xmrig | 52d327361516de408b4e718f310cdf4c17d630ecdcc8e0a36c8c9e95225d5b97

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
Size 3.1MB
Sample240614-ma7a8swejb
SHA256 52d327361516de408b4e718f310cdf4c17d630ecdcc8e0a36c8c9e95225d5b97
MD5 b7540063d8263886b283dc5074d48280
SHA1 a7df70ecb99d4c098263e22be52e7d6f41afa647
SHA512 c3e93009d07bdfd1f95e348997abd66fdb51ba9c2647be8167ddb9738c05ed5d2d6b35d65ec0b124280a9ff50d9c536140bf9451a3d43ad97124c2e62a43c288
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/324-0-0x00007FF704860000-0x00007FF704C56000-memory.dmp	xmrig
behavioral2/files/0x0008000000023584-9.dat	xmrig
behavioral2/files/0x00060000000233cd-10.dat	xmrig
behavioral2/files/0x0007000000023585-8.dat	xmrig
behavioral2/files/0x0007000000023586-45.dat	xmrig
behavioral2/files/0x0007000000023587-44.dat	xmrig
behavioral2/files/0x0007000000023588-43.dat	xmrig
behavioral2/memory/1312-64-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp	xmrig
behavioral2/files/0x000800000002358a-74.dat	xmrig
behavioral2/memory/2452-77-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp	xmrig
behavioral2/memory/3844-83-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	xmrig
behavioral2/memory/1736-85-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp	xmrig
behavioral2/memory/3648-87-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp	xmrig
behavioral2/memory/376-86-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp	xmrig
behavioral2/memory/2120-84-0x00007FF757000000-0x00007FF7573F6000-memory.dmp	xmrig
behavioral2/memory/3048-82-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp	xmrig
behavioral2/memory/1068-81-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp	xmrig
behavioral2/files/0x000800000002358b-76.dat	xmrig
behavioral2/memory/2172-75-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp	xmrig
behavioral2/files/0x000700000002358e-70.dat	xmrig
behavioral2/files/0x0007000000023589-68.dat	xmrig
behavioral2/files/0x000700000002358d-66.dat	xmrig
behavioral2/files/0x000700000002358c-59.dat	xmrig
behavioral2/memory/4036-56-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	xmrig
behavioral2/memory/2768-50-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	xmrig
behavioral2/files/0x000700000002358f-90.dat	xmrig
behavioral2/files/0x0007000000023590-97.dat	xmrig
behavioral2/memory/380-108-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp	xmrig
behavioral2/memory/1584-107-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023593-118.dat	xmrig
behavioral2/files/0x0007000000023595-126.dat	xmrig
behavioral2/files/0x0007000000023592-125.dat	xmrig
behavioral2/files/0x0007000000023596-137.dat	xmrig
behavioral2/memory/2756-140-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp	xmrig
behavioral2/memory/1784-142-0x00007FF773880000-0x00007FF773C76000-memory.dmp	xmrig
behavioral2/memory/5084-145-0x00007FF787820000-0x00007FF787C16000-memory.dmp	xmrig
behavioral2/memory/3920-149-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023597-146.dat	xmrig
behavioral2/memory/4980-143-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp	xmrig
behavioral2/memory/4108-134-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp	xmrig
behavioral2/memory/536-131-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023594-127.dat	xmrig
behavioral2/memory/3976-122-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023591-113.dat	xmrig
behavioral2/files/0x0008000000023582-109.dat	xmrig
behavioral2/memory/3152-175-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp	xmrig
behavioral2/files/0x000700000002359e-182.dat	xmrig
behavioral2/files/0x00070000000235a1-186.dat	xmrig
behavioral2/memory/1888-185-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp	xmrig
behavioral2/files/0x000700000002359c-174.dat	xmrig
behavioral2/files/0x0007000000023598-166.dat	xmrig
behavioral2/files/0x00070000000235a3-254.dat	xmrig
behavioral2/files/0x00070000000235b7-264.dat	xmrig
behavioral2/files/0x00070000000235bb-275.dat	xmrig
behavioral2/files/0x00070000000235ba-279.dat	xmrig
behavioral2/files/0x00070000000235be-289.dat	xmrig
behavioral2/files/0x00070000000235bf-362.dat	xmrig
behavioral2/files/0x00070000000235d9-368.dat	xmrig
behavioral2/memory/324-1280-0x00007FF704860000-0x00007FF704C56000-memory.dmp	xmrig
behavioral2/memory/1584-1889-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	xmrig
behavioral2/memory/3976-1892-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	xmrig
behavioral2/memory/3844-3029-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	xmrig
behavioral2/memory/2768-3030-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	xmrig
behavioral2/memory/4036-3031-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	2704	powershell.exe
5	2704	powershell.exe
10	2704	powershell.exe
11	2704	powershell.exe
13	2704	powershell.exe
14	2704	powershell.exe
16	2704	powershell.exe
19	2704	powershell.exe
20	2704	powershell.exe
21	2704	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3844	YjMtENW.exe
2768	zSsHzvQ.exe
4036	PmItEyT.exe
2120	dmrdDMV.exe
1312	ErkRUbo.exe
2172	uAwmGQY.exe
1736	XbPqoiz.exe
2452	nFiXhvk.exe
1068	WEMuUez.exe
376	uiPPDnf.exe
3048	sYUwWjg.exe
3648	wKTLUim.exe
1584	yBGpwuM.exe
2756	dnukPFr.exe
380	lvLiWux.exe
3976	ARVhTPF.exe
1784	BqyHbZP.exe
536	thOgqhM.exe
4108	bmZmvMH.exe
4980	LYXhTmy.exe
5084	OUevYel.exe
3920	KQnvyaO.exe
3152	nAetehb.exe
1888	UOsCHWq.exe
64	vCKvoXl.exe
4340	HqWrntB.exe
1244	mDPDYKq.exe
4120	HypEywS.exe
4580	qdwLNrh.exe
1632	SXcmvRU.exe
416	fXujLXH.exe
1764	oAhWNLK.exe
1708	gnidRGO.exe
5104	ndOFUdW.exe
4220	BVKSTLg.exe
3944	YZYRoBL.exe
3588	HtCttwt.exe
2556	OSEKwks.exe
2812	lSbObVp.exe
1052	dSglmew.exe
2492	hYvtIvN.exe
452	yyErqMa.exe
5024	aGnCXqp.exe
4544	ZdrSJye.exe
1436	TaBuPgS.exe
4548	ISjcVHw.exe
732	OevRSWO.exe
3860	ULlKkRv.exe
3812	dhpVEyL.exe
4932	dhPunmW.exe
2880	CaTTZtx.exe
1624	MFKloet.exe
912	jokfpfE.exe
3364	ipxpQSE.exe
3008	LyxxdVj.exe
1640	FWkUbYg.exe
4408	ykSpURp.exe
4940	JnsKcqH.exe
4152	zeocmAF.exe
2168	KvilCGU.exe
2656	XSOiHZg.exe
4000	jWMDciJ.exe
3288	kIcljvT.exe
4316	PkKPUps.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/324-0-0x00007FF704860000-0x00007FF704C56000-memory.dmp	upx
behavioral2/files/0x0008000000023584-9.dat	upx
behavioral2/files/0x00060000000233cd-10.dat	upx
behavioral2/files/0x0007000000023585-8.dat	upx
behavioral2/files/0x0007000000023586-45.dat	upx
behavioral2/files/0x0007000000023587-44.dat	upx
behavioral2/files/0x0007000000023588-43.dat	upx
behavioral2/memory/1312-64-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp	upx
behavioral2/files/0x000800000002358a-74.dat	upx
behavioral2/memory/2452-77-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp	upx
behavioral2/memory/3844-83-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	upx
behavioral2/memory/1736-85-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp	upx
behavioral2/memory/3648-87-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp	upx
behavioral2/memory/376-86-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp	upx
behavioral2/memory/2120-84-0x00007FF757000000-0x00007FF7573F6000-memory.dmp	upx
behavioral2/memory/3048-82-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp	upx
behavioral2/memory/1068-81-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp	upx
behavioral2/files/0x000800000002358b-76.dat	upx
behavioral2/memory/2172-75-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp	upx
behavioral2/files/0x000700000002358e-70.dat	upx
behavioral2/files/0x0007000000023589-68.dat	upx
behavioral2/files/0x000700000002358d-66.dat	upx
behavioral2/files/0x000700000002358c-59.dat	upx
behavioral2/memory/4036-56-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	upx
behavioral2/memory/2768-50-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	upx
behavioral2/files/0x000700000002358f-90.dat	upx
behavioral2/files/0x0007000000023590-97.dat	upx
behavioral2/memory/380-108-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp	upx
behavioral2/memory/1584-107-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	upx
behavioral2/files/0x0007000000023593-118.dat	upx
behavioral2/files/0x0007000000023595-126.dat	upx
behavioral2/files/0x0007000000023592-125.dat	upx
behavioral2/files/0x0007000000023596-137.dat	upx
behavioral2/memory/2756-140-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp	upx
behavioral2/memory/1784-142-0x00007FF773880000-0x00007FF773C76000-memory.dmp	upx
behavioral2/memory/5084-145-0x00007FF787820000-0x00007FF787C16000-memory.dmp	upx
behavioral2/memory/3920-149-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp	upx
behavioral2/files/0x0007000000023597-146.dat	upx
behavioral2/memory/4980-143-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp	upx
behavioral2/memory/4108-134-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp	upx
behavioral2/memory/536-131-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp	upx
behavioral2/files/0x0007000000023594-127.dat	upx
behavioral2/memory/3976-122-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	upx
behavioral2/files/0x0007000000023591-113.dat	upx
behavioral2/files/0x0008000000023582-109.dat	upx
behavioral2/memory/3152-175-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp	upx
behavioral2/files/0x000700000002359e-182.dat	upx
behavioral2/files/0x00070000000235a1-186.dat	upx
behavioral2/memory/1888-185-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp	upx
behavioral2/files/0x000700000002359c-174.dat	upx
behavioral2/files/0x0007000000023598-166.dat	upx
behavioral2/files/0x00070000000235a3-254.dat	upx
behavioral2/files/0x00070000000235b7-264.dat	upx
behavioral2/files/0x00070000000235bb-275.dat	upx
behavioral2/files/0x00070000000235ba-279.dat	upx
behavioral2/files/0x00070000000235be-289.dat	upx
behavioral2/files/0x00070000000235bf-362.dat	upx
behavioral2/files/0x00070000000235d9-368.dat	upx
behavioral2/memory/324-1280-0x00007FF704860000-0x00007FF704C56000-memory.dmp	upx
behavioral2/memory/1584-1889-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	upx
behavioral2/memory/3976-1892-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	upx
behavioral2/memory/3844-3029-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	upx
behavioral2/memory/2768-3030-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	upx
behavioral2/memory/4036-3031-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uUfFxFT.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\lzHAXWN.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\UyGlWHM.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\XnKPmgX.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dZABlKn.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\wtUxNvN.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ZPHMkUt.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\tdXbkGf.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\uXaTXHJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\damJlRc.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\IdzCwGM.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\mmlcaLS.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\gYapFoQ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\WICWwuK.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\PmAmQOB.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\hqysmsO.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\IeYUSHH.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\qvDAWVf.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HsvznJx.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HIiEMJn.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ZJOKZli.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\CiBznBb.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HRbxUvD.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pJRRncb.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\toLRNgZ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dBGKCwl.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\bfjKwWz.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\JpWhMzx.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\CiuXHGt.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\tsNqQDd.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\NqOMOFa.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pdoifWv.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\UrcastJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\muJrVut.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\OtvXcWP.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\aGreTSm.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ooSFFJO.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pdVVJMP.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\NmEcxbp.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\wbBsMUX.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\QnHttiT.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\cpgwKMc.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dPTfwtE.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HnZEVIm.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HZfxGoY.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\nrzhwgC.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\EanLSQJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\RtwseNt.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\jPWyrUJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HzifiNa.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\QGxKvan.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\gBIoKsn.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\aBHcpzJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\yUGAnmp.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\FyEQLON.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\brxGgfM.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pnpkxRu.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\vXGVmex.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\gGWZdoJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\qtacDKH.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\sRgrrHE.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dfdttNY.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\NyJUYQV.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ioozEdc.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	powershell.exe
2704	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
Token: SeDebugPrivilege	2704	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 2704	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	83
PID 324 wrote to memory of 2704	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	83
PID 324 wrote to memory of 3844	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	84
PID 324 wrote to memory of 3844	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	84
PID 324 wrote to memory of 2768	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	85
PID 324 wrote to memory of 2768	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	85
PID 324 wrote to memory of 4036	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	86
PID 324 wrote to memory of 4036	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	86
PID 324 wrote to memory of 1312	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	87
PID 324 wrote to memory of 1312	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	87
PID 324 wrote to memory of 2120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	88
PID 324 wrote to memory of 2120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	88
PID 324 wrote to memory of 2172	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	89
PID 324 wrote to memory of 2172	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	89
PID 324 wrote to memory of 2452	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	90
PID 324 wrote to memory of 2452	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	90
PID 324 wrote to memory of 1736	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	91
PID 324 wrote to memory of 1736	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	91
PID 324 wrote to memory of 1068	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	92
PID 324 wrote to memory of 1068	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	92
PID 324 wrote to memory of 376	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	93
PID 324 wrote to memory of 376	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	93
PID 324 wrote to memory of 3048	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	94
PID 324 wrote to memory of 3048	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	94
PID 324 wrote to memory of 3648	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	95
PID 324 wrote to memory of 3648	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	95
PID 324 wrote to memory of 1584	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	96
PID 324 wrote to memory of 1584	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	96
PID 324 wrote to memory of 2756	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	97
PID 324 wrote to memory of 2756	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	97
PID 324 wrote to memory of 380	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	98
PID 324 wrote to memory of 380	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	98
PID 324 wrote to memory of 3976	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	99
PID 324 wrote to memory of 3976	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	99
PID 324 wrote to memory of 1784	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	100
PID 324 wrote to memory of 1784	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	100
PID 324 wrote to memory of 536	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	101
PID 324 wrote to memory of 536	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	101
PID 324 wrote to memory of 4108	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	102
PID 324 wrote to memory of 4108	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	102
PID 324 wrote to memory of 4980	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	103
PID 324 wrote to memory of 4980	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	103
PID 324 wrote to memory of 5084	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	104
PID 324 wrote to memory of 5084	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	104
PID 324 wrote to memory of 3920	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	105
PID 324 wrote to memory of 3920	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	105
PID 324 wrote to memory of 3152	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	106
PID 324 wrote to memory of 3152	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	106
PID 324 wrote to memory of 1888	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	107
PID 324 wrote to memory of 1888	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	107
PID 324 wrote to memory of 64	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	108
PID 324 wrote to memory of 64	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	108
PID 324 wrote to memory of 4340	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	109
PID 324 wrote to memory of 4340	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	109
PID 324 wrote to memory of 1244	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	111
PID 324 wrote to memory of 1244	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	111
PID 324 wrote to memory of 4120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	113
PID 324 wrote to memory of 4120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	113
PID 324 wrote to memory of 4580	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	114
PID 324 wrote to memory of 4580	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	114
PID 324 wrote to memory of 1632	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	115
PID 324 wrote to memory of 1632	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	115
PID 324 wrote to memory of 416	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	116
PID 324 wrote to memory of 416	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System\YjMtENW.exe
  C:\Windows\System\YjMtENW.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\zSsHzvQ.exe
  C:\Windows\System\zSsHzvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\PmItEyT.exe
  C:\Windows\System\PmItEyT.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\ErkRUbo.exe
  C:\Windows\System\ErkRUbo.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\dmrdDMV.exe
  C:\Windows\System\dmrdDMV.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\uAwmGQY.exe
  C:\Windows\System\uAwmGQY.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\nFiXhvk.exe
  C:\Windows\System\nFiXhvk.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\XbPqoiz.exe
  C:\Windows\System\XbPqoiz.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\WEMuUez.exe
  C:\Windows\System\WEMuUez.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\uiPPDnf.exe
  C:\Windows\System\uiPPDnf.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\sYUwWjg.exe
  C:\Windows\System\sYUwWjg.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\wKTLUim.exe
  C:\Windows\System\wKTLUim.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\yBGpwuM.exe
  C:\Windows\System\yBGpwuM.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\dnukPFr.exe
  C:\Windows\System\dnukPFr.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\lvLiWux.exe
  C:\Windows\System\lvLiWux.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ARVhTPF.exe
  C:\Windows\System\ARVhTPF.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\BqyHbZP.exe
  C:\Windows\System\BqyHbZP.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\thOgqhM.exe
  C:\Windows\System\thOgqhM.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\bmZmvMH.exe
  C:\Windows\System\bmZmvMH.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\LYXhTmy.exe
  C:\Windows\System\LYXhTmy.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\OUevYel.exe
  C:\Windows\System\OUevYel.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\KQnvyaO.exe
  C:\Windows\System\KQnvyaO.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\nAetehb.exe
  C:\Windows\System\nAetehb.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\UOsCHWq.exe
  C:\Windows\System\UOsCHWq.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\vCKvoXl.exe
  C:\Windows\System\vCKvoXl.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\HqWrntB.exe
  C:\Windows\System\HqWrntB.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\mDPDYKq.exe
  C:\Windows\System\mDPDYKq.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\HypEywS.exe
  C:\Windows\System\HypEywS.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\qdwLNrh.exe
  C:\Windows\System\qdwLNrh.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\SXcmvRU.exe
  C:\Windows\System\SXcmvRU.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\fXujLXH.exe
  C:\Windows\System\fXujLXH.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\oAhWNLK.exe
  C:\Windows\System\oAhWNLK.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\gnidRGO.exe
  C:\Windows\System\gnidRGO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ndOFUdW.exe
  C:\Windows\System\ndOFUdW.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\BVKSTLg.exe
  C:\Windows\System\BVKSTLg.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\YZYRoBL.exe
  C:\Windows\System\YZYRoBL.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\HtCttwt.exe
  C:\Windows\System\HtCttwt.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\OSEKwks.exe
  C:\Windows\System\OSEKwks.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\lSbObVp.exe
  C:\Windows\System\lSbObVp.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\dSglmew.exe
  C:\Windows\System\dSglmew.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\hYvtIvN.exe
  C:\Windows\System\hYvtIvN.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\yyErqMa.exe
  C:\Windows\System\yyErqMa.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\aGnCXqp.exe
  C:\Windows\System\aGnCXqp.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\ZdrSJye.exe
  C:\Windows\System\ZdrSJye.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\TaBuPgS.exe
  C:\Windows\System\TaBuPgS.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ISjcVHw.exe
  C:\Windows\System\ISjcVHw.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\OevRSWO.exe
  C:\Windows\System\OevRSWO.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\ULlKkRv.exe
  C:\Windows\System\ULlKkRv.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\dhpVEyL.exe
  C:\Windows\System\dhpVEyL.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\dhPunmW.exe
  C:\Windows\System\dhPunmW.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\CaTTZtx.exe
  C:\Windows\System\CaTTZtx.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\MFKloet.exe
  C:\Windows\System\MFKloet.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\jokfpfE.exe
  C:\Windows\System\jokfpfE.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ipxpQSE.exe
  C:\Windows\System\ipxpQSE.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\LyxxdVj.exe
  C:\Windows\System\LyxxdVj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FWkUbYg.exe
  C:\Windows\System\FWkUbYg.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ykSpURp.exe
  C:\Windows\System\ykSpURp.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\JnsKcqH.exe
  C:\Windows\System\JnsKcqH.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\zeocmAF.exe
  C:\Windows\System\zeocmAF.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\KvilCGU.exe
  C:\Windows\System\KvilCGU.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\XSOiHZg.exe
  C:\Windows\System\XSOiHZg.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\jWMDciJ.exe
  C:\Windows\System\jWMDciJ.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\kIcljvT.exe
  C:\Windows\System\kIcljvT.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\PkKPUps.exe
  C:\Windows\System\PkKPUps.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\GpIHnQa.exe
  C:\Windows\System\GpIHnQa.exe
  2⤵
  PID:3412
- C:\Windows\System\vaPPhNi.exe
  C:\Windows\System\vaPPhNi.exe
  2⤵
  PID:3560
- C:\Windows\System\wOnyBDS.exe
  C:\Windows\System\wOnyBDS.exe
  2⤵
  PID:2420
- C:\Windows\System\NQcLeFG.exe
  C:\Windows\System\NQcLeFG.exe
  2⤵
  PID:672
- C:\Windows\System\UIbiOKh.exe
  C:\Windows\System\UIbiOKh.exe
  2⤵
  PID:4060
- C:\Windows\System\tuhInWe.exe
  C:\Windows\System\tuhInWe.exe
  2⤵
  PID:1720
- C:\Windows\System\BnieeaY.exe
  C:\Windows\System\BnieeaY.exe
  2⤵
  PID:3996
- C:\Windows\System\GJWtNLh.exe
  C:\Windows\System\GJWtNLh.exe
  2⤵
  PID:4876
- C:\Windows\System\pyFXfHc.exe
  C:\Windows\System\pyFXfHc.exe
  2⤵
  PID:4576
- C:\Windows\System\TkMatBY.exe
  C:\Windows\System\TkMatBY.exe
  2⤵
  PID:5116
- C:\Windows\System\ZAMKaKy.exe
  C:\Windows\System\ZAMKaKy.exe
  2⤵
  PID:4492
- C:\Windows\System\TVXJKvx.exe
  C:\Windows\System\TVXJKvx.exe
  2⤵
  PID:4468
- C:\Windows\System\xJbRVxm.exe
  C:\Windows\System\xJbRVxm.exe
  2⤵
  PID:4716
- C:\Windows\System\voSoocN.exe
  C:\Windows\System\voSoocN.exe
  2⤵
  PID:2036
- C:\Windows\System\LEVVKto.exe
  C:\Windows\System\LEVVKto.exe
  2⤵
  PID:4012
- C:\Windows\System\BsMnFfQ.exe
  C:\Windows\System\BsMnFfQ.exe
  2⤵
  PID:1492
- C:\Windows\System\GmTUHfT.exe
  C:\Windows\System\GmTUHfT.exe
  2⤵
  PID:832
- C:\Windows\System\XYNgNuA.exe
  C:\Windows\System\XYNgNuA.exe
  2⤵
  PID:3040
- C:\Windows\System\LDKJtWS.exe
  C:\Windows\System\LDKJtWS.exe
  2⤵
  PID:992
- C:\Windows\System\WJvENZS.exe
  C:\Windows\System\WJvENZS.exe
  2⤵
  PID:2000
- C:\Windows\System\aLeTOTH.exe
  C:\Windows\System\aLeTOTH.exe
  2⤵
  PID:2700
- C:\Windows\System\zhKQFnb.exe
  C:\Windows\System\zhKQFnb.exe
  2⤵
  PID:5016
- C:\Windows\System\SeNgKID.exe
  C:\Windows\System\SeNgKID.exe
  2⤵
  PID:5132
- C:\Windows\System\cvbljFv.exe
  C:\Windows\System\cvbljFv.exe
  2⤵
  PID:5168
- C:\Windows\System\CCRwysg.exe
  C:\Windows\System\CCRwysg.exe
  2⤵
  PID:5200
- C:\Windows\System\fcsvfkN.exe
  C:\Windows\System\fcsvfkN.exe
  2⤵
  PID:5228
- C:\Windows\System\WvsRVVq.exe
  C:\Windows\System\WvsRVVq.exe
  2⤵
  PID:5260
- C:\Windows\System\FboaTlu.exe
  C:\Windows\System\FboaTlu.exe
  2⤵
  PID:5296
- C:\Windows\System\yjtHOKO.exe
  C:\Windows\System\yjtHOKO.exe
  2⤵
  PID:5324
- C:\Windows\System\JfAyOMf.exe
  C:\Windows\System\JfAyOMf.exe
  2⤵
  PID:5360
- C:\Windows\System\saWZglK.exe
  C:\Windows\System\saWZglK.exe
  2⤵
  PID:5392
- C:\Windows\System\pAyXGRj.exe
  C:\Windows\System\pAyXGRj.exe
  2⤵
  PID:5424
- C:\Windows\System\yDPsxEU.exe
  C:\Windows\System\yDPsxEU.exe
  2⤵
  PID:5456
- C:\Windows\System\RtTEVvH.exe
  C:\Windows\System\RtTEVvH.exe
  2⤵
  PID:5476
- C:\Windows\System\vZTVOkR.exe
  C:\Windows\System\vZTVOkR.exe
  2⤵
  PID:5520
- C:\Windows\System\ONJPNeb.exe
  C:\Windows\System\ONJPNeb.exe
  2⤵
  PID:5588
- C:\Windows\System\pznBgtG.exe
  C:\Windows\System\pznBgtG.exe
  2⤵
  PID:5604
- C:\Windows\System\dmmVLFf.exe
  C:\Windows\System\dmmVLFf.exe
  2⤵
  PID:5624
- C:\Windows\System\rxSbUBo.exe
  C:\Windows\System\rxSbUBo.exe
  2⤵
  PID:5644
- C:\Windows\System\RbVjlXS.exe
  C:\Windows\System\RbVjlXS.exe
  2⤵
  PID:5672
- C:\Windows\System\bxbkvhz.exe
  C:\Windows\System\bxbkvhz.exe
  2⤵
  PID:5720
- C:\Windows\System\TREaFtQ.exe
  C:\Windows\System\TREaFtQ.exe
  2⤵
  PID:5748
- C:\Windows\System\TDoHjrX.exe
  C:\Windows\System\TDoHjrX.exe
  2⤵
  PID:5788
- C:\Windows\System\mouaPtG.exe
  C:\Windows\System\mouaPtG.exe
  2⤵
  PID:5824
- C:\Windows\System\TSQvWgX.exe
  C:\Windows\System\TSQvWgX.exe
  2⤵
  PID:5864
- C:\Windows\System\ynzDhEO.exe
  C:\Windows\System\ynzDhEO.exe
  2⤵
  PID:5888
- C:\Windows\System\EpSxAcH.exe
  C:\Windows\System\EpSxAcH.exe
  2⤵
  PID:5916
- C:\Windows\System\sgHzSXM.exe
  C:\Windows\System\sgHzSXM.exe
  2⤵
  PID:5944
- C:\Windows\System\rTIniLZ.exe
  C:\Windows\System\rTIniLZ.exe
  2⤵
  PID:5972
- C:\Windows\System\lrwoADB.exe
  C:\Windows\System\lrwoADB.exe
  2⤵
  PID:6008
- C:\Windows\System\IvykHvz.exe
  C:\Windows\System\IvykHvz.exe
  2⤵
  PID:6040
- C:\Windows\System\gFaZMnf.exe
  C:\Windows\System\gFaZMnf.exe
  2⤵
  PID:6068
- C:\Windows\System\ehwKzin.exe
  C:\Windows\System\ehwKzin.exe
  2⤵
  PID:6096
- C:\Windows\System\lklwUGj.exe
  C:\Windows\System\lklwUGj.exe
  2⤵
  PID:6124
- C:\Windows\System\QIKrVds.exe
  C:\Windows\System\QIKrVds.exe
  2⤵
  PID:2936
- C:\Windows\System\oJVxnYM.exe
  C:\Windows\System\oJVxnYM.exe
  2⤵
  PID:5188
- C:\Windows\System\UhkZJXo.exe
  C:\Windows\System\UhkZJXo.exe
  2⤵
  PID:5244
- C:\Windows\System\wyuesvU.exe
  C:\Windows\System\wyuesvU.exe
  2⤵
  PID:5308
- C:\Windows\System\CDNmwVC.exe
  C:\Windows\System\CDNmwVC.exe
  2⤵
  PID:5348
- C:\Windows\System\wxbSvQw.exe
  C:\Windows\System\wxbSvQw.exe
  2⤵
  PID:5412
- C:\Windows\System\tItgjgf.exe
  C:\Windows\System\tItgjgf.exe
  2⤵
  PID:5472
- C:\Windows\System\QzeqcSA.exe
  C:\Windows\System\QzeqcSA.exe
  2⤵
  PID:5516
- C:\Windows\System\iFdcikk.exe
  C:\Windows\System\iFdcikk.exe
  2⤵
  PID:5612
- C:\Windows\System\cqsoyuS.exe
  C:\Windows\System\cqsoyuS.exe
  2⤵
  PID:5660
- C:\Windows\System\ILrTgyC.exe
  C:\Windows\System\ILrTgyC.exe
  2⤵
  PID:5736
- C:\Windows\System\ThifZYd.exe
  C:\Windows\System\ThifZYd.exe
  2⤵
  PID:5772
- C:\Windows\System\wprPfYi.exe
  C:\Windows\System\wprPfYi.exe
  2⤵
  PID:5808
- C:\Windows\System\oquGQZA.exe
  C:\Windows\System\oquGQZA.exe
  2⤵
  PID:5852
- C:\Windows\System\WwwmJWs.exe
  C:\Windows\System\WwwmJWs.exe
  2⤵
  PID:5928
- C:\Windows\System\kgwgXSH.exe
  C:\Windows\System\kgwgXSH.exe
  2⤵
  PID:5996
- C:\Windows\System\JTZOWUP.exe
  C:\Windows\System\JTZOWUP.exe
  2⤵
  PID:6092
- C:\Windows\System\IZhBmfL.exe
  C:\Windows\System\IZhBmfL.exe
  2⤵
  PID:5164
- C:\Windows\System\pvfBlvO.exe
  C:\Windows\System\pvfBlvO.exe
  2⤵
  PID:5352
- C:\Windows\System\wxBhRgm.exe
  C:\Windows\System\wxBhRgm.exe
  2⤵
  PID:5148
- C:\Windows\System\YjxzLpd.exe
  C:\Windows\System\YjxzLpd.exe
  2⤵
  PID:5556
- C:\Windows\System\yYdAMDl.exe
  C:\Windows\System\yYdAMDl.exe
  2⤵
  PID:5688
- C:\Windows\System\KwEhrZZ.exe
  C:\Windows\System\KwEhrZZ.exe
  2⤵
  PID:5816
- C:\Windows\System\XZdlIir.exe
  C:\Windows\System\XZdlIir.exe
  2⤵
  PID:5964
- C:\Windows\System\GxmRtnr.exe
  C:\Windows\System\GxmRtnr.exe
  2⤵
  PID:5240
- C:\Windows\System\FaukgLG.exe
  C:\Windows\System\FaukgLG.exe
  2⤵
  PID:5496
- C:\Windows\System\sKnzTPY.exe
  C:\Windows\System\sKnzTPY.exe
  2⤵
  PID:5884
- C:\Windows\System\RuMwQka.exe
  C:\Windows\System\RuMwQka.exe
  2⤵
  PID:5404
- C:\Windows\System\jPjcBMv.exe
  C:\Windows\System\jPjcBMv.exe
  2⤵
  PID:5760
- C:\Windows\System\mvIVKaq.exe
  C:\Windows\System\mvIVKaq.exe
  2⤵
  PID:6180
- C:\Windows\System\ZJOKZli.exe
  C:\Windows\System\ZJOKZli.exe
  2⤵
  PID:6204
- C:\Windows\System\CiuXHGt.exe
  C:\Windows\System\CiuXHGt.exe
  2⤵
  PID:6224
- C:\Windows\System\mdiJBJM.exe
  C:\Windows\System\mdiJBJM.exe
  2⤵
  PID:6252
- C:\Windows\System\IVDsZVH.exe
  C:\Windows\System\IVDsZVH.exe
  2⤵
  PID:6280
- C:\Windows\System\rLSbMzn.exe
  C:\Windows\System\rLSbMzn.exe
  2⤵
  PID:6308
- C:\Windows\System\WxWyETj.exe
  C:\Windows\System\WxWyETj.exe
  2⤵
  PID:6340
- C:\Windows\System\VBGLrgx.exe
  C:\Windows\System\VBGLrgx.exe
  2⤵
  PID:6364
- C:\Windows\System\JqtCotu.exe
  C:\Windows\System\JqtCotu.exe
  2⤵
  PID:6396
- C:\Windows\System\KxCOdCg.exe
  C:\Windows\System\KxCOdCg.exe
  2⤵
  PID:6428
- C:\Windows\System\hPZYxle.exe
  C:\Windows\System\hPZYxle.exe
  2⤵
  PID:6464
- C:\Windows\System\SRsBFZt.exe
  C:\Windows\System\SRsBFZt.exe
  2⤵
  PID:6484
- C:\Windows\System\CcYjwEm.exe
  C:\Windows\System\CcYjwEm.exe
  2⤵
  PID:6512
- C:\Windows\System\povYEFP.exe
  C:\Windows\System\povYEFP.exe
  2⤵
  PID:6540
- C:\Windows\System\KPQtsSh.exe
  C:\Windows\System\KPQtsSh.exe
  2⤵
  PID:6568
- C:\Windows\System\VMFsWul.exe
  C:\Windows\System\VMFsWul.exe
  2⤵
  PID:6600
- C:\Windows\System\lFwvQaU.exe
  C:\Windows\System\lFwvQaU.exe
  2⤵
  PID:6624
- C:\Windows\System\DFHtNHu.exe
  C:\Windows\System\DFHtNHu.exe
  2⤵
  PID:6652
- C:\Windows\System\JkyuFNG.exe
  C:\Windows\System\JkyuFNG.exe
  2⤵
  PID:6684
- C:\Windows\System\FxXikoM.exe
  C:\Windows\System\FxXikoM.exe
  2⤵
  PID:6708
- C:\Windows\System\NuLspIW.exe
  C:\Windows\System\NuLspIW.exe
  2⤵
  PID:6736
- C:\Windows\System\icpdtmJ.exe
  C:\Windows\System\icpdtmJ.exe
  2⤵
  PID:6764
- C:\Windows\System\GfdspmU.exe
  C:\Windows\System\GfdspmU.exe
  2⤵
  PID:6800
- C:\Windows\System\ePwIBcz.exe
  C:\Windows\System\ePwIBcz.exe
  2⤵
  PID:6828
- C:\Windows\System\gkbUBmt.exe
  C:\Windows\System\gkbUBmt.exe
  2⤵
  PID:6860
- C:\Windows\System\SrrVDhm.exe
  C:\Windows\System\SrrVDhm.exe
  2⤵
  PID:6884
- C:\Windows\System\olBjRHo.exe
  C:\Windows\System\olBjRHo.exe
  2⤵
  PID:6912
- C:\Windows\System\QMMWsCg.exe
  C:\Windows\System\QMMWsCg.exe
  2⤵
  PID:6944
- C:\Windows\System\sLWVOeX.exe
  C:\Windows\System\sLWVOeX.exe
  2⤵
  PID:6968
- C:\Windows\System\ppNLXyT.exe
  C:\Windows\System\ppNLXyT.exe
  2⤵
  PID:7004
- C:\Windows\System\EkVdiBb.exe
  C:\Windows\System\EkVdiBb.exe
  2⤵
  PID:7028
- C:\Windows\System\NyiRNOv.exe
  C:\Windows\System\NyiRNOv.exe
  2⤵
  PID:7056
- C:\Windows\System\whFSjgF.exe
  C:\Windows\System\whFSjgF.exe
  2⤵
  PID:7088
- C:\Windows\System\tUUlXyA.exe
  C:\Windows\System\tUUlXyA.exe
  2⤵
  PID:7112
- C:\Windows\System\kHmwkdv.exe
  C:\Windows\System\kHmwkdv.exe
  2⤵
  PID:7144
- C:\Windows\System\rLWSfIY.exe
  C:\Windows\System\rLWSfIY.exe
  2⤵
  PID:6148
- C:\Windows\System\RjravUn.exe
  C:\Windows\System\RjravUn.exe
  2⤵
  PID:6216
- C:\Windows\System\jiMGenb.exe
  C:\Windows\System\jiMGenb.exe
  2⤵
  PID:6276
- C:\Windows\System\fgAxCob.exe
  C:\Windows\System\fgAxCob.exe
  2⤵
  PID:6348
- C:\Windows\System\tDDAzWK.exe
  C:\Windows\System\tDDAzWK.exe
  2⤵
  PID:6420
- C:\Windows\System\iAjtLNt.exe
  C:\Windows\System\iAjtLNt.exe
  2⤵
  PID:6508
- C:\Windows\System\BhURoTp.exe
  C:\Windows\System\BhURoTp.exe
  2⤵
  PID:6564
- C:\Windows\System\vMfHiJb.exe
  C:\Windows\System\vMfHiJb.exe
  2⤵
  PID:6648
- C:\Windows\System\FboVwMF.exe
  C:\Windows\System\FboVwMF.exe
  2⤵
  PID:6704
- C:\Windows\System\AGqUhna.exe
  C:\Windows\System\AGqUhna.exe
  2⤵
  PID:6780
- C:\Windows\System\AhzYhmS.exe
  C:\Windows\System\AhzYhmS.exe
  2⤵
  PID:6840
- C:\Windows\System\CKVvKzb.exe
  C:\Windows\System\CKVvKzb.exe
  2⤵
  PID:6924
- C:\Windows\System\mrqYGGx.exe
  C:\Windows\System\mrqYGGx.exe
  2⤵
  PID:6960
- C:\Windows\System\glWPRdu.exe
  C:\Windows\System\glWPRdu.exe
  2⤵
  PID:7044
- C:\Windows\System\QupeCSs.exe
  C:\Windows\System\QupeCSs.exe
  2⤵
  PID:7108
- C:\Windows\System\NcZmnGt.exe
  C:\Windows\System\NcZmnGt.exe
  2⤵
  PID:7132
- C:\Windows\System\ObxQVFu.exe
  C:\Windows\System\ObxQVFu.exe
  2⤵
  PID:6296
- C:\Windows\System\pnpkxRu.exe
  C:\Windows\System\pnpkxRu.exe
  2⤵
  PID:6496
- C:\Windows\System\WeMIbJp.exe
  C:\Windows\System\WeMIbJp.exe
  2⤵
  PID:6636
- C:\Windows\System\nEOraAP.exe
  C:\Windows\System\nEOraAP.exe
  2⤵
  PID:6816
- C:\Windows\System\ggNElUa.exe
  C:\Windows\System\ggNElUa.exe
  2⤵
  PID:6964
- C:\Windows\System\LgRBJSI.exe
  C:\Windows\System\LgRBJSI.exe
  2⤵
  PID:7096
- C:\Windows\System\iBJQauP.exe
  C:\Windows\System\iBJQauP.exe
  2⤵
  PID:6448
- C:\Windows\System\MkqwXzd.exe
  C:\Windows\System\MkqwXzd.exe
  2⤵
  PID:6896
- C:\Windows\System\OHtEPsi.exe
  C:\Windows\System\OHtEPsi.exe
  2⤵
  PID:6408
- C:\Windows\System\MGBhIpW.exe
  C:\Windows\System\MGBhIpW.exe
  2⤵
  PID:6760
- C:\Windows\System\TbZEpFk.exe
  C:\Windows\System\TbZEpFk.exe
  2⤵
  PID:7188
- C:\Windows\System\hewYuOr.exe
  C:\Windows\System\hewYuOr.exe
  2⤵
  PID:7220
- C:\Windows\System\VhVyPAH.exe
  C:\Windows\System\VhVyPAH.exe
  2⤵
  PID:7248
- C:\Windows\System\bmArfeO.exe
  C:\Windows\System\bmArfeO.exe
  2⤵
  PID:7280
- C:\Windows\System\LFiFxDw.exe
  C:\Windows\System\LFiFxDw.exe
  2⤵
  PID:7308
- C:\Windows\System\evRQUUy.exe
  C:\Windows\System\evRQUUy.exe
  2⤵
  PID:7340
- C:\Windows\System\rUkrHJU.exe
  C:\Windows\System\rUkrHJU.exe
  2⤵
  PID:7364
- C:\Windows\System\SjSDchJ.exe
  C:\Windows\System\SjSDchJ.exe
  2⤵
  PID:7392
- C:\Windows\System\MxefUdq.exe
  C:\Windows\System\MxefUdq.exe
  2⤵
  PID:7420
- C:\Windows\System\wUAeeXM.exe
  C:\Windows\System\wUAeeXM.exe
  2⤵
  PID:7448
- C:\Windows\System\uOcNTca.exe
  C:\Windows\System\uOcNTca.exe
  2⤵
  PID:7476
- C:\Windows\System\isTnMHf.exe
  C:\Windows\System\isTnMHf.exe
  2⤵
  PID:7504
- C:\Windows\System\AwPlkmZ.exe
  C:\Windows\System\AwPlkmZ.exe
  2⤵
  PID:7536
- C:\Windows\System\Htozndy.exe
  C:\Windows\System\Htozndy.exe
  2⤵
  PID:7560
- C:\Windows\System\SxYrVcw.exe
  C:\Windows\System\SxYrVcw.exe
  2⤵
  PID:7596
- C:\Windows\System\CliTcnf.exe
  C:\Windows\System\CliTcnf.exe
  2⤵
  PID:7628
- C:\Windows\System\qBYKXgN.exe
  C:\Windows\System\qBYKXgN.exe
  2⤵
  PID:7652
- C:\Windows\System\KwFHzaW.exe
  C:\Windows\System\KwFHzaW.exe
  2⤵
  PID:7672
- C:\Windows\System\hZmmgIb.exe
  C:\Windows\System\hZmmgIb.exe
  2⤵
  PID:7704
- C:\Windows\System\Nmhxits.exe
  C:\Windows\System\Nmhxits.exe
  2⤵
  PID:7740
- C:\Windows\System\EUoVyGH.exe
  C:\Windows\System\EUoVyGH.exe
  2⤵
  PID:7768
- C:\Windows\System\HtBICgu.exe
  C:\Windows\System\HtBICgu.exe
  2⤵
  PID:7796
- C:\Windows\System\sNqPHmT.exe
  C:\Windows\System\sNqPHmT.exe
  2⤵
  PID:7824
- C:\Windows\System\jEskKux.exe
  C:\Windows\System\jEskKux.exe
  2⤵
  PID:7852
- C:\Windows\System\eiFDiiA.exe
  C:\Windows\System\eiFDiiA.exe
  2⤵
  PID:7888
- C:\Windows\System\dIXWSch.exe
  C:\Windows\System\dIXWSch.exe
  2⤵
  PID:7908
- C:\Windows\System\xypVoyC.exe
  C:\Windows\System\xypVoyC.exe
  2⤵
  PID:7940
- C:\Windows\System\bgyElyd.exe
  C:\Windows\System\bgyElyd.exe
  2⤵
  PID:7972
- C:\Windows\System\IAqOBSb.exe
  C:\Windows\System\IAqOBSb.exe
  2⤵
  PID:7992
- C:\Windows\System\oIlgnxe.exe
  C:\Windows\System\oIlgnxe.exe
  2⤵
  PID:8024
- C:\Windows\System\ppERApt.exe
  C:\Windows\System\ppERApt.exe
  2⤵
  PID:8048
- C:\Windows\System\ucNiOin.exe
  C:\Windows\System\ucNiOin.exe
  2⤵
  PID:8080
- C:\Windows\System\ZccxzAC.exe
  C:\Windows\System\ZccxzAC.exe
  2⤵
  PID:8104
- C:\Windows\System\SrzrKci.exe
  C:\Windows\System\SrzrKci.exe
  2⤵
  PID:8132
- C:\Windows\System\dAVJlNS.exe
  C:\Windows\System\dAVJlNS.exe
  2⤵
  PID:8160
- C:\Windows\System\eqWduXM.exe
  C:\Windows\System\eqWduXM.exe
  2⤵
  PID:7176
- C:\Windows\System\utYUYnH.exe
  C:\Windows\System\utYUYnH.exe
  2⤵
  PID:7232
- C:\Windows\System\JvetDKK.exe
  C:\Windows\System\JvetDKK.exe
  2⤵
  PID:7296
- C:\Windows\System\DTsTVZo.exe
  C:\Windows\System\DTsTVZo.exe
  2⤵
  PID:7352
- C:\Windows\System\FUdPFxQ.exe
  C:\Windows\System\FUdPFxQ.exe
  2⤵
  PID:7436
- C:\Windows\System\DEDxOOe.exe
  C:\Windows\System\DEDxOOe.exe
  2⤵
  PID:7472
- C:\Windows\System\woaEICl.exe
  C:\Windows\System\woaEICl.exe
  2⤵
  PID:7528
- C:\Windows\System\edMVLAo.exe
  C:\Windows\System\edMVLAo.exe
  2⤵
  PID:7604
- C:\Windows\System\pbdNCBx.exe
  C:\Windows\System\pbdNCBx.exe
  2⤵
  PID:7680
- C:\Windows\System\xYjCOkQ.exe
  C:\Windows\System\xYjCOkQ.exe
  2⤵
  PID:7736
- C:\Windows\System\viNpvGu.exe
  C:\Windows\System\viNpvGu.exe
  2⤵
  PID:7808
- C:\Windows\System\dptLaKe.exe
  C:\Windows\System\dptLaKe.exe
  2⤵
  PID:7872
- C:\Windows\System\XZcYJtk.exe
  C:\Windows\System\XZcYJtk.exe
  2⤵
  PID:7932
- C:\Windows\System\BxindIj.exe
  C:\Windows\System\BxindIj.exe
  2⤵
  PID:8004
- C:\Windows\System\QipOHXH.exe
  C:\Windows\System\QipOHXH.exe
  2⤵
  PID:8072
- C:\Windows\System\pAZsOMW.exe
  C:\Windows\System\pAZsOMW.exe
  2⤵
  PID:8144
- C:\Windows\System\wshKNWB.exe
  C:\Windows\System\wshKNWB.exe
  2⤵
  PID:7212
- C:\Windows\System\czSmkOz.exe
  C:\Windows\System\czSmkOz.exe
  2⤵
  PID:7348
- C:\Windows\System\HMdUJgG.exe
  C:\Windows\System\HMdUJgG.exe
  2⤵
  PID:7496
- C:\Windows\System\AMzHkwu.exe
  C:\Windows\System\AMzHkwu.exe
  2⤵
  PID:7644
- C:\Windows\System\ZFduhrL.exe
  C:\Windows\System\ZFduhrL.exe
  2⤵
  PID:7792
- C:\Windows\System\BxrOHtf.exe
  C:\Windows\System\BxrOHtf.exe
  2⤵
  PID:7960
- C:\Windows\System\pHnRrou.exe
  C:\Windows\System\pHnRrou.exe
  2⤵
  PID:8016
- C:\Windows\System\uQKslxS.exe
  C:\Windows\System\uQKslxS.exe
  2⤵
  PID:7316
- C:\Windows\System\MMPoVPU.exe
  C:\Windows\System\MMPoVPU.exe
  2⤵
  PID:7588
- C:\Windows\System\aweWCUL.exe
  C:\Windows\System\aweWCUL.exe
  2⤵
  PID:7928
- C:\Windows\System\rexYdaQ.exe
  C:\Windows\System\rexYdaQ.exe
  2⤵
  PID:7468
- C:\Windows\System\sKuDETV.exe
  C:\Windows\System\sKuDETV.exe
  2⤵
  PID:7184
- C:\Windows\System\SFEKtqI.exe
  C:\Windows\System\SFEKtqI.exe
  2⤵
  PID:8200
- C:\Windows\System\ThNqLnt.exe
  C:\Windows\System\ThNqLnt.exe
  2⤵
  PID:8228
- C:\Windows\System\NoPfsWJ.exe
  C:\Windows\System\NoPfsWJ.exe
  2⤵
  PID:8256
- C:\Windows\System\buWsVHo.exe
  C:\Windows\System\buWsVHo.exe
  2⤵
  PID:8296
- C:\Windows\System\hBOXPEm.exe
  C:\Windows\System\hBOXPEm.exe
  2⤵
  PID:8328
- C:\Windows\System\YMebeWU.exe
  C:\Windows\System\YMebeWU.exe
  2⤵
  PID:8356
- C:\Windows\System\ndeewFg.exe
  C:\Windows\System\ndeewFg.exe
  2⤵
  PID:8384
- C:\Windows\System\JYxfFAp.exe
  C:\Windows\System\JYxfFAp.exe
  2⤵
  PID:8412
- C:\Windows\System\ECOOQLM.exe
  C:\Windows\System\ECOOQLM.exe
  2⤵
  PID:8440
- C:\Windows\System\ffLIXRB.exe
  C:\Windows\System\ffLIXRB.exe
  2⤵
  PID:8468
- C:\Windows\System\ZyKABXe.exe
  C:\Windows\System\ZyKABXe.exe
  2⤵
  PID:8496
- C:\Windows\System\zKZSAAV.exe
  C:\Windows\System\zKZSAAV.exe
  2⤵
  PID:8524
- C:\Windows\System\sccGawY.exe
  C:\Windows\System\sccGawY.exe
  2⤵
  PID:8552
- C:\Windows\System\JzlAhWn.exe
  C:\Windows\System\JzlAhWn.exe
  2⤵
  PID:8580
- C:\Windows\System\JbiIAAV.exe
  C:\Windows\System\JbiIAAV.exe
  2⤵
  PID:8608
- C:\Windows\System\iOjWDCk.exe
  C:\Windows\System\iOjWDCk.exe
  2⤵
  PID:8636
- C:\Windows\System\xWETsnq.exe
  C:\Windows\System\xWETsnq.exe
  2⤵
  PID:8664
- C:\Windows\System\DqcSseA.exe
  C:\Windows\System\DqcSseA.exe
  2⤵
  PID:8692
- C:\Windows\System\GPfMzaV.exe
  C:\Windows\System\GPfMzaV.exe
  2⤵
  PID:8720
- C:\Windows\System\lMgwOHP.exe
  C:\Windows\System\lMgwOHP.exe
  2⤵
  PID:8748
- C:\Windows\System\eHRksCY.exe
  C:\Windows\System\eHRksCY.exe
  2⤵
  PID:8776
- C:\Windows\System\wjZMdUn.exe
  C:\Windows\System\wjZMdUn.exe
  2⤵
  PID:8804
- C:\Windows\System\JgpEqde.exe
  C:\Windows\System\JgpEqde.exe
  2⤵
  PID:8832
- C:\Windows\System\lCQRteb.exe
  C:\Windows\System\lCQRteb.exe
  2⤵
  PID:8860
- C:\Windows\System\dFCdhgB.exe
  C:\Windows\System\dFCdhgB.exe
  2⤵
  PID:8888
- C:\Windows\System\LqPDegi.exe
  C:\Windows\System\LqPDegi.exe
  2⤵
  PID:8916
- C:\Windows\System\DkosNbx.exe
  C:\Windows\System\DkosNbx.exe
  2⤵
  PID:8944
- C:\Windows\System\aLuZIpu.exe
  C:\Windows\System\aLuZIpu.exe
  2⤵
  PID:8972
- C:\Windows\System\TJElxdZ.exe
  C:\Windows\System\TJElxdZ.exe
  2⤵
  PID:9000
- C:\Windows\System\xXBefcS.exe
  C:\Windows\System\xXBefcS.exe
  2⤵
  PID:9028
- C:\Windows\System\lvbstJZ.exe
  C:\Windows\System\lvbstJZ.exe
  2⤵
  PID:9056
- C:\Windows\System\jyiCiUz.exe
  C:\Windows\System\jyiCiUz.exe
  2⤵
  PID:9084
- C:\Windows\System\gUsusGq.exe
  C:\Windows\System\gUsusGq.exe
  2⤵
  PID:9120
- C:\Windows\System\WMtIGFs.exe
  C:\Windows\System\WMtIGFs.exe
  2⤵
  PID:9140
- C:\Windows\System\nNcUzbQ.exe
  C:\Windows\System\nNcUzbQ.exe
  2⤵
  PID:9172
- C:\Windows\System\IcNpmRK.exe
  C:\Windows\System\IcNpmRK.exe
  2⤵
  PID:9200
- C:\Windows\System\EXlWHlO.exe
  C:\Windows\System\EXlWHlO.exe
  2⤵
  PID:8220
- C:\Windows\System\HJguNIg.exe
  C:\Windows\System\HJguNIg.exe
  2⤵
  PID:3372
- C:\Windows\System\OrJEICO.exe
  C:\Windows\System\OrJEICO.exe
  2⤵
  PID:8348
- C:\Windows\System\vPESSRd.exe
  C:\Windows\System\vPESSRd.exe
  2⤵
  PID:8408
- C:\Windows\System\oPeLvbb.exe
  C:\Windows\System\oPeLvbb.exe
  2⤵
  PID:8480
- C:\Windows\System\grzdUgy.exe
  C:\Windows\System\grzdUgy.exe
  2⤵
  PID:8544
- C:\Windows\System\VjArARs.exe
  C:\Windows\System\VjArARs.exe
  2⤵
  PID:8592
- C:\Windows\System\nGKOYfo.exe
  C:\Windows\System\nGKOYfo.exe
  2⤵
  PID:8628
- C:\Windows\System\OHJOIHe.exe
  C:\Windows\System\OHJOIHe.exe
  2⤵
  PID:8676
- C:\Windows\System\ANzmxlm.exe
  C:\Windows\System\ANzmxlm.exe
  2⤵
  PID:8736
- C:\Windows\System\MMaMwyi.exe
  C:\Windows\System\MMaMwyi.exe
  2⤵
  PID:8796
- C:\Windows\System\eMFPyfw.exe
  C:\Windows\System\eMFPyfw.exe
  2⤵
  PID:8880
- C:\Windows\System\GPKEarR.exe
  C:\Windows\System\GPKEarR.exe
  2⤵
  PID:9012
- C:\Windows\System\gleLIGj.exe
  C:\Windows\System\gleLIGj.exe
  2⤵
  PID:9052
- C:\Windows\System\htAVizZ.exe
  C:\Windows\System\htAVizZ.exe
  2⤵
  PID:9108
- C:\Windows\System\OjNgHgZ.exe
  C:\Windows\System\OjNgHgZ.exe
  2⤵
  PID:3192
- C:\Windows\System\ebtaUnb.exe
  C:\Windows\System\ebtaUnb.exe
  2⤵
  PID:4812
- C:\Windows\System\wjDlLQn.exe
  C:\Windows\System\wjDlLQn.exe
  2⤵
  PID:4496
- C:\Windows\System\qAWNvkU.exe
  C:\Windows\System\qAWNvkU.exe
  2⤵
  PID:9164
- C:\Windows\System\vhMkOVV.exe
  C:\Windows\System\vhMkOVV.exe
  2⤵
  PID:9196
- C:\Windows\System\IVwsCRv.exe
  C:\Windows\System\IVwsCRv.exe
  2⤵
  PID:4384
- C:\Windows\System\kVlpDNB.exe
  C:\Windows\System\kVlpDNB.exe
  2⤵
  PID:8452
- C:\Windows\System\LXAzKNH.exe
  C:\Windows\System\LXAzKNH.exe
  2⤵
  PID:8576
- C:\Windows\System\TXPYVuD.exe
  C:\Windows\System\TXPYVuD.exe
  2⤵
  PID:8604
- C:\Windows\System\DJgsILD.exe
  C:\Windows\System\DJgsILD.exe
  2⤵
  PID:8768
- C:\Windows\System\JTLNgOm.exe
  C:\Windows\System\JTLNgOm.exe
  2⤵
  PID:9076
- C:\Windows\System\KieWGXa.exe
  C:\Windows\System\KieWGXa.exe
  2⤵
  PID:1864
- C:\Windows\System\OtVFcQN.exe
  C:\Windows\System\OtVFcQN.exe
  2⤵
  PID:5956
- C:\Windows\System\ImTOrVE.exe
  C:\Windows\System\ImTOrVE.exe
  2⤵
  PID:8648
- C:\Windows\System\VHQGULh.exe
  C:\Windows\System\VHQGULh.exe
  2⤵
  PID:8400
- C:\Windows\System\vmzFblO.exe
  C:\Windows\System\vmzFblO.exe
  2⤵
  PID:8620
- C:\Windows\System\QGAuMAw.exe
  C:\Windows\System\QGAuMAw.exe
  2⤵
  PID:9104
- C:\Windows\System\IheNadP.exe
  C:\Windows\System\IheNadP.exe
  2⤵
  PID:1372
- C:\Windows\System\MZudptL.exe
  C:\Windows\System\MZudptL.exe
  2⤵
  PID:8656
- C:\Windows\System\ucdzjAe.exe
  C:\Windows\System\ucdzjAe.exe
  2⤵
  PID:8272
- C:\Windows\System\xwEwlNt.exe
  C:\Windows\System\xwEwlNt.exe
  2⤵
  PID:5564
- C:\Windows\System\BtOAyBu.exe
  C:\Windows\System\BtOAyBu.exe
  2⤵
  PID:9244
- C:\Windows\System\vafYGwh.exe
  C:\Windows\System\vafYGwh.exe
  2⤵
  PID:9272
- C:\Windows\System\JeFbVgX.exe
  C:\Windows\System\JeFbVgX.exe
  2⤵
  PID:9300
- C:\Windows\System\jQbvNlW.exe
  C:\Windows\System\jQbvNlW.exe
  2⤵
  PID:9328
- C:\Windows\System\fsTqUwU.exe
  C:\Windows\System\fsTqUwU.exe
  2⤵
  PID:9356
- C:\Windows\System\GYyObHE.exe
  C:\Windows\System\GYyObHE.exe
  2⤵
  PID:9384
- C:\Windows\System\pNqOARQ.exe
  C:\Windows\System\pNqOARQ.exe
  2⤵
  PID:9412
- C:\Windows\System\YjTTyeH.exe
  C:\Windows\System\YjTTyeH.exe
  2⤵
  PID:9440
- C:\Windows\System\bFyqeIQ.exe
  C:\Windows\System\bFyqeIQ.exe
  2⤵
  PID:9468
- C:\Windows\System\iwVHtDq.exe
  C:\Windows\System\iwVHtDq.exe
  2⤵
  PID:9496
- C:\Windows\System\MRkYxrq.exe
  C:\Windows\System\MRkYxrq.exe
  2⤵
  PID:9524
- C:\Windows\System\TaBCOed.exe
  C:\Windows\System\TaBCOed.exe
  2⤵
  PID:9552
- C:\Windows\System\lpClUBt.exe
  C:\Windows\System\lpClUBt.exe
  2⤵
  PID:9584
- C:\Windows\System\nEPHMIV.exe
  C:\Windows\System\nEPHMIV.exe
  2⤵
  PID:9612
- C:\Windows\System\FGYJpNd.exe
  C:\Windows\System\FGYJpNd.exe
  2⤵
  PID:9640
- C:\Windows\System\eMPNKNa.exe
  C:\Windows\System\eMPNKNa.exe
  2⤵
  PID:9668
- C:\Windows\System\OYghYfI.exe
  C:\Windows\System\OYghYfI.exe
  2⤵
  PID:9696
- C:\Windows\System\ZCXxhAk.exe
  C:\Windows\System\ZCXxhAk.exe
  2⤵
  PID:9724
- C:\Windows\System\UmFpsSI.exe
  C:\Windows\System\UmFpsSI.exe
  2⤵
  PID:9752
- C:\Windows\System\zDSNFsF.exe
  C:\Windows\System\zDSNFsF.exe
  2⤵
  PID:9780
- C:\Windows\System\NWnkwiA.exe
  C:\Windows\System\NWnkwiA.exe
  2⤵
  PID:9808
- C:\Windows\System\pxdCECv.exe
  C:\Windows\System\pxdCECv.exe
  2⤵
  PID:9836
- C:\Windows\System\jvHNeQT.exe
  C:\Windows\System\jvHNeQT.exe
  2⤵
  PID:9864
- C:\Windows\System\uPOwAFk.exe
  C:\Windows\System\uPOwAFk.exe
  2⤵
  PID:9892
- C:\Windows\System\FLfHLjT.exe
  C:\Windows\System\FLfHLjT.exe
  2⤵
  PID:9920
- C:\Windows\System\QMcpcYr.exe
  C:\Windows\System\QMcpcYr.exe
  2⤵
  PID:9948
- C:\Windows\System\vGOYVnP.exe
  C:\Windows\System\vGOYVnP.exe
  2⤵
  PID:9976
- C:\Windows\System\nnoYwql.exe
  C:\Windows\System\nnoYwql.exe
  2⤵
  PID:10004
- C:\Windows\System\kWiwvRZ.exe
  C:\Windows\System\kWiwvRZ.exe
  2⤵
  PID:10032
- C:\Windows\System\jogEkZo.exe
  C:\Windows\System\jogEkZo.exe
  2⤵
  PID:10060
- C:\Windows\System\hMNhhtK.exe
  C:\Windows\System\hMNhhtK.exe
  2⤵
  PID:10088
- C:\Windows\System\RgWGWsG.exe
  C:\Windows\System\RgWGWsG.exe
  2⤵
  PID:10116
- C:\Windows\System\bZMzPNc.exe
  C:\Windows\System\bZMzPNc.exe
  2⤵
  PID:10144
- C:\Windows\System\PySYTtt.exe
  C:\Windows\System\PySYTtt.exe
  2⤵
  PID:10172
- C:\Windows\System\VNfxMgu.exe
  C:\Windows\System\VNfxMgu.exe
  2⤵
  PID:10200
- C:\Windows\System\GxQTjHS.exe
  C:\Windows\System\GxQTjHS.exe
  2⤵
  PID:10228
- C:\Windows\System\zEreSQj.exe
  C:\Windows\System\zEreSQj.exe
  2⤵
  PID:9284
- C:\Windows\System\mSiWJam.exe
  C:\Windows\System\mSiWJam.exe
  2⤵
  PID:9320
- C:\Windows\System\yPFqHVd.exe
  C:\Windows\System\yPFqHVd.exe
  2⤵
  PID:2532
- C:\Windows\System\woCFWrt.exe
  C:\Windows\System\woCFWrt.exe
  2⤵
  PID:9376
- C:\Windows\System\osUfECP.exe
  C:\Windows\System\osUfECP.exe
  2⤵
  PID:9452
- C:\Windows\System\TlRxmJQ.exe
  C:\Windows\System\TlRxmJQ.exe
  2⤵
  PID:9508
- C:\Windows\System\JOEDDpN.exe
  C:\Windows\System\JOEDDpN.exe
  2⤵
  PID:9576
- C:\Windows\System\aIpHJjP.exe
  C:\Windows\System\aIpHJjP.exe
  2⤵
  PID:9632
- C:\Windows\System\VEYfSWa.exe
  C:\Windows\System\VEYfSWa.exe
  2⤵
  PID:9708
- C:\Windows\System\iiskHSC.exe
  C:\Windows\System\iiskHSC.exe
  2⤵
  PID:9772
- C:\Windows\System\aSynUIi.exe
  C:\Windows\System\aSynUIi.exe
  2⤵
  PID:9832
- C:\Windows\System\XPSPmVt.exe
  C:\Windows\System\XPSPmVt.exe
  2⤵
  PID:9904
- C:\Windows\System\irQioFs.exe
  C:\Windows\System\irQioFs.exe
  2⤵
  PID:9968
- C:\Windows\System\JVUlGjo.exe
  C:\Windows\System\JVUlGjo.exe
  2⤵
  PID:10028
- C:\Windows\System\MXmAGmG.exe
  C:\Windows\System\MXmAGmG.exe
  2⤵
  PID:10100
- C:\Windows\System\zIAQHrr.exe
  C:\Windows\System\zIAQHrr.exe
  2⤵
  PID:10164
- C:\Windows\System\bvilrOP.exe
  C:\Windows\System\bvilrOP.exe
  2⤵
  PID:10224
- C:\Windows\System\bcBfqdW.exe
  C:\Windows\System\bcBfqdW.exe
  2⤵
  PID:9348
- C:\Windows\System\aGZejch.exe
  C:\Windows\System\aGZejch.exe
  2⤵
  PID:9432
- C:\Windows\System\SUGIvhU.exe
  C:\Windows\System\SUGIvhU.exe
  2⤵
  PID:9568
- C:\Windows\System\cCCWnAi.exe
  C:\Windows\System\cCCWnAi.exe
  2⤵
  PID:9736
- C:\Windows\System\PdYPgFa.exe
  C:\Windows\System\PdYPgFa.exe
  2⤵
  PID:9876
- C:\Windows\System\xRmUvFM.exe
  C:\Windows\System\xRmUvFM.exe
  2⤵
  PID:10000
- C:\Windows\System\QwyPBsy.exe
  C:\Windows\System\QwyPBsy.exe
  2⤵
  PID:10128
- C:\Windows\System\gtQwoRg.exe
  C:\Windows\System\gtQwoRg.exe
  2⤵
  PID:9316
- C:\Windows\System\sBGPABr.exe
  C:\Windows\System\sBGPABr.exe
  2⤵
  PID:9636
- C:\Windows\System\VrXsSKL.exe
  C:\Windows\System\VrXsSKL.exe
  2⤵
  PID:9944
- C:\Windows\System\FJdTJBa.exe
  C:\Windows\System\FJdTJBa.exe
  2⤵
  PID:9296
- C:\Windows\System\xWSFwLK.exe
  C:\Windows\System\xWSFwLK.exe
  2⤵
  PID:10080
- C:\Windows\System\AapVvWU.exe
  C:\Windows\System\AapVvWU.exe
  2⤵
  PID:9828
- C:\Windows\System\ZRfVWSO.exe
  C:\Windows\System\ZRfVWSO.exe
  2⤵
  PID:10268
- C:\Windows\System\jBRLwTx.exe
  C:\Windows\System\jBRLwTx.exe
  2⤵
  PID:10296
- C:\Windows\System\npwwhyd.exe
  C:\Windows\System\npwwhyd.exe
  2⤵
  PID:10324
- C:\Windows\System\NPHsVpv.exe
  C:\Windows\System\NPHsVpv.exe
  2⤵
  PID:10352
- C:\Windows\System\NJfqzpI.exe
  C:\Windows\System\NJfqzpI.exe
  2⤵
  PID:10384
- C:\Windows\System\DNmlDtT.exe
  C:\Windows\System\DNmlDtT.exe
  2⤵
  PID:10400
- C:\Windows\System\oTcBRNQ.exe
  C:\Windows\System\oTcBRNQ.exe
  2⤵
  PID:10416
- C:\Windows\System\qPtiBmx.exe
  C:\Windows\System\qPtiBmx.exe
  2⤵
  PID:10432
- C:\Windows\System\ONSpgYa.exe
  C:\Windows\System\ONSpgYa.exe
  2⤵
  PID:10496
- C:\Windows\System\prnnbPZ.exe
  C:\Windows\System\prnnbPZ.exe
  2⤵
  PID:10524
- C:\Windows\System\QYCoUkm.exe
  C:\Windows\System\QYCoUkm.exe
  2⤵
  PID:10552
- C:\Windows\System\RsUaBoE.exe
  C:\Windows\System\RsUaBoE.exe
  2⤵
  PID:10580
- C:\Windows\System\NmVIjEZ.exe
  C:\Windows\System\NmVIjEZ.exe
  2⤵
  PID:10608
- C:\Windows\System\BiNSCPW.exe
  C:\Windows\System\BiNSCPW.exe
  2⤵
  PID:10636
- C:\Windows\System\GGyQFPY.exe
  C:\Windows\System\GGyQFPY.exe
  2⤵
  PID:10664
- C:\Windows\System\YnOJIUL.exe
  C:\Windows\System\YnOJIUL.exe
  2⤵
  PID:10692
- C:\Windows\System\lqPeFyc.exe
  C:\Windows\System\lqPeFyc.exe
  2⤵
  PID:10720
- C:\Windows\System\vSjQfUC.exe
  C:\Windows\System\vSjQfUC.exe
  2⤵
  PID:10748
- C:\Windows\System\DwdEmmY.exe
  C:\Windows\System\DwdEmmY.exe
  2⤵
  PID:10776
- C:\Windows\System\tBsildm.exe
  C:\Windows\System\tBsildm.exe
  2⤵
  PID:10804
- C:\Windows\System\KbRveuq.exe
  C:\Windows\System\KbRveuq.exe
  2⤵
  PID:10832
- C:\Windows\System\atQcBgm.exe
  C:\Windows\System\atQcBgm.exe
  2⤵
  PID:10860
- C:\Windows\System\ZNeqzkC.exe
  C:\Windows\System\ZNeqzkC.exe
  2⤵
  PID:10888
- C:\Windows\System\jyiziqC.exe
  C:\Windows\System\jyiziqC.exe
  2⤵
  PID:10916
- C:\Windows\System\yVkooch.exe
  C:\Windows\System\yVkooch.exe
  2⤵
  PID:10944
- C:\Windows\System\tIonHre.exe
  C:\Windows\System\tIonHre.exe
  2⤵
  PID:10972
- C:\Windows\System\xIZITcI.exe
  C:\Windows\System\xIZITcI.exe
  2⤵
  PID:11000
- C:\Windows\System\aRwNssd.exe
  C:\Windows\System\aRwNssd.exe
  2⤵
  PID:11028
- C:\Windows\System\BabUFyO.exe
  C:\Windows\System\BabUFyO.exe
  2⤵
  PID:11056
- C:\Windows\System\stqbxpz.exe
  C:\Windows\System\stqbxpz.exe
  2⤵
  PID:11084
- C:\Windows\System\NlafMfj.exe
  C:\Windows\System\NlafMfj.exe
  2⤵
  PID:11112
- C:\Windows\System\yuzrkMJ.exe
  C:\Windows\System\yuzrkMJ.exe
  2⤵
  PID:11140
- C:\Windows\System\IFxzOUK.exe
  C:\Windows\System\IFxzOUK.exe
  2⤵
  PID:11168
- C:\Windows\System\BfCbenH.exe
  C:\Windows\System\BfCbenH.exe
  2⤵
  PID:11196
- C:\Windows\System\uBvzDjQ.exe
  C:\Windows\System\uBvzDjQ.exe
  2⤵
  PID:11224
- C:\Windows\System\LVquPRj.exe
  C:\Windows\System\LVquPRj.exe
  2⤵
  PID:11252
- C:\Windows\System\iCmFqCx.exe
  C:\Windows\System\iCmFqCx.exe
  2⤵
  PID:10288
- C:\Windows\System\wkeoEBP.exe
  C:\Windows\System\wkeoEBP.exe
  2⤵
  PID:10344
- C:\Windows\System\oXyebds.exe
  C:\Windows\System\oXyebds.exe
  2⤵
  PID:10368
- C:\Windows\System\jCSVwIV.exe
  C:\Windows\System\jCSVwIV.exe
  2⤵
  PID:10464
- C:\Windows\System\IesxMyH.exe
  C:\Windows\System\IesxMyH.exe
  2⤵
  PID:10516
- C:\Windows\System\RcoWMMq.exe
  C:\Windows\System\RcoWMMq.exe
  2⤵
  PID:10576
- C:\Windows\System\ylYzzzx.exe
  C:\Windows\System\ylYzzzx.exe
  2⤵
  PID:10656
- C:\Windows\System\EPCGNUb.exe
  C:\Windows\System\EPCGNUb.exe
  2⤵
  PID:10716
- C:\Windows\System\foMbTZA.exe
  C:\Windows\System\foMbTZA.exe
  2⤵
  PID:10788
- C:\Windows\System\EanLSQJ.exe
  C:\Windows\System\EanLSQJ.exe
  2⤵
  PID:10852
- C:\Windows\System\EoMAvNQ.exe
  C:\Windows\System\EoMAvNQ.exe
  2⤵
  PID:10912
- C:\Windows\System\XetfgPi.exe
  C:\Windows\System\XetfgPi.exe
  2⤵
  PID:10984
- C:\Windows\System\EZnxncc.exe
  C:\Windows\System\EZnxncc.exe
  2⤵
  PID:11048
- C:\Windows\System\nIxLBed.exe
  C:\Windows\System\nIxLBed.exe
  2⤵
  PID:11108
- C:\Windows\System\YtnxQTX.exe
  C:\Windows\System\YtnxQTX.exe
  2⤵
  PID:11180
- C:\Windows\System\AfPgSQw.exe
  C:\Windows\System\AfPgSQw.exe
  2⤵
  PID:11240
- C:\Windows\System\UHDbuiD.exe
  C:\Windows\System\UHDbuiD.exe
  2⤵
  PID:10320
- C:\Windows\System\OFdkeAg.exe
  C:\Windows\System\OFdkeAg.exe
  2⤵
  PID:10460
- C:\Windows\System\wVOSLga.exe
  C:\Windows\System\wVOSLga.exe
  2⤵
  PID:10624
- C:\Windows\System\HpSbbSz.exe
  C:\Windows\System\HpSbbSz.exe
  2⤵
  PID:10768
- C:\Windows\System\CkymFud.exe
  C:\Windows\System\CkymFud.exe
  2⤵
  PID:10908
- C:\Windows\System\EFHoSet.exe
  C:\Windows\System\EFHoSet.exe
  2⤵
  PID:11080
- C:\Windows\System\yCwVtjQ.exe
  C:\Windows\System\yCwVtjQ.exe
  2⤵
  PID:11220
- C:\Windows\System\yMiEpuG.exe
  C:\Windows\System\yMiEpuG.exe
  2⤵
  PID:10444
- C:\Windows\System\dTmfgOx.exe
  C:\Windows\System\dTmfgOx.exe
  2⤵
  PID:10744
- C:\Windows\System\fvVwvov.exe
  C:\Windows\System\fvVwvov.exe
  2⤵
  PID:11164
- C:\Windows\System\VqafXaV.exe
  C:\Windows\System\VqafXaV.exe
  2⤵
  PID:10828
- C:\Windows\System\eapHcas.exe
  C:\Windows\System\eapHcas.exe
  2⤵
  PID:10396
- C:\Windows\System\DzuXJsa.exe
  C:\Windows\System\DzuXJsa.exe
  2⤵
  PID:11284
- C:\Windows\System\lcDsICz.exe
  C:\Windows\System\lcDsICz.exe
  2⤵
  PID:11312
- C:\Windows\System\ROwwmjm.exe
  C:\Windows\System\ROwwmjm.exe
  2⤵
  PID:11340
- C:\Windows\System\sGRZBAk.exe
  C:\Windows\System\sGRZBAk.exe
  2⤵
  PID:11368
- C:\Windows\System\boTEJMo.exe
  C:\Windows\System\boTEJMo.exe
  2⤵
  PID:11396
- C:\Windows\System\TwXtrLq.exe
  C:\Windows\System\TwXtrLq.exe
  2⤵
  PID:11424
- C:\Windows\System\hnuwQft.exe
  C:\Windows\System\hnuwQft.exe
  2⤵
  PID:11452
- C:\Windows\System\HPDucYs.exe
  C:\Windows\System\HPDucYs.exe
  2⤵
  PID:11480
- C:\Windows\System\HlgRrWX.exe
  C:\Windows\System\HlgRrWX.exe
  2⤵
  PID:11508
- C:\Windows\System\aDtchjc.exe
  C:\Windows\System\aDtchjc.exe
  2⤵
  PID:11536
- C:\Windows\System\FLTQDoL.exe
  C:\Windows\System\FLTQDoL.exe
  2⤵
  PID:11564
- C:\Windows\System\LCZAHBC.exe
  C:\Windows\System\LCZAHBC.exe
  2⤵
  PID:11592
- C:\Windows\System\DacxRlR.exe
  C:\Windows\System\DacxRlR.exe
  2⤵
  PID:11620
- C:\Windows\System\lFBxaHC.exe
  C:\Windows\System\lFBxaHC.exe
  2⤵
  PID:11648
- C:\Windows\System\hugQfrz.exe
  C:\Windows\System\hugQfrz.exe
  2⤵
  PID:11676
- C:\Windows\System\poSuxue.exe
  C:\Windows\System\poSuxue.exe
  2⤵
  PID:11704
- C:\Windows\System\sugPeWC.exe
  C:\Windows\System\sugPeWC.exe
  2⤵
  PID:11732
- C:\Windows\System\CnpDKoc.exe
  C:\Windows\System\CnpDKoc.exe
  2⤵
  PID:11760
- C:\Windows\System\XSFLPlo.exe
  C:\Windows\System\XSFLPlo.exe
  2⤵
  PID:11788
- C:\Windows\System\LokdXBM.exe
  C:\Windows\System\LokdXBM.exe
  2⤵
  PID:11816
- C:\Windows\System\GkuPtuR.exe
  C:\Windows\System\GkuPtuR.exe
  2⤵
  PID:11844
- C:\Windows\System\nEBpZrn.exe
  C:\Windows\System\nEBpZrn.exe
  2⤵
  PID:11872
- C:\Windows\System\kttKESA.exe
  C:\Windows\System\kttKESA.exe
  2⤵
  PID:11900
- C:\Windows\System\nbRPbOZ.exe
  C:\Windows\System\nbRPbOZ.exe
  2⤵
  PID:11928
- C:\Windows\System\JHmEEhV.exe
  C:\Windows\System\JHmEEhV.exe
  2⤵
  PID:11956
- C:\Windows\System\VZgqnFp.exe
  C:\Windows\System\VZgqnFp.exe
  2⤵
  PID:11984
- C:\Windows\System\fQuCpBa.exe
  C:\Windows\System\fQuCpBa.exe
  2⤵
  PID:12012
- C:\Windows\System\kFRTWzJ.exe
  C:\Windows\System\kFRTWzJ.exe
  2⤵
  PID:12040
- C:\Windows\System\iwUEhia.exe
  C:\Windows\System\iwUEhia.exe
  2⤵
  PID:12072
- C:\Windows\System\QbRPzto.exe
  C:\Windows\System\QbRPzto.exe
  2⤵
  PID:12100
- C:\Windows\System\FIMaqbw.exe
  C:\Windows\System\FIMaqbw.exe
  2⤵
  PID:12128
- C:\Windows\System\PeKhElp.exe
  C:\Windows\System\PeKhElp.exe
  2⤵
  PID:12160
- C:\Windows\System\yQoUdZo.exe
  C:\Windows\System\yQoUdZo.exe
  2⤵
  PID:12188
- C:\Windows\System\zAUjvDJ.exe
  C:\Windows\System\zAUjvDJ.exe
  2⤵
  PID:12216
- C:\Windows\System\eqtVutF.exe
  C:\Windows\System\eqtVutF.exe
  2⤵
  PID:12244
- C:\Windows\System\IaalpPQ.exe
  C:\Windows\System\IaalpPQ.exe
  2⤵
  PID:12272
- C:\Windows\System\OHxFgOZ.exe
  C:\Windows\System\OHxFgOZ.exe
  2⤵
  PID:11296
- C:\Windows\System\ghERaqF.exe
  C:\Windows\System\ghERaqF.exe
  2⤵
  PID:11364
- C:\Windows\System\IJwAAmn.exe
  C:\Windows\System\IJwAAmn.exe
  2⤵
  PID:11420
- C:\Windows\System\JMBesFW.exe
  C:\Windows\System\JMBesFW.exe
  2⤵
  PID:11496
- C:\Windows\System\SpwLOVQ.exe
  C:\Windows\System\SpwLOVQ.exe
  2⤵
  PID:11556
- C:\Windows\System\sHkVNtj.exe
  C:\Windows\System\sHkVNtj.exe
  2⤵
  PID:11616
- C:\Windows\System\DiDogzX.exe
  C:\Windows\System\DiDogzX.exe
  2⤵
  PID:11668
- C:\Windows\System\VuLoDHm.exe
  C:\Windows\System\VuLoDHm.exe
  2⤵
  PID:11744
- C:\Windows\System\xuIdyCS.exe
  C:\Windows\System\xuIdyCS.exe
  2⤵
  PID:11808
- C:\Windows\System\fRupJqp.exe
  C:\Windows\System\fRupJqp.exe
  2⤵
  PID:11868
- C:\Windows\System\wQMdnRK.exe
  C:\Windows\System\wQMdnRK.exe
  2⤵
  PID:11952
- C:\Windows\System\CkNnVPp.exe
  C:\Windows\System\CkNnVPp.exe
  2⤵
  PID:12024
- C:\Windows\System\vhldWTL.exe
  C:\Windows\System\vhldWTL.exe
  2⤵
  PID:12092
- C:\Windows\System\CGKOBwB.exe
  C:\Windows\System\CGKOBwB.exe
  2⤵
  PID:12156
- C:\Windows\System\mAamdfQ.exe
  C:\Windows\System\mAamdfQ.exe
  2⤵
  PID:12228
- C:\Windows\System\AeopbId.exe
  C:\Windows\System\AeopbId.exe
  2⤵
  PID:11276
- C:\Windows\System\vQiKxcC.exe
  C:\Windows\System\vQiKxcC.exe
  2⤵
  PID:11416
- C:\Windows\System\wuTfMBo.exe
  C:\Windows\System\wuTfMBo.exe
  2⤵
  PID:11584
- C:\Windows\System\nfBJFQw.exe
  C:\Windows\System\nfBJFQw.exe
  2⤵
  PID:11776
- C:\Windows\System\YxjzFCM.exe
  C:\Windows\System\YxjzFCM.exe
  2⤵
  PID:400
- C:\Windows\System\OVCDccA.exe
  C:\Windows\System\OVCDccA.exe
  2⤵
  PID:11912
- C:\Windows\System\mEBxVQj.exe
  C:\Windows\System\mEBxVQj.exe
  2⤵
  PID:11980
- C:\Windows\System\cMazRcp.exe
  C:\Windows\System\cMazRcp.exe
  2⤵
  PID:12140
- C:\Windows\System\wBvFHzK.exe
  C:\Windows\System\wBvFHzK.exe
  2⤵
  PID:12284
- C:\Windows\System\vkUYwRE.exe
  C:\Windows\System\vkUYwRE.exe
  2⤵
  PID:11660
- C:\Windows\System\RBOOBdc.exe
  C:\Windows\System\RBOOBdc.exe
  2⤵
  PID:11840
- C:\Windows\System\joeUAyV.exe
  C:\Windows\System\joeUAyV.exe
  2⤵
  PID:12088
- C:\Windows\System\hfLLMts.exe
  C:\Windows\System\hfLLMts.exe
  2⤵
  PID:11784
- C:\Windows\System\BHgowvF.exe
  C:\Windows\System\BHgowvF.exe
  2⤵
  PID:11528
- C:\Windows\System\HzifiNa.exe
  C:\Windows\System\HzifiNa.exe
  2⤵
  PID:12292
- C:\Windows\System\bcNqFao.exe
  C:\Windows\System\bcNqFao.exe
  2⤵
  PID:12320
- C:\Windows\System\mHXGznv.exe
  C:\Windows\System\mHXGznv.exe
  2⤵
  PID:12348
- C:\Windows\System\SBFDPdk.exe
  C:\Windows\System\SBFDPdk.exe
  2⤵
  PID:12376
- C:\Windows\System\oXenKPS.exe
  C:\Windows\System\oXenKPS.exe
  2⤵
  PID:12404
- C:\Windows\System\oKpmJOh.exe
  C:\Windows\System\oKpmJOh.exe
  2⤵
  PID:12432
- C:\Windows\System\lffdqcH.exe
  C:\Windows\System\lffdqcH.exe
  2⤵
  PID:12460
- C:\Windows\System\WnaAQdy.exe
  C:\Windows\System\WnaAQdy.exe
  2⤵
  PID:12488
- C:\Windows\System\OVDwgFY.exe
  C:\Windows\System\OVDwgFY.exe
  2⤵
  PID:12520
- C:\Windows\System\XfHuZEb.exe
  C:\Windows\System\XfHuZEb.exe
  2⤵
  PID:12556
- C:\Windows\System\PrraWLr.exe
  C:\Windows\System\PrraWLr.exe
  2⤵
  PID:12576
- C:\Windows\System\qHJDBVS.exe
  C:\Windows\System\qHJDBVS.exe
  2⤵
  PID:12604
- C:\Windows\System\qFrKwKK.exe
  C:\Windows\System\qFrKwKK.exe
  2⤵
  PID:12632
- C:\Windows\System\jpqvJgs.exe
  C:\Windows\System\jpqvJgs.exe
  2⤵
  PID:12660
- C:\Windows\System\uGVQuOV.exe
  C:\Windows\System\uGVQuOV.exe
  2⤵
  PID:12688
- C:\Windows\System\fQeDdzn.exe
  C:\Windows\System\fQeDdzn.exe
  2⤵
  PID:12716
- C:\Windows\System\VqmGzep.exe
  C:\Windows\System\VqmGzep.exe
  2⤵
  PID:12744
- C:\Windows\System\zuuurOF.exe
  C:\Windows\System\zuuurOF.exe
  2⤵
  PID:12772
- C:\Windows\System\dxMcOVo.exe
  C:\Windows\System\dxMcOVo.exe
  2⤵
  PID:12800
- C:\Windows\System\XaYJfdU.exe
  C:\Windows\System\XaYJfdU.exe
  2⤵
  PID:12828
- C:\Windows\System\ZrbhJwV.exe
  C:\Windows\System\ZrbhJwV.exe
  2⤵
  PID:12856
- C:\Windows\System\nLNRixj.exe
  C:\Windows\System\nLNRixj.exe
  2⤵
  PID:12884
- C:\Windows\System\pFzoiSg.exe
  C:\Windows\System\pFzoiSg.exe
  2⤵
  PID:12912
- C:\Windows\System\PrknVLL.exe
  C:\Windows\System\PrknVLL.exe
  2⤵
  PID:12940
- C:\Windows\System\dDkllnq.exe
  C:\Windows\System\dDkllnq.exe
  2⤵
  PID:12968
- C:\Windows\System\mERVLqF.exe
  C:\Windows\System\mERVLqF.exe
  2⤵
  PID:12996
- C:\Windows\System\GshXIuW.exe
  C:\Windows\System\GshXIuW.exe
  2⤵
  PID:13024
- C:\Windows\System\MfOlfgy.exe
  C:\Windows\System\MfOlfgy.exe
  2⤵
  PID:13052
- C:\Windows\System\uqxMZjF.exe
  C:\Windows\System\uqxMZjF.exe
  2⤵
  PID:13080
- C:\Windows\System\BKHZdvI.exe
  C:\Windows\System\BKHZdvI.exe
  2⤵
  PID:13108
- C:\Windows\System\BMDAfBV.exe
  C:\Windows\System\BMDAfBV.exe
  2⤵
  PID:13136
- C:\Windows\System\sSLdNuo.exe
  C:\Windows\System\sSLdNuo.exe
  2⤵
  PID:13164
- C:\Windows\System\EcfLBNe.exe
  C:\Windows\System\EcfLBNe.exe
  2⤵
  PID:13192
- C:\Windows\System\jhihRyO.exe
  C:\Windows\System\jhihRyO.exe
  2⤵
  PID:13220
- C:\Windows\System\jrhQdra.exe
  C:\Windows\System\jrhQdra.exe
  2⤵
  PID:13248
- C:\Windows\System\IHCrNcF.exe
  C:\Windows\System\IHCrNcF.exe
  2⤵
  PID:13272
- C:\Windows\System\emIDzKD.exe
  C:\Windows\System\emIDzKD.exe
  2⤵
  PID:13304
- C:\Windows\System\HpPSNTw.exe
  C:\Windows\System\HpPSNTw.exe
  2⤵
  PID:12340
- C:\Windows\System\gXilsVn.exe
  C:\Windows\System\gXilsVn.exe
  2⤵
  PID:12144
- C:\Windows\System\wWMUuwi.exe
  C:\Windows\System\wWMUuwi.exe
  2⤵
  PID:12456
- C:\Windows\System\iVYDyeH.exe
  C:\Windows\System\iVYDyeH.exe
  2⤵
  PID:12532
- C:\Windows\System\xgsLLmu.exe
  C:\Windows\System\xgsLLmu.exe
  2⤵
  PID:12596
- C:\Windows\System\hhVCvTn.exe
  C:\Windows\System\hhVCvTn.exe
  2⤵
  PID:12652
- C:\Windows\System\tFOQtRc.exe
  C:\Windows\System\tFOQtRc.exe
  2⤵
  PID:12728
- C:\Windows\System\ipnALiF.exe
  C:\Windows\System\ipnALiF.exe
  2⤵
  PID:12792
- C:\Windows\System\sWFxxee.exe
  C:\Windows\System\sWFxxee.exe
  2⤵
  PID:12852
- C:\Windows\System\iOjZJVY.exe
  C:\Windows\System\iOjZJVY.exe
  2⤵
  PID:12924
- C:\Windows\System\VQLdZaR.exe
  C:\Windows\System\VQLdZaR.exe
  2⤵
  PID:12988
- C:\Windows\System\gXAIuUv.exe
  C:\Windows\System\gXAIuUv.exe
  2⤵
  PID:13048
- C:\Windows\System\ervMYZE.exe
  C:\Windows\System\ervMYZE.exe
  2⤵
  PID:13120
- C:\Windows\System\jjqCtwY.exe
  C:\Windows\System\jjqCtwY.exe
  2⤵
  PID:13184
- C:\Windows\System\XyoDPgd.exe
  C:\Windows\System\XyoDPgd.exe
  2⤵
  PID:13244
- C:\Windows\System\PEKzIVc.exe
  C:\Windows\System\PEKzIVc.exe
  2⤵
  PID:12304
- C:\Windows\System\UXBUslF.exe
  C:\Windows\System\UXBUslF.exe
  2⤵
  PID:12448
- C:\Windows\System\SReKilZ.exe
  C:\Windows\System\SReKilZ.exe
  2⤵
  PID:12684
- C:\Windows\System\OsriIQI.exe
  C:\Windows\System\OsriIQI.exe
  2⤵
  PID:13076
- C:\Windows\System\KFSEXrC.exe
  C:\Windows\System\KFSEXrC.exe
  2⤵
  PID:13292
- C:\Windows\System\KImwPUu.exe
  C:\Windows\System\KImwPUu.exe
  2⤵
  PID:12908
- C:\Windows\System\oNpyiNu.exe
  C:\Windows\System\oNpyiNu.exe
  2⤵
  PID:3356
- C:\Windows\System\girBUxR.exe
  C:\Windows\System\girBUxR.exe
  2⤵
  PID:13240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_a4hfl2qu.n3e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4hfl2qu.n3e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ARVhTPF.exe

Path C:\Windows\System\ARVhTPF.exe
Size 3.1MB
SHA256 3b10cd28fd4e9dda53762f98e5d761ba6690bf24e2fc992d968dbe3f083f63eb
MD5 e66a3b85d10db02c8076cb843b4496e6
SHA1 7dfebfbde4374c454ab6b199efd2af7e474a8856
SHA512 02b7301483447178d1389ba1c9d64590a3ab121746b50c748ec98309995d27c5c2c9358281b0ce9bcf3f0a1d5b6ea5a51d7fe6f68c358d629fd50902a5b5ec77
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:7bBeSFkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

BqyHbZP.exe

Path C:\Windows\System\BqyHbZP.exe
Size 3.1MB
SHA256 9b22b998ab7e6b9385a336db98b5277f4863bf6f7d4af994f3890ade644c2245
MD5 9fed3f78e77290780406bd7be19d8a2f
SHA1 879b3606a5a5eaa5e9f5e6a95a1784c4c61a0844
SHA512 f3c606f6abcf32cd0fcc9fc54a8cbb44336ea62ed616f1d7b7ca8a44fe2bb059fdb8a11c7d627367c27e16f958e796215ac4c3a0d162dda929cabcfff7cf7e7d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:7bBeSFkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErkRUbo.exe

Path C:\Windows\System\ErkRUbo.exe
Size 3.1MB
SHA256 241df04abbbcdf923a1856dff7732d1336e7338276af98f0ff1f7354947fa12e
MD5 9d800561429402fc5ac1b9966c2f0b6a
SHA1 c7802758c435c4ff0fcde00dcc1970ec6674942f
SHA512 97947e480e62ede622f631c1074e0c3c9764539e3ccfafd36ac022151cb37d20b80892774a1f961a2e917bd8999c1e52625bc551060139cb35c0d390ea3c230b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqWrntB.exe

Path C:\Windows\System\HqWrntB.exe
Size 3.1MB
SHA256 7898bbb459c28063904d64d5094b76a7b95488741b2928e6669197471f63cecb
MD5 17aed4ecb336aa00ec912338099ef896
SHA1 74d4f652a56d6949c74140e93e98560d274194c2
SHA512 678c0fde43261068031f411c78f86f4c46d861cc07da018dfd501c5a8b9202b369f9b8a0817379328c8af5c522e0772ae02cc17cfaae25a927e7fff4f579601e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HypEywS.exe

Path C:\Windows\System\HypEywS.exe
Size 3.1MB
SHA256 61816bb6a8eee9a1dfe6c29670151f446cba541ba2e7512ecce283db14fdc519
MD5 e71425c5b97614572c4650e0ed09796d
SHA1 fc86d444a2b700fa3cbfd884f0279ea92447aa11
SHA512 655a8d8be0dcbfa6857fdf954050eee93f4faf94e903845b920154c73929b162982d1e94a3f6af0d4a6243572683c366e8a167ced1747cb552a7086c537e779a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:7bBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

KQnvyaO.exe

Path C:\Windows\System\KQnvyaO.exe
Size 3.1MB
SHA256 119ef92f76a4545f8d47a3e732812f903b67109e409c40e9b04f62415a16b505
MD5 8e941165f1e2d137a9eebd5c2d69622e
SHA1 a373bf1f22bf258d6023d5e1919e90c49fd84c3e
SHA512 1b2a37b25e5a347cd5d0f6ff5ee796c2c7aa54ffb6834cb734cf5c30ecc42e3ec386eb44bbf0c013409f38ba7a0b7342ac3a19bef7519389de43239e9f2f76c5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYXhTmy.exe

Path C:\Windows\System\LYXhTmy.exe
Size 3.1MB
SHA256 2f981673e96e3e9ced1b1d20afafca1781accf2bf0e1415bdbdee4ef70a41183
MD5 857752b310142699167454191108ef17
SHA1 bce2bae891ca86060c60a1c27823f3f27770c040
SHA512 7bb575eafdda413c8930851d1105f0c257a22f0fd4248d012f730ce15900599cd43cf3f83cc5007b4f63648135256608e9343fb5f935e4e26c341a441ac932d3
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OUevYel.exe

Path C:\Windows\System\OUevYel.exe
Size 3.1MB
SHA256 9552327b435105ebbf14019dcc2a7163f5f09ef1f7f4851efec0a8dd385cd61a
MD5 5583bf804d5c783fb527111385817a75
SHA1 650bf8e0811be40eb0b761e5c54efed2e9de9c5b
SHA512 3027f70f093623ac082f08c11649a50ba817be796d9c6d8415e52a9de9e6545fe46433b1b9b9cc6697c66c24a1f2ec6184c870d9891d328062c50032b4214fca
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

PmItEyT.exe

Path C:\Windows\System\PmItEyT.exe
Size 3.1MB
SHA256 06d7a9bf3e80dbb8f6e22ddf41c5e059d2e8ad273cf3e22d40c2bc831516977e
MD5 49ac807adcd83dcc70db6f030cb346bb
SHA1 caca0ecd9c08a5431325533dff97945cb9c4e754
SHA512 c4f8bb0e7e188d179788bb496ebcffc1bf767d57fe2a41262cf8893f21b827a5d37dbd2240160e7c256ef28e2d9c96afd630bcb0f0f832bc7eebef991a034299
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:7bBeSFk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SXcmvRU.exe

Path C:\Windows\System\SXcmvRU.exe
Size 3.1MB
SHA256 45921994aaefbf094e2fa9f0d7e8d4d39766011cdd22fd694a59a5d629d6ae14
MD5 5bc8b4f95916d5cf43f40dc3cd379899
SHA1 f495c8c16751f87ca5800aa39eabfada3649828d
SHA512 e47e10156f7bedf93011efdca81b025a81b70695bb6f29ea4ff7b0b3d54022d075ff3d7d1ed71e6bfbc84e38abb4837717e0a3421afad63650692f6ccd8e842a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

UOsCHWq.exe

Path C:\Windows\System\UOsCHWq.exe
Size 3.1MB
SHA256 16bd1474d9e7a0fb466a1d2ae80f13d8025dda435f7c6790a82b15f33e1a4696
MD5 305d8c3946ecffd3efcc3272971b4e3d
SHA1 48fc856fe7ea3a2f1e0b0b397ac49132343be9a6
SHA512 67fb35c6ae5f82647ee00226c04f652b64fb3fae2090689048f0333c51b3d04af1768234908a09369cc2484c6e3a78d314f343e37c8e893e3a958f85e87e6b58
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

WEMuUez.exe

Path C:\Windows\System\WEMuUez.exe
Size 3.1MB
SHA256 c114cb3ddad1156f2a9cbf9d9aa92dfc79ac9f96cb0e82fe3a9ef3d921f9138b
MD5 e647972379aee3e0bb362ef983c17548
SHA1 40f8bd139fa01e0f74343e19f4797e5536613d46
SHA512 18a0b2263be29c051b0194397f3bee5ea242524cfb4d39caa10374bc9fe25df4aaa396164b03ecb8a77e8aaee1da86e802ac3e5d31702f4301e481e8646f7d6e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

XbPqoiz.exe

Path C:\Windows\System\XbPqoiz.exe
Size 3.1MB
SHA256 82b5463e1d499e5bdc5d6ac5a162fe0d2feba9ead6821de051e49c87bab34549
MD5 d7dc2ebe7fb1952fe7d4f06d35a7117b
SHA1 0822a9d5b32aab769b473b966709cb91da93cc00
SHA512 526e0cd604db02b6179924e126980c5cc816472a7b38d332821c47322180c7db73b32fe24dec60db9ea38bc4ab29771dc7142fc730a6cbb2b248f77a5bf00306
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

YjMtENW.exe

Path C:\Windows\System\YjMtENW.exe
Size 3.1MB
SHA256 02ea31aedfcffdf5f2882d195c20397862c6e07fdd7da69556f41ca23488a452
MD5 d85ff0d9963172670e59a11aa283ed9a
SHA1 b8bb8759bb73e072a55e60f09d19ffd99e771cfb
SHA512 3f83ce113601b51cf076c337073c668c70b0e04c9f53c8e98e96c75fa415f47e9bd6fdf96b87039788251e51e724bb604b329f19fadfdd49125ff5efc009e746
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmZmvMH.exe

Path C:\Windows\System\bmZmvMH.exe
Size 3.1MB
SHA256 0f1cb1fd810fc68e4ed01f378bf4320df38237d7331599923277f83bd04f1e14
MD5 be5d62c622596a0c34b0ca86c469d85e
SHA1 ed76c5fd8ecf7215cfa75214fba08365749c1691
SHA512 099ac50bb1bb5dc42bb54883725ac750c3a460463074d1dc7d8dac4b2512aea65cda86f9389749dd043073fc37f964f74bd9b16d3fa459ca52aac5fb381aeb50
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWK:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dmrdDMV.exe

Path C:\Windows\System\dmrdDMV.exe
Size 3.1MB
SHA256 51216c530eb4e81449f585a025b47e2472fbcdb47fed278e551c8a9da49a9f99
MD5 46d45e7485153bbbfcae6a9471cef9de
SHA1 58092e1c70f311e015aef2f60e811f94ba3b1a33
SHA512 def5057ad271e4e09c930ca9bdc8801af3d32b5d4834f6b4bc047f7e1d134351bee0e2f397c2f8489a694187a8b3e6fc7fc997e871d1ba61d719fa0691003353
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:7bBeSFk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnukPFr.exe

Path C:\Windows\System\dnukPFr.exe
Size 3.1MB
SHA256 5112f15660283ce07b3cb7a32f6c8daf78fd7e23197ded62af3edbdfe002595a
MD5 ed922387526d539fd7a2861aa94632b6
SHA1 cdc84d44b18e004766425f5f357d1d23280e6b6a
SHA512 4944c8fe07fb3ecb24fcde1c7528cadf6a715b4f7a25340e4142e72388a454914e0db86b00eb0084de6158d5d97a6068ba9f9cef7da67349af1652cf4f236825
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

fXujLXH.exe

Path C:\Windows\System\fXujLXH.exe
Size 3.1MB
SHA256 ef468b69ea95bc2f77b8ffe425d8b99a40941735a50f3ee15a7ae34f205838f2
MD5 3312dbbdc0370ea22fff491ffba36209
SHA1 ff3142c6554bb8354638732a0e35779b445d59e8
SHA512 68d8781dae8e933c2f31e1a50b114ba869c9ffcc0d16e0f906c1467cc4f6ea692c3adf660a2418bd2bc14fcab9a6bf4e7ffb4e169c4d0478bd7e175eda827127
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW9:7bBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

gnidRGO.exe

Path C:\Windows\System\gnidRGO.exe
Size 3.1MB
SHA256 e8a767652aac587d06ef783299397df0a84680e2537f2449f740bfb7e8450b6b
MD5 59c4607fb7013ce72121d54b2995f5bf
SHA1 977f215a4f9018b6b24f8584b3c5cda0dcf04503
SHA512 3d9ab6984adfa897ad4e88ea3b9d6b73ac05ba597668f79267118678bf9821c34c20adee73596da123b4c76ca37ef49b2f4b669ef42f3d6e8882df9570044a8e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:7bBeSFks
MD5 SHA1 SHA512 SSDEEP

Submit Download

lvLiWux.exe

Path C:\Windows\System\lvLiWux.exe
Size 3.1MB
SHA256 8bc70dba9a4eadead416080d90513e6de1e33ec267ddf72097ef83f398e2df69
MD5 0b01a9a7ece1b12ad0255e4e586d8028
SHA1 618572de8daccbe79754a6bec37fad0b9eb512d4
SHA512 73188d7023c2be81ff19976466f00c954f514c85baa0ae826dae28bf88fc2d9ae7c8fbdd7c28d22a90d929971850bd37082d1f5e15f06a98a0e4c20010691df4
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWn:7bBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

mDPDYKq.exe

Path C:\Windows\System\mDPDYKq.exe
Size 3.1MB
SHA256 4b207a0467ef3acd7b2a5f5c36da0167fab90579a474ff66d5ad310e0e87a8c8
MD5 517d4ecab9039e532fe949d8d67e71fc
SHA1 fbc1a5895afb50e6098ced0dc0a227984667722b
SHA512 2b18a23b3c4ee58c056766c963eddbb1a6e924883f806e001d3304c5eee04e8f2305baa4b9609e8fa077c6cb8057845fdb248c0d725aa8f755d0ca09ca2744ff
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

nAetehb.exe

Path C:\Windows\System\nAetehb.exe
Size 3.1MB
SHA256 de4a4a8b8edd339db4966ad45c3dd66b79d83a613a709a4fc12880f1b304b5e4
MD5 6d9177f41917dc52e91cae8c3a36a774
SHA1 2d446d661202badcb87737c1ac7c167a738a84d8
SHA512 72673118313e26dbc68e179ab0dda72b5ac870c65236fda3f342218b11af943bc12bb16bbfa399ee34a621b21f12268790e4c4892007cd8407f22bf0c54dc0fc
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

nFiXhvk.exe

Path C:\Windows\System\nFiXhvk.exe
Size 3.1MB
SHA256 391c72377b13117d0158368c5e154dd107458b9f31ff888b7096e9023609aa76
MD5 886eb8178b43e2ba2ca46a917f6bdcaa
SHA1 68a13616910e4d8fce0e9d489c83b9fb02ebb544
SHA512 a1e84c64af02037b4bd13c1b2cd9d575f7f8be523c2b86bee24a7e9210c382b61da597b09cadcc829fd30187b392c0162dd2dbcf04790c843fe05502ed01069c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:7bBeSFkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

oAhWNLK.exe

Path C:\Windows\System\oAhWNLK.exe
Size 3.1MB
SHA256 d4dc932a86763b73de69343ab566e37aaf7f45d0594ad0ddc29f189327a06c1f
MD5 af9d48007d03eb2b73d5e94592138965
SHA1 c88e9326bc82b2f12d78ff77db3c7f4690ad5c22
SHA512 4fecc5fe8969c9668f3fe83cc64ec63d98131ef6e53166c3ee7e0faa0fb66b700006f7fd89b3893b1baa051c73d93ea80ad95414ea9e1737be645c3a3b0dfe2a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW5:7bBeSFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

qdwLNrh.exe

Path C:\Windows\System\qdwLNrh.exe
Size 3.1MB
SHA256 1be4ae9dedade23a8195997832adcf25b7ba1b1f825ad6b35d9481d0c817b271
MD5 ea1daf4e76c54c36d195558f1aa2c064
SHA1 2b580637b159de4e7959055f9dbf33235477326a
SHA512 f45d8aebedf5c24e5a92a5b1079993b706ba6d778e6962518b0f6aab5e413a84d1c2e6264750e4730c017e3ea4641ca40a4fef607236ca5b122da1e240f8c156
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

sYUwWjg.exe

Path C:\Windows\System\sYUwWjg.exe
Size 3.1MB
SHA256 5a55b2c62020dbff386c2873ebc8a2a27d53fb077cec85e98d7e85e621c8df9c
MD5 840e619f132ec78a80a3b0f2bac1b7ee
SHA1 bca28ff6cfefb5a91c7e67a35cb223d887bd5e72
SHA512 5e79d8e9865701bd852cf9fdf7bf74ebb1a1b81f9337925ba8cbcb9fb9095277aa5a38691dac55e70f7f2e979b7c92ec960dd9cef092fb7e7478f0b5666d63f7
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:7bBeSFkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

thOgqhM.exe

Path C:\Windows\System\thOgqhM.exe
Size 3.1MB
SHA256 98eb94af49b8326086d3959ca1a243d7c2719bc013c69fd866365c5eb93ab2be
MD5 761a738486ad8c3d637abb6a98046742
SHA1 060d469343ed0e2494f907578ede1cb62d79681f
SHA512 0c7676dc608649cc5e488486a2a3571770ad7e73d728758d376379e573464276018a9e7b188bc22c28a061f52f638fd3321a977db048841a87cdddd2014246ee
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

uAwmGQY.exe

Path C:\Windows\System\uAwmGQY.exe
Size 3.1MB
SHA256 77d4d72247d1ebd0805574711d06395b36019152a969df5b2eb4bf2dc560406d
MD5 94ea81b5cd5a68f6565cd03acf3f48ae
SHA1 5e269fe8dc6b87e7375474da115e0d1e2949f930
SHA512 d24e97ccfcdd53bd68d35d2d613c5b0fbae5fef76a4ca2b128a3843dc87cfa20f5e4603ebaa9b49ffe00316a84c70f8b1ffcf8ef150a4392e70564dd942e4685
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

uiPPDnf.exe

Path C:\Windows\System\uiPPDnf.exe
Size 3.1MB
SHA256 6d7a17c9ed05877c825ea313926456622ac523c62a52a65754cf6decf5ae07b9
MD5 42f0b4bfe804d50a423bd3b9cb9036ac
SHA1 7674b959ccf50c8772531ffdfdf1f75f290cbb7c
SHA512 26dd443da8ab8be0a1ad5a15d78b3923beb4b682a9e5d01b3442ada77a6ef431cac408d0723d6ea0c735e3f5cc7046ac571dcc359cf234f7d22f53f7169a7071
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

vCKvoXl.exe

Path C:\Windows\System\vCKvoXl.exe
Size 3.1MB
SHA256 9333b575a5703ea7ea5c0b26f4b94440f5aeb3a8a13f83614a0cefe7905606a8
MD5 a8f6de1e9b9af46678ef27a0c2c83930
SHA1 ff9461020c496d8f112d05adbeea5ed614269ea4
SHA512 b0adf010a356cedf56437ed48365d817a04c08ab92485504576d2cbb0796614c17ccd4587f5b1cbe262a20846305594b635d6f9da6791a4d5c7a172d404a4db1
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wKTLUim.exe

Path C:\Windows\System\wKTLUim.exe
Size 3.1MB
SHA256 2a2b8463c832909933a215cce7164c38c02f2cdf36350026de92426cac1dd468
MD5 59530c487a6023361a93e1189b7d0b63
SHA1 e872bd01521ba82ff500aaee790156558a9a4eb5
SHA512 8e193916f9c57d38c1f7a2981550af9efa1cb9c8966d4cbcef1ce2ce13836b942a6fd04bb3f5289daeffb35da45fcf91f052c2a5e6a0f5ce5764325ba4242a94
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

yBGpwuM.exe

Path C:\Windows\System\yBGpwuM.exe
Size 3.1MB
SHA256 518dac8aa4b1758d09b21dc0548486552e0ffba0c438583e1e65ff006719ca6a
MD5 546658c173340ebc73c5c2d175adf264
SHA1 07ba35d2703eb48788da594205f2366bbe5827c9
SHA512 0446a5b4495b24c655e99b9d7fdc5f45bae78e641d9981d634dae8fb503ed1a1a688df0a8bfff381f4210840aa904122aa6a49d6177ec471d3749f10309bc061
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:7bBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

zSsHzvQ.exe

Path C:\Windows\System\zSsHzvQ.exe
Size 3.1MB
SHA256 28e84f52930bcfce00afcd3a17068f23fb8031d5abe45185078fa92c5a8d7996
MD5 4b7e0902ea0b29cdfae6c35b8f73ad19
SHA1 ab7c900511cd2150b9bee32316b41da83a0a065a
SHA512 84f271694b48302a19579c05136cd1780d877da14ea68c14d0fa6c4e04c8993dc90a2497f7cd5547c40f7cd3552d4ae74e702756e22cb140d01933377c006e27
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWC:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-1-0x000002C647940000-0x000002C647950000-memory.dmp

Download

memory/324-1280-0x00007FF704860000-0x00007FF704C56000-memory.dmp

Download

memory/324-0-0x00007FF704860000-0x00007FF704C56000-memory.dmp

Download

memory/376-86-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp

Download

memory/376-3040-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp

Download

memory/380-108-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp

Download

memory/380-3042-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp

Download

memory/536-3044-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp

Download

memory/536-131-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp

Download

memory/1068-81-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp

Download

memory/1068-3041-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp

Download

memory/1312-3033-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp

Download

memory/1312-64-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp

Download

memory/1584-3043-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp

Download

memory/1584-107-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp

Download

memory/1584-1889-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp

Download

memory/1736-85-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp

Download

memory/1736-3034-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp

Download

memory/1784-142-0x00007FF773880000-0x00007FF773C76000-memory.dmp

Download

memory/1784-3048-0x00007FF773880000-0x00007FF773C76000-memory.dmp

Download

memory/1888-185-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp

Download

memory/1888-3053-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp

Download

memory/2120-3032-0x00007FF757000000-0x00007FF7573F6000-memory.dmp

Download

memory/2120-84-0x00007FF757000000-0x00007FF7573F6000-memory.dmp

Download

memory/2172-3035-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp

Download

memory/2172-75-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp

Download

memory/2452-3037-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp

Download

memory/2452-77-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp

Download

memory/2704-106-0x00000124FCB50000-0x00000124FD2F6000-memory.dmp

Download

memory/2704-28-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Download

memory/2704-5-0x00007FFCEE8A3000-0x00007FFCEE8A5000-memory.dmp

Download

memory/2704-1285-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Download

memory/2704-19-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Download

memory/2704-1583-0x00007FFCEE8A3000-0x00007FFCEE8A5000-memory.dmp

Download

memory/2704-42-0x00000124E1C00000-0x00000124E1C22000-memory.dmp

Download

memory/2756-140-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp

Download

memory/2756-3046-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp

Download

memory/2768-3030-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp

Download

memory/2768-50-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp

Download

memory/3048-3036-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp

Download

memory/3048-82-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp

Download

memory/3152-175-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp

Download

memory/3152-3052-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp

Download

memory/3648-87-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp

Download

memory/3648-3038-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp

Download

memory/3844-3029-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp

Download

memory/3844-83-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp

Download

memory/3920-149-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp

Download

memory/3920-3051-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp

Download

memory/3976-122-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Download

memory/3976-1892-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Download

memory/3976-3045-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Download

memory/4036-3031-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp

Download

memory/4036-56-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp

Download

memory/4108-3049-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp

Download

memory/4108-134-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp

Download

memory/4980-143-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp

Download

memory/4980-3047-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp

Download

memory/5084-145-0x00007FF787820000-0x00007FF787C16000-memory.dmp

Download

memory/5084-3050-0x00007FF787820000-0x00007FF787C16000-memory.dmp

Download