xmrig | 43d1aa9d5cdc815503a19b903c3e6d421be1c48309e3afacfb9da2085d622b86

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
Size 3.1MB
Sample240612-mgfrvs1dlf
SHA256 43d1aa9d5cdc815503a19b903c3e6d421be1c48309e3afacfb9da2085d622b86
MD5 32f8129e08d761ac733dec1447dfc9d0
SHA1 738c8b2d9eb7163d0f6c23a38b096d59950cc18c
SHA512 6806c1c87b2429b94ccd810e44ca6bc94dbb582ca3eded8357fd0ed2334b9cacbe59503b00b782b922da42f62ac83015c46fccf93621267731827233cba211e1
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW3:7bBeSFkb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF6ED590000-0x00007FF6ED986000-memory.dmp	xmrig
behavioral2/files/0x00080000000235e6-5.dat	xmrig
behavioral2/memory/4004-6-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ea-14.dat	xmrig
behavioral2/files/0x00070000000235ed-20.dat	xmrig
behavioral2/files/0x00070000000235ec-19.dat	xmrig
behavioral2/files/0x00070000000235eb-18.dat	xmrig
behavioral2/files/0x00070000000235f2-62.dat	xmrig
behavioral2/files/0x00070000000235f0-65.dat	xmrig
behavioral2/files/0x00070000000235f4-78.dat	xmrig
behavioral2/files/0x00070000000235f7-89.dat	xmrig
behavioral2/files/0x00070000000235fb-116.dat	xmrig
behavioral2/files/0x0007000000023601-122.dat	xmrig
behavioral2/memory/4108-146-0x00007FF62F270000-0x00007FF62F666000-memory.dmp	xmrig
behavioral2/files/0x0007000000023600-166.dat	xmrig
behavioral2/memory/5016-182-0x00007FF712170000-0x00007FF712566000-memory.dmp	xmrig
behavioral2/memory/2308-186-0x00007FF68A7C0000-0x00007FF68ABB6000-memory.dmp	xmrig
behavioral2/memory/1680-191-0x00007FF7DE3F0000-0x00007FF7DE7E6000-memory.dmp	xmrig
behavioral2/memory/4244-196-0x00007FF7CCF70000-0x00007FF7CD366000-memory.dmp	xmrig
behavioral2/files/0x000700000002360b-199.dat	xmrig
behavioral2/memory/1708-195-0x00007FF61E800000-0x00007FF61EBF6000-memory.dmp	xmrig
behavioral2/memory/4380-194-0x00007FF649770000-0x00007FF649B66000-memory.dmp	xmrig
behavioral2/memory/2860-193-0x00007FF768C80000-0x00007FF769076000-memory.dmp	xmrig
behavioral2/memory/3288-192-0x00007FF6F7480000-0x00007FF6F7876000-memory.dmp	xmrig
behavioral2/memory/1628-190-0x00007FF7DF500000-0x00007FF7DF8F6000-memory.dmp	xmrig
behavioral2/memory/2104-189-0x00007FF73AFE0000-0x00007FF73B3D6000-memory.dmp	xmrig
behavioral2/memory/1248-188-0x00007FF729B60000-0x00007FF729F56000-memory.dmp	xmrig
behavioral2/memory/1732-187-0x00007FF6A0510000-0x00007FF6A0906000-memory.dmp	xmrig
behavioral2/memory/436-185-0x00007FF6B5890000-0x00007FF6B5C86000-memory.dmp	xmrig
behavioral2/memory/3892-184-0x00007FF6AF6B0000-0x00007FF6AFAA6000-memory.dmp	xmrig
behavioral2/memory/4820-183-0x00007FF7FE060000-0x00007FF7FE456000-memory.dmp	xmrig
behavioral2/memory/3896-181-0x00007FF7E1460000-0x00007FF7E1856000-memory.dmp	xmrig
behavioral2/files/0x000700000002360a-180.dat	xmrig
behavioral2/files/0x0007000000023604-179.dat	xmrig
behavioral2/files/0x0007000000023603-178.dat	xmrig
behavioral2/memory/4172-177-0x00007FF6277A0000-0x00007FF627B96000-memory.dmp	xmrig
behavioral2/memory/1060-176-0x00007FF6BBF80000-0x00007FF6BC376000-memory.dmp	xmrig
behavioral2/files/0x0007000000023609-175.dat	xmrig
behavioral2/files/0x0007000000023608-174.dat	xmrig
behavioral2/files/0x0007000000023607-173.dat	xmrig
behavioral2/files/0x0007000000023606-172.dat	xmrig
behavioral2/files/0x0007000000023605-171.dat	xmrig
behavioral2/files/0x00080000000235fd-169.dat	xmrig
behavioral2/files/0x00080000000235fe-164.dat	xmrig
behavioral2/files/0x0007000000023602-162.dat	xmrig
behavioral2/memory/4320-145-0x00007FF76BA00000-0x00007FF76BDF6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ff-141.dat	xmrig
behavioral2/files/0x00070000000235fc-139.dat	xmrig
behavioral2/memory/3212-133-0x00007FF611A60000-0x00007FF611E56000-memory.dmp	xmrig
behavioral2/files/0x00080000000235e7-129.dat	xmrig
behavioral2/files/0x00070000000235fa-127.dat	xmrig
behavioral2/memory/3552-121-0x00007FF6CAED0000-0x00007FF6CB2C6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235f9-115.dat	xmrig
behavioral2/files/0x00070000000235f8-111.dat	xmrig
behavioral2/memory/4044-109-0x00007FF6DAEC0000-0x00007FF6DB2B6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235f3-75.dat	xmrig
behavioral2/files/0x00070000000235f6-88.dat	xmrig
behavioral2/files/0x00070000000235f5-84.dat	xmrig
behavioral2/files/0x00070000000235f1-73.dat	xmrig
behavioral2/files/0x00070000000235ef-59.dat	xmrig
behavioral2/files/0x00070000000235ee-46.dat	xmrig
behavioral2/memory/4004-1946-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp	xmrig
behavioral2/memory/4004-1947-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp	xmrig
behavioral2/memory/1680-1948-0x00007FF7DE3F0000-0x00007FF7DE7E6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
448	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4004	ZlejIpg.exe
1680	rCubDLf.exe
4044	FWKobSX.exe
3552	AOMKwPI.exe
3212	KBtqjVb.exe
4320	KMqBwew.exe
4108	vCdFsmC.exe
1060	aYsraEq.exe
4172	CuMaibP.exe
3896	LsDQWfi.exe
5016	CJgOmSO.exe
3288	IjiiuuB.exe
4820	IPHAMSR.exe
3892	MyvMXBU.exe
436	eqdTVBN.exe
2308	MjyeSDt.exe
1732	xcnTpXH.exe
2860	bQmTixe.exe
1248	SXuRKQj.exe
4380	dHXTMMF.exe
2104	Jhavxij.exe
1628	BDCSMgz.exe
1708	wwceKZM.exe
4244	vBCjnhl.exe
828	TiyPMKv.exe
4848	EBWTZEc.exe
1112	ZMmdYJq.exe
4960	LmsPwtQ.exe
3108	BtuuSDV.exe
3324	eEhiLiO.exe
2412	QVkbmBj.exe
4316	QmeYAqz.exe
3136	VObCYXk.exe
1984	jotnDZB.exe
1656	MQDjDWh.exe
2160	pRmhUhA.exe
4440	sIzgMDi.exe
2700	PouFZtf.exe
1888	VsqcJIL.exe
3036	EyhqpJZ.exe
4356	CrAyIKI.exe
1464	HWGoEYQ.exe
924	RkHPBCu.exe
3320	QOflWcH.exe
1276	OKgStKT.exe
1668	wreiPms.exe
4952	jTUbJDL.exe
3752	DXFERYA.exe
4348	OqczJez.exe
424	PyplsMg.exe
4932	VQWbcgw.exe
1544	MbzmkEI.exe
2388	MSvHteq.exe
4012	kcwsftt.exe
4336	uMrmzBm.exe
2424	aAuIPFK.exe
1672	tqYARJs.exe
1716	qYTPxBk.exe
1064	oTIqtDN.exe
3504	AaxvbvJ.exe
1740	VeXsawo.exe
3560	cnQrcKd.exe
1736	gWKBPiu.exe
4912	UeCSgJe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF6ED590000-0x00007FF6ED986000-memory.dmp	upx
behavioral2/files/0x00080000000235e6-5.dat	upx
behavioral2/memory/4004-6-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp	upx
behavioral2/files/0x00070000000235ea-14.dat	upx
behavioral2/files/0x00070000000235ed-20.dat	upx
behavioral2/files/0x00070000000235ec-19.dat	upx
behavioral2/files/0x00070000000235eb-18.dat	upx
behavioral2/files/0x00070000000235f2-62.dat	upx
behavioral2/files/0x00070000000235f0-65.dat	upx
behavioral2/files/0x00070000000235f4-78.dat	upx
behavioral2/files/0x00070000000235f7-89.dat	upx
behavioral2/files/0x00070000000235fb-116.dat	upx
behavioral2/files/0x0007000000023601-122.dat	upx
behavioral2/memory/4108-146-0x00007FF62F270000-0x00007FF62F666000-memory.dmp	upx
behavioral2/files/0x0007000000023600-166.dat	upx
behavioral2/memory/5016-182-0x00007FF712170000-0x00007FF712566000-memory.dmp	upx
behavioral2/memory/2308-186-0x00007FF68A7C0000-0x00007FF68ABB6000-memory.dmp	upx
behavioral2/memory/1680-191-0x00007FF7DE3F0000-0x00007FF7DE7E6000-memory.dmp	upx
behavioral2/memory/4244-196-0x00007FF7CCF70000-0x00007FF7CD366000-memory.dmp	upx
behavioral2/files/0x000700000002360b-199.dat	upx
behavioral2/memory/1708-195-0x00007FF61E800000-0x00007FF61EBF6000-memory.dmp	upx
behavioral2/memory/4380-194-0x00007FF649770000-0x00007FF649B66000-memory.dmp	upx
behavioral2/memory/2860-193-0x00007FF768C80000-0x00007FF769076000-memory.dmp	upx
behavioral2/memory/3288-192-0x00007FF6F7480000-0x00007FF6F7876000-memory.dmp	upx
behavioral2/memory/1628-190-0x00007FF7DF500000-0x00007FF7DF8F6000-memory.dmp	upx
behavioral2/memory/2104-189-0x00007FF73AFE0000-0x00007FF73B3D6000-memory.dmp	upx
behavioral2/memory/1248-188-0x00007FF729B60000-0x00007FF729F56000-memory.dmp	upx
behavioral2/memory/1732-187-0x00007FF6A0510000-0x00007FF6A0906000-memory.dmp	upx
behavioral2/memory/436-185-0x00007FF6B5890000-0x00007FF6B5C86000-memory.dmp	upx
behavioral2/memory/3892-184-0x00007FF6AF6B0000-0x00007FF6AFAA6000-memory.dmp	upx
behavioral2/memory/4820-183-0x00007FF7FE060000-0x00007FF7FE456000-memory.dmp	upx
behavioral2/memory/3896-181-0x00007FF7E1460000-0x00007FF7E1856000-memory.dmp	upx
behavioral2/files/0x000700000002360a-180.dat	upx
behavioral2/files/0x0007000000023604-179.dat	upx
behavioral2/files/0x0007000000023603-178.dat	upx
behavioral2/memory/4172-177-0x00007FF6277A0000-0x00007FF627B96000-memory.dmp	upx
behavioral2/memory/1060-176-0x00007FF6BBF80000-0x00007FF6BC376000-memory.dmp	upx
behavioral2/files/0x0007000000023609-175.dat	upx
behavioral2/files/0x0007000000023608-174.dat	upx
behavioral2/files/0x0007000000023607-173.dat	upx
behavioral2/files/0x0007000000023606-172.dat	upx
behavioral2/files/0x0007000000023605-171.dat	upx
behavioral2/files/0x00080000000235fd-169.dat	upx
behavioral2/files/0x00080000000235fe-164.dat	upx
behavioral2/files/0x0007000000023602-162.dat	upx
behavioral2/memory/4320-145-0x00007FF76BA00000-0x00007FF76BDF6000-memory.dmp	upx
behavioral2/files/0x00070000000235ff-141.dat	upx
behavioral2/files/0x00070000000235fc-139.dat	upx
behavioral2/memory/3212-133-0x00007FF611A60000-0x00007FF611E56000-memory.dmp	upx
behavioral2/files/0x00080000000235e7-129.dat	upx
behavioral2/files/0x00070000000235fa-127.dat	upx
behavioral2/memory/3552-121-0x00007FF6CAED0000-0x00007FF6CB2C6000-memory.dmp	upx
behavioral2/files/0x00070000000235f9-115.dat	upx
behavioral2/files/0x00070000000235f8-111.dat	upx
behavioral2/memory/4044-109-0x00007FF6DAEC0000-0x00007FF6DB2B6000-memory.dmp	upx
behavioral2/files/0x00070000000235f3-75.dat	upx
behavioral2/files/0x00070000000235f6-88.dat	upx
behavioral2/files/0x00070000000235f5-84.dat	upx
behavioral2/files/0x00070000000235f1-73.dat	upx
behavioral2/files/0x00070000000235ef-59.dat	upx
behavioral2/files/0x00070000000235ee-46.dat	upx
behavioral2/memory/4004-1946-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp	upx
behavioral2/memory/4004-1947-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp	upx
behavioral2/memory/1680-1948-0x00007FF7DE3F0000-0x00007FF7DE7E6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gmarIdA.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\mgESNWK.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\VDcwwrA.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\smVuzBD.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\WdmolVU.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\yXPufbc.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\nhZWsDI.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\CWcQaBu.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\Ijflrui.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\tllXwWs.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\IJiVzOz.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\eMQHQOD.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ltqixBl.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\AdSCYnV.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ydIqBoD.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ukDeIxh.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ilNchlp.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\mwrabUT.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\hyCMxRj.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\qVXtXSN.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\JUHKesx.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\mRmcJUr.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ddLupji.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\QXFlJXE.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ADRLgrS.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\PlKDKKF.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\JTKonBm.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\xEnyYyH.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\sIRuImu.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\tKKfsVK.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\TzwECkW.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\MyPzHdb.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\QAOPnCw.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\FGknAvQ.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\cQwRIda.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\nQcVwgn.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\vleRFVI.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\RscxPwK.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\YOAtpxG.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\BvbPnHi.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\fsFecUo.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\IYsJyQA.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\pbngVkd.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\fhmAjvd.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\XqVYxst.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\KbAtKYk.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\iZreTcb.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ipGTtXV.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\gJeSeKu.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\trMZYXK.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\RRVSaMK.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\SXGcAxg.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\ItzNgqW.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\cMJDKXH.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\voIQJKD.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\IPNykcP.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\FJGTFZy.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\aoRppdJ.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\psmteYc.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\aKViAKq.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\WqKlxZo.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\SlOBqtE.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\geSVisy.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
File created	C:\Windows\System\vdhdPkX.exe	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
448	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	448	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 448	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	90
PID 3460 wrote to memory of 448	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	90
PID 3460 wrote to memory of 4004	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	91
PID 3460 wrote to memory of 4004	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	91
PID 3460 wrote to memory of 1680	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	92
PID 3460 wrote to memory of 1680	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	92
PID 3460 wrote to memory of 4044	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	93
PID 3460 wrote to memory of 4044	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	93
PID 3460 wrote to memory of 3552	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	94
PID 3460 wrote to memory of 3552	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	94
PID 3460 wrote to memory of 3212	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	95
PID 3460 wrote to memory of 3212	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	95
PID 3460 wrote to memory of 4320	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	96
PID 3460 wrote to memory of 4320	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	96
PID 3460 wrote to memory of 4108	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	97
PID 3460 wrote to memory of 4108	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	97
PID 3460 wrote to memory of 1060	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	98
PID 3460 wrote to memory of 1060	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	98
PID 3460 wrote to memory of 4172	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	99
PID 3460 wrote to memory of 4172	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	99
PID 3460 wrote to memory of 3896	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	100
PID 3460 wrote to memory of 3896	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	100
PID 3460 wrote to memory of 5016	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	101
PID 3460 wrote to memory of 5016	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	101
PID 3460 wrote to memory of 3288	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	102
PID 3460 wrote to memory of 3288	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	102
PID 3460 wrote to memory of 4820	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	103
PID 3460 wrote to memory of 4820	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	103
PID 3460 wrote to memory of 3892	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	104
PID 3460 wrote to memory of 3892	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	104
PID 3460 wrote to memory of 436	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	105
PID 3460 wrote to memory of 436	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	105
PID 3460 wrote to memory of 2308	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	106
PID 3460 wrote to memory of 2308	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	106
PID 3460 wrote to memory of 1732	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	107
PID 3460 wrote to memory of 1732	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	107
PID 3460 wrote to memory of 2860	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	108
PID 3460 wrote to memory of 2860	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	108
PID 3460 wrote to memory of 1248	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	109
PID 3460 wrote to memory of 1248	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	109
PID 3460 wrote to memory of 4380	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	110
PID 3460 wrote to memory of 4380	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	110
PID 3460 wrote to memory of 2104	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	111
PID 3460 wrote to memory of 2104	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	111
PID 3460 wrote to memory of 1628	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	112
PID 3460 wrote to memory of 1628	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	112
PID 3460 wrote to memory of 4848	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	113
PID 3460 wrote to memory of 4848	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	113
PID 3460 wrote to memory of 1708	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	114
PID 3460 wrote to memory of 1708	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	114
PID 3460 wrote to memory of 4244	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	115
PID 3460 wrote to memory of 4244	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	115
PID 3460 wrote to memory of 828	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	116
PID 3460 wrote to memory of 828	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	116
PID 3460 wrote to memory of 1112	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	117
PID 3460 wrote to memory of 1112	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	117
PID 3460 wrote to memory of 1984	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	118
PID 3460 wrote to memory of 1984	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	118
PID 3460 wrote to memory of 4960	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	119
PID 3460 wrote to memory of 4960	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	119
PID 3460 wrote to memory of 3108	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	120
PID 3460 wrote to memory of 3108	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	120
PID 3460 wrote to memory of 3324	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	121
PID 3460 wrote to memory of 3324	3460	32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\32f8129e08d761ac733dec1447dfc9d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- C:\Windows\System\ZlejIpg.exe
  C:\Windows\System\ZlejIpg.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\rCubDLf.exe
  C:\Windows\System\rCubDLf.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\FWKobSX.exe
  C:\Windows\System\FWKobSX.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\AOMKwPI.exe
  C:\Windows\System\AOMKwPI.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\KBtqjVb.exe
  C:\Windows\System\KBtqjVb.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\KMqBwew.exe
  C:\Windows\System\KMqBwew.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\vCdFsmC.exe
  C:\Windows\System\vCdFsmC.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\aYsraEq.exe
  C:\Windows\System\aYsraEq.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\CuMaibP.exe
  C:\Windows\System\CuMaibP.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\LsDQWfi.exe
  C:\Windows\System\LsDQWfi.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\CJgOmSO.exe
  C:\Windows\System\CJgOmSO.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\IjiiuuB.exe
  C:\Windows\System\IjiiuuB.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\IPHAMSR.exe
  C:\Windows\System\IPHAMSR.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\MyvMXBU.exe
  C:\Windows\System\MyvMXBU.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\eqdTVBN.exe
  C:\Windows\System\eqdTVBN.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\MjyeSDt.exe
  C:\Windows\System\MjyeSDt.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\xcnTpXH.exe
  C:\Windows\System\xcnTpXH.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\bQmTixe.exe
  C:\Windows\System\bQmTixe.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\SXuRKQj.exe
  C:\Windows\System\SXuRKQj.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\dHXTMMF.exe
  C:\Windows\System\dHXTMMF.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\Jhavxij.exe
  C:\Windows\System\Jhavxij.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\BDCSMgz.exe
  C:\Windows\System\BDCSMgz.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\EBWTZEc.exe
  C:\Windows\System\EBWTZEc.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\wwceKZM.exe
  C:\Windows\System\wwceKZM.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\vBCjnhl.exe
  C:\Windows\System\vBCjnhl.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\TiyPMKv.exe
  C:\Windows\System\TiyPMKv.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\ZMmdYJq.exe
  C:\Windows\System\ZMmdYJq.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\jotnDZB.exe
  C:\Windows\System\jotnDZB.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\LmsPwtQ.exe
  C:\Windows\System\LmsPwtQ.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\BtuuSDV.exe
  C:\Windows\System\BtuuSDV.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\eEhiLiO.exe
  C:\Windows\System\eEhiLiO.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\QVkbmBj.exe
  C:\Windows\System\QVkbmBj.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\QmeYAqz.exe
  C:\Windows\System\QmeYAqz.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\VObCYXk.exe
  C:\Windows\System\VObCYXk.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\MQDjDWh.exe
  C:\Windows\System\MQDjDWh.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\pRmhUhA.exe
  C:\Windows\System\pRmhUhA.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\sIzgMDi.exe
  C:\Windows\System\sIzgMDi.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\PouFZtf.exe
  C:\Windows\System\PouFZtf.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\VsqcJIL.exe
  C:\Windows\System\VsqcJIL.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\EyhqpJZ.exe
  C:\Windows\System\EyhqpJZ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\CrAyIKI.exe
  C:\Windows\System\CrAyIKI.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\HWGoEYQ.exe
  C:\Windows\System\HWGoEYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\RkHPBCu.exe
  C:\Windows\System\RkHPBCu.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\QOflWcH.exe
  C:\Windows\System\QOflWcH.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\OKgStKT.exe
  C:\Windows\System\OKgStKT.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\wreiPms.exe
  C:\Windows\System\wreiPms.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\jTUbJDL.exe
  C:\Windows\System\jTUbJDL.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\DXFERYA.exe
  C:\Windows\System\DXFERYA.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\OqczJez.exe
  C:\Windows\System\OqczJez.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\PyplsMg.exe
  C:\Windows\System\PyplsMg.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\VQWbcgw.exe
  C:\Windows\System\VQWbcgw.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\MbzmkEI.exe
  C:\Windows\System\MbzmkEI.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\MSvHteq.exe
  C:\Windows\System\MSvHteq.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\kcwsftt.exe
  C:\Windows\System\kcwsftt.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\uMrmzBm.exe
  C:\Windows\System\uMrmzBm.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\aAuIPFK.exe
  C:\Windows\System\aAuIPFK.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\tqYARJs.exe
  C:\Windows\System\tqYARJs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qYTPxBk.exe
  C:\Windows\System\qYTPxBk.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\oTIqtDN.exe
  C:\Windows\System\oTIqtDN.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\AaxvbvJ.exe
  C:\Windows\System\AaxvbvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\VeXsawo.exe
  C:\Windows\System\VeXsawo.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\cnQrcKd.exe
  C:\Windows\System\cnQrcKd.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\gWKBPiu.exe
  C:\Windows\System\gWKBPiu.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\UeCSgJe.exe
  C:\Windows\System\UeCSgJe.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\nxiPcMK.exe
  C:\Windows\System\nxiPcMK.exe
  2⤵
  PID:992
- C:\Windows\System\FvBDxnd.exe
  C:\Windows\System\FvBDxnd.exe
  2⤵
  PID:2020
- C:\Windows\System\HvdgDeN.exe
  C:\Windows\System\HvdgDeN.exe
  2⤵
  PID:4396
- C:\Windows\System\FGknAvQ.exe
  C:\Windows\System\FGknAvQ.exe
  2⤵
  PID:3988
- C:\Windows\System\JkJONDC.exe
  C:\Windows\System\JkJONDC.exe
  2⤵
  PID:3340
- C:\Windows\System\UasPxtQ.exe
  C:\Windows\System\UasPxtQ.exe
  2⤵
  PID:1128
- C:\Windows\System\mUXZwKY.exe
  C:\Windows\System\mUXZwKY.exe
  2⤵
  PID:5152
- C:\Windows\System\kDEViDE.exe
  C:\Windows\System\kDEViDE.exe
  2⤵
  PID:5192
- C:\Windows\System\ORSqTrD.exe
  C:\Windows\System\ORSqTrD.exe
  2⤵
  PID:5248
- C:\Windows\System\XWzCodF.exe
  C:\Windows\System\XWzCodF.exe
  2⤵
  PID:5284
- C:\Windows\System\HXWUXIf.exe
  C:\Windows\System\HXWUXIf.exe
  2⤵
  PID:5320
- C:\Windows\System\qnIpsxw.exe
  C:\Windows\System\qnIpsxw.exe
  2⤵
  PID:5340
- C:\Windows\System\cKuaStb.exe
  C:\Windows\System\cKuaStb.exe
  2⤵
  PID:5368
- C:\Windows\System\TjeILkR.exe
  C:\Windows\System\TjeILkR.exe
  2⤵
  PID:5400
- C:\Windows\System\VFiEwEf.exe
  C:\Windows\System\VFiEwEf.exe
  2⤵
  PID:5452
- C:\Windows\System\TAfEpmR.exe
  C:\Windows\System\TAfEpmR.exe
  2⤵
  PID:5488
- C:\Windows\System\TzwECkW.exe
  C:\Windows\System\TzwECkW.exe
  2⤵
  PID:5516
- C:\Windows\System\KXPxhNW.exe
  C:\Windows\System\KXPxhNW.exe
  2⤵
  PID:5556
- C:\Windows\System\vMVNBDt.exe
  C:\Windows\System\vMVNBDt.exe
  2⤵
  PID:5604
- C:\Windows\System\QpyFaPN.exe
  C:\Windows\System\QpyFaPN.exe
  2⤵
  PID:5652
- C:\Windows\System\UBHVDcT.exe
  C:\Windows\System\UBHVDcT.exe
  2⤵
  PID:5684
- C:\Windows\System\jtxPJdN.exe
  C:\Windows\System\jtxPJdN.exe
  2⤵
  PID:5724
- C:\Windows\System\QzmkDzd.exe
  C:\Windows\System\QzmkDzd.exe
  2⤵
  PID:5752
- C:\Windows\System\bBFjvdt.exe
  C:\Windows\System\bBFjvdt.exe
  2⤵
  PID:5796
- C:\Windows\System\ZoNAecD.exe
  C:\Windows\System\ZoNAecD.exe
  2⤵
  PID:5840
- C:\Windows\System\cXRQIaO.exe
  C:\Windows\System\cXRQIaO.exe
  2⤵
  PID:5868
- C:\Windows\System\gFbOrtz.exe
  C:\Windows\System\gFbOrtz.exe
  2⤵
  PID:5904
- C:\Windows\System\uMyPzzj.exe
  C:\Windows\System\uMyPzzj.exe
  2⤵
  PID:5928
- C:\Windows\System\dGtznsP.exe
  C:\Windows\System\dGtznsP.exe
  2⤵
  PID:5948
- C:\Windows\System\uaSvkFV.exe
  C:\Windows\System\uaSvkFV.exe
  2⤵
  PID:5996
- C:\Windows\System\BvbPnHi.exe
  C:\Windows\System\BvbPnHi.exe
  2⤵
  PID:6028
- C:\Windows\System\HnlahsZ.exe
  C:\Windows\System\HnlahsZ.exe
  2⤵
  PID:6056
- C:\Windows\System\sWeWAHO.exe
  C:\Windows\System\sWeWAHO.exe
  2⤵
  PID:6084
- C:\Windows\System\KxwUDOM.exe
  C:\Windows\System\KxwUDOM.exe
  2⤵
  PID:6112
- C:\Windows\System\WPYtUdi.exe
  C:\Windows\System\WPYtUdi.exe
  2⤵
  PID:6140
- C:\Windows\System\ouHnAmh.exe
  C:\Windows\System\ouHnAmh.exe
  2⤵
  PID:5216
- C:\Windows\System\lsvRMyu.exe
  C:\Windows\System\lsvRMyu.exe
  2⤵
  PID:5296
- C:\Windows\System\jEBMQSV.exe
  C:\Windows\System\jEBMQSV.exe
  2⤵
  PID:5380
- C:\Windows\System\opXrSpp.exe
  C:\Windows\System\opXrSpp.exe
  2⤵
  PID:5476
- C:\Windows\System\WHSbpXr.exe
  C:\Windows\System\WHSbpXr.exe
  2⤵
  PID:8
- C:\Windows\System\LyVqzRH.exe
  C:\Windows\System\LyVqzRH.exe
  2⤵
  PID:5660
- C:\Windows\System\TgyXpjh.exe
  C:\Windows\System\TgyXpjh.exe
  2⤵
  PID:5424
- C:\Windows\System\vBxyABF.exe
  C:\Windows\System\vBxyABF.exe
  2⤵
  PID:5732
- C:\Windows\System\GBJgCbS.exe
  C:\Windows\System\GBJgCbS.exe
  2⤵
  PID:5772
- C:\Windows\System\arcvjUH.exe
  C:\Windows\System\arcvjUH.exe
  2⤵
  PID:5864
- C:\Windows\System\PnDqcZY.exe
  C:\Windows\System\PnDqcZY.exe
  2⤵
  PID:5940
- C:\Windows\System\woKSMsa.exe
  C:\Windows\System\woKSMsa.exe
  2⤵
  PID:5984
- C:\Windows\System\EIKKuhZ.exe
  C:\Windows\System\EIKKuhZ.exe
  2⤵
  PID:6064
- C:\Windows\System\KCShhNA.exe
  C:\Windows\System\KCShhNA.exe
  2⤵
  PID:6120
- C:\Windows\System\VPThUYT.exe
  C:\Windows\System\VPThUYT.exe
  2⤵
  PID:5328
- C:\Windows\System\qsntUWW.exe
  C:\Windows\System\qsntUWW.exe
  2⤵
  PID:5524
- C:\Windows\System\pTHduRy.exe
  C:\Windows\System\pTHduRy.exe
  2⤵
  PID:5700
- C:\Windows\System\gmIpSOH.exe
  C:\Windows\System\gmIpSOH.exe
  2⤵
  PID:5832
- C:\Windows\System\EzoLLsk.exe
  C:\Windows\System\EzoLLsk.exe
  2⤵
  PID:6048
- C:\Windows\System\mGClqYu.exe
  C:\Windows\System\mGClqYu.exe
  2⤵
  PID:5268
- C:\Windows\System\lvNHksO.exe
  C:\Windows\System\lvNHksO.exe
  2⤵
  PID:5824
- C:\Windows\System\noSFpbC.exe
  C:\Windows\System\noSFpbC.exe
  2⤵
  PID:6100
- C:\Windows\System\oVSuHhs.exe
  C:\Windows\System\oVSuHhs.exe
  2⤵
  PID:5464
- C:\Windows\System\swJUSTz.exe
  C:\Windows\System\swJUSTz.exe
  2⤵
  PID:5708
- C:\Windows\System\vRxbdZn.exe
  C:\Windows\System\vRxbdZn.exe
  2⤵
  PID:6180
- C:\Windows\System\OZliSme.exe
  C:\Windows\System\OZliSme.exe
  2⤵
  PID:6212
- C:\Windows\System\pzkgXAs.exe
  C:\Windows\System\pzkgXAs.exe
  2⤵
  PID:6252
- C:\Windows\System\CidUOZD.exe
  C:\Windows\System\CidUOZD.exe
  2⤵
  PID:6276
- C:\Windows\System\sFUaJFk.exe
  C:\Windows\System\sFUaJFk.exe
  2⤵
  PID:6312
- C:\Windows\System\ZujfEvj.exe
  C:\Windows\System\ZujfEvj.exe
  2⤵
  PID:6340
- C:\Windows\System\aInDohs.exe
  C:\Windows\System\aInDohs.exe
  2⤵
  PID:6372
- C:\Windows\System\AVoQAsF.exe
  C:\Windows\System\AVoQAsF.exe
  2⤵
  PID:6400
- C:\Windows\System\udBvruI.exe
  C:\Windows\System\udBvruI.exe
  2⤵
  PID:6428
- C:\Windows\System\rMhQPom.exe
  C:\Windows\System\rMhQPom.exe
  2⤵
  PID:6448
- C:\Windows\System\unbgLUb.exe
  C:\Windows\System\unbgLUb.exe
  2⤵
  PID:6484
- C:\Windows\System\hDOQbHB.exe
  C:\Windows\System\hDOQbHB.exe
  2⤵
  PID:6512
- C:\Windows\System\uXmoTNR.exe
  C:\Windows\System\uXmoTNR.exe
  2⤵
  PID:6540
- C:\Windows\System\PKlRbSR.exe
  C:\Windows\System\PKlRbSR.exe
  2⤵
  PID:6568
- C:\Windows\System\hQfyWFq.exe
  C:\Windows\System\hQfyWFq.exe
  2⤵
  PID:6588
- C:\Windows\System\fQInUcy.exe
  C:\Windows\System\fQInUcy.exe
  2⤵
  PID:6624
- C:\Windows\System\IwhcaJn.exe
  C:\Windows\System\IwhcaJn.exe
  2⤵
  PID:6652
- C:\Windows\System\wdEpQCR.exe
  C:\Windows\System\wdEpQCR.exe
  2⤵
  PID:6680
- C:\Windows\System\raScanC.exe
  C:\Windows\System\raScanC.exe
  2⤵
  PID:6708
- C:\Windows\System\VPhFabw.exe
  C:\Windows\System\VPhFabw.exe
  2⤵
  PID:6736
- C:\Windows\System\FuzfQXn.exe
  C:\Windows\System\FuzfQXn.exe
  2⤵
  PID:6764
- C:\Windows\System\dhjjqNF.exe
  C:\Windows\System\dhjjqNF.exe
  2⤵
  PID:6792
- C:\Windows\System\HWfEWMz.exe
  C:\Windows\System\HWfEWMz.exe
  2⤵
  PID:6812
- C:\Windows\System\GGwNdXB.exe
  C:\Windows\System\GGwNdXB.exe
  2⤵
  PID:6840
- C:\Windows\System\glPOoLB.exe
  C:\Windows\System\glPOoLB.exe
  2⤵
  PID:6872
- C:\Windows\System\peXnakx.exe
  C:\Windows\System\peXnakx.exe
  2⤵
  PID:6900
- C:\Windows\System\myywcWH.exe
  C:\Windows\System\myywcWH.exe
  2⤵
  PID:6928
- C:\Windows\System\wwjzPDx.exe
  C:\Windows\System\wwjzPDx.exe
  2⤵
  PID:6956
- C:\Windows\System\xzeoNvM.exe
  C:\Windows\System\xzeoNvM.exe
  2⤵
  PID:6988
- C:\Windows\System\bODAIPJ.exe
  C:\Windows\System\bODAIPJ.exe
  2⤵
  PID:7016
- C:\Windows\System\rQgLVLn.exe
  C:\Windows\System\rQgLVLn.exe
  2⤵
  PID:7036
- C:\Windows\System\ZBEAzyN.exe
  C:\Windows\System\ZBEAzyN.exe
  2⤵
  PID:7072
- C:\Windows\System\NmljCqF.exe
  C:\Windows\System\NmljCqF.exe
  2⤵
  PID:7100
- C:\Windows\System\crQsrKV.exe
  C:\Windows\System\crQsrKV.exe
  2⤵
  PID:7128
- C:\Windows\System\HqxnRfg.exe
  C:\Windows\System\HqxnRfg.exe
  2⤵
  PID:7148
- C:\Windows\System\VHQbBEd.exe
  C:\Windows\System\VHQbBEd.exe
  2⤵
  PID:6152
- C:\Windows\System\gmarIdA.exe
  C:\Windows\System\gmarIdA.exe
  2⤵
  PID:6260
- C:\Windows\System\lVJzjMd.exe
  C:\Windows\System\lVJzjMd.exe
  2⤵
  PID:6324
- C:\Windows\System\iYEYePu.exe
  C:\Windows\System\iYEYePu.exe
  2⤵
  PID:6388
- C:\Windows\System\GrcdBnh.exe
  C:\Windows\System\GrcdBnh.exe
  2⤵
  PID:6444
- C:\Windows\System\MGxESbf.exe
  C:\Windows\System\MGxESbf.exe
  2⤵
  PID:6520
- C:\Windows\System\YnDfZwD.exe
  C:\Windows\System\YnDfZwD.exe
  2⤵
  PID:6584
- C:\Windows\System\AdWzKIq.exe
  C:\Windows\System\AdWzKIq.exe
  2⤵
  PID:6660
- C:\Windows\System\LYdlipu.exe
  C:\Windows\System\LYdlipu.exe
  2⤵
  PID:6720
- C:\Windows\System\jxucGsy.exe
  C:\Windows\System\jxucGsy.exe
  2⤵
  PID:6800
- C:\Windows\System\cemtNty.exe
  C:\Windows\System\cemtNty.exe
  2⤵
  PID:6852
- C:\Windows\System\HeCDxof.exe
  C:\Windows\System\HeCDxof.exe
  2⤵
  PID:6888
- C:\Windows\System\wrjNsRZ.exe
  C:\Windows\System\wrjNsRZ.exe
  2⤵
  PID:2148
- C:\Windows\System\YmMKAnh.exe
  C:\Windows\System\YmMKAnh.exe
  2⤵
  PID:7048
- C:\Windows\System\RAQUqkV.exe
  C:\Windows\System\RAQUqkV.exe
  2⤵
  PID:7088
- C:\Windows\System\opWVEkV.exe
  C:\Windows\System\opWVEkV.exe
  2⤵
  PID:7160
- C:\Windows\System\KuGsJuJ.exe
  C:\Windows\System\KuGsJuJ.exe
  2⤵
  PID:6348
- C:\Windows\System\fyZmYfL.exe
  C:\Windows\System\fyZmYfL.exe
  2⤵
  PID:6364
- C:\Windows\System\WgaiAIZ.exe
  C:\Windows\System\WgaiAIZ.exe
  2⤵
  PID:6616
- C:\Windows\System\KwdrRVn.exe
  C:\Windows\System\KwdrRVn.exe
  2⤵
  PID:6744
- C:\Windows\System\BnjBUCc.exe
  C:\Windows\System\BnjBUCc.exe
  2⤵
  PID:6880
- C:\Windows\System\YkRwXjb.exe
  C:\Windows\System\YkRwXjb.exe
  2⤵
  PID:7024
- C:\Windows\System\HfNMfLl.exe
  C:\Windows\System\HfNMfLl.exe
  2⤵
  PID:6232
- C:\Windows\System\VlSiezk.exe
  C:\Windows\System\VlSiezk.exe
  2⤵
  PID:6528
- C:\Windows\System\KtmEozm.exe
  C:\Windows\System\KtmEozm.exe
  2⤵
  PID:6808
- C:\Windows\System\KTTKeeb.exe
  C:\Windows\System\KTTKeeb.exe
  2⤵
  PID:7144
- C:\Windows\System\tNjldSj.exe
  C:\Windows\System\tNjldSj.exe
  2⤵
  PID:6936
- C:\Windows\System\dWxxeMd.exe
  C:\Windows\System\dWxxeMd.exe
  2⤵
  PID:6688
- C:\Windows\System\DhFLQxW.exe
  C:\Windows\System\DhFLQxW.exe
  2⤵
  PID:7196
- C:\Windows\System\SWGKFgw.exe
  C:\Windows\System\SWGKFgw.exe
  2⤵
  PID:7224
- C:\Windows\System\FgnayrH.exe
  C:\Windows\System\FgnayrH.exe
  2⤵
  PID:7240
- C:\Windows\System\DKFgduA.exe
  C:\Windows\System\DKFgduA.exe
  2⤵
  PID:7268
- C:\Windows\System\YwKdkMw.exe
  C:\Windows\System\YwKdkMw.exe
  2⤵
  PID:7300
- C:\Windows\System\nkIQbTg.exe
  C:\Windows\System\nkIQbTg.exe
  2⤵
  PID:7324
- C:\Windows\System\YOmCtCY.exe
  C:\Windows\System\YOmCtCY.exe
  2⤵
  PID:7364
- C:\Windows\System\OJdNcFl.exe
  C:\Windows\System\OJdNcFl.exe
  2⤵
  PID:7392
- C:\Windows\System\kWyiBJq.exe
  C:\Windows\System\kWyiBJq.exe
  2⤵
  PID:7420
- C:\Windows\System\saItAhP.exe
  C:\Windows\System\saItAhP.exe
  2⤵
  PID:7440
- C:\Windows\System\LXpGrnw.exe
  C:\Windows\System\LXpGrnw.exe
  2⤵
  PID:7468
- C:\Windows\System\VeckZUz.exe
  C:\Windows\System\VeckZUz.exe
  2⤵
  PID:7504
- C:\Windows\System\wpXJUXS.exe
  C:\Windows\System\wpXJUXS.exe
  2⤵
  PID:7532
- C:\Windows\System\eORkEJv.exe
  C:\Windows\System\eORkEJv.exe
  2⤵
  PID:7548
- C:\Windows\System\JFOgWGc.exe
  C:\Windows\System\JFOgWGc.exe
  2⤵
  PID:7576
- C:\Windows\System\hqffKnt.exe
  C:\Windows\System\hqffKnt.exe
  2⤵
  PID:7604
- C:\Windows\System\NiRDaeD.exe
  C:\Windows\System\NiRDaeD.exe
  2⤵
  PID:7636
- C:\Windows\System\GQOieBy.exe
  C:\Windows\System\GQOieBy.exe
  2⤵
  PID:7672
- C:\Windows\System\potonGW.exe
  C:\Windows\System\potonGW.exe
  2⤵
  PID:7704
- C:\Windows\System\cgrePLC.exe
  C:\Windows\System\cgrePLC.exe
  2⤵
  PID:7728
- C:\Windows\System\pOZUmbF.exe
  C:\Windows\System\pOZUmbF.exe
  2⤵
  PID:7764
- C:\Windows\System\VAiUsDe.exe
  C:\Windows\System\VAiUsDe.exe
  2⤵
  PID:7784
- C:\Windows\System\FAgqcmY.exe
  C:\Windows\System\FAgqcmY.exe
  2⤵
  PID:7812
- C:\Windows\System\zlmYOUT.exe
  C:\Windows\System\zlmYOUT.exe
  2⤵
  PID:7840
- C:\Windows\System\tDenaKf.exe
  C:\Windows\System\tDenaKf.exe
  2⤵
  PID:7864
- C:\Windows\System\IDpvsGs.exe
  C:\Windows\System\IDpvsGs.exe
  2⤵
  PID:7884
- C:\Windows\System\FjUHVqA.exe
  C:\Windows\System\FjUHVqA.exe
  2⤵
  PID:7912
- C:\Windows\System\FcdsaAI.exe
  C:\Windows\System\FcdsaAI.exe
  2⤵
  PID:7944
- C:\Windows\System\hyDOSGh.exe
  C:\Windows\System\hyDOSGh.exe
  2⤵
  PID:7976
- C:\Windows\System\OVCivLA.exe
  C:\Windows\System\OVCivLA.exe
  2⤵
  PID:8000
- C:\Windows\System\OyGnQWW.exe
  C:\Windows\System\OyGnQWW.exe
  2⤵
  PID:8040
- C:\Windows\System\pFmHazZ.exe
  C:\Windows\System\pFmHazZ.exe
  2⤵
  PID:8072
- C:\Windows\System\hGALfpZ.exe
  C:\Windows\System\hGALfpZ.exe
  2⤵
  PID:8096
- C:\Windows\System\sCFRAgC.exe
  C:\Windows\System\sCFRAgC.exe
  2⤵
  PID:8124
- C:\Windows\System\ncAGrOM.exe
  C:\Windows\System\ncAGrOM.exe
  2⤵
  PID:8152
- C:\Windows\System\lQhbgBj.exe
  C:\Windows\System\lQhbgBj.exe
  2⤵
  PID:8180
- C:\Windows\System\auBWmaQ.exe
  C:\Windows\System\auBWmaQ.exe
  2⤵
  PID:4480
- C:\Windows\System\VZrZwQR.exe
  C:\Windows\System\VZrZwQR.exe
  2⤵
  PID:7252
- C:\Windows\System\qeFkARs.exe
  C:\Windows\System\qeFkARs.exe
  2⤵
  PID:7308
- C:\Windows\System\FPXEePG.exe
  C:\Windows\System\FPXEePG.exe
  2⤵
  PID:7380
- C:\Windows\System\dqUNiGh.exe
  C:\Windows\System\dqUNiGh.exe
  2⤵
  PID:7448
- C:\Windows\System\oQoRXhE.exe
  C:\Windows\System\oQoRXhE.exe
  2⤵
  PID:7496
- C:\Windows\System\BruODQS.exe
  C:\Windows\System\BruODQS.exe
  2⤵
  PID:7564
- C:\Windows\System\RBkwHho.exe
  C:\Windows\System\RBkwHho.exe
  2⤵
  PID:7624
- C:\Windows\System\TtdzNWv.exe
  C:\Windows\System\TtdzNWv.exe
  2⤵
  PID:7668
- C:\Windows\System\ODfvgrb.exe
  C:\Windows\System\ODfvgrb.exe
  2⤵
  PID:7740
- C:\Windows\System\KguvtZM.exe
  C:\Windows\System\KguvtZM.exe
  2⤵
  PID:7772
- C:\Windows\System\MoGQPjm.exe
  C:\Windows\System\MoGQPjm.exe
  2⤵
  PID:7872
- C:\Windows\System\MxwmUgu.exe
  C:\Windows\System\MxwmUgu.exe
  2⤵
  PID:7936
- C:\Windows\System\LxJEBvX.exe
  C:\Windows\System\LxJEBvX.exe
  2⤵
  PID:8012
- C:\Windows\System\uNbOFGZ.exe
  C:\Windows\System\uNbOFGZ.exe
  2⤵
  PID:8056
- C:\Windows\System\JuWHHLw.exe
  C:\Windows\System\JuWHHLw.exe
  2⤵
  PID:8148
- C:\Windows\System\pKDpFDE.exe
  C:\Windows\System\pKDpFDE.exe
  2⤵
  PID:6416
- C:\Windows\System\pYxTOLc.exe
  C:\Windows\System\pYxTOLc.exe
  2⤵
  PID:7356
- C:\Windows\System\kQQnyDS.exe
  C:\Windows\System\kQQnyDS.exe
  2⤵
  PID:7500
- C:\Windows\System\aVnNqxt.exe
  C:\Windows\System\aVnNqxt.exe
  2⤵
  PID:7652
- C:\Windows\System\yOjFpYp.exe
  C:\Windows\System\yOjFpYp.exe
  2⤵
  PID:7828
- C:\Windows\System\iTgKyQw.exe
  C:\Windows\System\iTgKyQw.exe
  2⤵
  PID:7892
- C:\Windows\System\IUBENqa.exe
  C:\Windows\System\IUBENqa.exe
  2⤵
  PID:8108
- C:\Windows\System\GolzfrD.exe
  C:\Windows\System\GolzfrD.exe
  2⤵
  PID:7288
- C:\Windows\System\fWcGkzW.exe
  C:\Windows\System\fWcGkzW.exe
  2⤵
  PID:7616
- C:\Windows\System\qzqjZVu.exe
  C:\Windows\System\qzqjZVu.exe
  2⤵
  PID:7968
- C:\Windows\System\tckfeNB.exe
  C:\Windows\System\tckfeNB.exe
  2⤵
  PID:7556
- C:\Windows\System\kLzaCpA.exe
  C:\Windows\System\kLzaCpA.exe
  2⤵
  PID:7412
- C:\Windows\System\odhOTiT.exe
  C:\Windows\System\odhOTiT.exe
  2⤵
  PID:8208
- C:\Windows\System\aCyEMLS.exe
  C:\Windows\System\aCyEMLS.exe
  2⤵
  PID:8236
- C:\Windows\System\vrgGOKU.exe
  C:\Windows\System\vrgGOKU.exe
  2⤵
  PID:8264
- C:\Windows\System\NvALJQK.exe
  C:\Windows\System\NvALJQK.exe
  2⤵
  PID:8280
- C:\Windows\System\fsFecUo.exe
  C:\Windows\System\fsFecUo.exe
  2⤵
  PID:8320
- C:\Windows\System\dfFKBXe.exe
  C:\Windows\System\dfFKBXe.exe
  2⤵
  PID:8336
- C:\Windows\System\ocXEmBR.exe
  C:\Windows\System\ocXEmBR.exe
  2⤵
  PID:8364
- C:\Windows\System\EjLEZUs.exe
  C:\Windows\System\EjLEZUs.exe
  2⤵
  PID:8404
- C:\Windows\System\SXUZzHd.exe
  C:\Windows\System\SXUZzHd.exe
  2⤵
  PID:8432
- C:\Windows\System\nhdfoFe.exe
  C:\Windows\System\nhdfoFe.exe
  2⤵
  PID:8456
- C:\Windows\System\GjgtawU.exe
  C:\Windows\System\GjgtawU.exe
  2⤵
  PID:8484
- C:\Windows\System\kPHDRze.exe
  C:\Windows\System\kPHDRze.exe
  2⤵
  PID:8504
- C:\Windows\System\khmmUEP.exe
  C:\Windows\System\khmmUEP.exe
  2⤵
  PID:8540
- C:\Windows\System\UWfdCLi.exe
  C:\Windows\System\UWfdCLi.exe
  2⤵
  PID:8572
- C:\Windows\System\gHQWQbq.exe
  C:\Windows\System\gHQWQbq.exe
  2⤵
  PID:8596
- C:\Windows\System\QUyIpky.exe
  C:\Windows\System\QUyIpky.exe
  2⤵
  PID:8628
- C:\Windows\System\eQydFel.exe
  C:\Windows\System\eQydFel.exe
  2⤵
  PID:8644
- C:\Windows\System\FeOLwsU.exe
  C:\Windows\System\FeOLwsU.exe
  2⤵
  PID:8676
- C:\Windows\System\OvupvHI.exe
  C:\Windows\System\OvupvHI.exe
  2⤵
  PID:8704
- C:\Windows\System\yzrATCV.exe
  C:\Windows\System\yzrATCV.exe
  2⤵
  PID:8740
- C:\Windows\System\OnLzRex.exe
  C:\Windows\System\OnLzRex.exe
  2⤵
  PID:8760
- C:\Windows\System\seyVVEX.exe
  C:\Windows\System\seyVVEX.exe
  2⤵
  PID:8792
- C:\Windows\System\YBWwBrD.exe
  C:\Windows\System\YBWwBrD.exe
  2⤵
  PID:8820
- C:\Windows\System\KEWeEns.exe
  C:\Windows\System\KEWeEns.exe
  2⤵
  PID:8844
- C:\Windows\System\ydgzDPe.exe
  C:\Windows\System\ydgzDPe.exe
  2⤵
  PID:8872
- C:\Windows\System\VMFHDmf.exe
  C:\Windows\System\VMFHDmf.exe
  2⤵
  PID:8908
- C:\Windows\System\LLzYJnG.exe
  C:\Windows\System\LLzYJnG.exe
  2⤵
  PID:8928
- C:\Windows\System\gwBzXdJ.exe
  C:\Windows\System\gwBzXdJ.exe
  2⤵
  PID:8960
- C:\Windows\System\KyQrAqt.exe
  C:\Windows\System\KyQrAqt.exe
  2⤵
  PID:8984
- C:\Windows\System\FWuCqeC.exe
  C:\Windows\System\FWuCqeC.exe
  2⤵
  PID:9016
- C:\Windows\System\WYqOjVf.exe
  C:\Windows\System\WYqOjVf.exe
  2⤵
  PID:9044
- C:\Windows\System\ayohItp.exe
  C:\Windows\System\ayohItp.exe
  2⤵
  PID:9080
- C:\Windows\System\XnsQcnn.exe
  C:\Windows\System\XnsQcnn.exe
  2⤵
  PID:9108
- C:\Windows\System\VlbXMTb.exe
  C:\Windows\System\VlbXMTb.exe
  2⤵
  PID:9136
- C:\Windows\System\EFHOkkB.exe
  C:\Windows\System\EFHOkkB.exe
  2⤵
  PID:9164
- C:\Windows\System\XYvVeDe.exe
  C:\Windows\System\XYvVeDe.exe
  2⤵
  PID:9192
- C:\Windows\System\LPhECXC.exe
  C:\Windows\System\LPhECXC.exe
  2⤵
  PID:8196
- C:\Windows\System\HYvDxVH.exe
  C:\Windows\System\HYvDxVH.exe
  2⤵
  PID:8232
- C:\Windows\System\Uxqvjeq.exe
  C:\Windows\System\Uxqvjeq.exe
  2⤵
  PID:8332
- C:\Windows\System\qDfGXEH.exe
  C:\Windows\System\qDfGXEH.exe
  2⤵
  PID:8396
- C:\Windows\System\bicWRgq.exe
  C:\Windows\System\bicWRgq.exe
  2⤵
  PID:8444
- C:\Windows\System\BAqYeGt.exe
  C:\Windows\System\BAqYeGt.exe
  2⤵
  PID:8516
- C:\Windows\System\lzxixCr.exe
  C:\Windows\System\lzxixCr.exe
  2⤵
  PID:8588
- C:\Windows\System\jHrJavY.exe
  C:\Windows\System\jHrJavY.exe
  2⤵
  PID:8636
- C:\Windows\System\oASTaqv.exe
  C:\Windows\System\oASTaqv.exe
  2⤵
  PID:8688
- C:\Windows\System\IRajasl.exe
  C:\Windows\System\IRajasl.exe
  2⤵
  PID:8756
- C:\Windows\System\xxfAvyO.exe
  C:\Windows\System\xxfAvyO.exe
  2⤵
  PID:8808
- C:\Windows\System\FGBjRpU.exe
  C:\Windows\System\FGBjRpU.exe
  2⤵
  PID:8860
- C:\Windows\System\GSdIJyx.exe
  C:\Windows\System\GSdIJyx.exe
  2⤵
  PID:8944
- C:\Windows\System\GqTIZuB.exe
  C:\Windows\System\GqTIZuB.exe
  2⤵
  PID:9024
- C:\Windows\System\uSyWxbS.exe
  C:\Windows\System\uSyWxbS.exe
  2⤵
  PID:9076
- C:\Windows\System\yYslAfE.exe
  C:\Windows\System\yYslAfE.exe
  2⤵
  PID:9176
- C:\Windows\System\MdGVjUu.exe
  C:\Windows\System\MdGVjUu.exe
  2⤵
  PID:8220
- C:\Windows\System\dioeFSZ.exe
  C:\Windows\System\dioeFSZ.exe
  2⤵
  PID:8348
- C:\Windows\System\ynPyiru.exe
  C:\Windows\System\ynPyiru.exe
  2⤵
  PID:8556
- C:\Windows\System\MeEJsTN.exe
  C:\Windows\System\MeEJsTN.exe
  2⤵
  PID:8640
- C:\Windows\System\fiPrzAL.exe
  C:\Windows\System\fiPrzAL.exe
  2⤵
  PID:8816
- C:\Windows\System\llJzIGp.exe
  C:\Windows\System\llJzIGp.exe
  2⤵
  PID:8924
- C:\Windows\System\YhoWnwA.exe
  C:\Windows\System\YhoWnwA.exe
  2⤵
  PID:9156
- C:\Windows\System\YReUPOh.exe
  C:\Windows\System\YReUPOh.exe
  2⤵
  PID:8420
- C:\Windows\System\BWEIDvh.exe
  C:\Windows\System\BWEIDvh.exe
  2⤵
  PID:8568
- C:\Windows\System\ofnZkzX.exe
  C:\Windows\System\ofnZkzX.exe
  2⤵
  PID:9124
- C:\Windows\System\ZJYOzNS.exe
  C:\Windows\System\ZJYOzNS.exe
  2⤵
  PID:8292
- C:\Windows\System\HUdYGQN.exe
  C:\Windows\System\HUdYGQN.exe
  2⤵
  PID:8700
- C:\Windows\System\cmBkGpC.exe
  C:\Windows\System\cmBkGpC.exe
  2⤵
  PID:9248
- C:\Windows\System\zIGiBei.exe
  C:\Windows\System\zIGiBei.exe
  2⤵
  PID:9276
- C:\Windows\System\DSlMbrU.exe
  C:\Windows\System\DSlMbrU.exe
  2⤵
  PID:9292
- C:\Windows\System\AiUhIqd.exe
  C:\Windows\System\AiUhIqd.exe
  2⤵
  PID:9308
- C:\Windows\System\CWxuPng.exe
  C:\Windows\System\CWxuPng.exe
  2⤵
  PID:9328
- C:\Windows\System\ZCpNIRN.exe
  C:\Windows\System\ZCpNIRN.exe
  2⤵
  PID:9364
- C:\Windows\System\wwiBBZl.exe
  C:\Windows\System\wwiBBZl.exe
  2⤵
  PID:9404
- C:\Windows\System\IYsJyQA.exe
  C:\Windows\System\IYsJyQA.exe
  2⤵
  PID:9448
- C:\Windows\System\TxhRuct.exe
  C:\Windows\System\TxhRuct.exe
  2⤵
  PID:9464
- C:\Windows\System\jCnAjhU.exe
  C:\Windows\System\jCnAjhU.exe
  2⤵
  PID:9504
- C:\Windows\System\rnWaXbB.exe
  C:\Windows\System\rnWaXbB.exe
  2⤵
  PID:9532
- C:\Windows\System\JOjJHvU.exe
  C:\Windows\System\JOjJHvU.exe
  2⤵
  PID:9552
- C:\Windows\System\hvSCHtr.exe
  C:\Windows\System\hvSCHtr.exe
  2⤵
  PID:9588
- C:\Windows\System\iWxrIfn.exe
  C:\Windows\System\iWxrIfn.exe
  2⤵
  PID:9616
- C:\Windows\System\XOcqMbA.exe
  C:\Windows\System\XOcqMbA.exe
  2⤵
  PID:9632
- C:\Windows\System\SyFIeCA.exe
  C:\Windows\System\SyFIeCA.exe
  2⤵
  PID:9660
- C:\Windows\System\FVXjFkR.exe
  C:\Windows\System\FVXjFkR.exe
  2⤵
  PID:9688
- C:\Windows\System\xiXrVAG.exe
  C:\Windows\System\xiXrVAG.exe
  2⤵
  PID:9704
- C:\Windows\System\RuLnPeg.exe
  C:\Windows\System\RuLnPeg.exe
  2⤵
  PID:9736
- C:\Windows\System\sdDFetM.exe
  C:\Windows\System\sdDFetM.exe
  2⤵
  PID:9784
- C:\Windows\System\wPbYfaB.exe
  C:\Windows\System\wPbYfaB.exe
  2⤵
  PID:9812
- C:\Windows\System\asAQSMe.exe
  C:\Windows\System\asAQSMe.exe
  2⤵
  PID:9828
- C:\Windows\System\BNaBhVN.exe
  C:\Windows\System\BNaBhVN.exe
  2⤵
  PID:9880
- C:\Windows\System\ngFUqgS.exe
  C:\Windows\System\ngFUqgS.exe
  2⤵
  PID:9896
- C:\Windows\System\VKdDQLP.exe
  C:\Windows\System\VKdDQLP.exe
  2⤵
  PID:9924
- C:\Windows\System\ruLZABh.exe
  C:\Windows\System\ruLZABh.exe
  2⤵
  PID:9952
- C:\Windows\System\hATOudo.exe
  C:\Windows\System\hATOudo.exe
  2⤵
  PID:9976
- C:\Windows\System\FHjVabV.exe
  C:\Windows\System\FHjVabV.exe
  2⤵
  PID:10008
- C:\Windows\System\QJuQUec.exe
  C:\Windows\System\QJuQUec.exe
  2⤵
  PID:10036
- C:\Windows\System\fwyiGbh.exe
  C:\Windows\System\fwyiGbh.exe
  2⤵
  PID:10060
- C:\Windows\System\ywhHRYs.exe
  C:\Windows\System\ywhHRYs.exe
  2⤵
  PID:10092
- C:\Windows\System\KTaXvdK.exe
  C:\Windows\System\KTaXvdK.exe
  2⤵
  PID:10112
- C:\Windows\System\hwwuCvm.exe
  C:\Windows\System\hwwuCvm.exe
  2⤵
  PID:10148
- C:\Windows\System\WKPQzGM.exe
  C:\Windows\System\WKPQzGM.exe
  2⤵
  PID:10176
- C:\Windows\System\knWStcP.exe
  C:\Windows\System\knWStcP.exe
  2⤵
  PID:10200
- C:\Windows\System\GOePqWQ.exe
  C:\Windows\System\GOePqWQ.exe
  2⤵
  PID:10232
- C:\Windows\System\lTCCAtw.exe
  C:\Windows\System\lTCCAtw.exe
  2⤵
  PID:9236
- C:\Windows\System\VAHHXsr.exe
  C:\Windows\System\VAHHXsr.exe
  2⤵
  PID:9268
- C:\Windows\System\POeuuwM.exe
  C:\Windows\System\POeuuwM.exe
  2⤵
  PID:9352
- C:\Windows\System\OOGJsUO.exe
  C:\Windows\System\OOGJsUO.exe
  2⤵
  PID:9432
- C:\Windows\System\fKfNUAi.exe
  C:\Windows\System\fKfNUAi.exe
  2⤵
  PID:9476
- C:\Windows\System\bCVbUkp.exe
  C:\Windows\System\bCVbUkp.exe
  2⤵
  PID:9544
- C:\Windows\System\MzfPICl.exe
  C:\Windows\System\MzfPICl.exe
  2⤵
  PID:9624
- C:\Windows\System\xPQxkUt.exe
  C:\Windows\System\xPQxkUt.exe
  2⤵
  PID:9672
- C:\Windows\System\lZtHWjr.exe
  C:\Windows\System\lZtHWjr.exe
  2⤵
  PID:9764
- C:\Windows\System\lPSUVDx.exe
  C:\Windows\System\lPSUVDx.exe
  2⤵
  PID:3260
- C:\Windows\System\IjSwxiQ.exe
  C:\Windows\System\IjSwxiQ.exe
  2⤵
  PID:4676
- C:\Windows\System\scLWnYe.exe
  C:\Windows\System\scLWnYe.exe
  2⤵
  PID:3548
- C:\Windows\System\HcJjnJK.exe
  C:\Windows\System\HcJjnJK.exe
  2⤵
  PID:3920
- C:\Windows\System\GlHEkOO.exe
  C:\Windows\System\GlHEkOO.exe
  2⤵
  PID:9944
- C:\Windows\System\MTtqymo.exe
  C:\Windows\System\MTtqymo.exe
  2⤵
  PID:1908
- C:\Windows\System\dNQdoOH.exe
  C:\Windows\System\dNQdoOH.exe
  2⤵
  PID:10080
- C:\Windows\System\smCkIWP.exe
  C:\Windows\System\smCkIWP.exe
  2⤵
  PID:10132
- C:\Windows\System\sBbdFLZ.exe
  C:\Windows\System\sBbdFLZ.exe
  2⤵
  PID:10192
- C:\Windows\System\cbTlNSy.exe
  C:\Windows\System\cbTlNSy.exe
  2⤵
  PID:8884
- C:\Windows\System\EwxaHHC.exe
  C:\Windows\System\EwxaHHC.exe
  2⤵
  PID:9344
- C:\Windows\System\auqqtXr.exe
  C:\Windows\System\auqqtXr.exe
  2⤵
  PID:9456
- C:\Windows\System\dNzElcx.exe
  C:\Windows\System\dNzElcx.exe
  2⤵
  PID:9644
- C:\Windows\System\mSIkSfD.exe
  C:\Windows\System\mSIkSfD.exe
  2⤵
  PID:2584
- C:\Windows\System\fxlHqKs.exe
  C:\Windows\System\fxlHqKs.exe
  2⤵
  PID:9848
- C:\Windows\System\fkiMxnk.exe
  C:\Windows\System\fkiMxnk.exe
  2⤵
  PID:9992
- C:\Windows\System\tTlxEOd.exe
  C:\Windows\System\tTlxEOd.exe
  2⤵
  PID:10104
- C:\Windows\System\xQJraMa.exe
  C:\Windows\System\xQJraMa.exe
  2⤵
  PID:9260
- C:\Windows\System\DebPHlH.exe
  C:\Windows\System\DebPHlH.exe
  2⤵
  PID:9568
- C:\Windows\System\erxuCpm.exe
  C:\Windows\System\erxuCpm.exe
  2⤵
  PID:4564
- C:\Windows\System\AbJCZRH.exe
  C:\Windows\System\AbJCZRH.exe
  2⤵
  PID:10032
- C:\Windows\System\amtfVOR.exe
  C:\Windows\System\amtfVOR.exe
  2⤵
  PID:9648
- C:\Windows\System\LDPCiRz.exe
  C:\Windows\System\LDPCiRz.exe
  2⤵
  PID:9440
- C:\Windows\System\iSfVhvo.exe
  C:\Windows\System\iSfVhvo.exe
  2⤵
  PID:10260
- C:\Windows\System\wNsSwJS.exe
  C:\Windows\System\wNsSwJS.exe
  2⤵
  PID:10280
- C:\Windows\System\xueBqEQ.exe
  C:\Windows\System\xueBqEQ.exe
  2⤵
  PID:10312
- C:\Windows\System\wCNmbvC.exe
  C:\Windows\System\wCNmbvC.exe
  2⤵
  PID:10336
- C:\Windows\System\vrTyxnw.exe
  C:\Windows\System\vrTyxnw.exe
  2⤵
  PID:10364
- C:\Windows\System\rxHkUsr.exe
  C:\Windows\System\rxHkUsr.exe
  2⤵
  PID:10388
- C:\Windows\System\QLAAwQV.exe
  C:\Windows\System\QLAAwQV.exe
  2⤵
  PID:10432
- C:\Windows\System\FvWbMDS.exe
  C:\Windows\System\FvWbMDS.exe
  2⤵
  PID:10460
- C:\Windows\System\iQMhIRz.exe
  C:\Windows\System\iQMhIRz.exe
  2⤵
  PID:10476
- C:\Windows\System\dqufDVG.exe
  C:\Windows\System\dqufDVG.exe
  2⤵
  PID:10496
- C:\Windows\System\GoJWDLR.exe
  C:\Windows\System\GoJWDLR.exe
  2⤵
  PID:10532
- C:\Windows\System\OozUHvk.exe
  C:\Windows\System\OozUHvk.exe
  2⤵
  PID:10560
- C:\Windows\System\rgwOpcn.exe
  C:\Windows\System\rgwOpcn.exe
  2⤵
  PID:10588
- C:\Windows\System\hNuyJkn.exe
  C:\Windows\System\hNuyJkn.exe
  2⤵
  PID:10624
- C:\Windows\System\zpMTwcy.exe
  C:\Windows\System\zpMTwcy.exe
  2⤵
  PID:10656
- C:\Windows\System\uoCJLJX.exe
  C:\Windows\System\uoCJLJX.exe
  2⤵
  PID:10676
- C:\Windows\System\ehMpnNl.exe
  C:\Windows\System\ehMpnNl.exe
  2⤵
  PID:10704
- C:\Windows\System\bnfEYCi.exe
  C:\Windows\System\bnfEYCi.exe
  2⤵
  PID:10744
- C:\Windows\System\JyfVnzS.exe
  C:\Windows\System\JyfVnzS.exe
  2⤵
  PID:10768
- C:\Windows\System\HrgYRfm.exe
  C:\Windows\System\HrgYRfm.exe
  2⤵
  PID:10788
- C:\Windows\System\owicTsO.exe
  C:\Windows\System\owicTsO.exe
  2⤵
  PID:10808
- C:\Windows\System\hHirYNX.exe
  C:\Windows\System\hHirYNX.exe
  2⤵
  PID:10836
- C:\Windows\System\IqiRbqt.exe
  C:\Windows\System\IqiRbqt.exe
  2⤵
  PID:10872
- C:\Windows\System\CcayopV.exe
  C:\Windows\System\CcayopV.exe
  2⤵
  PID:10892
- C:\Windows\System\OKOwPVX.exe
  C:\Windows\System\OKOwPVX.exe
  2⤵
  PID:10940
- C:\Windows\System\AKVoSFf.exe
  C:\Windows\System\AKVoSFf.exe
  2⤵
  PID:10956
- C:\Windows\System\aqdkRok.exe
  C:\Windows\System\aqdkRok.exe
  2⤵
  PID:10984
- C:\Windows\System\wMHmOnJ.exe
  C:\Windows\System\wMHmOnJ.exe
  2⤵
  PID:11012
- C:\Windows\System\MxfMgFD.exe
  C:\Windows\System\MxfMgFD.exe
  2⤵
  PID:11040
- C:\Windows\System\TsUwMhw.exe
  C:\Windows\System\TsUwMhw.exe
  2⤵
  PID:11080
- C:\Windows\System\yAkbDOL.exe
  C:\Windows\System\yAkbDOL.exe
  2⤵
  PID:11108
- C:\Windows\System\GyzIZcB.exe
  C:\Windows\System\GyzIZcB.exe
  2⤵
  PID:11136
- C:\Windows\System\DsceZep.exe
  C:\Windows\System\DsceZep.exe
  2⤵
  PID:11164
- C:\Windows\System\hnSRJpl.exe
  C:\Windows\System\hnSRJpl.exe
  2⤵
  PID:11180
- C:\Windows\System\iVecjam.exe
  C:\Windows\System\iVecjam.exe
  2⤵
  PID:11216
- C:\Windows\System\hSwkmhX.exe
  C:\Windows\System\hSwkmhX.exe
  2⤵
  PID:11248
- C:\Windows\System\WlOcjxz.exe
  C:\Windows\System\WlOcjxz.exe
  2⤵
  PID:10276
- C:\Windows\System\iyRsoWl.exe
  C:\Windows\System\iyRsoWl.exe
  2⤵
  PID:10296
- C:\Windows\System\qflhnwl.exe
  C:\Windows\System\qflhnwl.exe
  2⤵
  PID:10376
- C:\Windows\System\AxHMpil.exe
  C:\Windows\System\AxHMpil.exe
  2⤵
  PID:10444
- C:\Windows\System\WMuNxEX.exe
  C:\Windows\System\WMuNxEX.exe
  2⤵
  PID:10528
- C:\Windows\System\gJZyQZv.exe
  C:\Windows\System\gJZyQZv.exe
  2⤵
  PID:10600
- C:\Windows\System\McygpuN.exe
  C:\Windows\System\McygpuN.exe
  2⤵
  PID:10668
- C:\Windows\System\enNPjub.exe
  C:\Windows\System\enNPjub.exe
  2⤵
  PID:10732
- C:\Windows\System\GXSrSqE.exe
  C:\Windows\System\GXSrSqE.exe
  2⤵
  PID:10796
- C:\Windows\System\fiQXxyb.exe
  C:\Windows\System\fiQXxyb.exe
  2⤵
  PID:10864
- C:\Windows\System\dEfIXOs.exe
  C:\Windows\System\dEfIXOs.exe
  2⤵
  PID:10908
- C:\Windows\System\MnFRXOq.exe
  C:\Windows\System\MnFRXOq.exe
  2⤵
  PID:11024
- C:\Windows\System\tYIiwEd.exe
  C:\Windows\System\tYIiwEd.exe
  2⤵
  PID:11060
- C:\Windows\System\SLBZhZS.exe
  C:\Windows\System\SLBZhZS.exe
  2⤵
  PID:824
- C:\Windows\System\MqCujKp.exe
  C:\Windows\System\MqCujKp.exe
  2⤵
  PID:11172
- C:\Windows\System\sKtUStp.exe
  C:\Windows\System\sKtUStp.exe
  2⤵
  PID:11244
- C:\Windows\System\HWZqbbc.exe
  C:\Windows\System\HWZqbbc.exe
  2⤵
  PID:10356
- C:\Windows\System\WOHLoWh.exe
  C:\Windows\System\WOHLoWh.exe
  2⤵
  PID:10508
- C:\Windows\System\rLDkNVl.exe
  C:\Windows\System\rLDkNVl.exe
  2⤵
  PID:3496
- C:\Windows\System\ebZKzel.exe
  C:\Windows\System\ebZKzel.exe
  2⤵
  PID:10832
- C:\Windows\System\OgdfpKz.exe
  C:\Windows\System\OgdfpKz.exe
  2⤵
  PID:10976
- C:\Windows\System\xHihJYV.exe
  C:\Windows\System\xHihJYV.exe
  2⤵
  PID:11120
- C:\Windows\System\yCIfkXu.exe
  C:\Windows\System\yCIfkXu.exe
  2⤵
  PID:10252
- C:\Windows\System\XzYHcwf.exe
  C:\Windows\System\XzYHcwf.exe
  2⤵
  PID:10632
- C:\Windows\System\HYIdXgb.exe
  C:\Windows\System\HYIdXgb.exe
  2⤵
  PID:10952
- C:\Windows\System\iJlGYYT.exe
  C:\Windows\System\iJlGYYT.exe
  2⤵
  PID:10424
- C:\Windows\System\cRGfXLA.exe
  C:\Windows\System\cRGfXLA.exe
  2⤵
  PID:10880
- C:\Windows\System\vHqfmQk.exe
  C:\Windows\System\vHqfmQk.exe
  2⤵
  PID:11272
- C:\Windows\System\XEeLtPn.exe
  C:\Windows\System\XEeLtPn.exe
  2⤵
  PID:11288
- C:\Windows\System\tBEUtsQ.exe
  C:\Windows\System\tBEUtsQ.exe
  2⤵
  PID:11336
- C:\Windows\System\ySAFXso.exe
  C:\Windows\System\ySAFXso.exe
  2⤵
  PID:11380
- C:\Windows\System\GPxsOnV.exe
  C:\Windows\System\GPxsOnV.exe
  2⤵
  PID:11408
- C:\Windows\System\JhjctIv.exe
  C:\Windows\System\JhjctIv.exe
  2⤵
  PID:11428
- C:\Windows\System\MOsXMsc.exe
  C:\Windows\System\MOsXMsc.exe
  2⤵
  PID:11452
- C:\Windows\System\mvWHqDJ.exe
  C:\Windows\System\mvWHqDJ.exe
  2⤵
  PID:11484
- C:\Windows\System\nCFrADE.exe
  C:\Windows\System\nCFrADE.exe
  2⤵
  PID:11508
- C:\Windows\System\QurTwGP.exe
  C:\Windows\System\QurTwGP.exe
  2⤵
  PID:11548
- C:\Windows\System\MyPzHdb.exe
  C:\Windows\System\MyPzHdb.exe
  2⤵
  PID:11576
- C:\Windows\System\OQUBoIP.exe
  C:\Windows\System\OQUBoIP.exe
  2⤵
  PID:11592
- C:\Windows\System\ZrVNgKZ.exe
  C:\Windows\System\ZrVNgKZ.exe
  2⤵
  PID:11632
- C:\Windows\System\QGzXZTm.exe
  C:\Windows\System\QGzXZTm.exe
  2⤵
  PID:11660
- C:\Windows\System\zhSNAxI.exe
  C:\Windows\System\zhSNAxI.exe
  2⤵
  PID:11688
- C:\Windows\System\PNgjygZ.exe
  C:\Windows\System\PNgjygZ.exe
  2⤵
  PID:11716
- C:\Windows\System\JquIjZO.exe
  C:\Windows\System\JquIjZO.exe
  2⤵
  PID:11744
- C:\Windows\System\lxvRGdc.exe
  C:\Windows\System\lxvRGdc.exe
  2⤵
  PID:11772
- C:\Windows\System\eZxJLmc.exe
  C:\Windows\System\eZxJLmc.exe
  2⤵
  PID:11800
- C:\Windows\System\neWwccM.exe
  C:\Windows\System\neWwccM.exe
  2⤵
  PID:11828
- C:\Windows\System\SXGcAxg.exe
  C:\Windows\System\SXGcAxg.exe
  2⤵
  PID:11856
- C:\Windows\System\UWHbGfq.exe
  C:\Windows\System\UWHbGfq.exe
  2⤵
  PID:11884
- C:\Windows\System\EaTcqdB.exe
  C:\Windows\System\EaTcqdB.exe
  2⤵
  PID:11912
- C:\Windows\System\nLlBpdH.exe
  C:\Windows\System\nLlBpdH.exe
  2⤵
  PID:11940
- C:\Windows\System\nubjEjN.exe
  C:\Windows\System\nubjEjN.exe
  2⤵
  PID:11968
- C:\Windows\System\qtYLExR.exe
  C:\Windows\System\qtYLExR.exe
  2⤵
  PID:11996
- C:\Windows\System\DhsrnyG.exe
  C:\Windows\System\DhsrnyG.exe
  2⤵
  PID:12024
- C:\Windows\System\kiiwcTo.exe
  C:\Windows\System\kiiwcTo.exe
  2⤵
  PID:12056
- C:\Windows\System\gGcDJnq.exe
  C:\Windows\System\gGcDJnq.exe
  2⤵
  PID:12084
- C:\Windows\System\TGCwjhW.exe
  C:\Windows\System\TGCwjhW.exe
  2⤵
  PID:12112
- C:\Windows\System\ltbHRsE.exe
  C:\Windows\System\ltbHRsE.exe
  2⤵
  PID:12140
- C:\Windows\System\zyWeaiw.exe
  C:\Windows\System\zyWeaiw.exe
  2⤵
  PID:12168
- C:\Windows\System\DZpQvfX.exe
  C:\Windows\System\DZpQvfX.exe
  2⤵
  PID:12196
- C:\Windows\System\yjxmlAa.exe
  C:\Windows\System\yjxmlAa.exe
  2⤵
  PID:12224
- C:\Windows\System\ACtbHpM.exe
  C:\Windows\System\ACtbHpM.exe
  2⤵
  PID:12252
- C:\Windows\System\xiBNynj.exe
  C:\Windows\System\xiBNynj.exe
  2⤵
  PID:12280
- C:\Windows\System\mGaNRhx.exe
  C:\Windows\System\mGaNRhx.exe
  2⤵
  PID:11280
- C:\Windows\System\fdtpPJV.exe
  C:\Windows\System\fdtpPJV.exe
  2⤵
  PID:11300
- C:\Windows\System\lRgJYAF.exe
  C:\Windows\System\lRgJYAF.exe
  2⤵
  PID:11400
- C:\Windows\System\uYXhvpi.exe
  C:\Windows\System\uYXhvpi.exe
  2⤵
  PID:11480
- C:\Windows\System\gWIuQwo.exe
  C:\Windows\System\gWIuQwo.exe
  2⤵
  PID:11540
- C:\Windows\System\xZAXChS.exe
  C:\Windows\System\xZAXChS.exe
  2⤵
  PID:11604
- C:\Windows\System\tTUpgEm.exe
  C:\Windows\System\tTUpgEm.exe
  2⤵
  PID:10268
- C:\Windows\System\JjkboDW.exe
  C:\Windows\System\JjkboDW.exe
  2⤵
  PID:11728
- C:\Windows\System\qVXtXSN.exe
  C:\Windows\System\qVXtXSN.exe
  2⤵
  PID:11792
- C:\Windows\System\pFJcZSs.exe
  C:\Windows\System\pFJcZSs.exe
  2⤵
  PID:11824
- C:\Windows\System\EeIURLI.exe
  C:\Windows\System\EeIURLI.exe
  2⤵
  PID:11924
- C:\Windows\System\dGRXxty.exe
  C:\Windows\System\dGRXxty.exe
  2⤵
  PID:11988
- C:\Windows\System\DQcEoFw.exe
  C:\Windows\System\DQcEoFw.exe
  2⤵
  PID:12052
- C:\Windows\System\GRUomZu.exe
  C:\Windows\System\GRUomZu.exe
  2⤵
  PID:12124
- C:\Windows\System\eOnXyOx.exe
  C:\Windows\System\eOnXyOx.exe
  2⤵
  PID:12188
- C:\Windows\System\wLqfHys.exe
  C:\Windows\System\wLqfHys.exe
  2⤵
  PID:12248
- C:\Windows\System\dIxEJNq.exe
  C:\Windows\System\dIxEJNq.exe
  2⤵
  PID:11324
- C:\Windows\System\PmPLvpD.exe
  C:\Windows\System\PmPLvpD.exe
  2⤵
  PID:11444
- C:\Windows\System\ruxmqwY.exe
  C:\Windows\System\ruxmqwY.exe
  2⤵
  PID:11588
- C:\Windows\System\TgtNaNr.exe
  C:\Windows\System\TgtNaNr.exe
  2⤵
  PID:11764
- C:\Windows\System\GjjwrCb.exe
  C:\Windows\System\GjjwrCb.exe
  2⤵
  PID:11876
- C:\Windows\System\lipqcvZ.exe
  C:\Windows\System\lipqcvZ.exe
  2⤵
  PID:12020
- C:\Windows\System\kfTemMH.exe
  C:\Windows\System\kfTemMH.exe
  2⤵
  PID:12180
- C:\Windows\System\UZsWUjq.exe
  C:\Windows\System\UZsWUjq.exe
  2⤵
  PID:11360
- C:\Windows\System\RlxEahR.exe
  C:\Windows\System\RlxEahR.exe
  2⤵
  PID:11708
- C:\Windows\System\PWKOghP.exe
  C:\Windows\System\PWKOghP.exe
  2⤵
  PID:12016
- C:\Windows\System\FlmcWnb.exe
  C:\Windows\System\FlmcWnb.exe
  2⤵
  PID:11520
- C:\Windows\System\sFJceTE.exe
  C:\Windows\System\sFJceTE.exe
  2⤵
  PID:11104
- C:\Windows\System\AMcClWB.exe
  C:\Windows\System\AMcClWB.exe
  2⤵
  PID:12296
- C:\Windows\System\oxPsUKW.exe
  C:\Windows\System\oxPsUKW.exe
  2⤵
  PID:12324
- C:\Windows\System\JUHKesx.exe
  C:\Windows\System\JUHKesx.exe
  2⤵
  PID:12352
- C:\Windows\System\whnLBQr.exe
  C:\Windows\System\whnLBQr.exe
  2⤵
  PID:12380
- C:\Windows\System\qJdkMiS.exe
  C:\Windows\System\qJdkMiS.exe
  2⤵
  PID:12408
- C:\Windows\System\eDcnmDl.exe
  C:\Windows\System\eDcnmDl.exe
  2⤵
  PID:12436
- C:\Windows\System\JGvWrwO.exe
  C:\Windows\System\JGvWrwO.exe
  2⤵
  PID:12464
- C:\Windows\System\IUEXIMb.exe
  C:\Windows\System\IUEXIMb.exe
  2⤵
  PID:12492
- C:\Windows\System\NkijPfR.exe
  C:\Windows\System\NkijPfR.exe
  2⤵
  PID:12520
- C:\Windows\System\DGodqUe.exe
  C:\Windows\System\DGodqUe.exe
  2⤵
  PID:12548
- C:\Windows\System\xrYFXQR.exe
  C:\Windows\System\xrYFXQR.exe
  2⤵
  PID:12576
- C:\Windows\System\HpJwkMr.exe
  C:\Windows\System\HpJwkMr.exe
  2⤵
  PID:12604
- C:\Windows\System\TxbDKmo.exe
  C:\Windows\System\TxbDKmo.exe
  2⤵
  PID:12628
- C:\Windows\System\MIjxTTz.exe
  C:\Windows\System\MIjxTTz.exe
  2⤵
  PID:12652
- C:\Windows\System\UMcqphk.exe
  C:\Windows\System\UMcqphk.exe
  2⤵
  PID:12680
- C:\Windows\System\WsjwQyR.exe
  C:\Windows\System\WsjwQyR.exe
  2⤵
  PID:12700
- C:\Windows\System\xeMPeQA.exe
  C:\Windows\System\xeMPeQA.exe
  2⤵
  PID:12724
- C:\Windows\System\kfvYfJf.exe
  C:\Windows\System\kfvYfJf.exe
  2⤵
  PID:12748
- C:\Windows\System\vkXHqkU.exe
  C:\Windows\System\vkXHqkU.exe
  2⤵
  PID:12776
- C:\Windows\System\FcbnQuE.exe
  C:\Windows\System\FcbnQuE.exe
  2⤵
  PID:12804
- C:\Windows\System\DnAqcAz.exe
  C:\Windows\System\DnAqcAz.exe
  2⤵
  PID:12852
- C:\Windows\System\kUvWalI.exe
  C:\Windows\System\kUvWalI.exe
  2⤵
  PID:12880
- C:\Windows\System\HfRQDde.exe
  C:\Windows\System\HfRQDde.exe
  2⤵
  PID:12920
- C:\Windows\System\AsXinCC.exe
  C:\Windows\System\AsXinCC.exe
  2⤵
  PID:12948
- C:\Windows\System\hvuqLlA.exe
  C:\Windows\System\hvuqLlA.exe
  2⤵
  PID:12964
- C:\Windows\System\leglUGz.exe
  C:\Windows\System\leglUGz.exe
  2⤵
  PID:12992
- C:\Windows\System\oTCDZRW.exe
  C:\Windows\System\oTCDZRW.exe
  2⤵
  PID:13032
- C:\Windows\System\uFljqPk.exe
  C:\Windows\System\uFljqPk.exe
  2⤵
  PID:13060
- C:\Windows\System\wMFhuKM.exe
  C:\Windows\System\wMFhuKM.exe
  2⤵
  PID:13088
- C:\Windows\System\wrJBOzG.exe
  C:\Windows\System\wrJBOzG.exe
  2⤵
  PID:13104
- C:\Windows\System\UQHhjMD.exe
  C:\Windows\System\UQHhjMD.exe
  2⤵
  PID:13124
- C:\Windows\System\vjMihBD.exe
  C:\Windows\System\vjMihBD.exe
  2⤵
  PID:13152
- C:\Windows\System\AhdrvqU.exe
  C:\Windows\System\AhdrvqU.exe
  2⤵
  PID:13200
- C:\Windows\System\CVjdDCv.exe
  C:\Windows\System\CVjdDCv.exe
  2⤵
  PID:13228
- C:\Windows\System\tWISniR.exe
  C:\Windows\System\tWISniR.exe
  2⤵
  PID:13244
- C:\Windows\System\yetZIdQ.exe
  C:\Windows\System\yetZIdQ.exe
  2⤵
  PID:13272
- C:\Windows\System\eKYocHV.exe
  C:\Windows\System\eKYocHV.exe
  2⤵
  PID:11980
- C:\Windows\System\XhXXgAB.exe
  C:\Windows\System\XhXXgAB.exe
  2⤵
  PID:12336
- C:\Windows\System\sBElFCM.exe
  C:\Windows\System\sBElFCM.exe
  2⤵
  PID:12392
- C:\Windows\System\IAkdont.exe
  C:\Windows\System\IAkdont.exe
  2⤵
  PID:12456
- C:\Windows\System\IoSbuqc.exe
  C:\Windows\System\IoSbuqc.exe
  2⤵
  PID:12512
- C:\Windows\System\IxkQZmJ.exe
  C:\Windows\System\IxkQZmJ.exe
  2⤵
  PID:12616
- C:\Windows\System\DvxJgdC.exe
  C:\Windows\System\DvxJgdC.exe
  2⤵
  PID:12740
- C:\Windows\System\sslwzTj.exe
  C:\Windows\System\sslwzTj.exe
  2⤵
  PID:12840
- C:\Windows\System\eycAJHf.exe
  C:\Windows\System\eycAJHf.exe
  2⤵
  PID:12976
- C:\Windows\System\lgLNYeS.exe
  C:\Windows\System\lgLNYeS.exe
  2⤵
  PID:13016
- C:\Windows\System\qWKZDHO.exe
  C:\Windows\System\qWKZDHO.exe
  2⤵
  PID:13052
- C:\Windows\System\BCduJVg.exe
  C:\Windows\System\BCduJVg.exe
  2⤵
  PID:13136
- C:\Windows\System\xvdfmlw.exe
  C:\Windows\System\xvdfmlw.exe
  2⤵
  PID:13184
- C:\Windows\System\QTpaGWa.exe
  C:\Windows\System\QTpaGWa.exe
  2⤵
  PID:13260
- C:\Windows\System\LNtyyoW.exe
  C:\Windows\System\LNtyyoW.exe
  2⤵
  PID:12348
- C:\Windows\System\JHGJTxC.exe
  C:\Windows\System\JHGJTxC.exe
  2⤵
  PID:12504
- C:\Windows\System\yfOQaCh.exe
  C:\Windows\System\yfOQaCh.exe
  2⤵
  PID:12572
- C:\Windows\System\vAtWDLG.exe
  C:\Windows\System\vAtWDLG.exe
  2⤵
  PID:12708
- C:\Windows\System\fJcxDQt.exe
  C:\Windows\System\fJcxDQt.exe
  2⤵
  PID:12792
- C:\Windows\System\xLgNUzZ.exe
  C:\Windows\System\xLgNUzZ.exe
  2⤵
  PID:12932
- C:\Windows\System\hFQcDgM.exe
  C:\Windows\System\hFQcDgM.exe
  2⤵
  PID:12960
- C:\Windows\System\zwkDMAD.exe
  C:\Windows\System\zwkDMAD.exe
  2⤵
  PID:5112
- C:\Windows\System\wkpUXYL.exe
  C:\Windows\System\wkpUXYL.exe
  2⤵
  PID:1488
- C:\Windows\System\jnJmAnX.exe
  C:\Windows\System\jnJmAnX.exe
  2⤵
  PID:13024
- C:\Windows\System\WtjhrhU.exe
  C:\Windows\System\WtjhrhU.exe
  2⤵
  PID:13132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4320,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mffqsiqn.yxe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mffqsiqn.yxe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AOMKwPI.exe

Path C:\Windows\System\AOMKwPI.exe
Size 3.1MB
SHA256 c06022f964e507a411b427a91b09ddbd51793431018a4bd8761f4a9b41faa744
MD5 b8a81dcd7c1f6171457b8373c40e8bd5
SHA1 7295847a765a47273c4c582ed42770e5f8be51ca
SHA512 7f53097355d25531249009a8bc832607a2282c6dfb5e56b1b6909d93b5493ea7b570b41c67701f82f94832b7c51272cb320a44db99095ac732acef86a0ca1c03
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:7bBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDCSMgz.exe

Path C:\Windows\System\BDCSMgz.exe
Size 3.1MB
SHA256 e34df6e0b9c4286a076e419f79624733daa1b89a65bbc0270a6a14bd47a8df1e
MD5 7a7551645e14c03e7162deb5fabc486f
SHA1 d540943c156a4ff856c0ae0255cbc270ad87dab0
SHA512 fa2d6ac7f82b0d719afdcd44e803e4c9ee893f3ac61391657fe704b83c24531ab0f65e1150a058f5364affaed276257af6d4167d906d20464d68967d2f6b08ae
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

BtuuSDV.exe

Path C:\Windows\System\BtuuSDV.exe
Size 3.1MB
SHA256 8f7c92d6a40e90574cc6d01ea5523818216aeb383286e39365c9f9795617a3a3
MD5 59bb3e315dc336b01d85bf2023b61f2c
SHA1 48e1e097e16ac7f23146e908e7da4455f14680cb
SHA512 979822b91020dfe830e35bf026cfeaf3ebf3a6f26f568be241e056c866922711b3cea2b0ede09ded3c3fa18b22f8cf29301fa9603de81be695d93670f91a8f7a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CJgOmSO.exe

Path C:\Windows\System\CJgOmSO.exe
Size 3.1MB
SHA256 b4103028ac329718c2f914bc10c11526a27e3bb567fc536c3bfdc8852c0a613f
MD5 10df37a5c05c8bcffb364d370093e309
SHA1 16d27f16be2551b7690acfbdc2dc57ca3992f0e0
SHA512 7df3684e36a616c8c853b108e388d12da03f9706bdaff8a87cfe1faa8b58a53fd710ef7eacf586fad26d4ab88de15893240a378f3821d8807bcd05569d8d2314
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CuMaibP.exe

Path C:\Windows\System\CuMaibP.exe
Size 3.1MB
SHA256 54eb4faaed031a112f0b86a42f133c6817d83d8b0eef8229d384582736fe4500
MD5 b60a3a40021a55d71b41eb17c3afef4a
SHA1 1b9f5066d53d1e6e5fe427fd3715a6cf39cb752c
SHA512 be0577b62a0e726386d6c457a0cababbee2a57231de13581063e5271c7b880a22561b08199aa2b2b3f3dd0248558a7864ba419e7e5209fc87189b42166049883
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:7bBeSFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBWTZEc.exe

Path C:\Windows\System\EBWTZEc.exe
Size 3.1MB
SHA256 6bc3806f1896948e603e2867e105ac452d6d602511e9a7533a91c6f04b2e6760
MD5 74b28a446244e98c6bb15a992be9e179
SHA1 6944db819093721dc7824211cd33536138657bd4
SHA512 4a577acfff8e7547aafaa67a3f870526f37b473ef0dc4bc4e257f04173871887e4dca0e80d43cd0a62f084acb9290a43b60d0f8f09f2cfa7f3a23a82b0994c35
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:7bBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

FWKobSX.exe

Path C:\Windows\System\FWKobSX.exe
Size 3.1MB
SHA256 37e6a113d8ea330ec351476cfc05c652036dcf3610f569b45e7c7620d49283da
MD5 27168c7cf8379a22ca3f7e796f8f2f17
SHA1 337c4e9364aef3e6698227e7ba3ead75b8da87c1
SHA512 f64420145b7e117750fed8de512fadecf6b58130df3bfd41f449f2d934beb793b215df543510a3c3541b8a0e2265500fdb4af1998d2482478f736ecfe61a11be
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFk7
MD5 SHA1 SHA512 SSDEEP

Submit Download

IPHAMSR.exe

Path C:\Windows\System\IPHAMSR.exe
Size 3.1MB
SHA256 024f9950e254040183b4fc9bf7508a583115d27aa3dc18e39300cf15749f8272
MD5 b2f30354ee0840b32081492e79668172
SHA1 c13440fa13308bd8593e4addf8d8ac27f6faa3d1
SHA512 d2580c062b9be70c1e67bd99f9370e7e136f8e0f6e9d660100af459be9f82830adff09e76f01663e0996b429053349a927ecb019149b24e7c049adb621e1158e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

IjiiuuB.exe

Path C:\Windows\System\IjiiuuB.exe
Size 3.1MB
SHA256 8ea9e99355d37c6666c00ad26a5e78d3c361632102d704bb1f21c4d7aab6b1c8
MD5 445aa3e77cfba724cb44440636b711ae
SHA1 495dd11bd65d0dfa04b83e5a3c581d086b3d44a0
SHA512 5f14b2d88c302f2067f1d6139b5035e6231c4e14458829b84c565d8de86dd906b041fb05dab48af227a6e589e1cea751397c449624248976be9579d2fb8c986a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jhavxij.exe

Path C:\Windows\System\Jhavxij.exe
Size 3.1MB
SHA256 bfedacbcd51cd5117c9df59a4e525ad3059c2bfa0eea26e6029243ea98afcfe8
MD5 acbe137d7d1e370249ca07661ee5b78c
SHA1 e600ee283027d499264f2f9d59f6af5a6d58fe1a
SHA512 c6d40efc7e4649a149bccb8060ff6498faa1f3b08db4cc997fb557ff16030457b845cbacc48f3ca623129a70c7111436b2e12d929e5963936ff3da6410f4b17f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

KBtqjVb.exe

Path C:\Windows\System\KBtqjVb.exe
Size 3.1MB
SHA256 018c5c685a37b818fa65f6ba0a512ecfded3dd51328104a3a2375e6a63c5d8e8
MD5 04c33a5be7fbd8d1ebef3ece84000cb1
SHA1 938dba0a34feb8d30f23c7b5753e5b43af899f6c
SHA512 1e33b6c041765a848abf2f65cc6e193c75098c3ee81964a1929944a69cd83a29f99f52e9e0e50214bdc79ba96de58a6d99c2c615d34145cf34a5ac528082ee21
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWP:7bBeSFkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMqBwew.exe

Path C:\Windows\System\KMqBwew.exe
Size 3.1MB
SHA256 048ec9655c3f1ac06752127d94666da8e151fae467c4c3ea9cd50725b44b3d27
MD5 730d8f5ce33d2f1eb7c64f6257223bb9
SHA1 ce8b6f1311343e676b8854063a090993c48556c1
SHA512 1a175cc718499e59de76bcac365b5ccd434e89b218da70855e93ef7790d00da00ce923d45dc32faaad1ea8acaa02520ada4fdd1b8164c95518f694b91e6fe509
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

LmsPwtQ.exe

Path C:\Windows\System\LmsPwtQ.exe
Size 3.1MB
SHA256 1dd10cba274cd6c0d65beb051af7ad2bae9bf2e1977be6648cd7b11de4f4afd8
MD5 1d6264c69d5d84f6fab2c81991c55154
SHA1 335ab52490e256f8a631618ed8bfdffc1f1ef9fd
SHA512 ba974a809ed2365c39377326f7a09e28d6887714205ba9d10855e1852fe4f2d56de9634d39e756476f8f5d0cebdca3cc0633e509ac5437428c41e6ef31028a9a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

LsDQWfi.exe

Path C:\Windows\System\LsDQWfi.exe
Size 3.1MB
SHA256 ff1d60747381b4d41bf8c9ec37d52d997f080f7f04efcfcb0986fa12db908336
MD5 025bab2f7d9cd5f402328f0a3c1c817c
SHA1 48f34bfb4d70be35a6d8f344b6ad4ea05652f018
SHA512 d266a0a59602aeb366264feb1595be7ce2c4f9d5bb639da67510d0c507f88aa994d36363787e8e0bfaf40fff44cd9dcc3c05567c0d722f9101e4a5100e5c4b81
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:7bBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

MQDjDWh.exe

Path C:\Windows\System\MQDjDWh.exe
Size 3.1MB
SHA256 e3340ea43f8d38a8344782685709cb4c1cc994109d2312e51a346ee3b5ad3228
MD5 87b9748426466b6b605fd54cd0e0b581
SHA1 3a3f5a9eba9a0ef2bec96aceeca7aae11c1bda18
SHA512 fca4617e43cab519e4a5c2b6167f24713a72fc18468812350c2d38a4798e032b924de8ba5c7fee6fc670c41c233f8538454e11a30d677368d57ecbd5fc203521
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

MjyeSDt.exe

Path C:\Windows\System\MjyeSDt.exe
Size 3.1MB
SHA256 8164ffe6811299a57237d05248852d0707fd6bfc54fd7448259c9c101e51a713
MD5 62f97c69c8674e958cf6f12d6b81a55d
SHA1 b4437297560f10bbffb029671b59410bb656a8be
SHA512 3a3cd064f5f9b2cb0035887cf4ce652328154652e4b6afc4d84ba226c1a46617d270e905075c05d196ebea89e7e945902a3503630b55838b6343d9669fa7bd37
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:7bBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyvMXBU.exe

Path C:\Windows\System\MyvMXBU.exe
Size 3.1MB
SHA256 fb8bc190dc9d783497276bb8256c3de51dacd992b996343087ec788595bb6d17
MD5 49761bba627818a0469ea4efde7463d5
SHA1 6a9193135f88e1bb598f37606db2f94fb5281d3d
SHA512 79c48952a9d52bf1334a3449185efcaea399c8ef32ef8f905275420d3de8b9ab5889ef5f3a0311bada5394698942b0f0e0dfa49be5952c377278f6b2315be12c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:7bBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

QVkbmBj.exe

Path C:\Windows\System\QVkbmBj.exe
Size 3.1MB
SHA256 bc7fbeb09c6c78aebb60402acea7311a99c1367cf61b821af5d26700a363d4bd
MD5 c2d35791e316a96ccab2f2752ba79c3d
SHA1 0df6e85926d4321eaf297b2be3dd85c8eb8d5ec8
SHA512 18f62cb6ef5042d988d1fa41a752737506b54db614916b6211a6dc3d4fb351461b2e45297a54465cb7f4cc5183019a4d524d43d7e6e3bc71ddeaf3ef7f29fb64
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:7bBeSFkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QmeYAqz.exe

Path C:\Windows\System\QmeYAqz.exe
Size 3.1MB
SHA256 1224b1ea437491247d6f88a13838cba4cc5255850d19d4ebb2cf9c68867f53b8
MD5 54edb43693d68c7c21156b3d430bfc2a
SHA1 87b4fe77d480892c0ff03d11f79c6578b6ba765e
SHA512 370cfd7cb286a8a4cf3233b39da749337cfdba953f68aaef301c07b2d7f49cfaaeb760263369edf95b40e723672ce3329a4f9c5b7095c032185bd083fd28a397
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SXuRKQj.exe

Path C:\Windows\System\SXuRKQj.exe
Size 3.1MB
SHA256 f7a16e258ba1ff3232d5e1d04f7dfd20e3be7265cfbd49527db57664b4d15530
MD5 acfed88afb03326ed15f3ee098898aac
SHA1 643dc97271a78c3c9dd17aa81404fbd54cc30ae0
SHA512 36841d90a7291f3318d45ec50e4998d9565fc6ccacdbd1d6b1a7b55b49b900d0aa1005023e69e8acfd6dcb86178b82af25619ee1e17c53acd34328d420c49293
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:7bBeSFkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

TiyPMKv.exe

Path C:\Windows\System\TiyPMKv.exe
Size 3.1MB
SHA256 84bee75572c96875fbe5b7905038cb70e35302493a5bb94e842f2599ae2a50e7
MD5 0458acdafed2845a81954c88729d6bb2
SHA1 a09aa1ed10d0c7bcae9a5308103426db1d571cb1
SHA512 27d7dc378c74049cc0b8717d57887128a11f4f345088946af5b38c36838305ec4fd67d481cb3d124f1c054b117a104d148c9f0df6edc05b117bf96fed02f9d52
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:7bBeSFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VObCYXk.exe

Path C:\Windows\System\VObCYXk.exe
Size 3.1MB
SHA256 308dee7c5a2f522aca5d98c4c4e79bc988d4e2c8c358fa9745ae423b2670f14e
MD5 55124d51382582fdfc7d0436ef78c241
SHA1 c1bf5aad897ee6a6ef0214915e4786effe17d72a
SHA512 768435598512d19c25f42498294164372aefbefbe8a7505303bf73b7486e553c5de802d417a65af8b4e562f2558f933c04b12f5dbdf8b54d246fb06b73e8ff94
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZMmdYJq.exe

Path C:\Windows\System\ZMmdYJq.exe
Size 3.1MB
SHA256 2136d0fe90433fb6be35221f909e080e1adafc1a671287b18a8725b0505adb89
MD5 1d8fedf27cf1575a79c8e87ad3b3b408
SHA1 c3235d8f3cb1df029f3f1eacecd4475bacda9695
SHA512 0d2e026222cccbc29d23d5e37abfae29c5e75e51ca2d94bf6aa5dbddd9a57822437419916be7a6cf649ff20e7d70a3bb78f6f553a10958283896b435b9b7b8d1
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZlejIpg.exe

Path C:\Windows\System\ZlejIpg.exe
Size 3.1MB
SHA256 365a45848be022310f1c1229dc159b71704c60f53cf58aa95d92653da5febe22
MD5 ccb407c8ddc0329824c71e2c376396dd
SHA1 be453a55ea583094456cd354dca7d6a19f81bc94
SHA512 71b90ac2f93e1b7a2b32055ef659eb90b42efe97f47f615afd9c379f8d36cb933433c4b7d1a72431d6b4e3a4a4204c2d08ed7b204d68ce3209e13716227a6b7f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

aYsraEq.exe

Path C:\Windows\System\aYsraEq.exe
Size 3.1MB
SHA256 7a326c1238410983a1bf9590f9ce104655fac6688030652c52053fc5e4deaf62
MD5 86b978a060f744c5e2d2bb803b88f4de
SHA1 f604f59214f9bc35a664c86afa7a63aea14744ac
SHA512 4e173ba7085652edcacf50ab5fed76bf154cc26ef91ad138674541b4c7487718aa0735d0dde8f8f745839f3432b73d2972b532be8fd71d09d1fef071a90d4d41
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW6:7bBeSFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

bQmTixe.exe

Path C:\Windows\System\bQmTixe.exe
Size 3.1MB
SHA256 cc745b0939f84cda2ec55ed8e80f3701a44e64a09dfc0438c052c720397dee50
MD5 cc1122f559107482a8a578bb21b984fe
SHA1 d7434e8a3887cc538f84453369db63a3e3520051
SHA512 b373511f742959b1b1dbc07060e4f59155698571bd73499c4e3bf742f008ffe49637e245bf7d5cb53fb97cdbf73029e7d1eb05659c496044d0c56e3de58affb3
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

dHXTMMF.exe

Path C:\Windows\System\dHXTMMF.exe
Size 3.1MB
SHA256 5c4165edb6db459c4375aee6b55616f72a392873a928f0fb339ef49969f50e2a
MD5 025b72bfb53099d2009987764cff3c49
SHA1 201aea5452630421e50514f68ea178fb3d22c706
SHA512 381c7f968d79fa907e2bf161845f8e133a8dbbc9b48b853dfcce5e80a7324a726f18a64dcaa107616aa4008f87e8f90cf007235fcc10e5e47a01f0cea448db8a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW8:7bBeSFkg
MD5 SHA1 SHA512 SSDEEP

Submit Download

eEhiLiO.exe

Path C:\Windows\System\eEhiLiO.exe
Size 3.1MB
SHA256 dd6ad74a7cce9a7afef41c2b21e121767594d50942a56486ba974279ede74571
MD5 f8537ace0a7960fc5aecb4772a1c89c3
SHA1 3893beb9c806d4f57a45a7cfd55a61dc8e7869a4
SHA512 fbb33a3220a9549b7a7b99e925990d5554fda2c308e21bb4678b263505568f8dd2d6dc3939fe9868d3be36d38920d2ad1767a42584bcc3434d332cd3bc80672f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

eqdTVBN.exe

Path C:\Windows\System\eqdTVBN.exe
Size 3.1MB
SHA256 27ce2a2193ab48b15eb35a598d437791fe9965f9c27dd9bbdacd459f61c97d3f
MD5 2a688953d7cd8315398ff8c643f641a1
SHA1 f8c3fd992b28c64e2c32d962a164eeb164c267a5
SHA512 5fe93d710eb8f1eba223cce12448b7dbe9f9033628b6705a4e470fb8208c485166f93da125ed1e3143d1341b679756669929e66d06643fcacc51a6299f7ec105
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jotnDZB.exe

Path C:\Windows\System\jotnDZB.exe
Size 3.1MB
SHA256 e6980de7c4f0dc087e1e3bd0ef812ca5fbc06fa964ddb08754f7cbf99d7af63f
MD5 96fd562316f14d80040c9f442dea5771
SHA1 ed3eb04e08ce26c0a1ac8ead8e49d62e618803d3
SHA512 493c26505d63f2b7b6dc1c4cce9a595d76e7f8eeda81f76e4f27c078b74793a54ecbc21b02d597d662cbaaed45070e8a3d843de3b6b5596ef148c1d442c5e33d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:7bBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

pRmhUhA.exe

Path C:\Windows\System\pRmhUhA.exe
Size 3.1MB
SHA256 2302b4a863799240ea828738f1353fb011baea84a7da101ef99957618f359388
MD5 d2434879a87e93c8808f03c3f925bb6b
SHA1 d2508d015a646332a06c9dd4437721d1ea895e2a
SHA512 e8ab45a9d49b592b1a96b8b923c954cacfa7e4497915cdf922073ba43a56d302abdf1a24c944a8bf785fa568759f0a254feb43060530ae409e73d4f2d76b6e0d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

rCubDLf.exe

Path C:\Windows\System\rCubDLf.exe
Size 3.1MB
SHA256 534a43dad2fe7a515446fbe80b7aa2566d1118b2cf778d13493c56e5d4c38295
MD5 6d44b4d7853f4e9da921f71b68de1cef
SHA1 7b6bd42941e571984f61b12ec7aaf1bc05440f1c
SHA512 932696a3a82d59fc185fa34ec3028f68fe6d5c4f4510ff55106447a90d383bca8eb9fd9d4b5dfc91b16050b80553882ba67a792f954e9f190e2ba27a7f7f679a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXJpwVZ.exe

Path C:\Windows\System\sXJpwVZ.exe
Size 8B
SHA256 7ea668b9c8c6ac714dde44eac6df129523f5401069ecb8212b5b927f56886729
MD5 47601af1d4990364ad4a698e9063bbc9
SHA1 c61c4d4d2e5fe60c9b5cc4675332eaa95c109b04
SHA512 55e9aa7022904421be1edc20b9bef8d4b50a75c7444195b1d94a81f53d96c3f3a89bc8bd1d3a3fe2af01db39e7cc0d7f41b5a3353df47ad2111691534bc1fd12
MD5 SHA1 SHA512

Submit Download

vBCjnhl.exe

Path C:\Windows\System\vBCjnhl.exe
Size 3.1MB
SHA256 f53a6f911ac9c7899877801fc3c134d5c9137aff55562ae1785444db23e9ae74
MD5 9d6c3da8f5806fcb6dce32e60e04f296
SHA1 f3ae4fde919f8e4172c339104f0f143984461f84
SHA512 325a48bd18968f3b2f408bf5789a79da98b3a1e67f9bafbe7b135df2419053124b8b16c46dd4e2db54b5329ee25c7243b4ee3d7119f82c5515f3378d1bfb9def
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:7bBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

vCdFsmC.exe

Path C:\Windows\System\vCdFsmC.exe
Size 3.1MB
SHA256 bb9b867ebf01d09829e93761bc62330b0fe9fe52a992e3af86e555c21d76fdcf
MD5 e2d00960938470091bd07247e1292a49
SHA1 0ec33495167e8361983411df49693fc872a8a4bf
SHA512 43bc7fb92c79bb30a4bc53b6b65a4a98a9e3b56e15953a7f144d1c15eb672007addcb4c6c29e71dade4241a28b4e8042477a529ed41f22b56cb0d964f75167d7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

wwceKZM.exe

Path C:\Windows\System\wwceKZM.exe
Size 3.1MB
SHA256 08b585ea61960f5db4f49c0656b38b37b6a5c0aa52444f9c5f2b407b4645d447
MD5 4748ce0ee5e6b1c822ab852f0fe224e4
SHA1 3a4a32cc772c2cda1f6911ef1f4a67c2356ed4f1
SHA512 d56b4a380307d0aca684a9c905fdbb40599ff613da8eb46c5c57e4e25db8ac60c8bb1944409adf33b89a8559433ba243fd35bf30ff385e92575056b1a4612593
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:7bBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

xcnTpXH.exe

Path C:\Windows\System\xcnTpXH.exe
Size 3.1MB
SHA256 942039ace75c7e2651be4f7d5df9e7e844b87ccfd6a84e2efa5e8974e504b75a
MD5 1a12c6dfadf1ecfbd79396eeb8869a47
SHA1 0cd2cf2d7cc2e6637b9d73ed10f08b5958f075e3
SHA512 e7c8fc1a82e1739c999f3bd99bc6f36563241ffa78b6978e223b65f39c6bcef6d5043ddc723f700eca0ee1abdea4f74c7ce32ed4b1beed0d8d5a9bb5ea0f5bc9
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-1962-0x00007FF6B5890000-0x00007FF6B5C86000-memory.dmp

Download

memory/436-185-0x00007FF6B5890000-0x00007FF6B5C86000-memory.dmp

Download

memory/448-11-0x00007FF842863000-0x00007FF842865000-memory.dmp

Download

memory/448-40-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/448-105-0x000001417A9E0000-0x000001417AA02000-memory.dmp

Download

memory/448-81-0x00007FF842860000-0x00007FF843321000-memory.dmp

Download

memory/1060-176-0x00007FF6BBF80000-0x00007FF6BC376000-memory.dmp

Download

memory/1060-1953-0x00007FF6BBF80000-0x00007FF6BC376000-memory.dmp

Download

memory/1248-1968-0x00007FF729B60000-0x00007FF729F56000-memory.dmp

Download

memory/1248-188-0x00007FF729B60000-0x00007FF729F56000-memory.dmp

Download

memory/1628-1963-0x00007FF7DF500000-0x00007FF7DF8F6000-memory.dmp

Download

memory/1628-190-0x00007FF7DF500000-0x00007FF7DF8F6000-memory.dmp

Download

memory/1680-1948-0x00007FF7DE3F0000-0x00007FF7DE7E6000-memory.dmp

Download

memory/1680-191-0x00007FF7DE3F0000-0x00007FF7DE7E6000-memory.dmp

Download

memory/1708-195-0x00007FF61E800000-0x00007FF61EBF6000-memory.dmp

Download

memory/1708-1969-0x00007FF61E800000-0x00007FF61EBF6000-memory.dmp

Download

memory/1732-187-0x00007FF6A0510000-0x00007FF6A0906000-memory.dmp

Download

memory/1732-1966-0x00007FF6A0510000-0x00007FF6A0906000-memory.dmp

Download

memory/2104-1964-0x00007FF73AFE0000-0x00007FF73B3D6000-memory.dmp

Download

memory/2104-189-0x00007FF73AFE0000-0x00007FF73B3D6000-memory.dmp

Download

memory/2308-1960-0x00007FF68A7C0000-0x00007FF68ABB6000-memory.dmp

Download

memory/2308-186-0x00007FF68A7C0000-0x00007FF68ABB6000-memory.dmp

Download

memory/2860-1967-0x00007FF768C80000-0x00007FF769076000-memory.dmp

Download

memory/2860-193-0x00007FF768C80000-0x00007FF769076000-memory.dmp

Download

memory/3212-133-0x00007FF611A60000-0x00007FF611E56000-memory.dmp

Download

memory/3212-1950-0x00007FF611A60000-0x00007FF611E56000-memory.dmp

Download

memory/3288-1956-0x00007FF6F7480000-0x00007FF6F7876000-memory.dmp

Download

memory/3288-192-0x00007FF6F7480000-0x00007FF6F7876000-memory.dmp

Download

memory/3460-1-0x000001BFBE1B0000-0x000001BFBE1C0000-memory.dmp

Download

memory/3460-0-0x00007FF6ED590000-0x00007FF6ED986000-memory.dmp

Download

memory/3552-1951-0x00007FF6CAED0000-0x00007FF6CB2C6000-memory.dmp

Download

memory/3552-121-0x00007FF6CAED0000-0x00007FF6CB2C6000-memory.dmp

Download

memory/3892-1961-0x00007FF6AF6B0000-0x00007FF6AFAA6000-memory.dmp

Download

memory/3892-184-0x00007FF6AF6B0000-0x00007FF6AFAA6000-memory.dmp

Download

memory/3896-1954-0x00007FF7E1460000-0x00007FF7E1856000-memory.dmp

Download

memory/3896-181-0x00007FF7E1460000-0x00007FF7E1856000-memory.dmp

Download

memory/4004-6-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp

Download

memory/4004-1946-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp

Download

memory/4004-1947-0x00007FF62F000000-0x00007FF62F3F6000-memory.dmp

Download

memory/4044-1949-0x00007FF6DAEC0000-0x00007FF6DB2B6000-memory.dmp

Download

memory/4044-109-0x00007FF6DAEC0000-0x00007FF6DB2B6000-memory.dmp

Download

memory/4108-146-0x00007FF62F270000-0x00007FF62F666000-memory.dmp

Download

memory/4108-1958-0x00007FF62F270000-0x00007FF62F666000-memory.dmp

Download

memory/4172-1957-0x00007FF6277A0000-0x00007FF627B96000-memory.dmp

Download

memory/4172-177-0x00007FF6277A0000-0x00007FF627B96000-memory.dmp

Download

memory/4244-196-0x00007FF7CCF70000-0x00007FF7CD366000-memory.dmp

Download

memory/4244-1970-0x00007FF7CCF70000-0x00007FF7CD366000-memory.dmp

Download

memory/4320-145-0x00007FF76BA00000-0x00007FF76BDF6000-memory.dmp

Download

memory/4320-1952-0x00007FF76BA00000-0x00007FF76BDF6000-memory.dmp

Download

memory/4380-1965-0x00007FF649770000-0x00007FF649B66000-memory.dmp

Download

memory/4380-194-0x00007FF649770000-0x00007FF649B66000-memory.dmp

Download

memory/4820-183-0x00007FF7FE060000-0x00007FF7FE456000-memory.dmp

Download

memory/4820-1959-0x00007FF7FE060000-0x00007FF7FE456000-memory.dmp

Download

memory/5016-182-0x00007FF712170000-0x00007FF712566000-memory.dmp

Download

memory/5016-1955-0x00007FF712170000-0x00007FF712566000-memory.dmp

Download