xmrig | ba4355962bdac63ccdb6c42298130ea7b8ef8f67ee71fd5dcf2d628017ca95de

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
Size 2.9MB
Sample240527-nvsh9abb23
SHA256 ba4355962bdac63ccdb6c42298130ea7b8ef8f67ee71fd5dcf2d628017ca95de
MD5 e7cebc61fd424079f6c31dc94fe49d20
SHA1 f1fb27c84647de6c1fde3e142262f71709880a51
SHA512 518d106ac36a952a7cb406ae5853d7d87dab5eed778a15a00ba8630881246c7e084ec48668cf1d6313ad2e35e9ab280f3fc789124258e41a6024ec1590f44f9f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFH:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4984-0-0x00007FF7A79C0000-0x00007FF7A7DB6000-memory.dmp	xmrig
behavioral2/files/0x00080000000233bb-5.dat	xmrig
behavioral2/files/0x00070000000233c0-9.dat	xmrig
behavioral2/files/0x00070000000233bf-11.dat	xmrig
behavioral2/files/0x00070000000233c1-34.dat	xmrig
behavioral2/files/0x00070000000233c4-42.dat	xmrig
behavioral2/files/0x00070000000233c5-36.dat	xmrig
behavioral2/files/0x00080000000233c3-59.dat	xmrig
behavioral2/files/0x00070000000233c7-67.dat	xmrig
behavioral2/files/0x00070000000233c8-74.dat	xmrig
behavioral2/files/0x00070000000233ca-80.dat	xmrig
behavioral2/files/0x00070000000233c9-83.dat	xmrig
behavioral2/files/0x00070000000233cb-96.dat	xmrig
behavioral2/files/0x00070000000233d0-115.dat	xmrig
behavioral2/files/0x00070000000233d1-126.dat	xmrig
behavioral2/files/0x00070000000233d5-148.dat	xmrig
behavioral2/files/0x00070000000233d8-163.dat	xmrig
behavioral2/files/0x00070000000233db-178.dat	xmrig
behavioral2/memory/1504-828-0x00007FF60D0C0000-0x00007FF60D4B6000-memory.dmp	xmrig
behavioral2/memory/2744-860-0x00007FF7A3430000-0x00007FF7A3826000-memory.dmp	xmrig
behavioral2/memory/2172-855-0x00007FF645ED0000-0x00007FF6462C6000-memory.dmp	xmrig
behavioral2/memory/1100-839-0x00007FF636200000-0x00007FF6365F6000-memory.dmp	xmrig
behavioral2/memory/3024-841-0x00007FF68EFC0000-0x00007FF68F3B6000-memory.dmp	xmrig
behavioral2/memory/3616-866-0x00007FF6D31A0000-0x00007FF6D3596000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dd-180.dat	xmrig
behavioral2/files/0x00070000000233dc-175.dat	xmrig
behavioral2/files/0x00070000000233da-173.dat	xmrig
behavioral2/files/0x00070000000233d9-168.dat	xmrig
behavioral2/files/0x00070000000233d7-158.dat	xmrig
behavioral2/files/0x00070000000233d6-153.dat	xmrig
behavioral2/files/0x00070000000233d4-143.dat	xmrig
behavioral2/files/0x00070000000233d3-133.dat	xmrig
behavioral2/files/0x00070000000233d2-131.dat	xmrig
behavioral2/files/0x00070000000233cf-116.dat	xmrig
behavioral2/files/0x00070000000233ce-111.dat	xmrig
behavioral2/files/0x00070000000233cd-106.dat	xmrig
behavioral2/files/0x00070000000233cc-100.dat	xmrig
behavioral2/files/0x00080000000233bc-91.dat	xmrig
behavioral2/memory/4980-79-0x00007FF6A69B0000-0x00007FF6A6DA6000-memory.dmp	xmrig
behavioral2/memory/4960-78-0x00007FF7A9DB0000-0x00007FF7AA1A6000-memory.dmp	xmrig
behavioral2/memory/1600-72-0x00007FF7C5B30000-0x00007FF7C5F26000-memory.dmp	xmrig
behavioral2/files/0x00080000000233c2-65.dat	xmrig
behavioral2/files/0x00070000000233c6-64.dat	xmrig
behavioral2/memory/4320-62-0x00007FF6A1170000-0x00007FF6A1566000-memory.dmp	xmrig
behavioral2/memory/4524-878-0x00007FF7EF240000-0x00007FF7EF636000-memory.dmp	xmrig
behavioral2/memory/1020-886-0x00007FF7A0100000-0x00007FF7A04F6000-memory.dmp	xmrig
behavioral2/memory/4660-900-0x00007FF7B9000000-0x00007FF7B93F6000-memory.dmp	xmrig
behavioral2/memory/672-913-0x00007FF719340000-0x00007FF719736000-memory.dmp	xmrig
behavioral2/memory/4068-923-0x00007FF6BAC00000-0x00007FF6BAFF6000-memory.dmp	xmrig
behavioral2/memory/2028-928-0x00007FF77B0E0000-0x00007FF77B4D6000-memory.dmp	xmrig
behavioral2/memory/1828-932-0x00007FF794E80000-0x00007FF795276000-memory.dmp	xmrig
behavioral2/memory/2560-924-0x00007FF605770000-0x00007FF605B66000-memory.dmp	xmrig
behavioral2/memory/5016-920-0x00007FF741AA0000-0x00007FF741E96000-memory.dmp	xmrig
behavioral2/memory/3644-910-0x00007FF7F4C30000-0x00007FF7F5026000-memory.dmp	xmrig
behavioral2/memory/1500-906-0x00007FF79C870000-0x00007FF79CC66000-memory.dmp	xmrig
behavioral2/memory/4832-889-0x00007FF66E370000-0x00007FF66E766000-memory.dmp	xmrig
behavioral2/memory/2496-959-0x00007FF730320000-0x00007FF730716000-memory.dmp	xmrig
behavioral2/memory/3204-964-0x00007FF6B71F0000-0x00007FF6B75E6000-memory.dmp	xmrig
behavioral2/memory/5016-2134-0x00007FF741AA0000-0x00007FF741E96000-memory.dmp	xmrig
behavioral2/memory/1600-2135-0x00007FF7C5B30000-0x00007FF7C5F26000-memory.dmp	xmrig
behavioral2/memory/4320-2136-0x00007FF6A1170000-0x00007FF6A1566000-memory.dmp	xmrig
behavioral2/memory/4960-2137-0x00007FF7A9DB0000-0x00007FF7AA1A6000-memory.dmp	xmrig
behavioral2/memory/4980-2138-0x00007FF6A69B0000-0x00007FF6A6DA6000-memory.dmp	xmrig
behavioral2/memory/4068-2139-0x00007FF6BAC00000-0x00007FF6BAFF6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
7	4972	powershell.exe
9	4972	powershell.exe
15	4972	powershell.exe
16	4972	powershell.exe
18	4972	powershell.exe
21	4972	powershell.exe
22	4972	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
5016	fQdfZMr.exe
4320	nbOIqmj.exe
1600	dDiAZHI.exe
4068	ppmMhNo.exe
4960	oNmssBk.exe
4980	PFFaAsP.exe
1504	hvYINDK.exe
1100	MNiCFSr.exe
3024	pcNbmtT.exe
2560	sVvQsvl.exe
2028	YWpLsML.exe
1828	veTIfJM.exe
2496	NNaWJhL.exe
3204	quuBRzB.exe
2172	kflbQes.exe
2744	FUlIzTW.exe
3616	xGRITxE.exe
4524	oKggOFb.exe
1020	OmladNE.exe
4832	qYCXyhw.exe
4660	rwkrWwg.exe
1500	KOTxvUP.exe
3644	UAnooJy.exe
672	rGBbHRJ.exe
2420	EnMyDPp.exe
2716	JFWqTvb.exe
748	SGUFQJP.exe
996	togNKrD.exe
1708	vzGhYPl.exe
4700	NJywRXM.exe
2124	NfpBTPs.exe
612	CCIwRGw.exe
1132	PqvJZAU.exe
4664	ubaeTeU.exe
1588	yOZeOrY.exe
4220	mLzWuAB.exe
1760	UDVOYYZ.exe
4384	XElmSkt.exe
2320	MjVMCHn.exe
4824	oJVOMdK.exe
4740	bnHHECS.exe
380	uCRYwUB.exe
3120	fMJvoHF.exe
2232	CyvIfvB.exe
3092	XKGEyZt.exe
4448	FYVwZMC.exe
4276	OisKRoK.exe
2316	dTpbWrg.exe
4272	zaQaINE.exe
4492	xCeeLXf.exe
5064	dzbTwYU.exe
1608	CYJPhys.exe
4576	EcriOdZ.exe
4708	KLTlSrO.exe
1456	aMdLuUv.exe
3784	hyOMejw.exe
372	ahyzhtd.exe
4944	bjofZsN.exe
3168	utQTAsz.exe
4080	YDXOdey.exe
4572	yBApSSz.exe
2240	HkJJGfw.exe
4936	VkdNRyP.exe
4612	TjWSMGJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4984-0-0x00007FF7A79C0000-0x00007FF7A7DB6000-memory.dmp	upx
behavioral2/files/0x00080000000233bb-5.dat	upx
behavioral2/files/0x00070000000233c0-9.dat	upx
behavioral2/files/0x00070000000233bf-11.dat	upx
behavioral2/files/0x00070000000233c1-34.dat	upx
behavioral2/files/0x00070000000233c4-42.dat	upx
behavioral2/files/0x00070000000233c5-36.dat	upx
behavioral2/files/0x00080000000233c3-59.dat	upx
behavioral2/files/0x00070000000233c7-67.dat	upx
behavioral2/files/0x00070000000233c8-74.dat	upx
behavioral2/files/0x00070000000233ca-80.dat	upx
behavioral2/files/0x00070000000233c9-83.dat	upx
behavioral2/files/0x00070000000233cb-96.dat	upx
behavioral2/files/0x00070000000233d0-115.dat	upx
behavioral2/files/0x00070000000233d1-126.dat	upx
behavioral2/files/0x00070000000233d5-148.dat	upx
behavioral2/files/0x00070000000233d8-163.dat	upx
behavioral2/files/0x00070000000233db-178.dat	upx
behavioral2/memory/1504-828-0x00007FF60D0C0000-0x00007FF60D4B6000-memory.dmp	upx
behavioral2/memory/2744-860-0x00007FF7A3430000-0x00007FF7A3826000-memory.dmp	upx
behavioral2/memory/2172-855-0x00007FF645ED0000-0x00007FF6462C6000-memory.dmp	upx
behavioral2/memory/1100-839-0x00007FF636200000-0x00007FF6365F6000-memory.dmp	upx
behavioral2/memory/3024-841-0x00007FF68EFC0000-0x00007FF68F3B6000-memory.dmp	upx
behavioral2/memory/3616-866-0x00007FF6D31A0000-0x00007FF6D3596000-memory.dmp	upx
behavioral2/files/0x00070000000233dd-180.dat	upx
behavioral2/files/0x00070000000233dc-175.dat	upx
behavioral2/files/0x00070000000233da-173.dat	upx
behavioral2/files/0x00070000000233d9-168.dat	upx
behavioral2/files/0x00070000000233d7-158.dat	upx
behavioral2/files/0x00070000000233d6-153.dat	upx
behavioral2/files/0x00070000000233d4-143.dat	upx
behavioral2/files/0x00070000000233d3-133.dat	upx
behavioral2/files/0x00070000000233d2-131.dat	upx
behavioral2/files/0x00070000000233cf-116.dat	upx
behavioral2/files/0x00070000000233ce-111.dat	upx
behavioral2/files/0x00070000000233cd-106.dat	upx
behavioral2/files/0x00070000000233cc-100.dat	upx
behavioral2/files/0x00080000000233bc-91.dat	upx
behavioral2/memory/4980-79-0x00007FF6A69B0000-0x00007FF6A6DA6000-memory.dmp	upx
behavioral2/memory/4960-78-0x00007FF7A9DB0000-0x00007FF7AA1A6000-memory.dmp	upx
behavioral2/memory/1600-72-0x00007FF7C5B30000-0x00007FF7C5F26000-memory.dmp	upx
behavioral2/files/0x00080000000233c2-65.dat	upx
behavioral2/files/0x00070000000233c6-64.dat	upx
behavioral2/memory/4320-62-0x00007FF6A1170000-0x00007FF6A1566000-memory.dmp	upx
behavioral2/memory/4524-878-0x00007FF7EF240000-0x00007FF7EF636000-memory.dmp	upx
behavioral2/memory/1020-886-0x00007FF7A0100000-0x00007FF7A04F6000-memory.dmp	upx
behavioral2/memory/4660-900-0x00007FF7B9000000-0x00007FF7B93F6000-memory.dmp	upx
behavioral2/memory/672-913-0x00007FF719340000-0x00007FF719736000-memory.dmp	upx
behavioral2/memory/4068-923-0x00007FF6BAC00000-0x00007FF6BAFF6000-memory.dmp	upx
behavioral2/memory/2028-928-0x00007FF77B0E0000-0x00007FF77B4D6000-memory.dmp	upx
behavioral2/memory/1828-932-0x00007FF794E80000-0x00007FF795276000-memory.dmp	upx
behavioral2/memory/2560-924-0x00007FF605770000-0x00007FF605B66000-memory.dmp	upx
behavioral2/memory/5016-920-0x00007FF741AA0000-0x00007FF741E96000-memory.dmp	upx
behavioral2/memory/3644-910-0x00007FF7F4C30000-0x00007FF7F5026000-memory.dmp	upx
behavioral2/memory/1500-906-0x00007FF79C870000-0x00007FF79CC66000-memory.dmp	upx
behavioral2/memory/4832-889-0x00007FF66E370000-0x00007FF66E766000-memory.dmp	upx
behavioral2/memory/2496-959-0x00007FF730320000-0x00007FF730716000-memory.dmp	upx
behavioral2/memory/3204-964-0x00007FF6B71F0000-0x00007FF6B75E6000-memory.dmp	upx
behavioral2/memory/5016-2134-0x00007FF741AA0000-0x00007FF741E96000-memory.dmp	upx
behavioral2/memory/1600-2135-0x00007FF7C5B30000-0x00007FF7C5F26000-memory.dmp	upx
behavioral2/memory/4320-2136-0x00007FF6A1170000-0x00007FF6A1566000-memory.dmp	upx
behavioral2/memory/4960-2137-0x00007FF7A9DB0000-0x00007FF7AA1A6000-memory.dmp	upx
behavioral2/memory/4980-2138-0x00007FF6A69B0000-0x00007FF6A6DA6000-memory.dmp	upx
behavioral2/memory/4068-2139-0x00007FF6BAC00000-0x00007FF6BAFF6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uAACmvA.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\HzlKCNO.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\qEmNcfE.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\GbsUldT.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\fpUVPKA.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\QZRTXGg.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\PKdofyg.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\vxQUtBz.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\nByLOdc.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\lJaCLyj.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\aQryNOU.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\EUSSxJK.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\yevNfBu.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\WYPklMk.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\fJBMExB.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\aKNtgFl.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\OeIjGpZ.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\nzbzgHI.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\wCQrmhs.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\QMXUcCx.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\MLIGWFq.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\ioFhaTV.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\rcpJqbF.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\WMBtmGT.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\ngfxWzw.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\QvrlNDd.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\DLsrymR.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\WlfYfOM.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\hmWugGM.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\uQVEivk.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\WIUNwZj.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\yldJIfE.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\hUNFiwd.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\rSRtAiq.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\AeVwMGP.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\tzalJCT.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\mHmMbrH.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\jGizdQE.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\qdjTATV.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\zNUoNZS.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\fGeylby.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\AXHQpWc.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\VDFsVnR.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\Pjnrfqy.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\gRkjtTI.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\mqBHeaL.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\OaqBayS.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\UiZhrGb.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\FRJSKXJ.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\yOZeOrY.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\asydFlA.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\vTtFsgf.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\CklxeSc.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\kyMdvDB.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\kitzGAc.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\svVGDnl.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\JGhzhMb.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\MBJDcWK.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\CXbScfs.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\rpxafRJ.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\Xirsjde.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\eZMgjbg.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\OfFlxjC.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
File created	C:\Windows\System\xgrKoXl.exe	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
Token: SeDebugPrivilege	4972	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4972	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	85
PID 4984 wrote to memory of 4972	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	85
PID 4984 wrote to memory of 5016	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	86
PID 4984 wrote to memory of 5016	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	86
PID 4984 wrote to memory of 4320	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	87
PID 4984 wrote to memory of 4320	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	87
PID 4984 wrote to memory of 1600	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	88
PID 4984 wrote to memory of 1600	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	88
PID 4984 wrote to memory of 4068	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	89
PID 4984 wrote to memory of 4068	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	89
PID 4984 wrote to memory of 4980	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	90
PID 4984 wrote to memory of 4980	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	90
PID 4984 wrote to memory of 4960	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	91
PID 4984 wrote to memory of 4960	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	91
PID 4984 wrote to memory of 1504	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	92
PID 4984 wrote to memory of 1504	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	92
PID 4984 wrote to memory of 1100	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	93
PID 4984 wrote to memory of 1100	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	93
PID 4984 wrote to memory of 3024	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	94
PID 4984 wrote to memory of 3024	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	94
PID 4984 wrote to memory of 2560	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	95
PID 4984 wrote to memory of 2560	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	95
PID 4984 wrote to memory of 2028	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	96
PID 4984 wrote to memory of 2028	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	96
PID 4984 wrote to memory of 1828	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	97
PID 4984 wrote to memory of 1828	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	97
PID 4984 wrote to memory of 2496	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	98
PID 4984 wrote to memory of 2496	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	98
PID 4984 wrote to memory of 3204	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	99
PID 4984 wrote to memory of 3204	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	99
PID 4984 wrote to memory of 2172	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	100
PID 4984 wrote to memory of 2172	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	100
PID 4984 wrote to memory of 2744	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	101
PID 4984 wrote to memory of 2744	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	101
PID 4984 wrote to memory of 3616	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	102
PID 4984 wrote to memory of 3616	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	102
PID 4984 wrote to memory of 4524	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	103
PID 4984 wrote to memory of 4524	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	103
PID 4984 wrote to memory of 1020	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	104
PID 4984 wrote to memory of 1020	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	104
PID 4984 wrote to memory of 4832	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	105
PID 4984 wrote to memory of 4832	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	105
PID 4984 wrote to memory of 4660	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	106
PID 4984 wrote to memory of 4660	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	106
PID 4984 wrote to memory of 1500	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	107
PID 4984 wrote to memory of 1500	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	107
PID 4984 wrote to memory of 3644	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	108
PID 4984 wrote to memory of 3644	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	108
PID 4984 wrote to memory of 672	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	109
PID 4984 wrote to memory of 672	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	109
PID 4984 wrote to memory of 2420	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	110
PID 4984 wrote to memory of 2420	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	110
PID 4984 wrote to memory of 2716	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	111
PID 4984 wrote to memory of 2716	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	111
PID 4984 wrote to memory of 748	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	112
PID 4984 wrote to memory of 748	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	112
PID 4984 wrote to memory of 996	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	113
PID 4984 wrote to memory of 996	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	113
PID 4984 wrote to memory of 1708	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	114
PID 4984 wrote to memory of 1708	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	114
PID 4984 wrote to memory of 4700	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	115
PID 4984 wrote to memory of 4700	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	115
PID 4984 wrote to memory of 2124	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	116
PID 4984 wrote to memory of 2124	4984	e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e7cebc61fd424079f6c31dc94fe49d20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System\fQdfZMr.exe
  C:\Windows\System\fQdfZMr.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\nbOIqmj.exe
  C:\Windows\System\nbOIqmj.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\dDiAZHI.exe
  C:\Windows\System\dDiAZHI.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ppmMhNo.exe
  C:\Windows\System\ppmMhNo.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\PFFaAsP.exe
  C:\Windows\System\PFFaAsP.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\oNmssBk.exe
  C:\Windows\System\oNmssBk.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\hvYINDK.exe
  C:\Windows\System\hvYINDK.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\MNiCFSr.exe
  C:\Windows\System\MNiCFSr.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\pcNbmtT.exe
  C:\Windows\System\pcNbmtT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\sVvQsvl.exe
  C:\Windows\System\sVvQsvl.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\YWpLsML.exe
  C:\Windows\System\YWpLsML.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\veTIfJM.exe
  C:\Windows\System\veTIfJM.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\NNaWJhL.exe
  C:\Windows\System\NNaWJhL.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\quuBRzB.exe
  C:\Windows\System\quuBRzB.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\kflbQes.exe
  C:\Windows\System\kflbQes.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\FUlIzTW.exe
  C:\Windows\System\FUlIzTW.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\xGRITxE.exe
  C:\Windows\System\xGRITxE.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\oKggOFb.exe
  C:\Windows\System\oKggOFb.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\OmladNE.exe
  C:\Windows\System\OmladNE.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\qYCXyhw.exe
  C:\Windows\System\qYCXyhw.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\rwkrWwg.exe
  C:\Windows\System\rwkrWwg.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\KOTxvUP.exe
  C:\Windows\System\KOTxvUP.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\UAnooJy.exe
  C:\Windows\System\UAnooJy.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\rGBbHRJ.exe
  C:\Windows\System\rGBbHRJ.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\EnMyDPp.exe
  C:\Windows\System\EnMyDPp.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\JFWqTvb.exe
  C:\Windows\System\JFWqTvb.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\SGUFQJP.exe
  C:\Windows\System\SGUFQJP.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\togNKrD.exe
  C:\Windows\System\togNKrD.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\vzGhYPl.exe
  C:\Windows\System\vzGhYPl.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\NJywRXM.exe
  C:\Windows\System\NJywRXM.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\NfpBTPs.exe
  C:\Windows\System\NfpBTPs.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\CCIwRGw.exe
  C:\Windows\System\CCIwRGw.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\PqvJZAU.exe
  C:\Windows\System\PqvJZAU.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ubaeTeU.exe
  C:\Windows\System\ubaeTeU.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\yOZeOrY.exe
  C:\Windows\System\yOZeOrY.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\mLzWuAB.exe
  C:\Windows\System\mLzWuAB.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\UDVOYYZ.exe
  C:\Windows\System\UDVOYYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\XElmSkt.exe
  C:\Windows\System\XElmSkt.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\MjVMCHn.exe
  C:\Windows\System\MjVMCHn.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\oJVOMdK.exe
  C:\Windows\System\oJVOMdK.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\bnHHECS.exe
  C:\Windows\System\bnHHECS.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\uCRYwUB.exe
  C:\Windows\System\uCRYwUB.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\fMJvoHF.exe
  C:\Windows\System\fMJvoHF.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\CyvIfvB.exe
  C:\Windows\System\CyvIfvB.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\XKGEyZt.exe
  C:\Windows\System\XKGEyZt.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\FYVwZMC.exe
  C:\Windows\System\FYVwZMC.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\OisKRoK.exe
  C:\Windows\System\OisKRoK.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\dTpbWrg.exe
  C:\Windows\System\dTpbWrg.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\zaQaINE.exe
  C:\Windows\System\zaQaINE.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\xCeeLXf.exe
  C:\Windows\System\xCeeLXf.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\dzbTwYU.exe
  C:\Windows\System\dzbTwYU.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\CYJPhys.exe
  C:\Windows\System\CYJPhys.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\EcriOdZ.exe
  C:\Windows\System\EcriOdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\KLTlSrO.exe
  C:\Windows\System\KLTlSrO.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\aMdLuUv.exe
  C:\Windows\System\aMdLuUv.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\hyOMejw.exe
  C:\Windows\System\hyOMejw.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\ahyzhtd.exe
  C:\Windows\System\ahyzhtd.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\bjofZsN.exe
  C:\Windows\System\bjofZsN.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\utQTAsz.exe
  C:\Windows\System\utQTAsz.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\YDXOdey.exe
  C:\Windows\System\YDXOdey.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\yBApSSz.exe
  C:\Windows\System\yBApSSz.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\HkJJGfw.exe
  C:\Windows\System\HkJJGfw.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\VkdNRyP.exe
  C:\Windows\System\VkdNRyP.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\TjWSMGJ.exe
  C:\Windows\System\TjWSMGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\ppppAnk.exe
  C:\Windows\System\ppppAnk.exe
  2⤵
  PID:3124
- C:\Windows\System\ZqnrusJ.exe
  C:\Windows\System\ZqnrusJ.exe
  2⤵
  PID:5040
- C:\Windows\System\CklxeSc.exe
  C:\Windows\System\CklxeSc.exe
  2⤵
  PID:4112
- C:\Windows\System\IiozCJY.exe
  C:\Windows\System\IiozCJY.exe
  2⤵
  PID:212
- C:\Windows\System\zieBsCC.exe
  C:\Windows\System\zieBsCC.exe
  2⤵
  PID:4284
- C:\Windows\System\WVEUWAi.exe
  C:\Windows\System\WVEUWAi.exe
  2⤵
  PID:2088
- C:\Windows\System\bPBxFEJ.exe
  C:\Windows\System\bPBxFEJ.exe
  2⤵
  PID:5084
- C:\Windows\System\qZKkfZM.exe
  C:\Windows\System\qZKkfZM.exe
  2⤵
  PID:5076
- C:\Windows\System\OcteLOl.exe
  C:\Windows\System\OcteLOl.exe
  2⤵
  PID:1480
- C:\Windows\System\QydceRd.exe
  C:\Windows\System\QydceRd.exe
  2⤵
  PID:3640
- C:\Windows\System\KrtSqAV.exe
  C:\Windows\System\KrtSqAV.exe
  2⤵
  PID:2752
- C:\Windows\System\IEZVpps.exe
  C:\Windows\System\IEZVpps.exe
  2⤵
  PID:5140
- C:\Windows\System\UdjCdTU.exe
  C:\Windows\System\UdjCdTU.exe
  2⤵
  PID:5172
- C:\Windows\System\xZzygsX.exe
  C:\Windows\System\xZzygsX.exe
  2⤵
  PID:5200
- C:\Windows\System\zxjmonf.exe
  C:\Windows\System\zxjmonf.exe
  2⤵
  PID:5228
- C:\Windows\System\aybeAKP.exe
  C:\Windows\System\aybeAKP.exe
  2⤵
  PID:5256
- C:\Windows\System\BJVJuqb.exe
  C:\Windows\System\BJVJuqb.exe
  2⤵
  PID:5284
- C:\Windows\System\zHsyIOS.exe
  C:\Windows\System\zHsyIOS.exe
  2⤵
  PID:5312
- C:\Windows\System\trMJjFL.exe
  C:\Windows\System\trMJjFL.exe
  2⤵
  PID:5340
- C:\Windows\System\EpykRyE.exe
  C:\Windows\System\EpykRyE.exe
  2⤵
  PID:5368
- C:\Windows\System\eXbxklr.exe
  C:\Windows\System\eXbxklr.exe
  2⤵
  PID:5396
- C:\Windows\System\tEBZmaU.exe
  C:\Windows\System\tEBZmaU.exe
  2⤵
  PID:5424
- C:\Windows\System\hfoVkax.exe
  C:\Windows\System\hfoVkax.exe
  2⤵
  PID:5452
- C:\Windows\System\GZYtMUf.exe
  C:\Windows\System\GZYtMUf.exe
  2⤵
  PID:5480
- C:\Windows\System\jbJSZIK.exe
  C:\Windows\System\jbJSZIK.exe
  2⤵
  PID:5508
- C:\Windows\System\HZPvIje.exe
  C:\Windows\System\HZPvIje.exe
  2⤵
  PID:5536
- C:\Windows\System\KDTCSOH.exe
  C:\Windows\System\KDTCSOH.exe
  2⤵
  PID:5560
- C:\Windows\System\hZWzpLX.exe
  C:\Windows\System\hZWzpLX.exe
  2⤵
  PID:5592
- C:\Windows\System\XndCbxS.exe
  C:\Windows\System\XndCbxS.exe
  2⤵
  PID:5620
- C:\Windows\System\QvrlNDd.exe
  C:\Windows\System\QvrlNDd.exe
  2⤵
  PID:5648
- C:\Windows\System\qAwgCfV.exe
  C:\Windows\System\qAwgCfV.exe
  2⤵
  PID:5676
- C:\Windows\System\HqYurwZ.exe
  C:\Windows\System\HqYurwZ.exe
  2⤵
  PID:5704
- C:\Windows\System\HZNJyfg.exe
  C:\Windows\System\HZNJyfg.exe
  2⤵
  PID:5732
- C:\Windows\System\neezvta.exe
  C:\Windows\System\neezvta.exe
  2⤵
  PID:5760
- C:\Windows\System\JHfODnE.exe
  C:\Windows\System\JHfODnE.exe
  2⤵
  PID:5788
- C:\Windows\System\rDvnhIY.exe
  C:\Windows\System\rDvnhIY.exe
  2⤵
  PID:5816
- C:\Windows\System\wCMeVJS.exe
  C:\Windows\System\wCMeVJS.exe
  2⤵
  PID:5844
- C:\Windows\System\SLBJmHi.exe
  C:\Windows\System\SLBJmHi.exe
  2⤵
  PID:5872
- C:\Windows\System\KIikqaA.exe
  C:\Windows\System\KIikqaA.exe
  2⤵
  PID:5900
- C:\Windows\System\hNoLuSH.exe
  C:\Windows\System\hNoLuSH.exe
  2⤵
  PID:5928
- C:\Windows\System\jcXtBax.exe
  C:\Windows\System\jcXtBax.exe
  2⤵
  PID:5956
- C:\Windows\System\LBEkCKT.exe
  C:\Windows\System\LBEkCKT.exe
  2⤵
  PID:5984
- C:\Windows\System\iPJIUjJ.exe
  C:\Windows\System\iPJIUjJ.exe
  2⤵
  PID:6012
- C:\Windows\System\TSYJVVe.exe
  C:\Windows\System\TSYJVVe.exe
  2⤵
  PID:6036
- C:\Windows\System\ZqxDiFq.exe
  C:\Windows\System\ZqxDiFq.exe
  2⤵
  PID:6064
- C:\Windows\System\sspHEXy.exe
  C:\Windows\System\sspHEXy.exe
  2⤵
  PID:6092
- C:\Windows\System\rIUPjBz.exe
  C:\Windows\System\rIUPjBz.exe
  2⤵
  PID:6124
- C:\Windows\System\zbMSsSD.exe
  C:\Windows\System\zbMSsSD.exe
  2⤵
  PID:1768
- C:\Windows\System\FkfWBPS.exe
  C:\Windows\System\FkfWBPS.exe
  2⤵
  PID:4440
- C:\Windows\System\qEpgJmy.exe
  C:\Windows\System\qEpgJmy.exe
  2⤵
  PID:4296
- C:\Windows\System\rBCduyI.exe
  C:\Windows\System\rBCduyI.exe
  2⤵
  PID:4356
- C:\Windows\System\OJgiazj.exe
  C:\Windows\System\OJgiazj.exe
  2⤵
  PID:5104
- C:\Windows\System\DxaFyYW.exe
  C:\Windows\System\DxaFyYW.exe
  2⤵
  PID:4160
- C:\Windows\System\cFbvHRa.exe
  C:\Windows\System\cFbvHRa.exe
  2⤵
  PID:5184
- C:\Windows\System\LxjUHvb.exe
  C:\Windows\System\LxjUHvb.exe
  2⤵
  PID:5240
- C:\Windows\System\Cajlbzy.exe
  C:\Windows\System\Cajlbzy.exe
  2⤵
  PID:5304
- C:\Windows\System\RyrOUBv.exe
  C:\Windows\System\RyrOUBv.exe
  2⤵
  PID:5380
- C:\Windows\System\FGPRIHR.exe
  C:\Windows\System\FGPRIHR.exe
  2⤵
  PID:5440
- C:\Windows\System\iQkNHtV.exe
  C:\Windows\System\iQkNHtV.exe
  2⤵
  PID:5500
- C:\Windows\System\IKOhlQS.exe
  C:\Windows\System\IKOhlQS.exe
  2⤵
  PID:5576
- C:\Windows\System\NgigMqU.exe
  C:\Windows\System\NgigMqU.exe
  2⤵
  PID:5636
- C:\Windows\System\lzDCrJb.exe
  C:\Windows\System\lzDCrJb.exe
  2⤵
  PID:5692
- C:\Windows\System\LgKyzeH.exe
  C:\Windows\System\LgKyzeH.exe
  2⤵
  PID:5776
- C:\Windows\System\kKHlszE.exe
  C:\Windows\System\kKHlszE.exe
  2⤵
  PID:5832
- C:\Windows\System\CLRvsWq.exe
  C:\Windows\System\CLRvsWq.exe
  2⤵
  PID:5892
- C:\Windows\System\hIKLVwH.exe
  C:\Windows\System\hIKLVwH.exe
  2⤵
  PID:5968
- C:\Windows\System\IZrDmrp.exe
  C:\Windows\System\IZrDmrp.exe
  2⤵
  PID:6024
- C:\Windows\System\itSKPNJ.exe
  C:\Windows\System\itSKPNJ.exe
  2⤵
  PID:6084
- C:\Windows\System\HoCFAqG.exe
  C:\Windows\System\HoCFAqG.exe
  2⤵
  PID:4424
- C:\Windows\System\jPBsGMD.exe
  C:\Windows\System\jPBsGMD.exe
  2⤵
  PID:3232
- C:\Windows\System\tGNJJFf.exe
  C:\Windows\System\tGNJJFf.exe
  2⤵
  PID:4108
- C:\Windows\System\BSgbMDV.exe
  C:\Windows\System\BSgbMDV.exe
  2⤵
  PID:5212
- C:\Windows\System\GzdowgN.exe
  C:\Windows\System\GzdowgN.exe
  2⤵
  PID:5352
- C:\Windows\System\OLNhWfV.exe
  C:\Windows\System\OLNhWfV.exe
  2⤵
  PID:5476
- C:\Windows\System\JgLzzQT.exe
  C:\Windows\System\JgLzzQT.exe
  2⤵
  PID:5612
- C:\Windows\System\VcqHgaK.exe
  C:\Windows\System\VcqHgaK.exe
  2⤵
  PID:5800
- C:\Windows\System\pCaMgRM.exe
  C:\Windows\System\pCaMgRM.exe
  2⤵
  PID:5940
- C:\Windows\System\MFvNYRP.exe
  C:\Windows\System\MFvNYRP.exe
  2⤵
  PID:6056
- C:\Windows\System\dmawAEf.exe
  C:\Windows\System\dmawAEf.exe
  2⤵
  PID:6176
- C:\Windows\System\gocyYZv.exe
  C:\Windows\System\gocyYZv.exe
  2⤵
  PID:6196
- C:\Windows\System\MalnKhp.exe
  C:\Windows\System\MalnKhp.exe
  2⤵
  PID:6224
- C:\Windows\System\HNifyOp.exe
  C:\Windows\System\HNifyOp.exe
  2⤵
  PID:6252
- C:\Windows\System\RqWyIgC.exe
  C:\Windows\System\RqWyIgC.exe
  2⤵
  PID:6280
- C:\Windows\System\ylaFEAq.exe
  C:\Windows\System\ylaFEAq.exe
  2⤵
  PID:6304
- C:\Windows\System\RnAtecf.exe
  C:\Windows\System\RnAtecf.exe
  2⤵
  PID:6336
- C:\Windows\System\UtzVNxD.exe
  C:\Windows\System\UtzVNxD.exe
  2⤵
  PID:6364
- C:\Windows\System\ddGWynu.exe
  C:\Windows\System\ddGWynu.exe
  2⤵
  PID:6392
- C:\Windows\System\BxUlguN.exe
  C:\Windows\System\BxUlguN.exe
  2⤵
  PID:6420
- C:\Windows\System\SyKFAGR.exe
  C:\Windows\System\SyKFAGR.exe
  2⤵
  PID:6448
- C:\Windows\System\BnzmkkE.exe
  C:\Windows\System\BnzmkkE.exe
  2⤵
  PID:6476
- C:\Windows\System\yUoonDb.exe
  C:\Windows\System\yUoonDb.exe
  2⤵
  PID:6504
- C:\Windows\System\QGJyhYQ.exe
  C:\Windows\System\QGJyhYQ.exe
  2⤵
  PID:6532
- C:\Windows\System\oWnQRrE.exe
  C:\Windows\System\oWnQRrE.exe
  2⤵
  PID:6560
- C:\Windows\System\FoNNPFF.exe
  C:\Windows\System\FoNNPFF.exe
  2⤵
  PID:6588
- C:\Windows\System\ibWyTfw.exe
  C:\Windows\System\ibWyTfw.exe
  2⤵
  PID:6616
- C:\Windows\System\MCWNJxG.exe
  C:\Windows\System\MCWNJxG.exe
  2⤵
  PID:6644
- C:\Windows\System\Wjgglri.exe
  C:\Windows\System\Wjgglri.exe
  2⤵
  PID:6672
- C:\Windows\System\RRcGprw.exe
  C:\Windows\System\RRcGprw.exe
  2⤵
  PID:6700
- C:\Windows\System\OJMAvmh.exe
  C:\Windows\System\OJMAvmh.exe
  2⤵
  PID:6728
- C:\Windows\System\KljAxNw.exe
  C:\Windows\System\KljAxNw.exe
  2⤵
  PID:6756
- C:\Windows\System\cfwXyBA.exe
  C:\Windows\System\cfwXyBA.exe
  2⤵
  PID:6784
- C:\Windows\System\dwZicrV.exe
  C:\Windows\System\dwZicrV.exe
  2⤵
  PID:6812
- C:\Windows\System\vwbwjpj.exe
  C:\Windows\System\vwbwjpj.exe
  2⤵
  PID:6840
- C:\Windows\System\qqpNqdh.exe
  C:\Windows\System\qqpNqdh.exe
  2⤵
  PID:6868
- C:\Windows\System\iNLbcBC.exe
  C:\Windows\System\iNLbcBC.exe
  2⤵
  PID:6896
- C:\Windows\System\hwZKAfJ.exe
  C:\Windows\System\hwZKAfJ.exe
  2⤵
  PID:6924
- C:\Windows\System\KKYyeGN.exe
  C:\Windows\System\KKYyeGN.exe
  2⤵
  PID:6952
- C:\Windows\System\LQuHdYJ.exe
  C:\Windows\System\LQuHdYJ.exe
  2⤵
  PID:6980
- C:\Windows\System\sPzghHy.exe
  C:\Windows\System\sPzghHy.exe
  2⤵
  PID:7012
- C:\Windows\System\iGaPlif.exe
  C:\Windows\System\iGaPlif.exe
  2⤵
  PID:7036
- C:\Windows\System\SohHGPz.exe
  C:\Windows\System\SohHGPz.exe
  2⤵
  PID:7064
- C:\Windows\System\ykyrCnx.exe
  C:\Windows\System\ykyrCnx.exe
  2⤵
  PID:7092
- C:\Windows\System\BIVBkKD.exe
  C:\Windows\System\BIVBkKD.exe
  2⤵
  PID:7120
- C:\Windows\System\RWOnTsd.exe
  C:\Windows\System\RWOnTsd.exe
  2⤵
  PID:7148
- C:\Windows\System\ZTuduqv.exe
  C:\Windows\System\ZTuduqv.exe
  2⤵
  PID:6136
- C:\Windows\System\OgypcZs.exe
  C:\Windows\System\OgypcZs.exe
  2⤵
  PID:5128
- C:\Windows\System\LXMBQHM.exe
  C:\Windows\System\LXMBQHM.exe
  2⤵
  PID:5412
- C:\Windows\System\olDZBUM.exe
  C:\Windows\System\olDZBUM.exe
  2⤵
  PID:5744
- C:\Windows\System\SwhVtGt.exe
  C:\Windows\System\SwhVtGt.exe
  2⤵
  PID:6152
- C:\Windows\System\bOnIWmY.exe
  C:\Windows\System\bOnIWmY.exe
  2⤵
  PID:6212
- C:\Windows\System\XmMhTdI.exe
  C:\Windows\System\XmMhTdI.exe
  2⤵
  PID:6268
- C:\Windows\System\sFDsNEC.exe
  C:\Windows\System\sFDsNEC.exe
  2⤵
  PID:6328
- C:\Windows\System\vfjARUv.exe
  C:\Windows\System\vfjARUv.exe
  2⤵
  PID:6404
- C:\Windows\System\bIIPqTx.exe
  C:\Windows\System\bIIPqTx.exe
  2⤵
  PID:6464
- C:\Windows\System\IQzlCce.exe
  C:\Windows\System\IQzlCce.exe
  2⤵
  PID:6524
- C:\Windows\System\OpVLFVU.exe
  C:\Windows\System\OpVLFVU.exe
  2⤵
  PID:6600
- C:\Windows\System\VHmSSXe.exe
  C:\Windows\System\VHmSSXe.exe
  2⤵
  PID:6656
- C:\Windows\System\DMalDcX.exe
  C:\Windows\System\DMalDcX.exe
  2⤵
  PID:6716
- C:\Windows\System\OZuEdaz.exe
  C:\Windows\System\OZuEdaz.exe
  2⤵
  PID:6776
- C:\Windows\System\tsfBPwF.exe
  C:\Windows\System\tsfBPwF.exe
  2⤵
  PID:6852
- C:\Windows\System\DfCYuTl.exe
  C:\Windows\System\DfCYuTl.exe
  2⤵
  PID:6912
- C:\Windows\System\DbUtGTh.exe
  C:\Windows\System\DbUtGTh.exe
  2⤵
  PID:6972
- C:\Windows\System\EmbHOxl.exe
  C:\Windows\System\EmbHOxl.exe
  2⤵
  PID:7048
- C:\Windows\System\UnvAaFt.exe
  C:\Windows\System\UnvAaFt.exe
  2⤵
  PID:7104
- C:\Windows\System\VLyAvST.exe
  C:\Windows\System\VLyAvST.exe
  2⤵
  PID:7164
- C:\Windows\System\FnsMsUW.exe
  C:\Windows\System\FnsMsUW.exe
  2⤵
  PID:4816
- C:\Windows\System\xFhuDuj.exe
  C:\Windows\System\xFhuDuj.exe
  2⤵
  PID:5996
- C:\Windows\System\YUrctSu.exe
  C:\Windows\System\YUrctSu.exe
  2⤵
  PID:6264
- C:\Windows\System\RxTyPqG.exe
  C:\Windows\System\RxTyPqG.exe
  2⤵
  PID:6380
- C:\Windows\System\QgjUwbu.exe
  C:\Windows\System\QgjUwbu.exe
  2⤵
  PID:6552
- C:\Windows\System\TDjEmRk.exe
  C:\Windows\System\TDjEmRk.exe
  2⤵
  PID:1524
- C:\Windows\System\edoZOam.exe
  C:\Windows\System\edoZOam.exe
  2⤵
  PID:6824
- C:\Windows\System\KlRvBKu.exe
  C:\Windows\System\KlRvBKu.exe
  2⤵
  PID:6944
- C:\Windows\System\gfvjaCc.exe
  C:\Windows\System\gfvjaCc.exe
  2⤵
  PID:7080
- C:\Windows\System\aqqYLAI.exe
  C:\Windows\System\aqqYLAI.exe
  2⤵
  PID:7196
- C:\Windows\System\gEphHtU.exe
  C:\Windows\System\gEphHtU.exe
  2⤵
  PID:7224
- C:\Windows\System\CpulMqS.exe
  C:\Windows\System\CpulMqS.exe
  2⤵
  PID:7252
- C:\Windows\System\HTKalTW.exe
  C:\Windows\System\HTKalTW.exe
  2⤵
  PID:7280
- C:\Windows\System\uzLOClm.exe
  C:\Windows\System\uzLOClm.exe
  2⤵
  PID:7308
- C:\Windows\System\HMdZCMs.exe
  C:\Windows\System\HMdZCMs.exe
  2⤵
  PID:7336
- C:\Windows\System\hacDRpm.exe
  C:\Windows\System\hacDRpm.exe
  2⤵
  PID:7364
- C:\Windows\System\xxverCP.exe
  C:\Windows\System\xxverCP.exe
  2⤵
  PID:7392
- C:\Windows\System\ojAYkwb.exe
  C:\Windows\System\ojAYkwb.exe
  2⤵
  PID:7420
- C:\Windows\System\xJNiztW.exe
  C:\Windows\System\xJNiztW.exe
  2⤵
  PID:7452
- C:\Windows\System\gRMZXBU.exe
  C:\Windows\System\gRMZXBU.exe
  2⤵
  PID:7476
- C:\Windows\System\XpbMjtQ.exe
  C:\Windows\System\XpbMjtQ.exe
  2⤵
  PID:7504
- C:\Windows\System\GrSUGiJ.exe
  C:\Windows\System\GrSUGiJ.exe
  2⤵
  PID:7532
- C:\Windows\System\WLzCBTH.exe
  C:\Windows\System\WLzCBTH.exe
  2⤵
  PID:7560
- C:\Windows\System\NNxhhMN.exe
  C:\Windows\System\NNxhhMN.exe
  2⤵
  PID:7588
- C:\Windows\System\XUyuaMv.exe
  C:\Windows\System\XUyuaMv.exe
  2⤵
  PID:7616
- C:\Windows\System\coWPMTi.exe
  C:\Windows\System\coWPMTi.exe
  2⤵
  PID:7644
- C:\Windows\System\hJkvzPW.exe
  C:\Windows\System\hJkvzPW.exe
  2⤵
  PID:7672
- C:\Windows\System\njmnmPB.exe
  C:\Windows\System\njmnmPB.exe
  2⤵
  PID:7700
- C:\Windows\System\lCcpGnr.exe
  C:\Windows\System\lCcpGnr.exe
  2⤵
  PID:7728
- C:\Windows\System\efXmaPm.exe
  C:\Windows\System\efXmaPm.exe
  2⤵
  PID:7756
- C:\Windows\System\PcJsrEr.exe
  C:\Windows\System\PcJsrEr.exe
  2⤵
  PID:7784
- C:\Windows\System\HaQzlVf.exe
  C:\Windows\System\HaQzlVf.exe
  2⤵
  PID:7812
- C:\Windows\System\pvAJaIC.exe
  C:\Windows\System\pvAJaIC.exe
  2⤵
  PID:7840
- C:\Windows\System\hTPlbux.exe
  C:\Windows\System\hTPlbux.exe
  2⤵
  PID:7868
- C:\Windows\System\gUgtdWw.exe
  C:\Windows\System\gUgtdWw.exe
  2⤵
  PID:7896
- C:\Windows\System\Dmppwcp.exe
  C:\Windows\System\Dmppwcp.exe
  2⤵
  PID:7924
- C:\Windows\System\xoHnZLf.exe
  C:\Windows\System\xoHnZLf.exe
  2⤵
  PID:7952
- C:\Windows\System\tszCeFP.exe
  C:\Windows\System\tszCeFP.exe
  2⤵
  PID:7980
- C:\Windows\System\gDPqzev.exe
  C:\Windows\System\gDPqzev.exe
  2⤵
  PID:8008
- C:\Windows\System\BeqbqtR.exe
  C:\Windows\System\BeqbqtR.exe
  2⤵
  PID:8036
- C:\Windows\System\epGRaPo.exe
  C:\Windows\System\epGRaPo.exe
  2⤵
  PID:8064
- C:\Windows\System\RQwsEdl.exe
  C:\Windows\System\RQwsEdl.exe
  2⤵
  PID:8092
- C:\Windows\System\IxxEnwk.exe
  C:\Windows\System\IxxEnwk.exe
  2⤵
  PID:8120
- C:\Windows\System\lutnKpb.exe
  C:\Windows\System\lutnKpb.exe
  2⤵
  PID:8148
- C:\Windows\System\oSgYwEn.exe
  C:\Windows\System\oSgYwEn.exe
  2⤵
  PID:8176
- C:\Windows\System\hGdnmcK.exe
  C:\Windows\System\hGdnmcK.exe
  2⤵
  PID:3252
- C:\Windows\System\EznucMc.exe
  C:\Windows\System\EznucMc.exe
  2⤵
  PID:6188
- C:\Windows\System\FjDNpKR.exe
  C:\Windows\System\FjDNpKR.exe
  2⤵
  PID:6440
- C:\Windows\System\emhARof.exe
  C:\Windows\System\emhARof.exe
  2⤵
  PID:6744
- C:\Windows\System\kAVkoZC.exe
  C:\Windows\System\kAVkoZC.exe
  2⤵
  PID:7020
- C:\Windows\System\VdOtmrm.exe
  C:\Windows\System\VdOtmrm.exe
  2⤵
  PID:7300
- C:\Windows\System\NvnNHGy.exe
  C:\Windows\System\NvnNHGy.exe
  2⤵
  PID:7348
- C:\Windows\System\wMDBUHN.exe
  C:\Windows\System\wMDBUHN.exe
  2⤵
  PID:7352
- C:\Windows\System\RNBcGFH.exe
  C:\Windows\System\RNBcGFH.exe
  2⤵
  PID:7432
- C:\Windows\System\myyDolH.exe
  C:\Windows\System\myyDolH.exe
  2⤵
  PID:7472
- C:\Windows\System\RwPKvky.exe
  C:\Windows\System\RwPKvky.exe
  2⤵
  PID:7544
- C:\Windows\System\ywHidjO.exe
  C:\Windows\System\ywHidjO.exe
  2⤵
  PID:7608
- C:\Windows\System\ytaBrSn.exe
  C:\Windows\System\ytaBrSn.exe
  2⤵
  PID:7632
- C:\Windows\System\rMfkAdX.exe
  C:\Windows\System\rMfkAdX.exe
  2⤵
  PID:7684
- C:\Windows\System\vRoqYeK.exe
  C:\Windows\System\vRoqYeK.exe
  2⤵
  PID:2456
- C:\Windows\System\QPOciFf.exe
  C:\Windows\System\QPOciFf.exe
  2⤵
  PID:7796
- C:\Windows\System\PFjrAnN.exe
  C:\Windows\System\PFjrAnN.exe
  2⤵
  PID:7860
- C:\Windows\System\PWtjQea.exe
  C:\Windows\System\PWtjQea.exe
  2⤵
  PID:7884
- C:\Windows\System\FCIQeVR.exe
  C:\Windows\System\FCIQeVR.exe
  2⤵
  PID:2952
- C:\Windows\System\eIbTMAL.exe
  C:\Windows\System\eIbTMAL.exe
  2⤵
  PID:4056
- C:\Windows\System\ndiwXdL.exe
  C:\Windows\System\ndiwXdL.exe
  2⤵
  PID:8020
- C:\Windows\System\UvYYHRS.exe
  C:\Windows\System\UvYYHRS.exe
  2⤵
  PID:8076
- C:\Windows\System\TrJnCXw.exe
  C:\Windows\System\TrJnCXw.exe
  2⤵
  PID:3932
- C:\Windows\System\fCJBFdI.exe
  C:\Windows\System\fCJBFdI.exe
  2⤵
  PID:4828
- C:\Windows\System\ycmhEXt.exe
  C:\Windows\System\ycmhEXt.exe
  2⤵
  PID:2536
- C:\Windows\System\TzdIIdW.exe
  C:\Windows\System\TzdIIdW.exe
  2⤵
  PID:1324
- C:\Windows\System\nHHFsZX.exe
  C:\Windows\System\nHHFsZX.exe
  2⤵
  PID:6884
- C:\Windows\System\IHfPMhO.exe
  C:\Windows\System\IHfPMhO.exe
  2⤵
  PID:3780
- C:\Windows\System\zleFuzy.exe
  C:\Windows\System\zleFuzy.exe
  2⤵
  PID:3432
- C:\Windows\System\KXDdTrj.exe
  C:\Windows\System\KXDdTrj.exe
  2⤵
  PID:5000
- C:\Windows\System\xIkqAui.exe
  C:\Windows\System\xIkqAui.exe
  2⤵
  PID:7412
- C:\Windows\System\YMDHUyk.exe
  C:\Windows\System\YMDHUyk.exe
  2⤵
  PID:7692
- C:\Windows\System\YschlyK.exe
  C:\Windows\System\YschlyK.exe
  2⤵
  PID:7908
- C:\Windows\System\QeXQEsb.exe
  C:\Windows\System\QeXQEsb.exe
  2⤵
  PID:1124
- C:\Windows\System\PWiTtLH.exe
  C:\Windows\System\PWiTtLH.exe
  2⤵
  PID:2748
- C:\Windows\System\nSoJRZS.exe
  C:\Windows\System\nSoJRZS.exe
  2⤵
  PID:1568
- C:\Windows\System\ZDJeZXf.exe
  C:\Windows\System\ZDJeZXf.exe
  2⤵
  PID:8048
- C:\Windows\System\iTRrFgR.exe
  C:\Windows\System\iTRrFgR.exe
  2⤵
  PID:2652
- C:\Windows\System\PIpbWLQ.exe
  C:\Windows\System\PIpbWLQ.exe
  2⤵
  PID:7468
- C:\Windows\System\EqGNtDu.exe
  C:\Windows\System\EqGNtDu.exe
  2⤵
  PID:8052
- C:\Windows\System\ZLERuIP.exe
  C:\Windows\System\ZLERuIP.exe
  2⤵
  PID:8000
- C:\Windows\System\CRwaVxn.exe
  C:\Windows\System\CRwaVxn.exe
  2⤵
  PID:7972
- C:\Windows\System\DZASgmY.exe
  C:\Windows\System\DZASgmY.exe
  2⤵
  PID:7492
- C:\Windows\System\DZcxJqE.exe
  C:\Windows\System\DZcxJqE.exe
  2⤵
  PID:7580
- C:\Windows\System\BHxSpXU.exe
  C:\Windows\System\BHxSpXU.exe
  2⤵
  PID:8272
- C:\Windows\System\RBrhYyg.exe
  C:\Windows\System\RBrhYyg.exe
  2⤵
  PID:8360
- C:\Windows\System\GpTMUra.exe
  C:\Windows\System\GpTMUra.exe
  2⤵
  PID:8468
- C:\Windows\System\DGQOlFI.exe
  C:\Windows\System\DGQOlFI.exe
  2⤵
  PID:8492
- C:\Windows\System\FccWCIk.exe
  C:\Windows\System\FccWCIk.exe
  2⤵
  PID:8544
- C:\Windows\System\MyttztO.exe
  C:\Windows\System\MyttztO.exe
  2⤵
  PID:8608
- C:\Windows\System\WvtqsxW.exe
  C:\Windows\System\WvtqsxW.exe
  2⤵
  PID:8652
- C:\Windows\System\peVnBcH.exe
  C:\Windows\System\peVnBcH.exe
  2⤵
  PID:8704
- C:\Windows\System\XpQGvnD.exe
  C:\Windows\System\XpQGvnD.exe
  2⤵
  PID:8724
- C:\Windows\System\AdevlDW.exe
  C:\Windows\System\AdevlDW.exe
  2⤵
  PID:8832
- C:\Windows\System\VGweJYO.exe
  C:\Windows\System\VGweJYO.exe
  2⤵
  PID:8920
- C:\Windows\System\Yklorna.exe
  C:\Windows\System\Yklorna.exe
  2⤵
  PID:8968
- C:\Windows\System\uHOqfZj.exe
  C:\Windows\System\uHOqfZj.exe
  2⤵
  PID:8996
- C:\Windows\System\VmrBOzQ.exe
  C:\Windows\System\VmrBOzQ.exe
  2⤵
  PID:9012
- C:\Windows\System\nXKvLMV.exe
  C:\Windows\System\nXKvLMV.exe
  2⤵
  PID:9044
- C:\Windows\System\jvsleuM.exe
  C:\Windows\System\jvsleuM.exe
  2⤵
  PID:9104
- C:\Windows\System\cauGFxa.exe
  C:\Windows\System\cauGFxa.exe
  2⤵
  PID:9164
- C:\Windows\System\JJCvvSg.exe
  C:\Windows\System\JJCvvSg.exe
  2⤵
  PID:9208
- C:\Windows\System\COTuFLf.exe
  C:\Windows\System\COTuFLf.exe
  2⤵
  PID:8244
- C:\Windows\System\mCiSNPJ.exe
  C:\Windows\System\mCiSNPJ.exe
  2⤵
  PID:1700
- C:\Windows\System\POTnTvQ.exe
  C:\Windows\System\POTnTvQ.exe
  2⤵
  PID:8356
- C:\Windows\System\DgbLtdC.exe
  C:\Windows\System\DgbLtdC.exe
  2⤵
  PID:8392
- C:\Windows\System\jLxpZbU.exe
  C:\Windows\System\jLxpZbU.exe
  2⤵
  PID:8428
- C:\Windows\System\mHkazRp.exe
  C:\Windows\System\mHkazRp.exe
  2⤵
  PID:8504
- C:\Windows\System\hJDeNmv.exe
  C:\Windows\System\hJDeNmv.exe
  2⤵
  PID:8556
- C:\Windows\System\SCTIGeX.exe
  C:\Windows\System\SCTIGeX.exe
  2⤵
  PID:8600
- C:\Windows\System\cwGAXnw.exe
  C:\Windows\System\cwGAXnw.exe
  2⤵
  PID:8668
- C:\Windows\System\ZLxOjXw.exe
  C:\Windows\System\ZLxOjXw.exe
  2⤵
  PID:8584
- C:\Windows\System\reqcGhN.exe
  C:\Windows\System\reqcGhN.exe
  2⤵
  PID:8688
- C:\Windows\System\CpUrAio.exe
  C:\Windows\System\CpUrAio.exe
  2⤵
  PID:8844
- C:\Windows\System\lgImseo.exe
  C:\Windows\System\lgImseo.exe
  2⤵
  PID:8812
- C:\Windows\System\CsauGMl.exe
  C:\Windows\System\CsauGMl.exe
  2⤵
  PID:8868
- C:\Windows\System\NXvRuHU.exe
  C:\Windows\System\NXvRuHU.exe
  2⤵
  PID:8904
- C:\Windows\System\GEwhNaZ.exe
  C:\Windows\System\GEwhNaZ.exe
  2⤵
  PID:8944
- C:\Windows\System\Ekrtanq.exe
  C:\Windows\System\Ekrtanq.exe
  2⤵
  PID:9036
- C:\Windows\System\HmZqXDD.exe
  C:\Windows\System\HmZqXDD.exe
  2⤵
  PID:9024
- C:\Windows\System\OVxgsnF.exe
  C:\Windows\System\OVxgsnF.exe
  2⤵
  PID:9040
- C:\Windows\System\uAACmvA.exe
  C:\Windows\System\uAACmvA.exe
  2⤵
  PID:9180
- C:\Windows\System\fRBCaXR.exe
  C:\Windows\System\fRBCaXR.exe
  2⤵
  PID:7768
- C:\Windows\System\VfLEuOV.exe
  C:\Windows\System\VfLEuOV.exe
  2⤵
  PID:7936
- C:\Windows\System\UDeNoUF.exe
  C:\Windows\System\UDeNoUF.exe
  2⤵
  PID:7328
- C:\Windows\System\VqeuJuv.exe
  C:\Windows\System\VqeuJuv.exe
  2⤵
  PID:7916
- C:\Windows\System\hOplpWX.exe
  C:\Windows\System\hOplpWX.exe
  2⤵
  PID:8420
- C:\Windows\System\wKftUXQ.exe
  C:\Windows\System\wKftUXQ.exe
  2⤵
  PID:8488
- C:\Windows\System\KjLXIlS.exe
  C:\Windows\System\KjLXIlS.exe
  2⤵
  PID:8536
- C:\Windows\System\QsGSYkB.exe
  C:\Windows\System\QsGSYkB.exe
  2⤵
  PID:8588
- C:\Windows\System\CPuGEMC.exe
  C:\Windows\System\CPuGEMC.exe
  2⤵
  PID:8736
- C:\Windows\System\OvqnSnj.exe
  C:\Windows\System\OvqnSnj.exe
  2⤵
  PID:8780
- C:\Windows\System\XGHBNHK.exe
  C:\Windows\System\XGHBNHK.exe
  2⤵
  PID:8880
- C:\Windows\System\BnPLuvG.exe
  C:\Windows\System\BnPLuvG.exe
  2⤵
  PID:8896
- C:\Windows\System\AgwwWdZ.exe
  C:\Windows\System\AgwwWdZ.exe
  2⤵
  PID:8948
- C:\Windows\System\fcXXbJp.exe
  C:\Windows\System\fcXXbJp.exe
  2⤵
  PID:3556
- C:\Windows\System\bWEuYAS.exe
  C:\Windows\System\bWEuYAS.exe
  2⤵
  PID:9100
- C:\Windows\System\MKBjbtc.exe
  C:\Windows\System\MKBjbtc.exe
  2⤵
  PID:1144
- C:\Windows\System\pEBzGWr.exe
  C:\Windows\System\pEBzGWr.exe
  2⤵
  PID:9200
- C:\Windows\System\ZLPiaDc.exe
  C:\Windows\System\ZLPiaDc.exe
  2⤵
  PID:8384
- C:\Windows\System\BZGQsbc.exe
  C:\Windows\System\BZGQsbc.exe
  2⤵
  PID:8520
- C:\Windows\System\sCnTzhn.exe
  C:\Windows\System\sCnTzhn.exe
  2⤵
  PID:8628
- C:\Windows\System\iPVKMrt.exe
  C:\Windows\System\iPVKMrt.exe
  2⤵
  PID:8876
- C:\Windows\System\YHJLtOi.exe
  C:\Windows\System\YHJLtOi.exe
  2⤵
  PID:8936
- C:\Windows\System\ZtAIddl.exe
  C:\Windows\System\ZtAIddl.exe
  2⤵
  PID:9076
- C:\Windows\System\RFqhGUB.exe
  C:\Windows\System\RFqhGUB.exe
  2⤵
  PID:7852
- C:\Windows\System\QBTMcAu.exe
  C:\Windows\System\QBTMcAu.exe
  2⤵
  PID:7660
- C:\Windows\System\kYhRErV.exe
  C:\Windows\System\kYhRErV.exe
  2⤵
  PID:8692
- C:\Windows\System\FxYQudB.exe
  C:\Windows\System\FxYQudB.exe
  2⤵
  PID:9080
- C:\Windows\System\Tyzpocn.exe
  C:\Windows\System\Tyzpocn.exe
  2⤵
  PID:9196
- C:\Windows\System\SdVOmCv.exe
  C:\Windows\System\SdVOmCv.exe
  2⤵
  PID:8988
- C:\Windows\System\EsxiUMX.exe
  C:\Windows\System\EsxiUMX.exe
  2⤵
  PID:8412
- C:\Windows\System\OOacYsK.exe
  C:\Windows\System\OOacYsK.exe
  2⤵
  PID:9236
- C:\Windows\System\MbVmIbM.exe
  C:\Windows\System\MbVmIbM.exe
  2⤵
  PID:9264
- C:\Windows\System\QDGJpjX.exe
  C:\Windows\System\QDGJpjX.exe
  2⤵
  PID:9292
- C:\Windows\System\GIVSjYd.exe
  C:\Windows\System\GIVSjYd.exe
  2⤵
  PID:9308
- C:\Windows\System\LZErRZK.exe
  C:\Windows\System\LZErRZK.exe
  2⤵
  PID:9348
- C:\Windows\System\KWRBALF.exe
  C:\Windows\System\KWRBALF.exe
  2⤵
  PID:9376
- C:\Windows\System\sPWJxaW.exe
  C:\Windows\System\sPWJxaW.exe
  2⤵
  PID:9404
- C:\Windows\System\FmfUmsj.exe
  C:\Windows\System\FmfUmsj.exe
  2⤵
  PID:9432
- C:\Windows\System\ppWcDbo.exe
  C:\Windows\System\ppWcDbo.exe
  2⤵
  PID:9460
- C:\Windows\System\khcEywM.exe
  C:\Windows\System\khcEywM.exe
  2⤵
  PID:9476
- C:\Windows\System\YrrmqUz.exe
  C:\Windows\System\YrrmqUz.exe
  2⤵
  PID:9504
- C:\Windows\System\uukOoMH.exe
  C:\Windows\System\uukOoMH.exe
  2⤵
  PID:9536
- C:\Windows\System\CKRJbmZ.exe
  C:\Windows\System\CKRJbmZ.exe
  2⤵
  PID:9576
- C:\Windows\System\zhVHesT.exe
  C:\Windows\System\zhVHesT.exe
  2⤵
  PID:9604
- C:\Windows\System\EumDfbu.exe
  C:\Windows\System\EumDfbu.exe
  2⤵
  PID:9628
- C:\Windows\System\XBhsSTQ.exe
  C:\Windows\System\XBhsSTQ.exe
  2⤵
  PID:9652
- C:\Windows\System\yevNfBu.exe
  C:\Windows\System\yevNfBu.exe
  2⤵
  PID:9692
- C:\Windows\System\FknYWGe.exe
  C:\Windows\System\FknYWGe.exe
  2⤵
  PID:9708
- C:\Windows\System\QLsAfoY.exe
  C:\Windows\System\QLsAfoY.exe
  2⤵
  PID:9748
- C:\Windows\System\QNiCTAM.exe
  C:\Windows\System\QNiCTAM.exe
  2⤵
  PID:9764
- C:\Windows\System\ZhUkcMK.exe
  C:\Windows\System\ZhUkcMK.exe
  2⤵
  PID:9804
- C:\Windows\System\FQyMMHf.exe
  C:\Windows\System\FQyMMHf.exe
  2⤵
  PID:9832
- C:\Windows\System\JpKcHiL.exe
  C:\Windows\System\JpKcHiL.exe
  2⤵
  PID:9848
- C:\Windows\System\FBYXLYJ.exe
  C:\Windows\System\FBYXLYJ.exe
  2⤵
  PID:9888
- C:\Windows\System\GMFSEPD.exe
  C:\Windows\System\GMFSEPD.exe
  2⤵
  PID:9916
- C:\Windows\System\szCemLr.exe
  C:\Windows\System\szCemLr.exe
  2⤵
  PID:9936
- C:\Windows\System\rXBtPxZ.exe
  C:\Windows\System\rXBtPxZ.exe
  2⤵
  PID:9960
- C:\Windows\System\ctMPHYR.exe
  C:\Windows\System\ctMPHYR.exe
  2⤵
  PID:10000
- C:\Windows\System\mIUSGlP.exe
  C:\Windows\System\mIUSGlP.exe
  2⤵
  PID:10028
- C:\Windows\System\WasQURc.exe
  C:\Windows\System\WasQURc.exe
  2⤵
  PID:10056
- C:\Windows\System\CbFbDbr.exe
  C:\Windows\System\CbFbDbr.exe
  2⤵
  PID:10084
- C:\Windows\System\CQLsRaR.exe
  C:\Windows\System\CQLsRaR.exe
  2⤵
  PID:10108
- C:\Windows\System\rpFrAuB.exe
  C:\Windows\System\rpFrAuB.exe
  2⤵
  PID:10132
- C:\Windows\System\jwCVGxl.exe
  C:\Windows\System\jwCVGxl.exe
  2⤵
  PID:10172
- C:\Windows\System\haaxPvz.exe
  C:\Windows\System\haaxPvz.exe
  2⤵
  PID:10192
- C:\Windows\System\MyepYau.exe
  C:\Windows\System\MyepYau.exe
  2⤵
  PID:10224
- C:\Windows\System\BNbheQF.exe
  C:\Windows\System\BNbheQF.exe
  2⤵
  PID:9232
- C:\Windows\System\fRPKNds.exe
  C:\Windows\System\fRPKNds.exe
  2⤵
  PID:9340
- C:\Windows\System\FFrQekt.exe
  C:\Windows\System\FFrQekt.exe
  2⤵
  PID:9360
- C:\Windows\System\liBlHiH.exe
  C:\Windows\System\liBlHiH.exe
  2⤵
  PID:9396
- C:\Windows\System\PySksNv.exe
  C:\Windows\System\PySksNv.exe
  2⤵
  PID:9428
- C:\Windows\System\bQDBofG.exe
  C:\Windows\System\bQDBofG.exe
  2⤵
  PID:9472
- C:\Windows\System\UPaHprX.exe
  C:\Windows\System\UPaHprX.exe
  2⤵
  PID:9572
- C:\Windows\System\BkLmmws.exe
  C:\Windows\System\BkLmmws.exe
  2⤵
  PID:9640
- C:\Windows\System\vOoRiQA.exe
  C:\Windows\System\vOoRiQA.exe
  2⤵
  PID:9680
- C:\Windows\System\iTBCBVC.exe
  C:\Windows\System\iTBCBVC.exe
  2⤵
  PID:9728
- C:\Windows\System\xVfHEul.exe
  C:\Windows\System\xVfHEul.exe
  2⤵
  PID:9860
- C:\Windows\System\NaMezuP.exe
  C:\Windows\System\NaMezuP.exe
  2⤵
  PID:9900
- C:\Windows\System\XtdEmKG.exe
  C:\Windows\System\XtdEmKG.exe
  2⤵
  PID:9972
- C:\Windows\System\wJXtHXQ.exe
  C:\Windows\System\wJXtHXQ.exe
  2⤵
  PID:10024
- C:\Windows\System\hIrqxKU.exe
  C:\Windows\System\hIrqxKU.exe
  2⤵
  PID:10120
- C:\Windows\System\BBMpizD.exe
  C:\Windows\System\BBMpizD.exe
  2⤵
  PID:10164
- C:\Windows\System\wyAmbHw.exe
  C:\Windows\System\wyAmbHw.exe
  2⤵
  PID:10220
- C:\Windows\System\EajUfya.exe
  C:\Windows\System\EajUfya.exe
  2⤵
  PID:4088
- C:\Windows\System\HyvXZde.exe
  C:\Windows\System\HyvXZde.exe
  2⤵
  PID:9400
- C:\Windows\System\MGIIqlg.exe
  C:\Windows\System\MGIIqlg.exe
  2⤵
  PID:9524
- C:\Windows\System\HzhlrhX.exe
  C:\Windows\System\HzhlrhX.exe
  2⤵
  PID:9704
- C:\Windows\System\rYJgkgy.exe
  C:\Windows\System\rYJgkgy.exe
  2⤵
  PID:9840
- C:\Windows\System\MyiBpXS.exe
  C:\Windows\System\MyiBpXS.exe
  2⤵
  PID:9956
- C:\Windows\System\SDjjeDj.exe
  C:\Windows\System\SDjjeDj.exe
  2⤵
  PID:10160
- C:\Windows\System\IKvyhjz.exe
  C:\Windows\System\IKvyhjz.exe
  2⤵
  PID:9332
- C:\Windows\System\JoWabUp.exe
  C:\Windows\System\JoWabUp.exe
  2⤵
  PID:9596
- C:\Windows\System\rouyaHU.exe
  C:\Windows\System\rouyaHU.exe
  2⤵
  PID:3240
- C:\Windows\System\IhNttbU.exe
  C:\Windows\System\IhNttbU.exe
  2⤵
  PID:10116
- C:\Windows\System\rJzQhqM.exe
  C:\Windows\System\rJzQhqM.exe
  2⤵
  PID:1864
- C:\Windows\System\orSGLWc.exe
  C:\Windows\System\orSGLWc.exe
  2⤵
  PID:10052
- C:\Windows\System\ypkrjcK.exe
  C:\Windows\System\ypkrjcK.exe
  2⤵
  PID:10256
- C:\Windows\System\kgarUGu.exe
  C:\Windows\System\kgarUGu.exe
  2⤵
  PID:10284
- C:\Windows\System\rvFYUTf.exe
  C:\Windows\System\rvFYUTf.exe
  2⤵
  PID:10320
- C:\Windows\System\osvqSyw.exe
  C:\Windows\System\osvqSyw.exe
  2⤵
  PID:10348
- C:\Windows\System\ABpSgDj.exe
  C:\Windows\System\ABpSgDj.exe
  2⤵
  PID:10368
- C:\Windows\System\VepMSRT.exe
  C:\Windows\System\VepMSRT.exe
  2⤵
  PID:10404
- C:\Windows\System\gFgfWcJ.exe
  C:\Windows\System\gFgfWcJ.exe
  2⤵
  PID:10432
- C:\Windows\System\HpKGvKe.exe
  C:\Windows\System\HpKGvKe.exe
  2⤵
  PID:10460
- C:\Windows\System\kmFRxwL.exe
  C:\Windows\System\kmFRxwL.exe
  2⤵
  PID:10488
- C:\Windows\System\dxqayAS.exe
  C:\Windows\System\dxqayAS.exe
  2⤵
  PID:10504
- C:\Windows\System\nWAqyDa.exe
  C:\Windows\System\nWAqyDa.exe
  2⤵
  PID:10540
- C:\Windows\System\ueuxvoz.exe
  C:\Windows\System\ueuxvoz.exe
  2⤵
  PID:10560
- C:\Windows\System\HHzlxKa.exe
  C:\Windows\System\HHzlxKa.exe
  2⤵
  PID:10600
- C:\Windows\System\bfkmdYS.exe
  C:\Windows\System\bfkmdYS.exe
  2⤵
  PID:10628
- C:\Windows\System\LqyIHew.exe
  C:\Windows\System\LqyIHew.exe
  2⤵
  PID:10656
- C:\Windows\System\WWsctXU.exe
  C:\Windows\System\WWsctXU.exe
  2⤵
  PID:10672
- C:\Windows\System\cVSYuuj.exe
  C:\Windows\System\cVSYuuj.exe
  2⤵
  PID:10712
- C:\Windows\System\iUvPPhC.exe
  C:\Windows\System\iUvPPhC.exe
  2⤵
  PID:10736
- C:\Windows\System\nryyAbn.exe
  C:\Windows\System\nryyAbn.exe
  2⤵
  PID:10756
- C:\Windows\System\leYeWSk.exe
  C:\Windows\System\leYeWSk.exe
  2⤵
  PID:10796
- C:\Windows\System\KDxeuMZ.exe
  C:\Windows\System\KDxeuMZ.exe
  2⤵
  PID:10824
- C:\Windows\System\cRfYoxI.exe
  C:\Windows\System\cRfYoxI.exe
  2⤵
  PID:10852
- C:\Windows\System\WHmaiYt.exe
  C:\Windows\System\WHmaiYt.exe
  2⤵
  PID:10880
- C:\Windows\System\CjtdkZN.exe
  C:\Windows\System\CjtdkZN.exe
  2⤵
  PID:10912
- C:\Windows\System\JAyMDcQ.exe
  C:\Windows\System\JAyMDcQ.exe
  2⤵
  PID:10940
- C:\Windows\System\nSQxDXw.exe
  C:\Windows\System\nSQxDXw.exe
  2⤵
  PID:10968
- C:\Windows\System\XcolYzh.exe
  C:\Windows\System\XcolYzh.exe
  2⤵
  PID:10984
- C:\Windows\System\bMCovKj.exe
  C:\Windows\System\bMCovKj.exe
  2⤵
  PID:11032
- C:\Windows\System\yARlntI.exe
  C:\Windows\System\yARlntI.exe
  2⤵
  PID:11060
- C:\Windows\System\YYqBcqx.exe
  C:\Windows\System\YYqBcqx.exe
  2⤵
  PID:11076
- C:\Windows\System\JOPUrfN.exe
  C:\Windows\System\JOPUrfN.exe
  2⤵
  PID:11116
- C:\Windows\System\wPIPnYA.exe
  C:\Windows\System\wPIPnYA.exe
  2⤵
  PID:11132
- C:\Windows\System\iqojRjv.exe
  C:\Windows\System\iqojRjv.exe
  2⤵
  PID:11172
- C:\Windows\System\VtCZRdA.exe
  C:\Windows\System\VtCZRdA.exe
  2⤵
  PID:11188
- C:\Windows\System\QVXWeRY.exe
  C:\Windows\System\QVXWeRY.exe
  2⤵
  PID:11228
- C:\Windows\System\WGibpXJ.exe
  C:\Windows\System\WGibpXJ.exe
  2⤵
  PID:11256
- C:\Windows\System\mtDqnJg.exe
  C:\Windows\System\mtDqnJg.exe
  2⤵
  PID:10280
- C:\Windows\System\JjPtYig.exe
  C:\Windows\System\JjPtYig.exe
  2⤵
  PID:4608
- C:\Windows\System\tSUaKHI.exe
  C:\Windows\System\tSUaKHI.exe
  2⤵
  PID:10340
- C:\Windows\System\ZaAbKDV.exe
  C:\Windows\System\ZaAbKDV.exe
  2⤵
  PID:3472
- C:\Windows\System\WMhgDAK.exe
  C:\Windows\System\WMhgDAK.exe
  2⤵
  PID:10480
- C:\Windows\System\VJjqpjG.exe
  C:\Windows\System\VJjqpjG.exe
  2⤵
  PID:10536
- C:\Windows\System\ilBpHiM.exe
  C:\Windows\System\ilBpHiM.exe
  2⤵
  PID:10592
- C:\Windows\System\zceOurZ.exe
  C:\Windows\System\zceOurZ.exe
  2⤵
  PID:10668
- C:\Windows\System\TCrstWx.exe
  C:\Windows\System\TCrstWx.exe
  2⤵
  PID:10728
- C:\Windows\System\rjQqxDw.exe
  C:\Windows\System\rjQqxDw.exe
  2⤵
  PID:10792
- C:\Windows\System\wAFgCSf.exe
  C:\Windows\System\wAFgCSf.exe
  2⤵
  PID:10840
- C:\Windows\System\GjCTkpl.exe
  C:\Windows\System\GjCTkpl.exe
  2⤵
  PID:10924
- C:\Windows\System\VIdZYWs.exe
  C:\Windows\System\VIdZYWs.exe
  2⤵
  PID:10980
- C:\Windows\System\GgnZmCu.exe
  C:\Windows\System\GgnZmCu.exe
  2⤵
  PID:11016
- C:\Windows\System\GhCXAEm.exe
  C:\Windows\System\GhCXAEm.exe
  2⤵
  PID:11096
- C:\Windows\System\wXVbTEB.exe
  C:\Windows\System\wXVbTEB.exe
  2⤵
  PID:11160
- C:\Windows\System\uaXGiiW.exe
  C:\Windows\System\uaXGiiW.exe
  2⤵
  PID:11184
- C:\Windows\System\WPrkkFM.exe
  C:\Windows\System\WPrkkFM.exe
  2⤵
  PID:11220
- C:\Windows\System\lmOXhDZ.exe
  C:\Windows\System\lmOXhDZ.exe
  2⤵
  PID:10376
- C:\Windows\System\sGXXXkE.exe
  C:\Windows\System\sGXXXkE.exe
  2⤵
  PID:10648
- C:\Windows\System\bzlaTDD.exe
  C:\Windows\System\bzlaTDD.exe
  2⤵
  PID:10696
- C:\Windows\System\iGkqEFQ.exe
  C:\Windows\System\iGkqEFQ.exe
  2⤵
  PID:10872
- C:\Windows\System\PxyvNCI.exe
  C:\Windows\System\PxyvNCI.exe
  2⤵
  PID:10964
- C:\Windows\System\hSHyRnY.exe
  C:\Windows\System\hSHyRnY.exe
  2⤵
  PID:11104
- C:\Windows\System\QZlYuLV.exe
  C:\Windows\System\QZlYuLV.exe
  2⤵
  PID:11248
- C:\Windows\System\sRmETjv.exe
  C:\Windows\System\sRmETjv.exe
  2⤵
  PID:10444
- C:\Windows\System\hcOZCSa.exe
  C:\Windows\System\hcOZCSa.exe
  2⤵
  PID:10876
- C:\Windows\System\elGKutu.exe
  C:\Windows\System\elGKutu.exe
  2⤵
  PID:10356
- C:\Windows\System\iuFNZbo.exe
  C:\Windows\System\iuFNZbo.exe
  2⤵
  PID:10816
- C:\Windows\System\jLGttyg.exe
  C:\Windows\System\jLGttyg.exe
  2⤵
  PID:11204
- C:\Windows\System\yBecUSz.exe
  C:\Windows\System\yBecUSz.exe
  2⤵
  PID:3748
- C:\Windows\System\wzvADcj.exe
  C:\Windows\System\wzvADcj.exe
  2⤵
  PID:11284
- C:\Windows\System\enaoWXk.exe
  C:\Windows\System\enaoWXk.exe
  2⤵
  PID:11312
- C:\Windows\System\gVzPrvR.exe
  C:\Windows\System\gVzPrvR.exe
  2⤵
  PID:11336
- C:\Windows\System\FpJMUca.exe
  C:\Windows\System\FpJMUca.exe
  2⤵
  PID:11380
- C:\Windows\System\JFfrVky.exe
  C:\Windows\System\JFfrVky.exe
  2⤵
  PID:11416
- C:\Windows\System\PHOsKUh.exe
  C:\Windows\System\PHOsKUh.exe
  2⤵
  PID:11456
- C:\Windows\System\SJmXbqO.exe
  C:\Windows\System\SJmXbqO.exe
  2⤵
  PID:11480
- C:\Windows\System\DLPIKNZ.exe
  C:\Windows\System\DLPIKNZ.exe
  2⤵
  PID:11500
- C:\Windows\System\WLxxgSW.exe
  C:\Windows\System\WLxxgSW.exe
  2⤵
  PID:11540
- C:\Windows\System\vFXxlLO.exe
  C:\Windows\System\vFXxlLO.exe
  2⤵
  PID:11556
- C:\Windows\System\ejardda.exe
  C:\Windows\System\ejardda.exe
  2⤵
  PID:11596
- C:\Windows\System\hoOgBNO.exe
  C:\Windows\System\hoOgBNO.exe
  2⤵
  PID:11616
- C:\Windows\System\ufMQcuV.exe
  C:\Windows\System\ufMQcuV.exe
  2⤵
  PID:11656
- C:\Windows\System\TppaKlE.exe
  C:\Windows\System\TppaKlE.exe
  2⤵
  PID:11684
- C:\Windows\System\GDZWypF.exe
  C:\Windows\System\GDZWypF.exe
  2⤵
  PID:11712
- C:\Windows\System\dEUTJOS.exe
  C:\Windows\System\dEUTJOS.exe
  2⤵
  PID:11740
- C:\Windows\System\aYTNIox.exe
  C:\Windows\System\aYTNIox.exe
  2⤵
  PID:11768
- C:\Windows\System\ZVWWgtU.exe
  C:\Windows\System\ZVWWgtU.exe
  2⤵
  PID:11796
- C:\Windows\System\mkqofjG.exe
  C:\Windows\System\mkqofjG.exe
  2⤵
  PID:11812
- C:\Windows\System\fqRbnfb.exe
  C:\Windows\System\fqRbnfb.exe
  2⤵
  PID:11828
- C:\Windows\System\vGPUIYA.exe
  C:\Windows\System\vGPUIYA.exe
  2⤵
  PID:11868
- C:\Windows\System\qLYePMR.exe
  C:\Windows\System\qLYePMR.exe
  2⤵
  PID:11900
- C:\Windows\System\vgBWNQE.exe
  C:\Windows\System\vgBWNQE.exe
  2⤵
  PID:11936
- C:\Windows\System\TfOVGmY.exe
  C:\Windows\System\TfOVGmY.exe
  2⤵
  PID:11952
- C:\Windows\System\KCZCZnx.exe
  C:\Windows\System\KCZCZnx.exe
  2⤵
  PID:11980
- C:\Windows\System\KYPKeHi.exe
  C:\Windows\System\KYPKeHi.exe
  2⤵
  PID:12008
- C:\Windows\System\sXReZzL.exe
  C:\Windows\System\sXReZzL.exe
  2⤵
  PID:12040
- C:\Windows\System\gLrqSfW.exe
  C:\Windows\System\gLrqSfW.exe
  2⤵
  PID:12064
- C:\Windows\System\odflVIx.exe
  C:\Windows\System\odflVIx.exe
  2⤵
  PID:12084
- C:\Windows\System\yUJpAsZ.exe
  C:\Windows\System\yUJpAsZ.exe
  2⤵
  PID:12132
- C:\Windows\System\PKhSpbK.exe
  C:\Windows\System\PKhSpbK.exe
  2⤵
  PID:12160
- C:\Windows\System\rvQGyqo.exe
  C:\Windows\System\rvQGyqo.exe
  2⤵
  PID:12184
- C:\Windows\System\WLaisoi.exe
  C:\Windows\System\WLaisoi.exe
  2⤵
  PID:12212
- C:\Windows\System\wWCJGgb.exe
  C:\Windows\System\wWCJGgb.exe
  2⤵
  PID:12232
- C:\Windows\System\cQJAOiq.exe
  C:\Windows\System\cQJAOiq.exe
  2⤵
  PID:12272
- C:\Windows\System\JGchwkV.exe
  C:\Windows\System\JGchwkV.exe
  2⤵
  PID:10768
- C:\Windows\System\HyZQFwi.exe
  C:\Windows\System\HyZQFwi.exe
  2⤵
  PID:1004
- C:\Windows\System\Dxcdmpj.exe
  C:\Windows\System\Dxcdmpj.exe
  2⤵
  PID:11324
- C:\Windows\System\aTkMYJT.exe
  C:\Windows\System\aTkMYJT.exe
  2⤵
  PID:11400
- C:\Windows\System\bWewmom.exe
  C:\Windows\System\bWewmom.exe
  2⤵
  PID:11472
- C:\Windows\System\SicNXPt.exe
  C:\Windows\System\SicNXPt.exe
  2⤵
  PID:11528
- C:\Windows\System\tYqrNFq.exe
  C:\Windows\System\tYqrNFq.exe
  2⤵
  PID:11612
- C:\Windows\System\bTVtLQP.exe
  C:\Windows\System\bTVtLQP.exe
  2⤵
  PID:11696
- C:\Windows\System\SvGhedT.exe
  C:\Windows\System\SvGhedT.exe
  2⤵
  PID:11784
- C:\Windows\System\oXkRefV.exe
  C:\Windows\System\oXkRefV.exe
  2⤵
  PID:11880
- C:\Windows\System\cWwQYfm.exe
  C:\Windows\System\cWwQYfm.exe
  2⤵
  PID:11924
- C:\Windows\System\IUIytMs.exe
  C:\Windows\System\IUIytMs.exe
  2⤵
  PID:11968
- C:\Windows\System\AQUQVVu.exe
  C:\Windows\System\AQUQVVu.exe
  2⤵
  PID:12048
- C:\Windows\System\dklnBus.exe
  C:\Windows\System\dklnBus.exe
  2⤵
  PID:12100
- C:\Windows\System\ljJGVSD.exe
  C:\Windows\System\ljJGVSD.exe
  2⤵
  PID:12152
- C:\Windows\System\UjaAbtK.exe
  C:\Windows\System\UjaAbtK.exe
  2⤵
  PID:12244
- C:\Windows\System\xiwXRcr.exe
  C:\Windows\System\xiwXRcr.exe
  2⤵
  PID:4416
- C:\Windows\System\trpqzVR.exe
  C:\Windows\System\trpqzVR.exe
  2⤵
  PID:11436
- C:\Windows\System\amZGXLb.exe
  C:\Windows\System\amZGXLb.exe
  2⤵
  PID:11572
- C:\Windows\System\OurHghy.exe
  C:\Windows\System\OurHghy.exe
  2⤵
  PID:11780
- C:\Windows\System\MzllaVy.exe
  C:\Windows\System\MzllaVy.exe
  2⤵
  PID:11992
- C:\Windows\System\iJGyWBT.exe
  C:\Windows\System\iJGyWBT.exe
  2⤵
  PID:12028
- C:\Windows\System\ACyTkRm.exe
  C:\Windows\System\ACyTkRm.exe
  2⤵
  PID:12128
- C:\Windows\System\KDnzWkA.exe
  C:\Windows\System\KDnzWkA.exe
  2⤵
  PID:11512
- C:\Windows\System\hUUgKmA.exe
  C:\Windows\System\hUUgKmA.exe
  2⤵
  PID:11848
- C:\Windows\System\vyLazpe.exe
  C:\Windows\System\vyLazpe.exe
  2⤵
  PID:12280
- C:\Windows\System\KCvvJmP.exe
  C:\Windows\System\KCvvJmP.exe
  2⤵
  PID:11636
- C:\Windows\System\bcINsBK.exe
  C:\Windows\System\bcINsBK.exe
  2⤵
  PID:12296
- C:\Windows\System\JArghaF.exe
  C:\Windows\System\JArghaF.exe
  2⤵
  PID:12324
- C:\Windows\System\ASpssAy.exe
  C:\Windows\System\ASpssAy.exe
  2⤵
  PID:12340
- C:\Windows\System\wyuEreR.exe
  C:\Windows\System\wyuEreR.exe
  2⤵
  PID:12380
- C:\Windows\System\rzJzCCQ.exe
  C:\Windows\System\rzJzCCQ.exe
  2⤵
  PID:12400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2gppnyhc.zbq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2gppnyhc.zbq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CCIwRGw.exe

Path C:\Windows\System\CCIwRGw.exe
Size 2.9MB
SHA256 a522f0d8955df1ef1a7458799f0bc18c1995f6d9a5adb3e6a05fc727c89ceb75
MD5 275c65313e9f4cdd63f7777ea8083f5c
SHA1 53535020a6bcfa60519338a16ea9f64ce9acbcd4
SHA512 614a745c8ed1c74ce2fb28db65503905ce7be466cc7fee6578f4db413e63c1f7ac683ef15b76c076a275d90b684f3dac4ec73128a3f0c4ea9e1581fc40492787
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnMyDPp.exe

Path C:\Windows\System\EnMyDPp.exe
Size 2.9MB
SHA256 9a4ddd63cda939dfaef1ddf6770529dc749aa33c38eb8435932b526695edd7e3
MD5 66868547502c114faa5945729e8e1604
SHA1 60b95e4354da7ebeef72f3e05a1fbc44ccd0cd31
SHA512 5be306a9b900ce955cce1d5f28c737478da9ec5f7acacb8aa9a2d8b19c808bbabb991343a9a683cfd0694ba58be2cd440e6a3cde79c0dc323d4a623c1f2e83a7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFp:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

FUlIzTW.exe

Path C:\Windows\System\FUlIzTW.exe
Size 2.9MB
SHA256 3f4bfc8f0d004603422a5001f245ea07b056cbb01a09e1c963c0daa9863da546
MD5 35c41ccca774d6c2973020e595629b0b
SHA1 e20b3bb051e5ff3ad664b1d0fbb0a473ff68e797
SHA512 a7baf4f37df785f44ad48cb0c256ab98a4487240c0e32da07ab26376a7a010383657a4f1294276f4a16fa778e3104a20e559be6c161a09df8f22dee810f88824
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFg:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

JFWqTvb.exe

Path C:\Windows\System\JFWqTvb.exe
Size 2.9MB
SHA256 d28c5ebe089802692c08ce7419c7357acaaae07ba85451cc5ebd7a3bccb82fb0
MD5 7b16b0d83dd84321a5f4881f4349a1a8
SHA1 b843367a4bfcbfd34f0db912872ac4c6b67c6ab1
SHA512 eb15080d1642b8c4302cf6adda062f440d02c2a3996e3aec0fd068d14ae5e8f0fe9c143ffb0dd8db15669447e948fd07520eb65755fb58e5c5a2c9f66f16549f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFr8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

KOTxvUP.exe

Path C:\Windows\System\KOTxvUP.exe
Size 2.9MB
SHA256 eacc14da97a4f06607a062696c623c181a1152b2f179bf5bfb116964f5573fc1
MD5 7bb8a2188087dd1fd2d8845ec7f0b100
SHA1 554ab0691096785acd8e7bae8ba59366c6ff9ddb
SHA512 4db04c0897841c042edb45017955e9f4be7c49696bead1d3acde83313a329d9f22bd979d1abc0490c574a5695d9b09fffe4ffd73710dd9e5d58c79e07fe8f8f6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFD:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LdrMKdT.exe

Path C:\Windows\System\LdrMKdT.exe
Size 8B
SHA256 36e55333ae3d5576ba03b741cb1c838f247aac6b1cd7cdcee267d53cebe8decc
MD5 f5de367e14d93143ef1faedf842e5b6d
SHA1 53c34a3e3da8f1f6c2e9e53890e9edf2ff008d74
SHA512 0b231b233512c747cdbb209c99fd8472d55d97087002ae2f0851082cba32457ea0555a830f41369229ad1917eed68b9237ee47ec40ef110da72ae97f30abe677
MD5 SHA1 SHA512

Submit Download

MNiCFSr.exe

Path C:\Windows\System\MNiCFSr.exe
Size 2.9MB
SHA256 3bf4effe645bbebb4646ffc36134e5283e4931d8b93f58e30f8e65c440e33606
MD5 a0c3b7d1abf3251749fc43989a3b5b42
SHA1 9f70ecc0fa39c3b8bfa657a1cbb25e1175b18d39
SHA512 fd8d899ce945e0b93ecbae551418dded5df5f5e31be71138fa360100ae97ba270d8952471f119c7aa8c75684434d6be0adcca4e11a4de45ea24cf730a1436a0c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJywRXM.exe

Path C:\Windows\System\NJywRXM.exe
Size 2.9MB
SHA256 d9d1cbf824aac31c1c6c5547b97c38a2eb68d3041cf7e76a40842e7795d3e3c3
MD5 a0aed15250c6a343739aa089253c12d8
SHA1 f71e3c8ef917d4961ab49b1948be100481153196
SHA512 28be4a74ea42e0af5b5f725c51c70c32ba7fb0ff76914217e2044299e04ea7e187f75b1c5da33c39d44baeeabc2970234a0407fb3e768f8503b586442ca8d244
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

NNaWJhL.exe

Path C:\Windows\System\NNaWJhL.exe
Size 2.9MB
SHA256 3e59d5e3fee875b0833160e0993b4056975fcc7c85cc1f0759201d47b0b2bf18
MD5 025960b31ff4c7f5797f6d45634f6f0a
SHA1 456c4738243f04e0b9e8d0463126e6b223a25c9f
SHA512 65bb4d08541057f1431444a99811bfe6087afa29d542e21d0a131d6853d911dd85b0b086dc992abedd4f16e61e4f1a8855575d7e285167d06026a11fca78c832
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFO8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

NfpBTPs.exe

Path C:\Windows\System\NfpBTPs.exe
Size 2.9MB
SHA256 04741c9727c2f65eb5c5846209389a8653a344041850c359d05b4e2ef9edc30a
MD5 04a8953b44c2ec15a09f563c34e7106f
SHA1 2a94f54801a29bfc6ba8fef038567d9f401e0878
SHA512 29c8851a973e2eb10e97e61f395b711b4f585a2db1fd5d36910cf44ecac7483bc65abc5f4ed731132f4dc56e323d0734a3a9421e9a1dd5a89fa400585f10ebb4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFE8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OmladNE.exe

Path C:\Windows\System\OmladNE.exe
Size 2.9MB
SHA256 e45b56cf36bd2df7bc4c3565d93b239f6a79a52b540c08715a05a7024b9ad8ca
MD5 0f45a840c20f672b3992131fe581faa9
SHA1 97583c7672c5ab62f73444213291800d867af05a
SHA512 f09501bc7fc1059bd828be403baa3a4f51819703c3c9543c57e72616e157a0071f6a062ed641688fb16e59c921f079e89629b2796a6699bb5138279f11589d6c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFs:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

PFFaAsP.exe

Path C:\Windows\System\PFFaAsP.exe
Size 2.9MB
SHA256 d6adb57875d939d248c707009310495145581021ab50e93a4a22653b4f700438
MD5 8b1bbd94cd209e3f00abc68a0e9d3d9f
SHA1 716b00661a616e8161b9c3f3763d468c785cc184
SHA512 0367772127ad14ec65edf64a42e00fc226e4ac360b2a60db4679d6decbe04aafd1242aa3979f299ecd603b7419f92f329127cd6bfb4ad888e24abad33091283e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

PqvJZAU.exe

Path C:\Windows\System\PqvJZAU.exe
Size 2.9MB
SHA256 813020b2f7e3a89b22013fdf33568069396253c45106c7c850696a8d3fa8fa43
MD5 0a9699aa6d70c18ce5dfdb21e370ea51
SHA1 d35c5e98c95ca4824bafa0c8dc9805f13cf27f47
SHA512 5a58efe6d5595685c85c9764a3f5876825fcbd5298dcca5047fb4156badec556db55307ef4fd56f199197bf31d1263bc197cf59f77614d8cb7d23ca98c1d0d44
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFr:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SGUFQJP.exe

Path C:\Windows\System\SGUFQJP.exe
Size 2.9MB
SHA256 e103f6459e5f99b5d06e89d0aa2e968b7ced24af037c7083b4acf1cdc4d456a7
MD5 8d9defffa1e272dffdd671a81a60d6d3
SHA1 c2800b8342bc36aa7cee2bf86cbd14a952cabe6a
SHA512 470ba4178367225004628677aebc499f78dfbd7a9466a5a549ed251a67dc32fb35ef51d7d7830624ea8914ae4f6c83ecbb8a15293e1aab0af4823197e858e215
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFp:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAnooJy.exe

Path C:\Windows\System\UAnooJy.exe
Size 2.9MB
SHA256 6cd21250e9406813c62e2cf19c719b33881b4cf86c2d56968f060b9463c50316
MD5 da2fc74bbc8bdbcc86d4174ff238213b
SHA1 4fa9e93ec4b4745e9a6d2a1bc6fdccf3eadd16ba
SHA512 11b798b873c8e72fa1d32ee30457326b06f9ad3376b73fc5c76a58b852a86b8d00f4de816052a1e83dd07ff0206bba49365fea6abd5cc5b34b3bafa991eb89ff
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

YWpLsML.exe

Path C:\Windows\System\YWpLsML.exe
Size 2.9MB
SHA256 f294aed8b10b342356102ab273402a05101c61f2415f079cc2e44f085bf8bd27
MD5 1d6b7a5e99056e0b8291e1b8d25f893f
SHA1 92698acbd9d1e0eb76754553a8014b9ddf25b5ef
SHA512 f8fe100f0b69aacaa1bc499e84fdca088ebe194ae818010c8150fc481e642d89949dc27127e8787d670143660d7e47e8e5178e8c4707c1824dafcb68d4a9093c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFK:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dDiAZHI.exe

Path C:\Windows\System\dDiAZHI.exe
Size 2.9MB
SHA256 f21d2aae41202ad7302366466f229a5a6a5e512709682a9913d091a671d3a98d
MD5 d508d610b8249783e047c462d82d5f65
SHA1 482f5688c8010e295510ae2e73599bc0f8db7054
SHA512 ec83dce74cba7408605414d9ef4c105a5d8100fbc5cd790cadf0d1c89070a213488efd15f7fc8a964151c7a264aacda593a431a77a288c587fa1ee158f31c953
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFa:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fQdfZMr.exe

Path C:\Windows\System\fQdfZMr.exe
Size 2.9MB
SHA256 dd50e2dc32fb932b6fd2b763c1c543b93bc2c449c68f995fd4f0a549e3f52561
MD5 71af43cac15648510807792f6a1a367a
SHA1 debfa39d08d2a217b5ce15c5f9e27ecef1f4af24
SHA512 2fde23d89b6276e27d749dc61411829a5b1112505a6197c2cb4d1204c355525152f077ed12376fd8da8d0e793d3a7680540b7908c1b88445f9ab9d15076767ab
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFW:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hvYINDK.exe

Path C:\Windows\System\hvYINDK.exe
Size 2.9MB
SHA256 503f425890370b5aff64a070502558039d8c2d204b56ba49c49b11d83d0b1ab5
MD5 6868421fa48e8a1761b9a09328daac8a
SHA1 4ececccdfd26016136c906bcfb6f8d781eec6a96
SHA512 81132b8935ff45ff27ce53e0100d34edd1b8d5880509118d0344e0c649aa9afcf6274a5fd28c298400cb18fc3a42e4cc977d79ab5b22f9f82ea5357d325aca7e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

kflbQes.exe

Path C:\Windows\System\kflbQes.exe
Size 2.9MB
SHA256 7f242bb5c830b65d999d24af6f16885f596c75b971098473187c258aad334f74
MD5 450e981244b4d0c0e9cd19d584dbef2e
SHA1 1daf271d6d308da4b45d7947919e2164936abc20
SHA512 883294585c4c3787f36d4b13ed6f20e4ce7ffead21780f7ded33779f19ec7c23e9d92015cd1b512c03e758d53e71393c92a402e6b689ab2dbf8f8a38db3be0ad
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFj:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbOIqmj.exe

Path C:\Windows\System\nbOIqmj.exe
Size 2.9MB
SHA256 85b4b2c5b313648143ed0f25c5f14f6ddc67fbf59d06a405cbdc30b6ff213be0
MD5 45e7a89165be06482022a748860594b0
SHA1 9f53d96056f48cd4baacc095a0a555e331187895
SHA512 49b4a09e43d7ecfe73d4bd95511a8c6941e2918e467169e324fe8309e91bdebee1307b84939f514d11b8183e553a8f064900c65123388c9194ecba474acbc724
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

oKggOFb.exe

Path C:\Windows\System\oKggOFb.exe
Size 2.9MB
SHA256 5a37ecfb526cf05b8ae6409494d3854dd6c26f565c13838ae894abe0fa3c8613
MD5 f58936f787c9436f943d20020c2d86d2
SHA1 df99a872df4c08580fe0468cbd10299e34a2d650
SHA512 7a3e641cfac41d2e8e1a7b7ea83ca73084667b74fcb4530d6e482db69ba47d6d6fbb9efcdb57ce05234ff9f07a440baa7dfcef93391aa040fb1b3787d3359627
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

oNmssBk.exe

Path C:\Windows\System\oNmssBk.exe
Size 2.9MB
SHA256 6593d4a6fbf09bbc07d43afba8c96bd6191f3eaf18788e34cf3d4cd91052e176
MD5 46e666079131812923cd38129932ba9d
SHA1 e965afe4455996ebd0c3a76ae75266550fe6dadf
SHA512 be0a26e50093db5ddea0260e6cbf2c9d7a020b1bb407623e6d73484d2cc006cdd7e4f8505564763277a8939c6990b70fef1c3aa44affa821b8f97b0f4abe7127
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFP:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcNbmtT.exe

Path C:\Windows\System\pcNbmtT.exe
Size 2.9MB
SHA256 8b1d6f5921a63d630b387dd311b0550a5ce7bdd695e99914446587141851e32b
MD5 70b51ebb636e470bbb94233e5a556987
SHA1 8030ee82c2be4f39471edda13721005c310415d8
SHA512 b80924330ba5c070a547db574670e407e3dd366563998776cba40d1a918857a23800738166174811a683d0bfa2f927de75032015f7b55b0fb8f945134b09e482
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppmMhNo.exe

Path C:\Windows\System\ppmMhNo.exe
Size 2.9MB
SHA256 9b1b9a647123fba6841292cad57f37bf08de07e406a151c3c6c00cb03cd079d8
MD5 cefb902e04d05fa0ed885f417feb9cb5
SHA1 652c3746a7ce52ebdaf83a0c95a4118395407989
SHA512 78a3499bf846799bbfbbaa09951bea5fe6177d9985a6e485a9bdbef172dca457c8f41001df56290e46bca19bef6daa66a6ff5554f30ae2195cfa8e9a02961710
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFk:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

qYCXyhw.exe

Path C:\Windows\System\qYCXyhw.exe
Size 2.9MB
SHA256 49472d0bca7d21b1b3de2eb6692399deb513786f45dd1ffee0d6e2ae1ff35544
MD5 a1f552ea5a472b3bc2c12577e35fb3fd
SHA1 9173fcc91268d9ca1ab97a0e30e9833ca699489c
SHA512 a44ec770b82bac6b5745c5a34a131b7873c9b098aac3f63a9987709a121603e0ca2bd6b3aae1696755a657b80c0c470c90806a51c0b7ca10eabdc11693e2abfc
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFi:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

quuBRzB.exe

Path C:\Windows\System\quuBRzB.exe
Size 2.9MB
SHA256 5e7a23a478115376acc2d211a373998852e2633b53b91abed4ae8d8a2d2278ae
MD5 285c09e78e45ed1a70e4c075f1bc304e
SHA1 6a7cf6d40b67d1692ec71a8815985e48c1d89f5f
SHA512 efbd4c0176dfc08df4ace2c1479564f9a766f2a2c74942f6a827057e0a10b5ade3329fd08a8a8546c2b10beed626d839a2d7c8c1799299099b501b432fc980e2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

rGBbHRJ.exe

Path C:\Windows\System\rGBbHRJ.exe
Size 2.9MB
SHA256 1f89d3429221ebe5dfc8ff0b492e4f71e4fd78a2875c57d872e2e01eaf9128f9
MD5 4d8c8ff03ae7a61d0f4256d2f2faa2f1
SHA1 90cf8490d4c72d0472fdc2a86a28777874d9670c
SHA512 d5031bad8a6b7f674739948967d025bcd2f126edae638ba4b00596a2d00487b8f1639b7fe2a26434d0c720a77b71197d2f0e72f2d306467481957da9f886fb44
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

rwkrWwg.exe

Path C:\Windows\System\rwkrWwg.exe
Size 2.9MB
SHA256 784abb9134c9b315338a161f52afe9dadba24f3fb0b474d26ffbc3523629a59b
MD5 4afb7896e394aae7eaba806f69a7abd1
SHA1 2074596fe9b974f94d3b6cf73113cebb6d9283a9
SHA512 9c313122fb9076516e1da67834badd4b9866fafcf437d0d26a647b1eb18cb0b0fe347c7b77b9106c5bae4524bb8c04bbcfbe3ddeb689f92c91457ebebbdc3d0b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF4:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sVvQsvl.exe

Path C:\Windows\System\sVvQsvl.exe
Size 2.9MB
SHA256 723170642f551b9d8a3d1557fa196325fa91c2ecd39963f34d8e90867436ca95
MD5 2106d8ad71571510c6336e349235ba0e
SHA1 85fb39a46f87f0d771c6275a38dfd5f506a338ce
SHA512 e3dff104feee303f0a3016a8dc5f1ed8a25f060a7ce87a79da74a8980897f934dc9a9b1d3d94d085ebf941bbb20dbee5c4edf0b5aebb850e590f908634956ef9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFs:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

togNKrD.exe

Path C:\Windows\System\togNKrD.exe
Size 2.9MB
SHA256 87e2971dd00ad76a9d88b7e9032e1f2c69ac5f7bb157844c69bf43eca149eb78
MD5 afd3ee63151a17b00099e420fa99417b
SHA1 bc36fbd721a038ee53bc506fbf92a4ddf9e221a2
SHA512 d1a550305c465c7e3224691f5e89f9b8f83b45d1258dd5b5d9c0900a16ee98980a6031d09d02b584670ffab139f2710eac057105b43ccc056d791e5a5c8523ba
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

veTIfJM.exe

Path C:\Windows\System\veTIfJM.exe
Size 2.9MB
SHA256 07ceb31c54f06d063287be0b300b32074e3213562f5960e5e223dd2c98f256bb
MD5 66d60202761dcc23d6155247b269ad47
SHA1 3984697b90420e0eb96d37636575142c488e7d60
SHA512 8d7faafc2ff9fcb25d9a07013b3a41aaa310c6959a2f90e0dcb783664ba98130dde57cb534bca714c2c61450288d8f1e5d584c518f052237f8ecc101f2243331
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vzGhYPl.exe

Path C:\Windows\System\vzGhYPl.exe
Size 2.9MB
SHA256 39c7fa45504260e856c112b481e4030faa8280919912dc1195d3a1f263091d39
MD5 dd810c5504e1a7158be8715e7b20767b
SHA1 655ae1357a74e6c0605bf818febe333252a4c53f
SHA512 036e7fffd7296032ebf7c53e5c275d7f588f9c591812590ba5f1650db60f704c9133ac960542cdc3a583f486d4a73a63aa0fb89d4439222d44d5088abd3c5e6d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToFy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

xGRITxE.exe

Path C:\Windows\System\xGRITxE.exe
Size 2.9MB
SHA256 e7fa590a018d40aec0406a2c6e9af06307c557d78f67d6276e5075390a34bba9
MD5 cb4fe0a9c5d0bdf2e4a5ae29daebf3ff
SHA1 29cde67de28885479fc9bc46210b30fb7b40fc45
SHA512 fa158cba40e6bc1d9810e3ec080b4ffa2f0f3968f543a2a6c67b02f91e1cc0ceb98a5ffaba904f9d63b539d9529e807ef020830e31fc28ef355ccbe692a346c3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToF+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-913-0x00007FF719340000-0x00007FF719736000-memory.dmp

Download

memory/672-2157-0x00007FF719340000-0x00007FF719736000-memory.dmp

Download

memory/1020-886-0x00007FF7A0100000-0x00007FF7A04F6000-memory.dmp

Download

memory/1020-2142-0x00007FF7A0100000-0x00007FF7A04F6000-memory.dmp

Download

memory/1100-2145-0x00007FF636200000-0x00007FF6365F6000-memory.dmp

Download

memory/1100-839-0x00007FF636200000-0x00007FF6365F6000-memory.dmp

Download

memory/1500-2155-0x00007FF79C870000-0x00007FF79CC66000-memory.dmp

Download

memory/1500-906-0x00007FF79C870000-0x00007FF79CC66000-memory.dmp

Download

memory/1504-2147-0x00007FF60D0C0000-0x00007FF60D4B6000-memory.dmp

Download

memory/1504-828-0x00007FF60D0C0000-0x00007FF60D4B6000-memory.dmp

Download

memory/1600-72-0x00007FF7C5B30000-0x00007FF7C5F26000-memory.dmp

Download

memory/1600-2135-0x00007FF7C5B30000-0x00007FF7C5F26000-memory.dmp

Download

memory/1828-932-0x00007FF794E80000-0x00007FF795276000-memory.dmp

Download

memory/1828-2146-0x00007FF794E80000-0x00007FF795276000-memory.dmp

Download

memory/2028-2152-0x00007FF77B0E0000-0x00007FF77B4D6000-memory.dmp

Download

memory/2028-928-0x00007FF77B0E0000-0x00007FF77B4D6000-memory.dmp

Download

memory/2172-2143-0x00007FF645ED0000-0x00007FF6462C6000-memory.dmp

Download

memory/2172-855-0x00007FF645ED0000-0x00007FF6462C6000-memory.dmp

Download

memory/2496-2149-0x00007FF730320000-0x00007FF730716000-memory.dmp

Download

memory/2496-959-0x00007FF730320000-0x00007FF730716000-memory.dmp

Download

memory/2560-2151-0x00007FF605770000-0x00007FF605B66000-memory.dmp

Download

memory/2560-924-0x00007FF605770000-0x00007FF605B66000-memory.dmp

Download

memory/2744-2150-0x00007FF7A3430000-0x00007FF7A3826000-memory.dmp

Download

memory/2744-860-0x00007FF7A3430000-0x00007FF7A3826000-memory.dmp

Download

memory/3024-841-0x00007FF68EFC0000-0x00007FF68F3B6000-memory.dmp

Download

memory/3024-2144-0x00007FF68EFC0000-0x00007FF68F3B6000-memory.dmp

Download

memory/3204-964-0x00007FF6B71F0000-0x00007FF6B75E6000-memory.dmp

Download

memory/3204-2140-0x00007FF6B71F0000-0x00007FF6B75E6000-memory.dmp

Download

memory/3616-2148-0x00007FF6D31A0000-0x00007FF6D3596000-memory.dmp

Download

memory/3616-866-0x00007FF6D31A0000-0x00007FF6D3596000-memory.dmp

Download

memory/3644-910-0x00007FF7F4C30000-0x00007FF7F5026000-memory.dmp

Download

memory/3644-2153-0x00007FF7F4C30000-0x00007FF7F5026000-memory.dmp

Download

memory/4068-2139-0x00007FF6BAC00000-0x00007FF6BAFF6000-memory.dmp

Download

memory/4068-923-0x00007FF6BAC00000-0x00007FF6BAFF6000-memory.dmp

Download

memory/4320-62-0x00007FF6A1170000-0x00007FF6A1566000-memory.dmp

Download

memory/4320-2136-0x00007FF6A1170000-0x00007FF6A1566000-memory.dmp

Download

memory/4524-878-0x00007FF7EF240000-0x00007FF7EF636000-memory.dmp

Download

memory/4524-2141-0x00007FF7EF240000-0x00007FF7EF636000-memory.dmp

Download

memory/4660-900-0x00007FF7B9000000-0x00007FF7B93F6000-memory.dmp

Download

memory/4660-2156-0x00007FF7B9000000-0x00007FF7B93F6000-memory.dmp

Download

memory/4832-2154-0x00007FF66E370000-0x00007FF66E766000-memory.dmp

Download

memory/4832-889-0x00007FF66E370000-0x00007FF66E766000-memory.dmp

Download

memory/4960-2137-0x00007FF7A9DB0000-0x00007FF7AA1A6000-memory.dmp

Download

memory/4960-78-0x00007FF7A9DB0000-0x00007FF7AA1A6000-memory.dmp

Download

memory/4972-2132-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Download

memory/4972-420-0x00000222B0050000-0x00000222B07F6000-memory.dmp

Download

memory/4972-39-0x0000022297360000-0x0000022297382000-memory.dmp

Download

memory/4972-2133-0x00007FF9A4673000-0x00007FF9A4675000-memory.dmp

Download

memory/4972-31-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Download

memory/4972-3-0x00007FF9A4673000-0x00007FF9A4675000-memory.dmp

Download

memory/4972-47-0x00007FF9A4670000-0x00007FF9A5131000-memory.dmp

Download

memory/4980-79-0x00007FF6A69B0000-0x00007FF6A6DA6000-memory.dmp

Download

memory/4980-2138-0x00007FF6A69B0000-0x00007FF6A6DA6000-memory.dmp

Download

memory/4984-0-0x00007FF7A79C0000-0x00007FF7A7DB6000-memory.dmp

Download

memory/4984-1-0x0000023427F60000-0x0000023427F70000-memory.dmp

Download

memory/5016-2134-0x00007FF741AA0000-0x00007FF741E96000-memory.dmp

Download

memory/5016-920-0x00007FF741AA0000-0x00007FF741E96000-memory.dmp

Download