xmrig | 6306c75ece0a398a202032f6f569f72dc3b9018f448f7d9f7f0422970f4d4916

Analysis

max time kernel
99s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
Size 3.0MB
Sample240613-psep2syflg
SHA256 6306c75ece0a398a202032f6f569f72dc3b9018f448f7d9f7f0422970f4d4916
MD5 7cc6ab9c0c75362a5d53590645abd500
SHA1 97bc5d1fb4f8de80daeb126b817524fadbde6ab6
SHA512 2be0c337b16a6c11050a8de19217d7896c4414e2e8d5e039b2360b95fd1dcba91c9a624c51538d6d8d78b023686f91988819b1aa264b4910d8c27fb91ce96bd4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cq:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3768-0-0x00007FF651ED0000-0x00007FF6522C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-8.dat	xmrig
behavioral2/files/0x000800000002340f-9.dat	xmrig
behavioral2/files/0x0007000000023414-36.dat	xmrig
behavioral2/files/0x0008000000023413-43.dat	xmrig
behavioral2/files/0x0008000000023412-49.dat	xmrig
behavioral2/files/0x0007000000023415-58.dat	xmrig
behavioral2/files/0x000700000002341a-71.dat	xmrig
behavioral2/files/0x0007000000023417-81.dat	xmrig
behavioral2/files/0x000700000002341c-89.dat	xmrig
behavioral2/files/0x000700000002341d-102.dat	xmrig
behavioral2/files/0x0007000000023427-152.dat	xmrig
behavioral2/files/0x000700000002342b-164.dat	xmrig
behavioral2/files/0x000700000002342d-174.dat	xmrig
behavioral2/files/0x000700000002342e-179.dat	xmrig
behavioral2/files/0x000700000002342c-177.dat	xmrig
behavioral2/files/0x000700000002342a-167.dat	xmrig
behavioral2/memory/4036-707-0x00007FF621240000-0x00007FF621636000-memory.dmp	xmrig
behavioral2/memory/1444-708-0x00007FF7978F0000-0x00007FF797CE6000-memory.dmp	xmrig
behavioral2/memory/2824-709-0x00007FF637100000-0x00007FF6374F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-162.dat	xmrig
behavioral2/files/0x0007000000023428-157.dat	xmrig
behavioral2/files/0x0007000000023426-147.dat	xmrig
behavioral2/files/0x0007000000023425-142.dat	xmrig
behavioral2/files/0x0007000000023424-137.dat	xmrig
behavioral2/files/0x0007000000023423-132.dat	xmrig
behavioral2/files/0x0007000000023422-127.dat	xmrig
behavioral2/files/0x0007000000023421-122.dat	xmrig
behavioral2/memory/4380-717-0x00007FF769050000-0x00007FF769446000-memory.dmp	xmrig
behavioral2/memory/4124-713-0x00007FF792440000-0x00007FF792836000-memory.dmp	xmrig
behavioral2/memory/3196-710-0x00007FF7C2420000-0x00007FF7C2816000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-117.dat	xmrig
behavioral2/files/0x000700000002341f-112.dat	xmrig
behavioral2/files/0x000700000002341e-107.dat	xmrig
behavioral2/files/0x000700000002341b-92.dat	xmrig
behavioral2/files/0x0007000000023419-87.dat	xmrig
behavioral2/files/0x0007000000023418-85.dat	xmrig
behavioral2/files/0x0007000000023416-76.dat	xmrig
behavioral2/memory/324-57-0x00007FF7D86E0000-0x00007FF7D8AD6000-memory.dmp	xmrig
behavioral2/memory/3856-53-0x00007FF77A2C0000-0x00007FF77A6B6000-memory.dmp	xmrig
behavioral2/memory/5008-46-0x00007FF6C2900000-0x00007FF6C2CF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-31.dat	xmrig
behavioral2/files/0x0005000000022f1e-12.dat	xmrig
behavioral2/memory/796-736-0x00007FF75C110000-0x00007FF75C506000-memory.dmp	xmrig
behavioral2/memory/4892-732-0x00007FF6E4B00000-0x00007FF6E4EF6000-memory.dmp	xmrig
behavioral2/memory/4180-729-0x00007FF6D3880000-0x00007FF6D3C76000-memory.dmp	xmrig
behavioral2/memory/3720-725-0x00007FF6AB3F0000-0x00007FF6AB7E6000-memory.dmp	xmrig
behavioral2/memory/720-750-0x00007FF767ED0000-0x00007FF7682C6000-memory.dmp	xmrig
behavioral2/memory/3324-758-0x00007FF688960000-0x00007FF688D56000-memory.dmp	xmrig
behavioral2/memory/1804-763-0x00007FF660B40000-0x00007FF660F36000-memory.dmp	xmrig
behavioral2/memory/952-766-0x00007FF7C6C20000-0x00007FF7C7016000-memory.dmp	xmrig
behavioral2/memory/4980-765-0x00007FF77AAA0000-0x00007FF77AE96000-memory.dmp	xmrig
behavioral2/memory/4408-746-0x00007FF6C13B0000-0x00007FF6C17A6000-memory.dmp	xmrig
behavioral2/memory/792-768-0x00007FF610870000-0x00007FF610C66000-memory.dmp	xmrig
behavioral2/memory/4876-771-0x00007FF6FB8E0000-0x00007FF6FBCD6000-memory.dmp	xmrig
behavioral2/memory/448-773-0x00007FF7EA5B0000-0x00007FF7EA9A6000-memory.dmp	xmrig
behavioral2/memory/4852-772-0x00007FF631FE0000-0x00007FF6323D6000-memory.dmp	xmrig
behavioral2/memory/4772-769-0x00007FF78C6D0000-0x00007FF78CAC6000-memory.dmp	xmrig
behavioral2/memory/4036-2115-0x00007FF621240000-0x00007FF621636000-memory.dmp	xmrig
behavioral2/memory/5008-2117-0x00007FF6C2900000-0x00007FF6C2CF6000-memory.dmp	xmrig
behavioral2/memory/792-2118-0x00007FF610870000-0x00007FF610C66000-memory.dmp	xmrig
behavioral2/memory/3856-2119-0x00007FF77A2C0000-0x00007FF77A6B6000-memory.dmp	xmrig
behavioral2/memory/324-2120-0x00007FF7D86E0000-0x00007FF7D8AD6000-memory.dmp	xmrig
behavioral2/memory/4772-2121-0x00007FF78C6D0000-0x00007FF78CAC6000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	732	powershell.exe
5	732	powershell.exe
9	732	powershell.exe
10	732	powershell.exe
12	732	powershell.exe
13	732	powershell.exe
15	732	powershell.exe
18	732	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
732	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
792	tsPINVa.exe
5008	UFrCZuo.exe
3856	MaovCsr.exe
324	cDrfQsJ.exe
4772	FlPshFd.exe
4876	fMuXZnB.exe
4852	BGCZmrJ.exe
4036	PAeTWKX.exe
448	WEqxOUU.exe
1444	XKJkVdT.exe
2824	WZFhuyT.exe
3196	tOYMVIH.exe
4124	IUmzsvv.exe
4380	rvvFSGZ.exe
3720	BJYPPCi.exe
4180	hCexRAc.exe
4892	TLwiuzO.exe
796	euQFXwP.exe
4408	DrOwHmC.exe
720	mdKLzvs.exe
3324	NZhGRIz.exe
1804	iJMkZxu.exe
4980	zuFvwcA.exe
952	oVohYjg.exe
3292	yCNRyVI.exe
1696	HVKjZNe.exe
1968	otMWnBh.exe
4308	CuAWnFH.exe
1860	lTsDaQx.exe
3252	ZCgWmlQ.exe
2996	iDNZuYk.exe
3220	aOctOBb.exe
4768	bYtyDdb.exe
2876	zmaoLoU.exe
3144	ofxcSmy.exe
2912	YmEhgRn.exe
3968	hUYCJRC.exe
412	TskkiRr.exe
4832	KXPMtzO.exe
4164	YXLhsLh.exe
4024	ZoUYMPl.exe
5108	NxAPVqt.exe
728	wAlaSPM.exe
4564	jgMALTp.exe
4944	WXfFwEO.exe
4440	iiauKaQ.exe
2192	KwGNcqF.exe
3644	ZgzumAt.exe
2676	fFbCwDz.exe
3568	wqLobqA.exe
4888	kVJLTjc.exe
688	UElIAFo.exe
2484	acAqCln.exe
5056	MriTvjg.exe
1468	wKpKSgk.exe
2208	poBdwJH.exe
1036	XXwdVaV.exe
3756	HnNaret.exe
4260	XBdJiJE.exe
1032	DxhuyDC.exe
2576	sipndOu.exe
1884	wpiSkeq.exe
4276	AMUqnQM.exe
3260	XHkDIyz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3768-0-0x00007FF651ED0000-0x00007FF6522C6000-memory.dmp	upx
behavioral2/files/0x0007000000023410-8.dat	upx
behavioral2/files/0x000800000002340f-9.dat	upx
behavioral2/files/0x0007000000023414-36.dat	upx
behavioral2/files/0x0008000000023413-43.dat	upx
behavioral2/files/0x0008000000023412-49.dat	upx
behavioral2/files/0x0007000000023415-58.dat	upx
behavioral2/files/0x000700000002341a-71.dat	upx
behavioral2/files/0x0007000000023417-81.dat	upx
behavioral2/files/0x000700000002341c-89.dat	upx
behavioral2/files/0x000700000002341d-102.dat	upx
behavioral2/files/0x0007000000023427-152.dat	upx
behavioral2/files/0x000700000002342b-164.dat	upx
behavioral2/files/0x000700000002342d-174.dat	upx
behavioral2/files/0x000700000002342e-179.dat	upx
behavioral2/files/0x000700000002342c-177.dat	upx
behavioral2/files/0x000700000002342a-167.dat	upx
behavioral2/memory/4036-707-0x00007FF621240000-0x00007FF621636000-memory.dmp	upx
behavioral2/memory/1444-708-0x00007FF7978F0000-0x00007FF797CE6000-memory.dmp	upx
behavioral2/memory/2824-709-0x00007FF637100000-0x00007FF6374F6000-memory.dmp	upx
behavioral2/files/0x0007000000023429-162.dat	upx
behavioral2/files/0x0007000000023428-157.dat	upx
behavioral2/files/0x0007000000023426-147.dat	upx
behavioral2/files/0x0007000000023425-142.dat	upx
behavioral2/files/0x0007000000023424-137.dat	upx
behavioral2/files/0x0007000000023423-132.dat	upx
behavioral2/files/0x0007000000023422-127.dat	upx
behavioral2/files/0x0007000000023421-122.dat	upx
behavioral2/memory/4380-717-0x00007FF769050000-0x00007FF769446000-memory.dmp	upx
behavioral2/memory/4124-713-0x00007FF792440000-0x00007FF792836000-memory.dmp	upx
behavioral2/memory/3196-710-0x00007FF7C2420000-0x00007FF7C2816000-memory.dmp	upx
behavioral2/files/0x0007000000023420-117.dat	upx
behavioral2/files/0x000700000002341f-112.dat	upx
behavioral2/files/0x000700000002341e-107.dat	upx
behavioral2/files/0x000700000002341b-92.dat	upx
behavioral2/files/0x0007000000023419-87.dat	upx
behavioral2/files/0x0007000000023418-85.dat	upx
behavioral2/files/0x0007000000023416-76.dat	upx
behavioral2/memory/324-57-0x00007FF7D86E0000-0x00007FF7D8AD6000-memory.dmp	upx
behavioral2/memory/3856-53-0x00007FF77A2C0000-0x00007FF77A6B6000-memory.dmp	upx
behavioral2/memory/5008-46-0x00007FF6C2900000-0x00007FF6C2CF6000-memory.dmp	upx
behavioral2/files/0x0007000000023411-31.dat	upx
behavioral2/files/0x0005000000022f1e-12.dat	upx
behavioral2/memory/796-736-0x00007FF75C110000-0x00007FF75C506000-memory.dmp	upx
behavioral2/memory/4892-732-0x00007FF6E4B00000-0x00007FF6E4EF6000-memory.dmp	upx
behavioral2/memory/4180-729-0x00007FF6D3880000-0x00007FF6D3C76000-memory.dmp	upx
behavioral2/memory/3720-725-0x00007FF6AB3F0000-0x00007FF6AB7E6000-memory.dmp	upx
behavioral2/memory/720-750-0x00007FF767ED0000-0x00007FF7682C6000-memory.dmp	upx
behavioral2/memory/3324-758-0x00007FF688960000-0x00007FF688D56000-memory.dmp	upx
behavioral2/memory/1804-763-0x00007FF660B40000-0x00007FF660F36000-memory.dmp	upx
behavioral2/memory/952-766-0x00007FF7C6C20000-0x00007FF7C7016000-memory.dmp	upx
behavioral2/memory/4980-765-0x00007FF77AAA0000-0x00007FF77AE96000-memory.dmp	upx
behavioral2/memory/4408-746-0x00007FF6C13B0000-0x00007FF6C17A6000-memory.dmp	upx
behavioral2/memory/792-768-0x00007FF610870000-0x00007FF610C66000-memory.dmp	upx
behavioral2/memory/4876-771-0x00007FF6FB8E0000-0x00007FF6FBCD6000-memory.dmp	upx
behavioral2/memory/448-773-0x00007FF7EA5B0000-0x00007FF7EA9A6000-memory.dmp	upx
behavioral2/memory/4852-772-0x00007FF631FE0000-0x00007FF6323D6000-memory.dmp	upx
behavioral2/memory/4772-769-0x00007FF78C6D0000-0x00007FF78CAC6000-memory.dmp	upx
behavioral2/memory/4036-2115-0x00007FF621240000-0x00007FF621636000-memory.dmp	upx
behavioral2/memory/5008-2117-0x00007FF6C2900000-0x00007FF6C2CF6000-memory.dmp	upx
behavioral2/memory/792-2118-0x00007FF610870000-0x00007FF610C66000-memory.dmp	upx
behavioral2/memory/3856-2119-0x00007FF77A2C0000-0x00007FF77A6B6000-memory.dmp	upx
behavioral2/memory/324-2120-0x00007FF7D86E0000-0x00007FF7D8AD6000-memory.dmp	upx
behavioral2/memory/4772-2121-0x00007FF78C6D0000-0x00007FF78CAC6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WkMZYXZ.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\LWFKYeu.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\rQNbrhP.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\RgrYjIe.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\kSkTqnz.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\mhOOdwL.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\lMuqkQY.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\IEnWgoq.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\yqTcIBX.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\MaovCsr.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\WZFhuyT.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\ByewLPx.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\TCnudwb.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\vhnlEIZ.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\Iyudzkw.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\STvtswY.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\atXPGYJ.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\ZiyWxSX.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\FlPshFd.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\DrOwHmC.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\OKpKWJG.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\VBZEDPx.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\hLXgTGq.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\LQVxyAa.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\cyjaxIL.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\XoXEmIG.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\wQFLbqL.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\iiauKaQ.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\dqumzFb.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\tSsKctr.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\pEuWnQD.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\eAnbKML.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\YUVUkXw.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\xldclfc.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\LQiIfFZ.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\VtZmMNp.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\wQHHInl.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\HVKjZNe.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\FysIzDX.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\kCaoqZo.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\WETDJMy.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\CahtPjd.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\DxhuyDC.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\TkQYZtc.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\htHUnQA.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\fNNoNrV.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\TSrSXqo.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\AYsmUPA.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\Kuzqshi.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\VNJfyLK.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\wkvQvcn.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\iVYmNNh.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\kcSWYJM.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\FdushUc.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\BhojBLH.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\TLwiuzO.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\hUYCJRC.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\YjfzMct.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\OctMueb.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\wBvfQGr.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\xYMSUqB.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\WyjuZvt.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\TCGDaCe.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\WEqxOUU.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
732	powershell.exe
732	powershell.exe
732	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
Token: SeDebugPrivilege	732	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 732	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	82
PID 3768 wrote to memory of 732	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	82
PID 3768 wrote to memory of 792	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	83
PID 3768 wrote to memory of 792	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	83
PID 3768 wrote to memory of 5008	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	84
PID 3768 wrote to memory of 5008	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	84
PID 3768 wrote to memory of 3856	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	85
PID 3768 wrote to memory of 3856	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	85
PID 3768 wrote to memory of 324	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	86
PID 3768 wrote to memory of 324	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	86
PID 3768 wrote to memory of 4772	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	87
PID 3768 wrote to memory of 4772	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	87
PID 3768 wrote to memory of 4876	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	88
PID 3768 wrote to memory of 4876	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	88
PID 3768 wrote to memory of 4852	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	89
PID 3768 wrote to memory of 4852	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	89
PID 3768 wrote to memory of 4036	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	90
PID 3768 wrote to memory of 4036	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	90
PID 3768 wrote to memory of 448	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	91
PID 3768 wrote to memory of 448	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	91
PID 3768 wrote to memory of 1444	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	92
PID 3768 wrote to memory of 1444	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	92
PID 3768 wrote to memory of 2824	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	93
PID 3768 wrote to memory of 2824	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	93
PID 3768 wrote to memory of 3196	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	94
PID 3768 wrote to memory of 3196	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	94
PID 3768 wrote to memory of 4124	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	95
PID 3768 wrote to memory of 4124	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	95
PID 3768 wrote to memory of 4380	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	96
PID 3768 wrote to memory of 4380	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	96
PID 3768 wrote to memory of 3720	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	97
PID 3768 wrote to memory of 3720	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	97
PID 3768 wrote to memory of 4180	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	98
PID 3768 wrote to memory of 4180	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	98
PID 3768 wrote to memory of 4892	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	99
PID 3768 wrote to memory of 4892	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	99
PID 3768 wrote to memory of 796	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	100
PID 3768 wrote to memory of 796	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	100
PID 3768 wrote to memory of 4408	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	101
PID 3768 wrote to memory of 4408	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	101
PID 3768 wrote to memory of 720	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	102
PID 3768 wrote to memory of 720	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	102
PID 3768 wrote to memory of 3324	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	103
PID 3768 wrote to memory of 3324	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	103
PID 3768 wrote to memory of 1804	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	104
PID 3768 wrote to memory of 1804	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	104
PID 3768 wrote to memory of 4980	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	105
PID 3768 wrote to memory of 4980	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	105
PID 3768 wrote to memory of 952	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	106
PID 3768 wrote to memory of 952	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	106
PID 3768 wrote to memory of 3292	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	107
PID 3768 wrote to memory of 3292	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	107
PID 3768 wrote to memory of 1696	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	108
PID 3768 wrote to memory of 1696	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	108
PID 3768 wrote to memory of 1968	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	109
PID 3768 wrote to memory of 1968	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	109
PID 3768 wrote to memory of 4308	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	110
PID 3768 wrote to memory of 4308	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	110
PID 3768 wrote to memory of 1860	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	111
PID 3768 wrote to memory of 1860	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	111
PID 3768 wrote to memory of 3252	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	112
PID 3768 wrote to memory of 3252	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	112
PID 3768 wrote to memory of 2996	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	113
PID 3768 wrote to memory of 2996	3768	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:732
- C:\Windows\System\tsPINVa.exe
  C:\Windows\System\tsPINVa.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\UFrCZuo.exe
  C:\Windows\System\UFrCZuo.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\MaovCsr.exe
  C:\Windows\System\MaovCsr.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\cDrfQsJ.exe
  C:\Windows\System\cDrfQsJ.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\FlPshFd.exe
  C:\Windows\System\FlPshFd.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\fMuXZnB.exe
  C:\Windows\System\fMuXZnB.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\BGCZmrJ.exe
  C:\Windows\System\BGCZmrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\PAeTWKX.exe
  C:\Windows\System\PAeTWKX.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\WEqxOUU.exe
  C:\Windows\System\WEqxOUU.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\XKJkVdT.exe
  C:\Windows\System\XKJkVdT.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WZFhuyT.exe
  C:\Windows\System\WZFhuyT.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\tOYMVIH.exe
  C:\Windows\System\tOYMVIH.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\IUmzsvv.exe
  C:\Windows\System\IUmzsvv.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\rvvFSGZ.exe
  C:\Windows\System\rvvFSGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\BJYPPCi.exe
  C:\Windows\System\BJYPPCi.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\hCexRAc.exe
  C:\Windows\System\hCexRAc.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\TLwiuzO.exe
  C:\Windows\System\TLwiuzO.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\euQFXwP.exe
  C:\Windows\System\euQFXwP.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\DrOwHmC.exe
  C:\Windows\System\DrOwHmC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\mdKLzvs.exe
  C:\Windows\System\mdKLzvs.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\NZhGRIz.exe
  C:\Windows\System\NZhGRIz.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\iJMkZxu.exe
  C:\Windows\System\iJMkZxu.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\zuFvwcA.exe
  C:\Windows\System\zuFvwcA.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\oVohYjg.exe
  C:\Windows\System\oVohYjg.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\yCNRyVI.exe
  C:\Windows\System\yCNRyVI.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\HVKjZNe.exe
  C:\Windows\System\HVKjZNe.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\otMWnBh.exe
  C:\Windows\System\otMWnBh.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\CuAWnFH.exe
  C:\Windows\System\CuAWnFH.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\lTsDaQx.exe
  C:\Windows\System\lTsDaQx.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\ZCgWmlQ.exe
  C:\Windows\System\ZCgWmlQ.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\iDNZuYk.exe
  C:\Windows\System\iDNZuYk.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\aOctOBb.exe
  C:\Windows\System\aOctOBb.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\bYtyDdb.exe
  C:\Windows\System\bYtyDdb.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\zmaoLoU.exe
  C:\Windows\System\zmaoLoU.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ofxcSmy.exe
  C:\Windows\System\ofxcSmy.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\YmEhgRn.exe
  C:\Windows\System\YmEhgRn.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\hUYCJRC.exe
  C:\Windows\System\hUYCJRC.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\TskkiRr.exe
  C:\Windows\System\TskkiRr.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\KXPMtzO.exe
  C:\Windows\System\KXPMtzO.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\YXLhsLh.exe
  C:\Windows\System\YXLhsLh.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\ZoUYMPl.exe
  C:\Windows\System\ZoUYMPl.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\NxAPVqt.exe
  C:\Windows\System\NxAPVqt.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\wAlaSPM.exe
  C:\Windows\System\wAlaSPM.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\jgMALTp.exe
  C:\Windows\System\jgMALTp.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\WXfFwEO.exe
  C:\Windows\System\WXfFwEO.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\iiauKaQ.exe
  C:\Windows\System\iiauKaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\KwGNcqF.exe
  C:\Windows\System\KwGNcqF.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ZgzumAt.exe
  C:\Windows\System\ZgzumAt.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\fFbCwDz.exe
  C:\Windows\System\fFbCwDz.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\wqLobqA.exe
  C:\Windows\System\wqLobqA.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\kVJLTjc.exe
  C:\Windows\System\kVJLTjc.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\UElIAFo.exe
  C:\Windows\System\UElIAFo.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\acAqCln.exe
  C:\Windows\System\acAqCln.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MriTvjg.exe
  C:\Windows\System\MriTvjg.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\wKpKSgk.exe
  C:\Windows\System\wKpKSgk.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\poBdwJH.exe
  C:\Windows\System\poBdwJH.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\XXwdVaV.exe
  C:\Windows\System\XXwdVaV.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\HnNaret.exe
  C:\Windows\System\HnNaret.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\XBdJiJE.exe
  C:\Windows\System\XBdJiJE.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\DxhuyDC.exe
  C:\Windows\System\DxhuyDC.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\sipndOu.exe
  C:\Windows\System\sipndOu.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\wpiSkeq.exe
  C:\Windows\System\wpiSkeq.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\AMUqnQM.exe
  C:\Windows\System\AMUqnQM.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\XHkDIyz.exe
  C:\Windows\System\XHkDIyz.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\OKpKWJG.exe
  C:\Windows\System\OKpKWJG.exe
  2⤵
  PID:2064
- C:\Windows\System\uXXSrcf.exe
  C:\Windows\System\uXXSrcf.exe
  2⤵
  PID:4356
- C:\Windows\System\hMYxswF.exe
  C:\Windows\System\hMYxswF.exe
  2⤵
  PID:2432
- C:\Windows\System\cQKxZvs.exe
  C:\Windows\System\cQKxZvs.exe
  2⤵
  PID:3668
- C:\Windows\System\ByewLPx.exe
  C:\Windows\System\ByewLPx.exe
  2⤵
  PID:2588
- C:\Windows\System\TCnudwb.exe
  C:\Windows\System\TCnudwb.exe
  2⤵
  PID:4624
- C:\Windows\System\bIcFFpF.exe
  C:\Windows\System\bIcFFpF.exe
  2⤵
  PID:2088
- C:\Windows\System\oxDLdel.exe
  C:\Windows\System\oxDLdel.exe
  2⤵
  PID:4052
- C:\Windows\System\ujkKlnF.exe
  C:\Windows\System\ujkKlnF.exe
  2⤵
  PID:1000
- C:\Windows\System\SGJPXyU.exe
  C:\Windows\System\SGJPXyU.exe
  2⤵
  PID:5144
- C:\Windows\System\OdeYqlQ.exe
  C:\Windows\System\OdeYqlQ.exe
  2⤵
  PID:5168
- C:\Windows\System\xEdJZhU.exe
  C:\Windows\System\xEdJZhU.exe
  2⤵
  PID:5200
- C:\Windows\System\OPGIGkQ.exe
  C:\Windows\System\OPGIGkQ.exe
  2⤵
  PID:5224
- C:\Windows\System\fprCMkP.exe
  C:\Windows\System\fprCMkP.exe
  2⤵
  PID:5252
- C:\Windows\System\pDpUhQx.exe
  C:\Windows\System\pDpUhQx.exe
  2⤵
  PID:5284
- C:\Windows\System\rojprVX.exe
  C:\Windows\System\rojprVX.exe
  2⤵
  PID:5308
- C:\Windows\System\qjpjSBp.exe
  C:\Windows\System\qjpjSBp.exe
  2⤵
  PID:5336
- C:\Windows\System\iFTqrWv.exe
  C:\Windows\System\iFTqrWv.exe
  2⤵
  PID:5368
- C:\Windows\System\kVQdrhy.exe
  C:\Windows\System\kVQdrhy.exe
  2⤵
  PID:5396
- C:\Windows\System\lfnOsOB.exe
  C:\Windows\System\lfnOsOB.exe
  2⤵
  PID:5424
- C:\Windows\System\OvLPFmO.exe
  C:\Windows\System\OvLPFmO.exe
  2⤵
  PID:5448
- C:\Windows\System\lhEHAPL.exe
  C:\Windows\System\lhEHAPL.exe
  2⤵
  PID:5476
- C:\Windows\System\TkQYZtc.exe
  C:\Windows\System\TkQYZtc.exe
  2⤵
  PID:5504
- C:\Windows\System\zAJvayO.exe
  C:\Windows\System\zAJvayO.exe
  2⤵
  PID:5532
- C:\Windows\System\NxwWBbx.exe
  C:\Windows\System\NxwWBbx.exe
  2⤵
  PID:5564
- C:\Windows\System\CYSZKMD.exe
  C:\Windows\System\CYSZKMD.exe
  2⤵
  PID:5592
- C:\Windows\System\ksCNDuO.exe
  C:\Windows\System\ksCNDuO.exe
  2⤵
  PID:5620
- C:\Windows\System\hjJCnhw.exe
  C:\Windows\System\hjJCnhw.exe
  2⤵
  PID:5648
- C:\Windows\System\RXHmMJG.exe
  C:\Windows\System\RXHmMJG.exe
  2⤵
  PID:5676
- C:\Windows\System\TwhwSvG.exe
  C:\Windows\System\TwhwSvG.exe
  2⤵
  PID:5700
- C:\Windows\System\LQVxyAa.exe
  C:\Windows\System\LQVxyAa.exe
  2⤵
  PID:5728
- C:\Windows\System\FwkBmJJ.exe
  C:\Windows\System\FwkBmJJ.exe
  2⤵
  PID:5764
- C:\Windows\System\GpjQqzg.exe
  C:\Windows\System\GpjQqzg.exe
  2⤵
  PID:5800
- C:\Windows\System\vhnlEIZ.exe
  C:\Windows\System\vhnlEIZ.exe
  2⤵
  PID:5824
- C:\Windows\System\rGRCsFq.exe
  C:\Windows\System\rGRCsFq.exe
  2⤵
  PID:5852
- C:\Windows\System\hvvLHuw.exe
  C:\Windows\System\hvvLHuw.exe
  2⤵
  PID:5880
- C:\Windows\System\ZwSCxXK.exe
  C:\Windows\System\ZwSCxXK.exe
  2⤵
  PID:5908
- C:\Windows\System\VNJfyLK.exe
  C:\Windows\System\VNJfyLK.exe
  2⤵
  PID:5936
- C:\Windows\System\YjfzMct.exe
  C:\Windows\System\YjfzMct.exe
  2⤵
  PID:5964
- C:\Windows\System\XJVvuRi.exe
  C:\Windows\System\XJVvuRi.exe
  2⤵
  PID:5992
- C:\Windows\System\lpMnEZU.exe
  C:\Windows\System\lpMnEZU.exe
  2⤵
  PID:6020
- C:\Windows\System\htTlsbB.exe
  C:\Windows\System\htTlsbB.exe
  2⤵
  PID:6052
- C:\Windows\System\srRVHuR.exe
  C:\Windows\System\srRVHuR.exe
  2⤵
  PID:6084
- C:\Windows\System\TAHfYvF.exe
  C:\Windows\System\TAHfYvF.exe
  2⤵
  PID:6112
- C:\Windows\System\DDEAWLZ.exe
  C:\Windows\System\DDEAWLZ.exe
  2⤵
  PID:488
- C:\Windows\System\JyMSokp.exe
  C:\Windows\System\JyMSokp.exe
  2⤵
  PID:4472
- C:\Windows\System\nKfDZFI.exe
  C:\Windows\System\nKfDZFI.exe
  2⤵
  PID:4648
- C:\Windows\System\EBTSWpc.exe
  C:\Windows\System\EBTSWpc.exe
  2⤵
  PID:3588
- C:\Windows\System\rxQUKCQ.exe
  C:\Windows\System\rxQUKCQ.exe
  2⤵
  PID:4264
- C:\Windows\System\fbozbaW.exe
  C:\Windows\System\fbozbaW.exe
  2⤵
  PID:5156
- C:\Windows\System\LsLBmHi.exe
  C:\Windows\System\LsLBmHi.exe
  2⤵
  PID:5220
- C:\Windows\System\pyRTMZK.exe
  C:\Windows\System\pyRTMZK.exe
  2⤵
  PID:5296
- C:\Windows\System\MkMmjmp.exe
  C:\Windows\System\MkMmjmp.exe
  2⤵
  PID:5356
- C:\Windows\System\AYSCMSH.exe
  C:\Windows\System\AYSCMSH.exe
  2⤵
  PID:5416
- C:\Windows\System\Iyudzkw.exe
  C:\Windows\System\Iyudzkw.exe
  2⤵
  PID:5492
- C:\Windows\System\iIXkFTr.exe
  C:\Windows\System\iIXkFTr.exe
  2⤵
  PID:5552
- C:\Windows\System\WkMZYXZ.exe
  C:\Windows\System\WkMZYXZ.exe
  2⤵
  PID:5612
- C:\Windows\System\yJBHWle.exe
  C:\Windows\System\yJBHWle.exe
  2⤵
  PID:5688
- C:\Windows\System\qXieXaV.exe
  C:\Windows\System\qXieXaV.exe
  2⤵
  PID:5756
- C:\Windows\System\dVwNOKy.exe
  C:\Windows\System\dVwNOKy.exe
  2⤵
  PID:5820
- C:\Windows\System\eDBYugY.exe
  C:\Windows\System\eDBYugY.exe
  2⤵
  PID:5896
- C:\Windows\System\hAxWZCb.exe
  C:\Windows\System\hAxWZCb.exe
  2⤵
  PID:5956
- C:\Windows\System\PtrLlZP.exe
  C:\Windows\System\PtrLlZP.exe
  2⤵
  PID:1728
- C:\Windows\System\LUivJWg.exe
  C:\Windows\System\LUivJWg.exe
  2⤵
  PID:6068
- C:\Windows\System\STvtswY.exe
  C:\Windows\System\STvtswY.exe
  2⤵
  PID:6132
- C:\Windows\System\hzBFPeO.exe
  C:\Windows\System\hzBFPeO.exe
  2⤵
  PID:1116
- C:\Windows\System\StpleUn.exe
  C:\Windows\System\StpleUn.exe
  2⤵
  PID:4076
- C:\Windows\System\CkxPbRF.exe
  C:\Windows\System\CkxPbRF.exe
  2⤵
  PID:5192
- C:\Windows\System\WiLvjxl.exe
  C:\Windows\System\WiLvjxl.exe
  2⤵
  PID:5332
- C:\Windows\System\jnoujXb.exe
  C:\Windows\System\jnoujXb.exe
  2⤵
  PID:5520
- C:\Windows\System\EHnuzGv.exe
  C:\Windows\System\EHnuzGv.exe
  2⤵
  PID:5660
- C:\Windows\System\RECVeib.exe
  C:\Windows\System\RECVeib.exe
  2⤵
  PID:5812
- C:\Windows\System\yqTcIBX.exe
  C:\Windows\System\yqTcIBX.exe
  2⤵
  PID:5932
- C:\Windows\System\bhnEzsb.exe
  C:\Windows\System\bhnEzsb.exe
  2⤵
  PID:6100
- C:\Windows\System\zEKrNpI.exe
  C:\Windows\System\zEKrNpI.exe
  2⤵
  PID:6148
- C:\Windows\System\ddWirhD.exe
  C:\Windows\System\ddWirhD.exe
  2⤵
  PID:6176
- C:\Windows\System\xvHccQx.exe
  C:\Windows\System\xvHccQx.exe
  2⤵
  PID:6204
- C:\Windows\System\VyUdmJW.exe
  C:\Windows\System\VyUdmJW.exe
  2⤵
  PID:6232
- C:\Windows\System\PttnoFd.exe
  C:\Windows\System\PttnoFd.exe
  2⤵
  PID:6260
- C:\Windows\System\OnakwCx.exe
  C:\Windows\System\OnakwCx.exe
  2⤵
  PID:6288
- C:\Windows\System\TQONOaj.exe
  C:\Windows\System\TQONOaj.exe
  2⤵
  PID:6316
- C:\Windows\System\HrALmUi.exe
  C:\Windows\System\HrALmUi.exe
  2⤵
  PID:6344
- C:\Windows\System\pFCFZPu.exe
  C:\Windows\System\pFCFZPu.exe
  2⤵
  PID:6372
- C:\Windows\System\XdriiPH.exe
  C:\Windows\System\XdriiPH.exe
  2⤵
  PID:6400
- C:\Windows\System\DLdHjLk.exe
  C:\Windows\System\DLdHjLk.exe
  2⤵
  PID:6428
- C:\Windows\System\qmMOzgv.exe
  C:\Windows\System\qmMOzgv.exe
  2⤵
  PID:6456
- C:\Windows\System\izGJvgr.exe
  C:\Windows\System\izGJvgr.exe
  2⤵
  PID:6484
- C:\Windows\System\DRHzxCQ.exe
  C:\Windows\System\DRHzxCQ.exe
  2⤵
  PID:6512
- C:\Windows\System\rYSVzLk.exe
  C:\Windows\System\rYSVzLk.exe
  2⤵
  PID:6540
- C:\Windows\System\yldxCLg.exe
  C:\Windows\System\yldxCLg.exe
  2⤵
  PID:6568
- C:\Windows\System\vAiSuaD.exe
  C:\Windows\System\vAiSuaD.exe
  2⤵
  PID:6596
- C:\Windows\System\rdOEfXg.exe
  C:\Windows\System\rdOEfXg.exe
  2⤵
  PID:6624
- C:\Windows\System\WtwQgFL.exe
  C:\Windows\System\WtwQgFL.exe
  2⤵
  PID:6652
- C:\Windows\System\LWFKYeu.exe
  C:\Windows\System\LWFKYeu.exe
  2⤵
  PID:6680
- C:\Windows\System\ThkPeTS.exe
  C:\Windows\System\ThkPeTS.exe
  2⤵
  PID:6708
- C:\Windows\System\tsdZtFq.exe
  C:\Windows\System\tsdZtFq.exe
  2⤵
  PID:6736
- C:\Windows\System\jrZcaTb.exe
  C:\Windows\System\jrZcaTb.exe
  2⤵
  PID:6764
- C:\Windows\System\kuJukgi.exe
  C:\Windows\System\kuJukgi.exe
  2⤵
  PID:6792
- C:\Windows\System\WUYkBzi.exe
  C:\Windows\System\WUYkBzi.exe
  2⤵
  PID:6820
- C:\Windows\System\EYqWAUt.exe
  C:\Windows\System\EYqWAUt.exe
  2⤵
  PID:6848
- C:\Windows\System\GLZlnKt.exe
  C:\Windows\System\GLZlnKt.exe
  2⤵
  PID:6876
- C:\Windows\System\JXaghoK.exe
  C:\Windows\System\JXaghoK.exe
  2⤵
  PID:6904
- C:\Windows\System\scrfTLq.exe
  C:\Windows\System\scrfTLq.exe
  2⤵
  PID:6932
- C:\Windows\System\PqgbezR.exe
  C:\Windows\System\PqgbezR.exe
  2⤵
  PID:6956
- C:\Windows\System\EyoAYmJ.exe
  C:\Windows\System\EyoAYmJ.exe
  2⤵
  PID:6988
- C:\Windows\System\aqzeORV.exe
  C:\Windows\System\aqzeORV.exe
  2⤵
  PID:7016
- C:\Windows\System\ygDXUWM.exe
  C:\Windows\System\ygDXUWM.exe
  2⤵
  PID:7044
- C:\Windows\System\qPaPWyK.exe
  C:\Windows\System\qPaPWyK.exe
  2⤵
  PID:7072
- C:\Windows\System\UMWmThQ.exe
  C:\Windows\System\UMWmThQ.exe
  2⤵
  PID:7100
- C:\Windows\System\aaubXIj.exe
  C:\Windows\System\aaubXIj.exe
  2⤵
  PID:7128
- C:\Windows\System\ugvmuDa.exe
  C:\Windows\System\ugvmuDa.exe
  2⤵
  PID:7156
- C:\Windows\System\nLEUwai.exe
  C:\Windows\System\nLEUwai.exe
  2⤵
  PID:5132
- C:\Windows\System\mehuUsO.exe
  C:\Windows\System\mehuUsO.exe
  2⤵
  PID:5584
- C:\Windows\System\mNVSlPG.exe
  C:\Windows\System\mNVSlPG.exe
  2⤵
  PID:5988
- C:\Windows\System\nFiPTED.exe
  C:\Windows\System\nFiPTED.exe
  2⤵
  PID:1856
- C:\Windows\System\AYoEYLd.exe
  C:\Windows\System\AYoEYLd.exe
  2⤵
  PID:6196
- C:\Windows\System\yzKaCAw.exe
  C:\Windows\System\yzKaCAw.exe
  2⤵
  PID:6272
- C:\Windows\System\OUKimsL.exe
  C:\Windows\System\OUKimsL.exe
  2⤵
  PID:6328
- C:\Windows\System\XXOVSld.exe
  C:\Windows\System\XXOVSld.exe
  2⤵
  PID:6388
- C:\Windows\System\MqGTYZv.exe
  C:\Windows\System\MqGTYZv.exe
  2⤵
  PID:6444
- C:\Windows\System\rtYePeD.exe
  C:\Windows\System\rtYePeD.exe
  2⤵
  PID:6500
- C:\Windows\System\CVqnHor.exe
  C:\Windows\System\CVqnHor.exe
  2⤵
  PID:6560
- C:\Windows\System\XLJrvSJ.exe
  C:\Windows\System\XLJrvSJ.exe
  2⤵
  PID:6616
- C:\Windows\System\rcCubfE.exe
  C:\Windows\System\rcCubfE.exe
  2⤵
  PID:6692
- C:\Windows\System\tybDhXT.exe
  C:\Windows\System\tybDhXT.exe
  2⤵
  PID:6748
- C:\Windows\System\pIfEbBS.exe
  C:\Windows\System\pIfEbBS.exe
  2⤵
  PID:4508
- C:\Windows\System\cyjaxIL.exe
  C:\Windows\System\cyjaxIL.exe
  2⤵
  PID:6864
- C:\Windows\System\nrGTlaN.exe
  C:\Windows\System\nrGTlaN.exe
  2⤵
  PID:6924
- C:\Windows\System\cRcdWNT.exe
  C:\Windows\System\cRcdWNT.exe
  2⤵
  PID:3044
- C:\Windows\System\EdozGJV.exe
  C:\Windows\System\EdozGJV.exe
  2⤵
  PID:7056
- C:\Windows\System\oXsAaBo.exe
  C:\Windows\System\oXsAaBo.exe
  2⤵
  PID:932
- C:\Windows\System\zhgrmEE.exe
  C:\Windows\System\zhgrmEE.exe
  2⤵
  PID:3488
- C:\Windows\System\zLtSXYI.exe
  C:\Windows\System\zLtSXYI.exe
  2⤵
  PID:5464
- C:\Windows\System\JNNLhoo.exe
  C:\Windows\System\JNNLhoo.exe
  2⤵
  PID:6168
- C:\Windows\System\fedBLsb.exe
  C:\Windows\System\fedBLsb.exe
  2⤵
  PID:5012
- C:\Windows\System\rGDfOhZ.exe
  C:\Windows\System\rGDfOhZ.exe
  2⤵
  PID:1276
- C:\Windows\System\vhgHhwf.exe
  C:\Windows\System\vhgHhwf.exe
  2⤵
  PID:6528
- C:\Windows\System\gJjZTSD.exe
  C:\Windows\System\gJjZTSD.exe
  2⤵
  PID:6664
- C:\Windows\System\wkvQvcn.exe
  C:\Windows\System\wkvQvcn.exe
  2⤵
  PID:6780
- C:\Windows\System\PfiJBCT.exe
  C:\Windows\System\PfiJBCT.exe
  2⤵
  PID:6896
- C:\Windows\System\khaIHhF.exe
  C:\Windows\System\khaIHhF.exe
  2⤵
  PID:4848
- C:\Windows\System\hMkYJwz.exe
  C:\Windows\System\hMkYJwz.exe
  2⤵
  PID:7088
- C:\Windows\System\MfdffYf.exe
  C:\Windows\System\MfdffYf.exe
  2⤵
  PID:2392
- C:\Windows\System\NtaCvnT.exe
  C:\Windows\System\NtaCvnT.exe
  2⤵
  PID:5020
- C:\Windows\System\XoXEmIG.exe
  C:\Windows\System\XoXEmIG.exe
  2⤵
  PID:6248
- C:\Windows\System\YOrXYCE.exe
  C:\Windows\System\YOrXYCE.exe
  2⤵
  PID:3460
- C:\Windows\System\XfnEOhJ.exe
  C:\Windows\System\XfnEOhJ.exe
  2⤵
  PID:6976
- C:\Windows\System\zjeKtKr.exe
  C:\Windows\System\zjeKtKr.exe
  2⤵
  PID:2584
- C:\Windows\System\ONaWwUX.exe
  C:\Windows\System\ONaWwUX.exe
  2⤵
  PID:1732
- C:\Windows\System\lKkmTjg.exe
  C:\Windows\System\lKkmTjg.exe
  2⤵
  PID:5016
- C:\Windows\System\gGIUGZP.exe
  C:\Windows\System\gGIUGZP.exe
  2⤵
  PID:6588
- C:\Windows\System\XIvHkeZ.exe
  C:\Windows\System\XIvHkeZ.exe
  2⤵
  PID:3340
- C:\Windows\System\zvLdXpo.exe
  C:\Windows\System\zvLdXpo.exe
  2⤵
  PID:1088
- C:\Windows\System\yQFxtCc.exe
  C:\Windows\System\yQFxtCc.exe
  2⤵
  PID:3640
- C:\Windows\System\sTDGXrD.exe
  C:\Windows\System\sTDGXrD.exe
  2⤵
  PID:2804
- C:\Windows\System\krOzxAR.exe
  C:\Windows\System\krOzxAR.exe
  2⤵
  PID:6244
- C:\Windows\System\AFKFOWH.exe
  C:\Windows\System\AFKFOWH.exe
  2⤵
  PID:1452
- C:\Windows\System\nsZGCXL.exe
  C:\Windows\System\nsZGCXL.exe
  2⤵
  PID:4000
- C:\Windows\System\pGTOwDD.exe
  C:\Windows\System\pGTOwDD.exe
  2⤵
  PID:7200
- C:\Windows\System\VmssGuy.exe
  C:\Windows\System\VmssGuy.exe
  2⤵
  PID:7324
- C:\Windows\System\upqcDtX.exe
  C:\Windows\System\upqcDtX.exe
  2⤵
  PID:7388
- C:\Windows\System\FFdqmAz.exe
  C:\Windows\System\FFdqmAz.exe
  2⤵
  PID:7408
- C:\Windows\System\bvLpUNF.exe
  C:\Windows\System\bvLpUNF.exe
  2⤵
  PID:7444
- C:\Windows\System\iVYmNNh.exe
  C:\Windows\System\iVYmNNh.exe
  2⤵
  PID:7476
- C:\Windows\System\zLOHzsM.exe
  C:\Windows\System\zLOHzsM.exe
  2⤵
  PID:7500
- C:\Windows\System\lkqFOGd.exe
  C:\Windows\System\lkqFOGd.exe
  2⤵
  PID:7544
- C:\Windows\System\idTorkJ.exe
  C:\Windows\System\idTorkJ.exe
  2⤵
  PID:7580
- C:\Windows\System\rFyelFR.exe
  C:\Windows\System\rFyelFR.exe
  2⤵
  PID:7616
- C:\Windows\System\lrrygEI.exe
  C:\Windows\System\lrrygEI.exe
  2⤵
  PID:7636
- C:\Windows\System\jSWCebo.exe
  C:\Windows\System\jSWCebo.exe
  2⤵
  PID:7664
- C:\Windows\System\jYbBXdU.exe
  C:\Windows\System\jYbBXdU.exe
  2⤵
  PID:7688
- C:\Windows\System\vfgQgWO.exe
  C:\Windows\System\vfgQgWO.exe
  2⤵
  PID:7716
- C:\Windows\System\xgGHOEa.exe
  C:\Windows\System\xgGHOEa.exe
  2⤵
  PID:7736
- C:\Windows\System\GeUZOtf.exe
  C:\Windows\System\GeUZOtf.exe
  2⤵
  PID:7780
- C:\Windows\System\gGfTDPo.exe
  C:\Windows\System\gGfTDPo.exe
  2⤵
  PID:7816
- C:\Windows\System\WwgSFww.exe
  C:\Windows\System\WwgSFww.exe
  2⤵
  PID:7840
- C:\Windows\System\nXBenDa.exe
  C:\Windows\System\nXBenDa.exe
  2⤵
  PID:7860
- C:\Windows\System\hCJrvDP.exe
  C:\Windows\System\hCJrvDP.exe
  2⤵
  PID:7908
- C:\Windows\System\jAQEjIQ.exe
  C:\Windows\System\jAQEjIQ.exe
  2⤵
  PID:7940
- C:\Windows\System\aGsphEC.exe
  C:\Windows\System\aGsphEC.exe
  2⤵
  PID:7968
- C:\Windows\System\MMxNlJC.exe
  C:\Windows\System\MMxNlJC.exe
  2⤵
  PID:7996
- C:\Windows\System\XJSrkoR.exe
  C:\Windows\System\XJSrkoR.exe
  2⤵
  PID:8024
- C:\Windows\System\kcSWYJM.exe
  C:\Windows\System\kcSWYJM.exe
  2⤵
  PID:8052
- C:\Windows\System\buTcybO.exe
  C:\Windows\System\buTcybO.exe
  2⤵
  PID:8080
- C:\Windows\System\fizwHbG.exe
  C:\Windows\System\fizwHbG.exe
  2⤵
  PID:8108
- C:\Windows\System\aXtiAfz.exe
  C:\Windows\System\aXtiAfz.exe
  2⤵
  PID:8136
- C:\Windows\System\fVNTqHW.exe
  C:\Windows\System\fVNTqHW.exe
  2⤵
  PID:8172
- C:\Windows\System\KMlXUSg.exe
  C:\Windows\System\KMlXUSg.exe
  2⤵
  PID:3548
- C:\Windows\System\FXqaDex.exe
  C:\Windows\System\FXqaDex.exe
  2⤵
  PID:2668
- C:\Windows\System\QwdSdFu.exe
  C:\Windows\System\QwdSdFu.exe
  2⤵
  PID:7196
- C:\Windows\System\oUiNwma.exe
  C:\Windows\System\oUiNwma.exe
  2⤵
  PID:7244
- C:\Windows\System\okEdvvy.exe
  C:\Windows\System\okEdvvy.exe
  2⤵
  PID:3560
- C:\Windows\System\hvBCZAx.exe
  C:\Windows\System\hvBCZAx.exe
  2⤵
  PID:3988
- C:\Windows\System\jpIpUTr.exe
  C:\Windows\System\jpIpUTr.exe
  2⤵
  PID:7216
- C:\Windows\System\bUxbwlh.exe
  C:\Windows\System\bUxbwlh.exe
  2⤵
  PID:7332
- C:\Windows\System\muSIhqY.exe
  C:\Windows\System\muSIhqY.exe
  2⤵
  PID:7424
- C:\Windows\System\UTMbVij.exe
  C:\Windows\System\UTMbVij.exe
  2⤵
  PID:7524
- C:\Windows\System\BmSiMoo.exe
  C:\Windows\System\BmSiMoo.exe
  2⤵
  PID:7572
- C:\Windows\System\htHUnQA.exe
  C:\Windows\System\htHUnQA.exe
  2⤵
  PID:7632
- C:\Windows\System\aCdssyC.exe
  C:\Windows\System\aCdssyC.exe
  2⤵
  PID:7728
- C:\Windows\System\oEukGet.exe
  C:\Windows\System\oEukGet.exe
  2⤵
  PID:7808
- C:\Windows\System\VUohQMq.exe
  C:\Windows\System\VUohQMq.exe
  2⤵
  PID:7868
- C:\Windows\System\KvVFzkm.exe
  C:\Windows\System\KvVFzkm.exe
  2⤵
  PID:7952
- C:\Windows\System\TFqAjmN.exe
  C:\Windows\System\TFqAjmN.exe
  2⤵
  PID:8128
- C:\Windows\System\YuvWqaV.exe
  C:\Windows\System\YuvWqaV.exe
  2⤵
  PID:4176
- C:\Windows\System\AWPFxxW.exe
  C:\Windows\System\AWPFxxW.exe
  2⤵
  PID:7352
- C:\Windows\System\bhNPHBq.exe
  C:\Windows\System\bhNPHBq.exe
  2⤵
  PID:6028
- C:\Windows\System\tpAzJMg.exe
  C:\Windows\System\tpAzJMg.exe
  2⤵
  PID:7432
- C:\Windows\System\utXdItW.exe
  C:\Windows\System\utXdItW.exe
  2⤵
  PID:7468
- C:\Windows\System\KEbeJVr.exe
  C:\Windows\System\KEbeJVr.exe
  2⤵
  PID:7920
- C:\Windows\System\KvduhgY.exe
  C:\Windows\System\KvduhgY.exe
  2⤵
  PID:8072
- C:\Windows\System\fNNoNrV.exe
  C:\Windows\System\fNNoNrV.exe
  2⤵
  PID:8156
- C:\Windows\System\QVkBwuY.exe
  C:\Windows\System\QVkBwuY.exe
  2⤵
  PID:7320
- C:\Windows\System\wDHIAgC.exe
  C:\Windows\System\wDHIAgC.exe
  2⤵
  PID:8152
- C:\Windows\System\FdushUc.exe
  C:\Windows\System\FdushUc.exe
  2⤵
  PID:7936
- C:\Windows\System\kldSVGK.exe
  C:\Windows\System\kldSVGK.exe
  2⤵
  PID:7212
- C:\Windows\System\GSslrJy.exe
  C:\Windows\System\GSslrJy.exe
  2⤵
  PID:6724
- C:\Windows\System\HSqrrBw.exe
  C:\Windows\System\HSqrrBw.exe
  2⤵
  PID:7712
- C:\Windows\System\lNayTUs.exe
  C:\Windows\System\lNayTUs.exe
  2⤵
  PID:7396
- C:\Windows\System\LNGTiqv.exe
  C:\Windows\System\LNGTiqv.exe
  2⤵
  PID:8008
- C:\Windows\System\GfKSLPP.exe
  C:\Windows\System\GfKSLPP.exe
  2⤵
  PID:8020
- C:\Windows\System\wWJPBfW.exe
  C:\Windows\System\wWJPBfW.exe
  2⤵
  PID:8216
- C:\Windows\System\GLSrKla.exe
  C:\Windows\System\GLSrKla.exe
  2⤵
  PID:8260
- C:\Windows\System\SilaJGz.exe
  C:\Windows\System\SilaJGz.exe
  2⤵
  PID:8288
- C:\Windows\System\pXneVlZ.exe
  C:\Windows\System\pXneVlZ.exe
  2⤵
  PID:8348
- C:\Windows\System\Xuuojtv.exe
  C:\Windows\System\Xuuojtv.exe
  2⤵
  PID:8364
- C:\Windows\System\sxBuKMw.exe
  C:\Windows\System\sxBuKMw.exe
  2⤵
  PID:8420
- C:\Windows\System\zaGXGoW.exe
  C:\Windows\System\zaGXGoW.exe
  2⤵
  PID:8472
- C:\Windows\System\FysIzDX.exe
  C:\Windows\System\FysIzDX.exe
  2⤵
  PID:8512
- C:\Windows\System\XSfszqh.exe
  C:\Windows\System\XSfszqh.exe
  2⤵
  PID:8564
- C:\Windows\System\rqvKvEs.exe
  C:\Windows\System\rqvKvEs.exe
  2⤵
  PID:8592
- C:\Windows\System\QyZxvvc.exe
  C:\Windows\System\QyZxvvc.exe
  2⤵
  PID:8644
- C:\Windows\System\VsblpVN.exe
  C:\Windows\System\VsblpVN.exe
  2⤵
  PID:8672
- C:\Windows\System\hQqKpKL.exe
  C:\Windows\System\hQqKpKL.exe
  2⤵
  PID:8712
- C:\Windows\System\BulJkRn.exe
  C:\Windows\System\BulJkRn.exe
  2⤵
  PID:8752
- C:\Windows\System\DTBSLxj.exe
  C:\Windows\System\DTBSLxj.exe
  2⤵
  PID:8784
- C:\Windows\System\MRDXwTA.exe
  C:\Windows\System\MRDXwTA.exe
  2⤵
  PID:8844
- C:\Windows\System\kCaoqZo.exe
  C:\Windows\System\kCaoqZo.exe
  2⤵
  PID:8884
- C:\Windows\System\hsDoVFt.exe
  C:\Windows\System\hsDoVFt.exe
  2⤵
  PID:8920
- C:\Windows\System\yzlSApR.exe
  C:\Windows\System\yzlSApR.exe
  2⤵
  PID:8940
- C:\Windows\System\rQNbrhP.exe
  C:\Windows\System\rQNbrhP.exe
  2⤵
  PID:9012
- C:\Windows\System\CBGEOfb.exe
  C:\Windows\System\CBGEOfb.exe
  2⤵
  PID:9056
- C:\Windows\System\UlqouJZ.exe
  C:\Windows\System\UlqouJZ.exe
  2⤵
  PID:9076
- C:\Windows\System\WkjUDGg.exe
  C:\Windows\System\WkjUDGg.exe
  2⤵
  PID:9124
- C:\Windows\System\jsKuWbT.exe
  C:\Windows\System\jsKuWbT.exe
  2⤵
  PID:9164
- C:\Windows\System\zORZbqE.exe
  C:\Windows\System\zORZbqE.exe
  2⤵
  PID:8228
- C:\Windows\System\sdZYkDU.exe
  C:\Windows\System\sdZYkDU.exe
  2⤵
  PID:8284
- C:\Windows\System\uVhsWlh.exe
  C:\Windows\System\uVhsWlh.exe
  2⤵
  PID:8304
- C:\Windows\System\ZbGQbqT.exe
  C:\Windows\System\ZbGQbqT.exe
  2⤵
  PID:8432
- C:\Windows\System\LsJQiyr.exe
  C:\Windows\System\LsJQiyr.exe
  2⤵
  PID:8412
- C:\Windows\System\hunmLcp.exe
  C:\Windows\System\hunmLcp.exe
  2⤵
  PID:8548
- C:\Windows\System\dgiSCXu.exe
  C:\Windows\System\dgiSCXu.exe
  2⤵
  PID:8576
- C:\Windows\System\aKDYgZX.exe
  C:\Windows\System\aKDYgZX.exe
  2⤵
  PID:8696
- C:\Windows\System\lMuqkQY.exe
  C:\Windows\System\lMuqkQY.exe
  2⤵
  PID:8744
- C:\Windows\System\mtAmZRJ.exe
  C:\Windows\System\mtAmZRJ.exe
  2⤵
  PID:8840
- C:\Windows\System\JMrWAHa.exe
  C:\Windows\System\JMrWAHa.exe
  2⤵
  PID:8868
- C:\Windows\System\VtKUdin.exe
  C:\Windows\System\VtKUdin.exe
  2⤵
  PID:8980
- C:\Windows\System\wgPpAFB.exe
  C:\Windows\System\wgPpAFB.exe
  2⤵
  PID:9040
- C:\Windows\System\SLjhCKt.exe
  C:\Windows\System\SLjhCKt.exe
  2⤵
  PID:9064
- C:\Windows\System\dkYVRSi.exe
  C:\Windows\System\dkYVRSi.exe
  2⤵
  PID:9160
- C:\Windows\System\yNasdxZ.exe
  C:\Windows\System\yNasdxZ.exe
  2⤵
  PID:9208
- C:\Windows\System\RsSBzhw.exe
  C:\Windows\System\RsSBzhw.exe
  2⤵
  PID:8212
- C:\Windows\System\hQwxTDP.exe
  C:\Windows\System\hQwxTDP.exe
  2⤵
  PID:8440
- C:\Windows\System\VktoeSX.exe
  C:\Windows\System\VktoeSX.exe
  2⤵
  PID:8540
- C:\Windows\System\fjDCTOY.exe
  C:\Windows\System\fjDCTOY.exe
  2⤵
  PID:8628
- C:\Windows\System\zZrktfV.exe
  C:\Windows\System\zZrktfV.exe
  2⤵
  PID:8820
- C:\Windows\System\BAVtukh.exe
  C:\Windows\System\BAVtukh.exe
  2⤵
  PID:8964
- C:\Windows\System\SXWhCAl.exe
  C:\Windows\System\SXWhCAl.exe
  2⤵
  PID:9084
- C:\Windows\System\VBZEDPx.exe
  C:\Windows\System\VBZEDPx.exe
  2⤵
  PID:9116
- C:\Windows\System\WETDJMy.exe
  C:\Windows\System\WETDJMy.exe
  2⤵
  PID:8248
- C:\Windows\System\BDZdHIA.exe
  C:\Windows\System\BDZdHIA.exe
  2⤵
  PID:8340
- C:\Windows\System\CbMfaKN.exe
  C:\Windows\System\CbMfaKN.exe
  2⤵
  PID:8536
- C:\Windows\System\ryiCSUo.exe
  C:\Windows\System\ryiCSUo.exe
  2⤵
  PID:8812
- C:\Windows\System\YUVUkXw.exe
  C:\Windows\System\YUVUkXw.exe
  2⤵
  PID:8956
- C:\Windows\System\OBlAnur.exe
  C:\Windows\System\OBlAnur.exe
  2⤵
  PID:9196
- C:\Windows\System\wTowdPE.exe
  C:\Windows\System\wTowdPE.exe
  2⤵
  PID:8300
- C:\Windows\System\YvsKGQW.exe
  C:\Windows\System\YvsKGQW.exe
  2⤵
  PID:8468
- C:\Windows\System\tsOWqzO.exe
  C:\Windows\System\tsOWqzO.exe
  2⤵
  PID:8640
- C:\Windows\System\kQfxxNn.exe
  C:\Windows\System\kQfxxNn.exe
  2⤵
  PID:9100
- C:\Windows\System\BhojBLH.exe
  C:\Windows\System\BhojBLH.exe
  2⤵
  PID:9228
- C:\Windows\System\IxVXobe.exe
  C:\Windows\System\IxVXobe.exe
  2⤵
  PID:9264
- C:\Windows\System\MlCNXho.exe
  C:\Windows\System\MlCNXho.exe
  2⤵
  PID:9284
- C:\Windows\System\XUrAelf.exe
  C:\Windows\System\XUrAelf.exe
  2⤵
  PID:9316
- C:\Windows\System\VjVMtCP.exe
  C:\Windows\System\VjVMtCP.exe
  2⤵
  PID:9332
- C:\Windows\System\VcARjAT.exe
  C:\Windows\System\VcARjAT.exe
  2⤵
  PID:9356
- C:\Windows\System\twQJMgj.exe
  C:\Windows\System\twQJMgj.exe
  2⤵
  PID:9396
- C:\Windows\System\mhcQEaT.exe
  C:\Windows\System\mhcQEaT.exe
  2⤵
  PID:9432
- C:\Windows\System\wBvfQGr.exe
  C:\Windows\System\wBvfQGr.exe
  2⤵
  PID:9460
- C:\Windows\System\RdXVnno.exe
  C:\Windows\System\RdXVnno.exe
  2⤵
  PID:9496
- C:\Windows\System\CaqGLxD.exe
  C:\Windows\System\CaqGLxD.exe
  2⤵
  PID:9536
- C:\Windows\System\JRAtbbe.exe
  C:\Windows\System\JRAtbbe.exe
  2⤵
  PID:9556
- C:\Windows\System\bncWQlI.exe
  C:\Windows\System\bncWQlI.exe
  2⤵
  PID:9592
- C:\Windows\System\AHscddF.exe
  C:\Windows\System\AHscddF.exe
  2⤵
  PID:9620
- C:\Windows\System\DQjskhq.exe
  C:\Windows\System\DQjskhq.exe
  2⤵
  PID:9652
- C:\Windows\System\TXSZsqa.exe
  C:\Windows\System\TXSZsqa.exe
  2⤵
  PID:9680
- C:\Windows\System\tJJbcRL.exe
  C:\Windows\System\tJJbcRL.exe
  2⤵
  PID:9712
- C:\Windows\System\vxxtzAH.exe
  C:\Windows\System\vxxtzAH.exe
  2⤵
  PID:9764
- C:\Windows\System\wILgTUK.exe
  C:\Windows\System\wILgTUK.exe
  2⤵
  PID:9792
- C:\Windows\System\QVoEMld.exe
  C:\Windows\System\QVoEMld.exe
  2⤵
  PID:9820
- C:\Windows\System\xLjRSWR.exe
  C:\Windows\System\xLjRSWR.exe
  2⤵
  PID:9852
- C:\Windows\System\DtiiQuB.exe
  C:\Windows\System\DtiiQuB.exe
  2⤵
  PID:9888
- C:\Windows\System\Wyzwawb.exe
  C:\Windows\System\Wyzwawb.exe
  2⤵
  PID:9916
- C:\Windows\System\wKijEtX.exe
  C:\Windows\System\wKijEtX.exe
  2⤵
  PID:9948
- C:\Windows\System\vofeyXi.exe
  C:\Windows\System\vofeyXi.exe
  2⤵
  PID:9980
- C:\Windows\System\aRYNnJC.exe
  C:\Windows\System\aRYNnJC.exe
  2⤵
  PID:10012
- C:\Windows\System\mOwshor.exe
  C:\Windows\System\mOwshor.exe
  2⤵
  PID:10036
- C:\Windows\System\ykrTvdN.exe
  C:\Windows\System\ykrTvdN.exe
  2⤵
  PID:10076
- C:\Windows\System\tfhUVyU.exe
  C:\Windows\System\tfhUVyU.exe
  2⤵
  PID:10108
- C:\Windows\System\fBxfRlw.exe
  C:\Windows\System\fBxfRlw.exe
  2⤵
  PID:10140
- C:\Windows\System\FHjcjSh.exe
  C:\Windows\System\FHjcjSh.exe
  2⤵
  PID:10172
- C:\Windows\System\CCwAgfC.exe
  C:\Windows\System\CCwAgfC.exe
  2⤵
  PID:10200
- C:\Windows\System\xldclfc.exe
  C:\Windows\System\xldclfc.exe
  2⤵
  PID:10236
- C:\Windows\System\aIdgIoe.exe
  C:\Windows\System\aIdgIoe.exe
  2⤵
  PID:9256
- C:\Windows\System\JSTysZm.exe
  C:\Windows\System\JSTysZm.exe
  2⤵
  PID:9328
- C:\Windows\System\LQiIfFZ.exe
  C:\Windows\System\LQiIfFZ.exe
  2⤵
  PID:9352
- C:\Windows\System\KELZZbN.exe
  C:\Windows\System\KELZZbN.exe
  2⤵
  PID:9448
- C:\Windows\System\vAddXIs.exe
  C:\Windows\System\vAddXIs.exe
  2⤵
  PID:9516
- C:\Windows\System\ZkvOccL.exe
  C:\Windows\System\ZkvOccL.exe
  2⤵
  PID:9588
- C:\Windows\System\nuSQpzn.exe
  C:\Windows\System\nuSQpzn.exe
  2⤵
  PID:9720
- C:\Windows\System\HhITEwe.exe
  C:\Windows\System\HhITEwe.exe
  2⤵
  PID:8828
- C:\Windows\System\jvrctdc.exe
  C:\Windows\System\jvrctdc.exe
  2⤵
  PID:9740
- C:\Windows\System\FcfAvwb.exe
  C:\Windows\System\FcfAvwb.exe
  2⤵
  PID:9808
- C:\Windows\System\CDvyqOG.exe
  C:\Windows\System\CDvyqOG.exe
  2⤵
  PID:9880
- C:\Windows\System\VRCghIp.exe
  C:\Windows\System\VRCghIp.exe
  2⤵
  PID:9960
- C:\Windows\System\JkVghsf.exe
  C:\Windows\System\JkVghsf.exe
  2⤵
  PID:10020
- C:\Windows\System\CmNtTtf.exe
  C:\Windows\System\CmNtTtf.exe
  2⤵
  PID:10060
- C:\Windows\System\IDFLhYz.exe
  C:\Windows\System\IDFLhYz.exe
  2⤵
  PID:10088
- C:\Windows\System\VwKYlev.exe
  C:\Windows\System\VwKYlev.exe
  2⤵
  PID:10184
- C:\Windows\System\ZKHAKDB.exe
  C:\Windows\System\ZKHAKDB.exe
  2⤵
  PID:10196
- C:\Windows\System\OAbmIpr.exe
  C:\Windows\System\OAbmIpr.exe
  2⤵
  PID:9308
- C:\Windows\System\YTPcjkw.exe
  C:\Windows\System\YTPcjkw.exe
  2⤵
  PID:9376
- C:\Windows\System\wNxDakP.exe
  C:\Windows\System\wNxDakP.exe
  2⤵
  PID:9492
- C:\Windows\System\CGtVrkc.exe
  C:\Windows\System\CGtVrkc.exe
  2⤵
  PID:9748
- C:\Windows\System\vyVNatE.exe
  C:\Windows\System\vyVNatE.exe
  2⤵
  PID:8632
- C:\Windows\System\CuYVANf.exe
  C:\Windows\System\CuYVANf.exe
  2⤵
  PID:9864
- C:\Windows\System\vPdDJzi.exe
  C:\Windows\System\vPdDJzi.exe
  2⤵
  PID:9996
- C:\Windows\System\nTKFQME.exe
  C:\Windows\System\nTKFQME.exe
  2⤵
  PID:10092
- C:\Windows\System\kWkClOe.exe
  C:\Windows\System\kWkClOe.exe
  2⤵
  PID:10216
- C:\Windows\System\mmKlXZV.exe
  C:\Windows\System\mmKlXZV.exe
  2⤵
  PID:9276
- C:\Windows\System\BCPQZEp.exe
  C:\Windows\System\BCPQZEp.exe
  2⤵
  PID:9636
- C:\Windows\System\wQFLbqL.exe
  C:\Windows\System\wQFLbqL.exe
  2⤵
  PID:9992
- C:\Windows\System\cRhGgks.exe
  C:\Windows\System\cRhGgks.exe
  2⤵
  PID:10156
- C:\Windows\System\GXQvVoM.exe
  C:\Windows\System\GXQvVoM.exe
  2⤵
  PID:10048
- C:\Windows\System\nidRbvY.exe
  C:\Windows\System\nidRbvY.exe
  2⤵
  PID:8488
- C:\Windows\System\EQeeZgH.exe
  C:\Windows\System\EQeeZgH.exe
  2⤵
  PID:10260
- C:\Windows\System\KHyaVMH.exe
  C:\Windows\System\KHyaVMH.exe
  2⤵
  PID:10288
- C:\Windows\System\FtZGjyf.exe
  C:\Windows\System\FtZGjyf.exe
  2⤵
  PID:10320
- C:\Windows\System\VtZmMNp.exe
  C:\Windows\System\VtZmMNp.exe
  2⤵
  PID:10348
- C:\Windows\System\kuPQONa.exe
  C:\Windows\System\kuPQONa.exe
  2⤵
  PID:10376
- C:\Windows\System\caPIYkF.exe
  C:\Windows\System\caPIYkF.exe
  2⤵
  PID:10404
- C:\Windows\System\xGeWcxB.exe
  C:\Windows\System\xGeWcxB.exe
  2⤵
  PID:10436
- C:\Windows\System\aVDTFjW.exe
  C:\Windows\System\aVDTFjW.exe
  2⤵
  PID:10464
- C:\Windows\System\RXopxnm.exe
  C:\Windows\System\RXopxnm.exe
  2⤵
  PID:10492
- C:\Windows\System\BPqLtue.exe
  C:\Windows\System\BPqLtue.exe
  2⤵
  PID:10528
- C:\Windows\System\zbdLGJc.exe
  C:\Windows\System\zbdLGJc.exe
  2⤵
  PID:10556
- C:\Windows\System\hhlxrMB.exe
  C:\Windows\System\hhlxrMB.exe
  2⤵
  PID:10584
- C:\Windows\System\XmuzFUX.exe
  C:\Windows\System\XmuzFUX.exe
  2⤵
  PID:10612
- C:\Windows\System\uaKFXCS.exe
  C:\Windows\System\uaKFXCS.exe
  2⤵
  PID:10640
- C:\Windows\System\BsxxadB.exe
  C:\Windows\System\BsxxadB.exe
  2⤵
  PID:10668
- C:\Windows\System\TaEkrAt.exe
  C:\Windows\System\TaEkrAt.exe
  2⤵
  PID:10696
- C:\Windows\System\gWILKta.exe
  C:\Windows\System\gWILKta.exe
  2⤵
  PID:10724
- C:\Windows\System\TSrSXqo.exe
  C:\Windows\System\TSrSXqo.exe
  2⤵
  PID:10756
- C:\Windows\System\MbcXXpU.exe
  C:\Windows\System\MbcXXpU.exe
  2⤵
  PID:10784
- C:\Windows\System\XPsaqdV.exe
  C:\Windows\System\XPsaqdV.exe
  2⤵
  PID:10812
- C:\Windows\System\iDfdzJO.exe
  C:\Windows\System\iDfdzJO.exe
  2⤵
  PID:10840
- C:\Windows\System\RifOvcg.exe
  C:\Windows\System\RifOvcg.exe
  2⤵
  PID:10860
- C:\Windows\System\WNZTHMv.exe
  C:\Windows\System\WNZTHMv.exe
  2⤵
  PID:10900
- C:\Windows\System\RHrVHQS.exe
  C:\Windows\System\RHrVHQS.exe
  2⤵
  PID:10928
- C:\Windows\System\XObssPr.exe
  C:\Windows\System\XObssPr.exe
  2⤵
  PID:10956
- C:\Windows\System\YdkalFa.exe
  C:\Windows\System\YdkalFa.exe
  2⤵
  PID:10972
- C:\Windows\System\QuldzeN.exe
  C:\Windows\System\QuldzeN.exe
  2⤵
  PID:11012
- C:\Windows\System\nNkIElq.exe
  C:\Windows\System\nNkIElq.exe
  2⤵
  PID:11040
- C:\Windows\System\jApAHzV.exe
  C:\Windows\System\jApAHzV.exe
  2⤵
  PID:11064
- C:\Windows\System\GAGBwBI.exe
  C:\Windows\System\GAGBwBI.exe
  2⤵
  PID:11084
- C:\Windows\System\TvnpVOa.exe
  C:\Windows\System\TvnpVOa.exe
  2⤵
  PID:11124
- C:\Windows\System\CkbSnOW.exe
  C:\Windows\System\CkbSnOW.exe
  2⤵
  PID:11148
- C:\Windows\System\KdTSSfu.exe
  C:\Windows\System\KdTSSfu.exe
  2⤵
  PID:11180
- C:\Windows\System\LfXSUdJ.exe
  C:\Windows\System\LfXSUdJ.exe
  2⤵
  PID:11200
- C:\Windows\System\asTGmWU.exe
  C:\Windows\System\asTGmWU.exe
  2⤵
  PID:11240
- C:\Windows\System\ugEOwVx.exe
  C:\Windows\System\ugEOwVx.exe
  2⤵
  PID:10272
- C:\Windows\System\QTVhgXh.exe
  C:\Windows\System\QTVhgXh.exe
  2⤵
  PID:10332
- C:\Windows\System\HBbMkvI.exe
  C:\Windows\System\HBbMkvI.exe
  2⤵
  PID:10400
- C:\Windows\System\PYgHLfq.exe
  C:\Windows\System\PYgHLfq.exe
  2⤵
  PID:10476
- C:\Windows\System\atXPGYJ.exe
  C:\Windows\System\atXPGYJ.exe
  2⤵
  PID:10548
- C:\Windows\System\AhTEmmq.exe
  C:\Windows\System\AhTEmmq.exe
  2⤵
  PID:10600
- C:\Windows\System\KzcTtjg.exe
  C:\Windows\System\KzcTtjg.exe
  2⤵
  PID:10660
- C:\Windows\System\CeViUHe.exe
  C:\Windows\System\CeViUHe.exe
  2⤵
  PID:10736
- C:\Windows\System\hmjhCYC.exe
  C:\Windows\System\hmjhCYC.exe
  2⤵
  PID:10776
- C:\Windows\System\FGBWafJ.exe
  C:\Windows\System\FGBWafJ.exe
  2⤵
  PID:10856
- C:\Windows\System\HYNjnfv.exe
  C:\Windows\System\HYNjnfv.exe
  2⤵
  PID:10944
- C:\Windows\System\CahtPjd.exe
  C:\Windows\System\CahtPjd.exe
  2⤵
  PID:11008
- C:\Windows\System\BGZKIff.exe
  C:\Windows\System\BGZKIff.exe
  2⤵
  PID:11060
- C:\Windows\System\hCbAEzb.exe
  C:\Windows\System\hCbAEzb.exe
  2⤵
  PID:11116
- C:\Windows\System\mZBbhkN.exe
  C:\Windows\System\mZBbhkN.exe
  2⤵
  PID:11196
- C:\Windows\System\IEnWgoq.exe
  C:\Windows\System\IEnWgoq.exe
  2⤵
  PID:10256
- C:\Windows\System\NfcWvyC.exe
  C:\Windows\System\NfcWvyC.exe
  2⤵
  PID:10432
- C:\Windows\System\gNrhFFn.exe
  C:\Windows\System\gNrhFFn.exe
  2⤵
  PID:10580
- C:\Windows\System\mFsNDID.exe
  C:\Windows\System\mFsNDID.exe
  2⤵
  PID:10708
- C:\Windows\System\NwXdaxD.exe
  C:\Windows\System\NwXdaxD.exe
  2⤵
  PID:10896
- C:\Windows\System\thcpXtq.exe
  C:\Windows\System\thcpXtq.exe
  2⤵
  PID:11056
- C:\Windows\System\lYJhjvG.exe
  C:\Windows\System\lYJhjvG.exe
  2⤵
  PID:11176
- C:\Windows\System\rGtuFRz.exe
  C:\Windows\System\rGtuFRz.exe
  2⤵
  PID:10504
- C:\Windows\System\iMpEfcP.exe
  C:\Windows\System\iMpEfcP.exe
  2⤵
  PID:10852
- C:\Windows\System\AsJRfsj.exe
  C:\Windows\System\AsJRfsj.exe
  2⤵
  PID:10372
- C:\Windows\System\laMiLsD.exe
  C:\Windows\System\laMiLsD.exe
  2⤵
  PID:10768
- C:\Windows\System\OiXDmwk.exe
  C:\Windows\System\OiXDmwk.exe
  2⤵
  PID:11280
- C:\Windows\System\inAuKZz.exe
  C:\Windows\System\inAuKZz.exe
  2⤵
  PID:11300
- C:\Windows\System\tGLlogQ.exe
  C:\Windows\System\tGLlogQ.exe
  2⤵
  PID:11336
- C:\Windows\System\DQyiLyW.exe
  C:\Windows\System\DQyiLyW.exe
  2⤵
  PID:11364
- C:\Windows\System\pexyXve.exe
  C:\Windows\System\pexyXve.exe
  2⤵
  PID:11392
- C:\Windows\System\gFRjznm.exe
  C:\Windows\System\gFRjznm.exe
  2⤵
  PID:11420
- C:\Windows\System\YLLBnOF.exe
  C:\Windows\System\YLLBnOF.exe
  2⤵
  PID:11452
- C:\Windows\System\czMGPKR.exe
  C:\Windows\System\czMGPKR.exe
  2⤵
  PID:11480
- C:\Windows\System\ucpZECl.exe
  C:\Windows\System\ucpZECl.exe
  2⤵
  PID:11508
- C:\Windows\System\xYMSUqB.exe
  C:\Windows\System\xYMSUqB.exe
  2⤵
  PID:11536
- C:\Windows\System\FEsqMou.exe
  C:\Windows\System\FEsqMou.exe
  2⤵
  PID:11564
- C:\Windows\System\rBvSJOd.exe
  C:\Windows\System\rBvSJOd.exe
  2⤵
  PID:11592
- C:\Windows\System\VHNkiXF.exe
  C:\Windows\System\VHNkiXF.exe
  2⤵
  PID:11608
- C:\Windows\System\uHjhMgq.exe
  C:\Windows\System\uHjhMgq.exe
  2⤵
  PID:11648
- C:\Windows\System\dqumzFb.exe
  C:\Windows\System\dqumzFb.exe
  2⤵
  PID:11680
- C:\Windows\System\XHCiEzl.exe
  C:\Windows\System\XHCiEzl.exe
  2⤵
  PID:11708
- C:\Windows\System\YwJnxdH.exe
  C:\Windows\System\YwJnxdH.exe
  2⤵
  PID:11736
- C:\Windows\System\SWfrEfm.exe
  C:\Windows\System\SWfrEfm.exe
  2⤵
  PID:11764
- C:\Windows\System\CNfLUir.exe
  C:\Windows\System\CNfLUir.exe
  2⤵
  PID:11792
- C:\Windows\System\EEKBBAA.exe
  C:\Windows\System\EEKBBAA.exe
  2⤵
  PID:11820
- C:\Windows\System\rGUfuhy.exe
  C:\Windows\System\rGUfuhy.exe
  2⤵
  PID:11840
- C:\Windows\System\okLBxZN.exe
  C:\Windows\System\okLBxZN.exe
  2⤵
  PID:11864
- C:\Windows\System\GUMnjWX.exe
  C:\Windows\System\GUMnjWX.exe
  2⤵
  PID:11904
- C:\Windows\System\yDJyBgv.exe
  C:\Windows\System\yDJyBgv.exe
  2⤵
  PID:11932
- C:\Windows\System\oykcBua.exe
  C:\Windows\System\oykcBua.exe
  2⤵
  PID:11956
- C:\Windows\System\PQwnYgo.exe
  C:\Windows\System\PQwnYgo.exe
  2⤵
  PID:11988
- C:\Windows\System\DIVPmmq.exe
  C:\Windows\System\DIVPmmq.exe
  2⤵
  PID:12004
- C:\Windows\System\bjCleHx.exe
  C:\Windows\System\bjCleHx.exe
  2⤵
  PID:12044
- C:\Windows\System\WWqQBlN.exe
  C:\Windows\System\WWqQBlN.exe
  2⤵
  PID:12072
- C:\Windows\System\jRpWmnt.exe
  C:\Windows\System\jRpWmnt.exe
  2⤵
  PID:12100
- C:\Windows\System\vExOESt.exe
  C:\Windows\System\vExOESt.exe
  2⤵
  PID:12128
- C:\Windows\System\suKvoVl.exe
  C:\Windows\System\suKvoVl.exe
  2⤵
  PID:12144
- C:\Windows\System\pFkmdhg.exe
  C:\Windows\System\pFkmdhg.exe
  2⤵
  PID:12184
- C:\Windows\System\rZluSKn.exe
  C:\Windows\System\rZluSKn.exe
  2⤵
  PID:12212
- C:\Windows\System\jkCMjEw.exe
  C:\Windows\System\jkCMjEw.exe
  2⤵
  PID:12228
- C:\Windows\System\AHJwsZz.exe
  C:\Windows\System\AHJwsZz.exe
  2⤵
  PID:12268
- C:\Windows\System\mhsqSkE.exe
  C:\Windows\System\mhsqSkE.exe
  2⤵
  PID:11272
- C:\Windows\System\JXmWvHj.exe
  C:\Windows\System\JXmWvHj.exe
  2⤵
  PID:11332
- C:\Windows\System\MJJQQcX.exe
  C:\Windows\System\MJJQQcX.exe
  2⤵
  PID:11388
- C:\Windows\System\bxjlVCO.exe
  C:\Windows\System\bxjlVCO.exe
  2⤵
  PID:11468
- C:\Windows\System\kNwHhMH.exe
  C:\Windows\System\kNwHhMH.exe
  2⤵
  PID:11528
- C:\Windows\System\tSGbpxT.exe
  C:\Windows\System\tSGbpxT.exe
  2⤵
  PID:11588
- C:\Windows\System\BbnWzBg.exe
  C:\Windows\System\BbnWzBg.exe
  2⤵
  PID:11660
- C:\Windows\System\rPyiIeC.exe
  C:\Windows\System\rPyiIeC.exe
  2⤵
  PID:11728
- C:\Windows\System\FwYRJqN.exe
  C:\Windows\System\FwYRJqN.exe
  2⤵
  PID:11788
- C:\Windows\System\jMkpZUd.exe
  C:\Windows\System\jMkpZUd.exe
  2⤵
  PID:11856
- C:\Windows\System\zwkOAeR.exe
  C:\Windows\System\zwkOAeR.exe
  2⤵
  PID:11924
- C:\Windows\System\hLXgTGq.exe
  C:\Windows\System\hLXgTGq.exe
  2⤵
  PID:11996
- C:\Windows\System\WyjuZvt.exe
  C:\Windows\System\WyjuZvt.exe
  2⤵
  PID:12064
- C:\Windows\System\rydVdsp.exe
  C:\Windows\System\rydVdsp.exe
  2⤵
  PID:12096
- C:\Windows\System\Kqmgxrb.exe
  C:\Windows\System\Kqmgxrb.exe
  2⤵
  PID:12156
- C:\Windows\System\MpPVoyj.exe
  C:\Windows\System\MpPVoyj.exe
  2⤵
  PID:12260
- C:\Windows\System\OctMueb.exe
  C:\Windows\System\OctMueb.exe
  2⤵
  PID:11328
- C:\Windows\System\IzkLOJf.exe
  C:\Windows\System\IzkLOJf.exe
  2⤵
  PID:11500
- C:\Windows\System\MxOmkCG.exe
  C:\Windows\System\MxOmkCG.exe
  2⤵
  PID:1892
- C:\Windows\System\OKmwfeC.exe
  C:\Windows\System\OKmwfeC.exe
  2⤵
  PID:11700
- C:\Windows\System\fPSnZOc.exe
  C:\Windows\System\fPSnZOc.exe
  2⤵
  PID:11828
- C:\Windows\System\zHRisml.exe
  C:\Windows\System\zHRisml.exe
  2⤵
  PID:11920
- C:\Windows\System\zpRjbLK.exe
  C:\Windows\System\zpRjbLK.exe
  2⤵
  PID:12200
- C:\Windows\System\yOHlTpt.exe
  C:\Windows\System\yOHlTpt.exe
  2⤵
  PID:968
- C:\Windows\System\AYsmUPA.exe
  C:\Windows\System\AYsmUPA.exe
  2⤵
  PID:11636
- C:\Windows\System\ApZvQzY.exe
  C:\Windows\System\ApZvQzY.exe
  2⤵
  PID:12040
- C:\Windows\System\xjSEQOQ.exe
  C:\Windows\System\xjSEQOQ.exe
  2⤵
  PID:11320
- C:\Windows\System\afIZxOk.exe
  C:\Windows\System\afIZxOk.exe
  2⤵
  PID:12300
- C:\Windows\System\nbNNmhl.exe
  C:\Windows\System\nbNNmhl.exe
  2⤵
  PID:12316
- C:\Windows\System\tSsKctr.exe
  C:\Windows\System\tSsKctr.exe
  2⤵
  PID:12356
- C:\Windows\System\RojscUv.exe
  C:\Windows\System\RojscUv.exe
  2⤵
  PID:12376
- C:\Windows\System\NbuEqTu.exe
  C:\Windows\System\NbuEqTu.exe
  2⤵
  PID:12400
- C:\Windows\System\gUBdnjs.exe
  C:\Windows\System\gUBdnjs.exe
  2⤵
  PID:12448
- C:\Windows\System\ovqrNkE.exe
  C:\Windows\System\ovqrNkE.exe
  2⤵
  PID:12468
- C:\Windows\System\aJWyfAW.exe
  C:\Windows\System\aJWyfAW.exe
  2⤵
  PID:12496
- C:\Windows\System\dZqrrLP.exe
  C:\Windows\System\dZqrrLP.exe
  2⤵
  PID:12524
- C:\Windows\System\WHDGeOL.exe
  C:\Windows\System\WHDGeOL.exe
  2⤵
  PID:12580
- C:\Windows\System\pZxSMNn.exe
  C:\Windows\System\pZxSMNn.exe
  2⤵
  PID:12612
- C:\Windows\System\dpjBHlc.exe
  C:\Windows\System\dpjBHlc.exe
  2⤵
  PID:12648
- C:\Windows\System\MHTclDd.exe
  C:\Windows\System\MHTclDd.exe
  2⤵
  PID:12680
- C:\Windows\System\KJRryYY.exe
  C:\Windows\System\KJRryYY.exe
  2⤵
  PID:12728
- C:\Windows\System\KFXBQbr.exe
  C:\Windows\System\KFXBQbr.exe
  2⤵
  PID:12772
- C:\Windows\System\RgrYjIe.exe
  C:\Windows\System\RgrYjIe.exe
  2⤵
  PID:12800
- C:\Windows\System\TCGDaCe.exe
  C:\Windows\System\TCGDaCe.exe
  2⤵
  PID:12828
- C:\Windows\System\pqAvpGN.exe
  C:\Windows\System\pqAvpGN.exe
  2⤵
  PID:12860
- C:\Windows\System\yPVRPTN.exe
  C:\Windows\System\yPVRPTN.exe
  2⤵
  PID:12888
- C:\Windows\System\ZulbppM.exe
  C:\Windows\System\ZulbppM.exe
  2⤵
  PID:12920
- C:\Windows\System\eurpNxv.exe
  C:\Windows\System\eurpNxv.exe
  2⤵
  PID:12948
- C:\Windows\System\rsmHkAT.exe
  C:\Windows\System\rsmHkAT.exe
  2⤵
  PID:12976
- C:\Windows\System\ZiyWxSX.exe
  C:\Windows\System\ZiyWxSX.exe
  2⤵
  PID:13020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_glua5onz.d5r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_glua5onz.d5r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BGCZmrJ.exe

Path C:\Windows\System\BGCZmrJ.exe
Size 3.0MB
SHA256 f85754fb0e888969f0aa7eb961f1e437842fa213319ba2121568fed092321864
MD5 325159214e574cf54b094cbc0af3aab3
SHA1 e0891cb2450577d362719f93c0d5c88972328bfc
SHA512 501a0187e5693702335044033f4f92f545e0ab5cb869065085fe08170c4e2086b9c678e67f889bacdeb9e8c48ba27c0c8ed3087dbd99b98eb28d846a224f9fb5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ci:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

BJYPPCi.exe

Path C:\Windows\System\BJYPPCi.exe
Size 3.0MB
SHA256 ff968bec51c190dd3db247c57bcf4c03ce5d00f4e383512f5a0ba568cbe94053
MD5 087683ede325be577d43a3a681086211
SHA1 0c8e728921e602215d2960f0de0efdfe7842fcd5
SHA512 fda847bfc66f10e1f69b93d15859601b442ff429d97d922cc8980fdd8982671247c6c0d27e58a049de51486f3d397b08009bfd83b9f366bdeec13cded9974237
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

CuAWnFH.exe

Path C:\Windows\System\CuAWnFH.exe
Size 3.0MB
SHA256 2af001f9b9a6576f717099359c7ee730e413fbf64e61608224d0f81215b95347
MD5 7129774bb056660506c3576336e6c72e
SHA1 c1d80016c1c9541da0e0c722dd168e5c2d75224b
SHA512 885dab5b5ce3296ed64da2ad734aa6969007e62146aaeeca011a4b7488c4e4e81d660d014b6e7593e996087d5673a95e1a9f9d4ceed3d0e84ea3d3e4a6846ac6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DrOwHmC.exe

Path C:\Windows\System\DrOwHmC.exe
Size 3.0MB
SHA256 5c10305741d75cdd4b0c6fc09b9bece5452426e26a0acbe92aa0ae11a9662049
MD5 13203ce002a40bd583f0eac205edc21b
SHA1 2301ee36a149dfb01d3cc9cdc5c82b781132594a
SHA512 16e6dde04099295854ab7ef451c6f139154dd68f215ce9cb7a7b46225655a2fafc04e8d96a956ee496f11dd97693ced3b30388ee1387ecd45e35e9362e3beef0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ci:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlPshFd.exe

Path C:\Windows\System\FlPshFd.exe
Size 3.0MB
SHA256 dc6e39f253deb79588278a6b6c625b48761452b819b8ca847a723ce19faaa122
MD5 67bbab9ffac10a43b6e0b66df852fa1b
SHA1 6e766a6e6a6c15aa334bf068a832b1edb759b31c
SHA512 243a4f8bc6120fc0fd0ccd04320b8244ba62b036fe9e4ca14a565bc6f1a590621934b4206b7daef747ec5c58013e4658a0914849ae354ef35be5c6d5931a6aef
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cA:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVKjZNe.exe

Path C:\Windows\System\HVKjZNe.exe
Size 3.0MB
SHA256 661b1f4c951763069ef1cbb6bc285663d79a33a9b1ba10f4f41ca8246f41fd28
MD5 b513c7e8074c69500c0583edcda19997
SHA1 10248607d5a8cf8d130fbcc2e34c3df9a414cab8
SHA512 dc322de3e395944e8db7844616d750ecf1796d5ae3ff95d2e622ca5eee19dcb8d850b6ac36ff090ddb79325551d3444ea033ffcd25cb1e909c4bbf5dae60f3ee
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cR:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IUmzsvv.exe

Path C:\Windows\System\IUmzsvv.exe
Size 3.0MB
SHA256 5b7754188c6847a8e86a129db58c6bb0c8a7739a67ee9f717a44fcc755d3e75c
MD5 32f146d79d527f47c08c2a5b0984d497
SHA1 b58fc3e148859e9cbceffada9cf1194aaa671ce3
SHA512 a942cebf002642d764eed1ded4a749de8d138f8ecb5b95bf615ba5906b37f8f8fedec217cd2c83ef6edbb016a1dc08bfc673ef8d3d30e1be7a584512e4461b32
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cc:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

MaovCsr.exe

Path C:\Windows\System\MaovCsr.exe
Size 3.0MB
SHA256 be3c6ff07a29dded23f9272b6738b0193ca4c192ba577ecf5ff398310183ee3c
MD5 9a4530bfa3d5f2d513c8dafca06c61ee
SHA1 38e108ddb0d99a61b47b92325599856247dcd596
SHA512 a72ac447ad563fa9f9b57f52a383c1ae6d8aa693a0bdbbee3088bb38ae3f4f30b51ee3853626b4ae0d41ef6fb0284454d5e1c0efb598095069162568ea765ae0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

NZhGRIz.exe

Path C:\Windows\System\NZhGRIz.exe
Size 3.0MB
SHA256 9b91b6d59823e5f696673c5033c816b765f8d96ae61176dd694c473eda48e989
MD5 30b4ea80bff78c2d3fbfb01da1a81eb3
SHA1 6d203dc2e0ee286ed5c4b71a8b06df214a844ec4
SHA512 8ea49d9ef0a83c284a09963ec67b764d5c3cc8132cab65c942789ea1c3459cec519d51801186f1987e31a436925b7924a6c9deaa9cfc92dcbcd05c075064da7d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PAeTWKX.exe

Path C:\Windows\System\PAeTWKX.exe
Size 3.0MB
SHA256 0e67baa7d76fa639576f9fb39db10da18545c77e57b654f3dcead851d48fe7d1
MD5 9a69dcbd1b31fb5e07482d6279e2f6d8
SHA1 5e4130cf996d210f57c8fb0917d26af278488858
SHA512 8eef44462e14b5f4f9c94955ae21b588b84a66087452e49fb227d2315ca8c729ce5117ef896240f5ac3498e23e195ce7593dbd23b0d7c874b6774b4c75140e9d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

TLwiuzO.exe

Path C:\Windows\System\TLwiuzO.exe
Size 3.0MB
SHA256 adbe8fe3120a2ad265b0a4b85220df206d4754221cdcac0f1ed47aed512a013c
MD5 8872101259c961c1c74da6ad28c72f95
SHA1 46687ae86c142d4c1542256367d0f709f4031fc5
SHA512 2f36b08b8d983b71c1b92bb52de04e483548b7472c4b4be5304467303dc53122bdd4cca2b8cf8af00e437c5ab6970dc544ac46400ba5ac016c664e4ea7b6773e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

UFrCZuo.exe

Path C:\Windows\System\UFrCZuo.exe
Size 3.0MB
SHA256 e474f99b83d604a4c963973eb47c63f2e74c4b8e2c8dc13dfc3755f32613f9fb
MD5 1e61415169d73aa3dd7fbcf2bad5753e
SHA1 ec17df9e95cf32a25688a282702e50d31cbea4c5
SHA512 62f399654702f13694de7bd91e5c493229b21c3f6b70637ea47f0934ce512247e6a8f9231f14cd80be96de05edfedf5d495e9e3465d60ee2015aeb62d7524f73
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WEqxOUU.exe

Path C:\Windows\System\WEqxOUU.exe
Size 3.0MB
SHA256 11f4da13b34f14d4084b942ebe0fcedf2ef8ad50b33cb75ce9f7d36a30e423ec
MD5 966dee3d3cb6a87b44c3fe0feb0fd6ad
SHA1 90c5360a0403c342b37cd38bede7054d77685ffc
SHA512 538d2cb28136d2178b1434170b14364deaef09312ba7f49f277ab5819ea5258735b99c884e5ffe6875b23ef34912c674b381fa812e7bdd82774c40edaf4b9462
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cK:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WZFhuyT.exe

Path C:\Windows\System\WZFhuyT.exe
Size 3.0MB
SHA256 26bceef73efccc8f4ddfe525241bc1f2e1bf4f1d64e52a347ead24b9208e8610
MD5 594875af194c2c130d29a1dc1c90c4cc
SHA1 f4e9fc68aafe90176cc36890abcb3f84ff7378ea
SHA512 cc024997b1511451f19ddbdb7fa283a453edf8426050efda41fd13ae60672410ff8347b20861f0ec8dbdcfc58d56f4ad14659ed0157abce487e37299c3928f28
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

XKJkVdT.exe

Path C:\Windows\System\XKJkVdT.exe
Size 3.0MB
SHA256 48619941b69dc0716f44f57b06d181e7245893b21d6272e8335ce268b1bfe895
MD5 a2706eb330283da45c6b50e67ac65cfc
SHA1 5ea3ab5c399fbcd3b680b63e1ba0203ef2c6aaa2
SHA512 f7e8d67091f82de07587a8b2dff3ab0bec9024597e54a552c57e083fff3bc7f4618d05d329c6748eef32360c540614e824d1bd37e7cfdb87a3d0bf9d0789faf5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZCgWmlQ.exe

Path C:\Windows\System\ZCgWmlQ.exe
Size 3.0MB
SHA256 76bb20b819a8375371073ed345d2a5422eb252ef2dc72332a9a18b270a046d1c
MD5 ef31cda5fc72f712b4a817c772090610
SHA1 f4181a042e93eada2f6b91860e660cd57bd1074b
SHA512 5c75869af1240cd31d691ee7631e717977a237cbd9e90caa000a0e79ffc80e6393ebcb8fb34dca0c543f1bb5d198322779abba619ed538e7874ee261d7010333
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

aOctOBb.exe

Path C:\Windows\System\aOctOBb.exe
Size 3.0MB
SHA256 4bd49158f26158d8be14e081032281f892ce16ca98626b208199751920df1d31
MD5 6e556ae8f9c54b4d4b4be76791be4bba
SHA1 df2c6bb4b6d6bf790cb682ae100cedf708a8a615
SHA512 bf164c7281d8482004522fda1eeb8976340af522137a69d3146ee307459ad8fe75585da4d85c60cabe5e538c16e849a07cecdc6f69a7682d5f1ae58b2ad6c754
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ce:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bYtyDdb.exe

Path C:\Windows\System\bYtyDdb.exe
Size 3.0MB
SHA256 d123a556faeb501772494d76f1c71e9ac3432614abd117f51c83dcb2cf77e12c
MD5 d52cc0ce6ec43e06a0117b91dd046e53
SHA1 fd517a0d73037e7e124841d6c50d4595753987e1
SHA512 e9b62f8b8712a2c781bd9a7cf6c4aca24b8fdaa207ff6c91ce1304eb1c698e268cc942d9b904a6a57b368bfb07fce24dae3452de02a093263d34a7c0d91a9308
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ct:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cDrfQsJ.exe

Path C:\Windows\System\cDrfQsJ.exe
Size 3.0MB
SHA256 bebfbb3a76c8ff6b269d39a3e0f7de4ca903db691f64952a8dab657562b623bc
MD5 d1fb4eeaf10743c0edf0ea925ca6378b
SHA1 85395e7fd70d42642d1dd2bd8c3e6fe71b854de2
SHA512 9c3718c8f51b4b96d503a7aac24ffec8a31a1a40e72ea130ed6e927ddbaa0ac6b88dbd049dcec0379bdbed6fddfb7323be4fb327b05d874918c1994dd0d46543
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

eitvRxM.exe

Path C:\Windows\System\eitvRxM.exe
Size 8B
SHA256 35ac8b6a943f09a1cde24cd02afff8a0c7d652f165d54e16f6413276f4896cb0
MD5 910de5e4823f1b594342aaa45a243c27
SHA1 e685fe344492ae089d7952151010d07f38420dbc
SHA512 734b56228ae9283d7a41492191ea523ba29a1fabe1bd71428c57f89031a65c2affd92f940176ff946aa90efb62794a49b666566dba8320bb35feeeb83e9c2a4f
MD5 SHA1 SHA512

Submit Download

euQFXwP.exe

Path C:\Windows\System\euQFXwP.exe
Size 3.0MB
SHA256 efee45eb83da60fdf3516df45b9f1fa55718105374dcece7443dee07e89f6e96
MD5 1dfd652587e92226a0fb0f81fb89b439
SHA1 33ed9e01a3d37077d4a98baa3bd3263e9603ca0e
SHA512 2b7f357575dc1252f155eb36dd1351137082de166eca517ff5bab730675f1cc7ecb1261f89b0cd1ce6c4873955add079c546b12ef6cfc909d2af0c746576a407
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

fMuXZnB.exe

Path C:\Windows\System\fMuXZnB.exe
Size 3.0MB
SHA256 b95dac66e3102153b31a6db7a15d02d747afe2f02f9662b467fafcdb06719e31
MD5 751bc10691034b28658dd55e3d7d3d33
SHA1 fe309a81bea54a25245758c9bfa3f349b875d965
SHA512 067c7618219c2e6013a615b5358148b3824d938c9e38dc5c8e09285595cec172fd5d589f5b2acb3ba1620ccf71c831542428ea402cc57d1d2aa6c7e720257104
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

hCexRAc.exe

Path C:\Windows\System\hCexRAc.exe
Size 3.0MB
SHA256 1a5389acd7a1151b125729c4f16b46aa04bca9795fc28a359610d5f7997683ba
MD5 a2344f58ecf64e0776ed3683f83de71c
SHA1 a5905a5057a76db5a89a687694c09b589371e622
SHA512 24e4870c1745d0a301576d49bf1beb117486f7f6494af22ea507869a8e322e4b02514da3f79804786a399da12bd268e8b499ac242010a82d1c2305dd78da3b19
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c5:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

iDNZuYk.exe

Path C:\Windows\System\iDNZuYk.exe
Size 3.0MB
SHA256 af208f7d73ebc407858457d0617fecfca481066ba1676790143b5013a720390e
MD5 ab69434b7c31702a02b975966d724c94
SHA1 101a96a4cfd7b43ed16496b3372e00d1e26e43e1
SHA512 70c008362aac8ca06536de47b4d75fe2c37a5c3e5346fa93b6bdbbc72b1e066bd70707afc3b3253cb3624dc577aa05c7a3fc46f9c335379048a5622396209cdb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cG:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RO
MD5 SHA1 SHA512 SSDEEP

Submit Download

iJMkZxu.exe

Path C:\Windows\System\iJMkZxu.exe
Size 3.0MB
SHA256 9f7f2d1d41ce426c7edbf940e8b7acfe3565b6923d300b6f3eca6351e122d79d
MD5 1e642bf5b98ec2adcbc2a105e2d2eaf3
SHA1 d21d7854d9f66c3433849a3c0322aa1721dad5d6
SHA512 3492463e213247aab14bbd58f040b9dd1d8071f78400ba2e5a4e9d053b2820f9623b65a48517bede33e2b5e31a60c8e92ce08474d470b59310e691ca4be00968
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

lTsDaQx.exe

Path C:\Windows\System\lTsDaQx.exe
Size 3.0MB
SHA256 9b092a67b49b4fe0e1ae1935eb64c857df9f6bb1b2bb486b92c5e91d122402f4
MD5 d6e3d2fc8283dee02eb343d488691c90
SHA1 c2e6bb769661ea10dde036d9e42066220f6c053c
SHA512 a777eb294b79e1c18d8cfaa69180032c1131635582e479a5d6cbb610db6f91cafb5ea0ff9ac3c0a534b55a680038b52b48f9172f0d98ba04f732e7d7c34b633a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cP:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdKLzvs.exe

Path C:\Windows\System\mdKLzvs.exe
Size 3.0MB
SHA256 1a39a4acb6d3bdb698d216b713f4f8b1a7678f2f26f1c65b2cd835771a726eb5
MD5 656967c4e37074844151f8c4b05a4506
SHA1 f5754b4f36d33c932dc13a9ded8ba4ca5a282899
SHA512 63f1c09796c740b9c64c2db70bb03cba74d2877c333048dd3a330debb215594ad9e3f1fc928e0dfa3e61d1a45aa159cffbb6d2d6fadf3e846c01a082307599c5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

oVohYjg.exe

Path C:\Windows\System\oVohYjg.exe
Size 3.0MB
SHA256 ae8e0ea1e1d732d6eabc8d954ed152743f1a873e816e26bc50d73abf75639f9e
MD5 7424b39af8395a14cf66878659600a22
SHA1 a7da7151487a65b10ebb95137276364991b386ea
SHA512 19f956aa1058e5b8e30dd7c57094de4940a5cf8be4190b2da6595ae0bdfd3f3bbb7757a2e9b7e55b54397c79d5efbdbdb79ac9f5fdf36384a6d6c5f6d2990649
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cn:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

otMWnBh.exe

Path C:\Windows\System\otMWnBh.exe
Size 3.0MB
SHA256 0f06fdf8e2109ace18a37e7c0bd950394ce623593d972d42b28d4324ce419408
MD5 71c736b0e9388997ab1e46cca523b900
SHA1 a6ecbb52952fb0ec8c819a2e880f09211e57df5b
SHA512 0d436d84796a66d4856f7f6946116b86886912a44b16f26bb1cf1c9edb55f81deb68b817d479b804aea218f0f0edd91591f1976dc42167e6d33325cacac7b21d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cQ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

rvvFSGZ.exe

Path C:\Windows\System\rvvFSGZ.exe
Size 3.0MB
SHA256 f6b7e31449f1bedbd6b10847b177f6c82749162ae8eaf3771b733e13a3767624
MD5 cebe75b2e839c836fe593e3b0cd59e77
SHA1 a486a1d9515357f8ead86e30ed177ba7039e58ce
SHA512 b1be2200865613e3dbdff3933ab7c2bae74a03ada60c8710697385a8cce8d265bf3393e77df1ccaa39b26a673537ccd06866060dc16e1ff67783985fcf295d83
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cf:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tOYMVIH.exe

Path C:\Windows\System\tOYMVIH.exe
Size 3.0MB
SHA256 f7850cdce123db71f677dda5de695ff4941b799aefcb427b8d18a6014f2e1314
MD5 add0dfba4865d888268c75d89ad5422b
SHA1 cea9867edd40c82e71978579343486547c2ddcef
SHA512 82a4fc439dc3928e83b47f26d5f5b815c43f4e9f41ce1b642cb21394d75586f1e8343cd4d1a5f1357bd8b091f9f857401381740c76c3ea977b44ac4a9b6acd60
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cO:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsPINVa.exe

Path C:\Windows\System\tsPINVa.exe
Size 3.0MB
SHA256 2f45292323465f9ddf9ddcf8769112e10616a42a5401d90a1a86070f03d94023
MD5 b410c34375d061e66664d350484a11c2
SHA1 d43bedb352fffe559fd2347e3e4054e67dbcf330
SHA512 54b5036e20aeed96e24c2bf3aa850daa07b9c740959ee2deff31980144522843bfd4f38cea0fe59cc5297aff7c0f78d86eb1813be80089578e69b5bb1105cf27
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

yCNRyVI.exe

Path C:\Windows\System\yCNRyVI.exe
Size 3.0MB
SHA256 902eed41e7573027afe85ef439c852dfe512730db3adcca5838da0210048a55d
MD5 df2cb2b11a108bd389a7705e50c46b93
SHA1 db8206675b6c06bcb543dc24567094e9c104a413
SHA512 eefc84e7cb07bff882b54a88b7453f504fd5d6d717309a0a8744238e84cff138a7670eb3d3d8f7a65f9b5cc4f24940b7378e0e8128bf6d36adcc9a7622b3006c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

zuFvwcA.exe

Path C:\Windows\System\zuFvwcA.exe
Size 3.0MB
SHA256 7cb96a356de133bf412bbc4acd646dcce61ff0eb6ab1187eb2f02e2e70ac508d
MD5 825c75b30470640c796b8db1f976485b
SHA1 35374886e98cf4e211ff4aefcafa49a12b5ba023
SHA512 22ebe1462b90cbf0ca1f44b7260300b9d514cf5542f1c58f8b04df0dbfff892a96cba74c5312c63441d0400c3f81b8063abd9d473d638451ab2a93e2f532775f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-2120-0x00007FF7D86E0000-0x00007FF7D8AD6000-memory.dmp

Download

memory/324-57-0x00007FF7D86E0000-0x00007FF7D8AD6000-memory.dmp

Download

memory/448-2126-0x00007FF7EA5B0000-0x00007FF7EA9A6000-memory.dmp

Download

memory/448-773-0x00007FF7EA5B0000-0x00007FF7EA9A6000-memory.dmp

Download

memory/720-750-0x00007FF767ED0000-0x00007FF7682C6000-memory.dmp

Download

memory/720-2133-0x00007FF767ED0000-0x00007FF7682C6000-memory.dmp

Download

memory/732-2114-0x00007FFFFB2C0000-0x00007FFFFBD81000-memory.dmp

Download

memory/732-42-0x00007FFFFB2C0000-0x00007FFFFBD81000-memory.dmp

Download

memory/732-37-0x00000209FD980000-0x00000209FD9A2000-memory.dmp

Download

memory/732-32-0x00007FFFFB2C0000-0x00007FFFFBD81000-memory.dmp

Download

memory/732-392-0x00000209FED80000-0x00000209FF526000-memory.dmp

Download

memory/732-2116-0x00007FFFFB2C3000-0x00007FFFFB2C5000-memory.dmp

Download

memory/732-5-0x00007FFFFB2C3000-0x00007FFFFB2C5000-memory.dmp

Download

memory/792-2118-0x00007FF610870000-0x00007FF610C66000-memory.dmp

Download

memory/792-768-0x00007FF610870000-0x00007FF610C66000-memory.dmp

Download

memory/796-736-0x00007FF75C110000-0x00007FF75C506000-memory.dmp

Download

memory/796-2136-0x00007FF75C110000-0x00007FF75C506000-memory.dmp

Download

memory/952-766-0x00007FF7C6C20000-0x00007FF7C7016000-memory.dmp

Download

memory/952-2139-0x00007FF7C6C20000-0x00007FF7C7016000-memory.dmp

Download

memory/1444-708-0x00007FF7978F0000-0x00007FF797CE6000-memory.dmp

Download

memory/1444-2127-0x00007FF7978F0000-0x00007FF797CE6000-memory.dmp

Download

memory/1804-763-0x00007FF660B40000-0x00007FF660F36000-memory.dmp

Download

memory/1804-2140-0x00007FF660B40000-0x00007FF660F36000-memory.dmp

Download

memory/2824-709-0x00007FF637100000-0x00007FF6374F6000-memory.dmp

Download

memory/2824-2128-0x00007FF637100000-0x00007FF6374F6000-memory.dmp

Download

memory/3196-2129-0x00007FF7C2420000-0x00007FF7C2816000-memory.dmp

Download

memory/3196-710-0x00007FF7C2420000-0x00007FF7C2816000-memory.dmp

Download

memory/3324-2130-0x00007FF688960000-0x00007FF688D56000-memory.dmp

Download

memory/3324-758-0x00007FF688960000-0x00007FF688D56000-memory.dmp

Download

memory/3720-725-0x00007FF6AB3F0000-0x00007FF6AB7E6000-memory.dmp

Download

memory/3720-2137-0x00007FF6AB3F0000-0x00007FF6AB7E6000-memory.dmp

Download

memory/3768-1-0x000002018DBE0000-0x000002018DBF0000-memory.dmp

Download

memory/3768-0-0x00007FF651ED0000-0x00007FF6522C6000-memory.dmp

Download

memory/3856-53-0x00007FF77A2C0000-0x00007FF77A6B6000-memory.dmp

Download

memory/3856-2119-0x00007FF77A2C0000-0x00007FF77A6B6000-memory.dmp

Download

memory/4036-2115-0x00007FF621240000-0x00007FF621636000-memory.dmp

Download

memory/4036-707-0x00007FF621240000-0x00007FF621636000-memory.dmp

Download

memory/4036-2123-0x00007FF621240000-0x00007FF621636000-memory.dmp

Download

memory/4124-2125-0x00007FF792440000-0x00007FF792836000-memory.dmp

Download

memory/4124-713-0x00007FF792440000-0x00007FF792836000-memory.dmp

Download

memory/4180-729-0x00007FF6D3880000-0x00007FF6D3C76000-memory.dmp

Download

memory/4180-2131-0x00007FF6D3880000-0x00007FF6D3C76000-memory.dmp

Download

memory/4380-2138-0x00007FF769050000-0x00007FF769446000-memory.dmp

Download

memory/4380-717-0x00007FF769050000-0x00007FF769446000-memory.dmp

Download

memory/4408-746-0x00007FF6C13B0000-0x00007FF6C17A6000-memory.dmp

Download

memory/4408-2132-0x00007FF6C13B0000-0x00007FF6C17A6000-memory.dmp

Download

memory/4772-2121-0x00007FF78C6D0000-0x00007FF78CAC6000-memory.dmp

Download

memory/4772-769-0x00007FF78C6D0000-0x00007FF78CAC6000-memory.dmp

Download

memory/4852-772-0x00007FF631FE0000-0x00007FF6323D6000-memory.dmp

Download

memory/4852-2124-0x00007FF631FE0000-0x00007FF6323D6000-memory.dmp

Download

memory/4876-771-0x00007FF6FB8E0000-0x00007FF6FBCD6000-memory.dmp

Download

memory/4876-2122-0x00007FF6FB8E0000-0x00007FF6FBCD6000-memory.dmp

Download

memory/4892-2134-0x00007FF6E4B00000-0x00007FF6E4EF6000-memory.dmp

Download

memory/4892-732-0x00007FF6E4B00000-0x00007FF6E4EF6000-memory.dmp

Download

memory/4980-2135-0x00007FF77AAA0000-0x00007FF77AE96000-memory.dmp

Download

memory/4980-765-0x00007FF77AAA0000-0x00007FF77AE96000-memory.dmp

Download

memory/5008-2117-0x00007FF6C2900000-0x00007FF6C2CF6000-memory.dmp

Download

memory/5008-46-0x00007FF6C2900000-0x00007FF6C2CF6000-memory.dmp

Download