xmrig | 8f3dbd649016dc165ca716f10f863aa33af76936ec99a65d0bc2c57ea6e87e22

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
Size 2.9MB
Sample240528-grt5cagg5s
SHA256 8f3dbd649016dc165ca716f10f863aa33af76936ec99a65d0bc2c57ea6e87e22
MD5 35942abdb657567e092c512e2ef5a9b0
SHA1 d6f314e6df5d70b840e894e67c65ce63df956060
SHA512 c39347fe62f76df318e89b9eca72d812e5efd237341d1ddeb7f572ddeeb57f92c9586a140afeebd9cd19929f40ad7faf568d9ab90b1de73e35c91a505c42d7f2
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1988-0-0x00007FF779180000-0x00007FF779576000-memory.dmp	xmrig
behavioral2/files/0x00090000000233f4-6.dat	xmrig
behavioral2/files/0x000700000002340c-13.dat	xmrig
behavioral2/files/0x000700000002340f-26.dat	xmrig
behavioral2/files/0x0007000000023410-32.dat	xmrig
behavioral2/files/0x0007000000023412-52.dat	xmrig
behavioral2/files/0x0007000000023413-60.dat	xmrig
behavioral2/files/0x0007000000023418-72.dat	xmrig
behavioral2/files/0x0007000000023419-83.dat	xmrig
behavioral2/files/0x000700000002341b-96.dat	xmrig
behavioral2/files/0x000700000002341a-105.dat	xmrig
behavioral2/files/0x0008000000023414-114.dat	xmrig
behavioral2/memory/3424-120-0x00007FF6A2340000-0x00007FF6A2736000-memory.dmp	xmrig
behavioral2/memory/3700-122-0x00007FF6502F0000-0x00007FF6506E6000-memory.dmp	xmrig
behavioral2/memory/4676-125-0x00007FF772010000-0x00007FF772406000-memory.dmp	xmrig
behavioral2/memory/2220-128-0x00007FF673830000-0x00007FF673C26000-memory.dmp	xmrig
behavioral2/memory/828-129-0x00007FF6A80E0000-0x00007FF6A84D6000-memory.dmp	xmrig
behavioral2/memory/2608-127-0x00007FF771C30000-0x00007FF772026000-memory.dmp	xmrig
behavioral2/files/0x0008000000023409-132.dat	xmrig
behavioral2/files/0x000700000002341e-148.dat	xmrig
behavioral2/files/0x0007000000023420-165.dat	xmrig
behavioral2/memory/2916-197-0x00007FF670540000-0x00007FF670936000-memory.dmp	xmrig
behavioral2/memory/3084-211-0x00007FF689370000-0x00007FF689766000-memory.dmp	xmrig
behavioral2/memory/1448-210-0x00007FF6E10B0000-0x00007FF6E14A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-200.dat	xmrig
behavioral2/files/0x0007000000023424-198.dat	xmrig
behavioral2/files/0x0007000000023423-195.dat	xmrig
behavioral2/files/0x0007000000023422-193.dat	xmrig
behavioral2/memory/1576-192-0x00007FF718B10000-0x00007FF718F06000-memory.dmp	xmrig
behavioral2/memory/2588-191-0x00007FF6B16A0000-0x00007FF6B1A96000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-190.dat	xmrig
behavioral2/files/0x000700000002342c-189.dat	xmrig
behavioral2/files/0x000700000002342b-188.dat	xmrig
behavioral2/files/0x000700000002342a-187.dat	xmrig
behavioral2/files/0x0007000000023429-186.dat	xmrig
behavioral2/files/0x0007000000023428-185.dat	xmrig
behavioral2/files/0x0007000000023427-184.dat	xmrig
behavioral2/files/0x0007000000023426-183.dat	xmrig
behavioral2/files/0x0007000000023421-181.dat	xmrig
behavioral2/files/0x000700000002341f-153.dat	xmrig
behavioral2/memory/452-126-0x00007FF7C2690000-0x00007FF7C2A86000-memory.dmp	xmrig
behavioral2/memory/1440-124-0x00007FF637B80000-0x00007FF637F76000-memory.dmp	xmrig
behavioral2/memory/1464-123-0x00007FF666480000-0x00007FF666876000-memory.dmp	xmrig
behavioral2/memory/3724-119-0x00007FF743ED0000-0x00007FF7442C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-117.dat	xmrig
behavioral2/memory/1456-116-0x00007FF64FE00000-0x00007FF6501F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-112.dat	xmrig
behavioral2/files/0x0008000000023415-108.dat	xmrig
behavioral2/memory/4064-107-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp	xmrig
behavioral2/memory/1284-101-0x00007FF712FE0000-0x00007FF7133D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-92.dat	xmrig
behavioral2/memory/1568-89-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp	xmrig
behavioral2/memory/3152-81-0x00007FF74BD80000-0x00007FF74C176000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-68.dat	xmrig
behavioral2/files/0x0007000000023417-65.dat	xmrig
behavioral2/memory/536-64-0x00007FF790770000-0x00007FF790B66000-memory.dmp	xmrig
behavioral2/memory/4772-39-0x00007FF6BBE50000-0x00007FF6BC246000-memory.dmp	xmrig
behavioral2/memory/4180-38-0x00007FF709370000-0x00007FF709766000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-30.dat	xmrig
behavioral2/files/0x000700000002340d-18.dat	xmrig
behavioral2/memory/1332-14-0x00007FF6A0520000-0x00007FF6A0916000-memory.dmp	xmrig
behavioral2/memory/1568-2344-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp	xmrig
behavioral2/memory/4064-2345-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp	xmrig
behavioral2/memory/1332-2348-0x00007FF6A0520000-0x00007FF6A0916000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	4460	powershell.exe
12	4460	powershell.exe
14	4460	powershell.exe
15	4460	powershell.exe
17	4460	powershell.exe
18	4460	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4460	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1332	fWpMsKh.exe
4180	SQYbUcy.exe
4772	OXzjJyJ.exe
3700	omODPmW.exe
536	JLRieVU.exe
3152	BgVAFHu.exe
1464	gWPkJeJ.exe
1440	iCFsNOQ.exe
4676	vmtKTOy.exe
1568	eMCANna.exe
1284	wWCqpXT.exe
452	JcVZaKd.exe
4064	MFTDoQZ.exe
2608	swncovU.exe
1456	pvwdUPQ.exe
2220	zzKJBxN.exe
3724	jSBMRSp.exe
3424	pybMqDJ.exe
828	SSVsQoL.exe
2588	sqfLyMb.exe
1576	QwfVQNf.exe
2916	hijePgV.exe
1448	RTIBfbd.exe
3084	yRRfaHr.exe
2708	OsnieXJ.exe
1664	XkhIoPM.exe
1396	FeebQYG.exe
1240	VhFYhbZ.exe
2476	EnMlmSs.exe
4340	cQSfmWd.exe
1772	NshdSfy.exe
3448	oQjFwiX.exe
2384	IBZXzFe.exe
4188	txzyLMg.exe
4756	HIqZdjA.exe
1964	hlOYlGz.exe
4880	ZoowvZE.exe
1828	hGPUWUD.exe
4412	jHKzfMq.exe
3896	AghvLfP.exe
4992	qQZQVHC.exe
1912	EMuVdIN.exe
380	cTJdMio.exe
3980	eixaiyL.exe
1504	CySMnpq.exe
516	CaiNYrc.exe
1548	HpekItW.exe
4824	jJosUXz.exe
2672	suATLbf.exe
3040	zPQCniu.exe
4372	AfZqoMf.exe
3520	KrPELoW.exe
4856	eJLYsaA.exe
4148	dgtBLjX.exe
3716	ADuhFqD.exe
4116	jRhWDZk.exe
5064	jjYnxLc.exe
2680	KgsJiYH.exe
4768	lCUIhse.exe
3268	yBbGVJr.exe
4300	maEqYMO.exe
3552	SloJNbG.exe
4496	LSiHFMA.exe
3356	uWyEqPm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1988-0-0x00007FF779180000-0x00007FF779576000-memory.dmp	upx
behavioral2/files/0x00090000000233f4-6.dat	upx
behavioral2/files/0x000700000002340c-13.dat	upx
behavioral2/files/0x000700000002340f-26.dat	upx
behavioral2/files/0x0007000000023410-32.dat	upx
behavioral2/files/0x0007000000023412-52.dat	upx
behavioral2/files/0x0007000000023413-60.dat	upx
behavioral2/files/0x0007000000023418-72.dat	upx
behavioral2/files/0x0007000000023419-83.dat	upx
behavioral2/files/0x000700000002341b-96.dat	upx
behavioral2/files/0x000700000002341a-105.dat	upx
behavioral2/files/0x0008000000023414-114.dat	upx
behavioral2/memory/3424-120-0x00007FF6A2340000-0x00007FF6A2736000-memory.dmp	upx
behavioral2/memory/3700-122-0x00007FF6502F0000-0x00007FF6506E6000-memory.dmp	upx
behavioral2/memory/4676-125-0x00007FF772010000-0x00007FF772406000-memory.dmp	upx
behavioral2/memory/2220-128-0x00007FF673830000-0x00007FF673C26000-memory.dmp	upx
behavioral2/memory/828-129-0x00007FF6A80E0000-0x00007FF6A84D6000-memory.dmp	upx
behavioral2/memory/2608-127-0x00007FF771C30000-0x00007FF772026000-memory.dmp	upx
behavioral2/files/0x0008000000023409-132.dat	upx
behavioral2/files/0x000700000002341e-148.dat	upx
behavioral2/files/0x0007000000023420-165.dat	upx
behavioral2/memory/2916-197-0x00007FF670540000-0x00007FF670936000-memory.dmp	upx
behavioral2/memory/3084-211-0x00007FF689370000-0x00007FF689766000-memory.dmp	upx
behavioral2/memory/1448-210-0x00007FF6E10B0000-0x00007FF6E14A6000-memory.dmp	upx
behavioral2/files/0x0007000000023425-200.dat	upx
behavioral2/files/0x0007000000023424-198.dat	upx
behavioral2/files/0x0007000000023423-195.dat	upx
behavioral2/files/0x0007000000023422-193.dat	upx
behavioral2/memory/1576-192-0x00007FF718B10000-0x00007FF718F06000-memory.dmp	upx
behavioral2/memory/2588-191-0x00007FF6B16A0000-0x00007FF6B1A96000-memory.dmp	upx
behavioral2/files/0x000700000002342d-190.dat	upx
behavioral2/files/0x000700000002342c-189.dat	upx
behavioral2/files/0x000700000002342b-188.dat	upx
behavioral2/files/0x000700000002342a-187.dat	upx
behavioral2/files/0x0007000000023429-186.dat	upx
behavioral2/files/0x0007000000023428-185.dat	upx
behavioral2/files/0x0007000000023427-184.dat	upx
behavioral2/files/0x0007000000023426-183.dat	upx
behavioral2/files/0x0007000000023421-181.dat	upx
behavioral2/files/0x000700000002341f-153.dat	upx
behavioral2/memory/452-126-0x00007FF7C2690000-0x00007FF7C2A86000-memory.dmp	upx
behavioral2/memory/1440-124-0x00007FF637B80000-0x00007FF637F76000-memory.dmp	upx
behavioral2/memory/1464-123-0x00007FF666480000-0x00007FF666876000-memory.dmp	upx
behavioral2/memory/3724-119-0x00007FF743ED0000-0x00007FF7442C6000-memory.dmp	upx
behavioral2/files/0x000700000002341d-117.dat	upx
behavioral2/memory/1456-116-0x00007FF64FE00000-0x00007FF6501F6000-memory.dmp	upx
behavioral2/files/0x000700000002341c-112.dat	upx
behavioral2/files/0x0008000000023415-108.dat	upx
behavioral2/memory/4064-107-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp	upx
behavioral2/memory/1284-101-0x00007FF712FE0000-0x00007FF7133D6000-memory.dmp	upx
behavioral2/files/0x0007000000023416-92.dat	upx
behavioral2/memory/1568-89-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp	upx
behavioral2/memory/3152-81-0x00007FF74BD80000-0x00007FF74C176000-memory.dmp	upx
behavioral2/files/0x0007000000023411-68.dat	upx
behavioral2/files/0x0007000000023417-65.dat	upx
behavioral2/memory/536-64-0x00007FF790770000-0x00007FF790B66000-memory.dmp	upx
behavioral2/memory/4772-39-0x00007FF6BBE50000-0x00007FF6BC246000-memory.dmp	upx
behavioral2/memory/4180-38-0x00007FF709370000-0x00007FF709766000-memory.dmp	upx
behavioral2/files/0x000700000002340e-30.dat	upx
behavioral2/files/0x000700000002340d-18.dat	upx
behavioral2/memory/1332-14-0x00007FF6A0520000-0x00007FF6A0916000-memory.dmp	upx
behavioral2/memory/1568-2344-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp	upx
behavioral2/memory/4064-2345-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp	upx
behavioral2/memory/1332-2348-0x00007FF6A0520000-0x00007FF6A0916000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EWepixx.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\pJPWMzy.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\qcHDgek.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\rmWWjJz.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\PEQDjpS.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\KqbtAAx.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\TkUdqMV.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\BmwliWa.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\JKiCzBz.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\tYiaPde.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\FrqhtuC.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\ckVpffm.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\mVQApHk.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\dOmXhWM.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\SJJrYGc.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\vFzSqbV.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bNmQyaB.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\xIKBLoi.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\AJXidnQ.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\SzrpOHy.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\kfIYJUi.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\PkuWTTA.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\OjscziX.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\DTfEHEH.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\GqqQfww.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\jbDIAgQ.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\mHNjrOq.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\umOhMZr.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\EPMQFSl.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\TMTSGIj.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bPNzeWA.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\KLbOrqg.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\Fcwdlxg.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\GSNGwDo.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\aAvDtWp.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\AjjTrjp.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\bdhndPt.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\SZMGyFG.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\VxMevUC.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\knhnvWi.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\ewDelyF.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\QvYOemb.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\USfJxlS.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\sTcUEmx.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\DxOEiPC.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\BtsIpjg.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\WgLQvTy.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\NXpeNRk.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\FpYIVCm.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\AIZMmGO.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\DJnNcjA.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\zGHOlZZ.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\gYSSjQG.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\QdWIZFC.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\JIvvBHf.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\XGaoYmF.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\hztVxRw.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\obxYDbt.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\NgSBDlg.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\cLfElPi.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\YMYSUWD.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\WWLmbkX.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\vnJomCd.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
File created	C:\Windows\System\hiIDyka.exe	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4460	powershell.exe
4460	powershell.exe
4460	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4460	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4460	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	84
PID 1988 wrote to memory of 4460	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	84
PID 1988 wrote to memory of 1332	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	85
PID 1988 wrote to memory of 1332	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	85
PID 1988 wrote to memory of 4772	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	86
PID 1988 wrote to memory of 4772	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	86
PID 1988 wrote to memory of 4180	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	87
PID 1988 wrote to memory of 4180	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	87
PID 1988 wrote to memory of 3700	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	88
PID 1988 wrote to memory of 3700	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	88
PID 1988 wrote to memory of 536	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	89
PID 1988 wrote to memory of 536	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	89
PID 1988 wrote to memory of 3152	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	90
PID 1988 wrote to memory of 3152	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	90
PID 1988 wrote to memory of 1464	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	91
PID 1988 wrote to memory of 1464	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	91
PID 1988 wrote to memory of 1440	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	92
PID 1988 wrote to memory of 1440	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	92
PID 1988 wrote to memory of 4676	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	93
PID 1988 wrote to memory of 4676	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	93
PID 1988 wrote to memory of 1568	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	94
PID 1988 wrote to memory of 1568	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	94
PID 1988 wrote to memory of 1284	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	95
PID 1988 wrote to memory of 1284	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	95
PID 1988 wrote to memory of 452	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	96
PID 1988 wrote to memory of 452	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	96
PID 1988 wrote to memory of 4064	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	97
PID 1988 wrote to memory of 4064	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	97
PID 1988 wrote to memory of 2608	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	98
PID 1988 wrote to memory of 2608	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	98
PID 1988 wrote to memory of 1456	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	99
PID 1988 wrote to memory of 1456	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	99
PID 1988 wrote to memory of 2220	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	100
PID 1988 wrote to memory of 2220	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	100
PID 1988 wrote to memory of 3724	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	101
PID 1988 wrote to memory of 3724	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	101
PID 1988 wrote to memory of 3424	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	102
PID 1988 wrote to memory of 3424	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	102
PID 1988 wrote to memory of 828	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	103
PID 1988 wrote to memory of 828	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	103
PID 1988 wrote to memory of 2588	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	104
PID 1988 wrote to memory of 2588	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	104
PID 1988 wrote to memory of 1576	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	105
PID 1988 wrote to memory of 1576	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	105
PID 1988 wrote to memory of 2916	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	106
PID 1988 wrote to memory of 2916	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	106
PID 1988 wrote to memory of 1448	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	107
PID 1988 wrote to memory of 1448	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	107
PID 1988 wrote to memory of 3084	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	108
PID 1988 wrote to memory of 3084	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	108
PID 1988 wrote to memory of 2708	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	109
PID 1988 wrote to memory of 2708	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	109
PID 1988 wrote to memory of 1664	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	110
PID 1988 wrote to memory of 1664	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	110
PID 1988 wrote to memory of 1396	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	111
PID 1988 wrote to memory of 1396	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	111
PID 1988 wrote to memory of 1240	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	112
PID 1988 wrote to memory of 1240	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	112
PID 1988 wrote to memory of 2476	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	113
PID 1988 wrote to memory of 2476	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	113
PID 1988 wrote to memory of 4340	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	114
PID 1988 wrote to memory of 4340	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	114
PID 1988 wrote to memory of 1772	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	115
PID 1988 wrote to memory of 1772	1988	35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35942abdb657567e092c512e2ef5a9b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System\fWpMsKh.exe
  C:\Windows\System\fWpMsKh.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\OXzjJyJ.exe
  C:\Windows\System\OXzjJyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\SQYbUcy.exe
  C:\Windows\System\SQYbUcy.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\omODPmW.exe
  C:\Windows\System\omODPmW.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\JLRieVU.exe
  C:\Windows\System\JLRieVU.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\BgVAFHu.exe
  C:\Windows\System\BgVAFHu.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\gWPkJeJ.exe
  C:\Windows\System\gWPkJeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\iCFsNOQ.exe
  C:\Windows\System\iCFsNOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\vmtKTOy.exe
  C:\Windows\System\vmtKTOy.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\eMCANna.exe
  C:\Windows\System\eMCANna.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\wWCqpXT.exe
  C:\Windows\System\wWCqpXT.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\JcVZaKd.exe
  C:\Windows\System\JcVZaKd.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\MFTDoQZ.exe
  C:\Windows\System\MFTDoQZ.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\swncovU.exe
  C:\Windows\System\swncovU.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\pvwdUPQ.exe
  C:\Windows\System\pvwdUPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\zzKJBxN.exe
  C:\Windows\System\zzKJBxN.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\jSBMRSp.exe
  C:\Windows\System\jSBMRSp.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\pybMqDJ.exe
  C:\Windows\System\pybMqDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\SSVsQoL.exe
  C:\Windows\System\SSVsQoL.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\sqfLyMb.exe
  C:\Windows\System\sqfLyMb.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\QwfVQNf.exe
  C:\Windows\System\QwfVQNf.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\hijePgV.exe
  C:\Windows\System\hijePgV.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RTIBfbd.exe
  C:\Windows\System\RTIBfbd.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\yRRfaHr.exe
  C:\Windows\System\yRRfaHr.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\OsnieXJ.exe
  C:\Windows\System\OsnieXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\XkhIoPM.exe
  C:\Windows\System\XkhIoPM.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\FeebQYG.exe
  C:\Windows\System\FeebQYG.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\VhFYhbZ.exe
  C:\Windows\System\VhFYhbZ.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\EnMlmSs.exe
  C:\Windows\System\EnMlmSs.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\cQSfmWd.exe
  C:\Windows\System\cQSfmWd.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\NshdSfy.exe
  C:\Windows\System\NshdSfy.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\oQjFwiX.exe
  C:\Windows\System\oQjFwiX.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\IBZXzFe.exe
  C:\Windows\System\IBZXzFe.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\txzyLMg.exe
  C:\Windows\System\txzyLMg.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\HIqZdjA.exe
  C:\Windows\System\HIqZdjA.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\hlOYlGz.exe
  C:\Windows\System\hlOYlGz.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ZoowvZE.exe
  C:\Windows\System\ZoowvZE.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\hGPUWUD.exe
  C:\Windows\System\hGPUWUD.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\jHKzfMq.exe
  C:\Windows\System\jHKzfMq.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\AghvLfP.exe
  C:\Windows\System\AghvLfP.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\qQZQVHC.exe
  C:\Windows\System\qQZQVHC.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\EMuVdIN.exe
  C:\Windows\System\EMuVdIN.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\eixaiyL.exe
  C:\Windows\System\eixaiyL.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\cTJdMio.exe
  C:\Windows\System\cTJdMio.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\CySMnpq.exe
  C:\Windows\System\CySMnpq.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\CaiNYrc.exe
  C:\Windows\System\CaiNYrc.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\HpekItW.exe
  C:\Windows\System\HpekItW.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\jJosUXz.exe
  C:\Windows\System\jJosUXz.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\suATLbf.exe
  C:\Windows\System\suATLbf.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\zPQCniu.exe
  C:\Windows\System\zPQCniu.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\AfZqoMf.exe
  C:\Windows\System\AfZqoMf.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\KrPELoW.exe
  C:\Windows\System\KrPELoW.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\eJLYsaA.exe
  C:\Windows\System\eJLYsaA.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\dgtBLjX.exe
  C:\Windows\System\dgtBLjX.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\ADuhFqD.exe
  C:\Windows\System\ADuhFqD.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\jRhWDZk.exe
  C:\Windows\System\jRhWDZk.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\jjYnxLc.exe
  C:\Windows\System\jjYnxLc.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\KgsJiYH.exe
  C:\Windows\System\KgsJiYH.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\lCUIhse.exe
  C:\Windows\System\lCUIhse.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\yBbGVJr.exe
  C:\Windows\System\yBbGVJr.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\maEqYMO.exe
  C:\Windows\System\maEqYMO.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\SloJNbG.exe
  C:\Windows\System\SloJNbG.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\LSiHFMA.exe
  C:\Windows\System\LSiHFMA.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\uWyEqPm.exe
  C:\Windows\System\uWyEqPm.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\iDbBFOE.exe
  C:\Windows\System\iDbBFOE.exe
  2⤵
  PID:3180
- C:\Windows\System\HCmsCMz.exe
  C:\Windows\System\HCmsCMz.exe
  2⤵
  PID:1952
- C:\Windows\System\oXhKMDG.exe
  C:\Windows\System\oXhKMDG.exe
  2⤵
  PID:2936
- C:\Windows\System\OpOzdQW.exe
  C:\Windows\System\OpOzdQW.exe
  2⤵
  PID:4804
- C:\Windows\System\CytNlCP.exe
  C:\Windows\System\CytNlCP.exe
  2⤵
  PID:2944
- C:\Windows\System\yhJgePK.exe
  C:\Windows\System\yhJgePK.exe
  2⤵
  PID:3376
- C:\Windows\System\ZufPooQ.exe
  C:\Windows\System\ZufPooQ.exe
  2⤵
  PID:4344
- C:\Windows\System\AqRfugj.exe
  C:\Windows\System\AqRfugj.exe
  2⤵
  PID:3208
- C:\Windows\System\LVpSPnI.exe
  C:\Windows\System\LVpSPnI.exe
  2⤵
  PID:4336
- C:\Windows\System\nbIPZbC.exe
  C:\Windows\System\nbIPZbC.exe
  2⤵
  PID:3976
- C:\Windows\System\OLtJUmK.exe
  C:\Windows\System\OLtJUmK.exe
  2⤵
  PID:3924
- C:\Windows\System\fzTGETc.exe
  C:\Windows\System\fzTGETc.exe
  2⤵
  PID:2520
- C:\Windows\System\YxsthoP.exe
  C:\Windows\System\YxsthoP.exe
  2⤵
  PID:5032
- C:\Windows\System\NiwloiO.exe
  C:\Windows\System\NiwloiO.exe
  2⤵
  PID:2328
- C:\Windows\System\EDwVtXN.exe
  C:\Windows\System\EDwVtXN.exe
  2⤵
  PID:780
- C:\Windows\System\ivBLuRi.exe
  C:\Windows\System\ivBLuRi.exe
  2⤵
  PID:1976
- C:\Windows\System\oqXSmFH.exe
  C:\Windows\System\oqXSmFH.exe
  2⤵
  PID:1172
- C:\Windows\System\mwJROpx.exe
  C:\Windows\System\mwJROpx.exe
  2⤵
  PID:4360
- C:\Windows\System\fPveIZV.exe
  C:\Windows\System\fPveIZV.exe
  2⤵
  PID:396
- C:\Windows\System\uTVBakU.exe
  C:\Windows\System\uTVBakU.exe
  2⤵
  PID:3808
- C:\Windows\System\gZtnyMG.exe
  C:\Windows\System\gZtnyMG.exe
  2⤵
  PID:4968
- C:\Windows\System\AlEZAfc.exe
  C:\Windows\System\AlEZAfc.exe
  2⤵
  PID:3748
- C:\Windows\System\QPhxohY.exe
  C:\Windows\System\QPhxohY.exe
  2⤵
  PID:4724
- C:\Windows\System\UoWnlVI.exe
  C:\Windows\System\UoWnlVI.exe
  2⤵
  PID:2968
- C:\Windows\System\MrHaUgr.exe
  C:\Windows\System\MrHaUgr.exe
  2⤵
  PID:1056
- C:\Windows\System\JIzFQAt.exe
  C:\Windows\System\JIzFQAt.exe
  2⤵
  PID:2368
- C:\Windows\System\sABoizn.exe
  C:\Windows\System\sABoizn.exe
  2⤵
  PID:5128
- C:\Windows\System\JAApdTk.exe
  C:\Windows\System\JAApdTk.exe
  2⤵
  PID:5152
- C:\Windows\System\EeQMtJr.exe
  C:\Windows\System\EeQMtJr.exe
  2⤵
  PID:5168
- C:\Windows\System\sCVdSpz.exe
  C:\Windows\System\sCVdSpz.exe
  2⤵
  PID:5184
- C:\Windows\System\SrNwnSx.exe
  C:\Windows\System\SrNwnSx.exe
  2⤵
  PID:5232
- C:\Windows\System\aaFqEeE.exe
  C:\Windows\System\aaFqEeE.exe
  2⤵
  PID:5276
- C:\Windows\System\RusOieY.exe
  C:\Windows\System\RusOieY.exe
  2⤵
  PID:5304
- C:\Windows\System\gsdFEXH.exe
  C:\Windows\System\gsdFEXH.exe
  2⤵
  PID:5328
- C:\Windows\System\MQGLtXw.exe
  C:\Windows\System\MQGLtXw.exe
  2⤵
  PID:5356
- C:\Windows\System\cUZCqYb.exe
  C:\Windows\System\cUZCqYb.exe
  2⤵
  PID:5392
- C:\Windows\System\aZtsMpJ.exe
  C:\Windows\System\aZtsMpJ.exe
  2⤵
  PID:5420
- C:\Windows\System\oSCadQq.exe
  C:\Windows\System\oSCadQq.exe
  2⤵
  PID:5460
- C:\Windows\System\rVaefoH.exe
  C:\Windows\System\rVaefoH.exe
  2⤵
  PID:5492
- C:\Windows\System\twAtQXK.exe
  C:\Windows\System\twAtQXK.exe
  2⤵
  PID:5520
- C:\Windows\System\JoowmeV.exe
  C:\Windows\System\JoowmeV.exe
  2⤵
  PID:5536
- C:\Windows\System\ZJhGTrD.exe
  C:\Windows\System\ZJhGTrD.exe
  2⤵
  PID:5576
- C:\Windows\System\wmOCmYE.exe
  C:\Windows\System\wmOCmYE.exe
  2⤵
  PID:5604
- C:\Windows\System\xQTVWEl.exe
  C:\Windows\System\xQTVWEl.exe
  2⤵
  PID:5652
- C:\Windows\System\lmTOYRs.exe
  C:\Windows\System\lmTOYRs.exe
  2⤵
  PID:5692
- C:\Windows\System\iVLCEMT.exe
  C:\Windows\System\iVLCEMT.exe
  2⤵
  PID:5736
- C:\Windows\System\UdHybJG.exe
  C:\Windows\System\UdHybJG.exe
  2⤵
  PID:5776
- C:\Windows\System\GfBCTfy.exe
  C:\Windows\System\GfBCTfy.exe
  2⤵
  PID:5808
- C:\Windows\System\KBnmWzr.exe
  C:\Windows\System\KBnmWzr.exe
  2⤵
  PID:5832
- C:\Windows\System\ipJSaIi.exe
  C:\Windows\System\ipJSaIi.exe
  2⤵
  PID:5856
- C:\Windows\System\PQZiAaJ.exe
  C:\Windows\System\PQZiAaJ.exe
  2⤵
  PID:5904
- C:\Windows\System\dqwwLcK.exe
  C:\Windows\System\dqwwLcK.exe
  2⤵
  PID:5928
- C:\Windows\System\jNtPCVR.exe
  C:\Windows\System\jNtPCVR.exe
  2⤵
  PID:5972
- C:\Windows\System\KLbOrqg.exe
  C:\Windows\System\KLbOrqg.exe
  2⤵
  PID:5996
- C:\Windows\System\XgnBOeP.exe
  C:\Windows\System\XgnBOeP.exe
  2⤵
  PID:6020
- C:\Windows\System\IlqAmUI.exe
  C:\Windows\System\IlqAmUI.exe
  2⤵
  PID:6056
- C:\Windows\System\Zvdgwir.exe
  C:\Windows\System\Zvdgwir.exe
  2⤵
  PID:6084
- C:\Windows\System\xhmnXoi.exe
  C:\Windows\System\xhmnXoi.exe
  2⤵
  PID:6132
- C:\Windows\System\EewpNDB.exe
  C:\Windows\System\EewpNDB.exe
  2⤵
  PID:5160
- C:\Windows\System\LtNMFcH.exe
  C:\Windows\System\LtNMFcH.exe
  2⤵
  PID:5216
- C:\Windows\System\YtPTrMF.exe
  C:\Windows\System\YtPTrMF.exe
  2⤵
  PID:5296
- C:\Windows\System\KcnTmsE.exe
  C:\Windows\System\KcnTmsE.exe
  2⤵
  PID:5384
- C:\Windows\System\mFXVcne.exe
  C:\Windows\System\mFXVcne.exe
  2⤵
  PID:5480
- C:\Windows\System\FDUmamR.exe
  C:\Windows\System\FDUmamR.exe
  2⤵
  PID:5532
- C:\Windows\System\huFafHa.exe
  C:\Windows\System\huFafHa.exe
  2⤵
  PID:3224
- C:\Windows\System\ppXuTUe.exe
  C:\Windows\System\ppXuTUe.exe
  2⤵
  PID:5644
- C:\Windows\System\jIgzXVl.exe
  C:\Windows\System\jIgzXVl.exe
  2⤵
  PID:5748
- C:\Windows\System\LwyfprR.exe
  C:\Windows\System\LwyfprR.exe
  2⤵
  PID:2576
- C:\Windows\System\RBPtHZm.exe
  C:\Windows\System\RBPtHZm.exe
  2⤵
  PID:5864
- C:\Windows\System\rUCvUDk.exe
  C:\Windows\System\rUCvUDk.exe
  2⤵
  PID:5440
- C:\Windows\System\BBnycmi.exe
  C:\Windows\System\BBnycmi.exe
  2⤵
  PID:5988
- C:\Windows\System\LOOkWeX.exe
  C:\Windows\System\LOOkWeX.exe
  2⤵
  PID:6004
- C:\Windows\System\pOshtkJ.exe
  C:\Windows\System\pOshtkJ.exe
  2⤵
  PID:6072
- C:\Windows\System\UrQRhqp.exe
  C:\Windows\System\UrQRhqp.exe
  2⤵
  PID:5180
- C:\Windows\System\oBDSCwK.exe
  C:\Windows\System\oBDSCwK.exe
  2⤵
  PID:5340
- C:\Windows\System\QNQKzXO.exe
  C:\Windows\System\QNQKzXO.exe
  2⤵
  PID:5500
- C:\Windows\System\ZdbRRCJ.exe
  C:\Windows\System\ZdbRRCJ.exe
  2⤵
  PID:5688
- C:\Windows\System\RnqGIGO.exe
  C:\Windows\System\RnqGIGO.exe
  2⤵
  PID:1692
- C:\Windows\System\LyTIbEH.exe
  C:\Windows\System\LyTIbEH.exe
  2⤵
  PID:5896
- C:\Windows\System\nrbGThz.exe
  C:\Windows\System\nrbGThz.exe
  2⤵
  PID:5640
- C:\Windows\System\YEhewxD.exe
  C:\Windows\System\YEhewxD.exe
  2⤵
  PID:6068
- C:\Windows\System\UaYUOBZ.exe
  C:\Windows\System\UaYUOBZ.exe
  2⤵
  PID:1512
- C:\Windows\System\MtrtYcH.exe
  C:\Windows\System\MtrtYcH.exe
  2⤵
  PID:2304
- C:\Windows\System\PaoHUAI.exe
  C:\Windows\System\PaoHUAI.exe
  2⤵
  PID:3780
- C:\Windows\System\CzEzOGa.exe
  C:\Windows\System\CzEzOGa.exe
  2⤵
  PID:4380
- C:\Windows\System\qYMQCex.exe
  C:\Windows\System\qYMQCex.exe
  2⤵
  PID:6156
- C:\Windows\System\rVKtVPF.exe
  C:\Windows\System\rVKtVPF.exe
  2⤵
  PID:6192
- C:\Windows\System\zgqxMOI.exe
  C:\Windows\System\zgqxMOI.exe
  2⤵
  PID:6220
- C:\Windows\System\uMMXfKX.exe
  C:\Windows\System\uMMXfKX.exe
  2⤵
  PID:6248
- C:\Windows\System\wAGwvrm.exe
  C:\Windows\System\wAGwvrm.exe
  2⤵
  PID:6268
- C:\Windows\System\UTSTTyM.exe
  C:\Windows\System\UTSTTyM.exe
  2⤵
  PID:6284
- C:\Windows\System\ZFbahkZ.exe
  C:\Windows\System\ZFbahkZ.exe
  2⤵
  PID:6300
- C:\Windows\System\FtmscjW.exe
  C:\Windows\System\FtmscjW.exe
  2⤵
  PID:6348
- C:\Windows\System\HWnfcpf.exe
  C:\Windows\System\HWnfcpf.exe
  2⤵
  PID:6388
- C:\Windows\System\PcZcFiG.exe
  C:\Windows\System\PcZcFiG.exe
  2⤵
  PID:6420
- C:\Windows\System\GdMpyka.exe
  C:\Windows\System\GdMpyka.exe
  2⤵
  PID:6440
- C:\Windows\System\hwcVTfp.exe
  C:\Windows\System\hwcVTfp.exe
  2⤵
  PID:6468
- C:\Windows\System\JkNiQsC.exe
  C:\Windows\System\JkNiQsC.exe
  2⤵
  PID:6484
- C:\Windows\System\KloKrKf.exe
  C:\Windows\System\KloKrKf.exe
  2⤵
  PID:6508
- C:\Windows\System\DpfUIUR.exe
  C:\Windows\System\DpfUIUR.exe
  2⤵
  PID:6560
- C:\Windows\System\hDMlkPm.exe
  C:\Windows\System\hDMlkPm.exe
  2⤵
  PID:6588
- C:\Windows\System\mBJLdVE.exe
  C:\Windows\System\mBJLdVE.exe
  2⤵
  PID:6624
- C:\Windows\System\bNKkPFl.exe
  C:\Windows\System\bNKkPFl.exe
  2⤵
  PID:6644
- C:\Windows\System\yJINXxS.exe
  C:\Windows\System\yJINXxS.exe
  2⤵
  PID:6684
- C:\Windows\System\wPQDolv.exe
  C:\Windows\System\wPQDolv.exe
  2⤵
  PID:6704
- C:\Windows\System\wDmwNZM.exe
  C:\Windows\System\wDmwNZM.exe
  2⤵
  PID:6732
- C:\Windows\System\fuxYJli.exe
  C:\Windows\System\fuxYJli.exe
  2⤵
  PID:6760
- C:\Windows\System\GfgluLb.exe
  C:\Windows\System\GfgluLb.exe
  2⤵
  PID:6776
- C:\Windows\System\kvRxvdm.exe
  C:\Windows\System\kvRxvdm.exe
  2⤵
  PID:6824
- C:\Windows\System\SfRXBis.exe
  C:\Windows\System\SfRXBis.exe
  2⤵
  PID:6844
- C:\Windows\System\gvdXIGs.exe
  C:\Windows\System\gvdXIGs.exe
  2⤵
  PID:6872
- C:\Windows\System\viAvlye.exe
  C:\Windows\System\viAvlye.exe
  2⤵
  PID:6896
- C:\Windows\System\cuLEXgL.exe
  C:\Windows\System\cuLEXgL.exe
  2⤵
  PID:6928
- C:\Windows\System\XsPUppe.exe
  C:\Windows\System\XsPUppe.exe
  2⤵
  PID:6956
- C:\Windows\System\bqsccbk.exe
  C:\Windows\System\bqsccbk.exe
  2⤵
  PID:7000
- C:\Windows\System\nNRPXgl.exe
  C:\Windows\System\nNRPXgl.exe
  2⤵
  PID:7040
- C:\Windows\System\VViwUmz.exe
  C:\Windows\System\VViwUmz.exe
  2⤵
  PID:7064
- C:\Windows\System\eoKDTSQ.exe
  C:\Windows\System\eoKDTSQ.exe
  2⤵
  PID:7108
- C:\Windows\System\VsscgDh.exe
  C:\Windows\System\VsscgDh.exe
  2⤵
  PID:7144
- C:\Windows\System\ytBFMzJ.exe
  C:\Windows\System\ytBFMzJ.exe
  2⤵
  PID:5144
- C:\Windows\System\PmhkLSE.exe
  C:\Windows\System\PmhkLSE.exe
  2⤵
  PID:6148
- C:\Windows\System\lzDfEHW.exe
  C:\Windows\System\lzDfEHW.exe
  2⤵
  PID:5828
- C:\Windows\System\lGbcIYV.exe
  C:\Windows\System\lGbcIYV.exe
  2⤵
  PID:6292
- C:\Windows\System\iIoYdPR.exe
  C:\Windows\System\iIoYdPR.exe
  2⤵
  PID:6380
- C:\Windows\System\bZQfBDg.exe
  C:\Windows\System\bZQfBDg.exe
  2⤵
  PID:6460
- C:\Windows\System\dChtljN.exe
  C:\Windows\System\dChtljN.exe
  2⤵
  PID:6492
- C:\Windows\System\gShmZbb.exe
  C:\Windows\System\gShmZbb.exe
  2⤵
  PID:6544
- C:\Windows\System\xgFWTzZ.exe
  C:\Windows\System\xgFWTzZ.exe
  2⤵
  PID:6640
- C:\Windows\System\OUvfehZ.exe
  C:\Windows\System\OUvfehZ.exe
  2⤵
  PID:6696
- C:\Windows\System\YdOeuPJ.exe
  C:\Windows\System\YdOeuPJ.exe
  2⤵
  PID:6752
- C:\Windows\System\cxiBdVF.exe
  C:\Windows\System\cxiBdVF.exe
  2⤵
  PID:6836
- C:\Windows\System\sVHHWqm.exe
  C:\Windows\System\sVHHWqm.exe
  2⤵
  PID:6920
- C:\Windows\System\oVPgRTB.exe
  C:\Windows\System\oVPgRTB.exe
  2⤵
  PID:6988
- C:\Windows\System\TnjCCcZ.exe
  C:\Windows\System\TnjCCcZ.exe
  2⤵
  PID:7076
- C:\Windows\System\USfJxlS.exe
  C:\Windows\System\USfJxlS.exe
  2⤵
  PID:7152
- C:\Windows\System\vsirNmD.exe
  C:\Windows\System\vsirNmD.exe
  2⤵
  PID:6264
- C:\Windows\System\sLEZoer.exe
  C:\Windows\System\sLEZoer.exe
  2⤵
  PID:6356
- C:\Windows\System\PPmQLcU.exe
  C:\Windows\System\PPmQLcU.exe
  2⤵
  PID:6500
- C:\Windows\System\MUHdGYh.exe
  C:\Windows\System\MUHdGYh.exe
  2⤵
  PID:6728
- C:\Windows\System\ISKebxZ.exe
  C:\Windows\System\ISKebxZ.exe
  2⤵
  PID:3464
- C:\Windows\System\yKVDAjr.exe
  C:\Windows\System\yKVDAjr.exe
  2⤵
  PID:6948
- C:\Windows\System\pqErOSJ.exe
  C:\Windows\System\pqErOSJ.exe
  2⤵
  PID:7104
- C:\Windows\System\QMrLmNc.exe
  C:\Windows\System\QMrLmNc.exe
  2⤵
  PID:6228
- C:\Windows\System\UkTgHTl.exe
  C:\Windows\System\UkTgHTl.exe
  2⤵
  PID:6636
- C:\Windows\System\LFjzrGN.exe
  C:\Windows\System\LFjzrGN.exe
  2⤵
  PID:7056
- C:\Windows\System\zSusgPJ.exe
  C:\Windows\System\zSusgPJ.exe
  2⤵
  PID:6476
- C:\Windows\System\rPFNvCi.exe
  C:\Windows\System\rPFNvCi.exe
  2⤵
  PID:7136
- C:\Windows\System\TfaYLIF.exe
  C:\Windows\System\TfaYLIF.exe
  2⤵
  PID:7188
- C:\Windows\System\hVepBet.exe
  C:\Windows\System\hVepBet.exe
  2⤵
  PID:7232
- C:\Windows\System\EtNbVzM.exe
  C:\Windows\System\EtNbVzM.exe
  2⤵
  PID:7260
- C:\Windows\System\FyHsTyY.exe
  C:\Windows\System\FyHsTyY.exe
  2⤵
  PID:7312
- C:\Windows\System\cYRAOON.exe
  C:\Windows\System\cYRAOON.exe
  2⤵
  PID:7348
- C:\Windows\System\ngNHrQR.exe
  C:\Windows\System\ngNHrQR.exe
  2⤵
  PID:7396
- C:\Windows\System\gYsoOtE.exe
  C:\Windows\System\gYsoOtE.exe
  2⤵
  PID:7432
- C:\Windows\System\hGSrcfK.exe
  C:\Windows\System\hGSrcfK.exe
  2⤵
  PID:7452
- C:\Windows\System\sCivqtc.exe
  C:\Windows\System\sCivqtc.exe
  2⤵
  PID:7480
- C:\Windows\System\HFqSmIB.exe
  C:\Windows\System\HFqSmIB.exe
  2⤵
  PID:7500
- C:\Windows\System\qROlryB.exe
  C:\Windows\System\qROlryB.exe
  2⤵
  PID:7536
- C:\Windows\System\edlfEml.exe
  C:\Windows\System\edlfEml.exe
  2⤵
  PID:7604
- C:\Windows\System\DUGSIEz.exe
  C:\Windows\System\DUGSIEz.exe
  2⤵
  PID:7640
- C:\Windows\System\YCsjQJb.exe
  C:\Windows\System\YCsjQJb.exe
  2⤵
  PID:7712
- C:\Windows\System\SYERTop.exe
  C:\Windows\System\SYERTop.exe
  2⤵
  PID:7740
- C:\Windows\System\tvRHVkP.exe
  C:\Windows\System\tvRHVkP.exe
  2⤵
  PID:7760
- C:\Windows\System\pqCJvbF.exe
  C:\Windows\System\pqCJvbF.exe
  2⤵
  PID:7776
- C:\Windows\System\xldpHIA.exe
  C:\Windows\System\xldpHIA.exe
  2⤵
  PID:7812
- C:\Windows\System\sGksfWP.exe
  C:\Windows\System\sGksfWP.exe
  2⤵
  PID:7860
- C:\Windows\System\JMqndCK.exe
  C:\Windows\System\JMqndCK.exe
  2⤵
  PID:7888
- C:\Windows\System\BPLrKKl.exe
  C:\Windows\System\BPLrKKl.exe
  2⤵
  PID:7904
- C:\Windows\System\BtwiICi.exe
  C:\Windows\System\BtwiICi.exe
  2⤵
  PID:7936
- C:\Windows\System\jqxkpWl.exe
  C:\Windows\System\jqxkpWl.exe
  2⤵
  PID:7976
- C:\Windows\System\oYmAIBT.exe
  C:\Windows\System\oYmAIBT.exe
  2⤵
  PID:8012
- C:\Windows\System\KNGJavY.exe
  C:\Windows\System\KNGJavY.exe
  2⤵
  PID:8056
- C:\Windows\System\EMiFmvQ.exe
  C:\Windows\System\EMiFmvQ.exe
  2⤵
  PID:8076
- C:\Windows\System\pUKfrhs.exe
  C:\Windows\System\pUKfrhs.exe
  2⤵
  PID:8108
- C:\Windows\System\jwXweAc.exe
  C:\Windows\System\jwXweAc.exe
  2⤵
  PID:8136
- C:\Windows\System\JKxFbLB.exe
  C:\Windows\System\JKxFbLB.exe
  2⤵
  PID:8164
- C:\Windows\System\VLMuRNg.exe
  C:\Windows\System\VLMuRNg.exe
  2⤵
  PID:6480
- C:\Windows\System\JoYXXty.exe
  C:\Windows\System\JoYXXty.exe
  2⤵
  PID:7200
- C:\Windows\System\AIZMmGO.exe
  C:\Windows\System\AIZMmGO.exe
  2⤵
  PID:7252
- C:\Windows\System\tthvUBh.exe
  C:\Windows\System\tthvUBh.exe
  2⤵
  PID:7304
- C:\Windows\System\YdkLJKs.exe
  C:\Windows\System\YdkLJKs.exe
  2⤵
  PID:4072
- C:\Windows\System\ZMBAJva.exe
  C:\Windows\System\ZMBAJva.exe
  2⤵
  PID:7516
- C:\Windows\System\uDRkLkm.exe
  C:\Windows\System\uDRkLkm.exe
  2⤵
  PID:7684
- C:\Windows\System\hGKnqTN.exe
  C:\Windows\System\hGKnqTN.exe
  2⤵
  PID:7768
- C:\Windows\System\XzaEkKv.exe
  C:\Windows\System\XzaEkKv.exe
  2⤵
  PID:7836
- C:\Windows\System\GiiYkpp.exe
  C:\Windows\System\GiiYkpp.exe
  2⤵
  PID:7896
- C:\Windows\System\iwHVutw.exe
  C:\Windows\System\iwHVutw.exe
  2⤵
  PID:7924
- C:\Windows\System\BGXljLx.exe
  C:\Windows\System\BGXljLx.exe
  2⤵
  PID:8044
- C:\Windows\System\siTQjZD.exe
  C:\Windows\System\siTQjZD.exe
  2⤵
  PID:8116
- C:\Windows\System\GmAmEeQ.exe
  C:\Windows\System\GmAmEeQ.exe
  2⤵
  PID:8184
- C:\Windows\System\hFjLDAV.exe
  C:\Windows\System\hFjLDAV.exe
  2⤵
  PID:7244
- C:\Windows\System\ChvIWrc.exe
  C:\Windows\System\ChvIWrc.exe
  2⤵
  PID:7488
- C:\Windows\System\nxlXWvP.exe
  C:\Windows\System\nxlXWvP.exe
  2⤵
  PID:7736
- C:\Windows\System\oKTAhIA.exe
  C:\Windows\System\oKTAhIA.exe
  2⤵
  PID:7884
- C:\Windows\System\pKWNSwN.exe
  C:\Windows\System\pKWNSwN.exe
  2⤵
  PID:8024
- C:\Windows\System\LIoSfjO.exe
  C:\Windows\System\LIoSfjO.exe
  2⤵
  PID:7180
- C:\Windows\System\paVsaTJ.exe
  C:\Windows\System\paVsaTJ.exe
  2⤵
  PID:7804
- C:\Windows\System\qsUseWr.exe
  C:\Windows\System\qsUseWr.exe
  2⤵
  PID:7372
- C:\Windows\System\mGbLbso.exe
  C:\Windows\System\mGbLbso.exe
  2⤵
  PID:8160
- C:\Windows\System\syvsLoi.exe
  C:\Windows\System\syvsLoi.exe
  2⤵
  PID:8216
- C:\Windows\System\JZsfkxo.exe
  C:\Windows\System\JZsfkxo.exe
  2⤵
  PID:8232
- C:\Windows\System\gweUhkf.exe
  C:\Windows\System\gweUhkf.exe
  2⤵
  PID:8264
- C:\Windows\System\FcNRyzI.exe
  C:\Windows\System\FcNRyzI.exe
  2⤵
  PID:8288
- C:\Windows\System\YNUhwWX.exe
  C:\Windows\System\YNUhwWX.exe
  2⤵
  PID:8324
- C:\Windows\System\NIFreOF.exe
  C:\Windows\System\NIFreOF.exe
  2⤵
  PID:8356
- C:\Windows\System\fkhDBDF.exe
  C:\Windows\System\fkhDBDF.exe
  2⤵
  PID:8384
- C:\Windows\System\ZkTCuLb.exe
  C:\Windows\System\ZkTCuLb.exe
  2⤵
  PID:8412
- C:\Windows\System\DiySKEO.exe
  C:\Windows\System\DiySKEO.exe
  2⤵
  PID:8440
- C:\Windows\System\REBPUoK.exe
  C:\Windows\System\REBPUoK.exe
  2⤵
  PID:8460
- C:\Windows\System\AeSWCAN.exe
  C:\Windows\System\AeSWCAN.exe
  2⤵
  PID:8496
- C:\Windows\System\faxvVvR.exe
  C:\Windows\System\faxvVvR.exe
  2⤵
  PID:8524
- C:\Windows\System\GjFanSh.exe
  C:\Windows\System\GjFanSh.exe
  2⤵
  PID:8552
- C:\Windows\System\AAJYgJU.exe
  C:\Windows\System\AAJYgJU.exe
  2⤵
  PID:8580
- C:\Windows\System\xQmeCvh.exe
  C:\Windows\System\xQmeCvh.exe
  2⤵
  PID:8608
- C:\Windows\System\WyAXHGq.exe
  C:\Windows\System\WyAXHGq.exe
  2⤵
  PID:8636
- C:\Windows\System\FKFpTIe.exe
  C:\Windows\System\FKFpTIe.exe
  2⤵
  PID:8668
- C:\Windows\System\LHajkGV.exe
  C:\Windows\System\LHajkGV.exe
  2⤵
  PID:8696
- C:\Windows\System\eiMmYuN.exe
  C:\Windows\System\eiMmYuN.exe
  2⤵
  PID:8724
- C:\Windows\System\cdTwXqr.exe
  C:\Windows\System\cdTwXqr.exe
  2⤵
  PID:8752
- C:\Windows\System\boJjlvt.exe
  C:\Windows\System\boJjlvt.exe
  2⤵
  PID:8788
- C:\Windows\System\iOAqTXU.exe
  C:\Windows\System\iOAqTXU.exe
  2⤵
  PID:8808
- C:\Windows\System\bjRuDvd.exe
  C:\Windows\System\bjRuDvd.exe
  2⤵
  PID:8836
- C:\Windows\System\NPladPn.exe
  C:\Windows\System\NPladPn.exe
  2⤵
  PID:8852
- C:\Windows\System\kkmoUMl.exe
  C:\Windows\System\kkmoUMl.exe
  2⤵
  PID:8880
- C:\Windows\System\uiltfwI.exe
  C:\Windows\System\uiltfwI.exe
  2⤵
  PID:8920
- C:\Windows\System\lRQKFjA.exe
  C:\Windows\System\lRQKFjA.exe
  2⤵
  PID:8948
- C:\Windows\System\lMgiSsi.exe
  C:\Windows\System\lMgiSsi.exe
  2⤵
  PID:8976
- C:\Windows\System\ONFyDYP.exe
  C:\Windows\System\ONFyDYP.exe
  2⤵
  PID:9004
- C:\Windows\System\WQxtRwB.exe
  C:\Windows\System\WQxtRwB.exe
  2⤵
  PID:9020
- C:\Windows\System\MmjEhQZ.exe
  C:\Windows\System\MmjEhQZ.exe
  2⤵
  PID:9060
- C:\Windows\System\PZOEIEd.exe
  C:\Windows\System\PZOEIEd.exe
  2⤵
  PID:9088
- C:\Windows\System\hlMqAGh.exe
  C:\Windows\System\hlMqAGh.exe
  2⤵
  PID:9116
- C:\Windows\System\KNwJYTo.exe
  C:\Windows\System\KNwJYTo.exe
  2⤵
  PID:9132
- C:\Windows\System\ghKJcFX.exe
  C:\Windows\System\ghKJcFX.exe
  2⤵
  PID:9148
- C:\Windows\System\llBxlzB.exe
  C:\Windows\System\llBxlzB.exe
  2⤵
  PID:9192
- C:\Windows\System\tVwAgzb.exe
  C:\Windows\System\tVwAgzb.exe
  2⤵
  PID:8208
- C:\Windows\System\eKdnYgO.exe
  C:\Windows\System\eKdnYgO.exe
  2⤵
  PID:8244
- C:\Windows\System\XjgbTYF.exe
  C:\Windows\System\XjgbTYF.exe
  2⤵
  PID:8300
- C:\Windows\System\WfZJImG.exe
  C:\Windows\System\WfZJImG.exe
  2⤵
  PID:8396
- C:\Windows\System\JqxoPPV.exe
  C:\Windows\System\JqxoPPV.exe
  2⤵
  PID:8468
- C:\Windows\System\BdkkUfL.exe
  C:\Windows\System\BdkkUfL.exe
  2⤵
  PID:8520
- C:\Windows\System\EsnQkse.exe
  C:\Windows\System\EsnQkse.exe
  2⤵
  PID:8592
- C:\Windows\System\nIEVUIl.exe
  C:\Windows\System\nIEVUIl.exe
  2⤵
  PID:8628
- C:\Windows\System\yZyyjSE.exe
  C:\Windows\System\yZyyjSE.exe
  2⤵
  PID:8720
- C:\Windows\System\ZmdfBUK.exe
  C:\Windows\System\ZmdfBUK.exe
  2⤵
  PID:8772
- C:\Windows\System\fzocAAe.exe
  C:\Windows\System\fzocAAe.exe
  2⤵
  PID:8800
- C:\Windows\System\nwOWfeM.exe
  C:\Windows\System\nwOWfeM.exe
  2⤵
  PID:8904
- C:\Windows\System\VzNCnHG.exe
  C:\Windows\System\VzNCnHG.exe
  2⤵
  PID:8968
- C:\Windows\System\LrrsuoQ.exe
  C:\Windows\System\LrrsuoQ.exe
  2⤵
  PID:9052
- C:\Windows\System\YqrnQJY.exe
  C:\Windows\System\YqrnQJY.exe
  2⤵
  PID:9112
- C:\Windows\System\FSGQjQA.exe
  C:\Windows\System\FSGQjQA.exe
  2⤵
  PID:9180
- C:\Windows\System\TuOZGLw.exe
  C:\Windows\System\TuOZGLw.exe
  2⤵
  PID:8280
- C:\Windows\System\uvtysFj.exe
  C:\Windows\System\uvtysFj.exe
  2⤵
  PID:8408
- C:\Windows\System\nFvLZJt.exe
  C:\Windows\System\nFvLZJt.exe
  2⤵
  PID:8516
- C:\Windows\System\lrFLOdO.exe
  C:\Windows\System\lrFLOdO.exe
  2⤵
  PID:8708
- C:\Windows\System\VvsrkWo.exe
  C:\Windows\System\VvsrkWo.exe
  2⤵
  PID:8776
- C:\Windows\System\KxnnDWv.exe
  C:\Windows\System\KxnnDWv.exe
  2⤵
  PID:8996
- C:\Windows\System\BjLPXcE.exe
  C:\Windows\System\BjLPXcE.exe
  2⤵
  PID:9124
- C:\Windows\System\sJvybiM.exe
  C:\Windows\System\sJvybiM.exe
  2⤵
  PID:8200
- C:\Windows\System\NGRFCTL.exe
  C:\Windows\System\NGRFCTL.exe
  2⤵
  PID:8664
- C:\Windows\System\iLtdqCQ.exe
  C:\Windows\System\iLtdqCQ.exe
  2⤵
  PID:8892
- C:\Windows\System\cDhTfoQ.exe
  C:\Windows\System\cDhTfoQ.exe
  2⤵
  PID:8604
- C:\Windows\System\zBzMrVs.exe
  C:\Windows\System\zBzMrVs.exe
  2⤵
  PID:9268
- C:\Windows\System\DofSVFG.exe
  C:\Windows\System\DofSVFG.exe
  2⤵
  PID:9300
- C:\Windows\System\RDkStsL.exe
  C:\Windows\System\RDkStsL.exe
  2⤵
  PID:9344
- C:\Windows\System\dmBiSer.exe
  C:\Windows\System\dmBiSer.exe
  2⤵
  PID:9384
- C:\Windows\System\fkmXdpc.exe
  C:\Windows\System\fkmXdpc.exe
  2⤵
  PID:9412
- C:\Windows\System\mfTYKZv.exe
  C:\Windows\System\mfTYKZv.exe
  2⤵
  PID:9440
- C:\Windows\System\BmuQUAL.exe
  C:\Windows\System\BmuQUAL.exe
  2⤵
  PID:9456
- C:\Windows\System\VBrnJBE.exe
  C:\Windows\System\VBrnJBE.exe
  2⤵
  PID:9484
- C:\Windows\System\pjPkkBU.exe
  C:\Windows\System\pjPkkBU.exe
  2⤵
  PID:9524
- C:\Windows\System\yUKjoLk.exe
  C:\Windows\System\yUKjoLk.exe
  2⤵
  PID:9552
- C:\Windows\System\rmDPtmU.exe
  C:\Windows\System\rmDPtmU.exe
  2⤵
  PID:9580
- C:\Windows\System\OqwOect.exe
  C:\Windows\System\OqwOect.exe
  2⤵
  PID:9596
- C:\Windows\System\kNvDWmI.exe
  C:\Windows\System\kNvDWmI.exe
  2⤵
  PID:9620
- C:\Windows\System\UmoCIIv.exe
  C:\Windows\System\UmoCIIv.exe
  2⤵
  PID:9644
- C:\Windows\System\xkvRhjo.exe
  C:\Windows\System\xkvRhjo.exe
  2⤵
  PID:9692
- C:\Windows\System\AqbwjJM.exe
  C:\Windows\System\AqbwjJM.exe
  2⤵
  PID:9720
- C:\Windows\System\qYtOYml.exe
  C:\Windows\System\qYtOYml.exe
  2⤵
  PID:9748
- C:\Windows\System\AXrvIFL.exe
  C:\Windows\System\AXrvIFL.exe
  2⤵
  PID:9776
- C:\Windows\System\agTqiGQ.exe
  C:\Windows\System\agTqiGQ.exe
  2⤵
  PID:9792
- C:\Windows\System\gPaaohz.exe
  C:\Windows\System\gPaaohz.exe
  2⤵
  PID:9808
- C:\Windows\System\nlrDqVt.exe
  C:\Windows\System\nlrDqVt.exe
  2⤵
  PID:9824
- C:\Windows\System\ISYvwGk.exe
  C:\Windows\System\ISYvwGk.exe
  2⤵
  PID:9876
- C:\Windows\System\bgRgsZv.exe
  C:\Windows\System\bgRgsZv.exe
  2⤵
  PID:9916
- C:\Windows\System\PXjXVIf.exe
  C:\Windows\System\PXjXVIf.exe
  2⤵
  PID:9932
- C:\Windows\System\OlxgyFC.exe
  C:\Windows\System\OlxgyFC.exe
  2⤵
  PID:9972
- C:\Windows\System\DAXIoGy.exe
  C:\Windows\System\DAXIoGy.exe
  2⤵
  PID:10000
- C:\Windows\System\zNxPPfT.exe
  C:\Windows\System\zNxPPfT.exe
  2⤵
  PID:10028
- C:\Windows\System\BjnYmAf.exe
  C:\Windows\System\BjnYmAf.exe
  2⤵
  PID:10056
- C:\Windows\System\SzgyJPW.exe
  C:\Windows\System\SzgyJPW.exe
  2⤵
  PID:10084
- C:\Windows\System\qWsThZY.exe
  C:\Windows\System\qWsThZY.exe
  2⤵
  PID:10112
- C:\Windows\System\tcCQryX.exe
  C:\Windows\System\tcCQryX.exe
  2⤵
  PID:10140
- C:\Windows\System\kVCwRjs.exe
  C:\Windows\System\kVCwRjs.exe
  2⤵
  PID:10168
- C:\Windows\System\oVCacma.exe
  C:\Windows\System\oVCacma.exe
  2⤵
  PID:10196
- C:\Windows\System\CIqfFdx.exe
  C:\Windows\System\CIqfFdx.exe
  2⤵
  PID:10212
- C:\Windows\System\GUkfKoE.exe
  C:\Windows\System\GUkfKoE.exe
  2⤵
  PID:8348
- C:\Windows\System\aJKoDbo.exe
  C:\Windows\System\aJKoDbo.exe
  2⤵
  PID:9212
- C:\Windows\System\csSTSwi.exe
  C:\Windows\System\csSTSwi.exe
  2⤵
  PID:9328
- C:\Windows\System\zBnbHwY.exe
  C:\Windows\System\zBnbHwY.exe
  2⤵
  PID:9396
- C:\Windows\System\MIObdXt.exe
  C:\Windows\System\MIObdXt.exe
  2⤵
  PID:9472
- C:\Windows\System\opmDvUN.exe
  C:\Windows\System\opmDvUN.exe
  2⤵
  PID:9520
- C:\Windows\System\PCfxEZW.exe
  C:\Windows\System\PCfxEZW.exe
  2⤵
  PID:9576
- C:\Windows\System\dyaOrSw.exe
  C:\Windows\System\dyaOrSw.exe
  2⤵
  PID:9660
- C:\Windows\System\IfsuMNo.exe
  C:\Windows\System\IfsuMNo.exe
  2⤵
  PID:9732
- C:\Windows\System\wVUqIBb.exe
  C:\Windows\System\wVUqIBb.exe
  2⤵
  PID:9768
- C:\Windows\System\abKjgJE.exe
  C:\Windows\System\abKjgJE.exe
  2⤵
  PID:9844
- C:\Windows\System\pnrEfFV.exe
  C:\Windows\System\pnrEfFV.exe
  2⤵
  PID:9992
- C:\Windows\System\GIclMFf.exe
  C:\Windows\System\GIclMFf.exe
  2⤵
  PID:10024
- C:\Windows\System\oZcAwOJ.exe
  C:\Windows\System\oZcAwOJ.exe
  2⤵
  PID:10096
- C:\Windows\System\moYxxRl.exe
  C:\Windows\System\moYxxRl.exe
  2⤵
  PID:10160
- C:\Windows\System\atzsytH.exe
  C:\Windows\System\atzsytH.exe
  2⤵
  PID:10224
- C:\Windows\System\xdUHBlg.exe
  C:\Windows\System\xdUHBlg.exe
  2⤵
  PID:9264
- C:\Windows\System\jyufqDQ.exe
  C:\Windows\System\jyufqDQ.exe
  2⤵
  PID:9436
- C:\Windows\System\dILMsVH.exe
  C:\Windows\System\dILMsVH.exe
  2⤵
  PID:9588
- C:\Windows\System\DgalWAw.exe
  C:\Windows\System\DgalWAw.exe
  2⤵
  PID:9760
- C:\Windows\System\VIkLjRK.exe
  C:\Windows\System\VIkLjRK.exe
  2⤵
  PID:9888
- C:\Windows\System\fCawfpN.exe
  C:\Windows\System\fCawfpN.exe
  2⤵
  PID:10076
- C:\Windows\System\MUrruTY.exe
  C:\Windows\System\MUrruTY.exe
  2⤵
  PID:10204
- C:\Windows\System\QOHcxnM.exe
  C:\Windows\System\QOHcxnM.exe
  2⤵
  PID:9508
- C:\Windows\System\hTiWted.exe
  C:\Windows\System\hTiWted.exe
  2⤵
  PID:9820
- C:\Windows\System\glAcEbT.exe
  C:\Windows\System\glAcEbT.exe
  2⤵
  PID:10152
- C:\Windows\System\YMXpCOQ.exe
  C:\Windows\System\YMXpCOQ.exe
  2⤵
  PID:10136
- C:\Windows\System\vrSwudS.exe
  C:\Windows\System\vrSwudS.exe
  2⤵
  PID:10260
- C:\Windows\System\pCwMZIA.exe
  C:\Windows\System\pCwMZIA.exe
  2⤵
  PID:10288
- C:\Windows\System\llaEeHH.exe
  C:\Windows\System\llaEeHH.exe
  2⤵
  PID:10316
- C:\Windows\System\MqHGrJW.exe
  C:\Windows\System\MqHGrJW.exe
  2⤵
  PID:10344
- C:\Windows\System\erdpRhW.exe
  C:\Windows\System\erdpRhW.exe
  2⤵
  PID:10384
- C:\Windows\System\RbkMrgg.exe
  C:\Windows\System\RbkMrgg.exe
  2⤵
  PID:10400
- C:\Windows\System\vUpeaUn.exe
  C:\Windows\System\vUpeaUn.exe
  2⤵
  PID:10428
- C:\Windows\System\zxgezBI.exe
  C:\Windows\System\zxgezBI.exe
  2⤵
  PID:10456
- C:\Windows\System\sPRvmQF.exe
  C:\Windows\System\sPRvmQF.exe
  2⤵
  PID:10484
- C:\Windows\System\HtausVC.exe
  C:\Windows\System\HtausVC.exe
  2⤵
  PID:10512
- C:\Windows\System\GARqWDA.exe
  C:\Windows\System\GARqWDA.exe
  2⤵
  PID:10540
- C:\Windows\System\gkXbeoj.exe
  C:\Windows\System\gkXbeoj.exe
  2⤵
  PID:10568
- C:\Windows\System\njZRlxy.exe
  C:\Windows\System\njZRlxy.exe
  2⤵
  PID:10596
- C:\Windows\System\kvaiwwA.exe
  C:\Windows\System\kvaiwwA.exe
  2⤵
  PID:10624
- C:\Windows\System\IvQvGOS.exe
  C:\Windows\System\IvQvGOS.exe
  2⤵
  PID:10652
- C:\Windows\System\yBslqIP.exe
  C:\Windows\System\yBslqIP.exe
  2⤵
  PID:10680
- C:\Windows\System\KUrbDiz.exe
  C:\Windows\System\KUrbDiz.exe
  2⤵
  PID:10708
- C:\Windows\System\gYHgSnH.exe
  C:\Windows\System\gYHgSnH.exe
  2⤵
  PID:10728
- C:\Windows\System\bHlllvZ.exe
  C:\Windows\System\bHlllvZ.exe
  2⤵
  PID:10764
- C:\Windows\System\JZDkWXL.exe
  C:\Windows\System\JZDkWXL.exe
  2⤵
  PID:10792
- C:\Windows\System\HmcHzgc.exe
  C:\Windows\System\HmcHzgc.exe
  2⤵
  PID:10820
- C:\Windows\System\sHcVCSg.exe
  C:\Windows\System\sHcVCSg.exe
  2⤵
  PID:10848
- C:\Windows\System\kKSzMfk.exe
  C:\Windows\System\kKSzMfk.exe
  2⤵
  PID:10868
- C:\Windows\System\kudMAyz.exe
  C:\Windows\System\kudMAyz.exe
  2⤵
  PID:10896
- C:\Windows\System\dSPTpFC.exe
  C:\Windows\System\dSPTpFC.exe
  2⤵
  PID:10932
- C:\Windows\System\AmvfvVb.exe
  C:\Windows\System\AmvfvVb.exe
  2⤵
  PID:10960
- C:\Windows\System\nyTnPDD.exe
  C:\Windows\System\nyTnPDD.exe
  2⤵
  PID:10976
- C:\Windows\System\XNFmNzc.exe
  C:\Windows\System\XNFmNzc.exe
  2⤵
  PID:11016
- C:\Windows\System\TNHlXGg.exe
  C:\Windows\System\TNHlXGg.exe
  2⤵
  PID:11044
- C:\Windows\System\AKZgXHg.exe
  C:\Windows\System\AKZgXHg.exe
  2⤵
  PID:11072
- C:\Windows\System\ORnnDwH.exe
  C:\Windows\System\ORnnDwH.exe
  2⤵
  PID:11100
- C:\Windows\System\BaHcAoK.exe
  C:\Windows\System\BaHcAoK.exe
  2⤵
  PID:11128
- C:\Windows\System\xyHbXLe.exe
  C:\Windows\System\xyHbXLe.exe
  2⤵
  PID:11156
- C:\Windows\System\wYiMbXA.exe
  C:\Windows\System\wYiMbXA.exe
  2⤵
  PID:11184
- C:\Windows\System\OvpweOK.exe
  C:\Windows\System\OvpweOK.exe
  2⤵
  PID:11212
- C:\Windows\System\sIrDFZa.exe
  C:\Windows\System\sIrDFZa.exe
  2⤵
  PID:11240
- C:\Windows\System\kjnJpuh.exe
  C:\Windows\System\kjnJpuh.exe
  2⤵
  PID:10244
- C:\Windows\System\hJcRhCC.exe
  C:\Windows\System\hJcRhCC.exe
  2⤵
  PID:10328
- C:\Windows\System\xCnFoAm.exe
  C:\Windows\System\xCnFoAm.exe
  2⤵
  PID:10392
- C:\Windows\System\sjmYJsA.exe
  C:\Windows\System\sjmYJsA.exe
  2⤵
  PID:10452
- C:\Windows\System\FyJdLaH.exe
  C:\Windows\System\FyJdLaH.exe
  2⤵
  PID:10524
- C:\Windows\System\YTlRFBn.exe
  C:\Windows\System\YTlRFBn.exe
  2⤵
  PID:10592
- C:\Windows\System\JZoCFdr.exe
  C:\Windows\System\JZoCFdr.exe
  2⤵
  PID:10648
- C:\Windows\System\wuVlZAs.exe
  C:\Windows\System\wuVlZAs.exe
  2⤵
  PID:10696
- C:\Windows\System\OMehSLc.exe
  C:\Windows\System\OMehSLc.exe
  2⤵
  PID:10788
- C:\Windows\System\CjhvZsA.exe
  C:\Windows\System\CjhvZsA.exe
  2⤵
  PID:10832
- C:\Windows\System\WWLmbkX.exe
  C:\Windows\System\WWLmbkX.exe
  2⤵
  PID:9984
- C:\Windows\System\noxvssv.exe
  C:\Windows\System\noxvssv.exe
  2⤵
  PID:10968
- C:\Windows\System\IMIOgow.exe
  C:\Windows\System\IMIOgow.exe
  2⤵
  PID:11032
- C:\Windows\System\lvlgPBt.exe
  C:\Windows\System\lvlgPBt.exe
  2⤵
  PID:11096
- C:\Windows\System\JVrUpwN.exe
  C:\Windows\System\JVrUpwN.exe
  2⤵
  PID:11168
- C:\Windows\System\ZOtLLsn.exe
  C:\Windows\System\ZOtLLsn.exe
  2⤵
  PID:11236
- C:\Windows\System\cwGGZCk.exe
  C:\Windows\System\cwGGZCk.exe
  2⤵
  PID:10356
- C:\Windows\System\nOVSRUR.exe
  C:\Windows\System\nOVSRUR.exe
  2⤵
  PID:10500
- C:\Windows\System\zzDNjEo.exe
  C:\Windows\System\zzDNjEo.exe
  2⤵
  PID:10700
- C:\Windows\System\OnaxLqb.exe
  C:\Windows\System\OnaxLqb.exe
  2⤵
  PID:10876
- C:\Windows\System\TOxcsOG.exe
  C:\Windows\System\TOxcsOG.exe
  2⤵
  PID:11028
- C:\Windows\System\NvGoGKe.exe
  C:\Windows\System\NvGoGKe.exe
  2⤵
  PID:11196
- C:\Windows\System\WupgqKG.exe
  C:\Windows\System\WupgqKG.exe
  2⤵
  PID:10444
- C:\Windows\System\DURHsip.exe
  C:\Windows\System\DURHsip.exe
  2⤵
  PID:10836
- C:\Windows\System\hegimfr.exe
  C:\Windows\System\hegimfr.exe
  2⤵
  PID:9716
- C:\Windows\System\DTYxZOF.exe
  C:\Windows\System\DTYxZOF.exe
  2⤵
  PID:11292
- C:\Windows\System\QcsekYr.exe
  C:\Windows\System\QcsekYr.exe
  2⤵
  PID:11328
- C:\Windows\System\NXpeNRk.exe
  C:\Windows\System\NXpeNRk.exe
  2⤵
  PID:11372
- C:\Windows\System\oHXWszM.exe
  C:\Windows\System\oHXWszM.exe
  2⤵
  PID:11408
- C:\Windows\System\JQgZbsE.exe
  C:\Windows\System\JQgZbsE.exe
  2⤵
  PID:11432
- C:\Windows\System\ZmwClzP.exe
  C:\Windows\System\ZmwClzP.exe
  2⤵
  PID:11468
- C:\Windows\System\rmUrJzS.exe
  C:\Windows\System\rmUrJzS.exe
  2⤵
  PID:11532
- C:\Windows\System\znZXpMe.exe
  C:\Windows\System\znZXpMe.exe
  2⤵
  PID:11552
- C:\Windows\System\TmUCrMD.exe
  C:\Windows\System\TmUCrMD.exe
  2⤵
  PID:11576
- C:\Windows\System\jfAYREC.exe
  C:\Windows\System\jfAYREC.exe
  2⤵
  PID:11600
- C:\Windows\System\jKsDIss.exe
  C:\Windows\System\jKsDIss.exe
  2⤵
  PID:11644
- C:\Windows\System\RmXhmEJ.exe
  C:\Windows\System\RmXhmEJ.exe
  2⤵
  PID:11676
- C:\Windows\System\xQUuscY.exe
  C:\Windows\System\xQUuscY.exe
  2⤵
  PID:11700
- C:\Windows\System\iyLtYiT.exe
  C:\Windows\System\iyLtYiT.exe
  2⤵
  PID:11716
- C:\Windows\System\GwMEmoo.exe
  C:\Windows\System\GwMEmoo.exe
  2⤵
  PID:11740
- C:\Windows\System\hztVxRw.exe
  C:\Windows\System\hztVxRw.exe
  2⤵
  PID:11768
- C:\Windows\System\vCcZzAP.exe
  C:\Windows\System\vCcZzAP.exe
  2⤵
  PID:11792
- C:\Windows\System\QBSKZzO.exe
  C:\Windows\System\QBSKZzO.exe
  2⤵
  PID:11844
- C:\Windows\System\ZeaEqgS.exe
  C:\Windows\System\ZeaEqgS.exe
  2⤵
  PID:11884
- C:\Windows\System\CcaTeFt.exe
  C:\Windows\System\CcaTeFt.exe
  2⤵
  PID:11900
- C:\Windows\System\ntdUCOv.exe
  C:\Windows\System\ntdUCOv.exe
  2⤵
  PID:11928
- C:\Windows\System\lOKzBmw.exe
  C:\Windows\System\lOKzBmw.exe
  2⤵
  PID:11960
- C:\Windows\System\XhMSdxj.exe
  C:\Windows\System\XhMSdxj.exe
  2⤵
  PID:11988
- C:\Windows\System\kRWtZiF.exe
  C:\Windows\System\kRWtZiF.exe
  2⤵
  PID:12004
- C:\Windows\System\uaNcySb.exe
  C:\Windows\System\uaNcySb.exe
  2⤵
  PID:12028
- C:\Windows\System\VxMevUC.exe
  C:\Windows\System\VxMevUC.exe
  2⤵
  PID:12048
- C:\Windows\System\xotzJFZ.exe
  C:\Windows\System\xotzJFZ.exe
  2⤵
  PID:12064
- C:\Windows\System\Ednmnxq.exe
  C:\Windows\System\Ednmnxq.exe
  2⤵
  PID:12084
- C:\Windows\System\TggvxMi.exe
  C:\Windows\System\TggvxMi.exe
  2⤵
  PID:12124
- C:\Windows\System\ZDmrryN.exe
  C:\Windows\System\ZDmrryN.exe
  2⤵
  PID:12172
- C:\Windows\System\rsxDROs.exe
  C:\Windows\System\rsxDROs.exe
  2⤵
  PID:12200
- C:\Windows\System\ZXCBpBa.exe
  C:\Windows\System\ZXCBpBa.exe
  2⤵
  PID:12236
- C:\Windows\System\beuxtTX.exe
  C:\Windows\System\beuxtTX.exe
  2⤵
  PID:12284
- C:\Windows\System\IkuhmXP.exe
  C:\Windows\System\IkuhmXP.exe
  2⤵
  PID:11304
- C:\Windows\System\EWwXfYX.exe
  C:\Windows\System\EWwXfYX.exe
  2⤵
  PID:11400
- C:\Windows\System\bxujDdD.exe
  C:\Windows\System\bxujDdD.exe
  2⤵
  PID:10744
- C:\Windows\System\FFzdTLi.exe
  C:\Windows\System\FFzdTLi.exe
  2⤵
  PID:11504
- C:\Windows\System\knhnvWi.exe
  C:\Windows\System\knhnvWi.exe
  2⤵
  PID:11584
- C:\Windows\System\LZTcTdH.exe
  C:\Windows\System\LZTcTdH.exe
  2⤵
  PID:11684
- C:\Windows\System\rnrBIuN.exe
  C:\Windows\System\rnrBIuN.exe
  2⤵
  PID:11752
- C:\Windows\System\zRcapta.exe
  C:\Windows\System\zRcapta.exe
  2⤵
  PID:11764
- C:\Windows\System\hHDbBLY.exe
  C:\Windows\System\hHDbBLY.exe
  2⤵
  PID:11804
- C:\Windows\System\pKXFQuu.exe
  C:\Windows\System\pKXFQuu.exe
  2⤵
  PID:11908
- C:\Windows\System\trvjIoA.exe
  C:\Windows\System\trvjIoA.exe
  2⤵
  PID:12020
- C:\Windows\System\BzyUVWC.exe
  C:\Windows\System\BzyUVWC.exe
  2⤵
  PID:12080
- C:\Windows\System\sQaJseD.exe
  C:\Windows\System\sQaJseD.exe
  2⤵
  PID:12136
- C:\Windows\System\bGnEXIQ.exe
  C:\Windows\System\bGnEXIQ.exe
  2⤵
  PID:12192
- C:\Windows\System\BqDxIrI.exe
  C:\Windows\System\BqDxIrI.exe
  2⤵
  PID:12264
- C:\Windows\System\XRFoHfa.exe
  C:\Windows\System\XRFoHfa.exe
  2⤵
  PID:11364
- C:\Windows\System\woUYanw.exe
  C:\Windows\System\woUYanw.exe
  2⤵
  PID:11628
- C:\Windows\System\hZHxzWu.exe
  C:\Windows\System\hZHxzWu.exe
  2⤵
  PID:11692
- C:\Windows\System\qLZYunR.exe
  C:\Windows\System\qLZYunR.exe
  2⤵
  PID:11828
- C:\Windows\System\hqEtsDn.exe
  C:\Windows\System\hqEtsDn.exe
  2⤵
  PID:12104
- C:\Windows\System\UfKjXzT.exe
  C:\Windows\System\UfKjXzT.exe
  2⤵
  PID:12260
- C:\Windows\System\bPvoKAU.exe
  C:\Windows\System\bPvoKAU.exe
  2⤵
  PID:4328
- C:\Windows\System\EHATDJt.exe
  C:\Windows\System\EHATDJt.exe
  2⤵
  PID:3956
- C:\Windows\System\MuTkKSh.exe
  C:\Windows\System\MuTkKSh.exe
  2⤵
  PID:11568
- C:\Windows\System\MUWlwco.exe
  C:\Windows\System\MUWlwco.exe
  2⤵
  PID:11820
- C:\Windows\System\dnTBtEn.exe
  C:\Windows\System\dnTBtEn.exe
  2⤵
  PID:12120
- C:\Windows\System\DmVbeQL.exe
  C:\Windows\System\DmVbeQL.exe
  2⤵
  PID:11652
- C:\Windows\System\aiBMASV.exe
  C:\Windows\System\aiBMASV.exe
  2⤵
  PID:12296
- C:\Windows\System\RdkEenN.exe
  C:\Windows\System\RdkEenN.exe
  2⤵
  PID:12340
- C:\Windows\System\YKAvSNM.exe
  C:\Windows\System\YKAvSNM.exe
  2⤵
  PID:12364
- C:\Windows\System\bejCqOL.exe
  C:\Windows\System\bejCqOL.exe
  2⤵
  PID:12392
- C:\Windows\System\IfLAhjX.exe
  C:\Windows\System\IfLAhjX.exe
  2⤵
  PID:12420
- C:\Windows\System\MzmKzQC.exe
  C:\Windows\System\MzmKzQC.exe
  2⤵
  PID:12448
- C:\Windows\System\vnJomCd.exe
  C:\Windows\System\vnJomCd.exe
  2⤵
  PID:12484
- C:\Windows\System\XRknWVY.exe
  C:\Windows\System\XRknWVY.exe
  2⤵
  PID:12520
- C:\Windows\System\uHLMsTE.exe
  C:\Windows\System\uHLMsTE.exe
  2⤵
  PID:12548
- C:\Windows\System\gFBPljy.exe
  C:\Windows\System\gFBPljy.exe
  2⤵
  PID:12576
- C:\Windows\System\qdRvQZU.exe
  C:\Windows\System\qdRvQZU.exe
  2⤵
  PID:12592
- C:\Windows\System\AknpQVz.exe
  C:\Windows\System\AknpQVz.exe
  2⤵
  PID:12628
- C:\Windows\System\JTdDDZc.exe
  C:\Windows\System\JTdDDZc.exe
  2⤵
  PID:12660
- C:\Windows\System\TnlXYia.exe
  C:\Windows\System\TnlXYia.exe
  2⤵
  PID:12688
- C:\Windows\System\FMzWxWg.exe
  C:\Windows\System\FMzWxWg.exe
  2⤵
  PID:12704
- C:\Windows\System\dQqngwD.exe
  C:\Windows\System\dQqngwD.exe
  2⤵
  PID:12732
- C:\Windows\System\ZUFozWv.exe
  C:\Windows\System\ZUFozWv.exe
  2⤵
  PID:12760
- C:\Windows\System\BGGkfBs.exe
  C:\Windows\System\BGGkfBs.exe
  2⤵
  PID:12800
- C:\Windows\System\PnotSUA.exe
  C:\Windows\System\PnotSUA.exe
  2⤵
  PID:12824
- C:\Windows\System\gzsGZYW.exe
  C:\Windows\System\gzsGZYW.exe
  2⤵
  PID:12844
- C:\Windows\System\KovjMgE.exe
  C:\Windows\System\KovjMgE.exe
  2⤵
  PID:12868
- C:\Windows\System\tziTnDn.exe
  C:\Windows\System\tziTnDn.exe
  2⤵
  PID:12888
- C:\Windows\System\CTLksQV.exe
  C:\Windows\System\CTLksQV.exe
  2⤵
  PID:12924
- C:\Windows\System\ifqWfJB.exe
  C:\Windows\System\ifqWfJB.exe
  2⤵
  PID:12964
- C:\Windows\System\DimKZzf.exe
  C:\Windows\System\DimKZzf.exe
  2⤵
  PID:12996
- C:\Windows\System\WkskmRy.exe
  C:\Windows\System\WkskmRy.exe
  2⤵
  PID:13016
- C:\Windows\System\RfiHdbl.exe
  C:\Windows\System\RfiHdbl.exe
  2⤵
  PID:13056
- C:\Windows\System\WgLQvTy.exe
  C:\Windows\System\WgLQvTy.exe
  2⤵
  PID:13084
- C:\Windows\System\qDDqgkg.exe
  C:\Windows\System\qDDqgkg.exe
  2⤵
  PID:13108
- C:\Windows\System\XJQuNPo.exe
  C:\Windows\System\XJQuNPo.exe
  2⤵
  PID:13136
- C:\Windows\System\sKbHJPP.exe
  C:\Windows\System\sKbHJPP.exe
  2⤵
  PID:13160
- C:\Windows\System\TSWVyCr.exe
  C:\Windows\System\TSWVyCr.exe
  2⤵
  PID:13192
- C:\Windows\System\DrWKPmO.exe
  C:\Windows\System\DrWKPmO.exe
  2⤵
  PID:13228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_sddjxhdq.teb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sddjxhdq.teb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BgVAFHu.exe

Path C:\Windows\System\BgVAFHu.exe
Size 2.9MB
SHA256 a487fab60d029463f4f81d5e7ac1b606973cad3f6f2b089f3c0f2fd7a79804d4
MD5 344abe0ebe4f481cdd9a168694afaeff
SHA1 18a87f576d3c452f80ded815fd70884b7927b817
SHA512 e94364ced2b47f0231e3e4bbaef3ae2f77793575440c9ad56fc7863c8a15efa0795f66fdcd969095b48149077f876c0411579d751d6736cfe0cc2200dd249112
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLr:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnMlmSs.exe

Path C:\Windows\System\EnMlmSs.exe
Size 2.9MB
SHA256 9028bb23a157313771b1b32158e183034332630b0af205e4bfb4b16e61ae106d
MD5 7916aed975e07f1e540c2d0e902eaaa5
SHA1 9de5489f523fab52073e13d403606ae7394c7fc1
SHA512 27d30bfa38a9003b42fc007c23e4bf5746e144cd9491d1f26f83c7e4ed9dc39d9e1e28d2459e94dde89bb24591d3177f4624bdb004bd4550cde6c1544537734f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLy:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

FeebQYG.exe

Path C:\Windows\System\FeebQYG.exe
Size 2.9MB
SHA256 4fb93d121924053c9908c56dfea55559701d746b48d57f042f3b861813e1c254
MD5 3ca9ae83d66a319e2fa43a6347cd9e28
SHA1 1dea6e78f612d4af0e0e9558e2a50ba5a6b0cca6
SHA512 576dfaf004ffdd49d099e7ea4bb311261526bbb1fad9e5fbdd46f7f3ed0943df7263398ce4bcc1f1eb8022b7355272a36286cecb945531d8b9fbabdef729d3f3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLD:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

HIqZdjA.exe

Path C:\Windows\System\HIqZdjA.exe
Size 2.9MB
SHA256 8b316add5468980edb00f3ee110ead489ac6d6c71529ce3820305e4b24fe1800
MD5 33a29a860daf057e05b32cf7cac1e322
SHA1 61fd3f337b4ed2d581679a5dcebb0027f0d2a4f0
SHA512 4781bdeb7af233e8bf2879a6b710c94ea1f15d67e77afa29a1f44824beb41555435c5296b6fdf79fa4caa9db1f2d8773eedcf09e934cf9b685cdfb06a3f99baf
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLg:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBZXzFe.exe

Path C:\Windows\System\IBZXzFe.exe
Size 2.9MB
SHA256 c969bf2fff80f58477a7c37036975231cb2ced32feaf95bcfd4311e9e1852cd1
MD5 8b714988f81d0f64e1fb76b2258426f6
SHA1 cc7873348ff8ae397a4c48366e6363e129df87e6
SHA512 418f326c07de78bf58a26ad770a3fdd494388b8da96b140f09eb4c0dc1f08cde08d76905c54e127e31fffca8b143397973a5c483ac5c2d0f984136b917bbfb88
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLj:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

JLRieVU.exe

Path C:\Windows\System\JLRieVU.exe
Size 2.9MB
SHA256 2477400569051c3bca81b470b2eb6357c0714e0d86719aaba04d766dede799bf
MD5 c665f0e82f8f4f7c2b49108a0aa254ab
SHA1 2335d8c687292cf97df64039936bb5fe705fe2c7
SHA512 1a2046dbd7a2838a2eb2b570d5b6b717b3d0249c3a6a5d59cdb11bda78bc93d9ed7fb4c96eb7b97fe65eec570cd4045c317508986a24cd15e6c2f29cbd6ec043
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLK:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

JcVZaKd.exe

Path C:\Windows\System\JcVZaKd.exe
Size 2.9MB
SHA256 04c28ab05d9e99eeebf9aebe1f6e677811f7df90605e3e509357b1f7018b2f24
MD5 0b4bf6af35ab1ddf1f3323dc2222c832
SHA1 1fc35c651c43399fedfecd86940e7a28455b2b32
SHA512 c9eae7e3fde96b400efd2db52b82c70edb68750e7874af4a6c46f486efb7ff6a03884ee5255c650f58e1c3cdfec37e94ba64774cf0427f7e1182f25d88996c2e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLu:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

LtqGkNi.exe

Path C:\Windows\System\LtqGkNi.exe
Size 8B
SHA256 5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456
MD5 2adac273ce248e8d242a4b12f749bb46
SHA1 300bd2c60c669d978305195f11eaf26c73d9e457
SHA512 011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232
MD5 SHA1 SHA512

Submit Download

MFTDoQZ.exe

Path C:\Windows\System\MFTDoQZ.exe
Size 2.9MB
SHA256 33c4b891f33335fc9afef8aa57212598128709c8ccac91a667c1ffe85a7bceb9
MD5 7a0a55f935b512f97b7bdfe4d76baa30
SHA1 b9d6c465b7cbef27269b312a88a416c6962eb73f
SHA512 6e1f755918a46c6d0e55e93f15ee1199d439e2f8ba47382d9bf0f0bd11a57cc1493ada9999dc944acb07a2377346ca730563c23cd48dbf47588429af7564d909
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLp:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

NshdSfy.exe

Path C:\Windows\System\NshdSfy.exe
Size 2.9MB
SHA256 06b968865f1a5bd0ed148e1030e06a945b9f323d1489da51a751a607192c80f3
MD5 afb20c095001bde1d0ca0b7922923575
SHA1 7703a3be82707c3052f936baed58ca67785136ec
SHA512 4168ec6518b74c049dda39a72600fcf50e39aa93a86d67b14d7476734b82ee1dbf00b786023157406dc3a8afd609bf6638805eaef014f6c87a8e38cd12b6fedc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLS:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

OXzjJyJ.exe

Path C:\Windows\System\OXzjJyJ.exe
Size 2.9MB
SHA256 f17d57de8fc9b13b94b065e10dbf0987e6f50aaa54546a2b87764c9d5d7f42be
MD5 5920cb0123b3b579617773bf9fbfb71e
SHA1 4a3a6610615ed881092d072c72a38668240ecb85
SHA512 23a98e02d026290dd206bafe1ce34b2f57205dfa4856ae5a1c8ea476a691591ba960756d9108ca7860c5a9de59054988feab99ae7b7fc4a684074dad3e570c9e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLh:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

OsnieXJ.exe

Path C:\Windows\System\OsnieXJ.exe
Size 2.9MB
SHA256 0dd1745c26ec162cad4168905b228b01edbd1eb532d9fecd3d4cda71c58ce861
MD5 12fc83ef1753c5685bb25502e48fe505
SHA1 58842a03e9e54cc60754b970407b092725bb9c4a
SHA512 b00b9207fc305526bd309fa691635446637d055e72d00b17193b2213c9c4dcfa37d8ce53cea652dcfc1d5a9d4e9eaf3e46ecf777b5848e1ba9316b27cdc0bbd4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLG:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwfVQNf.exe

Path C:\Windows\System\QwfVQNf.exe
Size 2.9MB
SHA256 8b248f14b9b10fd8f1ff0dc3a4a89ac761c282543f146433733e018edb74b5f3
MD5 bf01aed9daa3233f7c0f1d8018e8633e
SHA1 24f4195792ddfb05d04380a2f06ee29944ecfede
SHA512 43dd7c18b6448de7b0a4813fa875ddc03830904c2dff671b7dced6aab8cf860f9ad9af417cc96fe9a672653e1732d0b4b9838e974afce90ec83d3c8f7bc9c728
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLv9:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTIBfbd.exe

Path C:\Windows\System\RTIBfbd.exe
Size 2.9MB
SHA256 109c3b9c8c3561b8acb9ea462feece1b687d3a6c6764b5d2b400f24204a942c5
MD5 afa7947520e8dc0a5011ff45c7579628
SHA1 6227ad89c2c8d50cfd880f68c366ffd312c3c374
SHA512 f09946202ea158d42a4ea9e73cde2c78ec9535b729306e90c30f30332b8f272c4888d984d383c763fa0c9be6d88548041aa811d7aaeeaf9d64090ca15366d0b1
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLL:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQYbUcy.exe

Path C:\Windows\System\SQYbUcy.exe
Size 2.9MB
SHA256 dad8ec7c76013e2dc6471d6fd20a4ec91775204d52ce627864fa9d6bd8432d82
MD5 441bc7a2024027f50122c6109005b643
SHA1 4723f469c52f7bddb8bbf9289a5f501c2b10c1aa
SHA512 b0fdb0b169de087a9fb8d9688ef41f32ffd47ff7b7fe68dc62210a55bf8556b92a9faab4d380f10fd5cbb0f97a1f96a1fb4cb60a8ee715f95b405a7945550cda
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLi:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

SSVsQoL.exe

Path C:\Windows\System\SSVsQoL.exe
Size 2.9MB
SHA256 a4cc4e35a8f6ddfc389859b9d9f63a7124fd125d250e805a15ec7da67661217f
MD5 28251c787ef4e237f1a5931de2a0c5bd
SHA1 fe09b8de19bf3902b816be87a38673cdb410d9ac
SHA512 d91e502ec24771b26624a2a9f881939a3b9c0da507db61517c144dac66d8ba33f1ef78e3f8370c3213494ae2537cee67b16261897af03e02bca82f87c9563868
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLT:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

VhFYhbZ.exe

Path C:\Windows\System\VhFYhbZ.exe
Size 2.9MB
SHA256 5206e522241ee4b22bd13b0c151550835f4aefcc835223c71c123cc4bdb6a7bc
MD5 125d7c7a9a9b66b1b01e765d292129c5
SHA1 443b3ec929cdd600eec6fbf0be2bf5f82edda04e
SHA512 4367f745581471f1a574f3504a1aad93dbf6759058eafffff214240d3622dc420648f8081fe13bf1cc5f5bd7859b7d992f7c2cfb1e79e4bc87cc1c6a62b06fdb
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLow:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

XkhIoPM.exe

Path C:\Windows\System\XkhIoPM.exe
Size 2.9MB
SHA256 b2fc89cb8b04fb5f4e37773460fef8c2e1d3a0e1ead6521ffcadcb8296957a62
MD5 92e5d908c4eb769e17977dbafd191ecb
SHA1 966ad1ae8d1f65a970c7c96c39a1792f262dbb84
SHA512 59d9730c7055f57aef74c755e7ee029a8e9028f926f37f3b790e2d5af634d538986530af898be833d33d0277a9969f9441edc22feea8cbf4d39177111f88204e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLX:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cQSfmWd.exe

Path C:\Windows\System\cQSfmWd.exe
Size 2.9MB
SHA256 ff62214d60c8536d7f4a57d74a8c71f3387eb23009967694e4d690f70c9f79fb
MD5 c7a0efe772cb0a38c6902adafb7a05f5
SHA1 b9254319cd37da8e9328ccf7c1c433edb0d4df2c
SHA512 534b588f0e62509921edbe2e09a0108bb1078ee88148f35898da50a04a1e7861bb148bab9f9bef76c12ae88dccfd25b140d36d20b8fac26f40fec6a49082b41f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLwZ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RO
MD5 SHA1 SHA512 SSDEEP

Submit Download

eMCANna.exe

Path C:\Windows\System\eMCANna.exe
Size 2.9MB
SHA256 cc2fa2d7e0857d6d7c0561d3d97b5780cce19eb588ced339e7b315214830e81c
MD5 36758c41c65d71d5083c863408b6ed85
SHA1 dd2d0e59c6502867f8bb6679cf3d8eb7d9900542
SHA512 6511c1dc6ec4cce57fc210efac1619962651163fe5344eb7f121206fd13ba94c5e22e52a200f4c4702c84eabf1761ea90cfb2e04527c43c015648b67146e814a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLp:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

fWpMsKh.exe

Path C:\Windows\System\fWpMsKh.exe
Size 2.9MB
SHA256 ad81f96db74ae8821df07d22e147f02e11f94c67408de4406d5c7269e27b06cb
MD5 8e7730659c884460008e2ebe574706bc
SHA1 850bfccfb8c5286c53bba69c98d41b6007438250
SHA512 15611c4b3826196ba130101f3bf0d9b04f17930ad3b55b13c3d64f76647a846f54002be067111988d13b3f9d4e3b0d15b2e838830df7ac7704eee2b4dcd0f089
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLF:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

gWPkJeJ.exe

Path C:\Windows\System\gWPkJeJ.exe
Size 2.9MB
SHA256 693ae8682cf300b3aec845bc0c3f0ece6ca5cd0e41e4b60fbb079b23f88f546c
MD5 82743890a54835eaf1322196a447bd1c
SHA1 e7a52e9f1abf072b7949e889952dd46c01415290
SHA512 364e59a2b79c20bb6286d950577f9e50a346812d2e2a6b0d97dda662bf5477db1811e55a9ccbb275774c95ec326ccda227347a8b8b12e6606081ce44eca96b62
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hijePgV.exe

Path C:\Windows\System\hijePgV.exe
Size 2.9MB
SHA256 decc1878fc5d1990351917679972e7e3442d28996f8198ad7a2aa32829006597
MD5 a6e8bd2c0b375c117c8ab9c67c2304c6
SHA1 dce9f820e581ba98740336eff773a68d38180dbd
SHA512 f6384b6b9ab96a728df324e5f292ce454c73f6805ec967f7b681cf191bd93a0fc5e8bd6e758a1a12913645d06fc5cba608185e2f758c0a681fd3caeddee4613b
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLD:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

hlOYlGz.exe

Path C:\Windows\System\hlOYlGz.exe
Size 2.9MB
SHA256 5a0bcc945f35a4ce10b540986dc4c1e7daba5c3b4383c2ac5f1753b883f9cee2
MD5 9b60453b295fce800327252ddb60a2fc
SHA1 21bc675ea36354a2cdf3ab9dce92c08af42fb5e9
SHA512 f0952837f9f68b8fb21c9f5bb05f5306ff1b9e3980106eb23717f26090506af3cf04d5440907d880fc1234b5cdf97ac323391c94532c07af2067091174e06356
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLw:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

iCFsNOQ.exe

Path C:\Windows\System\iCFsNOQ.exe
Size 2.9MB
SHA256 223f3d84d1a9d344238af47b0fd5038eb57b7d5ab2c49745f1dd270173cc616d
MD5 2d6bcdb7507ff2ab9801d5b99f740fa5
SHA1 ea431e3a614a08bd2d5fac36d56ff41ae31e6b9a
SHA512 888430acd7587e26259d2e2d61b32195ce4cac10dfeb49968562b884fe2b7e7c2028f04f3a2f4b93ec3dfbeaffe326923b54857c4da8c83187323418f49b9bf6
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLk:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

jSBMRSp.exe

Path C:\Windows\System\jSBMRSp.exe
Size 2.9MB
SHA256 320fc1fbe85f85036f1027ded2032bfda19dc7e49a4ac0bbd48373b459d17cc7
MD5 4b1a75cb3304c94e246756b6cdbde789
SHA1 211b99061ba3fd21045ee5e061eef0071da157e6
SHA512 f69b1547f5525d43f0e4cc592f988728becbe30236db1126d7d395bb3a098ad37cbca2097671ffeeea31e2ee7e1bbdfb6eecf44d2c4ba8e54b3b930bca0e429d
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLb:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

oQjFwiX.exe

Path C:\Windows\System\oQjFwiX.exe
Size 2.9MB
SHA256 cf5144d1178c476f6f018c5417fe9871da259939dfbec310a77961ab99883d7c
MD5 5602e3c794b1611e2ba170a5d620b36a
SHA1 c4d80409af84a43ef64d6979136b6040856d811b
SHA512 4095857a38dcbbc8cb38ebd6a30cd1193189ff704c8cbb29d803d81b36ef527e1a0e6a29d33d36fe44f7f9400f8cdcfe7556418da38314c30d0460c3625180e3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

omODPmW.exe

Path C:\Windows\System\omODPmW.exe
Size 2.9MB
SHA256 f7bee9831a484a632447d0677a2ca700dc299640a2977404e36fcef9d2b301e3
MD5 de9ba743de16386b65154161868b5af4
SHA1 5453242f4aee07bb8086714d807f26359d827cad
SHA512 5b4ed3011c62bc4634630d55998c4e5ef6c721c5548e8bbc12756c9ca585202cdad0b9507571695e76c579dca4b8f5a8447ff5aa0e0bc5567654e0148c926c08
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLn:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvwdUPQ.exe

Path C:\Windows\System\pvwdUPQ.exe
Size 2.9MB
SHA256 8331892480f6a4e2286149dd2240ff97635cb3206407d318da3c35e20411eb59
MD5 76724eeb483f4b8827f17984dd5a9394
SHA1 34fbe2757daab585b8e77d48534e7b11f69f2a07
SHA512 5d627e935cecfe7dd53120435433addf8fb3e7b1ed78754a8de8cc67fc743c339320e538e5ca7b4d4dde21b2aeeeb38b1588b7a46ccd24ecfb2aba0e11eb418c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RO
MD5 SHA1 SHA512 SSDEEP

Submit Download

pybMqDJ.exe

Path C:\Windows\System\pybMqDJ.exe
Size 2.9MB
SHA256 9c9d09d0856948cddd500c21fc208d4e0241ea1fb8eff8b8538cae2170c974a8
MD5 000c6cb9eaf057276c4411754007fec4
SHA1 0c9fc63ab0c72a58aa7605d1e996a73dcc0bff34
SHA512 6206e8d371a1b049bbc30dec67b2e6a9d31c96d664837f7dc47b601e53e576d3c517de3360b201e4dfc58c48ed27458e0e957bf360c92ae7d87da7b557f1bd1c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLL:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqfLyMb.exe

Path C:\Windows\System\sqfLyMb.exe
Size 2.9MB
SHA256 3fd6e66476cb7b30d7d2a5629f7ea0119fe5bbecb1a10416b223aea83facd22a
MD5 655b3784f7a570058e34c73cba9245bb
SHA1 cddcc22d6a1f5d4fb979a4a362863154d5d0fb06
SHA512 45f2acaf2e6e252492b73c8b2c9fe83902a3504c6fd274f750412439561c2a38610c2b61b42689a97b54294ac27f339dc6b09e94c0b9344028fb3869d1c8036e
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLY:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

swncovU.exe

Path C:\Windows\System\swncovU.exe
Size 2.9MB
SHA256 9d83238b28276c414ce212c518b98c96cf57477bb4ca63875b751b32f0b708c7
MD5 dad3ff8218355695972e818751d6aebf
SHA1 3286061b8bbad9eda16d180349a4705aa51b666a
SHA512 3f23df02722d55f69150ae55a934a98bf129e2ad7939fe2932fc58a6ffa5657c29b8ad0b63817feceed7665a06c72dba5d5cf1a6d8e017b962803b0e258f6277
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLD:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

txzyLMg.exe

Path C:\Windows\System\txzyLMg.exe
Size 2.9MB
SHA256 0f1ef26cff39786e8e7b728015bb993094320418bab5ede571f41bb2888cb2b3
MD5 73d46e5325d41734a5cdf907d65ea100
SHA1 b5fdbb94e8f0d1abf8958963071ab2f0a9d2639e
SHA512 c868e8fe8ce69ece3e4469989a9ab6dceadcdf50ed777539a23cd91038598362df87637f1e0d57ab5c36425d23f933224a4332a5843f4a1d89fa8be568ae9afc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLqz:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

vmtKTOy.exe

Path C:\Windows\System\vmtKTOy.exe
Size 2.9MB
SHA256 3123ea5314b77bc22eaebfd316ee7f5b1d5c1ee702b46ae6d8dff8b3702b3156
MD5 37909aff4b5910ab3c4583b21131aa46
SHA1 9881f85b800acb958c0788af829a70a85ae213a3
SHA512 d5f66cff286f594dbfbec62c606dcd422c126a7e875e77fdf549fdb323feda5637e79fd8c02cc86051cf359d538ea60cef3a722e7485192e29f2621d2e954f16
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLo:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

wWCqpXT.exe

Path C:\Windows\System\wWCqpXT.exe
Size 2.9MB
SHA256 d20afbc1ef3fb5677bd50f1ab0498b9b646899b1d351755ea9f6a3d7f95a6980
MD5 a9a61448ab2ee9f211aae1eb665ee93a
SHA1 6f606f461c331c93b67d83b0cf95d87473ec8ddb
SHA512 97a4b55fc22dbc7e292501f5cf8ea536a7e9a80c7205beba4dbf05b4f0e159638ffd90aad6c0d2085cbfebad153f092148620594f24d627b879d044dfc6d4de4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNL+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

yRRfaHr.exe

Path C:\Windows\System\yRRfaHr.exe
Size 2.9MB
SHA256 4ae7550f1f7acb29d8f6c050894b12b123dc7bc314c8b96c3c416f73afdc3f4e
MD5 38458cad29e929682951e6023e6f18cd
SHA1 40a0347e4501b0345365e0f86acfed1453039d70
SHA512 f55a396fbe37974f21418a5e1bb994627e11377a456d6f354124d7f93db03227b1fe8890bdc599f36be750946f3423c2c5575daba2b8f112cbb99acbc3c61866
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLc:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

zzKJBxN.exe

Path C:\Windows\System\zzKJBxN.exe
Size 2.9MB
SHA256 a1174e158c272da3fbfcea6eb7e8332cef792be39bece8eed485a6afc4c0aa56
MD5 d30ec025e72403d8b7b0f5bbf3fa0dc9
SHA1 3a04885c5b1dd9b0447af0b1e717a39847d99f82
SHA512 418dee76b873b73727962479b52049989596a01e55e03777d3c06a04a133155394e03a66e728f85299ef141bd532948fe01d4f517557dc59a2456af371602fda
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WGcNLP:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-126-0x00007FF7C2690000-0x00007FF7C2A86000-memory.dmp

Download

memory/452-2359-0x00007FF7C2690000-0x00007FF7C2A86000-memory.dmp

Download

memory/536-64-0x00007FF790770000-0x00007FF790B66000-memory.dmp

Download

memory/536-2353-0x00007FF790770000-0x00007FF790B66000-memory.dmp

Download

memory/828-2360-0x00007FF6A80E0000-0x00007FF6A84D6000-memory.dmp

Download

memory/828-129-0x00007FF6A80E0000-0x00007FF6A84D6000-memory.dmp

Download

memory/1284-2357-0x00007FF712FE0000-0x00007FF7133D6000-memory.dmp

Download

memory/1284-101-0x00007FF712FE0000-0x00007FF7133D6000-memory.dmp

Download

memory/1332-14-0x00007FF6A0520000-0x00007FF6A0916000-memory.dmp

Download

memory/1332-2348-0x00007FF6A0520000-0x00007FF6A0916000-memory.dmp

Download

memory/1440-124-0x00007FF637B80000-0x00007FF637F76000-memory.dmp

Download

memory/1440-2355-0x00007FF637B80000-0x00007FF637F76000-memory.dmp

Download

memory/1448-210-0x00007FF6E10B0000-0x00007FF6E14A6000-memory.dmp

Download

memory/1448-2371-0x00007FF6E10B0000-0x00007FF6E14A6000-memory.dmp

Download

memory/1456-2365-0x00007FF64FE00000-0x00007FF6501F6000-memory.dmp

Download

memory/1456-116-0x00007FF64FE00000-0x00007FF6501F6000-memory.dmp

Download

memory/1464-2356-0x00007FF666480000-0x00007FF666876000-memory.dmp

Download

memory/1464-123-0x00007FF666480000-0x00007FF666876000-memory.dmp

Download

memory/1568-89-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp

Download

memory/1568-2344-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp

Download

memory/1568-2358-0x00007FF7D32D0000-0x00007FF7D36C6000-memory.dmp

Download

memory/1576-192-0x00007FF718B10000-0x00007FF718F06000-memory.dmp

Download

memory/1576-2369-0x00007FF718B10000-0x00007FF718F06000-memory.dmp

Download

memory/1988-0-0x00007FF779180000-0x00007FF779576000-memory.dmp

Download

memory/1988-1-0x000001BA4EB00000-0x000001BA4EB10000-memory.dmp

Download

memory/2220-128-0x00007FF673830000-0x00007FF673C26000-memory.dmp

Download

memory/2220-2363-0x00007FF673830000-0x00007FF673C26000-memory.dmp

Download

memory/2588-191-0x00007FF6B16A0000-0x00007FF6B1A96000-memory.dmp

Download

memory/2588-2367-0x00007FF6B16A0000-0x00007FF6B1A96000-memory.dmp

Download

memory/2608-2366-0x00007FF771C30000-0x00007FF772026000-memory.dmp

Download

memory/2608-127-0x00007FF771C30000-0x00007FF772026000-memory.dmp

Download

memory/2916-2368-0x00007FF670540000-0x00007FF670936000-memory.dmp

Download

memory/2916-197-0x00007FF670540000-0x00007FF670936000-memory.dmp

Download

memory/3084-2370-0x00007FF689370000-0x00007FF689766000-memory.dmp

Download

memory/3084-211-0x00007FF689370000-0x00007FF689766000-memory.dmp

Download

memory/3152-81-0x00007FF74BD80000-0x00007FF74C176000-memory.dmp

Download

memory/3152-2351-0x00007FF74BD80000-0x00007FF74C176000-memory.dmp

Download

memory/3424-2361-0x00007FF6A2340000-0x00007FF6A2736000-memory.dmp

Download

memory/3424-120-0x00007FF6A2340000-0x00007FF6A2736000-memory.dmp

Download

memory/3700-2352-0x00007FF6502F0000-0x00007FF6506E6000-memory.dmp

Download

memory/3700-122-0x00007FF6502F0000-0x00007FF6506E6000-memory.dmp

Download

memory/3724-2362-0x00007FF743ED0000-0x00007FF7442C6000-memory.dmp

Download

memory/3724-119-0x00007FF743ED0000-0x00007FF7442C6000-memory.dmp

Download

memory/4064-2364-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp

Download

memory/4064-107-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp

Download

memory/4064-2345-0x00007FF61D2A0000-0x00007FF61D696000-memory.dmp

Download

memory/4180-38-0x00007FF709370000-0x00007FF709766000-memory.dmp

Download

memory/4180-2349-0x00007FF709370000-0x00007FF709766000-memory.dmp

Download

memory/4460-2343-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Download

memory/4460-2347-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Download

memory/4460-2346-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Download

memory/4460-15-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Download

memory/4460-212-0x00000190E0B40000-0x00000190E12E6000-memory.dmp

Download

memory/4460-33-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Download

memory/4460-50-0x00000190DFF90000-0x00000190DFFB2000-memory.dmp

Download

memory/4460-121-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Download

memory/4676-125-0x00007FF772010000-0x00007FF772406000-memory.dmp

Download

memory/4676-2354-0x00007FF772010000-0x00007FF772406000-memory.dmp

Download

memory/4772-2350-0x00007FF6BBE50000-0x00007FF6BC246000-memory.dmp

Download

memory/4772-39-0x00007FF6BBE50000-0x00007FF6BC246000-memory.dmp

Download