xmrig | 4840fce7b5646ed0bfb0cde416a013d53272cb7277ae24cf2a56e562e94c6525

Analysis

max time kernel
45s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
Size 3.1MB
Sample240613-enxpysxdkn
SHA256 4840fce7b5646ed0bfb0cde416a013d53272cb7277ae24cf2a56e562e94c6525
MD5 5d0f1649866696a59d2d2702f47da6a0
SHA1 d54db9070889af3b9f95dec3d670fdf194eda28f
SHA512 c8e3977baef71c8ede92c238b71cc2b55e6de09dbbdb34564f824d8422697c6961aff5b1edbac2933dc37ef914002d71905602ea2f7ba2ac186ab765854bfe7b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1000-0-0x00007FF7ED4E0000-0x00007FF7ED8D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002336e-6.dat	xmrig
behavioral2/files/0x0007000000023547-9.dat	xmrig
behavioral2/files/0x0008000000023546-10.dat	xmrig
behavioral2/files/0x0007000000023548-19.dat	xmrig
behavioral2/files/0x0007000000023549-25.dat	xmrig
behavioral2/memory/4024-29-0x00007FF742170000-0x00007FF742566000-memory.dmp	xmrig
behavioral2/files/0x000700000002354b-52.dat	xmrig
behavioral2/files/0x000700000002354a-57.dat	xmrig
behavioral2/files/0x000700000002354f-68.dat	xmrig
behavioral2/files/0x0007000000023550-78.dat	xmrig
behavioral2/files/0x0007000000023552-84.dat	xmrig
behavioral2/memory/3220-91-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp	xmrig
behavioral2/memory/4452-94-0x00007FF760290000-0x00007FF760686000-memory.dmp	xmrig
behavioral2/memory/2148-96-0x00007FF6AB350000-0x00007FF6AB746000-memory.dmp	xmrig
behavioral2/memory/4728-98-0x00007FF6B78D0000-0x00007FF6B7CC6000-memory.dmp	xmrig
behavioral2/memory/4924-97-0x00007FF6483B0000-0x00007FF6487A6000-memory.dmp	xmrig
behavioral2/memory/3768-95-0x00007FF737A70000-0x00007FF737E66000-memory.dmp	xmrig
behavioral2/memory/1756-92-0x00007FF7170A0000-0x00007FF717496000-memory.dmp	xmrig
behavioral2/memory/1068-90-0x00007FF6AD530000-0x00007FF6AD926000-memory.dmp	xmrig
behavioral2/files/0x0007000000023553-88.dat	xmrig
behavioral2/files/0x0007000000023551-86.dat	xmrig
behavioral2/memory/3624-83-0x00007FF65A2E0000-0x00007FF65A6D6000-memory.dmp	xmrig
behavioral2/memory/2496-82-0x00007FF77DA40000-0x00007FF77DE36000-memory.dmp	xmrig
behavioral2/files/0x000800000002354e-75.dat	xmrig
behavioral2/memory/4780-74-0x00007FF74E590000-0x00007FF74E986000-memory.dmp	xmrig
behavioral2/memory/740-66-0x00007FF7040C0000-0x00007FF7044B6000-memory.dmp	xmrig
behavioral2/files/0x000700000002354c-63.dat	xmrig
behavioral2/memory/3660-62-0x00007FF72CDF0000-0x00007FF72D1E6000-memory.dmp	xmrig
behavioral2/files/0x000800000002354d-119.dat	xmrig
behavioral2/files/0x0007000000023559-138.dat	xmrig
behavioral2/files/0x000700000002355d-148.dat	xmrig
behavioral2/files/0x000700000002355e-149.dat	xmrig
behavioral2/files/0x0007000000023562-171.dat	xmrig
behavioral2/files/0x0007000000023566-190.dat	xmrig
behavioral2/memory/1664-194-0x00007FF6CAA80000-0x00007FF6CAE76000-memory.dmp	xmrig
behavioral2/memory/4440-199-0x00007FF693860000-0x00007FF693C56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023569-222.dat	xmrig
behavioral2/files/0x000700000002356f-224.dat	xmrig
behavioral2/memory/3132-234-0x00007FF7A7AE0000-0x00007FF7A7ED6000-memory.dmp	xmrig
behavioral2/memory/408-231-0x00007FF6EA860000-0x00007FF6EAC56000-memory.dmp	xmrig
behavioral2/memory/2040-223-0x00007FF7918C0000-0x00007FF791CB6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023568-215.dat	xmrig
behavioral2/memory/3600-212-0x00007FF6CEDC0000-0x00007FF6CF1B6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023563-197.dat	xmrig
behavioral2/files/0x0007000000023561-188.dat	xmrig
behavioral2/memory/4960-182-0x00007FF726450000-0x00007FF726846000-memory.dmp	xmrig
behavioral2/memory/652-170-0x00007FF6A3E50000-0x00007FF6A4246000-memory.dmp	xmrig
behavioral2/memory/2936-154-0x00007FF68CBF0000-0x00007FF68CFE6000-memory.dmp	xmrig
behavioral2/memory/3264-151-0x00007FF6599C0000-0x00007FF659DB6000-memory.dmp	xmrig
behavioral2/files/0x000700000002355b-157.dat	xmrig
behavioral2/files/0x0007000000023558-134.dat	xmrig
behavioral2/files/0x0007000000023570-254.dat	xmrig
behavioral2/files/0x0007000000023579-257.dat	xmrig
behavioral2/files/0x000700000002357a-271.dat	xmrig
behavioral2/files/0x000700000002357d-284.dat	xmrig
behavioral2/files/0x0007000000023582-313.dat	xmrig
behavioral2/memory/1068-2500-0x00007FF6AD530000-0x00007FF6AD926000-memory.dmp	xmrig
behavioral2/memory/3264-2814-0x00007FF6599C0000-0x00007FF659DB6000-memory.dmp	xmrig
behavioral2/memory/4440-3188-0x00007FF693860000-0x00007FF693C56000-memory.dmp	xmrig
behavioral2/memory/4452-4085-0x00007FF760290000-0x00007FF760686000-memory.dmp	xmrig
behavioral2/memory/2148-4099-0x00007FF6AB350000-0x00007FF6AB746000-memory.dmp	xmrig
behavioral2/memory/3768-4108-0x00007FF737A70000-0x00007FF737E66000-memory.dmp	xmrig
behavioral2/memory/4780-4093-0x00007FF74E590000-0x00007FF74E986000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	1604	powershell.exe
5	1604	powershell.exe
7	1604	powershell.exe
8	1604	powershell.exe
10	1604	powershell.exe
11	1604	powershell.exe
13	1604	powershell.exe
27	1604	powershell.exe
32	1604	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1604	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1756	bIwncLu.exe
4024	dBPaJfI.exe
3660	GwvXDOB.exe
740	IHLAYis.exe
4452	VHTKqdw.exe
3768	mYDcPDt.exe
4780	fAiMDYh.exe
2148	ZxMOxqF.exe
2496	aLNCPJN.exe
3624	JdVwjHg.exe
4924	HrkjNBD.exe
4728	VEaGNvY.exe
1068	XooDnjG.exe
3220	WDtyIOG.exe
3264	oOSnWrm.exe
3600	EORLfrY.exe
2936	uWXYQxL.exe
652	jmhSjRG.exe
4960	lrXhZWh.exe
1664	yMoVNQY.exe
2040	kaTfDeD.exe
408	LoxNwrD.exe
4440	PqcVXdm.exe
3132	zRxCEhT.exe
2128	TLyLdDc.exe
3936	oBggHPZ.exe
1792	BivDANT.exe
1108	dpBTSgJ.exe
2236	sXGZRhb.exe
4848	pgbZOVE.exe
1956	ElppmaZ.exe
3080	wOgvWCH.exe
1268	ThQDMwN.exe
2328	FnSWgvh.exe
4472	cnusmSv.exe
3508	xtlXleT.exe
5012	gCOhsDC.exe
4832	yDrgvfc.exe
4396	zemrDiv.exe
2364	bQYbZaJ.exe
4896	oxsbxnf.exe
4888	loLFwgy.exe
4772	kVKRMoo.exe
2696	cvoLjKr.exe
1888	vJwZpEP.exe
3844	SjmnKCl.exe
3700	UIiluHc.exe
5100	aCcCkwR.exe
4272	gQBBvBR.exe
1712	EvCPWRm.exe
2336	iytVZbO.exe
556	TNgrkYy.exe
2284	dgiefBh.exe
1884	PELDNqJ.exe
4788	mrwOEHF.exe
856	GwjLDGN.exe
3812	oezEVaI.exe
2812	vJtpkzJ.exe
4532	HqTFvTo.exe
2192	WsLMflx.exe
4972	HkyVIGs.exe
636	fTIMltI.exe
3740	UBTFDyV.exe
1824	Flercao.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1000-0-0x00007FF7ED4E0000-0x00007FF7ED8D6000-memory.dmp	upx
behavioral2/files/0x000700000002336e-6.dat	upx
behavioral2/files/0x0007000000023547-9.dat	upx
behavioral2/files/0x0008000000023546-10.dat	upx
behavioral2/files/0x0007000000023548-19.dat	upx
behavioral2/files/0x0007000000023549-25.dat	upx
behavioral2/memory/4024-29-0x00007FF742170000-0x00007FF742566000-memory.dmp	upx
behavioral2/files/0x000700000002354b-52.dat	upx
behavioral2/files/0x000700000002354a-57.dat	upx
behavioral2/files/0x000700000002354f-68.dat	upx
behavioral2/files/0x0007000000023550-78.dat	upx
behavioral2/files/0x0007000000023552-84.dat	upx
behavioral2/memory/3220-91-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp	upx
behavioral2/memory/4452-94-0x00007FF760290000-0x00007FF760686000-memory.dmp	upx
behavioral2/memory/2148-96-0x00007FF6AB350000-0x00007FF6AB746000-memory.dmp	upx
behavioral2/memory/4728-98-0x00007FF6B78D0000-0x00007FF6B7CC6000-memory.dmp	upx
behavioral2/memory/4924-97-0x00007FF6483B0000-0x00007FF6487A6000-memory.dmp	upx
behavioral2/memory/3768-95-0x00007FF737A70000-0x00007FF737E66000-memory.dmp	upx
behavioral2/memory/1756-92-0x00007FF7170A0000-0x00007FF717496000-memory.dmp	upx
behavioral2/memory/1068-90-0x00007FF6AD530000-0x00007FF6AD926000-memory.dmp	upx
behavioral2/files/0x0007000000023553-88.dat	upx
behavioral2/files/0x0007000000023551-86.dat	upx
behavioral2/memory/3624-83-0x00007FF65A2E0000-0x00007FF65A6D6000-memory.dmp	upx
behavioral2/memory/2496-82-0x00007FF77DA40000-0x00007FF77DE36000-memory.dmp	upx
behavioral2/files/0x000800000002354e-75.dat	upx
behavioral2/memory/4780-74-0x00007FF74E590000-0x00007FF74E986000-memory.dmp	upx
behavioral2/memory/740-66-0x00007FF7040C0000-0x00007FF7044B6000-memory.dmp	upx
behavioral2/files/0x000700000002354c-63.dat	upx
behavioral2/memory/3660-62-0x00007FF72CDF0000-0x00007FF72D1E6000-memory.dmp	upx
behavioral2/files/0x000800000002354d-119.dat	upx
behavioral2/files/0x0007000000023559-138.dat	upx
behavioral2/files/0x000700000002355d-148.dat	upx
behavioral2/files/0x000700000002355e-149.dat	upx
behavioral2/files/0x0007000000023562-171.dat	upx
behavioral2/files/0x0007000000023566-190.dat	upx
behavioral2/memory/1664-194-0x00007FF6CAA80000-0x00007FF6CAE76000-memory.dmp	upx
behavioral2/memory/4440-199-0x00007FF693860000-0x00007FF693C56000-memory.dmp	upx
behavioral2/files/0x0007000000023569-222.dat	upx
behavioral2/files/0x000700000002356f-224.dat	upx
behavioral2/memory/3132-234-0x00007FF7A7AE0000-0x00007FF7A7ED6000-memory.dmp	upx
behavioral2/memory/408-231-0x00007FF6EA860000-0x00007FF6EAC56000-memory.dmp	upx
behavioral2/memory/2040-223-0x00007FF7918C0000-0x00007FF791CB6000-memory.dmp	upx
behavioral2/files/0x0007000000023568-215.dat	upx
behavioral2/memory/3600-212-0x00007FF6CEDC0000-0x00007FF6CF1B6000-memory.dmp	upx
behavioral2/files/0x0007000000023563-197.dat	upx
behavioral2/files/0x0007000000023561-188.dat	upx
behavioral2/memory/4960-182-0x00007FF726450000-0x00007FF726846000-memory.dmp	upx
behavioral2/memory/652-170-0x00007FF6A3E50000-0x00007FF6A4246000-memory.dmp	upx
behavioral2/memory/2936-154-0x00007FF68CBF0000-0x00007FF68CFE6000-memory.dmp	upx
behavioral2/memory/3264-151-0x00007FF6599C0000-0x00007FF659DB6000-memory.dmp	upx
behavioral2/files/0x000700000002355b-157.dat	upx
behavioral2/files/0x0007000000023558-134.dat	upx
behavioral2/files/0x0007000000023570-254.dat	upx
behavioral2/files/0x0007000000023579-257.dat	upx
behavioral2/files/0x000700000002357a-271.dat	upx
behavioral2/files/0x000700000002357d-284.dat	upx
behavioral2/files/0x0007000000023582-313.dat	upx
behavioral2/memory/1068-2500-0x00007FF6AD530000-0x00007FF6AD926000-memory.dmp	upx
behavioral2/memory/3264-2814-0x00007FF6599C0000-0x00007FF659DB6000-memory.dmp	upx
behavioral2/memory/4440-3188-0x00007FF693860000-0x00007FF693C56000-memory.dmp	upx
behavioral2/memory/4452-4085-0x00007FF760290000-0x00007FF760686000-memory.dmp	upx
behavioral2/memory/2148-4099-0x00007FF6AB350000-0x00007FF6AB746000-memory.dmp	upx
behavioral2/memory/3768-4108-0x00007FF737A70000-0x00007FF737E66000-memory.dmp	upx
behavioral2/memory/4780-4093-0x00007FF74E590000-0x00007FF74E986000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WzwAEnf.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\AOyEBkR.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\HnAYEpr.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\nZXTOxS.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\eSlaDJR.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\gvyKEZW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\aNpOtRC.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\EJxJlEf.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\hyRQjJO.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\fpssCBu.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\hQYOGMF.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\DVbMjIG.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\HqEgqvW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\PARwyLx.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\tSuVsyW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\XooDnjG.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\ThQDMwN.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\VYKyJGL.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\lSQIdDC.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\MeCSClE.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\zwklkOx.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\hUGdpRN.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\diTNJwB.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\dJwDghW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\hVsNYqK.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\AZFfCqa.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\dqKnUyE.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcHoGJP.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\gjOlymc.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\PUYJQsd.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\vQRSFmx.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\iVFQXnB.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\tsXuqIr.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\nswjZwo.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\TaHKGel.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\thpUvBj.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\RXTLlAQ.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\JCvNOsf.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\BLINtTk.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\LUBSLJp.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\iKeoEpW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\vMmgkCd.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\AAalKkl.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\kYFMvcW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\tkgKVue.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\bzFEuBM.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\RcclkXO.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\XTfaEpF.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\fQTldYX.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\taVuIJo.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\AsdjNAA.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\aCsIzUL.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\PVvyFQs.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\qQjUCjD.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\WbYlGfy.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\iryyYej.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\pOOOzyg.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\oyGHSuY.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\cIScGVx.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\VuTgZLN.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\ULGKeOO.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\aOFexVp.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\zgLALvZ.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
File created	C:\Windows\System\WsLtSPW.exe	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1604	powershell.exe
1604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeLockMemoryPrivilege	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1604	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	82
PID 1000 wrote to memory of 1604	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	82
PID 1000 wrote to memory of 1756	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	83
PID 1000 wrote to memory of 1756	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	83
PID 1000 wrote to memory of 4024	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	84
PID 1000 wrote to memory of 4024	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	84
PID 1000 wrote to memory of 3660	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	85
PID 1000 wrote to memory of 3660	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	85
PID 1000 wrote to memory of 740	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	86
PID 1000 wrote to memory of 740	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	86
PID 1000 wrote to memory of 4452	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	87
PID 1000 wrote to memory of 4452	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	87
PID 1000 wrote to memory of 3768	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	88
PID 1000 wrote to memory of 3768	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	88
PID 1000 wrote to memory of 4780	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	89
PID 1000 wrote to memory of 4780	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	89
PID 1000 wrote to memory of 2148	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	90
PID 1000 wrote to memory of 2148	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	90
PID 1000 wrote to memory of 2496	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	91
PID 1000 wrote to memory of 2496	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	91
PID 1000 wrote to memory of 3624	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	92
PID 1000 wrote to memory of 3624	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	92
PID 1000 wrote to memory of 4924	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	93
PID 1000 wrote to memory of 4924	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	93
PID 1000 wrote to memory of 1068	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	94
PID 1000 wrote to memory of 1068	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	94
PID 1000 wrote to memory of 4728	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	95
PID 1000 wrote to memory of 4728	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	95
PID 1000 wrote to memory of 3220	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	96
PID 1000 wrote to memory of 3220	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	96
PID 1000 wrote to memory of 3264	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	97
PID 1000 wrote to memory of 3264	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	97
PID 1000 wrote to memory of 3600	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	98
PID 1000 wrote to memory of 3600	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	98
PID 1000 wrote to memory of 2936	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	99
PID 1000 wrote to memory of 2936	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	99
PID 1000 wrote to memory of 652	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	100
PID 1000 wrote to memory of 652	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	100
PID 1000 wrote to memory of 4960	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	101
PID 1000 wrote to memory of 4960	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	101
PID 1000 wrote to memory of 1664	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	102
PID 1000 wrote to memory of 1664	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	102
PID 1000 wrote to memory of 2040	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	103
PID 1000 wrote to memory of 2040	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	103
PID 1000 wrote to memory of 408	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	104
PID 1000 wrote to memory of 408	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	104
PID 1000 wrote to memory of 4440	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	106
PID 1000 wrote to memory of 4440	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	106
PID 1000 wrote to memory of 3132	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	107
PID 1000 wrote to memory of 3132	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	107
PID 1000 wrote to memory of 2128	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	108
PID 1000 wrote to memory of 2128	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	108
PID 1000 wrote to memory of 3936	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	109
PID 1000 wrote to memory of 3936	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	109
PID 1000 wrote to memory of 1792	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	110
PID 1000 wrote to memory of 1792	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	110
PID 1000 wrote to memory of 1108	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	111
PID 1000 wrote to memory of 1108	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	111
PID 1000 wrote to memory of 2236	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	113
PID 1000 wrote to memory of 2236	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	113
PID 1000 wrote to memory of 4848	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	114
PID 1000 wrote to memory of 4848	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	114
PID 1000 wrote to memory of 1956	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	116
PID 1000 wrote to memory of 1956	1000	5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5d0f1649866696a59d2d2702f47da6a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\System\bIwncLu.exe
  C:\Windows\System\bIwncLu.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\dBPaJfI.exe
  C:\Windows\System\dBPaJfI.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\GwvXDOB.exe
  C:\Windows\System\GwvXDOB.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\IHLAYis.exe
  C:\Windows\System\IHLAYis.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\VHTKqdw.exe
  C:\Windows\System\VHTKqdw.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\mYDcPDt.exe
  C:\Windows\System\mYDcPDt.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\fAiMDYh.exe
  C:\Windows\System\fAiMDYh.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\ZxMOxqF.exe
  C:\Windows\System\ZxMOxqF.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\aLNCPJN.exe
  C:\Windows\System\aLNCPJN.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\JdVwjHg.exe
  C:\Windows\System\JdVwjHg.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\HrkjNBD.exe
  C:\Windows\System\HrkjNBD.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\XooDnjG.exe
  C:\Windows\System\XooDnjG.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\VEaGNvY.exe
  C:\Windows\System\VEaGNvY.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\WDtyIOG.exe
  C:\Windows\System\WDtyIOG.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\oOSnWrm.exe
  C:\Windows\System\oOSnWrm.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\EORLfrY.exe
  C:\Windows\System\EORLfrY.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\uWXYQxL.exe
  C:\Windows\System\uWXYQxL.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\jmhSjRG.exe
  C:\Windows\System\jmhSjRG.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\lrXhZWh.exe
  C:\Windows\System\lrXhZWh.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\yMoVNQY.exe
  C:\Windows\System\yMoVNQY.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\kaTfDeD.exe
  C:\Windows\System\kaTfDeD.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\LoxNwrD.exe
  C:\Windows\System\LoxNwrD.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PqcVXdm.exe
  C:\Windows\System\PqcVXdm.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\zRxCEhT.exe
  C:\Windows\System\zRxCEhT.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\TLyLdDc.exe
  C:\Windows\System\TLyLdDc.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\oBggHPZ.exe
  C:\Windows\System\oBggHPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\BivDANT.exe
  C:\Windows\System\BivDANT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\dpBTSgJ.exe
  C:\Windows\System\dpBTSgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\sXGZRhb.exe
  C:\Windows\System\sXGZRhb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\pgbZOVE.exe
  C:\Windows\System\pgbZOVE.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\ElppmaZ.exe
  C:\Windows\System\ElppmaZ.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\wOgvWCH.exe
  C:\Windows\System\wOgvWCH.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ThQDMwN.exe
  C:\Windows\System\ThQDMwN.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\FnSWgvh.exe
  C:\Windows\System\FnSWgvh.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\cnusmSv.exe
  C:\Windows\System\cnusmSv.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\xtlXleT.exe
  C:\Windows\System\xtlXleT.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\gCOhsDC.exe
  C:\Windows\System\gCOhsDC.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\yDrgvfc.exe
  C:\Windows\System\yDrgvfc.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\zemrDiv.exe
  C:\Windows\System\zemrDiv.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\bQYbZaJ.exe
  C:\Windows\System\bQYbZaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\oxsbxnf.exe
  C:\Windows\System\oxsbxnf.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\loLFwgy.exe
  C:\Windows\System\loLFwgy.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\kVKRMoo.exe
  C:\Windows\System\kVKRMoo.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\cvoLjKr.exe
  C:\Windows\System\cvoLjKr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\vJwZpEP.exe
  C:\Windows\System\vJwZpEP.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\SjmnKCl.exe
  C:\Windows\System\SjmnKCl.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\UIiluHc.exe
  C:\Windows\System\UIiluHc.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\aCcCkwR.exe
  C:\Windows\System\aCcCkwR.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\gQBBvBR.exe
  C:\Windows\System\gQBBvBR.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\EvCPWRm.exe
  C:\Windows\System\EvCPWRm.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\iytVZbO.exe
  C:\Windows\System\iytVZbO.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\TNgrkYy.exe
  C:\Windows\System\TNgrkYy.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\dgiefBh.exe
  C:\Windows\System\dgiefBh.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\PELDNqJ.exe
  C:\Windows\System\PELDNqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\mrwOEHF.exe
  C:\Windows\System\mrwOEHF.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\GwjLDGN.exe
  C:\Windows\System\GwjLDGN.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\oezEVaI.exe
  C:\Windows\System\oezEVaI.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\vJtpkzJ.exe
  C:\Windows\System\vJtpkzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HqTFvTo.exe
  C:\Windows\System\HqTFvTo.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\WsLMflx.exe
  C:\Windows\System\WsLMflx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\HkyVIGs.exe
  C:\Windows\System\HkyVIGs.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\fTIMltI.exe
  C:\Windows\System\fTIMltI.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\UBTFDyV.exe
  C:\Windows\System\UBTFDyV.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\Flercao.exe
  C:\Windows\System\Flercao.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\KOhIJoi.exe
  C:\Windows\System\KOhIJoi.exe
  2⤵
  PID:3824
- C:\Windows\System\YdnaHsY.exe
  C:\Windows\System\YdnaHsY.exe
  2⤵
  PID:2896
- C:\Windows\System\KNiohnK.exe
  C:\Windows\System\KNiohnK.exe
  2⤵
  PID:3112
- C:\Windows\System\uwXLCmr.exe
  C:\Windows\System\uwXLCmr.exe
  2⤵
  PID:3756
- C:\Windows\System\dAymvbZ.exe
  C:\Windows\System\dAymvbZ.exe
  2⤵
  PID:3944
- C:\Windows\System\erpgTrp.exe
  C:\Windows\System\erpgTrp.exe
  2⤵
  PID:2044
- C:\Windows\System\bxGCPCp.exe
  C:\Windows\System\bxGCPCp.exe
  2⤵
  PID:3308
- C:\Windows\System\fKzBTqM.exe
  C:\Windows\System\fKzBTqM.exe
  2⤵
  PID:2432
- C:\Windows\System\aZkhIcb.exe
  C:\Windows\System\aZkhIcb.exe
  2⤵
  PID:1984
- C:\Windows\System\PGPeuQf.exe
  C:\Windows\System\PGPeuQf.exe
  2⤵
  PID:2564
- C:\Windows\System\cuPCLof.exe
  C:\Windows\System\cuPCLof.exe
  2⤵
  PID:4660
- C:\Windows\System\cVQUpMl.exe
  C:\Windows\System\cVQUpMl.exe
  2⤵
  PID:2120
- C:\Windows\System\lqPTczr.exe
  C:\Windows\System\lqPTczr.exe
  2⤵
  PID:4276
- C:\Windows\System\KxgJmvX.exe
  C:\Windows\System\KxgJmvX.exe
  2⤵
  PID:3696
- C:\Windows\System\nxdiodm.exe
  C:\Windows\System\nxdiodm.exe
  2⤵
  PID:2996
- C:\Windows\System\ZHqBajJ.exe
  C:\Windows\System\ZHqBajJ.exe
  2⤵
  PID:3920
- C:\Windows\System\FeymDuG.exe
  C:\Windows\System\FeymDuG.exe
  2⤵
  PID:540
- C:\Windows\System\HJLCjlW.exe
  C:\Windows\System\HJLCjlW.exe
  2⤵
  PID:5128
- C:\Windows\System\cLjlgYq.exe
  C:\Windows\System\cLjlgYq.exe
  2⤵
  PID:5172
- C:\Windows\System\rJkguis.exe
  C:\Windows\System\rJkguis.exe
  2⤵
  PID:5216
- C:\Windows\System\UXDbgGC.exe
  C:\Windows\System\UXDbgGC.exe
  2⤵
  PID:5248
- C:\Windows\System\MQBggYG.exe
  C:\Windows\System\MQBggYG.exe
  2⤵
  PID:5280
- C:\Windows\System\lyLySBG.exe
  C:\Windows\System\lyLySBG.exe
  2⤵
  PID:5296
- C:\Windows\System\WWaxvcS.exe
  C:\Windows\System\WWaxvcS.exe
  2⤵
  PID:5344
- C:\Windows\System\YsYugrF.exe
  C:\Windows\System\YsYugrF.exe
  2⤵
  PID:5364
- C:\Windows\System\AUxUpkH.exe
  C:\Windows\System\AUxUpkH.exe
  2⤵
  PID:5392
- C:\Windows\System\LKlrQUs.exe
  C:\Windows\System\LKlrQUs.exe
  2⤵
  PID:5416
- C:\Windows\System\DpfXSCH.exe
  C:\Windows\System\DpfXSCH.exe
  2⤵
  PID:5456
- C:\Windows\System\VxSbGsl.exe
  C:\Windows\System\VxSbGsl.exe
  2⤵
  PID:5488
- C:\Windows\System\vJpPaTE.exe
  C:\Windows\System\vJpPaTE.exe
  2⤵
  PID:5524
- C:\Windows\System\YDeaVJH.exe
  C:\Windows\System\YDeaVJH.exe
  2⤵
  PID:5548
- C:\Windows\System\xyWltwu.exe
  C:\Windows\System\xyWltwu.exe
  2⤵
  PID:5580
- C:\Windows\System\sgvGmEw.exe
  C:\Windows\System\sgvGmEw.exe
  2⤵
  PID:5600
- C:\Windows\System\wBhhHci.exe
  C:\Windows\System\wBhhHci.exe
  2⤵
  PID:5632
- C:\Windows\System\AXYcyKk.exe
  C:\Windows\System\AXYcyKk.exe
  2⤵
  PID:5656
- C:\Windows\System\rzrAvdd.exe
  C:\Windows\System\rzrAvdd.exe
  2⤵
  PID:5680
- C:\Windows\System\agejdTQ.exe
  C:\Windows\System\agejdTQ.exe
  2⤵
  PID:5712
- C:\Windows\System\qXEnvmE.exe
  C:\Windows\System\qXEnvmE.exe
  2⤵
  PID:5760
- C:\Windows\System\oMWWaFX.exe
  C:\Windows\System\oMWWaFX.exe
  2⤵
  PID:5796
- C:\Windows\System\iUaBLeA.exe
  C:\Windows\System\iUaBLeA.exe
  2⤵
  PID:5812
- C:\Windows\System\sgLigim.exe
  C:\Windows\System\sgLigim.exe
  2⤵
  PID:5836
- C:\Windows\System\KOmUqba.exe
  C:\Windows\System\KOmUqba.exe
  2⤵
  PID:5860
- C:\Windows\System\btaxFlz.exe
  C:\Windows\System\btaxFlz.exe
  2⤵
  PID:5908
- C:\Windows\System\OjTZjUX.exe
  C:\Windows\System\OjTZjUX.exe
  2⤵
  PID:5940
- C:\Windows\System\XOAKhgi.exe
  C:\Windows\System\XOAKhgi.exe
  2⤵
  PID:5984
- C:\Windows\System\nBtGXVM.exe
  C:\Windows\System\nBtGXVM.exe
  2⤵
  PID:6020
- C:\Windows\System\nSTypIT.exe
  C:\Windows\System\nSTypIT.exe
  2⤵
  PID:6060
- C:\Windows\System\KExJZOI.exe
  C:\Windows\System\KExJZOI.exe
  2⤵
  PID:6084
- C:\Windows\System\feqzNRq.exe
  C:\Windows\System\feqzNRq.exe
  2⤵
  PID:6100
- C:\Windows\System\YpjLXeW.exe
  C:\Windows\System\YpjLXeW.exe
  2⤵
  PID:6128
- C:\Windows\System\xJggtdD.exe
  C:\Windows\System\xJggtdD.exe
  2⤵
  PID:3156
- C:\Windows\System\ojiAJFR.exe
  C:\Windows\System\ojiAJFR.exe
  2⤵
  PID:3276
- C:\Windows\System\rGiEcrd.exe
  C:\Windows\System\rGiEcrd.exe
  2⤵
  PID:5240
- C:\Windows\System\fjhUiWq.exe
  C:\Windows\System\fjhUiWq.exe
  2⤵
  PID:5336
- C:\Windows\System\ZHTklMt.exe
  C:\Windows\System\ZHTklMt.exe
  2⤵
  PID:5404
- C:\Windows\System\mIXjDoz.exe
  C:\Windows\System\mIXjDoz.exe
  2⤵
  PID:5500
- C:\Windows\System\mrIIKfb.exe
  C:\Windows\System\mrIIKfb.exe
  2⤵
  PID:5536
- C:\Windows\System\RRviNmC.exe
  C:\Windows\System\RRviNmC.exe
  2⤵
  PID:5568
- C:\Windows\System\dnWHTYq.exe
  C:\Windows\System\dnWHTYq.exe
  2⤵
  PID:5668
- C:\Windows\System\OkBBSgQ.exe
  C:\Windows\System\OkBBSgQ.exe
  2⤵
  PID:5756
- C:\Windows\System\ohZaSBO.exe
  C:\Windows\System\ohZaSBO.exe
  2⤵
  PID:5828
- C:\Windows\System\OItHjNZ.exe
  C:\Windows\System\OItHjNZ.exe
  2⤵
  PID:5892
- C:\Windows\System\PZygTQe.exe
  C:\Windows\System\PZygTQe.exe
  2⤵
  PID:5972
- C:\Windows\System\QCpvOrZ.exe
  C:\Windows\System\QCpvOrZ.exe
  2⤵
  PID:6032
- C:\Windows\System\ekuVnnP.exe
  C:\Windows\System\ekuVnnP.exe
  2⤵
  PID:6044
- C:\Windows\System\UOYFkeZ.exe
  C:\Windows\System\UOYFkeZ.exe
  2⤵
  PID:5156
- C:\Windows\System\WQkoLEX.exe
  C:\Windows\System\WQkoLEX.exe
  2⤵
  PID:6116
- C:\Windows\System\PszHQzV.exe
  C:\Windows\System\PszHQzV.exe
  2⤵
  PID:5268
- C:\Windows\System\BPGieth.exe
  C:\Windows\System\BPGieth.exe
  2⤵
  PID:5384
- C:\Windows\System\FNvKLNH.exe
  C:\Windows\System\FNvKLNH.exe
  2⤵
  PID:5576
- C:\Windows\System\NGxVVXi.exe
  C:\Windows\System\NGxVVXi.exe
  2⤵
  PID:5644
- C:\Windows\System\SdEDfxb.exe
  C:\Windows\System\SdEDfxb.exe
  2⤵
  PID:5652
- C:\Windows\System\UILmdhH.exe
  C:\Windows\System\UILmdhH.exe
  2⤵
  PID:5880
- C:\Windows\System\KCHHYxp.exe
  C:\Windows\System\KCHHYxp.exe
  2⤵
  PID:6040
- C:\Windows\System\RmYwDgH.exe
  C:\Windows\System\RmYwDgH.exe
  2⤵
  PID:5200
- C:\Windows\System\XyzWcjO.exe
  C:\Windows\System\XyzWcjO.exe
  2⤵
  PID:5436
- C:\Windows\System\JdaEyji.exe
  C:\Windows\System\JdaEyji.exe
  2⤵
  PID:5852
- C:\Windows\System\BYnNFHC.exe
  C:\Windows\System\BYnNFHC.exe
  2⤵
  PID:6120
- C:\Windows\System\EVomztr.exe
  C:\Windows\System\EVomztr.exe
  2⤵
  PID:5808
- C:\Windows\System\vVcbPnW.exe
  C:\Windows\System\vVcbPnW.exe
  2⤵
  PID:5928
- C:\Windows\System\CapOOVK.exe
  C:\Windows\System\CapOOVK.exe
  2⤵
  PID:6164
- C:\Windows\System\YLfWdut.exe
  C:\Windows\System\YLfWdut.exe
  2⤵
  PID:6192
- C:\Windows\System\kURdJmI.exe
  C:\Windows\System\kURdJmI.exe
  2⤵
  PID:6220
- C:\Windows\System\eZkcbaB.exe
  C:\Windows\System\eZkcbaB.exe
  2⤵
  PID:6244
- C:\Windows\System\waMCwHo.exe
  C:\Windows\System\waMCwHo.exe
  2⤵
  PID:6268
- C:\Windows\System\IpJAmfO.exe
  C:\Windows\System\IpJAmfO.exe
  2⤵
  PID:6312
- C:\Windows\System\tKxwxjS.exe
  C:\Windows\System\tKxwxjS.exe
  2⤵
  PID:6340
- C:\Windows\System\SexcdSH.exe
  C:\Windows\System\SexcdSH.exe
  2⤵
  PID:6356
- C:\Windows\System\vuVWzNo.exe
  C:\Windows\System\vuVWzNo.exe
  2⤵
  PID:6376
- C:\Windows\System\BJUjiBu.exe
  C:\Windows\System\BJUjiBu.exe
  2⤵
  PID:6408
- C:\Windows\System\DQlvvXg.exe
  C:\Windows\System\DQlvvXg.exe
  2⤵
  PID:6440
- C:\Windows\System\tpdFrDb.exe
  C:\Windows\System\tpdFrDb.exe
  2⤵
  PID:6456
- C:\Windows\System\mSboNDT.exe
  C:\Windows\System\mSboNDT.exe
  2⤵
  PID:6496
- C:\Windows\System\cfyGnxz.exe
  C:\Windows\System\cfyGnxz.exe
  2⤵
  PID:6524
- C:\Windows\System\iwaUBiL.exe
  C:\Windows\System\iwaUBiL.exe
  2⤵
  PID:6552
- C:\Windows\System\XYtXTCl.exe
  C:\Windows\System\XYtXTCl.exe
  2⤵
  PID:6596
- C:\Windows\System\comaAqY.exe
  C:\Windows\System\comaAqY.exe
  2⤵
  PID:6624
- C:\Windows\System\DalAlSC.exe
  C:\Windows\System\DalAlSC.exe
  2⤵
  PID:6640
- C:\Windows\System\pNpYAzU.exe
  C:\Windows\System\pNpYAzU.exe
  2⤵
  PID:6664
- C:\Windows\System\DmVfRht.exe
  C:\Windows\System\DmVfRht.exe
  2⤵
  PID:6684
- C:\Windows\System\MVjorXe.exe
  C:\Windows\System\MVjorXe.exe
  2⤵
  PID:6712
- C:\Windows\System\kIfnrsA.exe
  C:\Windows\System\kIfnrsA.exe
  2⤵
  PID:6740
- C:\Windows\System\ctdByOV.exe
  C:\Windows\System\ctdByOV.exe
  2⤵
  PID:6780
- C:\Windows\System\luNOthT.exe
  C:\Windows\System\luNOthT.exe
  2⤵
  PID:6796
- C:\Windows\System\gOFLDMq.exe
  C:\Windows\System\gOFLDMq.exe
  2⤵
  PID:6836
- C:\Windows\System\LCKzQer.exe
  C:\Windows\System\LCKzQer.exe
  2⤵
  PID:6860
- C:\Windows\System\DfDVlzt.exe
  C:\Windows\System\DfDVlzt.exe
  2⤵
  PID:6892
- C:\Windows\System\bAiAcEx.exe
  C:\Windows\System\bAiAcEx.exe
  2⤵
  PID:6924
- C:\Windows\System\vtpdsYA.exe
  C:\Windows\System\vtpdsYA.exe
  2⤵
  PID:6948
- C:\Windows\System\gcDOIxL.exe
  C:\Windows\System\gcDOIxL.exe
  2⤵
  PID:6980
- C:\Windows\System\kkIVIIn.exe
  C:\Windows\System\kkIVIIn.exe
  2⤵
  PID:7016
- C:\Windows\System\CrAAGsW.exe
  C:\Windows\System\CrAAGsW.exe
  2⤵
  PID:7044
- C:\Windows\System\HkPpZzJ.exe
  C:\Windows\System\HkPpZzJ.exe
  2⤵
  PID:7060
- C:\Windows\System\pGGjKjJ.exe
  C:\Windows\System\pGGjKjJ.exe
  2⤵
  PID:7088
- C:\Windows\System\VBZDbDM.exe
  C:\Windows\System\VBZDbDM.exe
  2⤵
  PID:7120
- C:\Windows\System\rmQLbIF.exe
  C:\Windows\System\rmQLbIF.exe
  2⤵
  PID:7160
- C:\Windows\System\mKJNPpF.exe
  C:\Windows\System\mKJNPpF.exe
  2⤵
  PID:6180
- C:\Windows\System\umrHEAO.exe
  C:\Windows\System\umrHEAO.exe
  2⤵
  PID:6228
- C:\Windows\System\GbknzrK.exe
  C:\Windows\System\GbknzrK.exe
  2⤵
  PID:6308
- C:\Windows\System\STxlmfF.exe
  C:\Windows\System\STxlmfF.exe
  2⤵
  PID:6372
- C:\Windows\System\TVqMwCG.exe
  C:\Windows\System\TVqMwCG.exe
  2⤵
  PID:6448
- C:\Windows\System\cvqHiBT.exe
  C:\Windows\System\cvqHiBT.exe
  2⤵
  PID:6536
- C:\Windows\System\iazYpaA.exe
  C:\Windows\System\iazYpaA.exe
  2⤵
  PID:6580
- C:\Windows\System\QsDzxqs.exe
  C:\Windows\System\QsDzxqs.exe
  2⤵
  PID:6636
- C:\Windows\System\KklTvIY.exe
  C:\Windows\System\KklTvIY.exe
  2⤵
  PID:6724
- C:\Windows\System\UJfCybg.exe
  C:\Windows\System\UJfCybg.exe
  2⤵
  PID:6848
- C:\Windows\System\NRUtrIA.exe
  C:\Windows\System\NRUtrIA.exe
  2⤵
  PID:6904
- C:\Windows\System\kZNdTjR.exe
  C:\Windows\System\kZNdTjR.exe
  2⤵
  PID:6940
- C:\Windows\System\WePIWgX.exe
  C:\Windows\System\WePIWgX.exe
  2⤵
  PID:7012
- C:\Windows\System\gBnPHsp.exe
  C:\Windows\System\gBnPHsp.exe
  2⤵
  PID:4416
- C:\Windows\System\XBPYOET.exe
  C:\Windows\System\XBPYOET.exe
  2⤵
  PID:7148
- C:\Windows\System\LlbkCPT.exe
  C:\Windows\System\LlbkCPT.exe
  2⤵
  PID:6240
- C:\Windows\System\KRUFcjF.exe
  C:\Windows\System\KRUFcjF.exe
  2⤵
  PID:6404
- C:\Windows\System\LgNRAef.exe
  C:\Windows\System\LgNRAef.exe
  2⤵
  PID:6632
- C:\Windows\System\ircqvFt.exe
  C:\Windows\System\ircqvFt.exe
  2⤵
  PID:6808
- C:\Windows\System\GaikFty.exe
  C:\Windows\System\GaikFty.exe
  2⤵
  PID:6788
- C:\Windows\System\kXprzMY.exe
  C:\Windows\System\kXprzMY.exe
  2⤵
  PID:5476
- C:\Windows\System\dvwndmP.exe
  C:\Windows\System\dvwndmP.exe
  2⤵
  PID:6960
- C:\Windows\System\TBjxWfX.exe
  C:\Windows\System\TBjxWfX.exe
  2⤵
  PID:6188
- C:\Windows\System\SPKBoUs.exe
  C:\Windows\System\SPKBoUs.exe
  2⤵
  PID:6468
- C:\Windows\System\KUiPCLZ.exe
  C:\Windows\System\KUiPCLZ.exe
  2⤵
  PID:7132
- C:\Windows\System\ziNxoUT.exe
  C:\Windows\System\ziNxoUT.exe
  2⤵
  PID:7100
- C:\Windows\System\QtvLucG.exe
  C:\Windows\System\QtvLucG.exe
  2⤵
  PID:6324
- C:\Windows\System\BefDewO.exe
  C:\Windows\System\BefDewO.exe
  2⤵
  PID:4240
- C:\Windows\System\OmQDxbc.exe
  C:\Windows\System\OmQDxbc.exe
  2⤵
  PID:7172
- C:\Windows\System\lHMtivo.exe
  C:\Windows\System\lHMtivo.exe
  2⤵
  PID:7200
- C:\Windows\System\gQcvgIV.exe
  C:\Windows\System\gQcvgIV.exe
  2⤵
  PID:7236
- C:\Windows\System\BuPlFQp.exe
  C:\Windows\System\BuPlFQp.exe
  2⤵
  PID:7260
- C:\Windows\System\VXoRDrh.exe
  C:\Windows\System\VXoRDrh.exe
  2⤵
  PID:7280
- C:\Windows\System\ilIVUAM.exe
  C:\Windows\System\ilIVUAM.exe
  2⤵
  PID:7308
- C:\Windows\System\sqCcNrt.exe
  C:\Windows\System\sqCcNrt.exe
  2⤵
  PID:7336
- C:\Windows\System\TEmxxVZ.exe
  C:\Windows\System\TEmxxVZ.exe
  2⤵
  PID:7376
- C:\Windows\System\GoOmTCx.exe
  C:\Windows\System\GoOmTCx.exe
  2⤵
  PID:7420
- C:\Windows\System\nEtZBeM.exe
  C:\Windows\System\nEtZBeM.exe
  2⤵
  PID:7448
- C:\Windows\System\XUzSJXv.exe
  C:\Windows\System\XUzSJXv.exe
  2⤵
  PID:7484
- C:\Windows\System\olDDxNk.exe
  C:\Windows\System\olDDxNk.exe
  2⤵
  PID:7512
- C:\Windows\System\YhCsLiA.exe
  C:\Windows\System\YhCsLiA.exe
  2⤵
  PID:7540
- C:\Windows\System\TMXqtkr.exe
  C:\Windows\System\TMXqtkr.exe
  2⤵
  PID:7556
- C:\Windows\System\HPHHVNo.exe
  C:\Windows\System\HPHHVNo.exe
  2⤵
  PID:7588
- C:\Windows\System\xIOLDpT.exe
  C:\Windows\System\xIOLDpT.exe
  2⤵
  PID:7612
- C:\Windows\System\LksjHOv.exe
  C:\Windows\System\LksjHOv.exe
  2⤵
  PID:7640
- C:\Windows\System\AAjKOom.exe
  C:\Windows\System\AAjKOom.exe
  2⤵
  PID:7680
- C:\Windows\System\GdafZEY.exe
  C:\Windows\System\GdafZEY.exe
  2⤵
  PID:7728
- C:\Windows\System\WJueYkj.exe
  C:\Windows\System\WJueYkj.exe
  2⤵
  PID:7748
- C:\Windows\System\sbFgFso.exe
  C:\Windows\System\sbFgFso.exe
  2⤵
  PID:7772
- C:\Windows\System\dhfQVAz.exe
  C:\Windows\System\dhfQVAz.exe
  2⤵
  PID:7808
- C:\Windows\System\TaHKGel.exe
  C:\Windows\System\TaHKGel.exe
  2⤵
  PID:7828
- C:\Windows\System\ZaOTRJd.exe
  C:\Windows\System\ZaOTRJd.exe
  2⤵
  PID:7844
- C:\Windows\System\mlbFItA.exe
  C:\Windows\System\mlbFItA.exe
  2⤵
  PID:7872
- C:\Windows\System\MxohUpr.exe
  C:\Windows\System\MxohUpr.exe
  2⤵
  PID:7912
- C:\Windows\System\nWaMzRu.exe
  C:\Windows\System\nWaMzRu.exe
  2⤵
  PID:7928
- C:\Windows\System\XhBkGOI.exe
  C:\Windows\System\XhBkGOI.exe
  2⤵
  PID:7968
- C:\Windows\System\USUBVsb.exe
  C:\Windows\System\USUBVsb.exe
  2⤵
  PID:7996
- C:\Windows\System\DOtrtgJ.exe
  C:\Windows\System\DOtrtgJ.exe
  2⤵
  PID:8020
- C:\Windows\System\LCgkvld.exe
  C:\Windows\System\LCgkvld.exe
  2⤵
  PID:8040
- C:\Windows\System\iFVXBfs.exe
  C:\Windows\System\iFVXBfs.exe
  2⤵
  PID:8076
- C:\Windows\System\DqnQJwm.exe
  C:\Windows\System\DqnQJwm.exe
  2⤵
  PID:8108
- C:\Windows\System\HZCdwTg.exe
  C:\Windows\System\HZCdwTg.exe
  2⤵
  PID:8136
- C:\Windows\System\SYrBAtJ.exe
  C:\Windows\System\SYrBAtJ.exe
  2⤵
  PID:8160
- C:\Windows\System\ENtHFJv.exe
  C:\Windows\System\ENtHFJv.exe
  2⤵
  PID:7108
- C:\Windows\System\yQBNZnB.exe
  C:\Windows\System\yQBNZnB.exe
  2⤵
  PID:7192
- C:\Windows\System\IksOati.exe
  C:\Windows\System\IksOati.exe
  2⤵
  PID:7244
- C:\Windows\System\OgKDJIa.exe
  C:\Windows\System\OgKDJIa.exe
  2⤵
  PID:7296
- C:\Windows\System\zEAyEee.exe
  C:\Windows\System\zEAyEee.exe
  2⤵
  PID:7396
- C:\Windows\System\nPLJCsA.exe
  C:\Windows\System\nPLJCsA.exe
  2⤵
  PID:7436
- C:\Windows\System\orAKgIC.exe
  C:\Windows\System\orAKgIC.exe
  2⤵
  PID:7532
- C:\Windows\System\ZPeReHh.exe
  C:\Windows\System\ZPeReHh.exe
  2⤵
  PID:7600
- C:\Windows\System\VwdyRtz.exe
  C:\Windows\System\VwdyRtz.exe
  2⤵
  PID:7660
- C:\Windows\System\cGCLuXp.exe
  C:\Windows\System\cGCLuXp.exe
  2⤵
  PID:7740
- C:\Windows\System\ZbgbCXZ.exe
  C:\Windows\System\ZbgbCXZ.exe
  2⤵
  PID:7824
- C:\Windows\System\tNCXkil.exe
  C:\Windows\System\tNCXkil.exe
  2⤵
  PID:7888
- C:\Windows\System\NyPLTzR.exe
  C:\Windows\System\NyPLTzR.exe
  2⤵
  PID:7940
- C:\Windows\System\UcbsNng.exe
  C:\Windows\System\UcbsNng.exe
  2⤵
  PID:8004
- C:\Windows\System\EXcYZSR.exe
  C:\Windows\System\EXcYZSR.exe
  2⤵
  PID:8068
- C:\Windows\System\RwPTxFv.exe
  C:\Windows\System\RwPTxFv.exe
  2⤵
  PID:8116
- C:\Windows\System\ZRyyRsA.exe
  C:\Windows\System\ZRyyRsA.exe
  2⤵
  PID:7184
- C:\Windows\System\kNHHBVU.exe
  C:\Windows\System\kNHHBVU.exe
  2⤵
  PID:7292
- C:\Windows\System\PHytitU.exe
  C:\Windows\System\PHytitU.exe
  2⤵
  PID:7208
- C:\Windows\System\SxyrZuC.exe
  C:\Windows\System\SxyrZuC.exe
  2⤵
  PID:7572
- C:\Windows\System\KZqQfBk.exe
  C:\Windows\System\KZqQfBk.exe
  2⤵
  PID:7768
- C:\Windows\System\XRryBRf.exe
  C:\Windows\System\XRryBRf.exe
  2⤵
  PID:7920
- C:\Windows\System\FjXbRbF.exe
  C:\Windows\System\FjXbRbF.exe
  2⤵
  PID:8056
- C:\Windows\System\KiHBbPu.exe
  C:\Windows\System\KiHBbPu.exe
  2⤵
  PID:7248
- C:\Windows\System\qkkmkzU.exe
  C:\Windows\System\qkkmkzU.exe
  2⤵
  PID:7548
- C:\Windows\System\TEoOlzX.exe
  C:\Windows\System\TEoOlzX.exe
  2⤵
  PID:7904
- C:\Windows\System\vJfzgcd.exe
  C:\Windows\System\vJfzgcd.exe
  2⤵
  PID:7352
- C:\Windows\System\DadFqtr.exe
  C:\Windows\System\DadFqtr.exe
  2⤵
  PID:3836
- C:\Windows\System\ElJflki.exe
  C:\Windows\System\ElJflki.exe
  2⤵
  PID:8208
- C:\Windows\System\ZmOpujz.exe
  C:\Windows\System\ZmOpujz.exe
  2⤵
  PID:8236
- C:\Windows\System\HRMzFoD.exe
  C:\Windows\System\HRMzFoD.exe
  2⤵
  PID:8264
- C:\Windows\System\pChgGyV.exe
  C:\Windows\System\pChgGyV.exe
  2⤵
  PID:8320
- C:\Windows\System\KjWAXIt.exe
  C:\Windows\System\KjWAXIt.exe
  2⤵
  PID:8348
- C:\Windows\System\HmpnRbr.exe
  C:\Windows\System\HmpnRbr.exe
  2⤵
  PID:8380
- C:\Windows\System\naXrzrE.exe
  C:\Windows\System\naXrzrE.exe
  2⤵
  PID:8424
- C:\Windows\System\pzUYuBt.exe
  C:\Windows\System\pzUYuBt.exe
  2⤵
  PID:8452
- C:\Windows\System\QbwWIkC.exe
  C:\Windows\System\QbwWIkC.exe
  2⤵
  PID:8480
- C:\Windows\System\OuXYYRj.exe
  C:\Windows\System\OuXYYRj.exe
  2⤵
  PID:8508
- C:\Windows\System\pFDmjrS.exe
  C:\Windows\System\pFDmjrS.exe
  2⤵
  PID:8524
- C:\Windows\System\kvLIZLX.exe
  C:\Windows\System\kvLIZLX.exe
  2⤵
  PID:8544
- C:\Windows\System\zxAzjeI.exe
  C:\Windows\System\zxAzjeI.exe
  2⤵
  PID:8572
- C:\Windows\System\exaHjxJ.exe
  C:\Windows\System\exaHjxJ.exe
  2⤵
  PID:8600
- C:\Windows\System\hKYHnZM.exe
  C:\Windows\System\hKYHnZM.exe
  2⤵
  PID:8616
- C:\Windows\System\GdbMSin.exe
  C:\Windows\System\GdbMSin.exe
  2⤵
  PID:8640
- C:\Windows\System\MOpbazx.exe
  C:\Windows\System\MOpbazx.exe
  2⤵
  PID:8676
- C:\Windows\System\hQupuUX.exe
  C:\Windows\System\hQupuUX.exe
  2⤵
  PID:8720
- C:\Windows\System\JhPGJWF.exe
  C:\Windows\System\JhPGJWF.exe
  2⤵
  PID:8760
- C:\Windows\System\YvCCVln.exe
  C:\Windows\System\YvCCVln.exe
  2⤵
  PID:8784
- C:\Windows\System\IPrnztu.exe
  C:\Windows\System\IPrnztu.exe
  2⤵
  PID:8816
- C:\Windows\System\cAeUFUp.exe
  C:\Windows\System\cAeUFUp.exe
  2⤵
  PID:8844
- C:\Windows\System\kCCzviH.exe
  C:\Windows\System\kCCzviH.exe
  2⤵
  PID:8872
- C:\Windows\System\sTRgPYj.exe
  C:\Windows\System\sTRgPYj.exe
  2⤵
  PID:8892
- C:\Windows\System\FZdrbpD.exe
  C:\Windows\System\FZdrbpD.exe
  2⤵
  PID:8928
- C:\Windows\System\aoNFkLA.exe
  C:\Windows\System\aoNFkLA.exe
  2⤵
  PID:8964
- C:\Windows\System\vFHKDJX.exe
  C:\Windows\System\vFHKDJX.exe
  2⤵
  PID:8992
- C:\Windows\System\McjakuI.exe
  C:\Windows\System\McjakuI.exe
  2⤵
  PID:9020
- C:\Windows\System\pmvBBug.exe
  C:\Windows\System\pmvBBug.exe
  2⤵
  PID:9052
- C:\Windows\System\KhBbBAR.exe
  C:\Windows\System\KhBbBAR.exe
  2⤵
  PID:9076
- C:\Windows\System\QVLyLRo.exe
  C:\Windows\System\QVLyLRo.exe
  2⤵
  PID:9104
- C:\Windows\System\VQcBMBw.exe
  C:\Windows\System\VQcBMBw.exe
  2⤵
  PID:9136
- C:\Windows\System\gRPguFu.exe
  C:\Windows\System\gRPguFu.exe
  2⤵
  PID:9164
- C:\Windows\System\VkPFZXI.exe
  C:\Windows\System\VkPFZXI.exe
  2⤵
  PID:9192
- C:\Windows\System\droDlZW.exe
  C:\Windows\System\droDlZW.exe
  2⤵
  PID:8200
- C:\Windows\System\vBbCLvS.exe
  C:\Windows\System\vBbCLvS.exe
  2⤵
  PID:8260
- C:\Windows\System\IImIwFv.exe
  C:\Windows\System\IImIwFv.exe
  2⤵
  PID:8360
- C:\Windows\System\uFrNeek.exe
  C:\Windows\System\uFrNeek.exe
  2⤵
  PID:8444
- C:\Windows\System\IftXdPZ.exe
  C:\Windows\System\IftXdPZ.exe
  2⤵
  PID:8500
- C:\Windows\System\RwvUcTa.exe
  C:\Windows\System\RwvUcTa.exe
  2⤵
  PID:8568
- C:\Windows\System\RjxOQkf.exe
  C:\Windows\System\RjxOQkf.exe
  2⤵
  PID:8664
- C:\Windows\System\dFwcxor.exe
  C:\Windows\System\dFwcxor.exe
  2⤵
  PID:8716
- C:\Windows\System\lZXBSEi.exe
  C:\Windows\System\lZXBSEi.exe
  2⤵
  PID:8768
- C:\Windows\System\MKipylz.exe
  C:\Windows\System\MKipylz.exe
  2⤵
  PID:8836
- C:\Windows\System\BsWKubT.exe
  C:\Windows\System\BsWKubT.exe
  2⤵
  PID:7716
- C:\Windows\System\jaduvSy.exe
  C:\Windows\System\jaduvSy.exe
  2⤵
  PID:8924
- C:\Windows\System\IpoErqk.exe
  C:\Windows\System\IpoErqk.exe
  2⤵
  PID:9004
- C:\Windows\System\ztIiFCa.exe
  C:\Windows\System\ztIiFCa.exe
  2⤵
  PID:9068
- C:\Windows\System\iBTBhMh.exe
  C:\Windows\System\iBTBhMh.exe
  2⤵
  PID:9132
- C:\Windows\System\hyHpYYv.exe
  C:\Windows\System\hyHpYYv.exe
  2⤵
  PID:9204
- C:\Windows\System\pzTEtoc.exe
  C:\Windows\System\pzTEtoc.exe
  2⤵
  PID:8336
- C:\Windows\System\rCukWuK.exe
  C:\Windows\System\rCukWuK.exe
  2⤵
  PID:8540
- C:\Windows\System\uKxBdMm.exe
  C:\Windows\System\uKxBdMm.exe
  2⤵
  PID:8652
- C:\Windows\System\iCcQQsH.exe
  C:\Windows\System\iCcQQsH.exe
  2⤵
  PID:8828
- C:\Windows\System\qWTiIOn.exe
  C:\Windows\System\qWTiIOn.exe
  2⤵
  PID:8916
- C:\Windows\System\QCIVVsg.exe
  C:\Windows\System\QCIVVsg.exe
  2⤵
  PID:9096
- C:\Windows\System\fanDetq.exe
  C:\Windows\System\fanDetq.exe
  2⤵
  PID:8228
- C:\Windows\System\xMNiwFA.exe
  C:\Windows\System\xMNiwFA.exe
  2⤵
  PID:8628
- C:\Windows\System\RtjRfxH.exe
  C:\Windows\System\RtjRfxH.exe
  2⤵
  PID:8936
- C:\Windows\System\ZBsVsTx.exe
  C:\Windows\System\ZBsVsTx.exe
  2⤵
  PID:8476
- C:\Windows\System\aNaEBkl.exe
  C:\Windows\System\aNaEBkl.exe
  2⤵
  PID:4996
- C:\Windows\System\taQDODt.exe
  C:\Windows\System\taQDODt.exe
  2⤵
  PID:4464
- C:\Windows\System\WzxmUyh.exe
  C:\Windows\System\WzxmUyh.exe
  2⤵
  PID:9240
- C:\Windows\System\tWbkXjd.exe
  C:\Windows\System\tWbkXjd.exe
  2⤵
  PID:9268
- C:\Windows\System\cFDaCpF.exe
  C:\Windows\System\cFDaCpF.exe
  2⤵
  PID:9296
- C:\Windows\System\rmbYbdE.exe
  C:\Windows\System\rmbYbdE.exe
  2⤵
  PID:9324
- C:\Windows\System\ZlUgoJd.exe
  C:\Windows\System\ZlUgoJd.exe
  2⤵
  PID:9352
- C:\Windows\System\LGYFjAG.exe
  C:\Windows\System\LGYFjAG.exe
  2⤵
  PID:9380
- C:\Windows\System\hEFPeDA.exe
  C:\Windows\System\hEFPeDA.exe
  2⤵
  PID:9408
- C:\Windows\System\GsDIlsg.exe
  C:\Windows\System\GsDIlsg.exe
  2⤵
  PID:9436
- C:\Windows\System\ifaCioB.exe
  C:\Windows\System\ifaCioB.exe
  2⤵
  PID:9464
- C:\Windows\System\RDNukZG.exe
  C:\Windows\System\RDNukZG.exe
  2⤵
  PID:9492
- C:\Windows\System\WFwqtvW.exe
  C:\Windows\System\WFwqtvW.exe
  2⤵
  PID:9520
- C:\Windows\System\ekYLdaz.exe
  C:\Windows\System\ekYLdaz.exe
  2⤵
  PID:9548
- C:\Windows\System\YsPLwtP.exe
  C:\Windows\System\YsPLwtP.exe
  2⤵
  PID:9576
- C:\Windows\System\lrgKwDq.exe
  C:\Windows\System\lrgKwDq.exe
  2⤵
  PID:9604
- C:\Windows\System\oFBQyBk.exe
  C:\Windows\System\oFBQyBk.exe
  2⤵
  PID:9632
- C:\Windows\System\isUyuAu.exe
  C:\Windows\System\isUyuAu.exe
  2⤵
  PID:9668
- C:\Windows\System\SfEmxEb.exe
  C:\Windows\System\SfEmxEb.exe
  2⤵
  PID:9696
- C:\Windows\System\gHfdkyL.exe
  C:\Windows\System\gHfdkyL.exe
  2⤵
  PID:9724
- C:\Windows\System\ofRZQCy.exe
  C:\Windows\System\ofRZQCy.exe
  2⤵
  PID:9752
- C:\Windows\System\RhsBiks.exe
  C:\Windows\System\RhsBiks.exe
  2⤵
  PID:9780
- C:\Windows\System\CsYOKcw.exe
  C:\Windows\System\CsYOKcw.exe
  2⤵
  PID:9808
- C:\Windows\System\nYvbwmW.exe
  C:\Windows\System\nYvbwmW.exe
  2⤵
  PID:9836
- C:\Windows\System\EaPBIbj.exe
  C:\Windows\System\EaPBIbj.exe
  2⤵
  PID:9864
- C:\Windows\System\MrUfzYK.exe
  C:\Windows\System\MrUfzYK.exe
  2⤵
  PID:9892
- C:\Windows\System\nnwLtqg.exe
  C:\Windows\System\nnwLtqg.exe
  2⤵
  PID:9920
- C:\Windows\System\fFzXJYu.exe
  C:\Windows\System\fFzXJYu.exe
  2⤵
  PID:9948
- C:\Windows\System\OBllAhp.exe
  C:\Windows\System\OBllAhp.exe
  2⤵
  PID:9976
- C:\Windows\System\NnDhKbB.exe
  C:\Windows\System\NnDhKbB.exe
  2⤵
  PID:10004
- C:\Windows\System\pQJCAQW.exe
  C:\Windows\System\pQJCAQW.exe
  2⤵
  PID:10032
- C:\Windows\System\NMujXUQ.exe
  C:\Windows\System\NMujXUQ.exe
  2⤵
  PID:10060
- C:\Windows\System\hgBXsZG.exe
  C:\Windows\System\hgBXsZG.exe
  2⤵
  PID:10088
- C:\Windows\System\BKEYoIu.exe
  C:\Windows\System\BKEYoIu.exe
  2⤵
  PID:10116
- C:\Windows\System\dYIdOwY.exe
  C:\Windows\System\dYIdOwY.exe
  2⤵
  PID:10144
- C:\Windows\System\yOUbAPl.exe
  C:\Windows\System\yOUbAPl.exe
  2⤵
  PID:10172
- C:\Windows\System\FPqgzkz.exe
  C:\Windows\System\FPqgzkz.exe
  2⤵
  PID:10200
- C:\Windows\System\WDHHyQk.exe
  C:\Windows\System\WDHHyQk.exe
  2⤵
  PID:10228
- C:\Windows\System\syAzZKY.exe
  C:\Windows\System\syAzZKY.exe
  2⤵
  PID:9252
- C:\Windows\System\VMoKVxi.exe
  C:\Windows\System\VMoKVxi.exe
  2⤵
  PID:9316
- C:\Windows\System\zPyazGw.exe
  C:\Windows\System\zPyazGw.exe
  2⤵
  PID:9376
- C:\Windows\System\zrKLpRi.exe
  C:\Windows\System\zrKLpRi.exe
  2⤵
  PID:9448
- C:\Windows\System\XaSNpTl.exe
  C:\Windows\System\XaSNpTl.exe
  2⤵
  PID:9488
- C:\Windows\System\mdYGEQZ.exe
  C:\Windows\System\mdYGEQZ.exe
  2⤵
  PID:9532
- C:\Windows\System\HwEqLjo.exe
  C:\Windows\System\HwEqLjo.exe
  2⤵
  PID:9572
- C:\Windows\System\yjcrsSU.exe
  C:\Windows\System\yjcrsSU.exe
  2⤵
  PID:1532
- C:\Windows\System\CVDrGrh.exe
  C:\Windows\System\CVDrGrh.exe
  2⤵
  PID:3392
- C:\Windows\System\noQHAzH.exe
  C:\Windows\System\noQHAzH.exe
  2⤵
  PID:2984
- C:\Windows\System\gYqUnLR.exe
  C:\Windows\System\gYqUnLR.exe
  2⤵
  PID:9664
- C:\Windows\System\agGskqe.exe
  C:\Windows\System\agGskqe.exe
  2⤵
  PID:9716
- C:\Windows\System\qONfgOk.exe
  C:\Windows\System\qONfgOk.exe
  2⤵
  PID:9792
- C:\Windows\System\FyaeHFW.exe
  C:\Windows\System\FyaeHFW.exe
  2⤵
  PID:3536
- C:\Windows\System\sPURSlI.exe
  C:\Windows\System\sPURSlI.exe
  2⤵
  PID:9860
- C:\Windows\System\YgWrhAv.exe
  C:\Windows\System\YgWrhAv.exe
  2⤵
  PID:9916
- C:\Windows\System\bAHQImD.exe
  C:\Windows\System\bAHQImD.exe
  2⤵
  PID:9988
- C:\Windows\System\OZVhicB.exe
  C:\Windows\System\OZVhicB.exe
  2⤵
  PID:10052
- C:\Windows\System\JrrSeSV.exe
  C:\Windows\System\JrrSeSV.exe
  2⤵
  PID:10112
- C:\Windows\System\ReLkWOy.exe
  C:\Windows\System\ReLkWOy.exe
  2⤵
  PID:10184
- C:\Windows\System\HpzAPRn.exe
  C:\Windows\System\HpzAPRn.exe
  2⤵
  PID:9232
- C:\Windows\System\toCxYZM.exe
  C:\Windows\System\toCxYZM.exe
  2⤵
  PID:9348
- C:\Windows\System\cCCZNdL.exe
  C:\Windows\System\cCCZNdL.exe
  2⤵
  PID:9484
- C:\Windows\System\ysKXMKa.exe
  C:\Windows\System\ysKXMKa.exe
  2⤵
  PID:964
- C:\Windows\System\jANLvWE.exe
  C:\Windows\System\jANLvWE.exe
  2⤵
  PID:2640
- C:\Windows\System\hiofzzQ.exe
  C:\Windows\System\hiofzzQ.exe
  2⤵
  PID:3056
- C:\Windows\System\EOYOWcc.exe
  C:\Windows\System\EOYOWcc.exe
  2⤵
  PID:3980
- C:\Windows\System\EiRoWri.exe
  C:\Windows\System\EiRoWri.exe
  2⤵
  PID:9972
- C:\Windows\System\EaGSxWe.exe
  C:\Windows\System\EaGSxWe.exe
  2⤵
  PID:10140
- C:\Windows\System\leMJwwV.exe
  C:\Windows\System\leMJwwV.exe
  2⤵
  PID:9404
- C:\Windows\System\EUEMROY.exe
  C:\Windows\System\EUEMROY.exe
  2⤵
  PID:4804
- C:\Windows\System\LuxZMQX.exe
  C:\Windows\System\LuxZMQX.exe
  2⤵
  PID:9908
- C:\Windows\System\cQzQguv.exe
  C:\Windows\System\cQzQguv.exe
  2⤵
  PID:10100
- C:\Windows\System\BMYxPeu.exe
  C:\Windows\System\BMYxPeu.exe
  2⤵
  PID:9624
- C:\Windows\System\bFHIiDc.exe
  C:\Windows\System\bFHIiDc.exe
  2⤵
  PID:452
- C:\Windows\System\dDjoXMo.exe
  C:\Windows\System\dDjoXMo.exe
  2⤵
  PID:10044
- C:\Windows\System\VkozKoI.exe
  C:\Windows\System\VkozKoI.exe
  2⤵
  PID:10268
- C:\Windows\System\YcJNGUm.exe
  C:\Windows\System\YcJNGUm.exe
  2⤵
  PID:10296
- C:\Windows\System\YpNBpuH.exe
  C:\Windows\System\YpNBpuH.exe
  2⤵
  PID:10324
- C:\Windows\System\AGgQXdl.exe
  C:\Windows\System\AGgQXdl.exe
  2⤵
  PID:10352
- C:\Windows\System\LNwenCw.exe
  C:\Windows\System\LNwenCw.exe
  2⤵
  PID:10380
- C:\Windows\System\jGXKlDs.exe
  C:\Windows\System\jGXKlDs.exe
  2⤵
  PID:10408
- C:\Windows\System\MlySdan.exe
  C:\Windows\System\MlySdan.exe
  2⤵
  PID:10436
- C:\Windows\System\NJgUIHe.exe
  C:\Windows\System\NJgUIHe.exe
  2⤵
  PID:10464
- C:\Windows\System\FZNhxWQ.exe
  C:\Windows\System\FZNhxWQ.exe
  2⤵
  PID:10492
- C:\Windows\System\tFmEnfi.exe
  C:\Windows\System\tFmEnfi.exe
  2⤵
  PID:10520
- C:\Windows\System\EZrXwJX.exe
  C:\Windows\System\EZrXwJX.exe
  2⤵
  PID:10548
- C:\Windows\System\zdpiXHf.exe
  C:\Windows\System\zdpiXHf.exe
  2⤵
  PID:10576
- C:\Windows\System\hJTJXqf.exe
  C:\Windows\System\hJTJXqf.exe
  2⤵
  PID:10604
- C:\Windows\System\WjmDtXB.exe
  C:\Windows\System\WjmDtXB.exe
  2⤵
  PID:10632
- C:\Windows\System\TKwsEkl.exe
  C:\Windows\System\TKwsEkl.exe
  2⤵
  PID:10660
- C:\Windows\System\pkPMZZi.exe
  C:\Windows\System\pkPMZZi.exe
  2⤵
  PID:10688
- C:\Windows\System\jMHPQAg.exe
  C:\Windows\System\jMHPQAg.exe
  2⤵
  PID:10716
- C:\Windows\System\GzxXnFi.exe
  C:\Windows\System\GzxXnFi.exe
  2⤵
  PID:10744
- C:\Windows\System\EMbPIJG.exe
  C:\Windows\System\EMbPIJG.exe
  2⤵
  PID:10772
- C:\Windows\System\vuoLEiU.exe
  C:\Windows\System\vuoLEiU.exe
  2⤵
  PID:10800
- C:\Windows\System\FZLxwQl.exe
  C:\Windows\System\FZLxwQl.exe
  2⤵
  PID:10820
- C:\Windows\System\HeqftOZ.exe
  C:\Windows\System\HeqftOZ.exe
  2⤵
  PID:10856
- C:\Windows\System\dNmyrhi.exe
  C:\Windows\System\dNmyrhi.exe
  2⤵
  PID:10884
- C:\Windows\System\EqAUpVY.exe
  C:\Windows\System\EqAUpVY.exe
  2⤵
  PID:10912
- C:\Windows\System\rqhCSxq.exe
  C:\Windows\System\rqhCSxq.exe
  2⤵
  PID:10952
- C:\Windows\System\hhfOqXY.exe
  C:\Windows\System\hhfOqXY.exe
  2⤵
  PID:10968
- C:\Windows\System\wXoIurM.exe
  C:\Windows\System\wXoIurM.exe
  2⤵
  PID:10996
- C:\Windows\System\xhyycjx.exe
  C:\Windows\System\xhyycjx.exe
  2⤵
  PID:11028
- C:\Windows\System\fnBPHLG.exe
  C:\Windows\System\fnBPHLG.exe
  2⤵
  PID:11056
- C:\Windows\System\rFXxKLV.exe
  C:\Windows\System\rFXxKLV.exe
  2⤵
  PID:11084
- C:\Windows\System\RyvNDmX.exe
  C:\Windows\System\RyvNDmX.exe
  2⤵
  PID:11112
- C:\Windows\System\MsbJLjh.exe
  C:\Windows\System\MsbJLjh.exe
  2⤵
  PID:11140
- C:\Windows\System\QtmwhmT.exe
  C:\Windows\System\QtmwhmT.exe
  2⤵
  PID:11168
- C:\Windows\System\epwFAwJ.exe
  C:\Windows\System\epwFAwJ.exe
  2⤵
  PID:11196
- C:\Windows\System\CTQFETs.exe
  C:\Windows\System\CTQFETs.exe
  2⤵
  PID:11224
- C:\Windows\System\VhUghaH.exe
  C:\Windows\System\VhUghaH.exe
  2⤵
  PID:11252
- C:\Windows\System\jodEUHc.exe
  C:\Windows\System\jodEUHc.exe
  2⤵
  PID:10280
- C:\Windows\System\IAjFxlM.exe
  C:\Windows\System\IAjFxlM.exe
  2⤵
  PID:10344
- C:\Windows\System\VlPexRs.exe
  C:\Windows\System\VlPexRs.exe
  2⤵
  PID:10404
- C:\Windows\System\jMBxPxq.exe
  C:\Windows\System\jMBxPxq.exe
  2⤵
  PID:10476
- C:\Windows\System\XwAbRFh.exe
  C:\Windows\System\XwAbRFh.exe
  2⤵
  PID:10572
- C:\Windows\System\luHfqxr.exe
  C:\Windows\System\luHfqxr.exe
  2⤵
  PID:10628
- C:\Windows\System\PymAqmr.exe
  C:\Windows\System\PymAqmr.exe
  2⤵
  PID:10700
- C:\Windows\System\yndOuRR.exe
  C:\Windows\System\yndOuRR.exe
  2⤵
  PID:10736
- C:\Windows\System\ywMiCtJ.exe
  C:\Windows\System\ywMiCtJ.exe
  2⤵
  PID:10792
- C:\Windows\System\WvntcNL.exe
  C:\Windows\System\WvntcNL.exe
  2⤵
  PID:10840
- C:\Windows\System\fNJjLmO.exe
  C:\Windows\System\fNJjLmO.exe
  2⤵
  PID:10924
- C:\Windows\System\ZcgjfBg.exe
  C:\Windows\System\ZcgjfBg.exe
  2⤵
  PID:10980
- C:\Windows\System\XQjAmOR.exe
  C:\Windows\System\XQjAmOR.exe
  2⤵
  PID:11048
- C:\Windows\System\diTNJwB.exe
  C:\Windows\System\diTNJwB.exe
  2⤵
  PID:11108
- C:\Windows\System\qvrPmdg.exe
  C:\Windows\System\qvrPmdg.exe
  2⤵
  PID:11180
- C:\Windows\System\VDDdoqC.exe
  C:\Windows\System\VDDdoqC.exe
  2⤵
  PID:11244
- C:\Windows\System\ReckHUV.exe
  C:\Windows\System\ReckHUV.exe
  2⤵
  PID:10336
- C:\Windows\System\tltxcDq.exe
  C:\Windows\System\tltxcDq.exe
  2⤵
  PID:10504
- C:\Windows\System\xsReUth.exe
  C:\Windows\System\xsReUth.exe
  2⤵
  PID:10652
- C:\Windows\System\vpwsFwv.exe
  C:\Windows\System\vpwsFwv.exe
  2⤵
  PID:10784
- C:\Windows\System\IRzYDoF.exe
  C:\Windows\System\IRzYDoF.exe
  2⤵
  PID:4536
- C:\Windows\System\rftuaDq.exe
  C:\Windows\System\rftuaDq.exe
  2⤵
  PID:11096
- C:\Windows\System\FCGBDrn.exe
  C:\Windows\System\FCGBDrn.exe
  2⤵
  PID:11236
- C:\Windows\System\NPyaWTb.exe
  C:\Windows\System\NPyaWTb.exe
  2⤵
  PID:10532
- C:\Windows\System\wwTkUUg.exe
  C:\Windows\System\wwTkUUg.exe
  2⤵
  PID:10908
- C:\Windows\System\EkmIpsZ.exe
  C:\Windows\System\EkmIpsZ.exe
  2⤵
  PID:11208
- C:\Windows\System\IGZRWuN.exe
  C:\Windows\System\IGZRWuN.exe
  2⤵
  PID:11076
- C:\Windows\System\wdBHsBU.exe
  C:\Windows\System\wdBHsBU.exe
  2⤵
  PID:10392
- C:\Windows\System\BJWBnOd.exe
  C:\Windows\System\BJWBnOd.exe
  2⤵
  PID:11292
- C:\Windows\System\plBRkUP.exe
  C:\Windows\System\plBRkUP.exe
  2⤵
  PID:11308
- C:\Windows\System\PnEwcJj.exe
  C:\Windows\System\PnEwcJj.exe
  2⤵
  PID:11348
- C:\Windows\System\ZIoRteg.exe
  C:\Windows\System\ZIoRteg.exe
  2⤵
  PID:11376
- C:\Windows\System\TdHUZER.exe
  C:\Windows\System\TdHUZER.exe
  2⤵
  PID:11404
- C:\Windows\System\CyXZhHm.exe
  C:\Windows\System\CyXZhHm.exe
  2⤵
  PID:11432
- C:\Windows\System\eqKNKBv.exe
  C:\Windows\System\eqKNKBv.exe
  2⤵
  PID:11460
- C:\Windows\System\eYNcYjK.exe
  C:\Windows\System\eYNcYjK.exe
  2⤵
  PID:11488
- C:\Windows\System\ffsVxKv.exe
  C:\Windows\System\ffsVxKv.exe
  2⤵
  PID:11516
- C:\Windows\System\kwVgCXi.exe
  C:\Windows\System\kwVgCXi.exe
  2⤵
  PID:11544
- C:\Windows\System\NWGwnwc.exe
  C:\Windows\System\NWGwnwc.exe
  2⤵
  PID:11572
- C:\Windows\System\ZyqbMvo.exe
  C:\Windows\System\ZyqbMvo.exe
  2⤵
  PID:11600
- C:\Windows\System\TQDLKxV.exe
  C:\Windows\System\TQDLKxV.exe
  2⤵
  PID:11628
- C:\Windows\System\qXCDFRk.exe
  C:\Windows\System\qXCDFRk.exe
  2⤵
  PID:11656
- C:\Windows\System\IVUAygx.exe
  C:\Windows\System\IVUAygx.exe
  2⤵
  PID:11684
- C:\Windows\System\vPwVJqj.exe
  C:\Windows\System\vPwVJqj.exe
  2⤵
  PID:11712
- C:\Windows\System\zxAhgcp.exe
  C:\Windows\System\zxAhgcp.exe
  2⤵
  PID:11744
- C:\Windows\System\rMuUOuJ.exe
  C:\Windows\System\rMuUOuJ.exe
  2⤵
  PID:11772
- C:\Windows\System\iADIfVn.exe
  C:\Windows\System\iADIfVn.exe
  2⤵
  PID:11800
- C:\Windows\System\jpYxmKF.exe
  C:\Windows\System\jpYxmKF.exe
  2⤵
  PID:11828
- C:\Windows\System\NsILbTP.exe
  C:\Windows\System\NsILbTP.exe
  2⤵
  PID:11856
- C:\Windows\System\CjQaWQB.exe
  C:\Windows\System\CjQaWQB.exe
  2⤵
  PID:11884
- C:\Windows\System\LyjKMEE.exe
  C:\Windows\System\LyjKMEE.exe
  2⤵
  PID:11912
- C:\Windows\System\rMxMxZM.exe
  C:\Windows\System\rMxMxZM.exe
  2⤵
  PID:11940
- C:\Windows\System\BZeEisq.exe
  C:\Windows\System\BZeEisq.exe
  2⤵
  PID:11968
- C:\Windows\System\HXiCUZs.exe
  C:\Windows\System\HXiCUZs.exe
  2⤵
  PID:11996
- C:\Windows\System\fpLrfit.exe
  C:\Windows\System\fpLrfit.exe
  2⤵
  PID:12024
- C:\Windows\System\HshiTsZ.exe
  C:\Windows\System\HshiTsZ.exe
  2⤵
  PID:12052
- C:\Windows\System\XTweHUb.exe
  C:\Windows\System\XTweHUb.exe
  2⤵
  PID:12080
- C:\Windows\System\mEQkidN.exe
  C:\Windows\System\mEQkidN.exe
  2⤵
  PID:12108
- C:\Windows\System\BtuZwHL.exe
  C:\Windows\System\BtuZwHL.exe
  2⤵
  PID:12136
- C:\Windows\System\eOaRAmD.exe
  C:\Windows\System\eOaRAmD.exe
  2⤵
  PID:12164
- C:\Windows\System\QBCASbO.exe
  C:\Windows\System\QBCASbO.exe
  2⤵
  PID:12192
- C:\Windows\System\tioCBhD.exe
  C:\Windows\System\tioCBhD.exe
  2⤵
  PID:12228
- C:\Windows\System\VYKyJGL.exe
  C:\Windows\System\VYKyJGL.exe
  2⤵
  PID:12248
- C:\Windows\System\rbzGNQf.exe
  C:\Windows\System\rbzGNQf.exe
  2⤵
  PID:12276
- C:\Windows\System\Kslwuib.exe
  C:\Windows\System\Kslwuib.exe
  2⤵
  PID:11284
- C:\Windows\System\hJBeUXE.exe
  C:\Windows\System\hJBeUXE.exe
  2⤵
  PID:11368
- C:\Windows\System\oFDuDBZ.exe
  C:\Windows\System\oFDuDBZ.exe
  2⤵
  PID:11400
- C:\Windows\System\zqVhRVC.exe
  C:\Windows\System\zqVhRVC.exe
  2⤵
  PID:11484
- C:\Windows\System\GqogjBA.exe
  C:\Windows\System\GqogjBA.exe
  2⤵
  PID:11556
- C:\Windows\System\znjOtIO.exe
  C:\Windows\System\znjOtIO.exe
  2⤵
  PID:11620
- C:\Windows\System\iszGEfR.exe
  C:\Windows\System\iszGEfR.exe
  2⤵
  PID:11676
- C:\Windows\System\TRwiLVc.exe
  C:\Windows\System\TRwiLVc.exe
  2⤵
  PID:2404
- C:\Windows\System\dWIgKLL.exe
  C:\Windows\System\dWIgKLL.exe
  2⤵
  PID:11740
- C:\Windows\System\WTyhluO.exe
  C:\Windows\System\WTyhluO.exe
  2⤵
  PID:11812
- C:\Windows\System\sqPaNkF.exe
  C:\Windows\System\sqPaNkF.exe
  2⤵
  PID:11876
- C:\Windows\System\VYOmOUi.exe
  C:\Windows\System\VYOmOUi.exe
  2⤵
  PID:11936
- C:\Windows\System\yDHkyVN.exe
  C:\Windows\System\yDHkyVN.exe
  2⤵
  PID:12008
- C:\Windows\System\jLgbKNI.exe
  C:\Windows\System\jLgbKNI.exe
  2⤵
  PID:12076
- C:\Windows\System\UzNUWlt.exe
  C:\Windows\System\UzNUWlt.exe
  2⤵
  PID:12132
- C:\Windows\System\jeDUBzT.exe
  C:\Windows\System\jeDUBzT.exe
  2⤵
  PID:12204
- C:\Windows\System\jCCbhKp.exe
  C:\Windows\System\jCCbhKp.exe
  2⤵
  PID:12268
- C:\Windows\System\eafOkLs.exe
  C:\Windows\System\eafOkLs.exe
  2⤵
  PID:11336
- C:\Windows\System\MhWLiNH.exe
  C:\Windows\System\MhWLiNH.exe
  2⤵
  PID:11512
- C:\Windows\System\TegbmUY.exe
  C:\Windows\System\TegbmUY.exe
  2⤵
  PID:11672
- C:\Windows\System\LoLaOkC.exe
  C:\Windows\System\LoLaOkC.exe
  2⤵
  PID:11768
- C:\Windows\System\VPtxIEN.exe
  C:\Windows\System\VPtxIEN.exe
  2⤵
  PID:11904
- C:\Windows\System\CJOtgMd.exe
  C:\Windows\System\CJOtgMd.exe
  2⤵
  PID:12048
- C:\Windows\System\jEChVzl.exe
  C:\Windows\System\jEChVzl.exe
  2⤵
  PID:12184
- C:\Windows\System\MTYCeBR.exe
  C:\Windows\System\MTYCeBR.exe
  2⤵
  PID:11396
- C:\Windows\System\LGlFtDs.exe
  C:\Windows\System\LGlFtDs.exe
  2⤵
  PID:1928
- C:\Windows\System\HjXEPOl.exe
  C:\Windows\System\HjXEPOl.exe
  2⤵
  PID:12036
- C:\Windows\System\VgpBwKA.exe
  C:\Windows\System\VgpBwKA.exe
  2⤵
  PID:11332
- C:\Windows\System\Nrgrwxr.exe
  C:\Windows\System\Nrgrwxr.exe
  2⤵
  PID:12160
- C:\Windows\System\lGRaYvV.exe
  C:\Windows\System\lGRaYvV.exe
  2⤵
  PID:11868
- C:\Windows\System\PctFWhO.exe
  C:\Windows\System\PctFWhO.exe
  2⤵
  PID:12316
- C:\Windows\System\oCPPVdJ.exe
  C:\Windows\System\oCPPVdJ.exe
  2⤵
  PID:12348
- C:\Windows\System\EHQOyyt.exe
  C:\Windows\System\EHQOyyt.exe
  2⤵
  PID:12376
- C:\Windows\System\pxJEgHs.exe
  C:\Windows\System\pxJEgHs.exe
  2⤵
  PID:12404
- C:\Windows\System\LWJBSuR.exe
  C:\Windows\System\LWJBSuR.exe
  2⤵
  PID:12432
- C:\Windows\System\PFYUDLa.exe
  C:\Windows\System\PFYUDLa.exe
  2⤵
  PID:12460
- C:\Windows\System\QVTLVoX.exe
  C:\Windows\System\QVTLVoX.exe
  2⤵
  PID:12488
- C:\Windows\System\eXTtlUr.exe
  C:\Windows\System\eXTtlUr.exe
  2⤵
  PID:12516
- C:\Windows\System\vRoMsLI.exe
  C:\Windows\System\vRoMsLI.exe
  2⤵
  PID:12544
- C:\Windows\System\VWfSqam.exe
  C:\Windows\System\VWfSqam.exe
  2⤵
  PID:12572
- C:\Windows\System\zFNdUDf.exe
  C:\Windows\System\zFNdUDf.exe
  2⤵
  PID:12600
- C:\Windows\System\LmQOPeS.exe
  C:\Windows\System\LmQOPeS.exe
  2⤵
  PID:12628
- C:\Windows\System\Uknpkpr.exe
  C:\Windows\System\Uknpkpr.exe
  2⤵
  PID:12644
- C:\Windows\System\CQzxbba.exe
  C:\Windows\System\CQzxbba.exe
  2⤵
  PID:12684
- C:\Windows\System\JGeIYuz.exe
  C:\Windows\System\JGeIYuz.exe
  2⤵
  PID:12712
- C:\Windows\System\miajlol.exe
  C:\Windows\System\miajlol.exe
  2⤵
  PID:12740
- C:\Windows\System\tHAlYJr.exe
  C:\Windows\System\tHAlYJr.exe
  2⤵
  PID:12768
- C:\Windows\System\OVoRWtL.exe
  C:\Windows\System\OVoRWtL.exe
  2⤵
  PID:12796
- C:\Windows\System\GNmUADO.exe
  C:\Windows\System\GNmUADO.exe
  2⤵
  PID:12824
- C:\Windows\System\yJvAOnl.exe
  C:\Windows\System\yJvAOnl.exe
  2⤵
  PID:12852
- C:\Windows\System\vAksIFr.exe
  C:\Windows\System\vAksIFr.exe
  2⤵
  PID:12880
- C:\Windows\System\HXlaICF.exe
  C:\Windows\System\HXlaICF.exe
  2⤵
  PID:12908
- C:\Windows\System\lhWavFA.exe
  C:\Windows\System\lhWavFA.exe
  2⤵
  PID:12936
- C:\Windows\System\oiUbHFO.exe
  C:\Windows\System\oiUbHFO.exe
  2⤵
  PID:12964
- C:\Windows\System\HuGUVxy.exe
  C:\Windows\System\HuGUVxy.exe
  2⤵
  PID:13104
- C:\Windows\System\NFaryrc.exe
  C:\Windows\System\NFaryrc.exe
  2⤵
  PID:13124
- C:\Windows\System\zNinVaV.exe
  C:\Windows\System\zNinVaV.exe
  2⤵
  PID:13160
- C:\Windows\System\pRFmSEr.exe
  C:\Windows\System\pRFmSEr.exe
  2⤵
  PID:13192
- C:\Windows\System\BgFzkaF.exe
  C:\Windows\System\BgFzkaF.exe
  2⤵
  PID:13220
- C:\Windows\System\HUXeGbZ.exe
  C:\Windows\System\HUXeGbZ.exe
  2⤵
  PID:13248
- C:\Windows\System\AjpEDpP.exe
  C:\Windows\System\AjpEDpP.exe
  2⤵
  PID:12344
- C:\Windows\System\gvyKEZW.exe
  C:\Windows\System\gvyKEZW.exe
  2⤵
  PID:13300
- C:\Windows\System\ZHaWpMQ.exe
  C:\Windows\System\ZHaWpMQ.exe
  2⤵
  PID:12368
- C:\Windows\System\BoIsNYw.exe
  C:\Windows\System\BoIsNYw.exe
  2⤵
  PID:12484
- C:\Windows\System\utToRid.exe
  C:\Windows\System\utToRid.exe
  2⤵
  PID:12564
- C:\Windows\System\mmPYTnA.exe
  C:\Windows\System\mmPYTnA.exe
  2⤵
  PID:13412
- C:\Windows\System\QvXzhjG.exe
  C:\Windows\System\QvXzhjG.exe
  2⤵
  PID:13408
- C:\Windows\System\tIUwePm.exe
  C:\Windows\System\tIUwePm.exe
  2⤵
  PID:13472
- C:\Windows\System\lublndq.exe
  C:\Windows\System\lublndq.exe
  2⤵
  PID:13500
- C:\Windows\System\qHWoGSx.exe
  C:\Windows\System\qHWoGSx.exe
  2⤵
  PID:13576
- C:\Windows\System\aUJAGNC.exe
  C:\Windows\System\aUJAGNC.exe
  2⤵
  PID:13604
- C:\Windows\System\sdafTiE.exe
  C:\Windows\System\sdafTiE.exe
  2⤵
  PID:13632
- C:\Windows\System\SsVgKEe.exe
  C:\Windows\System\SsVgKEe.exe
  2⤵
  PID:13660
- C:\Windows\System\kMoLPsj.exe
  C:\Windows\System\kMoLPsj.exe
  2⤵
  PID:13692
- C:\Windows\System\JrgnovK.exe
  C:\Windows\System\JrgnovK.exe
  2⤵
  PID:13720
- C:\Windows\System\LDXxxda.exe
  C:\Windows\System\LDXxxda.exe
  2⤵
  PID:13752
- C:\Windows\System\ZURWtHK.exe
  C:\Windows\System\ZURWtHK.exe
  2⤵
  PID:13404
- C:\Windows\System\rYQRtVO.exe
  C:\Windows\System\rYQRtVO.exe
  2⤵
  PID:13484
- C:\Windows\System\CbkUKen.exe
  C:\Windows\System\CbkUKen.exe
  2⤵
  PID:13448
- C:\Windows\System\eSlaDJR.exe
  C:\Windows\System\eSlaDJR.exe
  2⤵
  PID:13620
- C:\Windows\System\QBIikBD.exe
  C:\Windows\System\QBIikBD.exe
  2⤵
  PID:13716
- C:\Windows\System\BYyKKGn.exe
  C:\Windows\System\BYyKKGn.exe
  2⤵
  PID:13776
- C:\Windows\System\SNNPEIo.exe
  C:\Windows\System\SNNPEIo.exe
  2⤵
  PID:4480
- C:\Windows\System\xPnOZeJ.exe
  C:\Windows\System\xPnOZeJ.exe
  2⤵
  PID:13800
- C:\Windows\System\gTrXVJC.exe
  C:\Windows\System\gTrXVJC.exe
  2⤵
  PID:14276
- C:\Windows\System\lDBaVhm.exe
  C:\Windows\System\lDBaVhm.exe
  2⤵
  PID:14320
- C:\Windows\System\ulGbAWv.exe
  C:\Windows\System\ulGbAWv.exe
  2⤵
  PID:14616
- C:\Windows\System\XBOMJjG.exe
  C:\Windows\System\XBOMJjG.exe
  2⤵
  PID:14624
- C:\Windows\System\oxZggBD.exe
  C:\Windows\System\oxZggBD.exe
  2⤵
  PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_wetrc0mb.jsm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wetrc0mb.jsm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BivDANT.exe

Path C:\Windows\System\BivDANT.exe
Size 3.1MB
SHA256 793bed8c0f4042d2fdfa6e73307bd041470696fe3794c1977fa24e86e6b0bd56
MD5 190c04f4ae8477314bc66acb23e53d47
SHA1 1d41b48e43e9e43efa1e2a6750c5648236112905
SHA512 7ec666c400c8222223289c54d15db2177bf834cacb7a3fb5030665d133e80cebbea8cd452b32acf653cfecbd74c1adff63e8f3c55203a7bda4911739d9f6052f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWe:7bBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

EORLfrY.exe

Path C:\Windows\System\EORLfrY.exe
Size 3.1MB
SHA256 4fe575ba39b69c1f2ceaf91c7ed28bdfe138ca78d2fde35b1e4ed572da7ba734
MD5 59fdc616746e0ab8a16ef8e1c2430b0e
SHA1 4eadff79d07200419639fbaee4d05aa3e91b18bf
SHA512 8fe059fabbb6903d98ef2b1d3864e27d9f81a697f7e5bb6a4184efd977b4d722c2b20a3caa350c56fec6e24b8c407aef32f21fec7ce45ab2e9f37acff66e6e91
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ElppmaZ.exe

Path C:\Windows\System\ElppmaZ.exe
Size 3.1MB
SHA256 581e7c3d6c47b9c47c60dca95a94da5761d9dfcbe5fa18453745c5897c2c8090
MD5 a861bc937bfdf9882a50dda50494662e
SHA1 c2df664f1f150c385e22b56e009c4eea4dee9e30
SHA512 abfe63b94f67f7e9a3158aff462af12abfa81706c3b254ebf859abbb3d47455de5578af08451aaa5a12ede98d5ed12823404a19ae6aa9309a0647fa09fbd6e5d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWk:7bBeSFkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

GwvXDOB.exe

Path C:\Windows\System\GwvXDOB.exe
Size 3.1MB
SHA256 3ef231673bd7f3cde76eef64a1f2ae848e8fe159a01b72da0f7a60d523a75d08
MD5 cbd16a17f318d6071a37588720f39698
SHA1 efa0fae5a436d8ae776fd0609166bdfdeb81ba33
SHA512 615fdca04de30fbe1bc733daed968360f6d097c107f6454ef15590c08d39d243bf2dd8e0efc678fd2830fde04602c3696b6d6882bae4adead67cdd515e84921a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

HrkjNBD.exe

Path C:\Windows\System\HrkjNBD.exe
Size 3.1MB
SHA256 f691d4c5a7d357989b8ec81f44d667fef47d1b11a6b6a1f88fd5538547641479
MD5 7e49750bc2ccd1e17aa9a629f4fc4c8e
SHA1 84f2f7e6d20f085ed824be59bf0ddf259afd26d0
SHA512 1db7c854b56493d467675776f024f7df54821c88ef211f8a9cc9a2befdbe18af86244dc8942bd59bcf892828a91a9fbfbc3c04fba647346843be92ece4b0b5ad
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:7bBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

IHLAYis.exe

Path C:\Windows\System\IHLAYis.exe
Size 3.1MB
SHA256 78b01f63a8488168cef2d3d9823566a62d2456330cfe88afe79a0ae6dbf251fc
MD5 31eeeb6c235bb66fb4d31654ceef7d18
SHA1 7a23b8732d42ce310412bc5b456c34feddd4ed22
SHA512 d6c5f64e6f27d7cd9b0dc145487f2e6dfbad838d9031d44ba1bd6bdb93d85fcf3ef556c65802d28633528585a6880e673f2e19f969a087286960190ff97ac406
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:7bBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

JdVwjHg.exe

Path C:\Windows\System\JdVwjHg.exe
Size 3.1MB
SHA256 2da3fb7685546b5985e909bdf09ff5e987e211ba898f6fb4ffa56925d86d4684
MD5 4c61ef277f80182e4afa7f0592586c70
SHA1 ec0fb6e469d9e819530853e69a635082b32291be
SHA512 5224263dc853b1a34000f9070937855a50cd7acf5065a1c6e4179e48fd9251ac0d440ab571a2e870329b2b0d2b04823e34d3e5f5f1e7496c8bbae06d6c219d84
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

LoxNwrD.exe

Path C:\Windows\System\LoxNwrD.exe
Size 3.1MB
SHA256 5f95106eafe802a80e4b92a2925fa65900f00decb50f52d0fa9f614cc72b00ea
MD5 8c2f1ff6410b9df1ada54a2f86786da9
SHA1 03bf08186f4cce6781000c9489ad91101508f180
SHA512 7c2ee36b1282cd17d50bd855fab5f46e9da16fc3a38ab7bcd9c00c731a0d0a1f785aa25a20008db28cadf0fb0b76a761e86304c7993ce0693eb717e7bece2092
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

PqcVXdm.exe

Path C:\Windows\System\PqcVXdm.exe
Size 3.1MB
SHA256 7eee5db7e50f0512b96fadf7692f58309c71f4b6b1bcd53abbd380732e6fbe39
MD5 8f537b781d7ae9f4d7feeeef4f257360
SHA1 74e71eef48a3a03c2e2ae3e8565805345ea2d0f8
SHA512 3e3e1f82bd922a413963cf80d5aedbc616ef4ae789419c6c07d958cd8577bfcc488be3f10214211ec78e22e1a6bc69fc3ad8dbf8f95f6b7bb430b591a790aec2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWI:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TLyLdDc.exe

Path C:\Windows\System\TLyLdDc.exe
Size 3.1MB
SHA256 4948243223c24775b2ed3fd4d80c1e7188d1c3cdb494d14c343794210c4dbb20
MD5 a1960a7b6d2a271d0c82ca44c2ea5c16
SHA1 3a8af53ab88315cf0adc54501f1725e3a8b5156c
SHA512 d1434ba0d957ceebe1c9d0df5b0f1dfed9449ceef7a41aadbb7321b7e981f1b8c0025b1658e863efd2e632adf353bbd22c1adb9154c2d38d14e3ac3d91388137
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:7bBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

VEaGNvY.exe

Path C:\Windows\System\VEaGNvY.exe
Size 3.1MB
SHA256 51b7bb65cd44c68e81987b08559bc6f3b9fd17d85369baaecf7645aafd52e787
MD5 9ea1b83bc086dd2ce66fcf6fa8e17444
SHA1 1e4379c89d3e19da9023ccb022a6f3bc484d1dac
SHA512 4705db43f365296a706049ce203ee2bee5d0cfaf50b12c001eca1979ff435e5df32c1570579afe1f65e18e6a13d1f9c280bfb84d0e4ff8895d0885570c3b31a8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

VHTKqdw.exe

Path C:\Windows\System\VHTKqdw.exe
Size 3.1MB
SHA256 2b55b291ae238bf47a3069f29acdf3fdcf8624bfc9de7d712c7aa4d17e963415
MD5 613b5023052e4f0a81c032fdf4f8aad7
SHA1 152f8caa68ae593ea91792b8f4d8400b807c7ff9
SHA512 7aa8f7840581edca4b3c5d1c0710ef139a26189bd6a9d9c4d0c2cb507278a00c1d70a4d51871b2155a17b2c0bb0433a5c069a666962e2f80527b79e712e425f2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:7bBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

WDtyIOG.exe

Path C:\Windows\System\WDtyIOG.exe
Size 3.1MB
SHA256 6f8122708d50f8ce0aa230af4cea793b5c0e71a9cf6a76518f8311921422ffaf
MD5 0746fda0107a2df2163397e4407041ba
SHA1 64d271bbe7f28831ed8f695e09e2e3f6a72f6789
SHA512 3cee0b202710b1c148aaa3e3d482f7654f12fda8fc1221d05079ab57afc49a726210851098adfe129853da56c6d736e9b8c2efd8b61f4966c27f101088e79f91
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW6:7bBeSFkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

XooDnjG.exe

Path C:\Windows\System\XooDnjG.exe
Size 3.1MB
SHA256 aadad7da2c28e42fefa14971f917463f36f8d1d0a7935bd180ddd880623a68ce
MD5 be357428fb11f5ed3c3c25ce037b72ee
SHA1 bab88bd7a70b43fada9c2e35e5ecdc9050679d6d
SHA512 1317d38cbec23efd16ae15d00224d914e61f7b5f01a82466deeff9ead9f8fa1b8693a0f3c1bfc37dca3052dde19fa9dc6a92043b45a8238fb91da629c630c8c2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZxMOxqF.exe

Path C:\Windows\System\ZxMOxqF.exe
Size 3.1MB
SHA256 7033adf723f362f2fca60326b688113d4bbe69a54520f8fbb5305ba1a70b2922
MD5 7f7f79270a2188b5eeb8a4e2b678bf11
SHA1 96df1add3ed697b60799739b0f04c7c21010becb
SHA512 5def5cade9787704aed1868dbc13bd1192fcd7bd70ca3ee244b5bf7776ff1fe87c2690ad3b720e65ed1a7d48f41132dcd33a164cb1810fde0affa82d6fbe4040
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

aLNCPJN.exe

Path C:\Windows\System\aLNCPJN.exe
Size 3.1MB
SHA256 deca639142821d2e23d4ae90404346a1ae4c66496c938b3280fdff1f5547ba34
MD5 f2223305e1c87915b7e9e974f9b544b0
SHA1 0462fb724eb904b13baf86932fc16befe2597cd1
SHA512 bff921b5b5bda0ce01d6c1ec52541ca213de5d83c08e797ce2685de0e32f07967cb671f77a28b3d67a0c5b89a2ebde17c9e1efbbaeed87f02ef8e555f752d16a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

bIwncLu.exe

Path C:\Windows\System\bIwncLu.exe
Size 3.1MB
SHA256 b3637e5706a01039a03ae9a5f7685c040b491dd59a212b5e1a294bfcaf007de0
MD5 53d77c02f0bc8c2d48d197aad84c36bb
SHA1 1edc94030b01c45eec679fd03f7beff0b755ce6b
SHA512 dc638ab888c561e001e99f8da5356655bec0cb97da4eb1a91f310afe70cea70601c362cbe00fc71f04bc9817e0427b412e7e64780c3a3dfbba856fa46d84162d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

dBPaJfI.exe

Path C:\Windows\System\dBPaJfI.exe
Size 3.1MB
SHA256 94b341ae978e5114db081f269c62e6ca74dc6527eb88dfadc65005e878270cfb
MD5 0f10da8dcebe449d7241c530f9407b9e
SHA1 bef1e721187734d17388f548e5bf10a240d2b6cd
SHA512 abda01ed82700c38bf1bb5bd43c6d651ff5ea48ce2e0ab12a5914dd4bb247231b6c41b4f75f97da195d80b8b28847ddc80d2e0c462e297d84694f9081f1e9137
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dpBTSgJ.exe

Path C:\Windows\System\dpBTSgJ.exe
Size 3.1MB
SHA256 ca4316f234ab632a6be24ba7f7b9a11024e72db039ee770102b17aa32758b2b1
MD5 2600fd99865def11adb9436841e38be4
SHA1 b5333808c352a4b0949c27fa7fb19abcf52851d0
SHA512 fe01180c92dc15febe3afd9d0f7f815b084cf06bd11e90cc24ea9404a7550fa97647a6d81819944bf7ebc306ee37f8b4129d3c1ceee393b5fdfae9b1ef3a52b5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fAiMDYh.exe

Path C:\Windows\System\fAiMDYh.exe
Size 3.1MB
SHA256 daf25ef868cf329c19e90c40468268021606fa20e89186f64f544eccca10d576
MD5 3f6faf0c1830d1fad4d943d18f44da4e
SHA1 47d464f62a23f369203ab1daae66438063e03e25
SHA512 c1133a506d423a7b8473fc701556bfd8fe27657fad4814935bd8ec939928f2c9250ec3931ab6dc594b4344f156fea0686c2c681c7147800745dd0c5c5578670b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWP:7bBeSFkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmhSjRG.exe

Path C:\Windows\System\jmhSjRG.exe
Size 3.1MB
SHA256 77247fd5199845bcdd8d542da5b093ce075dfb49c939243fd77bfcd22bce62a5
MD5 328586c09e0a3a31acec943fefc1b58b
SHA1 7b5c70cfba94577a636a5327002559c47e5aef86
SHA512 693464abe253e51cadbdb8bdcca81c96c33440df7e386a92a5cbb4c5ee7edfe80ec8530a2b09a146c7cf9f1922f6c0ef354f031a74f6b4af7b43ef420b16c7af
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:7bBeSFke
MD5 SHA1 SHA512 SSDEEP

Submit Download

kaTfDeD.exe

Path C:\Windows\System\kaTfDeD.exe
Size 3.1MB
SHA256 309737b13473c9bf296161da1e54eab069ae9f6307d6351866d494d4a549b383
MD5 39a005baf7bbea1a88118510331c19c7
SHA1 b1d2d32d9ae6ee12f2631f7b5433cc52cfe801a7
SHA512 28ca3aa4322ac9cb4761250b601db1bdc54ecfa22d26885f9dd2f65abe3ae50a2573784190966e3d909926eaff8aee197e900e9270859ed1ea26233b26247769
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkR
MD5 SHA1 SHA512 SSDEEP

Submit Download

lrXhZWh.exe

Path C:\Windows\System\lrXhZWh.exe
Size 3.1MB
SHA256 33d4c761f77d2149a0f445a9f453e13b023eabb8fdce91f01c3a237b9f5615cd
MD5 254115c92941a92efc7f045743756312
SHA1 03e004c8ae9da2759c997c1ecc0c33cbb4c59bb8
SHA512 8a48aa813caf847dcbd012b918d49ad76fceb56e9b4edc02dc0506919a8d1a63b145f7c57e93002a814ce858c0d15400590faf94a6eeb741b032255e240167e7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:7bBeSFkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYDcPDt.exe

Path C:\Windows\System\mYDcPDt.exe
Size 3.1MB
SHA256 e55383389820b1cfca72b1ac6aa5291347a8f9978d615995cd797947ec8597ec
MD5 ae4b6bd4c9543d8a74deba48f0d2c6ac
SHA1 15de333b3a66b2dea8d82f541151098e50a97a67
SHA512 01c088f4fe31f517d249c4d6ba5604db8c9075eda54b68b7ab55177c8be4f1fd66a437823c15a023ffc937615df5ccc6cbb6ef11ea047530abd3b555f38c999c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWd:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

oBggHPZ.exe

Path C:\Windows\System\oBggHPZ.exe
Size 3.1MB
SHA256 4d51ed57f37b0cb20c2a25d0a374c417bdf2e8945e258db91d05adcdb68c66b2
MD5 012c8415525560234bd4555b7794b4ed
SHA1 f5bec34ef69ca3015d6cca8134bc116116579924
SHA512 4328d9b7ca50e911b4f30b7f5c13b3123ee5f696021d1331088836b485990d44c4a7c0a071540ab3f1f07cba26ecf2636de89ae17186c48face14405033e8f2e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:7bBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

oOSnWrm.exe

Path C:\Windows\System\oOSnWrm.exe
Size 3.1MB
SHA256 9cbd52a1caae2a05c416bcd0c211a5a8137a4590d363d121da928b937b10556c
MD5 bc105ba1210c4979311f49d23add3bc0
SHA1 a96b7d08ccdb2743e3be178e3d2edd905af3a9bb
SHA512 1b6be2f85a4d78a5f80f4c5b0b9cf555a8ced8308f36d2cadb6b97bfce7b676a488cf45cd6c84846c05296e37e338b63779a6560455890040689500f157d4752
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgbZOVE.exe

Path C:\Windows\System\pgbZOVE.exe
Size 3.1MB
SHA256 5119a526e9a4540f1d72753847b38f03badad7e5787d01340ab2445d64852a4e
MD5 9ecc22d542a9a83700deb4fab86607dd
SHA1 8aac49a67429fa754c58d5827fe18d7b38f77b57
SHA512 61bda66b3aacf2df6bbd2808ed37d68bc99b9a79da2bd2de39123b1272bb433a156c509a56b6b7dcf8a2b319f6c2efd51403d91ec248d387f4155ed10dcddddd
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW5:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXGZRhb.exe

Path C:\Windows\System\sXGZRhb.exe
Size 3.1MB
SHA256 c27542b1ae3b3f34c8ee6aafe3f6d9d22f7aebcc4b07e2f15a28484bb9316953
MD5 01e1054cf0851d86f4c5e2e745759ada
SHA1 3cfb6754a4e79ab5d59a7865b9d74cb110328951
SHA512 bc10d77a4a3c01d7a5b4cef45e260787f21d97800162501b9af1dc26ae67db33e45e8fc24678138ef74dddb79b7857fc3c69648565a570d59f5d01b69be27e01
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttCegRX.exe

Path C:\Windows\System\ttCegRX.exe
Size 18B
SHA256 ebda111caaa22bc3cf246f369967cd1970b81931672957409e64bbf9553c625c
MD5 90cc8a9ba43b0445c09133a8ad5a4344
SHA1 8c9caa4b0361dee0057b8af76b4b40588f028105
SHA512 f29975fce97f9633e3946d599e2ec21ffeeef2b5b296303b55ec62d5cb1907c1b6188646121e8e7c7076ee7a20855b896498133380dafcd815f5c9819927466b
MD5 SHA1 SHA512

Submit Download

uWXYQxL.exe

Path C:\Windows\System\uWXYQxL.exe
Size 3.1MB
SHA256 c156ceb84d2c0ae0691b2cd277f689892c8c2b23365ee7e5bbc282bb34581a23
MD5 27e4d010882106430fd2b2c2f9c7dc13
SHA1 5ea96a2735e7aa9aa2c3e0f16976cf40a9b1abb1
SHA512 8bb91349c3335608053c32491cc6ca53defbf25c34dea85091a888ec4387ac7d50bcc0eb15ad2b622ac298db1245ea32e69700b1452fd421c6dcedf00bff9131
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

wOgvWCH.exe

Path C:\Windows\System\wOgvWCH.exe
Size 3.1MB
SHA256 53670c4e700b86b40722dc964add4db8b2a98b84d52bfa1a49c1b9c0ac2e46ab
MD5 aed617b6cb780590013aa3f26c3183f4
SHA1 174e2bd75d500d6aec0719d6e8f7d3bcfb93710f
SHA512 90e5d0f64474a62d8b97db140fcd746d59404b70b4c286fe12bf2329347ba6bd42a5a71a72890e72368c3e1a501113c9012d9deaab58c8504103e239ab13cd37
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWG:7bBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

yMoVNQY.exe

Path C:\Windows\System\yMoVNQY.exe
Size 3.1MB
SHA256 44e94ae4abb77aa8c3f4cd8cd867f2fdc2934388d805aa29f12d27e8bca429a1
MD5 318d62ec2c75f3dbfcdd26244603e664
SHA1 73c82e623b51fe372f8a8aa546adaa2f82d8d2b4
SHA512 259e37cbd7960e507f0747b05910122b63b70cb8a15529fa323ebc762cfe992bbbe72ec5370bfad0791d49e3217b4205bd2b636c8253381442849eaa7ce92a4e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

zRxCEhT.exe

Path C:\Windows\System\zRxCEhT.exe
Size 3.1MB
SHA256 3c86ff84e2b0766c5a1860893cd0dd7e6122ca6c664041fd1f71f9df4ed66a26
MD5 d0bbdffda763809bed50f6cddde0138d
SHA1 0c2120f1dce1adcbb3556b54ec1048ae77d77f97
SHA512 70a26e6937982b08902262a54efe0ab5cb2afb08326d11efc704e81df5b02c9f4d70518eb9b0c573669e523b7ca39a09bffb5653b3c58e8cd296130329b538b0
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-231-0x00007FF6EA860000-0x00007FF6EAC56000-memory.dmp

Download

memory/652-170-0x00007FF6A3E50000-0x00007FF6A4246000-memory.dmp

Download

memory/740-66-0x00007FF7040C0000-0x00007FF7044B6000-memory.dmp

Download

memory/1000-1-0x0000018D1BDE0000-0x0000018D1BDF0000-memory.dmp

Download

memory/1000-0-0x00007FF7ED4E0000-0x00007FF7ED8D6000-memory.dmp

Download

memory/1068-90-0x00007FF6AD530000-0x00007FF6AD926000-memory.dmp

Download

memory/1068-2500-0x00007FF6AD530000-0x00007FF6AD926000-memory.dmp

Download

memory/1604-20-0x00007FFE09DA0000-0x00007FFE0A861000-memory.dmp

Download

memory/1604-2496-0x00007FFE09DA3000-0x00007FFE09DA5000-memory.dmp

Download

memory/1604-46-0x0000015C87CB0000-0x0000015C87CD2000-memory.dmp

Download

memory/1604-5-0x00007FFE09DA3000-0x00007FFE09DA5000-memory.dmp

Download

memory/1604-99-0x0000015CA2CC0000-0x0000015CA3466000-memory.dmp

Download

memory/1664-194-0x00007FF6CAA80000-0x00007FF6CAE76000-memory.dmp

Download

memory/1756-92-0x00007FF7170A0000-0x00007FF717496000-memory.dmp

Download

memory/2040-223-0x00007FF7918C0000-0x00007FF791CB6000-memory.dmp

Download

memory/2148-96-0x00007FF6AB350000-0x00007FF6AB746000-memory.dmp

Download

memory/2148-4099-0x00007FF6AB350000-0x00007FF6AB746000-memory.dmp

Download

memory/2496-82-0x00007FF77DA40000-0x00007FF77DE36000-memory.dmp

Download

memory/2936-154-0x00007FF68CBF0000-0x00007FF68CFE6000-memory.dmp

Download

memory/3132-234-0x00007FF7A7AE0000-0x00007FF7A7ED6000-memory.dmp

Download

memory/3220-91-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp

Download

memory/3264-2814-0x00007FF6599C0000-0x00007FF659DB6000-memory.dmp

Download

memory/3264-151-0x00007FF6599C0000-0x00007FF659DB6000-memory.dmp

Download

memory/3600-212-0x00007FF6CEDC0000-0x00007FF6CF1B6000-memory.dmp

Download

memory/3624-4147-0x00007FF65A2E0000-0x00007FF65A6D6000-memory.dmp

Download

memory/3624-83-0x00007FF65A2E0000-0x00007FF65A6D6000-memory.dmp

Download

memory/3660-62-0x00007FF72CDF0000-0x00007FF72D1E6000-memory.dmp

Download

memory/3768-95-0x00007FF737A70000-0x00007FF737E66000-memory.dmp

Download

memory/3768-4108-0x00007FF737A70000-0x00007FF737E66000-memory.dmp

Download

memory/4024-29-0x00007FF742170000-0x00007FF742566000-memory.dmp

Download

memory/4440-3188-0x00007FF693860000-0x00007FF693C56000-memory.dmp

Download

memory/4440-199-0x00007FF693860000-0x00007FF693C56000-memory.dmp

Download

memory/4452-4085-0x00007FF760290000-0x00007FF760686000-memory.dmp

Download

memory/4452-94-0x00007FF760290000-0x00007FF760686000-memory.dmp

Download

memory/4728-98-0x00007FF6B78D0000-0x00007FF6B7CC6000-memory.dmp

Download

memory/4780-4093-0x00007FF74E590000-0x00007FF74E986000-memory.dmp

Download

memory/4780-74-0x00007FF74E590000-0x00007FF74E986000-memory.dmp

Download

memory/4924-97-0x00007FF6483B0000-0x00007FF6487A6000-memory.dmp

Download

memory/4960-182-0x00007FF726450000-0x00007FF726846000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads