xmrig | aa6269cdea5430075fd89ca3c59e30b14fe8bdb52238cf88e1e36ba78cf55a7c

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
Size 1.7MB
Sample240526-lchvzsec63
SHA256 aa6269cdea5430075fd89ca3c59e30b14fe8bdb52238cf88e1e36ba78cf55a7c
MD5 0122ac17c3725e40c899de8f8865c6c0
SHA1 5d0c0ca0ae687a3cbe42ad5e8ae2b3848f95656c
SHA512 97bf1cd1e7da9af28100af9c7eda77de9f9fe32a422c2e82d6df0a16c736f7117533dd22bbb89a94d55845081e428a312a9200d0bfe59b595d2e3f634620b5e8
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADK:NAB4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/5032-78-0x00007FF603580000-0x00007FF603972000-memory.dmp	xmrig
behavioral2/memory/4508-116-0x00007FF747210000-0x00007FF747602000-memory.dmp	xmrig
behavioral2/memory/264-163-0x00007FF77A820000-0x00007FF77AC12000-memory.dmp	xmrig
behavioral2/memory/5028-151-0x00007FF6D81B0000-0x00007FF6D85A2000-memory.dmp	xmrig
behavioral2/memory/2936-145-0x00007FF72E7D0000-0x00007FF72EBC2000-memory.dmp	xmrig
behavioral2/memory/4288-129-0x00007FF706D10000-0x00007FF707102000-memory.dmp	xmrig
behavioral2/memory/3952-128-0x00007FF694FF0000-0x00007FF6953E2000-memory.dmp	xmrig
behavioral2/memory/2364-117-0x00007FF62F3A0000-0x00007FF62F792000-memory.dmp	xmrig
behavioral2/memory/4864-112-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp	xmrig
behavioral2/memory/840-106-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp	xmrig
behavioral2/memory/3420-101-0x00007FF69C220000-0x00007FF69C612000-memory.dmp	xmrig
behavioral2/memory/3516-97-0x00007FF7C5990000-0x00007FF7C5D82000-memory.dmp	xmrig
behavioral2/memory/4800-92-0x00007FF68F170000-0x00007FF68F562000-memory.dmp	xmrig
behavioral2/memory/4700-88-0x00007FF6E4260000-0x00007FF6E4652000-memory.dmp	xmrig
behavioral2/memory/764-84-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp	xmrig
behavioral2/memory/1992-79-0x00007FF673E60000-0x00007FF674252000-memory.dmp	xmrig
behavioral2/memory/2376-75-0x00007FF722B30000-0x00007FF722F22000-memory.dmp	xmrig
behavioral2/memory/2812-69-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp	xmrig
behavioral2/memory/3868-39-0x00007FF794570000-0x00007FF794962000-memory.dmp	xmrig
behavioral2/memory/1116-30-0x00007FF6539F0000-0x00007FF653DE2000-memory.dmp	xmrig
behavioral2/memory/3212-2827-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp	xmrig
behavioral2/memory/2280-2829-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp	xmrig
behavioral2/memory/2560-2830-0x00007FF759080000-0x00007FF759472000-memory.dmp	xmrig
behavioral2/memory/2812-2831-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp	xmrig
behavioral2/memory/840-2864-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp	xmrig
behavioral2/memory/3212-2878-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp	xmrig
behavioral2/memory/2280-2888-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp	xmrig
behavioral2/memory/764-2911-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp	xmrig
behavioral2/memory/3868-2913-0x00007FF794570000-0x00007FF794962000-memory.dmp	xmrig
behavioral2/memory/4700-2922-0x00007FF6E4260000-0x00007FF6E4652000-memory.dmp	xmrig
behavioral2/memory/4800-2925-0x00007FF68F170000-0x00007FF68F562000-memory.dmp	xmrig
behavioral2/memory/2560-2921-0x00007FF759080000-0x00007FF759472000-memory.dmp	xmrig
behavioral2/memory/116-2904-0x00007FF6D42E0000-0x00007FF6D46D2000-memory.dmp	xmrig
behavioral2/memory/1116-2903-0x00007FF6539F0000-0x00007FF653DE2000-memory.dmp	xmrig
behavioral2/memory/4864-2938-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp	xmrig
behavioral2/memory/4508-2937-0x00007FF747210000-0x00007FF747602000-memory.dmp	xmrig
behavioral2/memory/3420-2942-0x00007FF69C220000-0x00007FF69C612000-memory.dmp	xmrig
behavioral2/memory/2376-2940-0x00007FF722B30000-0x00007FF722F22000-memory.dmp	xmrig
behavioral2/memory/4288-2945-0x00007FF706D10000-0x00007FF707102000-memory.dmp	xmrig
behavioral2/memory/2364-2935-0x00007FF62F3A0000-0x00007FF62F792000-memory.dmp	xmrig
behavioral2/memory/1992-2928-0x00007FF673E60000-0x00007FF674252000-memory.dmp	xmrig
behavioral2/memory/3516-2933-0x00007FF7C5990000-0x00007FF7C5D82000-memory.dmp	xmrig
behavioral2/memory/5032-2931-0x00007FF603580000-0x00007FF603972000-memory.dmp	xmrig
behavioral2/memory/2812-2926-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp	xmrig
behavioral2/memory/3952-2946-0x00007FF694FF0000-0x00007FF6953E2000-memory.dmp	xmrig
behavioral2/memory/264-2951-0x00007FF77A820000-0x00007FF77AC12000-memory.dmp	xmrig
behavioral2/memory/5028-2956-0x00007FF6D81B0000-0x00007FF6D85A2000-memory.dmp	xmrig
behavioral2/memory/2936-2959-0x00007FF72E7D0000-0x00007FF72EBC2000-memory.dmp	xmrig
behavioral2/memory/116-2954-0x00007FF6D42E0000-0x00007FF6D46D2000-memory.dmp	xmrig
behavioral2/memory/840-3096-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	2840	powershell.exe
10	2840	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2840	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3212	QoyaXCN.exe
2280	mrNJwAT.exe
1116	mouyBZy.exe
764	DnKdidU.exe
3868	WUHjAlk.exe
4700	RWingYO.exe
2560	PdRfyqW.exe
2812	gRecHhy.exe
4800	gyFofzu.exe
3516	kpeNFti.exe
2376	MVItDgy.exe
5032	URBLTVV.exe
1992	pGvNNJH.exe
3420	uTXvXpz.exe
840	Kpnuuye.exe
4864	nuGlRRs.exe
4508	tSzPTwo.exe
2364	ZdHVHST.exe
3952	kcTBebJ.exe
4288	RfnaemA.exe
2936	ojzscMN.exe
5028	CjRxpPY.exe
116	zkIIuyE.exe
264	yjBzWHE.exe
4040	LzbvjvR.exe
4348	zfNaaei.exe
2644	RfASBLL.exe
5116	aaxfjTL.exe
2236	QvNapRv.exe
1500	lvmivWr.exe
5088	GeLPrPk.exe
1916	gvhuIUo.exe
552	QOCCPVE.exe
1888	myalwLJ.exe
1988	cvJkkmz.exe
4936	woFhYxs.exe
5128	UVVvjLr.exe
5156	zjNOQQu.exe
5180	OPcozzZ.exe
5212	vqERewC.exe
5240	hMFlkIl.exe
5276	yAsCHkL.exe
5304	wFQVfYN.exe
5328	IhqGkha.exe
5356	oiMbZoS.exe
5400	DUQOUzI.exe
5428	teDuJof.exe
5452	heBYFAL.exe
5484	vOvRjqb.exe
5508	RPACavD.exe
5540	XwMDgmw.exe
5572	SwLBpei.exe
5600	czkSKyG.exe
5628	FINipfd.exe
5656	jhqAmfG.exe
5684	RMkOnTF.exe
5708	iOchsed.exe
5740	wiCqqhc.exe
5768	BCDiKFb.exe
5796	RvUGIeY.exe
5824	xgFcupR.exe
5852	WIuQThL.exe
5880	eysezRJ.exe
5904	kqbiwDt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1056-0-0x00007FF6FEFF0000-0x00007FF6FF3E2000-memory.dmp	upx
behavioral2/files/0x0007000000023524-6.dat	upx
behavioral2/files/0x0007000000023526-24.dat	upx
behavioral2/files/0x0007000000023527-45.dat	upx
behavioral2/files/0x000700000002352a-57.dat	upx
behavioral2/files/0x000700000002352c-65.dat	upx
behavioral2/memory/5032-78-0x00007FF603580000-0x00007FF603972000-memory.dmp	upx
behavioral2/files/0x0008000000023520-89.dat	upx
behavioral2/files/0x0007000000023531-94.dat	upx
behavioral2/files/0x0007000000023532-100.dat	upx
behavioral2/memory/4508-116-0x00007FF747210000-0x00007FF747602000-memory.dmp	upx
behavioral2/files/0x0007000000023534-123.dat	upx
behavioral2/files/0x000700000002353e-176.dat	upx
behavioral2/files/0x0007000000023541-196.dat	upx
behavioral2/files/0x000700000002353f-194.dat	upx
behavioral2/files/0x0007000000023540-191.dat	upx
behavioral2/files/0x0008000000023539-189.dat	upx
behavioral2/files/0x000700000002353d-179.dat	upx
behavioral2/files/0x000700000002353c-174.dat	upx
behavioral2/files/0x000800000002353a-169.dat	upx
behavioral2/files/0x000700000002353b-164.dat	upx
behavioral2/memory/264-163-0x00007FF77A820000-0x00007FF77AC12000-memory.dmp	upx
behavioral2/files/0x0007000000023538-158.dat	upx
behavioral2/memory/116-157-0x00007FF6D42E0000-0x00007FF6D46D2000-memory.dmp	upx
behavioral2/files/0x0007000000023537-152.dat	upx
behavioral2/memory/5028-151-0x00007FF6D81B0000-0x00007FF6D85A2000-memory.dmp	upx
behavioral2/files/0x0007000000023536-146.dat	upx
behavioral2/memory/2936-145-0x00007FF72E7D0000-0x00007FF72EBC2000-memory.dmp	upx
behavioral2/files/0x0007000000023535-140.dat	upx
behavioral2/memory/4288-129-0x00007FF706D10000-0x00007FF707102000-memory.dmp	upx
behavioral2/memory/3952-128-0x00007FF694FF0000-0x00007FF6953E2000-memory.dmp	upx
behavioral2/files/0x0007000000023533-118.dat	upx
behavioral2/memory/2364-117-0x00007FF62F3A0000-0x00007FF62F792000-memory.dmp	upx
behavioral2/memory/4864-112-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp	upx
behavioral2/memory/840-106-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp	upx
behavioral2/memory/3420-101-0x00007FF69C220000-0x00007FF69C612000-memory.dmp	upx
behavioral2/memory/3516-97-0x00007FF7C5990000-0x00007FF7C5D82000-memory.dmp	upx
behavioral2/files/0x0007000000023530-93.dat	upx
behavioral2/memory/4800-92-0x00007FF68F170000-0x00007FF68F562000-memory.dmp	upx
behavioral2/memory/4700-88-0x00007FF6E4260000-0x00007FF6E4652000-memory.dmp	upx
behavioral2/memory/764-84-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp	upx
behavioral2/files/0x000700000002352f-82.dat	upx
behavioral2/memory/1992-79-0x00007FF673E60000-0x00007FF674252000-memory.dmp	upx
behavioral2/files/0x000700000002352b-76.dat	upx
behavioral2/memory/2376-75-0x00007FF722B30000-0x00007FF722F22000-memory.dmp	upx
behavioral2/files/0x000700000002352e-72.dat	upx
behavioral2/memory/2812-69-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp	upx
behavioral2/files/0x000700000002352d-67.dat	upx
behavioral2/files/0x0007000000023529-48.dat	upx
behavioral2/files/0x0007000000023528-46.dat	upx
behavioral2/memory/2560-44-0x00007FF759080000-0x00007FF759472000-memory.dmp	upx
behavioral2/memory/3868-39-0x00007FF794570000-0x00007FF794962000-memory.dmp	upx
behavioral2/files/0x0007000000023525-32.dat	upx
behavioral2/memory/1116-30-0x00007FF6539F0000-0x00007FF653DE2000-memory.dmp	upx
behavioral2/memory/2280-23-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp	upx
behavioral2/files/0x0007000000023523-15.dat	upx
behavioral2/files/0x000800000002351f-9.dat	upx
behavioral2/memory/3212-8-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp	upx
behavioral2/memory/3212-2827-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp	upx
behavioral2/memory/2280-2829-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp	upx
behavioral2/memory/2560-2830-0x00007FF759080000-0x00007FF759472000-memory.dmp	upx
behavioral2/memory/2812-2831-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp	upx
behavioral2/memory/840-2864-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp	upx
behavioral2/memory/3212-2878-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PlPRljJ.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\bMZZSOU.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\xdmFpwN.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\wCkvqlK.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\fkWqRQj.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ntgJDTn.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\YGmmFRB.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\JmWZdPM.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\eysezRJ.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\lNRDTWP.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ZPqpGvH.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\QCueDQl.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ciiJZEr.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\nWfmHEF.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\RKhiKiM.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\BuxbmVq.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\JlOmufo.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ycgUYuj.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\rRuIlrL.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\NNEPjAr.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\lnvHxTw.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\EWXZMnD.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\DIurXTg.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\YDfQiTS.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\oasxRKM.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\tjIflGr.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\hAvQNke.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\OBuvjIT.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\yVNfHMY.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\KWrgBmI.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\SSFsQiz.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\tSzPTwo.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\UpFqXyE.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\mETPxBu.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\qlGNPCz.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\XuxMtKH.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ZJEeRkj.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\vIbMurY.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\QIXvUFd.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\THZwjjI.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\PMlQVVm.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\xsQZbrf.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\Jmznfhn.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\WcgRijC.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ojzscMN.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\dkgXLBM.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\ETOTmBC.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\eIcJDFG.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\oQpzxDz.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\EXXrbmV.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\qFzSybF.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\TLjIpqc.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\pNkbyOV.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\IKGmQhC.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\NGLSmUX.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\CgraqNF.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\vfqTJGw.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\vCeTMsn.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\LvVwHNp.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\QfNilVm.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\vnsIPnD.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\dvWBFNt.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\XipqALz.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
File created	C:\Windows\System\sNvkHNX.exe	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2840	powershell.exe
2840	powershell.exe
2840	powershell.exe
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2840	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	92
PID 1056 wrote to memory of 2840	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	92
PID 1056 wrote to memory of 3212	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	93
PID 1056 wrote to memory of 3212	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	93
PID 1056 wrote to memory of 2280	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	94
PID 1056 wrote to memory of 2280	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	94
PID 1056 wrote to memory of 1116	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	95
PID 1056 wrote to memory of 1116	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	95
PID 1056 wrote to memory of 764	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	96
PID 1056 wrote to memory of 764	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	96
PID 1056 wrote to memory of 3868	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	97
PID 1056 wrote to memory of 3868	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	97
PID 1056 wrote to memory of 4700	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	98
PID 1056 wrote to memory of 4700	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	98
PID 1056 wrote to memory of 2560	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	99
PID 1056 wrote to memory of 2560	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	99
PID 1056 wrote to memory of 2812	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	100
PID 1056 wrote to memory of 2812	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	100
PID 1056 wrote to memory of 4800	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	101
PID 1056 wrote to memory of 4800	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	101
PID 1056 wrote to memory of 1992	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	102
PID 1056 wrote to memory of 1992	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	102
PID 1056 wrote to memory of 3516	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	103
PID 1056 wrote to memory of 3516	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	103
PID 1056 wrote to memory of 2376	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	104
PID 1056 wrote to memory of 2376	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	104
PID 1056 wrote to memory of 5032	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	105
PID 1056 wrote to memory of 5032	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	105
PID 1056 wrote to memory of 3420	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	106
PID 1056 wrote to memory of 3420	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	106
PID 1056 wrote to memory of 840	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	107
PID 1056 wrote to memory of 840	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	107
PID 1056 wrote to memory of 4864	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	108
PID 1056 wrote to memory of 4864	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	108
PID 1056 wrote to memory of 4508	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	109
PID 1056 wrote to memory of 4508	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	109
PID 1056 wrote to memory of 2364	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	110
PID 1056 wrote to memory of 2364	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	110
PID 1056 wrote to memory of 3952	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	111
PID 1056 wrote to memory of 3952	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	111
PID 1056 wrote to memory of 4288	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	112
PID 1056 wrote to memory of 4288	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	112
PID 1056 wrote to memory of 2936	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	113
PID 1056 wrote to memory of 2936	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	113
PID 1056 wrote to memory of 5028	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	114
PID 1056 wrote to memory of 5028	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	114
PID 1056 wrote to memory of 116	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	115
PID 1056 wrote to memory of 116	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	115
PID 1056 wrote to memory of 264	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	116
PID 1056 wrote to memory of 264	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	116
PID 1056 wrote to memory of 4040	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	117
PID 1056 wrote to memory of 4040	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	117
PID 1056 wrote to memory of 4348	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	118
PID 1056 wrote to memory of 4348	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	118
PID 1056 wrote to memory of 2644	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	119
PID 1056 wrote to memory of 2644	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	119
PID 1056 wrote to memory of 5116	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	120
PID 1056 wrote to memory of 5116	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	120
PID 1056 wrote to memory of 2236	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	121
PID 1056 wrote to memory of 2236	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	121
PID 1056 wrote to memory of 1500	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	122
PID 1056 wrote to memory of 1500	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	122
PID 1056 wrote to memory of 5088	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	123
PID 1056 wrote to memory of 5088	1056	0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0122ac17c3725e40c899de8f8865c6c0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2840" "2956" "2888" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3336
- C:\Windows\System\QoyaXCN.exe
  C:\Windows\System\QoyaXCN.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\mrNJwAT.exe
  C:\Windows\System\mrNJwAT.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\mouyBZy.exe
  C:\Windows\System\mouyBZy.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\DnKdidU.exe
  C:\Windows\System\DnKdidU.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\WUHjAlk.exe
  C:\Windows\System\WUHjAlk.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\RWingYO.exe
  C:\Windows\System\RWingYO.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\PdRfyqW.exe
  C:\Windows\System\PdRfyqW.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\gRecHhy.exe
  C:\Windows\System\gRecHhy.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\gyFofzu.exe
  C:\Windows\System\gyFofzu.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\pGvNNJH.exe
  C:\Windows\System\pGvNNJH.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\kpeNFti.exe
  C:\Windows\System\kpeNFti.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\MVItDgy.exe
  C:\Windows\System\MVItDgy.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\URBLTVV.exe
  C:\Windows\System\URBLTVV.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\uTXvXpz.exe
  C:\Windows\System\uTXvXpz.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\Kpnuuye.exe
  C:\Windows\System\Kpnuuye.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\nuGlRRs.exe
  C:\Windows\System\nuGlRRs.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\tSzPTwo.exe
  C:\Windows\System\tSzPTwo.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\ZdHVHST.exe
  C:\Windows\System\ZdHVHST.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\kcTBebJ.exe
  C:\Windows\System\kcTBebJ.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\RfnaemA.exe
  C:\Windows\System\RfnaemA.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ojzscMN.exe
  C:\Windows\System\ojzscMN.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\CjRxpPY.exe
  C:\Windows\System\CjRxpPY.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\zkIIuyE.exe
  C:\Windows\System\zkIIuyE.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\yjBzWHE.exe
  C:\Windows\System\yjBzWHE.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\LzbvjvR.exe
  C:\Windows\System\LzbvjvR.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\zfNaaei.exe
  C:\Windows\System\zfNaaei.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\RfASBLL.exe
  C:\Windows\System\RfASBLL.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\aaxfjTL.exe
  C:\Windows\System\aaxfjTL.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\QvNapRv.exe
  C:\Windows\System\QvNapRv.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\lvmivWr.exe
  C:\Windows\System\lvmivWr.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\GeLPrPk.exe
  C:\Windows\System\GeLPrPk.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\gvhuIUo.exe
  C:\Windows\System\gvhuIUo.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\QOCCPVE.exe
  C:\Windows\System\QOCCPVE.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\myalwLJ.exe
  C:\Windows\System\myalwLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\cvJkkmz.exe
  C:\Windows\System\cvJkkmz.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\woFhYxs.exe
  C:\Windows\System\woFhYxs.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\UVVvjLr.exe
  C:\Windows\System\UVVvjLr.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\zjNOQQu.exe
  C:\Windows\System\zjNOQQu.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\OPcozzZ.exe
  C:\Windows\System\OPcozzZ.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\vqERewC.exe
  C:\Windows\System\vqERewC.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\hMFlkIl.exe
  C:\Windows\System\hMFlkIl.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\yAsCHkL.exe
  C:\Windows\System\yAsCHkL.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\wFQVfYN.exe
  C:\Windows\System\wFQVfYN.exe
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Windows\System\IhqGkha.exe
  C:\Windows\System\IhqGkha.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\oiMbZoS.exe
  C:\Windows\System\oiMbZoS.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\DUQOUzI.exe
  C:\Windows\System\DUQOUzI.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\teDuJof.exe
  C:\Windows\System\teDuJof.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\heBYFAL.exe
  C:\Windows\System\heBYFAL.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\vOvRjqb.exe
  C:\Windows\System\vOvRjqb.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\RPACavD.exe
  C:\Windows\System\RPACavD.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\System\XwMDgmw.exe
  C:\Windows\System\XwMDgmw.exe
  2⤵
  - Executes dropped EXE
  PID:5540
- C:\Windows\System\SwLBpei.exe
  C:\Windows\System\SwLBpei.exe
  2⤵
  - Executes dropped EXE
  PID:5572
- C:\Windows\System\czkSKyG.exe
  C:\Windows\System\czkSKyG.exe
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Windows\System\FINipfd.exe
  C:\Windows\System\FINipfd.exe
  2⤵
  - Executes dropped EXE
  PID:5628
- C:\Windows\System\jhqAmfG.exe
  C:\Windows\System\jhqAmfG.exe
  2⤵
  - Executes dropped EXE
  PID:5656
- C:\Windows\System\RMkOnTF.exe
  C:\Windows\System\RMkOnTF.exe
  2⤵
  - Executes dropped EXE
  PID:5684
- C:\Windows\System\iOchsed.exe
  C:\Windows\System\iOchsed.exe
  2⤵
  - Executes dropped EXE
  PID:5708
- C:\Windows\System\wiCqqhc.exe
  C:\Windows\System\wiCqqhc.exe
  2⤵
  - Executes dropped EXE
  PID:5740
- C:\Windows\System\BCDiKFb.exe
  C:\Windows\System\BCDiKFb.exe
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Windows\System\RvUGIeY.exe
  C:\Windows\System\RvUGIeY.exe
  2⤵
  - Executes dropped EXE
  PID:5796
- C:\Windows\System\xgFcupR.exe
  C:\Windows\System\xgFcupR.exe
  2⤵
  - Executes dropped EXE
  PID:5824
- C:\Windows\System\WIuQThL.exe
  C:\Windows\System\WIuQThL.exe
  2⤵
  - Executes dropped EXE
  PID:5852
- C:\Windows\System\eysezRJ.exe
  C:\Windows\System\eysezRJ.exe
  2⤵
  - Executes dropped EXE
  PID:5880
- C:\Windows\System\kqbiwDt.exe
  C:\Windows\System\kqbiwDt.exe
  2⤵
  - Executes dropped EXE
  PID:5904
- C:\Windows\System\xagIgXl.exe
  C:\Windows\System\xagIgXl.exe
  2⤵
  PID:5936
- C:\Windows\System\sNFtGWm.exe
  C:\Windows\System\sNFtGWm.exe
  2⤵
  PID:5964
- C:\Windows\System\fSCzsiQ.exe
  C:\Windows\System\fSCzsiQ.exe
  2⤵
  PID:5992
- C:\Windows\System\rYuXnZv.exe
  C:\Windows\System\rYuXnZv.exe
  2⤵
  PID:6032
- C:\Windows\System\ipVraEM.exe
  C:\Windows\System\ipVraEM.exe
  2⤵
  PID:6060
- C:\Windows\System\ePzuZNg.exe
  C:\Windows\System\ePzuZNg.exe
  2⤵
  PID:6088
- C:\Windows\System\ZfQvcQu.exe
  C:\Windows\System\ZfQvcQu.exe
  2⤵
  PID:6108
- C:\Windows\System\RKPoVtE.exe
  C:\Windows\System\RKPoVtE.exe
  2⤵
  PID:6136
- C:\Windows\System\QxHhqPH.exe
  C:\Windows\System\QxHhqPH.exe
  2⤵
  PID:3484
- C:\Windows\System\prsAjiv.exe
  C:\Windows\System\prsAjiv.exe
  2⤵
  PID:5104
- C:\Windows\System\Ypwwxgm.exe
  C:\Windows\System\Ypwwxgm.exe
  2⤵
  PID:672
- C:\Windows\System\pOVxUBX.exe
  C:\Windows\System\pOVxUBX.exe
  2⤵
  PID:5140
- C:\Windows\System\ijRcCiW.exe
  C:\Windows\System\ijRcCiW.exe
  2⤵
  PID:5204
- C:\Windows\System\hsUxEcB.exe
  C:\Windows\System\hsUxEcB.exe
  2⤵
  PID:5264
- C:\Windows\System\mfgPIsB.exe
  C:\Windows\System\mfgPIsB.exe
  2⤵
  PID:5324
- C:\Windows\System\lMnNAme.exe
  C:\Windows\System\lMnNAme.exe
  2⤵
  PID:5416
- C:\Windows\System\sOQATOj.exe
  C:\Windows\System\sOQATOj.exe
  2⤵
  PID:5476
- C:\Windows\System\dMGWIYP.exe
  C:\Windows\System\dMGWIYP.exe
  2⤵
  PID:1772
- C:\Windows\System\VegyFNJ.exe
  C:\Windows\System\VegyFNJ.exe
  2⤵
  PID:5616
- C:\Windows\System\REHxrVZ.exe
  C:\Windows\System\REHxrVZ.exe
  2⤵
  PID:5676
- C:\Windows\System\RJxdkBs.exe
  C:\Windows\System\RJxdkBs.exe
  2⤵
  PID:5752
- C:\Windows\System\sYxsgpS.exe
  C:\Windows\System\sYxsgpS.exe
  2⤵
  PID:2124
- C:\Windows\System\AumokyI.exe
  C:\Windows\System\AumokyI.exe
  2⤵
  PID:5864
- C:\Windows\System\xeRdTGa.exe
  C:\Windows\System\xeRdTGa.exe
  2⤵
  PID:5920
- C:\Windows\System\iqNlhpi.exe
  C:\Windows\System\iqNlhpi.exe
  2⤵
  PID:5984
- C:\Windows\System\OeaHrpP.exe
  C:\Windows\System\OeaHrpP.exe
  2⤵
  PID:6056
- C:\Windows\System\ASqUhMU.exe
  C:\Windows\System\ASqUhMU.exe
  2⤵
  PID:6120
- C:\Windows\System\RLKovrN.exe
  C:\Windows\System\RLKovrN.exe
  2⤵
  PID:2420
- C:\Windows\System\orQdqag.exe
  C:\Windows\System\orQdqag.exe
  2⤵
  PID:1204
- C:\Windows\System\TxbPQvB.exe
  C:\Windows\System\TxbPQvB.exe
  2⤵
  PID:5196
- C:\Windows\System\nrTATzS.exe
  C:\Windows\System\nrTATzS.exe
  2⤵
  PID:5384
- C:\Windows\System\vFlSEgl.exe
  C:\Windows\System\vFlSEgl.exe
  2⤵
  PID:5504
- C:\Windows\System\iUsoKeR.exe
  C:\Windows\System\iUsoKeR.exe
  2⤵
  PID:5592
- C:\Windows\System\PhGGVje.exe
  C:\Windows\System\PhGGVje.exe
  2⤵
  PID:5780
- C:\Windows\System\DGJXqgb.exe
  C:\Windows\System\DGJXqgb.exe
  2⤵
  PID:5836
- C:\Windows\System\VpMbvZA.exe
  C:\Windows\System\VpMbvZA.exe
  2⤵
  PID:5956
- C:\Windows\System\oBjyvuj.exe
  C:\Windows\System\oBjyvuj.exe
  2⤵
  PID:6104
- C:\Windows\System\BlvZLid.exe
  C:\Windows\System\BlvZLid.exe
  2⤵
  PID:912
- C:\Windows\System\jkNvZAs.exe
  C:\Windows\System\jkNvZAs.exe
  2⤵
  PID:5176
- C:\Windows\System\GRymUaj.exe
  C:\Windows\System\GRymUaj.exe
  2⤵
  PID:5448
- C:\Windows\System\lxtJLKI.exe
  C:\Windows\System\lxtJLKI.exe
  2⤵
  PID:4172
- C:\Windows\System\inTgKlr.exe
  C:\Windows\System\inTgKlr.exe
  2⤵
  PID:6164
- C:\Windows\System\khAIAXJ.exe
  C:\Windows\System\khAIAXJ.exe
  2⤵
  PID:6192
- C:\Windows\System\olhdNtO.exe
  C:\Windows\System\olhdNtO.exe
  2⤵
  PID:6220
- C:\Windows\System\ddEyHrx.exe
  C:\Windows\System\ddEyHrx.exe
  2⤵
  PID:6248
- C:\Windows\System\CgraqNF.exe
  C:\Windows\System\CgraqNF.exe
  2⤵
  PID:6276
- C:\Windows\System\mAEoBbH.exe
  C:\Windows\System\mAEoBbH.exe
  2⤵
  PID:6304
- C:\Windows\System\vjJDZBd.exe
  C:\Windows\System\vjJDZBd.exe
  2⤵
  PID:6332
- C:\Windows\System\TzIrZpk.exe
  C:\Windows\System\TzIrZpk.exe
  2⤵
  PID:6360
- C:\Windows\System\AQghuTc.exe
  C:\Windows\System\AQghuTc.exe
  2⤵
  PID:6388
- C:\Windows\System\ubiVOau.exe
  C:\Windows\System\ubiVOau.exe
  2⤵
  PID:6416
- C:\Windows\System\GxTUVOk.exe
  C:\Windows\System\GxTUVOk.exe
  2⤵
  PID:6444
- C:\Windows\System\lAUGgoZ.exe
  C:\Windows\System\lAUGgoZ.exe
  2⤵
  PID:6480
- C:\Windows\System\JgVdeGv.exe
  C:\Windows\System\JgVdeGv.exe
  2⤵
  PID:6508
- C:\Windows\System\rWCHcHO.exe
  C:\Windows\System\rWCHcHO.exe
  2⤵
  PID:6536
- C:\Windows\System\GgJpYdZ.exe
  C:\Windows\System\GgJpYdZ.exe
  2⤵
  PID:6568
- C:\Windows\System\NukxfTd.exe
  C:\Windows\System\NukxfTd.exe
  2⤵
  PID:6600
- C:\Windows\System\DoGPVUN.exe
  C:\Windows\System\DoGPVUN.exe
  2⤵
  PID:6628
- C:\Windows\System\NAUgryM.exe
  C:\Windows\System\NAUgryM.exe
  2⤵
  PID:6656
- C:\Windows\System\rebVoVB.exe
  C:\Windows\System\rebVoVB.exe
  2⤵
  PID:6684
- C:\Windows\System\bsNlGvL.exe
  C:\Windows\System\bsNlGvL.exe
  2⤵
  PID:6712
- C:\Windows\System\bHsUIJc.exe
  C:\Windows\System\bHsUIJc.exe
  2⤵
  PID:6740
- C:\Windows\System\ZHHzNSU.exe
  C:\Windows\System\ZHHzNSU.exe
  2⤵
  PID:6768
- C:\Windows\System\LjZGFzj.exe
  C:\Windows\System\LjZGFzj.exe
  2⤵
  PID:6800
- C:\Windows\System\YrWzSqT.exe
  C:\Windows\System\YrWzSqT.exe
  2⤵
  PID:6824
- C:\Windows\System\TNSIjAZ.exe
  C:\Windows\System\TNSIjAZ.exe
  2⤵
  PID:6852
- C:\Windows\System\wrPMhym.exe
  C:\Windows\System\wrPMhym.exe
  2⤵
  PID:6880
- C:\Windows\System\JFpllmQ.exe
  C:\Windows\System\JFpllmQ.exe
  2⤵
  PID:6908
- C:\Windows\System\aZiKHab.exe
  C:\Windows\System\aZiKHab.exe
  2⤵
  PID:6940
- C:\Windows\System\dAsyTME.exe
  C:\Windows\System\dAsyTME.exe
  2⤵
  PID:6964
- C:\Windows\System\xKigjIk.exe
  C:\Windows\System\xKigjIk.exe
  2⤵
  PID:6992
- C:\Windows\System\OqyTykW.exe
  C:\Windows\System\OqyTykW.exe
  2⤵
  PID:7024
- C:\Windows\System\sMZjKQZ.exe
  C:\Windows\System\sMZjKQZ.exe
  2⤵
  PID:7048
- C:\Windows\System\ZFiWbMb.exe
  C:\Windows\System\ZFiWbMb.exe
  2⤵
  PID:7128
- C:\Windows\System\EnrHcgO.exe
  C:\Windows\System\EnrHcgO.exe
  2⤵
  PID:7144
- C:\Windows\System\woGqFhq.exe
  C:\Windows\System\woGqFhq.exe
  2⤵
  PID:3852
- C:\Windows\System\hXCcLiL.exe
  C:\Windows\System\hXCcLiL.exe
  2⤵
  PID:6100
- C:\Windows\System\bWYnaAA.exe
  C:\Windows\System\bWYnaAA.exe
  2⤵
  PID:5172
- C:\Windows\System\ExwaKNV.exe
  C:\Windows\System\ExwaKNV.exe
  2⤵
  PID:6208
- C:\Windows\System\vjuQgzh.exe
  C:\Windows\System\vjuQgzh.exe
  2⤵
  PID:6236
- C:\Windows\System\BPFazmd.exe
  C:\Windows\System\BPFazmd.exe
  2⤵
  PID:6320
- C:\Windows\System\Syzfvbu.exe
  C:\Windows\System\Syzfvbu.exe
  2⤵
  PID:6348
- C:\Windows\System\Wevrjbc.exe
  C:\Windows\System\Wevrjbc.exe
  2⤵
  PID:6384
- C:\Windows\System\OefEKmb.exe
  C:\Windows\System\OefEKmb.exe
  2⤵
  PID:6456
- C:\Windows\System\bVAVmiO.exe
  C:\Windows\System\bVAVmiO.exe
  2⤵
  PID:6472
- C:\Windows\System\hoVzwyR.exe
  C:\Windows\System\hoVzwyR.exe
  2⤵
  PID:6524
- C:\Windows\System\zpZqaFf.exe
  C:\Windows\System\zpZqaFf.exe
  2⤵
  PID:6560
- C:\Windows\System\xvsNrik.exe
  C:\Windows\System\xvsNrik.exe
  2⤵
  PID:1384
- C:\Windows\System\QIXvUFd.exe
  C:\Windows\System\QIXvUFd.exe
  2⤵
  PID:2052
- C:\Windows\System\dXMfLoc.exe
  C:\Windows\System\dXMfLoc.exe
  2⤵
  PID:6736
- C:\Windows\System\IHuBAwN.exe
  C:\Windows\System\IHuBAwN.exe
  2⤵
  PID:6764
- C:\Windows\System\rpvdHNw.exe
  C:\Windows\System\rpvdHNw.exe
  2⤵
  PID:1832
- C:\Windows\System\txJjeSg.exe
  C:\Windows\System\txJjeSg.exe
  2⤵
  PID:4888
- C:\Windows\System\LjXORWp.exe
  C:\Windows\System\LjXORWp.exe
  2⤵
  PID:4604
- C:\Windows\System\DEKxYJh.exe
  C:\Windows\System\DEKxYJh.exe
  2⤵
  PID:6872
- C:\Windows\System\TdyeucK.exe
  C:\Windows\System\TdyeucK.exe
  2⤵
  PID:6924
- C:\Windows\System\DpKYKer.exe
  C:\Windows\System\DpKYKer.exe
  2⤵
  PID:6960
- C:\Windows\System\radDdHX.exe
  C:\Windows\System\radDdHX.exe
  2⤵
  PID:7008
- C:\Windows\System\OMjhiqv.exe
  C:\Windows\System\OMjhiqv.exe
  2⤵
  PID:7080
- C:\Windows\System\NGrOske.exe
  C:\Windows\System\NGrOske.exe
  2⤵
  PID:1260
- C:\Windows\System\oEiJVom.exe
  C:\Windows\System\oEiJVom.exe
  2⤵
  PID:1708
- C:\Windows\System\CGwKjaa.exe
  C:\Windows\System\CGwKjaa.exe
  2⤵
  PID:4616
- C:\Windows\System\fpNHEzB.exe
  C:\Windows\System\fpNHEzB.exe
  2⤵
  PID:1644
- C:\Windows\System\RVKGxMa.exe
  C:\Windows\System\RVKGxMa.exe
  2⤵
  PID:4624
- C:\Windows\System\AlBqfHK.exe
  C:\Windows\System\AlBqfHK.exe
  2⤵
  PID:608
- C:\Windows\System\iVgNgnT.exe
  C:\Windows\System\iVgNgnT.exe
  2⤵
  PID:2980
- C:\Windows\System\hyXaxPh.exe
  C:\Windows\System\hyXaxPh.exe
  2⤵
  PID:4232
- C:\Windows\System\TQfRaYQ.exe
  C:\Windows\System\TQfRaYQ.exe
  2⤵
  PID:3184
- C:\Windows\System\SuOMQxk.exe
  C:\Windows\System\SuOMQxk.exe
  2⤵
  PID:6440
- C:\Windows\System\Dzpbhhv.exe
  C:\Windows\System\Dzpbhhv.exe
  2⤵
  PID:6496
- C:\Windows\System\NiQwSpU.exe
  C:\Windows\System\NiQwSpU.exe
  2⤵
  PID:2240
- C:\Windows\System\eFWOvuv.exe
  C:\Windows\System\eFWOvuv.exe
  2⤵
  PID:4520
- C:\Windows\System\WTRBcmq.exe
  C:\Windows\System\WTRBcmq.exe
  2⤵
  PID:4488
- C:\Windows\System\fCyAMrB.exe
  C:\Windows\System\fCyAMrB.exe
  2⤵
  PID:2064
- C:\Windows\System\aExDQKb.exe
  C:\Windows\System\aExDQKb.exe
  2⤵
  PID:3480
- C:\Windows\System\FLvRRQH.exe
  C:\Windows\System\FLvRRQH.exe
  2⤵
  PID:1388
- C:\Windows\System\DHWurdP.exe
  C:\Windows\System\DHWurdP.exe
  2⤵
  PID:7136
- C:\Windows\System\rIVhMYX.exe
  C:\Windows\System\rIVhMYX.exe
  2⤵
  PID:5112
- C:\Windows\System\VjOAKZX.exe
  C:\Windows\System\VjOAKZX.exe
  2⤵
  PID:4640
- C:\Windows\System\gWkHXfh.exe
  C:\Windows\System\gWkHXfh.exe
  2⤵
  PID:2556
- C:\Windows\System\STgrWKa.exe
  C:\Windows\System\STgrWKa.exe
  2⤵
  PID:6932
- C:\Windows\System\XlrDSrB.exe
  C:\Windows\System\XlrDSrB.exe
  2⤵
  PID:6080
- C:\Windows\System\tQfcLXh.exe
  C:\Windows\System\tQfcLXh.exe
  2⤵
  PID:4972
- C:\Windows\System\tCBhZST.exe
  C:\Windows\System\tCBhZST.exe
  2⤵
  PID:6328
- C:\Windows\System\iPGEtGy.exe
  C:\Windows\System\iPGEtGy.exe
  2⤵
  PID:7072
- C:\Windows\System\HjeNKDf.exe
  C:\Windows\System\HjeNKDf.exe
  2⤵
  PID:7224
- C:\Windows\System\WcLawBp.exe
  C:\Windows\System\WcLawBp.exe
  2⤵
  PID:7240
- C:\Windows\System\bWdZlXI.exe
  C:\Windows\System\bWdZlXI.exe
  2⤵
  PID:7260
- C:\Windows\System\DlYvEnK.exe
  C:\Windows\System\DlYvEnK.exe
  2⤵
  PID:7296
- C:\Windows\System\WPNmiCM.exe
  C:\Windows\System\WPNmiCM.exe
  2⤵
  PID:7336
- C:\Windows\System\qxuHlKn.exe
  C:\Windows\System\qxuHlKn.exe
  2⤵
  PID:7372
- C:\Windows\System\CKrdIKL.exe
  C:\Windows\System\CKrdIKL.exe
  2⤵
  PID:7396
- C:\Windows\System\jeUQHsK.exe
  C:\Windows\System\jeUQHsK.exe
  2⤵
  PID:7416
- C:\Windows\System\jOtXFle.exe
  C:\Windows\System\jOtXFle.exe
  2⤵
  PID:7432
- C:\Windows\System\RRIKOyw.exe
  C:\Windows\System\RRIKOyw.exe
  2⤵
  PID:7452
- C:\Windows\System\IQONyUQ.exe
  C:\Windows\System\IQONyUQ.exe
  2⤵
  PID:7480
- C:\Windows\System\KyHTWjV.exe
  C:\Windows\System\KyHTWjV.exe
  2⤵
  PID:7504
- C:\Windows\System\qOdeOSD.exe
  C:\Windows\System\qOdeOSD.exe
  2⤵
  PID:7524
- C:\Windows\System\yAgxOEG.exe
  C:\Windows\System\yAgxOEG.exe
  2⤵
  PID:7564
- C:\Windows\System\WmeFjaf.exe
  C:\Windows\System\WmeFjaf.exe
  2⤵
  PID:7584
- C:\Windows\System\sKdwbPv.exe
  C:\Windows\System\sKdwbPv.exe
  2⤵
  PID:7608
- C:\Windows\System\wskLBfl.exe
  C:\Windows\System\wskLBfl.exe
  2⤵
  PID:7628
- C:\Windows\System\xHMeGwr.exe
  C:\Windows\System\xHMeGwr.exe
  2⤵
  PID:7672
- C:\Windows\System\jFaGwMG.exe
  C:\Windows\System\jFaGwMG.exe
  2⤵
  PID:7700
- C:\Windows\System\pExRPVf.exe
  C:\Windows\System\pExRPVf.exe
  2⤵
  PID:7720
- C:\Windows\System\rdpnlRA.exe
  C:\Windows\System\rdpnlRA.exe
  2⤵
  PID:7744
- C:\Windows\System\IEoeYGz.exe
  C:\Windows\System\IEoeYGz.exe
  2⤵
  PID:7776
- C:\Windows\System\zAHhEhv.exe
  C:\Windows\System\zAHhEhv.exe
  2⤵
  PID:7828
- C:\Windows\System\NDMAToc.exe
  C:\Windows\System\NDMAToc.exe
  2⤵
  PID:7864
- C:\Windows\System\hFlbgdq.exe
  C:\Windows\System\hFlbgdq.exe
  2⤵
  PID:7884
- C:\Windows\System\dIHdwCr.exe
  C:\Windows\System\dIHdwCr.exe
  2⤵
  PID:7908
- C:\Windows\System\NmYJxWt.exe
  C:\Windows\System\NmYJxWt.exe
  2⤵
  PID:7952
- C:\Windows\System\oTZboHd.exe
  C:\Windows\System\oTZboHd.exe
  2⤵
  PID:7972
- C:\Windows\System\xiwDiTt.exe
  C:\Windows\System\xiwDiTt.exe
  2⤵
  PID:8008
- C:\Windows\System\AqbytFt.exe
  C:\Windows\System\AqbytFt.exe
  2⤵
  PID:8036
- C:\Windows\System\MaDgANF.exe
  C:\Windows\System\MaDgANF.exe
  2⤵
  PID:8052
- C:\Windows\System\PlPRljJ.exe
  C:\Windows\System\PlPRljJ.exe
  2⤵
  PID:8076
- C:\Windows\System\aFjGrze.exe
  C:\Windows\System\aFjGrze.exe
  2⤵
  PID:8092
- C:\Windows\System\mVxwOmP.exe
  C:\Windows\System\mVxwOmP.exe
  2⤵
  PID:8116
- C:\Windows\System\wjFBoED.exe
  C:\Windows\System\wjFBoED.exe
  2⤵
  PID:8180
- C:\Windows\System\TTfgDcA.exe
  C:\Windows\System\TTfgDcA.exe
  2⤵
  PID:6268
- C:\Windows\System\BJduUQQ.exe
  C:\Windows\System\BJduUQQ.exe
  2⤵
  PID:7248
- C:\Windows\System\rHPeiJO.exe
  C:\Windows\System\rHPeiJO.exe
  2⤵
  PID:7288
- C:\Windows\System\PXmaJNW.exe
  C:\Windows\System\PXmaJNW.exe
  2⤵
  PID:7320
- C:\Windows\System\KkvfNbB.exe
  C:\Windows\System\KkvfNbB.exe
  2⤵
  PID:7384
- C:\Windows\System\dkgXLBM.exe
  C:\Windows\System\dkgXLBM.exe
  2⤵
  PID:7472
- C:\Windows\System\mqVPshT.exe
  C:\Windows\System\mqVPshT.exe
  2⤵
  PID:7520
- C:\Windows\System\WAzGASS.exe
  C:\Windows\System\WAzGASS.exe
  2⤵
  PID:7616
- C:\Windows\System\hyMbgtI.exe
  C:\Windows\System\hyMbgtI.exe
  2⤵
  PID:7604
- C:\Windows\System\YZOikxW.exe
  C:\Windows\System\YZOikxW.exe
  2⤵
  PID:7752
- C:\Windows\System\TKKjgak.exe
  C:\Windows\System\TKKjgak.exe
  2⤵
  PID:7712
- C:\Windows\System\ksmyRZD.exe
  C:\Windows\System\ksmyRZD.exe
  2⤵
  PID:7796
- C:\Windows\System\TGOpTAS.exe
  C:\Windows\System\TGOpTAS.exe
  2⤵
  PID:7840
- C:\Windows\System\XrztYzj.exe
  C:\Windows\System\XrztYzj.exe
  2⤵
  PID:7896
- C:\Windows\System\XAYUYRT.exe
  C:\Windows\System\XAYUYRT.exe
  2⤵
  PID:7968
- C:\Windows\System\yKGzwTx.exe
  C:\Windows\System\yKGzwTx.exe
  2⤵
  PID:8028
- C:\Windows\System\joFRmiy.exe
  C:\Windows\System\joFRmiy.exe
  2⤵
  PID:8144
- C:\Windows\System\qbtZxDZ.exe
  C:\Windows\System\qbtZxDZ.exe
  2⤵
  PID:3628
- C:\Windows\System\arCAMPc.exe
  C:\Windows\System\arCAMPc.exe
  2⤵
  PID:6468
- C:\Windows\System\HdmquAg.exe
  C:\Windows\System\HdmquAg.exe
  2⤵
  PID:7388
- C:\Windows\System\hwlwWDh.exe
  C:\Windows\System\hwlwWDh.exe
  2⤵
  PID:7556
- C:\Windows\System\YJFijwh.exe
  C:\Windows\System\YJFijwh.exe
  2⤵
  PID:7732
- C:\Windows\System\mYmNpFG.exe
  C:\Windows\System\mYmNpFG.exe
  2⤵
  PID:7880
- C:\Windows\System\qTFQZRp.exe
  C:\Windows\System\qTFQZRp.exe
  2⤵
  PID:8088
- C:\Windows\System\mMDRObm.exe
  C:\Windows\System\mMDRObm.exe
  2⤵
  PID:7272
- C:\Windows\System\UHOeLyO.exe
  C:\Windows\System\UHOeLyO.exe
  2⤵
  PID:7644
- C:\Windows\System\CuPMOXZ.exe
  C:\Windows\System\CuPMOXZ.exe
  2⤵
  PID:8004
- C:\Windows\System\NanuyZf.exe
  C:\Windows\System\NanuyZf.exe
  2⤵
  PID:8188
- C:\Windows\System\uIVfLdo.exe
  C:\Windows\System\uIVfLdo.exe
  2⤵
  PID:7692
- C:\Windows\System\BnYAMnz.exe
  C:\Windows\System\BnYAMnz.exe
  2⤵
  PID:8212
- C:\Windows\System\OBGlcHX.exe
  C:\Windows\System\OBGlcHX.exe
  2⤵
  PID:8248
- C:\Windows\System\YXfwDzw.exe
  C:\Windows\System\YXfwDzw.exe
  2⤵
  PID:8284
- C:\Windows\System\gHlAfqQ.exe
  C:\Windows\System\gHlAfqQ.exe
  2⤵
  PID:8312
- C:\Windows\System\xzerHQz.exe
  C:\Windows\System\xzerHQz.exe
  2⤵
  PID:8340
- C:\Windows\System\JOzmUXQ.exe
  C:\Windows\System\JOzmUXQ.exe
  2⤵
  PID:8356
- C:\Windows\System\hTiWzYH.exe
  C:\Windows\System\hTiWzYH.exe
  2⤵
  PID:8392
- C:\Windows\System\lOXaNbR.exe
  C:\Windows\System\lOXaNbR.exe
  2⤵
  PID:8412
- C:\Windows\System\MQCeflN.exe
  C:\Windows\System\MQCeflN.exe
  2⤵
  PID:8444
- C:\Windows\System\XoyGKTh.exe
  C:\Windows\System\XoyGKTh.exe
  2⤵
  PID:8460
- C:\Windows\System\TjlixBZ.exe
  C:\Windows\System\TjlixBZ.exe
  2⤵
  PID:8488
- C:\Windows\System\aFYTrhn.exe
  C:\Windows\System\aFYTrhn.exe
  2⤵
  PID:8504
- C:\Windows\System\IxOqchK.exe
  C:\Windows\System\IxOqchK.exe
  2⤵
  PID:8520
- C:\Windows\System\ITaZirB.exe
  C:\Windows\System\ITaZirB.exe
  2⤵
  PID:8552
- C:\Windows\System\KniFuaN.exe
  C:\Windows\System\KniFuaN.exe
  2⤵
  PID:8600
- C:\Windows\System\EPeXxwf.exe
  C:\Windows\System\EPeXxwf.exe
  2⤵
  PID:8632
- C:\Windows\System\bGEntQM.exe
  C:\Windows\System\bGEntQM.exe
  2⤵
  PID:8672
- C:\Windows\System\MdUelZv.exe
  C:\Windows\System\MdUelZv.exe
  2⤵
  PID:8712
- C:\Windows\System\LRczmKI.exe
  C:\Windows\System\LRczmKI.exe
  2⤵
  PID:8732
- C:\Windows\System\AEJSdpA.exe
  C:\Windows\System\AEJSdpA.exe
  2⤵
  PID:8780
- C:\Windows\System\BDyGNXj.exe
  C:\Windows\System\BDyGNXj.exe
  2⤵
  PID:8796
- C:\Windows\System\zEKYnUq.exe
  C:\Windows\System\zEKYnUq.exe
  2⤵
  PID:8824
- C:\Windows\System\qiWfAOZ.exe
  C:\Windows\System\qiWfAOZ.exe
  2⤵
  PID:8860
- C:\Windows\System\sbKKrxi.exe
  C:\Windows\System\sbKKrxi.exe
  2⤵
  PID:8876
- C:\Windows\System\rmcNlCh.exe
  C:\Windows\System\rmcNlCh.exe
  2⤵
  PID:8900
- C:\Windows\System\mfAEzBQ.exe
  C:\Windows\System\mfAEzBQ.exe
  2⤵
  PID:8940
- C:\Windows\System\dAdYqGz.exe
  C:\Windows\System\dAdYqGz.exe
  2⤵
  PID:8972
- C:\Windows\System\zSyUEzH.exe
  C:\Windows\System\zSyUEzH.exe
  2⤵
  PID:9000
- C:\Windows\System\azWeQCJ.exe
  C:\Windows\System\azWeQCJ.exe
  2⤵
  PID:9024
- C:\Windows\System\qzixROx.exe
  C:\Windows\System\qzixROx.exe
  2⤵
  PID:9048
- C:\Windows\System\DQfUGLn.exe
  C:\Windows\System\DQfUGLn.exe
  2⤵
  PID:9064
- C:\Windows\System\VXgtKQZ.exe
  C:\Windows\System\VXgtKQZ.exe
  2⤵
  PID:9088
- C:\Windows\System\kPuXujl.exe
  C:\Windows\System\kPuXujl.exe
  2⤵
  PID:9116
- C:\Windows\System\LzclAwO.exe
  C:\Windows\System\LzclAwO.exe
  2⤵
  PID:9140
- C:\Windows\System\lrWvjkz.exe
  C:\Windows\System\lrWvjkz.exe
  2⤵
  PID:9156
- C:\Windows\System\FFIulcu.exe
  C:\Windows\System\FFIulcu.exe
  2⤵
  PID:9184
- C:\Windows\System\HGyNBsI.exe
  C:\Windows\System\HGyNBsI.exe
  2⤵
  PID:9200
- C:\Windows\System\wVNqQzl.exe
  C:\Windows\System\wVNqQzl.exe
  2⤵
  PID:8260
- C:\Windows\System\AsQTGzv.exe
  C:\Windows\System\AsQTGzv.exe
  2⤵
  PID:8304
- C:\Windows\System\AndoFtk.exe
  C:\Windows\System\AndoFtk.exe
  2⤵
  PID:8436
- C:\Windows\System\jNBisdQ.exe
  C:\Windows\System\jNBisdQ.exe
  2⤵
  PID:8456
- C:\Windows\System\XroGUAT.exe
  C:\Windows\System\XroGUAT.exe
  2⤵
  PID:8424
- C:\Windows\System\PBmkCwp.exe
  C:\Windows\System\PBmkCwp.exe
  2⤵
  PID:8608
- C:\Windows\System\NIfPxWl.exe
  C:\Windows\System\NIfPxWl.exe
  2⤵
  PID:8648
- C:\Windows\System\mqaJDUN.exe
  C:\Windows\System\mqaJDUN.exe
  2⤵
  PID:8708
- C:\Windows\System\tjIflGr.exe
  C:\Windows\System\tjIflGr.exe
  2⤵
  PID:8816
- C:\Windows\System\IgrcTDg.exe
  C:\Windows\System\IgrcTDg.exe
  2⤵
  PID:8884
- C:\Windows\System\GkQVNjs.exe
  C:\Windows\System\GkQVNjs.exe
  2⤵
  PID:8948
- C:\Windows\System\ljgZATs.exe
  C:\Windows\System\ljgZATs.exe
  2⤵
  PID:9012
- C:\Windows\System\AaEluHf.exe
  C:\Windows\System\AaEluHf.exe
  2⤵
  PID:9072
- C:\Windows\System\aJronxy.exe
  C:\Windows\System\aJronxy.exe
  2⤵
  PID:9096
- C:\Windows\System\DFVWqwH.exe
  C:\Windows\System\DFVWqwH.exe
  2⤵
  PID:9132
- C:\Windows\System\aSeKpIl.exe
  C:\Windows\System\aSeKpIl.exe
  2⤵
  PID:9148
- C:\Windows\System\PUhkrnJ.exe
  C:\Windows\System\PUhkrnJ.exe
  2⤵
  PID:8336
- C:\Windows\System\sglVIva.exe
  C:\Windows\System\sglVIva.exe
  2⤵
  PID:8548
- C:\Windows\System\swGaPYv.exe
  C:\Windows\System\swGaPYv.exe
  2⤵
  PID:8760
- C:\Windows\System\UeQMySx.exe
  C:\Windows\System\UeQMySx.exe
  2⤵
  PID:8740
- C:\Windows\System\KxpvYru.exe
  C:\Windows\System\KxpvYru.exe
  2⤵
  PID:8992
- C:\Windows\System\FVIwuzQ.exe
  C:\Windows\System\FVIwuzQ.exe
  2⤵
  PID:8932
- C:\Windows\System\YxqMive.exe
  C:\Windows\System\YxqMive.exe
  2⤵
  PID:9196
- C:\Windows\System\dvWBFNt.exe
  C:\Windows\System\dvWBFNt.exe
  2⤵
  PID:8612
- C:\Windows\System\DOdEfst.exe
  C:\Windows\System\DOdEfst.exe
  2⤵
  PID:9112
- C:\Windows\System\jmJtwjI.exe
  C:\Windows\System\jmJtwjI.exe
  2⤵
  PID:8560
- C:\Windows\System\HIOxocK.exe
  C:\Windows\System\HIOxocK.exe
  2⤵
  PID:9236
- C:\Windows\System\vPxPbWt.exe
  C:\Windows\System\vPxPbWt.exe
  2⤵
  PID:9256
- C:\Windows\System\ESwKkOz.exe
  C:\Windows\System\ESwKkOz.exe
  2⤵
  PID:9280
- C:\Windows\System\hHKBUIU.exe
  C:\Windows\System\hHKBUIU.exe
  2⤵
  PID:9300
- C:\Windows\System\DlKSzXG.exe
  C:\Windows\System\DlKSzXG.exe
  2⤵
  PID:9372
- C:\Windows\System\GyNQEDt.exe
  C:\Windows\System\GyNQEDt.exe
  2⤵
  PID:9388
- C:\Windows\System\oRREpTx.exe
  C:\Windows\System\oRREpTx.exe
  2⤵
  PID:9408
- C:\Windows\System\bsUXvMR.exe
  C:\Windows\System\bsUXvMR.exe
  2⤵
  PID:9432
- C:\Windows\System\vcJHpKY.exe
  C:\Windows\System\vcJHpKY.exe
  2⤵
  PID:9452
- C:\Windows\System\PtitPWm.exe
  C:\Windows\System\PtitPWm.exe
  2⤵
  PID:9480
- C:\Windows\System\XXbeTBg.exe
  C:\Windows\System\XXbeTBg.exe
  2⤵
  PID:9508
- C:\Windows\System\qZcCOhC.exe
  C:\Windows\System\qZcCOhC.exe
  2⤵
  PID:9564
- C:\Windows\System\tRFVJZC.exe
  C:\Windows\System\tRFVJZC.exe
  2⤵
  PID:9580
- C:\Windows\System\OKdNhPA.exe
  C:\Windows\System\OKdNhPA.exe
  2⤵
  PID:9608
- C:\Windows\System\CfrJxvM.exe
  C:\Windows\System\CfrJxvM.exe
  2⤵
  PID:9628
- C:\Windows\System\xdmFpwN.exe
  C:\Windows\System\xdmFpwN.exe
  2⤵
  PID:9652
- C:\Windows\System\YFUgDlD.exe
  C:\Windows\System\YFUgDlD.exe
  2⤵
  PID:9672
- C:\Windows\System\NoPtBzI.exe
  C:\Windows\System\NoPtBzI.exe
  2⤵
  PID:9720
- C:\Windows\System\iIQdioU.exe
  C:\Windows\System\iIQdioU.exe
  2⤵
  PID:9764
- C:\Windows\System\PvgjbTp.exe
  C:\Windows\System\PvgjbTp.exe
  2⤵
  PID:9784
- C:\Windows\System\hBJffkC.exe
  C:\Windows\System\hBJffkC.exe
  2⤵
  PID:9920
- C:\Windows\System\fvvgsSd.exe
  C:\Windows\System\fvvgsSd.exe
  2⤵
  PID:9936
- C:\Windows\System\PulGtfN.exe
  C:\Windows\System\PulGtfN.exe
  2⤵
  PID:9952
- C:\Windows\System\YhwbAWo.exe
  C:\Windows\System\YhwbAWo.exe
  2⤵
  PID:9968
- C:\Windows\System\rRuIlrL.exe
  C:\Windows\System\rRuIlrL.exe
  2⤵
  PID:9984
- C:\Windows\System\sKnUyhl.exe
  C:\Windows\System\sKnUyhl.exe
  2⤵
  PID:10008
- C:\Windows\System\FGNRjib.exe
  C:\Windows\System\FGNRjib.exe
  2⤵
  PID:10080
- C:\Windows\System\rXsSizz.exe
  C:\Windows\System\rXsSizz.exe
  2⤵
  PID:10152
- C:\Windows\System\ZGDKMZf.exe
  C:\Windows\System\ZGDKMZf.exe
  2⤵
  PID:10184
- C:\Windows\System\HbtDkGY.exe
  C:\Windows\System\HbtDkGY.exe
  2⤵
  PID:10204
- C:\Windows\System\nHHgIHV.exe
  C:\Windows\System\nHHgIHV.exe
  2⤵
  PID:10220
- C:\Windows\System\puWBsgk.exe
  C:\Windows\System\puWBsgk.exe
  2⤵
  PID:9224
- C:\Windows\System\kXRZOVM.exe
  C:\Windows\System\kXRZOVM.exe
  2⤵
  PID:9292
- C:\Windows\System\lZFBRNi.exe
  C:\Windows\System\lZFBRNi.exe
  2⤵
  PID:9328
- C:\Windows\System\KguqaFG.exe
  C:\Windows\System\KguqaFG.exe
  2⤵
  PID:9380
- C:\Windows\System\OyckeRX.exe
  C:\Windows\System\OyckeRX.exe
  2⤵
  PID:9488
- C:\Windows\System\mLJRbXR.exe
  C:\Windows\System\mLJRbXR.exe
  2⤵
  PID:9560
- C:\Windows\System\imdPINw.exe
  C:\Windows\System\imdPINw.exe
  2⤵
  PID:9620
- C:\Windows\System\tBQOUCT.exe
  C:\Windows\System\tBQOUCT.exe
  2⤵
  PID:9736
- C:\Windows\System\HJBCcAx.exe
  C:\Windows\System\HJBCcAx.exe
  2⤵
  PID:9760
- C:\Windows\System\eMGheAa.exe
  C:\Windows\System\eMGheAa.exe
  2⤵
  PID:9812
- C:\Windows\System\fDcKiMy.exe
  C:\Windows\System\fDcKiMy.exe
  2⤵
  PID:9824
- C:\Windows\System\XsntpWN.exe
  C:\Windows\System\XsntpWN.exe
  2⤵
  PID:9832
- C:\Windows\System\cUHquuU.exe
  C:\Windows\System\cUHquuU.exe
  2⤵
  PID:9948
- C:\Windows\System\vROzHFj.exe
  C:\Windows\System\vROzHFj.exe
  2⤵
  PID:9980
- C:\Windows\System\gmUIlGI.exe
  C:\Windows\System\gmUIlGI.exe
  2⤵
  PID:10004
- C:\Windows\System\IPffJOi.exe
  C:\Windows\System\IPffJOi.exe
  2⤵
  PID:10072
- C:\Windows\System\PUloHYD.exe
  C:\Windows\System\PUloHYD.exe
  2⤵
  PID:10096
- C:\Windows\System\UnXMyad.exe
  C:\Windows\System\UnXMyad.exe
  2⤵
  PID:10164
- C:\Windows\System\KoJhsxT.exe
  C:\Windows\System\KoJhsxT.exe
  2⤵
  PID:8388
- C:\Windows\System\nVLwpnp.exe
  C:\Windows\System\nVLwpnp.exe
  2⤵
  PID:9272
- C:\Windows\System\XuxMtKH.exe
  C:\Windows\System\XuxMtKH.exe
  2⤵
  PID:9320
- C:\Windows\System\xSMceru.exe
  C:\Windows\System\xSMceru.exe
  2⤵
  PID:9400
- C:\Windows\System\jzpdjRV.exe
  C:\Windows\System\jzpdjRV.exe
  2⤵
  PID:9552
- C:\Windows\System\FvKvgky.exe
  C:\Windows\System\FvKvgky.exe
  2⤵
  PID:9804
- C:\Windows\System\HucpKXK.exe
  C:\Windows\System\HucpKXK.exe
  2⤵
  PID:9928
- C:\Windows\System\UJhHOio.exe
  C:\Windows\System\UJhHOio.exe
  2⤵
  PID:10044
- C:\Windows\System\OTeveGi.exe
  C:\Windows\System\OTeveGi.exe
  2⤵
  PID:9888
- C:\Windows\System\picPADo.exe
  C:\Windows\System\picPADo.exe
  2⤵
  PID:10172
- C:\Windows\System\VOYUBNC.exe
  C:\Windows\System\VOYUBNC.exe
  2⤵
  PID:9276
- C:\Windows\System\OLVJPwt.exe
  C:\Windows\System\OLVJPwt.exe
  2⤵
  PID:10028
- C:\Windows\System\GaMungF.exe
  C:\Windows\System\GaMungF.exe
  2⤵
  PID:8684
- C:\Windows\System\pgAGPRx.exe
  C:\Windows\System\pgAGPRx.exe
  2⤵
  PID:10244
- C:\Windows\System\QiuZHqP.exe
  C:\Windows\System\QiuZHqP.exe
  2⤵
  PID:10268
- C:\Windows\System\kBJujDL.exe
  C:\Windows\System\kBJujDL.exe
  2⤵
  PID:10292
- C:\Windows\System\SnyATHU.exe
  C:\Windows\System\SnyATHU.exe
  2⤵
  PID:10312
- C:\Windows\System\tQOAhIs.exe
  C:\Windows\System\tQOAhIs.exe
  2⤵
  PID:10380
- C:\Windows\System\jMryooo.exe
  C:\Windows\System\jMryooo.exe
  2⤵
  PID:10400
- C:\Windows\System\pHqmwDj.exe
  C:\Windows\System\pHqmwDj.exe
  2⤵
  PID:10424
- C:\Windows\System\LmVPLim.exe
  C:\Windows\System\LmVPLim.exe
  2⤵
  PID:10440
- C:\Windows\System\MOxEFcF.exe
  C:\Windows\System\MOxEFcF.exe
  2⤵
  PID:10484
- C:\Windows\System\UpFqXyE.exe
  C:\Windows\System\UpFqXyE.exe
  2⤵
  PID:10512
- C:\Windows\System\mvAaQMW.exe
  C:\Windows\System\mvAaQMW.exe
  2⤵
  PID:10536
- C:\Windows\System\trlCvSQ.exe
  C:\Windows\System\trlCvSQ.exe
  2⤵
  PID:10560
- C:\Windows\System\uKAAICg.exe
  C:\Windows\System\uKAAICg.exe
  2⤵
  PID:10584
- C:\Windows\System\SdmZytK.exe
  C:\Windows\System\SdmZytK.exe
  2⤵
  PID:10608
- C:\Windows\System\TMKYDXv.exe
  C:\Windows\System\TMKYDXv.exe
  2⤵
  PID:10628
- C:\Windows\System\FlqIkdv.exe
  C:\Windows\System\FlqIkdv.exe
  2⤵
  PID:10664
- C:\Windows\System\dqQMKDa.exe
  C:\Windows\System\dqQMKDa.exe
  2⤵
  PID:10684
- C:\Windows\System\LYNPpYq.exe
  C:\Windows\System\LYNPpYq.exe
  2⤵
  PID:10712
- C:\Windows\System\umghemy.exe
  C:\Windows\System\umghemy.exe
  2⤵
  PID:10728
- C:\Windows\System\FOCgmkO.exe
  C:\Windows\System\FOCgmkO.exe
  2⤵
  PID:10752
- C:\Windows\System\rCrYvdD.exe
  C:\Windows\System\rCrYvdD.exe
  2⤵
  PID:10768
- C:\Windows\System\ETOTmBC.exe
  C:\Windows\System\ETOTmBC.exe
  2⤵
  PID:10808
- C:\Windows\System\hCIidxi.exe
  C:\Windows\System\hCIidxi.exe
  2⤵
  PID:10824
- C:\Windows\System\WRvFCga.exe
  C:\Windows\System\WRvFCga.exe
  2⤵
  PID:10848
- C:\Windows\System\HHDSiCn.exe
  C:\Windows\System\HHDSiCn.exe
  2⤵
  PID:10868
- C:\Windows\System\oDrvgnl.exe
  C:\Windows\System\oDrvgnl.exe
  2⤵
  PID:10932
- C:\Windows\System\rmPcelI.exe
  C:\Windows\System\rmPcelI.exe
  2⤵
  PID:10956
- C:\Windows\System\bzeHMWn.exe
  C:\Windows\System\bzeHMWn.exe
  2⤵
  PID:10992
- C:\Windows\System\SFKzkpY.exe
  C:\Windows\System\SFKzkpY.exe
  2⤵
  PID:11024
- C:\Windows\System\ptRrhbo.exe
  C:\Windows\System\ptRrhbo.exe
  2⤵
  PID:11060
- C:\Windows\System\qlIpuWg.exe
  C:\Windows\System\qlIpuWg.exe
  2⤵
  PID:11080
- C:\Windows\System\pwicapr.exe
  C:\Windows\System\pwicapr.exe
  2⤵
  PID:11116
- C:\Windows\System\aQdixko.exe
  C:\Windows\System\aQdixko.exe
  2⤵
  PID:11140
- C:\Windows\System\dANbviS.exe
  C:\Windows\System\dANbviS.exe
  2⤵
  PID:11180
- C:\Windows\System\HtITcGn.exe
  C:\Windows\System\HtITcGn.exe
  2⤵
  PID:11204
- C:\Windows\System\cTsohcM.exe
  C:\Windows\System\cTsohcM.exe
  2⤵
  PID:11224
- C:\Windows\System\lVoolgd.exe
  C:\Windows\System\lVoolgd.exe
  2⤵
  PID:11248
- C:\Windows\System\lGUYLyL.exe
  C:\Windows\System\lGUYLyL.exe
  2⤵
  PID:10284
- C:\Windows\System\BtRdKHT.exe
  C:\Windows\System\BtRdKHT.exe
  2⤵
  PID:10308
- C:\Windows\System\dTuMrNX.exe
  C:\Windows\System\dTuMrNX.exe
  2⤵
  PID:10416
- C:\Windows\System\fHMcANB.exe
  C:\Windows\System\fHMcANB.exe
  2⤵
  PID:10436
- C:\Windows\System\pDLJPfm.exe
  C:\Windows\System\pDLJPfm.exe
  2⤵
  PID:10472
- C:\Windows\System\lrPszTU.exe
  C:\Windows\System\lrPszTU.exe
  2⤵
  PID:10528
- C:\Windows\System\rtELYJd.exe
  C:\Windows\System\rtELYJd.exe
  2⤵
  PID:10532
- C:\Windows\System\pteJDmQ.exe
  C:\Windows\System\pteJDmQ.exe
  2⤵
  PID:10580
- C:\Windows\System\mVRzRBi.exe
  C:\Windows\System\mVRzRBi.exe
  2⤵
  PID:10680
- C:\Windows\System\kaVwZmf.exe
  C:\Windows\System\kaVwZmf.exe
  2⤵
  PID:10696
- C:\Windows\System\rsvlpIK.exe
  C:\Windows\System\rsvlpIK.exe
  2⤵
  PID:10800
- C:\Windows\System\LBTREuQ.exe
  C:\Windows\System\LBTREuQ.exe
  2⤵
  PID:10912
- C:\Windows\System\MIiMLbT.exe
  C:\Windows\System\MIiMLbT.exe
  2⤵
  PID:10896
- C:\Windows\System\oRbLJtu.exe
  C:\Windows\System\oRbLJtu.exe
  2⤵
  PID:10984
- C:\Windows\System\GcOKVts.exe
  C:\Windows\System\GcOKVts.exe
  2⤵
  PID:11016
- C:\Windows\System\xvOYwph.exe
  C:\Windows\System\xvOYwph.exe
  2⤵
  PID:11124
- C:\Windows\System\kttfFYU.exe
  C:\Windows\System\kttfFYU.exe
  2⤵
  PID:9780
- C:\Windows\System\KPXDbJP.exe
  C:\Windows\System\KPXDbJP.exe
  2⤵
  PID:10336
- C:\Windows\System\laVQMVA.exe
  C:\Windows\System\laVQMVA.exe
  2⤵
  PID:10348
- C:\Windows\System\rRMBMBZ.exe
  C:\Windows\System\rRMBMBZ.exe
  2⤵
  PID:10616
- C:\Windows\System\wkyRdeI.exe
  C:\Windows\System\wkyRdeI.exe
  2⤵
  PID:10968
- C:\Windows\System\MMlvMcV.exe
  C:\Windows\System\MMlvMcV.exe
  2⤵
  PID:11020
- C:\Windows\System\rEJEWkw.exe
  C:\Windows\System\rEJEWkw.exe
  2⤵
  PID:11112
- C:\Windows\System\ejTPNNw.exe
  C:\Windows\System\ejTPNNw.exe
  2⤵
  PID:11220
- C:\Windows\System\lYNGqEQ.exe
  C:\Windows\System\lYNGqEQ.exe
  2⤵
  PID:10888
- C:\Windows\System\xQvupbB.exe
  C:\Windows\System\xQvupbB.exe
  2⤵
  PID:11256
- C:\Windows\System\paUjbYM.exe
  C:\Windows\System\paUjbYM.exe
  2⤵
  PID:11216
- C:\Windows\System\MxlHaSE.exe
  C:\Windows\System\MxlHaSE.exe
  2⤵
  PID:11284
- C:\Windows\System\EWXpKYc.exe
  C:\Windows\System\EWXpKYc.exe
  2⤵
  PID:11316
- C:\Windows\System\NIlrJGA.exe
  C:\Windows\System\NIlrJGA.exe
  2⤵
  PID:11332
- C:\Windows\System\hsrerZl.exe
  C:\Windows\System\hsrerZl.exe
  2⤵
  PID:11352
- C:\Windows\System\NNEPjAr.exe
  C:\Windows\System\NNEPjAr.exe
  2⤵
  PID:11396
- C:\Windows\System\yAuuSxU.exe
  C:\Windows\System\yAuuSxU.exe
  2⤵
  PID:11416
- C:\Windows\System\qJCuFEB.exe
  C:\Windows\System\qJCuFEB.exe
  2⤵
  PID:11432
- C:\Windows\System\MtymYEg.exe
  C:\Windows\System\MtymYEg.exe
  2⤵
  PID:11476
- C:\Windows\System\AdGgANB.exe
  C:\Windows\System\AdGgANB.exe
  2⤵
  PID:11492
- C:\Windows\System\rfeTMKN.exe
  C:\Windows\System\rfeTMKN.exe
  2⤵
  PID:11524
- C:\Windows\System\VNANevM.exe
  C:\Windows\System\VNANevM.exe
  2⤵
  PID:11556
- C:\Windows\System\BdVTTQs.exe
  C:\Windows\System\BdVTTQs.exe
  2⤵
  PID:11592
- C:\Windows\System\ENVTStG.exe
  C:\Windows\System\ENVTStG.exe
  2⤵
  PID:11608
- C:\Windows\System\iXhHAiG.exe
  C:\Windows\System\iXhHAiG.exe
  2⤵
  PID:11628
- C:\Windows\System\LTOoKDa.exe
  C:\Windows\System\LTOoKDa.exe
  2⤵
  PID:11648
- C:\Windows\System\MKgxdQh.exe
  C:\Windows\System\MKgxdQh.exe
  2⤵
  PID:11664
- C:\Windows\System\ZLAibDw.exe
  C:\Windows\System\ZLAibDw.exe
  2⤵
  PID:11688
- C:\Windows\System\gyUitWJ.exe
  C:\Windows\System\gyUitWJ.exe
  2⤵
  PID:11708
- C:\Windows\System\DFBBlbJ.exe
  C:\Windows\System\DFBBlbJ.exe
  2⤵
  PID:11792
- C:\Windows\System\UxscTMt.exe
  C:\Windows\System\UxscTMt.exe
  2⤵
  PID:11836
- C:\Windows\System\OpmoZoD.exe
  C:\Windows\System\OpmoZoD.exe
  2⤵
  PID:11856
- C:\Windows\System\GVRxgrW.exe
  C:\Windows\System\GVRxgrW.exe
  2⤵
  PID:11872
- C:\Windows\System\XczdEsY.exe
  C:\Windows\System\XczdEsY.exe
  2⤵
  PID:11908
- C:\Windows\System\uNMGaDf.exe
  C:\Windows\System\uNMGaDf.exe
  2⤵
  PID:11924
- C:\Windows\System\PtFmNtx.exe
  C:\Windows\System\PtFmNtx.exe
  2⤵
  PID:11952
- C:\Windows\System\LWxIevP.exe
  C:\Windows\System\LWxIevP.exe
  2⤵
  PID:11992
- C:\Windows\System\YwuUFvl.exe
  C:\Windows\System\YwuUFvl.exe
  2⤵
  PID:12020
- C:\Windows\System\ZckUHda.exe
  C:\Windows\System\ZckUHda.exe
  2⤵
  PID:12040
- C:\Windows\System\rtruJrH.exe
  C:\Windows\System\rtruJrH.exe
  2⤵
  PID:12084
- C:\Windows\System\zcQTGsw.exe
  C:\Windows\System\zcQTGsw.exe
  2⤵
  PID:12100
- C:\Windows\System\FcAdsgz.exe
  C:\Windows\System\FcAdsgz.exe
  2⤵
  PID:12124
- C:\Windows\System\EMwkYhy.exe
  C:\Windows\System\EMwkYhy.exe
  2⤵
  PID:12164
- C:\Windows\System\NMpGBdj.exe
  C:\Windows\System\NMpGBdj.exe
  2⤵
  PID:12200
- C:\Windows\System\IDYLzTV.exe
  C:\Windows\System\IDYLzTV.exe
  2⤵
  PID:12216
- C:\Windows\System\HmxNJzK.exe
  C:\Windows\System\HmxNJzK.exe
  2⤵
  PID:12244
- C:\Windows\System\FhTMaqY.exe
  C:\Windows\System\FhTMaqY.exe
  2⤵
  PID:12272
- C:\Windows\System\GjqoRdp.exe
  C:\Windows\System\GjqoRdp.exe
  2⤵
  PID:10796
- C:\Windows\System\YVRLOCS.exe
  C:\Windows\System\YVRLOCS.exe
  2⤵
  PID:11276
- C:\Windows\System\fHlStSl.exe
  C:\Windows\System\fHlStSl.exe
  2⤵
  PID:11408
- C:\Windows\System\BnFAbyj.exe
  C:\Windows\System\BnFAbyj.exe
  2⤵
  PID:11444
- C:\Windows\System\ObbuBAb.exe
  C:\Windows\System\ObbuBAb.exe
  2⤵
  PID:11500
- C:\Windows\System\aAwGrNf.exe
  C:\Windows\System\aAwGrNf.exe
  2⤵
  PID:1060
- C:\Windows\System\VELeuOl.exe
  C:\Windows\System\VELeuOl.exe
  2⤵
  PID:11640
- C:\Windows\System\scXJDwC.exe
  C:\Windows\System\scXJDwC.exe
  2⤵
  PID:11720
- C:\Windows\System\uasONIJ.exe
  C:\Windows\System\uasONIJ.exe
  2⤵
  PID:11684
- C:\Windows\System\Fspjrvg.exe
  C:\Windows\System\Fspjrvg.exe
  2⤵
  PID:1716
- C:\Windows\System\YovnZhU.exe
  C:\Windows\System\YovnZhU.exe
  2⤵
  PID:11848
- C:\Windows\System\vVAGYDM.exe
  C:\Windows\System\vVAGYDM.exe
  2⤵
  PID:11864
- C:\Windows\System\vpaniuW.exe
  C:\Windows\System\vpaniuW.exe
  2⤵
  PID:11960
- C:\Windows\System\PkaKkBN.exe
  C:\Windows\System\PkaKkBN.exe
  2⤵
  PID:3208
- C:\Windows\System\kdmkbIP.exe
  C:\Windows\System\kdmkbIP.exe
  2⤵
  PID:5020
- C:\Windows\System\YsSxrEe.exe
  C:\Windows\System\YsSxrEe.exe
  2⤵
  PID:12108
- C:\Windows\System\WCZogmS.exe
  C:\Windows\System\WCZogmS.exe
  2⤵
  PID:12080
- C:\Windows\System\eSfRtJw.exe
  C:\Windows\System\eSfRtJw.exe
  2⤵
  PID:12180
- C:\Windows\System\ygqwVFZ.exe
  C:\Windows\System\ygqwVFZ.exe
  2⤵
  PID:12236
- C:\Windows\System\XXziTuT.exe
  C:\Windows\System\XXziTuT.exe
  2⤵
  PID:10260
- C:\Windows\System\eADGmOJ.exe
  C:\Windows\System\eADGmOJ.exe
  2⤵
  PID:11424
- C:\Windows\System\xXIXVOD.exe
  C:\Windows\System\xXIXVOD.exe
  2⤵
  PID:11604
- C:\Windows\System\RuHbFiN.exe
  C:\Windows\System\RuHbFiN.exe
  2⤵
  PID:11568
- C:\Windows\System\OhnljNo.exe
  C:\Windows\System\OhnljNo.exe
  2⤵
  PID:11700
- C:\Windows\System\WJBBqWZ.exe
  C:\Windows\System\WJBBqWZ.exe
  2⤵
  PID:11920
- C:\Windows\System\WdMMfqm.exe
  C:\Windows\System\WdMMfqm.exe
  2⤵
  PID:12036
- C:\Windows\System\kCFlPJX.exe
  C:\Windows\System\kCFlPJX.exe
  2⤵
  PID:12208
- C:\Windows\System\ERZyFzb.exe
  C:\Windows\System\ERZyFzb.exe
  2⤵
  PID:10740
- C:\Windows\System\LAssrcz.exe
  C:\Windows\System\LAssrcz.exe
  2⤵
  PID:11520
- C:\Windows\System\mOoDSLC.exe
  C:\Windows\System\mOoDSLC.exe
  2⤵
  PID:11868
- C:\Windows\System\gSGSBNJ.exe
  C:\Windows\System\gSGSBNJ.exe
  2⤵
  PID:12072
- C:\Windows\System\CoPQwik.exe
  C:\Windows\System\CoPQwik.exe
  2⤵
  PID:12176
- C:\Windows\System\vfqTJGw.exe
  C:\Windows\System\vfqTJGw.exe
  2⤵
  PID:12300
- C:\Windows\System\lKmYbuL.exe
  C:\Windows\System\lKmYbuL.exe
  2⤵
  PID:12320
- C:\Windows\System\OvmQGYE.exe
  C:\Windows\System\OvmQGYE.exe
  2⤵
  PID:12340
- C:\Windows\System\TaxMQjk.exe
  C:\Windows\System\TaxMQjk.exe
  2⤵
  PID:12372
- C:\Windows\System\dylEhOs.exe
  C:\Windows\System\dylEhOs.exe
  2⤵
  PID:12400
- C:\Windows\System\ZwzoWEM.exe
  C:\Windows\System\ZwzoWEM.exe
  2⤵
  PID:12436
- C:\Windows\System\tGejvOp.exe
  C:\Windows\System\tGejvOp.exe
  2⤵
  PID:12452
- C:\Windows\System\IALSQAi.exe
  C:\Windows\System\IALSQAi.exe
  2⤵
  PID:12472
- C:\Windows\System\wdljQKm.exe
  C:\Windows\System\wdljQKm.exe
  2⤵
  PID:12500
- C:\Windows\System\bkxxZey.exe
  C:\Windows\System\bkxxZey.exe
  2⤵
  PID:12520
- C:\Windows\System\eDGBxlC.exe
  C:\Windows\System\eDGBxlC.exe
  2⤵
  PID:12536
- C:\Windows\System\YpLxeqe.exe
  C:\Windows\System\YpLxeqe.exe
  2⤵
  PID:12564
- C:\Windows\System\mahQpQq.exe
  C:\Windows\System\mahQpQq.exe
  2⤵
  PID:12584
- C:\Windows\System\XMSKSLK.exe
  C:\Windows\System\XMSKSLK.exe
  2⤵
  PID:12604
- C:\Windows\System\aOsgOQA.exe
  C:\Windows\System\aOsgOQA.exe
  2⤵
  PID:12620
- C:\Windows\System\iPHBBFe.exe
  C:\Windows\System\iPHBBFe.exe
  2⤵
  PID:12664
- C:\Windows\System\QfEdDyu.exe
  C:\Windows\System\QfEdDyu.exe
  2⤵
  PID:12716
- C:\Windows\System\YxhrUkm.exe
  C:\Windows\System\YxhrUkm.exe
  2⤵
  PID:12740
- C:\Windows\System\ohZWohn.exe
  C:\Windows\System\ohZWohn.exe
  2⤵
  PID:12788
- C:\Windows\System\jbqVxKs.exe
  C:\Windows\System\jbqVxKs.exe
  2⤵
  PID:12808
- C:\Windows\System\BamBDky.exe
  C:\Windows\System\BamBDky.exe
  2⤵
  PID:12832
- C:\Windows\System\lcvjINL.exe
  C:\Windows\System\lcvjINL.exe
  2⤵
  PID:12896
- C:\Windows\System\NlvDgNl.exe
  C:\Windows\System\NlvDgNl.exe
  2⤵
  PID:12916
- C:\Windows\System\OeKWnvL.exe
  C:\Windows\System\OeKWnvL.exe
  2⤵
  PID:12940
- C:\Windows\System\CkzTCSj.exe
  C:\Windows\System\CkzTCSj.exe
  2⤵
  PID:12976
- C:\Windows\System\rGcqRsL.exe
  C:\Windows\System\rGcqRsL.exe
  2⤵
  PID:13036
- C:\Windows\System\qcEuidA.exe
  C:\Windows\System\qcEuidA.exe
  2⤵
  PID:13052
- C:\Windows\System\XewIoQR.exe
  C:\Windows\System\XewIoQR.exe
  2⤵
  PID:13068
- C:\Windows\System\gVGyzaa.exe
  C:\Windows\System\gVGyzaa.exe
  2⤵
  PID:13104
- C:\Windows\System\ypqvjiy.exe
  C:\Windows\System\ypqvjiy.exe
  2⤵
  PID:13120
- C:\Windows\System\PlQSdAh.exe
  C:\Windows\System\PlQSdAh.exe
  2⤵
  PID:13152
- C:\Windows\System\yEZWTyS.exe
  C:\Windows\System\yEZWTyS.exe
  2⤵
  PID:13172
- C:\Windows\System\VVfNywK.exe
  C:\Windows\System\VVfNywK.exe
  2⤵
  PID:13188
- C:\Windows\System\DOoCIvN.exe
  C:\Windows\System\DOoCIvN.exe
  2⤵
  PID:13204
- C:\Windows\System\QmEIBam.exe
  C:\Windows\System\QmEIBam.exe
  2⤵
  PID:13232
- C:\Windows\System\tRdorvF.exe
  C:\Windows\System\tRdorvF.exe
  2⤵
  PID:13248
- C:\Windows\System\axnqGHQ.exe
  C:\Windows\System\axnqGHQ.exe
  2⤵
  PID:13272
- C:\Windows\System\xSwUnob.exe
  C:\Windows\System\xSwUnob.exe
  2⤵
  PID:13292
- C:\Windows\System\SjccYlS.exe
  C:\Windows\System\SjccYlS.exe
  2⤵
  PID:12348
- C:\Windows\System\lmatHlZ.exe
  C:\Windows\System\lmatHlZ.exe
  2⤵
  PID:12336
- C:\Windows\System\KUyNEIQ.exe
  C:\Windows\System\KUyNEIQ.exe
  2⤵
  PID:12468
- C:\Windows\System\MuOObKd.exe
  C:\Windows\System\MuOObKd.exe
  2⤵
  PID:12508
- C:\Windows\System\KxUuACn.exe
  C:\Windows\System\KxUuACn.exe
  2⤵
  PID:12724
- C:\Windows\System\bfaGWeR.exe
  C:\Windows\System\bfaGWeR.exe
  2⤵
  PID:12656
- C:\Windows\System\ELSQirc.exe
  C:\Windows\System\ELSQirc.exe
  2⤵
  PID:12824
- C:\Windows\System\WdDcFgo.exe
  C:\Windows\System\WdDcFgo.exe
  2⤵
  PID:12956
- C:\Windows\System\RISZfYv.exe
  C:\Windows\System\RISZfYv.exe
  2⤵
  PID:12984
- C:\Windows\System\JpuhRIu.exe
  C:\Windows\System\JpuhRIu.exe
  2⤵
  PID:13092
- C:\Windows\System\xhnyZwJ.exe
  C:\Windows\System\xhnyZwJ.exe
  2⤵
  PID:13200
- C:\Windows\System\hmXSfTY.exe
  C:\Windows\System\hmXSfTY.exe
  2⤵
  PID:13240
- C:\Windows\System\VyhJHEJ.exe
  C:\Windows\System\VyhJHEJ.exe
  2⤵
  PID:13224
- C:\Windows\System\LXHnVcW.exe
  C:\Windows\System\LXHnVcW.exe
  2⤵
  PID:12816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8
1⤵
PID:7108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mz30o2hr.12w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mz30o2hr.12w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CjRxpPY.exe

Path C:\Windows\System\CjRxpPY.exe
Size 1.7MB
SHA256 8e1469c5792a56a4cd3e726fe99f2989d8f982d1ffff3bc8931c21b03c59a225
MD5 9ecbfba0c66deffdbb9ce77bb1581046
SHA1 0e3e6d66c954d10ced5b7828f5d9895d684137b8
SHA512 ca2c3fd602362c82088b1d599576aed026a8681e94dd5c2cd439b5ddf76b080bc4a9b50b0fd20129f20524e93fe6dee1e00b99db49f2ed88e34e6fe20fb3e75b
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD8:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

DnKdidU.exe

Path C:\Windows\System\DnKdidU.exe
Size 1.7MB
SHA256 5926c1de1817182e4b71ba1d627f30ca34eccc0ba758dc466a7b10d5d801eff6
MD5 a875a9c6faa4d974f6026b66505586d5
SHA1 b13e7f89595e51ef3637a0d5d587dadea6acd3d7
SHA512 356657c1fdbadbbaea2b55a5fd443338970102e9ad826b46aa08e8107964f5fb07dc2fe82f14405701ebb4962d9405c35e963b9840eb6f0e10f5579f48183bcb
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADQ:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

GeLPrPk.exe

Path C:\Windows\System\GeLPrPk.exe
Size 1.7MB
SHA256 0204b5c3233ccf113bf9913bcb814b68343b007422d985c38c8eb25767db219d
MD5 979f67d6b0c6f6cef38a3ae8cd47da30
SHA1 200f0d42aa97afad645d5ff71ad5e499e153109d
SHA512 f6bb3aa24d54e47887efbe645300c145f3da5a9351696fad3bfc2ed4490a330b9380535d53df932a649b0e5b42dd2c27840afcca40a1239a3162e124b8925b41
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADL:NABF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpnuuye.exe

Path C:\Windows\System\Kpnuuye.exe
Size 1.7MB
SHA256 09d3a990e862f3e327fd78474a0b557b553c985e20e7f250def8412dd31f2c6e
MD5 be30562632cf7c74e97e475c2dd89a36
SHA1 72d655e97371e3dd64164404ce6b9753ed37dc75
SHA512 dfa33182c2f16eb5efb80bc962369066f7fb67991e81136d74b257f9b2900bcd19dc7cc720492cb0a9c3bd4b5d8fc26d5c176596bfc3df84468491bc793f7633
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADe:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

LzbvjvR.exe

Path C:\Windows\System\LzbvjvR.exe
Size 1.7MB
SHA256 871917ea5ee893aa366d8674cbb341e650ade09161663104998ae4b1dab37c9b
MD5 1e0977ed036c58f52f503282dc3caffc
SHA1 ff9a21db6da289a3a20edd5ef50d24eac1a042ee
SHA512 1ed7202482ef21b29be15ac67eacdfe6e2b411879bd2f8c874ac10e394c87c0daedaaa738d790ea1a4270bfb87b6daf56fde99f074f1c2a4dcc3a7555ef62254
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADR:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MVItDgy.exe

Path C:\Windows\System\MVItDgy.exe
Size 1.7MB
SHA256 afa59663d42f8adc78d70d23bb4e45d6f4bbb7411ca264ab770398974efb6eff
MD5 a0e599864bfec9a399170a5748bd2616
SHA1 6896c586d2c9a2a7873835cbfe3906a979139804
SHA512 b63f0e8aaa0b645501a48c8ce5a568abeb820f7b13032d494a5eb900d5d7a43292b289b4b8e083ac44a1e6d7c71cf8efc226d9a8a7715c396ceda255a5711eaf
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD/:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

PdRfyqW.exe

Path C:\Windows\System\PdRfyqW.exe
Size 1.7MB
SHA256 ffcd84673ad52dd1e207b1cc00ad5885e47ee51eaa8a7d17237f46ac8fa867ea
MD5 8651c8b6de37b0c19abfabcf2fd0fc82
SHA1 15d6667017987a4ed62249e606781f85263cc342
SHA512 bc88b8b90bca01e98d32e3e129d921ff0046842cd984a71dff8d9eb2622ebaf9bf68565d3c3e10126c42fda58019fb3f347805cd371e0bad846ee980171db20d
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADD:NABN
MD5 SHA1 SHA512 SSDEEP

Submit Download

QOCCPVE.exe

Path C:\Windows\System\QOCCPVE.exe
Size 1.7MB
SHA256 42db9cfa2813b5261b9d25c306b31c7e60c76c629c7f8d3d11df199f79e27a92
MD5 0c98fdb33c02374112d72c0143f7018c
SHA1 a356bd3d2dade7c0f01d8b3c6bb48ca4237bd586
SHA512 e56163330f221e9a30cfe8285ca21ccae8db3392a0d1759d143b1fd1739a4373e9f1bcbf655b2877be89bdaf4d248b805fc62ac483d868cc8e0caa6d24350657
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADP:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

QoyaXCN.exe

Path C:\Windows\System\QoyaXCN.exe
Size 1.7MB
SHA256 ab117917e3d1f02971e9f6faeaf1872f3146b9208049790c56cd93484feed9d6
MD5 d7ab49ccc7e42007089bec823897014c
SHA1 263a1fb849309df18d1a28de34bbf72a7711f043
SHA512 fcda00989f4a0bb78ea703fbebdeb59868f2be5a64c9a8e39258f095af1ac79921e81e572261cd870f66a82ba05afc9e2fe4520c76f31cc80e2b80d6cb93fe27
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADr:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

QvNapRv.exe

Path C:\Windows\System\QvNapRv.exe
Size 1.7MB
SHA256 bf59a481909fe19033a071bce5c54b0f09c7fbaa9ef2213a288297121f95a683
MD5 4f61dda8e8588bb07976e3d27a8d1acd
SHA1 6594d562927f1c927f57dab49eef2c7cfb95ad1f
SHA512 0658d600ca24835db9f8fba6c2c3d38b714a34c0613d1d20011520a0fcdc6b3f525f30a9808bf42fde0e339baf2fb80e88dbbe74bbf205caecf86af8ce130999
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADF:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

RWingYO.exe

Path C:\Windows\System\RWingYO.exe
Size 1.7MB
SHA256 995a032229e8102321ba4d0a432091e5700f95325cb9930841a184ccad2a77b2
MD5 23a92b513a9e39e4572d1b819053a640
SHA1 cc2956734cc11bc3d9da021f9788f610b5bec7f3
SHA512 9964b77c551956d26bc99b359aa72687674bd2cf6d342f882c94d790f63ff11a2b382e125defc80364886ba331010afdf01c9f523db64ab4b8e8057bb44fb56b
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD4:NABS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RfASBLL.exe

Path C:\Windows\System\RfASBLL.exe
Size 1.7MB
SHA256 24167ea4433528fc1949dfd3c68465a174511fe3bb3662b2d8fb9dba4f7bd832
MD5 10f18224bae8504e706bb1b20cffdf20
SHA1 3087970757207f5ed8b2bf3b02b4fbc3bf5e0f32
SHA512 4a2ef869ef3bbae6620e672d43fac7b1b11777cc4a83ad27460c374d07bee96441ed62dc5fc3fdabf2ae3f9f807f2eea2f4acf8b49b79678f20c466b5b793b66
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD6:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RfnaemA.exe

Path C:\Windows\System\RfnaemA.exe
Size 1.7MB
SHA256 61c3c8003aeefff849bcdf34d8c7b25ea451d25b3d8cb4f618438cccfb5f43e7
MD5 d56ad2e1fe0709830a3d24ec2da568aa
SHA1 7d2b3f61442947fb8b795c0d238511de3452ba32
SHA512 ddebc0a085a5743a14a30653a7f97f2f120ccda97268a277f8ced958fb65475b4d7c907f1b76076864490c3cdc8cc9e0d4177281298aa44c49fb325f75885173
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD1:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

URBLTVV.exe

Path C:\Windows\System\URBLTVV.exe
Size 1.7MB
SHA256 96263d573ed211ed5ba3e8b66e3ba4250de1a6aeaf2b2a4da97893fe3e20334c
MD5 44eaa09c40c0cfe0e5d2974b97eeff87
SHA1 ce971867194f7def21b85f5783cc46fc8aafdf98
SHA512 2e719d1238300a58fe076aae480f1e9f1aee0322da948df78e0e4efd8c62a57d6ee063663166bd590ad939a8b287e185779d9d1fa50cfa98af759d7ae797e7b8
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD8:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUHjAlk.exe

Path C:\Windows\System\WUHjAlk.exe
Size 1.7MB
SHA256 16303d4b87de809ceba4eb72b4e56f3eaeace3a8dbcb9fbd5c1f1bc9f44006a6
MD5 550b237d629160e64bb04bb949512221
SHA1 6f11dad9f9f1e3ed4639ee3394ffb8db61d75352
SHA512 b14fe27a1c38af81b9af86c9e208277ad15d2dfb0ba498c21c5a785ded694eeeba9cbef12519209de0fde5d9807795964ba15bd8caba04f42a11267b727e1a37
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADF:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZdHVHST.exe

Path C:\Windows\System\ZdHVHST.exe
Size 1.7MB
SHA256 9565a35f849bf161e0d0919b30494f995c8115386aeb6348c12ff87cb0c02a79
MD5 4747d96c8f6110f499f310d00eb72d3c
SHA1 6c7ea080ac4949e7598319084e91ad6f491c4e8a
SHA512 50cbfcca1b1caf101ba0599fe3d8a4ef127cb5519e4e9acbccd79a3aef4da21436e974f45b0d97399deac85c84ef796960c20ba3b2545368e2b5370a260244d0
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADN:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

aaxfjTL.exe

Path C:\Windows\System\aaxfjTL.exe
Size 1.7MB
SHA256 444b62345121b180ec9156f85e20871d4c813a55c9681b0b5fe1521b90427813
MD5 19b0149c701c821ea3173b46da77c0f5
SHA1 f80ea4858611f1e3157d7e99b4441f57bf6fbcea
SHA512 4134a27e933ee1200100a3ff33d92907bdd6a657bd3f55e204e78125ef8ab596cb7781c1918ddba39403babfd9c503b66896e7eab7968fc97b9828aecc91810c
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADR:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

gRecHhy.exe

Path C:\Windows\System\gRecHhy.exe
Size 1.7MB
SHA256 6b7d098886edbe3637a86b599d014e9588d7973900adbf3f3777768504352541
MD5 5c2e4b0bb07f038da0e0a77a0c0e59b4
SHA1 87cd15b602c9f755352121998054b5f530e19bda
SHA512 7b796a5b1a00dc5ce333d89f845ff1c318a60d45134778a6befd84813e85909094cc4edc97343f816fe9dc2e393414543f0d2c328b528ffdc6fb40fd468d797b
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADE:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvhuIUo.exe

Path C:\Windows\System\gvhuIUo.exe
Size 1.7MB
SHA256 e742598d084ac6cbc025bcd13c43b5982626a27dfcc656bd0cb849941372bc2d
MD5 0b5d548315f2d12b5dfd82b1ee5ed786
SHA1 9fc1b002e66e0421866bc12b6f7c96b6000b55ea
SHA512 94aac3c3f2e831f104caa59070b03054583d054b731ab37cb2dbf0a69f42d4cf0b90ea7688d66cb38175ff9c60b14bdc97f48f7218b671555d68711069ae486c
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADG:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

gyFofzu.exe

Path C:\Windows\System\gyFofzu.exe
Size 1.7MB
SHA256 60d14d54c2a239a06857eabbe1a5f099e196bc631aa483e3764be10fa1544469
MD5 e2be305f5d2ef6b417b268eaab7cdfc2
SHA1 587728537d7c1ea300f9f75c64fae5f0991cb9dc
SHA512 244e3205e2856a8e52cdb33247b9a1beee32c9509f2a8bffc3f09087966dd68d820dcb6d2025c7d9f8b667ef46055067f46db3cb63124713b0f87aedc9583285
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADm:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcTBebJ.exe

Path C:\Windows\System\kcTBebJ.exe
Size 1.7MB
SHA256 49c873b7f47fa4084c5b2529208a4231f0e6d2cd3b82f36fc131419714a32058
MD5 0ec57662fb007ca14e3601edee586b60
SHA1 2ad1df89d7fa27fa4af5ad29814a584f884f38d8
SHA512 422c7a008871f1008ab55d32f634f23e40966efd4e7d3638a5a8b88da500a29bc55370863f9a64a0ef7e1c1528bde6e30a43fa6755dcfe0bf7ce9b98f744bab1
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADz:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

kpeNFti.exe

Path C:\Windows\System\kpeNFti.exe
Size 1.7MB
SHA256 06c14da968c0918af4835fbfe524809a760a8aaa0c36ffef98afda19b747eba6
MD5 b9f4b477d52680f5b639bbf60a5d8fe4
SHA1 e674f811c295773f3e67f09f6594383e95254279
SHA512 161b17d2a156ef148b00106f37032b77ddc76a0ac9ca9676f135ae4f02b02c790d587f6d5b914496cf86427e3f7247117302cb6d3d306ba1466d6a1c4d34fa67
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADfQ:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

lvmivWr.exe

Path C:\Windows\System\lvmivWr.exe
Size 1.7MB
SHA256 d0979ee8e5132ce9b48978cd68ce6b3d84ceb40d09f31244fd5a2984ba3d5377
MD5 774dbe2767b37dc3fc497984554c4d31
SHA1 7ec5d7bb58506d0df95ad68f0aaa33a6538ce1bd
SHA512 ba1c538bde9e0dc6115058cba49f7bd898668158e1bc736326892e313d769c9451f6119b6a1ba104134e0c75db249e6d1995a583985701c1db8e0cc82faa5415
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADf:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mouyBZy.exe

Path C:\Windows\System\mouyBZy.exe
Size 1.7MB
SHA256 9b8ac7a40fac26cc0bf92a56e454db2438ff130263bac692c9d16e9cd2f66c53
MD5 389d11ce94db62dd4bc7da01b5874fc8
SHA1 80b0b7fb0cb121368b18196800902ee5502c8a8b
SHA512 ad7e92d865d6855896219c3666dee3f0788d56b8603b89d74ba69ae44719dbeb130f70ea1c9c5af7293675865f3ecf012be4883ec410331418171bdde2620116
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADh:NABL
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrNJwAT.exe

Path C:\Windows\System\mrNJwAT.exe
Size 1.7MB
SHA256 e29834a5e59ee7bc668237e80dddba199a27c4b1ecdfbfb89605528bfedae1dc
MD5 b6261d74171260a5b11ddada6d0a76a6
SHA1 55bf54dd406e9ad33800829cd6293cd4dc47248b
SHA512 94ebf44dc3b2e68b4eb9541ad53477e53fc29d6611018d3c02663f15e0e9475427d0c09351876fcd552392de29ce0e92f8a5dea80d3fef54a1345ac047f09e75
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADP:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msRvdaX.exe

Path C:\Windows\System\msRvdaX.exe
Size 8B
SHA256 4443ea8760d035c6b4f05df6df4c7e7ad9c5afa8dead954bce57dab5a5afcf1e
MD5 66bd487d69202ef8b2b1bb2e1931ebf3
SHA1 6297e827d2cc12ba96555851f82fc059665704b0
SHA512 9e09fc0a19c454ee0cecdc74d2823aed9c4a94ebbcd2ca5a3004beafcda66afd0bc9b7ffcaee69b05991566849eedce2fe3d3b28ecd596511f3194e8d04c5acc
MD5 SHA1 SHA512

Submit Download

nuGlRRs.exe

Path C:\Windows\System\nuGlRRs.exe
Size 1.7MB
SHA256 12af579864ee532e5160eb44bb9e5cfbcb79cfa8d7bbffa6eacfdf73ed4f7a31
MD5 026d7038ba7c1467f6d8d8dfb72d298f
SHA1 7821e3e54c06ecbfbf93ec8c3b78035307b217f1
SHA512 743aa336bebecc449f1f3320d8237bebdfdf7931cf26df869a5794d4f529eab5ae306a3db5885b11f3019d56258d4c608391d5ab302d6ccfbcc346d9c60ba772
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD3:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ojzscMN.exe

Path C:\Windows\System\ojzscMN.exe
Size 1.7MB
SHA256 ce66eb55eeeb2a06f99e8c25910b5be11f2ecade48348f0de7a0127b73ce5a2b
MD5 e62820c473d869786c8b8451f2deaff9
SHA1 ac348eefc05ad8d7c25905e8ff8f84a8d2f41363
SHA512 046af71b638013165b847deff8207a7db3299dc4ea43c740dae5867059e0f7889fa494da89c189f642bf88637cea160d3164e0c6ea08276c1d5c495da09bf2d6
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD+:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

pGvNNJH.exe

Path C:\Windows\System\pGvNNJH.exe
Size 1.7MB
SHA256 17dc0a9c30e8786c140af0b5cee037bbd7033cfa33c1a05ee13b538deb783641
MD5 b07cb3f58ed2a385edc18e526c8277c3
SHA1 e1001622af9084ecabacd411a3e0018b3059cf72
SHA512 8af9cc66dec2e8857fd03211bfe6f2f9ae190f029293ef58e307ac4df5ecc742313463443ac7ad5688a35f139ee34ed33c0ffe6872e2bdecbbd935c1be49c518
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADz:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

tSzPTwo.exe

Path C:\Windows\System\tSzPTwo.exe
Size 1.7MB
SHA256 a03b771b673ffd8c9fa749f858dce93184e6c2ae2b0831f127e8902cb964cf77
MD5 76fdebf045592773b0140c37fc720fa6
SHA1 3e69309066379fe4b38735779334880e98f40f6c
SHA512 c9d2d25838c5e5098de55dbc6f113f01737d7bb5a2072abc05ddc955e7d0d99f5d6807f9ff95efff49b06dbd6deeff3fd30e22fe8d9a44e6202be72061032eb4
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADI:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

uTXvXpz.exe

Path C:\Windows\System\uTXvXpz.exe
Size 1.7MB
SHA256 a87e8e02335d29939c7c47b6ab5ad515314bc042291c06a989c5833c9a76c4a9
MD5 fc4369cc3775968c9e4d4c3426fb9340
SHA1 ef03767070fdfb237e996af193fea6c3213d330c
SHA512 4c54cd2a2e9b0bca744068aaed859f71f376e7672f3df4cd0460483be46e3d813bb2600e09b173916d553f17af373c24e55fee0f9a36c8d509baa7189d94f5b4
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADm:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjBzWHE.exe

Path C:\Windows\System\yjBzWHE.exe
Size 1.7MB
SHA256 15784fadb16691f075558bc07842c8e3c074908246ebbed1de3f208614d2877f
MD5 50430f27891f60aec4cb4e3bf5f7e340
SHA1 8b8966254ad5cd0722074cda449f592d34f946e9
SHA512 fcc5f46913bda23a1a0c12f71e56d323c0677266fa7702c44d727b8edf75761e793142a18d4dcf94e4663b73e97370a895a584bf4be88d82f64097144867f6a9
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADE:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

zfNaaei.exe

Path C:\Windows\System\zfNaaei.exe
Size 1.7MB
SHA256 0a3ab33e3ac9f40e1b8b4dd0172a0a19cc8d676066fc8a6d6308078915656102
MD5 95e5e174778ba3ad01559eb08f389cf5
SHA1 672543203d4bcd5ed7d52ba31f634277c95e2290
SHA512 37361faacfed0d29f71b980a0e6ef9b6a1a81b7baf674431020eaad4475b8cd9e03d0b934b0f1779a62b3f52d94296b5a26fa3e1ca33ec41f9e7cd0141f1c30b
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IADQ:NABC
MD5 SHA1 SHA512 SSDEEP

Submit Download

zkIIuyE.exe

Path C:\Windows\System\zkIIuyE.exe
Size 1.7MB
SHA256 0f02341995e58d7306e1a8afe243d09345b7dbdee89b2e06f5c2166906653411
MD5 5a2be474d556308df79661a7dc8e0340
SHA1 4f19121bbb4e2377915eca34a32c705fb792c8e5
SHA512 5ad338557c30c9b4dc61dfbb125ad2874e5cfe22a77d4328697fe3598f528d5809f45647acdff320d74890a02139e2ccce70aa3e98aa379bb912dc4ee2e62e0e
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD3:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-157-0x00007FF6D42E0000-0x00007FF6D46D2000-memory.dmp

Download

memory/116-2954-0x00007FF6D42E0000-0x00007FF6D46D2000-memory.dmp

Download

memory/116-2904-0x00007FF6D42E0000-0x00007FF6D46D2000-memory.dmp

Download

memory/264-2951-0x00007FF77A820000-0x00007FF77AC12000-memory.dmp

Download

memory/264-163-0x00007FF77A820000-0x00007FF77AC12000-memory.dmp

Download

memory/764-2911-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp

Download

memory/764-84-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp

Download

memory/840-106-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp

Download

memory/840-2864-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp

Download

memory/840-3096-0x00007FF7DDC70000-0x00007FF7DE062000-memory.dmp

Download

memory/1056-1-0x00000244D85A0000-0x00000244D85B0000-memory.dmp

Download

memory/1056-0-0x00007FF6FEFF0000-0x00007FF6FF3E2000-memory.dmp

Download

memory/1116-30-0x00007FF6539F0000-0x00007FF653DE2000-memory.dmp

Download

memory/1116-2903-0x00007FF6539F0000-0x00007FF653DE2000-memory.dmp

Download

memory/1992-79-0x00007FF673E60000-0x00007FF674252000-memory.dmp

Download

memory/1992-2928-0x00007FF673E60000-0x00007FF674252000-memory.dmp

Download

memory/2280-2829-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp

Download

memory/2280-23-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp

Download

memory/2280-2888-0x00007FF7DED90000-0x00007FF7DF182000-memory.dmp

Download

memory/2364-117-0x00007FF62F3A0000-0x00007FF62F792000-memory.dmp

Download

memory/2364-2935-0x00007FF62F3A0000-0x00007FF62F792000-memory.dmp

Download

memory/2376-2940-0x00007FF722B30000-0x00007FF722F22000-memory.dmp

Download

memory/2376-75-0x00007FF722B30000-0x00007FF722F22000-memory.dmp

Download

memory/2560-2921-0x00007FF759080000-0x00007FF759472000-memory.dmp

Download

memory/2560-44-0x00007FF759080000-0x00007FF759472000-memory.dmp

Download

memory/2560-2830-0x00007FF759080000-0x00007FF759472000-memory.dmp

Download

memory/2812-2831-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp

Download

memory/2812-69-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp

Download

memory/2812-2926-0x00007FF72D2A0000-0x00007FF72D692000-memory.dmp

Download

memory/2840-443-0x0000016FBF020000-0x0000016FBF7C6000-memory.dmp

Download

memory/2840-139-0x0000016FBC330000-0x0000016FBC352000-memory.dmp

Download

memory/2936-145-0x00007FF72E7D0000-0x00007FF72EBC2000-memory.dmp

Download

memory/2936-2959-0x00007FF72E7D0000-0x00007FF72EBC2000-memory.dmp

Download

memory/3212-2878-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp

Download

memory/3212-2827-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp

Download

memory/3212-8-0x00007FF6BE630000-0x00007FF6BEA22000-memory.dmp

Download

memory/3420-2942-0x00007FF69C220000-0x00007FF69C612000-memory.dmp

Download

memory/3420-101-0x00007FF69C220000-0x00007FF69C612000-memory.dmp

Download

memory/3516-2933-0x00007FF7C5990000-0x00007FF7C5D82000-memory.dmp

Download

memory/3516-97-0x00007FF7C5990000-0x00007FF7C5D82000-memory.dmp

Download

memory/3868-2913-0x00007FF794570000-0x00007FF794962000-memory.dmp

Download

memory/3868-39-0x00007FF794570000-0x00007FF794962000-memory.dmp

Download

memory/3952-2946-0x00007FF694FF0000-0x00007FF6953E2000-memory.dmp

Download

memory/3952-128-0x00007FF694FF0000-0x00007FF6953E2000-memory.dmp

Download

memory/4288-129-0x00007FF706D10000-0x00007FF707102000-memory.dmp

Download

memory/4288-2945-0x00007FF706D10000-0x00007FF707102000-memory.dmp

Download

memory/4508-2937-0x00007FF747210000-0x00007FF747602000-memory.dmp

Download

memory/4508-116-0x00007FF747210000-0x00007FF747602000-memory.dmp

Download

memory/4700-88-0x00007FF6E4260000-0x00007FF6E4652000-memory.dmp

Download

memory/4700-2922-0x00007FF6E4260000-0x00007FF6E4652000-memory.dmp

Download

memory/4800-2925-0x00007FF68F170000-0x00007FF68F562000-memory.dmp

Download

memory/4800-92-0x00007FF68F170000-0x00007FF68F562000-memory.dmp

Download

memory/4864-112-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp

Download

memory/4864-2938-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp

Download

memory/5028-2956-0x00007FF6D81B0000-0x00007FF6D85A2000-memory.dmp

Download

memory/5028-151-0x00007FF6D81B0000-0x00007FF6D85A2000-memory.dmp

Download

memory/5032-2931-0x00007FF603580000-0x00007FF603972000-memory.dmp

Download

memory/5032-78-0x00007FF603580000-0x00007FF603972000-memory.dmp

Download