xmrig | 707940678f3f0277a841c204aabb0b1e2684ea91aa2c7b889525c7d75fd6d6be

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
Size 3.1MB
Sample240613-dqgabawcmp
SHA256 707940678f3f0277a841c204aabb0b1e2684ea91aa2c7b889525c7d75fd6d6be
MD5 59db99fcacee5284195617846aa0c030
SHA1 00495169cb8645fdf8381a8687a2efcefc7e75d6
SHA512 12717a873c18870e67de9b3fa260d6eb073dcd79a7277d6dbcd771b4175aabe3af31bd35a2b470ce59378873b86bd14065eb614d5fbc1e49a07f5a58aae90988
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:7bBeSFkz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2696-0-0x00007FF7EB150000-0x00007FF7EB546000-memory.dmp	xmrig
behavioral2/files/0x0007000000023278-6.dat	xmrig
behavioral2/files/0x0007000000023400-8.dat	xmrig
behavioral2/files/0x00080000000233fc-11.dat	xmrig
behavioral2/files/0x0007000000023401-26.dat	xmrig
behavioral2/files/0x0007000000023406-45.dat	xmrig
behavioral2/files/0x0007000000023402-48.dat	xmrig
behavioral2/files/0x0008000000023404-59.dat	xmrig
behavioral2/files/0x0007000000023407-65.dat	xmrig
behavioral2/memory/2404-67-0x00007FF64D5F0000-0x00007FF64D9E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-74.dat	xmrig
behavioral2/files/0x000700000002340a-81.dat	xmrig
behavioral2/files/0x00080000000233fd-94.dat	xmrig
behavioral2/files/0x000700000002340d-108.dat	xmrig
behavioral2/files/0x000700000002340e-110.dat	xmrig
behavioral2/files/0x000700000002340c-103.dat	xmrig
behavioral2/files/0x000700000002340f-115.dat	xmrig
behavioral2/files/0x0007000000023412-129.dat	xmrig
behavioral2/files/0x000700000002341b-178.dat	xmrig
behavioral2/memory/2168-622-0x00007FF6D7660000-0x00007FF6D7A56000-memory.dmp	xmrig
behavioral2/memory/3496-623-0x00007FF6339C0000-0x00007FF633DB6000-memory.dmp	xmrig
behavioral2/memory/3468-624-0x00007FF7973F0000-0x00007FF7977E6000-memory.dmp	xmrig
behavioral2/memory/5004-625-0x00007FF67A4A0000-0x00007FF67A896000-memory.dmp	xmrig
behavioral2/memory/3488-626-0x00007FF63F590000-0x00007FF63F986000-memory.dmp	xmrig
behavioral2/memory/3636-627-0x00007FF679600000-0x00007FF6799F6000-memory.dmp	xmrig
behavioral2/memory/2184-628-0x00007FF6645B0000-0x00007FF6649A6000-memory.dmp	xmrig
behavioral2/memory/1892-629-0x00007FF745BF0000-0x00007FF745FE6000-memory.dmp	xmrig
behavioral2/memory/2176-630-0x00007FF6F5AD0000-0x00007FF6F5EC6000-memory.dmp	xmrig
behavioral2/memory/1792-632-0x00007FF75B570000-0x00007FF75B966000-memory.dmp	xmrig
behavioral2/memory/4760-631-0x00007FF750C40000-0x00007FF751036000-memory.dmp	xmrig
behavioral2/memory/2528-634-0x00007FF7C8A70000-0x00007FF7C8E66000-memory.dmp	xmrig
behavioral2/memory/3828-633-0x00007FF764470000-0x00007FF764866000-memory.dmp	xmrig
behavioral2/memory/3344-636-0x00007FF7558C0000-0x00007FF755CB6000-memory.dmp	xmrig
behavioral2/memory/5116-637-0x00007FF7FDED0000-0x00007FF7FE2C6000-memory.dmp	xmrig
behavioral2/memory/1736-635-0x00007FF71B950000-0x00007FF71BD46000-memory.dmp	xmrig
behavioral2/memory/1720-638-0x00007FF64E150000-0x00007FF64E546000-memory.dmp	xmrig
behavioral2/memory/4080-639-0x00007FF732FE0000-0x00007FF7333D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-182.dat	xmrig
behavioral2/files/0x000700000002341a-173.dat	xmrig
behavioral2/files/0x0007000000023419-168.dat	xmrig
behavioral2/files/0x0007000000023418-163.dat	xmrig
behavioral2/files/0x0007000000023417-158.dat	xmrig
behavioral2/files/0x0007000000023416-153.dat	xmrig
behavioral2/files/0x0007000000023415-145.dat	xmrig
behavioral2/files/0x0007000000023414-142.dat	xmrig
behavioral2/files/0x0007000000023413-138.dat	xmrig
behavioral2/files/0x0007000000023411-127.dat	xmrig
behavioral2/files/0x0007000000023410-120.dat	xmrig
behavioral2/files/0x000700000002340b-92.dat	xmrig
behavioral2/files/0x0007000000023409-88.dat	xmrig
behavioral2/memory/1388-84-0x00007FF6FA540000-0x00007FF6FA936000-memory.dmp	xmrig
behavioral2/memory/4852-76-0x00007FF617960000-0x00007FF617D56000-memory.dmp	xmrig
behavioral2/memory/2680-62-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp	xmrig
behavioral2/memory/4844-60-0x00007FF6F8A40000-0x00007FF6F8E36000-memory.dmp	xmrig
behavioral2/files/0x0008000000023405-52.dat	xmrig
behavioral2/files/0x0007000000023403-46.dat	xmrig
behavioral2/memory/1812-9-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp	xmrig
behavioral2/memory/1812-1932-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp	xmrig
behavioral2/memory/3828-1933-0x00007FF764470000-0x00007FF764866000-memory.dmp	xmrig
behavioral2/memory/1812-1934-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp	xmrig
behavioral2/memory/4844-1935-0x00007FF6F8A40000-0x00007FF6F8E36000-memory.dmp	xmrig
behavioral2/memory/2528-1936-0x00007FF7C8A70000-0x00007FF7C8E66000-memory.dmp	xmrig
behavioral2/memory/2680-1937-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp	xmrig
behavioral2/memory/2404-1938-0x00007FF64D5F0000-0x00007FF64D9E6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1812	ShDBStn.exe
3828	VtECtzB.exe
4844	CjOQXmx.exe
2528	xLKncPx.exe
2680	LRQcqhU.exe
2404	eUVhgCv.exe
4852	xINRWEV.exe
1736	tSadGaZ.exe
1388	FRpUZXw.exe
3344	URBtihP.exe
5116	YLRirYt.exe
2168	PZiicjG.exe
1720	KuOHGMi.exe
4080	xvCtfRy.exe
3496	oGuToHv.exe
3468	OonzyzC.exe
5004	Ojcmrxj.exe
3488	ESiwQjD.exe
3636	VMIyNMW.exe
2184	KiLDxCB.exe
1892	RSzPDQi.exe
2176	CUzEZxw.exe
4760	xlkMiFp.exe
1792	ENlrUcj.exe
1064	LGdnJoR.exe
1208	GHUTPWB.exe
2196	XVUnqtZ.exe
1976	oIoqgTw.exe
3592	HVcZDyS.exe
3724	vHSIyyd.exe
1848	AkXMJgs.exe
1156	pwHlcAq.exe
3848	MCmkQVi.exe
4012	OQnouZI.exe
540	itjsVQN.exe
3644	gZmDEZj.exe
2356	anHTmIG.exe
4808	vqeHDCp.exe
2396	YAXjPdD.exe
4624	HLWZImP.exe
4244	iHVScrz.exe
736	zoZttjF.exe
4084	QzGUKGw.exe
3656	zrzZLko.exe
1492	GyWSIwM.exe
1244	BdmCHxi.exe
3696	PJeUEit.exe
4376	sAcmuXr.exe
4360	gRqSDqA.exe
4492	LcgGVbS.exe
3124	MFkbUOy.exe
3648	CuiFcbi.exe
3372	ltZcOFh.exe
3280	GlYEEwY.exe
4004	mCTXzpp.exe
4252	IMTbuLY.exe
1088	gfTUggD.exe
3732	QfGZjtH.exe
4168	NCtolUr.exe
5076	MtXRKkU.exe
2956	BOCkKBj.exe
992	AWXuXRO.exe
3032	iUaSbJM.exe
4752	miFMlms.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2696-0-0x00007FF7EB150000-0x00007FF7EB546000-memory.dmp	upx
behavioral2/files/0x0007000000023278-6.dat	upx
behavioral2/files/0x0007000000023400-8.dat	upx
behavioral2/files/0x00080000000233fc-11.dat	upx
behavioral2/files/0x0007000000023401-26.dat	upx
behavioral2/files/0x0007000000023406-45.dat	upx
behavioral2/files/0x0007000000023402-48.dat	upx
behavioral2/files/0x0008000000023404-59.dat	upx
behavioral2/files/0x0007000000023407-65.dat	upx
behavioral2/memory/2404-67-0x00007FF64D5F0000-0x00007FF64D9E6000-memory.dmp	upx
behavioral2/files/0x0007000000023408-74.dat	upx
behavioral2/files/0x000700000002340a-81.dat	upx
behavioral2/files/0x00080000000233fd-94.dat	upx
behavioral2/files/0x000700000002340d-108.dat	upx
behavioral2/files/0x000700000002340e-110.dat	upx
behavioral2/files/0x000700000002340c-103.dat	upx
behavioral2/files/0x000700000002340f-115.dat	upx
behavioral2/files/0x0007000000023412-129.dat	upx
behavioral2/files/0x000700000002341b-178.dat	upx
behavioral2/memory/2168-622-0x00007FF6D7660000-0x00007FF6D7A56000-memory.dmp	upx
behavioral2/memory/3496-623-0x00007FF6339C0000-0x00007FF633DB6000-memory.dmp	upx
behavioral2/memory/3468-624-0x00007FF7973F0000-0x00007FF7977E6000-memory.dmp	upx
behavioral2/memory/5004-625-0x00007FF67A4A0000-0x00007FF67A896000-memory.dmp	upx
behavioral2/memory/3488-626-0x00007FF63F590000-0x00007FF63F986000-memory.dmp	upx
behavioral2/memory/3636-627-0x00007FF679600000-0x00007FF6799F6000-memory.dmp	upx
behavioral2/memory/2184-628-0x00007FF6645B0000-0x00007FF6649A6000-memory.dmp	upx
behavioral2/memory/1892-629-0x00007FF745BF0000-0x00007FF745FE6000-memory.dmp	upx
behavioral2/memory/2176-630-0x00007FF6F5AD0000-0x00007FF6F5EC6000-memory.dmp	upx
behavioral2/memory/1792-632-0x00007FF75B570000-0x00007FF75B966000-memory.dmp	upx
behavioral2/memory/4760-631-0x00007FF750C40000-0x00007FF751036000-memory.dmp	upx
behavioral2/memory/2528-634-0x00007FF7C8A70000-0x00007FF7C8E66000-memory.dmp	upx
behavioral2/memory/3828-633-0x00007FF764470000-0x00007FF764866000-memory.dmp	upx
behavioral2/memory/3344-636-0x00007FF7558C0000-0x00007FF755CB6000-memory.dmp	upx
behavioral2/memory/5116-637-0x00007FF7FDED0000-0x00007FF7FE2C6000-memory.dmp	upx
behavioral2/memory/1736-635-0x00007FF71B950000-0x00007FF71BD46000-memory.dmp	upx
behavioral2/memory/1720-638-0x00007FF64E150000-0x00007FF64E546000-memory.dmp	upx
behavioral2/memory/4080-639-0x00007FF732FE0000-0x00007FF7333D6000-memory.dmp	upx
behavioral2/files/0x000700000002341c-182.dat	upx
behavioral2/files/0x000700000002341a-173.dat	upx
behavioral2/files/0x0007000000023419-168.dat	upx
behavioral2/files/0x0007000000023418-163.dat	upx
behavioral2/files/0x0007000000023417-158.dat	upx
behavioral2/files/0x0007000000023416-153.dat	upx
behavioral2/files/0x0007000000023415-145.dat	upx
behavioral2/files/0x0007000000023414-142.dat	upx
behavioral2/files/0x0007000000023413-138.dat	upx
behavioral2/files/0x0007000000023411-127.dat	upx
behavioral2/files/0x0007000000023410-120.dat	upx
behavioral2/files/0x000700000002340b-92.dat	upx
behavioral2/files/0x0007000000023409-88.dat	upx
behavioral2/memory/1388-84-0x00007FF6FA540000-0x00007FF6FA936000-memory.dmp	upx
behavioral2/memory/4852-76-0x00007FF617960000-0x00007FF617D56000-memory.dmp	upx
behavioral2/memory/2680-62-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp	upx
behavioral2/memory/4844-60-0x00007FF6F8A40000-0x00007FF6F8E36000-memory.dmp	upx
behavioral2/files/0x0008000000023405-52.dat	upx
behavioral2/files/0x0007000000023403-46.dat	upx
behavioral2/memory/1812-9-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp	upx
behavioral2/memory/1812-1932-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp	upx
behavioral2/memory/3828-1933-0x00007FF764470000-0x00007FF764866000-memory.dmp	upx
behavioral2/memory/1812-1934-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp	upx
behavioral2/memory/4844-1935-0x00007FF6F8A40000-0x00007FF6F8E36000-memory.dmp	upx
behavioral2/memory/2528-1936-0x00007FF7C8A70000-0x00007FF7C8E66000-memory.dmp	upx
behavioral2/memory/2680-1937-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp	upx
behavioral2/memory/2404-1938-0x00007FF64D5F0000-0x00007FF64D9E6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tFeWexX.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\BorBvUf.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\HxOqXAY.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\cPmvUPC.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\ZxbjsCu.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\NnJCmAE.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\Hiuxuvj.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\DGlmIFR.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\ThSXYKr.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\Pqguslc.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\BvBgqBD.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\WMRNrNI.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\xlkMiFp.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\KmZTeKP.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\ajHrEOw.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\XqjMPiq.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\QryZQKj.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\xAssSWs.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\zEpjLNd.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\ZrImAeH.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\HLWZImP.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\ShOxHZG.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\NyLhydu.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\XLhPFSg.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\ylKyoEt.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\oxkUucH.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\eZEawcQ.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\vzZRUrs.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\CBtyoVE.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\GIpOdlQ.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\VgVnqOZ.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\MvfJMMm.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\IuruUTe.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\yYPZomw.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\VMNFzwD.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\bFTtNwt.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\svowrTk.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\mbvwuTd.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\NGEbJKE.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\apLbgeF.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\sJxkmPc.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\XFALQYu.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\xJEytvD.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\aZUMVGw.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\WeRtato.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\OonzyzC.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\MicfHzL.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\TVRaZve.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\PgOACqS.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\cGgwIVi.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\DnUUkcm.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\umxfqYx.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\qOLlord.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\nxAeJWt.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\nTPuMxR.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\yTLAgqk.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\BNyqCcU.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\sbgnOxA.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\AkXMJgs.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\FOitsRd.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\pXCtFIK.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\bvshtIk.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\rrRSawQ.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
File created	C:\Windows\System\oZKpxVy.exe	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
396	powershell.exe
396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
Token: SeDebugPrivilege	396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 396	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	83
PID 2696 wrote to memory of 396	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	83
PID 2696 wrote to memory of 1812	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	84
PID 2696 wrote to memory of 1812	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	84
PID 2696 wrote to memory of 3828	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	85
PID 2696 wrote to memory of 3828	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	85
PID 2696 wrote to memory of 4844	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	86
PID 2696 wrote to memory of 4844	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	86
PID 2696 wrote to memory of 2528	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	87
PID 2696 wrote to memory of 2528	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	87
PID 2696 wrote to memory of 2404	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	88
PID 2696 wrote to memory of 2404	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	88
PID 2696 wrote to memory of 2680	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	89
PID 2696 wrote to memory of 2680	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	89
PID 2696 wrote to memory of 4852	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	90
PID 2696 wrote to memory of 4852	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	90
PID 2696 wrote to memory of 1736	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	91
PID 2696 wrote to memory of 1736	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	91
PID 2696 wrote to memory of 1388	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	92
PID 2696 wrote to memory of 1388	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	92
PID 2696 wrote to memory of 3344	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	93
PID 2696 wrote to memory of 3344	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	93
PID 2696 wrote to memory of 5116	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	94
PID 2696 wrote to memory of 5116	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	94
PID 2696 wrote to memory of 2168	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	95
PID 2696 wrote to memory of 2168	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	95
PID 2696 wrote to memory of 1720	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	96
PID 2696 wrote to memory of 1720	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	96
PID 2696 wrote to memory of 4080	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	97
PID 2696 wrote to memory of 4080	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	97
PID 2696 wrote to memory of 3496	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	98
PID 2696 wrote to memory of 3496	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	98
PID 2696 wrote to memory of 3468	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	99
PID 2696 wrote to memory of 3468	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	99
PID 2696 wrote to memory of 5004	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	100
PID 2696 wrote to memory of 5004	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	100
PID 2696 wrote to memory of 3488	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	101
PID 2696 wrote to memory of 3488	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	101
PID 2696 wrote to memory of 3636	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	102
PID 2696 wrote to memory of 3636	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	102
PID 2696 wrote to memory of 2184	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	103
PID 2696 wrote to memory of 2184	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	103
PID 2696 wrote to memory of 1892	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	104
PID 2696 wrote to memory of 1892	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	104
PID 2696 wrote to memory of 2176	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	105
PID 2696 wrote to memory of 2176	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	105
PID 2696 wrote to memory of 4760	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	106
PID 2696 wrote to memory of 4760	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	106
PID 2696 wrote to memory of 1792	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	107
PID 2696 wrote to memory of 1792	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	107
PID 2696 wrote to memory of 1064	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	108
PID 2696 wrote to memory of 1064	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	108
PID 2696 wrote to memory of 1208	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	109
PID 2696 wrote to memory of 1208	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	109
PID 2696 wrote to memory of 2196	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	110
PID 2696 wrote to memory of 2196	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	110
PID 2696 wrote to memory of 1976	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	111
PID 2696 wrote to memory of 1976	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	111
PID 2696 wrote to memory of 3592	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	112
PID 2696 wrote to memory of 3592	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	112
PID 2696 wrote to memory of 3724	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	113
PID 2696 wrote to memory of 3724	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	113
PID 2696 wrote to memory of 1848	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	114
PID 2696 wrote to memory of 1848	2696	59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\59db99fcacee5284195617846aa0c030_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System\ShDBStn.exe
  C:\Windows\System\ShDBStn.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\VtECtzB.exe
  C:\Windows\System\VtECtzB.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\CjOQXmx.exe
  C:\Windows\System\CjOQXmx.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\xLKncPx.exe
  C:\Windows\System\xLKncPx.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\eUVhgCv.exe
  C:\Windows\System\eUVhgCv.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\LRQcqhU.exe
  C:\Windows\System\LRQcqhU.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\xINRWEV.exe
  C:\Windows\System\xINRWEV.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\tSadGaZ.exe
  C:\Windows\System\tSadGaZ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\FRpUZXw.exe
  C:\Windows\System\FRpUZXw.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\URBtihP.exe
  C:\Windows\System\URBtihP.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\YLRirYt.exe
  C:\Windows\System\YLRirYt.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\PZiicjG.exe
  C:\Windows\System\PZiicjG.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\KuOHGMi.exe
  C:\Windows\System\KuOHGMi.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\xvCtfRy.exe
  C:\Windows\System\xvCtfRy.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\oGuToHv.exe
  C:\Windows\System\oGuToHv.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\OonzyzC.exe
  C:\Windows\System\OonzyzC.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\Ojcmrxj.exe
  C:\Windows\System\Ojcmrxj.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\ESiwQjD.exe
  C:\Windows\System\ESiwQjD.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\VMIyNMW.exe
  C:\Windows\System\VMIyNMW.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\KiLDxCB.exe
  C:\Windows\System\KiLDxCB.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\RSzPDQi.exe
  C:\Windows\System\RSzPDQi.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\CUzEZxw.exe
  C:\Windows\System\CUzEZxw.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\xlkMiFp.exe
  C:\Windows\System\xlkMiFp.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\ENlrUcj.exe
  C:\Windows\System\ENlrUcj.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\LGdnJoR.exe
  C:\Windows\System\LGdnJoR.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\GHUTPWB.exe
  C:\Windows\System\GHUTPWB.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\XVUnqtZ.exe
  C:\Windows\System\XVUnqtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\oIoqgTw.exe
  C:\Windows\System\oIoqgTw.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\HVcZDyS.exe
  C:\Windows\System\HVcZDyS.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\vHSIyyd.exe
  C:\Windows\System\vHSIyyd.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\AkXMJgs.exe
  C:\Windows\System\AkXMJgs.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\pwHlcAq.exe
  C:\Windows\System\pwHlcAq.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\MCmkQVi.exe
  C:\Windows\System\MCmkQVi.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\OQnouZI.exe
  C:\Windows\System\OQnouZI.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\itjsVQN.exe
  C:\Windows\System\itjsVQN.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\gZmDEZj.exe
  C:\Windows\System\gZmDEZj.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\anHTmIG.exe
  C:\Windows\System\anHTmIG.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\vqeHDCp.exe
  C:\Windows\System\vqeHDCp.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\YAXjPdD.exe
  C:\Windows\System\YAXjPdD.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\HLWZImP.exe
  C:\Windows\System\HLWZImP.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\iHVScrz.exe
  C:\Windows\System\iHVScrz.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\zoZttjF.exe
  C:\Windows\System\zoZttjF.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\QzGUKGw.exe
  C:\Windows\System\QzGUKGw.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\zrzZLko.exe
  C:\Windows\System\zrzZLko.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\GyWSIwM.exe
  C:\Windows\System\GyWSIwM.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\BdmCHxi.exe
  C:\Windows\System\BdmCHxi.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\PJeUEit.exe
  C:\Windows\System\PJeUEit.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\sAcmuXr.exe
  C:\Windows\System\sAcmuXr.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\gRqSDqA.exe
  C:\Windows\System\gRqSDqA.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\LcgGVbS.exe
  C:\Windows\System\LcgGVbS.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\MFkbUOy.exe
  C:\Windows\System\MFkbUOy.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\CuiFcbi.exe
  C:\Windows\System\CuiFcbi.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\ltZcOFh.exe
  C:\Windows\System\ltZcOFh.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\GlYEEwY.exe
  C:\Windows\System\GlYEEwY.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\mCTXzpp.exe
  C:\Windows\System\mCTXzpp.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\IMTbuLY.exe
  C:\Windows\System\IMTbuLY.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\gfTUggD.exe
  C:\Windows\System\gfTUggD.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\QfGZjtH.exe
  C:\Windows\System\QfGZjtH.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\NCtolUr.exe
  C:\Windows\System\NCtolUr.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\MtXRKkU.exe
  C:\Windows\System\MtXRKkU.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\BOCkKBj.exe
  C:\Windows\System\BOCkKBj.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\AWXuXRO.exe
  C:\Windows\System\AWXuXRO.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\iUaSbJM.exe
  C:\Windows\System\iUaSbJM.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\miFMlms.exe
  C:\Windows\System\miFMlms.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\DlHlYJG.exe
  C:\Windows\System\DlHlYJG.exe
  2⤵
  PID:4884
- C:\Windows\System\JwkrcaT.exe
  C:\Windows\System\JwkrcaT.exe
  2⤵
  PID:2112
- C:\Windows\System\sseFRSo.exe
  C:\Windows\System\sseFRSo.exe
  2⤵
  PID:1608
- C:\Windows\System\xtIWBbC.exe
  C:\Windows\System\xtIWBbC.exe
  2⤵
  PID:4324
- C:\Windows\System\uFiJAdX.exe
  C:\Windows\System\uFiJAdX.exe
  2⤵
  PID:2336
- C:\Windows\System\LxCxxTa.exe
  C:\Windows\System\LxCxxTa.exe
  2⤵
  PID:1648
- C:\Windows\System\GuRycuT.exe
  C:\Windows\System\GuRycuT.exe
  2⤵
  PID:4860
- C:\Windows\System\AKaHSwi.exe
  C:\Windows\System\AKaHSwi.exe
  2⤵
  PID:1604
- C:\Windows\System\PgDaigW.exe
  C:\Windows\System\PgDaigW.exe
  2⤵
  PID:2488
- C:\Windows\System\csvDvRE.exe
  C:\Windows\System\csvDvRE.exe
  2⤵
  PID:4296
- C:\Windows\System\ozhWgNd.exe
  C:\Windows\System\ozhWgNd.exe
  2⤵
  PID:3396
- C:\Windows\System\qiINSUD.exe
  C:\Windows\System\qiINSUD.exe
  2⤵
  PID:408
- C:\Windows\System\qOLlord.exe
  C:\Windows\System\qOLlord.exe
  2⤵
  PID:4996
- C:\Windows\System\aFSWBTu.exe
  C:\Windows\System\aFSWBTu.exe
  2⤵
  PID:4960
- C:\Windows\System\BxySHAm.exe
  C:\Windows\System\BxySHAm.exe
  2⤵
  PID:4616
- C:\Windows\System\MWhvrHR.exe
  C:\Windows\System\MWhvrHR.exe
  2⤵
  PID:3356
- C:\Windows\System\kyfSfWK.exe
  C:\Windows\System\kyfSfWK.exe
  2⤵
  PID:5040
- C:\Windows\System\yHRvGFx.exe
  C:\Windows\System\yHRvGFx.exe
  2⤵
  PID:4420
- C:\Windows\System\HNZKPSH.exe
  C:\Windows\System\HNZKPSH.exe
  2⤵
  PID:1356
- C:\Windows\System\KmZTeKP.exe
  C:\Windows\System\KmZTeKP.exe
  2⤵
  PID:5144
- C:\Windows\System\ajHrEOw.exe
  C:\Windows\System\ajHrEOw.exe
  2⤵
  PID:5172
- C:\Windows\System\IvkoSBd.exe
  C:\Windows\System\IvkoSBd.exe
  2⤵
  PID:5200
- C:\Windows\System\IHMtnKw.exe
  C:\Windows\System\IHMtnKw.exe
  2⤵
  PID:5228
- C:\Windows\System\xTlDiZL.exe
  C:\Windows\System\xTlDiZL.exe
  2⤵
  PID:5256
- C:\Windows\System\cNjFKvv.exe
  C:\Windows\System\cNjFKvv.exe
  2⤵
  PID:5284
- C:\Windows\System\taibfXP.exe
  C:\Windows\System\taibfXP.exe
  2⤵
  PID:5312
- C:\Windows\System\eMVaSbd.exe
  C:\Windows\System\eMVaSbd.exe
  2⤵
  PID:5340
- C:\Windows\System\OJFWyCh.exe
  C:\Windows\System\OJFWyCh.exe
  2⤵
  PID:5368
- C:\Windows\System\SSMtAJh.exe
  C:\Windows\System\SSMtAJh.exe
  2⤵
  PID:5396
- C:\Windows\System\mpeJbbt.exe
  C:\Windows\System\mpeJbbt.exe
  2⤵
  PID:5424
- C:\Windows\System\uiWfPzT.exe
  C:\Windows\System\uiWfPzT.exe
  2⤵
  PID:5460
- C:\Windows\System\EbgeTbI.exe
  C:\Windows\System\EbgeTbI.exe
  2⤵
  PID:5480
- C:\Windows\System\CxOxsam.exe
  C:\Windows\System\CxOxsam.exe
  2⤵
  PID:5508
- C:\Windows\System\VFPjMGU.exe
  C:\Windows\System\VFPjMGU.exe
  2⤵
  PID:5536
- C:\Windows\System\HTYSiCi.exe
  C:\Windows\System\HTYSiCi.exe
  2⤵
  PID:5564
- C:\Windows\System\CMruLeo.exe
  C:\Windows\System\CMruLeo.exe
  2⤵
  PID:5592
- C:\Windows\System\CinSeDW.exe
  C:\Windows\System\CinSeDW.exe
  2⤵
  PID:5620
- C:\Windows\System\EOwpkxE.exe
  C:\Windows\System\EOwpkxE.exe
  2⤵
  PID:5648
- C:\Windows\System\wcdutPt.exe
  C:\Windows\System\wcdutPt.exe
  2⤵
  PID:5676
- C:\Windows\System\LEbAXGJ.exe
  C:\Windows\System\LEbAXGJ.exe
  2⤵
  PID:5704
- C:\Windows\System\fEZSSCs.exe
  C:\Windows\System\fEZSSCs.exe
  2⤵
  PID:5732
- C:\Windows\System\fHmyvfG.exe
  C:\Windows\System\fHmyvfG.exe
  2⤵
  PID:5760
- C:\Windows\System\cDRAEvH.exe
  C:\Windows\System\cDRAEvH.exe
  2⤵
  PID:5788
- C:\Windows\System\hSOrifz.exe
  C:\Windows\System\hSOrifz.exe
  2⤵
  PID:5824
- C:\Windows\System\wSLqmJh.exe
  C:\Windows\System\wSLqmJh.exe
  2⤵
  PID:5852
- C:\Windows\System\BpEpJTJ.exe
  C:\Windows\System\BpEpJTJ.exe
  2⤵
  PID:5884
- C:\Windows\System\RhKUGsE.exe
  C:\Windows\System\RhKUGsE.exe
  2⤵
  PID:5908
- C:\Windows\System\emNCsYa.exe
  C:\Windows\System\emNCsYa.exe
  2⤵
  PID:5928
- C:\Windows\System\rrRSawQ.exe
  C:\Windows\System\rrRSawQ.exe
  2⤵
  PID:5956
- C:\Windows\System\whzfaoO.exe
  C:\Windows\System\whzfaoO.exe
  2⤵
  PID:5984
- C:\Windows\System\JXTMuuS.exe
  C:\Windows\System\JXTMuuS.exe
  2⤵
  PID:6012
- C:\Windows\System\cOYGnsN.exe
  C:\Windows\System\cOYGnsN.exe
  2⤵
  PID:6040
- C:\Windows\System\ipccEmQ.exe
  C:\Windows\System\ipccEmQ.exe
  2⤵
  PID:6064
- C:\Windows\System\pkpxkFn.exe
  C:\Windows\System\pkpxkFn.exe
  2⤵
  PID:6096
- C:\Windows\System\RXZiVZz.exe
  C:\Windows\System\RXZiVZz.exe
  2⤵
  PID:6124
- C:\Windows\System\jjQcIvS.exe
  C:\Windows\System\jjQcIvS.exe
  2⤵
  PID:4472
- C:\Windows\System\LMDItew.exe
  C:\Windows\System\LMDItew.exe
  2⤵
  PID:3268
- C:\Windows\System\fUkxtnw.exe
  C:\Windows\System\fUkxtnw.exe
  2⤵
  PID:2464
- C:\Windows\System\EQcjbWE.exe
  C:\Windows\System\EQcjbWE.exe
  2⤵
  PID:3256
- C:\Windows\System\txqzgSA.exe
  C:\Windows\System\txqzgSA.exe
  2⤵
  PID:5160
- C:\Windows\System\qkfWmmb.exe
  C:\Windows\System\qkfWmmb.exe
  2⤵
  PID:5220
- C:\Windows\System\DGlmIFR.exe
  C:\Windows\System\DGlmIFR.exe
  2⤵
  PID:5296
- C:\Windows\System\aKFFAtX.exe
  C:\Windows\System\aKFFAtX.exe
  2⤵
  PID:5352
- C:\Windows\System\aIBktPi.exe
  C:\Windows\System\aIBktPi.exe
  2⤵
  PID:5416
- C:\Windows\System\aIPCSbf.exe
  C:\Windows\System\aIPCSbf.exe
  2⤵
  PID:5492
- C:\Windows\System\umxfqYx.exe
  C:\Windows\System\umxfqYx.exe
  2⤵
  PID:5552
- C:\Windows\System\PLsoBtH.exe
  C:\Windows\System\PLsoBtH.exe
  2⤵
  PID:5612
- C:\Windows\System\IslNnqM.exe
  C:\Windows\System\IslNnqM.exe
  2⤵
  PID:5688
- C:\Windows\System\TvVDSvb.exe
  C:\Windows\System\TvVDSvb.exe
  2⤵
  PID:5748
- C:\Windows\System\qZAHRIV.exe
  C:\Windows\System\qZAHRIV.exe
  2⤵
  PID:5816
- C:\Windows\System\ewBzCnL.exe
  C:\Windows\System\ewBzCnL.exe
  2⤵
  PID:5872
- C:\Windows\System\fdwoAFK.exe
  C:\Windows\System\fdwoAFK.exe
  2⤵
  PID:5944
- C:\Windows\System\UXZhsmF.exe
  C:\Windows\System\UXZhsmF.exe
  2⤵
  PID:6004
- C:\Windows\System\IGzvCeA.exe
  C:\Windows\System\IGzvCeA.exe
  2⤵
  PID:6080
- C:\Windows\System\ouDCICY.exe
  C:\Windows\System\ouDCICY.exe
  2⤵
  PID:6140
- C:\Windows\System\AIFWRSZ.exe
  C:\Windows\System\AIFWRSZ.exe
  2⤵
  PID:4924
- C:\Windows\System\XLhPFSg.exe
  C:\Windows\System\XLhPFSg.exe
  2⤵
  PID:5188
- C:\Windows\System\VTRUwHb.exe
  C:\Windows\System\VTRUwHb.exe
  2⤵
  PID:5328
- C:\Windows\System\ckOvEPL.exe
  C:\Windows\System\ckOvEPL.exe
  2⤵
  PID:5456
- C:\Windows\System\mLZODhb.exe
  C:\Windows\System\mLZODhb.exe
  2⤵
  PID:5604
- C:\Windows\System\pReOPlK.exe
  C:\Windows\System\pReOPlK.exe
  2⤵
  PID:5724
- C:\Windows\System\ROKFaQT.exe
  C:\Windows\System\ROKFaQT.exe
  2⤵
  PID:5848
- C:\Windows\System\DXINIIM.exe
  C:\Windows\System\DXINIIM.exe
  2⤵
  PID:5996
- C:\Windows\System\cWPZsQj.exe
  C:\Windows\System\cWPZsQj.exe
  2⤵
  PID:6116
- C:\Windows\System\MicfHzL.exe
  C:\Windows\System\MicfHzL.exe
  2⤵
  PID:5132
- C:\Windows\System\IGNSogM.exe
  C:\Windows\System\IGNSogM.exe
  2⤵
  PID:5452
- C:\Windows\System\nxAeJWt.exe
  C:\Windows\System\nxAeJWt.exe
  2⤵
  PID:5800
- C:\Windows\System\mLiiDnw.exe
  C:\Windows\System\mLiiDnw.exe
  2⤵
  PID:6168
- C:\Windows\System\HvJsfcO.exe
  C:\Windows\System\HvJsfcO.exe
  2⤵
  PID:6208
- C:\Windows\System\RmuKHQs.exe
  C:\Windows\System\RmuKHQs.exe
  2⤵
  PID:6236
- C:\Windows\System\NyLhydu.exe
  C:\Windows\System\NyLhydu.exe
  2⤵
  PID:6264
- C:\Windows\System\jrqHYnH.exe
  C:\Windows\System\jrqHYnH.exe
  2⤵
  PID:6280
- C:\Windows\System\xFihLTH.exe
  C:\Windows\System\xFihLTH.exe
  2⤵
  PID:6308
- C:\Windows\System\IgYspqe.exe
  C:\Windows\System\IgYspqe.exe
  2⤵
  PID:6336
- C:\Windows\System\GxVSewb.exe
  C:\Windows\System\GxVSewb.exe
  2⤵
  PID:6364
- C:\Windows\System\vQWaogV.exe
  C:\Windows\System\vQWaogV.exe
  2⤵
  PID:6392
- C:\Windows\System\mpdrFhz.exe
  C:\Windows\System\mpdrFhz.exe
  2⤵
  PID:6420
- C:\Windows\System\oDJMtCk.exe
  C:\Windows\System\oDJMtCk.exe
  2⤵
  PID:6448
- C:\Windows\System\xDGDVAD.exe
  C:\Windows\System\xDGDVAD.exe
  2⤵
  PID:6476
- C:\Windows\System\uTQvXaD.exe
  C:\Windows\System\uTQvXaD.exe
  2⤵
  PID:6504
- C:\Windows\System\rURMiRd.exe
  C:\Windows\System\rURMiRd.exe
  2⤵
  PID:6532
- C:\Windows\System\smJbuXB.exe
  C:\Windows\System\smJbuXB.exe
  2⤵
  PID:6556
- C:\Windows\System\DxOhMbU.exe
  C:\Windows\System\DxOhMbU.exe
  2⤵
  PID:6584
- C:\Windows\System\JAiboir.exe
  C:\Windows\System\JAiboir.exe
  2⤵
  PID:6616
- C:\Windows\System\XFALQYu.exe
  C:\Windows\System\XFALQYu.exe
  2⤵
  PID:6644
- C:\Windows\System\wYUGEQu.exe
  C:\Windows\System\wYUGEQu.exe
  2⤵
  PID:6672
- C:\Windows\System\ZtWLBMO.exe
  C:\Windows\System\ZtWLBMO.exe
  2⤵
  PID:6700
- C:\Windows\System\DKYOVlA.exe
  C:\Windows\System\DKYOVlA.exe
  2⤵
  PID:6728
- C:\Windows\System\oZKpxVy.exe
  C:\Windows\System\oZKpxVy.exe
  2⤵
  PID:6756
- C:\Windows\System\jZRKASU.exe
  C:\Windows\System\jZRKASU.exe
  2⤵
  PID:6784
- C:\Windows\System\dQyqZNu.exe
  C:\Windows\System\dQyqZNu.exe
  2⤵
  PID:6812
- C:\Windows\System\xdcBhpU.exe
  C:\Windows\System\xdcBhpU.exe
  2⤵
  PID:6840
- C:\Windows\System\RKjTkdd.exe
  C:\Windows\System\RKjTkdd.exe
  2⤵
  PID:6868
- C:\Windows\System\dpNiycJ.exe
  C:\Windows\System\dpNiycJ.exe
  2⤵
  PID:6896
- C:\Windows\System\fanVOKg.exe
  C:\Windows\System\fanVOKg.exe
  2⤵
  PID:6924
- C:\Windows\System\DqGAPrh.exe
  C:\Windows\System\DqGAPrh.exe
  2⤵
  PID:6952
- C:\Windows\System\QPgvZke.exe
  C:\Windows\System\QPgvZke.exe
  2⤵
  PID:7108
- C:\Windows\System\eXxLQZG.exe
  C:\Windows\System\eXxLQZG.exe
  2⤵
  PID:7152
- C:\Windows\System\Czeurkm.exe
  C:\Windows\System\Czeurkm.exe
  2⤵
  PID:5388
- C:\Windows\System\GEjdffQ.exe
  C:\Windows\System\GEjdffQ.exe
  2⤵
  PID:1772
- C:\Windows\System\egjiqWi.exe
  C:\Windows\System\egjiqWi.exe
  2⤵
  PID:6376
- C:\Windows\System\PEnEdQe.exe
  C:\Windows\System\PEnEdQe.exe
  2⤵
  PID:6436
- C:\Windows\System\wlFhEtY.exe
  C:\Windows\System\wlFhEtY.exe
  2⤵
  PID:6496
- C:\Windows\System\VgVnqOZ.exe
  C:\Windows\System\VgVnqOZ.exe
  2⤵
  PID:6604
- C:\Windows\System\vUdTAyg.exe
  C:\Windows\System\vUdTAyg.exe
  2⤵
  PID:6660
- C:\Windows\System\AWRLSSB.exe
  C:\Windows\System\AWRLSSB.exe
  2⤵
  PID:1820
- C:\Windows\System\sJDidfI.exe
  C:\Windows\System\sJDidfI.exe
  2⤵
  PID:3232
- C:\Windows\System\pMSMUjr.exe
  C:\Windows\System\pMSMUjr.exe
  2⤵
  PID:3316
- C:\Windows\System\DgCxFjp.exe
  C:\Windows\System\DgCxFjp.exe
  2⤵
  PID:4780
- C:\Windows\System\vFIeyDe.exe
  C:\Windows\System\vFIeyDe.exe
  2⤵
  PID:6908
- C:\Windows\System\rAbzUdG.exe
  C:\Windows\System\rAbzUdG.exe
  2⤵
  PID:4508
- C:\Windows\System\ljuLtWc.exe
  C:\Windows\System\ljuLtWc.exe
  2⤵
  PID:4008
- C:\Windows\System\swCxCde.exe
  C:\Windows\System\swCxCde.exe
  2⤵
  PID:7140
- C:\Windows\System\TVRaZve.exe
  C:\Windows\System\TVRaZve.exe
  2⤵
  PID:4468
- C:\Windows\System\cKEhCqR.exe
  C:\Windows\System\cKEhCqR.exe
  2⤵
  PID:324
- C:\Windows\System\ypwRcrm.exe
  C:\Windows\System\ypwRcrm.exe
  2⤵
  PID:2296
- C:\Windows\System\XibhjPS.exe
  C:\Windows\System\XibhjPS.exe
  2⤵
  PID:4872
- C:\Windows\System\NGEbJKE.exe
  C:\Windows\System\NGEbJKE.exe
  2⤵
  PID:5028
- C:\Windows\System\pnGkDLr.exe
  C:\Windows\System\pnGkDLr.exe
  2⤵
  PID:6352
- C:\Windows\System\BFJwJjB.exe
  C:\Windows\System\BFJwJjB.exe
  2⤵
  PID:5664
- C:\Windows\System\JnRQUkO.exe
  C:\Windows\System\JnRQUkO.exe
  2⤵
  PID:6432
- C:\Windows\System\XqjMPiq.exe
  C:\Windows\System\XqjMPiq.exe
  2⤵
  PID:7164
- C:\Windows\System\RwiRpZd.exe
  C:\Windows\System\RwiRpZd.exe
  2⤵
  PID:6740
- C:\Windows\System\VSntFKd.exe
  C:\Windows\System\VSntFKd.exe
  2⤵
  PID:1320
- C:\Windows\System\UPsEonU.exe
  C:\Windows\System\UPsEonU.exe
  2⤵
  PID:1404
- C:\Windows\System\MHYKNag.exe
  C:\Windows\System\MHYKNag.exe
  2⤵
  PID:4792
- C:\Windows\System\DMhAcKZ.exe
  C:\Windows\System\DMhAcKZ.exe
  2⤵
  PID:3260
- C:\Windows\System\VGRbOoA.exe
  C:\Windows\System\VGRbOoA.exe
  2⤵
  PID:4796
- C:\Windows\System\zvApitJ.exe
  C:\Windows\System\zvApitJ.exe
  2⤵
  PID:3148
- C:\Windows\System\zlhsTch.exe
  C:\Windows\System\zlhsTch.exe
  2⤵
  PID:2332
- C:\Windows\System\DgDxzrb.exe
  C:\Windows\System\DgDxzrb.exe
  2⤵
  PID:3204
- C:\Windows\System\wxZECxr.exe
  C:\Windows\System\wxZECxr.exe
  2⤵
  PID:7132
- C:\Windows\System\VGKtBzo.exe
  C:\Windows\System\VGKtBzo.exe
  2⤵
  PID:6056
- C:\Windows\System\JRQFReh.exe
  C:\Windows\System\JRQFReh.exe
  2⤵
  PID:7124
- C:\Windows\System\ylKyoEt.exe
  C:\Windows\System\ylKyoEt.exe
  2⤵
  PID:2316
- C:\Windows\System\mdHmjGz.exe
  C:\Windows\System\mdHmjGz.exe
  2⤵
  PID:7184
- C:\Windows\System\ZCpIJiR.exe
  C:\Windows\System\ZCpIJiR.exe
  2⤵
  PID:7216
- C:\Windows\System\UKnvPeC.exe
  C:\Windows\System\UKnvPeC.exe
  2⤵
  PID:7244
- C:\Windows\System\ejwUhDw.exe
  C:\Windows\System\ejwUhDw.exe
  2⤵
  PID:7272
- C:\Windows\System\MvfJMMm.exe
  C:\Windows\System\MvfJMMm.exe
  2⤵
  PID:7304
- C:\Windows\System\JxwGeqC.exe
  C:\Windows\System\JxwGeqC.exe
  2⤵
  PID:7332
- C:\Windows\System\XMFdJbv.exe
  C:\Windows\System\XMFdJbv.exe
  2⤵
  PID:7360
- C:\Windows\System\ThSXYKr.exe
  C:\Windows\System\ThSXYKr.exe
  2⤵
  PID:7392
- C:\Windows\System\dRdkYnn.exe
  C:\Windows\System\dRdkYnn.exe
  2⤵
  PID:7416
- C:\Windows\System\RbVesMU.exe
  C:\Windows\System\RbVesMU.exe
  2⤵
  PID:7444
- C:\Windows\System\uWTvlfH.exe
  C:\Windows\System\uWTvlfH.exe
  2⤵
  PID:7460
- C:\Windows\System\AxXuDBs.exe
  C:\Windows\System\AxXuDBs.exe
  2⤵
  PID:7492
- C:\Windows\System\bNKJUit.exe
  C:\Windows\System\bNKJUit.exe
  2⤵
  PID:7536
- C:\Windows\System\NOYezjN.exe
  C:\Windows\System\NOYezjN.exe
  2⤵
  PID:7556
- C:\Windows\System\tHoCQEi.exe
  C:\Windows\System\tHoCQEi.exe
  2⤵
  PID:7588
- C:\Windows\System\ipUJxFx.exe
  C:\Windows\System\ipUJxFx.exe
  2⤵
  PID:7616
- C:\Windows\System\SCzjxUn.exe
  C:\Windows\System\SCzjxUn.exe
  2⤵
  PID:7652
- C:\Windows\System\stbUEOS.exe
  C:\Windows\System\stbUEOS.exe
  2⤵
  PID:7672
- C:\Windows\System\gVxUTLG.exe
  C:\Windows\System\gVxUTLG.exe
  2⤵
  PID:7700
- C:\Windows\System\YElUgjV.exe
  C:\Windows\System\YElUgjV.exe
  2⤵
  PID:7728
- C:\Windows\System\AvRTMeC.exe
  C:\Windows\System\AvRTMeC.exe
  2⤵
  PID:7760
- C:\Windows\System\ZNRqjjP.exe
  C:\Windows\System\ZNRqjjP.exe
  2⤵
  PID:7784
- C:\Windows\System\vsQcYZl.exe
  C:\Windows\System\vsQcYZl.exe
  2⤵
  PID:7820
- C:\Windows\System\dYAdBST.exe
  C:\Windows\System\dYAdBST.exe
  2⤵
  PID:7840
- C:\Windows\System\CaQvscL.exe
  C:\Windows\System\CaQvscL.exe
  2⤵
  PID:7872
- C:\Windows\System\nbqlBNE.exe
  C:\Windows\System\nbqlBNE.exe
  2⤵
  PID:7900
- C:\Windows\System\CGhGEyw.exe
  C:\Windows\System\CGhGEyw.exe
  2⤵
  PID:7928
- C:\Windows\System\isTDyMP.exe
  C:\Windows\System\isTDyMP.exe
  2⤵
  PID:7956
- C:\Windows\System\arChSTu.exe
  C:\Windows\System\arChSTu.exe
  2⤵
  PID:7988
- C:\Windows\System\LCKZggK.exe
  C:\Windows\System\LCKZggK.exe
  2⤵
  PID:8012
- C:\Windows\System\AtzSVOq.exe
  C:\Windows\System\AtzSVOq.exe
  2⤵
  PID:8040
- C:\Windows\System\RvLWjLb.exe
  C:\Windows\System\RvLWjLb.exe
  2⤵
  PID:8072
- C:\Windows\System\YYjQdkI.exe
  C:\Windows\System\YYjQdkI.exe
  2⤵
  PID:8104
- C:\Windows\System\WbZoVrA.exe
  C:\Windows\System\WbZoVrA.exe
  2⤵
  PID:8124
- C:\Windows\System\QryZQKj.exe
  C:\Windows\System\QryZQKj.exe
  2⤵
  PID:8152
- C:\Windows\System\IMaACbn.exe
  C:\Windows\System\IMaACbn.exe
  2⤵
  PID:8180
- C:\Windows\System\KSVDlrA.exe
  C:\Windows\System\KSVDlrA.exe
  2⤵
  PID:7052
- C:\Windows\System\AoZJUlV.exe
  C:\Windows\System\AoZJUlV.exe
  2⤵
  PID:7260
- C:\Windows\System\RTUUleX.exe
  C:\Windows\System\RTUUleX.exe
  2⤵
  PID:7328
- C:\Windows\System\YnsspZc.exe
  C:\Windows\System\YnsspZc.exe
  2⤵
  PID:7400
- C:\Windows\System\FOitsRd.exe
  C:\Windows\System\FOitsRd.exe
  2⤵
  PID:7456
- C:\Windows\System\GexmesM.exe
  C:\Windows\System\GexmesM.exe
  2⤵
  PID:7524
- C:\Windows\System\nlKCucJ.exe
  C:\Windows\System\nlKCucJ.exe
  2⤵
  PID:7608
- C:\Windows\System\cJHxhfF.exe
  C:\Windows\System\cJHxhfF.exe
  2⤵
  PID:7640
- C:\Windows\System\aIhkHFR.exe
  C:\Windows\System\aIhkHFR.exe
  2⤵
  PID:7720
- C:\Windows\System\VdYKCJw.exe
  C:\Windows\System\VdYKCJw.exe
  2⤵
  PID:7768
- C:\Windows\System\jZjKajw.exe
  C:\Windows\System\jZjKajw.exe
  2⤵
  PID:7828
- C:\Windows\System\nTPuMxR.exe
  C:\Windows\System\nTPuMxR.exe
  2⤵
  PID:7888
- C:\Windows\System\sHZTtJi.exe
  C:\Windows\System\sHZTtJi.exe
  2⤵
  PID:7924
- C:\Windows\System\nQGBaLs.exe
  C:\Windows\System\nQGBaLs.exe
  2⤵
  PID:8000
- C:\Windows\System\PgOACqS.exe
  C:\Windows\System\PgOACqS.exe
  2⤵
  PID:8064
- C:\Windows\System\iUxwGEB.exe
  C:\Windows\System\iUxwGEB.exe
  2⤵
  PID:8116
- C:\Windows\System\hmaDivT.exe
  C:\Windows\System\hmaDivT.exe
  2⤵
  PID:8188
- C:\Windows\System\OSarKDH.exe
  C:\Windows\System\OSarKDH.exe
  2⤵
  PID:7072
- C:\Windows\System\AuYGHdp.exe
  C:\Windows\System\AuYGHdp.exe
  2⤵
  PID:7356
- C:\Windows\System\nCYNqcV.exe
  C:\Windows\System\nCYNqcV.exe
  2⤵
  PID:7484
- C:\Windows\System\NWuatuz.exe
  C:\Windows\System\NWuatuz.exe
  2⤵
  PID:7044
- C:\Windows\System\eWdvbWy.exe
  C:\Windows\System\eWdvbWy.exe
  2⤵
  PID:7752
- C:\Windows\System\QINsqeb.exe
  C:\Windows\System\QINsqeb.exe
  2⤵
  PID:7092
- C:\Windows\System\Hiuxuvj.exe
  C:\Windows\System\Hiuxuvj.exe
  2⤵
  PID:8024
- C:\Windows\System\immCYHr.exe
  C:\Windows\System\immCYHr.exe
  2⤵
  PID:8148
- C:\Windows\System\BiHqbkC.exe
  C:\Windows\System\BiHqbkC.exe
  2⤵
  PID:7324
- C:\Windows\System\OdTXNbq.exe
  C:\Windows\System\OdTXNbq.exe
  2⤵
  PID:7632
- C:\Windows\System\yPcvFuZ.exe
  C:\Windows\System\yPcvFuZ.exe
  2⤵
  PID:7920
- C:\Windows\System\MWLhurF.exe
  C:\Windows\System\MWLhurF.exe
  2⤵
  PID:7316
- C:\Windows\System\tFeWexX.exe
  C:\Windows\System\tFeWexX.exe
  2⤵
  PID:8092
- C:\Windows\System\XAFgyla.exe
  C:\Windows\System\XAFgyla.exe
  2⤵
  PID:7076
- C:\Windows\System\AWCylcI.exe
  C:\Windows\System\AWCylcI.exe
  2⤵
  PID:8220
- C:\Windows\System\oxkUucH.exe
  C:\Windows\System\oxkUucH.exe
  2⤵
  PID:8248
- C:\Windows\System\PdvmrpP.exe
  C:\Windows\System\PdvmrpP.exe
  2⤵
  PID:8276
- C:\Windows\System\kDixXMy.exe
  C:\Windows\System\kDixXMy.exe
  2⤵
  PID:8304
- C:\Windows\System\eZEawcQ.exe
  C:\Windows\System\eZEawcQ.exe
  2⤵
  PID:8332
- C:\Windows\System\fNlvJra.exe
  C:\Windows\System\fNlvJra.exe
  2⤵
  PID:8360
- C:\Windows\System\TtyzQGm.exe
  C:\Windows\System\TtyzQGm.exe
  2⤵
  PID:8388
- C:\Windows\System\cGgwIVi.exe
  C:\Windows\System\cGgwIVi.exe
  2⤵
  PID:8416
- C:\Windows\System\IeolsFK.exe
  C:\Windows\System\IeolsFK.exe
  2⤵
  PID:8444
- C:\Windows\System\ptkKuea.exe
  C:\Windows\System\ptkKuea.exe
  2⤵
  PID:8472
- C:\Windows\System\GnjBjFT.exe
  C:\Windows\System\GnjBjFT.exe
  2⤵
  PID:8500
- C:\Windows\System\TkiYile.exe
  C:\Windows\System\TkiYile.exe
  2⤵
  PID:8528
- C:\Windows\System\YUHrPaL.exe
  C:\Windows\System\YUHrPaL.exe
  2⤵
  PID:8556
- C:\Windows\System\tKVdxOP.exe
  C:\Windows\System\tKVdxOP.exe
  2⤵
  PID:8584
- C:\Windows\System\QQxONvd.exe
  C:\Windows\System\QQxONvd.exe
  2⤵
  PID:8612
- C:\Windows\System\wKtUTzp.exe
  C:\Windows\System\wKtUTzp.exe
  2⤵
  PID:8640
- C:\Windows\System\uYIoUka.exe
  C:\Windows\System\uYIoUka.exe
  2⤵
  PID:8668
- C:\Windows\System\wbbAmkD.exe
  C:\Windows\System\wbbAmkD.exe
  2⤵
  PID:8696
- C:\Windows\System\BorBvUf.exe
  C:\Windows\System\BorBvUf.exe
  2⤵
  PID:8724
- C:\Windows\System\dgASlSj.exe
  C:\Windows\System\dgASlSj.exe
  2⤵
  PID:8752
- C:\Windows\System\UYnEuGV.exe
  C:\Windows\System\UYnEuGV.exe
  2⤵
  PID:8780
- C:\Windows\System\PWdrdjL.exe
  C:\Windows\System\PWdrdjL.exe
  2⤵
  PID:8808
- C:\Windows\System\fqarzfJ.exe
  C:\Windows\System\fqarzfJ.exe
  2⤵
  PID:8836
- C:\Windows\System\JONKORH.exe
  C:\Windows\System\JONKORH.exe
  2⤵
  PID:8864
- C:\Windows\System\dUkWFLy.exe
  C:\Windows\System\dUkWFLy.exe
  2⤵
  PID:8892
- C:\Windows\System\bsEfrrv.exe
  C:\Windows\System\bsEfrrv.exe
  2⤵
  PID:8920
- C:\Windows\System\PvdFXck.exe
  C:\Windows\System\PvdFXck.exe
  2⤵
  PID:8948
- C:\Windows\System\hhRfHnn.exe
  C:\Windows\System\hhRfHnn.exe
  2⤵
  PID:8976
- C:\Windows\System\iQkuBJu.exe
  C:\Windows\System\iQkuBJu.exe
  2⤵
  PID:9004
- C:\Windows\System\FMxaFod.exe
  C:\Windows\System\FMxaFod.exe
  2⤵
  PID:9032
- C:\Windows\System\ELDbxMv.exe
  C:\Windows\System\ELDbxMv.exe
  2⤵
  PID:9064
- C:\Windows\System\azKlAcH.exe
  C:\Windows\System\azKlAcH.exe
  2⤵
  PID:9092
- C:\Windows\System\sjoecZz.exe
  C:\Windows\System\sjoecZz.exe
  2⤵
  PID:9120
- C:\Windows\System\vzZRUrs.exe
  C:\Windows\System\vzZRUrs.exe
  2⤵
  PID:9156
- C:\Windows\System\GMDawNr.exe
  C:\Windows\System\GMDawNr.exe
  2⤵
  PID:9176
- C:\Windows\System\UPaSfNE.exe
  C:\Windows\System\UPaSfNE.exe
  2⤵
  PID:9204
- C:\Windows\System\JYHFpaK.exe
  C:\Windows\System\JYHFpaK.exe
  2⤵
  PID:8236
- C:\Windows\System\ERWcISw.exe
  C:\Windows\System\ERWcISw.exe
  2⤵
  PID:8296
- C:\Windows\System\wzNXoDC.exe
  C:\Windows\System\wzNXoDC.exe
  2⤵
  PID:8372
- C:\Windows\System\txXwnna.exe
  C:\Windows\System\txXwnna.exe
  2⤵
  PID:8412
- C:\Windows\System\cbiSqKW.exe
  C:\Windows\System\cbiSqKW.exe
  2⤵
  PID:8488
- C:\Windows\System\PlIPlTE.exe
  C:\Windows\System\PlIPlTE.exe
  2⤵
  PID:8548
- C:\Windows\System\xAssSWs.exe
  C:\Windows\System\xAssSWs.exe
  2⤵
  PID:8608
- C:\Windows\System\yxQQFnE.exe
  C:\Windows\System\yxQQFnE.exe
  2⤵
  PID:8664
- C:\Windows\System\iQNPHav.exe
  C:\Windows\System\iQNPHav.exe
  2⤵
  PID:8736
- C:\Windows\System\WVZTeyp.exe
  C:\Windows\System\WVZTeyp.exe
  2⤵
  PID:8800
- C:\Windows\System\SotAiSN.exe
  C:\Windows\System\SotAiSN.exe
  2⤵
  PID:8860
- C:\Windows\System\ejQGLNY.exe
  C:\Windows\System\ejQGLNY.exe
  2⤵
  PID:8932
- C:\Windows\System\REsEZCL.exe
  C:\Windows\System\REsEZCL.exe
  2⤵
  PID:8996
- C:\Windows\System\ZhrHhcY.exe
  C:\Windows\System\ZhrHhcY.exe
  2⤵
  PID:9060
- C:\Windows\System\KdrnAwE.exe
  C:\Windows\System\KdrnAwE.exe
  2⤵
  PID:9132
- C:\Windows\System\VslRvQu.exe
  C:\Windows\System\VslRvQu.exe
  2⤵
  PID:9196
- C:\Windows\System\hTDaTCh.exe
  C:\Windows\System\hTDaTCh.exe
  2⤵
  PID:8288
- C:\Windows\System\AePXpnv.exe
  C:\Windows\System\AePXpnv.exe
  2⤵
  PID:8456
- C:\Windows\System\NbvQugX.exe
  C:\Windows\System\NbvQugX.exe
  2⤵
  PID:8596
- C:\Windows\System\ovRstLX.exe
  C:\Windows\System\ovRstLX.exe
  2⤵
  PID:8720
- C:\Windows\System\thNCiYp.exe
  C:\Windows\System\thNCiYp.exe
  2⤵
  PID:8888
- C:\Windows\System\JccaMxW.exe
  C:\Windows\System\JccaMxW.exe
  2⤵
  PID:9048
- C:\Windows\System\sRoNikv.exe
  C:\Windows\System\sRoNikv.exe
  2⤵
  PID:9192
- C:\Windows\System\QkQjFRq.exe
  C:\Windows\System\QkQjFRq.exe
  2⤵
  PID:8520
- C:\Windows\System\EXPDwtk.exe
  C:\Windows\System\EXPDwtk.exe
  2⤵
  PID:8848
- C:\Windows\System\kgKZWbg.exe
  C:\Windows\System\kgKZWbg.exe
  2⤵
  PID:9172
- C:\Windows\System\ebxjZQA.exe
  C:\Windows\System\ebxjZQA.exe
  2⤵
  PID:8992
- C:\Windows\System\xHDSRWl.exe
  C:\Windows\System\xHDSRWl.exe
  2⤵
  PID:9228
- C:\Windows\System\ENrdFXZ.exe
  C:\Windows\System\ENrdFXZ.exe
  2⤵
  PID:9256
- C:\Windows\System\GkchHFL.exe
  C:\Windows\System\GkchHFL.exe
  2⤵
  PID:9304
- C:\Windows\System\zVtHCOp.exe
  C:\Windows\System\zVtHCOp.exe
  2⤵
  PID:9320
- C:\Windows\System\dgNEgRl.exe
  C:\Windows\System\dgNEgRl.exe
  2⤵
  PID:9348
- C:\Windows\System\NwrRgir.exe
  C:\Windows\System\NwrRgir.exe
  2⤵
  PID:9364
- C:\Windows\System\zEpjLNd.exe
  C:\Windows\System\zEpjLNd.exe
  2⤵
  PID:9404
- C:\Windows\System\CBtyoVE.exe
  C:\Windows\System\CBtyoVE.exe
  2⤵
  PID:9432
- C:\Windows\System\Pqguslc.exe
  C:\Windows\System\Pqguslc.exe
  2⤵
  PID:9460
- C:\Windows\System\jSYoMfq.exe
  C:\Windows\System\jSYoMfq.exe
  2⤵
  PID:9488
- C:\Windows\System\ZrImAeH.exe
  C:\Windows\System\ZrImAeH.exe
  2⤵
  PID:9516
- C:\Windows\System\uZlCrJq.exe
  C:\Windows\System\uZlCrJq.exe
  2⤵
  PID:9544
- C:\Windows\System\uPRubyl.exe
  C:\Windows\System\uPRubyl.exe
  2⤵
  PID:9572
- C:\Windows\System\PoVfcMl.exe
  C:\Windows\System\PoVfcMl.exe
  2⤵
  PID:9600
- C:\Windows\System\auKfbWZ.exe
  C:\Windows\System\auKfbWZ.exe
  2⤵
  PID:9632
- C:\Windows\System\tBlTpoc.exe
  C:\Windows\System\tBlTpoc.exe
  2⤵
  PID:9660
- C:\Windows\System\eaVwYsu.exe
  C:\Windows\System\eaVwYsu.exe
  2⤵
  PID:9688
- C:\Windows\System\yEzIxCQ.exe
  C:\Windows\System\yEzIxCQ.exe
  2⤵
  PID:9716
- C:\Windows\System\UZjwDxF.exe
  C:\Windows\System\UZjwDxF.exe
  2⤵
  PID:9744
- C:\Windows\System\uXEqkjZ.exe
  C:\Windows\System\uXEqkjZ.exe
  2⤵
  PID:9772
- C:\Windows\System\IuruUTe.exe
  C:\Windows\System\IuruUTe.exe
  2⤵
  PID:9800
- C:\Windows\System\cdIeuXq.exe
  C:\Windows\System\cdIeuXq.exe
  2⤵
  PID:9840
- C:\Windows\System\jGZYDdw.exe
  C:\Windows\System\jGZYDdw.exe
  2⤵
  PID:9856
- C:\Windows\System\rGbjcRO.exe
  C:\Windows\System\rGbjcRO.exe
  2⤵
  PID:9884
- C:\Windows\System\CpBfknE.exe
  C:\Windows\System\CpBfknE.exe
  2⤵
  PID:9912
- C:\Windows\System\SdoRJES.exe
  C:\Windows\System\SdoRJES.exe
  2⤵
  PID:9940
- C:\Windows\System\VMrNnnD.exe
  C:\Windows\System\VMrNnnD.exe
  2⤵
  PID:9968
- C:\Windows\System\xQTOCTj.exe
  C:\Windows\System\xQTOCTj.exe
  2⤵
  PID:9996
- C:\Windows\System\rbRvDlj.exe
  C:\Windows\System\rbRvDlj.exe
  2⤵
  PID:10024
- C:\Windows\System\ITBdWEF.exe
  C:\Windows\System\ITBdWEF.exe
  2⤵
  PID:10052
- C:\Windows\System\BYfdFPX.exe
  C:\Windows\System\BYfdFPX.exe
  2⤵
  PID:10080
- C:\Windows\System\wReuYpC.exe
  C:\Windows\System\wReuYpC.exe
  2⤵
  PID:10108
- C:\Windows\System\nIRZTMM.exe
  C:\Windows\System\nIRZTMM.exe
  2⤵
  PID:10136
- C:\Windows\System\lKpKXVx.exe
  C:\Windows\System\lKpKXVx.exe
  2⤵
  PID:10164
- C:\Windows\System\llzqbQM.exe
  C:\Windows\System\llzqbQM.exe
  2⤵
  PID:10192
- C:\Windows\System\wMiTJMi.exe
  C:\Windows\System\wMiTJMi.exe
  2⤵
  PID:10220
- C:\Windows\System\HxOqXAY.exe
  C:\Windows\System\HxOqXAY.exe
  2⤵
  PID:1620
- C:\Windows\System\yYPZomw.exe
  C:\Windows\System\yYPZomw.exe
  2⤵
  PID:1380
- C:\Windows\System\mAaUANJ.exe
  C:\Windows\System\mAaUANJ.exe
  2⤵
  PID:9292
- C:\Windows\System\sOPyASc.exe
  C:\Windows\System\sOPyASc.exe
  2⤵
  PID:6324
- C:\Windows\System\emneVEc.exe
  C:\Windows\System\emneVEc.exe
  2⤵
  PID:9356
- C:\Windows\System\CiMfbDM.exe
  C:\Windows\System\CiMfbDM.exe
  2⤵
  PID:9420
- C:\Windows\System\pUdcCiz.exe
  C:\Windows\System\pUdcCiz.exe
  2⤵
  PID:9480
- C:\Windows\System\oQZHWxa.exe
  C:\Windows\System\oQZHWxa.exe
  2⤵
  PID:9540
- C:\Windows\System\xvOFwkr.exe
  C:\Windows\System\xvOFwkr.exe
  2⤵
  PID:9616
- C:\Windows\System\pzCPGAF.exe
  C:\Windows\System\pzCPGAF.exe
  2⤵
  PID:9680
- C:\Windows\System\qbIVTdK.exe
  C:\Windows\System\qbIVTdK.exe
  2⤵
  PID:9740
- C:\Windows\System\CymKhVe.exe
  C:\Windows\System\CymKhVe.exe
  2⤵
  PID:9816
- C:\Windows\System\AZZVUpn.exe
  C:\Windows\System\AZZVUpn.exe
  2⤵
  PID:9868
- C:\Windows\System\WceBcqK.exe
  C:\Windows\System\WceBcqK.exe
  2⤵
  PID:9932
- C:\Windows\System\OaOLjCt.exe
  C:\Windows\System\OaOLjCt.exe
  2⤵
  PID:9988
- C:\Windows\System\VMNFzwD.exe
  C:\Windows\System\VMNFzwD.exe
  2⤵
  PID:10048
- C:\Windows\System\vPojKLy.exe
  C:\Windows\System\vPojKLy.exe
  2⤵
  PID:10104
- C:\Windows\System\yGdReIU.exe
  C:\Windows\System\yGdReIU.exe
  2⤵
  PID:10176
- C:\Windows\System\tugBpJx.exe
  C:\Windows\System\tugBpJx.exe
  2⤵
  PID:9220
- C:\Windows\System\yTLAgqk.exe
  C:\Windows\System\yTLAgqk.exe
  2⤵
  PID:9276
- C:\Windows\System\nbUSpqJ.exe
  C:\Windows\System\nbUSpqJ.exe
  2⤵
  PID:9388
- C:\Windows\System\FsPIqoQ.exe
  C:\Windows\System\FsPIqoQ.exe
  2⤵
  PID:9532
- C:\Windows\System\FUwtrsM.exe
  C:\Windows\System\FUwtrsM.exe
  2⤵
  PID:9676
- C:\Windows\System\igcUyNh.exe
  C:\Windows\System\igcUyNh.exe
  2⤵
  PID:9824
- C:\Windows\System\yprbPna.exe
  C:\Windows\System\yprbPna.exe
  2⤵
  PID:9960
- C:\Windows\System\GlXdyXf.exe
  C:\Windows\System\GlXdyXf.exe
  2⤵
  PID:10096
- C:\Windows\System\jDCnTkN.exe
  C:\Windows\System\jDCnTkN.exe
  2⤵
  PID:10216
- C:\Windows\System\ICFXKLd.exe
  C:\Windows\System\ICFXKLd.exe
  2⤵
  PID:9332
- C:\Windows\System\tqtxtiZ.exe
  C:\Windows\System\tqtxtiZ.exe
  2⤵
  PID:9656
- C:\Windows\System\PQdOusX.exe
  C:\Windows\System\PQdOusX.exe
  2⤵
  PID:10020
- C:\Windows\System\waJOntD.exe
  C:\Windows\System\waJOntD.exe
  2⤵
  PID:9252
- C:\Windows\System\iZHqpmt.exe
  C:\Windows\System\iZHqpmt.exe
  2⤵
  PID:9908
- C:\Windows\System\yrBKHGn.exe
  C:\Windows\System\yrBKHGn.exe
  2⤵
  PID:2124
- C:\Windows\System\VUEiSxf.exe
  C:\Windows\System\VUEiSxf.exe
  2⤵
  PID:4352
- C:\Windows\System\BvBgqBD.exe
  C:\Windows\System\BvBgqBD.exe
  2⤵
  PID:10264
- C:\Windows\System\pXCtFIK.exe
  C:\Windows\System\pXCtFIK.exe
  2⤵
  PID:10280
- C:\Windows\System\KvEtgPr.exe
  C:\Windows\System\KvEtgPr.exe
  2⤵
  PID:10320
- C:\Windows\System\gLMgOPY.exe
  C:\Windows\System\gLMgOPY.exe
  2⤵
  PID:10348
- C:\Windows\System\sHKVTSv.exe
  C:\Windows\System\sHKVTSv.exe
  2⤵
  PID:10364
- C:\Windows\System\cGLEUHm.exe
  C:\Windows\System\cGLEUHm.exe
  2⤵
  PID:10400
- C:\Windows\System\tFGyTTo.exe
  C:\Windows\System\tFGyTTo.exe
  2⤵
  PID:10424
- C:\Windows\System\KWEjISL.exe
  C:\Windows\System\KWEjISL.exe
  2⤵
  PID:10448
- C:\Windows\System\qWovwQs.exe
  C:\Windows\System\qWovwQs.exe
  2⤵
  PID:10468
- C:\Windows\System\fgKDnJz.exe
  C:\Windows\System\fgKDnJz.exe
  2⤵
  PID:10496
- C:\Windows\System\bvshtIk.exe
  C:\Windows\System\bvshtIk.exe
  2⤵
  PID:10528
- C:\Windows\System\FMdOqXc.exe
  C:\Windows\System\FMdOqXc.exe
  2⤵
  PID:10544
- C:\Windows\System\qNQYSvJ.exe
  C:\Windows\System\qNQYSvJ.exe
  2⤵
  PID:10600
- C:\Windows\System\vCVUdIp.exe
  C:\Windows\System\vCVUdIp.exe
  2⤵
  PID:10628
- C:\Windows\System\sPPmCwY.exe
  C:\Windows\System\sPPmCwY.exe
  2⤵
  PID:10656
- C:\Windows\System\QdinRjY.exe
  C:\Windows\System\QdinRjY.exe
  2⤵
  PID:10684
- C:\Windows\System\hSWaGkD.exe
  C:\Windows\System\hSWaGkD.exe
  2⤵
  PID:10712
- C:\Windows\System\jRmHnzC.exe
  C:\Windows\System\jRmHnzC.exe
  2⤵
  PID:10740
- C:\Windows\System\aAQZWPe.exe
  C:\Windows\System\aAQZWPe.exe
  2⤵
  PID:10756
- C:\Windows\System\yaIGZio.exe
  C:\Windows\System\yaIGZio.exe
  2⤵
  PID:10796
- C:\Windows\System\PtsGRfQ.exe
  C:\Windows\System\PtsGRfQ.exe
  2⤵
  PID:10824
- C:\Windows\System\yOiICrM.exe
  C:\Windows\System\yOiICrM.exe
  2⤵
  PID:10840
- C:\Windows\System\JzeDavj.exe
  C:\Windows\System\JzeDavj.exe
  2⤵
  PID:10868
- C:\Windows\System\DUdvVTQ.exe
  C:\Windows\System\DUdvVTQ.exe
  2⤵
  PID:10908
- C:\Windows\System\nQctmbH.exe
  C:\Windows\System\nQctmbH.exe
  2⤵
  PID:10936
- C:\Windows\System\QejIJWV.exe
  C:\Windows\System\QejIJWV.exe
  2⤵
  PID:10952
- C:\Windows\System\HwBLUqz.exe
  C:\Windows\System\HwBLUqz.exe
  2⤵
  PID:10984
- C:\Windows\System\CdivSwM.exe
  C:\Windows\System\CdivSwM.exe
  2⤵
  PID:11020
- C:\Windows\System\HWziksI.exe
  C:\Windows\System\HWziksI.exe
  2⤵
  PID:11036
- C:\Windows\System\kMXPmYv.exe
  C:\Windows\System\kMXPmYv.exe
  2⤵
  PID:11076
- C:\Windows\System\LVjmZrk.exe
  C:\Windows\System\LVjmZrk.exe
  2⤵
  PID:11104
- C:\Windows\System\lZJQhiJ.exe
  C:\Windows\System\lZJQhiJ.exe
  2⤵
  PID:11132
- C:\Windows\System\mAtupmb.exe
  C:\Windows\System\mAtupmb.exe
  2⤵
  PID:11148
- C:\Windows\System\DLqQvtW.exe
  C:\Windows\System\DLqQvtW.exe
  2⤵
  PID:11168
- C:\Windows\System\SKHOEzI.exe
  C:\Windows\System\SKHOEzI.exe
  2⤵
  PID:11208
- C:\Windows\System\iBKiVfZ.exe
  C:\Windows\System\iBKiVfZ.exe
  2⤵
  PID:11244
- C:\Windows\System\bFTtNwt.exe
  C:\Windows\System\bFTtNwt.exe
  2⤵
  PID:11260
- C:\Windows\System\CbhIIOx.exe
  C:\Windows\System\CbhIIOx.exe
  2⤵
  PID:10316
- C:\Windows\System\AoiBsJl.exe
  C:\Windows\System\AoiBsJl.exe
  2⤵
  PID:10392
- C:\Windows\System\YxjSfJj.exe
  C:\Windows\System\YxjSfJj.exe
  2⤵
  PID:10444
- C:\Windows\System\dtffCeA.exe
  C:\Windows\System\dtffCeA.exe
  2⤵
  PID:10488
- C:\Windows\System\euggzNr.exe
  C:\Windows\System\euggzNr.exe
  2⤵
  PID:10568
- C:\Windows\System\kACtFkd.exe
  C:\Windows\System\kACtFkd.exe
  2⤵
  PID:10640
- C:\Windows\System\ScAPvDn.exe
  C:\Windows\System\ScAPvDn.exe
  2⤵
  PID:10696
- C:\Windows\System\zFyWYsl.exe
  C:\Windows\System\zFyWYsl.exe
  2⤵
  PID:10752
- C:\Windows\System\vIFXiCf.exe
  C:\Windows\System\vIFXiCf.exe
  2⤵
  PID:10836
- C:\Windows\System\xhBcHmm.exe
  C:\Windows\System\xhBcHmm.exe
  2⤵
  PID:10904
- C:\Windows\System\xbMIcTQ.exe
  C:\Windows\System\xbMIcTQ.exe
  2⤵
  PID:10976
- C:\Windows\System\cPwoyOh.exe
  C:\Windows\System\cPwoyOh.exe
  2⤵
  PID:11012
- C:\Windows\System\bYZwZwh.exe
  C:\Windows\System\bYZwZwh.exe
  2⤵
  PID:11072
- C:\Windows\System\kubhCeg.exe
  C:\Windows\System\kubhCeg.exe
  2⤵
  PID:11128
- C:\Windows\System\gHRTHWc.exe
  C:\Windows\System\gHRTHWc.exe
  2⤵
  PID:11176
- C:\Windows\System\lziINOu.exe
  C:\Windows\System\lziINOu.exe
  2⤵
  PID:11236
- C:\Windows\System\KMshuxx.exe
  C:\Windows\System\KMshuxx.exe
  2⤵
  PID:3672
- C:\Windows\System\hcHaPRS.exe
  C:\Windows\System\hcHaPRS.exe
  2⤵
  PID:10432
- C:\Windows\System\NZxjLWt.exe
  C:\Windows\System\NZxjLWt.exe
  2⤵
  PID:10592
- C:\Windows\System\JdZegkw.exe
  C:\Windows\System\JdZegkw.exe
  2⤵
  PID:10736
- C:\Windows\System\qQujnXm.exe
  C:\Windows\System\qQujnXm.exe
  2⤵
  PID:10932
- C:\Windows\System\kACeiTq.exe
  C:\Windows\System\kACeiTq.exe
  2⤵
  PID:11068
- C:\Windows\System\RXyPwgv.exe
  C:\Windows\System\RXyPwgv.exe
  2⤵
  PID:11196
- C:\Windows\System\SZPilGu.exe
  C:\Windows\System\SZPilGu.exe
  2⤵
  PID:10276
- C:\Windows\System\zVlRkrD.exe
  C:\Windows\System\zVlRkrD.exe
  2⤵
  PID:10820
- C:\Windows\System\kUTDZbY.exe
  C:\Windows\System\kUTDZbY.exe
  2⤵
  PID:11200
- C:\Windows\System\mrLLWva.exe
  C:\Windows\System\mrLLWva.exe
  2⤵
  PID:10708
- C:\Windows\System\jPIWxLC.exe
  C:\Windows\System\jPIWxLC.exe
  2⤵
  PID:11156
- C:\Windows\System\aXEvqzP.exe
  C:\Windows\System\aXEvqzP.exe
  2⤵
  PID:11276
- C:\Windows\System\XHspxvP.exe
  C:\Windows\System\XHspxvP.exe
  2⤵
  PID:11304
- C:\Windows\System\sYIuQqn.exe
  C:\Windows\System\sYIuQqn.exe
  2⤵
  PID:11328
- C:\Windows\System\JZFEaLA.exe
  C:\Windows\System\JZFEaLA.exe
  2⤵
  PID:11344
- C:\Windows\System\dgBPlPs.exe
  C:\Windows\System\dgBPlPs.exe
  2⤵
  PID:11376
- C:\Windows\System\FJBqNgi.exe
  C:\Windows\System\FJBqNgi.exe
  2⤵
  PID:11400
- C:\Windows\System\WzkGGvs.exe
  C:\Windows\System\WzkGGvs.exe
  2⤵
  PID:11440
- C:\Windows\System\ImAkLsR.exe
  C:\Windows\System\ImAkLsR.exe
  2⤵
  PID:11480
- C:\Windows\System\qtVixrm.exe
  C:\Windows\System\qtVixrm.exe
  2⤵
  PID:11496
- C:\Windows\System\fcTEXCc.exe
  C:\Windows\System\fcTEXCc.exe
  2⤵
  PID:11536
- C:\Windows\System\OYPpAmm.exe
  C:\Windows\System\OYPpAmm.exe
  2⤵
  PID:11564
- C:\Windows\System\PfnOIMm.exe
  C:\Windows\System\PfnOIMm.exe
  2⤵
  PID:11588
- C:\Windows\System\ahZbnbW.exe
  C:\Windows\System\ahZbnbW.exe
  2⤵
  PID:11604
- C:\Windows\System\MBspnCp.exe
  C:\Windows\System\MBspnCp.exe
  2⤵
  PID:11628
- C:\Windows\System\BAzIKjw.exe
  C:\Windows\System\BAzIKjw.exe
  2⤵
  PID:11676
- C:\Windows\System\OjepFOk.exe
  C:\Windows\System\OjepFOk.exe
  2⤵
  PID:11704
- C:\Windows\System\FdDSetH.exe
  C:\Windows\System\FdDSetH.exe
  2⤵
  PID:11720
- C:\Windows\System\ZQKpKkS.exe
  C:\Windows\System\ZQKpKkS.exe
  2⤵
  PID:11760
- C:\Windows\System\svowrTk.exe
  C:\Windows\System\svowrTk.exe
  2⤵
  PID:11788
- C:\Windows\System\BNyqCcU.exe
  C:\Windows\System\BNyqCcU.exe
  2⤵
  PID:11816
- C:\Windows\System\GjXvHGr.exe
  C:\Windows\System\GjXvHGr.exe
  2⤵
  PID:11844
- C:\Windows\System\kxJlote.exe
  C:\Windows\System\kxJlote.exe
  2⤵
  PID:11872
- C:\Windows\System\OXqNzxu.exe
  C:\Windows\System\OXqNzxu.exe
  2⤵
  PID:11904
- C:\Windows\System\xIEaYyg.exe
  C:\Windows\System\xIEaYyg.exe
  2⤵
  PID:11924
- C:\Windows\System\IoGUVYg.exe
  C:\Windows\System\IoGUVYg.exe
  2⤵
  PID:11952
- C:\Windows\System\xJEytvD.exe
  C:\Windows\System\xJEytvD.exe
  2⤵
  PID:11976
- C:\Windows\System\hUHVakR.exe
  C:\Windows\System\hUHVakR.exe
  2⤵
  PID:12012
- C:\Windows\System\uMZZnxD.exe
  C:\Windows\System\uMZZnxD.exe
  2⤵
  PID:12044
- C:\Windows\System\TIpjkDO.exe
  C:\Windows\System\TIpjkDO.exe
  2⤵
  PID:12072
- C:\Windows\System\bzKEPWo.exe
  C:\Windows\System\bzKEPWo.exe
  2⤵
  PID:12088
- C:\Windows\System\oZkOhLZ.exe
  C:\Windows\System\oZkOhLZ.exe
  2⤵
  PID:12124
- C:\Windows\System\wPwBSVP.exe
  C:\Windows\System\wPwBSVP.exe
  2⤵
  PID:12156
- C:\Windows\System\UqDqRIP.exe
  C:\Windows\System\UqDqRIP.exe
  2⤵
  PID:12184
- C:\Windows\System\knrCgoB.exe
  C:\Windows\System\knrCgoB.exe
  2⤵
  PID:12212
- C:\Windows\System\hobuXIn.exe
  C:\Windows\System\hobuXIn.exe
  2⤵
  PID:12228
- C:\Windows\System\mQfVeDT.exe
  C:\Windows\System\mQfVeDT.exe
  2⤵
  PID:12268
- C:\Windows\System\irlOFRK.exe
  C:\Windows\System\irlOFRK.exe
  2⤵
  PID:10668
- C:\Windows\System\cbnpcCf.exe
  C:\Windows\System\cbnpcCf.exe
  2⤵
  PID:11336
- C:\Windows\System\kRbZWnz.exe
  C:\Windows\System\kRbZWnz.exe
  2⤵
  PID:11392
- C:\Windows\System\bMeHUlo.exe
  C:\Windows\System\bMeHUlo.exe
  2⤵
  PID:11476
- C:\Windows\System\PEQRcIk.exe
  C:\Windows\System\PEQRcIk.exe
  2⤵
  PID:11528
- C:\Windows\System\DjDyzlj.exe
  C:\Windows\System\DjDyzlj.exe
  2⤵
  PID:11612
- C:\Windows\System\tUKTXLJ.exe
  C:\Windows\System\tUKTXLJ.exe
  2⤵
  PID:11668
- C:\Windows\System\dCEkDNq.exe
  C:\Windows\System\dCEkDNq.exe
  2⤵
  PID:11732
- C:\Windows\System\TPWmebZ.exe
  C:\Windows\System\TPWmebZ.exe
  2⤵
  PID:11804
- C:\Windows\System\TFzNTOi.exe
  C:\Windows\System\TFzNTOi.exe
  2⤵
  PID:4032
- C:\Windows\System\AOBuRVO.exe
  C:\Windows\System\AOBuRVO.exe
  2⤵
  PID:11888
- C:\Windows\System\DnUUkcm.exe
  C:\Windows\System\DnUUkcm.exe
  2⤵
  PID:11944
- C:\Windows\System\YsgCxmh.exe
  C:\Windows\System\YsgCxmh.exe
  2⤵
  PID:12056
- C:\Windows\System\kSixkBV.exe
  C:\Windows\System\kSixkBV.exe
  2⤵
  PID:12116
- C:\Windows\System\qCiLkGj.exe
  C:\Windows\System\qCiLkGj.exe
  2⤵
  PID:12176
- C:\Windows\System\GIpOdlQ.exe
  C:\Windows\System\GIpOdlQ.exe
  2⤵
  PID:12264
- C:\Windows\System\dQgLvCm.exe
  C:\Windows\System\dQgLvCm.exe
  2⤵
  PID:11384
- C:\Windows\System\cOFEOHt.exe
  C:\Windows\System\cOFEOHt.exe
  2⤵
  PID:11456
- C:\Windows\System\gLZQClH.exe
  C:\Windows\System\gLZQClH.exe
  2⤵
  PID:11648
- C:\Windows\System\qnTOCmw.exe
  C:\Windows\System\qnTOCmw.exe
  2⤵
  PID:11716
- C:\Windows\System\BMaBCOq.exe
  C:\Windows\System\BMaBCOq.exe
  2⤵
  PID:11932
- C:\Windows\System\xXSHAGF.exe
  C:\Windows\System\xXSHAGF.exe
  2⤵
  PID:12112
- C:\Windows\System\SnqSGNN.exe
  C:\Windows\System\SnqSGNN.exe
  2⤵
  PID:12260
- C:\Windows\System\mbvwuTd.exe
  C:\Windows\System\mbvwuTd.exe
  2⤵
  PID:11600
- C:\Windows\System\HmiuRfm.exe
  C:\Windows\System\HmiuRfm.exe
  2⤵
  PID:4236
- C:\Windows\System\bfHLqoS.exe
  C:\Windows\System\bfHLqoS.exe
  2⤵
  PID:12240
- C:\Windows\System\ngTbuuc.exe
  C:\Windows\System\ngTbuuc.exe
  2⤵
  PID:12020
- C:\Windows\System\rGCVQjT.exe
  C:\Windows\System\rGCVQjT.exe
  2⤵
  PID:11700
- C:\Windows\System\aZUMVGw.exe
  C:\Windows\System\aZUMVGw.exe
  2⤵
  PID:12312
- C:\Windows\System\uAHKDyt.exe
  C:\Windows\System\uAHKDyt.exe
  2⤵
  PID:12328
- C:\Windows\System\OZPASqY.exe
  C:\Windows\System\OZPASqY.exe
  2⤵
  PID:12348
- C:\Windows\System\KeVZTrr.exe
  C:\Windows\System\KeVZTrr.exe
  2⤵
  PID:12376
- C:\Windows\System\lZbjTlw.exe
  C:\Windows\System\lZbjTlw.exe
  2⤵
  PID:12396
- C:\Windows\System\WeRtato.exe
  C:\Windows\System\WeRtato.exe
  2⤵
  PID:12420
- C:\Windows\System\nqfUnhd.exe
  C:\Windows\System\nqfUnhd.exe
  2⤵
  PID:12444
- C:\Windows\System\tiNSOuw.exe
  C:\Windows\System\tiNSOuw.exe
  2⤵
  PID:12472
- C:\Windows\System\ZcKsIIg.exe
  C:\Windows\System\ZcKsIIg.exe
  2⤵
  PID:12520
- C:\Windows\System\VtOvGmO.exe
  C:\Windows\System\VtOvGmO.exe
  2⤵
  PID:12548
- C:\Windows\System\mkUJmjV.exe
  C:\Windows\System\mkUJmjV.exe
  2⤵
  PID:12592
- C:\Windows\System\uzYkEKl.exe
  C:\Windows\System\uzYkEKl.exe
  2⤵
  PID:12608
- C:\Windows\System\MtWzFVJ.exe
  C:\Windows\System\MtWzFVJ.exe
  2⤵
  PID:12648
- C:\Windows\System\JqnTDHj.exe
  C:\Windows\System\JqnTDHj.exe
  2⤵
  PID:12684
- C:\Windows\System\asUTiYF.exe
  C:\Windows\System\asUTiYF.exe
  2⤵
  PID:12700
- C:\Windows\System\aUmWNiW.exe
  C:\Windows\System\aUmWNiW.exe
  2⤵
  PID:12724
- C:\Windows\System\CMFsyjr.exe
  C:\Windows\System\CMFsyjr.exe
  2⤵
  PID:12760
- C:\Windows\System\aEZddIM.exe
  C:\Windows\System\aEZddIM.exe
  2⤵
  PID:12780
- C:\Windows\System\pczbAqp.exe
  C:\Windows\System\pczbAqp.exe
  2⤵
  PID:12808
- C:\Windows\System\kPLeuJU.exe
  C:\Windows\System\kPLeuJU.exe
  2⤵
  PID:12840
- C:\Windows\System\wVVkArz.exe
  C:\Windows\System\wVVkArz.exe
  2⤵
  PID:12872
- C:\Windows\System\AhePBzJ.exe
  C:\Windows\System\AhePBzJ.exe
  2⤵
  PID:12912
- C:\Windows\System\togyTEz.exe
  C:\Windows\System\togyTEz.exe
  2⤵
  PID:12940
- C:\Windows\System\sJxkmPc.exe
  C:\Windows\System\sJxkmPc.exe
  2⤵
  PID:12968
- C:\Windows\System\ShOxHZG.exe
  C:\Windows\System\ShOxHZG.exe
  2⤵
  PID:12996
- C:\Windows\System\qWqeGhl.exe
  C:\Windows\System\qWqeGhl.exe
  2⤵
  PID:13024
- C:\Windows\System\HbsdbrA.exe
  C:\Windows\System\HbsdbrA.exe
  2⤵
  PID:13052
- C:\Windows\System\VRYkpCK.exe
  C:\Windows\System\VRYkpCK.exe
  2⤵
  PID:13080
- C:\Windows\System\YJycfkC.exe
  C:\Windows\System\YJycfkC.exe
  2⤵
  PID:13108
- C:\Windows\System\cbLmvWX.exe
  C:\Windows\System\cbLmvWX.exe
  2⤵
  PID:13136
- C:\Windows\System\zzdQkQC.exe
  C:\Windows\System\zzdQkQC.exe
  2⤵
  PID:13164
- C:\Windows\System\iHPhsSZ.exe
  C:\Windows\System\iHPhsSZ.exe
  2⤵
  PID:13192
- C:\Windows\System\hTOPxTo.exe
  C:\Windows\System\hTOPxTo.exe
  2⤵
  PID:13220
- C:\Windows\System\FPSowss.exe
  C:\Windows\System\FPSowss.exe
  2⤵
  PID:13240
- C:\Windows\System\HrUQiMq.exe
  C:\Windows\System\HrUQiMq.exe
  2⤵
  PID:13280
- C:\Windows\System\thcUjlN.exe
  C:\Windows\System\thcUjlN.exe
  2⤵
  PID:13308
- C:\Windows\System\dXwUELx.exe
  C:\Windows\System\dXwUELx.exe
  2⤵
  PID:12336
- C:\Windows\System\hoSXWft.exe
  C:\Windows\System\hoSXWft.exe
  2⤵
  PID:12432
- C:\Windows\System\JPIuEdM.exe
  C:\Windows\System\JPIuEdM.exe
  2⤵
  PID:12464
- C:\Windows\System\jqwHIHV.exe
  C:\Windows\System\jqwHIHV.exe
  2⤵
  PID:12508
- C:\Windows\System\UFStfsg.exe
  C:\Windows\System\UFStfsg.exe
  2⤵
  PID:12600
- C:\Windows\System\ECgoGcQ.exe
  C:\Windows\System\ECgoGcQ.exe
  2⤵
  PID:11808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_l5l2bvs3.3c0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5l2bvs3.3c0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AkXMJgs.exe

Path C:\Windows\System\AkXMJgs.exe
Size 3.1MB
SHA256 bdb1034f43d7fb878c4fcdb91232988213b03474ae8a66928282c62251539eb5
MD5 67a4cdb159e5b3b48ab1d2843db2395c
SHA1 a9c9f844b433aa611e0926fff2d697e5da75158e
SHA512 bb4e69215cdb26ee655fdee34615cffc17921ccd181a66d45dc99f9955a9e968887914d8a91b95d1659c85dbd451dc60f15ecfffb49a7de5e3730cf776c8410d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CUzEZxw.exe

Path C:\Windows\System\CUzEZxw.exe
Size 3.1MB
SHA256 3ca599bd777ce037cfbd114f51cc1d5401c8513ca78b4de2815a524cfa336750
MD5 3a7c17eea9e9068fb450bbe7a4f7d83f
SHA1 5702f8781293d73be2d77928f9d0b37106ee1ef2
SHA512 b5667ca91467c1fcfb8c9bc2b2e5f82d95dc08b81b64ac6956565df6b6bc266c4283d96f202d23653e5284d9a5eb79b2c8b425e9d928d5ff41af454590fef57a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CjOQXmx.exe

Path C:\Windows\System\CjOQXmx.exe
Size 3.1MB
SHA256 3456ea32830ed0b3c153788f8515d8d34f01c60356860dc3565623b7bf12e986
MD5 c00b521b581ddab460d8345b3c978ec3
SHA1 46993bd1acb71e77375bfb2c9e2c48caa3f21777
SHA512 2d9b6acf6dcc9e1ca015e8436760b1f5886ddc5a414325f3f8c7c59c6fca6d544fb217dc87436d6476bf6fe59c1299a1c33d522d80cc54a590e522505141780d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ENlrUcj.exe

Path C:\Windows\System\ENlrUcj.exe
Size 3.1MB
SHA256 2929fba3dbf855fc8ce728363a82693c64ffe6e9cf35f6f36fb932f6b6e1886a
MD5 832befbe48ec1089a2fca79325cf3389
SHA1 5f77455b0aca32937ea54b37ab3710c64777800f
SHA512 585e57e0c1165e8110014cd93bd30cd1245eff5859f4e330905ea4820dcb781fb41b2ceca219bd337c8a4ea891c74556ac0111b1a15e3f5bc9ca887e2595c06e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ESiwQjD.exe

Path C:\Windows\System\ESiwQjD.exe
Size 3.1MB
SHA256 40c32077eb0838862ca19b35f7aa7e602c7fde82e396b351d9635c610e9df6b3
MD5 9b1384bd222fa269f1a4891bf7020fa0
SHA1 7656b7f6362be19b15b5b823249e52dac9cdc79d
SHA512 ff71947416bc8cfd40d1e2bbb6f58c5903027d8e4c0f8ad897abc10b7fb119d97eafb702dc3c498a1726ff22ec7aab096ae6632c509ca296569262aad11bb32f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

FRpUZXw.exe

Path C:\Windows\System\FRpUZXw.exe
Size 3.1MB
SHA256 74a91bcc2e172a6a3d2f4f8ca1e41866156a54cea863101a391e4bc3b8f1d12c
MD5 a311f2f7d82d79d4527816acf2377f3f
SHA1 72c53ef689528297d87879a155ebb8de289ee4b0
SHA512 49769043471ca014958e2827254db517fbaff0d2711fe6ed93a011f56b70163cdac56d72f415124b4a01c728c6e6d5b5bbe2c875ef7a82e2d876295dbde4632e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHUTPWB.exe

Path C:\Windows\System\GHUTPWB.exe
Size 3.1MB
SHA256 43a56eda117da0d5d2e5b8c0434e7b36ed3203119b23ab617983e721afddb05f
MD5 69988e85f4a324b5033d0bb3d8d16d35
SHA1 83b2e7b482b9eb68195ad8d63c2a9f29ffd0412d
SHA512 b4b7c2e321bfd0423ef509a255a12304dcd2704e0d549654e33fe762786ff329d348ef45947d5c17c8b41f21f4a07ddeca5ac8aaba76ff362673bb080b8d5edd
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVcZDyS.exe

Path C:\Windows\System\HVcZDyS.exe
Size 3.1MB
SHA256 7038347235e1d1364b9bb61bbf31d0851eafd5adef702276ca5567c55b4b0d64
MD5 c746bfbc61ad8a3a1f67651a95223e05
SHA1 8b35b7e990c15edd77a742044e2b9ff50c117335
SHA512 29409efcb9047f199bc96464ba50575e81269a9d74dfefd8dcaf7c25ee078f930026aa7843bef36c322a4dd772fcad84e9b12f9dc89cbf9639801485b7e1a04e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:7bBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

KiLDxCB.exe

Path C:\Windows\System\KiLDxCB.exe
Size 3.1MB
SHA256 b0dc2a1725ab74453e53360287aaa689eabb33e10fb556eaecbbb5568137641b
MD5 b64577517e4844784472f622d44ca9d1
SHA1 bbe449b0049eed399bc9cdb7ea68eb8c803a9956
SHA512 58653b1a70d4d3d42a7e4e72a6f1583a50f8b100abae8d4118c12d47db9c8fd27a88c5512693688cbf0ae29e6e590df3ecec61aa88c5701014f0e52738f76c33
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:7bBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

KuOHGMi.exe

Path C:\Windows\System\KuOHGMi.exe
Size 3.1MB
SHA256 b092d0b2966d41bb82a7827181a1d6a21ac6e809a3b316c4cab89e4dd8b69135
MD5 c066c007b70b7755cbbd72a01478724a
SHA1 502b9fd97f8078a957166abdfa198e51827d4370
SHA512 8edcb60c5e48f68ba253d892c37e23e2f33b9a25455c6476f44eb6bd024eef816750e0737b25c20ded2a8f7e9e3ee8298c617389df614f6d33e6a6354d3344a4
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

LGdnJoR.exe

Path C:\Windows\System\LGdnJoR.exe
Size 3.1MB
SHA256 22338ea35d83dd8b47a05b6e75ed643d25966bade60bb837a4bab3ff929faa9d
MD5 b7fe9ffdc639499ba41da3ff4793e854
SHA1 c4f78a67b80d2e2d557072aad3a3061e0d486cc3
SHA512 01de2b2cca94e2aff6f0c514ac39b8fdc7eb4762dc8fc91c49a66e223d73ad8c33b9b585216a055d25409cce3c60eac6051f278e6cf23243df7dc93139459db7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

LRQcqhU.exe

Path C:\Windows\System\LRQcqhU.exe
Size 3.1MB
SHA256 f3b9b80ba6ad4f9f24506fd895be1e25bd8a14b1a60b99cff2dff7dc10bbfbab
MD5 5c29a8be49372e1a1e32b30a2a6cc512
SHA1 62e132cb9bca4edf657991a5810724e61264394a
SHA512 cf96722357c78f5d2253655486730b414c6b2987bc204910d4c6d50c37cfbe4f1534385526039ed17384667f47e634862378812616cadd301eaaee5d65541e2f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojcmrxj.exe

Path C:\Windows\System\Ojcmrxj.exe
Size 3.1MB
SHA256 0ff84adec802ffbadf23ab4fc70c7f66e029e7f634ba5df07e52e1f5831157d8
MD5 611ed835e9a5c36636bce094677c3137
SHA1 f20ad2ea136b78685132f1d044d1e24370163c39
SHA512 fc41cc8a238e3a23b6cc30677357f6ac213a84eb414b2c268ff3147dd85cd176be06710ffeeb8dac0355750bd54aaac8a33e1afd644c10d09dbd557b97c837c2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OonzyzC.exe

Path C:\Windows\System\OonzyzC.exe
Size 3.1MB
SHA256 6939245adc695ae2dfa39fd06751fc2cffc1dbc3989564b37dfd540fb1bf9414
MD5 caedea192ec6cf122d40702d3323445f
SHA1 02a4d6513d6a295d9480351e554aa0e8dd7fcd21
SHA512 f67f933fe46f4498b4be5211eeb1c5ca80f9306364266ada290888dc80aaf02eeb4a66f44cacf0ad935209639256732ec543a867460514e99ef82bb6b6f2dacc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PZiicjG.exe

Path C:\Windows\System\PZiicjG.exe
Size 3.1MB
SHA256 0e72baf39928b4873ed12df2e5bc492b658fe3311644af58190a2e7558225acd
MD5 4502fdeaeeeb3788515d399b9a961d9a
SHA1 c2971bb11313ff3bf9f0e008a50ba36f696f5036
SHA512 fbbc0aa1896d23e11d8bd35f78b5165561c67845dcc17efd041db44f01672986934fb7293af2fb4e6cdca8ae8f0b1ea9f310f9d98ead5b3f37dece35a497928d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW3:7bBeSFkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RSzPDQi.exe

Path C:\Windows\System\RSzPDQi.exe
Size 3.1MB
SHA256 3e29eb6dd2366857aa7afffd85d9ded484b380fef5f12ebb9c149348ba791e1b
MD5 969a8b644aab291326ee6e11bd1ac517
SHA1 1cd47b51c8fa189396c39f53b7e7eda4eafb403c
SHA512 2fb0b840b4f9c75dc11bac47e4fdc91fb3a6d7ab36d1d518cea1a955c4bb7ee45cd67665edca7931a5327dc8031fab499f3c1aad932368af078baaa1038f4080
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFky
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShDBStn.exe

Path C:\Windows\System\ShDBStn.exe
Size 3.1MB
SHA256 36d85c8f0c486da29938895c0c1742389471defa528b69d2e6282608462a7891
MD5 ae75460b407e074a1320e7a87be0fb7d
SHA1 fd08a03d465ebe6d51e213684bdc95261a0c919e
SHA512 2826d5e46af5b9ba50219f145046a77dd6fcb41f31267bcec81db75df5fd4a00ad8d6fc46c0e8d26c6aa3c725e27320136b511fb323912af0347dad5f711e2de
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

URBtihP.exe

Path C:\Windows\System\URBtihP.exe
Size 3.1MB
SHA256 605aac766bd46b19c1a2847e60a3d9ef10abfd7b05db882c07404215fc2d7375
MD5 7f063ef82b23d9bee72265ef7c507c7c
SHA1 c817f85154f47cf55bf8aa142f412e2d8dbe7622
SHA512 a671167c0f3e9ed1dee4dd9ae2bd23ecdb07502b9f49ff92e5fd101a4c9c092d612df7ab26275c703f74b48a6aa1545504f6dc8514229b8548d10758985b62ea
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMIyNMW.exe

Path C:\Windows\System\VMIyNMW.exe
Size 3.1MB
SHA256 25d981d54210055d03aa704d693f90974f8c5d21bf44abefc48eadc526069ea8
MD5 2ac3f4e1524746994e80706f7d48167e
SHA1 8e54dc32c5c97c0f6953b9b57805c08acb0823c9
SHA512 23b0207d5f769147dff98d52ebb1dcc4f0146210d9a51b1ba06788d853883349d87c58a83057f8d8ffa4e2f2f124cdb47877331e33bfdfae2332b27fb132cd14
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:7bBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

VtECtzB.exe

Path C:\Windows\System\VtECtzB.exe
Size 3.1MB
SHA256 3632a3ae2f949d8ef1f7c6a72426b90743b87506ca51fc3f51e45bba3d2448ac
MD5 50f6056ec77389b4720019e6de5c7220
SHA1 98bec098b12e6fc099f497c4f8a47ac134821b03
SHA512 cc475cfe1ded4c4be9e7e742a79ca3f9f50ad02e82c131e0d167b075d2be7ccf04f1b6b579eeb4606886ca6eec89e2a62111bddee93191e98fd5cf827ec715ec
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:7bBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

XVUnqtZ.exe

Path C:\Windows\System\XVUnqtZ.exe
Size 3.1MB
SHA256 dae00524cfce1f705ddc45ef0857682507e5e35f79a35b37b72fd6c859a694ef
MD5 77df9f75933a2b2acee6bc432a3ec617
SHA1 d37d0828c8ed381a03112269c20df13eea3999d3
SHA512 8263759d60ae471376588ae452c07ab9f21ba61f0c6a7cc606e1b1d04f7bc3c38cff5ddce8a4c085d06e5322982200a0087eda0062144dbc4e3a1d683b9c8694
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

YLRirYt.exe

Path C:\Windows\System\YLRirYt.exe
Size 3.1MB
SHA256 724c11b028d9d36a45edc72d88794efd3e2408eca9e267ffde0450d61084322d
MD5 04da55c36f785c38a83e71b491e7478b
SHA1 a6e1cbf22023daa5a22cc11fa7a918114499694c
SHA512 4fd5943b33f8504f874f474caedf549d6c9c1e24abad8b63d4da0fb84c1a91f09ce998c7b5e38535d685dad120c6eb2e9e245cad67ee3d5ad47555130691d3c6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWI:7bBeSFkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

eUVhgCv.exe

Path C:\Windows\System\eUVhgCv.exe
Size 3.1MB
SHA256 5f3f8632634c7035067a0b2eb58222b37174d6b5dae94f0bba40ec72d21214c3
MD5 b162dabb827c1c4de9ab5563d3e812d9
SHA1 5a395f10563cbc658daa29074642099064d2326a
SHA512 aebcfc3c5700b5b7e577b749281ad2eca87afb45f3f214a6633c78e4170fc3ce3a1b66be1e027884cf063c6169cbddedc45ba9296d0d2148de3a96114a4c092e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGuToHv.exe

Path C:\Windows\System\oGuToHv.exe
Size 3.1MB
SHA256 d8bdf88da3fa83a0ea9969ed5d3ce9120e32a69ef3c7799c31d43f9cf1d20cf9
MD5 01ae660feb1e7a0dd8097a10a9ba105d
SHA1 2e12c8b751f84a27611e1bc9b060270579c12267
SHA512 80014ebd425c4b058f5d953f332ad557a229dba224a2104096e2228c2504b38f16359d9d5eb29367b4c3ca263b7526d92ad4a26ea46d13e0e69ce158cf0418d8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

oIoqgTw.exe

Path C:\Windows\System\oIoqgTw.exe
Size 3.1MB
SHA256 1c0ae9a713aab2d32b5c53c9aef98a033b15a31359d4592d021457626244893d
MD5 6c7d92ad9c89ea10e0375b725677a3d5
SHA1 8def06cd759d3789e821de7bb4cc5c4ddf0bb2b6
SHA512 12085f2d8a54354b43348d78219467ee8bfaa157e73568ba1a79c46616b25c85f18145b0044617512118bd7a4f73416ff6574111c14edc545f3eafaee585912a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWd:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwHlcAq.exe

Path C:\Windows\System\pwHlcAq.exe
Size 3.1MB
SHA256 b7b2a4fa945f501d8c6a4fb53c90900aac83297518bcf9a51b1039c36379e52e
MD5 caf32e215e419dfac854a54d3f5d0c62
SHA1 6a0f7c979a4de355fd82c589416bb2a0ae963535
SHA512 dac44f60b6be8562fc6338d9d3141e304682166b47ef2f3d4d461e4992d7356f209ce9957467476de83d275337f14f1b1e9bbc7d3def0c6d0636b47f5c6b9260
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tSadGaZ.exe

Path C:\Windows\System\tSadGaZ.exe
Size 3.1MB
SHA256 fe369152ffc392b52d6b1b132bdb131cde36aca86ceffd7be6fcf45f4443464e
MD5 8dd496efa25a6a699113a5d1b91b61b7
SHA1 43fe80c1235e457eb240b35073341779a4d1e86a
SHA512 2893d62fe3c5a992471a9086a1ceba17a4597cb5479c7b2539362513d5ecf917a06735c266dfcc11707125f5f1b773e20b936cdd5488c9fdc590c685b252919a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

vHSIyyd.exe

Path C:\Windows\System\vHSIyyd.exe
Size 3.1MB
SHA256 42074c4ae074fe568d8b02067abef6ffb04c6767be3a8cc1a084f30853e0dbec
MD5 2e29ceba7aa94f11fd03861edd9740ee
SHA1 d7fb4c48a0243da39de7103d5a8be240a2abae2f
SHA512 b7374190ef866434895b0558f8f10d4e6fb661ad68f23e6c35c33a0db156f3d525603ee0eedecbc6702496ff24f3c30aaf5e92fd1c8cde4fa9644e87b17890a0
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:7bBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xINRWEV.exe

Path C:\Windows\System\xINRWEV.exe
Size 3.1MB
SHA256 9b98e71d035fef2f31f7aa475e27b5aa5ec03cacf919051282585ec1f5e8bf14
MD5 3f7a2b0d4b3e7ee62d3646013cde8707
SHA1 c2333898315470bd85106a83ca1dc5bf835ba75d
SHA512 3ec9bfa3e296448d33702dfcf3a2c1f08cbb279f99e0a689a7219fd02314354c83d07804f588c85b0d24fae1e80f49dd46aab72a83a3a5211addf6de1e075052
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLKncPx.exe

Path C:\Windows\System\xLKncPx.exe
Size 3.1MB
SHA256 8851166347123db690ce0715126ce2bb9dc95aa5aff82465c104becac564066c
MD5 5af8e8580d535486a0217bb57330cf1f
SHA1 f211b04b0c6ca5239e8ed4b19483318e79876957
SHA512 94e2d74f86f2ee26db8ab389d0c7f0ffc3a499f7c25fa3503f35f72e82b6df097dafdc86ad9c360d940170faf3cb56edbdc6ac64d85a4085c680163dc967ead9
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

xlkMiFp.exe

Path C:\Windows\System\xlkMiFp.exe
Size 3.1MB
SHA256 2198f5833a36bf74b035d2ea95a3ff341f92b038d37da1e4a2da969d6ab4a244
MD5 1bb39110a96b83bbc33f5a0fc1f859f3
SHA1 dff1b40c77d47d864e966f828efc571643373f1c
SHA512 770b3531a50e7a27763f26df1bb168b7c8fa7c660337cdc1ed709f568061c2149b9942812d5936cf09ba978f870e2614174f5bc91368d287d3c56caecfc4e768
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvCtfRy.exe

Path C:\Windows\System\xvCtfRy.exe
Size 3.1MB
SHA256 c36f4acc286fa1be102719bb7590f1d08e0658d06240cbcde7cde66810fc7a6d
MD5 e908848e6b48d3497697e3078feaceff
SHA1 128168872fc2e40690c8da3de93b930fb353d813
SHA512 bcadf7e4c328efa87053724db25799cb712448130a1d5564707b9d09dc54741297039ac4e41ea003066dff6f42c1333ea7fdc1fcd3b905c6a51fb9a44ec760ed
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-20-0x00007FFEF97C0000-0x00007FFEFA281000-memory.dmp

Download

memory/396-3-0x00007FFEF97C3000-0x00007FFEF97C5000-memory.dmp

Download

memory/396-43-0x00007FFEF97C0000-0x00007FFEFA281000-memory.dmp

Download

memory/396-23-0x00000203AB270000-0x00000203AB292000-memory.dmp

Download

memory/396-1792-0x00007FFEF97C0000-0x00007FFEFA281000-memory.dmp

Download

memory/1388-84-0x00007FF6FA540000-0x00007FF6FA936000-memory.dmp

Download

memory/1388-1941-0x00007FF6FA540000-0x00007FF6FA936000-memory.dmp

Download

memory/1720-638-0x00007FF64E150000-0x00007FF64E546000-memory.dmp

Download

memory/1720-1945-0x00007FF64E150000-0x00007FF64E546000-memory.dmp

Download

memory/1736-635-0x00007FF71B950000-0x00007FF71BD46000-memory.dmp

Download

memory/1736-1940-0x00007FF71B950000-0x00007FF71BD46000-memory.dmp

Download

memory/1792-632-0x00007FF75B570000-0x00007FF75B966000-memory.dmp

Download

memory/1792-1952-0x00007FF75B570000-0x00007FF75B966000-memory.dmp

Download

memory/1812-9-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp

Download

memory/1812-1932-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp

Download

memory/1812-1934-0x00007FF6929B0000-0x00007FF692DA6000-memory.dmp

Download

memory/1892-629-0x00007FF745BF0000-0x00007FF745FE6000-memory.dmp

Download

memory/1892-1954-0x00007FF745BF0000-0x00007FF745FE6000-memory.dmp

Download

memory/2168-622-0x00007FF6D7660000-0x00007FF6D7A56000-memory.dmp

Download

memory/2168-1944-0x00007FF6D7660000-0x00007FF6D7A56000-memory.dmp

Download

memory/2176-630-0x00007FF6F5AD0000-0x00007FF6F5EC6000-memory.dmp

Download

memory/2176-1956-0x00007FF6F5AD0000-0x00007FF6F5EC6000-memory.dmp

Download

memory/2184-1953-0x00007FF6645B0000-0x00007FF6649A6000-memory.dmp

Download

memory/2184-628-0x00007FF6645B0000-0x00007FF6649A6000-memory.dmp

Download

memory/2404-1938-0x00007FF64D5F0000-0x00007FF64D9E6000-memory.dmp

Download

memory/2404-67-0x00007FF64D5F0000-0x00007FF64D9E6000-memory.dmp

Download

memory/2528-634-0x00007FF7C8A70000-0x00007FF7C8E66000-memory.dmp

Download

memory/2528-1936-0x00007FF7C8A70000-0x00007FF7C8E66000-memory.dmp

Download

memory/2680-1937-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp

Download

memory/2680-62-0x00007FF7FA590000-0x00007FF7FA986000-memory.dmp

Download

memory/2696-1-0x000001DD05C90000-0x000001DD05CA0000-memory.dmp

Download

memory/2696-0-0x00007FF7EB150000-0x00007FF7EB546000-memory.dmp

Download

memory/3344-636-0x00007FF7558C0000-0x00007FF755CB6000-memory.dmp

Download

memory/3344-1942-0x00007FF7558C0000-0x00007FF755CB6000-memory.dmp

Download

memory/3468-1950-0x00007FF7973F0000-0x00007FF7977E6000-memory.dmp

Download

memory/3468-624-0x00007FF7973F0000-0x00007FF7977E6000-memory.dmp

Download

memory/3488-1947-0x00007FF63F590000-0x00007FF63F986000-memory.dmp

Download

memory/3488-626-0x00007FF63F590000-0x00007FF63F986000-memory.dmp

Download

memory/3496-623-0x00007FF6339C0000-0x00007FF633DB6000-memory.dmp

Download

memory/3496-1949-0x00007FF6339C0000-0x00007FF633DB6000-memory.dmp

Download

memory/3636-627-0x00007FF679600000-0x00007FF6799F6000-memory.dmp

Download

memory/3636-1951-0x00007FF679600000-0x00007FF6799F6000-memory.dmp

Download

memory/3828-633-0x00007FF764470000-0x00007FF764866000-memory.dmp

Download

memory/3828-1933-0x00007FF764470000-0x00007FF764866000-memory.dmp

Download

memory/4080-1946-0x00007FF732FE0000-0x00007FF7333D6000-memory.dmp

Download

memory/4080-639-0x00007FF732FE0000-0x00007FF7333D6000-memory.dmp

Download

memory/4760-1955-0x00007FF750C40000-0x00007FF751036000-memory.dmp

Download

memory/4760-631-0x00007FF750C40000-0x00007FF751036000-memory.dmp

Download

memory/4844-1935-0x00007FF6F8A40000-0x00007FF6F8E36000-memory.dmp

Download

memory/4844-60-0x00007FF6F8A40000-0x00007FF6F8E36000-memory.dmp

Download

memory/4852-1939-0x00007FF617960000-0x00007FF617D56000-memory.dmp

Download

memory/4852-76-0x00007FF617960000-0x00007FF617D56000-memory.dmp

Download

memory/5004-625-0x00007FF67A4A0000-0x00007FF67A896000-memory.dmp

Download

memory/5004-1948-0x00007FF67A4A0000-0x00007FF67A896000-memory.dmp

Download

memory/5116-1943-0x00007FF7FDED0000-0x00007FF7FE2C6000-memory.dmp

Download

memory/5116-637-0x00007FF7FDED0000-0x00007FF7FE2C6000-memory.dmp

Download