xmrig | d142f345efc396483815ad812bd9b4128e015f5603ca98cd0b5a397842cd4eaf

Analysis

max time kernel
63s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
Size 3.0MB
Sample240613-mfes6svcld
SHA256 d142f345efc396483815ad812bd9b4128e015f5603ca98cd0b5a397842cd4eaf
MD5 7405d3795f9edbbe00b6e6c25509c270
SHA1 664e664e2b4e15e8b05acfe5ed5483fd6e5f8711
SHA512 09599a7a4733a3f152893f644d7ef198c732c84c98960f2eaf53e8f5037b891f91d26234cc7f43b08b01fbc1b3b6f3fc084539c1ca406f72456185874ade5a1b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFk/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2348-0-0x00007FF77E3F0000-0x00007FF77E7E6000-memory.dmp	xmrig
behavioral2/files/0x00090000000233f0-6.dat	xmrig
behavioral2/files/0x00080000000233f6-8.dat	xmrig
behavioral2/files/0x00080000000233f5-19.dat	xmrig
behavioral2/files/0x00070000000233f9-32.dat	xmrig
behavioral2/files/0x00070000000233fa-35.dat	xmrig
behavioral2/files/0x00080000000233fe-61.dat	xmrig
behavioral2/files/0x0007000000023404-96.dat	xmrig
behavioral2/files/0x0007000000023406-106.dat	xmrig
behavioral2/files/0x0007000000023408-116.dat	xmrig
behavioral2/files/0x000700000002340f-151.dat	xmrig
behavioral2/files/0x0007000000023410-164.dat	xmrig
behavioral2/files/0x0007000000023414-176.dat	xmrig
behavioral2/files/0x0007000000023412-174.dat	xmrig
behavioral2/files/0x0007000000023413-171.dat	xmrig
behavioral2/files/0x0007000000023411-169.dat	xmrig
behavioral2/files/0x000700000002340e-154.dat	xmrig
behavioral2/files/0x000700000002340d-149.dat	xmrig
behavioral2/files/0x000700000002340c-144.dat	xmrig
behavioral2/files/0x000700000002340b-139.dat	xmrig
behavioral2/files/0x000700000002340a-134.dat	xmrig
behavioral2/files/0x0007000000023409-129.dat	xmrig
behavioral2/files/0x0007000000023407-119.dat	xmrig
behavioral2/files/0x0007000000023405-109.dat	xmrig
behavioral2/files/0x0007000000023403-99.dat	xmrig
behavioral2/files/0x0007000000023402-94.dat	xmrig
behavioral2/files/0x0007000000023401-89.dat	xmrig
behavioral2/files/0x00080000000233fd-84.dat	xmrig
behavioral2/files/0x0007000000023400-79.dat	xmrig
behavioral2/files/0x00070000000233ff-74.dat	xmrig
behavioral2/files/0x00070000000233fc-64.dat	xmrig
behavioral2/files/0x00070000000233fb-53.dat	xmrig
behavioral2/files/0x00070000000233f8-25.dat	xmrig
behavioral2/files/0x00070000000233f7-23.dat	xmrig
behavioral2/memory/4004-13-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp	xmrig
behavioral2/memory/2424-791-0x00007FF75F300000-0x00007FF75F6F6000-memory.dmp	xmrig
behavioral2/memory/3416-792-0x00007FF715C50000-0x00007FF716046000-memory.dmp	xmrig
behavioral2/memory/3112-808-0x00007FF723850000-0x00007FF723C46000-memory.dmp	xmrig
behavioral2/memory/3748-816-0x00007FF6E6270000-0x00007FF6E6666000-memory.dmp	xmrig
behavioral2/memory/2208-826-0x00007FF736630000-0x00007FF736A26000-memory.dmp	xmrig
behavioral2/memory/1600-862-0x00007FF7B0A10000-0x00007FF7B0E06000-memory.dmp	xmrig
behavioral2/memory/3048-851-0x00007FF71B1E0000-0x00007FF71B5D6000-memory.dmp	xmrig
behavioral2/memory/964-843-0x00007FF7B4E20000-0x00007FF7B5216000-memory.dmp	xmrig
behavioral2/memory/3892-834-0x00007FF663A70000-0x00007FF663E66000-memory.dmp	xmrig
behavioral2/memory/884-872-0x00007FF7D3820000-0x00007FF7D3C16000-memory.dmp	xmrig
behavioral2/memory/2672-882-0x00007FF671640000-0x00007FF671A36000-memory.dmp	xmrig
behavioral2/memory/3364-901-0x00007FF6FA5E0000-0x00007FF6FA9D6000-memory.dmp	xmrig
behavioral2/memory/4452-931-0x00007FF725030000-0x00007FF725426000-memory.dmp	xmrig
behavioral2/memory/2960-962-0x00007FF65FB60000-0x00007FF65FF56000-memory.dmp	xmrig
behavioral2/memory/3928-975-0x00007FF7A06E0000-0x00007FF7A0AD6000-memory.dmp	xmrig
behavioral2/memory/2572-966-0x00007FF689A50000-0x00007FF689E46000-memory.dmp	xmrig
behavioral2/memory/3444-958-0x00007FF7F3A30000-0x00007FF7F3E26000-memory.dmp	xmrig
behavioral2/memory/2932-954-0x00007FF645D70000-0x00007FF646166000-memory.dmp	xmrig
behavioral2/memory/3260-950-0x00007FF63BB60000-0x00007FF63BF56000-memory.dmp	xmrig
behavioral2/memory/2380-944-0x00007FF7B0AC0000-0x00007FF7B0EB6000-memory.dmp	xmrig
behavioral2/memory/4560-941-0x00007FF659580000-0x00007FF659976000-memory.dmp	xmrig
behavioral2/memory/2908-940-0x00007FF7CBE80000-0x00007FF7CC276000-memory.dmp	xmrig
behavioral2/memory/4436-935-0x00007FF783BE0000-0x00007FF783FD6000-memory.dmp	xmrig
behavioral2/memory/4004-2035-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp	xmrig
behavioral2/memory/4004-2036-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp	xmrig
behavioral2/memory/2960-2037-0x00007FF65FB60000-0x00007FF65FF56000-memory.dmp	xmrig
behavioral2/memory/3416-2038-0x00007FF715C50000-0x00007FF716046000-memory.dmp	xmrig
behavioral2/memory/2572-2039-0x00007FF689A50000-0x00007FF689E46000-memory.dmp	xmrig
behavioral2/memory/2424-2040-0x00007FF75F300000-0x00007FF75F6F6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4004	SCfnerC.exe
2960	MXnIPKU.exe
2572	quRBuNf.exe
2424	NdFhpbb.exe
3416	OGrnlCN.exe
3112	IMLssLL.exe
3748	xBqBVUF.exe
2208	GjsKFET.exe
3928	Ofnldrp.exe
3892	qrfyByN.exe
964	wbLxCYL.exe
3048	Vrrrkbg.exe
1600	PGQqBSC.exe
884	bmtiohC.exe
2672	WrXSEJx.exe
3364	nBAaWXd.exe
4452	baoABpq.exe
4436	XNqFzHB.exe
2908	aLJeBWp.exe
4560	TIYktfP.exe
2380	nitGPif.exe
3260	NeMmndE.exe
2932	fwfFMLf.exe
3444	NaJonYA.exe
2400	ndrsgkj.exe
3280	lTQNZNh.exe
4312	IsvuHkr.exe
2284	mCUkQPn.exe
1528	TqTdkRh.exe
5024	dhFrjJq.exe
2692	mrSmNht.exe
1592	KbLTfDQ.exe
3104	HVhvlgX.exe
1108	XvidbEg.exe
4676	WVyOedQ.exe
1520	XqaFpzX.exe
3500	DWsizHy.exe
2916	JmyVpvg.exe
2108	FRnkYQZ.exe
2788	VLuUJyW.exe
1684	eQOpvMm.exe
4980	ACOHYZD.exe
4836	JFQcHDe.exe
1040	AIUNVzH.exe
3492	NYhhlpG.exe
868	ppxiioJ.exe
4332	DTOQwLb.exe
2948	PNHtcqT.exe
1924	SCIBxNn.exe
3584	aOyKtIn.exe
4108	ciRZJKw.exe
8	ImvqnLh.exe
1448	qIERVWg.exe
2540	opYQEYq.exe
2760	jygGFtG.exe
4024	hIIiSaB.exe
2764	CVvUjvh.exe
4656	kjIFAJC.exe
4072	eLSPMpQ.exe
1548	XiOVKws.exe
4628	JKlwrbq.exe
3248	jlRVsvt.exe
4168	aQulxWf.exe
544	BYxqelB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2348-0-0x00007FF77E3F0000-0x00007FF77E7E6000-memory.dmp	upx
behavioral2/files/0x00090000000233f0-6.dat	upx
behavioral2/files/0x00080000000233f6-8.dat	upx
behavioral2/files/0x00080000000233f5-19.dat	upx
behavioral2/files/0x00070000000233f9-32.dat	upx
behavioral2/files/0x00070000000233fa-35.dat	upx
behavioral2/files/0x00080000000233fe-61.dat	upx
behavioral2/files/0x0007000000023404-96.dat	upx
behavioral2/files/0x0007000000023406-106.dat	upx
behavioral2/files/0x0007000000023408-116.dat	upx
behavioral2/files/0x000700000002340f-151.dat	upx
behavioral2/files/0x0007000000023410-164.dat	upx
behavioral2/files/0x0007000000023414-176.dat	upx
behavioral2/files/0x0007000000023412-174.dat	upx
behavioral2/files/0x0007000000023413-171.dat	upx
behavioral2/files/0x0007000000023411-169.dat	upx
behavioral2/files/0x000700000002340e-154.dat	upx
behavioral2/files/0x000700000002340d-149.dat	upx
behavioral2/files/0x000700000002340c-144.dat	upx
behavioral2/files/0x000700000002340b-139.dat	upx
behavioral2/files/0x000700000002340a-134.dat	upx
behavioral2/files/0x0007000000023409-129.dat	upx
behavioral2/files/0x0007000000023407-119.dat	upx
behavioral2/files/0x0007000000023405-109.dat	upx
behavioral2/files/0x0007000000023403-99.dat	upx
behavioral2/files/0x0007000000023402-94.dat	upx
behavioral2/files/0x0007000000023401-89.dat	upx
behavioral2/files/0x00080000000233fd-84.dat	upx
behavioral2/files/0x0007000000023400-79.dat	upx
behavioral2/files/0x00070000000233ff-74.dat	upx
behavioral2/files/0x00070000000233fc-64.dat	upx
behavioral2/files/0x00070000000233fb-53.dat	upx
behavioral2/files/0x00070000000233f8-25.dat	upx
behavioral2/files/0x00070000000233f7-23.dat	upx
behavioral2/memory/4004-13-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp	upx
behavioral2/memory/2424-791-0x00007FF75F300000-0x00007FF75F6F6000-memory.dmp	upx
behavioral2/memory/3416-792-0x00007FF715C50000-0x00007FF716046000-memory.dmp	upx
behavioral2/memory/3112-808-0x00007FF723850000-0x00007FF723C46000-memory.dmp	upx
behavioral2/memory/3748-816-0x00007FF6E6270000-0x00007FF6E6666000-memory.dmp	upx
behavioral2/memory/2208-826-0x00007FF736630000-0x00007FF736A26000-memory.dmp	upx
behavioral2/memory/1600-862-0x00007FF7B0A10000-0x00007FF7B0E06000-memory.dmp	upx
behavioral2/memory/3048-851-0x00007FF71B1E0000-0x00007FF71B5D6000-memory.dmp	upx
behavioral2/memory/964-843-0x00007FF7B4E20000-0x00007FF7B5216000-memory.dmp	upx
behavioral2/memory/3892-834-0x00007FF663A70000-0x00007FF663E66000-memory.dmp	upx
behavioral2/memory/884-872-0x00007FF7D3820000-0x00007FF7D3C16000-memory.dmp	upx
behavioral2/memory/2672-882-0x00007FF671640000-0x00007FF671A36000-memory.dmp	upx
behavioral2/memory/3364-901-0x00007FF6FA5E0000-0x00007FF6FA9D6000-memory.dmp	upx
behavioral2/memory/4452-931-0x00007FF725030000-0x00007FF725426000-memory.dmp	upx
behavioral2/memory/2960-962-0x00007FF65FB60000-0x00007FF65FF56000-memory.dmp	upx
behavioral2/memory/3928-975-0x00007FF7A06E0000-0x00007FF7A0AD6000-memory.dmp	upx
behavioral2/memory/2572-966-0x00007FF689A50000-0x00007FF689E46000-memory.dmp	upx
behavioral2/memory/3444-958-0x00007FF7F3A30000-0x00007FF7F3E26000-memory.dmp	upx
behavioral2/memory/2932-954-0x00007FF645D70000-0x00007FF646166000-memory.dmp	upx
behavioral2/memory/3260-950-0x00007FF63BB60000-0x00007FF63BF56000-memory.dmp	upx
behavioral2/memory/2380-944-0x00007FF7B0AC0000-0x00007FF7B0EB6000-memory.dmp	upx
behavioral2/memory/4560-941-0x00007FF659580000-0x00007FF659976000-memory.dmp	upx
behavioral2/memory/2908-940-0x00007FF7CBE80000-0x00007FF7CC276000-memory.dmp	upx
behavioral2/memory/4436-935-0x00007FF783BE0000-0x00007FF783FD6000-memory.dmp	upx
behavioral2/memory/4004-2035-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp	upx
behavioral2/memory/4004-2036-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp	upx
behavioral2/memory/2960-2037-0x00007FF65FB60000-0x00007FF65FF56000-memory.dmp	upx
behavioral2/memory/3416-2038-0x00007FF715C50000-0x00007FF716046000-memory.dmp	upx
behavioral2/memory/2572-2039-0x00007FF689A50000-0x00007FF689E46000-memory.dmp	upx
behavioral2/memory/2424-2040-0x00007FF75F300000-0x00007FF75F6F6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sMXrOdP.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\mqWfCIZ.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\SvaRcbA.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\RnyucUr.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\ezUeLqO.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\UTdjIOl.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\jzdmSbR.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\QepWpzh.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\ljWsaZy.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\BAKbXvU.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\LdnTOQr.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\FAALgEO.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\tvfJnKK.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\jJdmmqI.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\EHvdbwt.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\WenaGGD.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\YjqEqWG.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\CfdWOuG.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\fintkzR.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\CUqwbie.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\tiqHxqr.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\tYPcwON.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\lxwdsrw.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\uyPGAPu.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\csfbPVw.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\JqEFmNi.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\Fhuwobx.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\GYIOLVQ.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\PbrDjeW.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\NaiAMoh.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\xTLRSOw.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\jVjXAET.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\pzYnjul.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\YaiWYgw.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\CLVoWRI.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\jVaxNfH.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\veAmoSw.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\lQxbaLB.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\AlmUIRp.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\wWbBaKT.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\KJvHvvW.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\PItLoLc.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\OXjkJIC.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\dulolpI.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\OhKRumx.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\lRuOmIa.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\UgDXtzr.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\SpWnxvW.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\nTgLRAT.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\LezKQrM.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\VlWgoNZ.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\RNcQneo.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\dqNnSyZ.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\LRLhTlZ.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\SCtsUXW.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\wErgqrP.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\BehkMbd.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\EkfgkcS.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\QJcykOs.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\znLgdCR.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\JzRpxSW.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\cfGqfuX.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\jIpkEMi.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
File created	C:\Windows\System\rvgJqCT.exe	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
Token: SeDebugPrivilege	4996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4996	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	82
PID 2348 wrote to memory of 4996	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	82
PID 2348 wrote to memory of 4004	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	83
PID 2348 wrote to memory of 4004	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	83
PID 2348 wrote to memory of 2960	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	84
PID 2348 wrote to memory of 2960	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	84
PID 2348 wrote to memory of 2572	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	85
PID 2348 wrote to memory of 2572	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	85
PID 2348 wrote to memory of 2424	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	86
PID 2348 wrote to memory of 2424	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	86
PID 2348 wrote to memory of 3416	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	87
PID 2348 wrote to memory of 3416	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	87
PID 2348 wrote to memory of 3112	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	88
PID 2348 wrote to memory of 3112	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	88
PID 2348 wrote to memory of 3748	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	89
PID 2348 wrote to memory of 3748	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	89
PID 2348 wrote to memory of 2208	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	90
PID 2348 wrote to memory of 2208	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	90
PID 2348 wrote to memory of 3928	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	91
PID 2348 wrote to memory of 3928	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	91
PID 2348 wrote to memory of 3892	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	92
PID 2348 wrote to memory of 3892	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	92
PID 2348 wrote to memory of 964	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	93
PID 2348 wrote to memory of 964	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	93
PID 2348 wrote to memory of 3048	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	94
PID 2348 wrote to memory of 3048	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	94
PID 2348 wrote to memory of 1600	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	95
PID 2348 wrote to memory of 1600	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	95
PID 2348 wrote to memory of 884	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	96
PID 2348 wrote to memory of 884	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	96
PID 2348 wrote to memory of 2672	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	97
PID 2348 wrote to memory of 2672	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	97
PID 2348 wrote to memory of 3364	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	98
PID 2348 wrote to memory of 3364	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	98
PID 2348 wrote to memory of 4452	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	99
PID 2348 wrote to memory of 4452	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	99
PID 2348 wrote to memory of 4436	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	100
PID 2348 wrote to memory of 4436	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	100
PID 2348 wrote to memory of 2908	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	101
PID 2348 wrote to memory of 2908	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	101
PID 2348 wrote to memory of 4560	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	102
PID 2348 wrote to memory of 4560	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	102
PID 2348 wrote to memory of 2380	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	103
PID 2348 wrote to memory of 2380	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	103
PID 2348 wrote to memory of 3260	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	104
PID 2348 wrote to memory of 3260	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	104
PID 2348 wrote to memory of 2932	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	105
PID 2348 wrote to memory of 2932	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	105
PID 2348 wrote to memory of 3444	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	106
PID 2348 wrote to memory of 3444	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	106
PID 2348 wrote to memory of 2400	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	107
PID 2348 wrote to memory of 2400	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	107
PID 2348 wrote to memory of 3280	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	108
PID 2348 wrote to memory of 3280	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	108
PID 2348 wrote to memory of 4312	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	109
PID 2348 wrote to memory of 4312	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	109
PID 2348 wrote to memory of 2284	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	110
PID 2348 wrote to memory of 2284	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	110
PID 2348 wrote to memory of 1528	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	111
PID 2348 wrote to memory of 1528	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	111
PID 2348 wrote to memory of 5024	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	112
PID 2348 wrote to memory of 5024	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	112
PID 2348 wrote to memory of 2692	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	113
PID 2348 wrote to memory of 2692	2348	7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7405d3795f9edbbe00b6e6c25509c270_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\System\SCfnerC.exe
  C:\Windows\System\SCfnerC.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\MXnIPKU.exe
  C:\Windows\System\MXnIPKU.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\quRBuNf.exe
  C:\Windows\System\quRBuNf.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\NdFhpbb.exe
  C:\Windows\System\NdFhpbb.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OGrnlCN.exe
  C:\Windows\System\OGrnlCN.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\IMLssLL.exe
  C:\Windows\System\IMLssLL.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\xBqBVUF.exe
  C:\Windows\System\xBqBVUF.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\GjsKFET.exe
  C:\Windows\System\GjsKFET.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\Ofnldrp.exe
  C:\Windows\System\Ofnldrp.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\qrfyByN.exe
  C:\Windows\System\qrfyByN.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\wbLxCYL.exe
  C:\Windows\System\wbLxCYL.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\Vrrrkbg.exe
  C:\Windows\System\Vrrrkbg.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\PGQqBSC.exe
  C:\Windows\System\PGQqBSC.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\bmtiohC.exe
  C:\Windows\System\bmtiohC.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\WrXSEJx.exe
  C:\Windows\System\WrXSEJx.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\nBAaWXd.exe
  C:\Windows\System\nBAaWXd.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\baoABpq.exe
  C:\Windows\System\baoABpq.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\XNqFzHB.exe
  C:\Windows\System\XNqFzHB.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\aLJeBWp.exe
  C:\Windows\System\aLJeBWp.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\TIYktfP.exe
  C:\Windows\System\TIYktfP.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\nitGPif.exe
  C:\Windows\System\nitGPif.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\NeMmndE.exe
  C:\Windows\System\NeMmndE.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\fwfFMLf.exe
  C:\Windows\System\fwfFMLf.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\NaJonYA.exe
  C:\Windows\System\NaJonYA.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ndrsgkj.exe
  C:\Windows\System\ndrsgkj.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\lTQNZNh.exe
  C:\Windows\System\lTQNZNh.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\IsvuHkr.exe
  C:\Windows\System\IsvuHkr.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\mCUkQPn.exe
  C:\Windows\System\mCUkQPn.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\TqTdkRh.exe
  C:\Windows\System\TqTdkRh.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\dhFrjJq.exe
  C:\Windows\System\dhFrjJq.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\mrSmNht.exe
  C:\Windows\System\mrSmNht.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\KbLTfDQ.exe
  C:\Windows\System\KbLTfDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\HVhvlgX.exe
  C:\Windows\System\HVhvlgX.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\XvidbEg.exe
  C:\Windows\System\XvidbEg.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\WVyOedQ.exe
  C:\Windows\System\WVyOedQ.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\XqaFpzX.exe
  C:\Windows\System\XqaFpzX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\DWsizHy.exe
  C:\Windows\System\DWsizHy.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\JmyVpvg.exe
  C:\Windows\System\JmyVpvg.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\FRnkYQZ.exe
  C:\Windows\System\FRnkYQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\VLuUJyW.exe
  C:\Windows\System\VLuUJyW.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\eQOpvMm.exe
  C:\Windows\System\eQOpvMm.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\ACOHYZD.exe
  C:\Windows\System\ACOHYZD.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\JFQcHDe.exe
  C:\Windows\System\JFQcHDe.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\AIUNVzH.exe
  C:\Windows\System\AIUNVzH.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\NYhhlpG.exe
  C:\Windows\System\NYhhlpG.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\ppxiioJ.exe
  C:\Windows\System\ppxiioJ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\DTOQwLb.exe
  C:\Windows\System\DTOQwLb.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\PNHtcqT.exe
  C:\Windows\System\PNHtcqT.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\SCIBxNn.exe
  C:\Windows\System\SCIBxNn.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\aOyKtIn.exe
  C:\Windows\System\aOyKtIn.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\ciRZJKw.exe
  C:\Windows\System\ciRZJKw.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ImvqnLh.exe
  C:\Windows\System\ImvqnLh.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\qIERVWg.exe
  C:\Windows\System\qIERVWg.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\opYQEYq.exe
  C:\Windows\System\opYQEYq.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\jygGFtG.exe
  C:\Windows\System\jygGFtG.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\hIIiSaB.exe
  C:\Windows\System\hIIiSaB.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\CVvUjvh.exe
  C:\Windows\System\CVvUjvh.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\kjIFAJC.exe
  C:\Windows\System\kjIFAJC.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\eLSPMpQ.exe
  C:\Windows\System\eLSPMpQ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\XiOVKws.exe
  C:\Windows\System\XiOVKws.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\JKlwrbq.exe
  C:\Windows\System\JKlwrbq.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\jlRVsvt.exe
  C:\Windows\System\jlRVsvt.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\aQulxWf.exe
  C:\Windows\System\aQulxWf.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\BYxqelB.exe
  C:\Windows\System\BYxqelB.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\ywrzGDv.exe
  C:\Windows\System\ywrzGDv.exe
  2⤵
  PID:3708
- C:\Windows\System\wjlQFBA.exe
  C:\Windows\System\wjlQFBA.exe
  2⤵
  PID:1852
- C:\Windows\System\pKzKVgk.exe
  C:\Windows\System\pKzKVgk.exe
  2⤵
  PID:4140
- C:\Windows\System\mJqYMuC.exe
  C:\Windows\System\mJqYMuC.exe
  2⤵
  PID:2612
- C:\Windows\System\ELfabwr.exe
  C:\Windows\System\ELfabwr.exe
  2⤵
  PID:4364
- C:\Windows\System\HfoxdxV.exe
  C:\Windows\System\HfoxdxV.exe
  2⤵
  PID:1428
- C:\Windows\System\hIRyYkr.exe
  C:\Windows\System\hIRyYkr.exe
  2⤵
  PID:4444
- C:\Windows\System\RnhBNnw.exe
  C:\Windows\System\RnhBNnw.exe
  2⤵
  PID:3808
- C:\Windows\System\pNsyDIL.exe
  C:\Windows\System\pNsyDIL.exe
  2⤵
  PID:372
- C:\Windows\System\oYdPbEP.exe
  C:\Windows\System\oYdPbEP.exe
  2⤵
  PID:3628
- C:\Windows\System\LYMPnNn.exe
  C:\Windows\System\LYMPnNn.exe
  2⤵
  PID:2668
- C:\Windows\System\IvbkqXx.exe
  C:\Windows\System\IvbkqXx.exe
  2⤵
  PID:2780
- C:\Windows\System\pvxJXQi.exe
  C:\Windows\System\pvxJXQi.exe
  2⤵
  PID:3412
- C:\Windows\System\tEGnWyg.exe
  C:\Windows\System\tEGnWyg.exe
  2⤵
  PID:5144
- C:\Windows\System\UsSzbYe.exe
  C:\Windows\System\UsSzbYe.exe
  2⤵
  PID:5172
- C:\Windows\System\TryXOWS.exe
  C:\Windows\System\TryXOWS.exe
  2⤵
  PID:5200
- C:\Windows\System\FIVUckX.exe
  C:\Windows\System\FIVUckX.exe
  2⤵
  PID:5228
- C:\Windows\System\ifEkYnz.exe
  C:\Windows\System\ifEkYnz.exe
  2⤵
  PID:5256
- C:\Windows\System\KAmwCAl.exe
  C:\Windows\System\KAmwCAl.exe
  2⤵
  PID:5284
- C:\Windows\System\oKHepTY.exe
  C:\Windows\System\oKHepTY.exe
  2⤵
  PID:5312
- C:\Windows\System\jpoHXTF.exe
  C:\Windows\System\jpoHXTF.exe
  2⤵
  PID:5340
- C:\Windows\System\XldbStS.exe
  C:\Windows\System\XldbStS.exe
  2⤵
  PID:5368
- C:\Windows\System\DlswWrm.exe
  C:\Windows\System\DlswWrm.exe
  2⤵
  PID:5396
- C:\Windows\System\fYOyzQK.exe
  C:\Windows\System\fYOyzQK.exe
  2⤵
  PID:5424
- C:\Windows\System\aoRvbhd.exe
  C:\Windows\System\aoRvbhd.exe
  2⤵
  PID:5452
- C:\Windows\System\zQriMIl.exe
  C:\Windows\System\zQriMIl.exe
  2⤵
  PID:5484
- C:\Windows\System\XYBfJTd.exe
  C:\Windows\System\XYBfJTd.exe
  2⤵
  PID:5508
- C:\Windows\System\UiIKPbh.exe
  C:\Windows\System\UiIKPbh.exe
  2⤵
  PID:5536
- C:\Windows\System\Llcvusy.exe
  C:\Windows\System\Llcvusy.exe
  2⤵
  PID:5564
- C:\Windows\System\DvTuqqR.exe
  C:\Windows\System\DvTuqqR.exe
  2⤵
  PID:5592
- C:\Windows\System\nJYTPrl.exe
  C:\Windows\System\nJYTPrl.exe
  2⤵
  PID:5620
- C:\Windows\System\xvhqCmF.exe
  C:\Windows\System\xvhqCmF.exe
  2⤵
  PID:5648
- C:\Windows\System\GajZdou.exe
  C:\Windows\System\GajZdou.exe
  2⤵
  PID:5676
- C:\Windows\System\byCJdbY.exe
  C:\Windows\System\byCJdbY.exe
  2⤵
  PID:5704
- C:\Windows\System\NcHnDkl.exe
  C:\Windows\System\NcHnDkl.exe
  2⤵
  PID:5732
- C:\Windows\System\LEtzkSB.exe
  C:\Windows\System\LEtzkSB.exe
  2⤵
  PID:5760
- C:\Windows\System\zUsfArr.exe
  C:\Windows\System\zUsfArr.exe
  2⤵
  PID:5788
- C:\Windows\System\LTNsGMp.exe
  C:\Windows\System\LTNsGMp.exe
  2⤵
  PID:5816
- C:\Windows\System\jZaCFRP.exe
  C:\Windows\System\jZaCFRP.exe
  2⤵
  PID:5844
- C:\Windows\System\gOmbitX.exe
  C:\Windows\System\gOmbitX.exe
  2⤵
  PID:5872
- C:\Windows\System\bWrjnjU.exe
  C:\Windows\System\bWrjnjU.exe
  2⤵
  PID:5900
- C:\Windows\System\ocJyhUz.exe
  C:\Windows\System\ocJyhUz.exe
  2⤵
  PID:5928
- C:\Windows\System\OPOfwSb.exe
  C:\Windows\System\OPOfwSb.exe
  2⤵
  PID:5956
- C:\Windows\System\MnLypMa.exe
  C:\Windows\System\MnLypMa.exe
  2⤵
  PID:5984
- C:\Windows\System\OAkbkjm.exe
  C:\Windows\System\OAkbkjm.exe
  2⤵
  PID:6012
- C:\Windows\System\YzSQCSj.exe
  C:\Windows\System\YzSQCSj.exe
  2⤵
  PID:6040
- C:\Windows\System\dniQzlW.exe
  C:\Windows\System\dniQzlW.exe
  2⤵
  PID:6068
- C:\Windows\System\qURVQXC.exe
  C:\Windows\System\qURVQXC.exe
  2⤵
  PID:6104
- C:\Windows\System\omqEgDn.exe
  C:\Windows\System\omqEgDn.exe
  2⤵
  PID:6124
- C:\Windows\System\CEzlMxw.exe
  C:\Windows\System\CEzlMxw.exe
  2⤵
  PID:4536
- C:\Windows\System\MdtKHcM.exe
  C:\Windows\System\MdtKHcM.exe
  2⤵
  PID:1996
- C:\Windows\System\BTMDvOR.exe
  C:\Windows\System\BTMDvOR.exe
  2⤵
  PID:1256
- C:\Windows\System\VQXMcdU.exe
  C:\Windows\System\VQXMcdU.exe
  2⤵
  PID:1808
- C:\Windows\System\tiqHxqr.exe
  C:\Windows\System\tiqHxqr.exe
  2⤵
  PID:4632
- C:\Windows\System\ZDwBXeq.exe
  C:\Windows\System\ZDwBXeq.exe
  2⤵
  PID:5136
- C:\Windows\System\vuJQDbC.exe
  C:\Windows\System\vuJQDbC.exe
  2⤵
  PID:5212
- C:\Windows\System\XMtYkhZ.exe
  C:\Windows\System\XMtYkhZ.exe
  2⤵
  PID:5272
- C:\Windows\System\oBpoeDL.exe
  C:\Windows\System\oBpoeDL.exe
  2⤵
  PID:5332
- C:\Windows\System\XcVeBmv.exe
  C:\Windows\System\XcVeBmv.exe
  2⤵
  PID:5408
- C:\Windows\System\jeyIbMb.exe
  C:\Windows\System\jeyIbMb.exe
  2⤵
  PID:5468
- C:\Windows\System\qodJyPn.exe
  C:\Windows\System\qodJyPn.exe
  2⤵
  PID:5528
- C:\Windows\System\ywbIotJ.exe
  C:\Windows\System\ywbIotJ.exe
  2⤵
  PID:5604
- C:\Windows\System\aASNrab.exe
  C:\Windows\System\aASNrab.exe
  2⤵
  PID:5664
- C:\Windows\System\mSvzYGo.exe
  C:\Windows\System\mSvzYGo.exe
  2⤵
  PID:5724
- C:\Windows\System\IObLvGV.exe
  C:\Windows\System\IObLvGV.exe
  2⤵
  PID:5800
- C:\Windows\System\cKXrZZZ.exe
  C:\Windows\System\cKXrZZZ.exe
  2⤵
  PID:5860
- C:\Windows\System\kwjWvgB.exe
  C:\Windows\System\kwjWvgB.exe
  2⤵
  PID:5920
- C:\Windows\System\GlPpjYX.exe
  C:\Windows\System\GlPpjYX.exe
  2⤵
  PID:5996
- C:\Windows\System\vyHdSFt.exe
  C:\Windows\System\vyHdSFt.exe
  2⤵
  PID:6056
- C:\Windows\System\pqFumcY.exe
  C:\Windows\System\pqFumcY.exe
  2⤵
  PID:6120
- C:\Windows\System\QURYPzW.exe
  C:\Windows\System\QURYPzW.exe
  2⤵
  PID:3664
- C:\Windows\System\YRNAMKf.exe
  C:\Windows\System\YRNAMKf.exe
  2⤵
  PID:4208
- C:\Windows\System\rXdFyYS.exe
  C:\Windows\System\rXdFyYS.exe
  2⤵
  PID:5188
- C:\Windows\System\vvloIdc.exe
  C:\Windows\System\vvloIdc.exe
  2⤵
  PID:5360
- C:\Windows\System\aLPsnGK.exe
  C:\Windows\System\aLPsnGK.exe
  2⤵
  PID:5504
- C:\Windows\System\dWqixqo.exe
  C:\Windows\System\dWqixqo.exe
  2⤵
  PID:5692
- C:\Windows\System\CSrzYie.exe
  C:\Windows\System\CSrzYie.exe
  2⤵
  PID:5828
- C:\Windows\System\iSqRhpj.exe
  C:\Windows\System\iSqRhpj.exe
  2⤵
  PID:5968
- C:\Windows\System\ZSghHBA.exe
  C:\Windows\System\ZSghHBA.exe
  2⤵
  PID:6164
- C:\Windows\System\ogNIFtv.exe
  C:\Windows\System\ogNIFtv.exe
  2⤵
  PID:6192
- C:\Windows\System\yWcNYuh.exe
  C:\Windows\System\yWcNYuh.exe
  2⤵
  PID:6220
- C:\Windows\System\VwPVEEg.exe
  C:\Windows\System\VwPVEEg.exe
  2⤵
  PID:6248
- C:\Windows\System\PvZZlOl.exe
  C:\Windows\System\PvZZlOl.exe
  2⤵
  PID:6276
- C:\Windows\System\hsiZlpP.exe
  C:\Windows\System\hsiZlpP.exe
  2⤵
  PID:6304
- C:\Windows\System\JhwTdhv.exe
  C:\Windows\System\JhwTdhv.exe
  2⤵
  PID:6332
- C:\Windows\System\TMtcbDJ.exe
  C:\Windows\System\TMtcbDJ.exe
  2⤵
  PID:6360
- C:\Windows\System\BVQrOhy.exe
  C:\Windows\System\BVQrOhy.exe
  2⤵
  PID:6388
- C:\Windows\System\dxSvxhu.exe
  C:\Windows\System\dxSvxhu.exe
  2⤵
  PID:6416
- C:\Windows\System\YjKvWFG.exe
  C:\Windows\System\YjKvWFG.exe
  2⤵
  PID:6452
- C:\Windows\System\Srhmlwc.exe
  C:\Windows\System\Srhmlwc.exe
  2⤵
  PID:6480
- C:\Windows\System\PCRYlmC.exe
  C:\Windows\System\PCRYlmC.exe
  2⤵
  PID:6508
- C:\Windows\System\leQSWQu.exe
  C:\Windows\System\leQSWQu.exe
  2⤵
  PID:6536
- C:\Windows\System\lzPXunH.exe
  C:\Windows\System\lzPXunH.exe
  2⤵
  PID:6568
- C:\Windows\System\XOYZQZO.exe
  C:\Windows\System\XOYZQZO.exe
  2⤵
  PID:6596
- C:\Windows\System\fOqGCfg.exe
  C:\Windows\System\fOqGCfg.exe
  2⤵
  PID:6624
- C:\Windows\System\sRgZDhO.exe
  C:\Windows\System\sRgZDhO.exe
  2⤵
  PID:6640
- C:\Windows\System\YupISWj.exe
  C:\Windows\System\YupISWj.exe
  2⤵
  PID:6668
- C:\Windows\System\cTQcHew.exe
  C:\Windows\System\cTQcHew.exe
  2⤵
  PID:6696
- C:\Windows\System\xNqzmLh.exe
  C:\Windows\System\xNqzmLh.exe
  2⤵
  PID:6724
- C:\Windows\System\rGMKQns.exe
  C:\Windows\System\rGMKQns.exe
  2⤵
  PID:6752
- C:\Windows\System\VBNLviz.exe
  C:\Windows\System\VBNLviz.exe
  2⤵
  PID:6780
- C:\Windows\System\wogswaz.exe
  C:\Windows\System\wogswaz.exe
  2⤵
  PID:6808
- C:\Windows\System\DdllXNH.exe
  C:\Windows\System\DdllXNH.exe
  2⤵
  PID:6836
- C:\Windows\System\nDIAqVO.exe
  C:\Windows\System\nDIAqVO.exe
  2⤵
  PID:6860
- C:\Windows\System\zoPuVcA.exe
  C:\Windows\System\zoPuVcA.exe
  2⤵
  PID:6892
- C:\Windows\System\RhWgxza.exe
  C:\Windows\System\RhWgxza.exe
  2⤵
  PID:6920
- C:\Windows\System\fHOqrpZ.exe
  C:\Windows\System\fHOqrpZ.exe
  2⤵
  PID:6948
- C:\Windows\System\bXeRHvm.exe
  C:\Windows\System\bXeRHvm.exe
  2⤵
  PID:6976
- C:\Windows\System\NFZdqdG.exe
  C:\Windows\System\NFZdqdG.exe
  2⤵
  PID:7004
- C:\Windows\System\CwCHjzb.exe
  C:\Windows\System\CwCHjzb.exe
  2⤵
  PID:7032
- C:\Windows\System\lSKUvRL.exe
  C:\Windows\System\lSKUvRL.exe
  2⤵
  PID:7060
- C:\Windows\System\daOXKAB.exe
  C:\Windows\System\daOXKAB.exe
  2⤵
  PID:7088
- C:\Windows\System\sSUvsMx.exe
  C:\Windows\System\sSUvsMx.exe
  2⤵
  PID:7116
- C:\Windows\System\pAtGNJl.exe
  C:\Windows\System\pAtGNJl.exe
  2⤵
  PID:7144
- C:\Windows\System\NzCjMXr.exe
  C:\Windows\System\NzCjMXr.exe
  2⤵
  PID:6032
- C:\Windows\System\dfFgYYD.exe
  C:\Windows\System\dfFgYYD.exe
  2⤵
  PID:4896
- C:\Windows\System\QGESahs.exe
  C:\Windows\System\QGESahs.exe
  2⤵
  PID:5304
- C:\Windows\System\wLZrJEB.exe
  C:\Windows\System\wLZrJEB.exe
  2⤵
  PID:5716
- C:\Windows\System\dUYqslT.exe
  C:\Windows\System\dUYqslT.exe
  2⤵
  PID:6148
- C:\Windows\System\qCXJLHj.exe
  C:\Windows\System\qCXJLHj.exe
  2⤵
  PID:6208
- C:\Windows\System\KbWwNJa.exe
  C:\Windows\System\KbWwNJa.exe
  2⤵
  PID:6268
- C:\Windows\System\mlHNHMI.exe
  C:\Windows\System\mlHNHMI.exe
  2⤵
  PID:6344
- C:\Windows\System\pbyNxPW.exe
  C:\Windows\System\pbyNxPW.exe
  2⤵
  PID:6404
- C:\Windows\System\VbCoFzd.exe
  C:\Windows\System\VbCoFzd.exe
  2⤵
  PID:6472
- C:\Windows\System\TJqlQSU.exe
  C:\Windows\System\TJqlQSU.exe
  2⤵
  PID:6528
- C:\Windows\System\sbcZqJi.exe
  C:\Windows\System\sbcZqJi.exe
  2⤵
  PID:6588
- C:\Windows\System\RfiCaWI.exe
  C:\Windows\System\RfiCaWI.exe
  2⤵
  PID:6652
- C:\Windows\System\bljwFnb.exe
  C:\Windows\System\bljwFnb.exe
  2⤵
  PID:6712
- C:\Windows\System\VUGhYnt.exe
  C:\Windows\System\VUGhYnt.exe
  2⤵
  PID:6772
- C:\Windows\System\FeAeAEE.exe
  C:\Windows\System\FeAeAEE.exe
  2⤵
  PID:6848
- C:\Windows\System\McJJTnV.exe
  C:\Windows\System\McJJTnV.exe
  2⤵
  PID:436
- C:\Windows\System\JKTzbfV.exe
  C:\Windows\System\JKTzbfV.exe
  2⤵
  PID:6964
- C:\Windows\System\Hfimofb.exe
  C:\Windows\System\Hfimofb.exe
  2⤵
  PID:7020
- C:\Windows\System\VxFNMid.exe
  C:\Windows\System\VxFNMid.exe
  2⤵
  PID:7080
- C:\Windows\System\KsIobjG.exe
  C:\Windows\System\KsIobjG.exe
  2⤵
  PID:7136
- C:\Windows\System\PdlplRv.exe
  C:\Windows\System\PdlplRv.exe
  2⤵
  PID:3828
- C:\Windows\System\UFNkemH.exe
  C:\Windows\System\UFNkemH.exe
  2⤵
  PID:5580
- C:\Windows\System\CRyHDjZ.exe
  C:\Windows\System\CRyHDjZ.exe
  2⤵
  PID:6236
- C:\Windows\System\irPoxPq.exe
  C:\Windows\System\irPoxPq.exe
  2⤵
  PID:6376
- C:\Windows\System\ZWlytWd.exe
  C:\Windows\System\ZWlytWd.exe
  2⤵
  PID:6504
- C:\Windows\System\FnTUboK.exe
  C:\Windows\System\FnTUboK.exe
  2⤵
  PID:2616
- C:\Windows\System\dvyVEvM.exe
  C:\Windows\System\dvyVEvM.exe
  2⤵
  PID:6740
- C:\Windows\System\BXltDNj.exe
  C:\Windows\System\BXltDNj.exe
  2⤵
  PID:6876
- C:\Windows\System\NDiAzMj.exe
  C:\Windows\System\NDiAzMj.exe
  2⤵
  PID:6992
- C:\Windows\System\lYgHAFa.exe
  C:\Windows\System\lYgHAFa.exe
  2⤵
  PID:7112
- C:\Windows\System\CfwKKME.exe
  C:\Windows\System\CfwKKME.exe
  2⤵
  PID:5128
- C:\Windows\System\sfNRXdk.exe
  C:\Windows\System\sfNRXdk.exe
  2⤵
  PID:6316
- C:\Windows\System\oCdFqmc.exe
  C:\Windows\System\oCdFqmc.exe
  2⤵
  PID:7188
- C:\Windows\System\PEizOOZ.exe
  C:\Windows\System\PEizOOZ.exe
  2⤵
  PID:7216
- C:\Windows\System\WvtHMzW.exe
  C:\Windows\System\WvtHMzW.exe
  2⤵
  PID:7244
- C:\Windows\System\HigIGZI.exe
  C:\Windows\System\HigIGZI.exe
  2⤵
  PID:7272
- C:\Windows\System\sMXrOdP.exe
  C:\Windows\System\sMXrOdP.exe
  2⤵
  PID:7300
- C:\Windows\System\QWIEKyw.exe
  C:\Windows\System\QWIEKyw.exe
  2⤵
  PID:7328
- C:\Windows\System\WIjFBTn.exe
  C:\Windows\System\WIjFBTn.exe
  2⤵
  PID:7356
- C:\Windows\System\ffHoAxz.exe
  C:\Windows\System\ffHoAxz.exe
  2⤵
  PID:7384
- C:\Windows\System\VvYGWYY.exe
  C:\Windows\System\VvYGWYY.exe
  2⤵
  PID:7412
- C:\Windows\System\KCHvpzv.exe
  C:\Windows\System\KCHvpzv.exe
  2⤵
  PID:7440
- C:\Windows\System\iFZCsqE.exe
  C:\Windows\System\iFZCsqE.exe
  2⤵
  PID:7468
- C:\Windows\System\lsQGZtI.exe
  C:\Windows\System\lsQGZtI.exe
  2⤵
  PID:7496
- C:\Windows\System\oxcTQMq.exe
  C:\Windows\System\oxcTQMq.exe
  2⤵
  PID:7524
- C:\Windows\System\sqTxwCy.exe
  C:\Windows\System\sqTxwCy.exe
  2⤵
  PID:7552
- C:\Windows\System\JLHtjJg.exe
  C:\Windows\System\JLHtjJg.exe
  2⤵
  PID:7580
- C:\Windows\System\JQHeADd.exe
  C:\Windows\System\JQHeADd.exe
  2⤵
  PID:7608
- C:\Windows\System\MkuzQGR.exe
  C:\Windows\System\MkuzQGR.exe
  2⤵
  PID:7636
- C:\Windows\System\zjMaoei.exe
  C:\Windows\System\zjMaoei.exe
  2⤵
  PID:7664
- C:\Windows\System\vhGFWnW.exe
  C:\Windows\System\vhGFWnW.exe
  2⤵
  PID:7692
- C:\Windows\System\uFsBFHE.exe
  C:\Windows\System\uFsBFHE.exe
  2⤵
  PID:7720
- C:\Windows\System\AzQtpIW.exe
  C:\Windows\System\AzQtpIW.exe
  2⤵
  PID:7748
- C:\Windows\System\pafGiXG.exe
  C:\Windows\System\pafGiXG.exe
  2⤵
  PID:7776
- C:\Windows\System\frsZkzR.exe
  C:\Windows\System\frsZkzR.exe
  2⤵
  PID:7804
- C:\Windows\System\phqDhwh.exe
  C:\Windows\System\phqDhwh.exe
  2⤵
  PID:7832
- C:\Windows\System\AepJdBD.exe
  C:\Windows\System\AepJdBD.exe
  2⤵
  PID:7860
- C:\Windows\System\cBgZrHx.exe
  C:\Windows\System\cBgZrHx.exe
  2⤵
  PID:7888
- C:\Windows\System\feqblRt.exe
  C:\Windows\System\feqblRt.exe
  2⤵
  PID:7916
- C:\Windows\System\AqKOMYN.exe
  C:\Windows\System\AqKOMYN.exe
  2⤵
  PID:7984
- C:\Windows\System\ZGcFzJT.exe
  C:\Windows\System\ZGcFzJT.exe
  2⤵
  PID:8008
- C:\Windows\System\ejJwtWg.exe
  C:\Windows\System\ejJwtWg.exe
  2⤵
  PID:8048
- C:\Windows\System\yOQfExm.exe
  C:\Windows\System\yOQfExm.exe
  2⤵
  PID:8068
- C:\Windows\System\zDNjfdG.exe
  C:\Windows\System\zDNjfdG.exe
  2⤵
  PID:8088
- C:\Windows\System\jbZjtzm.exe
  C:\Windows\System\jbZjtzm.exe
  2⤵
  PID:8104
- C:\Windows\System\MOnqeNT.exe
  C:\Windows\System\MOnqeNT.exe
  2⤵
  PID:8124
- C:\Windows\System\KsjcDvZ.exe
  C:\Windows\System\KsjcDvZ.exe
  2⤵
  PID:8144
- C:\Windows\System\DNwHTDa.exe
  C:\Windows\System\DNwHTDa.exe
  2⤵
  PID:8172
- C:\Windows\System\lrrwBLL.exe
  C:\Windows\System\lrrwBLL.exe
  2⤵
  PID:6448
- C:\Windows\System\IrTxHEV.exe
  C:\Windows\System\IrTxHEV.exe
  2⤵
  PID:6800
- C:\Windows\System\DTSiGud.exe
  C:\Windows\System\DTSiGud.exe
  2⤵
  PID:6932
- C:\Windows\System\oVAiMwx.exe
  C:\Windows\System\oVAiMwx.exe
  2⤵
  PID:7164
- C:\Windows\System\SvpZrEM.exe
  C:\Windows\System\SvpZrEM.exe
  2⤵
  PID:7176
- C:\Windows\System\pXVBcho.exe
  C:\Windows\System\pXVBcho.exe
  2⤵
  PID:7236
- C:\Windows\System\guFaznZ.exe
  C:\Windows\System\guFaznZ.exe
  2⤵
  PID:7292
- C:\Windows\System\TnFEqfv.exe
  C:\Windows\System\TnFEqfv.exe
  2⤵
  PID:7344
- C:\Windows\System\lCYHwIp.exe
  C:\Windows\System\lCYHwIp.exe
  2⤵
  PID:700
- C:\Windows\System\YjqEqWG.exe
  C:\Windows\System\YjqEqWG.exe
  2⤵
  PID:1352
- C:\Windows\System\zxWHtXc.exe
  C:\Windows\System\zxWHtXc.exe
  2⤵
  PID:7484
- C:\Windows\System\NGcgOXF.exe
  C:\Windows\System\NGcgOXF.exe
  2⤵
  PID:7516
- C:\Windows\System\qqkevpt.exe
  C:\Windows\System\qqkevpt.exe
  2⤵
  PID:4284
- C:\Windows\System\gTOWVMM.exe
  C:\Windows\System\gTOWVMM.exe
  2⤵
  PID:2512
- C:\Windows\System\EgVcbFT.exe
  C:\Windows\System\EgVcbFT.exe
  2⤵
  PID:7656
- C:\Windows\System\eMSEcCl.exe
  C:\Windows\System\eMSEcCl.exe
  2⤵
  PID:4784
- C:\Windows\System\koQeFJW.exe
  C:\Windows\System\koQeFJW.exe
  2⤵
  PID:4668
- C:\Windows\System\QDNxGid.exe
  C:\Windows\System\QDNxGid.exe
  2⤵
  PID:7792
- C:\Windows\System\mQRWNoC.exe
  C:\Windows\System\mQRWNoC.exe
  2⤵
  PID:2536
- C:\Windows\System\SmlnypQ.exe
  C:\Windows\System\SmlnypQ.exe
  2⤵
  PID:7872
- C:\Windows\System\UZDaaMj.exe
  C:\Windows\System\UZDaaMj.exe
  2⤵
  PID:7848
- C:\Windows\System\QGcsBTB.exe
  C:\Windows\System\QGcsBTB.exe
  2⤵
  PID:3152
- C:\Windows\System\DVWlUXy.exe
  C:\Windows\System\DVWlUXy.exe
  2⤵
  PID:7900
- C:\Windows\System\fFjRMjF.exe
  C:\Windows\System\fFjRMjF.exe
  2⤵
  PID:4460
- C:\Windows\System\UANoTHr.exe
  C:\Windows\System\UANoTHr.exe
  2⤵
  PID:3556
- C:\Windows\System\HLTelPz.exe
  C:\Windows\System\HLTelPz.exe
  2⤵
  PID:920
- C:\Windows\System\asKTvMR.exe
  C:\Windows\System\asKTvMR.exe
  2⤵
  PID:4496
- C:\Windows\System\OuagQfD.exe
  C:\Windows\System\OuagQfD.exe
  2⤵
  PID:8016
- C:\Windows\System\ShXeUoq.exe
  C:\Windows\System\ShXeUoq.exe
  2⤵
  PID:1840
- C:\Windows\System\thtJeQO.exe
  C:\Windows\System\thtJeQO.exe
  2⤵
  PID:8100
- C:\Windows\System\XCRXeKF.exe
  C:\Windows\System\XCRXeKF.exe
  2⤵
  PID:4792
- C:\Windows\System\ePUazDc.exe
  C:\Windows\System\ePUazDc.exe
  2⤵
  PID:744
- C:\Windows\System\Ahifyyj.exe
  C:\Windows\System\Ahifyyj.exe
  2⤵
  PID:5096
- C:\Windows\System\XNEqSOI.exe
  C:\Windows\System\XNEqSOI.exe
  2⤵
  PID:3092
- C:\Windows\System\OzoggrW.exe
  C:\Windows\System\OzoggrW.exe
  2⤵
  PID:1180
- C:\Windows\System\jVCvOZQ.exe
  C:\Windows\System\jVCvOZQ.exe
  2⤵
  PID:7980
- C:\Windows\System\fgvcfSo.exe
  C:\Windows\System\fgvcfSo.exe
  2⤵
  PID:7372
- C:\Windows\System\ZgpuvWb.exe
  C:\Windows\System\ZgpuvWb.exe
  2⤵
  PID:6580
- C:\Windows\System\ToKEghw.exe
  C:\Windows\System\ToKEghw.exe
  2⤵
  PID:7232
- C:\Windows\System\qFVaBWa.exe
  C:\Windows\System\qFVaBWa.exe
  2⤵
  PID:4916
- C:\Windows\System\EEGEOzS.exe
  C:\Windows\System\EEGEOzS.exe
  2⤵
  PID:7976
- C:\Windows\System\ezsyOIO.exe
  C:\Windows\System\ezsyOIO.exe
  2⤵
  PID:4492
- C:\Windows\System\zcAySBT.exe
  C:\Windows\System\zcAySBT.exe
  2⤵
  PID:7844
- C:\Windows\System\jqdEoiJ.exe
  C:\Windows\System\jqdEoiJ.exe
  2⤵
  PID:8032
- C:\Windows\System\pLMklGE.exe
  C:\Windows\System\pLMklGE.exe
  2⤵
  PID:7048
- C:\Windows\System\hoFowKd.exe
  C:\Windows\System\hoFowKd.exe
  2⤵
  PID:8220
- C:\Windows\System\BLMfhiE.exe
  C:\Windows\System\BLMfhiE.exe
  2⤵
  PID:8240
- C:\Windows\System\jhTmUOw.exe
  C:\Windows\System\jhTmUOw.exe
  2⤵
  PID:8280
- C:\Windows\System\IMZdmXp.exe
  C:\Windows\System\IMZdmXp.exe
  2⤵
  PID:8328
- C:\Windows\System\FJnQdcR.exe
  C:\Windows\System\FJnQdcR.exe
  2⤵
  PID:8364
- C:\Windows\System\JsoJlDv.exe
  C:\Windows\System\JsoJlDv.exe
  2⤵
  PID:8424
- C:\Windows\System\YVdANwC.exe
  C:\Windows\System\YVdANwC.exe
  2⤵
  PID:8444
- C:\Windows\System\QSvSEEa.exe
  C:\Windows\System\QSvSEEa.exe
  2⤵
  PID:8472
- C:\Windows\System\TjAVCqE.exe
  C:\Windows\System\TjAVCqE.exe
  2⤵
  PID:8492
- C:\Windows\System\yMdATCU.exe
  C:\Windows\System\yMdATCU.exe
  2⤵
  PID:8532
- C:\Windows\System\iORxVBq.exe
  C:\Windows\System\iORxVBq.exe
  2⤵
  PID:8560
- C:\Windows\System\lwzRqKo.exe
  C:\Windows\System\lwzRqKo.exe
  2⤵
  PID:8584
- C:\Windows\System\ADmpaXx.exe
  C:\Windows\System\ADmpaXx.exe
  2⤵
  PID:8616
- C:\Windows\System\juGWvha.exe
  C:\Windows\System\juGWvha.exe
  2⤵
  PID:8640
- C:\Windows\System\RVRCVYN.exe
  C:\Windows\System\RVRCVYN.exe
  2⤵
  PID:8656
- C:\Windows\System\YohnfAT.exe
  C:\Windows\System\YohnfAT.exe
  2⤵
  PID:8692
- C:\Windows\System\pYbOpQq.exe
  C:\Windows\System\pYbOpQq.exe
  2⤵
  PID:8728
- C:\Windows\System\PhhntUH.exe
  C:\Windows\System\PhhntUH.exe
  2⤵
  PID:8760
- C:\Windows\System\oKjWOmn.exe
  C:\Windows\System\oKjWOmn.exe
  2⤵
  PID:8788
- C:\Windows\System\tbwnGgz.exe
  C:\Windows\System\tbwnGgz.exe
  2⤵
  PID:8804
- C:\Windows\System\sugAeoa.exe
  C:\Windows\System\sugAeoa.exe
  2⤵
  PID:8820
- C:\Windows\System\inseAHZ.exe
  C:\Windows\System\inseAHZ.exe
  2⤵
  PID:8844
- C:\Windows\System\XkwiFOf.exe
  C:\Windows\System\XkwiFOf.exe
  2⤵
  PID:8860
- C:\Windows\System\yYoDGjA.exe
  C:\Windows\System\yYoDGjA.exe
  2⤵
  PID:8880
- C:\Windows\System\ckGrnVY.exe
  C:\Windows\System\ckGrnVY.exe
  2⤵
  PID:8900
- C:\Windows\System\LhtAmUG.exe
  C:\Windows\System\LhtAmUG.exe
  2⤵
  PID:8944
- C:\Windows\System\fzgkTaA.exe
  C:\Windows\System\fzgkTaA.exe
  2⤵
  PID:8988
- C:\Windows\System\YCfZKeG.exe
  C:\Windows\System\YCfZKeG.exe
  2⤵
  PID:9040
- C:\Windows\System\eVwkEvN.exe
  C:\Windows\System\eVwkEvN.exe
  2⤵
  PID:9068
- C:\Windows\System\tRezJnr.exe
  C:\Windows\System\tRezJnr.exe
  2⤵
  PID:9096
- C:\Windows\System\WfNFYGp.exe
  C:\Windows\System\WfNFYGp.exe
  2⤵
  PID:9124
- C:\Windows\System\VfbatNO.exe
  C:\Windows\System\VfbatNO.exe
  2⤵
  PID:9148
- C:\Windows\System\IhnSNmF.exe
  C:\Windows\System\IhnSNmF.exe
  2⤵
  PID:9168
- C:\Windows\System\FcpNOfv.exe
  C:\Windows\System\FcpNOfv.exe
  2⤵
  PID:9196
- C:\Windows\System\VIZmpXN.exe
  C:\Windows\System\VIZmpXN.exe
  2⤵
  PID:2640
- C:\Windows\System\BwcVcIV.exe
  C:\Windows\System\BwcVcIV.exe
  2⤵
  PID:7312
- C:\Windows\System\CGlHrMB.exe
  C:\Windows\System\CGlHrMB.exe
  2⤵
  PID:8276
- C:\Windows\System\zGuruCK.exe
  C:\Windows\System\zGuruCK.exe
  2⤵
  PID:8348
- C:\Windows\System\rPIKWey.exe
  C:\Windows\System\rPIKWey.exe
  2⤵
  PID:8464
- C:\Windows\System\BRxLTpD.exe
  C:\Windows\System\BRxLTpD.exe
  2⤵
  PID:8480
- C:\Windows\System\IPDTmhL.exe
  C:\Windows\System\IPDTmhL.exe
  2⤵
  PID:8540
- C:\Windows\System\LHtnFgm.exe
  C:\Windows\System\LHtnFgm.exe
  2⤵
  PID:8636
- C:\Windows\System\MTYvSnc.exe
  C:\Windows\System\MTYvSnc.exe
  2⤵
  PID:7228
- C:\Windows\System\ujeiVDP.exe
  C:\Windows\System\ujeiVDP.exe
  2⤵
  PID:8684
- C:\Windows\System\whyqfmj.exe
  C:\Windows\System\whyqfmj.exe
  2⤵
  PID:8784
- C:\Windows\System\AzGWfBZ.exe
  C:\Windows\System\AzGWfBZ.exe
  2⤵
  PID:8896
- C:\Windows\System\QbqLTal.exe
  C:\Windows\System\QbqLTal.exe
  2⤵
  PID:8932
- C:\Windows\System\aUQZTIq.exe
  C:\Windows\System\aUQZTIq.exe
  2⤵
  PID:9008
- C:\Windows\System\gBqWIOT.exe
  C:\Windows\System\gBqWIOT.exe
  2⤵
  PID:9120
- C:\Windows\System\LRhMEOC.exe
  C:\Windows\System\LRhMEOC.exe
  2⤵
  PID:9180
- C:\Windows\System\lUnpEHZ.exe
  C:\Windows\System\lUnpEHZ.exe
  2⤵
  PID:7072
- C:\Windows\System\YQqNUir.exe
  C:\Windows\System\YQqNUir.exe
  2⤵
  PID:8268
- C:\Windows\System\BtRZjvu.exe
  C:\Windows\System\BtRZjvu.exe
  2⤵
  PID:8520
- C:\Windows\System\LgOJxvI.exe
  C:\Windows\System\LgOJxvI.exe
  2⤵
  PID:8676
- C:\Windows\System\BWnxnEU.exe
  C:\Windows\System\BWnxnEU.exe
  2⤵
  PID:8856
- C:\Windows\System\YhmeEed.exe
  C:\Windows\System\YhmeEed.exe
  2⤵
  PID:648
- C:\Windows\System\UzcovKj.exe
  C:\Windows\System\UzcovKj.exe
  2⤵
  PID:8688
- C:\Windows\System\vfKPxLG.exe
  C:\Windows\System\vfKPxLG.exe
  2⤵
  PID:9164
- C:\Windows\System\hbWwawN.exe
  C:\Windows\System\hbWwawN.exe
  2⤵
  PID:7708
- C:\Windows\System\VUiQMLp.exe
  C:\Windows\System\VUiQMLp.exe
  2⤵
  PID:9232
- C:\Windows\System\srUxJEU.exe
  C:\Windows\System\srUxJEU.exe
  2⤵
  PID:9264
- C:\Windows\System\awGqPYG.exe
  C:\Windows\System\awGqPYG.exe
  2⤵
  PID:9292
- C:\Windows\System\wGxVzWY.exe
  C:\Windows\System\wGxVzWY.exe
  2⤵
  PID:9308
- C:\Windows\System\gyKfGeU.exe
  C:\Windows\System\gyKfGeU.exe
  2⤵
  PID:9352
- C:\Windows\System\lCoVLGk.exe
  C:\Windows\System\lCoVLGk.exe
  2⤵
  PID:9392
- C:\Windows\System\mwdSheT.exe
  C:\Windows\System\mwdSheT.exe
  2⤵
  PID:9420
- C:\Windows\System\LZdwfMk.exe
  C:\Windows\System\LZdwfMk.exe
  2⤵
  PID:9448
- C:\Windows\System\CoYpeXv.exe
  C:\Windows\System\CoYpeXv.exe
  2⤵
  PID:9464
- C:\Windows\System\lfWqcHG.exe
  C:\Windows\System\lfWqcHG.exe
  2⤵
  PID:9504
- C:\Windows\System\kydkJah.exe
  C:\Windows\System\kydkJah.exe
  2⤵
  PID:9520
- C:\Windows\System\wLdQADW.exe
  C:\Windows\System\wLdQADW.exe
  2⤵
  PID:9560
- C:\Windows\System\TilsXGn.exe
  C:\Windows\System\TilsXGn.exe
  2⤵
  PID:9580
- C:\Windows\System\DsmQIhj.exe
  C:\Windows\System\DsmQIhj.exe
  2⤵
  PID:9616
- C:\Windows\System\wuxmaNh.exe
  C:\Windows\System\wuxmaNh.exe
  2⤵
  PID:9644
- C:\Windows\System\GxveTQL.exe
  C:\Windows\System\GxveTQL.exe
  2⤵
  PID:9676
- C:\Windows\System\jItFUgW.exe
  C:\Windows\System\jItFUgW.exe
  2⤵
  PID:9692
- C:\Windows\System\kIqgExz.exe
  C:\Windows\System\kIqgExz.exe
  2⤵
  PID:9732
- C:\Windows\System\psglkOa.exe
  C:\Windows\System\psglkOa.exe
  2⤵
  PID:9768
- C:\Windows\System\kNEIauH.exe
  C:\Windows\System\kNEIauH.exe
  2⤵
  PID:9784
- C:\Windows\System\gwZcuIS.exe
  C:\Windows\System\gwZcuIS.exe
  2⤵
  PID:9832
- C:\Windows\System\GMxVDQZ.exe
  C:\Windows\System\GMxVDQZ.exe
  2⤵
  PID:9880
- C:\Windows\System\XuOaAre.exe
  C:\Windows\System\XuOaAre.exe
  2⤵
  PID:9900
- C:\Windows\System\UzyNGXJ.exe
  C:\Windows\System\UzyNGXJ.exe
  2⤵
  PID:9916
- C:\Windows\System\NJrRqAC.exe
  C:\Windows\System\NJrRqAC.exe
  2⤵
  PID:9972
- C:\Windows\System\fhsMNbw.exe
  C:\Windows\System\fhsMNbw.exe
  2⤵
  PID:9988
- C:\Windows\System\tVWtcxR.exe
  C:\Windows\System\tVWtcxR.exe
  2⤵
  PID:10028
- C:\Windows\System\KWmOYLZ.exe
  C:\Windows\System\KWmOYLZ.exe
  2⤵
  PID:10056
- C:\Windows\System\cJTGhcO.exe
  C:\Windows\System\cJTGhcO.exe
  2⤵
  PID:10084
- C:\Windows\System\HiQBNxz.exe
  C:\Windows\System\HiQBNxz.exe
  2⤵
  PID:10112
- C:\Windows\System\YEdUFCc.exe
  C:\Windows\System\YEdUFCc.exe
  2⤵
  PID:10140
- C:\Windows\System\yrLwUsa.exe
  C:\Windows\System\yrLwUsa.exe
  2⤵
  PID:10168
- C:\Windows\System\HrMTrbb.exe
  C:\Windows\System\HrMTrbb.exe
  2⤵
  PID:10196
- C:\Windows\System\fkHJTuK.exe
  C:\Windows\System\fkHJTuK.exe
  2⤵
  PID:10224
- C:\Windows\System\IobjASC.exe
  C:\Windows\System\IobjASC.exe
  2⤵
  PID:9248
- C:\Windows\System\AyMGoqU.exe
  C:\Windows\System\AyMGoqU.exe
  2⤵
  PID:9304
- C:\Windows\System\kzfPGrR.exe
  C:\Windows\System\kzfPGrR.exe
  2⤵
  PID:9384
- C:\Windows\System\uALdzgK.exe
  C:\Windows\System\uALdzgK.exe
  2⤵
  PID:8400
- C:\Windows\System\FfcrqvB.exe
  C:\Windows\System\FfcrqvB.exe
  2⤵
  PID:8976
- C:\Windows\System\aEflTKa.exe
  C:\Windows\System\aEflTKa.exe
  2⤵
  PID:9480
- C:\Windows\System\mTVYRYL.exe
  C:\Windows\System\mTVYRYL.exe
  2⤵
  PID:9544
- C:\Windows\System\SgsWEcn.exe
  C:\Windows\System\SgsWEcn.exe
  2⤵
  PID:9612
- C:\Windows\System\IFIIpwu.exe
  C:\Windows\System\IFIIpwu.exe
  2⤵
  PID:9684
- C:\Windows\System\ZypTogE.exe
  C:\Windows\System\ZypTogE.exe
  2⤵
  PID:9724
- C:\Windows\System\hVjeIjR.exe
  C:\Windows\System\hVjeIjR.exe
  2⤵
  PID:9776
- C:\Windows\System\wWkWxkO.exe
  C:\Windows\System\wWkWxkO.exe
  2⤵
  PID:9936
- C:\Windows\System\aSICaUE.exe
  C:\Windows\System\aSICaUE.exe
  2⤵
  PID:10000
- C:\Windows\System\cxwSIZs.exe
  C:\Windows\System\cxwSIZs.exe
  2⤵
  PID:10040
- C:\Windows\System\qYYrvGO.exe
  C:\Windows\System\qYYrvGO.exe
  2⤵
  PID:10104
- C:\Windows\System\fkMMxcY.exe
  C:\Windows\System\fkMMxcY.exe
  2⤵
  PID:10132
- C:\Windows\System\aIoQtRQ.exe
  C:\Windows\System\aIoQtRQ.exe
  2⤵
  PID:10216
- C:\Windows\System\DeXAFhD.exe
  C:\Windows\System\DeXAFhD.exe
  2⤵
  PID:9348
- C:\Windows\System\ZSuYFLg.exe
  C:\Windows\System\ZSuYFLg.exe
  2⤵
  PID:8500
- C:\Windows\System\ImRjZks.exe
  C:\Windows\System\ImRjZks.exe
  2⤵
  PID:9592
- C:\Windows\System\WlkebUo.exe
  C:\Windows\System\WlkebUo.exe
  2⤵
  PID:9856
- C:\Windows\System\elBVGCU.exe
  C:\Windows\System\elBVGCU.exe
  2⤵
  PID:10068
- C:\Windows\System\NxwTZDy.exe
  C:\Windows\System\NxwTZDy.exe
  2⤵
  PID:10164
- C:\Windows\System\SQVBofJ.exe
  C:\Windows\System\SQVBofJ.exe
  2⤵
  PID:9060
- C:\Windows\System\AbxmRbe.exe
  C:\Windows\System\AbxmRbe.exe
  2⤵
  PID:9780
- C:\Windows\System\vktaKss.exe
  C:\Windows\System\vktaKss.exe
  2⤵
  PID:10180
- C:\Windows\System\vqsiOMI.exe
  C:\Windows\System\vqsiOMI.exe
  2⤵
  PID:9980
- C:\Windows\System\PlBtKda.exe
  C:\Windows\System\PlBtKda.exe
  2⤵
  PID:8972
- C:\Windows\System\yWOPuWZ.exe
  C:\Windows\System\yWOPuWZ.exe
  2⤵
  PID:10268
- C:\Windows\System\QFzXzxG.exe
  C:\Windows\System\QFzXzxG.exe
  2⤵
  PID:10296
- C:\Windows\System\mvQTESU.exe
  C:\Windows\System\mvQTESU.exe
  2⤵
  PID:10312
- C:\Windows\System\jEcUUKo.exe
  C:\Windows\System\jEcUUKo.exe
  2⤵
  PID:10348
- C:\Windows\System\FKraTAN.exe
  C:\Windows\System\FKraTAN.exe
  2⤵
  PID:10380
- C:\Windows\System\SDmBcCz.exe
  C:\Windows\System\SDmBcCz.exe
  2⤵
  PID:10408
- C:\Windows\System\xQTfRrS.exe
  C:\Windows\System\xQTfRrS.exe
  2⤵
  PID:10436
- C:\Windows\System\lXYtlGr.exe
  C:\Windows\System\lXYtlGr.exe
  2⤵
  PID:10464
- C:\Windows\System\VZefVtL.exe
  C:\Windows\System\VZefVtL.exe
  2⤵
  PID:10496
- C:\Windows\System\eheInUv.exe
  C:\Windows\System\eheInUv.exe
  2⤵
  PID:10512
- C:\Windows\System\vhgzVPR.exe
  C:\Windows\System\vhgzVPR.exe
  2⤵
  PID:10544
- C:\Windows\System\bJlmcwA.exe
  C:\Windows\System\bJlmcwA.exe
  2⤵
  PID:10576
- C:\Windows\System\grMWoiz.exe
  C:\Windows\System\grMWoiz.exe
  2⤵
  PID:10608
- C:\Windows\System\QXXLSPS.exe
  C:\Windows\System\QXXLSPS.exe
  2⤵
  PID:10624
- C:\Windows\System\cqaLfCt.exe
  C:\Windows\System\cqaLfCt.exe
  2⤵
  PID:10640
- C:\Windows\System\QepWpzh.exe
  C:\Windows\System\QepWpzh.exe
  2⤵
  PID:10688
- C:\Windows\System\AhbBtSH.exe
  C:\Windows\System\AhbBtSH.exe
  2⤵
  PID:10720
- C:\Windows\System\JiafdBX.exe
  C:\Windows\System\JiafdBX.exe
  2⤵
  PID:10744
- C:\Windows\System\UKfwZhX.exe
  C:\Windows\System\UKfwZhX.exe
  2⤵
  PID:10776
- C:\Windows\System\elfgnGb.exe
  C:\Windows\System\elfgnGb.exe
  2⤵
  PID:10804
- C:\Windows\System\HghTfHx.exe
  C:\Windows\System\HghTfHx.exe
  2⤵
  PID:10832
- C:\Windows\System\brXxdRh.exe
  C:\Windows\System\brXxdRh.exe
  2⤵
  PID:10860
- C:\Windows\System\ORImFGW.exe
  C:\Windows\System\ORImFGW.exe
  2⤵
  PID:10876
- C:\Windows\System\pytbzsj.exe
  C:\Windows\System\pytbzsj.exe
  2⤵
  PID:10916
- C:\Windows\System\ZQbLPFX.exe
  C:\Windows\System\ZQbLPFX.exe
  2⤵
  PID:10944
- C:\Windows\System\SEBqSHB.exe
  C:\Windows\System\SEBqSHB.exe
  2⤵
  PID:10972
- C:\Windows\System\umoagxp.exe
  C:\Windows\System\umoagxp.exe
  2⤵
  PID:11012
- C:\Windows\System\BlghtoE.exe
  C:\Windows\System\BlghtoE.exe
  2⤵
  PID:11040
- C:\Windows\System\VuDnfbt.exe
  C:\Windows\System\VuDnfbt.exe
  2⤵
  PID:11068
- C:\Windows\System\WBhNXBX.exe
  C:\Windows\System\WBhNXBX.exe
  2⤵
  PID:11088
- C:\Windows\System\RWtXVTq.exe
  C:\Windows\System\RWtXVTq.exe
  2⤵
  PID:11120
- C:\Windows\System\rPsSBAr.exe
  C:\Windows\System\rPsSBAr.exe
  2⤵
  PID:11140
- C:\Windows\System\YntsYzg.exe
  C:\Windows\System\YntsYzg.exe
  2⤵
  PID:11180
- C:\Windows\System\HfRuZba.exe
  C:\Windows\System\HfRuZba.exe
  2⤵
  PID:11200
- C:\Windows\System\THGQONo.exe
  C:\Windows\System\THGQONo.exe
  2⤵
  PID:11236
- C:\Windows\System\STlDfQg.exe
  C:\Windows\System\STlDfQg.exe
  2⤵
  PID:11256
- C:\Windows\System\MVaONKY.exe
  C:\Windows\System\MVaONKY.exe
  2⤵
  PID:10280
- C:\Windows\System\TuYGvWX.exe
  C:\Windows\System\TuYGvWX.exe
  2⤵
  PID:10324
- C:\Windows\System\gsyepgW.exe
  C:\Windows\System\gsyepgW.exe
  2⤵
  PID:10376
- C:\Windows\System\wernUWK.exe
  C:\Windows\System\wernUWK.exe
  2⤵
  PID:10488
- C:\Windows\System\MnPCatE.exe
  C:\Windows\System\MnPCatE.exe
  2⤵
  PID:10560
- C:\Windows\System\ykohNzG.exe
  C:\Windows\System\ykohNzG.exe
  2⤵
  PID:10600
- C:\Windows\System\JnUSlEB.exe
  C:\Windows\System\JnUSlEB.exe
  2⤵
  PID:10712
- C:\Windows\System\iLHyKXm.exe
  C:\Windows\System\iLHyKXm.exe
  2⤵
  PID:10752
- C:\Windows\System\izwUjCp.exe
  C:\Windows\System\izwUjCp.exe
  2⤵
  PID:10816
- C:\Windows\System\coEPZhm.exe
  C:\Windows\System\coEPZhm.exe
  2⤵
  PID:10908
- C:\Windows\System\gVEaSQs.exe
  C:\Windows\System\gVEaSQs.exe
  2⤵
  PID:10968
- C:\Windows\System\lLSTbfw.exe
  C:\Windows\System\lLSTbfw.exe
  2⤵
  PID:11036
- C:\Windows\System\swSqAuT.exe
  C:\Windows\System\swSqAuT.exe
  2⤵
  PID:11076
- C:\Windows\System\uboGLFa.exe
  C:\Windows\System\uboGLFa.exe
  2⤵
  PID:11160
- C:\Windows\System\GnTkvaQ.exe
  C:\Windows\System\GnTkvaQ.exe
  2⤵
  PID:9704
- C:\Windows\System\RnyucUr.exe
  C:\Windows\System\RnyucUr.exe
  2⤵
  PID:10264
- C:\Windows\System\VIzqyuc.exe
  C:\Windows\System\VIzqyuc.exe
  2⤵
  PID:10428
- C:\Windows\System\XwZRdQV.exe
  C:\Windows\System\XwZRdQV.exe
  2⤵
  PID:10632
- C:\Windows\System\CZvpBIr.exe
  C:\Windows\System\CZvpBIr.exe
  2⤵
  PID:10796
- C:\Windows\System\wBVvAGs.exe
  C:\Windows\System\wBVvAGs.exe
  2⤵
  PID:10940
- C:\Windows\System\bgPJPxI.exe
  C:\Windows\System\bgPJPxI.exe
  2⤵
  PID:11112
- C:\Windows\System\SHUDJOJ.exe
  C:\Windows\System\SHUDJOJ.exe
  2⤵
  PID:9720
- C:\Windows\System\mkgjNkZ.exe
  C:\Windows\System\mkgjNkZ.exe
  2⤵
  PID:10596
- C:\Windows\System\RsNbnFl.exe
  C:\Windows\System\RsNbnFl.exe
  2⤵
  PID:10872
- C:\Windows\System\qRvpwDz.exe
  C:\Windows\System\qRvpwDz.exe
  2⤵
  PID:11252
- C:\Windows\System\ZphqTXv.exe
  C:\Windows\System\ZphqTXv.exe
  2⤵
  PID:11060
- C:\Windows\System\tXXfEYx.exe
  C:\Windows\System\tXXfEYx.exe
  2⤵
  PID:3992
- C:\Windows\System\HZAOEJR.exe
  C:\Windows\System\HZAOEJR.exe
  2⤵
  PID:11292
- C:\Windows\System\cSlUgAB.exe
  C:\Windows\System\cSlUgAB.exe
  2⤵
  PID:11320
- C:\Windows\System\EvDgBvV.exe
  C:\Windows\System\EvDgBvV.exe
  2⤵
  PID:11348
- C:\Windows\System\pQPhSWj.exe
  C:\Windows\System\pQPhSWj.exe
  2⤵
  PID:11364
- C:\Windows\System\KBwJIbx.exe
  C:\Windows\System\KBwJIbx.exe
  2⤵
  PID:11396
- C:\Windows\System\BqAwdET.exe
  C:\Windows\System\BqAwdET.exe
  2⤵
  PID:11420
- C:\Windows\System\JzRpxSW.exe
  C:\Windows\System\JzRpxSW.exe
  2⤵
  PID:11460
- C:\Windows\System\BPIobSK.exe
  C:\Windows\System\BPIobSK.exe
  2⤵
  PID:11480
- C:\Windows\System\BCtFJSd.exe
  C:\Windows\System\BCtFJSd.exe
  2⤵
  PID:11508
- C:\Windows\System\TPnwWKF.exe
  C:\Windows\System\TPnwWKF.exe
  2⤵
  PID:11544
- C:\Windows\System\DZYwICP.exe
  C:\Windows\System\DZYwICP.exe
  2⤵
  PID:11572
- C:\Windows\System\qpKcuzL.exe
  C:\Windows\System\qpKcuzL.exe
  2⤵
  PID:11588
- C:\Windows\System\vQwrgwo.exe
  C:\Windows\System\vQwrgwo.exe
  2⤵
  PID:11628
- C:\Windows\System\MaJQJms.exe
  C:\Windows\System\MaJQJms.exe
  2⤵
  PID:11656
- C:\Windows\System\xZPJejN.exe
  C:\Windows\System\xZPJejN.exe
  2⤵
  PID:11672
- C:\Windows\System\kObHDjR.exe
  C:\Windows\System\kObHDjR.exe
  2⤵
  PID:11700
- C:\Windows\System\RSufkaf.exe
  C:\Windows\System\RSufkaf.exe
  2⤵
  PID:11732
- C:\Windows\System\rDiiRVP.exe
  C:\Windows\System\rDiiRVP.exe
  2⤵
  PID:11768
- C:\Windows\System\GaoNwEc.exe
  C:\Windows\System\GaoNwEc.exe
  2⤵
  PID:11784
- C:\Windows\System\DGkWcLn.exe
  C:\Windows\System\DGkWcLn.exe
  2⤵
  PID:11816
- C:\Windows\System\DSCtehU.exe
  C:\Windows\System\DSCtehU.exe
  2⤵
  PID:11840
- C:\Windows\System\WPDMKkA.exe
  C:\Windows\System\WPDMKkA.exe
  2⤵
  PID:11880
- C:\Windows\System\nIxVHsr.exe
  C:\Windows\System\nIxVHsr.exe
  2⤵
  PID:11896
- C:\Windows\System\feLdFqo.exe
  C:\Windows\System\feLdFqo.exe
  2⤵
  PID:11936
- C:\Windows\System\bnOJOEh.exe
  C:\Windows\System\bnOJOEh.exe
  2⤵
  PID:11952
- C:\Windows\System\hyPVzUK.exe
  C:\Windows\System\hyPVzUK.exe
  2⤵
  PID:11992
- C:\Windows\System\LunQLFS.exe
  C:\Windows\System\LunQLFS.exe
  2⤵
  PID:12020
- C:\Windows\System\koHaJyo.exe
  C:\Windows\System\koHaJyo.exe
  2⤵
  PID:12040
- C:\Windows\System\BtbLtPt.exe
  C:\Windows\System\BtbLtPt.exe
  2⤵
  PID:12072
- C:\Windows\System\RQlkhFI.exe
  C:\Windows\System\RQlkhFI.exe
  2⤵
  PID:12104
- C:\Windows\System\LrSDXjU.exe
  C:\Windows\System\LrSDXjU.exe
  2⤵
  PID:12132
- C:\Windows\System\MLHYugw.exe
  C:\Windows\System\MLHYugw.exe
  2⤵
  PID:12164
- C:\Windows\System\ECCZIEd.exe
  C:\Windows\System\ECCZIEd.exe
  2⤵
  PID:12192
- C:\Windows\System\nOsORxZ.exe
  C:\Windows\System\nOsORxZ.exe
  2⤵
  PID:12220
- C:\Windows\System\DXHNflD.exe
  C:\Windows\System\DXHNflD.exe
  2⤵
  PID:12248
- C:\Windows\System\YhKMMah.exe
  C:\Windows\System\YhKMMah.exe
  2⤵
  PID:12272
- C:\Windows\System\IKvvPTE.exe
  C:\Windows\System\IKvvPTE.exe
  2⤵
  PID:11276
- C:\Windows\System\AUOUdOm.exe
  C:\Windows\System\AUOUdOm.exe
  2⤵
  PID:11336
- C:\Windows\System\mBuJdSV.exe
  C:\Windows\System\mBuJdSV.exe
  2⤵
  PID:11436
- C:\Windows\System\AppVMWt.exe
  C:\Windows\System\AppVMWt.exe
  2⤵
  PID:11468
- C:\Windows\System\HyiUfcG.exe
  C:\Windows\System\HyiUfcG.exe
  2⤵
  PID:11536
- C:\Windows\System\xitObJh.exe
  C:\Windows\System\xitObJh.exe
  2⤵
  PID:11584
- C:\Windows\System\BhNmkKi.exe
  C:\Windows\System\BhNmkKi.exe
  2⤵
  PID:11684
- C:\Windows\System\cqFLYsr.exe
  C:\Windows\System\cqFLYsr.exe
  2⤵
  PID:11752
- C:\Windows\System\QFtPZrj.exe
  C:\Windows\System\QFtPZrj.exe
  2⤵
  PID:11824
- C:\Windows\System\lvmDLgd.exe
  C:\Windows\System\lvmDLgd.exe
  2⤵
  PID:11892
- C:\Windows\System\vncLdvn.exe
  C:\Windows\System\vncLdvn.exe
  2⤵
  PID:11920
- C:\Windows\System\FJNXFHl.exe
  C:\Windows\System\FJNXFHl.exe
  2⤵
  PID:12012
- C:\Windows\System\nvykLWV.exe
  C:\Windows\System\nvykLWV.exe
  2⤵
  PID:12068
- C:\Windows\System\FKBLmjA.exe
  C:\Windows\System\FKBLmjA.exe
  2⤵
  PID:12148
- C:\Windows\System\nlknqbu.exe
  C:\Windows\System\nlknqbu.exe
  2⤵
  PID:12184
- C:\Windows\System\XgxvFJX.exe
  C:\Windows\System\XgxvFJX.exe
  2⤵
  PID:12280
- C:\Windows\System\dmgeQKP.exe
  C:\Windows\System\dmgeQKP.exe
  2⤵
  PID:11332
- C:\Windows\System\ktkGSTu.exe
  C:\Windows\System\ktkGSTu.exe
  2⤵
  PID:11452
- C:\Windows\System\vTyRETy.exe
  C:\Windows\System\vTyRETy.exe
  2⤵
  PID:11496
- C:\Windows\System\DcbHNHI.exe
  C:\Windows\System\DcbHNHI.exe
  2⤵
  PID:11652
- C:\Windows\System\RzLlPoM.exe
  C:\Windows\System\RzLlPoM.exe
  2⤵
  PID:11868
- C:\Windows\System\voBmrAN.exe
  C:\Windows\System\voBmrAN.exe
  2⤵
  PID:1688
- C:\Windows\System\oAatgxD.exe
  C:\Windows\System\oAatgxD.exe
  2⤵
  PID:12264
- C:\Windows\System\kGhfTFL.exe
  C:\Windows\System\kGhfTFL.exe
  2⤵
  PID:11392
- C:\Windows\System\uTYlFxU.exe
  C:\Windows\System\uTYlFxU.exe
  2⤵
  PID:11716
- C:\Windows\System\xkewBLI.exe
  C:\Windows\System\xkewBLI.exe
  2⤵
  PID:12100
- C:\Windows\System\ocjWLvm.exe
  C:\Windows\System\ocjWLvm.exe
  2⤵
  PID:11456
- C:\Windows\System\CMsiTbz.exe
  C:\Windows\System\CMsiTbz.exe
  2⤵
  PID:11304
- C:\Windows\System\wzBxMZD.exe
  C:\Windows\System\wzBxMZD.exe
  2⤵
  PID:12296
- C:\Windows\System\Axsynfo.exe
  C:\Windows\System\Axsynfo.exe
  2⤵
  PID:12324
- C:\Windows\System\EmixcIh.exe
  C:\Windows\System\EmixcIh.exe
  2⤵
  PID:12352
- C:\Windows\System\AzkXoWx.exe
  C:\Windows\System\AzkXoWx.exe
  2⤵
  PID:12368
- C:\Windows\System\DCAjRxs.exe
  C:\Windows\System\DCAjRxs.exe
  2⤵
  PID:12408
- C:\Windows\System\RUAFXYd.exe
  C:\Windows\System\RUAFXYd.exe
  2⤵
  PID:12424
- C:\Windows\System\pRKfnqA.exe
  C:\Windows\System\pRKfnqA.exe
  2⤵
  PID:12464
- C:\Windows\System\cqomPLD.exe
  C:\Windows\System\cqomPLD.exe
  2⤵
  PID:12492
- C:\Windows\System\qHtMQOH.exe
  C:\Windows\System\qHtMQOH.exe
  2⤵
  PID:12520
- C:\Windows\System\cxvLTyZ.exe
  C:\Windows\System\cxvLTyZ.exe
  2⤵
  PID:12548
- C:\Windows\System\niRmKDI.exe
  C:\Windows\System\niRmKDI.exe
  2⤵
  PID:12576
- C:\Windows\System\hbahWLB.exe
  C:\Windows\System\hbahWLB.exe
  2⤵
  PID:12620
- C:\Windows\System\fLmIhhu.exe
  C:\Windows\System\fLmIhhu.exe
  2⤵
  PID:12644
- C:\Windows\System\lDDQxrd.exe
  C:\Windows\System\lDDQxrd.exe
  2⤵
  PID:12672
- C:\Windows\System\qaEStmA.exe
  C:\Windows\System\qaEStmA.exe
  2⤵
  PID:12704
- C:\Windows\System\iDslUzj.exe
  C:\Windows\System\iDslUzj.exe
  2⤵
  PID:12732
- C:\Windows\System\XphfOVM.exe
  C:\Windows\System\XphfOVM.exe
  2⤵
  PID:12748
- C:\Windows\System\ZugsSWZ.exe
  C:\Windows\System\ZugsSWZ.exe
  2⤵
  PID:12788
- C:\Windows\System\euVxIxG.exe
  C:\Windows\System\euVxIxG.exe
  2⤵
  PID:12824
- C:\Windows\System\SRmzGNX.exe
  C:\Windows\System\SRmzGNX.exe
  2⤵
  PID:12852
- C:\Windows\System\bjGIyaA.exe
  C:\Windows\System\bjGIyaA.exe
  2⤵
  PID:12884
- C:\Windows\System\SvbkGtf.exe
  C:\Windows\System\SvbkGtf.exe
  2⤵
  PID:12912
- C:\Windows\System\sKEwDrE.exe
  C:\Windows\System\sKEwDrE.exe
  2⤵
  PID:12928
- C:\Windows\System\aTdOuYM.exe
  C:\Windows\System\aTdOuYM.exe
  2⤵
  PID:12948
- C:\Windows\System\zxEZXZX.exe
  C:\Windows\System\zxEZXZX.exe
  2⤵
  PID:12984
- C:\Windows\System\gPEEgSO.exe
  C:\Windows\System\gPEEgSO.exe
  2⤵
  PID:13020
- C:\Windows\System\XnFrksF.exe
  C:\Windows\System\XnFrksF.exe
  2⤵
  PID:13052
- C:\Windows\System\ONTKoPH.exe
  C:\Windows\System\ONTKoPH.exe
  2⤵
  PID:13080
- C:\Windows\System\sMmauER.exe
  C:\Windows\System\sMmauER.exe
  2⤵
  PID:13108
- C:\Windows\System\EJovQtC.exe
  C:\Windows\System\EJovQtC.exe
  2⤵
  PID:13184
- C:\Windows\System\QgPWsGi.exe
  C:\Windows\System\QgPWsGi.exe
  2⤵
  PID:13232
- C:\Windows\System\cRtxqCj.exe
  C:\Windows\System\cRtxqCj.exe
  2⤵
  PID:13252
- C:\Windows\System\qJymPVM.exe
  C:\Windows\System\qJymPVM.exe
  2⤵
  PID:13280
- C:\Windows\System\EOxdpEj.exe
  C:\Windows\System\EOxdpEj.exe
  2⤵
  PID:12292
- C:\Windows\System\tRUYjxP.exe
  C:\Windows\System\tRUYjxP.exe
  2⤵
  PID:12340
- C:\Windows\System\HlalppL.exe
  C:\Windows\System\HlalppL.exe
  2⤵
  PID:12416
- C:\Windows\System\asEhaXI.exe
  C:\Windows\System\asEhaXI.exe
  2⤵
  PID:12488
- C:\Windows\System\MAEmDJp.exe
  C:\Windows\System\MAEmDJp.exe
  2⤵
  PID:12544
- C:\Windows\System\FtlToiF.exe
  C:\Windows\System\FtlToiF.exe
  2⤵
  PID:12596
- C:\Windows\System\oJHqgEh.exe
  C:\Windows\System\oJHqgEh.exe
  2⤵
  PID:12656
- C:\Windows\System\MNEwOen.exe
  C:\Windows\System\MNEwOen.exe
  2⤵
  PID:12744
- C:\Windows\System\ZzPWyoG.exe
  C:\Windows\System\ZzPWyoG.exe
  2⤵
  PID:3488
- C:\Windows\System\PqqzLmf.exe
  C:\Windows\System\PqqzLmf.exe
  2⤵
  PID:12848
- C:\Windows\System\uUjTUcg.exe
  C:\Windows\System\uUjTUcg.exe
  2⤵
  PID:12920
- C:\Windows\System\dGcRESr.exe
  C:\Windows\System\dGcRESr.exe
  2⤵
  PID:12976
- C:\Windows\System\PtMWgaa.exe
  C:\Windows\System\PtMWgaa.exe
  2⤵
  PID:13048
- C:\Windows\System\uHfNtPw.exe
  C:\Windows\System\uHfNtPw.exe
  2⤵
  PID:13120
- C:\Windows\System\kCumYzh.exe
  C:\Windows\System\kCumYzh.exe
  2⤵
  PID:13160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_52aeankd.4zv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_52aeankd.4zv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

GjsKFET.exe

Path C:\Windows\System\GjsKFET.exe
Size 3.0MB
SHA256 45fb9bb8474f2ac7dfdc105d2d994a46f3af28d4962b8105745c4447a549a435
MD5 7d22e5d6cc9ec64fdd9cd371b5de22d2
SHA1 42dfe57995436c363283178b46ff447b514e7031
SHA512 d59665e4458ecc4d47fa1b7a76dd40639413915e13caa66809863c8a3456695a9b3e21c8efe7213871c2efc94c7a5059675f1034a20f59f2f440d17a7f7a8595
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW6:7bBeSFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVhvlgX.exe

Path C:\Windows\System\HVhvlgX.exe
Size 3.1MB
SHA256 aae96cea6a24c072b8e4b5039c1248b977621d7ccecaba01ef64b3ef3bab08fe
MD5 97c55eb45db63b70fde2cd371c03391b
SHA1 6e669dda6815d055e3f3fb6f573c1cb84bae2612
SHA512 f4d9036f2058f8bc8a148b610a1923cc48dda3ef6257cddaf74745650514d2035ba3e7dffc664e1ad6db8f2974bc9ab6c41460c84fd1c57b66c88a92acbd89c3
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW7:7bBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMLssLL.exe

Path C:\Windows\System\IMLssLL.exe
Size 3.0MB
SHA256 3968e837fa5fe40b42f97606ef6db80729cd4974efd73ef83c1aa744e4c2882f
MD5 48d4e2f617409c09f6cdd5135427f4ad
SHA1 38b39a647e744a498bb955450a93aea56f4a8252
SHA512 ce9d893e6d7e1969e6f3f0fee59bad24bebe517f8fc7294ff355d24b1d44452c96569a644a7667c64d573ebadc3866411e9d04d5f9dc63a59ac5bbd2d7cbbae6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IsvuHkr.exe

Path C:\Windows\System\IsvuHkr.exe
Size 3.1MB
SHA256 9aea7ef7f2feaf9f251cd4082a55cd73149f0629ceea730135f0ff31b8272d3f
MD5 2ff6c11da93cb4f53f3f546e13640518
SHA1 cf01550029786525689a796a5935dae0cdc096fe
SHA512 ebd3943762cb3d8746030e7e35d700307cb68c03e3de25e4cee5bbf5b620b991b9ba0faeb31f51024b21d3283d3c3b563fadbf9c3ca9b8fc987d63879028a4f2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWI:7bBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

KbLTfDQ.exe

Path C:\Windows\System\KbLTfDQ.exe
Size 3.1MB
SHA256 e5598ef58b580b9c435c9121f53df5e2031c8e61c1829c09644ee71e8fe806a8
MD5 d6780ea9898253dc56096f935d22dcbd
SHA1 d2059742b32f553048f49d5698bb7c1e9143b248
SHA512 a0d1b61883c736f4f58a432ec8aab950b6b6141797f36934439aa9d2d8fb2e704b1a9fa342f1a224eed3d4c52a0a59c2e4eab40e3e209a5104bd233df2eee321
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:7bBeSFkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXnIPKU.exe

Path C:\Windows\System\MXnIPKU.exe
Size 3.0MB
SHA256 0c6726442a551f354db086b74ad31a9d46c829f6f957a2ee45ca44de7a28effe
MD5 f1532aba6d97a00c861691d9a90b1981
SHA1 779f99f4cb13c5ace027bba6f8139ac966d23a83
SHA512 2e8845dee4325c8d0570a8c1fae3a4bdc80526d80a44ddd3c0660b6f3521f781c0f64d86ef55c6852f01ee134fae266d96cb281eee2611df76e3f33cb4c3d108
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:7bBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

NaJonYA.exe

Path C:\Windows\System\NaJonYA.exe
Size 3.0MB
SHA256 94876696ec44d9fdb616769e319125546900a2b36cb55add27ef71ccfaab11cd
MD5 4731eb42ab7b8b9634c89cf02c4e8d07
SHA1 a1b4d8705acff3dc349d916839342e6489f4ec56
SHA512 9999cd226c2116241ff27ffe3f4f2cfe19b3eb3c52aafb21702ed7e333f59f2ec83d1e23b6fba1abcdd689a341f0cfd9c50b0597f8d6d59de1c463d5103e287c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NdFhpbb.exe

Path C:\Windows\System\NdFhpbb.exe
Size 3.0MB
SHA256 10ab770113988df3618dc93c7fce13ec70e9e1dd6d7684caeadffc20a702265f
MD5 96fe2aee8a3239de3f93cee49e685f08
SHA1 95609ae91f9398c8871f0d5457d49deef629e9ec
SHA512 76979cd1cf8aa1c9aee2ec91b5aa9794f715ded3c5559dd5f9697a679253851018918121db63ae4791f668910e0ec1411e4ada22a45abbf180db0c1a8416ac95
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:7bBeSFkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

NeMmndE.exe

Path C:\Windows\System\NeMmndE.exe
Size 3.0MB
SHA256 2e2d133bc25c57a8b8391f116ba52dd9c0d65327cb079602d79b4506b245ca58
MD5 917380e504d7d4ab18abac55ccb236c0
SHA1 bda2865361ef740310049dd1d25a079235b5ef9b
SHA512 8d91ea1f107029369bb2c3a2a51064ba20faab16c8b7953a75a39fe7a0ad5329b0ad53e820df56e76c408bf67e076f10f07499351885b8b4758187a6ef147f37
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OGrnlCN.exe

Path C:\Windows\System\OGrnlCN.exe
Size 3.0MB
SHA256 a1fd6e123cc77e487a1b76128537c739b400338f3d5f3d3f3daab87757d74fa8
MD5 4a459cbd4f25d71f15c2f9348d2634c1
SHA1 d46f9b16ee930b937cdf1898aae4e439e8376649
SHA512 8f5c7ba35aa474867aa1598a3c2a60fe48c97bc0304e098e19094061c169bec17e97c5fccaa7eb0cda0ae2d4d9e4f1b375c51938911a2af44325869c503800e8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:7bBeSFk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofnldrp.exe

Path C:\Windows\System\Ofnldrp.exe
Size 3.0MB
SHA256 097d50a0be33a990edf0373668e7d6691e60d79b3804d76c6a37c7c472957e1e
MD5 82f8d90001d4c5444d9ee7e9a5d34200
SHA1 3797cb6e90aa3c8f79c6a5269885f8027ec60059
SHA512 8908e11df2e3b95df08d1feeb6c1c992c13681c094e46452ee880b84cb0a6e1327f062ee39a81c7a05debb8ce3a3e111866e07f4da8ae626c15177fcd6928478
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

PGQqBSC.exe

Path C:\Windows\System\PGQqBSC.exe
Size 3.0MB
SHA256 76ab1e17ad34560ef37fec740549930960db75e98bde030f8110ab55b4f5bcc1
MD5 9fb5128bb616bfe8db8545435cbdfd6e
SHA1 95f0e79c64de231c968067335ac141a3df5e9d9c
SHA512 219c9829cb8cd2b0038abb0f5db13a1e8f75aebdc8d9047798660d32b421da82c4d04bc1dab0ac7b564ed6915c3883b6b455469a7c0a2136c8d78864a4511e40
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCfnerC.exe

Path C:\Windows\System\SCfnerC.exe
Size 3.0MB
SHA256 bdb36945c2974186bc40145980c2ab711bb2eed17d11756a1dc24683fff6bad0
MD5 401852486ada64ac7cb89b07926812e6
SHA1 bbfadd33a0f2dd18aca95c5f7c3be8bff7b85bc9
SHA512 ac6a3a9d7f24b27fe53fcc07f65075e87daff1a4ce0ae154b4ed6fb3a1850e0a31bebe7624114644494401280b7881e7d15c2075fc7eadc0617e877e2a6ee676
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TIYktfP.exe

Path C:\Windows\System\TIYktfP.exe
Size 3.0MB
SHA256 1f0700ff5a8533065992dc75066d7a00a5d7fad465dff39718aeadf295a2da50
MD5 de585a122b729522c43b55ddf5dac401
SHA1 56eaed8610f4693b05847ef0570c6fc7e9f46583
SHA512 67630ded746032b9643f018bc6342f5a0625ce1a561c2fa31b91e202291fe021db179a0992f66b99840545a6eafdf97c911911be284bf9ca67e2e2d2c27be8fd
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TqTdkRh.exe

Path C:\Windows\System\TqTdkRh.exe
Size 3.1MB
SHA256 33ba56c7cfd24ddbcab2ffeb2762a012a73ec1fe8a9511bde58b3629f8f684de
MD5 12464505234c209d430bc9ee3570cf12
SHA1 e3a2c0166042dbaef813475d4a2ff353876b65df
SHA512 9940242d12a44bcbaab38003cda0bf6af7d1e0cf5643bd4df310aaf045c00b6160e8723a6f0c0e282b728e917cd2703df2bde5e64a7fd07099345725d8dc4c30
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vrrrkbg.exe

Path C:\Windows\System\Vrrrkbg.exe
Size 3.0MB
SHA256 05c702ff77da8b7bf1c52aa5086292ee87a9eee9ee7bca158c6c5d600783b47c
MD5 df464c335e655decd1220aa2e2a74ce5
SHA1 84dc8bc9419bc2e2b09814801469c21dc993a519
SHA512 227cdb97c2473fcfdca2a697cfb9df87d0603d3be08169d6e9b2bbe22f80b3a92729a7e663af4d41f8c7603a64af0733b8e436384c6504d627fbdce9108bfe1e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW3:7bBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrXSEJx.exe

Path C:\Windows\System\WrXSEJx.exe
Size 3.0MB
SHA256 0a9db770b5b418de9edd02a553a8c43f1094fd3dc6c854bf58cdf9f795e8915f
MD5 21b91f3bd129e32b6d4f6f7f1c6dfb1b
SHA1 740e8bbe4678eb6ebd0b18d703286e7f4d4164c4
SHA512 61d8ea0962b083233afcf1f5109674e48530c2363ec0493f2ddf91f8137a4f783d1ae46b56ba04b7bcc1baad54f81341f22c14a885d6b5b0f43f2d10e2a7d11a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:7bBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XNqFzHB.exe

Path C:\Windows\System\XNqFzHB.exe
Size 3.0MB
SHA256 9301417e789c65593227439d96cf3c51fc8ffed3f684e85ea45279533e1f27b7
MD5 cac4ceebfb2b5a1e8d3aca56881a699f
SHA1 79a7bbf23621ccf39157e2f127fa53fe18585de5
SHA512 754b0f8d24e2e4b2edef8beb71772dd859e256b17d7b3fa49ec3e2d1a59fa7e072eef158f2d0c7f0784624f5f6eb18c6f669424ec0caec605cd4396931376420
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:7bBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

aLJeBWp.exe

Path C:\Windows\System\aLJeBWp.exe
Size 3.0MB
SHA256 55a948963e5686d6fb2994a27608f9671cd950a2566b39f7e233a1f8bb89703b
MD5 44ba1e39b1e88b29bc822f5e76d67539
SHA1 13b5ca0ce1059581d9d5a87a02c5baab85372818
SHA512 1f8e71fd7dc1af3a8d594d4217d34269afb7e7b6385df8ea0bf7de2150b4d472f8ce4072e5b56645b307b9e3bc72285df8948d8dcdf0d130fcea44e85180c5c2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

baoABpq.exe

Path C:\Windows\System\baoABpq.exe
Size 3.0MB
SHA256 f4a124706b88fb64b11c3e9a48dfdfff386cf65a1d8d55f4d2b0b367b0370a5a
MD5 e71f7bfe32c1efecead1b56734f0f8dd
SHA1 5a6336aafe47894516200b80d7f60e877bc0ddad
SHA512 178ceec7117d5da72bdbfe08e985b2a9a2c29afb848514ac6f6c69e02452a4bc3cc1a5512f25ebfadb03f3ac17aceb13903f9aea30f6869311744bb6d4ed9982
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmtiohC.exe

Path C:\Windows\System\bmtiohC.exe
Size 3.0MB
SHA256 169cbb0f31d970c5d6179d8fda0f7c8c6aca4c6761bd2e5c792171e85c7483b0
MD5 796acf4f639a32fea33cbbd86216d198
SHA1 9844c2fe7210592c8f9121e4ef1a5b312892ab7f
SHA512 44d710da5f5267d23a00615950629b08f37d30fbe22f95aa8c3023923185139bb04f435ca39efc4d01e266bd8a517767d9893692f23db1a222c45623ff0098fa
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW9:7bBeSFkR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhFrjJq.exe

Path C:\Windows\System\dhFrjJq.exe
Size 3.1MB
SHA256 30713a11daca01f2bac60c5d57537d78ed98cfdebc79a538ee02098a50e5beeb
MD5 a316496b9a50073391c1b26a8ea4ce6f
SHA1 1cfe692f4cb67abb73ceb47c7e6c48fee4f3670e
SHA512 51976f5a0b34766d2ce3c320abb960e21494f9f5b1496f9b965cb8c58203830bf399c7f7acd76553428e2568e5fa219e7cf046ab0727c27f35126fcf52587ade
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWh:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwfFMLf.exe

Path C:\Windows\System\fwfFMLf.exe
Size 3.0MB
SHA256 a0483afcbcf32197eedd75c1b7977b96f8221139a24934ee1a0556a6e44cc4ba
MD5 ee95b7a792571f22ebab88fb7e872bd7
SHA1 0d66caa96d193518837c8d337e1fe5f69a3fc1c4
SHA512 bc7d4f43f71463391ed6c366e1e4eae1a2a650101af5af0097af5faae98f3daab3afdd35eb52822fc0faece56a8485b71e729fdc4f0a3d091be0495caa9ffc5c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:7bBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

lTQNZNh.exe

Path C:\Windows\System\lTQNZNh.exe
Size 3.1MB
SHA256 cdcfcc338b45d6801bbc597e9899aadf42a7d6866e6ce1413ebd409c2052e018
MD5 ecbdf02431f38646e16d7fc403b6db8e
SHA1 b5ca4e0c289c01a7cf2d4b8266a7b771d4c22f92
SHA512 46c66d54a34b6bb13901c3a7fba86b76e32144b6d107c61097638e3a3447ef70e6889d1c9e8215ab2ad80bf43807c9f4c37c03d8691b77e90a671d11be484a9c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCUkQPn.exe

Path C:\Windows\System\mCUkQPn.exe
Size 3.1MB
SHA256 ed42f5bfa507eda56071693bb1288458c7a17f582fe6710858a18ad2fcd9e725
MD5 28f741d460e0ccfea1ad242fafc3ea76
SHA1 b2a7287298ed85831bf6f50fc12aed0a2ab138c3
SHA512 1e875163a0cb72196d6cbd093aaf8e37d121bb0181966bac208c982bad19c728e5f34a1bc3fc4a00bd4366fc24e0eba2e45637dfd890fb93e19f58e196c05ba3
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWW:7bBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrSmNht.exe

Path C:\Windows\System\mrSmNht.exe
Size 3.1MB
SHA256 ce2e90f164d06098ff8d0531790e70f81ebc32acc14a80ad9bf44002b26f43c5
MD5 15af48ec03bda56e257b22a50659575a
SHA1 af2528d439ac2eb3000b80375262a26760f934d3
SHA512 aa476f8c61e9cca03066fa03fd9cff89353cd684d79c9986e83d999398174f062866c852cd6e1f4d444c1112aaf23d47ccca583beadb980a382d65fc9df828a7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:7bBeSFk8
MD5 SHA1 SHA512 SSDEEP

Submit Download

nBAaWXd.exe

Path C:\Windows\System\nBAaWXd.exe
Size 3.0MB
SHA256 e96162288adc33726c077fb13ce891619efee221075dfec68f4c87d13831dc59
MD5 eeb372a3d690bd0a74247a09fb0cd3ce
SHA1 c74ec25246340739a39e2308cb0b47b75c27519d
SHA512 2d21c726e9c1633ee284791901333053a56f99561397c82e348c51ad014a6cd941ecc3c46b4dc94cf7cc74e745ab08fdfd2a28787091a4c52c4ae7bfcf0fd6dc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:7bBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

ndrsgkj.exe

Path C:\Windows\System\ndrsgkj.exe
Size 3.1MB
SHA256 99e6d90f7a4c053a4befe802636dd25ac1cc8c90d2235f023fb1e40352a489a9
MD5 9e7afe68a949536470bd332958b8fd46
SHA1 f1bbef9e50e366c80070c99523a980adacc7612b
SHA512 f348443304ccaab15223c7d00546156c10d6dbec27a037a597075a66c61d0e1ea5e407c1bc9cd42fe17189df5b5001f4a26f14a1c130a8d63e79cdbc80d66cf8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWk:7bBeSFkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nitGPif.exe

Path C:\Windows\System\nitGPif.exe
Size 3.0MB
SHA256 368e3da209a2eb34bbf93a42f0728277f50eb9e3da93659fe648a37cc6da91a4
MD5 1b866edaa7605df4f71a23be78dca43f
SHA1 070b46a4763f0bfe57de9221ffc795721b65449a
SHA512 4e09bda33d455813503728505ee2d3f24bd0bfefacc44de68ae109f724b1a45e2e67d78b23907820f78d0c8d8bbe947108a388a577bb1e6d6eba3b3606242880
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFkg
MD5 SHA1 SHA512 SSDEEP

Submit Download

qrfyByN.exe

Path C:\Windows\System\qrfyByN.exe
Size 3.0MB
SHA256 03f6490ce9093552bd8504b376b96f5880f58d86b98e2983f008442ee6584cf6
MD5 316fae3da83bcf1124d5f75ac7d15877
SHA1 7ac7b24c5f5af0f34bfb98549f04b7218f07978d
SHA512 4354b8ff8584c365c87703fcbf84f93d303ccae96ae552743cc0596f9d226559e5d16ccdb76181cad8aa5dadf92bca8f9b0a253cdfd3ea87a84ff4caf8637bf5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

quRBuNf.exe

Path C:\Windows\System\quRBuNf.exe
Size 3.0MB
SHA256 b26137748918a00590560e4ddc71b45afef7c339a4e6b75fded2aaa6798d3327
MD5 5eefbe4da9ac2847e26b365619e87161
SHA1 53cff52a90cda72f134457ffe0fdf0106b22682e
SHA512 4ec3c0af8faaeb44e110dfe47562832ecd45ef14dd655440621ef4adf4728bb167582539ac48404cf529d13e3266e28502f94f79489690b92fa98d97ec23c3a3
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbLxCYL.exe

Path C:\Windows\System\wbLxCYL.exe
Size 3.0MB
SHA256 10c079a1c3d185cabe50b4afa856cca7bd9f859c7fda2f070ffc202c48b6eadf
MD5 360fd3747ccc9fdb5f7b6a59f00a81b8
SHA1 0d4569545e04981f9862244cb45b03cbced5690a
SHA512 517527378fc7ab0230ac2e09c9c42ef26590570783a1ff661c4dc0a2793fe487057592b958ff6941ca86bba59e55c0c3108a713d66ac97f8d8a76698de40801d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

xBqBVUF.exe

Path C:\Windows\System\xBqBVUF.exe
Size 3.0MB
SHA256 1041928d034e9f175ffef7df5fb0a72e19f5a6f914ed857de7b65eb1a51c2607
MD5 460ed0a84de8a2bb799468cbe34d1998
SHA1 9c10cb4db52b93a14e34f20969b5ef214206f535
SHA512 4c3bbcf479cf52b3a324e22630ce59190f0b1d69abcaa60652e90470bbe0329f861fb41353a25146fc977d9a8f48b60ec23db6f7463c2de705aa66bdface4fd2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/884-872-0x00007FF7D3820000-0x00007FF7D3C16000-memory.dmp

Download

memory/884-2047-0x00007FF7D3820000-0x00007FF7D3C16000-memory.dmp

Download

memory/964-843-0x00007FF7B4E20000-0x00007FF7B5216000-memory.dmp

Download

memory/964-2046-0x00007FF7B4E20000-0x00007FF7B5216000-memory.dmp

Download

memory/1600-862-0x00007FF7B0A10000-0x00007FF7B0E06000-memory.dmp

Download

memory/1600-2048-0x00007FF7B0A10000-0x00007FF7B0E06000-memory.dmp

Download

memory/2208-826-0x00007FF736630000-0x00007FF736A26000-memory.dmp

Download

memory/2208-2043-0x00007FF736630000-0x00007FF736A26000-memory.dmp

Download

memory/2348-1-0x000002DBACC00000-0x000002DBACC10000-memory.dmp

Download

memory/2348-0-0x00007FF77E3F0000-0x00007FF77E7E6000-memory.dmp

Download

memory/2380-2058-0x00007FF7B0AC0000-0x00007FF7B0EB6000-memory.dmp

Download

memory/2380-944-0x00007FF7B0AC0000-0x00007FF7B0EB6000-memory.dmp

Download

memory/2424-2040-0x00007FF75F300000-0x00007FF75F6F6000-memory.dmp

Download

memory/2424-791-0x00007FF75F300000-0x00007FF75F6F6000-memory.dmp

Download

memory/2572-2039-0x00007FF689A50000-0x00007FF689E46000-memory.dmp

Download

memory/2572-966-0x00007FF689A50000-0x00007FF689E46000-memory.dmp

Download

memory/2672-2050-0x00007FF671640000-0x00007FF671A36000-memory.dmp

Download

memory/2672-882-0x00007FF671640000-0x00007FF671A36000-memory.dmp

Download

memory/2908-940-0x00007FF7CBE80000-0x00007FF7CC276000-memory.dmp

Download

memory/2908-2054-0x00007FF7CBE80000-0x00007FF7CC276000-memory.dmp

Download

memory/2932-954-0x00007FF645D70000-0x00007FF646166000-memory.dmp

Download

memory/2932-2052-0x00007FF645D70000-0x00007FF646166000-memory.dmp

Download

memory/2960-962-0x00007FF65FB60000-0x00007FF65FF56000-memory.dmp

Download

memory/2960-2037-0x00007FF65FB60000-0x00007FF65FF56000-memory.dmp

Download

memory/3048-2049-0x00007FF71B1E0000-0x00007FF71B5D6000-memory.dmp

Download

memory/3048-851-0x00007FF71B1E0000-0x00007FF71B5D6000-memory.dmp

Download

memory/3112-808-0x00007FF723850000-0x00007FF723C46000-memory.dmp

Download

memory/3112-2042-0x00007FF723850000-0x00007FF723C46000-memory.dmp

Download

memory/3260-2056-0x00007FF63BB60000-0x00007FF63BF56000-memory.dmp

Download

memory/3260-950-0x00007FF63BB60000-0x00007FF63BF56000-memory.dmp

Download

memory/3364-2051-0x00007FF6FA5E0000-0x00007FF6FA9D6000-memory.dmp

Download

memory/3364-901-0x00007FF6FA5E0000-0x00007FF6FA9D6000-memory.dmp

Download

memory/3416-792-0x00007FF715C50000-0x00007FF716046000-memory.dmp

Download

memory/3416-2038-0x00007FF715C50000-0x00007FF716046000-memory.dmp

Download

memory/3444-2059-0x00007FF7F3A30000-0x00007FF7F3E26000-memory.dmp

Download

memory/3444-958-0x00007FF7F3A30000-0x00007FF7F3E26000-memory.dmp

Download

memory/3748-816-0x00007FF6E6270000-0x00007FF6E6666000-memory.dmp

Download

memory/3748-2041-0x00007FF6E6270000-0x00007FF6E6666000-memory.dmp

Download

memory/3892-834-0x00007FF663A70000-0x00007FF663E66000-memory.dmp

Download

memory/3892-2045-0x00007FF663A70000-0x00007FF663E66000-memory.dmp

Download

memory/3928-975-0x00007FF7A06E0000-0x00007FF7A0AD6000-memory.dmp

Download

memory/3928-2044-0x00007FF7A06E0000-0x00007FF7A0AD6000-memory.dmp

Download

memory/4004-13-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp

Download

memory/4004-2035-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp

Download

memory/4004-2036-0x00007FF79A3D0000-0x00007FF79A7C6000-memory.dmp

Download

memory/4436-2055-0x00007FF783BE0000-0x00007FF783FD6000-memory.dmp

Download

memory/4436-935-0x00007FF783BE0000-0x00007FF783FD6000-memory.dmp

Download

memory/4452-2057-0x00007FF725030000-0x00007FF725426000-memory.dmp

Download

memory/4452-931-0x00007FF725030000-0x00007FF725426000-memory.dmp

Download

memory/4560-2053-0x00007FF659580000-0x00007FF659976000-memory.dmp

Download

memory/4560-941-0x00007FF659580000-0x00007FF659976000-memory.dmp

Download

memory/4996-790-0x00007FFE899C0000-0x00007FFE8A481000-memory.dmp

Download

memory/4996-36-0x00007FFE899C0000-0x00007FFE8A481000-memory.dmp

Download

memory/4996-57-0x0000020F31FF0000-0x0000020F32012000-memory.dmp

Download

memory/4996-5-0x00007FFE899C3000-0x00007FFE899C5000-memory.dmp

Download