xmrig | 08a65effc69ad90473baca613af2683756f0f209241ab5b2f2f38b0f5fbfcef9

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
Size 1.6MB
Sample240528-jpbw4acf62
SHA256 08a65effc69ad90473baca613af2683756f0f209241ab5b2f2f38b0f5fbfcef9
MD5 399d7b88d04e539d8de8447817245600
SHA1 5afe88d53579835cdaf9d341fe31a4783bd59c14
SHA512 5b6518c6670f369679864d939285dfe72c798ebf1df71dc578dfea0ad44fccb530af1d9df10b7a6c075a423a54f28997d53bb01cf9325a60bd6ef448004ccb20
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dj:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1268-36-0x00007FF6DE770000-0x00007FF6DEB62000-memory.dmp	xmrig
behavioral2/memory/2540-120-0x00007FF727000000-0x00007FF7273F2000-memory.dmp	xmrig
behavioral2/memory/4284-134-0x00007FF645340000-0x00007FF645732000-memory.dmp	xmrig
behavioral2/memory/2620-176-0x00007FF7554A0000-0x00007FF755892000-memory.dmp	xmrig
behavioral2/memory/3572-182-0x00007FF6284A0000-0x00007FF628892000-memory.dmp	xmrig
behavioral2/memory/4468-170-0x00007FF732D40000-0x00007FF733132000-memory.dmp	xmrig
behavioral2/memory/1584-164-0x00007FF708CC0000-0x00007FF7090B2000-memory.dmp	xmrig
behavioral2/memory/3648-158-0x00007FF7A6390000-0x00007FF7A6782000-memory.dmp	xmrig
behavioral2/memory/1040-157-0x00007FF794D90000-0x00007FF795182000-memory.dmp	xmrig
behavioral2/memory/1904-151-0x00007FF651B50000-0x00007FF651F42000-memory.dmp	xmrig
behavioral2/memory/4540-145-0x00007FF65CBA0000-0x00007FF65CF92000-memory.dmp	xmrig
behavioral2/memory/1564-141-0x00007FF6F57D0000-0x00007FF6F5BC2000-memory.dmp	xmrig
behavioral2/memory/336-137-0x00007FF614540000-0x00007FF614932000-memory.dmp	xmrig
behavioral2/memory/1288-133-0x00007FF774730000-0x00007FF774B22000-memory.dmp	xmrig
behavioral2/memory/1504-130-0x00007FF68F0D0000-0x00007FF68F4C2000-memory.dmp	xmrig
behavioral2/memory/4668-127-0x00007FF74E120000-0x00007FF74E512000-memory.dmp	xmrig
behavioral2/memory/2776-121-0x00007FF6E7150000-0x00007FF6E7542000-memory.dmp	xmrig
behavioral2/memory/3208-116-0x00007FF718BD0000-0x00007FF718FC2000-memory.dmp	xmrig
behavioral2/memory/2900-109-0x00007FF62BFF0000-0x00007FF62C3E2000-memory.dmp	xmrig
behavioral2/memory/1592-104-0x00007FF659BE0000-0x00007FF659FD2000-memory.dmp	xmrig
behavioral2/memory/648-94-0x00007FF7F3D40000-0x00007FF7F4132000-memory.dmp	xmrig
behavioral2/memory/1884-27-0x00007FF6509B0000-0x00007FF650DA2000-memory.dmp	xmrig
behavioral2/memory/2080-2094-0x00007FF701D90000-0x00007FF702182000-memory.dmp	xmrig
behavioral2/memory/3156-2108-0x00007FF715E20000-0x00007FF716212000-memory.dmp	xmrig
behavioral2/memory/2080-2141-0x00007FF701D90000-0x00007FF702182000-memory.dmp	xmrig
behavioral2/memory/1268-2149-0x00007FF6DE770000-0x00007FF6DEB62000-memory.dmp	xmrig
behavioral2/memory/1884-2152-0x00007FF6509B0000-0x00007FF650DA2000-memory.dmp	xmrig
behavioral2/memory/3156-2153-0x00007FF715E20000-0x00007FF716212000-memory.dmp	xmrig
behavioral2/memory/1564-2160-0x00007FF6F57D0000-0x00007FF6F5BC2000-memory.dmp	xmrig
behavioral2/memory/648-2161-0x00007FF7F3D40000-0x00007FF7F4132000-memory.dmp	xmrig
behavioral2/memory/3208-2167-0x00007FF718BD0000-0x00007FF718FC2000-memory.dmp	xmrig
behavioral2/memory/2776-2169-0x00007FF6E7150000-0x00007FF6E7542000-memory.dmp	xmrig
behavioral2/memory/2540-2166-0x00007FF727000000-0x00007FF7273F2000-memory.dmp	xmrig
behavioral2/memory/1592-2164-0x00007FF659BE0000-0x00007FF659FD2000-memory.dmp	xmrig
behavioral2/memory/2900-2157-0x00007FF62BFF0000-0x00007FF62C3E2000-memory.dmp	xmrig
behavioral2/memory/336-2156-0x00007FF614540000-0x00007FF614932000-memory.dmp	xmrig
behavioral2/memory/1288-2171-0x00007FF774730000-0x00007FF774B22000-memory.dmp	xmrig
behavioral2/memory/3572-2194-0x00007FF6284A0000-0x00007FF628892000-memory.dmp	xmrig
behavioral2/memory/2620-2189-0x00007FF7554A0000-0x00007FF755892000-memory.dmp	xmrig
behavioral2/memory/3648-2187-0x00007FF7A6390000-0x00007FF7A6782000-memory.dmp	xmrig
behavioral2/memory/4284-2185-0x00007FF645340000-0x00007FF645732000-memory.dmp	xmrig
behavioral2/memory/1584-2183-0x00007FF708CC0000-0x00007FF7090B2000-memory.dmp	xmrig
behavioral2/memory/1040-2181-0x00007FF794D90000-0x00007FF795182000-memory.dmp	xmrig
behavioral2/memory/1904-2180-0x00007FF651B50000-0x00007FF651F42000-memory.dmp	xmrig
behavioral2/memory/4668-2178-0x00007FF74E120000-0x00007FF74E512000-memory.dmp	xmrig
behavioral2/memory/1504-2174-0x00007FF68F0D0000-0x00007FF68F4C2000-memory.dmp	xmrig
behavioral2/memory/4468-2191-0x00007FF732D40000-0x00007FF733132000-memory.dmp	xmrig
behavioral2/memory/4540-2176-0x00007FF65CBA0000-0x00007FF65CF92000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	2696	powershell.exe
10	2696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2080	sXSHgEl.exe
1268	sihUusJ.exe
1884	dTYDdiX.exe
3156	KRVHttS.exe
648	MOtDJaP.exe
336	ZhlxPBF.exe
1592	YZAEliI.exe
2900	WFJNGLR.exe
1564	ecAmMmI.exe
3208	bcsljWL.exe
2540	TyEMsMU.exe
2776	tmyoXXX.exe
4668	NDnQWgF.exe
1504	BCVRhNf.exe
1288	AkLumUt.exe
4540	DkNZjbT.exe
1904	pvjDBtv.exe
1040	uIdARqj.exe
4284	GnaGamo.exe
3648	kEFZhYm.exe
1584	NfFERNo.exe
4468	YuKrXCg.exe
2620	QfwbvXE.exe
3572	LBstmJf.exe
5104	rLMqtfX.exe
4352	nINNpTf.exe
2392	npZmKeD.exe
4560	sLbsyRm.exe
3060	UQwsjyr.exe
4760	LGnGVmj.exe
4520	NlkGCEI.exe
3964	hKyXmiT.exe
3592	tXKbraG.exe
1452	KmSatfv.exe
1360	YuLbjQW.exe
1736	cBIKmlV.exe
4684	DtwKGID.exe
1424	kovxEJC.exe
3336	SGloZzZ.exe
2368	BvIijhO.exe
4320	MEytHII.exe
4496	lXNjIrX.exe
4988	lytDblL.exe
1140	LgyqsRk.exe
4232	NJjBpEe.exe
3928	dEEhHxp.exe
464	vDtXIHk.exe
4016	BCtpcDK.exe
2372	hFSSYhb.exe
1888	GABVWFu.exe
832	DMJWpBN.exe
4088	QryjJis.exe
2544	LqAiIeq.exe
3656	XaRphnj.exe
3848	xJolvBS.exe
3920	nMiBEvq.exe
2624	eDHOuEL.exe
3392	PaROYiK.exe
2972	TEhjTZU.exe
5084	zokzpZG.exe
3332	cugtHNI.exe
1012	mOJkDji.exe
4856	uKXyNQG.exe
4396	EaAzRbF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1916-0-0x00007FF6631B0000-0x00007FF6635A2000-memory.dmp	upx
behavioral2/files/0x0008000000023420-5.dat	upx
behavioral2/files/0x0007000000023421-8.dat	upx
behavioral2/memory/2080-10-0x00007FF701D90000-0x00007FF702182000-memory.dmp	upx
behavioral2/files/0x0007000000023422-16.dat	upx
behavioral2/files/0x0007000000023424-25.dat	upx
behavioral2/files/0x0007000000023423-29.dat	upx
behavioral2/memory/1268-36-0x00007FF6DE770000-0x00007FF6DEB62000-memory.dmp	upx
behavioral2/files/0x0007000000023427-54.dat	upx
behavioral2/files/0x0007000000023428-68.dat	upx
behavioral2/files/0x0007000000023426-76.dat	upx
behavioral2/files/0x000800000002342b-90.dat	upx
behavioral2/files/0x0007000000023431-96.dat	upx
behavioral2/files/0x000700000002342f-105.dat	upx
behavioral2/files/0x0007000000023430-112.dat	upx
behavioral2/memory/2540-120-0x00007FF727000000-0x00007FF7273F2000-memory.dmp	upx
behavioral2/memory/4284-134-0x00007FF645340000-0x00007FF645732000-memory.dmp	upx
behavioral2/files/0x0007000000023435-142.dat	upx
behavioral2/files/0x0007000000023437-154.dat	upx
behavioral2/memory/2620-176-0x00007FF7554A0000-0x00007FF755892000-memory.dmp	upx
behavioral2/files/0x000700000002343b-188.dat	upx
behavioral2/files/0x000700000002343f-200.dat	upx
behavioral2/files/0x000700000002343d-198.dat	upx
behavioral2/files/0x000700000002343e-195.dat	upx
behavioral2/files/0x000700000002343c-193.dat	upx
behavioral2/files/0x000700000002343a-183.dat	upx
behavioral2/memory/3572-182-0x00007FF6284A0000-0x00007FF628892000-memory.dmp	upx
behavioral2/files/0x0007000000023439-177.dat	upx
behavioral2/files/0x0007000000023438-171.dat	upx
behavioral2/memory/4468-170-0x00007FF732D40000-0x00007FF733132000-memory.dmp	upx
behavioral2/memory/1584-164-0x00007FF708CC0000-0x00007FF7090B2000-memory.dmp	upx
behavioral2/files/0x0007000000023436-159.dat	upx
behavioral2/memory/3648-158-0x00007FF7A6390000-0x00007FF7A6782000-memory.dmp	upx
behavioral2/memory/1040-157-0x00007FF794D90000-0x00007FF795182000-memory.dmp	upx
behavioral2/memory/1904-151-0x00007FF651B50000-0x00007FF651F42000-memory.dmp	upx
behavioral2/files/0x0007000000023434-146.dat	upx
behavioral2/memory/4540-145-0x00007FF65CBA0000-0x00007FF65CF92000-memory.dmp	upx
behavioral2/memory/1564-141-0x00007FF6F57D0000-0x00007FF6F5BC2000-memory.dmp	upx
behavioral2/memory/336-137-0x00007FF614540000-0x00007FF614932000-memory.dmp	upx
behavioral2/memory/1288-133-0x00007FF774730000-0x00007FF774B22000-memory.dmp	upx
behavioral2/files/0x0007000000023433-131.dat	upx
behavioral2/memory/1504-130-0x00007FF68F0D0000-0x00007FF68F4C2000-memory.dmp	upx
behavioral2/files/0x0008000000023429-128.dat	upx
behavioral2/memory/4668-127-0x00007FF74E120000-0x00007FF74E512000-memory.dmp	upx
behavioral2/files/0x000800000002341e-125.dat	upx
behavioral2/files/0x0007000000023432-123.dat	upx
behavioral2/memory/2776-121-0x00007FF6E7150000-0x00007FF6E7542000-memory.dmp	upx
behavioral2/memory/3208-116-0x00007FF718BD0000-0x00007FF718FC2000-memory.dmp	upx
behavioral2/memory/2900-109-0x00007FF62BFF0000-0x00007FF62C3E2000-memory.dmp	upx
behavioral2/memory/1592-104-0x00007FF659BE0000-0x00007FF659FD2000-memory.dmp	upx
behavioral2/memory/648-94-0x00007FF7F3D40000-0x00007FF7F4132000-memory.dmp	upx
behavioral2/files/0x000700000002342d-93.dat	upx
behavioral2/files/0x000700000002342c-83.dat	upx
behavioral2/files/0x000700000002342e-87.dat	upx
behavioral2/files/0x000700000002342a-70.dat	upx
behavioral2/files/0x0007000000023425-58.dat	upx
behavioral2/memory/3156-28-0x00007FF715E20000-0x00007FF716212000-memory.dmp	upx
behavioral2/memory/1884-27-0x00007FF6509B0000-0x00007FF650DA2000-memory.dmp	upx
behavioral2/memory/2080-2094-0x00007FF701D90000-0x00007FF702182000-memory.dmp	upx
behavioral2/memory/3156-2108-0x00007FF715E20000-0x00007FF716212000-memory.dmp	upx
behavioral2/memory/2080-2141-0x00007FF701D90000-0x00007FF702182000-memory.dmp	upx
behavioral2/memory/1268-2149-0x00007FF6DE770000-0x00007FF6DEB62000-memory.dmp	upx
behavioral2/memory/1884-2152-0x00007FF6509B0000-0x00007FF650DA2000-memory.dmp	upx
behavioral2/memory/3156-2153-0x00007FF715E20000-0x00007FF716212000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XbtVrNZ.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\pJHtFXw.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\TRNSyzN.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\pxIkoTM.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\iVgebmo.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\wpHZuMz.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\UYIXftk.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\PYTzJzo.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\GNwaiPX.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\FvIntab.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\pwRMWlE.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\hwTFusS.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\qBqWikG.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\wHUoctf.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\NvKldig.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\UHXPnyw.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\FkGFPxR.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\SiEBMOM.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\HVQOsnW.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\eDHOuEL.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\yEylqEa.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\YSXTsWx.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\AdPQfgd.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\LZnHuje.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\hKyXmiT.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\NcjHpyt.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\JUtjQcJ.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\xZdusTq.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\QryjJis.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\zhWMyLk.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\zMUIvpV.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\hFSSYhb.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\TOIIcRu.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\ZbKfsfQ.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\jyspzBx.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\UVnHsNv.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\RHzIAjD.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\LqOXeCI.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\WDjokzq.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\nHQanbc.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\ijxSFYY.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\QXorXAg.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\QuISCom.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\rWeKOqo.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\QfwbvXE.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\fTACqyv.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\pFICrqv.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\VzszQaV.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\tjLATBb.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\YSsmFlN.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\DUGsaUA.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\vDyFszb.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\DGQpccm.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\uBRvKZY.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\XQzupdI.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\VVBjVaB.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\YZAEliI.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\BmvyQOs.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\eyzkSOi.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\hGbWdtU.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\JVrIzbQ.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\Jhqcucp.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\WFJNGLR.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
File created	C:\Windows\System\TPVMRaW.exe	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2696	powershell.exe
2696	powershell.exe
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
Token: SeDebugPrivilege	2696	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2696	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	84
PID 1916 wrote to memory of 2696	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	84
PID 1916 wrote to memory of 2080	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	85
PID 1916 wrote to memory of 2080	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	85
PID 1916 wrote to memory of 1268	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	86
PID 1916 wrote to memory of 1268	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	86
PID 1916 wrote to memory of 1884	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	87
PID 1916 wrote to memory of 1884	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	87
PID 1916 wrote to memory of 3156	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	88
PID 1916 wrote to memory of 3156	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	88
PID 1916 wrote to memory of 648	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	89
PID 1916 wrote to memory of 648	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	89
PID 1916 wrote to memory of 336	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	90
PID 1916 wrote to memory of 336	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	90
PID 1916 wrote to memory of 1592	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	91
PID 1916 wrote to memory of 1592	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	91
PID 1916 wrote to memory of 2900	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	92
PID 1916 wrote to memory of 2900	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	92
PID 1916 wrote to memory of 1564	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	93
PID 1916 wrote to memory of 1564	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	93
PID 1916 wrote to memory of 3208	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	94
PID 1916 wrote to memory of 3208	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	94
PID 1916 wrote to memory of 2540	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	95
PID 1916 wrote to memory of 2540	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	95
PID 1916 wrote to memory of 2776	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	96
PID 1916 wrote to memory of 2776	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	96
PID 1916 wrote to memory of 4668	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	97
PID 1916 wrote to memory of 4668	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	97
PID 1916 wrote to memory of 1504	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	98
PID 1916 wrote to memory of 1504	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	98
PID 1916 wrote to memory of 1288	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	99
PID 1916 wrote to memory of 1288	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	99
PID 1916 wrote to memory of 1904	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	100
PID 1916 wrote to memory of 1904	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	100
PID 1916 wrote to memory of 4540	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	101
PID 1916 wrote to memory of 4540	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	101
PID 1916 wrote to memory of 1040	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	102
PID 1916 wrote to memory of 1040	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	102
PID 1916 wrote to memory of 4284	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	103
PID 1916 wrote to memory of 4284	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	103
PID 1916 wrote to memory of 3648	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	104
PID 1916 wrote to memory of 3648	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	104
PID 1916 wrote to memory of 1584	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	105
PID 1916 wrote to memory of 1584	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	105
PID 1916 wrote to memory of 4468	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	106
PID 1916 wrote to memory of 4468	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	106
PID 1916 wrote to memory of 2620	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	107
PID 1916 wrote to memory of 2620	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	107
PID 1916 wrote to memory of 3572	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	108
PID 1916 wrote to memory of 3572	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	108
PID 1916 wrote to memory of 5104	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	109
PID 1916 wrote to memory of 5104	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	109
PID 1916 wrote to memory of 4352	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	110
PID 1916 wrote to memory of 4352	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	110
PID 1916 wrote to memory of 2392	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	111
PID 1916 wrote to memory of 2392	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	111
PID 1916 wrote to memory of 4560	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	112
PID 1916 wrote to memory of 4560	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	112
PID 1916 wrote to memory of 3060	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	113
PID 1916 wrote to memory of 3060	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	113
PID 1916 wrote to memory of 4760	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	114
PID 1916 wrote to memory of 4760	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	114
PID 1916 wrote to memory of 4520	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	115
PID 1916 wrote to memory of 4520	1916	399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\399d7b88d04e539d8de8447817245600_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2696" "2964" "2896" "2968" "0" "0" "2972" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13692
- C:\Windows\System\sXSHgEl.exe
  C:\Windows\System\sXSHgEl.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\sihUusJ.exe
  C:\Windows\System\sihUusJ.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\dTYDdiX.exe
  C:\Windows\System\dTYDdiX.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\KRVHttS.exe
  C:\Windows\System\KRVHttS.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\MOtDJaP.exe
  C:\Windows\System\MOtDJaP.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\ZhlxPBF.exe
  C:\Windows\System\ZhlxPBF.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\YZAEliI.exe
  C:\Windows\System\YZAEliI.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\WFJNGLR.exe
  C:\Windows\System\WFJNGLR.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ecAmMmI.exe
  C:\Windows\System\ecAmMmI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\bcsljWL.exe
  C:\Windows\System\bcsljWL.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\TyEMsMU.exe
  C:\Windows\System\TyEMsMU.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\tmyoXXX.exe
  C:\Windows\System\tmyoXXX.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NDnQWgF.exe
  C:\Windows\System\NDnQWgF.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\BCVRhNf.exe
  C:\Windows\System\BCVRhNf.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\AkLumUt.exe
  C:\Windows\System\AkLumUt.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\pvjDBtv.exe
  C:\Windows\System\pvjDBtv.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\DkNZjbT.exe
  C:\Windows\System\DkNZjbT.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\uIdARqj.exe
  C:\Windows\System\uIdARqj.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\GnaGamo.exe
  C:\Windows\System\GnaGamo.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\kEFZhYm.exe
  C:\Windows\System\kEFZhYm.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\NfFERNo.exe
  C:\Windows\System\NfFERNo.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\YuKrXCg.exe
  C:\Windows\System\YuKrXCg.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\QfwbvXE.exe
  C:\Windows\System\QfwbvXE.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\LBstmJf.exe
  C:\Windows\System\LBstmJf.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\rLMqtfX.exe
  C:\Windows\System\rLMqtfX.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\nINNpTf.exe
  C:\Windows\System\nINNpTf.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\npZmKeD.exe
  C:\Windows\System\npZmKeD.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\sLbsyRm.exe
  C:\Windows\System\sLbsyRm.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\UQwsjyr.exe
  C:\Windows\System\UQwsjyr.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\LGnGVmj.exe
  C:\Windows\System\LGnGVmj.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\NlkGCEI.exe
  C:\Windows\System\NlkGCEI.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\hKyXmiT.exe
  C:\Windows\System\hKyXmiT.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\tXKbraG.exe
  C:\Windows\System\tXKbraG.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\KmSatfv.exe
  C:\Windows\System\KmSatfv.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\YuLbjQW.exe
  C:\Windows\System\YuLbjQW.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\cBIKmlV.exe
  C:\Windows\System\cBIKmlV.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\DtwKGID.exe
  C:\Windows\System\DtwKGID.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\kovxEJC.exe
  C:\Windows\System\kovxEJC.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\SGloZzZ.exe
  C:\Windows\System\SGloZzZ.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\BvIijhO.exe
  C:\Windows\System\BvIijhO.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\MEytHII.exe
  C:\Windows\System\MEytHII.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\lXNjIrX.exe
  C:\Windows\System\lXNjIrX.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\lytDblL.exe
  C:\Windows\System\lytDblL.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LgyqsRk.exe
  C:\Windows\System\LgyqsRk.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\NJjBpEe.exe
  C:\Windows\System\NJjBpEe.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\dEEhHxp.exe
  C:\Windows\System\dEEhHxp.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\vDtXIHk.exe
  C:\Windows\System\vDtXIHk.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\BCtpcDK.exe
  C:\Windows\System\BCtpcDK.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\hFSSYhb.exe
  C:\Windows\System\hFSSYhb.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\GABVWFu.exe
  C:\Windows\System\GABVWFu.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\DMJWpBN.exe
  C:\Windows\System\DMJWpBN.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\QryjJis.exe
  C:\Windows\System\QryjJis.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\LqAiIeq.exe
  C:\Windows\System\LqAiIeq.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XaRphnj.exe
  C:\Windows\System\XaRphnj.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\xJolvBS.exe
  C:\Windows\System\xJolvBS.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\nMiBEvq.exe
  C:\Windows\System\nMiBEvq.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\eDHOuEL.exe
  C:\Windows\System\eDHOuEL.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\PaROYiK.exe
  C:\Windows\System\PaROYiK.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\TEhjTZU.exe
  C:\Windows\System\TEhjTZU.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\zokzpZG.exe
  C:\Windows\System\zokzpZG.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\cugtHNI.exe
  C:\Windows\System\cugtHNI.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\mOJkDji.exe
  C:\Windows\System\mOJkDji.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\uKXyNQG.exe
  C:\Windows\System\uKXyNQG.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\EaAzRbF.exe
  C:\Windows\System\EaAzRbF.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\mWLsWuh.exe
  C:\Windows\System\mWLsWuh.exe
  2⤵
  PID:3100
- C:\Windows\System\MjJcZzY.exe
  C:\Windows\System\MjJcZzY.exe
  2⤵
  PID:3924
- C:\Windows\System\hXNqgjP.exe
  C:\Windows\System\hXNqgjP.exe
  2⤵
  PID:3860
- C:\Windows\System\uVaLOMC.exe
  C:\Windows\System\uVaLOMC.exe
  2⤵
  PID:1088
- C:\Windows\System\wRQYhuJ.exe
  C:\Windows\System\wRQYhuJ.exe
  2⤵
  PID:5144
- C:\Windows\System\BOwfDEx.exe
  C:\Windows\System\BOwfDEx.exe
  2⤵
  PID:5160
- C:\Windows\System\FWUAIBI.exe
  C:\Windows\System\FWUAIBI.exe
  2⤵
  PID:5188
- C:\Windows\System\udHVdOx.exe
  C:\Windows\System\udHVdOx.exe
  2⤵
  PID:5216
- C:\Windows\System\tBUTjdw.exe
  C:\Windows\System\tBUTjdw.exe
  2⤵
  PID:5244
- C:\Windows\System\fdJWPBg.exe
  C:\Windows\System\fdJWPBg.exe
  2⤵
  PID:5276
- C:\Windows\System\BfXZBtQ.exe
  C:\Windows\System\BfXZBtQ.exe
  2⤵
  PID:5304
- C:\Windows\System\PEPATXC.exe
  C:\Windows\System\PEPATXC.exe
  2⤵
  PID:5328
- C:\Windows\System\XhyGwEq.exe
  C:\Windows\System\XhyGwEq.exe
  2⤵
  PID:5356
- C:\Windows\System\EvGnVoz.exe
  C:\Windows\System\EvGnVoz.exe
  2⤵
  PID:5388
- C:\Windows\System\UEfJAXM.exe
  C:\Windows\System\UEfJAXM.exe
  2⤵
  PID:5416
- C:\Windows\System\hJKzMmN.exe
  C:\Windows\System\hJKzMmN.exe
  2⤵
  PID:5440
- C:\Windows\System\RHaLyUv.exe
  C:\Windows\System\RHaLyUv.exe
  2⤵
  PID:5472
- C:\Windows\System\TPVMRaW.exe
  C:\Windows\System\TPVMRaW.exe
  2⤵
  PID:5500
- C:\Windows\System\hMMzLyG.exe
  C:\Windows\System\hMMzLyG.exe
  2⤵
  PID:5528
- C:\Windows\System\OnThRDo.exe
  C:\Windows\System\OnThRDo.exe
  2⤵
  PID:5556
- C:\Windows\System\FLHZxhs.exe
  C:\Windows\System\FLHZxhs.exe
  2⤵
  PID:5584
- C:\Windows\System\DzQvgvf.exe
  C:\Windows\System\DzQvgvf.exe
  2⤵
  PID:5616
- C:\Windows\System\iVgebmo.exe
  C:\Windows\System\iVgebmo.exe
  2⤵
  PID:5644
- C:\Windows\System\fYDWWif.exe
  C:\Windows\System\fYDWWif.exe
  2⤵
  PID:5672
- C:\Windows\System\TZIvdOs.exe
  C:\Windows\System\TZIvdOs.exe
  2⤵
  PID:5700
- C:\Windows\System\BxmNPoG.exe
  C:\Windows\System\BxmNPoG.exe
  2⤵
  PID:5724
- C:\Windows\System\XecktdB.exe
  C:\Windows\System\XecktdB.exe
  2⤵
  PID:5752
- C:\Windows\System\TOIIcRu.exe
  C:\Windows\System\TOIIcRu.exe
  2⤵
  PID:5784
- C:\Windows\System\aBAzVir.exe
  C:\Windows\System\aBAzVir.exe
  2⤵
  PID:5816
- C:\Windows\System\vhsLrNf.exe
  C:\Windows\System\vhsLrNf.exe
  2⤵
  PID:5840
- C:\Windows\System\lCwgEym.exe
  C:\Windows\System\lCwgEym.exe
  2⤵
  PID:5868
- C:\Windows\System\BWriWjN.exe
  C:\Windows\System\BWriWjN.exe
  2⤵
  PID:5896
- C:\Windows\System\JNzGMIH.exe
  C:\Windows\System\JNzGMIH.exe
  2⤵
  PID:5924
- C:\Windows\System\BmvyQOs.exe
  C:\Windows\System\BmvyQOs.exe
  2⤵
  PID:5952
- C:\Windows\System\iWJJFGw.exe
  C:\Windows\System\iWJJFGw.exe
  2⤵
  PID:5976
- C:\Windows\System\yEylqEa.exe
  C:\Windows\System\yEylqEa.exe
  2⤵
  PID:6004
- C:\Windows\System\EBJdMPR.exe
  C:\Windows\System\EBJdMPR.exe
  2⤵
  PID:6036
- C:\Windows\System\xwvmboD.exe
  C:\Windows\System\xwvmboD.exe
  2⤵
  PID:6060
- C:\Windows\System\LowRdMk.exe
  C:\Windows\System\LowRdMk.exe
  2⤵
  PID:6088
- C:\Windows\System\YSsmFlN.exe
  C:\Windows\System\YSsmFlN.exe
  2⤵
  PID:6116
- C:\Windows\System\iNZHDVU.exe
  C:\Windows\System\iNZHDVU.exe
  2⤵
  PID:5060
- C:\Windows\System\qWBXTsd.exe
  C:\Windows\System\qWBXTsd.exe
  2⤵
  PID:1668
- C:\Windows\System\wpHZuMz.exe
  C:\Windows\System\wpHZuMz.exe
  2⤵
  PID:2472
- C:\Windows\System\dCmLNeW.exe
  C:\Windows\System\dCmLNeW.exe
  2⤵
  PID:400
- C:\Windows\System\hXkvTMB.exe
  C:\Windows\System\hXkvTMB.exe
  2⤵
  PID:3176
- C:\Windows\System\geXjEyU.exe
  C:\Windows\System\geXjEyU.exe
  2⤵
  PID:5132
- C:\Windows\System\NvKldig.exe
  C:\Windows\System\NvKldig.exe
  2⤵
  PID:5200
- C:\Windows\System\KKLmZTd.exe
  C:\Windows\System\KKLmZTd.exe
  2⤵
  PID:5236
- C:\Windows\System\hrmQRuA.exe
  C:\Windows\System\hrmQRuA.exe
  2⤵
  PID:5316
- C:\Windows\System\lKmpaZX.exe
  C:\Windows\System\lKmpaZX.exe
  2⤵
  PID:5380
- C:\Windows\System\wxtvnih.exe
  C:\Windows\System\wxtvnih.exe
  2⤵
  PID:5456
- C:\Windows\System\UYIXftk.exe
  C:\Windows\System\UYIXftk.exe
  2⤵
  PID:5540
- C:\Windows\System\fYxBemr.exe
  C:\Windows\System\fYxBemr.exe
  2⤵
  PID:5600
- C:\Windows\System\UCAdUsg.exe
  C:\Windows\System\UCAdUsg.exe
  2⤵
  PID:5660
- C:\Windows\System\vATWQOi.exe
  C:\Windows\System\vATWQOi.exe
  2⤵
  PID:2408
- C:\Windows\System\bWeuzgY.exe
  C:\Windows\System\bWeuzgY.exe
  2⤵
  PID:5768
- C:\Windows\System\hmJszxb.exe
  C:\Windows\System\hmJszxb.exe
  2⤵
  PID:5832
- C:\Windows\System\GJyEQhE.exe
  C:\Windows\System\GJyEQhE.exe
  2⤵
  PID:5884
- C:\Windows\System\TnMPoLC.exe
  C:\Windows\System\TnMPoLC.exe
  2⤵
  PID:5940
- C:\Windows\System\GIXETOJ.exe
  C:\Windows\System\GIXETOJ.exe
  2⤵
  PID:5996
- C:\Windows\System\FvIntab.exe
  C:\Windows\System\FvIntab.exe
  2⤵
  PID:6048
- C:\Windows\System\aqIChPW.exe
  C:\Windows\System\aqIChPW.exe
  2⤵
  PID:4508
- C:\Windows\System\jVjnCll.exe
  C:\Windows\System\jVjnCll.exe
  2⤵
  PID:6136
- C:\Windows\System\EboEiLX.exe
  C:\Windows\System\EboEiLX.exe
  2⤵
  PID:2868
- C:\Windows\System\fqCaSrQ.exe
  C:\Windows\System\fqCaSrQ.exe
  2⤵
  PID:3596
- C:\Windows\System\tCYIoSH.exe
  C:\Windows\System\tCYIoSH.exe
  2⤵
  PID:3084
- C:\Windows\System\bXAReNE.exe
  C:\Windows\System\bXAReNE.exe
  2⤵
  PID:5268
- C:\Windows\System\BKYxKep.exe
  C:\Windows\System\BKYxKep.exe
  2⤵
  PID:5372
- C:\Windows\System\DGZxxcX.exe
  C:\Windows\System\DGZxxcX.exe
  2⤵
  PID:5512
- C:\Windows\System\oUUSdOo.exe
  C:\Windows\System\oUUSdOo.exe
  2⤵
  PID:5632
- C:\Windows\System\eEFOwcS.exe
  C:\Windows\System\eEFOwcS.exe
  2⤵
  PID:968
- C:\Windows\System\TwMFfiO.exe
  C:\Windows\System\TwMFfiO.exe
  2⤵
  PID:2656
- C:\Windows\System\nHQanbc.exe
  C:\Windows\System\nHQanbc.exe
  2⤵
  PID:1688
- C:\Windows\System\iGogHEq.exe
  C:\Windows\System\iGogHEq.exe
  2⤵
  PID:6020
- C:\Windows\System\CwolaHx.exe
  C:\Windows\System\CwolaHx.exe
  2⤵
  PID:6084
- C:\Windows\System\UaRfVGn.exe
  C:\Windows\System\UaRfVGn.exe
  2⤵
  PID:4384
- C:\Windows\System\nfBTZUP.exe
  C:\Windows\System\nfBTZUP.exe
  2⤵
  PID:3180
- C:\Windows\System\XCbTfXF.exe
  C:\Windows\System\XCbTfXF.exe
  2⤵
  PID:2160
- C:\Windows\System\XaYiXtR.exe
  C:\Windows\System\XaYiXtR.exe
  2⤵
  PID:5628
- C:\Windows\System\jaDqXQE.exe
  C:\Windows\System\jaDqXQE.exe
  2⤵
  PID:4184
- C:\Windows\System\GoXICAJ.exe
  C:\Windows\System\GoXICAJ.exe
  2⤵
  PID:4512
- C:\Windows\System\sKzpICx.exe
  C:\Windows\System\sKzpICx.exe
  2⤵
  PID:6076
- C:\Windows\System\ZRJxUnN.exe
  C:\Windows\System\ZRJxUnN.exe
  2⤵
  PID:4868
- C:\Windows\System\fKmgrax.exe
  C:\Windows\System\fKmgrax.exe
  2⤵
  PID:3540
- C:\Windows\System\zzWysXV.exe
  C:\Windows\System\zzWysXV.exe
  2⤵
  PID:5432
- C:\Windows\System\uVMuSJO.exe
  C:\Windows\System\uVMuSJO.exe
  2⤵
  PID:1460
- C:\Windows\System\IAJYVIr.exe
  C:\Windows\System\IAJYVIr.exe
  2⤵
  PID:1816
- C:\Windows\System\VpzXhjg.exe
  C:\Windows\System\VpzXhjg.exe
  2⤵
  PID:6172
- C:\Windows\System\uokaPRE.exe
  C:\Windows\System\uokaPRE.exe
  2⤵
  PID:6200
- C:\Windows\System\NOupRCh.exe
  C:\Windows\System\NOupRCh.exe
  2⤵
  PID:6228
- C:\Windows\System\YiKrMJP.exe
  C:\Windows\System\YiKrMJP.exe
  2⤵
  PID:6312
- C:\Windows\System\JiBrXTb.exe
  C:\Windows\System\JiBrXTb.exe
  2⤵
  PID:6352
- C:\Windows\System\SZWKDEx.exe
  C:\Windows\System\SZWKDEx.exe
  2⤵
  PID:6376
- C:\Windows\System\DFpaCPa.exe
  C:\Windows\System\DFpaCPa.exe
  2⤵
  PID:6392
- C:\Windows\System\xAkroCj.exe
  C:\Windows\System\xAkroCj.exe
  2⤵
  PID:6440
- C:\Windows\System\atvpFar.exe
  C:\Windows\System\atvpFar.exe
  2⤵
  PID:6464
- C:\Windows\System\AfafjUP.exe
  C:\Windows\System\AfafjUP.exe
  2⤵
  PID:6480
- C:\Windows\System\ddDFHKx.exe
  C:\Windows\System\ddDFHKx.exe
  2⤵
  PID:6504
- C:\Windows\System\DxWgrwX.exe
  C:\Windows\System\DxWgrwX.exe
  2⤵
  PID:6524
- C:\Windows\System\roMrsWL.exe
  C:\Windows\System\roMrsWL.exe
  2⤵
  PID:6552
- C:\Windows\System\vsGwNPL.exe
  C:\Windows\System\vsGwNPL.exe
  2⤵
  PID:6604
- C:\Windows\System\qALhfmf.exe
  C:\Windows\System\qALhfmf.exe
  2⤵
  PID:6632
- C:\Windows\System\syPwCRG.exe
  C:\Windows\System\syPwCRG.exe
  2⤵
  PID:6656
- C:\Windows\System\YlexXRg.exe
  C:\Windows\System\YlexXRg.exe
  2⤵
  PID:6672
- C:\Windows\System\oYzgoVX.exe
  C:\Windows\System\oYzgoVX.exe
  2⤵
  PID:6692
- C:\Windows\System\VdPLUqg.exe
  C:\Windows\System\VdPLUqg.exe
  2⤵
  PID:6712
- C:\Windows\System\VXXwBpZ.exe
  C:\Windows\System\VXXwBpZ.exe
  2⤵
  PID:6732
- C:\Windows\System\mJCvDSr.exe
  C:\Windows\System\mJCvDSr.exe
  2⤵
  PID:6748
- C:\Windows\System\UsAEcNl.exe
  C:\Windows\System\UsAEcNl.exe
  2⤵
  PID:6772
- C:\Windows\System\eyzkSOi.exe
  C:\Windows\System\eyzkSOi.exe
  2⤵
  PID:6788
- C:\Windows\System\ivvpHPe.exe
  C:\Windows\System\ivvpHPe.exe
  2⤵
  PID:6840
- C:\Windows\System\BNAHmbk.exe
  C:\Windows\System\BNAHmbk.exe
  2⤵
  PID:6860
- C:\Windows\System\oGwQkRn.exe
  C:\Windows\System\oGwQkRn.exe
  2⤵
  PID:6880
- C:\Windows\System\JkaKVqx.exe
  C:\Windows\System\JkaKVqx.exe
  2⤵
  PID:6900
- C:\Windows\System\jBHdYrm.exe
  C:\Windows\System\jBHdYrm.exe
  2⤵
  PID:6920
- C:\Windows\System\rWENYXe.exe
  C:\Windows\System\rWENYXe.exe
  2⤵
  PID:7008
- C:\Windows\System\WpwgnOE.exe
  C:\Windows\System\WpwgnOE.exe
  2⤵
  PID:7024
- C:\Windows\System\hGbWdtU.exe
  C:\Windows\System\hGbWdtU.exe
  2⤵
  PID:7044
- C:\Windows\System\NgSMbCw.exe
  C:\Windows\System\NgSMbCw.exe
  2⤵
  PID:7068
- C:\Windows\System\vvsXOGk.exe
  C:\Windows\System\vvsXOGk.exe
  2⤵
  PID:7084
- C:\Windows\System\UqQYudS.exe
  C:\Windows\System\UqQYudS.exe
  2⤵
  PID:7132
- C:\Windows\System\OfNpQOA.exe
  C:\Windows\System\OfNpQOA.exe
  2⤵
  PID:7164
- C:\Windows\System\iJFEpxU.exe
  C:\Windows\System\iJFEpxU.exe
  2⤵
  PID:6156
- C:\Windows\System\YIfPLWW.exe
  C:\Windows\System\YIfPLWW.exe
  2⤵
  PID:1484
- C:\Windows\System\YzTefYH.exe
  C:\Windows\System\YzTefYH.exe
  2⤵
  PID:6188
- C:\Windows\System\SDorlHk.exe
  C:\Windows\System\SDorlHk.exe
  2⤵
  PID:2364
- C:\Windows\System\pSgdNtP.exe
  C:\Windows\System\pSgdNtP.exe
  2⤵
  PID:684
- C:\Windows\System\DUIKTUa.exe
  C:\Windows\System\DUIKTUa.exe
  2⤵
  PID:2908
- C:\Windows\System\wvYazbt.exe
  C:\Windows\System\wvYazbt.exe
  2⤵
  PID:1480
- C:\Windows\System\MZlTCXb.exe
  C:\Windows\System\MZlTCXb.exe
  2⤵
  PID:6220
- C:\Windows\System\iGuAYol.exe
  C:\Windows\System\iGuAYol.exe
  2⤵
  PID:6340
- C:\Windows\System\AVqmWzT.exe
  C:\Windows\System\AVqmWzT.exe
  2⤵
  PID:5028
- C:\Windows\System\XHFicGZ.exe
  C:\Windows\System\XHFicGZ.exe
  2⤵
  PID:6408
- C:\Windows\System\jLEQZQJ.exe
  C:\Windows\System\jLEQZQJ.exe
  2⤵
  PID:6452
- C:\Windows\System\HbuuGiv.exe
  C:\Windows\System\HbuuGiv.exe
  2⤵
  PID:6520
- C:\Windows\System\rVQoVHr.exe
  C:\Windows\System\rVQoVHr.exe
  2⤵
  PID:6560
- C:\Windows\System\JKFYWht.exe
  C:\Windows\System\JKFYWht.exe
  2⤵
  PID:6704
- C:\Windows\System\lqqiiRp.exe
  C:\Windows\System\lqqiiRp.exe
  2⤵
  PID:6780
- C:\Windows\System\fTACqyv.exe
  C:\Windows\System\fTACqyv.exe
  2⤵
  PID:6848
- C:\Windows\System\aWjsczX.exe
  C:\Windows\System\aWjsczX.exe
  2⤵
  PID:6948
- C:\Windows\System\UvthaNd.exe
  C:\Windows\System\UvthaNd.exe
  2⤵
  PID:6980
- C:\Windows\System\GOJxKEa.exe
  C:\Windows\System\GOJxKEa.exe
  2⤵
  PID:7004
- C:\Windows\System\KRGlFGM.exe
  C:\Windows\System\KRGlFGM.exe
  2⤵
  PID:7064
- C:\Windows\System\jPLuiYI.exe
  C:\Windows\System\jPLuiYI.exe
  2⤵
  PID:7160
- C:\Windows\System\rVZvjnm.exe
  C:\Windows\System\rVZvjnm.exe
  2⤵
  PID:2608
- C:\Windows\System\AXUhIkV.exe
  C:\Windows\System\AXUhIkV.exe
  2⤵
  PID:6184
- C:\Windows\System\iMdXhiB.exe
  C:\Windows\System\iMdXhiB.exe
  2⤵
  PID:2388
- C:\Windows\System\UPhxCsA.exe
  C:\Windows\System\UPhxCsA.exe
  2⤵
  PID:6364
- C:\Windows\System\aaZDTCX.exe
  C:\Windows\System\aaZDTCX.exe
  2⤵
  PID:6388
- C:\Windows\System\RBLeyhK.exe
  C:\Windows\System\RBLeyhK.exe
  2⤵
  PID:6708
- C:\Windows\System\NcjHpyt.exe
  C:\Windows\System\NcjHpyt.exe
  2⤵
  PID:6916
- C:\Windows\System\tyPLUOq.exe
  C:\Windows\System\tyPLUOq.exe
  2⤵
  PID:6872
- C:\Windows\System\gZdrrKq.exe
  C:\Windows\System\gZdrrKq.exe
  2⤵
  PID:7036
- C:\Windows\System\yehBKFR.exe
  C:\Windows\System\yehBKFR.exe
  2⤵
  PID:4576
- C:\Windows\System\jSzGOna.exe
  C:\Windows\System\jSzGOna.exe
  2⤵
  PID:6492
- C:\Windows\System\vLsXbtI.exe
  C:\Windows\System\vLsXbtI.exe
  2⤵
  PID:6612
- C:\Windows\System\YcGNlHP.exe
  C:\Windows\System\YcGNlHP.exe
  2⤵
  PID:6740
- C:\Windows\System\PWboSYM.exe
  C:\Windows\System\PWboSYM.exe
  2⤵
  PID:6896
- C:\Windows\System\kXBJuyO.exe
  C:\Windows\System\kXBJuyO.exe
  2⤵
  PID:6720
- C:\Windows\System\JDqhfpi.exe
  C:\Windows\System\JDqhfpi.exe
  2⤵
  PID:7176
- C:\Windows\System\nTlPHoq.exe
  C:\Windows\System\nTlPHoq.exe
  2⤵
  PID:7200
- C:\Windows\System\LfGBFnb.exe
  C:\Windows\System\LfGBFnb.exe
  2⤵
  PID:7232
- C:\Windows\System\ZgJHZEn.exe
  C:\Windows\System\ZgJHZEn.exe
  2⤵
  PID:7268
- C:\Windows\System\gZrOEWi.exe
  C:\Windows\System\gZrOEWi.exe
  2⤵
  PID:7292
- C:\Windows\System\kvhDOIW.exe
  C:\Windows\System\kvhDOIW.exe
  2⤵
  PID:7348
- C:\Windows\System\LewGljJ.exe
  C:\Windows\System\LewGljJ.exe
  2⤵
  PID:7364
- C:\Windows\System\cufptsG.exe
  C:\Windows\System\cufptsG.exe
  2⤵
  PID:7392
- C:\Windows\System\aijxZTf.exe
  C:\Windows\System\aijxZTf.exe
  2⤵
  PID:7416
- C:\Windows\System\SMLuAsU.exe
  C:\Windows\System\SMLuAsU.exe
  2⤵
  PID:7436
- C:\Windows\System\uCwjaiq.exe
  C:\Windows\System\uCwjaiq.exe
  2⤵
  PID:7488
- C:\Windows\System\sAfvrOT.exe
  C:\Windows\System\sAfvrOT.exe
  2⤵
  PID:7508
- C:\Windows\System\DuuZLuK.exe
  C:\Windows\System\DuuZLuK.exe
  2⤵
  PID:7536
- C:\Windows\System\MIKyBjR.exe
  C:\Windows\System\MIKyBjR.exe
  2⤵
  PID:7552
- C:\Windows\System\dWHEyBa.exe
  C:\Windows\System\dWHEyBa.exe
  2⤵
  PID:7588
- C:\Windows\System\XhVczwr.exe
  C:\Windows\System\XhVczwr.exe
  2⤵
  PID:7612
- C:\Windows\System\NPzVTBA.exe
  C:\Windows\System\NPzVTBA.exe
  2⤵
  PID:7640
- C:\Windows\System\viWSkYG.exe
  C:\Windows\System\viWSkYG.exe
  2⤵
  PID:7696
- C:\Windows\System\TqgrwwD.exe
  C:\Windows\System\TqgrwwD.exe
  2⤵
  PID:7716
- C:\Windows\System\bEQvAuE.exe
  C:\Windows\System\bEQvAuE.exe
  2⤵
  PID:7740
- C:\Windows\System\qdPYSFr.exe
  C:\Windows\System\qdPYSFr.exe
  2⤵
  PID:7760
- C:\Windows\System\GZODEMi.exe
  C:\Windows\System\GZODEMi.exe
  2⤵
  PID:7784
- C:\Windows\System\eEziEtC.exe
  C:\Windows\System\eEziEtC.exe
  2⤵
  PID:7800
- C:\Windows\System\CFGxLtt.exe
  C:\Windows\System\CFGxLtt.exe
  2⤵
  PID:7828
- C:\Windows\System\WDlcNyP.exe
  C:\Windows\System\WDlcNyP.exe
  2⤵
  PID:7848
- C:\Windows\System\LfgiqwU.exe
  C:\Windows\System\LfgiqwU.exe
  2⤵
  PID:7872
- C:\Windows\System\gdjofks.exe
  C:\Windows\System\gdjofks.exe
  2⤵
  PID:7904
- C:\Windows\System\ROhQFRH.exe
  C:\Windows\System\ROhQFRH.exe
  2⤵
  PID:7976
- C:\Windows\System\Smwdgia.exe
  C:\Windows\System\Smwdgia.exe
  2⤵
  PID:7992
- C:\Windows\System\FGFVNwz.exe
  C:\Windows\System\FGFVNwz.exe
  2⤵
  PID:8012
- C:\Windows\System\xQwOmGl.exe
  C:\Windows\System\xQwOmGl.exe
  2⤵
  PID:8048
- C:\Windows\System\ijxSFYY.exe
  C:\Windows\System\ijxSFYY.exe
  2⤵
  PID:8068
- C:\Windows\System\jAGzzCV.exe
  C:\Windows\System\jAGzzCV.exe
  2⤵
  PID:8088
- C:\Windows\System\BWclKXF.exe
  C:\Windows\System\BWclKXF.exe
  2⤵
  PID:8120
- C:\Windows\System\FvRDkMv.exe
  C:\Windows\System\FvRDkMv.exe
  2⤵
  PID:8140
- C:\Windows\System\XYuTZIX.exe
  C:\Windows\System\XYuTZIX.exe
  2⤵
  PID:8160
- C:\Windows\System\DMdApbA.exe
  C:\Windows\System\DMdApbA.exe
  2⤵
  PID:8180
- C:\Windows\System\UHXPnyw.exe
  C:\Windows\System\UHXPnyw.exe
  2⤵
  PID:6852
- C:\Windows\System\iXSJyQB.exe
  C:\Windows\System\iXSJyQB.exe
  2⤵
  PID:7316
- C:\Windows\System\XXIciPT.exe
  C:\Windows\System\XXIciPT.exe
  2⤵
  PID:7336
- C:\Windows\System\fafwfWV.exe
  C:\Windows\System\fafwfWV.exe
  2⤵
  PID:7372
- C:\Windows\System\marnaWS.exe
  C:\Windows\System\marnaWS.exe
  2⤵
  PID:7428
- C:\Windows\System\zhWMyLk.exe
  C:\Windows\System\zhWMyLk.exe
  2⤵
  PID:7604
- C:\Windows\System\uqvXWGp.exe
  C:\Windows\System\uqvXWGp.exe
  2⤵
  PID:7624
- C:\Windows\System\XnWShQy.exe
  C:\Windows\System\XnWShQy.exe
  2⤵
  PID:7664
- C:\Windows\System\LbNHbEc.exe
  C:\Windows\System\LbNHbEc.exe
  2⤵
  PID:7732
- C:\Windows\System\oLrZDhR.exe
  C:\Windows\System\oLrZDhR.exe
  2⤵
  PID:7844
- C:\Windows\System\pFICrqv.exe
  C:\Windows\System\pFICrqv.exe
  2⤵
  PID:7840
- C:\Windows\System\kGGqYwY.exe
  C:\Windows\System\kGGqYwY.exe
  2⤵
  PID:7864
- C:\Windows\System\MYIsLBG.exe
  C:\Windows\System\MYIsLBG.exe
  2⤵
  PID:7984
- C:\Windows\System\tkAyTbi.exe
  C:\Windows\System\tkAyTbi.exe
  2⤵
  PID:8044
- C:\Windows\System\SHfNpVh.exe
  C:\Windows\System\SHfNpVh.exe
  2⤵
  PID:6540
- C:\Windows\System\NJWUPtS.exe
  C:\Windows\System\NJWUPtS.exe
  2⤵
  PID:8132
- C:\Windows\System\XAWwOeh.exe
  C:\Windows\System\XAWwOeh.exe
  2⤵
  PID:8176
- C:\Windows\System\PNvVzQi.exe
  C:\Windows\System\PNvVzQi.exe
  2⤵
  PID:7240
- C:\Windows\System\epNJSjN.exe
  C:\Windows\System\epNJSjN.exe
  2⤵
  PID:7284
- C:\Windows\System\SGpYqaU.exe
  C:\Windows\System\SGpYqaU.exe
  2⤵
  PID:7544
- C:\Windows\System\bqnmImg.exe
  C:\Windows\System\bqnmImg.exe
  2⤵
  PID:7724
- C:\Windows\System\FkGFPxR.exe
  C:\Windows\System\FkGFPxR.exe
  2⤵
  PID:7708
- C:\Windows\System\AQyAZFx.exe
  C:\Windows\System\AQyAZFx.exe
  2⤵
  PID:8024
- C:\Windows\System\dNnlKpj.exe
  C:\Windows\System\dNnlKpj.exe
  2⤵
  PID:7948
- C:\Windows\System\jTlEfHd.exe
  C:\Windows\System\jTlEfHd.exe
  2⤵
  PID:8156
- C:\Windows\System\aRykNBM.exe
  C:\Windows\System\aRykNBM.exe
  2⤵
  PID:8136
- C:\Windows\System\ejPNdho.exe
  C:\Windows\System\ejPNdho.exe
  2⤵
  PID:8204
- C:\Windows\System\upLZema.exe
  C:\Windows\System\upLZema.exe
  2⤵
  PID:8244
- C:\Windows\System\CsZIRzj.exe
  C:\Windows\System\CsZIRzj.exe
  2⤵
  PID:8272
- C:\Windows\System\WJLFvVm.exe
  C:\Windows\System\WJLFvVm.exe
  2⤵
  PID:8288
- C:\Windows\System\ANTqWNL.exe
  C:\Windows\System\ANTqWNL.exe
  2⤵
  PID:8308
- C:\Windows\System\dfunVOQ.exe
  C:\Windows\System\dfunVOQ.exe
  2⤵
  PID:8336
- C:\Windows\System\moLvzrZ.exe
  C:\Windows\System\moLvzrZ.exe
  2⤵
  PID:8356
- C:\Windows\System\voRtZza.exe
  C:\Windows\System\voRtZza.exe
  2⤵
  PID:8380
- C:\Windows\System\EWzwGKh.exe
  C:\Windows\System\EWzwGKh.exe
  2⤵
  PID:8396
- C:\Windows\System\eHHBHKI.exe
  C:\Windows\System\eHHBHKI.exe
  2⤵
  PID:8460
- C:\Windows\System\jhHrQyg.exe
  C:\Windows\System\jhHrQyg.exe
  2⤵
  PID:8516
- C:\Windows\System\kjUjfqG.exe
  C:\Windows\System\kjUjfqG.exe
  2⤵
  PID:8536
- C:\Windows\System\swBdZBt.exe
  C:\Windows\System\swBdZBt.exe
  2⤵
  PID:8572
- C:\Windows\System\YHfJBcA.exe
  C:\Windows\System\YHfJBcA.exe
  2⤵
  PID:8596
- C:\Windows\System\qPXwZqq.exe
  C:\Windows\System\qPXwZqq.exe
  2⤵
  PID:8628
- C:\Windows\System\Hszdgsg.exe
  C:\Windows\System\Hszdgsg.exe
  2⤵
  PID:8648
- C:\Windows\System\ovskhLD.exe
  C:\Windows\System\ovskhLD.exe
  2⤵
  PID:8688
- C:\Windows\System\QAJvLwx.exe
  C:\Windows\System\QAJvLwx.exe
  2⤵
  PID:8712
- C:\Windows\System\trpKTeH.exe
  C:\Windows\System\trpKTeH.exe
  2⤵
  PID:8732
- C:\Windows\System\DqNwfcq.exe
  C:\Windows\System\DqNwfcq.exe
  2⤵
  PID:8776
- C:\Windows\System\RGLpcCK.exe
  C:\Windows\System\RGLpcCK.exe
  2⤵
  PID:8796
- C:\Windows\System\klIyNiC.exe
  C:\Windows\System\klIyNiC.exe
  2⤵
  PID:8816
- C:\Windows\System\oZqOVmd.exe
  C:\Windows\System\oZqOVmd.exe
  2⤵
  PID:8836
- C:\Windows\System\OjkYsLP.exe
  C:\Windows\System\OjkYsLP.exe
  2⤵
  PID:8852
- C:\Windows\System\zXnkpfV.exe
  C:\Windows\System\zXnkpfV.exe
  2⤵
  PID:8892
- C:\Windows\System\SiEBMOM.exe
  C:\Windows\System\SiEBMOM.exe
  2⤵
  PID:8936
- C:\Windows\System\NlAmVCp.exe
  C:\Windows\System\NlAmVCp.exe
  2⤵
  PID:8960
- C:\Windows\System\kprOiXd.exe
  C:\Windows\System\kprOiXd.exe
  2⤵
  PID:8980
- C:\Windows\System\zaDRdub.exe
  C:\Windows\System\zaDRdub.exe
  2⤵
  PID:9008
- C:\Windows\System\QopsDYQ.exe
  C:\Windows\System\QopsDYQ.exe
  2⤵
  PID:9048
- C:\Windows\System\DUGsaUA.exe
  C:\Windows\System\DUGsaUA.exe
  2⤵
  PID:9084
- C:\Windows\System\ILhquoY.exe
  C:\Windows\System\ILhquoY.exe
  2⤵
  PID:9120
- C:\Windows\System\uKXNrrD.exe
  C:\Windows\System\uKXNrrD.exe
  2⤵
  PID:9144
- C:\Windows\System\wjalTxt.exe
  C:\Windows\System\wjalTxt.exe
  2⤵
  PID:9176
- C:\Windows\System\pRcRvuo.exe
  C:\Windows\System\pRcRvuo.exe
  2⤵
  PID:9196
- C:\Windows\System\PYTzJzo.exe
  C:\Windows\System\PYTzJzo.exe
  2⤵
  PID:7620
- C:\Windows\System\JtKmKCC.exe
  C:\Windows\System\JtKmKCC.exe
  2⤵
  PID:8196
- C:\Windows\System\Bxlslrb.exe
  C:\Windows\System\Bxlslrb.exe
  2⤵
  PID:8256
- C:\Windows\System\bWAdSPE.exe
  C:\Windows\System\bWAdSPE.exe
  2⤵
  PID:8320
- C:\Windows\System\AVrPsof.exe
  C:\Windows\System\AVrPsof.exe
  2⤵
  PID:8404
- C:\Windows\System\vcDRgrl.exe
  C:\Windows\System\vcDRgrl.exe
  2⤵
  PID:8364
- C:\Windows\System\GHkkkxg.exe
  C:\Windows\System\GHkkkxg.exe
  2⤵
  PID:8448
- C:\Windows\System\XbtVrNZ.exe
  C:\Windows\System\XbtVrNZ.exe
  2⤵
  PID:8500
- C:\Windows\System\KrpKsnU.exe
  C:\Windows\System\KrpKsnU.exe
  2⤵
  PID:8588
- C:\Windows\System\jPoLmHY.exe
  C:\Windows\System\jPoLmHY.exe
  2⤵
  PID:8636
- C:\Windows\System\zNysPJL.exe
  C:\Windows\System\zNysPJL.exe
  2⤵
  PID:8720
- C:\Windows\System\MGndrMz.exe
  C:\Windows\System\MGndrMz.exe
  2⤵
  PID:8748
- C:\Windows\System\OpDbmBH.exe
  C:\Windows\System\OpDbmBH.exe
  2⤵
  PID:8812
- C:\Windows\System\MGgpcJD.exe
  C:\Windows\System\MGgpcJD.exe
  2⤵
  PID:8848
- C:\Windows\System\XVnBayV.exe
  C:\Windows\System\XVnBayV.exe
  2⤵
  PID:9000
- C:\Windows\System\oQHrQLQ.exe
  C:\Windows\System\oQHrQLQ.exe
  2⤵
  PID:9072
- C:\Windows\System\fYujhLD.exe
  C:\Windows\System\fYujhLD.exe
  2⤵
  PID:9136
- C:\Windows\System\SlMXRKZ.exe
  C:\Windows\System\SlMXRKZ.exe
  2⤵
  PID:9168
- C:\Windows\System\JUyBVar.exe
  C:\Windows\System\JUyBVar.exe
  2⤵
  PID:8040
- C:\Windows\System\JgixRzw.exe
  C:\Windows\System\JgixRzw.exe
  2⤵
  PID:8316
- C:\Windows\System\JDQGWzE.exe
  C:\Windows\System\JDQGWzE.exe
  2⤵
  PID:8432
- C:\Windows\System\PcIRZzQ.exe
  C:\Windows\System\PcIRZzQ.exe
  2⤵
  PID:1280
- C:\Windows\System\NJCBtuH.exe
  C:\Windows\System\NJCBtuH.exe
  2⤵
  PID:8700
- C:\Windows\System\JRWHTGn.exe
  C:\Windows\System\JRWHTGn.exe
  2⤵
  PID:8828
- C:\Windows\System\JmOZgrC.exe
  C:\Windows\System\JmOZgrC.exe
  2⤵
  PID:8884
- C:\Windows\System\GaMPiYp.exe
  C:\Windows\System\GaMPiYp.exe
  2⤵
  PID:9128
- C:\Windows\System\bQTialJ.exe
  C:\Windows\System\bQTialJ.exe
  2⤵
  PID:8216
- C:\Windows\System\IgfnUAd.exe
  C:\Windows\System\IgfnUAd.exe
  2⤵
  PID:4224
- C:\Windows\System\QoditYK.exe
  C:\Windows\System\QoditYK.exe
  2⤵
  PID:8644
- C:\Windows\System\FRZnGXQ.exe
  C:\Windows\System\FRZnGXQ.exe
  2⤵
  PID:5064
- C:\Windows\System\wtbhEji.exe
  C:\Windows\System\wtbhEji.exe
  2⤵
  PID:7628
- C:\Windows\System\selMIyv.exe
  C:\Windows\System\selMIyv.exe
  2⤵
  PID:9240
- C:\Windows\System\nVjBYBt.exe
  C:\Windows\System\nVjBYBt.exe
  2⤵
  PID:9264
- C:\Windows\System\uiDdzbQ.exe
  C:\Windows\System\uiDdzbQ.exe
  2⤵
  PID:9284
- C:\Windows\System\tCeLkRw.exe
  C:\Windows\System\tCeLkRw.exe
  2⤵
  PID:9300
- C:\Windows\System\GljujGB.exe
  C:\Windows\System\GljujGB.exe
  2⤵
  PID:9320
- C:\Windows\System\Twbyjay.exe
  C:\Windows\System\Twbyjay.exe
  2⤵
  PID:9376
- C:\Windows\System\XcMKkgL.exe
  C:\Windows\System\XcMKkgL.exe
  2⤵
  PID:9404
- C:\Windows\System\niKRojF.exe
  C:\Windows\System\niKRojF.exe
  2⤵
  PID:9432
- C:\Windows\System\YDLJvXq.exe
  C:\Windows\System\YDLJvXq.exe
  2⤵
  PID:9452
- C:\Windows\System\UWSDnsO.exe
  C:\Windows\System\UWSDnsO.exe
  2⤵
  PID:9472
- C:\Windows\System\pwRMWlE.exe
  C:\Windows\System\pwRMWlE.exe
  2⤵
  PID:9532
- C:\Windows\System\AyhrIGk.exe
  C:\Windows\System\AyhrIGk.exe
  2⤵
  PID:9552
- C:\Windows\System\hmeKNCH.exe
  C:\Windows\System\hmeKNCH.exe
  2⤵
  PID:9580
- C:\Windows\System\MDVIzFq.exe
  C:\Windows\System\MDVIzFq.exe
  2⤵
  PID:9604
- C:\Windows\System\IDfWQyB.exe
  C:\Windows\System\IDfWQyB.exe
  2⤵
  PID:9644
- C:\Windows\System\zZNBHEi.exe
  C:\Windows\System\zZNBHEi.exe
  2⤵
  PID:9680
- C:\Windows\System\XtQUDzC.exe
  C:\Windows\System\XtQUDzC.exe
  2⤵
  PID:9700
- C:\Windows\System\phUZdFm.exe
  C:\Windows\System\phUZdFm.exe
  2⤵
  PID:9736
- C:\Windows\System\JUtjQcJ.exe
  C:\Windows\System\JUtjQcJ.exe
  2⤵
  PID:9752
- C:\Windows\System\OftjmhI.exe
  C:\Windows\System\OftjmhI.exe
  2⤵
  PID:9772
- C:\Windows\System\DXptBiQ.exe
  C:\Windows\System\DXptBiQ.exe
  2⤵
  PID:9872
- C:\Windows\System\ibJPipm.exe
  C:\Windows\System\ibJPipm.exe
  2⤵
  PID:9888
- C:\Windows\System\PqQJhxb.exe
  C:\Windows\System\PqQJhxb.exe
  2⤵
  PID:9988
- C:\Windows\System\gpqmOPx.exe
  C:\Windows\System\gpqmOPx.exe
  2⤵
  PID:10004
- C:\Windows\System\rABMonk.exe
  C:\Windows\System\rABMonk.exe
  2⤵
  PID:10020
- C:\Windows\System\JIKERvm.exe
  C:\Windows\System\JIKERvm.exe
  2⤵
  PID:10036
- C:\Windows\System\OVJSMMn.exe
  C:\Windows\System\OVJSMMn.exe
  2⤵
  PID:10052
- C:\Windows\System\dELOwdd.exe
  C:\Windows\System\dELOwdd.exe
  2⤵
  PID:10068
- C:\Windows\System\nZBzDSO.exe
  C:\Windows\System\nZBzDSO.exe
  2⤵
  PID:10084
- C:\Windows\System\irKhGpu.exe
  C:\Windows\System\irKhGpu.exe
  2⤵
  PID:10104
- C:\Windows\System\yiJyrMV.exe
  C:\Windows\System\yiJyrMV.exe
  2⤵
  PID:10168
- C:\Windows\System\zRFfbpp.exe
  C:\Windows\System\zRFfbpp.exe
  2⤵
  PID:10192
- C:\Windows\System\ZaUwBzV.exe
  C:\Windows\System\ZaUwBzV.exe
  2⤵
  PID:10216
- C:\Windows\System\uAxLXHy.exe
  C:\Windows\System\uAxLXHy.exe
  2⤵
  PID:9160
- C:\Windows\System\ppnFjEF.exe
  C:\Windows\System\ppnFjEF.exe
  2⤵
  PID:9312
- C:\Windows\System\vmtXCaw.exe
  C:\Windows\System\vmtXCaw.exe
  2⤵
  PID:9332
- C:\Windows\System\EZAGAVA.exe
  C:\Windows\System\EZAGAVA.exe
  2⤵
  PID:9468
- C:\Windows\System\ZbKfsfQ.exe
  C:\Windows\System\ZbKfsfQ.exe
  2⤵
  PID:4876
- C:\Windows\System\eGGjfqm.exe
  C:\Windows\System\eGGjfqm.exe
  2⤵
  PID:9600
- C:\Windows\System\aOgVxWz.exe
  C:\Windows\System\aOgVxWz.exe
  2⤵
  PID:9616
- C:\Windows\System\kOgYCUP.exe
  C:\Windows\System\kOgYCUP.exe
  2⤵
  PID:9696
- C:\Windows\System\LIfJPPN.exe
  C:\Windows\System\LIfJPPN.exe
  2⤵
  PID:9796
- C:\Windows\System\yYUkKmL.exe
  C:\Windows\System\yYUkKmL.exe
  2⤵
  PID:9764
- C:\Windows\System\nsGnHoH.exe
  C:\Windows\System\nsGnHoH.exe
  2⤵
  PID:9812
- C:\Windows\System\CQssfhC.exe
  C:\Windows\System\CQssfhC.exe
  2⤵
  PID:9844
- C:\Windows\System\PwysuIo.exe
  C:\Windows\System\PwysuIo.exe
  2⤵
  PID:10000
- C:\Windows\System\atLHaDj.exe
  C:\Windows\System\atLHaDj.exe
  2⤵
  PID:10048
- C:\Windows\System\oPTlIIf.exe
  C:\Windows\System\oPTlIIf.exe
  2⤵
  PID:9948
- C:\Windows\System\kACFfbp.exe
  C:\Windows\System\kACFfbp.exe
  2⤵
  PID:9900
- C:\Windows\System\HazcvYh.exe
  C:\Windows\System\HazcvYh.exe
  2⤵
  PID:10144
- C:\Windows\System\lKDmxcH.exe
  C:\Windows\System\lKDmxcH.exe
  2⤵
  PID:10176
- C:\Windows\System\tYcQhRe.exe
  C:\Windows\System\tYcQhRe.exe
  2⤵
  PID:10180
- C:\Windows\System\FhErLGY.exe
  C:\Windows\System\FhErLGY.exe
  2⤵
  PID:3492
- C:\Windows\System\nJClzcN.exe
  C:\Windows\System\nJClzcN.exe
  2⤵
  PID:9428
- C:\Windows\System\jQLDVSO.exe
  C:\Windows\System\jQLDVSO.exe
  2⤵
  PID:9392
- C:\Windows\System\ujxPeUC.exe
  C:\Windows\System\ujxPeUC.exe
  2⤵
  PID:9708
- C:\Windows\System\qpZuclu.exe
  C:\Windows\System\qpZuclu.exe
  2⤵
  PID:9784
- C:\Windows\System\kXMOcig.exe
  C:\Windows\System\kXMOcig.exe
  2⤵
  PID:10064
- C:\Windows\System\SKlKHpS.exe
  C:\Windows\System\SKlKHpS.exe
  2⤵
  PID:9880
- C:\Windows\System\UFfxPAB.exe
  C:\Windows\System\UFfxPAB.exe
  2⤵
  PID:9364
- C:\Windows\System\ThHmFed.exe
  C:\Windows\System\ThHmFed.exe
  2⤵
  PID:9668
- C:\Windows\System\bxdWCjQ.exe
  C:\Windows\System\bxdWCjQ.exe
  2⤵
  PID:9832
- C:\Windows\System\bfUDcwb.exe
  C:\Windows\System\bfUDcwb.exe
  2⤵
  PID:2996
- C:\Windows\System\ohKVRqj.exe
  C:\Windows\System\ohKVRqj.exe
  2⤵
  PID:9956
- C:\Windows\System\uNCmpDx.exe
  C:\Windows\System\uNCmpDx.exe
  2⤵
  PID:9744
- C:\Windows\System\JlJxJFy.exe
  C:\Windows\System\JlJxJFy.exe
  2⤵
  PID:10252
- C:\Windows\System\BeuNTSx.exe
  C:\Windows\System\BeuNTSx.exe
  2⤵
  PID:10292
- C:\Windows\System\kKztgYv.exe
  C:\Windows\System\kKztgYv.exe
  2⤵
  PID:10320
- C:\Windows\System\wJOirjS.exe
  C:\Windows\System\wJOirjS.exe
  2⤵
  PID:10344
- C:\Windows\System\DhCuCFx.exe
  C:\Windows\System\DhCuCFx.exe
  2⤵
  PID:10384
- C:\Windows\System\zfmpExH.exe
  C:\Windows\System\zfmpExH.exe
  2⤵
  PID:10412
- C:\Windows\System\GlPKxsy.exe
  C:\Windows\System\GlPKxsy.exe
  2⤵
  PID:10428
- C:\Windows\System\YWUKfcX.exe
  C:\Windows\System\YWUKfcX.exe
  2⤵
  PID:10452
- C:\Windows\System\Gljofzn.exe
  C:\Windows\System\Gljofzn.exe
  2⤵
  PID:10476
- C:\Windows\System\tSAskGM.exe
  C:\Windows\System\tSAskGM.exe
  2⤵
  PID:10492
- C:\Windows\System\kdMjdzr.exe
  C:\Windows\System\kdMjdzr.exe
  2⤵
  PID:10524
- C:\Windows\System\OLMBFMR.exe
  C:\Windows\System\OLMBFMR.exe
  2⤵
  PID:10540
- C:\Windows\System\KSHOYCW.exe
  C:\Windows\System\KSHOYCW.exe
  2⤵
  PID:10600
- C:\Windows\System\oczfxge.exe
  C:\Windows\System\oczfxge.exe
  2⤵
  PID:10628
- C:\Windows\System\JUIzeNs.exe
  C:\Windows\System\JUIzeNs.exe
  2⤵
  PID:10668
- C:\Windows\System\xtYUUrM.exe
  C:\Windows\System\xtYUUrM.exe
  2⤵
  PID:10696
- C:\Windows\System\AUCqTCS.exe
  C:\Windows\System\AUCqTCS.exe
  2⤵
  PID:10728
- C:\Windows\System\egyCzaN.exe
  C:\Windows\System\egyCzaN.exe
  2⤵
  PID:10748
- C:\Windows\System\sezNVwV.exe
  C:\Windows\System\sezNVwV.exe
  2⤵
  PID:10768
- C:\Windows\System\cdbJNHI.exe
  C:\Windows\System\cdbJNHI.exe
  2⤵
  PID:10796
- C:\Windows\System\pJHtFXw.exe
  C:\Windows\System\pJHtFXw.exe
  2⤵
  PID:10820
- C:\Windows\System\DiOQihc.exe
  C:\Windows\System\DiOQihc.exe
  2⤵
  PID:10836
- C:\Windows\System\fefvnKP.exe
  C:\Windows\System\fefvnKP.exe
  2⤵
  PID:10852
- C:\Windows\System\IgiJSfC.exe
  C:\Windows\System\IgiJSfC.exe
  2⤵
  PID:10872
- C:\Windows\System\QnwXLUA.exe
  C:\Windows\System\QnwXLUA.exe
  2⤵
  PID:10908
- C:\Windows\System\fDAnIzo.exe
  C:\Windows\System\fDAnIzo.exe
  2⤵
  PID:10932
- C:\Windows\System\eNuKyKh.exe
  C:\Windows\System\eNuKyKh.exe
  2⤵
  PID:10972
- C:\Windows\System\ARjHEJY.exe
  C:\Windows\System\ARjHEJY.exe
  2⤵
  PID:11008
- C:\Windows\System\tsgqhCj.exe
  C:\Windows\System\tsgqhCj.exe
  2⤵
  PID:11040
- C:\Windows\System\CHxNAht.exe
  C:\Windows\System\CHxNAht.exe
  2⤵
  PID:11072
- C:\Windows\System\wGDBuDa.exe
  C:\Windows\System\wGDBuDa.exe
  2⤵
  PID:11092
- C:\Windows\System\pYtNVEd.exe
  C:\Windows\System\pYtNVEd.exe
  2⤵
  PID:11132
- C:\Windows\System\QXorXAg.exe
  C:\Windows\System\QXorXAg.exe
  2⤵
  PID:11168
- C:\Windows\System\XlAkPUl.exe
  C:\Windows\System\XlAkPUl.exe
  2⤵
  PID:11196
- C:\Windows\System\RdWcCHd.exe
  C:\Windows\System\RdWcCHd.exe
  2⤵
  PID:11216
- C:\Windows\System\OWScxUp.exe
  C:\Windows\System\OWScxUp.exe
  2⤵
  PID:11244
- C:\Windows\System\PuRGitg.exe
  C:\Windows\System\PuRGitg.exe
  2⤵
  PID:11260
- C:\Windows\System\lyCYTUd.exe
  C:\Windows\System\lyCYTUd.exe
  2⤵
  PID:3496
- C:\Windows\System\EIWBSsf.exe
  C:\Windows\System\EIWBSsf.exe
  2⤵
  PID:10284
- C:\Windows\System\wmMqfKL.exe
  C:\Windows\System\wmMqfKL.exe
  2⤵
  PID:10408
- C:\Windows\System\ZpbfxwO.exe
  C:\Windows\System\ZpbfxwO.exe
  2⤵
  PID:10440
- C:\Windows\System\SACOdRL.exe
  C:\Windows\System\SACOdRL.exe
  2⤵
  PID:10472
- C:\Windows\System\fsDotmx.exe
  C:\Windows\System\fsDotmx.exe
  2⤵
  PID:10572
- C:\Windows\System\OZDCvrz.exe
  C:\Windows\System\OZDCvrz.exe
  2⤵
  PID:10624
- C:\Windows\System\MZPewCX.exe
  C:\Windows\System\MZPewCX.exe
  2⤵
  PID:10692
- C:\Windows\System\IoMeuJB.exe
  C:\Windows\System\IoMeuJB.exe
  2⤵
  PID:10716
- C:\Windows\System\ysWBxgZ.exe
  C:\Windows\System\ysWBxgZ.exe
  2⤵
  PID:10776
- C:\Windows\System\TrTYbDY.exe
  C:\Windows\System\TrTYbDY.exe
  2⤵
  PID:10828
- C:\Windows\System\ZYKGBLY.exe
  C:\Windows\System\ZYKGBLY.exe
  2⤵
  PID:10868
- C:\Windows\System\pmJooiR.exe
  C:\Windows\System\pmJooiR.exe
  2⤵
  PID:11032
- C:\Windows\System\oxqZPkE.exe
  C:\Windows\System\oxqZPkE.exe
  2⤵
  PID:11088
- C:\Windows\System\bkBwQBw.exe
  C:\Windows\System\bkBwQBw.exe
  2⤵
  PID:11148
- C:\Windows\System\oZYuBVY.exe
  C:\Windows\System\oZYuBVY.exe
  2⤵
  PID:11180
- C:\Windows\System\noLvLUG.exe
  C:\Windows\System\noLvLUG.exe
  2⤵
  PID:10060
- C:\Windows\System\kMbEcMa.exe
  C:\Windows\System\kMbEcMa.exe
  2⤵
  PID:10368
- C:\Windows\System\bOIgaiv.exe
  C:\Windows\System\bOIgaiv.exe
  2⤵
  PID:10460
- C:\Windows\System\zbBqoVG.exe
  C:\Windows\System\zbBqoVG.exe
  2⤵
  PID:10548
- C:\Windows\System\UGQOQnP.exe
  C:\Windows\System\UGQOQnP.exe
  2⤵
  PID:10664
- C:\Windows\System\gWkdOLc.exe
  C:\Windows\System\gWkdOLc.exe
  2⤵
  PID:10844
- C:\Windows\System\LZrZBxd.exe
  C:\Windows\System\LZrZBxd.exe
  2⤵
  PID:11024
- C:\Windows\System\NWhkypo.exe
  C:\Windows\System\NWhkypo.exe
  2⤵
  PID:11144
- C:\Windows\System\IfrxAMd.exe
  C:\Windows\System\IfrxAMd.exe
  2⤵
  PID:9864
- C:\Windows\System\CQLxuCg.exe
  C:\Windows\System\CQLxuCg.exe
  2⤵
  PID:10032
- C:\Windows\System\nezywLu.exe
  C:\Windows\System\nezywLu.exe
  2⤵
  PID:10904
- C:\Windows\System\ykmaiHq.exe
  C:\Windows\System\ykmaiHq.exe
  2⤵
  PID:11296
- C:\Windows\System\hVoknWn.exe
  C:\Windows\System\hVoknWn.exe
  2⤵
  PID:11332
- C:\Windows\System\okIQyBp.exe
  C:\Windows\System\okIQyBp.exe
  2⤵
  PID:11388
- C:\Windows\System\jMQhDtz.exe
  C:\Windows\System\jMQhDtz.exe
  2⤵
  PID:11408
- C:\Windows\System\OzhPKSS.exe
  C:\Windows\System\OzhPKSS.exe
  2⤵
  PID:11436
- C:\Windows\System\pfEDJhi.exe
  C:\Windows\System\pfEDJhi.exe
  2⤵
  PID:11480
- C:\Windows\System\TbmOxGV.exe
  C:\Windows\System\TbmOxGV.exe
  2⤵
  PID:11512
- C:\Windows\System\IiuRIIz.exe
  C:\Windows\System\IiuRIIz.exe
  2⤵
  PID:11552
- C:\Windows\System\pHDcDrR.exe
  C:\Windows\System\pHDcDrR.exe
  2⤵
  PID:11576
- C:\Windows\System\GkSPckF.exe
  C:\Windows\System\GkSPckF.exe
  2⤵
  PID:11600
- C:\Windows\System\EyXdbfh.exe
  C:\Windows\System\EyXdbfh.exe
  2⤵
  PID:11616
- C:\Windows\System\loBHoeQ.exe
  C:\Windows\System\loBHoeQ.exe
  2⤵
  PID:11640
- C:\Windows\System\ejBFfhM.exe
  C:\Windows\System\ejBFfhM.exe
  2⤵
  PID:11660
- C:\Windows\System\QeoxgdJ.exe
  C:\Windows\System\QeoxgdJ.exe
  2⤵
  PID:11692
- C:\Windows\System\gDKBRYz.exe
  C:\Windows\System\gDKBRYz.exe
  2⤵
  PID:11712
- C:\Windows\System\CBJfDGt.exe
  C:\Windows\System\CBJfDGt.exe
  2⤵
  PID:11748
- C:\Windows\System\wtnTBpD.exe
  C:\Windows\System\wtnTBpD.exe
  2⤵
  PID:11776
- C:\Windows\System\ZIREaZh.exe
  C:\Windows\System\ZIREaZh.exe
  2⤵
  PID:11820
- C:\Windows\System\hBBRmmg.exe
  C:\Windows\System\hBBRmmg.exe
  2⤵
  PID:11836
- C:\Windows\System\jhzhBdU.exe
  C:\Windows\System\jhzhBdU.exe
  2⤵
  PID:11856
- C:\Windows\System\YHpWaDZ.exe
  C:\Windows\System\YHpWaDZ.exe
  2⤵
  PID:11880
- C:\Windows\System\TvsVNZQ.exe
  C:\Windows\System\TvsVNZQ.exe
  2⤵
  PID:11924
- C:\Windows\System\kHKVUuB.exe
  C:\Windows\System\kHKVUuB.exe
  2⤵
  PID:11972
- C:\Windows\System\tWMnteu.exe
  C:\Windows\System\tWMnteu.exe
  2⤵
  PID:11992
- C:\Windows\System\hZQlUeH.exe
  C:\Windows\System\hZQlUeH.exe
  2⤵
  PID:12028
- C:\Windows\System\hwTFusS.exe
  C:\Windows\System\hwTFusS.exe
  2⤵
  PID:12056
- C:\Windows\System\Cndbaus.exe
  C:\Windows\System\Cndbaus.exe
  2⤵
  PID:12072
- C:\Windows\System\rYzuQAH.exe
  C:\Windows\System\rYzuQAH.exe
  2⤵
  PID:12112
- C:\Windows\System\GyDWFxe.exe
  C:\Windows\System\GyDWFxe.exe
  2⤵
  PID:12140
- C:\Windows\System\VaguXNo.exe
  C:\Windows\System\VaguXNo.exe
  2⤵
  PID:12168
- C:\Windows\System\SiMvVVk.exe
  C:\Windows\System\SiMvVVk.exe
  2⤵
  PID:12196
- C:\Windows\System\cnrAOAL.exe
  C:\Windows\System\cnrAOAL.exe
  2⤵
  PID:12212
- C:\Windows\System\HOjkQif.exe
  C:\Windows\System\HOjkQif.exe
  2⤵
  PID:12252
- C:\Windows\System\ujnYjUB.exe
  C:\Windows\System\ujnYjUB.exe
  2⤵
  PID:12280
- C:\Windows\System\CRYPzEQ.exe
  C:\Windows\System\CRYPzEQ.exe
  2⤵
  PID:10708
- C:\Windows\System\yXTmbEf.exe
  C:\Windows\System\yXTmbEf.exe
  2⤵
  PID:11212
- C:\Windows\System\kXkbaWO.exe
  C:\Windows\System\kXkbaWO.exe
  2⤵
  PID:10832
- C:\Windows\System\UrDeeuj.exe
  C:\Windows\System\UrDeeuj.exe
  2⤵
  PID:11344
- C:\Windows\System\fKDVKXM.exe
  C:\Windows\System\fKDVKXM.exe
  2⤵
  PID:11380
- C:\Windows\System\QuISCom.exe
  C:\Windows\System\QuISCom.exe
  2⤵
  PID:11448
- C:\Windows\System\lEWmejk.exe
  C:\Windows\System\lEWmejk.exe
  2⤵
  PID:11536
- C:\Windows\System\UQnrzGA.exe
  C:\Windows\System\UQnrzGA.exe
  2⤵
  PID:11632
- C:\Windows\System\WCcDUsS.exe
  C:\Windows\System\WCcDUsS.exe
  2⤵
  PID:11684
- C:\Windows\System\PxZMqyU.exe
  C:\Windows\System\PxZMqyU.exe
  2⤵
  PID:11736
- C:\Windows\System\RGrPLjt.exe
  C:\Windows\System\RGrPLjt.exe
  2⤵
  PID:11768
- C:\Windows\System\tVUYLxu.exe
  C:\Windows\System\tVUYLxu.exe
  2⤵
  PID:11908
- C:\Windows\System\iULGmpQ.exe
  C:\Windows\System\iULGmpQ.exe
  2⤵
  PID:11964
- C:\Windows\System\qqYdpmW.exe
  C:\Windows\System\qqYdpmW.exe
  2⤵
  PID:11960
- C:\Windows\System\VCQLOWD.exe
  C:\Windows\System\VCQLOWD.exe
  2⤵
  PID:12128
- C:\Windows\System\XSmDLeP.exe
  C:\Windows\System\XSmDLeP.exe
  2⤵
  PID:12184
- C:\Windows\System\bDhdSBN.exe
  C:\Windows\System\bDhdSBN.exe
  2⤵
  PID:12228
- C:\Windows\System\nulayGV.exe
  C:\Windows\System\nulayGV.exe
  2⤵
  PID:10360
- C:\Windows\System\JavNNNS.exe
  C:\Windows\System\JavNNNS.exe
  2⤵
  PID:11288
- C:\Windows\System\jyspzBx.exe
  C:\Windows\System\jyspzBx.exe
  2⤵
  PID:11488
- C:\Windows\System\XcYhdAf.exe
  C:\Windows\System\XcYhdAf.exe
  2⤵
  PID:11656
- C:\Windows\System\wclrqLT.exe
  C:\Windows\System\wclrqLT.exe
  2⤵
  PID:11800
- C:\Windows\System\VTFjMqV.exe
  C:\Windows\System\VTFjMqV.exe
  2⤵
  PID:11872
- C:\Windows\System\bZhRRuZ.exe
  C:\Windows\System\bZhRRuZ.exe
  2⤵
  PID:12048
- C:\Windows\System\ZdRgbUu.exe
  C:\Windows\System\ZdRgbUu.exe
  2⤵
  PID:12180
- C:\Windows\System\VIQZxSa.exe
  C:\Windows\System\VIQZxSa.exe
  2⤵
  PID:12248
- C:\Windows\System\GZuIOem.exe
  C:\Windows\System\GZuIOem.exe
  2⤵
  PID:11528
- C:\Windows\System\uYgVKsu.exe
  C:\Windows\System\uYgVKsu.exe
  2⤵
  PID:11608
- C:\Windows\System\VKyFnMy.exe
  C:\Windows\System\VKyFnMy.exe
  2⤵
  PID:11948
- C:\Windows\System\ovxAYbq.exe
  C:\Windows\System\ovxAYbq.exe
  2⤵
  PID:12324
- C:\Windows\System\waCWyOX.exe
  C:\Windows\System\waCWyOX.exe
  2⤵
  PID:12352
- C:\Windows\System\DbAMvzC.exe
  C:\Windows\System\DbAMvzC.exe
  2⤵
  PID:12368
- C:\Windows\System\HeqiuNV.exe
  C:\Windows\System\HeqiuNV.exe
  2⤵
  PID:12388
- C:\Windows\System\kCotmHd.exe
  C:\Windows\System\kCotmHd.exe
  2⤵
  PID:12412
- C:\Windows\System\IaJXRvl.exe
  C:\Windows\System\IaJXRvl.exe
  2⤵
  PID:12436
- C:\Windows\System\gcrzJID.exe
  C:\Windows\System\gcrzJID.exe
  2⤵
  PID:12452
- C:\Windows\System\JMxfFWk.exe
  C:\Windows\System\JMxfFWk.exe
  2⤵
  PID:12472
- C:\Windows\System\UjFqwaR.exe
  C:\Windows\System\UjFqwaR.exe
  2⤵
  PID:12496
- C:\Windows\System\WIBpXEP.exe
  C:\Windows\System\WIBpXEP.exe
  2⤵
  PID:12516
- C:\Windows\System\swSOdHm.exe
  C:\Windows\System\swSOdHm.exe
  2⤵
  PID:12536
- C:\Windows\System\vMWOwmF.exe
  C:\Windows\System\vMWOwmF.exe
  2⤵
  PID:12572
- C:\Windows\System\VIgizqb.exe
  C:\Windows\System\VIgizqb.exe
  2⤵
  PID:12648
- C:\Windows\System\XFljfEK.exe
  C:\Windows\System\XFljfEK.exe
  2⤵
  PID:12688
- C:\Windows\System\zVpGwJD.exe
  C:\Windows\System\zVpGwJD.exe
  2⤵
  PID:12712
- C:\Windows\System\EIDngHa.exe
  C:\Windows\System\EIDngHa.exe
  2⤵
  PID:12736
- C:\Windows\System\jHiAwdF.exe
  C:\Windows\System\jHiAwdF.exe
  2⤵
  PID:12756
- C:\Windows\System\uaaNeNE.exe
  C:\Windows\System\uaaNeNE.exe
  2⤵
  PID:12772
- C:\Windows\System\GTLTdey.exe
  C:\Windows\System\GTLTdey.exe
  2⤵
  PID:12812
- C:\Windows\System\uSYQEYq.exe
  C:\Windows\System\uSYQEYq.exe
  2⤵
  PID:12844
- C:\Windows\System\Ddecsod.exe
  C:\Windows\System\Ddecsod.exe
  2⤵
  PID:12864
- C:\Windows\System\HmkcZWY.exe
  C:\Windows\System\HmkcZWY.exe
  2⤵
  PID:12892
- C:\Windows\System\GyTAKky.exe
  C:\Windows\System\GyTAKky.exe
  2⤵
  PID:12912
- C:\Windows\System\KXoGBKE.exe
  C:\Windows\System\KXoGBKE.exe
  2⤵
  PID:12932
- C:\Windows\System\GEbshxx.exe
  C:\Windows\System\GEbshxx.exe
  2⤵
  PID:12972
- C:\Windows\System\DuLESBG.exe
  C:\Windows\System\DuLESBG.exe
  2⤵
  PID:13004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_emcmdu1c.kli.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_emcmdu1c.kli.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AkLumUt.exe

Path C:\Windows\System\AkLumUt.exe
Size 1.6MB
SHA256 a3cbfc2f199ddaa225f297af783babd5e21c4596f27ea162ed79ec1383536af3
MD5 e0be17073c0776dc7bee412a94231f79
SHA1 a48caee624088d0cdd1bc6f009d3c0e02a960cdd
SHA512 3875ff49cca4b58afbb2bc00bdbbc4fc25343178894ef4598d7f63d48cdad783e5656e78c0c2f5beae6ce8c2e1a4e438a65776332d5e6d6fee806de9752cd409
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dR:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO/
MD5 SHA1 SHA512 SSDEEP

Submit Download

BCVRhNf.exe

Path C:\Windows\System\BCVRhNf.exe
Size 1.6MB
SHA256 e7b84d435b43605770e15c8d192d7ee73fc5199648e1ac2b794e019728835886
MD5 e2d654687098bc856114883e33a0a6f7
SHA1 c75aa78dc254f9e47516b18831b740e4022a1b7e
SHA512 baa4c95b9952cd78df9a371b6ceaedec824bbb0b2cf028c16a5a1a05561a5c104df809c51726f7f99c6c3b77bd0829b2961b00e05217c3fd5ea8a94a72596372
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dO:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

DkNZjbT.exe

Path C:\Windows\System\DkNZjbT.exe
Size 1.6MB
SHA256 c6794e216c07b64dded27e15655d9c7a2adaae35b58a12391b05eabd9b2cf702
MD5 5c84b42323576ee3a84b48364ee1d694
SHA1 fad8670caa365f51f110c7f550eac764f652c8c7
SHA512 bbf2452e8c2f785f76835f3592dc22a52f7994d47c5d637eec5ae7563784594c758c043f4c7c8164dee77d553661ffbb9bc469b5f275ea3cd07a742edf317979
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dD:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO1
MD5 SHA1 SHA512 SSDEEP

Submit Download

GnaGamo.exe

Path C:\Windows\System\GnaGamo.exe
Size 1.6MB
SHA256 0d22bf96f7c1e3ff6b15883b5f4a992aa9dbc170c40c2a0ca830613b815d4676
MD5 7424f35ac14ef9649b4ce1826f6323ae
SHA1 1200b1700a29db51c47de1db3f4a622bc7844778
SHA512 5e6bbe82bb2a5f401cd9a599063bedeba24efcc9a7f7fbe5389ef2e193fcc95f7d7a42832dfb74f2f42da68778f2f89995039e5d2ae525ef8451415e59a1a03d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d6:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

KRVHttS.exe

Path C:\Windows\System\KRVHttS.exe
Size 1.6MB
SHA256 50a6b2b98df04f4c47ec381c9a2a3f39c410916f00e2e8661f400b8e27e631ed
MD5 02f68e47b0a88e2154dc29d6779c3d26
SHA1 c86ee72a31bcb84011888b0520e059791aafd7dd
SHA512 265a3d17549f57c0770aa0871f01f68530d1d02f81b75257575ca125c619841142157767d437ff16dfc43d1e9eb804fb9a66d8b46a183b36da2b0567df2afedb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dA:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LBstmJf.exe

Path C:\Windows\System\LBstmJf.exe
Size 1.6MB
SHA256 5b6fecc509ec6fb66e33a1f5fe58fdaf36b4208c678e32e8b4497002c64e6a91
MD5 c8b42155ec8e37c3ed349b352d56b31c
SHA1 5bc6ba28fd4ebea4809a67515201168b4bcd26b5
SHA512 55cdee0fe43956216ae162772470407985b34930419770c0fc6149140d71a99c421a6c76dd2ea3a23d2875203389cb89f7daf1c213522f46690544bc85ddadc3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d6:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO0
MD5 SHA1 SHA512 SSDEEP

Submit Download

LGnGVmj.exe

Path C:\Windows\System\LGnGVmj.exe
Size 1.6MB
SHA256 4da0097a0ff9705d1e4f1b7cd82c3cebd78361cdc88d26ef0153639db578eeb5
MD5 7de71e737b730541039ccb4803dbfb17
SHA1 a89e6970c0faa2c8e5402b67b10f587ab15794f1
SHA512 ef3cd68bee6d4fe05f35802b66d6e0df3b9e886ad978426a201f9a24625c0be72af86c7b471e6e4d72cf44e190f1ebae123323381ad2412bd2b361773395c5a8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dK:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOo
MD5 SHA1 SHA512 SSDEEP

Submit Download

MOtDJaP.exe

Path C:\Windows\System\MOtDJaP.exe
Size 1.6MB
SHA256 723d1a58a8362e7fb00d0f6add3b8c1ad810d74264521912a9f2ddd474957329
MD5 973025f37688f1be08a9f63c2510ac4c
SHA1 89903ebe3257b2942fe5fd606f59a98b1cd2cf70
SHA512 c13fc66effbca66a0b0be38f65c2748bfa95498e603e35d60e9fd6d8dc8631c973269c7100da8e3f4e08407781eb80e748787676f005d02cfed88c884b7ae783
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d6:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOc
MD5 SHA1 SHA512 SSDEEP

Submit Download

NDnQWgF.exe

Path C:\Windows\System\NDnQWgF.exe
Size 1.6MB
SHA256 38f43ee3e69f633a5b532d7e2f73ad910617f456875c865c852e9691635d7297
MD5 14490cbc7449bc5029d52e57ea666fd5
SHA1 55a773deb239596dc007e6c5bb0c56b8a4122c83
SHA512 adb6bfd9f4b50fb8105b0b407dbaeae32ffdaf3dee89cd624fb346cba72e480b3730da798f028c15dcba223f062a64be241378eb4d6190a45bbfb8cbe5998059
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dM:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO+
MD5 SHA1 SHA512 SSDEEP

Submit Download

NfFERNo.exe

Path C:\Windows\System\NfFERNo.exe
Size 1.6MB
SHA256 ad97d3191a6529fa264745f285296587b822e23474599181be3eb94b904e9e0c
MD5 b32f8703d8b5d8b11deb7b75a7702b4d
SHA1 8e9b32cf0a152b7511a4a871e62f8d6d218111f7
SHA512 e7257a795fa956d359a20ea35f0ecea1fa4f56734002ef86c7afdf387aa78186aab185c184e218c52ab0104392b91d8d357ab5c122a98dea1a97b9a82c954897
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dF:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

NlkGCEI.exe

Path C:\Windows\System\NlkGCEI.exe
Size 1.6MB
SHA256 8f505c330f96709d6bb90046c669dfa343d367e365435fa008bac5205ecd2e21
MD5 5a1011cfcdd91ec1a0705417e7c58b09
SHA1 58a060d7a83c04bc602bacdf97d2ed4178274410
SHA512 89c707795bf16e762af112098c573ef19b1d3118f16c7d6fc4b818c540592c876a2328b6939cee2d3071c4b9788f2cb203f329d81b0a57f003ab18222821b0e7
SSDEEP 49152:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOjN:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

QfwbvXE.exe

Path C:\Windows\System\QfwbvXE.exe
Size 1.6MB
SHA256 546cfb2549a9357f2589d625b18cd88c604a30493339da406d4a5bd462317817
MD5 50f3617a0966ecaa1c430dea817078eb
SHA1 de686641c150774e1f0aa3c05fce8890c73a94e5
SHA512 99c0c8aa4b6784161e847c8759da549263bb45f23afd703f45eefa81831f02a4ac5f99ccf2a871a3bd1994d9c12442a86788010773a0f7caa9b635cde40a4d9e
SSDEEP 49152:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO8G:NABQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyEMsMU.exe

Path C:\Windows\System\TyEMsMU.exe
Size 1.6MB
SHA256 26a5d711dc3f3c7650844472e531b9ecbcc86d3d6b1d3e34e08bb97ed16970db
MD5 107d60ffe57a8144b563385883b6133b
SHA1 0a12db16fd63a1679939ea0d5e20b724adbfcc21
SHA512 04a86290d7867f343cc75f7b029992ce4031ab859fe47c3747555fe32d94c2331cf4664ba0b71123668eebd89c8f35ceff83fadf3966b15829d2381dde02492f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d9:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

UQwsjyr.exe

Path C:\Windows\System\UQwsjyr.exe
Size 1.6MB
SHA256 3eab2b2b9b329f14794fe9aa8ce68d121e65da75c86eea6cb2f758fc4214a854
MD5 f7be967659c222a0921cfa37e76bcc4f
SHA1 cfa6e969cc979a420a09a7e48cdffe90308246c2
SHA512 f0c28953959001cd39fc54ac0c89783fa369b83eb9842ce55e8241c53712c1941fb6c7859949bfa06d6d3b1f7e29bfc9043f900c9fee27ea3fd2471c1b75bf34
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dK:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFJNGLR.exe

Path C:\Windows\System\WFJNGLR.exe
Size 1.6MB
SHA256 56df83f08335f50dad992c4fc5c81dd13daacf5ccbc6327475dd4167cc1572e3
MD5 2dcfafde4255ebedf03fcf1a83c992ad
SHA1 03c3479399edc911806109e271122b66e65b4fbd
SHA512 c3e98235f7c1ba3cb9391d15840a31f2c5c22f9e8aa3d28ee685bd6d75f3c1aca0c3b09adbafd62b2b7964ed99b8d8e849851bd2357929e4e9f64926f2f1e43a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dZ:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

YZAEliI.exe

Path C:\Windows\System\YZAEliI.exe
Size 1.6MB
SHA256 edb0e54d980f16abb6a43d179dbe552e0cc367c31ae0aba67ad8b1cb86142573
MD5 005d2a526e4e657dfeb770958ff766e8
SHA1 ca877c1199672188cd1ea86ccfcae3e0216cba03
SHA512 b97c728652dc7f2d569524096beb1e4163a74e422f4e3b8cb65f29d693057d7ee0761ba76c1a04322c583b170375605bed41aea55d9fa46958ae2ccd8f2943da
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dO:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOs
MD5 SHA1 SHA512 SSDEEP

Submit Download

YuKrXCg.exe

Path C:\Windows\System\YuKrXCg.exe
Size 1.6MB
SHA256 a673f0bfb4792b075ff996c14a68425baa267949f006f6eb49e3b4e7d5fe8be6
MD5 de7f61a0ed24f99ad3f75a47421042b5
SHA1 065bfb975e69c441f2950c7094be9615c2fba74a
SHA512 b7580a765a0c7d61f6f1995e62d94683f6d376eaebe769b8cd812c069373f4fdcb9e6c75cea151db3175bd3b5cc1174789f6e1389b438cf1a42af23eed802024
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dk:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZhlxPBF.exe

Path C:\Windows\System\ZhlxPBF.exe
Size 1.6MB
SHA256 b65c845f71f08326d6e7f61eb75b5491289ab7812690bcd4c7ce9af8e2d81638
MD5 6818635f7b1b884027e8fddd2800a641
SHA1 bc167d48a09603e2f8fe72dbb57dc2511a1874e6
SHA512 644d44a66be6a646dc5fb3269303fc471566f4b596c093b4eb8f88107a1dfb274fa3c6697227c9ecf85a61ad0d76b8d2683b9c395412efc0de2651fa390fac37
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dR:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

alniosR.exe

Path C:\Windows\System\alniosR.exe
Size 8B
SHA256 76bc446e18daed4e6417440c778e757728762c893f014de08ffa5f0fe98668bd
MD5 68703642e5faeaf00b4b9f791a04a7f5
SHA1 2e8f5d51bda54b6b227caed2cb4535020c7a482c
SHA512 0c1919485a30576b5fdf963204dc04b356f524c23dfb4ffaecdbb8a8ea4a0993cf3ac05bee011edf07b5b637ac7455499983eac22f5cdd87cd869e7a046115a5
MD5 SHA1 SHA512

Submit Download

bcsljWL.exe

Path C:\Windows\System\bcsljWL.exe
Size 1.6MB
SHA256 c3d0e771914991cbc836f8567436c96bf0ef935f18a52a34704ddb93a65dd4ae
MD5 1fd129e69a79b0db7220bfcd010ac2d0
SHA1 2a91de6b316b16b8831aca70196e496e5b6e3f54
SHA512 3a4a253d09384dd2a528aead7e28eec3cb457fde98c89b3599e6e62c9d224c84fbd0a83ad0df44137f25eda5d666cf3278bda631d51298c4f5a20f9bd923c30a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dD:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dTYDdiX.exe

Path C:\Windows\System\dTYDdiX.exe
Size 1.6MB
SHA256 c3221e4f8a2dd90a5e952bd86a5f90f7ce5ddeca509c44523c07bc0d3c3f298b
MD5 131e360cc5be370ba6f0460746f26fac
SHA1 c3e83fa1530876b7c5e2833297eeed0559537259
SHA512 3e66c13c62e1b8a422378f5bf4b70355ab01a647e39d3577bbb199058e9de3696334086456869432bcb678b3197bcc5c9332c9643f114d61e4d3060db229ee3d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dS:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecAmMmI.exe

Path C:\Windows\System\ecAmMmI.exe
Size 1.6MB
SHA256 7a9a6a568157295cfa238f1fbe95b525b981c8619a8a77a629731aec7a2426d6
MD5 e3d4e67de6a01ddee6eec9316a51e8a9
SHA1 c6e18c5b8f4642c10d9d0a0c05111cba470bfa9c
SHA512 295c3a15f7578480f19ff9a45d6126e649fb93eb1f4135ff35006b1e581409356c5bbd9df98038a688c092e31dfcfa133cc9c8e91d5d0e905deb83a49c8d8e56
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dP:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

hKyXmiT.exe

Path C:\Windows\System\hKyXmiT.exe
Size 1.6MB
SHA256 f52a911b46388ae0a53d15f59397afb8fc71c21fe8e2db8485afd0ddc79c1dd6
MD5 13c17eda55f52952c7b1bbbe5cfa3ab8
SHA1 8406fbc8afdf3d6d67a31009b6fca24c6078e817
SHA512 5b0c32f320084fff3bb5395012b9c48f889679d3af8dba06c607c5a210f831749344cdeaea978ae1a9c3fea03d14a2e8d57b6507616dcad6a7d228f8a2f2eae9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098di:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOo
MD5 SHA1 SHA512 SSDEEP

Submit Download

kEFZhYm.exe

Path C:\Windows\System\kEFZhYm.exe
Size 1.6MB
SHA256 e11c231d50a9b0a82e83c37bddc8f721741ff4e3552ed086dd2787316c6a1953
MD5 23d7577ba360b59cf98e0a6f6ee67447
SHA1 dde1806026fce896ad0c809ed9aecf3b15cfc334
SHA512 fba6095b7d8e75ae613e57b98510af91af69e3a776fb6194c63505b1e681910d9d5825bf453baf1674a5d759cc53e2658e56fb4d7e9cf2f8361519b37d4edf49
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dv:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO5
MD5 SHA1 SHA512 SSDEEP

Submit Download

nINNpTf.exe

Path C:\Windows\System\nINNpTf.exe
Size 1.6MB
SHA256 f97c6383866fe21fa0bed40fe0fae976484d9d12c196749df5fca28849f806e9
MD5 ee8675f4c029e5c981bff5f6362640d4
SHA1 e40c43ed1b1d29d7b96b288eed12622cae805dac
SHA512 6f38c1d50ea745c5f2ce493126525f3c7ba459f50bd800090d83cc50fa6d70889698bb0ca7490e460ac12d975034a023ec4c6108fc9e93f8326ef24e8ddb513b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dJ:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

npZmKeD.exe

Path C:\Windows\System\npZmKeD.exe
Size 1.6MB
SHA256 f0cc1e75612c9dc73a1a42e5bf8da12a4e3a150764c34965146b8321f1e76c88
MD5 228df46b02dd5171519f91574e93de7b
SHA1 4ac5214a059bccf1b6d1cb96895583323420c38c
SHA512 2d0d92cb280f79f30586ec758106b642427d6cae715ca34fbf39c30f4135c18da7be3cf6fc9cdd1f0b05f59449a66377003bf1d80a2d23e75b2f4f75347738a4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d6:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOc
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvjDBtv.exe

Path C:\Windows\System\pvjDBtv.exe
Size 1.6MB
SHA256 e040a487eadfc79d7f3e82d136896668a48b6f56dbe678c7b1e5dd7317f1cd15
MD5 be50c8658cacb3211bf0f6595a192032
SHA1 73cf8cb4a7fb7f7d0b6da4a3f6ea29ae69a416c1
SHA512 f174a01012ee19fc3adb0efd6cf503cf9a66ab1d7787def24bdae06c25cdfdf75eaef46e888a2888b5db06b4f0d0ebdf9966aec8c0bee7f34d2ea26285fbad23
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098di:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOI
MD5 SHA1 SHA512 SSDEEP

Submit Download

rLMqtfX.exe

Path C:\Windows\System\rLMqtfX.exe
Size 1.6MB
SHA256 1c6c73b556d81a1fdfcb1191d1c9071e6000c0cf671c3885c1a21f348ddfa8bf
MD5 250c723aa4210dd1b4c5cff0f5f96b85
SHA1 6dadf55365eef7e8b9e0b8aea04da8f6569d7d9a
SHA512 2e271400d351f80901379e0578a97265496695e2fce3708344fce5051dbbc8f16ae26d069f3eee456e1e8c2029f26eeca23c9262c7efee762362383f519562f1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d4:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

sLbsyRm.exe

Path C:\Windows\System\sLbsyRm.exe
Size 1.6MB
SHA256 50a9c9b211fcd10e0adddf133f90c00e834760ca8cfb46a3968fcbb7e4346738
MD5 b0212ce245e61d9454afa18a5a99f2dd
SHA1 89aa8ffae4f5aac5f3719ab84d4eb68d98fc0290
SHA512 f29dcc6cd9d10b699086637be8f6625c0c7a815d79523dafdacec9381b8fb65c56dc143422806a283b132c6e6de65c078041a76520faf920fdde1272962358af
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dO:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXSHgEl.exe

Path C:\Windows\System\sXSHgEl.exe
Size 1.6MB
SHA256 5391d103decd95857e6e76e387d9e8ca83d903aa294874bfd1b53e19f9ada078
MD5 1793d996739b41a3bf544892713b4ed5
SHA1 f6d3719f663d115e2f534a14cfcf812a3cf891b7
SHA512 f57bbd95c6cff16dd9722b7e22d2f2a0ed0ffa638fd6eb9ab4fda100e0e2041da3d3151ec13b322e46e8cc9b4c3e4ce47274ee5dd173ef95000278902ad73a2c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dH:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihUusJ.exe

Path C:\Windows\System\sihUusJ.exe
Size 1.6MB
SHA256 b31a1de5234c8443c353d32c29fb2942d5ad95a62b30f666acd24bb9138c45fc
MD5 48e2c7939be0450affa0a69fe893fa74
SHA1 5417ef87d3e6736ceface5cd5c6e8f17f56137ad
SHA512 d8c8275eb5186d89d57286f9405be26aa489d939d1ca9dc4ea0d112441bbfa96f7bcf5cfab5687f388e2d165bae58a91707c252d43dc8fe3a8d7bdf5b5826ce3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dp:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tXKbraG.exe

Path C:\Windows\System\tXKbraG.exe
Size 1.6MB
SHA256 9dbf593842e017a15063e78f27e3dd8bd06319c44937376e4d4858415e2d9c4f
MD5 7fcf2c81c3f9fa086d5a288f8258a015
SHA1 56dc42cef8d3232ca604a94f376eaf51e82fd4d1
SHA512 be2270d186add60a1dacec748208a301aad5ee271df6c829108b24d572e2052c1ec3ece0b8c8757a6bb12a799e2cf181f72b39999dfa4da005782f24447c76ec
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098d9:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmyoXXX.exe

Path C:\Windows\System\tmyoXXX.exe
Size 1.6MB
SHA256 30e6d2b73a5c9263934f2a4c820f363e47b422305b621f353986484895965e62
MD5 3220e740883b1588083564a5ad3fdad5
SHA1 991a32edec2758bf7f8e4b3792a567aca9742250
SHA512 c132fb53015c61c964e1df57515baaf62b92a57a64a090bca8998a8b10ffa8eaea929a8584ab6a89b0b6bc0fdff19cc995ea2e5d9f13b08fc7f45e790e96eecf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dF:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

uIdARqj.exe

Path C:\Windows\System\uIdARqj.exe
Size 1.6MB
SHA256 95972edcbaa9d69e146ac3d43af3c919d8d2335fd261e9a3c773a7d760876bb2
MD5 8cd226ecedb1cee4165c2d5d85c881d9
SHA1 24dbd68e5aea5914b8679da6e03e40b3f7a4bc54
SHA512 cffe151038d70e7eec5a9e9791138d722ae885cc28b12756c0ae6b6ff9e4eb62348f6254a338b0af4546de566f9995e2c9466d8a969cbcb52951e20f6cb6773a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098dB:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1lO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-2156-0x00007FF614540000-0x00007FF614932000-memory.dmp

Download

memory/336-137-0x00007FF614540000-0x00007FF614932000-memory.dmp

Download

memory/648-2161-0x00007FF7F3D40000-0x00007FF7F4132000-memory.dmp

Download

memory/648-94-0x00007FF7F3D40000-0x00007FF7F4132000-memory.dmp

Download

memory/1040-157-0x00007FF794D90000-0x00007FF795182000-memory.dmp

Download

memory/1040-2181-0x00007FF794D90000-0x00007FF795182000-memory.dmp

Download

memory/1268-36-0x00007FF6DE770000-0x00007FF6DEB62000-memory.dmp

Download

memory/1268-2149-0x00007FF6DE770000-0x00007FF6DEB62000-memory.dmp

Download

memory/1288-133-0x00007FF774730000-0x00007FF774B22000-memory.dmp

Download

memory/1288-2171-0x00007FF774730000-0x00007FF774B22000-memory.dmp

Download

memory/1504-130-0x00007FF68F0D0000-0x00007FF68F4C2000-memory.dmp

Download

memory/1504-2174-0x00007FF68F0D0000-0x00007FF68F4C2000-memory.dmp

Download

memory/1564-2160-0x00007FF6F57D0000-0x00007FF6F5BC2000-memory.dmp

Download

memory/1564-141-0x00007FF6F57D0000-0x00007FF6F5BC2000-memory.dmp

Download

memory/1584-164-0x00007FF708CC0000-0x00007FF7090B2000-memory.dmp

Download

memory/1584-2183-0x00007FF708CC0000-0x00007FF7090B2000-memory.dmp

Download

memory/1592-2164-0x00007FF659BE0000-0x00007FF659FD2000-memory.dmp

Download

memory/1592-104-0x00007FF659BE0000-0x00007FF659FD2000-memory.dmp

Download

memory/1884-2152-0x00007FF6509B0000-0x00007FF650DA2000-memory.dmp

Download

memory/1884-27-0x00007FF6509B0000-0x00007FF650DA2000-memory.dmp

Download

memory/1904-151-0x00007FF651B50000-0x00007FF651F42000-memory.dmp

Download

memory/1904-2180-0x00007FF651B50000-0x00007FF651F42000-memory.dmp

Download

memory/1916-1-0x000001D441D30000-0x000001D441D40000-memory.dmp

Download

memory/1916-0-0x00007FF6631B0000-0x00007FF6635A2000-memory.dmp

Download

memory/2080-2141-0x00007FF701D90000-0x00007FF702182000-memory.dmp

Download

memory/2080-10-0x00007FF701D90000-0x00007FF702182000-memory.dmp

Download

memory/2080-2094-0x00007FF701D90000-0x00007FF702182000-memory.dmp

Download

memory/2540-2166-0x00007FF727000000-0x00007FF7273F2000-memory.dmp

Download

memory/2540-120-0x00007FF727000000-0x00007FF7273F2000-memory.dmp

Download

memory/2620-176-0x00007FF7554A0000-0x00007FF755892000-memory.dmp

Download

memory/2620-2189-0x00007FF7554A0000-0x00007FF755892000-memory.dmp

Download

memory/2696-23-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Download

memory/2696-2107-0x00007FFDB2F23000-0x00007FFDB2F25000-memory.dmp

Download

memory/2696-437-0x000001C732DC0000-0x000001C733566000-memory.dmp

Download

memory/2696-2117-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Download

memory/2696-53-0x000001C72FE40000-0x000001C72FE62000-memory.dmp

Download

memory/2696-11-0x00007FFDB2F23000-0x00007FFDB2F25000-memory.dmp

Download

memory/2696-78-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

Download

memory/2776-121-0x00007FF6E7150000-0x00007FF6E7542000-memory.dmp

Download

memory/2776-2169-0x00007FF6E7150000-0x00007FF6E7542000-memory.dmp

Download

memory/2900-109-0x00007FF62BFF0000-0x00007FF62C3E2000-memory.dmp

Download

memory/2900-2157-0x00007FF62BFF0000-0x00007FF62C3E2000-memory.dmp

Download

memory/3156-28-0x00007FF715E20000-0x00007FF716212000-memory.dmp

Download

memory/3156-2153-0x00007FF715E20000-0x00007FF716212000-memory.dmp

Download

memory/3156-2108-0x00007FF715E20000-0x00007FF716212000-memory.dmp

Download

memory/3208-116-0x00007FF718BD0000-0x00007FF718FC2000-memory.dmp

Download

memory/3208-2167-0x00007FF718BD0000-0x00007FF718FC2000-memory.dmp

Download

memory/3572-2194-0x00007FF6284A0000-0x00007FF628892000-memory.dmp

Download

memory/3572-182-0x00007FF6284A0000-0x00007FF628892000-memory.dmp

Download

memory/3648-158-0x00007FF7A6390000-0x00007FF7A6782000-memory.dmp

Download

memory/3648-2187-0x00007FF7A6390000-0x00007FF7A6782000-memory.dmp

Download

memory/4284-2185-0x00007FF645340000-0x00007FF645732000-memory.dmp

Download

memory/4284-134-0x00007FF645340000-0x00007FF645732000-memory.dmp

Download

memory/4468-170-0x00007FF732D40000-0x00007FF733132000-memory.dmp

Download

memory/4468-2191-0x00007FF732D40000-0x00007FF733132000-memory.dmp

Download

memory/4540-145-0x00007FF65CBA0000-0x00007FF65CF92000-memory.dmp

Download

memory/4540-2176-0x00007FF65CBA0000-0x00007FF65CF92000-memory.dmp

Download

memory/4668-127-0x00007FF74E120000-0x00007FF74E512000-memory.dmp

Download

memory/4668-2178-0x00007FF74E120000-0x00007FF74E512000-memory.dmp

Download