xmrig | 24959255b54fa16feda57b770417f29a5a1d9a3d5ce158c3d2accb6ea9fc5609

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
Size 3.3MB
Sample240527-rd9b8afa2w
SHA256 24959255b54fa16feda57b770417f29a5a1d9a3d5ce158c3d2accb6ea9fc5609
MD5 77bab2e5f98bcf23eedd0192264c0d30
SHA1 b42478ed99fa73a4e945b0eed733a30a3cf58145
SHA512 a1abf662659f4aece5904bf92c17af962d82219ed4882f850f80bb0532aceb45050d203f835c7075cfb62d05de29f7096636e4a424e22242d1d9a30451727b84
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:SbBeSFkN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3264-0-0x00007FF7AF180000-0x00007FF7AF576000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-9.dat	xmrig
behavioral2/files/0x000700000002341b-12.dat	xmrig
behavioral2/files/0x0009000000023410-6.dat	xmrig
behavioral2/files/0x000700000002341d-32.dat	xmrig
behavioral2/files/0x0007000000023420-37.dat	xmrig
behavioral2/files/0x000800000002341f-49.dat	xmrig
behavioral2/files/0x0007000000023421-57.dat	xmrig
behavioral2/memory/852-64-0x00007FF74B120000-0x00007FF74B516000-memory.dmp	xmrig
behavioral2/memory/1236-68-0x00007FF60B5B0000-0x00007FF60B9A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-74.dat	xmrig
behavioral2/memory/3064-76-0x00007FF745E40000-0x00007FF746236000-memory.dmp	xmrig
behavioral2/memory/2464-80-0x00007FF66BF70000-0x00007FF66C366000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-89.dat	xmrig
behavioral2/files/0x0007000000023428-99.dat	xmrig
behavioral2/files/0x0007000000023429-107.dat	xmrig
behavioral2/files/0x000700000002342c-117.dat	xmrig
behavioral2/files/0x000700000002342e-133.dat	xmrig
behavioral2/files/0x0007000000023436-173.dat	xmrig
behavioral2/memory/3712-525-0x00007FF7CA6D0000-0x00007FF7CAAC6000-memory.dmp	xmrig
behavioral2/memory/2844-526-0x00007FF7F44E0000-0x00007FF7F48D6000-memory.dmp	xmrig
behavioral2/memory/4968-527-0x00007FF7BA680000-0x00007FF7BAA76000-memory.dmp	xmrig
behavioral2/memory/4904-528-0x00007FF633E30000-0x00007FF634226000-memory.dmp	xmrig
behavioral2/memory/4364-524-0x00007FF70FCF0000-0x00007FF7100E6000-memory.dmp	xmrig
behavioral2/memory/2776-536-0x00007FF73D170000-0x00007FF73D566000-memory.dmp	xmrig
behavioral2/memory/3480-538-0x00007FF747260000-0x00007FF747656000-memory.dmp	xmrig
behavioral2/memory/2344-541-0x00007FF7F14C0000-0x00007FF7F18B6000-memory.dmp	xmrig
behavioral2/memory/400-542-0x00007FF7F47B0000-0x00007FF7F4BA6000-memory.dmp	xmrig
behavioral2/memory/3544-540-0x00007FF7BA440000-0x00007FF7BA836000-memory.dmp	xmrig
behavioral2/memory/1324-537-0x00007FF6E4010000-0x00007FF6E4406000-memory.dmp	xmrig
behavioral2/memory/2484-535-0x00007FF602F00000-0x00007FF6032F6000-memory.dmp	xmrig
behavioral2/memory/2376-534-0x00007FF6A7790000-0x00007FF6A7B86000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-187.dat	xmrig
behavioral2/files/0x0007000000023439-184.dat	xmrig
behavioral2/files/0x0007000000023438-182.dat	xmrig
behavioral2/files/0x0007000000023437-178.dat	xmrig
behavioral2/files/0x0007000000023435-167.dat	xmrig
behavioral2/files/0x0007000000023434-163.dat	xmrig
behavioral2/files/0x0007000000023433-158.dat	xmrig
behavioral2/files/0x0007000000023432-153.dat	xmrig
behavioral2/files/0x0007000000023431-148.dat	xmrig
behavioral2/files/0x0007000000023430-143.dat	xmrig
behavioral2/files/0x000700000002342f-138.dat	xmrig
behavioral2/files/0x000700000002342d-128.dat	xmrig
behavioral2/files/0x000700000002342b-118.dat	xmrig
behavioral2/files/0x000700000002342a-113.dat	xmrig
behavioral2/files/0x0007000000023427-97.dat	xmrig
behavioral2/files/0x0007000000023425-87.dat	xmrig
behavioral2/memory/1116-81-0x00007FF725EC0000-0x00007FF7262B6000-memory.dmp	xmrig
behavioral2/memory/2228-77-0x00007FF70F430000-0x00007FF70F826000-memory.dmp	xmrig
behavioral2/memory/3792-75-0x00007FF60E690000-0x00007FF60EA86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-72.dat	xmrig
behavioral2/memory/2232-71-0x00007FF647780000-0x00007FF647B76000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-66.dat	xmrig
behavioral2/memory/3224-65-0x00007FF79A4C0000-0x00007FF79A8B6000-memory.dmp	xmrig
behavioral2/memory/3956-60-0x00007FF6F7140000-0x00007FF6F7536000-memory.dmp	xmrig
behavioral2/memory/1840-55-0x00007FF66CEB0000-0x00007FF66D2A6000-memory.dmp	xmrig
behavioral2/files/0x000800000002341e-43.dat	xmrig
behavioral2/memory/1840-2415-0x00007FF66CEB0000-0x00007FF66D2A6000-memory.dmp	xmrig
behavioral2/memory/3792-2416-0x00007FF60E690000-0x00007FF60EA86000-memory.dmp	xmrig
behavioral2/memory/3956-2417-0x00007FF6F7140000-0x00007FF6F7536000-memory.dmp	xmrig
behavioral2/memory/3064-2418-0x00007FF745E40000-0x00007FF746236000-memory.dmp	xmrig
behavioral2/memory/852-2419-0x00007FF74B120000-0x00007FF74B516000-memory.dmp	xmrig
behavioral2/memory/3224-2420-0x00007FF79A4C0000-0x00007FF79A8B6000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
7	3648	powershell.exe
9	3648	powershell.exe
23	3648	powershell.exe
22	3648	powershell.exe
24	3648	powershell.exe
26	3648	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3648	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1840	BOmiPvC.exe
3792	drYMMTS.exe
3956	WytYHRe.exe
3064	VvdfyfD.exe
852	dghFVTx.exe
3224	bQuEBCB.exe
1236	bsCIWrz.exe
2228	qqLkhBr.exe
2232	bBsDtAN.exe
2464	xwZQfUW.exe
1116	Ajiqabc.exe
4364	ZLgoQEX.exe
3712	ySwfqzH.exe
2844	yiFYuZU.exe
4968	LsgLLlj.exe
4904	gJwqTaC.exe
2376	HyduGlC.exe
2484	botBBvi.exe
2776	TyNeCmT.exe
1324	wLgnWTv.exe
3480	TQShEAd.exe
3544	HMXLnzR.exe
2344	kBWMtBf.exe
400	dNLjmgw.exe
2196	jrETEyV.exe
2276	syCSPKN.exe
1596	ukztHqB.exe
2620	NQUcJBu.exe
3996	bSueSvC.exe
2204	zCzaCKB.exe
3516	OUjlxQo.exe
2600	QgCkrWf.exe
1684	tXyAgFo.exe
2968	HhkboCC.exe
3508	xwmzRtP.exe
3744	qbVpipC.exe
4004	CroFcqX.exe
3624	PiifhtQ.exe
4996	YuewUbN.exe
1552	FcNtEAl.exe
3924	zStKyWd.exe
232	kOvNhnv.exe
4184	zxOdSlE.exe
5004	CEHmgeC.exe
4540	DXvTYGd.exe
728	jwvMzaX.exe
4784	yEmdXKt.exe
952	YQOdGbf.exe
1708	orykxBS.exe
2452	MVUinnk.exe
4504	pXpwblz.exe
4804	YTuXllb.exe
2352	rVePHhX.exe
4084	lmgnIkk.exe
4212	mnFsLxW.exe
4692	qWwOfhE.exe
4244	RGftgEk.exe
404	BpEvMCJ.exe
396	XfPdiwz.exe
5112	UrdNIME.exe
3232	amsUtgx.exe
3324	wwVTDHt.exe
2672	XHKAscN.exe
3700	PmVAIRI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3264-0-0x00007FF7AF180000-0x00007FF7AF576000-memory.dmp	upx
behavioral2/files/0x000700000002341c-9.dat	upx
behavioral2/files/0x000700000002341b-12.dat	upx
behavioral2/files/0x0009000000023410-6.dat	upx
behavioral2/files/0x000700000002341d-32.dat	upx
behavioral2/files/0x0007000000023420-37.dat	upx
behavioral2/files/0x000800000002341f-49.dat	upx
behavioral2/files/0x0007000000023421-57.dat	upx
behavioral2/memory/852-64-0x00007FF74B120000-0x00007FF74B516000-memory.dmp	upx
behavioral2/memory/1236-68-0x00007FF60B5B0000-0x00007FF60B9A6000-memory.dmp	upx
behavioral2/files/0x0007000000023424-74.dat	upx
behavioral2/memory/3064-76-0x00007FF745E40000-0x00007FF746236000-memory.dmp	upx
behavioral2/memory/2464-80-0x00007FF66BF70000-0x00007FF66C366000-memory.dmp	upx
behavioral2/files/0x0007000000023426-89.dat	upx
behavioral2/files/0x0007000000023428-99.dat	upx
behavioral2/files/0x0007000000023429-107.dat	upx
behavioral2/files/0x000700000002342c-117.dat	upx
behavioral2/files/0x000700000002342e-133.dat	upx
behavioral2/files/0x0007000000023436-173.dat	upx
behavioral2/memory/3712-525-0x00007FF7CA6D0000-0x00007FF7CAAC6000-memory.dmp	upx
behavioral2/memory/2844-526-0x00007FF7F44E0000-0x00007FF7F48D6000-memory.dmp	upx
behavioral2/memory/4968-527-0x00007FF7BA680000-0x00007FF7BAA76000-memory.dmp	upx
behavioral2/memory/4904-528-0x00007FF633E30000-0x00007FF634226000-memory.dmp	upx
behavioral2/memory/4364-524-0x00007FF70FCF0000-0x00007FF7100E6000-memory.dmp	upx
behavioral2/memory/2776-536-0x00007FF73D170000-0x00007FF73D566000-memory.dmp	upx
behavioral2/memory/3480-538-0x00007FF747260000-0x00007FF747656000-memory.dmp	upx
behavioral2/memory/2344-541-0x00007FF7F14C0000-0x00007FF7F18B6000-memory.dmp	upx
behavioral2/memory/400-542-0x00007FF7F47B0000-0x00007FF7F4BA6000-memory.dmp	upx
behavioral2/memory/3544-540-0x00007FF7BA440000-0x00007FF7BA836000-memory.dmp	upx
behavioral2/memory/1324-537-0x00007FF6E4010000-0x00007FF6E4406000-memory.dmp	upx
behavioral2/memory/2484-535-0x00007FF602F00000-0x00007FF6032F6000-memory.dmp	upx
behavioral2/memory/2376-534-0x00007FF6A7790000-0x00007FF6A7B86000-memory.dmp	upx
behavioral2/files/0x000700000002343a-187.dat	upx
behavioral2/files/0x0007000000023439-184.dat	upx
behavioral2/files/0x0007000000023438-182.dat	upx
behavioral2/files/0x0007000000023437-178.dat	upx
behavioral2/files/0x0007000000023435-167.dat	upx
behavioral2/files/0x0007000000023434-163.dat	upx
behavioral2/files/0x0007000000023433-158.dat	upx
behavioral2/files/0x0007000000023432-153.dat	upx
behavioral2/files/0x0007000000023431-148.dat	upx
behavioral2/files/0x0007000000023430-143.dat	upx
behavioral2/files/0x000700000002342f-138.dat	upx
behavioral2/files/0x000700000002342d-128.dat	upx
behavioral2/files/0x000700000002342b-118.dat	upx
behavioral2/files/0x000700000002342a-113.dat	upx
behavioral2/files/0x0007000000023427-97.dat	upx
behavioral2/files/0x0007000000023425-87.dat	upx
behavioral2/memory/1116-81-0x00007FF725EC0000-0x00007FF7262B6000-memory.dmp	upx
behavioral2/memory/2228-77-0x00007FF70F430000-0x00007FF70F826000-memory.dmp	upx
behavioral2/memory/3792-75-0x00007FF60E690000-0x00007FF60EA86000-memory.dmp	upx
behavioral2/files/0x0007000000023423-72.dat	upx
behavioral2/memory/2232-71-0x00007FF647780000-0x00007FF647B76000-memory.dmp	upx
behavioral2/files/0x0007000000023422-66.dat	upx
behavioral2/memory/3224-65-0x00007FF79A4C0000-0x00007FF79A8B6000-memory.dmp	upx
behavioral2/memory/3956-60-0x00007FF6F7140000-0x00007FF6F7536000-memory.dmp	upx
behavioral2/memory/1840-55-0x00007FF66CEB0000-0x00007FF66D2A6000-memory.dmp	upx
behavioral2/files/0x000800000002341e-43.dat	upx
behavioral2/memory/1840-2415-0x00007FF66CEB0000-0x00007FF66D2A6000-memory.dmp	upx
behavioral2/memory/3792-2416-0x00007FF60E690000-0x00007FF60EA86000-memory.dmp	upx
behavioral2/memory/3956-2417-0x00007FF6F7140000-0x00007FF6F7536000-memory.dmp	upx
behavioral2/memory/3064-2418-0x00007FF745E40000-0x00007FF746236000-memory.dmp	upx
behavioral2/memory/852-2419-0x00007FF74B120000-0x00007FF74B516000-memory.dmp	upx
behavioral2/memory/3224-2420-0x00007FF79A4C0000-0x00007FF79A8B6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vzWhOrs.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\YtAuNul.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\XhrlwDK.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\QxYPOfH.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\mUKsjHA.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\UvybuLL.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\SphMRHo.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\DIPbEUj.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\lpjXxCo.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\cyGrfKT.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\TezfVtH.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\MaolJRx.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\yJGHCjs.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\JXdAZTb.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\KjZjDvC.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\ZEkjFhC.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\VHzPtJU.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\FJCNzFg.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\VZoxfxr.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\suFKTsT.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\vqECvfp.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\JgDvZrz.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\BPIHnMo.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\fDomcHb.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\Ntogvmw.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\KBtaofw.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\rhnwtjm.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\WAaXbgV.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\rdIgBqi.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\KrdHNgW.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\TdQlwzX.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\pUQjiYX.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\JbhTbFN.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\luyzYNu.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\OjRUZXB.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\OPELOSE.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\bonMUyw.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\GqUiKDC.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\EiMtARS.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\AMYvtdW.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\oxsHEWa.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\AkEUoSj.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\rOpbbOt.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\ssGITVJ.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\IONHbzT.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\BEcRZeq.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\PrpCIpq.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\DQWNodv.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\IVztDRP.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\RalIzbJ.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\ZhJpspu.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\fEZFGXl.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\CVrAkRu.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\iFdgkDJ.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\XURBoDr.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\xRqRcsh.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\rZUBkUg.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\FcpLfwZ.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\EiSHcxU.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\pzBdkMf.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\syrgBOz.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\sRcrZaV.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\wDkjRpP.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
File created	C:\Windows\System\DytgSFh.exe	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3648	powershell.exe
3648	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeLockMemoryPrivilege	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 3648	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	82
PID 3264 wrote to memory of 3648	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	82
PID 3264 wrote to memory of 1840	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	83
PID 3264 wrote to memory of 1840	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	83
PID 3264 wrote to memory of 3792	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	84
PID 3264 wrote to memory of 3792	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	84
PID 3264 wrote to memory of 3956	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	85
PID 3264 wrote to memory of 3956	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	85
PID 3264 wrote to memory of 3064	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	86
PID 3264 wrote to memory of 3064	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	86
PID 3264 wrote to memory of 852	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	87
PID 3264 wrote to memory of 852	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	87
PID 3264 wrote to memory of 3224	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	88
PID 3264 wrote to memory of 3224	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	88
PID 3264 wrote to memory of 1236	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	89
PID 3264 wrote to memory of 1236	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	89
PID 3264 wrote to memory of 2228	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	90
PID 3264 wrote to memory of 2228	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	90
PID 3264 wrote to memory of 2232	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	91
PID 3264 wrote to memory of 2232	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	91
PID 3264 wrote to memory of 2464	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	92
PID 3264 wrote to memory of 2464	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	92
PID 3264 wrote to memory of 1116	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	93
PID 3264 wrote to memory of 1116	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	93
PID 3264 wrote to memory of 4364	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	94
PID 3264 wrote to memory of 4364	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	94
PID 3264 wrote to memory of 3712	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	95
PID 3264 wrote to memory of 3712	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	95
PID 3264 wrote to memory of 2844	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	96
PID 3264 wrote to memory of 2844	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	96
PID 3264 wrote to memory of 4968	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	97
PID 3264 wrote to memory of 4968	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	97
PID 3264 wrote to memory of 4904	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	98
PID 3264 wrote to memory of 4904	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	98
PID 3264 wrote to memory of 2376	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	99
PID 3264 wrote to memory of 2376	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	99
PID 3264 wrote to memory of 2484	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	100
PID 3264 wrote to memory of 2484	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	100
PID 3264 wrote to memory of 2776	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	101
PID 3264 wrote to memory of 2776	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	101
PID 3264 wrote to memory of 1324	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	102
PID 3264 wrote to memory of 1324	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	102
PID 3264 wrote to memory of 3480	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	103
PID 3264 wrote to memory of 3480	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	103
PID 3264 wrote to memory of 3544	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	104
PID 3264 wrote to memory of 3544	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	104
PID 3264 wrote to memory of 2344	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	105
PID 3264 wrote to memory of 2344	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	105
PID 3264 wrote to memory of 400	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	106
PID 3264 wrote to memory of 400	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	106
PID 3264 wrote to memory of 2196	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	107
PID 3264 wrote to memory of 2196	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	107
PID 3264 wrote to memory of 2276	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	108
PID 3264 wrote to memory of 2276	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	108
PID 3264 wrote to memory of 1596	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	109
PID 3264 wrote to memory of 1596	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	109
PID 3264 wrote to memory of 2620	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	110
PID 3264 wrote to memory of 2620	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	110
PID 3264 wrote to memory of 3996	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	111
PID 3264 wrote to memory of 3996	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	111
PID 3264 wrote to memory of 2204	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	112
PID 3264 wrote to memory of 2204	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	112
PID 3264 wrote to memory of 3516	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	113
PID 3264 wrote to memory of 3516	3264	77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77bab2e5f98bcf23eedd0192264c0d30_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\System\BOmiPvC.exe
  C:\Windows\System\BOmiPvC.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\drYMMTS.exe
  C:\Windows\System\drYMMTS.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\WytYHRe.exe
  C:\Windows\System\WytYHRe.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\VvdfyfD.exe
  C:\Windows\System\VvdfyfD.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\dghFVTx.exe
  C:\Windows\System\dghFVTx.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\bQuEBCB.exe
  C:\Windows\System\bQuEBCB.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\bsCIWrz.exe
  C:\Windows\System\bsCIWrz.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\qqLkhBr.exe
  C:\Windows\System\qqLkhBr.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\bBsDtAN.exe
  C:\Windows\System\bBsDtAN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\xwZQfUW.exe
  C:\Windows\System\xwZQfUW.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\Ajiqabc.exe
  C:\Windows\System\Ajiqabc.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\ZLgoQEX.exe
  C:\Windows\System\ZLgoQEX.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\ySwfqzH.exe
  C:\Windows\System\ySwfqzH.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\yiFYuZU.exe
  C:\Windows\System\yiFYuZU.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\LsgLLlj.exe
  C:\Windows\System\LsgLLlj.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\gJwqTaC.exe
  C:\Windows\System\gJwqTaC.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\HyduGlC.exe
  C:\Windows\System\HyduGlC.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\botBBvi.exe
  C:\Windows\System\botBBvi.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\TyNeCmT.exe
  C:\Windows\System\TyNeCmT.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\wLgnWTv.exe
  C:\Windows\System\wLgnWTv.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\TQShEAd.exe
  C:\Windows\System\TQShEAd.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\HMXLnzR.exe
  C:\Windows\System\HMXLnzR.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\kBWMtBf.exe
  C:\Windows\System\kBWMtBf.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\dNLjmgw.exe
  C:\Windows\System\dNLjmgw.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\jrETEyV.exe
  C:\Windows\System\jrETEyV.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\syCSPKN.exe
  C:\Windows\System\syCSPKN.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\ukztHqB.exe
  C:\Windows\System\ukztHqB.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\NQUcJBu.exe
  C:\Windows\System\NQUcJBu.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\bSueSvC.exe
  C:\Windows\System\bSueSvC.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\zCzaCKB.exe
  C:\Windows\System\zCzaCKB.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\OUjlxQo.exe
  C:\Windows\System\OUjlxQo.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\QgCkrWf.exe
  C:\Windows\System\QgCkrWf.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tXyAgFo.exe
  C:\Windows\System\tXyAgFo.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\HhkboCC.exe
  C:\Windows\System\HhkboCC.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\xwmzRtP.exe
  C:\Windows\System\xwmzRtP.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\qbVpipC.exe
  C:\Windows\System\qbVpipC.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\CroFcqX.exe
  C:\Windows\System\CroFcqX.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\PiifhtQ.exe
  C:\Windows\System\PiifhtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\YuewUbN.exe
  C:\Windows\System\YuewUbN.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\FcNtEAl.exe
  C:\Windows\System\FcNtEAl.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\zStKyWd.exe
  C:\Windows\System\zStKyWd.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\kOvNhnv.exe
  C:\Windows\System\kOvNhnv.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\zxOdSlE.exe
  C:\Windows\System\zxOdSlE.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\CEHmgeC.exe
  C:\Windows\System\CEHmgeC.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\DXvTYGd.exe
  C:\Windows\System\DXvTYGd.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\jwvMzaX.exe
  C:\Windows\System\jwvMzaX.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\yEmdXKt.exe
  C:\Windows\System\yEmdXKt.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\YQOdGbf.exe
  C:\Windows\System\YQOdGbf.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\orykxBS.exe
  C:\Windows\System\orykxBS.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\MVUinnk.exe
  C:\Windows\System\MVUinnk.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\pXpwblz.exe
  C:\Windows\System\pXpwblz.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\YTuXllb.exe
  C:\Windows\System\YTuXllb.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\rVePHhX.exe
  C:\Windows\System\rVePHhX.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\lmgnIkk.exe
  C:\Windows\System\lmgnIkk.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\mnFsLxW.exe
  C:\Windows\System\mnFsLxW.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\qWwOfhE.exe
  C:\Windows\System\qWwOfhE.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\RGftgEk.exe
  C:\Windows\System\RGftgEk.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\BpEvMCJ.exe
  C:\Windows\System\BpEvMCJ.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\XfPdiwz.exe
  C:\Windows\System\XfPdiwz.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\UrdNIME.exe
  C:\Windows\System\UrdNIME.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\amsUtgx.exe
  C:\Windows\System\amsUtgx.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\wwVTDHt.exe
  C:\Windows\System\wwVTDHt.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\XHKAscN.exe
  C:\Windows\System\XHKAscN.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\PmVAIRI.exe
  C:\Windows\System\PmVAIRI.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\wkikRiF.exe
  C:\Windows\System\wkikRiF.exe
  2⤵
  PID:984
- C:\Windows\System\WysvQhS.exe
  C:\Windows\System\WysvQhS.exe
  2⤵
  PID:4584
- C:\Windows\System\wgGDgCs.exe
  C:\Windows\System\wgGDgCs.exe
  2⤵
  PID:4528
- C:\Windows\System\LIgJHGx.exe
  C:\Windows\System\LIgJHGx.exe
  2⤵
  PID:3044
- C:\Windows\System\WvimbVx.exe
  C:\Windows\System\WvimbVx.exe
  2⤵
  PID:4032
- C:\Windows\System\ewSdhST.exe
  C:\Windows\System\ewSdhST.exe
  2⤵
  PID:3620
- C:\Windows\System\ZsnUaMC.exe
  C:\Windows\System\ZsnUaMC.exe
  2⤵
  PID:3188
- C:\Windows\System\LLQtCBN.exe
  C:\Windows\System\LLQtCBN.exe
  2⤵
  PID:1644
- C:\Windows\System\ckrwofJ.exe
  C:\Windows\System\ckrwofJ.exe
  2⤵
  PID:3896
- C:\Windows\System\kPSEZQq.exe
  C:\Windows\System\kPSEZQq.exe
  2⤵
  PID:1472
- C:\Windows\System\FpRZvzn.exe
  C:\Windows\System\FpRZvzn.exe
  2⤵
  PID:5144
- C:\Windows\System\GcHNIaX.exe
  C:\Windows\System\GcHNIaX.exe
  2⤵
  PID:5172
- C:\Windows\System\obmIHvX.exe
  C:\Windows\System\obmIHvX.exe
  2⤵
  PID:5204
- C:\Windows\System\eaCLerK.exe
  C:\Windows\System\eaCLerK.exe
  2⤵
  PID:5236
- C:\Windows\System\wWCoGEJ.exe
  C:\Windows\System\wWCoGEJ.exe
  2⤵
  PID:5260
- C:\Windows\System\OThaOSG.exe
  C:\Windows\System\OThaOSG.exe
  2⤵
  PID:5284
- C:\Windows\System\nNNfSjR.exe
  C:\Windows\System\nNNfSjR.exe
  2⤵
  PID:5312
- C:\Windows\System\WrKavjE.exe
  C:\Windows\System\WrKavjE.exe
  2⤵
  PID:5344
- C:\Windows\System\NGAhLYl.exe
  C:\Windows\System\NGAhLYl.exe
  2⤵
  PID:5376
- C:\Windows\System\tblnbrk.exe
  C:\Windows\System\tblnbrk.exe
  2⤵
  PID:5404
- C:\Windows\System\IOTcrsh.exe
  C:\Windows\System\IOTcrsh.exe
  2⤵
  PID:5440
- C:\Windows\System\AKHLgOQ.exe
  C:\Windows\System\AKHLgOQ.exe
  2⤵
  PID:5468
- C:\Windows\System\cWzQXYT.exe
  C:\Windows\System\cWzQXYT.exe
  2⤵
  PID:5492
- C:\Windows\System\PCIjhiX.exe
  C:\Windows\System\PCIjhiX.exe
  2⤵
  PID:5520
- C:\Windows\System\CssYKZi.exe
  C:\Windows\System\CssYKZi.exe
  2⤵
  PID:5548
- C:\Windows\System\dpFoUqT.exe
  C:\Windows\System\dpFoUqT.exe
  2⤵
  PID:5576
- C:\Windows\System\WaskSBq.exe
  C:\Windows\System\WaskSBq.exe
  2⤵
  PID:5608
- C:\Windows\System\kLlWgrs.exe
  C:\Windows\System\kLlWgrs.exe
  2⤵
  PID:5636
- C:\Windows\System\PTBJAhb.exe
  C:\Windows\System\PTBJAhb.exe
  2⤵
  PID:5664
- C:\Windows\System\xRuuchl.exe
  C:\Windows\System\xRuuchl.exe
  2⤵
  PID:5688
- C:\Windows\System\EnECyze.exe
  C:\Windows\System\EnECyze.exe
  2⤵
  PID:5716
- C:\Windows\System\yyHYSYg.exe
  C:\Windows\System\yyHYSYg.exe
  2⤵
  PID:5744
- C:\Windows\System\EOwaWBt.exe
  C:\Windows\System\EOwaWBt.exe
  2⤵
  PID:5772
- C:\Windows\System\amEoymv.exe
  C:\Windows\System\amEoymv.exe
  2⤵
  PID:5804
- C:\Windows\System\UfdtcdZ.exe
  C:\Windows\System\UfdtcdZ.exe
  2⤵
  PID:5832
- C:\Windows\System\UkOwptn.exe
  C:\Windows\System\UkOwptn.exe
  2⤵
  PID:5860
- C:\Windows\System\deezeQZ.exe
  C:\Windows\System\deezeQZ.exe
  2⤵
  PID:5884
- C:\Windows\System\yvEpaCx.exe
  C:\Windows\System\yvEpaCx.exe
  2⤵
  PID:5912
- C:\Windows\System\EEuarQR.exe
  C:\Windows\System\EEuarQR.exe
  2⤵
  PID:5944
- C:\Windows\System\uvtIvqT.exe
  C:\Windows\System\uvtIvqT.exe
  2⤵
  PID:5972
- C:\Windows\System\CDEGcMW.exe
  C:\Windows\System\CDEGcMW.exe
  2⤵
  PID:5996
- C:\Windows\System\ygqprgR.exe
  C:\Windows\System\ygqprgR.exe
  2⤵
  PID:6024
- C:\Windows\System\jiKlKpJ.exe
  C:\Windows\System\jiKlKpJ.exe
  2⤵
  PID:6056
- C:\Windows\System\QzCSADQ.exe
  C:\Windows\System\QzCSADQ.exe
  2⤵
  PID:6084
- C:\Windows\System\yeBWikt.exe
  C:\Windows\System\yeBWikt.exe
  2⤵
  PID:6112
- C:\Windows\System\tCNeuYu.exe
  C:\Windows\System\tCNeuYu.exe
  2⤵
  PID:6140
- C:\Windows\System\ryWzznW.exe
  C:\Windows\System\ryWzznW.exe
  2⤵
  PID:4896
- C:\Windows\System\IGlxkAb.exe
  C:\Windows\System\IGlxkAb.exe
  2⤵
  PID:876
- C:\Windows\System\orkGttN.exe
  C:\Windows\System\orkGttN.exe
  2⤵
  PID:4948
- C:\Windows\System\viUJXeu.exe
  C:\Windows\System\viUJXeu.exe
  2⤵
  PID:2856
- C:\Windows\System\bdoVOdc.exe
  C:\Windows\System\bdoVOdc.exe
  2⤵
  PID:5160
- C:\Windows\System\ZoJcbuv.exe
  C:\Windows\System\ZoJcbuv.exe
  2⤵
  PID:5220
- C:\Windows\System\umgitpd.exe
  C:\Windows\System\umgitpd.exe
  2⤵
  PID:5276
- C:\Windows\System\NJeQCJW.exe
  C:\Windows\System\NJeQCJW.exe
  2⤵
  PID:5360
- C:\Windows\System\XLOMMOP.exe
  C:\Windows\System\XLOMMOP.exe
  2⤵
  PID:5424
- C:\Windows\System\pREAARX.exe
  C:\Windows\System\pREAARX.exe
  2⤵
  PID:5484
- C:\Windows\System\mlnxAra.exe
  C:\Windows\System\mlnxAra.exe
  2⤵
  PID:5540
- C:\Windows\System\BckmVOB.exe
  C:\Windows\System\BckmVOB.exe
  2⤵
  PID:5620
- C:\Windows\System\KQFUZQe.exe
  C:\Windows\System\KQFUZQe.exe
  2⤵
  PID:5680
- C:\Windows\System\ZYtCJSI.exe
  C:\Windows\System\ZYtCJSI.exe
  2⤵
  PID:5740
- C:\Windows\System\btDReJi.exe
  C:\Windows\System\btDReJi.exe
  2⤵
  PID:5816
- C:\Windows\System\oNEGxiD.exe
  C:\Windows\System\oNEGxiD.exe
  2⤵
  PID:5872
- C:\Windows\System\lfamRpz.exe
  C:\Windows\System\lfamRpz.exe
  2⤵
  PID:5928
- C:\Windows\System\szDJXnX.exe
  C:\Windows\System\szDJXnX.exe
  2⤵
  PID:5992
- C:\Windows\System\vYWXQwC.exe
  C:\Windows\System\vYWXQwC.exe
  2⤵
  PID:6048
- C:\Windows\System\hQHitof.exe
  C:\Windows\System\hQHitof.exe
  2⤵
  PID:6104
- C:\Windows\System\sVFDRtr.exe
  C:\Windows\System\sVFDRtr.exe
  2⤵
  PID:4664
- C:\Windows\System\NODKLvJ.exe
  C:\Windows\System\NODKLvJ.exe
  2⤵
  PID:3540
- C:\Windows\System\AqBcNQh.exe
  C:\Windows\System\AqBcNQh.exe
  2⤵
  PID:3080
- C:\Windows\System\GGajLdn.exe
  C:\Windows\System\GGajLdn.exe
  2⤵
  PID:5332
- C:\Windows\System\eYAKnBW.exe
  C:\Windows\System\eYAKnBW.exe
  2⤵
  PID:5460
- C:\Windows\System\xkPDfCr.exe
  C:\Windows\System\xkPDfCr.exe
  2⤵
  PID:5596
- C:\Windows\System\ofuPBQL.exe
  C:\Windows\System\ofuPBQL.exe
  2⤵
  PID:5768
- C:\Windows\System\RRCojeC.exe
  C:\Windows\System\RRCojeC.exe
  2⤵
  PID:5900
- C:\Windows\System\YtulqsW.exe
  C:\Windows\System\YtulqsW.exe
  2⤵
  PID:6040
- C:\Windows\System\WSjxCOj.exe
  C:\Windows\System\WSjxCOj.exe
  2⤵
  PID:1160
- C:\Windows\System\IHXdXjL.exe
  C:\Windows\System\IHXdXjL.exe
  2⤵
  PID:5196
- C:\Windows\System\NbYsQVb.exe
  C:\Windows\System\NbYsQVb.exe
  2⤵
  PID:5516
- C:\Windows\System\gxzLveY.exe
  C:\Windows\System\gxzLveY.exe
  2⤵
  PID:5844
- C:\Windows\System\hthSUbc.exe
  C:\Windows\System\hthSUbc.exe
  2⤵
  PID:3848
- C:\Windows\System\TyFKPdD.exe
  C:\Windows\System\TyFKPdD.exe
  2⤵
  PID:6164
- C:\Windows\System\XRdbFcm.exe
  C:\Windows\System\XRdbFcm.exe
  2⤵
  PID:6192
- C:\Windows\System\sxJJviS.exe
  C:\Windows\System\sxJJviS.exe
  2⤵
  PID:6504
- C:\Windows\System\GceBVOc.exe
  C:\Windows\System\GceBVOc.exe
  2⤵
  PID:6564
- C:\Windows\System\mrOaCsW.exe
  C:\Windows\System\mrOaCsW.exe
  2⤵
  PID:6592
- C:\Windows\System\kxXZnxK.exe
  C:\Windows\System\kxXZnxK.exe
  2⤵
  PID:6620
- C:\Windows\System\rZGGnZZ.exe
  C:\Windows\System\rZGGnZZ.exe
  2⤵
  PID:6652
- C:\Windows\System\DfkSIqv.exe
  C:\Windows\System\DfkSIqv.exe
  2⤵
  PID:6676
- C:\Windows\System\EGUcynS.exe
  C:\Windows\System\EGUcynS.exe
  2⤵
  PID:6708
- C:\Windows\System\UAGfJXC.exe
  C:\Windows\System\UAGfJXC.exe
  2⤵
  PID:6736
- C:\Windows\System\TfHCxln.exe
  C:\Windows\System\TfHCxln.exe
  2⤵
  PID:6760
- C:\Windows\System\eXqOoEp.exe
  C:\Windows\System\eXqOoEp.exe
  2⤵
  PID:6780
- C:\Windows\System\ovngigc.exe
  C:\Windows\System\ovngigc.exe
  2⤵
  PID:6820
- C:\Windows\System\SoZHxkj.exe
  C:\Windows\System\SoZHxkj.exe
  2⤵
  PID:6848
- C:\Windows\System\VjGpsFT.exe
  C:\Windows\System\VjGpsFT.exe
  2⤵
  PID:6876
- C:\Windows\System\SquJVOZ.exe
  C:\Windows\System\SquJVOZ.exe
  2⤵
  PID:6892
- C:\Windows\System\TiXHHVe.exe
  C:\Windows\System\TiXHHVe.exe
  2⤵
  PID:6908
- C:\Windows\System\WBuVgTA.exe
  C:\Windows\System\WBuVgTA.exe
  2⤵
  PID:6952
- C:\Windows\System\hmsiHyQ.exe
  C:\Windows\System\hmsiHyQ.exe
  2⤵
  PID:6972
- C:\Windows\System\GjsmRcH.exe
  C:\Windows\System\GjsmRcH.exe
  2⤵
  PID:7016
- C:\Windows\System\qcHdQkI.exe
  C:\Windows\System\qcHdQkI.exe
  2⤵
  PID:7036
- C:\Windows\System\ZFjQoTV.exe
  C:\Windows\System\ZFjQoTV.exe
  2⤵
  PID:7072
- C:\Windows\System\DYnfrYT.exe
  C:\Windows\System\DYnfrYT.exe
  2⤵
  PID:7116
- C:\Windows\System\maPgyCi.exe
  C:\Windows\System\maPgyCi.exe
  2⤵
  PID:7144
- C:\Windows\System\UFgoYdl.exe
  C:\Windows\System\UFgoYdl.exe
  2⤵
  PID:7164
- C:\Windows\System\BZDllug.exe
  C:\Windows\System\BZDllug.exe
  2⤵
  PID:5708
- C:\Windows\System\YeVwOrT.exe
  C:\Windows\System\YeVwOrT.exe
  2⤵
  PID:1624
- C:\Windows\System\nPrBxrE.exe
  C:\Windows\System\nPrBxrE.exe
  2⤵
  PID:6228
- C:\Windows\System\XUaVUQq.exe
  C:\Windows\System\XUaVUQq.exe
  2⤵
  PID:6256
- C:\Windows\System\CezynhQ.exe
  C:\Windows\System\CezynhQ.exe
  2⤵
  PID:6292
- C:\Windows\System\XqKYhbZ.exe
  C:\Windows\System\XqKYhbZ.exe
  2⤵
  PID:6324
- C:\Windows\System\uIitGKi.exe
  C:\Windows\System\uIitGKi.exe
  2⤵
  PID:6364
- C:\Windows\System\MwPePxG.exe
  C:\Windows\System\MwPePxG.exe
  2⤵
  PID:6388
- C:\Windows\System\BhHdPCo.exe
  C:\Windows\System\BhHdPCo.exe
  2⤵
  PID:6420
- C:\Windows\System\LtZrQXn.exe
  C:\Windows\System\LtZrQXn.exe
  2⤵
  PID:6472
- C:\Windows\System\ViNPKfO.exe
  C:\Windows\System\ViNPKfO.exe
  2⤵
  PID:4876
- C:\Windows\System\QPhxwCk.exe
  C:\Windows\System\QPhxwCk.exe
  2⤵
  PID:4080
- C:\Windows\System\FMtPidz.exe
  C:\Windows\System\FMtPidz.exe
  2⤵
  PID:5116
- C:\Windows\System\MldVrvH.exe
  C:\Windows\System\MldVrvH.exe
  2⤵
  PID:3484
- C:\Windows\System\FDIpALf.exe
  C:\Windows\System\FDIpALf.exe
  2⤵
  PID:6576
- C:\Windows\System\JKfQmBQ.exe
  C:\Windows\System\JKfQmBQ.exe
  2⤵
  PID:3652
- C:\Windows\System\faHxiIi.exe
  C:\Windows\System\faHxiIi.exe
  2⤵
  PID:6632
- C:\Windows\System\OlerbNC.exe
  C:\Windows\System\OlerbNC.exe
  2⤵
  PID:6692
- C:\Windows\System\xLDCRHe.exe
  C:\Windows\System\xLDCRHe.exe
  2⤵
  PID:6752
- C:\Windows\System\RrAulqI.exe
  C:\Windows\System\RrAulqI.exe
  2⤵
  PID:6840
- C:\Windows\System\HjoXwHO.exe
  C:\Windows\System\HjoXwHO.exe
  2⤵
  PID:6900
- C:\Windows\System\SfCSEcK.exe
  C:\Windows\System\SfCSEcK.exe
  2⤵
  PID:6944
- C:\Windows\System\bTAmiGv.exe
  C:\Windows\System\bTAmiGv.exe
  2⤵
  PID:7100
- C:\Windows\System\WorhaJK.exe
  C:\Windows\System\WorhaJK.exe
  2⤵
  PID:7160
- C:\Windows\System\ydsVsIF.exe
  C:\Windows\System\ydsVsIF.exe
  2⤵
  PID:3608
- C:\Windows\System\uqqOlcK.exe
  C:\Windows\System\uqqOlcK.exe
  2⤵
  PID:6156
- C:\Windows\System\aBwlUUt.exe
  C:\Windows\System\aBwlUUt.exe
  2⤵
  PID:6284
- C:\Windows\System\YDIhOJS.exe
  C:\Windows\System\YDIhOJS.exe
  2⤵
  PID:6352
- C:\Windows\System\YlLUGDL.exe
  C:\Windows\System\YlLUGDL.exe
  2⤵
  PID:6404
- C:\Windows\System\fexyOZq.exe
  C:\Windows\System\fexyOZq.exe
  2⤵
  PID:6536
- C:\Windows\System\tkdUfsf.exe
  C:\Windows\System\tkdUfsf.exe
  2⤵
  PID:1056
- C:\Windows\System\ckNgcVI.exe
  C:\Windows\System\ckNgcVI.exe
  2⤵
  PID:6612
- C:\Windows\System\DCUUttf.exe
  C:\Windows\System\DCUUttf.exe
  2⤵
  PID:6552
- C:\Windows\System\EErcaGT.exe
  C:\Windows\System\EErcaGT.exe
  2⤵
  PID:6316
- C:\Windows\System\OJQfCKZ.exe
  C:\Windows\System\OJQfCKZ.exe
  2⤵
  PID:6860
- C:\Windows\System\iTXSudY.exe
  C:\Windows\System\iTXSudY.exe
  2⤵
  PID:7132
- C:\Windows\System\kunssVK.exe
  C:\Windows\System\kunssVK.exe
  2⤵
  PID:1856
- C:\Windows\System\UFWRdEb.exe
  C:\Windows\System\UFWRdEb.exe
  2⤵
  PID:6340
- C:\Windows\System\WqLumGS.exe
  C:\Windows\System\WqLumGS.exe
  2⤵
  PID:688
- C:\Windows\System\PoajdZb.exe
  C:\Windows\System\PoajdZb.exe
  2⤵
  PID:1988
- C:\Windows\System\dyfNjmp.exe
  C:\Windows\System\dyfNjmp.exe
  2⤵
  PID:6756
- C:\Windows\System\RPqQYeV.exe
  C:\Windows\System\RPqQYeV.exe
  2⤵
  PID:6700
- C:\Windows\System\OGFuaJy.exe
  C:\Windows\System\OGFuaJy.exe
  2⤵
  PID:6452
- C:\Windows\System\OHwJQKD.exe
  C:\Windows\System\OHwJQKD.exe
  2⤵
  PID:6464
- C:\Windows\System\IZgGYfm.exe
  C:\Windows\System\IZgGYfm.exe
  2⤵
  PID:6524
- C:\Windows\System\CRoHcOO.exe
  C:\Windows\System\CRoHcOO.exe
  2⤵
  PID:5656
- C:\Windows\System\YqDmKGA.exe
  C:\Windows\System\YqDmKGA.exe
  2⤵
  PID:6460
- C:\Windows\System\aVxeDEg.exe
  C:\Windows\System\aVxeDEg.exe
  2⤵
  PID:7184
- C:\Windows\System\VSayONx.exe
  C:\Windows\System\VSayONx.exe
  2⤵
  PID:7212
- C:\Windows\System\GvdBTDe.exe
  C:\Windows\System\GvdBTDe.exe
  2⤵
  PID:7264
- C:\Windows\System\YsQBjVg.exe
  C:\Windows\System\YsQBjVg.exe
  2⤵
  PID:7304
- C:\Windows\System\QvffLMq.exe
  C:\Windows\System\QvffLMq.exe
  2⤵
  PID:7332
- C:\Windows\System\bltbrNA.exe
  C:\Windows\System\bltbrNA.exe
  2⤵
  PID:7348
- C:\Windows\System\WUxtkOK.exe
  C:\Windows\System\WUxtkOK.exe
  2⤵
  PID:7400
- C:\Windows\System\TOYOfeH.exe
  C:\Windows\System\TOYOfeH.exe
  2⤵
  PID:7440
- C:\Windows\System\pTWGJnd.exe
  C:\Windows\System\pTWGJnd.exe
  2⤵
  PID:7492
- C:\Windows\System\vgWfCyu.exe
  C:\Windows\System\vgWfCyu.exe
  2⤵
  PID:7520
- C:\Windows\System\DohXtYg.exe
  C:\Windows\System\DohXtYg.exe
  2⤵
  PID:7572
- C:\Windows\System\XvuaLGC.exe
  C:\Windows\System\XvuaLGC.exe
  2⤵
  PID:7592
- C:\Windows\System\dBLeZZU.exe
  C:\Windows\System\dBLeZZU.exe
  2⤵
  PID:7636
- C:\Windows\System\odqawmA.exe
  C:\Windows\System\odqawmA.exe
  2⤵
  PID:7672
- C:\Windows\System\GEpaofb.exe
  C:\Windows\System\GEpaofb.exe
  2⤵
  PID:7720
- C:\Windows\System\anlwsqV.exe
  C:\Windows\System\anlwsqV.exe
  2⤵
  PID:7760
- C:\Windows\System\JhwwFpL.exe
  C:\Windows\System\JhwwFpL.exe
  2⤵
  PID:7812
- C:\Windows\System\maLRTiX.exe
  C:\Windows\System\maLRTiX.exe
  2⤵
  PID:7844
- C:\Windows\System\sRnoZKh.exe
  C:\Windows\System\sRnoZKh.exe
  2⤵
  PID:7900
- C:\Windows\System\RpPGzrX.exe
  C:\Windows\System\RpPGzrX.exe
  2⤵
  PID:7928
- C:\Windows\System\ypZAFkL.exe
  C:\Windows\System\ypZAFkL.exe
  2⤵
  PID:7980
- C:\Windows\System\PDzQSdF.exe
  C:\Windows\System\PDzQSdF.exe
  2⤵
  PID:8024
- C:\Windows\System\PGjygeW.exe
  C:\Windows\System\PGjygeW.exe
  2⤵
  PID:8048
- C:\Windows\System\SYyxXpP.exe
  C:\Windows\System\SYyxXpP.exe
  2⤵
  PID:8092
- C:\Windows\System\DqOZanK.exe
  C:\Windows\System\DqOZanK.exe
  2⤵
  PID:8152
- C:\Windows\System\vEtIiqc.exe
  C:\Windows\System\vEtIiqc.exe
  2⤵
  PID:5324
- C:\Windows\System\NFkEyhZ.exe
  C:\Windows\System\NFkEyhZ.exe
  2⤵
  PID:7252
- C:\Windows\System\hJGFInj.exe
  C:\Windows\System\hJGFInj.exe
  2⤵
  PID:7280
- C:\Windows\System\LfAgWso.exe
  C:\Windows\System\LfAgWso.exe
  2⤵
  PID:1516
- C:\Windows\System\tpoZMVy.exe
  C:\Windows\System\tpoZMVy.exe
  2⤵
  PID:7432
- C:\Windows\System\RPEYnjp.exe
  C:\Windows\System\RPEYnjp.exe
  2⤵
  PID:7464
- C:\Windows\System\TcGHleE.exe
  C:\Windows\System\TcGHleE.exe
  2⤵
  PID:7548
- C:\Windows\System\NUgdWyb.exe
  C:\Windows\System\NUgdWyb.exe
  2⤵
  PID:7628
- C:\Windows\System\GLgkGjk.exe
  C:\Windows\System\GLgkGjk.exe
  2⤵
  PID:7692
- C:\Windows\System\HJdxFXr.exe
  C:\Windows\System\HJdxFXr.exe
  2⤵
  PID:7740
- C:\Windows\System\lTNXCLX.exe
  C:\Windows\System\lTNXCLX.exe
  2⤵
  PID:7832
- C:\Windows\System\JAsvMRH.exe
  C:\Windows\System\JAsvMRH.exe
  2⤵
  PID:7948
- C:\Windows\System\ieAiRsB.exe
  C:\Windows\System\ieAiRsB.exe
  2⤵
  PID:7972
- C:\Windows\System\LdjoErZ.exe
  C:\Windows\System\LdjoErZ.exe
  2⤵
  PID:8012
- C:\Windows\System\TrbLxfv.exe
  C:\Windows\System\TrbLxfv.exe
  2⤵
  PID:8072
- C:\Windows\System\IWpdQdI.exe
  C:\Windows\System\IWpdQdI.exe
  2⤵
  PID:8124
- C:\Windows\System\MaMJclD.exe
  C:\Windows\System\MaMJclD.exe
  2⤵
  PID:7192
- C:\Windows\System\xxHmBpG.exe
  C:\Windows\System\xxHmBpG.exe
  2⤵
  PID:7260
- C:\Windows\System\LdwWiIv.exe
  C:\Windows\System\LdwWiIv.exe
  2⤵
  PID:7388
- C:\Windows\System\tkhLfOY.exe
  C:\Windows\System\tkhLfOY.exe
  2⤵
  PID:7504
- C:\Windows\System\vRoznst.exe
  C:\Windows\System\vRoznst.exe
  2⤵
  PID:7604
- C:\Windows\System\HhjoGUQ.exe
  C:\Windows\System\HhjoGUQ.exe
  2⤵
  PID:7800
- C:\Windows\System\GzuWsku.exe
  C:\Windows\System\GzuWsku.exe
  2⤵
  PID:7860
- C:\Windows\System\cuaIoof.exe
  C:\Windows\System\cuaIoof.exe
  2⤵
  PID:7888
- C:\Windows\System\LqOcCNN.exe
  C:\Windows\System\LqOcCNN.exe
  2⤵
  PID:8008
- C:\Windows\System\mTGIddX.exe
  C:\Windows\System\mTGIddX.exe
  2⤵
  PID:8108
- C:\Windows\System\adNTgJN.exe
  C:\Windows\System\adNTgJN.exe
  2⤵
  PID:7232
- C:\Windows\System\hyqfNcC.exe
  C:\Windows\System\hyqfNcC.exe
  2⤵
  PID:7476
- C:\Windows\System\nBuBxdA.exe
  C:\Windows\System\nBuBxdA.exe
  2⤵
  PID:7540
- C:\Windows\System\kuhwNkc.exe
  C:\Windows\System\kuhwNkc.exe
  2⤵
  PID:7748
- C:\Windows\System\IypSzGV.exe
  C:\Windows\System\IypSzGV.exe
  2⤵
  PID:7876
- C:\Windows\System\mvQjuFi.exe
  C:\Windows\System\mvQjuFi.exe
  2⤵
  PID:8140
- C:\Windows\System\BGoeRuE.exe
  C:\Windows\System\BGoeRuE.exe
  2⤵
  PID:7344
- C:\Windows\System\PstcvPc.exe
  C:\Windows\System\PstcvPc.exe
  2⤵
  PID:7808
- C:\Windows\System\aWcMkDW.exe
  C:\Windows\System\aWcMkDW.exe
  2⤵
  PID:7960
- C:\Windows\System\oyVwmhx.exe
  C:\Windows\System\oyVwmhx.exe
  2⤵
  PID:7564
- C:\Windows\System\jjKkCAA.exe
  C:\Windows\System\jjKkCAA.exe
  2⤵
  PID:7688
- C:\Windows\System\xWoBPFh.exe
  C:\Windows\System\xWoBPFh.exe
  2⤵
  PID:7868
- C:\Windows\System\TdsOIIh.exe
  C:\Windows\System\TdsOIIh.exe
  2⤵
  PID:8136
- C:\Windows\System\bhKitNx.exe
  C:\Windows\System\bhKitNx.exe
  2⤵
  PID:8244
- C:\Windows\System\PPhtKwx.exe
  C:\Windows\System\PPhtKwx.exe
  2⤵
  PID:8268
- C:\Windows\System\eWiIZNx.exe
  C:\Windows\System\eWiIZNx.exe
  2⤵
  PID:8316
- C:\Windows\System\yiCBbpX.exe
  C:\Windows\System\yiCBbpX.exe
  2⤵
  PID:8348
- C:\Windows\System\oBSqoxV.exe
  C:\Windows\System\oBSqoxV.exe
  2⤵
  PID:8392
- C:\Windows\System\sulZKmk.exe
  C:\Windows\System\sulZKmk.exe
  2⤵
  PID:8420
- C:\Windows\System\XPohdDT.exe
  C:\Windows\System\XPohdDT.exe
  2⤵
  PID:8440
- C:\Windows\System\OhJDKzO.exe
  C:\Windows\System\OhJDKzO.exe
  2⤵
  PID:8468
- C:\Windows\System\rZeHAJj.exe
  C:\Windows\System\rZeHAJj.exe
  2⤵
  PID:8488
- C:\Windows\System\SOScvBF.exe
  C:\Windows\System\SOScvBF.exe
  2⤵
  PID:8536
- C:\Windows\System\jNkZekE.exe
  C:\Windows\System\jNkZekE.exe
  2⤵
  PID:8560
- C:\Windows\System\MjBgOQn.exe
  C:\Windows\System\MjBgOQn.exe
  2⤵
  PID:8608
- C:\Windows\System\dFVISPY.exe
  C:\Windows\System\dFVISPY.exe
  2⤵
  PID:8640
- C:\Windows\System\KtKaGFZ.exe
  C:\Windows\System\KtKaGFZ.exe
  2⤵
  PID:8656
- C:\Windows\System\YpUDgiD.exe
  C:\Windows\System\YpUDgiD.exe
  2⤵
  PID:8700
- C:\Windows\System\pUgoiMu.exe
  C:\Windows\System\pUgoiMu.exe
  2⤵
  PID:8732
- C:\Windows\System\zJozUss.exe
  C:\Windows\System\zJozUss.exe
  2⤵
  PID:8760
- C:\Windows\System\tyVdIGT.exe
  C:\Windows\System\tyVdIGT.exe
  2⤵
  PID:8796
- C:\Windows\System\ALbUspc.exe
  C:\Windows\System\ALbUspc.exe
  2⤵
  PID:8828
- C:\Windows\System\GoVpMpV.exe
  C:\Windows\System\GoVpMpV.exe
  2⤵
  PID:8844
- C:\Windows\System\OBqreWZ.exe
  C:\Windows\System\OBqreWZ.exe
  2⤵
  PID:8876
- C:\Windows\System\UJiNeNc.exe
  C:\Windows\System\UJiNeNc.exe
  2⤵
  PID:8904
- C:\Windows\System\zMUTlIz.exe
  C:\Windows\System\zMUTlIz.exe
  2⤵
  PID:8924
- C:\Windows\System\DcsRYNQ.exe
  C:\Windows\System\DcsRYNQ.exe
  2⤵
  PID:8980
- C:\Windows\System\OmapvUw.exe
  C:\Windows\System\OmapvUw.exe
  2⤵
  PID:9004
- C:\Windows\System\wuNzuYH.exe
  C:\Windows\System\wuNzuYH.exe
  2⤵
  PID:9060
- C:\Windows\System\oQbuoVZ.exe
  C:\Windows\System\oQbuoVZ.exe
  2⤵
  PID:9088
- C:\Windows\System\xJDsiHb.exe
  C:\Windows\System\xJDsiHb.exe
  2⤵
  PID:9132
- C:\Windows\System\DNSSUYw.exe
  C:\Windows\System\DNSSUYw.exe
  2⤵
  PID:9172
- C:\Windows\System\IPsIPzM.exe
  C:\Windows\System\IPsIPzM.exe
  2⤵
  PID:9200
- C:\Windows\System\djDuRTm.exe
  C:\Windows\System\djDuRTm.exe
  2⤵
  PID:8236
- C:\Windows\System\vVaBoiJ.exe
  C:\Windows\System\vVaBoiJ.exe
  2⤵
  PID:8304
- C:\Windows\System\UyeEoWa.exe
  C:\Windows\System\UyeEoWa.exe
  2⤵
  PID:8408
- C:\Windows\System\DgUzmme.exe
  C:\Windows\System\DgUzmme.exe
  2⤵
  PID:8476
- C:\Windows\System\mgXgzOk.exe
  C:\Windows\System\mgXgzOk.exe
  2⤵
  PID:8576
- C:\Windows\System\McLXZWr.exe
  C:\Windows\System\McLXZWr.exe
  2⤵
  PID:8624
- C:\Windows\System\ScqwblC.exe
  C:\Windows\System\ScqwblC.exe
  2⤵
  PID:8712
- C:\Windows\System\EGxjXRq.exe
  C:\Windows\System\EGxjXRq.exe
  2⤵
  PID:7380
- C:\Windows\System\XIAkLNe.exe
  C:\Windows\System\XIAkLNe.exe
  2⤵
  PID:8884
- C:\Windows\System\wVRcPco.exe
  C:\Windows\System\wVRcPco.exe
  2⤵
  PID:8896
- C:\Windows\System\KZznpkR.exe
  C:\Windows\System\KZznpkR.exe
  2⤵
  PID:8996
- C:\Windows\System\wVrgfPK.exe
  C:\Windows\System\wVrgfPK.exe
  2⤵
  PID:9128
- C:\Windows\System\VUuJdXz.exe
  C:\Windows\System\VUuJdXz.exe
  2⤵
  PID:9192
- C:\Windows\System\kSSNCXr.exe
  C:\Windows\System\kSSNCXr.exe
  2⤵
  PID:8256
- C:\Windows\System\IHgxkVL.exe
  C:\Windows\System\IHgxkVL.exe
  2⤵
  PID:8448
- C:\Windows\System\RmCsRpV.exe
  C:\Windows\System\RmCsRpV.exe
  2⤵
  PID:8668
- C:\Windows\System\cFuwVqM.exe
  C:\Windows\System\cFuwVqM.exe
  2⤵
  PID:4216
- C:\Windows\System\htNkrIz.exe
  C:\Windows\System\htNkrIz.exe
  2⤵
  PID:9152
- C:\Windows\System\zZXlOTF.exe
  C:\Windows\System\zZXlOTF.exe
  2⤵
  PID:8388
- C:\Windows\System\sVJIfSX.exe
  C:\Windows\System\sVJIfSX.exe
  2⤵
  PID:8892
- C:\Windows\System\OpXkwyJ.exe
  C:\Windows\System\OpXkwyJ.exe
  2⤵
  PID:8752
- C:\Windows\System\lCTlXrs.exe
  C:\Windows\System\lCTlXrs.exe
  2⤵
  PID:9224
- C:\Windows\System\ODjEYks.exe
  C:\Windows\System\ODjEYks.exe
  2⤵
  PID:9268
- C:\Windows\System\xRqRcsh.exe
  C:\Windows\System\xRqRcsh.exe
  2⤵
  PID:9288
- C:\Windows\System\QgMejwH.exe
  C:\Windows\System\QgMejwH.exe
  2⤵
  PID:9328
- C:\Windows\System\suUqgOE.exe
  C:\Windows\System\suUqgOE.exe
  2⤵
  PID:9388
- C:\Windows\System\pfakXck.exe
  C:\Windows\System\pfakXck.exe
  2⤵
  PID:9412
- C:\Windows\System\SWTQiGh.exe
  C:\Windows\System\SWTQiGh.exe
  2⤵
  PID:9440
- C:\Windows\System\gEmHzGs.exe
  C:\Windows\System\gEmHzGs.exe
  2⤵
  PID:9484
- C:\Windows\System\CqjFjvW.exe
  C:\Windows\System\CqjFjvW.exe
  2⤵
  PID:9520
- C:\Windows\System\QRALjtA.exe
  C:\Windows\System\QRALjtA.exe
  2⤵
  PID:9540
- C:\Windows\System\CxwFGkK.exe
  C:\Windows\System\CxwFGkK.exe
  2⤵
  PID:9564
- C:\Windows\System\bUYKggg.exe
  C:\Windows\System\bUYKggg.exe
  2⤵
  PID:9608
- C:\Windows\System\HfEqCiy.exe
  C:\Windows\System\HfEqCiy.exe
  2⤵
  PID:9664
- C:\Windows\System\QPQYuNV.exe
  C:\Windows\System\QPQYuNV.exe
  2⤵
  PID:9680
- C:\Windows\System\HTepGFO.exe
  C:\Windows\System\HTepGFO.exe
  2⤵
  PID:9712
- C:\Windows\System\IBpHPVM.exe
  C:\Windows\System\IBpHPVM.exe
  2⤵
  PID:9736
- C:\Windows\System\beloEko.exe
  C:\Windows\System\beloEko.exe
  2⤵
  PID:9768
- C:\Windows\System\XDIhJjZ.exe
  C:\Windows\System\XDIhJjZ.exe
  2⤵
  PID:9808
- C:\Windows\System\QdrBMxq.exe
  C:\Windows\System\QdrBMxq.exe
  2⤵
  PID:9836
- C:\Windows\System\PaoCEyA.exe
  C:\Windows\System\PaoCEyA.exe
  2⤵
  PID:9852
- C:\Windows\System\ubElTJO.exe
  C:\Windows\System\ubElTJO.exe
  2⤵
  PID:9892
- C:\Windows\System\BpHOCJb.exe
  C:\Windows\System\BpHOCJb.exe
  2⤵
  PID:9908
- C:\Windows\System\fboCkaI.exe
  C:\Windows\System\fboCkaI.exe
  2⤵
  PID:9948
- C:\Windows\System\kVrvwEd.exe
  C:\Windows\System\kVrvwEd.exe
  2⤵
  PID:9968
- C:\Windows\System\kRhUDwD.exe
  C:\Windows\System\kRhUDwD.exe
  2⤵
  PID:10000
- C:\Windows\System\LEOKOjF.exe
  C:\Windows\System\LEOKOjF.exe
  2⤵
  PID:10024
- C:\Windows\System\kzCchrB.exe
  C:\Windows\System\kzCchrB.exe
  2⤵
  PID:10060
- C:\Windows\System\iQrCNzE.exe
  C:\Windows\System\iQrCNzE.exe
  2⤵
  PID:10092
- C:\Windows\System\crjknri.exe
  C:\Windows\System\crjknri.exe
  2⤵
  PID:10112
- C:\Windows\System\UfOjxaP.exe
  C:\Windows\System\UfOjxaP.exe
  2⤵
  PID:10148
- C:\Windows\System\hxuRAAw.exe
  C:\Windows\System\hxuRAAw.exe
  2⤵
  PID:10176
- C:\Windows\System\PYOUbaY.exe
  C:\Windows\System\PYOUbaY.exe
  2⤵
  PID:10196
- C:\Windows\System\grneOLi.exe
  C:\Windows\System\grneOLi.exe
  2⤵
  PID:10232
- C:\Windows\System\fUfGDoU.exe
  C:\Windows\System\fUfGDoU.exe
  2⤵
  PID:8820
- C:\Windows\System\gMeYnrm.exe
  C:\Windows\System\gMeYnrm.exe
  2⤵
  PID:8556
- C:\Windows\System\GfidjxK.exe
  C:\Windows\System\GfidjxK.exe
  2⤵
  PID:9300
- C:\Windows\System\iXpBJat.exe
  C:\Windows\System\iXpBJat.exe
  2⤵
  PID:9420
- C:\Windows\System\VCXgmNR.exe
  C:\Windows\System\VCXgmNR.exe
  2⤵
  PID:9528
- C:\Windows\System\WLTTAnQ.exe
  C:\Windows\System\WLTTAnQ.exe
  2⤵
  PID:9592
- C:\Windows\System\RyUEByZ.exe
  C:\Windows\System\RyUEByZ.exe
  2⤵
  PID:9672
- C:\Windows\System\RSJaXha.exe
  C:\Windows\System\RSJaXha.exe
  2⤵
  PID:9720
- C:\Windows\System\pUiudIl.exe
  C:\Windows\System\pUiudIl.exe
  2⤵
  PID:9824
- C:\Windows\System\XSFuvpd.exe
  C:\Windows\System\XSFuvpd.exe
  2⤵
  PID:9900
- C:\Windows\System\JrciIlC.exe
  C:\Windows\System\JrciIlC.exe
  2⤵
  PID:9980
- C:\Windows\System\wchXEXv.exe
  C:\Windows\System\wchXEXv.exe
  2⤵
  PID:9996
- C:\Windows\System\DilBHdn.exe
  C:\Windows\System\DilBHdn.exe
  2⤵
  PID:10100
- C:\Windows\System\arbuJHx.exe
  C:\Windows\System\arbuJHx.exe
  2⤵
  PID:10144
- C:\Windows\System\DKXrBCG.exe
  C:\Windows\System\DKXrBCG.exe
  2⤵
  PID:8936
- C:\Windows\System\rCvglNd.exe
  C:\Windows\System\rCvglNd.exe
  2⤵
  PID:9276
- C:\Windows\System\tbAKWVK.exe
  C:\Windows\System\tbAKWVK.exe
  2⤵
  PID:9372
- C:\Windows\System\CPqOHUq.exe
  C:\Windows\System\CPqOHUq.exe
  2⤵
  PID:9560
- C:\Windows\System\DsmqHWB.exe
  C:\Windows\System\DsmqHWB.exe
  2⤵
  PID:9704
- C:\Windows\System\MnKNgrq.exe
  C:\Windows\System\MnKNgrq.exe
  2⤵
  PID:9932
- C:\Windows\System\sVWTzWN.exe
  C:\Windows\System\sVWTzWN.exe
  2⤵
  PID:10076
- C:\Windows\System\mkkcyue.exe
  C:\Windows\System\mkkcyue.exe
  2⤵
  PID:10216
- C:\Windows\System\gdnlUGg.exe
  C:\Windows\System\gdnlUGg.exe
  2⤵
  PID:9516
- C:\Windows\System\ElUmYlb.exe
  C:\Windows\System\ElUmYlb.exe
  2⤵
  PID:9752
- C:\Windows\System\sGSjAlu.exe
  C:\Windows\System\sGSjAlu.exe
  2⤵
  PID:10220
- C:\Windows\System\jQBLFoJ.exe
  C:\Windows\System\jQBLFoJ.exe
  2⤵
  PID:9396
- C:\Windows\System\LSiGsHX.exe
  C:\Windows\System\LSiGsHX.exe
  2⤵
  PID:10244
- C:\Windows\System\SqTuzZs.exe
  C:\Windows\System\SqTuzZs.exe
  2⤵
  PID:10272
- C:\Windows\System\JekdGFS.exe
  C:\Windows\System\JekdGFS.exe
  2⤵
  PID:10292
- C:\Windows\System\rsAgTsq.exe
  C:\Windows\System\rsAgTsq.exe
  2⤵
  PID:10332
- C:\Windows\System\PJrwmrz.exe
  C:\Windows\System\PJrwmrz.exe
  2⤵
  PID:10348
- C:\Windows\System\MApZopm.exe
  C:\Windows\System\MApZopm.exe
  2⤵
  PID:10372
- C:\Windows\System\BQvCvtj.exe
  C:\Windows\System\BQvCvtj.exe
  2⤵
  PID:10396
- C:\Windows\System\zvbaoCc.exe
  C:\Windows\System\zvbaoCc.exe
  2⤵
  PID:10420
- C:\Windows\System\TMFBaje.exe
  C:\Windows\System\TMFBaje.exe
  2⤵
  PID:10472
- C:\Windows\System\OYLiUYg.exe
  C:\Windows\System\OYLiUYg.exe
  2⤵
  PID:10492
- C:\Windows\System\nUdUDyI.exe
  C:\Windows\System\nUdUDyI.exe
  2⤵
  PID:10520
- C:\Windows\System\RUdNSkN.exe
  C:\Windows\System\RUdNSkN.exe
  2⤵
  PID:10548
- C:\Windows\System\tQXjelE.exe
  C:\Windows\System\tQXjelE.exe
  2⤵
  PID:10576
- C:\Windows\System\pQQcJXr.exe
  C:\Windows\System\pQQcJXr.exe
  2⤵
  PID:10616
- C:\Windows\System\pyOGAST.exe
  C:\Windows\System\pyOGAST.exe
  2⤵
  PID:10644
- C:\Windows\System\lFbbTDa.exe
  C:\Windows\System\lFbbTDa.exe
  2⤵
  PID:10672
- C:\Windows\System\VggFiup.exe
  C:\Windows\System\VggFiup.exe
  2⤵
  PID:10700
- C:\Windows\System\OIySruk.exe
  C:\Windows\System\OIySruk.exe
  2⤵
  PID:10728
- C:\Windows\System\BxfgEjv.exe
  C:\Windows\System\BxfgEjv.exe
  2⤵
  PID:10744
- C:\Windows\System\YaPgduX.exe
  C:\Windows\System\YaPgduX.exe
  2⤵
  PID:10776
- C:\Windows\System\AOLWYZB.exe
  C:\Windows\System\AOLWYZB.exe
  2⤵
  PID:10812
- C:\Windows\System\cjghDyP.exe
  C:\Windows\System\cjghDyP.exe
  2⤵
  PID:10840
- C:\Windows\System\aLdRyvB.exe
  C:\Windows\System\aLdRyvB.exe
  2⤵
  PID:10864
- C:\Windows\System\Axkcuov.exe
  C:\Windows\System\Axkcuov.exe
  2⤵
  PID:10896
- C:\Windows\System\rTAtJBL.exe
  C:\Windows\System\rTAtJBL.exe
  2⤵
  PID:10924
- C:\Windows\System\MorKRYu.exe
  C:\Windows\System\MorKRYu.exe
  2⤵
  PID:10952
- C:\Windows\System\mtkvZdW.exe
  C:\Windows\System\mtkvZdW.exe
  2⤵
  PID:10980
- C:\Windows\System\dwkDQcA.exe
  C:\Windows\System\dwkDQcA.exe
  2⤵
  PID:11008
- C:\Windows\System\jcfdVuX.exe
  C:\Windows\System\jcfdVuX.exe
  2⤵
  PID:11036
- C:\Windows\System\gAWeKkC.exe
  C:\Windows\System\gAWeKkC.exe
  2⤵
  PID:11060
- C:\Windows\System\KmBQWna.exe
  C:\Windows\System\KmBQWna.exe
  2⤵
  PID:11092
- C:\Windows\System\CWvFiYE.exe
  C:\Windows\System\CWvFiYE.exe
  2⤵
  PID:11120
- C:\Windows\System\wnTDfAl.exe
  C:\Windows\System\wnTDfAl.exe
  2⤵
  PID:11144
- C:\Windows\System\qKQMBbw.exe
  C:\Windows\System\qKQMBbw.exe
  2⤵
  PID:11176
- C:\Windows\System\cyDWXcd.exe
  C:\Windows\System\cyDWXcd.exe
  2⤵
  PID:11204
- C:\Windows\System\jiaKQGR.exe
  C:\Windows\System\jiaKQGR.exe
  2⤵
  PID:11232
- C:\Windows\System\vkrUZIp.exe
  C:\Windows\System\vkrUZIp.exe
  2⤵
  PID:11260
- C:\Windows\System\oACShkF.exe
  C:\Windows\System\oACShkF.exe
  2⤵
  PID:10264
- C:\Windows\System\jHyaLID.exe
  C:\Windows\System\jHyaLID.exe
  2⤵
  PID:10340
- C:\Windows\System\gcvITFj.exe
  C:\Windows\System\gcvITFj.exe
  2⤵
  PID:10392
- C:\Windows\System\BXcSzNf.exe
  C:\Windows\System\BXcSzNf.exe
  2⤵
  PID:10484
- C:\Windows\System\nJFSNBT.exe
  C:\Windows\System\nJFSNBT.exe
  2⤵
  PID:10532
- C:\Windows\System\rkkpyUh.exe
  C:\Windows\System\rkkpyUh.exe
  2⤵
  PID:10568
- C:\Windows\System\efRCDjt.exe
  C:\Windows\System\efRCDjt.exe
  2⤵
  PID:10668
- C:\Windows\System\gnDxGYm.exe
  C:\Windows\System\gnDxGYm.exe
  2⤵
  PID:10712
- C:\Windows\System\QEjqduv.exe
  C:\Windows\System\QEjqduv.exe
  2⤵
  PID:10804
- C:\Windows\System\ZNhBmmv.exe
  C:\Windows\System\ZNhBmmv.exe
  2⤵
  PID:10884
- C:\Windows\System\JmOdJmI.exe
  C:\Windows\System\JmOdJmI.exe
  2⤵
  PID:10936
- C:\Windows\System\NFNrNGA.exe
  C:\Windows\System\NFNrNGA.exe
  2⤵
  PID:11000
- C:\Windows\System\bHrVLuq.exe
  C:\Windows\System\bHrVLuq.exe
  2⤵
  PID:11032
- C:\Windows\System\ikkgIbb.exe
  C:\Windows\System\ikkgIbb.exe
  2⤵
  PID:11104
- C:\Windows\System\emxSMlw.exe
  C:\Windows\System\emxSMlw.exe
  2⤵
  PID:11216
- C:\Windows\System\mXjKqfU.exe
  C:\Windows\System\mXjKqfU.exe
  2⤵
  PID:10312
- C:\Windows\System\OJqAbSq.exe
  C:\Windows\System\OJqAbSq.exe
  2⤵
  PID:10508
- C:\Windows\System\ipbDMzi.exe
  C:\Windows\System\ipbDMzi.exe
  2⤵
  PID:10912
- C:\Windows\System\sKYfdSc.exe
  C:\Windows\System\sKYfdSc.exe
  2⤵
  PID:10968
- C:\Windows\System\vyBukeY.exe
  C:\Windows\System\vyBukeY.exe
  2⤵
  PID:11080
- C:\Windows\System\dDeztKM.exe
  C:\Windows\System\dDeztKM.exe
  2⤵
  PID:10324
- C:\Windows\System\xqNhrDX.exe
  C:\Windows\System\xqNhrDX.exe
  2⤵
  PID:10664
- C:\Windows\System\heEMQHe.exe
  C:\Windows\System\heEMQHe.exe
  2⤵
  PID:11128
- C:\Windows\System\wyPVKzO.exe
  C:\Windows\System\wyPVKzO.exe
  2⤵
  PID:11020
- C:\Windows\System\gYDZbeE.exe
  C:\Windows\System\gYDZbeE.exe
  2⤵
  PID:11276
- C:\Windows\System\jovGgqK.exe
  C:\Windows\System\jovGgqK.exe
  2⤵
  PID:11304
- C:\Windows\System\AXNMzfT.exe
  C:\Windows\System\AXNMzfT.exe
  2⤵
  PID:11332
- C:\Windows\System\LgKeOTN.exe
  C:\Windows\System\LgKeOTN.exe
  2⤵
  PID:11356
- C:\Windows\System\orzMGcS.exe
  C:\Windows\System\orzMGcS.exe
  2⤵
  PID:11388
- C:\Windows\System\AHnbnOJ.exe
  C:\Windows\System\AHnbnOJ.exe
  2⤵
  PID:11416
- C:\Windows\System\wxxhXHa.exe
  C:\Windows\System\wxxhXHa.exe
  2⤵
  PID:11444
- C:\Windows\System\aFqowmC.exe
  C:\Windows\System\aFqowmC.exe
  2⤵
  PID:11460
- C:\Windows\System\nMsIChb.exe
  C:\Windows\System\nMsIChb.exe
  2⤵
  PID:11500
- C:\Windows\System\ZUlvVsv.exe
  C:\Windows\System\ZUlvVsv.exe
  2⤵
  PID:11528
- C:\Windows\System\VmYGGvW.exe
  C:\Windows\System\VmYGGvW.exe
  2⤵
  PID:11556
- C:\Windows\System\RopPXQr.exe
  C:\Windows\System\RopPXQr.exe
  2⤵
  PID:11576
- C:\Windows\System\BqwjcPs.exe
  C:\Windows\System\BqwjcPs.exe
  2⤵
  PID:11612
- C:\Windows\System\JuVykTD.exe
  C:\Windows\System\JuVykTD.exe
  2⤵
  PID:11640
- C:\Windows\System\auSPeST.exe
  C:\Windows\System\auSPeST.exe
  2⤵
  PID:11668
- C:\Windows\System\huRLUCh.exe
  C:\Windows\System\huRLUCh.exe
  2⤵
  PID:11696
- C:\Windows\System\wHNFnKw.exe
  C:\Windows\System\wHNFnKw.exe
  2⤵
  PID:11724
- C:\Windows\System\ffeNton.exe
  C:\Windows\System\ffeNton.exe
  2⤵
  PID:11752
- C:\Windows\System\jRPwyNo.exe
  C:\Windows\System\jRPwyNo.exe
  2⤵
  PID:11780
- C:\Windows\System\mYRemfk.exe
  C:\Windows\System\mYRemfk.exe
  2⤵
  PID:11812
- C:\Windows\System\JAYmIHv.exe
  C:\Windows\System\JAYmIHv.exe
  2⤵
  PID:11840
- C:\Windows\System\dFzqjdg.exe
  C:\Windows\System\dFzqjdg.exe
  2⤵
  PID:11868
- C:\Windows\System\nIxnUJd.exe
  C:\Windows\System\nIxnUJd.exe
  2⤵
  PID:11896
- C:\Windows\System\hjzhlLZ.exe
  C:\Windows\System\hjzhlLZ.exe
  2⤵
  PID:11924
- C:\Windows\System\xANwAnZ.exe
  C:\Windows\System\xANwAnZ.exe
  2⤵
  PID:11952
- C:\Windows\System\AzYUtTG.exe
  C:\Windows\System\AzYUtTG.exe
  2⤵
  PID:11980
- C:\Windows\System\nCjgLiv.exe
  C:\Windows\System\nCjgLiv.exe
  2⤵
  PID:12008
- C:\Windows\System\DhBuHao.exe
  C:\Windows\System\DhBuHao.exe
  2⤵
  PID:12036
- C:\Windows\System\gJbbCNy.exe
  C:\Windows\System\gJbbCNy.exe
  2⤵
  PID:12064
- C:\Windows\System\PDNqZcv.exe
  C:\Windows\System\PDNqZcv.exe
  2⤵
  PID:12092
- C:\Windows\System\FDYRNrt.exe
  C:\Windows\System\FDYRNrt.exe
  2⤵
  PID:12124
- C:\Windows\System\kjjDJtx.exe
  C:\Windows\System\kjjDJtx.exe
  2⤵
  PID:12152
- C:\Windows\System\kcTTqHv.exe
  C:\Windows\System\kcTTqHv.exe
  2⤵
  PID:12180
- C:\Windows\System\TMzHqos.exe
  C:\Windows\System\TMzHqos.exe
  2⤵
  PID:12208
- C:\Windows\System\zCdHAYZ.exe
  C:\Windows\System\zCdHAYZ.exe
  2⤵
  PID:12236
- C:\Windows\System\ZwzrAIo.exe
  C:\Windows\System\ZwzrAIo.exe
  2⤵
  PID:12264
- C:\Windows\System\ZgoYdkm.exe
  C:\Windows\System\ZgoYdkm.exe
  2⤵
  PID:10972
- C:\Windows\System\IyuTzUa.exe
  C:\Windows\System\IyuTzUa.exe
  2⤵
  PID:11324
- C:\Windows\System\CAQGUWr.exe
  C:\Windows\System\CAQGUWr.exe
  2⤵
  PID:11408
- C:\Windows\System\VMvgnju.exe
  C:\Windows\System\VMvgnju.exe
  2⤵
  PID:11484
- C:\Windows\System\BWhrucL.exe
  C:\Windows\System\BWhrucL.exe
  2⤵
  PID:11540
- C:\Windows\System\QVolnlv.exe
  C:\Windows\System\QVolnlv.exe
  2⤵
  PID:11604
- C:\Windows\System\jZlrsyO.exe
  C:\Windows\System\jZlrsyO.exe
  2⤵
  PID:11664
- C:\Windows\System\rkEVVNs.exe
  C:\Windows\System\rkEVVNs.exe
  2⤵
  PID:11736
- C:\Windows\System\NaryBku.exe
  C:\Windows\System\NaryBku.exe
  2⤵
  PID:11808
- C:\Windows\System\VfSDYnf.exe
  C:\Windows\System\VfSDYnf.exe
  2⤵
  PID:3424
- C:\Windows\System\HOIGphT.exe
  C:\Windows\System\HOIGphT.exe
  2⤵
  PID:11908
- C:\Windows\System\kDtzCnr.exe
  C:\Windows\System\kDtzCnr.exe
  2⤵
  PID:11964
- C:\Windows\System\iMzcYTD.exe
  C:\Windows\System\iMzcYTD.exe
  2⤵
  PID:12028
- C:\Windows\System\HpnQeRp.exe
  C:\Windows\System\HpnQeRp.exe
  2⤵
  PID:12088
- C:\Windows\System\TzkjtmS.exe
  C:\Windows\System\TzkjtmS.exe
  2⤵
  PID:12164
- C:\Windows\System\sMSLwHt.exe
  C:\Windows\System\sMSLwHt.exe
  2⤵
  PID:12232
- C:\Windows\System\coQYqhJ.exe
  C:\Windows\System\coQYqhJ.exe
  2⤵
  PID:11300
- C:\Windows\System\EecuiZh.exe
  C:\Windows\System\EecuiZh.exe
  2⤵
  PID:11452
- C:\Windows\System\MMctfcs.exe
  C:\Windows\System\MMctfcs.exe
  2⤵
  PID:11564
- C:\Windows\System\efYKKas.exe
  C:\Windows\System\efYKKas.exe
  2⤵
  PID:11772
- C:\Windows\System\ZpjKDnt.exe
  C:\Windows\System\ZpjKDnt.exe
  2⤵
  PID:3512
- C:\Windows\System\oOGhOvj.exe
  C:\Windows\System\oOGhOvj.exe
  2⤵
  PID:12020
- C:\Windows\System\xWruMkt.exe
  C:\Windows\System\xWruMkt.exe
  2⤵
  PID:12200
- C:\Windows\System\bUMFzVw.exe
  C:\Windows\System\bUMFzVw.exe
  2⤵
  PID:11368
- C:\Windows\System\LLIgWjj.exe
  C:\Windows\System\LLIgWjj.exe
  2⤵
  PID:11720
- C:\Windows\System\mQNWIYc.exe
  C:\Windows\System\mQNWIYc.exe
  2⤵
  PID:12004
- C:\Windows\System\KTvTOYz.exe
  C:\Windows\System\KTvTOYz.exe
  2⤵
  PID:11520
- C:\Windows\System\ZyCFFcQ.exe
  C:\Windows\System\ZyCFFcQ.exe
  2⤵
  PID:11268
- C:\Windows\System\EhanFiR.exe
  C:\Windows\System\EhanFiR.exe
  2⤵
  PID:12304
- C:\Windows\System\LpGgMMS.exe
  C:\Windows\System\LpGgMMS.exe
  2⤵
  PID:12332
- C:\Windows\System\hQdgCgr.exe
  C:\Windows\System\hQdgCgr.exe
  2⤵
  PID:12360
- C:\Windows\System\anWhNiu.exe
  C:\Windows\System\anWhNiu.exe
  2⤵
  PID:12388
- C:\Windows\System\YSWzkkc.exe
  C:\Windows\System\YSWzkkc.exe
  2⤵
  PID:12416
- C:\Windows\System\yiqLCiT.exe
  C:\Windows\System\yiqLCiT.exe
  2⤵
  PID:12444
- C:\Windows\System\ySURbsa.exe
  C:\Windows\System\ySURbsa.exe
  2⤵
  PID:12472
- C:\Windows\System\CYvpSFh.exe
  C:\Windows\System\CYvpSFh.exe
  2⤵
  PID:12504
- C:\Windows\System\BEowGcO.exe
  C:\Windows\System\BEowGcO.exe
  2⤵
  PID:12536
- C:\Windows\System\DvOZyzv.exe
  C:\Windows\System\DvOZyzv.exe
  2⤵
  PID:12568
- C:\Windows\System\GqSkCcP.exe
  C:\Windows\System\GqSkCcP.exe
  2⤵
  PID:12596
- C:\Windows\System\MinDlNG.exe
  C:\Windows\System\MinDlNG.exe
  2⤵
  PID:12624
- C:\Windows\System\SSnfYHZ.exe
  C:\Windows\System\SSnfYHZ.exe
  2⤵
  PID:12652
- C:\Windows\System\PSdmfYs.exe
  C:\Windows\System\PSdmfYs.exe
  2⤵
  PID:12680
- C:\Windows\System\ILdVuep.exe
  C:\Windows\System\ILdVuep.exe
  2⤵
  PID:12712
- C:\Windows\System\RoznvTz.exe
  C:\Windows\System\RoznvTz.exe
  2⤵
  PID:12740
- C:\Windows\System\zzuUwkj.exe
  C:\Windows\System\zzuUwkj.exe
  2⤵
  PID:12772
- C:\Windows\System\nbdpuYw.exe
  C:\Windows\System\nbdpuYw.exe
  2⤵
  PID:12800
- C:\Windows\System\VLfznnh.exe
  C:\Windows\System\VLfznnh.exe
  2⤵
  PID:12824
- C:\Windows\System\TyvJjHG.exe
  C:\Windows\System\TyvJjHG.exe
  2⤵
  PID:12852
- C:\Windows\System\jDTqwpv.exe
  C:\Windows\System\jDTqwpv.exe
  2⤵
  PID:12880
- C:\Windows\System\dujbImE.exe
  C:\Windows\System\dujbImE.exe
  2⤵
  PID:12908
- C:\Windows\System\ktCnykr.exe
  C:\Windows\System\ktCnykr.exe
  2⤵
  PID:12936
- C:\Windows\System\EnKcWaD.exe
  C:\Windows\System\EnKcWaD.exe
  2⤵
  PID:12968
- C:\Windows\System\JjhlbXq.exe
  C:\Windows\System\JjhlbXq.exe
  2⤵
  PID:12992
- C:\Windows\System\DmJgdpT.exe
  C:\Windows\System\DmJgdpT.exe
  2⤵
  PID:13020
- C:\Windows\System\aIGedbB.exe
  C:\Windows\System\aIGedbB.exe
  2⤵
  PID:13048
- C:\Windows\System\SUnqXTU.exe
  C:\Windows\System\SUnqXTU.exe
  2⤵
  PID:13076
- C:\Windows\System\NMWdHiM.exe
  C:\Windows\System\NMWdHiM.exe
  2⤵
  PID:13104
- C:\Windows\System\kxEUnuw.exe
  C:\Windows\System\kxEUnuw.exe
  2⤵
  PID:13132
- C:\Windows\System\rymHUXq.exe
  C:\Windows\System\rymHUXq.exe
  2⤵
  PID:13164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_kguz14bl.rgz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kguz14bl.rgz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Ajiqabc.exe

Path C:\Windows\System\Ajiqabc.exe
Size 3.3MB
SHA256 fbdecd468a3e51735c0e2ba80031d417a8649cf758b5ebba03e76b92e7d29c0a
MD5 52598333127117ae1e8dd3656a249611
SHA1 9cc53f5db623f6ef33901ea4150f0880a4c7f8b7
SHA512 fe40bdca8d19d5c9da0172aa08456db6a7fe128ed892aa60037c1c0da117f68e70772f87f024be04ba7f88bfacde5d7a6365935f9d9e3edb54899556e21df64f
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:SbBeSFkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

BOmiPvC.exe

Path C:\Windows\System\BOmiPvC.exe
Size 3.3MB
SHA256 1549f274a26a76f6bc816b48811833b076e44a310fead7c772ab7a742606f323
MD5 8975e7832ed74e04a1ae08e4be2d90c0
SHA1 54e6924a30f4039ba17964d2d71206223c52dc30
SHA512 8bf7aa454fa45d485d3b041b345eb50e9232ddb36d7a16aa21f112fb206253a82583c65b933bd878f43d1620730f7313078bdce1c0447f79314bf1e2452af3d7
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:SbBeSFk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMXLnzR.exe

Path C:\Windows\System\HMXLnzR.exe
Size 3.3MB
SHA256 d6f2a636f2d71e63ddd7a388efc624a145a83873814ace5a4291a1aa181e3b4b
MD5 9a2c6f456807129e3ffff800993f0d32
SHA1 5c7bf22a64bcb427d17028e8dedc6be9187be441
SHA512 63133c25b8fc1be1bd87a7bc22d059983f64d5b28fd1c75122aecf2e58c6ae0d2ccddd824c661a051d3bff315da4ed7c928082ad46e5231675b6f6e626bcc555
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:SbBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyduGlC.exe

Path C:\Windows\System\HyduGlC.exe
Size 3.3MB
SHA256 28a9d4d62dcd9d2d166483121af392bc71dd359ebd0ea146b91fb4fbdf233773
MD5 cba72c4e7862af0ec3d8b3dff623f395
SHA1 0b8b97be96a901710444d3feeb8b7416d3f6be8d
SHA512 caad3f982b92e86ed6ef5ece5863bf71ff4bf83213cb198b0d082f22aa5a89e0b30657b0fb03fc77d56834e5c139fea8f2cbdba2bdf53543a27061e3a96ed1c4
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:SbBeSFkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHObAWQ.exe

Path C:\Windows\System\KHObAWQ.exe
Size 8B
SHA256 3b6442d24e80d27600c9f4b799385788d98c70d600c89b99f83b72de8a2d37b2
MD5 6e243c8b38e3d92f12c1f3eed40a3381
SHA1 9cddf51e5ed1489561f7f07e24dbb0373375660c
SHA512 1198fd093d8b9db02c218d5c2855535582ecbe96e17ed1d7c0e3e5f22338aecda2fcb8f90f131612a5aa5269b550a96f2f4d4d31468134ed76bcb198b6885ad2
MD5 SHA1 SHA512

Submit Download

LsgLLlj.exe

Path C:\Windows\System\LsgLLlj.exe
Size 3.3MB
SHA256 aa998f8e2eb97a027b2f848a528a303ba821e52ad09c511c429a4d43ad0d5901
MD5 c425039a86a0778c695fccc669829e87
SHA1 e0bf3a9e68ce6a293af5214ddd68827d6b159f77
SHA512 35b66945e257b4404f05a9ef35c106ac384a636c292510cecdd6b317dff8f98476f1b6ec0800bb58241c3da143ead018b13b73cd599c72bcd235892c78bedf50
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW8:SbBeSFkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

NQUcJBu.exe

Path C:\Windows\System\NQUcJBu.exe
Size 3.3MB
SHA256 753c48f1f0bb2d8145582faa604e7dc53c7a445d5c114eecbbf675d1cadd0ffa
MD5 9312bc6051f0bbcf936c8c28bba1a8e7
SHA1 af45c60559cf6e691791fe23167f34d16ae97268
SHA512 69964c92498c75038baeff26a353dc4254cb856b26117c3e35bce857ebb89dceb4a70a2f1650a11efadb216f1cfda61aebb690408694e8cfd0b5f89cb3a1d6f1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OUjlxQo.exe

Path C:\Windows\System\OUjlxQo.exe
Size 3.3MB
SHA256 1588885c1e65137f89bdddfb35963720be481b3e5bfbdd2ba672264d34c7a698
MD5 aece0f549dd5f5d99ba1630e97fb1cef
SHA1 e89cb8b8a2f778c18a8f808ea69dc6b83e916c81
SHA512 b2cde5037c896416a6cdaa60d0b706903279a2f2964d608a0c8e0e94fd9e8bb3d8c0f33fac4ba07b8f1f3596ca22001a8bafbb4310dbd57da03aca14e1ace1c3
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:SbBeSFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

QgCkrWf.exe

Path C:\Windows\System\QgCkrWf.exe
Size 3.3MB
SHA256 cb843dcae4b0d189818902f1939f73f6ff6533ce7415f067bd4d216a7eb0140a
MD5 869ee7ed0ef264cacd2dd15ab6353a49
SHA1 10e9a12e0b75f611b642c32e9ab7e81a0d8dfe46
SHA512 dc0b8d80a1aaf5c63d09e540f7393e30b934accf1afbe46a4cd7c5d94ef89fd04381615f98d5ec15d6db0972ac1a7095f04116a5949f6765f105bc5568bc868e
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TQShEAd.exe

Path C:\Windows\System\TQShEAd.exe
Size 3.3MB
SHA256 f1aab4673a9f613ea7ab691fc241c9269cd31922d8cae706d55e73f8e038ad60
MD5 1ea983017993670f17ad6ab1461df642
SHA1 6024f9d70a0aa9fe76c282b39d8122cb150d91cf
SHA512 cdb6f83d461c2cdf2827a2ba9f1ec47d8c5cf983ca6f946e8fd63aa4d884479e53af8b00e3213338ead1e840534c765e908b68490e8ad0cab132bc1a906ed5a1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:SbBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyNeCmT.exe

Path C:\Windows\System\TyNeCmT.exe
Size 3.3MB
SHA256 dcb5e5053c34f5ccc9300cda34e07886f9f7d68c7c44d593bfa13aca8f649753
MD5 58eb242ea062226c20c2e0f624f9f3af
SHA1 35ae776f5c24f378ce378ba04c042f53c5162401
SHA512 a47c6689882d42f9317430bd350ed9eb6a86d1e7f9cce1a96ea3fd3451b61258fde1beaecb963378e33c062927bd8436dca33cab154fdfce9b5c07c62cbedae1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWt:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

VvdfyfD.exe

Path C:\Windows\System\VvdfyfD.exe
Size 3.3MB
SHA256 7045d406c4c181ad819487d006e6cdfab9f07ca2a6930f71355046223117452f
MD5 7c37a21462857b2f2dd2511f4b46f7cb
SHA1 83a257eae424f46be35503c42e4b70df914f5b5f
SHA512 49da83aa25ae5fe28203b71929fdc96720ec143553e15c20eab240506a6d998116a111a8fa4ad56306135dd39b11b46e1831711911d6f33aa00360eaf42b3de9
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWi:SbBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

WytYHRe.exe

Path C:\Windows\System\WytYHRe.exe
Size 3.3MB
SHA256 28335d76f0a63cc2b41a1958c1be1c5be795f005479027f075f7c8208759c537
MD5 84d06152a6ffeb9d356f7109ff044ebb
SHA1 e295de84b937c6ec4c5879510eda9f20e8f2d517
SHA512 7cee55c10ec2e7022eb911ba1da7d61ecded22de0ffd1c504c63248158f3a6c574a6e3b21bd08d9ec0ecb0e7410fdedabeb7893994188327264fdcf95be7a34e
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:SbBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZLgoQEX.exe

Path C:\Windows\System\ZLgoQEX.exe
Size 3.3MB
SHA256 40ca5d6ea7362f056267f37001a245a6c35d47837466ebee7187401f1d98d360
MD5 b8bb230999c9817141678de3cc5cd684
SHA1 1f3e278664eb214015b87c1f6c19a613146da2ba
SHA512 604265ec9e97e30ef938312260170080aaecb67465d02923c205a9b4a4fd0efe4751068b4c7dda4dccd9e8ee86022f5a21f6d8556bee694318fe8c10227a004d
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:SbBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bBsDtAN.exe

Path C:\Windows\System\bBsDtAN.exe
Size 3.3MB
SHA256 ff5701340cd7f173b460b60c30006e4601c3876c0469a25a671c1d024b69ba46
MD5 ad227ac74c64f290470b61a9b77e8239
SHA1 a693064eb13175f0534f5241113637d40e3a7869
SHA512 c3498539c3772130a28bf1c1baba4348533d5727c3c860d22edba67cfa261de21f2c02c380a92b5ddb3ee7c91ae14575e3a50cb1b3c730a1b12af72410abc1a1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWe:SbBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

bQuEBCB.exe

Path C:\Windows\System\bQuEBCB.exe
Size 3.3MB
SHA256 667fe4cc15f962d02c970a7fee4ef2373be1aeffbce42c537d1c19caa6f4361e
MD5 0f87a4b8e211f7bf1a913162efc0ea17
SHA1 e88b724f0960eec2d062e9998a8ca281ef6c8766
SHA512 7eefc795b1cc1e08aa277f427488d42d255083e66f033c8de9989b094b7ef568e91732e577085b36cd1955a2c93bf48dae4b3e98dffd42a4adc3971ea7b2adb1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:SbBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bSueSvC.exe

Path C:\Windows\System\bSueSvC.exe
Size 3.3MB
SHA256 3c1b34013ff662583d2e0e80cc230b9f13abdbbb07697d3726e4fa313937b6ae
MD5 db9b76cd7c111011b63654cd0cb880de
SHA1 6c68706821f00a6cfb281fc1fd4dfe0b3cb0d078
SHA512 06dcc7a98686e315312aa26b123872ebc4a6d1dc24de068cffeb3c55d321c0c98a47336dc9a168060910bc98de64cf113f5a91991af0f8a6bd49ef4c49bce76c
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:SbBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

botBBvi.exe

Path C:\Windows\System\botBBvi.exe
Size 3.3MB
SHA256 1be15f86795c460fa0c8d8b68c27dc2b922d62555531200486df6f4fe089853b
MD5 bc409cf314ef3f71fc8ef580498d7250
SHA1 34af97f895a176d60d43a4f1b6197ede1b3c899b
SHA512 0e539f4806eb7afb4754248f89640b243906b1830007c8706a74086258d32bda0f4e1c97e51d64438cd9e356fdf43969147955ca67c80e4430a1850d6d4071f9
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:SbBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsCIWrz.exe

Path C:\Windows\System\bsCIWrz.exe
Size 3.3MB
SHA256 ad27d4b47da162e5523cad4b1aa7af14b06d6b6a9d77e316fd9a08ee771e8495
MD5 99b60dbaa4581d9431ef1b50198df714
SHA1 405ebe014f505efb5f8af27c0bef8ced85017625
SHA512 b8c7b3ed80c791a11a08200bfd29f2eb3ce6df4822d608f1cfecb5a054b1a2aa1daab4021c46b83b4e227654a477244b33bebd4b2e1ec4dd0a1162dfbee85dfe
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWi:SbBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dNLjmgw.exe

Path C:\Windows\System\dNLjmgw.exe
Size 3.3MB
SHA256 442fb3490deaf75fb6eb6e4ed624ac6a10fa6c6739fdf54309655df3afbedd02
MD5 55822786670250d1c4ccd9dfbab01921
SHA1 e740e00a01b9cf27634c76c5d93f6a0eb0e29f45
SHA512 c94f1adaa13d1acedbf6397b4878d9fb527dd2dcbad7eef86acd441dee1194932bbf4a13a1525d5ff66c84f323191dd4830a22fc5af7b17d506a65469041bac3
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:SbBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dghFVTx.exe

Path C:\Windows\System\dghFVTx.exe
Size 3.3MB
SHA256 8dca6d821390555e8c91aff50872a63539c925de73381b6b7e7446f294782df4
MD5 d85f0a20bdb0fc8e62459b46bb9c4f7c
SHA1 e13a9d7ba28e6460e6774a63527981293b283652
SHA512 ee164af1214dc315017963906356a2eeeb2a13368bfa0bd13c9d8f197e932725bf7e5d17c5d078370128030c2461fa687613fa13e0bf115413a4f7545dd76f47
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:SbBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

drYMMTS.exe

Path C:\Windows\System\drYMMTS.exe
Size 3.3MB
SHA256 acd68739f67384cb87266c0f0fbc2357e3c09d94904b1342c92c471c8561d1db
MD5 e97f4079208243fec1bc4d30fbd78f69
SHA1 f667fca2eeafce831a8b1aa63041b6869c1ef275
SHA512 e6eacd1d332eee4d17ac6161b58d81292ac94e57fd3bf6647dd83c18e4fc3aca398a8538ca8191e4cccd95a64452d067d985db03643036b898b79735bb07e3d9
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWn:SbBeSFkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

gJwqTaC.exe

Path C:\Windows\System\gJwqTaC.exe
Size 3.3MB
SHA256 1e2ecaecb58c7ed6f612cc8a8c0c15091e78b4c651e7fc9ab9334aae1afd1164
MD5 51d2cfe9b8a5b4a2f314c35b1d51fdef
SHA1 ff07eda2cf644dbf0050e978ced8b79a6d36dae0
SHA512 fe2054d501e557ba93c0d4944aaea57abfbdad07e7a224c284178f9514f6211131a3971c41661576483cc4e4dca3a57ee1add876bd96ffc1e8bffdb170d56c2a
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFkd
MD5 SHA1 SHA512 SSDEEP

Submit Download

jrETEyV.exe

Path C:\Windows\System\jrETEyV.exe
Size 3.3MB
SHA256 a6fedcede3d6aec432bfad4c8c042f22c4a9506638f2b53ca9bd236148a1d76d
MD5 d9ee1e5747f45c57bf809b09be34c25d
SHA1 91428dc7fbf0dc2368f10fcebb8c3804e070e980
SHA512 7290e553643aa1f0ae6685d7f131c1bf116977807230631380a9b11226de9c4ab88ea2a04eb22b905c5eb8ed645e08115dc87253653e52de1aa0b1410c92f142
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:SbBeSFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

kBWMtBf.exe

Path C:\Windows\System\kBWMtBf.exe
Size 3.3MB
SHA256 c999a54b66ba64c629ff3843145ef8009de2a50f1e9a6d97f3292a347d4b8e4a
MD5 a7925ab2856aaca98fc7a443fb74718a
SHA1 adf05772c2adaba2b00530880390ac70d11a0efa
SHA512 a08744235ddedb3418e81a0ee577445be8c40c0d2dfe7e7b3ff0ce1e2e66ca0c3e4b24d8f0df9524c39e87d812f98109127a46b588cb4bd3b857aac4739bdada
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:SbBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqLkhBr.exe

Path C:\Windows\System\qqLkhBr.exe
Size 3.3MB
SHA256 9ee1e3ee5e13b37512b902035069e3ac2fa99a55a7125c33dd2309715ef1c68c
MD5 d474233b5bb56de2f94a328d7cc4bc5f
SHA1 ccc968b6b900fadeade5e656d2679e850c5b8cea
SHA512 54e3ab7d77ddaafdc8bafb654db5d941e982a885c47c03defd229a98aed45d774de3440881e0456ff6ab77e203e8e8dee1fe58be64225f2d455bfcbad3cd6431
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:SbBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

syCSPKN.exe

Path C:\Windows\System\syCSPKN.exe
Size 3.3MB
SHA256 a196c3420be8bb5ea32bb8ae40c5911590da94ef1163671d20376562e0e50529
MD5 2748dbe70bedefc84495af2ee440d6d8
SHA1 eed10f68213394f0cd1b8da20f109a8e95d82010
SHA512 95b87858649322dce71b44350bfb7f0cf79cd5cbc515c32ad75abc6592227c7bba9ae27507bc9102aa046ccab740868dec3c1d35d20b489e31d65daea304967e
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:SbBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

tXyAgFo.exe

Path C:\Windows\System\tXyAgFo.exe
Size 3.3MB
SHA256 62bf58700098ee40672c34a0e24b15e1022b2a97cfee0e2659e151230e9be0b5
MD5 a189e65f879ab537e5e3d0e654c48a11
SHA1 d65db764c575fc451db5bee686bbd8d52b2576af
SHA512 01467f481097606a6aefd81b24baf71e400f0e204f95628db037d6bc8ea703b1b2a050f6b5a1a52772cf252179becba20504be18800d24b2b6e3351d50f7047c
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:SbBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ukztHqB.exe

Path C:\Windows\System\ukztHqB.exe
Size 3.3MB
SHA256 902ae2e197d21165a05a946f6b657d950bc6a02cc82e048df087b25fbfda99e7
MD5 af0541ed218d6ba945ac851112f57d16
SHA1 5d6e1d174046686eee2c47dcb5e4ec93c28cdc4e
SHA512 928b7a568e44a5405358a5ed9c4a2bf263cbc6a247d28397468e8179db0335dc3223b89f42734a8fde9afb1141ebeeffd5935175f0dc1c3fc0c029f78c699918
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:SbBeSFk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLgnWTv.exe

Path C:\Windows\System\wLgnWTv.exe
Size 3.3MB
SHA256 a998bf6a8bc97bf198d2f941c419abc253c20adde1de49ab6d9e701ec261a1e0
MD5 b0ec1256dc2486e7c815d1eb87299786
SHA1 cedbd3f6765b50d10f4380f1d144e86628b0967f
SHA512 ee333ed26e74a128c43bea9de30f1706706c222204ac0aec5b48f3424fc7b40dcd903edb545f154bad701eb1db601a2b69a9ea139c969896c0d8255474686fe3
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xwZQfUW.exe

Path C:\Windows\System\xwZQfUW.exe
Size 3.3MB
SHA256 184ffe4e4417141f56c2166de319528260ba469999786b3ac83e89b7fd451d63
MD5 2da4b5d5bbf332c65c6858b21dee7b40
SHA1 988615bf7b6ef233db448a0fded26850d670cf44
SHA512 3a2ab8071fe7c248a068eea59069b3376d673b5f52675d2ce4f0b9c35e9c78ffc6bcdb84eebe22b8692fa0306de08b1f9be31fe508d136cce570e5f08e2b3698
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:SbBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ySwfqzH.exe

Path C:\Windows\System\ySwfqzH.exe
Size 3.3MB
SHA256 3f53b03e5b2c2f96b1bc4e6ab8d1f6d0c4eec5c03f2c850fd1ab04f403376b0d
MD5 f1a771e187322961d0e9ececdce0f0af
SHA1 385d938a754bc3ce28b34bb18f591f367cd848d3
SHA512 2ab1626c5a8f443719508aa72799cef3db81e17e9c45c50243691c561e62d1259fe484a51d24cca2702e65d295698fa273cd99de0318914f733bc5aade801312
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:SbBeSFkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

yiFYuZU.exe

Path C:\Windows\System\yiFYuZU.exe
Size 3.3MB
SHA256 b3780144009a26a1540ac561374ca949c7247e4fe0e90d78834e6fae0364df57
MD5 9865aa0b12c03f47e5fd865c652ae6e9
SHA1 6b2bc42ef0e527a79b970d0fbd7402e32fe0155c
SHA512 6811a1e49fcb8b16568e0131263a25d45ba075c39e1ff23900550b03d5366a0ddfd6cd00a3c549673b81654d53b86154692d66090c5a75408243748463ac5aff
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:SbBeSFkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

zCzaCKB.exe

Path C:\Windows\System\zCzaCKB.exe
Size 3.3MB
SHA256 11f29f58875f30030e55a95f491847ac1b73744be08032de1653a36aefd2c255
MD5 3097e8bb4e864a6ac62ccaa1f935b5bb
SHA1 067762d8bc8922770908dc353c898eacb2778b23
SHA512 4c72c623ebb0b3e9dfc88359d7e0f3672e1a7ac37f12f814d6f0e407359828c21e4edc38c2f0910140bb9f43ef7ac99c3e904dd05a57d05470c34c95d788a821
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:SbBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-542-0x00007FF7F47B0000-0x00007FF7F4BA6000-memory.dmp

Download

memory/400-2438-0x00007FF7F47B0000-0x00007FF7F4BA6000-memory.dmp

Download

memory/852-64-0x00007FF74B120000-0x00007FF74B516000-memory.dmp

Download

memory/852-2419-0x00007FF74B120000-0x00007FF74B516000-memory.dmp

Download

memory/1116-81-0x00007FF725EC0000-0x00007FF7262B6000-memory.dmp

Download

memory/1116-2425-0x00007FF725EC0000-0x00007FF7262B6000-memory.dmp

Download

memory/1236-68-0x00007FF60B5B0000-0x00007FF60B9A6000-memory.dmp

Download

memory/1236-2421-0x00007FF60B5B0000-0x00007FF60B9A6000-memory.dmp

Download

memory/1324-537-0x00007FF6E4010000-0x00007FF6E4406000-memory.dmp

Download

memory/1324-2432-0x00007FF6E4010000-0x00007FF6E4406000-memory.dmp

Download

memory/1840-55-0x00007FF66CEB0000-0x00007FF66D2A6000-memory.dmp

Download

memory/1840-2415-0x00007FF66CEB0000-0x00007FF66D2A6000-memory.dmp

Download

memory/2228-2422-0x00007FF70F430000-0x00007FF70F826000-memory.dmp

Download

memory/2228-77-0x00007FF70F430000-0x00007FF70F826000-memory.dmp

Download

memory/2232-71-0x00007FF647780000-0x00007FF647B76000-memory.dmp

Download

memory/2232-2423-0x00007FF647780000-0x00007FF647B76000-memory.dmp

Download

memory/2344-541-0x00007FF7F14C0000-0x00007FF7F18B6000-memory.dmp

Download

memory/2344-2437-0x00007FF7F14C0000-0x00007FF7F18B6000-memory.dmp

Download

memory/2376-2431-0x00007FF6A7790000-0x00007FF6A7B86000-memory.dmp

Download

memory/2376-534-0x00007FF6A7790000-0x00007FF6A7B86000-memory.dmp

Download

memory/2464-2424-0x00007FF66BF70000-0x00007FF66C366000-memory.dmp

Download

memory/2464-80-0x00007FF66BF70000-0x00007FF66C366000-memory.dmp

Download

memory/2484-535-0x00007FF602F00000-0x00007FF6032F6000-memory.dmp

Download

memory/2484-2433-0x00007FF602F00000-0x00007FF6032F6000-memory.dmp

Download

memory/2776-536-0x00007FF73D170000-0x00007FF73D566000-memory.dmp

Download

memory/2776-2434-0x00007FF73D170000-0x00007FF73D566000-memory.dmp

Download

memory/2844-526-0x00007FF7F44E0000-0x00007FF7F48D6000-memory.dmp

Download

memory/2844-2428-0x00007FF7F44E0000-0x00007FF7F48D6000-memory.dmp

Download

memory/3064-2418-0x00007FF745E40000-0x00007FF746236000-memory.dmp

Download

memory/3064-76-0x00007FF745E40000-0x00007FF746236000-memory.dmp

Download

memory/3224-65-0x00007FF79A4C0000-0x00007FF79A8B6000-memory.dmp

Download

memory/3224-2420-0x00007FF79A4C0000-0x00007FF79A8B6000-memory.dmp

Download

memory/3264-0-0x00007FF7AF180000-0x00007FF7AF576000-memory.dmp

Download

memory/3264-1-0x000001C56DAE0000-0x000001C56DAF0000-memory.dmp

Download

memory/3480-538-0x00007FF747260000-0x00007FF747656000-memory.dmp

Download

memory/3480-2435-0x00007FF747260000-0x00007FF747656000-memory.dmp

Download

memory/3544-540-0x00007FF7BA440000-0x00007FF7BA836000-memory.dmp

Download

memory/3544-2436-0x00007FF7BA440000-0x00007FF7BA836000-memory.dmp

Download

memory/3648-327-0x00000176A2EF0000-0x00000176A3696000-memory.dmp

Download

memory/3648-26-0x0000017689880000-0x00000176898A2000-memory.dmp

Download

memory/3648-2413-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmp

Download

memory/3648-2412-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Download

memory/3648-50-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Download

memory/3648-31-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Download

memory/3648-10-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmp

Download

memory/3712-2427-0x00007FF7CA6D0000-0x00007FF7CAAC6000-memory.dmp

Download

memory/3712-525-0x00007FF7CA6D0000-0x00007FF7CAAC6000-memory.dmp

Download

memory/3792-2416-0x00007FF60E690000-0x00007FF60EA86000-memory.dmp

Download

memory/3792-75-0x00007FF60E690000-0x00007FF60EA86000-memory.dmp

Download

memory/3956-2417-0x00007FF6F7140000-0x00007FF6F7536000-memory.dmp

Download

memory/3956-60-0x00007FF6F7140000-0x00007FF6F7536000-memory.dmp

Download

memory/4364-524-0x00007FF70FCF0000-0x00007FF7100E6000-memory.dmp

Download

memory/4364-2426-0x00007FF70FCF0000-0x00007FF7100E6000-memory.dmp

Download

memory/4904-2430-0x00007FF633E30000-0x00007FF634226000-memory.dmp

Download

memory/4904-528-0x00007FF633E30000-0x00007FF634226000-memory.dmp

Download

memory/4968-2429-0x00007FF7BA680000-0x00007FF7BAA76000-memory.dmp

Download

memory/4968-527-0x00007FF7BA680000-0x00007FF7BAA76000-memory.dmp

Download