PID 3628 wrote to memory of 2496	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	92
PID 3628 wrote to memory of 3736	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	93
PID 3628 wrote to memory of 3736	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	93
PID 3628 wrote to memory of 3120	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	94
PID 3628 wrote to memory of 3120	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	94
PID 3628 wrote to memory of 4884	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	95
PID 3628 wrote to memory of 4884	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	95
PID 3628 wrote to memory of 3356	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	96
PID 3628 wrote to memory of 3356	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	96
PID 3628 wrote to memory of 3776	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	97
PID 3628 wrote to memory of 3776	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	97
PID 3628 wrote to memory of 3916	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	98
PID 3628 wrote to memory of 3916	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	98
PID 3628 wrote to memory of 860	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	99
PID 3628 wrote to memory of 860	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	99
PID 3628 wrote to memory of 2788	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	100
PID 3628 wrote to memory of 2788	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	100
PID 3628 wrote to memory of 3568	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	101
PID 3628 wrote to memory of 3568	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	101
PID 3628 wrote to memory of 4212	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	102
PID 3628 wrote to memory of 4212	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	102
PID 3628 wrote to memory of 3148	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	103
PID 3628 wrote to memory of 3148	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	103
PID 3628 wrote to memory of 1568	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	104
PID 3628 wrote to memory of 1568	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	104
PID 3628 wrote to memory of 2256	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	105
PID 3628 wrote to memory of 2256	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	105
PID 3628 wrote to memory of 3188	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	106
PID 3628 wrote to memory of 3188	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	106
PID 3628 wrote to memory of 1148	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	107
PID 3628 wrote to memory of 1148	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	107
PID 3628 wrote to memory of 1116	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	108
PID 3628 wrote to memory of 1116	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	108
PID 3628 wrote to memory of 3204	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	109
PID 3628 wrote to memory of 3204	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	109
PID 3628 wrote to memory of 4632	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	110
PID 3628 wrote to memory of 4632	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	110
PID 3628 wrote to memory of 3252	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	111
PID 3628 wrote to memory of 3252	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	111
PID 3628 wrote to memory of 1596	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	112
PID 3628 wrote to memory of 1596	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	112
PID 3628 wrote to memory of 4008	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	113
PID 3628 wrote to memory of 4008	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	113
PID 3628 wrote to memory of 4332	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	114
PID 3628 wrote to memory of 4332	3628	0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0807bc3b24b934def27efdda7eb2b660_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4480" "2952" "2892" "2956" "0" "0" "2960" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12100
- C:\Windows\System\ojZLMZK.exe
  C:\Windows\System\ojZLMZK.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\FpqAsmY.exe
  C:\Windows\System\FpqAsmY.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\WPTIlQG.exe
  C:\Windows\System\WPTIlQG.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\mOolKBW.exe
  C:\Windows\System\mOolKBW.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tKFrXhn.exe
  C:\Windows\System\tKFrXhn.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\IVOzBJr.exe
  C:\Windows\System\IVOzBJr.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\wgoBaqN.exe
  C:\Windows\System\wgoBaqN.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\SMWBdOU.exe
  C:\Windows\System\SMWBdOU.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\uRaPNeL.exe
  C:\Windows\System\uRaPNeL.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\KmoDGSZ.exe
  C:\Windows\System\KmoDGSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\gMBzUbc.exe
  C:\Windows\System\gMBzUbc.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\xikTOKv.exe
  C:\Windows\System\xikTOKv.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\aKZmkpE.exe
  C:\Windows\System\aKZmkpE.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\LESDxsa.exe
  C:\Windows\System\LESDxsa.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\rgsWXgt.exe
  C:\Windows\System\rgsWXgt.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\qQfFujL.exe
  C:\Windows\System\qQfFujL.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\YljWjfw.exe
  C:\Windows\System\YljWjfw.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\JJFMuRA.exe
  C:\Windows\System\JJFMuRA.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\fdzEWYk.exe
  C:\Windows\System\fdzEWYk.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\PCzhYKP.exe
  C:\Windows\System\PCzhYKP.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\OaYMNqu.exe
  C:\Windows\System\OaYMNqu.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\SruPrjD.exe
  C:\Windows\System\SruPrjD.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\bFCAMKq.exe
  C:\Windows\System\bFCAMKq.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\iNixaTQ.exe
  C:\Windows\System\iNixaTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\yqgNXdA.exe
  C:\Windows\System\yqgNXdA.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\tbTfcGF.exe
  C:\Windows\System\tbTfcGF.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\wicDyJI.exe
  C:\Windows\System\wicDyJI.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\jBesayx.exe
  C:\Windows\System\jBesayx.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\MabrmEN.exe
  C:\Windows\System\MabrmEN.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\oeTUIhb.exe
  C:\Windows\System\oeTUIhb.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\PzUjYiv.exe
  C:\Windows\System\PzUjYiv.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\tobBgCd.exe
  C:\Windows\System\tobBgCd.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\SPgPIIp.exe
  C:\Windows\System\SPgPIIp.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\DVRjhGk.exe
  C:\Windows\System\DVRjhGk.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\qhhaTho.exe
  C:\Windows\System\qhhaTho.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\SKJLIho.exe
  C:\Windows\System\SKJLIho.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\WievMsX.exe
  C:\Windows\System\WievMsX.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\aHhXecb.exe
  C:\Windows\System\aHhXecb.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\IFPvnFb.exe
  C:\Windows\System\IFPvnFb.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\BbLBHUf.exe
  C:\Windows\System\BbLBHUf.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\VhsmFDY.exe
  C:\Windows\System\VhsmFDY.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\bDBLDrk.exe
  C:\Windows\System\bDBLDrk.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\rhLVdmP.exe
  C:\Windows\System\rhLVdmP.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\RnmuaEt.exe
  C:\Windows\System\RnmuaEt.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\RPDoOlV.exe
  C:\Windows\System\RPDoOlV.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\UHdRrxZ.exe
  C:\Windows\System\UHdRrxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\LToRBgE.exe
  C:\Windows\System\LToRBgE.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\NqFasck.exe
  C:\Windows\System\NqFasck.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\RmzHraC.exe
  C:\Windows\System\RmzHraC.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\DhAcXMF.exe
  C:\Windows\System\DhAcXMF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\scVYJiM.exe
  C:\Windows\System\scVYJiM.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\MYrAbaC.exe
  C:\Windows\System\MYrAbaC.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\sRWxNvN.exe
  C:\Windows\System\sRWxNvN.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\UuKrjHy.exe
  C:\Windows\System\UuKrjHy.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\OrtjDSS.exe
  C:\Windows\System\OrtjDSS.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\lDuaskF.exe
  C:\Windows\System\lDuaskF.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\hdITvhl.exe
  C:\Windows\System\hdITvhl.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\PHJLdlr.exe
  C:\Windows\System\PHJLdlr.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\fqPdwGi.exe
  C:\Windows\System\fqPdwGi.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\kRCavPX.exe
  C:\Windows\System\kRCavPX.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\HPkXwfs.exe
  C:\Windows\System\HPkXwfs.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\XqGPwzQ.exe
  C:\Windows\System\XqGPwzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\yDdOqWV.exe
  C:\Windows\System\yDdOqWV.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\ZqCzjOS.exe
  C:\Windows\System\ZqCzjOS.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\QSjtiQB.exe
  C:\Windows\System\QSjtiQB.exe
  2⤵
  PID:3748
- C:\Windows\System\aicdTJM.exe
  C:\Windows\System\aicdTJM.exe
  2⤵
  PID:1396
- C:\Windows\System\zJILCiy.exe
  C:\Windows\System\zJILCiy.exe
  2⤵
  PID:4704
- C:\Windows\System\CMupaie.exe
  C:\Windows\System\CMupaie.exe
  2⤵
  PID:1640
- C:\Windows\System\KBWlHRW.exe
  C:\Windows\System\KBWlHRW.exe
  2⤵
  PID:4656
- C:\Windows\System\NZHsYNi.exe
  C:\Windows\System\NZHsYNi.exe
  2⤵
  PID:4940
- C:\Windows\System\UbdVoxk.exe
  C:\Windows\System\UbdVoxk.exe
  2⤵
  PID:3956
- C:\Windows\System\yZJfVXd.exe
  C:\Windows\System\yZJfVXd.exe
  2⤵
  PID:5084
- C:\Windows\System\pdnTqOy.exe
  C:\Windows\System\pdnTqOy.exe
  2⤵
  PID:4196
- C:\Windows\System\ywMQlVJ.exe
  C:\Windows\System\ywMQlVJ.exe
  2⤵
  PID:4640
- C:\Windows\System\OjkCLIZ.exe
  C:\Windows\System\OjkCLIZ.exe
  2⤵
  PID:2052
- C:\Windows\System\yhneiCK.exe
  C:\Windows\System\yhneiCK.exe
  2⤵
  PID:4140
- C:\Windows\System\WtEONwH.exe
  C:\Windows\System\WtEONwH.exe
  2⤵
  PID:988
- C:\Windows\System\CttqSEy.exe
  C:\Windows\System\CttqSEy.exe
  2⤵
  PID:4056
- C:\Windows\System\RyyXHTI.exe
  C:\Windows\System\RyyXHTI.exe
  2⤵
  PID:1780
- C:\Windows\System\anbQFmT.exe
  C:\Windows\System\anbQFmT.exe
  2⤵
  PID:3688
- C:\Windows\System\gICuiAj.exe
  C:\Windows\System\gICuiAj.exe
  2⤵
  PID:424
- C:\Windows\System\QMsWwRS.exe
  C:\Windows\System\QMsWwRS.exe
  2⤵
  PID:1392
- C:\Windows\System\UvqSvto.exe
  C:\Windows\System\UvqSvto.exe
  2⤵
  PID:2972
- C:\Windows\System\XjwOEOm.exe
  C:\Windows\System\XjwOEOm.exe
  2⤵
  PID:3760
- C:\Windows\System\gmdqXde.exe
  C:\Windows\System\gmdqXde.exe
  2⤵
  PID:2572
- C:\Windows\System\tncSDig.exe
  C:\Windows\System\tncSDig.exe
  2⤵
  PID:2232
- C:\Windows\System\iQBksZz.exe
  C:\Windows\System\iQBksZz.exe
  2⤵
  PID:3408
- C:\Windows\System\FUTfwxD.exe
  C:\Windows\System\FUTfwxD.exe
  2⤵
  PID:3448
- C:\Windows\System\jvHxsIa.exe
  C:\Windows\System\jvHxsIa.exe
  2⤵
  PID:4540
- C:\Windows\System\cUZWKXk.exe
  C:\Windows\System\cUZWKXk.exe
  2⤵
  PID:5140
- C:\Windows\System\ZkGfoQA.exe
  C:\Windows\System\ZkGfoQA.exe
  2⤵
  PID:5156
- C:\Windows\System\jWPWWmK.exe
  C:\Windows\System\jWPWWmK.exe
  2⤵
  PID:5184
- C:\Windows\System\ybjpBHF.exe
  C:\Windows\System\ybjpBHF.exe
  2⤵
  PID:5204
- C:\Windows\System\qTjCsVY.exe
  C:\Windows\System\qTjCsVY.exe
  2⤵
  PID:5220
- C:\Windows\System\OOHShfv.exe
  C:\Windows\System\OOHShfv.exe
  2⤵
  PID:5320
- C:\Windows\System\ixEMkVy.exe
  C:\Windows\System\ixEMkVy.exe
  2⤵
  PID:5376
- C:\Windows\System\aXefAlw.exe
  C:\Windows\System\aXefAlw.exe
  2⤵
  PID:5432
- C:\Windows\System\qknLHIN.exe
  C:\Windows\System\qknLHIN.exe
  2⤵
  PID:5448
- C:\Windows\System\VOiYOni.exe
  C:\Windows\System\VOiYOni.exe
  2⤵
  PID:5492
- C:\Windows\System\HSjplgU.exe
  C:\Windows\System\HSjplgU.exe
  2⤵
  PID:5532
- C:\Windows\System\etVeeNN.exe
  C:\Windows\System\etVeeNN.exe
  2⤵
  PID:5552
- C:\Windows\System\wxpyuMK.exe
  C:\Windows\System\wxpyuMK.exe
  2⤵
  PID:5572
- C:\Windows\System\QUaLcOh.exe
  C:\Windows\System\QUaLcOh.exe
  2⤵
  PID:5624
- C:\Windows\System\nWmSegq.exe
  C:\Windows\System\nWmSegq.exe
  2⤵
  PID:5656
- C:\Windows\System\GZzrSTK.exe
  C:\Windows\System\GZzrSTK.exe
  2⤵
  PID:5672
- C:\Windows\System\IyXhqLH.exe
  C:\Windows\System\IyXhqLH.exe
  2⤵
  PID:5688
- C:\Windows\System\dElFopM.exe
  C:\Windows\System\dElFopM.exe
  2⤵
  PID:5704
- C:\Windows\System\iaiVfxz.exe
  C:\Windows\System\iaiVfxz.exe
  2⤵
  PID:5752
- C:\Windows\System\IYiwZLS.exe
  C:\Windows\System\IYiwZLS.exe
  2⤵
  PID:5804
- C:\Windows\System\yXRAnqP.exe
  C:\Windows\System\yXRAnqP.exe
  2⤵
  PID:5840
- C:\Windows\System\tHygnFm.exe
  C:\Windows\System\tHygnFm.exe
  2⤵
  PID:5872
- C:\Windows\System\lSXjgBE.exe
  C:\Windows\System\lSXjgBE.exe
  2⤵
  PID:5904
- C:\Windows\System\OmxoVla.exe
  C:\Windows\System\OmxoVla.exe
  2⤵
  PID:5924
- C:\Windows\System\HTLVHft.exe
  C:\Windows\System\HTLVHft.exe
  2⤵
  PID:5952
- C:\Windows\System\vpdtFeO.exe
  C:\Windows\System\vpdtFeO.exe
  2⤵
  PID:5976
- C:\Windows\System\VqfXsGl.exe
  C:\Windows\System\VqfXsGl.exe
  2⤵
  PID:6008
- C:\Windows\System\xqBjXsU.exe
  C:\Windows\System\xqBjXsU.exe
  2⤵
  PID:6024
- C:\Windows\System\IAXUVBj.exe
  C:\Windows\System\IAXUVBj.exe
  2⤵
  PID:6044
- C:\Windows\System\cOlyzWR.exe
  C:\Windows\System\cOlyzWR.exe
  2⤵
  PID:6064
- C:\Windows\System\qxvsxKV.exe
  C:\Windows\System\qxvsxKV.exe
  2⤵
  PID:6092
- C:\Windows\System\BOZmYYZ.exe
  C:\Windows\System\BOZmYYZ.exe
  2⤵
  PID:6120
- C:\Windows\System\OBlrYLN.exe
  C:\Windows\System\OBlrYLN.exe
  2⤵
  PID:3280
- C:\Windows\System\cwGyaPl.exe
  C:\Windows\System\cwGyaPl.exe
  2⤵
  PID:4484
- C:\Windows\System\rlIEHMu.exe
  C:\Windows\System\rlIEHMu.exe
  2⤵
  PID:5124
- C:\Windows\System\gWgnWBe.exe
  C:\Windows\System\gWgnWBe.exe
  2⤵
  PID:5212
- C:\Windows\System\AXzFIfE.exe
  C:\Windows\System\AXzFIfE.exe
  2⤵
  PID:5292
- C:\Windows\System\yzUzVuB.exe
  C:\Windows\System\yzUzVuB.exe
  2⤵
  PID:5336
- C:\Windows\System\GboDQfy.exe
  C:\Windows\System\GboDQfy.exe
  2⤵
  PID:5368
- C:\Windows\System\xQgaDso.exe
  C:\Windows\System\xQgaDso.exe
  2⤵
  PID:900
- C:\Windows\System\bIfkovD.exe
  C:\Windows\System\bIfkovD.exe
  2⤵
  PID:2412
- C:\Windows\System\bEtBcjl.exe
  C:\Windows\System\bEtBcjl.exe
  2⤵
  PID:5464
- C:\Windows\System\kCHCJPD.exe
  C:\Windows\System\kCHCJPD.exe
  2⤵
  PID:5480
- C:\Windows\System\KOfxJYc.exe
  C:\Windows\System\KOfxJYc.exe
  2⤵
  PID:5520
- C:\Windows\System\ssyFxTm.exe
  C:\Windows\System\ssyFxTm.exe
  2⤵
  PID:4084
- C:\Windows\System\yhxGBCk.exe
  C:\Windows\System\yhxGBCk.exe
  2⤵
  PID:316
- C:\Windows\System\XfxvSot.exe
  C:\Windows\System\XfxvSot.exe
  2⤵
  PID:5648
- C:\Windows\System\RVzEEjK.exe
  C:\Windows\System\RVzEEjK.exe
  2⤵
  PID:5668
- C:\Windows\System\TPAPCff.exe
  C:\Windows\System\TPAPCff.exe
  2⤵
  PID:5716
- C:\Windows\System\kKAjLNB.exe
  C:\Windows\System\kKAjLNB.exe
  2⤵
  PID:5772
- C:\Windows\System\BoRdvoa.exe
  C:\Windows\System\BoRdvoa.exe
  2⤵
  PID:5892
- C:\Windows\System\GQXxfaF.exe
  C:\Windows\System\GQXxfaF.exe
  2⤵
  PID:5968
- C:\Windows\System\vpeVTWu.exe
  C:\Windows\System\vpeVTWu.exe
  2⤵
  PID:6000
- C:\Windows\System\IQDwdbP.exe
  C:\Windows\System\IQDwdbP.exe
  2⤵
  PID:3584
- C:\Windows\System\OjIipwS.exe
  C:\Windows\System\OjIipwS.exe
  2⤵
  PID:1956
- C:\Windows\System\jpLSSeL.exe
  C:\Windows\System\jpLSSeL.exe
  2⤵
  PID:5176
- C:\Windows\System\OhcZKsX.exe
  C:\Windows\System\OhcZKsX.exe
  2⤵
  PID:4116
- C:\Windows\System\APquGFm.exe
  C:\Windows\System\APquGFm.exe
  2⤵
  PID:1700
- C:\Windows\System\oaQrjUH.exe
  C:\Windows\System\oaQrjUH.exe
  2⤵
  PID:5544
- C:\Windows\System\dwzmasA.exe
  C:\Windows\System\dwzmasA.exe
  2⤵
  PID:5684
- C:\Windows\System\VigFjCB.exe
  C:\Windows\System\VigFjCB.exe
  2⤵
  PID:5932
- C:\Windows\System\zTmDAtd.exe
  C:\Windows\System\zTmDAtd.exe
  2⤵
  PID:5988
- C:\Windows\System\TsYEjHM.exe
  C:\Windows\System\TsYEjHM.exe
  2⤵
  PID:6116
- C:\Windows\System\uzJgogE.exe
  C:\Windows\System\uzJgogE.exe
  2⤵
  PID:1576
- C:\Windows\System\kXLKGLh.exe
  C:\Windows\System\kXLKGLh.exe
  2⤵
  PID:5444
- C:\Windows\System\lvAKzHD.exe
  C:\Windows\System\lvAKzHD.exe
  2⤵
  PID:5604
- C:\Windows\System\ANKoxfU.exe
  C:\Windows\System\ANKoxfU.exe
  2⤵
  PID:4492
- C:\Windows\System\wBzkyyg.exe
  C:\Windows\System\wBzkyyg.exe
  2⤵
  PID:6076
- C:\Windows\System\JYqoIqq.exe
  C:\Windows\System\JYqoIqq.exe
  2⤵
  PID:3552
- C:\Windows\System\jPNhyhM.exe
  C:\Windows\System\jPNhyhM.exe
  2⤵
  PID:4376
- C:\Windows\System\uiUpaPa.exe
  C:\Windows\System\uiUpaPa.exe
  2⤵
  PID:6184
- C:\Windows\System\gzWLXkz.exe
  C:\Windows\System\gzWLXkz.exe
  2⤵
  PID:6208
- C:\Windows\System\UVjhiWC.exe
  C:\Windows\System\UVjhiWC.exe
  2⤵
  PID:6232
- C:\Windows\System\XIMNwre.exe
  C:\Windows\System\XIMNwre.exe
  2⤵
  PID:6256
- C:\Windows\System\exrcmcm.exe
  C:\Windows\System\exrcmcm.exe
  2⤵
  PID:6276
- C:\Windows\System\OuADgmu.exe
  C:\Windows\System\OuADgmu.exe
  2⤵
  PID:6296
- C:\Windows\System\ciUFiMi.exe
  C:\Windows\System\ciUFiMi.exe
  2⤵
  PID:6336
- C:\Windows\System\cVrUljr.exe
  C:\Windows\System\cVrUljr.exe
  2⤵
  PID:6384
- C:\Windows\System\uOOFFFv.exe
  C:\Windows\System\uOOFFFv.exe
  2⤵
  PID:6408
- C:\Windows\System\hEwzfpc.exe
  C:\Windows\System\hEwzfpc.exe
  2⤵
  PID:6428
- C:\Windows\System\LCuNrXR.exe
  C:\Windows\System\LCuNrXR.exe
  2⤵
  PID:6480
- C:\Windows\System\WUTXBQr.exe
  C:\Windows\System\WUTXBQr.exe
  2⤵
  PID:6516
- C:\Windows\System\vklwTEZ.exe
  C:\Windows\System\vklwTEZ.exe
  2⤵
  PID:6536
- C:\Windows\System\yuFmTcd.exe
  C:\Windows\System\yuFmTcd.exe
  2⤵
  PID:6556
- C:\Windows\System\aTkzkte.exe
  C:\Windows\System\aTkzkte.exe
  2⤵
  PID:6576
- C:\Windows\System\SWqgjvK.exe
  C:\Windows\System\SWqgjvK.exe
  2⤵
  PID:6596
- C:\Windows\System\wLWeFlG.exe
  C:\Windows\System\wLWeFlG.exe
  2⤵
  PID:6636
- C:\Windows\System\eNuyGyX.exe
  C:\Windows\System\eNuyGyX.exe
  2⤵
  PID:6664
- C:\Windows\System\QiQHteD.exe
  C:\Windows\System\QiQHteD.exe
  2⤵
  PID:6684
- C:\Windows\System\BDewTOJ.exe
  C:\Windows\System\BDewTOJ.exe
  2⤵
  PID:6716
- C:\Windows\System\nvmWFSa.exe
  C:\Windows\System\nvmWFSa.exe
  2⤵
  PID:6740
- C:\Windows\System\WsFEjhm.exe
  C:\Windows\System\WsFEjhm.exe
  2⤵
  PID:6788
- C:\Windows\System\JkeBrnU.exe
  C:\Windows\System\JkeBrnU.exe
  2⤵
  PID:6816
- C:\Windows\System\HhIavqK.exe
  C:\Windows\System\HhIavqK.exe
  2⤵
  PID:6856
- C:\Windows\System\uoMQPLk.exe
  C:\Windows\System\uoMQPLk.exe
  2⤵
  PID:6880
- C:\Windows\System\CWMOUpu.exe
  C:\Windows\System\CWMOUpu.exe
  2⤵
  PID:6908
- C:\Windows\System\tYZoMNd.exe
  C:\Windows\System\tYZoMNd.exe
  2⤵
  PID:6936
- C:\Windows\System\tbXmGjn.exe
  C:\Windows\System\tbXmGjn.exe
  2⤵
  PID:6956
- C:\Windows\System\vAYSqVm.exe
  C:\Windows\System\vAYSqVm.exe
  2⤵
  PID:6976
- C:\Windows\System\grtCJnW.exe
  C:\Windows\System\grtCJnW.exe
  2⤵
  PID:7004
- C:\Windows\System\yLUHHtA.exe
  C:\Windows\System\yLUHHtA.exe
  2⤵
  PID:7020
- C:\Windows\System\saNRUay.exe
  C:\Windows\System\saNRUay.exe
  2⤵
  PID:7052
- C:\Windows\System\jdnijCR.exe
  C:\Windows\System\jdnijCR.exe
  2⤵
  PID:7072
- C:\Windows\System\TtbwoJX.exe
  C:\Windows\System\TtbwoJX.exe
  2⤵
  PID:7096
- C:\Windows\System\nMWRCcx.exe
  C:\Windows\System\nMWRCcx.exe
  2⤵
  PID:7116
- C:\Windows\System\XUukInL.exe
  C:\Windows\System\XUukInL.exe
  2⤵
  PID:7140
- C:\Windows\System\ILLfEyp.exe
  C:\Windows\System\ILLfEyp.exe
  2⤵
  PID:6148
- C:\Windows\System\evhUkuc.exe
  C:\Windows\System\evhUkuc.exe
  2⤵
  PID:6180
- C:\Windows\System\gjRXXOr.exe
  C:\Windows\System\gjRXXOr.exe
  2⤵
  PID:6268
- C:\Windows\System\KbsOucd.exe
  C:\Windows\System\KbsOucd.exe
  2⤵
  PID:6328
- C:\Windows\System\TGRtwPH.exe
  C:\Windows\System\TGRtwPH.exe
  2⤵
  PID:6380
- C:\Windows\System\DYekkdv.exe
  C:\Windows\System\DYekkdv.exe
  2⤵
  PID:6468
- C:\Windows\System\qbFUYsg.exe
  C:\Windows\System\qbFUYsg.exe
  2⤵
  PID:6528
- C:\Windows\System\JrNmIFU.exe
  C:\Windows\System\JrNmIFU.exe
  2⤵
  PID:6660
- C:\Windows\System\dWtUTXv.exe
  C:\Windows\System\dWtUTXv.exe
  2⤵
  PID:6656
- C:\Windows\System\WNvWLWx.exe
  C:\Windows\System\WNvWLWx.exe
  2⤵
  PID:6464
- C:\Windows\System\OICgvRP.exe
  C:\Windows\System\OICgvRP.exe
  2⤵
  PID:6832
- C:\Windows\System\pVvqoXn.exe
  C:\Windows\System\pVvqoXn.exe
  2⤵
  PID:6944
- C:\Windows\System\xwdCfWY.exe
  C:\Windows\System\xwdCfWY.exe
  2⤵
  PID:6984
- C:\Windows\System\riXFpxk.exe
  C:\Windows\System\riXFpxk.exe
  2⤵
  PID:7032
- C:\Windows\System\YyxbDmO.exe
  C:\Windows\System\YyxbDmO.exe
  2⤵
  PID:7108
- C:\Windows\System\QjPsvsT.exe
  C:\Windows\System\QjPsvsT.exe
  2⤵
  PID:7088
- C:\Windows\System\nsiwGzz.exe
  C:\Windows\System\nsiwGzz.exe
  2⤵
  PID:6352
- C:\Windows\System\NzlQvqB.exe
  C:\Windows\System\NzlQvqB.exe
  2⤵
  PID:6376
- C:\Windows\System\zoHEakS.exe
  C:\Windows\System\zoHEakS.exe
  2⤵
  PID:6316
- C:\Windows\System\tpbDEuo.exe
  C:\Windows\System\tpbDEuo.exe
  2⤵
  PID:6624
- C:\Windows\System\tZhHEDQ.exe
  C:\Windows\System\tZhHEDQ.exe
  2⤵
  PID:6756
- C:\Windows\System\KKhkEhz.exe
  C:\Windows\System\KKhkEhz.exe
  2⤵
  PID:6916
- C:\Windows\System\ySCVnKN.exe
  C:\Windows\System\ySCVnKN.exe
  2⤵
  PID:7028
- C:\Windows\System\iWzmAxk.exe
  C:\Windows\System\iWzmAxk.exe
  2⤵
  PID:7068
- C:\Windows\System\fQAmUmq.exe
  C:\Windows\System\fQAmUmq.exe
  2⤵
  PID:7036
- C:\Windows\System\mgsVIzu.exe
  C:\Windows\System\mgsVIzu.exe
  2⤵
  PID:6176
- C:\Windows\System\DkkivcJ.exe
  C:\Windows\System\DkkivcJ.exe
  2⤵
  PID:6508
- C:\Windows\System\uUFhDMF.exe
  C:\Windows\System\uUFhDMF.exe
  2⤵
  PID:6836
- C:\Windows\System\LleFxIM.exe
  C:\Windows\System\LleFxIM.exe
  2⤵
  PID:6568
- C:\Windows\System\TFpuGHP.exe
  C:\Windows\System\TFpuGHP.exe
  2⤵
  PID:3276
- C:\Windows\System\CLiBXLF.exe
  C:\Windows\System\CLiBXLF.exe
  2⤵
  PID:3360
- C:\Windows\System\NjmPfrA.exe
  C:\Windows\System\NjmPfrA.exe
  2⤵
  PID:7184
- C:\Windows\System\iPuvzlA.exe
  C:\Windows\System\iPuvzlA.exe
  2⤵
  PID:7216
- C:\Windows\System\VIJLkaZ.exe
  C:\Windows\System\VIJLkaZ.exe
  2⤵
  PID:7260
- C:\Windows\System\RylBpqD.exe
  C:\Windows\System\RylBpqD.exe
  2⤵
  PID:7276
- C:\Windows\System\raDlyKu.exe
  C:\Windows\System\raDlyKu.exe
  2⤵
  PID:7300
- C:\Windows\System\sIjyjsL.exe
  C:\Windows\System\sIjyjsL.exe
  2⤵
  PID:7316
- C:\Windows\System\GjEgcPw.exe
  C:\Windows\System\GjEgcPw.exe
  2⤵
  PID:7336
- C:\Windows\System\XaxkOuy.exe
  C:\Windows\System\XaxkOuy.exe
  2⤵
  PID:7364
- C:\Windows\System\YqyjTBZ.exe
  C:\Windows\System\YqyjTBZ.exe
  2⤵
  PID:7384
- C:\Windows\System\TNjfDXb.exe
  C:\Windows\System\TNjfDXb.exe
  2⤵
  PID:7428
- C:\Windows\System\MyVGlgq.exe
  C:\Windows\System\MyVGlgq.exe
  2⤵
  PID:7448
- C:\Windows\System\QRmuQoZ.exe
  C:\Windows\System\QRmuQoZ.exe
  2⤵
  PID:7496
- C:\Windows\System\sdmXsLe.exe
  C:\Windows\System\sdmXsLe.exe
  2⤵
  PID:7520
- C:\Windows\System\zJlzcHL.exe
  C:\Windows\System\zJlzcHL.exe
  2⤵
  PID:7572
- C:\Windows\System\icyQrsc.exe
  C:\Windows\System\icyQrsc.exe
  2⤵
  PID:7596
- C:\Windows\System\bKtIIcn.exe
  C:\Windows\System\bKtIIcn.exe
  2⤵
  PID:7612
- C:\Windows\System\DaDxSEk.exe
  C:\Windows\System\DaDxSEk.exe
  2⤵
  PID:7640
- C:\Windows\System\XzkJWID.exe
  C:\Windows\System\XzkJWID.exe
  2⤵
  PID:7668
- C:\Windows\System\qDWPtgy.exe
  C:\Windows\System\qDWPtgy.exe
  2⤵
  PID:7692
- C:\Windows\System\jwELYve.exe
  C:\Windows\System\jwELYve.exe
  2⤵
  PID:7708
- C:\Windows\System\AWCtPgX.exe
  C:\Windows\System\AWCtPgX.exe
  2⤵
  PID:7748
- C:\Windows\System\SoGOrrK.exe
  C:\Windows\System\SoGOrrK.exe
  2⤵
  PID:7768
- C:\Windows\System\yhZtjCL.exe
  C:\Windows\System\yhZtjCL.exe
  2⤵
  PID:7796
- C:\Windows\System\jAvozKM.exe
  C:\Windows\System\jAvozKM.exe
  2⤵
  PID:7816
- C:\Windows\System\pQEjIvX.exe
  C:\Windows\System\pQEjIvX.exe
  2⤵
  PID:7836
- C:\Windows\System\xiAAZwL.exe
  C:\Windows\System\xiAAZwL.exe
  2⤵
  PID:7892
- C:\Windows\System\fciSndx.exe
  C:\Windows\System\fciSndx.exe
  2⤵
  PID:7916
- C:\Windows\System\aHXayst.exe
  C:\Windows\System\aHXayst.exe
  2⤵
  PID:7960
- C:\Windows\System\vBBGaoj.exe
  C:\Windows\System\vBBGaoj.exe
  2⤵
  PID:7976
- C:\Windows\System\PRTOHhb.exe
  C:\Windows\System\PRTOHhb.exe
  2⤵
  PID:8004
- C:\Windows\System\rRiKZjj.exe
  C:\Windows\System\rRiKZjj.exe
  2⤵
  PID:8028
- C:\Windows\System\KYKdhFd.exe
  C:\Windows\System\KYKdhFd.exe
  2⤵
  PID:8080
- C:\Windows\System\bGRCWbj.exe
  C:\Windows\System\bGRCWbj.exe
  2⤵
  PID:8096
- C:\Windows\System\pytUXGH.exe
  C:\Windows\System\pytUXGH.exe
  2⤵
  PID:8120
- C:\Windows\System\tmwAtUP.exe
  C:\Windows\System\tmwAtUP.exe
  2⤵
  PID:8140
- C:\Windows\System\ScRokio.exe
  C:\Windows\System\ScRokio.exe
  2⤵
  PID:8168
- C:\Windows\System\XPVviLi.exe
  C:\Windows\System\XPVviLi.exe
  2⤵
  PID:8184
- C:\Windows\System\HGCpheR.exe
  C:\Windows\System\HGCpheR.exe
  2⤵
  PID:7212
- C:\Windows\System\LpTBxEd.exe
  C:\Windows\System\LpTBxEd.exe
  2⤵
  PID:7236
- C:\Windows\System\GUeXDJw.exe
  C:\Windows\System\GUeXDJw.exe
  2⤵
  PID:7284
- C:\Windows\System\mpObXMZ.exe
  C:\Windows\System\mpObXMZ.exe
  2⤵
  PID:7324
- C:\Windows\System\ITPXPAE.exe
  C:\Windows\System\ITPXPAE.exe
  2⤵
  PID:7372
- C:\Windows\System\yncVBGc.exe
  C:\Windows\System\yncVBGc.exe
  2⤵
  PID:7508
- C:\Windows\System\vOtDvBw.exe
  C:\Windows\System\vOtDvBw.exe
  2⤵
  PID:7544
- C:\Windows\System\MxKHeRk.exe
  C:\Windows\System\MxKHeRk.exe
  2⤵
  PID:7688
- C:\Windows\System\sLLcvio.exe
  C:\Windows\System\sLLcvio.exe
  2⤵
  PID:7740
- C:\Windows\System\sSmNglx.exe
  C:\Windows\System\sSmNglx.exe
  2⤵
  PID:7792
- C:\Windows\System\aBqLFbs.exe
  C:\Windows\System\aBqLFbs.exe
  2⤵
  PID:7828
- C:\Windows\System\ItBMZKr.exe
  C:\Windows\System\ItBMZKr.exe
  2⤵
  PID:7860
- C:\Windows\System\kCDFgrJ.exe
  C:\Windows\System\kCDFgrJ.exe
  2⤵
  PID:7924
- C:\Windows\System\pWsIlLk.exe
  C:\Windows\System\pWsIlLk.exe
  2⤵
  PID:7968
- C:\Windows\System\upQMhWg.exe
  C:\Windows\System\upQMhWg.exe
  2⤵
  PID:8040
- C:\Windows\System\hruyYdn.exe
  C:\Windows\System\hruyYdn.exe
  2⤵
  PID:5252
- C:\Windows\System\HUrMzXH.exe
  C:\Windows\System\HUrMzXH.exe
  2⤵
  PID:7396
- C:\Windows\System\gBoHPoL.exe
  C:\Windows\System\gBoHPoL.exe
  2⤵
  PID:7476
- C:\Windows\System\UbWGiEk.exe
  C:\Windows\System\UbWGiEk.exe
  2⤵
  PID:7604
- C:\Windows\System\BIyhiyw.exe
  C:\Windows\System\BIyhiyw.exe
  2⤵
  PID:7764
- C:\Windows\System\EBYMzhy.exe
  C:\Windows\System\EBYMzhy.exe
  2⤵
  PID:7864
- C:\Windows\System\IMuhUIT.exe
  C:\Windows\System\IMuhUIT.exe
  2⤵
  PID:8024
- C:\Windows\System\VLJhOnx.exe
  C:\Windows\System\VLJhOnx.exe
  2⤵
  PID:5168
- C:\Windows\System\GIQEbla.exe
  C:\Windows\System\GIQEbla.exe
  2⤵
  PID:2524
- C:\Windows\System\zFgiCwN.exe
  C:\Windows\System\zFgiCwN.exe
  2⤵
  PID:7780
- C:\Windows\System\knGqhAg.exe
  C:\Windows\System\knGqhAg.exe
  2⤵
  PID:8156
- C:\Windows\System\MqngZDK.exe
  C:\Windows\System\MqngZDK.exe
  2⤵
  PID:7952
- C:\Windows\System\enwcTSe.exe
  C:\Windows\System\enwcTSe.exe
  2⤵
  PID:8196
- C:\Windows\System\ZULOYYe.exe
  C:\Windows\System\ZULOYYe.exe
  2⤵
  PID:8216
- C:\Windows\System\gweAWsX.exe
  C:\Windows\System\gweAWsX.exe
  2⤵
  PID:8256
- C:\Windows\System\YdFkEYo.exe
  C:\Windows\System\YdFkEYo.exe
  2⤵
  PID:8284
- C:\Windows\System\rSelaph.exe
  C:\Windows\System\rSelaph.exe
  2⤵
  PID:8308
- C:\Windows\System\RLgaqud.exe
  C:\Windows\System\RLgaqud.exe
  2⤵
  PID:8348
- C:\Windows\System\dkPswrz.exe
  C:\Windows\System\dkPswrz.exe
  2⤵
  PID:8372
- C:\Windows\System\GkxkTgl.exe
  C:\Windows\System\GkxkTgl.exe
  2⤵
  PID:8400
- C:\Windows\System\kkdtbep.exe
  C:\Windows\System\kkdtbep.exe
  2⤵
  PID:8420
- C:\Windows\System\IGXTXgv.exe
  C:\Windows\System\IGXTXgv.exe
  2⤵
  PID:8444
- C:\Windows\System\VyaceYe.exe
  C:\Windows\System\VyaceYe.exe
  2⤵
  PID:8480
- C:\Windows\System\zzWuvtc.exe
  C:\Windows\System\zzWuvtc.exe
  2⤵
  PID:8496
- C:\Windows\System\XyrSMPP.exe
  C:\Windows\System\XyrSMPP.exe
  2⤵
  PID:8544
- C:\Windows\System\OoNGkhn.exe
  C:\Windows\System\OoNGkhn.exe
  2⤵
  PID:8596
- C:\Windows\System\JhwaPzV.exe
  C:\Windows\System\JhwaPzV.exe
  2⤵
  PID:8636
- C:\Windows\System\fvqXJAv.exe
  C:\Windows\System\fvqXJAv.exe
  2⤵
  PID:8652
- C:\Windows\System\wzZMbyB.exe
  C:\Windows\System\wzZMbyB.exe
  2⤵
  PID:8672
- C:\Windows\System\AyosyGd.exe
  C:\Windows\System\AyosyGd.exe
  2⤵
  PID:8720
- C:\Windows\System\WwroEPl.exe
  C:\Windows\System\WwroEPl.exe
  2⤵
  PID:8756
- C:\Windows\System\nPhYlwx.exe
  C:\Windows\System\nPhYlwx.exe
  2⤵
  PID:8772
- C:\Windows\System\nbyxOvt.exe
  C:\Windows\System\nbyxOvt.exe
  2⤵
  PID:8800
- C:\Windows\System\RdhWxma.exe
  C:\Windows\System\RdhWxma.exe
  2⤵
  PID:8840
- C:\Windows\System\SniFXtV.exe
  C:\Windows\System\SniFXtV.exe
  2⤵
  PID:8856
- C:\Windows\System\VeJyLiO.exe
  C:\Windows\System\VeJyLiO.exe
  2⤵
  PID:8888
- C:\Windows\System\oxtfbNK.exe
  C:\Windows\System\oxtfbNK.exe
  2⤵
  PID:8924
- C:\Windows\System\sQRKTcB.exe
  C:\Windows\System\sQRKTcB.exe
  2⤵
  PID:8940
- C:\Windows\System\HjQBNFj.exe
  C:\Windows\System\HjQBNFj.exe
  2⤵
  PID:8968
- C:\Windows\System\QZlQVor.exe
  C:\Windows\System\QZlQVor.exe
  2⤵
  PID:8996
- C:\Windows\System\ISnQwfd.exe
  C:\Windows\System\ISnQwfd.exe
  2⤵
  PID:9024
- C:\Windows\System\eVbQdrz.exe
  C:\Windows\System\eVbQdrz.exe
  2⤵
  PID:9048
- C:\Windows\System\NkOwGGc.exe
  C:\Windows\System\NkOwGGc.exe
  2⤵
  PID:9064
- C:\Windows\System\aCTmHww.exe
  C:\Windows\System\aCTmHww.exe
  2⤵
  PID:9088
- C:\Windows\System\GwwVFdi.exe
  C:\Windows\System\GwwVFdi.exe
  2⤵
  PID:9112
- C:\Windows\System\kNWFtna.exe
  C:\Windows\System\kNWFtna.exe
  2⤵
  PID:9132
- C:\Windows\System\EmLbgYA.exe
  C:\Windows\System\EmLbgYA.exe
  2⤵
  PID:9168
- C:\Windows\System\OVNeZEB.exe
  C:\Windows\System\OVNeZEB.exe
  2⤵
  PID:8276
- C:\Windows\System\iPlMagA.exe
  C:\Windows\System\iPlMagA.exe
  2⤵
  PID:8344
- C:\Windows\System\qrQgnws.exe
  C:\Windows\System\qrQgnws.exe
  2⤵
  PID:8388
- C:\Windows\System\wCTuFsT.exe
  C:\Windows\System\wCTuFsT.exe
  2⤵
  PID:8464
- C:\Windows\System\NTshxxT.exe
  C:\Windows\System\NTshxxT.exe
  2⤵
  PID:8508
- C:\Windows\System\SswSUmd.exe
  C:\Windows\System\SswSUmd.exe
  2⤵
  PID:8532
- C:\Windows\System\rrVSyJd.exe
  C:\Windows\System\rrVSyJd.exe
  2⤵
  PID:8536
- C:\Windows\System\RSVmMdh.exe
  C:\Windows\System\RSVmMdh.exe
  2⤵
  PID:8608
- C:\Windows\System\xwXOeua.exe
  C:\Windows\System\xwXOeua.exe
  2⤵
  PID:8700
- C:\Windows\System\ZYjpIod.exe
  C:\Windows\System\ZYjpIod.exe
  2⤵
  PID:8768
- C:\Windows\System\mTZEoqL.exe
  C:\Windows\System\mTZEoqL.exe
  2⤵
  PID:8812
- C:\Windows\System\fVgxSbn.exe
  C:\Windows\System\fVgxSbn.exe
  2⤵
  PID:8852
- C:\Windows\System\vZolBrs.exe
  C:\Windows\System\vZolBrs.exe
  2⤵
  PID:8880
- C:\Windows\System\DoXyUwl.exe
  C:\Windows\System\DoXyUwl.exe
  2⤵
  PID:8932
- C:\Windows\System\avaGikr.exe
  C:\Windows\System\avaGikr.exe
  2⤵
  PID:8976
- C:\Windows\System\FnHGaDq.exe
  C:\Windows\System\FnHGaDq.exe
  2⤵
  PID:9012
- C:\Windows\System\HusbYen.exe
  C:\Windows\System\HusbYen.exe
  2⤵
  PID:9124
- C:\Windows\System\SfjSTIH.exe
  C:\Windows\System\SfjSTIH.exe
  2⤵
  PID:8324
- C:\Windows\System\QLqzzNx.exe
  C:\Windows\System\QLqzzNx.exe
  2⤵
  PID:8492
- C:\Windows\System\UOODaDP.exe
  C:\Windows\System\UOODaDP.exe
  2⤵
  PID:8472
- C:\Windows\System\SViNrOF.exe
  C:\Windows\System\SViNrOF.exe
  2⤵
  PID:8648
- C:\Windows\System\dOmWTOy.exe
  C:\Windows\System\dOmWTOy.exe
  2⤵
  PID:8792
- C:\Windows\System\GuLGZKt.exe
  C:\Windows\System\GuLGZKt.exe
  2⤵
  PID:8948
- C:\Windows\System\lmMuCoC.exe
  C:\Windows\System\lmMuCoC.exe
  2⤵
  PID:9004
- C:\Windows\System\GRsboEd.exe
  C:\Windows\System\GRsboEd.exe
  2⤵
  PID:8232
- C:\Windows\System\QDGcSWd.exe
  C:\Windows\System\QDGcSWd.exe
  2⤵
  PID:8416
- C:\Windows\System\CmCmZgV.exe
  C:\Windows\System\CmCmZgV.exe
  2⤵
  PID:8616
- C:\Windows\System\CAiXjaJ.exe
  C:\Windows\System\CAiXjaJ.exe
  2⤵
  PID:9148
- C:\Windows\System\tSEEuSy.exe
  C:\Windows\System\tSEEuSy.exe
  2⤵
  PID:8820
- C:\Windows\System\nsvbdUW.exe
  C:\Windows\System\nsvbdUW.exe
  2⤵
  PID:9236
- C:\Windows\System\oNIpEnJ.exe
  C:\Windows\System\oNIpEnJ.exe
  2⤵
  PID:9264
- C:\Windows\System\HQDsmms.exe
  C:\Windows\System\HQDsmms.exe
  2⤵
  PID:9288
- C:\Windows\System\EYUEPUq.exe
  C:\Windows\System\EYUEPUq.exe
  2⤵
  PID:9320
- C:\Windows\System\ZlrSeqm.exe
  C:\Windows\System\ZlrSeqm.exe
  2⤵
  PID:9372
- C:\Windows\System\ejCMvYC.exe
  C:\Windows\System\ejCMvYC.exe
  2⤵
  PID:9396
- C:\Windows\System\BwkNwDw.exe
  C:\Windows\System\BwkNwDw.exe
  2⤵
  PID:9424
- C:\Windows\System\pnJqFaH.exe
  C:\Windows\System\pnJqFaH.exe
  2⤵
  PID:9444
- C:\Windows\System\BTxtNSA.exe
  C:\Windows\System\BTxtNSA.exe
  2⤵
  PID:9464
- C:\Windows\System\yZNaiWb.exe
  C:\Windows\System\yZNaiWb.exe
  2⤵
  PID:9492
- C:\Windows\System\WIsoMqd.exe
  C:\Windows\System\WIsoMqd.exe
  2⤵
  PID:9532
- C:\Windows\System\kUcRvmZ.exe
  C:\Windows\System\kUcRvmZ.exe
  2⤵
  PID:9560
- C:\Windows\System\NvTObZh.exe
  C:\Windows\System\NvTObZh.exe
  2⤵
  PID:9592
- C:\Windows\System\hoSffWB.exe
  C:\Windows\System\hoSffWB.exe
  2⤵
  PID:9616
- C:\Windows\System\pSBIYjr.exe
  C:\Windows\System\pSBIYjr.exe
  2⤵
  PID:9652
- C:\Windows\System\aeoIIIx.exe
  C:\Windows\System\aeoIIIx.exe
  2⤵
  PID:9684
- C:\Windows\System\BAHCFLl.exe
  C:\Windows\System\BAHCFLl.exe
  2⤵
  PID:9704
- C:\Windows\System\bETLamP.exe
  C:\Windows\System\bETLamP.exe
  2⤵
  PID:9732
- C:\Windows\System\OJdbtkO.exe
  C:\Windows\System\OJdbtkO.exe
  2⤵
  PID:9760
- C:\Windows\System\ZtMmaOg.exe
  C:\Windows\System\ZtMmaOg.exe
  2⤵
  PID:9796
- C:\Windows\System\HvhxBTj.exe
  C:\Windows\System\HvhxBTj.exe
  2⤵
  PID:9816
- C:\Windows\System\kTwIgcY.exe
  C:\Windows\System\kTwIgcY.exe
  2⤵
  PID:9836
- C:\Windows\System\VEkdVNU.exe
  C:\Windows\System\VEkdVNU.exe
  2⤵
  PID:9856
- C:\Windows\System\rgbyshr.exe
  C:\Windows\System\rgbyshr.exe
  2⤵
  PID:9892
- C:\Windows\System\fMbFoPc.exe
  C:\Windows\System\fMbFoPc.exe
  2⤵
  PID:9936
- C:\Windows\System\dMWBxlX.exe
  C:\Windows\System\dMWBxlX.exe
  2⤵
  PID:9964
- C:\Windows\System\dHjpKkw.exe
  C:\Windows\System\dHjpKkw.exe
  2⤵
  PID:9984
- C:\Windows\System\bvtOTZi.exe
  C:\Windows\System\bvtOTZi.exe
  2⤵
  PID:10004
- C:\Windows\System\nLIpGLw.exe
  C:\Windows\System\nLIpGLw.exe
  2⤵
  PID:10028
- C:\Windows\System\SnMBxAO.exe
  C:\Windows\System\SnMBxAO.exe
  2⤵
  PID:10072
- C:\Windows\System\gqWSqeW.exe
  C:\Windows\System\gqWSqeW.exe
  2⤵
  PID:10096
- C:\Windows\System\JAgmGze.exe
  C:\Windows\System\JAgmGze.exe
  2⤵
  PID:10120
- C:\Windows\System\dwfDeHL.exe
  C:\Windows\System\dwfDeHL.exe
  2⤵
  PID:10144
- C:\Windows\System\RzNiTtJ.exe
  C:\Windows\System\RzNiTtJ.exe
  2⤵
  PID:10172
- C:\Windows\System\qKjXIoQ.exe
  C:\Windows\System\qKjXIoQ.exe
  2⤵
  PID:10200
- C:\Windows\System\HhKrViY.exe
  C:\Windows\System\HhKrViY.exe
  2⤵
  PID:8304
- C:\Windows\System\LFQBeFq.exe
  C:\Windows\System\LFQBeFq.exe
  2⤵
  PID:9232
- C:\Windows\System\dJWRSJf.exe
  C:\Windows\System\dJWRSJf.exe
  2⤵
  PID:9256
- C:\Windows\System\TauDZBO.exe
  C:\Windows\System\TauDZBO.exe
  2⤵
  PID:9348
- C:\Windows\System\HizMrDI.exe
  C:\Windows\System\HizMrDI.exe
  2⤵
  PID:9432
- C:\Windows\System\nQmXKwT.exe
  C:\Windows\System\nQmXKwT.exe
  2⤵
  PID:9484
- C:\Windows\System\xeBaNPr.exe
  C:\Windows\System\xeBaNPr.exe
  2⤵
  PID:9572
- C:\Windows\System\gzjhVXu.exe
  C:\Windows\System\gzjhVXu.exe
  2⤵
  PID:9664
- C:\Windows\System\sYDSNpZ.exe
  C:\Windows\System\sYDSNpZ.exe
  2⤵
  PID:9720
- C:\Windows\System\jHuGBVD.exe
  C:\Windows\System\jHuGBVD.exe
  2⤵
  PID:9804
- C:\Windows\System\VPoWLYw.exe
  C:\Windows\System\VPoWLYw.exe
  2⤵
  PID:9832
- C:\Windows\System\grkycaK.exe
  C:\Windows\System\grkycaK.exe
  2⤵
  PID:9876
- C:\Windows\System\sWXhmzs.exe
  C:\Windows\System\sWXhmzs.exe
  2⤵
  PID:9972
- C:\Windows\System\mElPWsC.exe
  C:\Windows\System\mElPWsC.exe
  2⤵
  PID:10000
- C:\Windows\System\GeJLovd.exe
  C:\Windows\System\GeJLovd.exe
  2⤵
  PID:10092
- C:\Windows\System\tKPanyD.exe
  C:\Windows\System\tKPanyD.exe
  2⤵
  PID:10136
- C:\Windows\System\eRqruCe.exe
  C:\Windows\System\eRqruCe.exe
  2⤵
  PID:10224
- C:\Windows\System\RWzGtZw.exe
  C:\Windows\System\RWzGtZw.exe
  2⤵
  PID:9280
- C:\Windows\System\toWkRfh.exe
  C:\Windows\System\toWkRfh.exe
  2⤵
  PID:9416
- C:\Windows\System\FPGPtws.exe
  C:\Windows\System\FPGPtws.exe
  2⤵
  PID:9552
- C:\Windows\System\kAfqZaY.exe
  C:\Windows\System\kAfqZaY.exe
  2⤵
  PID:9696
- C:\Windows\System\kxCEwBD.exe
  C:\Windows\System\kxCEwBD.exe
  2⤵
  PID:9852
- C:\Windows\System\GKRtLva.exe
  C:\Windows\System\GKRtLva.exe
  2⤵
  PID:9944
- C:\Windows\System\NAfWpmI.exe
  C:\Windows\System\NAfWpmI.exe
  2⤵
  PID:10116
- C:\Windows\System\kyFuWWO.exe
  C:\Windows\System\kyFuWWO.exe
  2⤵
  PID:10192
- C:\Windows\System\TpGcCZw.exe
  C:\Windows\System\TpGcCZw.exe
  2⤵
  PID:9600
- C:\Windows\System\dIqjtyD.exe
  C:\Windows\System\dIqjtyD.exe
  2⤵
  PID:9928
- C:\Windows\System\zgpnBVb.exe
  C:\Windows\System\zgpnBVb.exe
  2⤵
  PID:9512
- C:\Windows\System\xIhXXUJ.exe
  C:\Windows\System\xIhXXUJ.exe
  2⤵
  PID:10064
- C:\Windows\System\EqPgpCs.exe
  C:\Windows\System\EqPgpCs.exe
  2⤵
  PID:10264
- C:\Windows\System\mBisvgF.exe
  C:\Windows\System\mBisvgF.exe
  2⤵
  PID:10288
- C:\Windows\System\ydGeHrs.exe
  C:\Windows\System\ydGeHrs.exe
  2⤵
  PID:10332
- C:\Windows\System\mFBgtlN.exe
  C:\Windows\System\mFBgtlN.exe
  2⤵
  PID:10356
- C:\Windows\System\sbvvGYi.exe
  C:\Windows\System\sbvvGYi.exe
  2⤵
  PID:10372
- C:\Windows\System\DUxTNwO.exe
  C:\Windows\System\DUxTNwO.exe
  2⤵
  PID:10400
- C:\Windows\System\ykMyEFJ.exe
  C:\Windows\System\ykMyEFJ.exe
  2⤵
  PID:10428
- C:\Windows\System\XwafECn.exe
  C:\Windows\System\XwafECn.exe
  2⤵
  PID:10452
- C:\Windows\System\JkWAUlu.exe
  C:\Windows\System\JkWAUlu.exe
  2⤵
  PID:10476
- C:\Windows\System\DAzaFVf.exe
  C:\Windows\System\DAzaFVf.exe
  2⤵
  PID:10496
- C:\Windows\System\ibeyfMr.exe
  C:\Windows\System\ibeyfMr.exe
  2⤵
  PID:10516
- C:\Windows\System\uoGBGZi.exe
  C:\Windows\System\uoGBGZi.exe
  2⤵
  PID:10560
- C:\Windows\System\zXCCeAL.exe
  C:\Windows\System\zXCCeAL.exe
  2⤵
  PID:10624
- C:\Windows\System\LdIKuTu.exe
  C:\Windows\System\LdIKuTu.exe
  2⤵
  PID:10644
- C:\Windows\System\WlwSHMm.exe
  C:\Windows\System\WlwSHMm.exe
  2⤵
  PID:10664
- C:\Windows\System\AlvDErR.exe
  C:\Windows\System\AlvDErR.exe
  2⤵
  PID:10692
- C:\Windows\System\ymSVNTj.exe
  C:\Windows\System\ymSVNTj.exe
  2⤵
  PID:10744
- C:\Windows\System\YxcOxXC.exe
  C:\Windows\System\YxcOxXC.exe
  2⤵
  PID:10768
- C:\Windows\System\NkTtcJS.exe
  C:\Windows\System\NkTtcJS.exe
  2⤵
  PID:10808
- C:\Windows\System\RaeICmr.exe
  C:\Windows\System\RaeICmr.exe
  2⤵
  PID:10832
- C:\Windows\System\pCapjlC.exe
  C:\Windows\System\pCapjlC.exe
  2⤵
  PID:10860
- C:\Windows\System\TSTccqa.exe
  C:\Windows\System\TSTccqa.exe
  2⤵
  PID:10880
- C:\Windows\System\JQqJQaz.exe
  C:\Windows\System\JQqJQaz.exe
  2⤵
  PID:10900
- C:\Windows\System\JTCMPTm.exe
  C:\Windows\System\JTCMPTm.exe
  2⤵
  PID:10928
- C:\Windows\System\eIudDnc.exe
  C:\Windows\System\eIudDnc.exe
  2⤵
  PID:10956
- C:\Windows\System\oohnvMi.exe
  C:\Windows\System\oohnvMi.exe
  2⤵
  PID:10984
- C:\Windows\System\oUysgvj.exe
  C:\Windows\System\oUysgvj.exe
  2⤵
  PID:11000
- C:\Windows\System\UQIxRzB.exe
  C:\Windows\System\UQIxRzB.exe
  2⤵
  PID:11024
- C:\Windows\System\TSzHDAz.exe
  C:\Windows\System\TSzHDAz.exe
  2⤵
  PID:11048
- C:\Windows\System\xpagKQw.exe
  C:\Windows\System\xpagKQw.exe
  2⤵
  PID:11076
- C:\Windows\System\JUkYlkA.exe
  C:\Windows\System\JUkYlkA.exe
  2⤵
  PID:11112
- C:\Windows\System\rQOraNC.exe
  C:\Windows\System\rQOraNC.exe
  2⤵
  PID:11132
- C:\Windows\System\ElHzRQf.exe
  C:\Windows\System\ElHzRQf.exe
  2⤵
  PID:11156
- C:\Windows\System\LMvQQYR.exe
  C:\Windows\System\LMvQQYR.exe
  2⤵
  PID:11184
- C:\Windows\System\lskSuSL.exe
  C:\Windows\System\lskSuSL.exe
  2⤵
  PID:11256
- C:\Windows\System\uwHZFKK.exe
  C:\Windows\System\uwHZFKK.exe
  2⤵
  PID:10168
- C:\Windows\System\BzFGBjF.exe
  C:\Windows\System\BzFGBjF.exe
  2⤵
  PID:10312
- C:\Windows\System\UFlTTJo.exe
  C:\Windows\System\UFlTTJo.exe
  2⤵
  PID:10384
- C:\Windows\System\fpjMAnN.exe
  C:\Windows\System\fpjMAnN.exe
  2⤵
  PID:10392
- C:\Windows\System\SbKikdk.exe
  C:\Windows\System\SbKikdk.exe
  2⤵
  PID:10508
- C:\Windows\System\uVdvCgk.exe
  C:\Windows\System\uVdvCgk.exe
  2⤵
  PID:10544
- C:\Windows\System\QEHBUHK.exe
  C:\Windows\System\QEHBUHK.exe
  2⤵
  PID:10608
- C:\Windows\System\SkljbZE.exe
  C:\Windows\System\SkljbZE.exe
  2⤵
  PID:10704
- C:\Windows\System\aYptkAM.exe
  C:\Windows\System\aYptkAM.exe
  2⤵
  PID:10740
- C:\Windows\System\ikAwuWh.exe
  C:\Windows\System\ikAwuWh.exe
  2⤵
  PID:10828
- C:\Windows\System\LBUCMuQ.exe
  C:\Windows\System\LBUCMuQ.exe
  2⤵
  PID:10896
- C:\Windows\System\TgfOixR.exe
  C:\Windows\System\TgfOixR.exe
  2⤵
  PID:10948
- C:\Windows\System\cYyfZRJ.exe
  C:\Windows\System\cYyfZRJ.exe
  2⤵
  PID:11008
- C:\Windows\System\UJBVNMG.exe
  C:\Windows\System\UJBVNMG.exe
  2⤵
  PID:11056
- C:\Windows\System\UphcauQ.exe
  C:\Windows\System\UphcauQ.exe
  2⤵
  PID:11120
- C:\Windows\System\EBsIrRy.exe
  C:\Windows\System\EBsIrRy.exe
  2⤵
  PID:11196
- C:\Windows\System\CwgLsoW.exe
  C:\Windows\System\CwgLsoW.exe
  2⤵
  PID:11228
- C:\Windows\System\Kxqevnt.exe
  C:\Windows\System\Kxqevnt.exe
  2⤵
  PID:10272
- C:\Windows\System\emuTFgM.exe
  C:\Windows\System\emuTFgM.exe
  2⤵
  PID:10492
- C:\Windows\System\wfpnvVh.exe
  C:\Windows\System\wfpnvVh.exe
  2⤵
  PID:10632
- C:\Windows\System\ZkcZZqj.exe
  C:\Windows\System\ZkcZZqj.exe
  2⤵
  PID:10868
- C:\Windows\System\jBTNAff.exe
  C:\Windows\System\jBTNAff.exe
  2⤵
  PID:11044
- C:\Windows\System\cFRAVSr.exe
  C:\Windows\System\cFRAVSr.exe
  2⤵
  PID:11144
- C:\Windows\System\aonoqgI.exe
  C:\Windows\System\aonoqgI.exe
  2⤵
  PID:10444
- C:\Windows\System\ILeYfAD.exe
  C:\Windows\System\ILeYfAD.exe
  2⤵
  PID:10640
- C:\Windows\System\EmxjdsL.exe
  C:\Windows\System\EmxjdsL.exe
  2⤵
  PID:11016
- C:\Windows\System\sHZXzsQ.exe
  C:\Windows\System\sHZXzsQ.exe
  2⤵
  PID:9924
- C:\Windows\System\cbSDPJh.exe
  C:\Windows\System\cbSDPJh.exe
  2⤵
  PID:11280
- C:\Windows\System\eeQHjBz.exe
  C:\Windows\System\eeQHjBz.exe
  2⤵
  PID:11348
- C:\Windows\System\VdsHuCu.exe
  C:\Windows\System\VdsHuCu.exe
  2⤵
  PID:11364
- C:\Windows\System\cLUAylx.exe
  C:\Windows\System\cLUAylx.exe
  2⤵
  PID:11388
- C:\Windows\System\ocJVKUF.exe
  C:\Windows\System\ocJVKUF.exe
  2⤵
  PID:11408
- C:\Windows\System\WeVIPLw.exe
  C:\Windows\System\WeVIPLw.exe
  2⤵
  PID:11440
- C:\Windows\System\CBpMJjo.exe
  C:\Windows\System\CBpMJjo.exe
  2⤵
  PID:11472
- C:\Windows\System\oyAJJcw.exe
  C:\Windows\System\oyAJJcw.exe
  2⤵
  PID:11532
- C:\Windows\System\OPinXsb.exe
  C:\Windows\System\OPinXsb.exe
  2⤵
  PID:11572
- C:\Windows\System\axwSKJy.exe
  C:\Windows\System\axwSKJy.exe
  2⤵
  PID:11588
- C:\Windows\System\kevcVru.exe
  C:\Windows\System\kevcVru.exe
  2⤵
  PID:11612
- C:\Windows\System\lGfRrxJ.exe
  C:\Windows\System\lGfRrxJ.exe
  2⤵
  PID:11644
- C:\Windows\System\rzgnoZr.exe
  C:\Windows\System\rzgnoZr.exe
  2⤵
  PID:11664
- C:\Windows\System\WHewMZX.exe
  C:\Windows\System\WHewMZX.exe
  2⤵
  PID:11692
- C:\Windows\System\gWwSpMJ.exe
  C:\Windows\System\gWwSpMJ.exe
  2⤵
  PID:11724
- C:\Windows\System\gIOLEiN.exe
  C:\Windows\System\gIOLEiN.exe
  2⤵
  PID:11748
- C:\Windows\System\lUadXqq.exe
  C:\Windows\System\lUadXqq.exe
  2⤵
  PID:11780
- C:\Windows\System\jurECNs.exe
  C:\Windows\System\jurECNs.exe
  2⤵
  PID:11800
- C:\Windows\System\yaGDDaA.exe
  C:\Windows\System\yaGDDaA.exe
  2⤵
  PID:11820
- C:\Windows\System\SaQitdB.exe
  C:\Windows\System\SaQitdB.exe
  2⤵
  PID:11856
- C:\Windows\System\QwOIwZB.exe
  C:\Windows\System\QwOIwZB.exe
  2⤵
  PID:11888
- C:\Windows\System\KLTmFqg.exe
  C:\Windows\System\KLTmFqg.exe
  2⤵
  PID:11940
- C:\Windows\System\kAiJxTB.exe
  C:\Windows\System\kAiJxTB.exe
  2⤵
  PID:11976
- C:\Windows\System\FeMyjGa.exe
  C:\Windows\System\FeMyjGa.exe
  2⤵
  PID:11992
- C:\Windows\System\fYWdiov.exe
  C:\Windows\System\fYWdiov.exe
  2⤵
  PID:12020
- C:\Windows\System\mMaQAos.exe
  C:\Windows\System\mMaQAos.exe
  2⤵
  PID:12048
- C:\Windows\System\JFCTfHX.exe
  C:\Windows\System\JFCTfHX.exe
  2⤵
  PID:12076
- C:\Windows\System\smaKZLl.exe
  C:\Windows\System\smaKZLl.exe
  2⤵
  PID:12108
- C:\Windows\System\CjqhfAQ.exe
  C:\Windows\System\CjqhfAQ.exe
  2⤵
  PID:12136
- C:\Windows\System\nEOQmmU.exe
  C:\Windows\System\nEOQmmU.exe
  2⤵
  PID:12164
- C:\Windows\System\lVqJwOD.exe
  C:\Windows\System\lVqJwOD.exe
  2⤵
  PID:12192
- C:\Windows\System\vREBFHE.exe
  C:\Windows\System\vREBFHE.exe
  2⤵
  PID:12212
- C:\Windows\System\sUJLhLW.exe
  C:\Windows\System\sUJLhLW.exe
  2⤵
  PID:12256
- C:\Windows\System\dpljpOk.exe
  C:\Windows\System\dpljpOk.exe
  2⤵
  PID:12272
- C:\Windows\System\azARNct.exe
  C:\Windows\System\azARNct.exe
  2⤵
  PID:11272
- C:\Windows\System\XhwhZMu.exe
  C:\Windows\System\XhwhZMu.exe
  2⤵
  PID:11328
- C:\Windows\System\OAZnykw.exe
  C:\Windows\System\OAZnykw.exe
  2⤵
  PID:10584
- C:\Windows\System\yGmHlOi.exe
  C:\Windows\System\yGmHlOi.exe
  2⤵
  PID:11400
- C:\Windows\System\lQZvczh.exe
  C:\Windows\System\lQZvczh.exe
  2⤵
  PID:11436
- C:\Windows\System\CKNwaQA.exe
  C:\Windows\System\CKNwaQA.exe
  2⤵
  PID:11560
- C:\Windows\System\FEOdfDB.exe
  C:\Windows\System\FEOdfDB.exe
  2⤵
  PID:11540
- C:\Windows\System\PNOiqOS.exe
  C:\Windows\System\PNOiqOS.exe
  2⤵
  PID:11608
- C:\Windows\System\mDZUkws.exe
  C:\Windows\System\mDZUkws.exe
  2⤵
  PID:11732
- C:\Windows\System\BOhRqre.exe
  C:\Windows\System\BOhRqre.exe
  2⤵
  PID:11776
- C:\Windows\System\cGgmvlC.exe
  C:\Windows\System\cGgmvlC.exe
  2⤵
  PID:11872
- C:\Windows\System\JDzdSBE.exe
  C:\Windows\System\JDzdSBE.exe
  2⤵
  PID:11932
- C:\Windows\System\sxlaHVU.exe
  C:\Windows\System\sxlaHVU.exe
  2⤵
  PID:11968
- C:\Windows\System\IIIdebX.exe
  C:\Windows\System\IIIdebX.exe
  2⤵
  PID:12040
- C:\Windows\System\PBUajCB.exe
  C:\Windows\System\PBUajCB.exe
  2⤵
  PID:12060
- C:\Windows\System\sfyrujW.exe
  C:\Windows\System\sfyrujW.exe
  2⤵
  PID:12144
- C:\Windows\System\ejZSJro.exe
  C:\Windows\System\ejZSJro.exe
  2⤵
  PID:12188
- C:\Windows\System\zDtaXrg.exe
  C:\Windows\System\zDtaXrg.exe
  2⤵
  PID:12264
- C:\Windows\System\vJdFIuI.exe
  C:\Windows\System\vJdFIuI.exe
  2⤵
  PID:11300
- C:\Windows\System\ouAzWPH.exe
  C:\Windows\System\ouAzWPH.exe
  2⤵
  PID:3800
- C:\Windows\System\MTveNJL.exe
  C:\Windows\System\MTveNJL.exe
  2⤵
  PID:11528
- C:\Windows\System\iVqZyMp.exe
  C:\Windows\System\iVqZyMp.exe
  2⤵
  PID:11520
- C:\Windows\System\MKCHtQo.exe
  C:\Windows\System\MKCHtQo.exe
  2⤵
  PID:11908
- C:\Windows\System\GFSuvVU.exe
  C:\Windows\System\GFSuvVU.exe
  2⤵
  PID:12012
- C:\Windows\System\FvJdVUZ.exe
  C:\Windows\System\FvJdVUZ.exe
  2⤵
  PID:11296
- C:\Windows\System\bfEqGmk.exe
  C:\Windows\System\bfEqGmk.exe
  2⤵
  PID:11316
- C:\Windows\System\JhzIUKL.exe
  C:\Windows\System\JhzIUKL.exe
  2⤵
  PID:11660
- C:\Windows\System\dmQXlcB.exe
  C:\Windows\System\dmQXlcB.exe
  2⤵
  PID:11816
- C:\Windows\System\LvCrnlr.exe
  C:\Windows\System\LvCrnlr.exe
  2⤵
  PID:12128
- C:\Windows\System\yDSxnsP.exe
  C:\Windows\System\yDSxnsP.exe
  2⤵
  PID:11568
- C:\Windows\System\UBbwQmk.exe
  C:\Windows\System\UBbwQmk.exe
  2⤵
  PID:12316
- C:\Windows\System\OOnGUaz.exe
  C:\Windows\System\OOnGUaz.exe
  2⤵
  PID:12336
- C:\Windows\System\JmtUheK.exe
  C:\Windows\System\JmtUheK.exe
  2⤵
  PID:12352
- C:\Windows\System\JdkXZoi.exe
  C:\Windows\System\JdkXZoi.exe
  2⤵
  PID:12392
- C:\Windows\System\BsonCfu.exe
  C:\Windows\System\BsonCfu.exe
  2⤵
  PID:12428
- C:\Windows\System\TxjMszg.exe
  C:\Windows\System\TxjMszg.exe
  2⤵
  PID:12456
- C:\Windows\System\YBvGUzO.exe
  C:\Windows\System\YBvGUzO.exe
  2⤵
  PID:12484
- C:\Windows\System\oVQlWTN.exe
  C:\Windows\System\oVQlWTN.exe
  2⤵
  PID:12512
- C:\Windows\System\OAThaUJ.exe
  C:\Windows\System\OAThaUJ.exe
  2⤵
  PID:12532
- C:\Windows\System\fjWatUk.exe
  C:\Windows\System\fjWatUk.exe
  2⤵
  PID:12552
- C:\Windows\System\DpdPbkh.exe
  C:\Windows\System\DpdPbkh.exe
  2⤵
  PID:12580
- C:\Windows\System\ofdRlOK.exe
  C:\Windows\System\ofdRlOK.exe
  2⤵
  PID:12600
- C:\Windows\System\mcgxPZV.exe
  C:\Windows\System\mcgxPZV.exe
  2⤵
  PID:12648
- C:\Windows\System\QiQwSWx.exe
  C:\Windows\System\QiQwSWx.exe
  2⤵
  PID:12664
- C:\Windows\System\mAcyklJ.exe
  C:\Windows\System\mAcyklJ.exe
  2⤵
  PID:12692
- C:\Windows\System\qvoXvtD.exe
  C:\Windows\System\qvoXvtD.exe
  2⤵
  PID:12732
- C:\Windows\System\SyvzGeu.exe
  C:\Windows\System\SyvzGeu.exe
  2⤵
  PID:12756
- C:\Windows\System\pUbglva.exe
  C:\Windows\System\pUbglva.exe
  2⤵
  PID:12784
- C:\Windows\System\STezLpf.exe
  C:\Windows\System\STezLpf.exe
  2⤵
  PID:12804
- C:\Windows\System\WSjtnEp.exe
  C:\Windows\System\WSjtnEp.exe
  2⤵
  PID:12828
- C:\Windows\System\PVamGoe.exe
  C:\Windows\System\PVamGoe.exe
  2⤵
  PID:12844
- C:\Windows\System\kyqMZLB.exe
  C:\Windows\System\kyqMZLB.exe
  2⤵
  PID:12860
- C:\Windows\System\Rtdqryh.exe
  C:\Windows\System\Rtdqryh.exe
  2⤵
  PID:12880
- C:\Windows\System\XoZTneR.exe
  C:\Windows\System\XoZTneR.exe
  2⤵
  PID:12900
- C:\Windows\System\qKppEgn.exe
  C:\Windows\System\qKppEgn.exe
  2⤵
  PID:12952
- C:\Windows\System\CaGXKkk.exe
  C:\Windows\System\CaGXKkk.exe
  2⤵
  PID:12996
- C:\Windows\System\LPiblGR.exe
  C:\Windows\System\LPiblGR.exe
  2⤵
  PID:13020
- C:\Windows\System\OYSJGzt.exe
  C:\Windows\System\OYSJGzt.exe
  2⤵
  PID:13076
- C:\Windows\System\IqCAlxR.exe
  C:\Windows\System\IqCAlxR.exe
  2⤵
  PID:13096
- C:\Windows\System\zLyiLqJ.exe
  C:\Windows\System\zLyiLqJ.exe
  2⤵
  PID:13120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_wvs2auhf.o14.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wvs2auhf.o14.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

FpqAsmY.exe

Path C:\Windows\System\FpqAsmY.exe
Size 1.7MB
SHA256 35bb6e0361fc31e8ace66c82ee941e8c6aa44ec8b91b93ec8976d56cff5fa55a
MD5 13735aafea3d0703fa710c9a0db5d147
SHA1 8a8e4bf83bdadd531894ee6c9da30b692c3a03f7
SHA512 e13ede3d57ab38661a6df81c5a37c3ffb1b4939e3eed53979148ede9daa58cc4fc804aa7639ce4c116d0484c3ecf44663e9fd587b6442a9995ff71df3ccb7e10
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw0:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

IVOzBJr.exe

Path C:\Windows\System\IVOzBJr.exe
Size 1.7MB
SHA256 4a7224ccf38ac934f2fccb35cb3b98a5506a767b2a0411f7adde22467b66d35c
MD5 216473a99a2d07191935f8909d78886b
SHA1 4c7f7e4685dd9db07befdd939feacc3b34e78f20
SHA512 0b64ee4528f337445125dc2e7e63dea62677451a7bb669bb86432ba52ba6fa506d28dacd9ff97bc4e9829cfc1b335b836f9f84f7b4d630c623cb5b016bb98500
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw+:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

JJFMuRA.exe

Path C:\Windows\System\JJFMuRA.exe
Size 1.7MB
SHA256 4e68b29286814dcec5e02c3e855dd43c605ba7af33c43d285329c4d7a8fbb700
MD5 684754c226bb07f2ba27c7e8c6a771e2
SHA1 df4d0c7b31b6e7210581803b4936928c3ac75940
SHA512 8625843f670824b8b610e65fd483cb088ca64c6e37977f0a2d0d18bfd5d9ecf9a59273b789ea188b066a5ae3559ec9d9a94c7112fbff0d04667e6e52f603a28a
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwx:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

KmoDGSZ.exe

Path C:\Windows\System\KmoDGSZ.exe
Size 1.7MB
SHA256 00b94e4b209f976677a457b1bfd5d55dd82ce7c2300195b60160a60b1156a4da
MD5 1873f7ecbbf9a3aaaa25294ebda9aa72
SHA1 45825d8d1f41311ae6b487a18f26ee261768b9ff
SHA512 2ad04a2cadcd8092386bd7111661ebed7539b2a96dea9bce979ed128ee6ab88219cd6feeabe7e845a73bd330bbd787923e40eddeeea687ff224157e379a55e44
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwA:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

LESDxsa.exe

Path C:\Windows\System\LESDxsa.exe
Size 1.7MB
SHA256 15493753b88107cdb7610b0fd64eb46344327b5af9b6e4d7dfa8791b7ee20682
MD5 1c3d8db4e0bc375eca5ab9cb9ebbc24f
SHA1 f5ec087f5de1fceecc027cee090c830a40df0a15
SHA512 2918af8f9770584f9046fcbe43d25490d239f95e41fbeece9e488f2b94237624db4feb24a9221e71bca44bb787d72fabe0cb9ae139ac558d0f1fd1dbf528ae3d
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw7:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

MabrmEN.exe

Path C:\Windows\System\MabrmEN.exe
Size 1.7MB
SHA256 24ff1ab8cbe0d3db7770d6862ea2d504901c83de8b1abf5eeaecf82e2488236f
MD5 30caeebb37e09f8565b91e71861437fb
SHA1 27ee8d9bb3116ba63154c358e2bdeb14f9acd059
SHA512 c2f014c353f46516ece7647a975bc6bfdfd103a63721b86967894fbc58876908ab68c0193df1563d05d8a39c741d8b9d4b28da1f98a2f7431a29ab6f40e90ab6
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwA:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

OaYMNqu.exe

Path C:\Windows\System\OaYMNqu.exe
Size 1.7MB
SHA256 3941f496b6156bbd02df1b7bd8076aab688b50fb15d3a4c59418ff204bdc0b1d
MD5 8b11ff04db8e664f0cf10508d569b104
SHA1 4f73d0542459cbd3739435293250787ea80b79e5
SHA512 5e590a0894e11d54654aaf1598ba4924e18c228fa5ccb00b9622769247d99a69efce85c1c5f219d0ed46503e8103969dbb822652676f0221b8cf18aaaa1f1a94
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwE:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCzhYKP.exe

Path C:\Windows\System\PCzhYKP.exe
Size 1.7MB
SHA256 2b8acf0865ec6150316a604d1d9fdf58b239353ec9b78b35fac33a47f8df183f
MD5 1f6840b951d51f8e7eb1dbed7b4a381a
SHA1 9a68c6bab0710503ea0d866883267c43638e2035
SHA512 95f64fbd91392056943efb5f8fd83ed6b352e5fb53e5d8e24aa24b65cfac1c991e845a48a91ba2db9a5f3e1a346446cadc32d55a5e9b30510e55bfc8d8846280
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw+:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

PzUjYiv.exe

Path C:\Windows\System\PzUjYiv.exe
Size 1.7MB
SHA256 2067a4585ebbc5a18c337a17536f92e9484348bb6378cbbd7210183864cb3b5e
MD5 b7a618a72fad2cdf7003db004f44878d
SHA1 15886a1dba8969b1dcbfefc5c8d8d78842d42851
SHA512 2e0cc897d0c7bd58906c967fe2d73ff9535930ed0ed04c0e64ddf983768e23366e02ba86a01deb3c97e477747262808833af46c20f1d7fe18410d910d2195843
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwo:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMWBdOU.exe

Path C:\Windows\System\SMWBdOU.exe
Size 1.7MB
SHA256 1a551c32eb7e8513630d65beacad4155e95c7c18fbbd96d7ec090aafa4a8e1d6
MD5 f15726adfe49fd4356f5f49b2e983c6d
SHA1 f6171d7b1d04561ae78d54490f33cf6ee130b272
SHA512 dbddba5c33102258a5943dd3db29ae3116742358a25344b2404f2359605be5aef1279dfc5f5ba688eebb39ec0132e00277e001e6a396e567e3f4ead3af267f31
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwh:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

SPgPIIp.exe

Path C:\Windows\System\SPgPIIp.exe
Size 1.7MB
SHA256 9753438c350a38a348e3d597cce52d789f7e1c1093de80933370ac2ef8ff75aa
MD5 599e6a69653238ad908084b3755f2e34
SHA1 dc214456ae3227b354145851231553e6920d5697
SHA512 265ded52b52ae3383926c123df031b2f3adca5c42598f525b8a0b1e3b954383116b73c0c95b5060ff9dd06d6a4f3fb418bf0e84fbee2c2840c4be7c096bbd94e
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwk:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

SruPrjD.exe

Path C:\Windows\System\SruPrjD.exe
Size 1.7MB
SHA256 b7b93f4e19202c5449fa4377c1c7e05435c7c287b6f9b8f02bf9d15b325f14b9
MD5 f9cd36d0969b327d4f0d391571d81b9e
SHA1 d1f60a1572929fd84d8d098fe78e3b2df86bcdd2
SHA512 4673947d9959cfb847c88d5d80a3a92a2b46502f69d38b64e0a8985ae1bf7f27f8a0ab09e7084e6ae7d2b3e294c32edd8fbcbcc716588248c12d57b8669197af
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwI:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WPTIlQG.exe

Path C:\Windows\System\WPTIlQG.exe
Size 1.7MB
SHA256 ff2a15f26d3fb259eb571096bafd4ff3ee7b9f4cc78585e44a0ab1c041af0a00
MD5 2c0decf06648adc7db27398f33027257
SHA1 6f71cee1faf4a6004dcf8ec6cd1c77dcb925df8e
SHA512 787c9ef89d8631c5234b63e9f47bd11155c6b270900abde7805556303a2830d99f1e7d147dea6d43d4df7912e91de55b16d1418c798953d85e848618b65f7964
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwa:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

YljWjfw.exe

Path C:\Windows\System\YljWjfw.exe
Size 1.7MB
SHA256 fe46f876d6ddc7ce34c2381b575e207e92c4eba2b18b81277a56a1d99af3638b
MD5 aaf13cccd6b462bbf9896089e826324b
SHA1 1b63389d432e1dd9d604d58f8381348c0c744672
SHA512 c599b0100942a44075aa45f1b2d32ae3720eea121030d4f472d4e5c35dc7780ea69efa23c5287ddf4671f47f0496e75a5acce60222fe3360e9a69f84d3046f41
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwD:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

aKZmkpE.exe

Path C:\Windows\System\aKZmkpE.exe
Size 1.7MB
SHA256 ee4fe71c9698b32c4ed3695da1b0d09047cb329087b0921e95abeaa35b168c06
MD5 830a98e8f5e877c051712b468533aef0
SHA1 7d2e5a022a1d35a8bfeb7f1b590ef2a880edc544
SHA512 16931cbf1b1da59383732f63076b9422237cf0bbe0ecd327066fe37d3d4023c3fe36ed119aefe50443ad0072defe4dd698fff4b096bf434769ad6f314fa96088
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw7:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFCAMKq.exe

Path C:\Windows\System\bFCAMKq.exe
Size 1.7MB
SHA256 cc5b3f0d051d5ce26db1bf7148a3d49a239549cf128436b366fecc7fba450be2
MD5 ea1ab37cf837a4d59f180e9b86903d1f
SHA1 2b2a888d0d71b9ec77a17bc385c1904c58834fca
SHA512 a1ecc12320d14d8c5da72074db85db3ec7368c09c513dd4e37f2fa680c80044a4de83f393ac10e49c9c9b72b0f1d8587185a2b4c6aa95f241755997c2d9c826d
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwd:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

fdzEWYk.exe

Path C:\Windows\System\fdzEWYk.exe
Size 1.7MB
SHA256 db3acf917ac6eda890b88a3dae9993ee0e522ad27e38ea7b215fd4e413cef8bf
MD5 f788a501399029496d0cb03ac051414c
SHA1 b09295c22acccd5f600bd94b97b36054fee4ca52
SHA512 b9f705755b89be69f263ec4307204fe358c74eac62efd949d752330668664485111bb42d510432c3b67afb780324140fd7a9903ba466073801d36a6d702ee8a3
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw/:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMBzUbc.exe

Path C:\Windows\System\gMBzUbc.exe
Size 1.7MB
SHA256 37f84359c1b92edd4683d6eddd65024baa0ab77e42fcd2086f9ac5fde51415e4
MD5 8c486d4f9061296bc9de9fa135678675
SHA1 187e8ed59f76f126d2abadd234ab0df1a6e7f595
SHA512 15ca8cc832fa0c5e28893e17aa8cda33c6dd64242707dab04f88be60a3980671488f07288519c5605e4b88f8fdcf22f837f0d125323653c1c8b628945ffdb229
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw5:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

iNixaTQ.exe

Path C:\Windows\System\iNixaTQ.exe
Size 1.7MB
SHA256 2de632d693619cce775db60b33948f8b43c7e6884d568c278cb922ec632bc2ab
MD5 02fc455fdcee158b00c16e57099b0d56
SHA1 839b9aa8a2c2a3fc35bb66219b175f3c3c364c70
SHA512 91a3f86bd4a049d05fd67fabd45fbd38a67b3d5c4acb4ba98980e3dcc6011474d302d2242d9325e6138afc5caeac0de34634851948d9b5b1e2d6c057c2e41ef1
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwu:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

jBesayx.exe

Path C:\Windows\System\jBesayx.exe
Size 1.7MB
SHA256 84d936a11a8167d8af5f8db2e0ea9731cff0f7c856930e3cb7304c0e21f3fde6
MD5 1d5ba7a4714f2cbbe0230540dc3b68a4
SHA1 5dbe5de398b169caf25e692f37c8dbe47a83ea62
SHA512 84a60d7ee0c7642b1ac0ec3718d8edb6d57fa787988449970f676e15f0c0ede8ecbe685a40901f980d0a93fa7980a87a1318ccda45db5dac63885dfc679d154c
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw/:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mOolKBW.exe

Path C:\Windows\System\mOolKBW.exe
Size 1.7MB
SHA256 5d3ed517879579bcccccc15fbba3b435153c5c91b9022cb5876a68f1049e5246
MD5 d1933ab1ed8afe09a34497a2d25bc279
SHA1 6681a74662fd2332deab42b49a6d0142faeb0f38
SHA512 68b5b022ea299197e07d96c019d72ab016955a3a394bcd50675f81e0c7556cba96de8ddc189c722b126c06d30aeeb8f0008d0d1e44e6736be12c189ebb31d49f
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwD:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

oeTUIhb.exe

Path C:\Windows\System\oeTUIhb.exe
Size 1.7MB
SHA256 6004c7f79ee8ba3b9ddb1189ae3ec03639168bf79666ca9958e1b0fec334f5b1
MD5 d6a045cf40625de84f9af4b50e9c9fea
SHA1 270755970175786eafb350fc9f34bd93d1362eec
SHA512 6cf679e5e7505c5079eb44dc10fde4d398bf5e106012696e6928f525746f7f4d2993d320adb68bfe4ad34820a58197082d7e4625300a93726e5240cc025f22fd
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwb:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ojZLMZK.exe

Path C:\Windows\System\ojZLMZK.exe
Size 1.7MB
SHA256 ddf98a2dddeb24f1d1f89677f3680c3e44ceaecf17372e7a2272f7c48dfbfcd8
MD5 d0286404f74a00ff4692d045b6c87596
SHA1 f13c7b45779577b0e92c2d78e84e5b2720b0b2d0
SHA512 8d2a065f7945d9cbae99eb1d0459d34f8aaed0e69e09e5cff53bbdc08686c81c71d10c57f38cd2d21ed625b9e6a11e238d21e8ee5bb89cc7911008680b05ee77
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwg:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

qQfFujL.exe

Path C:\Windows\System\qQfFujL.exe
Size 1.7MB
SHA256 35e934d4ac997b49656ecfc9e4c6324dd8b032f78beb690898363bc672aab389
MD5 4bd2ad1f31a3baec05d92a65ec04012b
SHA1 45d0594bfb3d5f11f0a5e741961fd62298a3497a
SHA512 48e7835ef1a2135539a491a6e7b0b9f60ca7001ca2009211d2fee62f9c71e52d93abd367993f76afdd2a1e1da5c50af9fe871b75adc52b0020d0a97c1789f31c
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwZ:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

rgsWXgt.exe

Path C:\Windows\System\rgsWXgt.exe
Size 1.7MB
SHA256 fb85d0b1b24b0434e74f33f76ae275b0652606d5e193c9effbbdc9b2e1f77c1d
MD5 9dfde5906a2d2105bb6924c5d6d6dd6f
SHA1 8237d748306be034eb1e2b4681391c092422ab64
SHA512 0d9a3188ba1f40c90ee2f50a42818eb0e2a58f1611a9e99905390c31d337ab61151219dacd2957614507241b65715dc199bcafca5453f715f2d77791db2b17d5
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwm:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

tKFrXhn.exe

Path C:\Windows\System\tKFrXhn.exe
Size 1.7MB
SHA256 1473095a26bdc2eb0528e683af994b3abde7494215094cbac996e545fd9c18a1
MD5 942e27a25d6e0cc9e9e61b50428d544a
SHA1 678985022687a333009aac9933eb4f0de9c357b4
SHA512 5a95f9b6ddf07317752e45cf9034803fa8ac478aa4264b5276c0a4d80f3b588772c0081c06e121271aa1b67062f6d6d9215e18e19619640e4f4a7f1f4f0f4b1e
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwc:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbTfcGF.exe

Path C:\Windows\System\tbTfcGF.exe
Size 1.7MB
SHA256 7e0041f5732c465413defdd84657797c3e9ea4079f86bc88717cdf269dfb31c2
MD5 a4aa4101259be623b0260a81fcf9c6f8
SHA1 b763f75280807623609e620267d409a7a942db13
SHA512 6b8896a86e42e708366afeb17d05cf73e3904ca9af518e3a55bcb4abb49a9b878e13e4e3e9f60b9af8c0049bc27443e88ff5e612872409879478c3b936be758b
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADw+:NABd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tobBgCd.exe

Path C:\Windows\System\tobBgCd.exe
Size 1.7MB
SHA256 db949e2b3e09424ece695d8ff94d930064ac669477d970e4ec88bb03111e9fe7
MD5 fe7005946c0d078a541937c6a4543d0c
SHA1 949588410b1bb7f3b80b1bd7b76733f8b2c52862
SHA512 603a0b3dca06f406a9d925699c5075f9746f82a5d13920fa6e48666431c7469caa07dcd156311717a0d9fabac4510f8c87af7edd78b8cd8ded2f86bd1361b860
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwq:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

uRaPNeL.exe

Path C:\Windows\System\uRaPNeL.exe
Size 1.7MB
SHA256 4d3c9c872a06c1eb3f3b7422031199e385a3c5f59321adade66642e4626caf74
MD5 9030dc86b1e1ec4dcbb7bd74e8f42e2a
SHA1 2f5acbad9278a0387c325afb9c833e3f82b1b9b7
SHA512 611ef051d7f688fa286170a65c93d55a034a39d9f71e4945b8b6988beb54d47dd4e03169b1d7ccdd63f3d66fbc6fddfe2af8c68fc030b37b43eac104163d5b26
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwv:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

wgoBaqN.exe

Path C:\Windows\System\wgoBaqN.exe
Size 1.7MB
SHA256 40f967e3b230670a748cb7f959243788a22568449964998cb4b07aec8e35e6e6
MD5 3299c82e2566c9e4a19151c1e2aabb59
SHA1 dd555b282d3ec977fb7b8f043b0ae48c5a253a8e
SHA512 a9c4caa82a0af81405c3483d93d0ca0b3f7f733902cae6d4e53bbc0a1b63dd9b5fcfe1bf7650ceebe362b8bedec908bb81865f53a9c6d98427bca8133c6cf058
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwZ:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

wicDyJI.exe

Path C:\Windows\System\wicDyJI.exe
Size 1.7MB
SHA256 d39bd7f3bb90c4b4e0b90cdfe4be603448c9d82ed43a983f9bbbbfea01905076
MD5 fa8b18750243bf333d2bdaeb92818835
SHA1 2e9e5e5a7e33515c84ddd472d5d42672eeca5ded
SHA512 becb0c036e28a662b2399e9009ce81f0473b321edda91811447afabd1221ae5566c92594fb0f702ab2c06f767ed252e676fc95fb08db7e0680239e16bbeaf5d2
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwI:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

xikTOKv.exe

Path C:\Windows\System\xikTOKv.exe
Size 1.7MB
SHA256 478ca94108dd347dbb5977af26700a154260284e5f735abaa8b7c2f558f0c358
MD5 56af5797ee8c3ed749e0ccbd63255fa8
SHA1 0dd3aca62a085e785c40b72d75a7481373838106
SHA512 43d8820eaab0e624fe137394736c07ddb8fc884ac440a899b186b5f0f05a814cbcc59fec90b3bc3bcd639c041b05a435cdb3bbeff520789b7e3a420116c325a3
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADwI:NABH
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqgNXdA.exe

Path C:\Windows\System\yqgNXdA.exe
Size 1.7MB
SHA256 82f839f69fdd0d632c5f83e16781f195cdc3f9ea6e859e81672b3bda9654b691
MD5 7608cd626776279abb73c0d90deb7855
SHA1 f0a3a904401634a0b39cf59e8866a85ea6f996f3
SHA512 eee2503b602d9ff19b11bcc0c196e70452b9351ca3257081cee22ab108e846d2a4c45771b3b86be6d1a6e863f8676d30b30f184b05b1d8316e2eed32e74a9faf
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADww:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-2704-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp

Download

memory/536-86-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp

Download

memory/548-91-0x00007FF6AEB00000-0x00007FF6AEEF2000-memory.dmp

Download

memory/548-2706-0x00007FF6AEB00000-0x00007FF6AEEF2000-memory.dmp

Download

memory/860-392-0x00007FF6D6410000-0x00007FF6D6802000-memory.dmp

Download

memory/860-2743-0x00007FF6D6410000-0x00007FF6D6802000-memory.dmp

Download

memory/1148-384-0x00007FF6BD2D0000-0x00007FF6BD6C2000-memory.dmp

Download

memory/1148-2725-0x00007FF6BD2D0000-0x00007FF6BD6C2000-memory.dmp

Download

memory/1276-70-0x00007FF62F630000-0x00007FF62FA22000-memory.dmp

Download

memory/1276-2694-0x00007FF62F630000-0x00007FF62FA22000-memory.dmp

Download

memory/1568-360-0x00007FF7A0030000-0x00007FF7A0422000-memory.dmp

Download

memory/1568-2731-0x00007FF7A0030000-0x00007FF7A0422000-memory.dmp

Download

memory/1728-2697-0x00007FF7BE960000-0x00007FF7BED52000-memory.dmp

Download

memory/1728-76-0x00007FF7BE960000-0x00007FF7BED52000-memory.dmp

Download

memory/2256-2729-0x00007FF76FC90000-0x00007FF770082000-memory.dmp

Download

memory/2256-369-0x00007FF76FC90000-0x00007FF770082000-memory.dmp

Download

memory/2496-2711-0x00007FF754390000-0x00007FF754782000-memory.dmp

Download

memory/2496-95-0x00007FF754390000-0x00007FF754782000-memory.dmp

Download

memory/2600-2701-0x00007FF7532B0000-0x00007FF7536A2000-memory.dmp

Download

memory/2600-83-0x00007FF7532B0000-0x00007FF7536A2000-memory.dmp

Download

memory/2788-2739-0x00007FF7267C0000-0x00007FF726BB2000-memory.dmp

Download

memory/2788-399-0x00007FF7267C0000-0x00007FF726BB2000-memory.dmp

Download

memory/3104-2702-0x00007FF62CF10000-0x00007FF62D302000-memory.dmp

Download

memory/3104-309-0x00007FF62CF10000-0x00007FF62D302000-memory.dmp

Download

memory/3120-2719-0x00007FF7AE890000-0x00007FF7AEC82000-memory.dmp

Download

memory/3120-313-0x00007FF7AE890000-0x00007FF7AEC82000-memory.dmp

Download

memory/3148-346-0x00007FF7B8600000-0x00007FF7B89F2000-memory.dmp

Download

memory/3148-2733-0x00007FF7B8600000-0x00007FF7B89F2000-memory.dmp

Download

memory/3188-2727-0x00007FF711D30000-0x00007FF712122000-memory.dmp

Download

memory/3188-378-0x00007FF711D30000-0x00007FF712122000-memory.dmp

Download

memory/3356-317-0x00007FF7C3B30000-0x00007FF7C3F22000-memory.dmp

Download

memory/3356-2715-0x00007FF7C3B30000-0x00007FF7C3F22000-memory.dmp

Download

memory/3568-342-0x00007FF68A6D0000-0x00007FF68AAC2000-memory.dmp

Download

memory/3568-2737-0x00007FF68A6D0000-0x00007FF68AAC2000-memory.dmp

Download

memory/3628-0-0x00007FF627800000-0x00007FF627BF2000-memory.dmp

Download

memory/3628-1-0x0000026AAF470000-0x0000026AAF480000-memory.dmp

Download

memory/3736-96-0x00007FF668110000-0x00007FF668502000-memory.dmp

Download

memory/3736-2720-0x00007FF668110000-0x00007FF668502000-memory.dmp

Download

memory/3776-321-0x00007FF649190000-0x00007FF649582000-memory.dmp

Download

memory/3776-2709-0x00007FF649190000-0x00007FF649582000-memory.dmp

Download

memory/3916-325-0x00007FF7DF110000-0x00007FF7DF502000-memory.dmp

Download

memory/3916-2722-0x00007FF7DF110000-0x00007FF7DF502000-memory.dmp

Download

memory/4212-2735-0x00007FF66C1B0000-0x00007FF66C5A2000-memory.dmp

Download

memory/4212-345-0x00007FF66C1B0000-0x00007FF66C5A2000-memory.dmp

Download

memory/4480-2685-0x00007FFA95280000-0x00007FFA95D41000-memory.dmp

Download

memory/4480-2645-0x00007FFA95280000-0x00007FFA95D41000-memory.dmp

Download

memory/4480-2644-0x00007FFA95283000-0x00007FFA95285000-memory.dmp

Download

memory/4480-39-0x000002063F960000-0x000002063F982000-memory.dmp

Download

memory/4480-38-0x00007FFA95280000-0x00007FFA95D41000-memory.dmp

Download

memory/4480-56-0x00007FFA95280000-0x00007FFA95D41000-memory.dmp

Download

memory/4480-373-0x00000206404D0000-0x0000020640C76000-memory.dmp

Download

memory/4480-3-0x00007FFA95283000-0x00007FFA95285000-memory.dmp

Download

memory/4600-2698-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp

Download

memory/4600-105-0x00007FF66FCE0000-0x00007FF6700D2000-memory.dmp

Download

memory/4740-2713-0x00007FF623380000-0x00007FF623772000-memory.dmp

Download

memory/4740-85-0x00007FF623380000-0x00007FF623772000-memory.dmp

Download

memory/4884-99-0x00007FF64B9E0000-0x00007FF64BDD2000-memory.dmp

Download

memory/4884-2717-0x00007FF64B9E0000-0x00007FF64BDD2000-memory.dmp

Download