xmrig | b5744ae61d2c66308b2c133c00dd7f202540a9aba3fbe8a3474a98cfca32fd09

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
Size 3.0MB
Sample240613-db3vrssakc
SHA256 b5744ae61d2c66308b2c133c00dd7f202540a9aba3fbe8a3474a98cfca32fd09
MD5 588afd8716e2081f16e9a31344261510
SHA1 a1f1eb98cb5e16e3ac4ebb836f85cf4c8a27b6aa
SHA512 cb8af078109efa0abb316a6510c4bcd5640204b48503346179244cbc0214c6adb99ada5c1029c4a3147fd9f3875d87645028aff9f4202626bc8f423c901cdc07
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1640-0-0x00007FF7DD970000-0x00007FF7DDD66000-memory.dmp	xmrig
behavioral2/files/0x0005000000022975-5.dat	xmrig
behavioral2/files/0x000800000002330f-10.dat	xmrig
behavioral2/files/0x000a0000000232fb-11.dat	xmrig
behavioral2/memory/2280-14-0x00007FF654D60000-0x00007FF655156000-memory.dmp	xmrig
behavioral2/files/0x0008000000023310-23.dat	xmrig
behavioral2/memory/4752-26-0x00007FF7FFBD0000-0x00007FF7FFFC6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023311-29.dat	xmrig
behavioral2/files/0x0008000000023313-38.dat	xmrig
behavioral2/files/0x0008000000023316-45.dat	xmrig
behavioral2/files/0x0008000000023314-41.dat	xmrig
behavioral2/memory/4832-64-0x00007FF729200000-0x00007FF7295F6000-memory.dmp	xmrig
behavioral2/files/0x000800000002331d-75.dat	xmrig
behavioral2/files/0x00080000000235e7-87.dat	xmrig
behavioral2/files/0x00070000000235ea-101.dat	xmrig
behavioral2/files/0x00070000000235eb-108.dat	xmrig
behavioral2/memory/4868-111-0x00007FF7E3CD0000-0x00007FF7E40C6000-memory.dmp	xmrig
behavioral2/memory/4704-116-0x00007FF76BFA0000-0x00007FF76C396000-memory.dmp	xmrig
behavioral2/memory/4368-118-0x00007FF627160000-0x00007FF627556000-memory.dmp	xmrig
behavioral2/memory/5092-119-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp	xmrig
behavioral2/memory/2100-122-0x00007FF7C5E00000-0x00007FF7C61F6000-memory.dmp	xmrig
behavioral2/memory/4700-123-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp	xmrig
behavioral2/memory/4908-121-0x00007FF7C2270000-0x00007FF7C2666000-memory.dmp	xmrig
behavioral2/memory/4804-120-0x00007FF74DB00000-0x00007FF74DEF6000-memory.dmp	xmrig
behavioral2/memory/1780-117-0x00007FF6A6780000-0x00007FF6A6B76000-memory.dmp	xmrig
behavioral2/memory/1448-115-0x00007FF6DCF40000-0x00007FF6DD336000-memory.dmp	xmrig
behavioral2/memory/1268-112-0x00007FF7C1270000-0x00007FF7C1666000-memory.dmp	xmrig
behavioral2/memory/1644-110-0x00007FF661590000-0x00007FF661986000-memory.dmp	xmrig
behavioral2/memory/4348-109-0x00007FF6CDFA0000-0x00007FF6CE396000-memory.dmp	xmrig
behavioral2/files/0x000a000000023318-97.dat	xmrig
behavioral2/files/0x00070000000235e9-96.dat	xmrig
behavioral2/files/0x00070000000235e8-92.dat	xmrig
behavioral2/files/0x000900000002331a-81.dat	xmrig
behavioral2/files/0x0008000000023317-77.dat	xmrig
behavioral2/files/0x000800000002331c-70.dat	xmrig
behavioral2/memory/2276-33-0x00007FF76AE20000-0x00007FF76B216000-memory.dmp	xmrig
behavioral2/memory/772-8-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ed-133.dat	xmrig
behavioral2/files/0x00070000000235ef-143.dat	xmrig
behavioral2/memory/3756-151-0x00007FF67A570000-0x00007FF67A966000-memory.dmp	xmrig
behavioral2/memory/3976-161-0x00007FF764700000-0x00007FF764AF6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235f3-168.dat	xmrig
behavioral2/files/0x00070000000235f2-166.dat	xmrig
behavioral2/files/0x00070000000235f1-163.dat	xmrig
behavioral2/memory/2616-158-0x00007FF625710000-0x00007FF625B06000-memory.dmp	xmrig
behavioral2/files/0x00070000000235f0-153.dat	xmrig
behavioral2/memory/4216-145-0x00007FF61D690000-0x00007FF61DA86000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ee-147.dat	xmrig
behavioral2/memory/4436-140-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ec-135.dat	xmrig
behavioral2/memory/3964-130-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp	xmrig
behavioral2/files/0x00070000000235f4-172.dat	xmrig
behavioral2/files/0x00070000000235f6-178.dat	xmrig
behavioral2/files/0x00070000000235f9-193.dat	xmrig
behavioral2/files/0x00070000000235fa-197.dat	xmrig
behavioral2/files/0x00070000000235f8-191.dat	xmrig
behavioral2/files/0x00070000000235f7-183.dat	xmrig
behavioral2/memory/1640-418-0x00007FF7DD970000-0x00007FF7DDD66000-memory.dmp	xmrig
behavioral2/memory/772-662-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp	xmrig
behavioral2/memory/2280-942-0x00007FF654D60000-0x00007FF655156000-memory.dmp	xmrig
behavioral2/memory/3964-1785-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp	xmrig
behavioral2/memory/4436-1998-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp	xmrig
behavioral2/memory/3756-1999-0x00007FF67A570000-0x00007FF67A966000-memory.dmp	xmrig
behavioral2/memory/3976-2000-0x00007FF764700000-0x00007FF764AF6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3968	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
772	CnGSugQ.exe
2280	AMrAHVH.exe
4752	UsgJZAU.exe
2276	KOiylQN.exe
4908	gmptRSV.exe
2100	UGMNAWX.exe
4832	adaofPE.exe
4348	xBaFqOG.exe
4700	hQwoXvU.exe
1644	OcjtUpM.exe
4868	wRMSBhe.exe
1268	YiovZBw.exe
1448	UeKkWWg.exe
4704	wfWnODh.exe
1780	garhfzC.exe
4368	TBiYKlq.exe
5092	OAXOoIK.exe
4804	pFHpqSA.exe
3964	aXURmdt.exe
4216	itmrirp.exe
4436	QYtkHSW.exe
2616	VxjNpLl.exe
3756	QuZstMW.exe
3976	mmXoeFn.exe
4332	tORejMy.exe
5112	LYIATsE.exe
1492	StcBCdY.exe
2376	vqoqUKg.exe
4140	mQPheEp.exe
3640	UUrufxu.exe
4684	dDTMtbo.exe
4692	SwJnvrG.exe
3212	hLMcKyC.exe
1388	bPbuOTh.exe
864	DaOwvga.exe
4328	rAgtnPq.exe
4428	TcEpWtd.exe
3296	rlwiKMQ.exe
1648	pAzgyyf.exe
5064	YJwHQGK.exe
2972	NdBKHhV.exe
1484	OaSKLUP.exe
1984	eRKcETr.exe
628	cIOuQfO.exe
4324	VyEqkYH.exe
3152	gfezmsN.exe
884	uDGuuOL.exe
4576	cIMxAYB.exe
2888	mmQbBsC.exe
2548	vCKoYWA.exe
2256	MAVQjMp.exe
3928	kxYuAqw.exe
4860	wFRnrJj.exe
5080	hCHUlzf.exe
3236	cmarbHL.exe
5144	LNMnzbh.exe
5176	EMAuVXq.exe
5196	osaNNXT.exe
5224	eEQWsiP.exe
5256	zCAoTXn.exe
5280	drQVwwu.exe
5308	ZxegNDh.exe
5336	zqlPVAj.exe
5364	EfcrYeu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1640-0-0x00007FF7DD970000-0x00007FF7DDD66000-memory.dmp	upx
behavioral2/files/0x0005000000022975-5.dat	upx
behavioral2/files/0x000800000002330f-10.dat	upx
behavioral2/files/0x000a0000000232fb-11.dat	upx
behavioral2/memory/2280-14-0x00007FF654D60000-0x00007FF655156000-memory.dmp	upx
behavioral2/files/0x0008000000023310-23.dat	upx
behavioral2/memory/4752-26-0x00007FF7FFBD0000-0x00007FF7FFFC6000-memory.dmp	upx
behavioral2/files/0x0008000000023311-29.dat	upx
behavioral2/files/0x0008000000023313-38.dat	upx
behavioral2/files/0x0008000000023316-45.dat	upx
behavioral2/files/0x0008000000023314-41.dat	upx
behavioral2/memory/4832-64-0x00007FF729200000-0x00007FF7295F6000-memory.dmp	upx
behavioral2/files/0x000800000002331d-75.dat	upx
behavioral2/files/0x00080000000235e7-87.dat	upx
behavioral2/files/0x00070000000235ea-101.dat	upx
behavioral2/files/0x00070000000235eb-108.dat	upx
behavioral2/memory/4868-111-0x00007FF7E3CD0000-0x00007FF7E40C6000-memory.dmp	upx
behavioral2/memory/4704-116-0x00007FF76BFA0000-0x00007FF76C396000-memory.dmp	upx
behavioral2/memory/4368-118-0x00007FF627160000-0x00007FF627556000-memory.dmp	upx
behavioral2/memory/5092-119-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp	upx
behavioral2/memory/2100-122-0x00007FF7C5E00000-0x00007FF7C61F6000-memory.dmp	upx
behavioral2/memory/4700-123-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp	upx
behavioral2/memory/4908-121-0x00007FF7C2270000-0x00007FF7C2666000-memory.dmp	upx
behavioral2/memory/4804-120-0x00007FF74DB00000-0x00007FF74DEF6000-memory.dmp	upx
behavioral2/memory/1780-117-0x00007FF6A6780000-0x00007FF6A6B76000-memory.dmp	upx
behavioral2/memory/1448-115-0x00007FF6DCF40000-0x00007FF6DD336000-memory.dmp	upx
behavioral2/memory/1268-112-0x00007FF7C1270000-0x00007FF7C1666000-memory.dmp	upx
behavioral2/memory/1644-110-0x00007FF661590000-0x00007FF661986000-memory.dmp	upx
behavioral2/memory/4348-109-0x00007FF6CDFA0000-0x00007FF6CE396000-memory.dmp	upx
behavioral2/files/0x000a000000023318-97.dat	upx
behavioral2/files/0x00070000000235e9-96.dat	upx
behavioral2/files/0x00070000000235e8-92.dat	upx
behavioral2/files/0x000900000002331a-81.dat	upx
behavioral2/files/0x0008000000023317-77.dat	upx
behavioral2/files/0x000800000002331c-70.dat	upx
behavioral2/memory/2276-33-0x00007FF76AE20000-0x00007FF76B216000-memory.dmp	upx
behavioral2/memory/772-8-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp	upx
behavioral2/files/0x00070000000235ed-133.dat	upx
behavioral2/files/0x00070000000235ef-143.dat	upx
behavioral2/memory/3756-151-0x00007FF67A570000-0x00007FF67A966000-memory.dmp	upx
behavioral2/memory/3976-161-0x00007FF764700000-0x00007FF764AF6000-memory.dmp	upx
behavioral2/files/0x00070000000235f3-168.dat	upx
behavioral2/files/0x00070000000235f2-166.dat	upx
behavioral2/files/0x00070000000235f1-163.dat	upx
behavioral2/memory/2616-158-0x00007FF625710000-0x00007FF625B06000-memory.dmp	upx
behavioral2/files/0x00070000000235f0-153.dat	upx
behavioral2/memory/4216-145-0x00007FF61D690000-0x00007FF61DA86000-memory.dmp	upx
behavioral2/files/0x00070000000235ee-147.dat	upx
behavioral2/memory/4436-140-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp	upx
behavioral2/files/0x00070000000235ec-135.dat	upx
behavioral2/memory/3964-130-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp	upx
behavioral2/files/0x00070000000235f4-172.dat	upx
behavioral2/files/0x00070000000235f6-178.dat	upx
behavioral2/files/0x00070000000235f9-193.dat	upx
behavioral2/files/0x00070000000235fa-197.dat	upx
behavioral2/files/0x00070000000235f8-191.dat	upx
behavioral2/files/0x00070000000235f7-183.dat	upx
behavioral2/memory/1640-418-0x00007FF7DD970000-0x00007FF7DDD66000-memory.dmp	upx
behavioral2/memory/772-662-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp	upx
behavioral2/memory/2280-942-0x00007FF654D60000-0x00007FF655156000-memory.dmp	upx
behavioral2/memory/3964-1785-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp	upx
behavioral2/memory/4436-1998-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp	upx
behavioral2/memory/3756-1999-0x00007FF67A570000-0x00007FF67A966000-memory.dmp	upx
behavioral2/memory/3976-2000-0x00007FF764700000-0x00007FF764AF6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wfWnODh.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\FyWbZfY.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\WivPGHG.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\frfjylX.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\oWOBoPs.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\SEfghWl.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\JmuMRlu.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\klyIhNn.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\qFcRJCJ.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\haHbnhF.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\KEYNwIm.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\MNWUnXV.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\ZxegNDh.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\eViCPYU.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\VKTWHfT.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\LiIVByT.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\FNwfWFc.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\syBAruS.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\qJUncvw.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\XhTfNKi.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\tqmSJEq.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\zvceeaR.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\DRVQUiL.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\WEvCmCp.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\neRbrbV.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\iCTxDFa.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\CnGSugQ.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\EjTTlQC.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\CEvOryj.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\SdWbdSc.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\YWiBCiR.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\VyZPUWt.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\GGnDPxW.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\DaOwvga.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\ClcyqUp.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\sVFDkgR.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\JXPznkt.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\ZiCxleR.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\GxRPtpz.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\GkwsmLR.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\QavQJpZ.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\BZznlhX.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\UuuGLtX.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\NBDpFXd.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\uRiAnyD.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\sWouiRE.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\LudiYXT.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\qNJVqLi.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\mOSiKco.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\hCHUlzf.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\tmNUkhk.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\bMZHOrv.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\wmIalZD.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\fftbbaA.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\ZUwDMkh.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\irLFKXh.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\rlwiKMQ.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\MjnowMF.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\opApwbY.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\BFIxxOV.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\UbdRMzG.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\QyPbTck.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\NdBKHhV.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
File created	C:\Windows\System\JIMEgic.exe	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
Token: SeDebugPrivilege	3968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3968	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	93
PID 1640 wrote to memory of 3968	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	93
PID 1640 wrote to memory of 772	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	94
PID 1640 wrote to memory of 772	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	94
PID 1640 wrote to memory of 2280	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	95
PID 1640 wrote to memory of 2280	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	95
PID 1640 wrote to memory of 4752	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	96
PID 1640 wrote to memory of 4752	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	96
PID 1640 wrote to memory of 2276	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	97
PID 1640 wrote to memory of 2276	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	97
PID 1640 wrote to memory of 4908	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	98
PID 1640 wrote to memory of 4908	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	98
PID 1640 wrote to memory of 2100	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	99
PID 1640 wrote to memory of 2100	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	99
PID 1640 wrote to memory of 4832	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	100
PID 1640 wrote to memory of 4832	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	100
PID 1640 wrote to memory of 4348	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	101
PID 1640 wrote to memory of 4348	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	101
PID 1640 wrote to memory of 4868	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	102
PID 1640 wrote to memory of 4868	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	102
PID 1640 wrote to memory of 4700	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	103
PID 1640 wrote to memory of 4700	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	103
PID 1640 wrote to memory of 1644	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	104
PID 1640 wrote to memory of 1644	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	104
PID 1640 wrote to memory of 1268	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	105
PID 1640 wrote to memory of 1268	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	105
PID 1640 wrote to memory of 1448	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	106
PID 1640 wrote to memory of 1448	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	106
PID 1640 wrote to memory of 4704	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	107
PID 1640 wrote to memory of 4704	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	107
PID 1640 wrote to memory of 1780	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	108
PID 1640 wrote to memory of 1780	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	108
PID 1640 wrote to memory of 4368	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	109
PID 1640 wrote to memory of 4368	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	109
PID 1640 wrote to memory of 5092	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	110
PID 1640 wrote to memory of 5092	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	110
PID 1640 wrote to memory of 4804	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	111
PID 1640 wrote to memory of 4804	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	111
PID 1640 wrote to memory of 3964	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	112
PID 1640 wrote to memory of 3964	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	112
PID 1640 wrote to memory of 4216	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	114
PID 1640 wrote to memory of 4216	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	114
PID 1640 wrote to memory of 4436	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	115
PID 1640 wrote to memory of 4436	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	115
PID 1640 wrote to memory of 2616	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	116
PID 1640 wrote to memory of 2616	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	116
PID 1640 wrote to memory of 3756	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	117
PID 1640 wrote to memory of 3756	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	117
PID 1640 wrote to memory of 3976	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	118
PID 1640 wrote to memory of 3976	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	118
PID 1640 wrote to memory of 4332	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	119
PID 1640 wrote to memory of 4332	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	119
PID 1640 wrote to memory of 5112	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	121
PID 1640 wrote to memory of 5112	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	121
PID 1640 wrote to memory of 1492	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	122
PID 1640 wrote to memory of 1492	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	122
PID 1640 wrote to memory of 2376	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	124
PID 1640 wrote to memory of 2376	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	124
PID 1640 wrote to memory of 4140	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	125
PID 1640 wrote to memory of 4140	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	125
PID 1640 wrote to memory of 3640	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	126
PID 1640 wrote to memory of 3640	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	126
PID 1640 wrote to memory of 4684	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	127
PID 1640 wrote to memory of 4684	1640	588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe	127

C:\Users\Admin\AppData\Local\Temp\588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\588afd8716e2081f16e9a31344261510_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\System\CnGSugQ.exe
  C:\Windows\System\CnGSugQ.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\AMrAHVH.exe
  C:\Windows\System\AMrAHVH.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\UsgJZAU.exe
  C:\Windows\System\UsgJZAU.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\KOiylQN.exe
  C:\Windows\System\KOiylQN.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\gmptRSV.exe
  C:\Windows\System\gmptRSV.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\UGMNAWX.exe
  C:\Windows\System\UGMNAWX.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\adaofPE.exe
  C:\Windows\System\adaofPE.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\xBaFqOG.exe
  C:\Windows\System\xBaFqOG.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\wRMSBhe.exe
  C:\Windows\System\wRMSBhe.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\hQwoXvU.exe
  C:\Windows\System\hQwoXvU.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\OcjtUpM.exe
  C:\Windows\System\OcjtUpM.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\YiovZBw.exe
  C:\Windows\System\YiovZBw.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\UeKkWWg.exe
  C:\Windows\System\UeKkWWg.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\wfWnODh.exe
  C:\Windows\System\wfWnODh.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\garhfzC.exe
  C:\Windows\System\garhfzC.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\TBiYKlq.exe
  C:\Windows\System\TBiYKlq.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\OAXOoIK.exe
  C:\Windows\System\OAXOoIK.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\pFHpqSA.exe
  C:\Windows\System\pFHpqSA.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\aXURmdt.exe
  C:\Windows\System\aXURmdt.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\itmrirp.exe
  C:\Windows\System\itmrirp.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\QYtkHSW.exe
  C:\Windows\System\QYtkHSW.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\VxjNpLl.exe
  C:\Windows\System\VxjNpLl.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\QuZstMW.exe
  C:\Windows\System\QuZstMW.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\mmXoeFn.exe
  C:\Windows\System\mmXoeFn.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\tORejMy.exe
  C:\Windows\System\tORejMy.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\LYIATsE.exe
  C:\Windows\System\LYIATsE.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\StcBCdY.exe
  C:\Windows\System\StcBCdY.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\vqoqUKg.exe
  C:\Windows\System\vqoqUKg.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\mQPheEp.exe
  C:\Windows\System\mQPheEp.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\UUrufxu.exe
  C:\Windows\System\UUrufxu.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\dDTMtbo.exe
  C:\Windows\System\dDTMtbo.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\SwJnvrG.exe
  C:\Windows\System\SwJnvrG.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\hLMcKyC.exe
  C:\Windows\System\hLMcKyC.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\bPbuOTh.exe
  C:\Windows\System\bPbuOTh.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\DaOwvga.exe
  C:\Windows\System\DaOwvga.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\rAgtnPq.exe
  C:\Windows\System\rAgtnPq.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\TcEpWtd.exe
  C:\Windows\System\TcEpWtd.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\rlwiKMQ.exe
  C:\Windows\System\rlwiKMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\pAzgyyf.exe
  C:\Windows\System\pAzgyyf.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\YJwHQGK.exe
  C:\Windows\System\YJwHQGK.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\NdBKHhV.exe
  C:\Windows\System\NdBKHhV.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\OaSKLUP.exe
  C:\Windows\System\OaSKLUP.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eRKcETr.exe
  C:\Windows\System\eRKcETr.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\cIOuQfO.exe
  C:\Windows\System\cIOuQfO.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\VyEqkYH.exe
  C:\Windows\System\VyEqkYH.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\gfezmsN.exe
  C:\Windows\System\gfezmsN.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\uDGuuOL.exe
  C:\Windows\System\uDGuuOL.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\cIMxAYB.exe
  C:\Windows\System\cIMxAYB.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\mmQbBsC.exe
  C:\Windows\System\mmQbBsC.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\vCKoYWA.exe
  C:\Windows\System\vCKoYWA.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\MAVQjMp.exe
  C:\Windows\System\MAVQjMp.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\kxYuAqw.exe
  C:\Windows\System\kxYuAqw.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\wFRnrJj.exe
  C:\Windows\System\wFRnrJj.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\hCHUlzf.exe
  C:\Windows\System\hCHUlzf.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\cmarbHL.exe
  C:\Windows\System\cmarbHL.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\LNMnzbh.exe
  C:\Windows\System\LNMnzbh.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\EMAuVXq.exe
  C:\Windows\System\EMAuVXq.exe
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Windows\System\osaNNXT.exe
  C:\Windows\System\osaNNXT.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\eEQWsiP.exe
  C:\Windows\System\eEQWsiP.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\zCAoTXn.exe
  C:\Windows\System\zCAoTXn.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\drQVwwu.exe
  C:\Windows\System\drQVwwu.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\ZxegNDh.exe
  C:\Windows\System\ZxegNDh.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\zqlPVAj.exe
  C:\Windows\System\zqlPVAj.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\EfcrYeu.exe
  C:\Windows\System\EfcrYeu.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\LzUWnFp.exe
  C:\Windows\System\LzUWnFp.exe
  2⤵
  PID:5396
- C:\Windows\System\wDdrZHs.exe
  C:\Windows\System\wDdrZHs.exe
  2⤵
  PID:5420
- C:\Windows\System\fSRcnKY.exe
  C:\Windows\System\fSRcnKY.exe
  2⤵
  PID:5456
- C:\Windows\System\pihfrMb.exe
  C:\Windows\System\pihfrMb.exe
  2⤵
  PID:5488
- C:\Windows\System\BZznlhX.exe
  C:\Windows\System\BZznlhX.exe
  2⤵
  PID:5516
- C:\Windows\System\hlIWJPx.exe
  C:\Windows\System\hlIWJPx.exe
  2⤵
  PID:5544
- C:\Windows\System\VefXFUd.exe
  C:\Windows\System\VefXFUd.exe
  2⤵
  PID:5572
- C:\Windows\System\LkKKYmc.exe
  C:\Windows\System\LkKKYmc.exe
  2⤵
  PID:5592
- C:\Windows\System\VGKnivi.exe
  C:\Windows\System\VGKnivi.exe
  2⤵
  PID:5628
- C:\Windows\System\ZtdSjfn.exe
  C:\Windows\System\ZtdSjfn.exe
  2⤵
  PID:5656
- C:\Windows\System\BpaifmR.exe
  C:\Windows\System\BpaifmR.exe
  2⤵
  PID:5676
- C:\Windows\System\eViCPYU.exe
  C:\Windows\System\eViCPYU.exe
  2⤵
  PID:5704
- C:\Windows\System\AvZdSTS.exe
  C:\Windows\System\AvZdSTS.exe
  2⤵
  PID:5740
- C:\Windows\System\HNRrHgA.exe
  C:\Windows\System\HNRrHgA.exe
  2⤵
  PID:5772
- C:\Windows\System\lnaIQEU.exe
  C:\Windows\System\lnaIQEU.exe
  2⤵
  PID:5800
- C:\Windows\System\HtDfnto.exe
  C:\Windows\System\HtDfnto.exe
  2⤵
  PID:5828
- C:\Windows\System\vhVnSXh.exe
  C:\Windows\System\vhVnSXh.exe
  2⤵
  PID:5860
- C:\Windows\System\zaoRNKS.exe
  C:\Windows\System\zaoRNKS.exe
  2⤵
  PID:5876
- C:\Windows\System\gRtomvM.exe
  C:\Windows\System\gRtomvM.exe
  2⤵
  PID:5912
- C:\Windows\System\LIiiEMH.exe
  C:\Windows\System\LIiiEMH.exe
  2⤵
  PID:5936
- C:\Windows\System\SIUWLeb.exe
  C:\Windows\System\SIUWLeb.exe
  2⤵
  PID:5964
- C:\Windows\System\BZjiBRl.exe
  C:\Windows\System\BZjiBRl.exe
  2⤵
  PID:5988
- C:\Windows\System\TavCywm.exe
  C:\Windows\System\TavCywm.exe
  2⤵
  PID:6028
- C:\Windows\System\KcKiIuy.exe
  C:\Windows\System\KcKiIuy.exe
  2⤵
  PID:6048
- C:\Windows\System\mRkFvGC.exe
  C:\Windows\System\mRkFvGC.exe
  2⤵
  PID:6084
- C:\Windows\System\WYUFJXN.exe
  C:\Windows\System\WYUFJXN.exe
  2⤵
  PID:6112
- C:\Windows\System\AKfYimo.exe
  C:\Windows\System\AKfYimo.exe
  2⤵
  PID:6132
- C:\Windows\System\ycfzphA.exe
  C:\Windows\System\ycfzphA.exe
  2⤵
  PID:5160
- C:\Windows\System\YUEHfcc.exe
  C:\Windows\System\YUEHfcc.exe
  2⤵
  PID:5220
- C:\Windows\System\ctrVfNF.exe
  C:\Windows\System\ctrVfNF.exe
  2⤵
  PID:5276
- C:\Windows\System\NReDnSD.exe
  C:\Windows\System\NReDnSD.exe
  2⤵
  PID:5320
- C:\Windows\System\nyvyYFU.exe
  C:\Windows\System\nyvyYFU.exe
  2⤵
  PID:5388
- C:\Windows\System\LHvUkRK.exe
  C:\Windows\System\LHvUkRK.exe
  2⤵
  PID:5448
- C:\Windows\System\tcQlQIC.exe
  C:\Windows\System\tcQlQIC.exe
  2⤵
  PID:5524
- C:\Windows\System\sjBkfFl.exe
  C:\Windows\System\sjBkfFl.exe
  2⤵
  PID:2908
- C:\Windows\System\rlsFHSm.exe
  C:\Windows\System\rlsFHSm.exe
  2⤵
  PID:5620
- C:\Windows\System\IXmkDtb.exe
  C:\Windows\System\IXmkDtb.exe
  2⤵
  PID:5664
- C:\Windows\System\dsaimKc.exe
  C:\Windows\System\dsaimKc.exe
  2⤵
  PID:5728
- C:\Windows\System\DccpgLE.exe
  C:\Windows\System\DccpgLE.exe
  2⤵
  PID:656
- C:\Windows\System\cbnDxwI.exe
  C:\Windows\System\cbnDxwI.exe
  2⤵
  PID:5840
- C:\Windows\System\UIClQEB.exe
  C:\Windows\System\UIClQEB.exe
  2⤵
  PID:5896
- C:\Windows\System\WCHzkJE.exe
  C:\Windows\System\WCHzkJE.exe
  2⤵
  PID:5944
- C:\Windows\System\ZqKntdW.exe
  C:\Windows\System\ZqKntdW.exe
  2⤵
  PID:6004
- C:\Windows\System\eqUyGWX.exe
  C:\Windows\System\eqUyGWX.exe
  2⤵
  PID:6044
- C:\Windows\System\zGyIsnB.exe
  C:\Windows\System\zGyIsnB.exe
  2⤵
  PID:5188
- C:\Windows\System\KhwtLBq.exe
  C:\Windows\System\KhwtLBq.exe
  2⤵
  PID:5408
- C:\Windows\System\klyIhNn.exe
  C:\Windows\System\klyIhNn.exe
  2⤵
  PID:5412
- C:\Windows\System\VVhLLBw.exe
  C:\Windows\System\VVhLLBw.exe
  2⤵
  PID:3256
- C:\Windows\System\gLjzuZw.exe
  C:\Windows\System\gLjzuZw.exe
  2⤵
  PID:5672
- C:\Windows\System\GphZHqh.exe
  C:\Windows\System\GphZHqh.exe
  2⤵
  PID:5816
- C:\Windows\System\MRpTCZg.exe
  C:\Windows\System\MRpTCZg.exe
  2⤵
  PID:5984
- C:\Windows\System\eyiUHQx.exe
  C:\Windows\System\eyiUHQx.exe
  2⤵
  PID:4820
- C:\Windows\System\iJdyrNt.exe
  C:\Windows\System\iJdyrNt.exe
  2⤵
  PID:5380
- C:\Windows\System\aDQdPva.exe
  C:\Windows\System\aDQdPva.exe
  2⤵
  PID:5640
- C:\Windows\System\awrNrvP.exe
  C:\Windows\System\awrNrvP.exe
  2⤵
  PID:5872
- C:\Windows\System\dglNFrH.exe
  C:\Windows\System\dglNFrH.exe
  2⤵
  PID:3012
- C:\Windows\System\tqmSJEq.exe
  C:\Windows\System\tqmSJEq.exe
  2⤵
  PID:6016
- C:\Windows\System\MjnowMF.exe
  C:\Windows\System\MjnowMF.exe
  2⤵
  PID:5552
- C:\Windows\System\olgzVYV.exe
  C:\Windows\System\olgzVYV.exe
  2⤵
  PID:6168
- C:\Windows\System\dayKsdn.exe
  C:\Windows\System\dayKsdn.exe
  2⤵
  PID:6196
- C:\Windows\System\JIMEgic.exe
  C:\Windows\System\JIMEgic.exe
  2⤵
  PID:6216
- C:\Windows\System\kxtEurF.exe
  C:\Windows\System\kxtEurF.exe
  2⤵
  PID:6244
- C:\Windows\System\dJNeqZV.exe
  C:\Windows\System\dJNeqZV.exe
  2⤵
  PID:6280
- C:\Windows\System\ChaRqRp.exe
  C:\Windows\System\ChaRqRp.exe
  2⤵
  PID:6308
- C:\Windows\System\eYxljWU.exe
  C:\Windows\System\eYxljWU.exe
  2⤵
  PID:6336
- C:\Windows\System\DWsrGvQ.exe
  C:\Windows\System\DWsrGvQ.exe
  2⤵
  PID:6360
- C:\Windows\System\SYzFrNT.exe
  C:\Windows\System\SYzFrNT.exe
  2⤵
  PID:6392
- C:\Windows\System\fUHSkou.exe
  C:\Windows\System\fUHSkou.exe
  2⤵
  PID:6420
- C:\Windows\System\bFSpfdD.exe
  C:\Windows\System\bFSpfdD.exe
  2⤵
  PID:6448
- C:\Windows\System\MZzJTrY.exe
  C:\Windows\System\MZzJTrY.exe
  2⤵
  PID:6476
- C:\Windows\System\OpviXZv.exe
  C:\Windows\System\OpviXZv.exe
  2⤵
  PID:6504
- C:\Windows\System\dUMbkOh.exe
  C:\Windows\System\dUMbkOh.exe
  2⤵
  PID:6528
- C:\Windows\System\DknDMKf.exe
  C:\Windows\System\DknDMKf.exe
  2⤵
  PID:6560
- C:\Windows\System\qdYdOZi.exe
  C:\Windows\System\qdYdOZi.exe
  2⤵
  PID:6588
- C:\Windows\System\EjTTlQC.exe
  C:\Windows\System\EjTTlQC.exe
  2⤵
  PID:6616
- C:\Windows\System\HKfAZkt.exe
  C:\Windows\System\HKfAZkt.exe
  2⤵
  PID:6640
- C:\Windows\System\AdNPhVb.exe
  C:\Windows\System\AdNPhVb.exe
  2⤵
  PID:6676
- C:\Windows\System\NWfLFNd.exe
  C:\Windows\System\NWfLFNd.exe
  2⤵
  PID:6700
- C:\Windows\System\opjdldW.exe
  C:\Windows\System\opjdldW.exe
  2⤵
  PID:6728
- C:\Windows\System\cmpDTsI.exe
  C:\Windows\System\cmpDTsI.exe
  2⤵
  PID:6756
- C:\Windows\System\igiediq.exe
  C:\Windows\System\igiediq.exe
  2⤵
  PID:6784
- C:\Windows\System\QCZSmxv.exe
  C:\Windows\System\QCZSmxv.exe
  2⤵
  PID:6812
- C:\Windows\System\LrnbcOm.exe
  C:\Windows\System\LrnbcOm.exe
  2⤵
  PID:6840
- C:\Windows\System\tFScOcK.exe
  C:\Windows\System\tFScOcK.exe
  2⤵
  PID:6868
- C:\Windows\System\klQEYXo.exe
  C:\Windows\System\klQEYXo.exe
  2⤵
  PID:6888
- C:\Windows\System\oriOVjm.exe
  C:\Windows\System\oriOVjm.exe
  2⤵
  PID:6928
- C:\Windows\System\FbPVPEH.exe
  C:\Windows\System\FbPVPEH.exe
  2⤵
  PID:6948
- C:\Windows\System\SZBUFyE.exe
  C:\Windows\System\SZBUFyE.exe
  2⤵
  PID:6976
- C:\Windows\System\BGeOPTe.exe
  C:\Windows\System\BGeOPTe.exe
  2⤵
  PID:7012
- C:\Windows\System\JHKGpkh.exe
  C:\Windows\System\JHKGpkh.exe
  2⤵
  PID:7040
- C:\Windows\System\iazDdsK.exe
  C:\Windows\System\iazDdsK.exe
  2⤵
  PID:7068
- C:\Windows\System\njNGWvl.exe
  C:\Windows\System\njNGWvl.exe
  2⤵
  PID:7092
- C:\Windows\System\mTLiWIa.exe
  C:\Windows\System\mTLiWIa.exe
  2⤵
  PID:7124
- C:\Windows\System\mQRWUkx.exe
  C:\Windows\System\mQRWUkx.exe
  2⤵
  PID:7144
- C:\Windows\System\jpHRqog.exe
  C:\Windows\System\jpHRqog.exe
  2⤵
  PID:6160
- C:\Windows\System\wcimHhI.exe
  C:\Windows\System\wcimHhI.exe
  2⤵
  PID:6236
- C:\Windows\System\fJuhXsb.exe
  C:\Windows\System\fJuhXsb.exe
  2⤵
  PID:6292
- C:\Windows\System\qVqZvrS.exe
  C:\Windows\System\qVqZvrS.exe
  2⤵
  PID:6352
- C:\Windows\System\pjWpKPs.exe
  C:\Windows\System\pjWpKPs.exe
  2⤵
  PID:6428
- C:\Windows\System\tMATHsg.exe
  C:\Windows\System\tMATHsg.exe
  2⤵
  PID:6488
- C:\Windows\System\ZahpOCV.exe
  C:\Windows\System\ZahpOCV.exe
  2⤵
  PID:6548
- C:\Windows\System\FtXEGcq.exe
  C:\Windows\System\FtXEGcq.exe
  2⤵
  PID:6600
- C:\Windows\System\HuTJGEG.exe
  C:\Windows\System\HuTJGEG.exe
  2⤵
  PID:6664
- C:\Windows\System\hAbxRgx.exe
  C:\Windows\System\hAbxRgx.exe
  2⤵
  PID:6740
- C:\Windows\System\CSPSheD.exe
  C:\Windows\System\CSPSheD.exe
  2⤵
  PID:6804
- C:\Windows\System\XDSgMYE.exe
  C:\Windows\System\XDSgMYE.exe
  2⤵
  PID:6876
- C:\Windows\System\IjjeTYR.exe
  C:\Windows\System\IjjeTYR.exe
  2⤵
  PID:1324
- C:\Windows\System\xykhQNd.exe
  C:\Windows\System\xykhQNd.exe
  2⤵
  PID:1584
- C:\Windows\System\yJlmudB.exe
  C:\Windows\System\yJlmudB.exe
  2⤵
  PID:1284
- C:\Windows\System\fAudFuD.exe
  C:\Windows\System\fAudFuD.exe
  2⤵
  PID:6996
- C:\Windows\System\cYaMzDd.exe
  C:\Windows\System\cYaMzDd.exe
  2⤵
  PID:7052
- C:\Windows\System\RJrZQYi.exe
  C:\Windows\System\RJrZQYi.exe
  2⤵
  PID:7132
- C:\Windows\System\UuuGLtX.exe
  C:\Windows\System\UuuGLtX.exe
  2⤵
  PID:6204
- C:\Windows\System\mfpCzLq.exe
  C:\Windows\System\mfpCzLq.exe
  2⤵
  PID:6320
- C:\Windows\System\hoZGYjN.exe
  C:\Windows\System\hoZGYjN.exe
  2⤵
  PID:6512
- C:\Windows\System\CEvOryj.exe
  C:\Windows\System\CEvOryj.exe
  2⤵
  PID:6652
- C:\Windows\System\ERtDGYv.exe
  C:\Windows\System\ERtDGYv.exe
  2⤵
  PID:6768
- C:\Windows\System\mlxYRLO.exe
  C:\Windows\System\mlxYRLO.exe
  2⤵
  PID:6884
- C:\Windows\System\HIoeEbN.exe
  C:\Windows\System\HIoeEbN.exe
  2⤵
  PID:6964
- C:\Windows\System\TvPctxB.exe
  C:\Windows\System\TvPctxB.exe
  2⤵
  PID:7108
- C:\Windows\System\PunFaKD.exe
  C:\Windows\System\PunFaKD.exe
  2⤵
  PID:6264
- C:\Windows\System\zrVLBCP.exe
  C:\Windows\System\zrVLBCP.exe
  2⤵
  PID:6692
- C:\Windows\System\qFcRJCJ.exe
  C:\Windows\System\qFcRJCJ.exe
  2⤵
  PID:6900
- C:\Windows\System\AcMDefc.exe
  C:\Windows\System\AcMDefc.exe
  2⤵
  PID:7020
- C:\Windows\System\SpVvGGd.exe
  C:\Windows\System\SpVvGGd.exe
  2⤵
  PID:6440
- C:\Windows\System\CLAmGGq.exe
  C:\Windows\System\CLAmGGq.exe
  2⤵
  PID:6852
- C:\Windows\System\ctYnvhh.exe
  C:\Windows\System\ctYnvhh.exe
  2⤵
  PID:7188
- C:\Windows\System\PqufPJX.exe
  C:\Windows\System\PqufPJX.exe
  2⤵
  PID:7220
- C:\Windows\System\zPmyYGn.exe
  C:\Windows\System\zPmyYGn.exe
  2⤵
  PID:7252
- C:\Windows\System\boMbwgv.exe
  C:\Windows\System\boMbwgv.exe
  2⤵
  PID:7280
- C:\Windows\System\ZiCxleR.exe
  C:\Windows\System\ZiCxleR.exe
  2⤵
  PID:7300
- C:\Windows\System\KLMAKcL.exe
  C:\Windows\System\KLMAKcL.exe
  2⤵
  PID:7336
- C:\Windows\System\MLWQLXT.exe
  C:\Windows\System\MLWQLXT.exe
  2⤵
  PID:7360
- C:\Windows\System\FyWbZfY.exe
  C:\Windows\System\FyWbZfY.exe
  2⤵
  PID:7392
- C:\Windows\System\SWmWtuK.exe
  C:\Windows\System\SWmWtuK.exe
  2⤵
  PID:7420
- C:\Windows\System\TjSNvJq.exe
  C:\Windows\System\TjSNvJq.exe
  2⤵
  PID:7448
- C:\Windows\System\cBHBBUB.exe
  C:\Windows\System\cBHBBUB.exe
  2⤵
  PID:7476
- C:\Windows\System\WqXRCRr.exe
  C:\Windows\System\WqXRCRr.exe
  2⤵
  PID:7500
- C:\Windows\System\kkEEEoK.exe
  C:\Windows\System\kkEEEoK.exe
  2⤵
  PID:7532
- C:\Windows\System\BNclrzA.exe
  C:\Windows\System\BNclrzA.exe
  2⤵
  PID:7560
- C:\Windows\System\ZyuaiZr.exe
  C:\Windows\System\ZyuaiZr.exe
  2⤵
  PID:7588
- C:\Windows\System\dIptfZH.exe
  C:\Windows\System\dIptfZH.exe
  2⤵
  PID:7616
- C:\Windows\System\dhkppVa.exe
  C:\Windows\System\dhkppVa.exe
  2⤵
  PID:7644
- C:\Windows\System\wOEwtMg.exe
  C:\Windows\System\wOEwtMg.exe
  2⤵
  PID:7672
- C:\Windows\System\LkqUzwn.exe
  C:\Windows\System\LkqUzwn.exe
  2⤵
  PID:7692
- C:\Windows\System\Grsshgz.exe
  C:\Windows\System\Grsshgz.exe
  2⤵
  PID:7728
- C:\Windows\System\GFvPtQf.exe
  C:\Windows\System\GFvPtQf.exe
  2⤵
  PID:7756
- C:\Windows\System\OEpJsbn.exe
  C:\Windows\System\OEpJsbn.exe
  2⤵
  PID:7784
- C:\Windows\System\OIZTwuD.exe
  C:\Windows\System\OIZTwuD.exe
  2⤵
  PID:7816
- C:\Windows\System\tmNUkhk.exe
  C:\Windows\System\tmNUkhk.exe
  2⤵
  PID:7840
- C:\Windows\System\herQMox.exe
  C:\Windows\System\herQMox.exe
  2⤵
  PID:7868
- C:\Windows\System\aSebgGZ.exe
  C:\Windows\System\aSebgGZ.exe
  2⤵
  PID:7892
- C:\Windows\System\eReWckY.exe
  C:\Windows\System\eReWckY.exe
  2⤵
  PID:7924
- C:\Windows\System\ROsDAPI.exe
  C:\Windows\System\ROsDAPI.exe
  2⤵
  PID:7948
- C:\Windows\System\UWHbSvE.exe
  C:\Windows\System\UWHbSvE.exe
  2⤵
  PID:7980
- C:\Windows\System\CESsPFn.exe
  C:\Windows\System\CESsPFn.exe
  2⤵
  PID:8008
- C:\Windows\System\VKTWHfT.exe
  C:\Windows\System\VKTWHfT.exe
  2⤵
  PID:8036
- C:\Windows\System\TJPRVYS.exe
  C:\Windows\System\TJPRVYS.exe
  2⤵
  PID:8056
- C:\Windows\System\LiIVByT.exe
  C:\Windows\System\LiIVByT.exe
  2⤵
  PID:8084
- C:\Windows\System\SdWbdSc.exe
  C:\Windows\System\SdWbdSc.exe
  2⤵
  PID:8112
- C:\Windows\System\upAmyKF.exe
  C:\Windows\System\upAmyKF.exe
  2⤵
  PID:8144
- C:\Windows\System\cpBuhbR.exe
  C:\Windows\System\cpBuhbR.exe
  2⤵
  PID:8168
- C:\Windows\System\qGcKrOy.exe
  C:\Windows\System\qGcKrOy.exe
  2⤵
  PID:7200
- C:\Windows\System\WQLBDlX.exe
  C:\Windows\System\WQLBDlX.exe
  2⤵
  PID:7264
- C:\Windows\System\WBaiPsb.exe
  C:\Windows\System\WBaiPsb.exe
  2⤵
  PID:7320
- C:\Windows\System\EobFuis.exe
  C:\Windows\System\EobFuis.exe
  2⤵
  PID:7380
- C:\Windows\System\SFyDkYS.exe
  C:\Windows\System\SFyDkYS.exe
  2⤵
  PID:7456
- C:\Windows\System\FNwfWFc.exe
  C:\Windows\System\FNwfWFc.exe
  2⤵
  PID:7508
- C:\Windows\System\ypjCHwS.exe
  C:\Windows\System\ypjCHwS.exe
  2⤵
  PID:7568
- C:\Windows\System\nOCqdoz.exe
  C:\Windows\System\nOCqdoz.exe
  2⤵
  PID:7628
- C:\Windows\System\fABubpW.exe
  C:\Windows\System\fABubpW.exe
  2⤵
  PID:7704
- C:\Windows\System\KPAXCMY.exe
  C:\Windows\System\KPAXCMY.exe
  2⤵
  PID:7768
- C:\Windows\System\coxlpjZ.exe
  C:\Windows\System\coxlpjZ.exe
  2⤵
  PID:7828
- C:\Windows\System\upzZTWe.exe
  C:\Windows\System\upzZTWe.exe
  2⤵
  PID:7900
- C:\Windows\System\WEwEelT.exe
  C:\Windows\System\WEwEelT.exe
  2⤵
  PID:7964
- C:\Windows\System\iVLYPVj.exe
  C:\Windows\System\iVLYPVj.exe
  2⤵
  PID:8024
- C:\Windows\System\mDQvnOj.exe
  C:\Windows\System\mDQvnOj.exe
  2⤵
  PID:8080
- C:\Windows\System\eBiolVa.exe
  C:\Windows\System\eBiolVa.exe
  2⤵
  PID:8152
- C:\Windows\System\qkcrDHy.exe
  C:\Windows\System\qkcrDHy.exe
  2⤵
  PID:7228
- C:\Windows\System\nvYFrHW.exe
  C:\Windows\System\nvYFrHW.exe
  2⤵
  PID:7352
- C:\Windows\System\CdnMLkc.exe
  C:\Windows\System\CdnMLkc.exe
  2⤵
  PID:7524
- C:\Windows\System\MNtCLez.exe
  C:\Windows\System\MNtCLez.exe
  2⤵
  PID:7684
- C:\Windows\System\aSPaqyw.exe
  C:\Windows\System\aSPaqyw.exe
  2⤵
  PID:7824
- C:\Windows\System\haHbnhF.exe
  C:\Windows\System\haHbnhF.exe
  2⤵
  PID:7996
- C:\Windows\System\zvceeaR.exe
  C:\Windows\System\zvceeaR.exe
  2⤵
  PID:8132
- C:\Windows\System\LFIjVBY.exe
  C:\Windows\System\LFIjVBY.exe
  2⤵
  PID:7348
- C:\Windows\System\MlpvHDw.exe
  C:\Windows\System\MlpvHDw.exe
  2⤵
  PID:7744
- C:\Windows\System\uwxynBX.exe
  C:\Windows\System\uwxynBX.exe
  2⤵
  PID:8124
- C:\Windows\System\WivPGHG.exe
  C:\Windows\System\WivPGHG.exe
  2⤵
  PID:7656
- C:\Windows\System\RCRbPRD.exe
  C:\Windows\System\RCRbPRD.exe
  2⤵
  PID:8200
- C:\Windows\System\tLSrspt.exe
  C:\Windows\System\tLSrspt.exe
  2⤵
  PID:8216
- C:\Windows\System\VzzmtcQ.exe
  C:\Windows\System\VzzmtcQ.exe
  2⤵
  PID:8244
- C:\Windows\System\nLlipGP.exe
  C:\Windows\System\nLlipGP.exe
  2⤵
  PID:8272
- C:\Windows\System\HKSghXi.exe
  C:\Windows\System\HKSghXi.exe
  2⤵
  PID:8300
- C:\Windows\System\IPizBor.exe
  C:\Windows\System\IPizBor.exe
  2⤵
  PID:8328
- C:\Windows\System\opApwbY.exe
  C:\Windows\System\opApwbY.exe
  2⤵
  PID:8356
- C:\Windows\System\RuDjquZ.exe
  C:\Windows\System\RuDjquZ.exe
  2⤵
  PID:8384
- C:\Windows\System\VWIvziW.exe
  C:\Windows\System\VWIvziW.exe
  2⤵
  PID:8412
- C:\Windows\System\rUsarmO.exe
  C:\Windows\System\rUsarmO.exe
  2⤵
  PID:8440
- C:\Windows\System\pBqvXdh.exe
  C:\Windows\System\pBqvXdh.exe
  2⤵
  PID:8476
- C:\Windows\System\DiGWXyl.exe
  C:\Windows\System\DiGWXyl.exe
  2⤵
  PID:8496
- C:\Windows\System\HlXFJVo.exe
  C:\Windows\System\HlXFJVo.exe
  2⤵
  PID:8524
- C:\Windows\System\HAXHCOZ.exe
  C:\Windows\System\HAXHCOZ.exe
  2⤵
  PID:8552
- C:\Windows\System\NBbklJM.exe
  C:\Windows\System\NBbklJM.exe
  2⤵
  PID:8580
- C:\Windows\System\ZXVdRrv.exe
  C:\Windows\System\ZXVdRrv.exe
  2⤵
  PID:8608
- C:\Windows\System\nwdVINS.exe
  C:\Windows\System\nwdVINS.exe
  2⤵
  PID:8636
- C:\Windows\System\wGMMGZT.exe
  C:\Windows\System\wGMMGZT.exe
  2⤵
  PID:8664
- C:\Windows\System\ligtpZH.exe
  C:\Windows\System\ligtpZH.exe
  2⤵
  PID:8692
- C:\Windows\System\ZlKouGG.exe
  C:\Windows\System\ZlKouGG.exe
  2⤵
  PID:8720
- C:\Windows\System\AiYyGWO.exe
  C:\Windows\System\AiYyGWO.exe
  2⤵
  PID:8748
- C:\Windows\System\huDIziD.exe
  C:\Windows\System\huDIziD.exe
  2⤵
  PID:8780
- C:\Windows\System\RtHsCDM.exe
  C:\Windows\System\RtHsCDM.exe
  2⤵
  PID:8804
- C:\Windows\System\RYjzqzB.exe
  C:\Windows\System\RYjzqzB.exe
  2⤵
  PID:8832
- C:\Windows\System\ESKeFCs.exe
  C:\Windows\System\ESKeFCs.exe
  2⤵
  PID:8860
- C:\Windows\System\HOrhtTF.exe
  C:\Windows\System\HOrhtTF.exe
  2⤵
  PID:8888
- C:\Windows\System\ybkrNFJ.exe
  C:\Windows\System\ybkrNFJ.exe
  2⤵
  PID:8912
- C:\Windows\System\SRKBFdS.exe
  C:\Windows\System\SRKBFdS.exe
  2⤵
  PID:8936
- C:\Windows\System\sVgSszz.exe
  C:\Windows\System\sVgSszz.exe
  2⤵
  PID:8952
- C:\Windows\System\mZJTNlJ.exe
  C:\Windows\System\mZJTNlJ.exe
  2⤵
  PID:9008
- C:\Windows\System\jyvdlDa.exe
  C:\Windows\System\jyvdlDa.exe
  2⤵
  PID:9052
- C:\Windows\System\jxrrjTX.exe
  C:\Windows\System\jxrrjTX.exe
  2⤵
  PID:9068
- C:\Windows\System\tfFspzt.exe
  C:\Windows\System\tfFspzt.exe
  2⤵
  PID:9084
- C:\Windows\System\ClsRgMi.exe
  C:\Windows\System\ClsRgMi.exe
  2⤵
  PID:9124
- C:\Windows\System\fxAQkxT.exe
  C:\Windows\System\fxAQkxT.exe
  2⤵
  PID:9152
- C:\Windows\System\meZhNUY.exe
  C:\Windows\System\meZhNUY.exe
  2⤵
  PID:9180
- C:\Windows\System\GxRPtpz.exe
  C:\Windows\System\GxRPtpz.exe
  2⤵
  PID:9208
- C:\Windows\System\XJGYOnL.exe
  C:\Windows\System\XJGYOnL.exe
  2⤵
  PID:4844
- C:\Windows\System\syBAruS.exe
  C:\Windows\System\syBAruS.exe
  2⤵
  PID:8292
- C:\Windows\System\wTEDTMT.exe
  C:\Windows\System\wTEDTMT.exe
  2⤵
  PID:8324
- C:\Windows\System\QQjpGfQ.exe
  C:\Windows\System\QQjpGfQ.exe
  2⤵
  PID:8424
- C:\Windows\System\SWckSYa.exe
  C:\Windows\System\SWckSYa.exe
  2⤵
  PID:8484
- C:\Windows\System\xRLNCIn.exe
  C:\Windows\System\xRLNCIn.exe
  2⤵
  PID:8520
- C:\Windows\System\kdFsNxW.exe
  C:\Windows\System\kdFsNxW.exe
  2⤵
  PID:8576
- C:\Windows\System\sePFFWd.exe
  C:\Windows\System\sePFFWd.exe
  2⤵
  PID:8660
- C:\Windows\System\jZtLWIn.exe
  C:\Windows\System\jZtLWIn.exe
  2⤵
  PID:7680
- C:\Windows\System\SCDDwnc.exe
  C:\Windows\System\SCDDwnc.exe
  2⤵
  PID:8788
- C:\Windows\System\baSJfIQ.exe
  C:\Windows\System\baSJfIQ.exe
  2⤵
  PID:8852
- C:\Windows\System\bgDuMyV.exe
  C:\Windows\System\bgDuMyV.exe
  2⤵
  PID:8884
- C:\Windows\System\ajhpdnz.exe
  C:\Windows\System\ajhpdnz.exe
  2⤵
  PID:9000
- C:\Windows\System\qJUncvw.exe
  C:\Windows\System\qJUncvw.exe
  2⤵
  PID:9060
- C:\Windows\System\aWQLUxU.exe
  C:\Windows\System\aWQLUxU.exe
  2⤵
  PID:9116
- C:\Windows\System\KLpaZyw.exe
  C:\Windows\System\KLpaZyw.exe
  2⤵
  PID:9168
- C:\Windows\System\znfsBxK.exe
  C:\Windows\System\znfsBxK.exe
  2⤵
  PID:8212
- C:\Windows\System\UFoYzBi.exe
  C:\Windows\System\UFoYzBi.exe
  2⤵
  PID:8396
- C:\Windows\System\dsWKiZQ.exe
  C:\Windows\System\dsWKiZQ.exe
  2⤵
  PID:8492
- C:\Windows\System\QmMzllB.exe
  C:\Windows\System\QmMzllB.exe
  2⤵
  PID:8548
- C:\Windows\System\DpCZPdA.exe
  C:\Windows\System\DpCZPdA.exe
  2⤵
  PID:8772
- C:\Windows\System\sgXzDOt.exe
  C:\Windows\System\sgXzDOt.exe
  2⤵
  PID:8944
- C:\Windows\System\CmjOzrE.exe
  C:\Windows\System\CmjOzrE.exe
  2⤵
  PID:9104
- C:\Windows\System\uoEYaGc.exe
  C:\Windows\System\uoEYaGc.exe
  2⤵
  PID:9204
- C:\Windows\System\fIghYVq.exe
  C:\Windows\System\fIghYVq.exe
  2⤵
  PID:8460
- C:\Windows\System\DRVQUiL.exe
  C:\Windows\System\DRVQUiL.exe
  2⤵
  PID:8744
- C:\Windows\System\PXPAZap.exe
  C:\Windows\System\PXPAZap.exe
  2⤵
  PID:9080
- C:\Windows\System\zXOboUa.exe
  C:\Windows\System\zXOboUa.exe
  2⤵
  PID:8948
- C:\Windows\System\VDUOpwb.exe
  C:\Windows\System\VDUOpwb.exe
  2⤵
  PID:8716
- C:\Windows\System\WgBSCng.exe
  C:\Windows\System\WgBSCng.exe
  2⤵
  PID:9240
- C:\Windows\System\MxkIWWF.exe
  C:\Windows\System\MxkIWWF.exe
  2⤵
  PID:9260
- C:\Windows\System\nUZagAM.exe
  C:\Windows\System\nUZagAM.exe
  2⤵
  PID:9296
- C:\Windows\System\zUMljMz.exe
  C:\Windows\System\zUMljMz.exe
  2⤵
  PID:9340
- C:\Windows\System\DXMwfGa.exe
  C:\Windows\System\DXMwfGa.exe
  2⤵
  PID:9368
- C:\Windows\System\bMZHOrv.exe
  C:\Windows\System\bMZHOrv.exe
  2⤵
  PID:9396
- C:\Windows\System\iDQmNxc.exe
  C:\Windows\System\iDQmNxc.exe
  2⤵
  PID:9424
- C:\Windows\System\DnSgRCz.exe
  C:\Windows\System\DnSgRCz.exe
  2⤵
  PID:9452
- C:\Windows\System\MADWeXT.exe
  C:\Windows\System\MADWeXT.exe
  2⤵
  PID:9496
- C:\Windows\System\YCgqQnN.exe
  C:\Windows\System\YCgqQnN.exe
  2⤵
  PID:9516
- C:\Windows\System\rlNaqMH.exe
  C:\Windows\System\rlNaqMH.exe
  2⤵
  PID:9532
- C:\Windows\System\WtLWdKT.exe
  C:\Windows\System\WtLWdKT.exe
  2⤵
  PID:9548
- C:\Windows\System\YuKGQcR.exe
  C:\Windows\System\YuKGQcR.exe
  2⤵
  PID:9568
- C:\Windows\System\OTstWiV.exe
  C:\Windows\System\OTstWiV.exe
  2⤵
  PID:9588
- C:\Windows\System\Dhwkmpr.exe
  C:\Windows\System\Dhwkmpr.exe
  2⤵
  PID:9628
- C:\Windows\System\VGLJXQN.exe
  C:\Windows\System\VGLJXQN.exe
  2⤵
  PID:9668
- C:\Windows\System\GBZfzst.exe
  C:\Windows\System\GBZfzst.exe
  2⤵
  PID:9716
- C:\Windows\System\upwQdPy.exe
  C:\Windows\System\upwQdPy.exe
  2⤵
  PID:9732
- C:\Windows\System\SKJcKVl.exe
  C:\Windows\System\SKJcKVl.exe
  2⤵
  PID:9760
- C:\Windows\System\UbdRMzG.exe
  C:\Windows\System\UbdRMzG.exe
  2⤵
  PID:9800
- C:\Windows\System\CPFKIJj.exe
  C:\Windows\System\CPFKIJj.exe
  2⤵
  PID:9828
- C:\Windows\System\frfjylX.exe
  C:\Windows\System\frfjylX.exe
  2⤵
  PID:9852
- C:\Windows\System\NBDpFXd.exe
  C:\Windows\System\NBDpFXd.exe
  2⤵
  PID:9884
- C:\Windows\System\bptVahZ.exe
  C:\Windows\System\bptVahZ.exe
  2⤵
  PID:9904
- C:\Windows\System\fzrnwRE.exe
  C:\Windows\System\fzrnwRE.exe
  2⤵
  PID:9936
- C:\Windows\System\HXmyBNq.exe
  C:\Windows\System\HXmyBNq.exe
  2⤵
  PID:9968
- C:\Windows\System\UrdhCJg.exe
  C:\Windows\System\UrdhCJg.exe
  2⤵
  PID:9996
- C:\Windows\System\VIBRSLN.exe
  C:\Windows\System\VIBRSLN.exe
  2⤵
  PID:10024
- C:\Windows\System\qySYKYa.exe
  C:\Windows\System\qySYKYa.exe
  2⤵
  PID:10068
- C:\Windows\System\WPlAodG.exe
  C:\Windows\System\WPlAodG.exe
  2⤵
  PID:10084
- C:\Windows\System\WuVIiGQ.exe
  C:\Windows\System\WuVIiGQ.exe
  2⤵
  PID:10112
- C:\Windows\System\rumWDmS.exe
  C:\Windows\System\rumWDmS.exe
  2⤵
  PID:10132
- C:\Windows\System\dGmauqV.exe
  C:\Windows\System\dGmauqV.exe
  2⤵
  PID:10168
- C:\Windows\System\NwdjMJs.exe
  C:\Windows\System\NwdjMJs.exe
  2⤵
  PID:10192
- C:\Windows\System\gIqNXoc.exe
  C:\Windows\System\gIqNXoc.exe
  2⤵
  PID:10224
- C:\Windows\System\UAiWfqX.exe
  C:\Windows\System\UAiWfqX.exe
  2⤵
  PID:9228
- C:\Windows\System\ZVeHfbv.exe
  C:\Windows\System\ZVeHfbv.exe
  2⤵
  PID:9292
- C:\Windows\System\dFWWEWO.exe
  C:\Windows\System\dFWWEWO.exe
  2⤵
  PID:9352
- C:\Windows\System\DSNAGId.exe
  C:\Windows\System\DSNAGId.exe
  2⤵
  PID:9444
- C:\Windows\System\VYJLwIk.exe
  C:\Windows\System\VYJLwIk.exe
  2⤵
  PID:9476
- C:\Windows\System\epCVrRF.exe
  C:\Windows\System\epCVrRF.exe
  2⤵
  PID:9528
- C:\Windows\System\sIjRabr.exe
  C:\Windows\System\sIjRabr.exe
  2⤵
  PID:9540
- C:\Windows\System\FVNsThe.exe
  C:\Windows\System\FVNsThe.exe
  2⤵
  PID:2460
- C:\Windows\System\GlhEfEa.exe
  C:\Windows\System\GlhEfEa.exe
  2⤵
  PID:2176
- C:\Windows\System\oSaajlR.exe
  C:\Windows\System\oSaajlR.exe
  2⤵
  PID:9600
- C:\Windows\System\OgEBAuq.exe
  C:\Windows\System\OgEBAuq.exe
  2⤵
  PID:9648
- C:\Windows\System\SweDSim.exe
  C:\Windows\System\SweDSim.exe
  2⤵
  PID:9708
- C:\Windows\System\UrKKQsv.exe
  C:\Windows\System\UrKKQsv.exe
  2⤵
  PID:9784
- C:\Windows\System\zAdTfTM.exe
  C:\Windows\System\zAdTfTM.exe
  2⤵
  PID:9876
- C:\Windows\System\wmIalZD.exe
  C:\Windows\System\wmIalZD.exe
  2⤵
  PID:9956
- C:\Windows\System\KEYNwIm.exe
  C:\Windows\System\KEYNwIm.exe
  2⤵
  PID:8904
- C:\Windows\System\ROfNFwN.exe
  C:\Windows\System\ROfNFwN.exe
  2⤵
  PID:10048
- C:\Windows\System\GYuJMtr.exe
  C:\Windows\System\GYuJMtr.exe
  2⤵
  PID:10100
- C:\Windows\System\XHKxzkj.exe
  C:\Windows\System\XHKxzkj.exe
  2⤵
  PID:10164
- C:\Windows\System\auSuHsM.exe
  C:\Windows\System\auSuHsM.exe
  2⤵
  PID:9252
- C:\Windows\System\iywmkAp.exe
  C:\Windows\System\iywmkAp.exe
  2⤵
  PID:9408
- C:\Windows\System\qeFvpNk.exe
  C:\Windows\System\qeFvpNk.exe
  2⤵
  PID:9564
- C:\Windows\System\CXSdojx.exe
  C:\Windows\System\CXSdojx.exe
  2⤵
  PID:3676
- C:\Windows\System\OaiJyRj.exe
  C:\Windows\System\OaiJyRj.exe
  2⤵
  PID:9692
- C:\Windows\System\BfYtmsw.exe
  C:\Windows\System\BfYtmsw.exe
  2⤵
  PID:9824
- C:\Windows\System\NIfxevz.exe
  C:\Windows\System\NIfxevz.exe
  2⤵
  PID:9952
- C:\Windows\System\AjXtKbg.exe
  C:\Windows\System\AjXtKbg.exe
  2⤵
  PID:10036
- C:\Windows\System\WdiJpbD.exe
  C:\Windows\System\WdiJpbD.exe
  2⤵
  PID:10236
- C:\Windows\System\jwYnGMm.exe
  C:\Windows\System\jwYnGMm.exe
  2⤵
  PID:700
- C:\Windows\System\gQsWYBU.exe
  C:\Windows\System\gQsWYBU.exe
  2⤵
  PID:9744
- C:\Windows\System\osSlntc.exe
  C:\Windows\System\osSlntc.exe
  2⤵
  PID:9980
- C:\Windows\System\jVIUBqk.exe
  C:\Windows\System\jVIUBqk.exe
  2⤵
  PID:2184
- C:\Windows\System\uRiAnyD.exe
  C:\Windows\System\uRiAnyD.exe
  2⤵
  PID:10124
- C:\Windows\System\ZfidRNS.exe
  C:\Windows\System\ZfidRNS.exe
  2⤵
  PID:10248
- C:\Windows\System\oCUAVxo.exe
  C:\Windows\System\oCUAVxo.exe
  2⤵
  PID:10276
- C:\Windows\System\qNcIkMv.exe
  C:\Windows\System\qNcIkMv.exe
  2⤵
  PID:10292
- C:\Windows\System\dZeJDhp.exe
  C:\Windows\System\dZeJDhp.exe
  2⤵
  PID:10312
- C:\Windows\System\CxRybeB.exe
  C:\Windows\System\CxRybeB.exe
  2⤵
  PID:10344
- C:\Windows\System\zTecmAP.exe
  C:\Windows\System\zTecmAP.exe
  2⤵
  PID:10388
- C:\Windows\System\gfUrtgC.exe
  C:\Windows\System\gfUrtgC.exe
  2⤵
  PID:10412
- C:\Windows\System\SUMFXDI.exe
  C:\Windows\System\SUMFXDI.exe
  2⤵
  PID:10432
- C:\Windows\System\ZVzyqZP.exe
  C:\Windows\System\ZVzyqZP.exe
  2⤵
  PID:10464
- C:\Windows\System\Pzxdlrj.exe
  C:\Windows\System\Pzxdlrj.exe
  2⤵
  PID:10488
- C:\Windows\System\pgbSgJY.exe
  C:\Windows\System\pgbSgJY.exe
  2⤵
  PID:10528
- C:\Windows\System\oWOBoPs.exe
  C:\Windows\System\oWOBoPs.exe
  2⤵
  PID:10556
- C:\Windows\System\CIUBrBL.exe
  C:\Windows\System\CIUBrBL.exe
  2⤵
  PID:10584
- C:\Windows\System\CiSRUxf.exe
  C:\Windows\System\CiSRUxf.exe
  2⤵
  PID:10604
- C:\Windows\System\UprYoWe.exe
  C:\Windows\System\UprYoWe.exe
  2⤵
  PID:10628
- C:\Windows\System\gXwDbph.exe
  C:\Windows\System\gXwDbph.exe
  2⤵
  PID:10644
- C:\Windows\System\KvJyWkj.exe
  C:\Windows\System\KvJyWkj.exe
  2⤵
  PID:10696
- C:\Windows\System\mNHgYpQ.exe
  C:\Windows\System\mNHgYpQ.exe
  2⤵
  PID:10724
- C:\Windows\System\YtSAZoG.exe
  C:\Windows\System\YtSAZoG.exe
  2⤵
  PID:10752
- C:\Windows\System\dsKDsUj.exe
  C:\Windows\System\dsKDsUj.exe
  2⤵
  PID:10776
- C:\Windows\System\buckBnL.exe
  C:\Windows\System\buckBnL.exe
  2⤵
  PID:10808
- C:\Windows\System\nqQaqRT.exe
  C:\Windows\System\nqQaqRT.exe
  2⤵
  PID:10836
- C:\Windows\System\spjAXRt.exe
  C:\Windows\System\spjAXRt.exe
  2⤵
  PID:10864
- C:\Windows\System\kjxmqwQ.exe
  C:\Windows\System\kjxmqwQ.exe
  2⤵
  PID:10892
- C:\Windows\System\rEleMNH.exe
  C:\Windows\System\rEleMNH.exe
  2⤵
  PID:10920
- C:\Windows\System\tNIxEgc.exe
  C:\Windows\System\tNIxEgc.exe
  2⤵
  PID:10948
- C:\Windows\System\EgMsfAl.exe
  C:\Windows\System\EgMsfAl.exe
  2⤵
  PID:10964
- C:\Windows\System\xosfiHg.exe
  C:\Windows\System\xosfiHg.exe
  2⤵
  PID:10992
- C:\Windows\System\TKGlyEK.exe
  C:\Windows\System\TKGlyEK.exe
  2⤵
  PID:11032
- C:\Windows\System\ypRgDmR.exe
  C:\Windows\System\ypRgDmR.exe
  2⤵
  PID:11060
- C:\Windows\System\ezojjdo.exe
  C:\Windows\System\ezojjdo.exe
  2⤵
  PID:11088
- C:\Windows\System\xfMZDrW.exe
  C:\Windows\System\xfMZDrW.exe
  2⤵
  PID:11112
- C:\Windows\System\MeWQIsy.exe
  C:\Windows\System\MeWQIsy.exe
  2⤵
  PID:11144
- C:\Windows\System\XKSxcFJ.exe
  C:\Windows\System\XKSxcFJ.exe
  2⤵
  PID:11164
- C:\Windows\System\vBGZmNz.exe
  C:\Windows\System\vBGZmNz.exe
  2⤵
  PID:11200
- C:\Windows\System\aIVlbPf.exe
  C:\Windows\System\aIVlbPf.exe
  2⤵
  PID:11228
- C:\Windows\System\SBLJPPa.exe
  C:\Windows\System\SBLJPPa.exe
  2⤵
  PID:11256
- C:\Windows\System\yDAQMLN.exe
  C:\Windows\System\yDAQMLN.exe
  2⤵
  PID:10320
- C:\Windows\System\uQQgUWn.exe
  C:\Windows\System\uQQgUWn.exe
  2⤵
  PID:10340
- C:\Windows\System\WEvCmCp.exe
  C:\Windows\System\WEvCmCp.exe
  2⤵
  PID:10420
- C:\Windows\System\fMDMKWw.exe
  C:\Windows\System\fMDMKWw.exe
  2⤵
  PID:10484
- C:\Windows\System\NijOayf.exe
  C:\Windows\System\NijOayf.exe
  2⤵
  PID:10520
- C:\Windows\System\PSIilJs.exe
  C:\Windows\System\PSIilJs.exe
  2⤵
  PID:10612
- C:\Windows\System\sQuxvVt.exe
  C:\Windows\System\sQuxvVt.exe
  2⤵
  PID:10660
- C:\Windows\System\ADwIIZa.exe
  C:\Windows\System\ADwIIZa.exe
  2⤵
  PID:10720
- C:\Windows\System\kQwjnUf.exe
  C:\Windows\System\kQwjnUf.exe
  2⤵
  PID:10820
- C:\Windows\System\CpJUpTD.exe
  C:\Windows\System\CpJUpTD.exe
  2⤵
  PID:10880
- C:\Windows\System\yYAHLJL.exe
  C:\Windows\System\yYAHLJL.exe
  2⤵
  PID:10940
- C:\Windows\System\WwQNoqq.exe
  C:\Windows\System\WwQNoqq.exe
  2⤵
  PID:11008
- C:\Windows\System\OKzwOZB.exe
  C:\Windows\System\OKzwOZB.exe
  2⤵
  PID:11052
- C:\Windows\System\mOzPuLw.exe
  C:\Windows\System\mOzPuLw.exe
  2⤵
  PID:11128
- C:\Windows\System\kAJdmGL.exe
  C:\Windows\System\kAJdmGL.exe
  2⤵
  PID:11152
- C:\Windows\System\VkQUNWC.exe
  C:\Windows\System\VkQUNWC.exe
  2⤵
  PID:11216
- C:\Windows\System\xxkiZOK.exe
  C:\Windows\System\xxkiZOK.exe
  2⤵
  PID:10244
- C:\Windows\System\yvAzrWV.exe
  C:\Windows\System\yvAzrWV.exe
  2⤵
  PID:10552
- C:\Windows\System\kRABuCA.exe
  C:\Windows\System\kRABuCA.exe
  2⤵
  PID:10712
- C:\Windows\System\ZJesHwV.exe
  C:\Windows\System\ZJesHwV.exe
  2⤵
  PID:10860
- C:\Windows\System\FiofglK.exe
  C:\Windows\System\FiofglK.exe
  2⤵
  PID:10988
- C:\Windows\System\sWouiRE.exe
  C:\Windows\System\sWouiRE.exe
  2⤵
  PID:11096
- C:\Windows\System\Xbcffba.exe
  C:\Windows\System\Xbcffba.exe
  2⤵
  PID:10308
- C:\Windows\System\uHUbRYq.exe
  C:\Windows\System\uHUbRYq.exe
  2⤵
  PID:10688
- C:\Windows\System\eeHZEUU.exe
  C:\Windows\System\eeHZEUU.exe
  2⤵
  PID:10984
- C:\Windows\System\zqRaZqU.exe
  C:\Windows\System\zqRaZqU.exe
  2⤵
  PID:10452
- C:\Windows\System\OhyvyRp.exe
  C:\Windows\System\OhyvyRp.exe
  2⤵
  PID:11252
- C:\Windows\System\plwmjnL.exe
  C:\Windows\System\plwmjnL.exe
  2⤵
  PID:11272
- C:\Windows\System\abcxypM.exe
  C:\Windows\System\abcxypM.exe
  2⤵
  PID:11300
- C:\Windows\System\IpnleWk.exe
  C:\Windows\System\IpnleWk.exe
  2⤵
  PID:11328
- C:\Windows\System\kAmgSMZ.exe
  C:\Windows\System\kAmgSMZ.exe
  2⤵
  PID:11356
- C:\Windows\System\pvoaJvi.exe
  C:\Windows\System\pvoaJvi.exe
  2⤵
  PID:11384
- C:\Windows\System\RxeFcBG.exe
  C:\Windows\System\RxeFcBG.exe
  2⤵
  PID:11400
- C:\Windows\System\hSTVeuo.exe
  C:\Windows\System\hSTVeuo.exe
  2⤵
  PID:11416
- C:\Windows\System\qcehnFN.exe
  C:\Windows\System\qcehnFN.exe
  2⤵
  PID:11432
- C:\Windows\System\YmUBNDe.exe
  C:\Windows\System\YmUBNDe.exe
  2⤵
  PID:11464
- C:\Windows\System\oyniqiE.exe
  C:\Windows\System\oyniqiE.exe
  2⤵
  PID:11504
- C:\Windows\System\xJxXjIq.exe
  C:\Windows\System\xJxXjIq.exe
  2⤵
  PID:11520
- C:\Windows\System\BZnDqqB.exe
  C:\Windows\System\BZnDqqB.exe
  2⤵
  PID:11540
- C:\Windows\System\nPnIerf.exe
  C:\Windows\System\nPnIerf.exe
  2⤵
  PID:11564
- C:\Windows\System\zQWCMth.exe
  C:\Windows\System\zQWCMth.exe
  2⤵
  PID:11640
- C:\Windows\System\GEmMDEv.exe
  C:\Windows\System\GEmMDEv.exe
  2⤵
  PID:11668
- C:\Windows\System\bcUyEMa.exe
  C:\Windows\System\bcUyEMa.exe
  2⤵
  PID:11696
- C:\Windows\System\fYNltWE.exe
  C:\Windows\System\fYNltWE.exe
  2⤵
  PID:11724
- C:\Windows\System\ZEVhljc.exe
  C:\Windows\System\ZEVhljc.exe
  2⤵
  PID:11740
- C:\Windows\System\ZmFRdkl.exe
  C:\Windows\System\ZmFRdkl.exe
  2⤵
  PID:11768
- C:\Windows\System\yKDgNah.exe
  C:\Windows\System\yKDgNah.exe
  2⤵
  PID:11808
- C:\Windows\System\gmNlZyI.exe
  C:\Windows\System\gmNlZyI.exe
  2⤵
  PID:11836
- C:\Windows\System\lbNQDcV.exe
  C:\Windows\System\lbNQDcV.exe
  2⤵
  PID:11864
- C:\Windows\System\YWiBCiR.exe
  C:\Windows\System\YWiBCiR.exe
  2⤵
  PID:11892
- C:\Windows\System\SBalPam.exe
  C:\Windows\System\SBalPam.exe
  2⤵
  PID:11920
- C:\Windows\System\DjiDBdZ.exe
  C:\Windows\System\DjiDBdZ.exe
  2⤵
  PID:11948
- C:\Windows\System\MzMXSVi.exe
  C:\Windows\System\MzMXSVi.exe
  2⤵
  PID:11976
- C:\Windows\System\pDDixSj.exe
  C:\Windows\System\pDDixSj.exe
  2⤵
  PID:11992
- C:\Windows\System\ekimhXC.exe
  C:\Windows\System\ekimhXC.exe
  2⤵
  PID:12012
- C:\Windows\System\BRTwncC.exe
  C:\Windows\System\BRTwncC.exe
  2⤵
  PID:12060
- C:\Windows\System\QfjbaDk.exe
  C:\Windows\System\QfjbaDk.exe
  2⤵
  PID:12088
- C:\Windows\System\JWgyRAs.exe
  C:\Windows\System\JWgyRAs.exe
  2⤵
  PID:12116
- C:\Windows\System\XpCBodh.exe
  C:\Windows\System\XpCBodh.exe
  2⤵
  PID:12136
- C:\Windows\System\EhpMAgB.exe
  C:\Windows\System\EhpMAgB.exe
  2⤵
  PID:12168
- C:\Windows\System\tcfEKGa.exe
  C:\Windows\System\tcfEKGa.exe
  2⤵
  PID:12200
- C:\Windows\System\CaPoDZm.exe
  C:\Windows\System\CaPoDZm.exe
  2⤵
  PID:12228
- C:\Windows\System\pGcmdiD.exe
  C:\Windows\System\pGcmdiD.exe
  2⤵
  PID:12256
- C:\Windows\System\jYEpNaL.exe
  C:\Windows\System\jYEpNaL.exe
  2⤵
  PID:12284
- C:\Windows\System\ClcyqUp.exe
  C:\Windows\System\ClcyqUp.exe
  2⤵
  PID:11320
- C:\Windows\System\DmdYWty.exe
  C:\Windows\System\DmdYWty.exe
  2⤵
  PID:11376
- C:\Windows\System\FvNIPNn.exe
  C:\Windows\System\FvNIPNn.exe
  2⤵
  PID:11460
- C:\Windows\System\hwnIcYk.exe
  C:\Windows\System\hwnIcYk.exe
  2⤵
  PID:11496
- C:\Windows\System\UnHfyfc.exe
  C:\Windows\System\UnHfyfc.exe
  2⤵
  PID:11560
- C:\Windows\System\PJlgrUL.exe
  C:\Windows\System\PJlgrUL.exe
  2⤵
  PID:11636
- C:\Windows\System\fftbbaA.exe
  C:\Windows\System\fftbbaA.exe
  2⤵
  PID:11708
- C:\Windows\System\lZctYUY.exe
  C:\Windows\System\lZctYUY.exe
  2⤵
  PID:11756
- C:\Windows\System\uzaigyz.exe
  C:\Windows\System\uzaigyz.exe
  2⤵
  PID:11832
- C:\Windows\System\yOPpXoQ.exe
  C:\Windows\System\yOPpXoQ.exe
  2⤵
  PID:11904
- C:\Windows\System\cSTGnTA.exe
  C:\Windows\System\cSTGnTA.exe
  2⤵
  PID:11964
- C:\Windows\System\VyZPUWt.exe
  C:\Windows\System\VyZPUWt.exe
  2⤵
  PID:12000
- C:\Windows\System\lUhnoXj.exe
  C:\Windows\System\lUhnoXj.exe
  2⤵
  PID:12100
- C:\Windows\System\ZtkUABW.exe
  C:\Windows\System\ZtkUABW.exe
  2⤵
  PID:12152
- C:\Windows\System\nEZEjXC.exe
  C:\Windows\System\nEZEjXC.exe
  2⤵
  PID:12224
- C:\Windows\System\YlYSIEr.exe
  C:\Windows\System\YlYSIEr.exe
  2⤵
  PID:11288
- C:\Windows\System\uxAWOOR.exe
  C:\Windows\System\uxAWOOR.exe
  2⤵
  PID:11396
- C:\Windows\System\itEKjEz.exe
  C:\Windows\System\itEKjEz.exe
  2⤵
  PID:11556
- C:\Windows\System\rUyGRVM.exe
  C:\Windows\System\rUyGRVM.exe
  2⤵
  PID:11760
- C:\Windows\System\MLPadII.exe
  C:\Windows\System\MLPadII.exe
  2⤵
  PID:11888
- C:\Windows\System\imfyRRn.exe
  C:\Windows\System\imfyRRn.exe
  2⤵
  PID:12056
- C:\Windows\System\gcOZLnW.exe
  C:\Windows\System\gcOZLnW.exe
  2⤵
  PID:12184
- C:\Windows\System\lUWJEhv.exe
  C:\Windows\System\lUWJEhv.exe
  2⤵
  PID:11368
- C:\Windows\System\ATSEQsw.exe
  C:\Windows\System\ATSEQsw.exe
  2⤵
  PID:11732
- C:\Windows\System\SEfghWl.exe
  C:\Windows\System\SEfghWl.exe
  2⤵
  PID:12160
- C:\Windows\System\fCXyuvP.exe
  C:\Windows\System\fCXyuvP.exe
  2⤵
  PID:11692
- C:\Windows\System\xdzHOCL.exe
  C:\Windows\System\xdzHOCL.exe
  2⤵
  PID:12080
- C:\Windows\System\LZRBiRw.exe
  C:\Windows\System\LZRBiRw.exe
  2⤵
  PID:12308
- C:\Windows\System\UwiTdjH.exe
  C:\Windows\System\UwiTdjH.exe
  2⤵
  PID:12336
- C:\Windows\System\cvRMZAm.exe
  C:\Windows\System\cvRMZAm.exe
  2⤵
  PID:12364
- C:\Windows\System\iMpShbN.exe
  C:\Windows\System\iMpShbN.exe
  2⤵
  PID:12392
- C:\Windows\System\kIYjapN.exe
  C:\Windows\System\kIYjapN.exe
  2⤵
  PID:12432
- C:\Windows\System\UyGYKxu.exe
  C:\Windows\System\UyGYKxu.exe
  2⤵
  PID:12448
- C:\Windows\System\ewkcSWZ.exe
  C:\Windows\System\ewkcSWZ.exe
  2⤵
  PID:12476
- C:\Windows\System\JrtStmc.exe
  C:\Windows\System\JrtStmc.exe
  2⤵
  PID:12504
- C:\Windows\System\FJsScYS.exe
  C:\Windows\System\FJsScYS.exe
  2⤵
  PID:12532
- C:\Windows\System\taaMCuv.exe
  C:\Windows\System\taaMCuv.exe
  2⤵
  PID:12560
- C:\Windows\System\wvlepSm.exe
  C:\Windows\System\wvlepSm.exe
  2⤵
  PID:12588
- C:\Windows\System\tpUwXMC.exe
  C:\Windows\System\tpUwXMC.exe
  2⤵
  PID:12616
- C:\Windows\System\sxIkmfy.exe
  C:\Windows\System\sxIkmfy.exe
  2⤵
  PID:12644
- C:\Windows\System\KBudPKV.exe
  C:\Windows\System\KBudPKV.exe
  2⤵
  PID:12672
- C:\Windows\System\lGSMJUe.exe
  C:\Windows\System\lGSMJUe.exe
  2⤵
  PID:12700
- C:\Windows\System\PLFxXeT.exe
  C:\Windows\System\PLFxXeT.exe
  2⤵
  PID:12728
- C:\Windows\System\vPbHLoC.exe
  C:\Windows\System\vPbHLoC.exe
  2⤵
  PID:12756
- C:\Windows\System\HVsbXOr.exe
  C:\Windows\System\HVsbXOr.exe
  2⤵
  PID:12784
- C:\Windows\System\hpnUKAN.exe
  C:\Windows\System\hpnUKAN.exe
  2⤵
  PID:12812
- C:\Windows\System\MNWUnXV.exe
  C:\Windows\System\MNWUnXV.exe
  2⤵
  PID:12840
- C:\Windows\System\NVvPCzp.exe
  C:\Windows\System\NVvPCzp.exe
  2⤵
  PID:12868
- C:\Windows\System\ZSeWEDB.exe
  C:\Windows\System\ZSeWEDB.exe
  2⤵
  PID:12896
- C:\Windows\System\wrWmfBT.exe
  C:\Windows\System\wrWmfBT.exe
  2⤵
  PID:12924
- C:\Windows\System\RXhgnWP.exe
  C:\Windows\System\RXhgnWP.exe
  2⤵
  PID:12952
- C:\Windows\System\kULifxh.exe
  C:\Windows\System\kULifxh.exe
  2⤵
  PID:12980
- C:\Windows\System\XcZWmAe.exe
  C:\Windows\System\XcZWmAe.exe
  2⤵
  PID:13008
- C:\Windows\System\cooHCrG.exe
  C:\Windows\System\cooHCrG.exe
  2⤵
  PID:13036
- C:\Windows\System\tVucoUW.exe
  C:\Windows\System\tVucoUW.exe
  2⤵
  PID:13064
- C:\Windows\System\LAxkzxh.exe
  C:\Windows\System\LAxkzxh.exe
  2⤵
  PID:13092
- C:\Windows\System\BCdoyvr.exe
  C:\Windows\System\BCdoyvr.exe
  2⤵
  PID:13120
- C:\Windows\System\bUcCaQy.exe
  C:\Windows\System\bUcCaQy.exe
  2⤵
  PID:13148
- C:\Windows\System\EOFVoMu.exe
  C:\Windows\System\EOFVoMu.exe
  2⤵
  PID:13176
- C:\Windows\System\sFceFPZ.exe
  C:\Windows\System\sFceFPZ.exe
  2⤵
  PID:13204
- C:\Windows\System\PIRcipn.exe
  C:\Windows\System\PIRcipn.exe
  2⤵
  PID:13232
- C:\Windows\System\jYLbTQz.exe
  C:\Windows\System\jYLbTQz.exe
  2⤵
  PID:13260
- C:\Windows\System\SpDRock.exe
  C:\Windows\System\SpDRock.exe
  2⤵
  PID:13288
- C:\Windows\System\gnHCVQa.exe
  C:\Windows\System\gnHCVQa.exe
  2⤵
  PID:12300
- C:\Windows\System\ZUwDMkh.exe
  C:\Windows\System\ZUwDMkh.exe
  2⤵
  PID:12360
- C:\Windows\System\EoOZOZt.exe
  C:\Windows\System\EoOZOZt.exe
  2⤵
  PID:12416
- C:\Windows\System\dmJbmuw.exe
  C:\Windows\System\dmJbmuw.exe
  2⤵
  PID:12496
- C:\Windows\System\dtDbTkc.exe
  C:\Windows\System\dtDbTkc.exe
  2⤵
  PID:12556
- C:\Windows\System\HEdpZiL.exe
  C:\Windows\System\HEdpZiL.exe
  2⤵
  PID:12632
- C:\Windows\System\AWpwZyv.exe
  C:\Windows\System\AWpwZyv.exe
  2⤵
  PID:12684
- C:\Windows\System\rATfaio.exe
  C:\Windows\System\rATfaio.exe
  2⤵
  PID:12716
- C:\Windows\System\GDOrVVd.exe
  C:\Windows\System\GDOrVVd.exe
  2⤵
  PID:12768
- C:\Windows\System\nkjJlEt.exe
  C:\Windows\System\nkjJlEt.exe
  2⤵
  PID:12836
- C:\Windows\System\LudiYXT.exe
  C:\Windows\System\LudiYXT.exe
  2⤵
  PID:12920
- C:\Windows\System\FAnGlPo.exe
  C:\Windows\System\FAnGlPo.exe
  2⤵
  PID:13000
- C:\Windows\System\JmuMRlu.exe
  C:\Windows\System\JmuMRlu.exe
  2⤵
  PID:13080
- C:\Windows\System\IdxIbjr.exe
  C:\Windows\System\IdxIbjr.exe
  2⤵
  PID:13160
- C:\Windows\System\VtjjzKw.exe
  C:\Windows\System\VtjjzKw.exe
  2⤵
  PID:12024
- C:\Windows\System\lKkNJlr.exe
  C:\Windows\System\lKkNJlr.exe
  2⤵
  PID:13276
- C:\Windows\System\bmZoQsT.exe
  C:\Windows\System\bmZoQsT.exe
  2⤵
  PID:12356
- C:\Windows\System\hqsIrpZ.exe
  C:\Windows\System\hqsIrpZ.exe
  2⤵
  PID:12524
- C:\Windows\System\KappJnj.exe
  C:\Windows\System\KappJnj.exe
  2⤵
  PID:12752
- C:\Windows\System\KBZPlVr.exe
  C:\Windows\System\KBZPlVr.exe
  2⤵
  PID:12916
- C:\Windows\System\QyPbTck.exe
  C:\Windows\System\QyPbTck.exe
  2⤵
  PID:12964
- C:\Windows\System\nFPNsSn.exe
  C:\Windows\System\nFPNsSn.exe
  2⤵
  PID:13116
- C:\Windows\System\avMDNUG.exe
  C:\Windows\System\avMDNUG.exe
  2⤵
  PID:13256
- C:\Windows\System\RmAqGzu.exe
  C:\Windows\System\RmAqGzu.exe
  2⤵
  PID:12488
- C:\Windows\System\uyYWxOJ.exe
  C:\Windows\System\uyYWxOJ.exe
  2⤵
  PID:12808
- C:\Windows\System\IxmlXcH.exe
  C:\Windows\System\IxmlXcH.exe
  2⤵
  PID:13220
- C:\Windows\System\MqviZmR.exe
  C:\Windows\System\MqviZmR.exe
  2⤵
  PID:3120
- C:\Windows\System\xZRoRAs.exe
  C:\Windows\System\xZRoRAs.exe
  2⤵
  PID:12428
- C:\Windows\System\DGRaYnn.exe
  C:\Windows\System\DGRaYnn.exe
  2⤵
  PID:13332
- C:\Windows\System\qNJVqLi.exe
  C:\Windows\System\qNJVqLi.exe
  2⤵
  PID:13360
- C:\Windows\System\uurpvep.exe
  C:\Windows\System\uurpvep.exe
  2⤵
  PID:13388
- C:\Windows\System\fSbSPBb.exe
  C:\Windows\System\fSbSPBb.exe
  2⤵
  PID:13416
- C:\Windows\System\jhFMNyY.exe
  C:\Windows\System\jhFMNyY.exe
  2⤵
  PID:13444
- C:\Windows\System\VIZndBn.exe
  C:\Windows\System\VIZndBn.exe
  2⤵
  PID:13472
- C:\Windows\System\wqSDHjy.exe
  C:\Windows\System\wqSDHjy.exe
  2⤵
  PID:13500
- C:\Windows\System\ZSFwZkb.exe
  C:\Windows\System\ZSFwZkb.exe
  2⤵
  PID:13528
- C:\Windows\System\chTTTRX.exe
  C:\Windows\System\chTTTRX.exe
  2⤵
  PID:13556
- C:\Windows\System\aAqmrIO.exe
  C:\Windows\System\aAqmrIO.exe
  2⤵
  PID:13584
- C:\Windows\System\AjNrfcT.exe
  C:\Windows\System\AjNrfcT.exe
  2⤵
  PID:13612
- C:\Windows\System\CeHwASd.exe
  C:\Windows\System\CeHwASd.exe
  2⤵
  PID:13640
- C:\Windows\System\GzCkNxZ.exe
  C:\Windows\System\GzCkNxZ.exe
  2⤵
  PID:13668
- C:\Windows\System\oilqzqJ.exe
  C:\Windows\System\oilqzqJ.exe
  2⤵
  PID:13696
- C:\Windows\System\vMMBNRV.exe
  C:\Windows\System\vMMBNRV.exe
  2⤵
  PID:13724
- C:\Windows\System\nDDpgxv.exe
  C:\Windows\System\nDDpgxv.exe
  2⤵
  PID:13752
- C:\Windows\System\YvVLSRF.exe
  C:\Windows\System\YvVLSRF.exe
  2⤵
  PID:13780
- C:\Windows\System\KjkmwjZ.exe
  C:\Windows\System\KjkmwjZ.exe
  2⤵
  PID:13808
- C:\Windows\System\yWEDHfi.exe
  C:\Windows\System\yWEDHfi.exe
  2⤵
  PID:13836
- C:\Windows\System\tdRmhku.exe
  C:\Windows\System\tdRmhku.exe
  2⤵
  PID:13864
- C:\Windows\System\OPrGaJN.exe
  C:\Windows\System\OPrGaJN.exe
  2⤵
  PID:13892
- C:\Windows\System\XWxNiuN.exe
  C:\Windows\System\XWxNiuN.exe
  2⤵
  PID:13920
- C:\Windows\System\UsPDSiN.exe
  C:\Windows\System\UsPDSiN.exe
  2⤵
  PID:13948
- C:\Windows\System\spYbxns.exe
  C:\Windows\System\spYbxns.exe
  2⤵
  PID:13976
- C:\Windows\System\QavQJpZ.exe
  C:\Windows\System\QavQJpZ.exe
  2⤵
  PID:14004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_dn5xjbu4.0zu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dn5xjbu4.0zu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AMrAHVH.exe

Path C:\Windows\System\AMrAHVH.exe
Size 3.0MB
SHA256 b418d046c352658c2a89c7c4a0657119c7c7de72b8fd64a0522bc1e7655169d6
MD5 fc71bd141e1f62d8bff0e007a8e36c4b
SHA1 1b43f3a1d66c99afb345bbb62c7b10e5d5aa5af3
SHA512 8fb5135d843ed130ce3eff42c1a7397d8c56d58cecf1c80d4d916ee76d312a17d7b7357f3902c922bca7d4ddacbc5683364b4ea24483154a3f4ddc4dcede67bc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

CnGSugQ.exe

Path C:\Windows\System\CnGSugQ.exe
Size 3.0MB
SHA256 14cc0a1e67796f522af9096a0367c6b2600d7abea1646f8a21cf7a04553a9764
MD5 d03cd50634ad1eb8c7746e7fce300dca
SHA1 b7f79dd74a3230c19adefee19102b8771ca29aed
SHA512 bd05e6b09b5ac6d115d3068164dee49b9f0f9014753ed3a4c5aea48d3f938d42cf9386993b304958fe4e1ae5f95a4d90e53d3a0101eb194f395884e33943faf7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWk:7bBeSFkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

KOiylQN.exe

Path C:\Windows\System\KOiylQN.exe
Size 3.0MB
SHA256 3ebb4a3d62d35550a5e5f126044b3b0ff2ca3abf1c61ca42617706a5bb1a6643
MD5 71f796b18ed98762493f1f7c9c1a0a62
SHA1 d42de76d17d675bec07320b25710917018496f49
SHA512 c2937e0db03555fc5d4f48ccaadda253178578bd4f1ad2ed61810ffeef7d883beaeff3220b37f496d4207417a4a52a38eba743e8521ca0c13b13520048adf98b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYIATsE.exe

Path C:\Windows\System\LYIATsE.exe
Size 3.0MB
SHA256 7a69c652ba6b39066415d84d1b76b190e5f97f07a9014e5626b03e00b206ad39
MD5 870904ad34fca6f5dba6763056215ea0
SHA1 dc430ca15e5c529b6175ae6bb00427f6a5467a31
SHA512 346259cd668a6d8cf34167db0d2917f267ceec37f37a4ab4b4e2520ef041f7ffbe5f64126b530b5ed8bef6759e1d36d60ae76eccf563e25653281c37ca9fa581
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:7bBeSFkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OAXOoIK.exe

Path C:\Windows\System\OAXOoIK.exe
Size 3.0MB
SHA256 193a4676a3a255403bf65d7497fffbf3ebad22cda5e6d2c501510027f99d4f1c
MD5 476470c0fef2d59785ad5a814c3b7320
SHA1 6aad750ca8957f45dd0658f89eb196b9b494eca9
SHA512 e0a371e215823d6e25dd3ad6cef2f1b63f4f275b1fe2a08b26eb90a291d2218902a7591c2b76048efe01d3a494091be5cf3beea41d6b04974bca4115a30c9dc1
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWK:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

OcjtUpM.exe

Path C:\Windows\System\OcjtUpM.exe
Size 3.0MB
SHA256 14847f7bde6ba3543d8ca2e2c05bb1be3b18179d54580c824fc55ceb60ed7bfb
MD5 fbac8243405f37b71e87bf615acc19de
SHA1 b3fca77e488188a5075818b6c5bf65fdeafbd42a
SHA512 473f67c827c59d51a8299f0fe3caa0dfc6c631e487b46804b93d761499af4e603553da07915681082a372ff1f829b70d0c3d4e71ee934527d04c0f2e26564dbc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:7bBeSFkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYtkHSW.exe

Path C:\Windows\System\QYtkHSW.exe
Size 3.0MB
SHA256 21d26de0543c92ad6b49a786c2e174e03e60f9430e1360a90266bd01d859cd6d
MD5 29c23c63bae061404a87b91f3cc419b6
SHA1 17fff963dfe6cf59043976661ef895798eb4a22c
SHA512 475e907c4d78e1c7e7d31fcad2dc047b4d9a5ce174e4c3b0698fbe147642d108730bedad67ed80a865c9b0d89386ebcb6de0c3e3d081abaa0c6f460321d0d50f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:7bBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuZstMW.exe

Path C:\Windows\System\QuZstMW.exe
Size 3.0MB
SHA256 5992aa95e50df9ff355b39ab6fbcd8dcb912f76b1c6184cbeb2ba3c9014a460b
MD5 782c4eaef816ddb9cba00270116c8a8d
SHA1 330a255c2b294e45909bb0fbc6d851a4b23655d4
SHA512 4782bc50ce453b11b6d8228b1c3b457003cc3d8b98696eb807473d01ccb89813ba052cbafb1504fdc207b74e46b19572202651104e1ec1bc06cbab172aec317e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StcBCdY.exe

Path C:\Windows\System\StcBCdY.exe
Size 3.0MB
SHA256 eab799e365198ab48950b13d5df28c8d302551d9eb66c75b764bc6ae55e085eb
MD5 acde851dad40d553b689d85d69070579
SHA1 4e6c02c4e025f0e99aab0b4d1e2657e75dce24df
SHA512 e5af4982169a083495807179fc69271ca8cb3028c8372686ab6d679a10f5e14536ada30581d34a2d61a02784714555343be5d436208497233335e262d12369df
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:7bBeSFkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SwJnvrG.exe

Path C:\Windows\System\SwJnvrG.exe
Size 3.0MB
SHA256 3df69a6900ace20231217b4fbda77ecd12c02a544e18bf6b6fca7d03490afbbd
MD5 abd21a7a5c5528b2cd03bc32452752b4
SHA1 2fa8265f0d7a108557f6ef60f21a219b094b5c03
SHA512 0eeb973543377baf7c7a4488982a268a1eb8efd564fec53202aec5a109505076611f14b7347e64d08cb0ae4fae989708318ccd8549cad73d977914ca7f8fd646
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

TBiYKlq.exe

Path C:\Windows\System\TBiYKlq.exe
Size 3.0MB
SHA256 383042871d79f51f0cbfd4f5287eee6b073e943f32dd79158e4a560e38b71a89
MD5 0b6b4c1d24e6217bdd353bfb1fe418e8
SHA1 6e6c799862d28450932f869a9c7690238028572a
SHA512 029d7105b096f9726418003039bd18edaedf4f24541fb976acaef076a9df6f3cc1e8979dbcc019686f8b998917928c9e7ac9207a16cfee9a67cb1f0b5c0f330c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

UGMNAWX.exe

Path C:\Windows\System\UGMNAWX.exe
Size 3.0MB
SHA256 a4dacc8df2c35448a7d1c018f423eaede449968725bbd85a0f6bd53627f4376e
MD5 98100d79a98cd446a33ead4472041ae3
SHA1 42d796eea2a779486c3f5cfbc85af70eb621b90b
SHA512 cbd6d510d96e1b600a61279eed9edf14340b80cac04bbdd528a1122f7dc80356bf0d56bc768f56365f355c1230ee456709d377fb60a0233c3c3ce3f02ea26723
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

UUrufxu.exe

Path C:\Windows\System\UUrufxu.exe
Size 3.0MB
SHA256 401a4a364298e863a9e1bd4fe232c621c9235f7b95f203de0f4ab38f5c9524e2
MD5 97502394e42dc89ae7aa942c963b38b6
SHA1 6bb1f29417d4a95614beea59d27f126ada00030a
SHA512 c8571c7eaadb6e3333bcf693454ad3e4f05f8c42ca06f3f8dc8662db454326e8cdfb8dca79c2e895869efbc84f999a2ecf5229efe4ee94ae738cbf68b85d46df
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

UeKkWWg.exe

Path C:\Windows\System\UeKkWWg.exe
Size 3.0MB
SHA256 9675ffd18ea56bbe5da39c3f220d2f83052ed2122430de466342bb5bd94c82c4
MD5 49d9849ae3795103eed13fb82a35b578
SHA1 ed0d17058b8680a421f4d5f42c091708cf0dc0d3
SHA512 7e526e568441abb4f8120a58f8d1bf0369a570b39056155b5bea1a45533b80093a3a66c27d03a0594372d168694d7e4816081f9b1bf58493f436710734a355ae
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

UsgJZAU.exe

Path C:\Windows\System\UsgJZAU.exe
Size 3.0MB
SHA256 23d2a4f0a66c3821320eec2d628ad7825eb6d0ed82fa9eb5c6afd5c1d81b141b
MD5 737a68e309ce4408b19fa8edb60547ba
SHA1 99998aedb03e49ada862af7719ca02a49e963c07
SHA512 4cbe8c12a5be95f2bf44b5b1bc0c8e2ea05630470a3a4e3e7f365187290ce330712720cef72dcf0dc1c3965bb8499b4ef326472c89d1de95115483bf661caec9
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VxjNpLl.exe

Path C:\Windows\System\VxjNpLl.exe
Size 3.0MB
SHA256 03b966185caaead6e579081a1ed9263c0322e888e2bc0878940e590808c894f0
MD5 8c0a088d55a361d542d883c6a4c4cad4
SHA1 d2d770dedde6ab8061ae03e1f7c0ae31d4326a90
SHA512 10b5f47d4b8063d7e967e1a06d837fe9d70fc521660adeaa2e7f636d360415c7a1ccda0ac0ce031c26295e5e1f1bd31df990da68e927345fc9aff0c72fcea57b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

YiovZBw.exe

Path C:\Windows\System\YiovZBw.exe
Size 3.0MB
SHA256 c29b1124dcbc7956ba79452a9d410a8c248f154b475aba237990201d8e9cbf4f
MD5 b5b03811cadbc6517717312a579ba5fe
SHA1 b5bf0525d8dc1daf7cd64cfb1bfa3cedced0e3f3
SHA512 42fa15ecf67943e6fb13fcae0e73bfe951afa499c62fe8d4477cab90dbae34703e746a2b1cebbaaa26ef34797a1c0e1665af84d490e98196dd0ca96990027e75
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aXURmdt.exe

Path C:\Windows\System\aXURmdt.exe
Size 3.0MB
SHA256 87b4492794ac12f5d4e705ed6324a37c73bb0535def0a265309dfece26057f6a
MD5 cb5d5b74cb2517d9a6c7811ff0ed7694
SHA1 b7f05b766a5bfae90083638c7049f2b6033cfdc4
SHA512 bb178f64212bc7cde7a333fe552a9c530b99ded57e1a1c1a4a4c573849092f0390a9c2a7048535bb2b462bf344c5590130dd60c6ef13e5c507b334a00eb4cf1e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:7bBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

adaofPE.exe

Path C:\Windows\System\adaofPE.exe
Size 3.0MB
SHA256 f317cabae2ea703f96028e5af7bc359b92cdbd8b4244bfc731265e23831ea1f2
MD5 7e8b87d503f168b4156f0ef72317e8e3
SHA1 c3ab5db1c1619ba3784556383969fd9cb7444378
SHA512 34151a0df41a1f81646934ecf5f1c898a3e5c2e9c2dfc3c870c651fca2748b75dd64f009821c878437e295be62106ca646a673f2e7b014384c641eb71afc2d2d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWK:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dDTMtbo.exe

Path C:\Windows\System\dDTMtbo.exe
Size 3.0MB
SHA256 5c13f5bf3ca62999aa2cc0ab430ade70fa2fc290d4d569f57a83d1dbcb2eaac7
MD5 c6bba6d60bfaa1e609a3dbc854972720
SHA1 c41c7d86277f05a559faca7565b45e21dc42a6a5
SHA512 d7578b5bd189d89ecef7bc793129545121d930b130ab52484d2d71563cb8850c66f5623778882505c62e2fbd23e2b5e9681b057baf6fa390ee3f4409a48a7d05
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW6:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

garhfzC.exe

Path C:\Windows\System\garhfzC.exe
Size 3.0MB
SHA256 29122c1b3dd722d47bdeb1a4849471ce476484114dfb9beefb7fff71c842268f
MD5 c9579f26e983f0d77dc8900c43543c96
SHA1 5f25bae7676ae491afd75930e4316b38b4fc63a1
SHA512 a9db702e022ee7550529590945b7281e63f0b8ac614e57bdca861101184677abf1bf30a133a9d9a40fbaf37cca15c7325ba093aef6f5f35588655f1e6151b80b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmptRSV.exe

Path C:\Windows\System\gmptRSV.exe
Size 3.0MB
SHA256 d98322aaa1881251ac4e9c46ceb892e626938e8b84aad66ea2770a769226f357
MD5 514acbbb3993ae0fcd32107d8312f7e9
SHA1 6a28920a7c9c758543272ea84caf390663855848
SHA512 ecb251c0dcc00743b9d9654ec355461f05a88d94e3ab66d94e5c9f097ffbe0b76b002a1f92de758202be5ffc610d0cdf6e7a3d4fe2817ad66f701db77bd2f4ca
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:7bBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

hQwoXvU.exe

Path C:\Windows\System\hQwoXvU.exe
Size 3.0MB
SHA256 6a645cdebe44e7e6ace5b2f100e6fa65487cfa511eb2083a068d458cf288ae84
MD5 515387e385ec3158d9acefdc9fb29d97
SHA1 c70b83cd0f501988befe2c2e3fac71d4aae1996e
SHA512 651f855c34dfb45f57b14e4bb9480c70d7ca68194915ccafd517d5ffe8ba5dd24573aff6adfc0690bf0e1d46e23a0406c8235f6fe80c5f80bc375aa5cb742f17
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

itmrirp.exe

Path C:\Windows\System\itmrirp.exe
Size 3.0MB
SHA256 ad56b085f36624b55bee6425e268935e99958a58a9461bbff90a80177b4400a7
MD5 a654efce111501de4b593372f0f74478
SHA1 5d353904d44e209b39f2185d8ae30c0c8ceb6e7c
SHA512 29326723b1c0fa3d619c1d77e314b0b0be1173a36643e05f847a53179bc2290ded76d6b19558631acf43c6a53bb2e56fca879e807c808bfbb91eecf21ce0c1c6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

mQPheEp.exe

Path C:\Windows\System\mQPheEp.exe
Size 3.0MB
SHA256 427cdad01e9b12dceff2e751b8ba561a0e5a3193d058c106038b8ff21037f548
MD5 3231eede01a72ed7923c44010f6b09fa
SHA1 9d5be81ffdcb86124acc20adb2e13faf093775e8
SHA512 25cc18ebf2df39487f1a665fb886d6a0e706b4669616661d46bfdb0a7c1cfc98aeeb8d6236f164cf439a327ab00acc8a40851e8b696c7f3378b9a1cfb9cba47c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:7bBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmXoeFn.exe

Path C:\Windows\System\mmXoeFn.exe
Size 3.0MB
SHA256 8d183039c896a1abb8d398604bbaa29d6a4aaea2e76ca80026df772e8a295cd8
MD5 2fb50a0af88dfaa857cd610dd2edcf24
SHA1 9c7141a04c9cc4b8e954230de0b7f79eaa93f5cd
SHA512 1491c7e34e88b53d85aef98c96670bc514cc601400e8e1d99470e53b36a878b53ac8a681be16c36ed3ca662807738221fd12dc21ddf342d49a5e4a0ad224f073
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWe:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

pFHpqSA.exe

Path C:\Windows\System\pFHpqSA.exe
Size 3.0MB
SHA256 4f08a2380288a251cd7351edad8d8cf100d8a6b1913dce5dc1254e22fcea482a
MD5 6a40890f816f237642aac3ba3f6eb0c7
SHA1 bf3a3cf1332cec98b66e5e6aaccb490924e75211
SHA512 b8b8c0f5d92a43a5804b1cdcc541cfd9c4ac5a0000e5dd0302a06ba9f8a601780d79f43ecf753e81d9b5898047fba4f769222ae76218bfe97d20d2f57bac422b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

tORejMy.exe

Path C:\Windows\System\tORejMy.exe
Size 3.0MB
SHA256 1c8c9278c46c848f510ce499e59a6f00df70db6ba48675a9644a8cdefbf2d063
MD5 cd0c15d1105770b95e6a614cb4194bc2
SHA1 9f53f913a0e8ddfaae1633e40aa37dc2711e546c
SHA512 4450a0d942903b26888f1c559d0267e83f4a2098ec9dbfd395647937e674667c111e82cd8b2b8bbba89a721d24b26011640705e06cd55e849afe4c4b5398dff7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

vqoqUKg.exe

Path C:\Windows\System\vqoqUKg.exe
Size 3.0MB
SHA256 3271188eaff5f79c6de3a08acb3c818f8046a929f9fbe1abba5a7ea65c820eae
MD5 32b782d54599f1ed7f1aa90a47c36e75
SHA1 da05f8d4aaf61514b127ab4048f3b2ce4bc63138
SHA512 de0df95557801a1d8951577a13fbd4501a3291150fb5ba6eb756bff0b286e7a533cb47ab41cedf171bc7b49770ef26e901a9001c54441e2642ad25c4830816db
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wRMSBhe.exe

Path C:\Windows\System\wRMSBhe.exe
Size 3.0MB
SHA256 15cf57ebbe2faf6874346e828ab8d12f4f7e7ee0fc016f8ddc1ed272ead1e2ad
MD5 c23ff9462d1dbe4dba814186b1e43964
SHA1 dfbd5417993b166b6b42c75076463d261bebab99
SHA512 56fa3ac0ac0a372a042f11ea81ad2351dc3255b7c973e9fdf1aeaa2f4abbd1e0c05a9a584065c5e23d431ed46851aa252e2025af7e39658aef461d0a60d0c9c5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfWnODh.exe

Path C:\Windows\System\wfWnODh.exe
Size 3.0MB
SHA256 4b606f32fa66f5e6a73cf414eb76caf3a4763aae518b7b99c015425e40588746
MD5 6407f523b02cfd555e1ed0b95865a864
SHA1 fac5901c92605f937036339b61e0baf4516edccb
SHA512 b2a105d115c7b0e2f3ab9b24c14a4ae85452b6db01be51a5049e0756a8e761c5ab3f6519413b0d3df2179a9a4a67ad0f1f9f2cd5395514d73db46fdd942f4a35
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xBaFqOG.exe

Path C:\Windows\System\xBaFqOG.exe
Size 3.0MB
SHA256 c55a21000f04b6e02207596f051b22fd7f20107b4bbacd4970a947f5ce107c3b
MD5 029115ebbe7c9fa2e4fe856759f8321a
SHA1 13f2fd16242c3d8363da7c02767a2916a26699ce
SHA512 d4a3c2896f335671ba2565018536420cf0f8d86a9254a112b8032ce28a0d83ed8bd94d9cc6504c9f598dfac7ed6a22dcbee983aab93b83b83ee16c8be93cbf88
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/772-8-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp

Download

memory/772-662-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp

Download

memory/772-2001-0x00007FF6E9040000-0x00007FF6E9436000-memory.dmp

Download

memory/1268-2012-0x00007FF7C1270000-0x00007FF7C1666000-memory.dmp

Download

memory/1268-112-0x00007FF7C1270000-0x00007FF7C1666000-memory.dmp

Download

memory/1448-115-0x00007FF6DCF40000-0x00007FF6DD336000-memory.dmp

Download

memory/1448-2014-0x00007FF6DCF40000-0x00007FF6DD336000-memory.dmp

Download

memory/1640-1-0x000001957E340000-0x000001957E350000-memory.dmp

Download

memory/1640-418-0x00007FF7DD970000-0x00007FF7DDD66000-memory.dmp

Download

memory/1640-0-0x00007FF7DD970000-0x00007FF7DDD66000-memory.dmp

Download

memory/1644-2010-0x00007FF661590000-0x00007FF661986000-memory.dmp

Download

memory/1644-110-0x00007FF661590000-0x00007FF661986000-memory.dmp

Download

memory/1780-117-0x00007FF6A6780000-0x00007FF6A6B76000-memory.dmp

Download

memory/1780-2015-0x00007FF6A6780000-0x00007FF6A6B76000-memory.dmp

Download

memory/2100-122-0x00007FF7C5E00000-0x00007FF7C61F6000-memory.dmp

Download

memory/2100-2006-0x00007FF7C5E00000-0x00007FF7C61F6000-memory.dmp

Download

memory/2276-2004-0x00007FF76AE20000-0x00007FF76B216000-memory.dmp

Download

memory/2276-33-0x00007FF76AE20000-0x00007FF76B216000-memory.dmp

Download

memory/2280-2002-0x00007FF654D60000-0x00007FF655156000-memory.dmp

Download

memory/2280-14-0x00007FF654D60000-0x00007FF655156000-memory.dmp

Download

memory/2280-942-0x00007FF654D60000-0x00007FF655156000-memory.dmp

Download

memory/2616-158-0x00007FF625710000-0x00007FF625B06000-memory.dmp

Download

memory/2616-2021-0x00007FF625710000-0x00007FF625B06000-memory.dmp

Download

memory/3756-2022-0x00007FF67A570000-0x00007FF67A966000-memory.dmp

Download

memory/3756-151-0x00007FF67A570000-0x00007FF67A966000-memory.dmp

Download

memory/3756-1999-0x00007FF67A570000-0x00007FF67A966000-memory.dmp

Download

memory/3964-2020-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp

Download

memory/3964-130-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp

Download

memory/3964-1785-0x00007FF61B100000-0x00007FF61B4F6000-memory.dmp

Download

memory/3968-61-0x00000160CE440000-0x00000160CE462000-memory.dmp

Download

memory/3968-49-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp

Download

memory/3968-46-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp

Download

memory/3968-35-0x00007FFCBBCD3000-0x00007FFCBBCD5000-memory.dmp

Download

memory/3968-948-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp

Download

memory/3968-1097-0x00007FFCBBCD0000-0x00007FFCBC791000-memory.dmp

Download

memory/3976-2000-0x00007FF764700000-0x00007FF764AF6000-memory.dmp

Download

memory/3976-2024-0x00007FF764700000-0x00007FF764AF6000-memory.dmp

Download

memory/3976-161-0x00007FF764700000-0x00007FF764AF6000-memory.dmp

Download

memory/4216-145-0x00007FF61D690000-0x00007FF61DA86000-memory.dmp

Download

memory/4216-2019-0x00007FF61D690000-0x00007FF61DA86000-memory.dmp

Download

memory/4348-109-0x00007FF6CDFA0000-0x00007FF6CE396000-memory.dmp

Download

memory/4348-2008-0x00007FF6CDFA0000-0x00007FF6CE396000-memory.dmp

Download

memory/4368-118-0x00007FF627160000-0x00007FF627556000-memory.dmp

Download

memory/4368-2016-0x00007FF627160000-0x00007FF627556000-memory.dmp

Download

memory/4436-1998-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp

Download

memory/4436-140-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp

Download

memory/4436-2023-0x00007FF65C1A0000-0x00007FF65C596000-memory.dmp

Download

memory/4700-123-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp

Download

memory/4700-2009-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp

Download

memory/4704-116-0x00007FF76BFA0000-0x00007FF76C396000-memory.dmp

Download

memory/4704-2013-0x00007FF76BFA0000-0x00007FF76C396000-memory.dmp

Download

memory/4752-26-0x00007FF7FFBD0000-0x00007FF7FFFC6000-memory.dmp

Download

memory/4752-2003-0x00007FF7FFBD0000-0x00007FF7FFFC6000-memory.dmp

Download

memory/4804-2018-0x00007FF74DB00000-0x00007FF74DEF6000-memory.dmp

Download

memory/4804-120-0x00007FF74DB00000-0x00007FF74DEF6000-memory.dmp

Download

memory/4832-64-0x00007FF729200000-0x00007FF7295F6000-memory.dmp

Download

memory/4832-2007-0x00007FF729200000-0x00007FF7295F6000-memory.dmp

Download

memory/4868-111-0x00007FF7E3CD0000-0x00007FF7E40C6000-memory.dmp

Download

memory/4868-2011-0x00007FF7E3CD0000-0x00007FF7E40C6000-memory.dmp

Download

memory/4908-2005-0x00007FF7C2270000-0x00007FF7C2666000-memory.dmp

Download

memory/4908-121-0x00007FF7C2270000-0x00007FF7C2666000-memory.dmp

Download

memory/5092-2017-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp

Download

memory/5092-119-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp

Download