xmrig | 88b355238870c6674cd0544389b56997c49dd3527db0192b2c8aedf0514c2f3d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
Size 2.9MB
Sample240614-cncnnsvgrm
SHA256 88b355238870c6674cd0544389b56997c49dd3527db0192b2c8aedf0514c2f3d
MD5 9a50eaa30c220d1dbc6187fb32f2e0b0
SHA1 19ec5b5deca5dbb944be20ec087d5a9c193c4777
SHA512 7c89a283a6d376aeb59a5026d2c8547a873c5ed10f972311cdf0ace70883f1c099999c966945918e1abdf03388954c57d1c4d8fe4896820d16b87cd08dbea032
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1168-0-0x00007FF7E3FE0000-0x00007FF7E43D6000-memory.dmp	xmrig
behavioral2/memory/3516-6-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-9.dat	xmrig
behavioral2/files/0x0008000000023418-10.dat	xmrig
behavioral2/files/0x000700000002341a-25.dat	xmrig
behavioral2/files/0x000700000002341b-29.dat	xmrig
behavioral2/files/0x000700000002341d-44.dat	xmrig
behavioral2/files/0x000700000002341e-61.dat	xmrig
behavioral2/memory/3500-68-0x00007FF72BA10000-0x00007FF72BE06000-memory.dmp	xmrig
behavioral2/files/0x0008000000023420-90.dat	xmrig
behavioral2/files/0x0007000000023424-96.dat	xmrig
behavioral2/files/0x0007000000023425-105.dat	xmrig
behavioral2/files/0x0007000000023427-115.dat	xmrig
behavioral2/files/0x000700000002342c-134.dat	xmrig
behavioral2/files/0x000700000002342f-149.dat	xmrig
behavioral2/memory/2748-767-0x00007FF714A50000-0x00007FF714E46000-memory.dmp	xmrig
behavioral2/memory/4656-768-0x00007FF7CB140000-0x00007FF7CB536000-memory.dmp	xmrig
behavioral2/memory/1952-769-0x00007FF69B650000-0x00007FF69BA46000-memory.dmp	xmrig
behavioral2/memory/3744-780-0x00007FF69E1C0000-0x00007FF69E5B6000-memory.dmp	xmrig
behavioral2/memory/2520-795-0x00007FF7C28B0000-0x00007FF7C2CA6000-memory.dmp	xmrig
behavioral2/memory/3980-799-0x00007FF7806E0000-0x00007FF780AD6000-memory.dmp	xmrig
behavioral2/memory/4952-787-0x00007FF635510000-0x00007FF635906000-memory.dmp	xmrig
behavioral2/memory/1960-811-0x00007FF669560000-0x00007FF669956000-memory.dmp	xmrig
behavioral2/memory/2912-820-0x00007FF77F3D0000-0x00007FF77F7C6000-memory.dmp	xmrig
behavioral2/memory/1600-817-0x00007FF7623A0000-0x00007FF762796000-memory.dmp	xmrig
behavioral2/memory/1260-816-0x00007FF65C8C0000-0x00007FF65CCB6000-memory.dmp	xmrig
behavioral2/memory/2568-808-0x00007FF7DBCC0000-0x00007FF7DC0B6000-memory.dmp	xmrig
behavioral2/memory/3204-805-0x00007FF7452C0000-0x00007FF7456B6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-184.dat	xmrig
behavioral2/files/0x0007000000023434-182.dat	xmrig
behavioral2/files/0x0007000000023435-179.dat	xmrig
behavioral2/files/0x0007000000023433-177.dat	xmrig
behavioral2/files/0x0007000000023432-172.dat	xmrig
behavioral2/files/0x0007000000023431-167.dat	xmrig
behavioral2/files/0x0007000000023430-162.dat	xmrig
behavioral2/files/0x000700000002342e-152.dat	xmrig
behavioral2/files/0x000700000002342d-147.dat	xmrig
behavioral2/files/0x000700000002342b-137.dat	xmrig
behavioral2/files/0x000700000002342a-132.dat	xmrig
behavioral2/files/0x0007000000023429-125.dat	xmrig
behavioral2/files/0x0007000000023428-120.dat	xmrig
behavioral2/files/0x0007000000023426-110.dat	xmrig
behavioral2/files/0x0008000000023416-94.dat	xmrig
behavioral2/files/0x0007000000023422-85.dat	xmrig
behavioral2/files/0x0007000000023423-82.dat	xmrig
behavioral2/files/0x000700000002341f-76.dat	xmrig
behavioral2/files/0x0008000000023421-74.dat	xmrig
behavioral2/memory/3864-69-0x00007FF641A60000-0x00007FF641E56000-memory.dmp	xmrig
behavioral2/memory/2308-65-0x00007FF7A5AA0000-0x00007FF7A5E96000-memory.dmp	xmrig
behavioral2/memory/2608-60-0x00007FF681F70000-0x00007FF682366000-memory.dmp	xmrig
behavioral2/memory/928-57-0x00007FF706900000-0x00007FF706CF6000-memory.dmp	xmrig
behavioral2/memory/3524-41-0x00007FF603D30000-0x00007FF604126000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-36.dat	xmrig
behavioral2/memory/2376-15-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp	xmrig
behavioral2/files/0x000600000002327b-11.dat	xmrig
behavioral2/memory/3212-828-0x00007FF772CC0000-0x00007FF7730B6000-memory.dmp	xmrig
behavioral2/memory/4088-833-0x00007FF744810000-0x00007FF744C06000-memory.dmp	xmrig
behavioral2/memory/3632-823-0x00007FF6F4C80000-0x00007FF6F5076000-memory.dmp	xmrig
behavioral2/memory/3516-2214-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp	xmrig
behavioral2/memory/2376-2217-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp	xmrig
behavioral2/memory/2748-2218-0x00007FF714A50000-0x00007FF714E46000-memory.dmp	xmrig
behavioral2/memory/3516-2219-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp	xmrig
behavioral2/memory/2308-2221-0x00007FF7A5AA0000-0x00007FF7A5E96000-memory.dmp	xmrig
behavioral2/memory/2376-2220-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	3716	powershell.exe
5	3716	powershell.exe
9	3716	powershell.exe
10	3716	powershell.exe
12	3716	powershell.exe
13	3716	powershell.exe
15	3716	powershell.exe
18	3716	powershell.exe
19	3716	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3516	OQzeLVi.exe
2376	mepREpj.exe
2308	LjCoMvl.exe
3524	UBSFXLx.exe
928	uLdOras.exe
2608	GHmUKwN.exe
3500	qvdkGhy.exe
3864	zdojQDx.exe
3212	DDekHgl.exe
2748	RyBeQwD.exe
4088	QjtfIvk.exe
4656	awBcLsC.exe
1952	ROgeHBV.exe
3744	ewNFJRC.exe
4952	HiwYgpO.exe
2520	MlXOzwR.exe
3980	zNEUHUk.exe
3204	hnJUghA.exe
2568	adXmORj.exe
1960	kNqlESp.exe
1260	cMQWcli.exe
1600	huRDXcX.exe
2912	ONupyHm.exe
3632	EUlRhrv.exe
3144	uspzNZr.exe
1356	GGkXSIx.exe
2868	XsQDEkB.exe
1616	tpeFhUJ.exe
2080	GXiWjUf.exe
712	lnTIUfS.exe
3328	rermdnX.exe
2564	cPmarPb.exe
3616	auXTBwU.exe
2556	pwItJwn.exe
4268	KaiBXBf.exe
2460	yfztTEz.exe
5064	YfmMhgc.exe
4864	hzSKufX.exe
3508	dHDZIHL.exe
3240	NQPltGE.exe
3928	NHJMfNs.exe
1756	fzbNBeE.exe
4868	hyDGWHd.exe
3652	yusEBMm.exe
1720	rKMVpwt.exe
5012	fMAttXe.exe
4304	WfYDsjL.exe
1052	gCfndmC.exe
1328	RMaxGOp.exe
4184	ZHLQXAQ.exe
2600	znkYSdm.exe
532	SNBOKHO.exe
4824	npMJKOp.exe
4844	RHGtoGY.exe
2752	kFrjVye.exe
1184	nPvbfEm.exe
688	uetFDtB.exe
392	aVnVEEe.exe
4320	HprOnpv.exe
1332	sltOitF.exe
3772	uLFxexk.exe
2956	xLjnavd.exe
2240	uYQJnnH.exe
5016	ZQxAesg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1168-0-0x00007FF7E3FE0000-0x00007FF7E43D6000-memory.dmp	upx
behavioral2/memory/3516-6-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp	upx
behavioral2/files/0x0007000000023419-9.dat	upx
behavioral2/files/0x0008000000023418-10.dat	upx
behavioral2/files/0x000700000002341a-25.dat	upx
behavioral2/files/0x000700000002341b-29.dat	upx
behavioral2/files/0x000700000002341d-44.dat	upx
behavioral2/files/0x000700000002341e-61.dat	upx
behavioral2/memory/3500-68-0x00007FF72BA10000-0x00007FF72BE06000-memory.dmp	upx
behavioral2/files/0x0008000000023420-90.dat	upx
behavioral2/files/0x0007000000023424-96.dat	upx
behavioral2/files/0x0007000000023425-105.dat	upx
behavioral2/files/0x0007000000023427-115.dat	upx
behavioral2/files/0x000700000002342c-134.dat	upx
behavioral2/files/0x000700000002342f-149.dat	upx
behavioral2/memory/2748-767-0x00007FF714A50000-0x00007FF714E46000-memory.dmp	upx
behavioral2/memory/4656-768-0x00007FF7CB140000-0x00007FF7CB536000-memory.dmp	upx
behavioral2/memory/1952-769-0x00007FF69B650000-0x00007FF69BA46000-memory.dmp	upx
behavioral2/memory/3744-780-0x00007FF69E1C0000-0x00007FF69E5B6000-memory.dmp	upx
behavioral2/memory/2520-795-0x00007FF7C28B0000-0x00007FF7C2CA6000-memory.dmp	upx
behavioral2/memory/3980-799-0x00007FF7806E0000-0x00007FF780AD6000-memory.dmp	upx
behavioral2/memory/4952-787-0x00007FF635510000-0x00007FF635906000-memory.dmp	upx
behavioral2/memory/1960-811-0x00007FF669560000-0x00007FF669956000-memory.dmp	upx
behavioral2/memory/2912-820-0x00007FF77F3D0000-0x00007FF77F7C6000-memory.dmp	upx
behavioral2/memory/1600-817-0x00007FF7623A0000-0x00007FF762796000-memory.dmp	upx
behavioral2/memory/1260-816-0x00007FF65C8C0000-0x00007FF65CCB6000-memory.dmp	upx
behavioral2/memory/2568-808-0x00007FF7DBCC0000-0x00007FF7DC0B6000-memory.dmp	upx
behavioral2/memory/3204-805-0x00007FF7452C0000-0x00007FF7456B6000-memory.dmp	upx
behavioral2/files/0x0007000000023436-184.dat	upx
behavioral2/files/0x0007000000023434-182.dat	upx
behavioral2/files/0x0007000000023435-179.dat	upx
behavioral2/files/0x0007000000023433-177.dat	upx
behavioral2/files/0x0007000000023432-172.dat	upx
behavioral2/files/0x0007000000023431-167.dat	upx
behavioral2/files/0x0007000000023430-162.dat	upx
behavioral2/files/0x000700000002342e-152.dat	upx
behavioral2/files/0x000700000002342d-147.dat	upx
behavioral2/files/0x000700000002342b-137.dat	upx
behavioral2/files/0x000700000002342a-132.dat	upx
behavioral2/files/0x0007000000023429-125.dat	upx
behavioral2/files/0x0007000000023428-120.dat	upx
behavioral2/files/0x0007000000023426-110.dat	upx
behavioral2/files/0x0008000000023416-94.dat	upx
behavioral2/files/0x0007000000023422-85.dat	upx
behavioral2/files/0x0007000000023423-82.dat	upx
behavioral2/files/0x000700000002341f-76.dat	upx
behavioral2/files/0x0008000000023421-74.dat	upx
behavioral2/memory/3864-69-0x00007FF641A60000-0x00007FF641E56000-memory.dmp	upx
behavioral2/memory/2308-65-0x00007FF7A5AA0000-0x00007FF7A5E96000-memory.dmp	upx
behavioral2/memory/2608-60-0x00007FF681F70000-0x00007FF682366000-memory.dmp	upx
behavioral2/memory/928-57-0x00007FF706900000-0x00007FF706CF6000-memory.dmp	upx
behavioral2/memory/3524-41-0x00007FF603D30000-0x00007FF604126000-memory.dmp	upx
behavioral2/files/0x000700000002341c-36.dat	upx
behavioral2/memory/2376-15-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp	upx
behavioral2/files/0x000600000002327b-11.dat	upx
behavioral2/memory/3212-828-0x00007FF772CC0000-0x00007FF7730B6000-memory.dmp	upx
behavioral2/memory/4088-833-0x00007FF744810000-0x00007FF744C06000-memory.dmp	upx
behavioral2/memory/3632-823-0x00007FF6F4C80000-0x00007FF6F5076000-memory.dmp	upx
behavioral2/memory/3516-2214-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp	upx
behavioral2/memory/2376-2217-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp	upx
behavioral2/memory/2748-2218-0x00007FF714A50000-0x00007FF714E46000-memory.dmp	upx
behavioral2/memory/3516-2219-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp	upx
behavioral2/memory/2308-2221-0x00007FF7A5AA0000-0x00007FF7A5E96000-memory.dmp	upx
behavioral2/memory/2376-2220-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pAfzXFe.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\WPVesVv.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\TCvDhjS.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\xrjVISn.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\JLDhZKV.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\UeHIKXX.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\EmTJjfl.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\zqedKtl.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\stZYTiL.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\fAOSfqc.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\vaqEHmO.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\vxwXQcP.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\evCPSIk.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\ArnDNBb.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\qOMloFI.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\vtPQLxp.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\esTOYGs.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\bLYpyjk.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\BIdTcPx.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\vyNnTSC.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\aDwqBPC.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\bOMlJGD.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\yNlLyRG.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\pjJkunW.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZfhMTCj.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\zlhdICE.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\CPpGfsA.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\gQSNqXu.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\MEMcDmq.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\KLLpTZX.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\uSMYnRR.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\lBJzBtQ.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\LBIJMlH.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\KUIbzxA.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\bTEOXRY.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\muDjUsP.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\eIylykE.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\hILeDPJ.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\sRPiKvj.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\KYsHRZi.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\BiBkMeR.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\GbHNNof.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\YTrubjH.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\wqtToHm.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\gBrmHJS.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\enmMTHT.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\nGAZUkm.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\TBopjWJ.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\pFQyCmB.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\mTZVVoO.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\gALaVUJ.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\uGOrZvE.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\ObHxROT.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\NBYipUE.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\dvPRmWU.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\tbyFURp.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\GloakuC.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\JRzmWrp.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\EJlxMfV.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\hzvVIBF.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\jWpudHU.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\IkMADcK.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\zJYaHTs.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
File created	C:\Windows\System\euzChRQ.exe	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3716	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3716	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	83
PID 1168 wrote to memory of 3716	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	83
PID 1168 wrote to memory of 3516	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	84
PID 1168 wrote to memory of 3516	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	84
PID 1168 wrote to memory of 2376	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	85
PID 1168 wrote to memory of 2376	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	85
PID 1168 wrote to memory of 2308	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	86
PID 1168 wrote to memory of 2308	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	86
PID 1168 wrote to memory of 3524	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	87
PID 1168 wrote to memory of 3524	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	87
PID 1168 wrote to memory of 928	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	88
PID 1168 wrote to memory of 928	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	88
PID 1168 wrote to memory of 2608	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	89
PID 1168 wrote to memory of 2608	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	89
PID 1168 wrote to memory of 3500	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	90
PID 1168 wrote to memory of 3500	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	90
PID 1168 wrote to memory of 3864	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	91
PID 1168 wrote to memory of 3864	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	91
PID 1168 wrote to memory of 2748	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	92
PID 1168 wrote to memory of 2748	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	92
PID 1168 wrote to memory of 3212	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	93
PID 1168 wrote to memory of 3212	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	93
PID 1168 wrote to memory of 4656	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	94
PID 1168 wrote to memory of 4656	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	94
PID 1168 wrote to memory of 4088	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	95
PID 1168 wrote to memory of 4088	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	95
PID 1168 wrote to memory of 1952	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	96
PID 1168 wrote to memory of 1952	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	96
PID 1168 wrote to memory of 3744	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	97
PID 1168 wrote to memory of 3744	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	97
PID 1168 wrote to memory of 4952	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	98
PID 1168 wrote to memory of 4952	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	98
PID 1168 wrote to memory of 2520	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	99
PID 1168 wrote to memory of 2520	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	99
PID 1168 wrote to memory of 3980	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	100
PID 1168 wrote to memory of 3980	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	100
PID 1168 wrote to memory of 3204	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	101
PID 1168 wrote to memory of 3204	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	101
PID 1168 wrote to memory of 2568	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	102
PID 1168 wrote to memory of 2568	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	102
PID 1168 wrote to memory of 1960	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	103
PID 1168 wrote to memory of 1960	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	103
PID 1168 wrote to memory of 1260	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	104
PID 1168 wrote to memory of 1260	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	104
PID 1168 wrote to memory of 1600	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	105
PID 1168 wrote to memory of 1600	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	105
PID 1168 wrote to memory of 2912	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	106
PID 1168 wrote to memory of 2912	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	106
PID 1168 wrote to memory of 3632	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	107
PID 1168 wrote to memory of 3632	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	107
PID 1168 wrote to memory of 3144	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	108
PID 1168 wrote to memory of 3144	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	108
PID 1168 wrote to memory of 1356	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	109
PID 1168 wrote to memory of 1356	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	109
PID 1168 wrote to memory of 2868	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	110
PID 1168 wrote to memory of 2868	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	110
PID 1168 wrote to memory of 1616	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	111
PID 1168 wrote to memory of 1616	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	111
PID 1168 wrote to memory of 2080	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	112
PID 1168 wrote to memory of 2080	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	112
PID 1168 wrote to memory of 712	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	113
PID 1168 wrote to memory of 712	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	113
PID 1168 wrote to memory of 3328	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	114
PID 1168 wrote to memory of 3328	1168	9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a50eaa30c220d1dbc6187fb32f2e0b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\System\OQzeLVi.exe
  C:\Windows\System\OQzeLVi.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\mepREpj.exe
  C:\Windows\System\mepREpj.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\LjCoMvl.exe
  C:\Windows\System\LjCoMvl.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\UBSFXLx.exe
  C:\Windows\System\UBSFXLx.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\uLdOras.exe
  C:\Windows\System\uLdOras.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\GHmUKwN.exe
  C:\Windows\System\GHmUKwN.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\qvdkGhy.exe
  C:\Windows\System\qvdkGhy.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\zdojQDx.exe
  C:\Windows\System\zdojQDx.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\RyBeQwD.exe
  C:\Windows\System\RyBeQwD.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\DDekHgl.exe
  C:\Windows\System\DDekHgl.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\awBcLsC.exe
  C:\Windows\System\awBcLsC.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\QjtfIvk.exe
  C:\Windows\System\QjtfIvk.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\ROgeHBV.exe
  C:\Windows\System\ROgeHBV.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\ewNFJRC.exe
  C:\Windows\System\ewNFJRC.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\HiwYgpO.exe
  C:\Windows\System\HiwYgpO.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\MlXOzwR.exe
  C:\Windows\System\MlXOzwR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\zNEUHUk.exe
  C:\Windows\System\zNEUHUk.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\hnJUghA.exe
  C:\Windows\System\hnJUghA.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\adXmORj.exe
  C:\Windows\System\adXmORj.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\kNqlESp.exe
  C:\Windows\System\kNqlESp.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\cMQWcli.exe
  C:\Windows\System\cMQWcli.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\huRDXcX.exe
  C:\Windows\System\huRDXcX.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ONupyHm.exe
  C:\Windows\System\ONupyHm.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\EUlRhrv.exe
  C:\Windows\System\EUlRhrv.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\uspzNZr.exe
  C:\Windows\System\uspzNZr.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\GGkXSIx.exe
  C:\Windows\System\GGkXSIx.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\XsQDEkB.exe
  C:\Windows\System\XsQDEkB.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\tpeFhUJ.exe
  C:\Windows\System\tpeFhUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\GXiWjUf.exe
  C:\Windows\System\GXiWjUf.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\lnTIUfS.exe
  C:\Windows\System\lnTIUfS.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\rermdnX.exe
  C:\Windows\System\rermdnX.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\cPmarPb.exe
  C:\Windows\System\cPmarPb.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\auXTBwU.exe
  C:\Windows\System\auXTBwU.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\pwItJwn.exe
  C:\Windows\System\pwItJwn.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\KaiBXBf.exe
  C:\Windows\System\KaiBXBf.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\yfztTEz.exe
  C:\Windows\System\yfztTEz.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\YfmMhgc.exe
  C:\Windows\System\YfmMhgc.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\hzSKufX.exe
  C:\Windows\System\hzSKufX.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\dHDZIHL.exe
  C:\Windows\System\dHDZIHL.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\NQPltGE.exe
  C:\Windows\System\NQPltGE.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\NHJMfNs.exe
  C:\Windows\System\NHJMfNs.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\fzbNBeE.exe
  C:\Windows\System\fzbNBeE.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\hyDGWHd.exe
  C:\Windows\System\hyDGWHd.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\yusEBMm.exe
  C:\Windows\System\yusEBMm.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\rKMVpwt.exe
  C:\Windows\System\rKMVpwt.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\fMAttXe.exe
  C:\Windows\System\fMAttXe.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\WfYDsjL.exe
  C:\Windows\System\WfYDsjL.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\gCfndmC.exe
  C:\Windows\System\gCfndmC.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\RMaxGOp.exe
  C:\Windows\System\RMaxGOp.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ZHLQXAQ.exe
  C:\Windows\System\ZHLQXAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\znkYSdm.exe
  C:\Windows\System\znkYSdm.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\SNBOKHO.exe
  C:\Windows\System\SNBOKHO.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\npMJKOp.exe
  C:\Windows\System\npMJKOp.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\RHGtoGY.exe
  C:\Windows\System\RHGtoGY.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\kFrjVye.exe
  C:\Windows\System\kFrjVye.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\nPvbfEm.exe
  C:\Windows\System\nPvbfEm.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\uetFDtB.exe
  C:\Windows\System\uetFDtB.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\aVnVEEe.exe
  C:\Windows\System\aVnVEEe.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\HprOnpv.exe
  C:\Windows\System\HprOnpv.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\sltOitF.exe
  C:\Windows\System\sltOitF.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\uLFxexk.exe
  C:\Windows\System\uLFxexk.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\xLjnavd.exe
  C:\Windows\System\xLjnavd.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\uYQJnnH.exe
  C:\Windows\System\uYQJnnH.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\ZQxAesg.exe
  C:\Windows\System\ZQxAesg.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\ErDkfat.exe
  C:\Windows\System\ErDkfat.exe
  2⤵
  PID:4964
- C:\Windows\System\ZMyixaM.exe
  C:\Windows\System\ZMyixaM.exe
  2⤵
  PID:3248
- C:\Windows\System\YHOXoHm.exe
  C:\Windows\System\YHOXoHm.exe
  2⤵
  PID:4180
- C:\Windows\System\XzQhPxD.exe
  C:\Windows\System\XzQhPxD.exe
  2⤵
  PID:3948
- C:\Windows\System\WOROghY.exe
  C:\Windows\System\WOROghY.exe
  2⤵
  PID:4296
- C:\Windows\System\dCKUWxU.exe
  C:\Windows\System\dCKUWxU.exe
  2⤵
  PID:4672
- C:\Windows\System\xqFkgKR.exe
  C:\Windows\System\xqFkgKR.exe
  2⤵
  PID:1712
- C:\Windows\System\xdWSWkm.exe
  C:\Windows\System\xdWSWkm.exe
  2⤵
  PID:3936
- C:\Windows\System\XoeziKM.exe
  C:\Windows\System\XoeziKM.exe
  2⤵
  PID:2292
- C:\Windows\System\secsKco.exe
  C:\Windows\System\secsKco.exe
  2⤵
  PID:1308
- C:\Windows\System\IfuwkAZ.exe
  C:\Windows\System\IfuwkAZ.exe
  2⤵
  PID:5028
- C:\Windows\System\lFHISnC.exe
  C:\Windows\System\lFHISnC.exe
  2⤵
  PID:4328
- C:\Windows\System\peXhZPq.exe
  C:\Windows\System\peXhZPq.exe
  2⤵
  PID:5100
- C:\Windows\System\Okonyiq.exe
  C:\Windows\System\Okonyiq.exe
  2⤵
  PID:644
- C:\Windows\System\GVSIKVU.exe
  C:\Windows\System\GVSIKVU.exe
  2⤵
  PID:5152
- C:\Windows\System\FyEongi.exe
  C:\Windows\System\FyEongi.exe
  2⤵
  PID:5176
- C:\Windows\System\wwJHApW.exe
  C:\Windows\System\wwJHApW.exe
  2⤵
  PID:5208
- C:\Windows\System\cBJmKyT.exe
  C:\Windows\System\cBJmKyT.exe
  2⤵
  PID:5236
- C:\Windows\System\WPUYHbc.exe
  C:\Windows\System\WPUYHbc.exe
  2⤵
  PID:5264
- C:\Windows\System\UdvALmU.exe
  C:\Windows\System\UdvALmU.exe
  2⤵
  PID:5288
- C:\Windows\System\UuruQfj.exe
  C:\Windows\System\UuruQfj.exe
  2⤵
  PID:5320
- C:\Windows\System\KRucspC.exe
  C:\Windows\System\KRucspC.exe
  2⤵
  PID:5348
- C:\Windows\System\cJUeKRm.exe
  C:\Windows\System\cJUeKRm.exe
  2⤵
  PID:5376
- C:\Windows\System\PVrCTta.exe
  C:\Windows\System\PVrCTta.exe
  2⤵
  PID:5404
- C:\Windows\System\gGoylgg.exe
  C:\Windows\System\gGoylgg.exe
  2⤵
  PID:5432
- C:\Windows\System\FuXauaz.exe
  C:\Windows\System\FuXauaz.exe
  2⤵
  PID:5460
- C:\Windows\System\wHyuRKv.exe
  C:\Windows\System\wHyuRKv.exe
  2⤵
  PID:5488
- C:\Windows\System\KUxHxWk.exe
  C:\Windows\System\KUxHxWk.exe
  2⤵
  PID:5516
- C:\Windows\System\gkZnNLL.exe
  C:\Windows\System\gkZnNLL.exe
  2⤵
  PID:5544
- C:\Windows\System\iIfQANC.exe
  C:\Windows\System\iIfQANC.exe
  2⤵
  PID:5572
- C:\Windows\System\uJWsFnF.exe
  C:\Windows\System\uJWsFnF.exe
  2⤵
  PID:5600
- C:\Windows\System\yLVJTip.exe
  C:\Windows\System\yLVJTip.exe
  2⤵
  PID:5632
- C:\Windows\System\YmMwRPw.exe
  C:\Windows\System\YmMwRPw.exe
  2⤵
  PID:5664
- C:\Windows\System\sUenoQi.exe
  C:\Windows\System\sUenoQi.exe
  2⤵
  PID:5692
- C:\Windows\System\PsvVEwK.exe
  C:\Windows\System\PsvVEwK.exe
  2⤵
  PID:5720
- C:\Windows\System\sCVNDJV.exe
  C:\Windows\System\sCVNDJV.exe
  2⤵
  PID:5748
- C:\Windows\System\vfFnuFQ.exe
  C:\Windows\System\vfFnuFQ.exe
  2⤵
  PID:5776
- C:\Windows\System\OXFWWvM.exe
  C:\Windows\System\OXFWWvM.exe
  2⤵
  PID:5804
- C:\Windows\System\ZqNaATd.exe
  C:\Windows\System\ZqNaATd.exe
  2⤵
  PID:5832
- C:\Windows\System\XvCxAHj.exe
  C:\Windows\System\XvCxAHj.exe
  2⤵
  PID:5860
- C:\Windows\System\kMkfzyL.exe
  C:\Windows\System\kMkfzyL.exe
  2⤵
  PID:5888
- C:\Windows\System\KykwYDj.exe
  C:\Windows\System\KykwYDj.exe
  2⤵
  PID:5916
- C:\Windows\System\CBXdDgV.exe
  C:\Windows\System\CBXdDgV.exe
  2⤵
  PID:5940
- C:\Windows\System\NTYaaZf.exe
  C:\Windows\System\NTYaaZf.exe
  2⤵
  PID:5968
- C:\Windows\System\YZxKgyA.exe
  C:\Windows\System\YZxKgyA.exe
  2⤵
  PID:6004
- C:\Windows\System\ZcxlhhR.exe
  C:\Windows\System\ZcxlhhR.exe
  2⤵
  PID:6036
- C:\Windows\System\qYqUTMq.exe
  C:\Windows\System\qYqUTMq.exe
  2⤵
  PID:6064
- C:\Windows\System\YjEABLL.exe
  C:\Windows\System\YjEABLL.exe
  2⤵
  PID:6092
- C:\Windows\System\ecDHrpk.exe
  C:\Windows\System\ecDHrpk.exe
  2⤵
  PID:6124
- C:\Windows\System\yIMzyxR.exe
  C:\Windows\System\yIMzyxR.exe
  2⤵
  PID:380
- C:\Windows\System\rUazNzO.exe
  C:\Windows\System\rUazNzO.exe
  2⤵
  PID:2560
- C:\Windows\System\daqwmCe.exe
  C:\Windows\System\daqwmCe.exe
  2⤵
  PID:4988
- C:\Windows\System\WopQtOS.exe
  C:\Windows\System\WopQtOS.exe
  2⤵
  PID:748
- C:\Windows\System\OLjBCCk.exe
  C:\Windows\System\OLjBCCk.exe
  2⤵
  PID:2768
- C:\Windows\System\EoKOgsg.exe
  C:\Windows\System\EoKOgsg.exe
  2⤵
  PID:5172
- C:\Windows\System\XKtNaNT.exe
  C:\Windows\System\XKtNaNT.exe
  2⤵
  PID:5248
- C:\Windows\System\lLeGhIt.exe
  C:\Windows\System\lLeGhIt.exe
  2⤵
  PID:5304
- C:\Windows\System\rhEGvrh.exe
  C:\Windows\System\rhEGvrh.exe
  2⤵
  PID:5360
- C:\Windows\System\HJUTgIu.exe
  C:\Windows\System\HJUTgIu.exe
  2⤵
  PID:5424
- C:\Windows\System\WrrOALj.exe
  C:\Windows\System\WrrOALj.exe
  2⤵
  PID:5500
- C:\Windows\System\ESqTEjF.exe
  C:\Windows\System\ESqTEjF.exe
  2⤵
  PID:5560
- C:\Windows\System\PzGtFyt.exe
  C:\Windows\System\PzGtFyt.exe
  2⤵
  PID:5628
- C:\Windows\System\wZjjPFS.exe
  C:\Windows\System\wZjjPFS.exe
  2⤵
  PID:5704
- C:\Windows\System\ZpMdNgO.exe
  C:\Windows\System\ZpMdNgO.exe
  2⤵
  PID:5764
- C:\Windows\System\aootHHG.exe
  C:\Windows\System\aootHHG.exe
  2⤵
  PID:5824
- C:\Windows\System\YnowWZp.exe
  C:\Windows\System\YnowWZp.exe
  2⤵
  PID:5880
- C:\Windows\System\icEnPpj.exe
  C:\Windows\System\icEnPpj.exe
  2⤵
  PID:5932
- C:\Windows\System\YEykgwS.exe
  C:\Windows\System\YEykgwS.exe
  2⤵
  PID:5996
- C:\Windows\System\rOmHhLE.exe
  C:\Windows\System\rOmHhLE.exe
  2⤵
  PID:6076
- C:\Windows\System\KXZbTPu.exe
  C:\Windows\System\KXZbTPu.exe
  2⤵
  PID:6136
- C:\Windows\System\ybRLzru.exe
  C:\Windows\System\ybRLzru.exe
  2⤵
  PID:1700
- C:\Windows\System\ICOXifP.exe
  C:\Windows\System\ICOXifP.exe
  2⤵
  PID:764
- C:\Windows\System\cofslfm.exe
  C:\Windows\System\cofslfm.exe
  2⤵
  PID:5276
- C:\Windows\System\ySMKxvU.exe
  C:\Windows\System\ySMKxvU.exe
  2⤵
  PID:5396
- C:\Windows\System\gaRdwPJ.exe
  C:\Windows\System\gaRdwPJ.exe
  2⤵
  PID:5536
- C:\Windows\System\pCkcJxW.exe
  C:\Windows\System\pCkcJxW.exe
  2⤵
  PID:5680
- C:\Windows\System\LTdTZET.exe
  C:\Windows\System\LTdTZET.exe
  2⤵
  PID:5852
- C:\Windows\System\SnicZME.exe
  C:\Windows\System\SnicZME.exe
  2⤵
  PID:5992
- C:\Windows\System\tXcNOBF.exe
  C:\Windows\System\tXcNOBF.exe
  2⤵
  PID:6164
- C:\Windows\System\Qgzszqb.exe
  C:\Windows\System\Qgzszqb.exe
  2⤵
  PID:6188
- C:\Windows\System\otXhlib.exe
  C:\Windows\System\otXhlib.exe
  2⤵
  PID:6220
- C:\Windows\System\dQHyyOy.exe
  C:\Windows\System\dQHyyOy.exe
  2⤵
  PID:6244
- C:\Windows\System\XGgwEMm.exe
  C:\Windows\System\XGgwEMm.exe
  2⤵
  PID:6276
- C:\Windows\System\yzkezDw.exe
  C:\Windows\System\yzkezDw.exe
  2⤵
  PID:6300
- C:\Windows\System\dZTQfAA.exe
  C:\Windows\System\dZTQfAA.exe
  2⤵
  PID:6328
- C:\Windows\System\SSCUjjH.exe
  C:\Windows\System\SSCUjjH.exe
  2⤵
  PID:6356
- C:\Windows\System\GbSbfUP.exe
  C:\Windows\System\GbSbfUP.exe
  2⤵
  PID:6384
- C:\Windows\System\DyqYTFB.exe
  C:\Windows\System\DyqYTFB.exe
  2⤵
  PID:6412
- C:\Windows\System\IvzgCno.exe
  C:\Windows\System\IvzgCno.exe
  2⤵
  PID:6444
- C:\Windows\System\RTPatyq.exe
  C:\Windows\System\RTPatyq.exe
  2⤵
  PID:6472
- C:\Windows\System\qEpFmHe.exe
  C:\Windows\System\qEpFmHe.exe
  2⤵
  PID:6500
- C:\Windows\System\StNRmMp.exe
  C:\Windows\System\StNRmMp.exe
  2⤵
  PID:6524
- C:\Windows\System\TVWVNpC.exe
  C:\Windows\System\TVWVNpC.exe
  2⤵
  PID:6552
- C:\Windows\System\pgksBYR.exe
  C:\Windows\System\pgksBYR.exe
  2⤵
  PID:6580
- C:\Windows\System\DHVldPB.exe
  C:\Windows\System\DHVldPB.exe
  2⤵
  PID:6608
- C:\Windows\System\ZkjNNMr.exe
  C:\Windows\System\ZkjNNMr.exe
  2⤵
  PID:6636
- C:\Windows\System\mtkimCz.exe
  C:\Windows\System\mtkimCz.exe
  2⤵
  PID:6664
- C:\Windows\System\UylCrbp.exe
  C:\Windows\System\UylCrbp.exe
  2⤵
  PID:6692
- C:\Windows\System\tXOesah.exe
  C:\Windows\System\tXOesah.exe
  2⤵
  PID:6724
- C:\Windows\System\akLcsqJ.exe
  C:\Windows\System\akLcsqJ.exe
  2⤵
  PID:6752
- C:\Windows\System\ijdLKLo.exe
  C:\Windows\System\ijdLKLo.exe
  2⤵
  PID:6776
- C:\Windows\System\vatxgjS.exe
  C:\Windows\System\vatxgjS.exe
  2⤵
  PID:6804
- C:\Windows\System\cqHzqhx.exe
  C:\Windows\System\cqHzqhx.exe
  2⤵
  PID:6836
- C:\Windows\System\KizXOdi.exe
  C:\Windows\System\KizXOdi.exe
  2⤵
  PID:6864
- C:\Windows\System\vDONURt.exe
  C:\Windows\System\vDONURt.exe
  2⤵
  PID:6888
- C:\Windows\System\OubBKnX.exe
  C:\Windows\System\OubBKnX.exe
  2⤵
  PID:6928
- C:\Windows\System\NpFxexB.exe
  C:\Windows\System\NpFxexB.exe
  2⤵
  PID:6948
- C:\Windows\System\njcwnSi.exe
  C:\Windows\System\njcwnSi.exe
  2⤵
  PID:6972
- C:\Windows\System\jIsgqKw.exe
  C:\Windows\System\jIsgqKw.exe
  2⤵
  PID:7000
- C:\Windows\System\CCNgiDO.exe
  C:\Windows\System\CCNgiDO.exe
  2⤵
  PID:7028
- C:\Windows\System\ITogzbM.exe
  C:\Windows\System\ITogzbM.exe
  2⤵
  PID:7056
- C:\Windows\System\VhyKJWR.exe
  C:\Windows\System\VhyKJWR.exe
  2⤵
  PID:7088
- C:\Windows\System\eyAxGou.exe
  C:\Windows\System\eyAxGou.exe
  2⤵
  PID:7116
- C:\Windows\System\jyXLAtz.exe
  C:\Windows\System\jyXLAtz.exe
  2⤵
  PID:7140
- C:\Windows\System\lFDovvR.exe
  C:\Windows\System\lFDovvR.exe
  2⤵
  PID:6052
- C:\Windows\System\jZLGzdP.exe
  C:\Windows\System\jZLGzdP.exe
  2⤵
  PID:1128
- C:\Windows\System\yrIlEUs.exe
  C:\Windows\System\yrIlEUs.exe
  2⤵
  PID:5336
- C:\Windows\System\RxvxhOC.exe
  C:\Windows\System\RxvxhOC.exe
  2⤵
  PID:5676
- C:\Windows\System\bBChwDp.exe
  C:\Windows\System\bBChwDp.exe
  2⤵
  PID:5964
- C:\Windows\System\PuaYAIM.exe
  C:\Windows\System\PuaYAIM.exe
  2⤵
  PID:1508
- C:\Windows\System\gfXahoM.exe
  C:\Windows\System\gfXahoM.exe
  2⤵
  PID:6260
- C:\Windows\System\mzIlqgQ.exe
  C:\Windows\System\mzIlqgQ.exe
  2⤵
  PID:6316
- C:\Windows\System\LCKyEis.exe
  C:\Windows\System\LCKyEis.exe
  2⤵
  PID:4124
- C:\Windows\System\YjoukJK.exe
  C:\Windows\System\YjoukJK.exe
  2⤵
  PID:6432
- C:\Windows\System\YVwKqwu.exe
  C:\Windows\System\YVwKqwu.exe
  2⤵
  PID:6492
- C:\Windows\System\QityYpO.exe
  C:\Windows\System\QityYpO.exe
  2⤵
  PID:2040
- C:\Windows\System\xMKkUwr.exe
  C:\Windows\System\xMKkUwr.exe
  2⤵
  PID:6596
- C:\Windows\System\vlMQbbt.exe
  C:\Windows\System\vlMQbbt.exe
  2⤵
  PID:6652
- C:\Windows\System\XcYupUi.exe
  C:\Windows\System\XcYupUi.exe
  2⤵
  PID:6712
- C:\Windows\System\pjJkunW.exe
  C:\Windows\System\pjJkunW.exe
  2⤵
  PID:6792
- C:\Windows\System\ZmoaVOl.exe
  C:\Windows\System\ZmoaVOl.exe
  2⤵
  PID:6848
- C:\Windows\System\NjETurD.exe
  C:\Windows\System\NjETurD.exe
  2⤵
  PID:6900
- C:\Windows\System\lmuucPh.exe
  C:\Windows\System\lmuucPh.exe
  2⤵
  PID:6960
- C:\Windows\System\GfcupCe.exe
  C:\Windows\System\GfcupCe.exe
  2⤵
  PID:7016
- C:\Windows\System\PvpKQlt.exe
  C:\Windows\System\PvpKQlt.exe
  2⤵
  PID:7080
- C:\Windows\System\sEYVuZk.exe
  C:\Windows\System\sEYVuZk.exe
  2⤵
  PID:7136
- C:\Windows\System\wGfcdCv.exe
  C:\Windows\System\wGfcdCv.exe
  2⤵
  PID:5164
- C:\Windows\System\pPadKgU.exe
  C:\Windows\System\pPadKgU.exe
  2⤵
  PID:5928
- C:\Windows\System\FuSsCNZ.exe
  C:\Windows\System\FuSsCNZ.exe
  2⤵
  PID:2592
- C:\Windows\System\hFeIZeM.exe
  C:\Windows\System\hFeIZeM.exe
  2⤵
  PID:6352
- C:\Windows\System\iwRGFwV.exe
  C:\Windows\System\iwRGFwV.exe
  2⤵
  PID:6520
- C:\Windows\System\txlBRGM.exe
  C:\Windows\System\txlBRGM.exe
  2⤵
  PID:6624
- C:\Windows\System\HoWhmCD.exe
  C:\Windows\System\HoWhmCD.exe
  2⤵
  PID:6764
- C:\Windows\System\YyMKurs.exe
  C:\Windows\System\YyMKurs.exe
  2⤵
  PID:6880
- C:\Windows\System\skYzUIS.exe
  C:\Windows\System\skYzUIS.exe
  2⤵
  PID:6992
- C:\Windows\System\LITzaFO.exe
  C:\Windows\System\LITzaFO.exe
  2⤵
  PID:2300
- C:\Windows\System\xKKKDcT.exe
  C:\Windows\System\xKKKDcT.exe
  2⤵
  PID:5612
- C:\Windows\System\EcZYVsL.exe
  C:\Windows\System\EcZYVsL.exe
  2⤵
  PID:6408
- C:\Windows\System\bRdTtgZ.exe
  C:\Windows\System\bRdTtgZ.exe
  2⤵
  PID:7196
- C:\Windows\System\ZdTEKqm.exe
  C:\Windows\System\ZdTEKqm.exe
  2⤵
  PID:7224
- C:\Windows\System\iYUkmnq.exe
  C:\Windows\System\iYUkmnq.exe
  2⤵
  PID:7252
- C:\Windows\System\IYgAzws.exe
  C:\Windows\System\IYgAzws.exe
  2⤵
  PID:7276
- C:\Windows\System\QyNmsup.exe
  C:\Windows\System\QyNmsup.exe
  2⤵
  PID:7304
- C:\Windows\System\epOYoVx.exe
  C:\Windows\System\epOYoVx.exe
  2⤵
  PID:7332
- C:\Windows\System\NlzHSWV.exe
  C:\Windows\System\NlzHSWV.exe
  2⤵
  PID:7364
- C:\Windows\System\JJxHQzL.exe
  C:\Windows\System\JJxHQzL.exe
  2⤵
  PID:7388
- C:\Windows\System\HDGmcte.exe
  C:\Windows\System\HDGmcte.exe
  2⤵
  PID:7416
- C:\Windows\System\XWFPTsS.exe
  C:\Windows\System\XWFPTsS.exe
  2⤵
  PID:7448
- C:\Windows\System\wnQiHAT.exe
  C:\Windows\System\wnQiHAT.exe
  2⤵
  PID:7476
- C:\Windows\System\VprzrpS.exe
  C:\Windows\System\VprzrpS.exe
  2⤵
  PID:7504
- C:\Windows\System\GuBSAKz.exe
  C:\Windows\System\GuBSAKz.exe
  2⤵
  PID:7532
- C:\Windows\System\GQbjwMZ.exe
  C:\Windows\System\GQbjwMZ.exe
  2⤵
  PID:7560
- C:\Windows\System\FHMlkSB.exe
  C:\Windows\System\FHMlkSB.exe
  2⤵
  PID:7588
- C:\Windows\System\eJxfbjL.exe
  C:\Windows\System\eJxfbjL.exe
  2⤵
  PID:7660
- C:\Windows\System\jzUpxpp.exe
  C:\Windows\System\jzUpxpp.exe
  2⤵
  PID:7704
- C:\Windows\System\bTYcTAv.exe
  C:\Windows\System\bTYcTAv.exe
  2⤵
  PID:7720
- C:\Windows\System\HmxMJjL.exe
  C:\Windows\System\HmxMJjL.exe
  2⤵
  PID:7736
- C:\Windows\System\PameLvp.exe
  C:\Windows\System\PameLvp.exe
  2⤵
  PID:7768
- C:\Windows\System\kxtrTbV.exe
  C:\Windows\System\kxtrTbV.exe
  2⤵
  PID:7812
- C:\Windows\System\UDcPzdD.exe
  C:\Windows\System\UDcPzdD.exe
  2⤵
  PID:7840
- C:\Windows\System\UVVzNgU.exe
  C:\Windows\System\UVVzNgU.exe
  2⤵
  PID:7864
- C:\Windows\System\UdwetUY.exe
  C:\Windows\System\UdwetUY.exe
  2⤵
  PID:7912
- C:\Windows\System\KolkDhf.exe
  C:\Windows\System\KolkDhf.exe
  2⤵
  PID:7972
- C:\Windows\System\OHOTwGx.exe
  C:\Windows\System\OHOTwGx.exe
  2⤵
  PID:7992
- C:\Windows\System\pFKkQWP.exe
  C:\Windows\System\pFKkQWP.exe
  2⤵
  PID:8012
- C:\Windows\System\THCvXcm.exe
  C:\Windows\System\THCvXcm.exe
  2⤵
  PID:8032
- C:\Windows\System\GbyLtdO.exe
  C:\Windows\System\GbyLtdO.exe
  2⤵
  PID:8080
- C:\Windows\System\pgIJpvg.exe
  C:\Windows\System\pgIJpvg.exe
  2⤵
  PID:8100
- C:\Windows\System\gbdmIaZ.exe
  C:\Windows\System\gbdmIaZ.exe
  2⤵
  PID:8120
- C:\Windows\System\cHhoxFf.exe
  C:\Windows\System\cHhoxFf.exe
  2⤵
  PID:8168
- C:\Windows\System\XmOLyJB.exe
  C:\Windows\System\XmOLyJB.exe
  2⤵
  PID:6464
- C:\Windows\System\cmYxZbD.exe
  C:\Windows\System\cmYxZbD.exe
  2⤵
  PID:6944
- C:\Windows\System\JmywpaT.exe
  C:\Windows\System\JmywpaT.exe
  2⤵
  PID:1888
- C:\Windows\System\RmRoBql.exe
  C:\Windows\System\RmRoBql.exe
  2⤵
  PID:5528
- C:\Windows\System\JqzuWoc.exe
  C:\Windows\System\JqzuWoc.exe
  2⤵
  PID:7188
- C:\Windows\System\GdZSHgz.exe
  C:\Windows\System\GdZSHgz.exe
  2⤵
  PID:7216
- C:\Windows\System\VbHejbT.exe
  C:\Windows\System\VbHejbT.exe
  2⤵
  PID:4504
- C:\Windows\System\RrWNhRw.exe
  C:\Windows\System\RrWNhRw.exe
  2⤵
  PID:7320
- C:\Windows\System\BNkUDUc.exe
  C:\Windows\System\BNkUDUc.exe
  2⤵
  PID:7356
- C:\Windows\System\YYgbZZW.exe
  C:\Windows\System\YYgbZZW.exe
  2⤵
  PID:7460
- C:\Windows\System\daCcbLe.exe
  C:\Windows\System\daCcbLe.exe
  2⤵
  PID:3100
- C:\Windows\System\KzPRUBz.exe
  C:\Windows\System\KzPRUBz.exe
  2⤵
  PID:4012
- C:\Windows\System\bzpTIfv.exe
  C:\Windows\System\bzpTIfv.exe
  2⤵
  PID:3336
- C:\Windows\System\XbLWhgU.exe
  C:\Windows\System\XbLWhgU.exe
  2⤵
  PID:3600
- C:\Windows\System\VMGpdiy.exe
  C:\Windows\System\VMGpdiy.exe
  2⤵
  PID:2948
- C:\Windows\System\lFiGtTa.exe
  C:\Windows\System\lFiGtTa.exe
  2⤵
  PID:4348
- C:\Windows\System\EXAHrZl.exe
  C:\Windows\System\EXAHrZl.exe
  2⤵
  PID:3544
- C:\Windows\System\WCcNpxL.exe
  C:\Windows\System\WCcNpxL.exe
  2⤵
  PID:7712
- C:\Windows\System\PKtMFEO.exe
  C:\Windows\System\PKtMFEO.exe
  2⤵
  PID:7764
- C:\Windows\System\hmBWFOm.exe
  C:\Windows\System\hmBWFOm.exe
  2⤵
  PID:7860
- C:\Windows\System\PXUUSpa.exe
  C:\Windows\System\PXUUSpa.exe
  2⤵
  PID:7932
- C:\Windows\System\VwiKDAE.exe
  C:\Windows\System\VwiKDAE.exe
  2⤵
  PID:4924
- C:\Windows\System\nydxZxs.exe
  C:\Windows\System\nydxZxs.exe
  2⤵
  PID:7988
- C:\Windows\System\PTAfOhZ.exe
  C:\Windows\System\PTAfOhZ.exe
  2⤵
  PID:8064
- C:\Windows\System\WjXGIeX.exe
  C:\Windows\System\WjXGIeX.exe
  2⤵
  PID:8140
- C:\Windows\System\qlwuBBe.exe
  C:\Windows\System\qlwuBBe.exe
  2⤵
  PID:6744
- C:\Windows\System\wfoMkfk.exe
  C:\Windows\System\wfoMkfk.exe
  2⤵
  PID:8020
- C:\Windows\System\FAYhQaO.exe
  C:\Windows\System\FAYhQaO.exe
  2⤵
  PID:3236
- C:\Windows\System\TLSYMfT.exe
  C:\Windows\System\TLSYMfT.exe
  2⤵
  PID:8056
- C:\Windows\System\mRhScSd.exe
  C:\Windows\System\mRhScSd.exe
  2⤵
  PID:1176
- C:\Windows\System\VyJVyyF.exe
  C:\Windows\System\VyJVyyF.exe
  2⤵
  PID:2112
- C:\Windows\System\QDGunTQ.exe
  C:\Windows\System\QDGunTQ.exe
  2⤵
  PID:7552
- C:\Windows\System\jVSEOnr.exe
  C:\Windows\System\jVSEOnr.exe
  2⤵
  PID:1640
- C:\Windows\System\jcLELuM.exe
  C:\Windows\System\jcLELuM.exe
  2⤵
  PID:7892
- C:\Windows\System\iLWcyKk.exe
  C:\Windows\System\iLWcyKk.exe
  2⤵
  PID:7652
- C:\Windows\System\OzsBqFk.exe
  C:\Windows\System\OzsBqFk.exe
  2⤵
  PID:7920
- C:\Windows\System\DMUsXTo.exe
  C:\Windows\System\DMUsXTo.exe
  2⤵
  PID:1488
- C:\Windows\System\JbyrlGE.exe
  C:\Windows\System\JbyrlGE.exe
  2⤵
  PID:7184
- C:\Windows\System\GGPiYkM.exe
  C:\Windows\System\GGPiYkM.exe
  2⤵
  PID:4928
- C:\Windows\System\LIVlDeI.exe
  C:\Windows\System\LIVlDeI.exe
  2⤵
  PID:4300
- C:\Windows\System\BRzAXMN.exe
  C:\Windows\System\BRzAXMN.exe
  2⤵
  PID:7928
- C:\Windows\System\xLSSewI.exe
  C:\Windows\System\xLSSewI.exe
  2⤵
  PID:8156
- C:\Windows\System\sqTXuVj.exe
  C:\Windows\System\sqTXuVj.exe
  2⤵
  PID:7380
- C:\Windows\System\GPJCQgs.exe
  C:\Windows\System\GPJCQgs.exe
  2⤵
  PID:4744
- C:\Windows\System\KuFPvfy.exe
  C:\Windows\System\KuFPvfy.exe
  2⤵
  PID:7852
- C:\Windows\System\oyKhcMI.exe
  C:\Windows\System\oyKhcMI.exe
  2⤵
  PID:8052
- C:\Windows\System\aoraOZt.exe
  C:\Windows\System\aoraOZt.exe
  2⤵
  PID:8216
- C:\Windows\System\aswRryw.exe
  C:\Windows\System\aswRryw.exe
  2⤵
  PID:8248
- C:\Windows\System\FExErht.exe
  C:\Windows\System\FExErht.exe
  2⤵
  PID:8288
- C:\Windows\System\vbkGvVy.exe
  C:\Windows\System\vbkGvVy.exe
  2⤵
  PID:8312
- C:\Windows\System\EAXotKz.exe
  C:\Windows\System\EAXotKz.exe
  2⤵
  PID:8380
- C:\Windows\System\kDUDojR.exe
  C:\Windows\System\kDUDojR.exe
  2⤵
  PID:8416
- C:\Windows\System\xhQhWPT.exe
  C:\Windows\System\xhQhWPT.exe
  2⤵
  PID:8472
- C:\Windows\System\rhrHTrP.exe
  C:\Windows\System\rhrHTrP.exe
  2⤵
  PID:8500
- C:\Windows\System\htDzCdA.exe
  C:\Windows\System\htDzCdA.exe
  2⤵
  PID:8552
- C:\Windows\System\UGonRXf.exe
  C:\Windows\System\UGonRXf.exe
  2⤵
  PID:8580
- C:\Windows\System\fkkRTjn.exe
  C:\Windows\System\fkkRTjn.exe
  2⤵
  PID:8632
- C:\Windows\System\trrWUFf.exe
  C:\Windows\System\trrWUFf.exe
  2⤵
  PID:8664
- C:\Windows\System\SasTLhp.exe
  C:\Windows\System\SasTLhp.exe
  2⤵
  PID:8708
- C:\Windows\System\TihVdxQ.exe
  C:\Windows\System\TihVdxQ.exe
  2⤵
  PID:8736
- C:\Windows\System\oDwkKlk.exe
  C:\Windows\System\oDwkKlk.exe
  2⤵
  PID:8784
- C:\Windows\System\RLfxxcF.exe
  C:\Windows\System\RLfxxcF.exe
  2⤵
  PID:8800
- C:\Windows\System\oaWWNgM.exe
  C:\Windows\System\oaWWNgM.exe
  2⤵
  PID:8864
- C:\Windows\System\csuWwZF.exe
  C:\Windows\System\csuWwZF.exe
  2⤵
  PID:8904
- C:\Windows\System\lPVHfhj.exe
  C:\Windows\System\lPVHfhj.exe
  2⤵
  PID:8944
- C:\Windows\System\aWBRTJp.exe
  C:\Windows\System\aWBRTJp.exe
  2⤵
  PID:8984
- C:\Windows\System\SQyaHOU.exe
  C:\Windows\System\SQyaHOU.exe
  2⤵
  PID:9012
- C:\Windows\System\obSrhvT.exe
  C:\Windows\System\obSrhvT.exe
  2⤵
  PID:9064
- C:\Windows\System\VvURksn.exe
  C:\Windows\System\VvURksn.exe
  2⤵
  PID:9116
- C:\Windows\System\jjZMUby.exe
  C:\Windows\System\jjZMUby.exe
  2⤵
  PID:9144
- C:\Windows\System\wZCUaKO.exe
  C:\Windows\System\wZCUaKO.exe
  2⤵
  PID:9176
- C:\Windows\System\cocNXQQ.exe
  C:\Windows\System\cocNXQQ.exe
  2⤵
  PID:7212
- C:\Windows\System\jebmXWa.exe
  C:\Windows\System\jebmXWa.exe
  2⤵
  PID:8260
- C:\Windows\System\DsXACtA.exe
  C:\Windows\System\DsXACtA.exe
  2⤵
  PID:8324
- C:\Windows\System\kaRlCvz.exe
  C:\Windows\System\kaRlCvz.exe
  2⤵
  PID:8404
- C:\Windows\System\BFcXZFG.exe
  C:\Windows\System\BFcXZFG.exe
  2⤵
  PID:3696
- C:\Windows\System\KEOHrmz.exe
  C:\Windows\System\KEOHrmz.exe
  2⤵
  PID:8568
- C:\Windows\System\qAoZrUh.exe
  C:\Windows\System\qAoZrUh.exe
  2⤵
  PID:8572
- C:\Windows\System\evCPSIk.exe
  C:\Windows\System\evCPSIk.exe
  2⤵
  PID:8676
- C:\Windows\System\AhZxRIY.exe
  C:\Windows\System\AhZxRIY.exe
  2⤵
  PID:8756
- C:\Windows\System\NAQhtTF.exe
  C:\Windows\System\NAQhtTF.exe
  2⤵
  PID:8760
- C:\Windows\System\FrYbJxH.exe
  C:\Windows\System\FrYbJxH.exe
  2⤵
  PID:8824
- C:\Windows\System\OElWbLp.exe
  C:\Windows\System\OElWbLp.exe
  2⤵
  PID:8896
- C:\Windows\System\nlPrrdf.exe
  C:\Windows\System\nlPrrdf.exe
  2⤵
  PID:9048
- C:\Windows\System\ZbJTspb.exe
  C:\Windows\System\ZbJTspb.exe
  2⤵
  PID:9076
- C:\Windows\System\GKgxGaU.exe
  C:\Windows\System\GKgxGaU.exe
  2⤵
  PID:9140
- C:\Windows\System\WjvgOoo.exe
  C:\Windows\System\WjvgOoo.exe
  2⤵
  PID:9168
- C:\Windows\System\dvySwAD.exe
  C:\Windows\System\dvySwAD.exe
  2⤵
  PID:8280
- C:\Windows\System\YZHUNvY.exe
  C:\Windows\System\YZHUNvY.exe
  2⤵
  PID:8392
- C:\Windows\System\TgzTXBz.exe
  C:\Windows\System\TgzTXBz.exe
  2⤵
  PID:8532
- C:\Windows\System\wNrAHpW.exe
  C:\Windows\System\wNrAHpW.exe
  2⤵
  PID:8620
- C:\Windows\System\TkFaZEE.exe
  C:\Windows\System\TkFaZEE.exe
  2⤵
  PID:8688
- C:\Windows\System\JgMqRCG.exe
  C:\Windows\System\JgMqRCG.exe
  2⤵
  PID:8848
- C:\Windows\System\GuKrWWo.exe
  C:\Windows\System\GuKrWWo.exe
  2⤵
  PID:8932
- C:\Windows\System\pXfqsPr.exe
  C:\Windows\System\pXfqsPr.exe
  2⤵
  PID:9080
- C:\Windows\System\IJwXDlj.exe
  C:\Windows\System\IJwXDlj.exe
  2⤵
  PID:9104
- C:\Windows\System\YZsDPrk.exe
  C:\Windows\System\YZsDPrk.exe
  2⤵
  PID:8428
- C:\Windows\System\FBErFSD.exe
  C:\Windows\System\FBErFSD.exe
  2⤵
  PID:8512
- C:\Windows\System\dxsAWnM.exe
  C:\Windows\System\dxsAWnM.exe
  2⤵
  PID:8720
- C:\Windows\System\mOOlPFf.exe
  C:\Windows\System\mOOlPFf.exe
  2⤵
  PID:8744
- C:\Windows\System\lUvRYUy.exe
  C:\Windows\System\lUvRYUy.exe
  2⤵
  PID:9136
- C:\Windows\System\wSBQGij.exe
  C:\Windows\System\wSBQGij.exe
  2⤵
  PID:8356
- C:\Windows\System\PUxXqcD.exe
  C:\Windows\System\PUxXqcD.exe
  2⤵
  PID:8592
- C:\Windows\System\lZxesyE.exe
  C:\Windows\System\lZxesyE.exe
  2⤵
  PID:8900
- C:\Windows\System\fYbPguN.exe
  C:\Windows\System\fYbPguN.exe
  2⤵
  PID:9036
- C:\Windows\System\BjvESRl.exe
  C:\Windows\System\BjvESRl.exe
  2⤵
  PID:8816
- C:\Windows\System\HATvCjB.exe
  C:\Windows\System\HATvCjB.exe
  2⤵
  PID:8468
- C:\Windows\System\YJVIAFv.exe
  C:\Windows\System\YJVIAFv.exe
  2⤵
  PID:8728
- C:\Windows\System\gEivoAS.exe
  C:\Windows\System\gEivoAS.exe
  2⤵
  PID:9224
- C:\Windows\System\bRYdUnn.exe
  C:\Windows\System\bRYdUnn.exe
  2⤵
  PID:9252
- C:\Windows\System\jdQwInY.exe
  C:\Windows\System\jdQwInY.exe
  2⤵
  PID:9276
- C:\Windows\System\ENCcEFv.exe
  C:\Windows\System\ENCcEFv.exe
  2⤵
  PID:9332
- C:\Windows\System\AKAJofu.exe
  C:\Windows\System\AKAJofu.exe
  2⤵
  PID:9356
- C:\Windows\System\pCIgMrD.exe
  C:\Windows\System\pCIgMrD.exe
  2⤵
  PID:9412
- C:\Windows\System\dtxQqxd.exe
  C:\Windows\System\dtxQqxd.exe
  2⤵
  PID:9432
- C:\Windows\System\TscKnGs.exe
  C:\Windows\System\TscKnGs.exe
  2⤵
  PID:9480
- C:\Windows\System\BFjKzXv.exe
  C:\Windows\System\BFjKzXv.exe
  2⤵
  PID:9496
- C:\Windows\System\vflcmGD.exe
  C:\Windows\System\vflcmGD.exe
  2⤵
  PID:9544
- C:\Windows\System\bTUgjJg.exe
  C:\Windows\System\bTUgjJg.exe
  2⤵
  PID:9560
- C:\Windows\System\TuoYuaZ.exe
  C:\Windows\System\TuoYuaZ.exe
  2⤵
  PID:9612
- C:\Windows\System\ZONQrDL.exe
  C:\Windows\System\ZONQrDL.exe
  2⤵
  PID:9644
- C:\Windows\System\IBQxgFy.exe
  C:\Windows\System\IBQxgFy.exe
  2⤵
  PID:9676
- C:\Windows\System\CtTeSqJ.exe
  C:\Windows\System\CtTeSqJ.exe
  2⤵
  PID:9708
- C:\Windows\System\AuhIqcN.exe
  C:\Windows\System\AuhIqcN.exe
  2⤵
  PID:9736
- C:\Windows\System\RJSlPTE.exe
  C:\Windows\System\RJSlPTE.exe
  2⤵
  PID:9764
- C:\Windows\System\CqsiYXH.exe
  C:\Windows\System\CqsiYXH.exe
  2⤵
  PID:9780
- C:\Windows\System\xJZIEUE.exe
  C:\Windows\System\xJZIEUE.exe
  2⤵
  PID:9804
- C:\Windows\System\MXvfofR.exe
  C:\Windows\System\MXvfofR.exe
  2⤵
  PID:9848
- C:\Windows\System\cATEXvM.exe
  C:\Windows\System\cATEXvM.exe
  2⤵
  PID:9888
- C:\Windows\System\fExchvW.exe
  C:\Windows\System\fExchvW.exe
  2⤵
  PID:9924
- C:\Windows\System\yavELrn.exe
  C:\Windows\System\yavELrn.exe
  2⤵
  PID:9940
- C:\Windows\System\YUFzgbM.exe
  C:\Windows\System\YUFzgbM.exe
  2⤵
  PID:9988
- C:\Windows\System\hneErBz.exe
  C:\Windows\System\hneErBz.exe
  2⤵
  PID:10028
- C:\Windows\System\xTPMkgl.exe
  C:\Windows\System\xTPMkgl.exe
  2⤵
  PID:10044
- C:\Windows\System\cEvozQt.exe
  C:\Windows\System\cEvozQt.exe
  2⤵
  PID:10076
- C:\Windows\System\UtrEmpe.exe
  C:\Windows\System\UtrEmpe.exe
  2⤵
  PID:10120
- C:\Windows\System\GHwXyjo.exe
  C:\Windows\System\GHwXyjo.exe
  2⤵
  PID:10156
- C:\Windows\System\ZvOkxCs.exe
  C:\Windows\System\ZvOkxCs.exe
  2⤵
  PID:10184
- C:\Windows\System\fVIZDrq.exe
  C:\Windows\System\fVIZDrq.exe
  2⤵
  PID:10220
- C:\Windows\System\mUrrQsk.exe
  C:\Windows\System\mUrrQsk.exe
  2⤵
  PID:9232
- C:\Windows\System\MovPQdk.exe
  C:\Windows\System\MovPQdk.exe
  2⤵
  PID:9264
- C:\Windows\System\xaTKsdT.exe
  C:\Windows\System\xaTKsdT.exe
  2⤵
  PID:9352
- C:\Windows\System\dGFipVy.exe
  C:\Windows\System\dGFipVy.exe
  2⤵
  PID:9464
- C:\Windows\System\mEvnWhw.exe
  C:\Windows\System\mEvnWhw.exe
  2⤵
  PID:9532
- C:\Windows\System\eqehxHO.exe
  C:\Windows\System\eqehxHO.exe
  2⤵
  PID:9584
- C:\Windows\System\PbMZrRK.exe
  C:\Windows\System\PbMZrRK.exe
  2⤵
  PID:9636
- C:\Windows\System\kQRwnCK.exe
  C:\Windows\System\kQRwnCK.exe
  2⤵
  PID:9692
- C:\Windows\System\StsfoDg.exe
  C:\Windows\System\StsfoDg.exe
  2⤵
  PID:9752
- C:\Windows\System\veGeExn.exe
  C:\Windows\System\veGeExn.exe
  2⤵
  PID:9868
- C:\Windows\System\YIINNfF.exe
  C:\Windows\System\YIINNfF.exe
  2⤵
  PID:9920
- C:\Windows\System\uxCAuhB.exe
  C:\Windows\System\uxCAuhB.exe
  2⤵
  PID:10004
- C:\Windows\System\KmVZHnA.exe
  C:\Windows\System\KmVZHnA.exe
  2⤵
  PID:10084
- C:\Windows\System\ulxoyeu.exe
  C:\Windows\System\ulxoyeu.exe
  2⤵
  PID:10116
- C:\Windows\System\zNqreRq.exe
  C:\Windows\System\zNqreRq.exe
  2⤵
  PID:10176
- C:\Windows\System\fixanvf.exe
  C:\Windows\System\fixanvf.exe
  2⤵
  PID:10232
- C:\Windows\System\aghkyJd.exe
  C:\Windows\System\aghkyJd.exe
  2⤵
  PID:9260
- C:\Windows\System\inKmYln.exe
  C:\Windows\System\inKmYln.exe
  2⤵
  PID:9440
- C:\Windows\System\TnchzxA.exe
  C:\Windows\System\TnchzxA.exe
  2⤵
  PID:9552
- C:\Windows\System\ToHwlPx.exe
  C:\Windows\System\ToHwlPx.exe
  2⤵
  PID:9704
- C:\Windows\System\LqNQHxU.exe
  C:\Windows\System\LqNQHxU.exe
  2⤵
  PID:9788
- C:\Windows\System\patDPXS.exe
  C:\Windows\System\patDPXS.exe
  2⤵
  PID:9900
- C:\Windows\System\uwFKEOV.exe
  C:\Windows\System\uwFKEOV.exe
  2⤵
  PID:10056
- C:\Windows\System\fWuUgrV.exe
  C:\Windows\System\fWuUgrV.exe
  2⤵
  PID:10152
- C:\Windows\System\LuaaoYy.exe
  C:\Windows\System\LuaaoYy.exe
  2⤵
  PID:9396
- C:\Windows\System\GHXiBlG.exe
  C:\Windows\System\GHXiBlG.exe
  2⤵
  PID:9744
- C:\Windows\System\hZqTdJb.exe
  C:\Windows\System\hZqTdJb.exe
  2⤵
  PID:10020
- C:\Windows\System\GPJKooa.exe
  C:\Windows\System\GPJKooa.exe
  2⤵
  PID:10204
- C:\Windows\System\thRiBjp.exe
  C:\Windows\System\thRiBjp.exe
  2⤵
  PID:9604
- C:\Windows\System\jTtlxud.exe
  C:\Windows\System\jTtlxud.exe
  2⤵
  PID:9516
- C:\Windows\System\hdcCHyB.exe
  C:\Windows\System\hdcCHyB.exe
  2⤵
  PID:8180
- C:\Windows\System\NEGbIKu.exe
  C:\Windows\System\NEGbIKu.exe
  2⤵
  PID:9908
- C:\Windows\System\MtrmzBu.exe
  C:\Windows\System\MtrmzBu.exe
  2⤵
  PID:10260
- C:\Windows\System\iifuJud.exe
  C:\Windows\System\iifuJud.exe
  2⤵
  PID:10288
- C:\Windows\System\wpoPTcr.exe
  C:\Windows\System\wpoPTcr.exe
  2⤵
  PID:10304
- C:\Windows\System\yKMMFzA.exe
  C:\Windows\System\yKMMFzA.exe
  2⤵
  PID:10344
- C:\Windows\System\WOptuAT.exe
  C:\Windows\System\WOptuAT.exe
  2⤵
  PID:10360
- C:\Windows\System\MZSghJC.exe
  C:\Windows\System\MZSghJC.exe
  2⤵
  PID:10404
- C:\Windows\System\WLkSSiu.exe
  C:\Windows\System\WLkSSiu.exe
  2⤵
  PID:10440
- C:\Windows\System\IgkLkJp.exe
  C:\Windows\System\IgkLkJp.exe
  2⤵
  PID:10456
- C:\Windows\System\bGRWSjA.exe
  C:\Windows\System\bGRWSjA.exe
  2⤵
  PID:10472
- C:\Windows\System\nybXNIO.exe
  C:\Windows\System\nybXNIO.exe
  2⤵
  PID:10540
- C:\Windows\System\jpQvcRY.exe
  C:\Windows\System\jpQvcRY.exe
  2⤵
  PID:10560
- C:\Windows\System\ZNqLTMJ.exe
  C:\Windows\System\ZNqLTMJ.exe
  2⤵
  PID:10588
- C:\Windows\System\NtEhASV.exe
  C:\Windows\System\NtEhASV.exe
  2⤵
  PID:10612
- C:\Windows\System\LfsJVyT.exe
  C:\Windows\System\LfsJVyT.exe
  2⤵
  PID:10656
- C:\Windows\System\JWJaCGo.exe
  C:\Windows\System\JWJaCGo.exe
  2⤵
  PID:10684
- C:\Windows\System\dndpmGy.exe
  C:\Windows\System\dndpmGy.exe
  2⤵
  PID:10712
- C:\Windows\System\xSMNVir.exe
  C:\Windows\System\xSMNVir.exe
  2⤵
  PID:10740
- C:\Windows\System\qigGyJr.exe
  C:\Windows\System\qigGyJr.exe
  2⤵
  PID:10768
- C:\Windows\System\LuwxfhQ.exe
  C:\Windows\System\LuwxfhQ.exe
  2⤵
  PID:10784
- C:\Windows\System\zlCPTjI.exe
  C:\Windows\System\zlCPTjI.exe
  2⤵
  PID:10824
- C:\Windows\System\qpVERAM.exe
  C:\Windows\System\qpVERAM.exe
  2⤵
  PID:10852
- C:\Windows\System\QVHHGEC.exe
  C:\Windows\System\QVHHGEC.exe
  2⤵
  PID:10880
- C:\Windows\System\wVCWRaw.exe
  C:\Windows\System\wVCWRaw.exe
  2⤵
  PID:10908
- C:\Windows\System\WmLJbUE.exe
  C:\Windows\System\WmLJbUE.exe
  2⤵
  PID:10924
- C:\Windows\System\RuGxvZe.exe
  C:\Windows\System\RuGxvZe.exe
  2⤵
  PID:10964
- C:\Windows\System\kRTPnnu.exe
  C:\Windows\System\kRTPnnu.exe
  2⤵
  PID:10984
- C:\Windows\System\UOLNgIA.exe
  C:\Windows\System\UOLNgIA.exe
  2⤵
  PID:11020
- C:\Windows\System\NrqlIQE.exe
  C:\Windows\System\NrqlIQE.exe
  2⤵
  PID:11048
- C:\Windows\System\CUlCGKX.exe
  C:\Windows\System\CUlCGKX.exe
  2⤵
  PID:11076
- C:\Windows\System\qVGpNya.exe
  C:\Windows\System\qVGpNya.exe
  2⤵
  PID:11100
- C:\Windows\System\igpoBkP.exe
  C:\Windows\System\igpoBkP.exe
  2⤵
  PID:11132
- C:\Windows\System\oWQcVgw.exe
  C:\Windows\System\oWQcVgw.exe
  2⤵
  PID:11160
- C:\Windows\System\sHBxbCv.exe
  C:\Windows\System\sHBxbCv.exe
  2⤵
  PID:11192
- C:\Windows\System\yqEOuRI.exe
  C:\Windows\System\yqEOuRI.exe
  2⤵
  PID:11220
- C:\Windows\System\DwgQISs.exe
  C:\Windows\System\DwgQISs.exe
  2⤵
  PID:11248
- C:\Windows\System\UOFbTZY.exe
  C:\Windows\System\UOFbTZY.exe
  2⤵
  PID:10252
- C:\Windows\System\LimIZDp.exe
  C:\Windows\System\LimIZDp.exe
  2⤵
  PID:10284
- C:\Windows\System\dNfiJVb.exe
  C:\Windows\System\dNfiJVb.exe
  2⤵
  PID:10352
- C:\Windows\System\QeYXuuO.exe
  C:\Windows\System\QeYXuuO.exe
  2⤵
  PID:10452
- C:\Windows\System\JWpRcXG.exe
  C:\Windows\System\JWpRcXG.exe
  2⤵
  PID:10548
- C:\Windows\System\apTcJsm.exe
  C:\Windows\System\apTcJsm.exe
  2⤵
  PID:10624
- C:\Windows\System\vPghYic.exe
  C:\Windows\System\vPghYic.exe
  2⤵
  PID:10696
- C:\Windows\System\cXzrbPt.exe
  C:\Windows\System\cXzrbPt.exe
  2⤵
  PID:10764
- C:\Windows\System\gTUtmZx.exe
  C:\Windows\System\gTUtmZx.exe
  2⤵
  PID:10804
- C:\Windows\System\ykjDQDD.exe
  C:\Windows\System\ykjDQDD.exe
  2⤵
  PID:10864
- C:\Windows\System\JtqCXNU.exe
  C:\Windows\System\JtqCXNU.exe
  2⤵
  PID:10952
- C:\Windows\System\mVdbDWi.exe
  C:\Windows\System\mVdbDWi.exe
  2⤵
  PID:11016
- C:\Windows\System\eZgNAfO.exe
  C:\Windows\System\eZgNAfO.exe
  2⤵
  PID:11092
- C:\Windows\System\aobQZYL.exe
  C:\Windows\System\aobQZYL.exe
  2⤵
  PID:11144
- C:\Windows\System\ChwDTKL.exe
  C:\Windows\System\ChwDTKL.exe
  2⤵
  PID:11184
- C:\Windows\System\WWdNPqE.exe
  C:\Windows\System\WWdNPqE.exe
  2⤵
  PID:11240
- C:\Windows\System\CbVsdBH.exe
  C:\Windows\System\CbVsdBH.exe
  2⤵
  PID:10356
- C:\Windows\System\RJXltFY.exe
  C:\Windows\System\RJXltFY.exe
  2⤵
  PID:10584
- C:\Windows\System\AQUJlJQ.exe
  C:\Windows\System\AQUJlJQ.exe
  2⤵
  PID:10736
- C:\Windows\System\ZuSRYHh.exe
  C:\Windows\System\ZuSRYHh.exe
  2⤵
  PID:10920
- C:\Windows\System\AhRPHZJ.exe
  C:\Windows\System\AhRPHZJ.exe
  2⤵
  PID:11068
- C:\Windows\System\kClIMxm.exe
  C:\Windows\System\kClIMxm.exe
  2⤵
  PID:11172
- C:\Windows\System\epKrYEQ.exe
  C:\Windows\System\epKrYEQ.exe
  2⤵
  PID:10280
- C:\Windows\System\nWtLMKS.exe
  C:\Windows\System\nWtLMKS.exe
  2⤵
  PID:10796
- C:\Windows\System\dnzKgRR.exe
  C:\Windows\System\dnzKgRR.exe
  2⤵
  PID:11232
- C:\Windows\System\xLmzIlY.exe
  C:\Windows\System\xLmzIlY.exe
  2⤵
  PID:10552
- C:\Windows\System\cgJEpBR.exe
  C:\Windows\System\cgJEpBR.exe
  2⤵
  PID:11272
- C:\Windows\System\YFZIeYm.exe
  C:\Windows\System\YFZIeYm.exe
  2⤵
  PID:11300
- C:\Windows\System\qnuGKxw.exe
  C:\Windows\System\qnuGKxw.exe
  2⤵
  PID:11328
- C:\Windows\System\UwAXxAl.exe
  C:\Windows\System\UwAXxAl.exe
  2⤵
  PID:11356
- C:\Windows\System\jNQqIwm.exe
  C:\Windows\System\jNQqIwm.exe
  2⤵
  PID:11384
- C:\Windows\System\uWOOxUn.exe
  C:\Windows\System\uWOOxUn.exe
  2⤵
  PID:11412
- C:\Windows\System\vFdOwKc.exe
  C:\Windows\System\vFdOwKc.exe
  2⤵
  PID:11444
- C:\Windows\System\nZffNEa.exe
  C:\Windows\System\nZffNEa.exe
  2⤵
  PID:11476
- C:\Windows\System\dotMkxn.exe
  C:\Windows\System\dotMkxn.exe
  2⤵
  PID:11504
- C:\Windows\System\jrMwCKM.exe
  C:\Windows\System\jrMwCKM.exe
  2⤵
  PID:11532
- C:\Windows\System\zKuCTKg.exe
  C:\Windows\System\zKuCTKg.exe
  2⤵
  PID:11560
- C:\Windows\System\wZdUMDL.exe
  C:\Windows\System\wZdUMDL.exe
  2⤵
  PID:11588
- C:\Windows\System\VrOkYJW.exe
  C:\Windows\System\VrOkYJW.exe
  2⤵
  PID:11616
- C:\Windows\System\yNGEquQ.exe
  C:\Windows\System\yNGEquQ.exe
  2⤵
  PID:11636
- C:\Windows\System\tjXzGpB.exe
  C:\Windows\System\tjXzGpB.exe
  2⤵
  PID:11660
- C:\Windows\System\LSxBrve.exe
  C:\Windows\System\LSxBrve.exe
  2⤵
  PID:11700
- C:\Windows\System\syKXDnn.exe
  C:\Windows\System\syKXDnn.exe
  2⤵
  PID:11724
- C:\Windows\System\mpWsZDU.exe
  C:\Windows\System\mpWsZDU.exe
  2⤵
  PID:11756
- C:\Windows\System\nYcXQMW.exe
  C:\Windows\System\nYcXQMW.exe
  2⤵
  PID:11784
- C:\Windows\System\cLdwkqN.exe
  C:\Windows\System\cLdwkqN.exe
  2⤵
  PID:11812
- C:\Windows\System\iluyqcj.exe
  C:\Windows\System\iluyqcj.exe
  2⤵
  PID:11840
- C:\Windows\System\CDqqNhW.exe
  C:\Windows\System\CDqqNhW.exe
  2⤵
  PID:11868
- C:\Windows\System\WZdAoJk.exe
  C:\Windows\System\WZdAoJk.exe
  2⤵
  PID:11884
- C:\Windows\System\cSHAPjs.exe
  C:\Windows\System\cSHAPjs.exe
  2⤵
  PID:11912
- C:\Windows\System\izJcYnk.exe
  C:\Windows\System\izJcYnk.exe
  2⤵
  PID:11940
- C:\Windows\System\PAHBFiV.exe
  C:\Windows\System\PAHBFiV.exe
  2⤵
  PID:11964
- C:\Windows\System\xxLCxqD.exe
  C:\Windows\System\xxLCxqD.exe
  2⤵
  PID:12008
- C:\Windows\System\EpaMpxP.exe
  C:\Windows\System\EpaMpxP.exe
  2⤵
  PID:12024
- C:\Windows\System\dykalaf.exe
  C:\Windows\System\dykalaf.exe
  2⤵
  PID:12064
- C:\Windows\System\RPBImHE.exe
  C:\Windows\System\RPBImHE.exe
  2⤵
  PID:12092
- C:\Windows\System\nfTAETc.exe
  C:\Windows\System\nfTAETc.exe
  2⤵
  PID:12124
- C:\Windows\System\XegQfYF.exe
  C:\Windows\System\XegQfYF.exe
  2⤵
  PID:12152
- C:\Windows\System\PnvlqlU.exe
  C:\Windows\System\PnvlqlU.exe
  2⤵
  PID:12180
- C:\Windows\System\XwMbiXv.exe
  C:\Windows\System\XwMbiXv.exe
  2⤵
  PID:12208
- C:\Windows\System\VfoLUqj.exe
  C:\Windows\System\VfoLUqj.exe
  2⤵
  PID:12236
- C:\Windows\System\TvosJSu.exe
  C:\Windows\System\TvosJSu.exe
  2⤵
  PID:12260
- C:\Windows\System\aXpNmGu.exe
  C:\Windows\System\aXpNmGu.exe
  2⤵
  PID:11004
- C:\Windows\System\przIMNC.exe
  C:\Windows\System\przIMNC.exe
  2⤵
  PID:11320
- C:\Windows\System\xmMFhzu.exe
  C:\Windows\System\xmMFhzu.exe
  2⤵
  PID:11400
- C:\Windows\System\YuBKxxZ.exe
  C:\Windows\System\YuBKxxZ.exe
  2⤵
  PID:4800
- C:\Windows\System\UYFutCI.exe
  C:\Windows\System\UYFutCI.exe
  2⤵
  PID:244
- C:\Windows\System\ETsIWgA.exe
  C:\Windows\System\ETsIWgA.exe
  2⤵
  PID:11488
- C:\Windows\System\yEuyyQL.exe
  C:\Windows\System\yEuyyQL.exe
  2⤵
  PID:11580
- C:\Windows\System\EqEjsTM.exe
  C:\Windows\System\EqEjsTM.exe
  2⤵
  PID:11644
- C:\Windows\System\LiRjuwT.exe
  C:\Windows\System\LiRjuwT.exe
  2⤵
  PID:11708
- C:\Windows\System\wHwGstW.exe
  C:\Windows\System\wHwGstW.exe
  2⤵
  PID:11752
- C:\Windows\System\euThIEF.exe
  C:\Windows\System\euThIEF.exe
  2⤵
  PID:11808
- C:\Windows\System\RVmVpwo.exe
  C:\Windows\System\RVmVpwo.exe
  2⤵
  PID:11852
- C:\Windows\System\KuwxKRL.exe
  C:\Windows\System\KuwxKRL.exe
  2⤵
  PID:11924
- C:\Windows\System\lkxSoAd.exe
  C:\Windows\System\lkxSoAd.exe
  2⤵
  PID:11980
- C:\Windows\System\LbjriaT.exe
  C:\Windows\System\LbjriaT.exe
  2⤵
  PID:12044
- C:\Windows\System\QVfeoat.exe
  C:\Windows\System\QVfeoat.exe
  2⤵
  PID:12060
- C:\Windows\System\dmSPzXY.exe
  C:\Windows\System\dmSPzXY.exe
  2⤵
  PID:12148
- C:\Windows\System\thbmjqz.exe
  C:\Windows\System\thbmjqz.exe
  2⤵
  PID:3168
- C:\Windows\System\ihKygyV.exe
  C:\Windows\System\ihKygyV.exe
  2⤵
  PID:12256
- C:\Windows\System\GHVdoqZ.exe
  C:\Windows\System\GHVdoqZ.exe
  2⤵
  PID:11324
- C:\Windows\System\czdFzSy.exe
  C:\Windows\System\czdFzSy.exe
  2⤵
  PID:2972
- C:\Windows\System\ArnDNBb.exe
  C:\Windows\System\ArnDNBb.exe
  2⤵
  PID:11556
- C:\Windows\System\YTrubjH.exe
  C:\Windows\System\YTrubjH.exe
  2⤵
  PID:11692
- C:\Windows\System\fbZoAJy.exe
  C:\Windows\System\fbZoAJy.exe
  2⤵
  PID:10468
- C:\Windows\System\ixRDYOk.exe
  C:\Windows\System\ixRDYOk.exe
  2⤵
  PID:11932
- C:\Windows\System\yKuBiGu.exe
  C:\Windows\System\yKuBiGu.exe
  2⤵
  PID:12076
- C:\Windows\System\WDbzbuo.exe
  C:\Windows\System\WDbzbuo.exe
  2⤵
  PID:12200
- C:\Windows\System\kQuCYDi.exe
  C:\Windows\System\kQuCYDi.exe
  2⤵
  PID:11292
- C:\Windows\System\ykXEAWO.exe
  C:\Windows\System\ykXEAWO.exe
  2⤵
  PID:11612
- C:\Windows\System\axqhVfR.exe
  C:\Windows\System\axqhVfR.exe
  2⤵
  PID:1780
- C:\Windows\System\KRedatF.exe
  C:\Windows\System\KRedatF.exe
  2⤵
  PID:12144
- C:\Windows\System\OleZqOg.exe
  C:\Windows\System\OleZqOg.exe
  2⤵
  PID:11796
- C:\Windows\System\vkVxAUV.exe
  C:\Windows\System\vkVxAUV.exe
  2⤵
  PID:4284
- C:\Windows\System\kPCvyCz.exe
  C:\Windows\System\kPCvyCz.exe
  2⤵
  PID:12300
- C:\Windows\System\UPppLnA.exe
  C:\Windows\System\UPppLnA.exe
  2⤵
  PID:12320
- C:\Windows\System\HaiYRlb.exe
  C:\Windows\System\HaiYRlb.exe
  2⤵
  PID:12356
- C:\Windows\System\jHLCjHM.exe
  C:\Windows\System\jHLCjHM.exe
  2⤵
  PID:12392
- C:\Windows\System\jdkpuyv.exe
  C:\Windows\System\jdkpuyv.exe
  2⤵
  PID:12420
- C:\Windows\System\VXVtHTQ.exe
  C:\Windows\System\VXVtHTQ.exe
  2⤵
  PID:12448
- C:\Windows\System\ioTgVZP.exe
  C:\Windows\System\ioTgVZP.exe
  2⤵
  PID:12468
- C:\Windows\System\LyZgUfQ.exe
  C:\Windows\System\LyZgUfQ.exe
  2⤵
  PID:12496
- C:\Windows\System\BZRGuhR.exe
  C:\Windows\System\BZRGuhR.exe
  2⤵
  PID:12520
- C:\Windows\System\uDapwRR.exe
  C:\Windows\System\uDapwRR.exe
  2⤵
  PID:12560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_if3r2riy.ghu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_if3r2riy.ghu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CTMpDSW.exe

Path C:\Windows\System\CTMpDSW.exe
Size 8B
SHA256 593106c260dc81c57565b84dcf164e3aba348716b31b67ed996f84e8eb33a8f2
MD5 e71397695bfc95ac5fe1d82687725659
SHA1 45272317203fb987b8952f41b0170bd5a78944b0
SHA512 b0a8d0ea3899c2bbb7c006edeeb2ecf2f4894f56db8d8ff247c4e6fc5083c186ab234b2494615de540e99bc5dda8055b1dfec22d34c5a32a9febff889f810e0e
MD5 SHA1 SHA512

Submit Download

DDekHgl.exe

Path C:\Windows\System\DDekHgl.exe
Size 2.9MB
SHA256 1f1240f65a79bd52e636f5261ab682b43f622d53ad39ff5a595e6b0475ef55fa
MD5 7a843db8873ec4747c55ecf98d319032
SHA1 74af66867c2f1c82eac8b670f4418bd5df18a1ae
SHA512 123234540078d82abeec44f42ef29629495bf37f059f7059777626b61d0fdc224c2f90533fadf029a06d2bcced0d1f40c11d0d4e9a05e56da755bed7bc41b7e6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

EUlRhrv.exe

Path C:\Windows\System\EUlRhrv.exe
Size 3.0MB
SHA256 549f36938358964cba5ccde99c9b41a12079e52b8e53a1aeaefc27a8afd46499
MD5 1040edd271591acbf4f9e9ff0de288e1
SHA1 c0f2a75088f07e70d55f22a73f1a27817edd31b7
SHA512 773846562cadaf38da464f8d33e288cb7935707cd516442dd321928db5f1832ed0f220f01f6e52ddb5c41bf46822b4ba740d131b96af8302f628da25252fdc8e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfe:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

GGkXSIx.exe

Path C:\Windows\System\GGkXSIx.exe
Size 3.0MB
SHA256 ccccdf1f14bb75759bd8f9f18c856396b9b3441be3c4d213289edc121a36cfec
MD5 1e4220094f3305ef77cd7a5f249a1722
SHA1 31cf182d9c69d3cc3a6f5bca3e71b9bdfc994adc
SHA512 f26d55ba439fae4a5b5804e5ca962e14d021b13560ad81238b12be21e50a3d763f559f4329c3016b4614f2ccaea3eaba5142e8d277afa87968dc300d5bd0d903
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfB:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHmUKwN.exe

Path C:\Windows\System\GHmUKwN.exe
Size 2.9MB
SHA256 5eb441c93ad07a61ba45c5c3da1b4cfd1c29fb52a76ec6c2f300a7ff31197a5e
MD5 6153bd803f7487f00f538849a491e55b
SHA1 fa72a35b61c0ec9a25d67fc8501bc2f6296536dc
SHA512 ce831b8b13c14599cd7ab7e460f3d56f19e9ed63e73965f553d9d109ee3e03b51d7b09ad312e441a5a89dc986f1352dd1853931c56cdec5bc8963fa82f07f1ce
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfA:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

GXiWjUf.exe

Path C:\Windows\System\GXiWjUf.exe
Size 3.0MB
SHA256 2f83ab216494bf43979d5823b98aa84467d79554adb2f0bed3214e0c1a7fc537
MD5 f5647b8f03f8ab499a6f3d35578f36a6
SHA1 dbd13a58af6b7cb65b3136c8a5c690a6b8fab2ad
SHA512 50465743ddcabd029926336d3b368290383b21d4236c336b85ae6fd338f34cf9c511e5b1703fa43bf987fd798da5806abbf1ceef6a20ab2f7963e12127e6870c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf3:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

HiwYgpO.exe

Path C:\Windows\System\HiwYgpO.exe
Size 3.0MB
SHA256 137ad64ee813f90b89c735409d6532f38d338b316503671f4b285b0767cc26ce
MD5 e3f6061bcd1aeac5b083dc130e8b0c90
SHA1 6aa43ae14c129b6aa892895c416d62c933ad8248
SHA512 0d8a9bf04f670c18853b583b2d0bb960727bdb8f3a954ecc4d79623f8e1211236da957c71f13c63ede556e06eb0bc44ef19b321356a263c0f8be1f8d8aa986d4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjCoMvl.exe

Path C:\Windows\System\LjCoMvl.exe
Size 2.9MB
SHA256 2d074cad757f5d0397c9fb6d8c014b61a0356178132c3b733c0548c1fa8f7eac
MD5 e9e097747eede29bff2abbbe1d1dc0a1
SHA1 dbb30c7f5b17849938a39d9a6eb3e272d0c8c60f
SHA512 007112cad75e2fcf3470b8eae0f7caef6825934ff0abf87ce7ef84c6ccecb9e4eaeebbb9a0ed9e48bf2d751cf3e1c311dafb4c05e611ff6ed8100b1504c5fbb8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf5:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlXOzwR.exe

Path C:\Windows\System\MlXOzwR.exe
Size 3.0MB
SHA256 e8dee5aa89a58f40c87ebf987549042c902f9929306f85bd8d629b4d3b96a9cb
MD5 096769d282227582e0ca78d312ef77c5
SHA1 aa44a80184fd3d040a041ee240cd9ac0eca9100e
SHA512 dbdf116216ac2004da1ef3d882845ad49a638549e72d2d70012328c9457099e0ea6928aceba57d0dcf6844bfc8a2f39a3440191324414f82eb091f1ee54f7606
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhff:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ONupyHm.exe

Path C:\Windows\System\ONupyHm.exe
Size 3.0MB
SHA256 aff26a969028fecb7bb5f042ee1cb404cb2d9301ee8857dd3b63e8a87076316b
MD5 d1b8071945101bb83e1fef426da4c306
SHA1 3cd383a8afa1387b558267e3b2f15dbeffcad759
SHA512 9b3132efac80b37ccb811132adb81a364c1b99ca2374718d4fc2f1c9215a6933cd54608645694e96b098ba0f007b497588a38dca286b2f13fde9236a46f18c33
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfD:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OQzeLVi.exe

Path C:\Windows\System\OQzeLVi.exe
Size 2.9MB
SHA256 b8f068ff5ab01dbb8da1307de55dd4c877aad1269fa97e7ead142bb149b9b406
MD5 9d8683e6fad565d5d90e77dc5a1b8f3c
SHA1 b3ca7c903f1d138c59bc10462143469dc298db1f
SHA512 d4e450c9ea01ef4361c85725ab21ff2d6bed8d59d649109c04efc8ba30170382200677191614f7ae39de57e1721aecc1d5889696df70c469fbe1929e2d1da031
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfs:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

QjtfIvk.exe

Path C:\Windows\System\QjtfIvk.exe
Size 2.9MB
SHA256 8e2990fcba314a61ed29f278456850858702d1a90fd505f1f1cec0023fad56aa
MD5 bcd9cc697702b6f48a17868917787ae8
SHA1 93213a149bab99116dc083ee2eca6623b476eb4f
SHA512 6e002a896d648d7131df86766b3e79f4d9da5fc79eae67b8f756a53e99782fbcd02ca137de5a4741dadafc24a4eb0e14af335a1d63dd39f8829e519d01b019f2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfW:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ROgeHBV.exe

Path C:\Windows\System\ROgeHBV.exe
Size 2.9MB
SHA256 091e72eb8c8dd7ccfe9997fe2cce760ef073789af14d0d85ab4f7a0d3a956e6d
MD5 c9ef09f8e582eb52d3f67b4516e8af73
SHA1 169ce06e50514c5c51dab09e6093db53bec3d1f5
SHA512 452c8d637d6ddcb1aea7aa1819db19cd1fd9adc9d06f4558af2f51303dad8b6cdaae94b99db3a02beb11b069c286f2d6943a867d6cc727b74565b1db2c3d2d01
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfg:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

RyBeQwD.exe

Path C:\Windows\System\RyBeQwD.exe
Size 2.9MB
SHA256 b70c4b4fd08fd1c5b9e9fccd86ba63deb271307ebd780742ba2cc5481cb411ee
MD5 64fd676dab59b3ae3f25e182b33186a7
SHA1 610d8a331d489e6a48baef60ec85aa17c9013d2e
SHA512 c7a8ec20e12297fb711da04d8bdb76f6e5dec438b5efa841f5e3f67de155969e469fc63229fbae233c2c8e51b3b139bd30d16723ce6edc5e8879b5f01b1037a4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfD:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UBSFXLx.exe

Path C:\Windows\System\UBSFXLx.exe
Size 2.9MB
SHA256 0b1d87963b613aac6b86be351d255b811bd7cc0a2a1e09e8c1355e636e835a16
MD5 da08cf7b0aa2d19c8e98f69ec9fc167a
SHA1 335c9b0822758185b887386e2fdd3767a5958ed8
SHA512 1762b3d0daf7df8c3e3eca53891b9e4f8951156f172f0594e1baa3dd140ef7dd0011bfdd22d19dd22ddd32816c1272f51ea73494497ad10b2b99a21bf47cebf8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfT:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsQDEkB.exe

Path C:\Windows\System\XsQDEkB.exe
Size 3.0MB
SHA256 9df4f1dec89a7646ea9a12cd1bfe9de160de13b80cc86c233087c04c55379c83
MD5 26a8f7d9e3b73bcf7b65733e064bab41
SHA1 d0e6e1ca9c3161259829b7369ce63119e1ebff48
SHA512 1a9177d507e5eadb083472b15ee1df5d3e056ebe11be102fd6f991ac31bff4a746549414e3bc8caab9d8179774ef095d4858f86ee4344a7167588133502c5d42
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

adXmORj.exe

Path C:\Windows\System\adXmORj.exe
Size 3.0MB
SHA256 0e3d12b0bae299ae30dcdfbdaad459c65f5b3f1e684a3fe8f265bd002e71a7b5
MD5 cef6322490f4798570c9edf12d6a0d17
SHA1 fd2d3fab0beef2809097e90523ef3b2094eea1d9
SHA512 9e22d35108ffe963626997223691c4f8eee8f7d32fdb8524482d6689e2c5359b2fe618b86359b7b916ae0647e000eb1f921e1d1b66ca33e1152f26b63262fbcc
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

auXTBwU.exe

Path C:\Windows\System\auXTBwU.exe
Size 3.0MB
SHA256 3d3f84a14b46f26da2fcb03cef2dc3b5e7a9944bfd0933d2b6cc454ac9063496
MD5 0e1eb7386ff88855479154d65d94e35d
SHA1 e1573e5863a63ecb6039c6daea8cb5fb4dbaecdb
SHA512 c1fe2ddbc0adb71affc5fe7d1879482f28a17fd154cbbc0f00c2eee66807ebda7b9d4d01b7d9dda366915012a87e8279efb111b60ac5e042c97b95ccc999e02b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfQ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

awBcLsC.exe

Path C:\Windows\System\awBcLsC.exe
Size 2.9MB
SHA256 078005a80aa607f1f87f4b7ac807bf1b3fc538a45f150e34ab93333ea97ff9f3
MD5 67366b718df8346240d04a44e8e33ad0
SHA1 e35efce240203ca7c1e70baaf8754560b7a9dc03
SHA512 63df6ba49d54cb03ae355f2f0236dee1ab1673ab9fdd40b7837c28d4ce2a05f6960b21890b3433e97749931b3f563b0939a38e1291c4cc266f663f2013e03212
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cMQWcli.exe

Path C:\Windows\System\cMQWcli.exe
Size 3.0MB
SHA256 67a28037be7a82ae3563f59d3db6d0990be88a87b6819b814697fda97b7e4ccc
MD5 47015d62a997571761cff30ffd20e2e2
SHA1 3d87e489417a39e45fd2ccc8178edfd2a43e69dc
SHA512 e3310d5cafbc5592823eb809bdd3243131c207c70a36b7a798e1ca09b230bc785081d72a557022a26da9342b8878d1952598971472016f46441ab3b56bf9f21c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfi:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cPmarPb.exe

Path C:\Windows\System\cPmarPb.exe
Size 3.0MB
SHA256 cad763d438166e17f9f99dedf863ba540abd737d266051ddea334b41697c10b5
MD5 578e4bfe1414ce594d8298a74c141a65
SHA1 e7a9bb35b510153bb43ced4b314c824494c1abb5
SHA512 db1bf2d2456a879dd45efdf8a1068d29931a1eb76c4582463cba1c8fec5d5cdb96151e6ae6208585d53ea7cca957d95a248990458d680be9c6d125b80951cbc4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewNFJRC.exe

Path C:\Windows\System\ewNFJRC.exe
Size 2.9MB
SHA256 a94ef342dfa8fdc3a6aa59fc1349d2dcde687e98cd2c7f4cb77d6b32747339b2
MD5 6c9d547688cc74de695a84011c869f4f
SHA1 a405d8d65f26f90e0ad311daf554489729021a46
SHA512 7791a931719c8f964012f0f6a670574df87b5d908412bf11851d0108a027703637f96d48fc755acb52a08a90ac817097ac04eb763a284175ff91fcee1e0a16b7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

hnJUghA.exe

Path C:\Windows\System\hnJUghA.exe
Size 3.0MB
SHA256 82966f991365eb77edb809b182cf78d16998f0705e7b0a93c1945218426130d7
MD5 c6c45d2d654d91ccec63f7952603fc3f
SHA1 8090690a98cee170ba8cd8169ac67e3825f36c0a
SHA512 36911d4a6e1ee453697d5edbb02c34b8bea3d9d08b002e8a274f724d2849be0a95f05edeaacdf5fb3c69b25b94f415a6d67e09a4a4c7fbd99664f32fe7afb226
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfB:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

huRDXcX.exe

Path C:\Windows\System\huRDXcX.exe
Size 3.0MB
SHA256 48dacfa41fc1e99e36590fb40ca46a9466e38470ce7085b51deaff895891d331
MD5 43d5d6c5c37f798be6005f6471bd4e5b
SHA1 f34ce92ac9aca4b1e7a89ad2f9897f67981fb57c
SHA512 f87972d3e50faaabc2a58fc747baddd4c4550ff6d3cb5fc46b68aabad39fa94bbee3e63f2b5912fce63651c4137fa4d880ab0be406cb11687805f2d982447a45
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfi:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

kNqlESp.exe

Path C:\Windows\System\kNqlESp.exe
Size 3.0MB
SHA256 a9baebc4e8b048443a4efff0bbc6e056cf95bfd90fa732bd2902b179a2c9099d
MD5 f978dd73aa2a56f40250c4fac42ff839
SHA1 dcad35cc44ed38b7c3c1849c98e3f9459eba09f9
SHA512 164973d861ae081c3800bf6a7851a354dbf515beea2df0579d4f414a033490da68417f693bc8f3c11d761b73316b502de46f38681c5596f78d0192404e8f2fcb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfr:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lnTIUfS.exe

Path C:\Windows\System\lnTIUfS.exe
Size 3.0MB
SHA256 0b50f4692b44525ba0af4c8dea700af0fbb01265407cc81343d2692921eb8ea7
MD5 d00777682484c15686d0e2ac3160bba6
SHA1 bdc2689691fef92860dee88a799105754521b19f
SHA512 624bd42db20184fed9eb4cbf634c8ea45b2a1c3ec448fdd14895d59d6bb0db39f1d5c10df00e55b1f1199873941fc9efe28b1cfcba3ccc214f6da84e0799dbf1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mepREpj.exe

Path C:\Windows\System\mepREpj.exe
Size 2.9MB
SHA256 d8f9fc58af7a1c0fefb393c39d44c5abc073fd879ff0e81fc113f3137f165d42
MD5 0f9f441c93e2ee4b6217fe7a6edbc7cf
SHA1 2462eb5a8fd07b4a1b2803a80540b515f8e8a851
SHA512 4ac3f639991623a10b4a18c0e3fe62e585b83f8e0816293a90946e4703b541556b05dfd66cb7060aeb7eb118d3d7f37f6b9f5ae347f98e1d81527cb5a70d70bd
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfR:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvdkGhy.exe

Path C:\Windows\System\qvdkGhy.exe
Size 2.9MB
SHA256 666b6d7742c38b3f853724240378822d8752aec1796fe09ff5ee98b097055b6a
MD5 789cc0269fd7baa6f97e4f8ecd4bb381
SHA1 b65d74b95013ca59c39100ff304bced02d2d5696
SHA512 8e3f8a0af0e2bdbe1d6eac954239c06992a1971d3118bad9a63751223c571e67080bbb26b281eb0668c30008ff1d8375179729352e87a722f7254d75c0348216
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf0:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

rermdnX.exe

Path C:\Windows\System\rermdnX.exe
Size 3.0MB
SHA256 5c40e804226321114e7c3264940a2f167c7683177cb9f38f8ae16c8976cf6b9d
MD5 953a0001693ad4a82c1d6c3b4ccab2d1
SHA1 562c3be71d9d209d2c109da8304ae81b2dffde70
SHA512 52e9f1884ad1da8429c7cac22dfbc39eeef5f09d8133f92c441581df9b973413b205db080f8b91bbca9051d67f64b755ffeb9a23223213360539b641bd0b58c6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhft:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tpeFhUJ.exe

Path C:\Windows\System\tpeFhUJ.exe
Size 3.0MB
SHA256 026f3b68aa2ba3234d027ff9ecd5efab1d1fe9e78a2703856577def1fa7a0bb7
MD5 cde64790037dcc54387ecb81e1f7c1fc
SHA1 960919e7ffebad6a465d1a275012123af747dbdf
SHA512 89a51c7fddcd206482a44b60a5fb17903f43b88a8cc0ff66786c761ae949f4e8b0b5729963cca33db44a11ea41cc0e223cd60ec50ffedfde76d4011a373a3ec0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

uLdOras.exe

Path C:\Windows\System\uLdOras.exe
Size 2.9MB
SHA256 a2dbb82f3e278082e383c168e9671dd151c00eaf18801c2bbc0ff37539e780be
MD5 09df1253d288090ec5d3b253e6caa1e3
SHA1 de3ce59e5ee8594d2663aa3940f5ac2b0574326a
SHA512 424db1cfa12f5bfeda8325543985fe20e67ce4854899a0e9ecadaef2f0127365c97da84fa45f7a175ff4320b79d04e677eeb0c17971a6649faefb679b9eaa9c3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhf9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

uspzNZr.exe

Path C:\Windows\System\uspzNZr.exe
Size 3.0MB
SHA256 f928d044ba7c64c65716ffbfce5fc3abb7108c4644a09e3a4600162b937f0af5
MD5 8e58d1147e193c7b51533459a1facc4b
SHA1 b1a771b8bff4ec626af14dea8de46d13aa14af0a
SHA512 79dca9bcae1e528c826f9223ec89db8aab8a62d49089607d7516583561a033dc84177a4ec345757874c77dc6158649784c31410f1776bd92b177965270b17862
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfb:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

zNEUHUk.exe

Path C:\Windows\System\zNEUHUk.exe
Size 3.0MB
SHA256 68ee151b0360e455bebb8eb55010fd16821ab6259a3aa6c3b354f519f49f0bb4
MD5 b2758b708476b216f9097e737e6b6f87
SHA1 a6cf423c2e8884679d906671ce92fea49d5b8740
SHA512 d837f6537d71e4bc07aacb7187f5e795e0bd36bc0463cd16a24d777577e0d25248a23f5203646d8d4b9b39f0312031890db8b37f6727983c37b96009231e92b3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfz:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

zdojQDx.exe

Path C:\Windows\System\zdojQDx.exe
Size 2.9MB
SHA256 13b230c26f073fd0db200a4b25854d6a9e73cb237e2602c4240ae2710847b51e
MD5 f2246ee66de99aa1ba0eee472061a3b7
SHA1 a81b9f55365a25dfe0712a735064cf290cdbd4b6
SHA512 8891bebd0c3d43f59c948c94aaaafe5b07b7bc4b4558222a96c4f486c0519ecee65e0fec42dfc3bcaebbb3db3f4b22becf8dbe25300440514e100b1e11501171
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2af+vxGhfm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/928-57-0x00007FF706900000-0x00007FF706CF6000-memory.dmp

Download

memory/928-2223-0x00007FF706900000-0x00007FF706CF6000-memory.dmp

Download

memory/1168-0-0x00007FF7E3FE0000-0x00007FF7E43D6000-memory.dmp

Download

memory/1168-1-0x0000014F707D0000-0x0000014F707E0000-memory.dmp

Download

memory/1260-2241-0x00007FF65C8C0000-0x00007FF65CCB6000-memory.dmp

Download

memory/1260-816-0x00007FF65C8C0000-0x00007FF65CCB6000-memory.dmp

Download

memory/1600-817-0x00007FF7623A0000-0x00007FF762796000-memory.dmp

Download

memory/1600-2242-0x00007FF7623A0000-0x00007FF762796000-memory.dmp

Download

memory/1952-769-0x00007FF69B650000-0x00007FF69BA46000-memory.dmp

Download

memory/1952-2235-0x00007FF69B650000-0x00007FF69BA46000-memory.dmp

Download

memory/1960-2238-0x00007FF669560000-0x00007FF669956000-memory.dmp

Download

memory/1960-811-0x00007FF669560000-0x00007FF669956000-memory.dmp

Download

memory/2308-2221-0x00007FF7A5AA0000-0x00007FF7A5E96000-memory.dmp

Download

memory/2308-65-0x00007FF7A5AA0000-0x00007FF7A5E96000-memory.dmp

Download

memory/2376-2217-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp

Download

memory/2376-2220-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp

Download

memory/2376-15-0x00007FF635EC0000-0x00007FF6362B6000-memory.dmp

Download

memory/2520-795-0x00007FF7C28B0000-0x00007FF7C2CA6000-memory.dmp

Download

memory/2520-2231-0x00007FF7C28B0000-0x00007FF7C2CA6000-memory.dmp

Download

memory/2568-808-0x00007FF7DBCC0000-0x00007FF7DC0B6000-memory.dmp

Download

memory/2568-2237-0x00007FF7DBCC0000-0x00007FF7DC0B6000-memory.dmp

Download

memory/2608-60-0x00007FF681F70000-0x00007FF682366000-memory.dmp

Download

memory/2608-2222-0x00007FF681F70000-0x00007FF682366000-memory.dmp

Download

memory/2748-2218-0x00007FF714A50000-0x00007FF714E46000-memory.dmp

Download

memory/2748-767-0x00007FF714A50000-0x00007FF714E46000-memory.dmp

Download

memory/2748-2228-0x00007FF714A50000-0x00007FF714E46000-memory.dmp

Download

memory/2912-2239-0x00007FF77F3D0000-0x00007FF77F7C6000-memory.dmp

Download

memory/2912-820-0x00007FF77F3D0000-0x00007FF77F7C6000-memory.dmp

Download

memory/3204-805-0x00007FF7452C0000-0x00007FF7456B6000-memory.dmp

Download

memory/3204-2230-0x00007FF7452C0000-0x00007FF7456B6000-memory.dmp

Download

memory/3212-2227-0x00007FF772CC0000-0x00007FF7730B6000-memory.dmp

Download

memory/3212-828-0x00007FF772CC0000-0x00007FF7730B6000-memory.dmp

Download

memory/3500-68-0x00007FF72BA10000-0x00007FF72BE06000-memory.dmp

Download

memory/3500-2225-0x00007FF72BA10000-0x00007FF72BE06000-memory.dmp

Download

memory/3516-2214-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp

Download

memory/3516-2219-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp

Download

memory/3516-6-0x00007FF7EC6F0000-0x00007FF7ECAE6000-memory.dmp

Download

memory/3524-2224-0x00007FF603D30000-0x00007FF604126000-memory.dmp

Download

memory/3524-41-0x00007FF603D30000-0x00007FF604126000-memory.dmp

Download

memory/3632-2240-0x00007FF6F4C80000-0x00007FF6F5076000-memory.dmp

Download

memory/3632-823-0x00007FF6F4C80000-0x00007FF6F5076000-memory.dmp

Download

memory/3716-2216-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

Download

memory/3716-32-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

Download

memory/3716-8-0x00007FFD069B3000-0x00007FFD069B5000-memory.dmp

Download

memory/3716-48-0x0000029DC3F90000-0x0000029DC3FB2000-memory.dmp

Download

memory/3716-407-0x0000029DDCEA0000-0x0000029DDD646000-memory.dmp

Download

memory/3716-39-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

Download

memory/3716-2215-0x00007FFD069B3000-0x00007FFD069B5000-memory.dmp

Download

memory/3744-780-0x00007FF69E1C0000-0x00007FF69E5B6000-memory.dmp

Download

memory/3744-2236-0x00007FF69E1C0000-0x00007FF69E5B6000-memory.dmp

Download

memory/3864-69-0x00007FF641A60000-0x00007FF641E56000-memory.dmp

Download

memory/3864-2226-0x00007FF641A60000-0x00007FF641E56000-memory.dmp

Download

memory/3980-2229-0x00007FF7806E0000-0x00007FF780AD6000-memory.dmp

Download

memory/3980-799-0x00007FF7806E0000-0x00007FF780AD6000-memory.dmp

Download

memory/4088-2233-0x00007FF744810000-0x00007FF744C06000-memory.dmp

Download

memory/4088-833-0x00007FF744810000-0x00007FF744C06000-memory.dmp

Download

memory/4656-2234-0x00007FF7CB140000-0x00007FF7CB536000-memory.dmp

Download

memory/4656-768-0x00007FF7CB140000-0x00007FF7CB536000-memory.dmp

Download

memory/4952-2232-0x00007FF635510000-0x00007FF635906000-memory.dmp

Download

memory/4952-787-0x00007FF635510000-0x00007FF635906000-memory.dmp

Download