xmrig | 84e6aa128fcc65f117ce1255028e276c388061c672d0503a51ce3df5971bc344

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
Size 2.8MB
Sample240518-28vgnadf56
SHA256 84e6aa128fcc65f117ce1255028e276c388061c672d0503a51ce3df5971bc344
MD5 200077e64f5c5f21f7c65903796af4a0
SHA1 7378144cfa8ae731e0b6d898721f0c186fed8306
SHA512 5f3a435aa0ae9c5d2d0f4ce6c3e4bf62af134daa5de7e4a8c0896436749ad133e5cf693cb11e69cb490fbb3e66fd0c02099d15f685f1f4af96cd4782234fed3a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggH8:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1076-0-0x00007FF75AD50000-0x00007FF75B0A4000-memory.dmp	xmrig
behavioral2/files/0x000900000002347e-5.dat	xmrig
behavioral2/files/0x000700000002348e-13.dat	xmrig
behavioral2/files/0x000700000002348d-17.dat	xmrig
behavioral2/memory/4548-16-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp	xmrig
behavioral2/memory/2592-14-0x00007FF71FD30000-0x00007FF720084000-memory.dmp	xmrig
behavioral2/memory/5100-6-0x00007FF70D250000-0x00007FF70D5A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002348f-22.dat	xmrig
behavioral2/memory/2060-26-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp	xmrig
behavioral2/files/0x0007000000023490-29.dat	xmrig
behavioral2/memory/3728-30-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023486-34.dat	xmrig
behavioral2/memory/4184-41-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023494-47.dat	xmrig
behavioral2/files/0x0007000000023493-52.dat	xmrig
behavioral2/memory/1332-54-0x00007FF716860000-0x00007FF716BB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023495-59.dat	xmrig
behavioral2/memory/2804-58-0x00007FF7829E0000-0x00007FF782D34000-memory.dmp	xmrig
behavioral2/memory/4812-60-0x00007FF667040000-0x00007FF667394000-memory.dmp	xmrig
behavioral2/files/0x0007000000023496-69.dat	xmrig
behavioral2/files/0x0007000000023498-79.dat	xmrig
behavioral2/files/0x0007000000023499-84.dat	xmrig
behavioral2/memory/1076-89-0x00007FF75AD50000-0x00007FF75B0A4000-memory.dmp	xmrig
behavioral2/memory/2096-104-0x00007FF6CA0A0000-0x00007FF6CA3F4000-memory.dmp	xmrig
behavioral2/memory/2560-107-0x00007FF699910000-0x00007FF699C64000-memory.dmp	xmrig
behavioral2/memory/2856-115-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp	xmrig
behavioral2/memory/4964-120-0x00007FF7AF0E0000-0x00007FF7AF434000-memory.dmp	xmrig
behavioral2/memory/4548-132-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a2-141.dat	xmrig
behavioral2/memory/464-148-0x00007FF7B4D10000-0x00007FF7B5064000-memory.dmp	xmrig
behavioral2/memory/780-162-0x00007FF73DB90000-0x00007FF73DEE4000-memory.dmp	xmrig
behavioral2/memory/1036-174-0x00007FF664880000-0x00007FF664BD4000-memory.dmp	xmrig
behavioral2/files/0x00070000000234ac-201.dat	xmrig
behavioral2/files/0x00070000000234aa-199.dat	xmrig
behavioral2/files/0x00070000000234ab-196.dat	xmrig
behavioral2/files/0x00070000000234a9-194.dat	xmrig
behavioral2/memory/4812-193-0x00007FF667040000-0x00007FF667394000-memory.dmp	xmrig
behavioral2/memory/4956-192-0x00007FF61B740000-0x00007FF61BA94000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a8-187.dat	xmrig
behavioral2/files/0x00070000000234a7-182.dat	xmrig
behavioral2/memory/2916-1106-0x00007FF742470000-0x00007FF7427C4000-memory.dmp	xmrig
behavioral2/memory/2856-1105-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp	xmrig
behavioral2/memory/2600-181-0x00007FF6302D0000-0x00007FF630624000-memory.dmp	xmrig
behavioral2/memory/432-180-0x00007FF617D20000-0x00007FF618074000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a6-175.dat	xmrig
behavioral2/files/0x00070000000234a5-169.dat	xmrig
behavioral2/memory/3972-168-0x00007FF76A5E0000-0x00007FF76A934000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a4-163.dat	xmrig
behavioral2/files/0x00070000000234a3-157.dat	xmrig
behavioral2/memory/2880-156-0x00007FF654260000-0x00007FF6545B4000-memory.dmp	xmrig
behavioral2/memory/4184-155-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp	xmrig
behavioral2/memory/3728-154-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp	xmrig
behavioral2/memory/2060-144-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a1-139.dat	xmrig
behavioral2/memory/3148-138-0x00007FF712B70000-0x00007FF712EC4000-memory.dmp	xmrig
behavioral2/memory/1616-137-0x00007FF6014A0000-0x00007FF6017F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a0-133.dat	xmrig
behavioral2/files/0x000700000002349f-130.dat	xmrig
behavioral2/memory/2008-128-0x00007FF777320000-0x00007FF777674000-memory.dmp	xmrig
behavioral2/files/0x000700000002349d-123.dat	xmrig
behavioral2/files/0x000700000002349e-121.dat	xmrig
behavioral2/memory/2916-116-0x00007FF742470000-0x00007FF7427C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002349c-111.dat	xmrig
behavioral2/memory/2592-109-0x00007FF71FD30000-0x00007FF720084000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5100	LhTvyWz.exe
2592	kESIRKy.exe
4548	xvJeGCC.exe
2060	efdsHQW.exe
3728	QMoniDy.exe
4184	klsVnew.exe
1036	gmUAIDw.exe
1332	sYRlAYg.exe
2804	SCixIsG.exe
4812	xovyYna.exe
2136	WHghnRj.exe
2288	bZQkXEL.exe
1428	HUkjrhv.exe
3372	NlLhBnH.exe
2096	OWQcnSz.exe
2560	MOCucvt.exe
2856	JaWdlES.exe
2916	hLGlFBf.exe
4964	pEZhBlP.exe
2008	ChZsura.exe
1616	pvmliuw.exe
3148	mFCocvw.exe
464	vDeMNBN.exe
2880	urWWEDW.exe
780	rsWKsuT.exe
3972	MMaeqcT.exe
432	BdNDPUj.exe
2600	JbyFpUl.exe
4956	MTzbGJn.exe
4468	yGgEAtv.exe
3552	EyqKaWs.exe
5056	TiJvCGc.exe
2516	znrIvns.exe
3296	qcJBfeU.exe
2616	oyNlndc.exe
2404	MTRbPrw.exe
4376	iinupbt.exe
1552	TgArjxI.exe
2468	ipgjZFW.exe
3628	KLvxrKq.exe
684	KFxnDdn.exe
2192	FgzMjcG.exe
4888	iTcxOrD.exe
1240	RklTsoN.exe
392	JFJDeUI.exe
1032	DiYlOPW.exe
1536	yYVhjCz.exe
1488	yjZgWBA.exe
3548	icJZxzf.exe
668	eutqSnu.exe
1068	waWlhKR.exe
1996	YXVTRhV.exe
2796	BiplXgz.exe
5092	JoARrkX.exe
3888	mISJakU.exe
1608	fwAGWOV.exe
4920	dTuHoOD.exe
4360	dvocCzj.exe
1500	LMkjeXC.exe
4884	lvpoADV.exe
3348	JqFvjZi.exe
1324	gWRCxer.exe
5132	wXmvxkN.exe
5160	jHAVSSl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1076-0-0x00007FF75AD50000-0x00007FF75B0A4000-memory.dmp	upx
behavioral2/files/0x000900000002347e-5.dat	upx
behavioral2/files/0x000700000002348e-13.dat	upx
behavioral2/files/0x000700000002348d-17.dat	upx
behavioral2/memory/4548-16-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp	upx
behavioral2/memory/2592-14-0x00007FF71FD30000-0x00007FF720084000-memory.dmp	upx
behavioral2/memory/5100-6-0x00007FF70D250000-0x00007FF70D5A4000-memory.dmp	upx
behavioral2/files/0x000700000002348f-22.dat	upx
behavioral2/memory/2060-26-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp	upx
behavioral2/files/0x0007000000023490-29.dat	upx
behavioral2/memory/3728-30-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp	upx
behavioral2/files/0x0009000000023486-34.dat	upx
behavioral2/memory/4184-41-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp	upx
behavioral2/files/0x0007000000023494-47.dat	upx
behavioral2/files/0x0007000000023493-52.dat	upx
behavioral2/memory/1332-54-0x00007FF716860000-0x00007FF716BB4000-memory.dmp	upx
behavioral2/files/0x0007000000023495-59.dat	upx
behavioral2/memory/2804-58-0x00007FF7829E0000-0x00007FF782D34000-memory.dmp	upx
behavioral2/memory/4812-60-0x00007FF667040000-0x00007FF667394000-memory.dmp	upx
behavioral2/files/0x0007000000023496-69.dat	upx
behavioral2/files/0x0007000000023498-79.dat	upx
behavioral2/files/0x0007000000023499-84.dat	upx
behavioral2/memory/1076-89-0x00007FF75AD50000-0x00007FF75B0A4000-memory.dmp	upx
behavioral2/memory/2096-104-0x00007FF6CA0A0000-0x00007FF6CA3F4000-memory.dmp	upx
behavioral2/memory/2560-107-0x00007FF699910000-0x00007FF699C64000-memory.dmp	upx
behavioral2/memory/2856-115-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp	upx
behavioral2/memory/4964-120-0x00007FF7AF0E0000-0x00007FF7AF434000-memory.dmp	upx
behavioral2/memory/4548-132-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp	upx
behavioral2/files/0x00070000000234a2-141.dat	upx
behavioral2/memory/464-148-0x00007FF7B4D10000-0x00007FF7B5064000-memory.dmp	upx
behavioral2/memory/780-162-0x00007FF73DB90000-0x00007FF73DEE4000-memory.dmp	upx
behavioral2/memory/1036-174-0x00007FF664880000-0x00007FF664BD4000-memory.dmp	upx
behavioral2/files/0x00070000000234ac-201.dat	upx
behavioral2/files/0x00070000000234aa-199.dat	upx
behavioral2/files/0x00070000000234ab-196.dat	upx
behavioral2/files/0x00070000000234a9-194.dat	upx
behavioral2/memory/4812-193-0x00007FF667040000-0x00007FF667394000-memory.dmp	upx
behavioral2/memory/4956-192-0x00007FF61B740000-0x00007FF61BA94000-memory.dmp	upx
behavioral2/files/0x00070000000234a8-187.dat	upx
behavioral2/files/0x00070000000234a7-182.dat	upx
behavioral2/memory/2916-1106-0x00007FF742470000-0x00007FF7427C4000-memory.dmp	upx
behavioral2/memory/2856-1105-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp	upx
behavioral2/memory/2600-181-0x00007FF6302D0000-0x00007FF630624000-memory.dmp	upx
behavioral2/memory/432-180-0x00007FF617D20000-0x00007FF618074000-memory.dmp	upx
behavioral2/files/0x00070000000234a6-175.dat	upx
behavioral2/files/0x00070000000234a5-169.dat	upx
behavioral2/memory/3972-168-0x00007FF76A5E0000-0x00007FF76A934000-memory.dmp	upx
behavioral2/files/0x00070000000234a4-163.dat	upx
behavioral2/files/0x00070000000234a3-157.dat	upx
behavioral2/memory/2880-156-0x00007FF654260000-0x00007FF6545B4000-memory.dmp	upx
behavioral2/memory/4184-155-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp	upx
behavioral2/memory/3728-154-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp	upx
behavioral2/memory/2060-144-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp	upx
behavioral2/files/0x00070000000234a1-139.dat	upx
behavioral2/memory/3148-138-0x00007FF712B70000-0x00007FF712EC4000-memory.dmp	upx
behavioral2/memory/1616-137-0x00007FF6014A0000-0x00007FF6017F4000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-133.dat	upx
behavioral2/files/0x000700000002349f-130.dat	upx
behavioral2/memory/2008-128-0x00007FF777320000-0x00007FF777674000-memory.dmp	upx
behavioral2/files/0x000700000002349d-123.dat	upx
behavioral2/files/0x000700000002349e-121.dat	upx
behavioral2/memory/2916-116-0x00007FF742470000-0x00007FF7427C4000-memory.dmp	upx
behavioral2/files/0x000700000002349c-111.dat	upx
behavioral2/memory/2592-109-0x00007FF71FD30000-0x00007FF720084000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fnuDWHu.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\PQyYSlc.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\uokeFey.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\AvFJfgg.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\PIcLrLN.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\xaFYcsc.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\RKpYdpw.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\KOkNCqP.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\HnYrOpP.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\SjewLhd.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\obyDDLc.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\TPxUHxi.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\dCFfXgZ.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\IMcaQUy.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\VRlTZkx.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\aOwCCjM.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\bZKLqBk.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZlpXpBZ.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\oIZpfqd.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\tFxibuW.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\avlstDK.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\YzRKBJT.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\wzdMKBX.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\laFHYNf.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\shgZQZh.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\oUkxpqn.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\Mjizjdk.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\GgebzPm.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\mxKiWfj.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\bHlmfNO.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\cVFHkEv.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\XslivPe.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\kykHkkx.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\yrVtGmV.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\TuOFYpE.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\bIrcGeW.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\ywqwHhx.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\AyDGNSZ.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\dZOBoxk.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\MTRbPrw.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\QGEftnG.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\OPGECsj.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\HUyoisg.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\nWJdyWv.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\OyCGHwB.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\oUTasTD.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\QICMWOl.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\rNdVFkF.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\gblDjmr.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\UrEmefR.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\pdqOoKm.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\pvmliuw.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\iTcxOrD.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\EaPJhEF.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\VUHZOVB.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\kESIRKy.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\FHFXlVn.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\GZuTkZU.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\lwliZUn.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\wFKrJMd.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\KgHoJyw.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\NlLhBnH.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\GNoVQGO.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
File created	C:\Windows\System\LcNsyCl.exe	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 5100	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	84
PID 1076 wrote to memory of 5100	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	84
PID 1076 wrote to memory of 2592	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	85
PID 1076 wrote to memory of 2592	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	85
PID 1076 wrote to memory of 4548	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	86
PID 1076 wrote to memory of 4548	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	86
PID 1076 wrote to memory of 2060	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	87
PID 1076 wrote to memory of 2060	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	87
PID 1076 wrote to memory of 3728	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	88
PID 1076 wrote to memory of 3728	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	88
PID 1076 wrote to memory of 4184	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	89
PID 1076 wrote to memory of 4184	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	89
PID 1076 wrote to memory of 1036	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	92
PID 1076 wrote to memory of 1036	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	92
PID 1076 wrote to memory of 1332	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	93
PID 1076 wrote to memory of 1332	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	93
PID 1076 wrote to memory of 2804	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	94
PID 1076 wrote to memory of 2804	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	94
PID 1076 wrote to memory of 4812	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	95
PID 1076 wrote to memory of 4812	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	95
PID 1076 wrote to memory of 2136	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	97
PID 1076 wrote to memory of 2136	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	97
PID 1076 wrote to memory of 2288	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	98
PID 1076 wrote to memory of 2288	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	98
PID 1076 wrote to memory of 1428	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	99
PID 1076 wrote to memory of 1428	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	99
PID 1076 wrote to memory of 3372	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	100
PID 1076 wrote to memory of 3372	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	100
PID 1076 wrote to memory of 2096	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	101
PID 1076 wrote to memory of 2096	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	101
PID 1076 wrote to memory of 2560	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	102
PID 1076 wrote to memory of 2560	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	102
PID 1076 wrote to memory of 2856	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	103
PID 1076 wrote to memory of 2856	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	103
PID 1076 wrote to memory of 2916	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	104
PID 1076 wrote to memory of 2916	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	104
PID 1076 wrote to memory of 4964	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	105
PID 1076 wrote to memory of 4964	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	105
PID 1076 wrote to memory of 2008	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	106
PID 1076 wrote to memory of 2008	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	106
PID 1076 wrote to memory of 1616	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	107
PID 1076 wrote to memory of 1616	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	107
PID 1076 wrote to memory of 3148	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	108
PID 1076 wrote to memory of 3148	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	108
PID 1076 wrote to memory of 464	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	109
PID 1076 wrote to memory of 464	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	109
PID 1076 wrote to memory of 2880	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	110
PID 1076 wrote to memory of 2880	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	110
PID 1076 wrote to memory of 780	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	111
PID 1076 wrote to memory of 780	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	111
PID 1076 wrote to memory of 3972	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	112
PID 1076 wrote to memory of 3972	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	112
PID 1076 wrote to memory of 432	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	113
PID 1076 wrote to memory of 432	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	113
PID 1076 wrote to memory of 2600	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	114
PID 1076 wrote to memory of 2600	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	114
PID 1076 wrote to memory of 4956	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	115
PID 1076 wrote to memory of 4956	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	115
PID 1076 wrote to memory of 4468	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	116
PID 1076 wrote to memory of 4468	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	116
PID 1076 wrote to memory of 3552	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	117
PID 1076 wrote to memory of 3552	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	117
PID 1076 wrote to memory of 5056	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	118
PID 1076 wrote to memory of 5056	1076	200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe	118

C:\Users\Admin\AppData\Local\Temp\200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\200077e64f5c5f21f7c65903796af4a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\System\LhTvyWz.exe
  C:\Windows\System\LhTvyWz.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\kESIRKy.exe
  C:\Windows\System\kESIRKy.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\xvJeGCC.exe
  C:\Windows\System\xvJeGCC.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\efdsHQW.exe
  C:\Windows\System\efdsHQW.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\QMoniDy.exe
  C:\Windows\System\QMoniDy.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\klsVnew.exe
  C:\Windows\System\klsVnew.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\gmUAIDw.exe
  C:\Windows\System\gmUAIDw.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\sYRlAYg.exe
  C:\Windows\System\sYRlAYg.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\SCixIsG.exe
  C:\Windows\System\SCixIsG.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\xovyYna.exe
  C:\Windows\System\xovyYna.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\WHghnRj.exe
  C:\Windows\System\WHghnRj.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\bZQkXEL.exe
  C:\Windows\System\bZQkXEL.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\HUkjrhv.exe
  C:\Windows\System\HUkjrhv.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\NlLhBnH.exe
  C:\Windows\System\NlLhBnH.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\OWQcnSz.exe
  C:\Windows\System\OWQcnSz.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\MOCucvt.exe
  C:\Windows\System\MOCucvt.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\JaWdlES.exe
  C:\Windows\System\JaWdlES.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\hLGlFBf.exe
  C:\Windows\System\hLGlFBf.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\pEZhBlP.exe
  C:\Windows\System\pEZhBlP.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\ChZsura.exe
  C:\Windows\System\ChZsura.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\pvmliuw.exe
  C:\Windows\System\pvmliuw.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\mFCocvw.exe
  C:\Windows\System\mFCocvw.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\vDeMNBN.exe
  C:\Windows\System\vDeMNBN.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\urWWEDW.exe
  C:\Windows\System\urWWEDW.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\rsWKsuT.exe
  C:\Windows\System\rsWKsuT.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\MMaeqcT.exe
  C:\Windows\System\MMaeqcT.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\BdNDPUj.exe
  C:\Windows\System\BdNDPUj.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\JbyFpUl.exe
  C:\Windows\System\JbyFpUl.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\MTzbGJn.exe
  C:\Windows\System\MTzbGJn.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\yGgEAtv.exe
  C:\Windows\System\yGgEAtv.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\EyqKaWs.exe
  C:\Windows\System\EyqKaWs.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\TiJvCGc.exe
  C:\Windows\System\TiJvCGc.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\znrIvns.exe
  C:\Windows\System\znrIvns.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\qcJBfeU.exe
  C:\Windows\System\qcJBfeU.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\oyNlndc.exe
  C:\Windows\System\oyNlndc.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\MTRbPrw.exe
  C:\Windows\System\MTRbPrw.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\iinupbt.exe
  C:\Windows\System\iinupbt.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\TgArjxI.exe
  C:\Windows\System\TgArjxI.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ipgjZFW.exe
  C:\Windows\System\ipgjZFW.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\KLvxrKq.exe
  C:\Windows\System\KLvxrKq.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\KFxnDdn.exe
  C:\Windows\System\KFxnDdn.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\FgzMjcG.exe
  C:\Windows\System\FgzMjcG.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\iTcxOrD.exe
  C:\Windows\System\iTcxOrD.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\RklTsoN.exe
  C:\Windows\System\RklTsoN.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\JFJDeUI.exe
  C:\Windows\System\JFJDeUI.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\DiYlOPW.exe
  C:\Windows\System\DiYlOPW.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\yYVhjCz.exe
  C:\Windows\System\yYVhjCz.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\yjZgWBA.exe
  C:\Windows\System\yjZgWBA.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\icJZxzf.exe
  C:\Windows\System\icJZxzf.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\eutqSnu.exe
  C:\Windows\System\eutqSnu.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\waWlhKR.exe
  C:\Windows\System\waWlhKR.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\YXVTRhV.exe
  C:\Windows\System\YXVTRhV.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\BiplXgz.exe
  C:\Windows\System\BiplXgz.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\JoARrkX.exe
  C:\Windows\System\JoARrkX.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\mISJakU.exe
  C:\Windows\System\mISJakU.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\fwAGWOV.exe
  C:\Windows\System\fwAGWOV.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\dTuHoOD.exe
  C:\Windows\System\dTuHoOD.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\dvocCzj.exe
  C:\Windows\System\dvocCzj.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\LMkjeXC.exe
  C:\Windows\System\LMkjeXC.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\lvpoADV.exe
  C:\Windows\System\lvpoADV.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\JqFvjZi.exe
  C:\Windows\System\JqFvjZi.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\gWRCxer.exe
  C:\Windows\System\gWRCxer.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\wXmvxkN.exe
  C:\Windows\System\wXmvxkN.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\jHAVSSl.exe
  C:\Windows\System\jHAVSSl.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\lTKQEOe.exe
  C:\Windows\System\lTKQEOe.exe
  2⤵
  PID:5188
- C:\Windows\System\bHlmfNO.exe
  C:\Windows\System\bHlmfNO.exe
  2⤵
  PID:5216
- C:\Windows\System\pCLsNjD.exe
  C:\Windows\System\pCLsNjD.exe
  2⤵
  PID:5240
- C:\Windows\System\iGAAlkr.exe
  C:\Windows\System\iGAAlkr.exe
  2⤵
  PID:5268
- C:\Windows\System\yqDMkMm.exe
  C:\Windows\System\yqDMkMm.exe
  2⤵
  PID:5300
- C:\Windows\System\ygqTyqE.exe
  C:\Windows\System\ygqTyqE.exe
  2⤵
  PID:5328
- C:\Windows\System\kgWwMRE.exe
  C:\Windows\System\kgWwMRE.exe
  2⤵
  PID:5356
- C:\Windows\System\dJxTCmC.exe
  C:\Windows\System\dJxTCmC.exe
  2⤵
  PID:5384
- C:\Windows\System\waXZxIb.exe
  C:\Windows\System\waXZxIb.exe
  2⤵
  PID:5412
- C:\Windows\System\FHFXlVn.exe
  C:\Windows\System\FHFXlVn.exe
  2⤵
  PID:5440
- C:\Windows\System\FpMDVGN.exe
  C:\Windows\System\FpMDVGN.exe
  2⤵
  PID:5464
- C:\Windows\System\KcwoExP.exe
  C:\Windows\System\KcwoExP.exe
  2⤵
  PID:5496
- C:\Windows\System\PzwLvpO.exe
  C:\Windows\System\PzwLvpO.exe
  2⤵
  PID:5524
- C:\Windows\System\WBOFPKY.exe
  C:\Windows\System\WBOFPKY.exe
  2⤵
  PID:5552
- C:\Windows\System\ZhaApyv.exe
  C:\Windows\System\ZhaApyv.exe
  2⤵
  PID:5580
- C:\Windows\System\bLDePjk.exe
  C:\Windows\System\bLDePjk.exe
  2⤵
  PID:5608
- C:\Windows\System\dyBSTmj.exe
  C:\Windows\System\dyBSTmj.exe
  2⤵
  PID:5636
- C:\Windows\System\JFfYmVU.exe
  C:\Windows\System\JFfYmVU.exe
  2⤵
  PID:5652
- C:\Windows\System\bEDVNMg.exe
  C:\Windows\System\bEDVNMg.exe
  2⤵
  PID:5688
- C:\Windows\System\RBauqnA.exe
  C:\Windows\System\RBauqnA.exe
  2⤵
  PID:5716
- C:\Windows\System\CXmeKWQ.exe
  C:\Windows\System\CXmeKWQ.exe
  2⤵
  PID:5748
- C:\Windows\System\SuAjfuu.exe
  C:\Windows\System\SuAjfuu.exe
  2⤵
  PID:5776
- C:\Windows\System\yxGhLzR.exe
  C:\Windows\System\yxGhLzR.exe
  2⤵
  PID:5804
- C:\Windows\System\IrcUdIh.exe
  C:\Windows\System\IrcUdIh.exe
  2⤵
  PID:5832
- C:\Windows\System\sDwaLeY.exe
  C:\Windows\System\sDwaLeY.exe
  2⤵
  PID:5860
- C:\Windows\System\QzbAznK.exe
  C:\Windows\System\QzbAznK.exe
  2⤵
  PID:5888
- C:\Windows\System\qSJvlea.exe
  C:\Windows\System\qSJvlea.exe
  2⤵
  PID:5916
- C:\Windows\System\TZnqwxI.exe
  C:\Windows\System\TZnqwxI.exe
  2⤵
  PID:5952
- C:\Windows\System\wxyYUxn.exe
  C:\Windows\System\wxyYUxn.exe
  2⤵
  PID:5984
- C:\Windows\System\vSUOgQc.exe
  C:\Windows\System\vSUOgQc.exe
  2⤵
  PID:6016
- C:\Windows\System\NjkWcho.exe
  C:\Windows\System\NjkWcho.exe
  2⤵
  PID:6032
- C:\Windows\System\NJXaTgc.exe
  C:\Windows\System\NJXaTgc.exe
  2⤵
  PID:6056
- C:\Windows\System\PIcLrLN.exe
  C:\Windows\System\PIcLrLN.exe
  2⤵
  PID:6088
- C:\Windows\System\QcWCcXM.exe
  C:\Windows\System\QcWCcXM.exe
  2⤵
  PID:6116
- C:\Windows\System\yaaCOfa.exe
  C:\Windows\System\yaaCOfa.exe
  2⤵
  PID:876
- C:\Windows\System\JmShHic.exe
  C:\Windows\System\JmShHic.exe
  2⤵
  PID:4792
- C:\Windows\System\EyUoEgL.exe
  C:\Windows\System\EyUoEgL.exe
  2⤵
  PID:4744
- C:\Windows\System\KicHgZC.exe
  C:\Windows\System\KicHgZC.exe
  2⤵
  PID:4496
- C:\Windows\System\CUeDKhD.exe
  C:\Windows\System\CUeDKhD.exe
  2⤵
  PID:5032
- C:\Windows\System\WcCGRCY.exe
  C:\Windows\System\WcCGRCY.exe
  2⤵
  PID:4816
- C:\Windows\System\UqyXESS.exe
  C:\Windows\System\UqyXESS.exe
  2⤵
  PID:2312
- C:\Windows\System\VWuSyyd.exe
  C:\Windows\System\VWuSyyd.exe
  2⤵
  PID:5176
- C:\Windows\System\avlstDK.exe
  C:\Windows\System\avlstDK.exe
  2⤵
  PID:5236
- C:\Windows\System\swJDSYO.exe
  C:\Windows\System\swJDSYO.exe
  2⤵
  PID:5312
- C:\Windows\System\MPROtVL.exe
  C:\Windows\System\MPROtVL.exe
  2⤵
  PID:5372
- C:\Windows\System\EUblFBh.exe
  C:\Windows\System\EUblFBh.exe
  2⤵
  PID:5432
- C:\Windows\System\WxBosKf.exe
  C:\Windows\System\WxBosKf.exe
  2⤵
  PID:5508
- C:\Windows\System\tjLFThO.exe
  C:\Windows\System\tjLFThO.exe
  2⤵
  PID:5544
- C:\Windows\System\HUWkBev.exe
  C:\Windows\System\HUWkBev.exe
  2⤵
  PID:5624
- C:\Windows\System\BNJjObY.exe
  C:\Windows\System\BNJjObY.exe
  2⤵
  PID:5680
- C:\Windows\System\EnrMoWJ.exe
  C:\Windows\System\EnrMoWJ.exe
  2⤵
  PID:5740
- C:\Windows\System\hKErkie.exe
  C:\Windows\System\hKErkie.exe
  2⤵
  PID:5816
- C:\Windows\System\TkqOUvi.exe
  C:\Windows\System\TkqOUvi.exe
  2⤵
  PID:5876
- C:\Windows\System\yNdNhkk.exe
  C:\Windows\System\yNdNhkk.exe
  2⤵
  PID:5940
- C:\Windows\System\EfVBoYc.exe
  C:\Windows\System\EfVBoYc.exe
  2⤵
  PID:6004
- C:\Windows\System\ENGaPRx.exe
  C:\Windows\System\ENGaPRx.exe
  2⤵
  PID:6072
- C:\Windows\System\mkIQjUF.exe
  C:\Windows\System\mkIQjUF.exe
  2⤵
  PID:6132
- C:\Windows\System\GZuTkZU.exe
  C:\Windows\System\GZuTkZU.exe
  2⤵
  PID:4452
- C:\Windows\System\oIRzGsk.exe
  C:\Windows\System\oIRzGsk.exe
  2⤵
  PID:2188
- C:\Windows\System\XSqRHLi.exe
  C:\Windows\System\XSqRHLi.exe
  2⤵
  PID:5148
- C:\Windows\System\MYLqgGi.exe
  C:\Windows\System\MYLqgGi.exe
  2⤵
  PID:5288
- C:\Windows\System\lzVbNEh.exe
  C:\Windows\System\lzVbNEh.exe
  2⤵
  PID:5460
- C:\Windows\System\ecadSgY.exe
  C:\Windows\System\ecadSgY.exe
  2⤵
  PID:5596
- C:\Windows\System\RMXmsIH.exe
  C:\Windows\System\RMXmsIH.exe
  2⤵
  PID:5732
- C:\Windows\System\BPNpeWS.exe
  C:\Windows\System\BPNpeWS.exe
  2⤵
  PID:5852
- C:\Windows\System\MqhNUsH.exe
  C:\Windows\System\MqhNUsH.exe
  2⤵
  PID:6048
- C:\Windows\System\yPXDMaN.exe
  C:\Windows\System\yPXDMaN.exe
  2⤵
  PID:3092
- C:\Windows\System\tvfJYfn.exe
  C:\Windows\System\tvfJYfn.exe
  2⤵
  PID:6164
- C:\Windows\System\lwliZUn.exe
  C:\Windows\System\lwliZUn.exe
  2⤵
  PID:6192
- C:\Windows\System\Dqtiyey.exe
  C:\Windows\System\Dqtiyey.exe
  2⤵
  PID:6220
- C:\Windows\System\jxsYmXm.exe
  C:\Windows\System\jxsYmXm.exe
  2⤵
  PID:6252
- C:\Windows\System\wHDeEOM.exe
  C:\Windows\System\wHDeEOM.exe
  2⤵
  PID:6276
- C:\Windows\System\iFYojIf.exe
  C:\Windows\System\iFYojIf.exe
  2⤵
  PID:6304
- C:\Windows\System\JvJhGug.exe
  C:\Windows\System\JvJhGug.exe
  2⤵
  PID:6332
- C:\Windows\System\Zjbjmyb.exe
  C:\Windows\System\Zjbjmyb.exe
  2⤵
  PID:6360
- C:\Windows\System\NZFdnzV.exe
  C:\Windows\System\NZFdnzV.exe
  2⤵
  PID:6392
- C:\Windows\System\EaPJhEF.exe
  C:\Windows\System\EaPJhEF.exe
  2⤵
  PID:6416
- C:\Windows\System\fEdtmKE.exe
  C:\Windows\System\fEdtmKE.exe
  2⤵
  PID:6444
- C:\Windows\System\GNoVQGO.exe
  C:\Windows\System\GNoVQGO.exe
  2⤵
  PID:6472
- C:\Windows\System\DtxgFiw.exe
  C:\Windows\System\DtxgFiw.exe
  2⤵
  PID:6500
- C:\Windows\System\nlYndJb.exe
  C:\Windows\System\nlYndJb.exe
  2⤵
  PID:6528
- C:\Windows\System\WMnImnG.exe
  C:\Windows\System\WMnImnG.exe
  2⤵
  PID:6556
- C:\Windows\System\CGDjYZR.exe
  C:\Windows\System\CGDjYZR.exe
  2⤵
  PID:6584
- C:\Windows\System\LvHIUBI.exe
  C:\Windows\System\LvHIUBI.exe
  2⤵
  PID:6612
- C:\Windows\System\AoJDNgN.exe
  C:\Windows\System\AoJDNgN.exe
  2⤵
  PID:6640
- C:\Windows\System\dLmhUNy.exe
  C:\Windows\System\dLmhUNy.exe
  2⤵
  PID:6668
- C:\Windows\System\QFBiJJS.exe
  C:\Windows\System\QFBiJJS.exe
  2⤵
  PID:6700
- C:\Windows\System\bMhsOsc.exe
  C:\Windows\System\bMhsOsc.exe
  2⤵
  PID:6728
- C:\Windows\System\ouibqOz.exe
  C:\Windows\System\ouibqOz.exe
  2⤵
  PID:6752
- C:\Windows\System\ywqwHhx.exe
  C:\Windows\System\ywqwHhx.exe
  2⤵
  PID:6780
- C:\Windows\System\LNjIdGq.exe
  C:\Windows\System\LNjIdGq.exe
  2⤵
  PID:6808
- C:\Windows\System\hmNALzC.exe
  C:\Windows\System\hmNALzC.exe
  2⤵
  PID:6836
- C:\Windows\System\prYCRUr.exe
  C:\Windows\System\prYCRUr.exe
  2⤵
  PID:6864
- C:\Windows\System\OIELkgn.exe
  C:\Windows\System\OIELkgn.exe
  2⤵
  PID:6892
- C:\Windows\System\waqDYtJ.exe
  C:\Windows\System\waqDYtJ.exe
  2⤵
  PID:6920
- C:\Windows\System\YZjPrJQ.exe
  C:\Windows\System\YZjPrJQ.exe
  2⤵
  PID:6948
- C:\Windows\System\dEhGAvl.exe
  C:\Windows\System\dEhGAvl.exe
  2⤵
  PID:6976
- C:\Windows\System\vMSkJrh.exe
  C:\Windows\System\vMSkJrh.exe
  2⤵
  PID:7008
- C:\Windows\System\xaFYcsc.exe
  C:\Windows\System\xaFYcsc.exe
  2⤵
  PID:7036
- C:\Windows\System\ZmrTFbb.exe
  C:\Windows\System\ZmrTFbb.exe
  2⤵
  PID:7064
- C:\Windows\System\fnuDWHu.exe
  C:\Windows\System\fnuDWHu.exe
  2⤵
  PID:7092
- C:\Windows\System\xvYDTSH.exe
  C:\Windows\System\xvYDTSH.exe
  2⤵
  PID:7116
- C:\Windows\System\IyJWsyq.exe
  C:\Windows\System\IyJWsyq.exe
  2⤵
  PID:7144
- C:\Windows\System\TOvkarO.exe
  C:\Windows\System\TOvkarO.exe
  2⤵
  PID:5044
- C:\Windows\System\tibWLlX.exe
  C:\Windows\System\tibWLlX.exe
  2⤵
  PID:1016
- C:\Windows\System\OkKRoyA.exe
  C:\Windows\System\OkKRoyA.exe
  2⤵
  PID:5672
- C:\Windows\System\qfBMTmS.exe
  C:\Windows\System\qfBMTmS.exe
  2⤵
  PID:5980
- C:\Windows\System\yGCQVEN.exe
  C:\Windows\System\yGCQVEN.exe
  2⤵
  PID:6160
- C:\Windows\System\fXjHDiz.exe
  C:\Windows\System\fXjHDiz.exe
  2⤵
  PID:6236
- C:\Windows\System\YQyRIzW.exe
  C:\Windows\System\YQyRIzW.exe
  2⤵
  PID:6296
- C:\Windows\System\ahFuOrV.exe
  C:\Windows\System\ahFuOrV.exe
  2⤵
  PID:6376
- C:\Windows\System\SuWPGiI.exe
  C:\Windows\System\SuWPGiI.exe
  2⤵
  PID:4304
- C:\Windows\System\LWsjCZa.exe
  C:\Windows\System\LWsjCZa.exe
  2⤵
  PID:6488
- C:\Windows\System\YoAmyDd.exe
  C:\Windows\System\YoAmyDd.exe
  2⤵
  PID:6552
- C:\Windows\System\ilDMbhm.exe
  C:\Windows\System\ilDMbhm.exe
  2⤵
  PID:6628
- C:\Windows\System\JHLvUPu.exe
  C:\Windows\System\JHLvUPu.exe
  2⤵
  PID:6684
- C:\Windows\System\FLeZYZY.exe
  C:\Windows\System\FLeZYZY.exe
  2⤵
  PID:6748
- C:\Windows\System\jEdVwkg.exe
  C:\Windows\System\jEdVwkg.exe
  2⤵
  PID:6824
- C:\Windows\System\uVBmXNf.exe
  C:\Windows\System\uVBmXNf.exe
  2⤵
  PID:2104
- C:\Windows\System\ByihXis.exe
  C:\Windows\System\ByihXis.exe
  2⤵
  PID:6940
- C:\Windows\System\SMKYPay.exe
  C:\Windows\System\SMKYPay.exe
  2⤵
  PID:6996
- C:\Windows\System\pHGLCud.exe
  C:\Windows\System\pHGLCud.exe
  2⤵
  PID:7056
- C:\Windows\System\aFXJgMF.exe
  C:\Windows\System\aFXJgMF.exe
  2⤵
  PID:7132
- C:\Windows\System\kYIysnF.exe
  C:\Windows\System\kYIysnF.exe
  2⤵
  PID:5208
- C:\Windows\System\gegstiG.exe
  C:\Windows\System\gegstiG.exe
  2⤵
  PID:5540
- C:\Windows\System\wbJMWya.exe
  C:\Windows\System\wbJMWya.exe
  2⤵
  PID:1932
- C:\Windows\System\ryGLRAI.exe
  C:\Windows\System\ryGLRAI.exe
  2⤵
  PID:6292
- C:\Windows\System\hOwguMN.exe
  C:\Windows\System\hOwguMN.exe
  2⤵
  PID:6412
- C:\Windows\System\xiklJKl.exe
  C:\Windows\System\xiklJKl.exe
  2⤵
  PID:6580
- C:\Windows\System\ifYqwpD.exe
  C:\Windows\System\ifYqwpD.exe
  2⤵
  PID:4356
- C:\Windows\System\wkYEhwP.exe
  C:\Windows\System\wkYEhwP.exe
  2⤵
  PID:6856
- C:\Windows\System\qjqENss.exe
  C:\Windows\System\qjqENss.exe
  2⤵
  PID:6972
- C:\Windows\System\gvkmNPn.exe
  C:\Windows\System\gvkmNPn.exe
  2⤵
  PID:7108
- C:\Windows\System\EOzkgHW.exe
  C:\Windows\System\EOzkgHW.exe
  2⤵
  PID:2508
- C:\Windows\System\ywLXEaf.exe
  C:\Windows\System\ywLXEaf.exe
  2⤵
  PID:7192
- C:\Windows\System\vWTHVpu.exe
  C:\Windows\System\vWTHVpu.exe
  2⤵
  PID:7220
- C:\Windows\System\qOZjbFx.exe
  C:\Windows\System\qOZjbFx.exe
  2⤵
  PID:7248
- C:\Windows\System\PsyVpOB.exe
  C:\Windows\System\PsyVpOB.exe
  2⤵
  PID:7272
- C:\Windows\System\CtbgasQ.exe
  C:\Windows\System\CtbgasQ.exe
  2⤵
  PID:7300
- C:\Windows\System\LcNsyCl.exe
  C:\Windows\System\LcNsyCl.exe
  2⤵
  PID:7332
- C:\Windows\System\qqcRrKV.exe
  C:\Windows\System\qqcRrKV.exe
  2⤵
  PID:7360
- C:\Windows\System\nOUhHPi.exe
  C:\Windows\System\nOUhHPi.exe
  2⤵
  PID:7384
- C:\Windows\System\MhSRNXQ.exe
  C:\Windows\System\MhSRNXQ.exe
  2⤵
  PID:7412
- C:\Windows\System\obyDDLc.exe
  C:\Windows\System\obyDDLc.exe
  2⤵
  PID:7444
- C:\Windows\System\trgLtFA.exe
  C:\Windows\System\trgLtFA.exe
  2⤵
  PID:7472
- C:\Windows\System\grYBVDn.exe
  C:\Windows\System\grYBVDn.exe
  2⤵
  PID:7496
- C:\Windows\System\eESLmFS.exe
  C:\Windows\System\eESLmFS.exe
  2⤵
  PID:7524
- C:\Windows\System\FMYWCyi.exe
  C:\Windows\System\FMYWCyi.exe
  2⤵
  PID:7552
- C:\Windows\System\bZqTmph.exe
  C:\Windows\System\bZqTmph.exe
  2⤵
  PID:7580
- C:\Windows\System\Typnhux.exe
  C:\Windows\System\Typnhux.exe
  2⤵
  PID:7612
- C:\Windows\System\BQQKVQm.exe
  C:\Windows\System\BQQKVQm.exe
  2⤵
  PID:7640
- C:\Windows\System\rKMBRDb.exe
  C:\Windows\System\rKMBRDb.exe
  2⤵
  PID:7664
- C:\Windows\System\vOobmXl.exe
  C:\Windows\System\vOobmXl.exe
  2⤵
  PID:7696
- C:\Windows\System\JMnpOVY.exe
  C:\Windows\System\JMnpOVY.exe
  2⤵
  PID:7720
- C:\Windows\System\CEDnRxK.exe
  C:\Windows\System\CEDnRxK.exe
  2⤵
  PID:7748
- C:\Windows\System\uJaoAmG.exe
  C:\Windows\System\uJaoAmG.exe
  2⤵
  PID:7776
- C:\Windows\System\AGTCVFs.exe
  C:\Windows\System\AGTCVFs.exe
  2⤵
  PID:7808
- C:\Windows\System\pBQTOFx.exe
  C:\Windows\System\pBQTOFx.exe
  2⤵
  PID:7832
- C:\Windows\System\DEoHhlt.exe
  C:\Windows\System\DEoHhlt.exe
  2⤵
  PID:7860
- C:\Windows\System\kBFyaNI.exe
  C:\Windows\System\kBFyaNI.exe
  2⤵
  PID:7888
- C:\Windows\System\ayfIOgb.exe
  C:\Windows\System\ayfIOgb.exe
  2⤵
  PID:7920
- C:\Windows\System\LUUQlNK.exe
  C:\Windows\System\LUUQlNK.exe
  2⤵
  PID:7944
- C:\Windows\System\yLOwtfW.exe
  C:\Windows\System\yLOwtfW.exe
  2⤵
  PID:7980
- C:\Windows\System\ciUNsQD.exe
  C:\Windows\System\ciUNsQD.exe
  2⤵
  PID:8004
- C:\Windows\System\gUHYIBc.exe
  C:\Windows\System\gUHYIBc.exe
  2⤵
  PID:8032
- C:\Windows\System\bjNDvfi.exe
  C:\Windows\System\bjNDvfi.exe
  2⤵
  PID:8056
- C:\Windows\System\OfXWHPH.exe
  C:\Windows\System\OfXWHPH.exe
  2⤵
  PID:8088
- C:\Windows\System\NlqbPUF.exe
  C:\Windows\System\NlqbPUF.exe
  2⤵
  PID:8116
- C:\Windows\System\NcwVjwa.exe
  C:\Windows\System\NcwVjwa.exe
  2⤵
  PID:8144
- C:\Windows\System\YzRKBJT.exe
  C:\Windows\System\YzRKBJT.exe
  2⤵
  PID:8172
- C:\Windows\System\oJKTJAa.exe
  C:\Windows\System\oJKTJAa.exe
  2⤵
  PID:1988
- C:\Windows\System\MjyXSVq.exe
  C:\Windows\System\MjyXSVq.exe
  2⤵
  PID:6544
- C:\Windows\System\IvTyUtW.exe
  C:\Windows\System\IvTyUtW.exe
  2⤵
  PID:6912
- C:\Windows\System\kCqpZCh.exe
  C:\Windows\System\kCqpZCh.exe
  2⤵
  PID:7164
- C:\Windows\System\UsRABwC.exe
  C:\Windows\System\UsRABwC.exe
  2⤵
  PID:7208
- C:\Windows\System\DHwgBLm.exe
  C:\Windows\System\DHwgBLm.exe
  2⤵
  PID:7268
- C:\Windows\System\mzlBMdC.exe
  C:\Windows\System\mzlBMdC.exe
  2⤵
  PID:7320
- C:\Windows\System\djkekcP.exe
  C:\Windows\System\djkekcP.exe
  2⤵
  PID:7376
- C:\Windows\System\IPcCpuj.exe
  C:\Windows\System\IPcCpuj.exe
  2⤵
  PID:7432
- C:\Windows\System\Afailxj.exe
  C:\Windows\System\Afailxj.exe
  2⤵
  PID:7484
- C:\Windows\System\tGsxPaz.exe
  C:\Windows\System\tGsxPaz.exe
  2⤵
  PID:7660
- C:\Windows\System\qTKVgoZ.exe
  C:\Windows\System\qTKVgoZ.exe
  2⤵
  PID:7716
- C:\Windows\System\LlcGICk.exe
  C:\Windows\System\LlcGICk.exe
  2⤵
  PID:7796
- C:\Windows\System\AMTxqHT.exe
  C:\Windows\System\AMTxqHT.exe
  2⤵
  PID:7848
- C:\Windows\System\cylggKk.exe
  C:\Windows\System\cylggKk.exe
  2⤵
  PID:7884
- C:\Windows\System\oapKONm.exe
  C:\Windows\System\oapKONm.exe
  2⤵
  PID:7940
- C:\Windows\System\liYhRmn.exe
  C:\Windows\System\liYhRmn.exe
  2⤵
  PID:1416
- C:\Windows\System\VRlTZkx.exe
  C:\Windows\System\VRlTZkx.exe
  2⤵
  PID:8080
- C:\Windows\System\RyynRZn.exe
  C:\Windows\System\RyynRZn.exe
  2⤵
  PID:8184
- C:\Windows\System\WBGtMJV.exe
  C:\Windows\System\WBGtMJV.exe
  2⤵
  PID:6796
- C:\Windows\System\sIWZMAb.exe
  C:\Windows\System\sIWZMAb.exe
  2⤵
  PID:7184
- C:\Windows\System\utzvfDz.exe
  C:\Windows\System\utzvfDz.exe
  2⤵
  PID:7316
- C:\Windows\System\MIgdmLC.exe
  C:\Windows\System\MIgdmLC.exe
  2⤵
  PID:368
- C:\Windows\System\BwpxHUo.exe
  C:\Windows\System\BwpxHUo.exe
  2⤵
  PID:1992
- C:\Windows\System\LBkTiZl.exe
  C:\Windows\System\LBkTiZl.exe
  2⤵
  PID:4896
- C:\Windows\System\HuuoeZg.exe
  C:\Windows\System\HuuoeZg.exe
  2⤵
  PID:4616
- C:\Windows\System\dDCgcsM.exe
  C:\Windows\System\dDCgcsM.exe
  2⤵
  PID:1248
- C:\Windows\System\zFGxiFw.exe
  C:\Windows\System\zFGxiFw.exe
  2⤵
  PID:2664
- C:\Windows\System\TCxuMtV.exe
  C:\Windows\System\TCxuMtV.exe
  2⤵
  PID:7516
- C:\Windows\System\ABNttHt.exe
  C:\Windows\System\ABNttHt.exe
  2⤵
  PID:1964
- C:\Windows\System\CpnePiJ.exe
  C:\Windows\System\CpnePiJ.exe
  2⤵
  PID:4180
- C:\Windows\System\mFyrXYS.exe
  C:\Windows\System\mFyrXYS.exe
  2⤵
  PID:3880
- C:\Windows\System\ZBpXlpq.exe
  C:\Windows\System\ZBpXlpq.exe
  2⤵
  PID:4940
- C:\Windows\System\QPKQzVP.exe
  C:\Windows\System\QPKQzVP.exe
  2⤵
  PID:1940
- C:\Windows\System\Vyfario.exe
  C:\Windows\System\Vyfario.exe
  2⤵
  PID:7964
- C:\Windows\System\aeHwkoi.exe
  C:\Windows\System\aeHwkoi.exe
  2⤵
  PID:8072
- C:\Windows\System\wzdMKBX.exe
  C:\Windows\System\wzdMKBX.exe
  2⤵
  PID:8076
- C:\Windows\System\yudQzHM.exe
  C:\Windows\System\yudQzHM.exe
  2⤵
  PID:1836
- C:\Windows\System\ZPTzZFU.exe
  C:\Windows\System\ZPTzZFU.exe
  2⤵
  PID:7404
- C:\Windows\System\zbHwDaJ.exe
  C:\Windows\System\zbHwDaJ.exe
  2⤵
  PID:7460
- C:\Windows\System\ozGAjLf.exe
  C:\Windows\System\ozGAjLf.exe
  2⤵
  PID:1848
- C:\Windows\System\ibabqZf.exe
  C:\Windows\System\ibabqZf.exe
  2⤵
  PID:2644
- C:\Windows\System\TPxUHxi.exe
  C:\Windows\System\TPxUHxi.exe
  2⤵
  PID:3836
- C:\Windows\System\AjEogTp.exe
  C:\Windows\System\AjEogTp.exe
  2⤵
  PID:6156
- C:\Windows\System\aOwCCjM.exe
  C:\Windows\System\aOwCCjM.exe
  2⤵
  PID:688
- C:\Windows\System\sMtYQNb.exe
  C:\Windows\System\sMtYQNb.exe
  2⤵
  PID:7596
- C:\Windows\System\qevKElR.exe
  C:\Windows\System\qevKElR.exe
  2⤵
  PID:4640
- C:\Windows\System\VqnAMgf.exe
  C:\Windows\System\VqnAMgf.exe
  2⤵
  PID:808
- C:\Windows\System\NjxAsTO.exe
  C:\Windows\System\NjxAsTO.exe
  2⤵
  PID:4632
- C:\Windows\System\CDINeVM.exe
  C:\Windows\System\CDINeVM.exe
  2⤵
  PID:8200
- C:\Windows\System\wOhYlVY.exe
  C:\Windows\System\wOhYlVY.exe
  2⤵
  PID:8228
- C:\Windows\System\fhpcZyl.exe
  C:\Windows\System\fhpcZyl.exe
  2⤵
  PID:8256
- C:\Windows\System\BdTOWuT.exe
  C:\Windows\System\BdTOWuT.exe
  2⤵
  PID:8284
- C:\Windows\System\uCGbcAg.exe
  C:\Windows\System\uCGbcAg.exe
  2⤵
  PID:8320
- C:\Windows\System\HnomRFv.exe
  C:\Windows\System\HnomRFv.exe
  2⤵
  PID:8340
- C:\Windows\System\xJgyQKH.exe
  C:\Windows\System\xJgyQKH.exe
  2⤵
  PID:8368
- C:\Windows\System\PNNeVRU.exe
  C:\Windows\System\PNNeVRU.exe
  2⤵
  PID:8396
- C:\Windows\System\DAuCwFK.exe
  C:\Windows\System\DAuCwFK.exe
  2⤵
  PID:8424
- C:\Windows\System\laFHYNf.exe
  C:\Windows\System\laFHYNf.exe
  2⤵
  PID:8452
- C:\Windows\System\UZefQpw.exe
  C:\Windows\System\UZefQpw.exe
  2⤵
  PID:8484
- C:\Windows\System\jOCgnoX.exe
  C:\Windows\System\jOCgnoX.exe
  2⤵
  PID:8508
- C:\Windows\System\MBUlirP.exe
  C:\Windows\System\MBUlirP.exe
  2⤵
  PID:8536
- C:\Windows\System\cVFHkEv.exe
  C:\Windows\System\cVFHkEv.exe
  2⤵
  PID:8564
- C:\Windows\System\HiyIJri.exe
  C:\Windows\System\HiyIJri.exe
  2⤵
  PID:8592
- C:\Windows\System\fWunCsy.exe
  C:\Windows\System\fWunCsy.exe
  2⤵
  PID:8620
- C:\Windows\System\sXHzPOZ.exe
  C:\Windows\System\sXHzPOZ.exe
  2⤵
  PID:8648
- C:\Windows\System\CYxKkuu.exe
  C:\Windows\System\CYxKkuu.exe
  2⤵
  PID:8676
- C:\Windows\System\jAxMTxy.exe
  C:\Windows\System\jAxMTxy.exe
  2⤵
  PID:8704
- C:\Windows\System\SNNmBqg.exe
  C:\Windows\System\SNNmBqg.exe
  2⤵
  PID:8732
- C:\Windows\System\iAgdIuY.exe
  C:\Windows\System\iAgdIuY.exe
  2⤵
  PID:8760
- C:\Windows\System\UHPTkVt.exe
  C:\Windows\System\UHPTkVt.exe
  2⤵
  PID:8788
- C:\Windows\System\joigupt.exe
  C:\Windows\System\joigupt.exe
  2⤵
  PID:8820
- C:\Windows\System\AiUCmlR.exe
  C:\Windows\System\AiUCmlR.exe
  2⤵
  PID:8848
- C:\Windows\System\euWlkYO.exe
  C:\Windows\System\euWlkYO.exe
  2⤵
  PID:8892
- C:\Windows\System\eKoYehu.exe
  C:\Windows\System\eKoYehu.exe
  2⤵
  PID:8920
- C:\Windows\System\VUHZOVB.exe
  C:\Windows\System\VUHZOVB.exe
  2⤵
  PID:8976
- C:\Windows\System\eoglxgL.exe
  C:\Windows\System\eoglxgL.exe
  2⤵
  PID:9008
- C:\Windows\System\PynLgZX.exe
  C:\Windows\System\PynLgZX.exe
  2⤵
  PID:9064
- C:\Windows\System\ubjzaGh.exe
  C:\Windows\System\ubjzaGh.exe
  2⤵
  PID:9092
- C:\Windows\System\dmxyWPL.exe
  C:\Windows\System\dmxyWPL.exe
  2⤵
  PID:9124
- C:\Windows\System\GgTyuHl.exe
  C:\Windows\System\GgTyuHl.exe
  2⤵
  PID:9160
- C:\Windows\System\QYLXIpk.exe
  C:\Windows\System\QYLXIpk.exe
  2⤵
  PID:8196
- C:\Windows\System\rePzcSU.exe
  C:\Windows\System\rePzcSU.exe
  2⤵
  PID:8268
- C:\Windows\System\cWOxTxl.exe
  C:\Windows\System\cWOxTxl.exe
  2⤵
  PID:8352
- C:\Windows\System\bMaWoVo.exe
  C:\Windows\System\bMaWoVo.exe
  2⤵
  PID:8444
- C:\Windows\System\QQlgrZx.exe
  C:\Windows\System\QQlgrZx.exe
  2⤵
  PID:8560
- C:\Windows\System\ioHhvtG.exe
  C:\Windows\System\ioHhvtG.exe
  2⤵
  PID:8612
- C:\Windows\System\pFseuSt.exe
  C:\Windows\System\pFseuSt.exe
  2⤵
  PID:8660
- C:\Windows\System\DLaPFFH.exe
  C:\Windows\System\DLaPFFH.exe
  2⤵
  PID:8752
- C:\Windows\System\PzFDBLe.exe
  C:\Windows\System\PzFDBLe.exe
  2⤵
  PID:8784
- C:\Windows\System\ofVoGgZ.exe
  C:\Windows\System\ofVoGgZ.exe
  2⤵
  PID:8844
- C:\Windows\System\artvukg.exe
  C:\Windows\System\artvukg.exe
  2⤵
  PID:8964
- C:\Windows\System\EjUBNRZ.exe
  C:\Windows\System\EjUBNRZ.exe
  2⤵
  PID:9076
- C:\Windows\System\uYOSgnb.exe
  C:\Windows\System\uYOSgnb.exe
  2⤵
  PID:9196
- C:\Windows\System\QwIEQtf.exe
  C:\Windows\System\QwIEQtf.exe
  2⤵
  PID:8408
- C:\Windows\System\hXMORNP.exe
  C:\Windows\System\hXMORNP.exe
  2⤵
  PID:8532
- C:\Windows\System\stKQvhI.exe
  C:\Windows\System\stKQvhI.exe
  2⤵
  PID:8644
- C:\Windows\System\EsvTlAA.exe
  C:\Windows\System\EsvTlAA.exe
  2⤵
  PID:8776
- C:\Windows\System\eIUVXxw.exe
  C:\Windows\System\eIUVXxw.exe
  2⤵
  PID:8992
- C:\Windows\System\xMfPHul.exe
  C:\Windows\System\xMfPHul.exe
  2⤵
  PID:9212
- C:\Windows\System\zAbIlrM.exe
  C:\Windows\System\zAbIlrM.exe
  2⤵
  PID:8448
- C:\Windows\System\eCqLLlt.exe
  C:\Windows\System\eCqLLlt.exe
  2⤵
  PID:9220
- C:\Windows\System\NGPPTqa.exe
  C:\Windows\System\NGPPTqa.exe
  2⤵
  PID:9268
- C:\Windows\System\HUhpwwr.exe
  C:\Windows\System\HUhpwwr.exe
  2⤵
  PID:9340
- C:\Windows\System\OWJaQIY.exe
  C:\Windows\System\OWJaQIY.exe
  2⤵
  PID:9364
- C:\Windows\System\WRHsjcZ.exe
  C:\Windows\System\WRHsjcZ.exe
  2⤵
  PID:9404
- C:\Windows\System\NNuvDAv.exe
  C:\Windows\System\NNuvDAv.exe
  2⤵
  PID:9432
- C:\Windows\System\VrKqcUM.exe
  C:\Windows\System\VrKqcUM.exe
  2⤵
  PID:9452
- C:\Windows\System\leQhEks.exe
  C:\Windows\System\leQhEks.exe
  2⤵
  PID:9488
- C:\Windows\System\OHEBKpm.exe
  C:\Windows\System\OHEBKpm.exe
  2⤵
  PID:9516
- C:\Windows\System\XslivPe.exe
  C:\Windows\System\XslivPe.exe
  2⤵
  PID:9544
- C:\Windows\System\ysothZq.exe
  C:\Windows\System\ysothZq.exe
  2⤵
  PID:9572
- C:\Windows\System\Ondiaby.exe
  C:\Windows\System\Ondiaby.exe
  2⤵
  PID:9600
- C:\Windows\System\sEyJqtA.exe
  C:\Windows\System\sEyJqtA.exe
  2⤵
  PID:9628
- C:\Windows\System\kykHkkx.exe
  C:\Windows\System\kykHkkx.exe
  2⤵
  PID:9656
- C:\Windows\System\YHtAMEC.exe
  C:\Windows\System\YHtAMEC.exe
  2⤵
  PID:9684
- C:\Windows\System\icFVBLD.exe
  C:\Windows\System\icFVBLD.exe
  2⤵
  PID:9712
- C:\Windows\System\tgEVexV.exe
  C:\Windows\System\tgEVexV.exe
  2⤵
  PID:9740
- C:\Windows\System\qbyftvu.exe
  C:\Windows\System\qbyftvu.exe
  2⤵
  PID:9768
- C:\Windows\System\fDGxqts.exe
  C:\Windows\System\fDGxqts.exe
  2⤵
  PID:9796
- C:\Windows\System\aceRMur.exe
  C:\Windows\System\aceRMur.exe
  2⤵
  PID:9824
- C:\Windows\System\NQnDtvj.exe
  C:\Windows\System\NQnDtvj.exe
  2⤵
  PID:9852
- C:\Windows\System\AVizcde.exe
  C:\Windows\System\AVizcde.exe
  2⤵
  PID:9880
- C:\Windows\System\EiyybAv.exe
  C:\Windows\System\EiyybAv.exe
  2⤵
  PID:9908
- C:\Windows\System\kgYrJTg.exe
  C:\Windows\System\kgYrJTg.exe
  2⤵
  PID:9936
- C:\Windows\System\FNnAdcW.exe
  C:\Windows\System\FNnAdcW.exe
  2⤵
  PID:9964
- C:\Windows\System\KRDNuMG.exe
  C:\Windows\System\KRDNuMG.exe
  2⤵
  PID:9984
- C:\Windows\System\sXhVwLd.exe
  C:\Windows\System\sXhVwLd.exe
  2⤵
  PID:10020
- C:\Windows\System\LozAqzS.exe
  C:\Windows\System\LozAqzS.exe
  2⤵
  PID:10048
- C:\Windows\System\UdMKNcf.exe
  C:\Windows\System\UdMKNcf.exe
  2⤵
  PID:10076
- C:\Windows\System\ZFNvEHK.exe
  C:\Windows\System\ZFNvEHK.exe
  2⤵
  PID:10104
- C:\Windows\System\JwBHvdJ.exe
  C:\Windows\System\JwBHvdJ.exe
  2⤵
  PID:10132
- C:\Windows\System\bZKLqBk.exe
  C:\Windows\System\bZKLqBk.exe
  2⤵
  PID:10160
- C:\Windows\System\aKORhMy.exe
  C:\Windows\System\aKORhMy.exe
  2⤵
  PID:10188
- C:\Windows\System\lFsEYza.exe
  C:\Windows\System\lFsEYza.exe
  2⤵
  PID:10216
- C:\Windows\System\JhnAncj.exe
  C:\Windows\System\JhnAncj.exe
  2⤵
  PID:8904
- C:\Windows\System\pypMCMG.exe
  C:\Windows\System\pypMCMG.exe
  2⤵
  PID:9148
- C:\Windows\System\EvCMHXo.exe
  C:\Windows\System\EvCMHXo.exe
  2⤵
  PID:9260
- C:\Windows\System\MPjDPbV.exe
  C:\Windows\System\MPjDPbV.exe
  2⤵
  PID:9360
- C:\Windows\System\nvfUUDf.exe
  C:\Windows\System\nvfUUDf.exe
  2⤵
  PID:9416
- C:\Windows\System\RObNEiM.exe
  C:\Windows\System\RObNEiM.exe
  2⤵
  PID:9480
- C:\Windows\System\sphiyKG.exe
  C:\Windows\System\sphiyKG.exe
  2⤵
  PID:9540
- C:\Windows\System\TqJKGms.exe
  C:\Windows\System\TqJKGms.exe
  2⤵
  PID:9612
- C:\Windows\System\GWMfJEg.exe
  C:\Windows\System\GWMfJEg.exe
  2⤵
  PID:9676
- C:\Windows\System\nWJdyWv.exe
  C:\Windows\System\nWJdyWv.exe
  2⤵
  PID:9736
- C:\Windows\System\TeNborN.exe
  C:\Windows\System\TeNborN.exe
  2⤵
  PID:9808
- C:\Windows\System\jqGhOWE.exe
  C:\Windows\System\jqGhOWE.exe
  2⤵
  PID:9864
- C:\Windows\System\AWDkktE.exe
  C:\Windows\System\AWDkktE.exe
  2⤵
  PID:9948
- C:\Windows\System\afbbGvz.exe
  C:\Windows\System\afbbGvz.exe
  2⤵
  PID:10012
- C:\Windows\System\DQITWef.exe
  C:\Windows\System\DQITWef.exe
  2⤵
  PID:10068
- C:\Windows\System\jrnYOTf.exe
  C:\Windows\System\jrnYOTf.exe
  2⤵
  PID:10148
- C:\Windows\System\GHBwjby.exe
  C:\Windows\System\GHBwjby.exe
  2⤵
  PID:10184
- C:\Windows\System\oKnZozK.exe
  C:\Windows\System\oKnZozK.exe
  2⤵
  PID:9256
- C:\Windows\System\nvVVwuu.exe
  C:\Windows\System\nvVVwuu.exe
  2⤵
  PID:9228
- C:\Windows\System\fQrprrG.exe
  C:\Windows\System\fQrprrG.exe
  2⤵
  PID:9568
- C:\Windows\System\UTDsjDL.exe
  C:\Windows\System\UTDsjDL.exe
  2⤵
  PID:9728
- C:\Windows\System\ryvjbWk.exe
  C:\Windows\System\ryvjbWk.exe
  2⤵
  PID:9848
- C:\Windows\System\dlYHCGO.exe
  C:\Windows\System\dlYHCGO.exe
  2⤵
  PID:10040
- C:\Windows\System\GJiSPzk.exe
  C:\Windows\System\GJiSPzk.exe
  2⤵
  PID:8336
- C:\Windows\System\PBdLmEA.exe
  C:\Windows\System\PBdLmEA.exe
  2⤵
  PID:9400
- C:\Windows\System\ZBRHdLW.exe
  C:\Windows\System\ZBRHdLW.exe
  2⤵
  PID:9644
- C:\Windows\System\obHeMhf.exe
  C:\Windows\System\obHeMhf.exe
  2⤵
  PID:10128
- C:\Windows\System\MZMJmDH.exe
  C:\Windows\System\MZMJmDH.exe
  2⤵
  PID:9784
- C:\Windows\System\OyCGHwB.exe
  C:\Windows\System\OyCGHwB.exe
  2⤵
  PID:10260
- C:\Windows\System\RvSLZyE.exe
  C:\Windows\System\RvSLZyE.exe
  2⤵
  PID:10288
- C:\Windows\System\WWJDWKp.exe
  C:\Windows\System\WWJDWKp.exe
  2⤵
  PID:10332
- C:\Windows\System\oorWeQx.exe
  C:\Windows\System\oorWeQx.exe
  2⤵
  PID:10364
- C:\Windows\System\ZlpXpBZ.exe
  C:\Windows\System\ZlpXpBZ.exe
  2⤵
  PID:10392
- C:\Windows\System\ieBXrEi.exe
  C:\Windows\System\ieBXrEi.exe
  2⤵
  PID:10420
- C:\Windows\System\hqNIRfq.exe
  C:\Windows\System\hqNIRfq.exe
  2⤵
  PID:10448
- C:\Windows\System\PQyYSlc.exe
  C:\Windows\System\PQyYSlc.exe
  2⤵
  PID:10476
- C:\Windows\System\EytWdHt.exe
  C:\Windows\System\EytWdHt.exe
  2⤵
  PID:10492
- C:\Windows\System\jRXgHQO.exe
  C:\Windows\System\jRXgHQO.exe
  2⤵
  PID:10532
- C:\Windows\System\lKpPvnq.exe
  C:\Windows\System\lKpPvnq.exe
  2⤵
  PID:10560
- C:\Windows\System\MBsJreC.exe
  C:\Windows\System\MBsJreC.exe
  2⤵
  PID:10588
- C:\Windows\System\VeIoGFl.exe
  C:\Windows\System\VeIoGFl.exe
  2⤵
  PID:10616
- C:\Windows\System\AsHdgmq.exe
  C:\Windows\System\AsHdgmq.exe
  2⤵
  PID:10644
- C:\Windows\System\zLEdqFy.exe
  C:\Windows\System\zLEdqFy.exe
  2⤵
  PID:10672
- C:\Windows\System\yXKMNtG.exe
  C:\Windows\System\yXKMNtG.exe
  2⤵
  PID:10704
- C:\Windows\System\IgCLRTS.exe
  C:\Windows\System\IgCLRTS.exe
  2⤵
  PID:10728
- C:\Windows\System\yeUsWFN.exe
  C:\Windows\System\yeUsWFN.exe
  2⤵
  PID:10756
- C:\Windows\System\wCpMWAt.exe
  C:\Windows\System\wCpMWAt.exe
  2⤵
  PID:10784
- C:\Windows\System\FxwoGWi.exe
  C:\Windows\System\FxwoGWi.exe
  2⤵
  PID:10816
- C:\Windows\System\bluKPgR.exe
  C:\Windows\System\bluKPgR.exe
  2⤵
  PID:10836
- C:\Windows\System\yrVtGmV.exe
  C:\Windows\System\yrVtGmV.exe
  2⤵
  PID:10860
- C:\Windows\System\Zwlrvma.exe
  C:\Windows\System\Zwlrvma.exe
  2⤵
  PID:10900
- C:\Windows\System\oIZpfqd.exe
  C:\Windows\System\oIZpfqd.exe
  2⤵
  PID:10928
- C:\Windows\System\AOnIufc.exe
  C:\Windows\System\AOnIufc.exe
  2⤵
  PID:10960
- C:\Windows\System\LRHZHCI.exe
  C:\Windows\System\LRHZHCI.exe
  2⤵
  PID:10988
- C:\Windows\System\rtNEbhs.exe
  C:\Windows\System\rtNEbhs.exe
  2⤵
  PID:11016
- C:\Windows\System\MXUHRxM.exe
  C:\Windows\System\MXUHRxM.exe
  2⤵
  PID:11052
- C:\Windows\System\ZDHqixU.exe
  C:\Windows\System\ZDHqixU.exe
  2⤵
  PID:11076
- C:\Windows\System\oDTrBwm.exe
  C:\Windows\System\oDTrBwm.exe
  2⤵
  PID:11104
- C:\Windows\System\niVANTb.exe
  C:\Windows\System\niVANTb.exe
  2⤵
  PID:11124
- C:\Windows\System\xbcjCSJ.exe
  C:\Windows\System\xbcjCSJ.exe
  2⤵
  PID:11148
- C:\Windows\System\BCApzaf.exe
  C:\Windows\System\BCApzaf.exe
  2⤵
  PID:11184
- C:\Windows\System\voWHNAT.exe
  C:\Windows\System\voWHNAT.exe
  2⤵
  PID:11216
- C:\Windows\System\vFKudot.exe
  C:\Windows\System\vFKudot.exe
  2⤵
  PID:11244
- C:\Windows\System\GWKNiRx.exe
  C:\Windows\System\GWKNiRx.exe
  2⤵
  PID:10256
- C:\Windows\System\dCOFuel.exe
  C:\Windows\System\dCOFuel.exe
  2⤵
  PID:10344
- C:\Windows\System\baZrhRz.exe
  C:\Windows\System\baZrhRz.exe
  2⤵
  PID:10408
- C:\Windows\System\wLxenLH.exe
  C:\Windows\System\wLxenLH.exe
  2⤵
  PID:10468
- C:\Windows\System\vgjgIfg.exe
  C:\Windows\System\vgjgIfg.exe
  2⤵
  PID:10508
- C:\Windows\System\YxweIur.exe
  C:\Windows\System\YxweIur.exe
  2⤵
  PID:10544
- C:\Windows\System\fOrwkxf.exe
  C:\Windows\System\fOrwkxf.exe
  2⤵
  PID:10608
- C:\Windows\System\qlijuyC.exe
  C:\Windows\System\qlijuyC.exe
  2⤵
  PID:10720
- C:\Windows\System\MUUdyzR.exe
  C:\Windows\System\MUUdyzR.exe
  2⤵
  PID:10772
- C:\Windows\System\dnRiXUl.exe
  C:\Windows\System\dnRiXUl.exe
  2⤵
  PID:10824
- C:\Windows\System\NtgmExB.exe
  C:\Windows\System\NtgmExB.exe
  2⤵
  PID:10920
- C:\Windows\System\AyDGNSZ.exe
  C:\Windows\System\AyDGNSZ.exe
  2⤵
  PID:10976
- C:\Windows\System\HoqdwVd.exe
  C:\Windows\System\HoqdwVd.exe
  2⤵
  PID:11060
- C:\Windows\System\EgPkRCp.exe
  C:\Windows\System\EgPkRCp.exe
  2⤵
  PID:11112
- C:\Windows\System\IUgUlGY.exe
  C:\Windows\System\IUgUlGY.exe
  2⤵
  PID:11180
- C:\Windows\System\MxeUopW.exe
  C:\Windows\System\MxeUopW.exe
  2⤵
  PID:11228
- C:\Windows\System\oNfrKey.exe
  C:\Windows\System\oNfrKey.exe
  2⤵
  PID:10284
- C:\Windows\System\ESQfIXP.exe
  C:\Windows\System\ESQfIXP.exe
  2⤵
  PID:10388
- C:\Windows\System\KFdBGTo.exe
  C:\Windows\System\KFdBGTo.exe
  2⤵
  PID:10604
- C:\Windows\System\RKpYdpw.exe
  C:\Windows\System\RKpYdpw.exe
  2⤵
  PID:10740
- C:\Windows\System\rRjvsMH.exe
  C:\Windows\System\rRjvsMH.exe
  2⤵
  PID:10884
- C:\Windows\System\FOOodOX.exe
  C:\Windows\System\FOOodOX.exe
  2⤵
  PID:11088
- C:\Windows\System\msexKHo.exe
  C:\Windows\System\msexKHo.exe
  2⤵
  PID:5084
- C:\Windows\System\dCFfXgZ.exe
  C:\Windows\System\dCFfXgZ.exe
  2⤵
  PID:10384
- C:\Windows\System\HUbgDHO.exe
  C:\Windows\System\HUbgDHO.exe
  2⤵
  PID:10856
- C:\Windows\System\xAfKZmx.exe
  C:\Windows\System\xAfKZmx.exe
  2⤵
  PID:11200
- C:\Windows\System\azaLpws.exe
  C:\Windows\System\azaLpws.exe
  2⤵
  PID:11024
- C:\Windows\System\OFYIQyD.exe
  C:\Windows\System\OFYIQyD.exe
  2⤵
  PID:11268
- C:\Windows\System\uwtfAjr.exe
  C:\Windows\System\uwtfAjr.exe
  2⤵
  PID:11284
- C:\Windows\System\TqCgPrj.exe
  C:\Windows\System\TqCgPrj.exe
  2⤵
  PID:11324
- C:\Windows\System\jVoVaym.exe
  C:\Windows\System\jVoVaym.exe
  2⤵
  PID:11352
- C:\Windows\System\QuGBEaW.exe
  C:\Windows\System\QuGBEaW.exe
  2⤵
  PID:11380
- C:\Windows\System\SIrxCyX.exe
  C:\Windows\System\SIrxCyX.exe
  2⤵
  PID:11408
- C:\Windows\System\TPDToQT.exe
  C:\Windows\System\TPDToQT.exe
  2⤵
  PID:11432
- C:\Windows\System\KOkNCqP.exe
  C:\Windows\System\KOkNCqP.exe
  2⤵
  PID:11452
- C:\Windows\System\TVXhgoF.exe
  C:\Windows\System\TVXhgoF.exe
  2⤵
  PID:11480
- C:\Windows\System\DQPepxB.exe
  C:\Windows\System\DQPepxB.exe
  2⤵
  PID:11516
- C:\Windows\System\DUIHrpI.exe
  C:\Windows\System\DUIHrpI.exe
  2⤵
  PID:11548
- C:\Windows\System\JGXPYqO.exe
  C:\Windows\System\JGXPYqO.exe
  2⤵
  PID:11576
- C:\Windows\System\mGMvXoi.exe
  C:\Windows\System\mGMvXoi.exe
  2⤵
  PID:11604
- C:\Windows\System\jYaXwWs.exe
  C:\Windows\System\jYaXwWs.exe
  2⤵
  PID:11632
- C:\Windows\System\wFKrJMd.exe
  C:\Windows\System\wFKrJMd.exe
  2⤵
  PID:11660
- C:\Windows\System\fRTTYHa.exe
  C:\Windows\System\fRTTYHa.exe
  2⤵
  PID:11688
- C:\Windows\System\AhWgPuW.exe
  C:\Windows\System\AhWgPuW.exe
  2⤵
  PID:11716
- C:\Windows\System\tImbWFv.exe
  C:\Windows\System\tImbWFv.exe
  2⤵
  PID:11744
- C:\Windows\System\wEzKYaU.exe
  C:\Windows\System\wEzKYaU.exe
  2⤵
  PID:11772
- C:\Windows\System\mPSKbkx.exe
  C:\Windows\System\mPSKbkx.exe
  2⤵
  PID:11800
- C:\Windows\System\pBYNeLW.exe
  C:\Windows\System\pBYNeLW.exe
  2⤵
  PID:11828
- C:\Windows\System\TuOFYpE.exe
  C:\Windows\System\TuOFYpE.exe
  2⤵
  PID:11856
- C:\Windows\System\AhgULQu.exe
  C:\Windows\System\AhgULQu.exe
  2⤵
  PID:11876
- C:\Windows\System\zWKIEcg.exe
  C:\Windows\System\zWKIEcg.exe
  2⤵
  PID:11900
- C:\Windows\System\tWvHGCI.exe
  C:\Windows\System\tWvHGCI.exe
  2⤵
  PID:11928
- C:\Windows\System\NAGwRDo.exe
  C:\Windows\System\NAGwRDo.exe
  2⤵
  PID:11964
- C:\Windows\System\OQMbXDg.exe
  C:\Windows\System\OQMbXDg.exe
  2⤵
  PID:11984
- C:\Windows\System\RsaefVm.exe
  C:\Windows\System\RsaefVm.exe
  2⤵
  PID:12024
- C:\Windows\System\tCAbHEr.exe
  C:\Windows\System\tCAbHEr.exe
  2⤵
  PID:12048
- C:\Windows\System\YoyJZTj.exe
  C:\Windows\System\YoyJZTj.exe
  2⤵
  PID:12080
- C:\Windows\System\cFCGcjw.exe
  C:\Windows\System\cFCGcjw.exe
  2⤵
  PID:12108
- C:\Windows\System\rbdUfcK.exe
  C:\Windows\System\rbdUfcK.exe
  2⤵
  PID:12136
- C:\Windows\System\txebySM.exe
  C:\Windows\System\txebySM.exe
  2⤵
  PID:12172
- C:\Windows\System\TSgIcbt.exe
  C:\Windows\System\TSgIcbt.exe
  2⤵
  PID:12212
- C:\Windows\System\GkAbIHm.exe
  C:\Windows\System\GkAbIHm.exe
  2⤵
  PID:12252
- C:\Windows\System\GVDsgAg.exe
  C:\Windows\System\GVDsgAg.exe
  2⤵
  PID:11140
- C:\Windows\System\psAYZrP.exe
  C:\Windows\System\psAYZrP.exe
  2⤵
  PID:11336
- C:\Windows\System\GVYKsXW.exe
  C:\Windows\System\GVYKsXW.exe
  2⤵
  PID:11376
- C:\Windows\System\aIzwtSg.exe
  C:\Windows\System\aIzwtSg.exe
  2⤵
  PID:11448
- C:\Windows\System\XHPUzxR.exe
  C:\Windows\System\XHPUzxR.exe
  2⤵
  PID:11496
- C:\Windows\System\ACxcVAJ.exe
  C:\Windows\System\ACxcVAJ.exe
  2⤵
  PID:11568
- C:\Windows\System\HqqrAev.exe
  C:\Windows\System\HqqrAev.exe
  2⤵
  PID:11624
- C:\Windows\System\xGFksZN.exe
  C:\Windows\System\xGFksZN.exe
  2⤵
  PID:11708
- C:\Windows\System\JRXOglI.exe
  C:\Windows\System\JRXOglI.exe
  2⤵
  PID:11824
- C:\Windows\System\FGgOmtG.exe
  C:\Windows\System\FGgOmtG.exe
  2⤵
  PID:11952
- C:\Windows\System\zoDXwZs.exe
  C:\Windows\System\zoDXwZs.exe
  2⤵
  PID:11996
- C:\Windows\System\plEfcOn.exe
  C:\Windows\System\plEfcOn.exe
  2⤵
  PID:12040
- C:\Windows\System\hxhUeZM.exe
  C:\Windows\System\hxhUeZM.exe
  2⤵
  PID:12092
- C:\Windows\System\tFxibuW.exe
  C:\Windows\System\tFxibuW.exe
  2⤵
  PID:12168
- C:\Windows\System\pdqOoKm.exe
  C:\Windows\System\pdqOoKm.exe
  2⤵
  PID:11300
- C:\Windows\System\zVkjwDE.exe
  C:\Windows\System\zVkjwDE.exe
  2⤵
  PID:11464
- C:\Windows\System\JMAIIVf.exe
  C:\Windows\System\JMAIIVf.exe
  2⤵
  PID:11672
- C:\Windows\System\ZSueBGk.exe
  C:\Windows\System\ZSueBGk.exe
  2⤵
  PID:11792
- C:\Windows\System\LxrKnyQ.exe
  C:\Windows\System\LxrKnyQ.exe
  2⤵
  PID:11916
- C:\Windows\System\XdCsgpx.exe
  C:\Windows\System\XdCsgpx.exe
  2⤵
  PID:12148
- C:\Windows\System\elturnX.exe
  C:\Windows\System\elturnX.exe
  2⤵
  PID:11896
- C:\Windows\System\aTsdzUt.exe
  C:\Windows\System\aTsdzUt.exe
  2⤵
  PID:12308
- C:\Windows\System\AEhsjkl.exe
  C:\Windows\System\AEhsjkl.exe
  2⤵
  PID:12340
- C:\Windows\System\JrykcLi.exe
  C:\Windows\System\JrykcLi.exe
  2⤵
  PID:12368
- C:\Windows\System\sRVSGtT.exe
  C:\Windows\System\sRVSGtT.exe
  2⤵
  PID:12396
- C:\Windows\System\vHEoYQM.exe
  C:\Windows\System\vHEoYQM.exe
  2⤵
  PID:12428
- C:\Windows\System\TDtpALr.exe
  C:\Windows\System\TDtpALr.exe
  2⤵
  PID:12448
- C:\Windows\System\oUTasTD.exe
  C:\Windows\System\oUTasTD.exe
  2⤵
  PID:12472
- C:\Windows\System\BAFAZXr.exe
  C:\Windows\System\BAFAZXr.exe
  2⤵
  PID:12488
- C:\Windows\System\kyiPuje.exe
  C:\Windows\System\kyiPuje.exe
  2⤵
  PID:12528
- C:\Windows\System\KDRXRGz.exe
  C:\Windows\System\KDRXRGz.exe
  2⤵
  PID:12572
- C:\Windows\System\SQimNXA.exe
  C:\Windows\System\SQimNXA.exe
  2⤵
  PID:12604
- C:\Windows\System\TFzfMml.exe
  C:\Windows\System\TFzfMml.exe
  2⤵
  PID:12620
- C:\Windows\System\nkFYNwy.exe
  C:\Windows\System\nkFYNwy.exe
  2⤵
  PID:12636
- C:\Windows\System\IbHLchg.exe
  C:\Windows\System\IbHLchg.exe
  2⤵
  PID:12656
- C:\Windows\System\XWaFXaK.exe
  C:\Windows\System\XWaFXaK.exe
  2⤵
  PID:12692
- C:\Windows\System\McJIoLB.exe
  C:\Windows\System\McJIoLB.exe
  2⤵
  PID:12720
- C:\Windows\System\knFYMxZ.exe
  C:\Windows\System\knFYMxZ.exe
  2⤵
  PID:12768
- C:\Windows\System\sgftuDC.exe
  C:\Windows\System\sgftuDC.exe
  2⤵
  PID:12796
- C:\Windows\System\ZIbbztZ.exe
  C:\Windows\System\ZIbbztZ.exe
  2⤵
  PID:12832
- C:\Windows\System\yuDhFsQ.exe
  C:\Windows\System\yuDhFsQ.exe
  2⤵
  PID:12860
- C:\Windows\System\YrRoOcm.exe
  C:\Windows\System\YrRoOcm.exe
  2⤵
  PID:12884
- C:\Windows\System\SaJlSOc.exe
  C:\Windows\System\SaJlSOc.exe
  2⤵
  PID:12904
- C:\Windows\System\dZOBoxk.exe
  C:\Windows\System\dZOBoxk.exe
  2⤵
  PID:12948
- C:\Windows\System\nXemHfa.exe
  C:\Windows\System\nXemHfa.exe
  2⤵
  PID:12976
- C:\Windows\System\UVcXyAw.exe
  C:\Windows\System\UVcXyAw.exe
  2⤵
  PID:13004
- C:\Windows\System\tyYDiDc.exe
  C:\Windows\System\tyYDiDc.exe
  2⤵
  PID:13032
- C:\Windows\System\mWUNHGR.exe
  C:\Windows\System\mWUNHGR.exe
  2⤵
  PID:13060
- C:\Windows\System\UCJpFgj.exe
  C:\Windows\System\UCJpFgj.exe
  2⤵
  PID:13088
- C:\Windows\System\XglslMW.exe
  C:\Windows\System\XglslMW.exe
  2⤵
  PID:13116
- C:\Windows\System\shgZQZh.exe
  C:\Windows\System\shgZQZh.exe
  2⤵
  PID:13144
- C:\Windows\System\GQxYOYz.exe
  C:\Windows\System\GQxYOYz.exe
  2⤵
  PID:13172
- C:\Windows\System\VruMYAu.exe
  C:\Windows\System\VruMYAu.exe
  2⤵
  PID:13200
- C:\Windows\System\gmlXneH.exe
  C:\Windows\System\gmlXneH.exe
  2⤵
  PID:13228
- C:\Windows\System\HoxNaOY.exe
  C:\Windows\System\HoxNaOY.exe
  2⤵
  PID:13256
- C:\Windows\System\MdatQwF.exe
  C:\Windows\System\MdatQwF.exe
  2⤵
  PID:13276
- C:\Windows\System\nOdgESd.exe
  C:\Windows\System\nOdgESd.exe
  2⤵
  PID:11400
- C:\Windows\System\xIuertW.exe
  C:\Windows\System\xIuertW.exe
  2⤵
  PID:12300
- C:\Windows\System\EgwqGpF.exe
  C:\Windows\System\EgwqGpF.exe
  2⤵
  PID:12356
- C:\Windows\System\UHXTsjL.exe
  C:\Windows\System\UHXTsjL.exe
  2⤵
  PID:12424
- C:\Windows\System\GTBLkDC.exe
  C:\Windows\System\GTBLkDC.exe
  2⤵
  PID:12480
- C:\Windows\System\yTnkMWs.exe
  C:\Windows\System\yTnkMWs.exe
  2⤵
  PID:12548
- C:\Windows\System\VBXixLh.exe
  C:\Windows\System\VBXixLh.exe
  2⤵
  PID:12584
- C:\Windows\System\tvwJPps.exe
  C:\Windows\System\tvwJPps.exe
  2⤵
  PID:12688
- C:\Windows\System\MRssdJH.exe
  C:\Windows\System\MRssdJH.exe
  2⤵
  PID:12756
- C:\Windows\System\gfBlHNe.exe
  C:\Windows\System\gfBlHNe.exe
  2⤵
  PID:12824
- C:\Windows\System\gMyCsCp.exe
  C:\Windows\System\gMyCsCp.exe
  2⤵
  PID:12896
- C:\Windows\System\VficERy.exe
  C:\Windows\System\VficERy.exe
  2⤵
  PID:12960
- C:\Windows\System\Pkzyorr.exe
  C:\Windows\System\Pkzyorr.exe
  2⤵
  PID:13016
- C:\Windows\System\fjBOYRl.exe
  C:\Windows\System\fjBOYRl.exe
  2⤵
  PID:13048
- C:\Windows\System\sBCQnMD.exe
  C:\Windows\System\sBCQnMD.exe
  2⤵
  PID:13128
- C:\Windows\System\MNDCWNd.exe
  C:\Windows\System\MNDCWNd.exe
  2⤵
  PID:13196
- C:\Windows\System\NCjEieb.exe
  C:\Windows\System\NCjEieb.exe
  2⤵
  PID:13248
- C:\Windows\System\VfUetaq.exe
  C:\Windows\System\VfUetaq.exe
  2⤵
  PID:13292
- C:\Windows\System\BIuhawx.exe
  C:\Windows\System\BIuhawx.exe
  2⤵
  PID:12328
- C:\Windows\System\aHZFZid.exe
  C:\Windows\System\aHZFZid.exe
  2⤵
  PID:12520
- C:\Windows\System\yFZkvFq.exe
  C:\Windows\System\yFZkvFq.exe
  2⤵
  PID:12744
- C:\Windows\System\FvXcueh.exe
  C:\Windows\System\FvXcueh.exe
  2⤵
  PID:12856
- C:\Windows\System\XgfNUyr.exe
  C:\Windows\System\XgfNUyr.exe
  2⤵
  PID:11656
- C:\Windows\System\tEZtcdt.exe
  C:\Windows\System\tEZtcdt.exe
  2⤵
  PID:13084
- C:\Windows\System\lGBQBFh.exe
  C:\Windows\System\lGBQBFh.exe
  2⤵
  PID:13184
- C:\Windows\System\oUkxpqn.exe
  C:\Windows\System\oUkxpqn.exe
  2⤵
  PID:12296
- C:\Windows\System\KgHoJyw.exe
  C:\Windows\System\KgHoJyw.exe
  2⤵
  PID:12784
- C:\Windows\System\URZrfpC.exe
  C:\Windows\System\URZrfpC.exe
  2⤵
  PID:13224
- C:\Windows\System\TKYJrJu.exe
  C:\Windows\System\TKYJrJu.exe
  2⤵
  PID:12932
- C:\Windows\System\HnYrOpP.exe
  C:\Windows\System\HnYrOpP.exe
  2⤵
  PID:13328
- C:\Windows\System\fexNami.exe
  C:\Windows\System\fexNami.exe
  2⤵
  PID:13356
- C:\Windows\System\AfNgEgT.exe
  C:\Windows\System\AfNgEgT.exe
  2⤵
  PID:13388
- C:\Windows\System\BQMjTnI.exe
  C:\Windows\System\BQMjTnI.exe
  2⤵
  PID:13416
- C:\Windows\System\ZFZKTbf.exe
  C:\Windows\System\ZFZKTbf.exe
  2⤵
  PID:13440
- C:\Windows\System\rgruynt.exe
  C:\Windows\System\rgruynt.exe
  2⤵
  PID:13460
- C:\Windows\System\QICMWOl.exe
  C:\Windows\System\QICMWOl.exe
  2⤵
  PID:13484
- C:\Windows\System\hHSTEth.exe
  C:\Windows\System\hHSTEth.exe
  2⤵
  PID:13508
- C:\Windows\System\oSvEUxr.exe
  C:\Windows\System\oSvEUxr.exe
  2⤵
  PID:13548
- C:\Windows\System\LuCNezI.exe
  C:\Windows\System\LuCNezI.exe
  2⤵
  PID:13572
- C:\Windows\System\dxCjwjb.exe
  C:\Windows\System\dxCjwjb.exe
  2⤵
  PID:13596
- C:\Windows\System\vVShPjn.exe
  C:\Windows\System\vVShPjn.exe
  2⤵
  PID:13624
- C:\Windows\System\KWHSNBj.exe
  C:\Windows\System\KWHSNBj.exe
  2⤵
  PID:13652
- C:\Windows\System\YUHVSYi.exe
  C:\Windows\System\YUHVSYi.exe
  2⤵
  PID:13688
- C:\Windows\System\UVFwcig.exe
  C:\Windows\System\UVFwcig.exe
  2⤵
  PID:13720
- C:\Windows\System\HJUZdHe.exe
  C:\Windows\System\HJUZdHe.exe
  2⤵
  PID:13744
- C:\Windows\System\kTbgVqU.exe
  C:\Windows\System\kTbgVqU.exe
  2⤵
  PID:13768
- C:\Windows\System\dttTOko.exe
  C:\Windows\System\dttTOko.exe
  2⤵
  PID:13804
- C:\Windows\System\yPznvxF.exe
  C:\Windows\System\yPznvxF.exe
  2⤵
  PID:13836
- C:\Windows\System\WhAHwbh.exe
  C:\Windows\System\WhAHwbh.exe
  2⤵
  PID:13864
- C:\Windows\System\OoBfNPq.exe
  C:\Windows\System\OoBfNPq.exe
  2⤵
  PID:13908
- C:\Windows\System\QGEftnG.exe
  C:\Windows\System\QGEftnG.exe
  2⤵
  PID:13932
- C:\Windows\System\GigAalA.exe
  C:\Windows\System\GigAalA.exe
  2⤵
  PID:13960
- C:\Windows\System\NWLqeyH.exe
  C:\Windows\System\NWLqeyH.exe
  2⤵
  PID:13996
- C:\Windows\System\QgSuaqR.exe
  C:\Windows\System\QgSuaqR.exe
  2⤵
  PID:14016
- C:\Windows\System\rNdVFkF.exe
  C:\Windows\System\rNdVFkF.exe
  2⤵
  PID:14048
- C:\Windows\System\gblDjmr.exe
  C:\Windows\System\gblDjmr.exe
  2⤵
  PID:14088
- C:\Windows\System\iAEulko.exe
  C:\Windows\System\iAEulko.exe
  2⤵
  PID:14116
- C:\Windows\System\WJQJzHj.exe
  C:\Windows\System\WJQJzHj.exe
  2⤵
  PID:14132
- C:\Windows\System\YzOFVOQ.exe
  C:\Windows\System\YzOFVOQ.exe
  2⤵
  PID:14152
- C:\Windows\System\xYgyBCB.exe
  C:\Windows\System\xYgyBCB.exe
  2⤵
  PID:14180
- C:\Windows\System\gQctEHR.exe
  C:\Windows\System\gQctEHR.exe
  2⤵
  PID:14220
- C:\Windows\System\SxzWdep.exe
  C:\Windows\System\SxzWdep.exe
  2⤵
  PID:14244
- C:\Windows\System\KSKozUD.exe
  C:\Windows\System\KSKozUD.exe
  2⤵
  PID:14280
- C:\Windows\System\hAPuHRF.exe
  C:\Windows\System\hAPuHRF.exe
  2⤵
  PID:14308
- C:\Windows\System\IKccVGr.exe
  C:\Windows\System\IKccVGr.exe
  2⤵
  PID:12944
- C:\Windows\System\SjewLhd.exe
  C:\Windows\System\SjewLhd.exe
  2⤵
  PID:13320
- C:\Windows\System\XCymVkR.exe
  C:\Windows\System\XCymVkR.exe
  2⤵
  PID:13400
- C:\Windows\System\VNvhcxr.exe
  C:\Windows\System\VNvhcxr.exe
  2⤵
  PID:13456
- C:\Windows\System\PkLHtkz.exe
  C:\Windows\System\PkLHtkz.exe
  2⤵
  PID:13472
- C:\Windows\System\SwtGXOC.exe
  C:\Windows\System\SwtGXOC.exe
  2⤵
  PID:13536
- C:\Windows\System\QFMadKK.exe
  C:\Windows\System\QFMadKK.exe
  2⤵
  PID:13620
- C:\Windows\System\fmYuikE.exe
  C:\Windows\System\fmYuikE.exe
  2⤵
  PID:13648
- C:\Windows\System\ZcFzzWA.exe
  C:\Windows\System\ZcFzzWA.exe
  2⤵
  PID:13680
- C:\Windows\System\tYLPNdl.exe
  C:\Windows\System\tYLPNdl.exe
  2⤵
  PID:13792
- C:\Windows\System\uokeFey.exe
  C:\Windows\System\uokeFey.exe
  2⤵
  PID:13860
- C:\Windows\System\cTraxrs.exe
  C:\Windows\System\cTraxrs.exe
  2⤵
  PID:13920
- C:\Windows\System\ECByNgg.exe
  C:\Windows\System\ECByNgg.exe
  2⤵
  PID:14004
- C:\Windows\System\dXFPYnL.exe
  C:\Windows\System\dXFPYnL.exe
  2⤵
  PID:14068
- C:\Windows\System\XgFadIy.exe
  C:\Windows\System\XgFadIy.exe
  2⤵
  PID:4128
- C:\Windows\System\accExxL.exe
  C:\Windows\System\accExxL.exe
  2⤵
  PID:14140
- C:\Windows\System\UrEmefR.exe
  C:\Windows\System\UrEmefR.exe
  2⤵
  PID:14236
- C:\Windows\System\bIrcGeW.exe
  C:\Windows\System\bIrcGeW.exe
  2⤵
  PID:14296
- C:\Windows\System\XpZPqHU.exe
  C:\Windows\System\XpZPqHU.exe
  2⤵
  PID:12468
- C:\Windows\System\VuQKIBG.exe
  C:\Windows\System\VuQKIBG.exe
  2⤵
  PID:13564
- C:\Windows\System\sSzVPPV.exe
  C:\Windows\System\sSzVPPV.exe
  2⤵
  PID:13588
- C:\Windows\System\AwFTGCv.exe
  C:\Windows\System\AwFTGCv.exe
  2⤵
  PID:13788
- C:\Windows\System\TzyGXUx.exe
  C:\Windows\System\TzyGXUx.exe
  2⤵
  PID:13816
- C:\Windows\System\uuiDVcZ.exe
  C:\Windows\System\uuiDVcZ.exe
  2⤵
  PID:14112
- C:\Windows\System\Mjizjdk.exe
  C:\Windows\System\Mjizjdk.exe
  2⤵
  PID:14200
- C:\Windows\System\fGgTFhW.exe
  C:\Windows\System\fGgTFhW.exe
  2⤵
  PID:14272
- C:\Windows\System\jNrxUbl.exe
  C:\Windows\System\jNrxUbl.exe
  2⤵
  PID:13480
- C:\Windows\System\Nivgtto.exe
  C:\Windows\System\Nivgtto.exe
  2⤵
  PID:13956
- C:\Windows\System\czttnFU.exe
  C:\Windows\System\czttnFU.exe
  2⤵
  PID:14212
- C:\Windows\System\DhFcKaU.exe
  C:\Windows\System\DhFcKaU.exe
  2⤵
  PID:13944
- C:\Windows\System\bCspUrz.exe
  C:\Windows\System\bCspUrz.exe
  2⤵
  PID:13924
- C:\Windows\System\eeUDFRh.exe
  C:\Windows\System\eeUDFRh.exe
  2⤵
  PID:14360
- C:\Windows\System\WKrQmfL.exe
  C:\Windows\System\WKrQmfL.exe
  2⤵
  PID:14384
- C:\Windows\System\RMoXiwa.exe
  C:\Windows\System\RMoXiwa.exe
  2⤵
  PID:14420
- C:\Windows\System\tXtnBoW.exe
  C:\Windows\System\tXtnBoW.exe
  2⤵
  PID:14448
- C:\Windows\System\CtLLMoP.exe
  C:\Windows\System\CtLLMoP.exe
  2⤵
  PID:14476
- C:\Windows\System\LiFwKmQ.exe
  C:\Windows\System\LiFwKmQ.exe
  2⤵
  PID:14504
- C:\Windows\System\IMcaQUy.exe
  C:\Windows\System\IMcaQUy.exe
  2⤵
  PID:14536
- C:\Windows\System\ViCchTc.exe
  C:\Windows\System\ViCchTc.exe
  2⤵
  PID:14572
- C:\Windows\System\DNCMBwY.exe
  C:\Windows\System\DNCMBwY.exe
  2⤵
  PID:14596
- C:\Windows\System\mCZCMVX.exe
  C:\Windows\System\mCZCMVX.exe
  2⤵
  PID:14616
- C:\Windows\System\DxiYsAg.exe
  C:\Windows\System\DxiYsAg.exe
  2⤵
  PID:14648
- C:\Windows\System\PorjNEC.exe
  C:\Windows\System\PorjNEC.exe
  2⤵
  PID:14672
- C:\Windows\System\mNhVVJz.exe
  C:\Windows\System\mNhVVJz.exe
  2⤵
  PID:14700
- C:\Windows\System\bwyIRpU.exe
  C:\Windows\System\bwyIRpU.exe
  2⤵
  PID:14732
- C:\Windows\System\AqNTkcp.exe
  C:\Windows\System\AqNTkcp.exe
  2⤵
  PID:14756
- C:\Windows\System\MLoOuAt.exe
  C:\Windows\System\MLoOuAt.exe
  2⤵
  PID:14784
- C:\Windows\System\msmOJKG.exe
  C:\Windows\System\msmOJKG.exe
  2⤵
  PID:14812
- C:\Windows\System\VPoREKX.exe
  C:\Windows\System\VPoREKX.exe
  2⤵
  PID:14840
- C:\Windows\System\KiuEqQC.exe
  C:\Windows\System\KiuEqQC.exe
  2⤵
  PID:14868
- C:\Windows\System\hxDopYb.exe
  C:\Windows\System\hxDopYb.exe
  2⤵
  PID:14896
- C:\Windows\System\lTwlDXg.exe
  C:\Windows\System\lTwlDXg.exe
  2⤵
  PID:14924
- C:\Windows\System\TRJRonQ.exe
  C:\Windows\System\TRJRonQ.exe
  2⤵
  PID:14960
- C:\Windows\System\CaFgPlr.exe
  C:\Windows\System\CaFgPlr.exe
  2⤵
  PID:14992
- C:\Windows\System\thHEwYa.exe
  C:\Windows\System\thHEwYa.exe
  2⤵
  PID:15020
- C:\Windows\System\kqGhljb.exe
  C:\Windows\System\kqGhljb.exe
  2⤵
  PID:15048
- C:\Windows\System\mUrTJka.exe
  C:\Windows\System\mUrTJka.exe
  2⤵
  PID:15076
- C:\Windows\System\eZBLoFc.exe
  C:\Windows\System\eZBLoFc.exe
  2⤵
  PID:15100
- C:\Windows\System\XAkhqLN.exe
  C:\Windows\System\XAkhqLN.exe
  2⤵
  PID:15120
- C:\Windows\System\RxsJnau.exe
  C:\Windows\System\RxsJnau.exe
  2⤵
  PID:15148
- C:\Windows\System\MBrQDJI.exe
  C:\Windows\System\MBrQDJI.exe
  2⤵
  PID:15176
- C:\Windows\System\AvFJfgg.exe
  C:\Windows\System\AvFJfgg.exe
  2⤵
  PID:15204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BdNDPUj.exe

Path C:\Windows\System\BdNDPUj.exe
Size 2.8MB
SHA256 50b029aac38599db6e8b2d2129341b2188c2ca749b0e9142046051c2d8763462
MD5 7ac68ddab34f7b8fec71faf6c1273266
SHA1 ad744ef4564546e7566f894f55fc2b6b0dc234f2
SHA512 bda60d384e391fabd62c7b330d957396943ca9250750651348d9049d871f770dd55f6b69c1cea22a8a390ca4c8a1c1143ad8daa32487b0fe253647214ae06e22
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHR:BemTLkNdfE0pZra
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChZsura.exe

Path C:\Windows\System\ChZsura.exe
Size 2.8MB
SHA256 15f4ab4d8b8c1c5f91f6425b14733ce655723f5c4c460cf8d871191b1a8bcdc5
MD5 a5e0ecaab457ebb23a6a0a68e75ca7fa
SHA1 3b207e76dc763c84131846325ccc33cdd5f8bf93
SHA512 f610af1bfa28b2f94bba13af0a0c62d9e9046c807cc1f1bd4febba899054ce6699e38fbef58be69e2d98a8fc5431f5863c9326aa80f7427e220a6d3dacccbc61
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHU:BemTLkNdfE0pZrx
MD5 SHA1 SHA512 SSDEEP

Submit Download

EyqKaWs.exe

Path C:\Windows\System\EyqKaWs.exe
Size 2.8MB
SHA256 bf14283e7c0041afb878db9dee304ff2790fed6f7f7077ed4e50f055604ef4f9
MD5 17270d20276042861a177874879f47c0
SHA1 0114f511bc1febcf6237eb80f6a278120694244d
SHA512 3dabf106bcbd5aef171580b8ca09110a1b8b7d3ee15476aab1e714fd586bca53b9ecba7bc11033111af8e17a246ae2d28c158756a0d3588838ad276146642da5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHM:BemTLkNdfE0pZrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUkjrhv.exe

Path C:\Windows\System\HUkjrhv.exe
Size 2.8MB
SHA256 19d66a4e783fa41882f12905c3e8e31474b71e62571012b5664aa3e08f167597
MD5 dcebf0893a3b87d860139121e5403f0a
SHA1 91381ce1a9feb29d6f624a0a4983f0ac1e5f7b88
SHA512 42a0e1bdccb5c09c712398fb668be7123f585d5b63fcdc3bc679e48b19a4524f5a706ba2841f12574c85ad79db601e8248e5afc8531ec45fd4de029065620746
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggH5:BemTLkNdfE0pZrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

JaWdlES.exe

Path C:\Windows\System\JaWdlES.exe
Size 2.8MB
SHA256 3b307af57284311e78c4d77c9f5f2fb451642c67068727c1cdab4ebbf116b913
MD5 81ac4989f087ae6c0792bbec1cb9efde
SHA1 1e63575285fa82b6eeb0a59af849266f1019c199
SHA512 583ee7369fd44c1f772fa239f85f0b54094a6924010bc78960b9c2b747bb2eada69a1fb5f4ebf2e3cbde97ce90cc8dc6d091a76c26e3a5aac3bafbd5512deb70
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHa:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JbyFpUl.exe

Path C:\Windows\System\JbyFpUl.exe
Size 2.8MB
SHA256 d51359d73efd34fe79185d892f35c120ffdf9017f0d21254bcf97bbc78ba4d6b
MD5 b19331fd36c5d9353fc7dec79ae854b2
SHA1 a40ecf16f2d0288081094a0242e71273d817e192
SHA512 ce7d52a81009d408622fcc8a1d6b20edab8291bd440c028591dc89940c743c4a7e6bb975ac5bde984d3c202588ae77c3bfc96af8addebc2f7d81bfb463e3086b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHV:BemTLkNdfE0pZr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LhTvyWz.exe

Path C:\Windows\System\LhTvyWz.exe
Size 2.8MB
SHA256 9842da1bbad54da140635d77c84b0be43e7458ab35fa666fdaf7d18bda519da5
MD5 c7c93cbd33ce9c3fff5d157ba340223a
SHA1 8c860c4c106b9aa2d62f183dd3f38ad5a9128ebf
SHA512 cbe3e8f4dcfc52d00cd1091f6180e47bfb969edd32bf8236d55f814e0a685f64fdb9956f0da796a7b6b04049f81ce9b715980e1157704f4916a7c288457a382a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHH:BemTLkNdfE0pZrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMaeqcT.exe

Path C:\Windows\System\MMaeqcT.exe
Size 2.8MB
SHA256 b4fd66c9e22da635e857bc8a5c2c75048faf5e6ea2e698e9d7f4455992cae209
MD5 5f264d56148ce890dd880c272724393a
SHA1 c06a1ac5e3f748dfa55c2802790da32c5dda6fa5
SHA512 4603a4a1c05cf56e66345036153a44431ad0edd95e3211b8030211e27472ce8871402740463a5bf39a4755de86265daf60fc2bdcee8cb37b5e1b9c8d789d0d30
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggH0:BemTLkNdfE0pZrR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MOCucvt.exe

Path C:\Windows\System\MOCucvt.exe
Size 2.8MB
SHA256 174ecd9fe47adac4ed0b5c5afa144fecf36235a8bfc28ae88302c3ebcbe8a15a
MD5 a8900565688cd82e1af7dec0f0f2f4d6
SHA1 46e96d2af7c32bf91ca20090bc83a15438009265
SHA512 8734b5e3e4478150823594af792d08ea0c7dbef51b67181e7354c648518b47cbdf182b4ce871f984cd9aee4389777c355828e516090a92d55d74966bf3e7c82f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHG:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

MTzbGJn.exe

Path C:\Windows\System\MTzbGJn.exe
Size 2.8MB
SHA256 3d68a8e4a79acf0228b8c74f0bcf75e34468eb3729746d5c0d1fafab7652cc54
MD5 05edcb7dc565cdb8a4cce1e587c26318
SHA1 f44c31c07d398ed420a4811f2f32fa5787eafc5f
SHA512 ccc2cdc0b1f95c58ca98a2651aecd3c26e857e6b96ea745efc989200245b2d25f2bb3f6d0871b64f8123b24f0b8919deaf88ad937cbbf03e191756188785b132
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHk:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

NlLhBnH.exe

Path C:\Windows\System\NlLhBnH.exe
Size 2.8MB
SHA256 0950da9e2685a230ceb5cf51deab391dfb803f170f816cf407b9e5bebcbb6c12
MD5 20a4f8717654ba447c989fbc02942cb7
SHA1 740eea17a79d111dd480f566589907f50e83be5f
SHA512 98c09847827618c7ab7b2df232ffd6dd0e00d34a0714b62f9ee6cb0ea82191d1a8a402400f1177d0f88071e84216b055c469ce84af7108c74453cb0df41515a4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHD:BemTLkNdfE0pZre
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWQcnSz.exe

Path C:\Windows\System\OWQcnSz.exe
Size 2.8MB
SHA256 b422db4be1b61a89d486e0844b27f4047aca1ffee04c40d8f83ec62f58044bf7
MD5 1faa93ca49123d95210dcb21a4a2f94d
SHA1 35c335c89888d49a2fc2cbb6d83f7f43cf4a2004
SHA512 b8f9be19b7a990598ba2dd141d19d1c01cc646962594e4cfef8df30ac5d75c113de4d9edd72e8a422e5ab6f7a9d5c292cf5dfdc4d563a705aaae7e47b2263625
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHI:BemTLkNdfE0pZr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMoniDy.exe

Path C:\Windows\System\QMoniDy.exe
Size 2.8MB
SHA256 0bf83f48d93d87e48b9283633e090cf64844fe3b552d44e5511b97a6445ab003
MD5 173170d8a21d43812ec41dabcacbddf5
SHA1 f05c3898162af520ba9f15c4fc182bcc4e4be3b8
SHA512 e8ba4b1416eb18c88214590e740539dc4640d845f7060083e22dcf3c9c041d44b194b1115cc33fde163bdf679196893d7977792ed3be275ca9d439951b3663ed
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHS:BemTLkNdfE0pZr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCixIsG.exe

Path C:\Windows\System\SCixIsG.exe
Size 2.8MB
SHA256 d720ede814ee5e58b2e161ed496329736736303f9145f34d96108773c487e510
MD5 761e75d21089d3f68c99adc7df527e28
SHA1 d8eb9ec46ef5a8814229ecb83090bd643889264c
SHA512 1ed411aec91d8621c3b42459e59ee15c75fdc33e23cd6a6916f6917816cd90b4f7652bfd267079d6ad9fd13af80965f57f26b8ec8c139dd873da13e2330748d7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHt:BemTLkNdfE0pZru
MD5 SHA1 SHA512 SSDEEP

Submit Download

TiJvCGc.exe

Path C:\Windows\System\TiJvCGc.exe
Size 2.8MB
SHA256 894e977fec0bac1f570eff396ab911dcad3adcbd4e95b220b31d47557da0b86e
MD5 d24f06e02933d35695f577e2c41fd96a
SHA1 35ac3ed541a62716d019763708f47e2c2e39ff8b
SHA512 d14a8ac7e34d93699c0697825880ef01a0c4d78ae3223d187c5251c60c87c8dc8cbe2352eae7aafe42df33cabcdd783fb2b456bdc5397cd0f0f2e8452ee39b68
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHH:BemTLkNdfE0pZrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHghnRj.exe

Path C:\Windows\System\WHghnRj.exe
Size 2.8MB
SHA256 a1c8d13dcfe28d2a56aa7503a35da482f787dd762a7e03fc3dae35e6a6195477
MD5 516638f0cd1a4e8fb5527904f6c86bc7
SHA1 ef7b654b12b431b0bf9d2263dd235b77d73eecb1
SHA512 a723eb0ae103f675dd579a05dc1fe577a709a1141d26c2cf68fc1f42398d2bf387334d5fb8fc3f1e6d02e43995246388282af96553548fe5282fd70438feb96d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHu:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

bZQkXEL.exe

Path C:\Windows\System\bZQkXEL.exe
Size 2.8MB
SHA256 d369dfc689edd7e414638ac833be6df1e88f967140647e7273f74cbc535574cb
MD5 e710d457129344bbe04d2d85997b21c7
SHA1 0764d0a9fa84bbb3401f68db94e7b68c9065a5d2
SHA512 93272fc28cf80d50dfa26cc3e243bdac5b5a8f1e1b1638863892877cdfcd6b128f2132ce075ce16036b3d9b421828b844b260633d377fef9f993b97d810784dd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHH:BemTLkNdfE0pZru
MD5 SHA1 SHA512 SSDEEP

Submit Download

efdsHQW.exe

Path C:\Windows\System\efdsHQW.exe
Size 2.8MB
SHA256 c1efb57f98f4d098fafd1638dfd0291a45615af7c94625c8dcccd8c241f31ca7
MD5 ded7504167a316a2a792b0cdf18a8f70
SHA1 232c0eeda95834eff99ea46f8c841caf288b51c1
SHA512 1b72ef0973598d68c63096fcf3f603246fc846b13981bca431450ff1966d5661e7bd61bd2c9ac6fc3488ec7abda2da5b09abc92d5064fda3583667dfc871a291
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggH8:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmUAIDw.exe

Path C:\Windows\System\gmUAIDw.exe
Size 2.8MB
SHA256 5e331954ff6df23051023bcbca3a04fc6d0e41b81e81eee16580acb29799606e
MD5 0646afc6513ae8e0bae55af91629341a
SHA1 c2142177238c9ff768be67bdd4db1adc91598add
SHA512 23d9c62f912848f442675907ce15e84dbd9a36e8d2017085f615aebcc9f07688c3acbb709f55a19ece9910f3d37cfcf4584af0b12c9c5f2a74596a9b68ba98de
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHK:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hLGlFBf.exe

Path C:\Windows\System\hLGlFBf.exe
Size 2.8MB
SHA256 d0bf99d633dbbbbce139e267bcb3622fe3ef203b0f763d13c57d780cbe7f23c8
MD5 fdc75ad325aa07adb2d9961267c58a9a
SHA1 a60c366f6e9912f5953fd1c6a5b203f650695973
SHA512 f569b1c634b6e33c88a840c3d2cf41cb46a1fb62434d260440ce5519eacbc13500828c372c3dab367e1cfc754544b7f4e52f6bb254cc1252842c1782bd5135fa
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHA:BemTLkNdfE0pZrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kESIRKy.exe

Path C:\Windows\System\kESIRKy.exe
Size 2.8MB
SHA256 93d325b6d189135d68d57f95ab2c09256f0903a0121a07db57c7bb4520cd2cc7
MD5 d7059cf6fcd39d2f0d7ca093baa57d72
SHA1 707b924344261a78f6a69eb0883d2609c89a0e6e
SHA512 ead0337040eeeba26ded371f9a751e6837aaac2cec080df9846c7718c10b47c44d979083a439a9027d94fc8c2fa452a0af3e00d5cd492fb17b09052590128e55
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHG:BemTLkNdfE0pZrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

klsVnew.exe

Path C:\Windows\System\klsVnew.exe
Size 2.8MB
SHA256 2653a9d5c0596abc0020d0fee1a7d6669f522fd0d53bf29f75569ddebaf70efc
MD5 7164f1cc5f76016dbd93ace12337c254
SHA1 d7f2a8dd980acd6e8759f9c0a52ec288d31fd8e2
SHA512 6aa29741312cb409ddb21fb21fa50619ac7700fe5b4c9f7903b451abac7c1cace318c79f5395d295960f8aa03103db99572ece44f19b68c57cb55d15686a54ee
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHT:BemTLkNdfE0pZr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

mFCocvw.exe

Path C:\Windows\System\mFCocvw.exe
Size 2.8MB
SHA256 6dc83af8275bf1ca84690f8737420df3e76dfa3a408051f74c10a0e8e588c262
MD5 256f1a790d29b5c2f0522adc49aee530
SHA1 5e61fb4cfd9046a0423690897455068c5661d4e0
SHA512 4693db55a7f5249942480b7ebef195061e0c9ba1d693903df8503ccbb4558dcbaf2159f9445182deffdc006cc5659a08693452e36e270e8e764010476a574e71
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHf:BemTLkNdfE0pZrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

pEZhBlP.exe

Path C:\Windows\System\pEZhBlP.exe
Size 2.8MB
SHA256 ed031ae96b9ea3d241cdbc842fdf52429167f3e3cefad8bc4b7ae8929fad5e06
MD5 0e04ee6686c081b5d55ce246f354982c
SHA1 1f052fcb301fd6376add1777dfce430728fc972d
SHA512 fdb23dfb6e9a568131d857b7304043f5fe89bdd95b1b3fd0a7d5e5ce6cc8d9ddb699735b1654be9964b1a29ee499fd07ca4eb29e29c1c4c39072bd64a4bf9cd0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHV:BemTLkNdfE0pZrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvmliuw.exe

Path C:\Windows\System\pvmliuw.exe
Size 2.8MB
SHA256 6b1b56503add3ab313526c136b2a103afbac5ad8961465415152ee00cf7a2069
MD5 be6d925b6b6f9040fffaa09b3c78dbf1
SHA1 17c6f9a64da133563427cb5f8f674a40042b64d9
SHA512 39ece214b7b7167c4dac549f66263b6e11c1f38b14e95454d7b84fc916b447bd2fbf6482afaa2b142a3eca978643463b143c18562cfa5f60394df8dce15e668f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggH0:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

rsWKsuT.exe

Path C:\Windows\System\rsWKsuT.exe
Size 2.8MB
SHA256 d97efacbfb79a91cdfc59304ecf94e8a28665bd56270a1dc90f4709b1f2c6d05
MD5 c6bc2f7deb845577bd6af82299b3cef9
SHA1 6081f5db35d7cd08aca26e8dceb93b698d21098e
SHA512 230677b509c88d554e2c034ac4f0bcad833b3e73a503e375cfb7ad1ef51b935ab78b92ae4cba226ba8fb37efef471fd74d85dc78f9073c4df377397457e3ba01
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHP:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

sYRlAYg.exe

Path C:\Windows\System\sYRlAYg.exe
Size 2.8MB
SHA256 3e7b8a2fa61e01be3caefd9ddb4058186e394eecf678a36fbdb1805de774b55c
MD5 74b0f1c1e9112c4c61b4f67073a106c6
SHA1 986aeb6a6d5fb587c31fd12f44a7cfb7557222c1
SHA512 414b709f7f43a2eeef71cefeef445c6e1dbf7a7b1ec548a53dcd28118d729106b7870f3151acb97f71e2679b07feab7449492cb7dd77d567cfe223200522febf
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHH:BemTLkNdfE0pZrS
MD5 SHA1 SHA512 SSDEEP

Submit Download

urWWEDW.exe

Path C:\Windows\System\urWWEDW.exe
Size 2.8MB
SHA256 297fc82271f20f7d19b52b6e1e9d1c8fed6ab0735b0c6eaf6e0d992848af5b2a
MD5 7bccd32688fb1f59882166191c612b22
SHA1 5d79fc06a62ed3b555ddd4e7a474ccab736c3a34
SHA512 d7d3bb16268c32747d510b11c119eff78f74c23a4edb12cdd9611b820a2dd8392e74ea5c9e6432d34bd0be4be1c509864b6991858dba7ae12b1d47a966adb66e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggH+:BemTLkNdfE0pZrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

vDeMNBN.exe

Path C:\Windows\System\vDeMNBN.exe
Size 2.8MB
SHA256 4f2b5db5837c5abafa0a535695d6e042b7eb7bd6785b102e50790fcae8ddf9cc
MD5 aa964192392bb1377a93f02d9ea255bf
SHA1 484c75cebd63b24587147b36e966ddbab8a134ae
SHA512 e1f0858951b270f08eae262f3763e7c63cf63d27a80f3e858b7e74c449fdb6a7e03cd8453a96f2bf8789f60100a3a0b55333a1d8e4ce2f05d972a04458ff834c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHE:BemTLkNdfE0pZrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

xovyYna.exe

Path C:\Windows\System\xovyYna.exe
Size 2.8MB
SHA256 5d6c36b0512270f188fa4abdcd18bdae0f13d30ff3e21de81abd44ddfcfef7db
MD5 83bf8b316dbc215711dd70224e6ff9d0
SHA1 9d8f2fef5190f9d5bbfc780406c65b5d0b419133
SHA512 4611b9adf73e2b10f226b6bdc10bf2ec5084065dabbf54e89e073f5d3c9f29e21eeee6a41369d35d8b3ab5fff5f374d8694b6a13f15c8f19efa57929d66c063f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHs:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvJeGCC.exe

Path C:\Windows\System\xvJeGCC.exe
Size 2.8MB
SHA256 d47e64f10fbb05a237af4f102b4c8f5ecd6773b76e917fdcdb388ed739598086
MD5 c0b32fabb887f230569c1cf65d744fb8
SHA1 ec3629baf05c28972a15b9764c77ce6c7cd06cf3
SHA512 716d6a4a17ba758dc9ff448dae66e4a036c3304843435f3d96a3a4d8dcc9b8bfa44fb0e346ae7352308ac28307bc1c21b6e9ad1f750036629f4e719f1afbdea7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHq:BemTLkNdfE0pZrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

yGgEAtv.exe

Path C:\Windows\System\yGgEAtv.exe
Size 2.8MB
SHA256 248ea24de55db8098d407a81e0de245be2fd29954d7672d09fd6006319a3c3b2
MD5 24fa561b35429ab52ebee4fbeffbb7b7
SHA1 ba84feb0b2fe3bb6ab375cd384782fc20634bce0
SHA512 8db44af0fa5a91e033e87c38fdb451187fdcbe40ebb418a1a740d6a13ed058ea37073a2b74041c68040115b2153d9fedb86c7385f6af980f450d8dd0991abd3a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHT:BemTLkNdfE0pZru
MD5 SHA1 SHA512 SSDEEP

Submit Download

znrIvns.exe

Path C:\Windows\System\znrIvns.exe
Size 2.8MB
SHA256 738f5a50be945d05adce53166139d63222ecbda3349f816e1d73edef7b8f0f5c
MD5 84e756cea8977696ebd6a4f0f90efb2c
SHA1 40eee6dfe3f9a20f04efb693531aa73bd6d8b5a2
SHA512 77c2823b07c28ca7c79d6254949ade1028010fbde1cfcc5957774348501ca89271f3779551a9a7dd3fd96af436b7af2f8ee49d70b889e9d54f6e5d0e73a7c1d5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdIc1lNpEdxAggHA:BemTLkNdfE0pZr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-2186-0x00007FF617D20000-0x00007FF618074000-memory.dmp

Download

memory/432-180-0x00007FF617D20000-0x00007FF618074000-memory.dmp

Download

memory/432-2214-0x00007FF617D20000-0x00007FF618074000-memory.dmp

Download

memory/464-2210-0x00007FF7B4D10000-0x00007FF7B5064000-memory.dmp

Download

memory/464-2182-0x00007FF7B4D10000-0x00007FF7B5064000-memory.dmp

Download

memory/464-148-0x00007FF7B4D10000-0x00007FF7B5064000-memory.dmp

Download

memory/780-2212-0x00007FF73DB90000-0x00007FF73DEE4000-memory.dmp

Download

memory/780-2183-0x00007FF73DB90000-0x00007FF73DEE4000-memory.dmp

Download

memory/780-162-0x00007FF73DB90000-0x00007FF73DEE4000-memory.dmp

Download

memory/1036-174-0x00007FF664880000-0x00007FF664BD4000-memory.dmp

Download

memory/1036-2194-0x00007FF664880000-0x00007FF664BD4000-memory.dmp

Download

memory/1036-43-0x00007FF664880000-0x00007FF664BD4000-memory.dmp

Download

memory/1076-1-0x000001CF72DA0000-0x000001CF72DB0000-memory.dmp

Download

memory/1076-0-0x00007FF75AD50000-0x00007FF75B0A4000-memory.dmp

Download

memory/1076-89-0x00007FF75AD50000-0x00007FF75B0A4000-memory.dmp

Download

memory/1332-54-0x00007FF716860000-0x00007FF716BB4000-memory.dmp

Download

memory/1332-2196-0x00007FF716860000-0x00007FF716BB4000-memory.dmp

Download

memory/1428-2200-0x00007FF601C70000-0x00007FF601FC4000-memory.dmp

Download

memory/1428-100-0x00007FF601C70000-0x00007FF601FC4000-memory.dmp

Download

memory/1616-2142-0x00007FF6014A0000-0x00007FF6017F4000-memory.dmp

Download

memory/1616-137-0x00007FF6014A0000-0x00007FF6017F4000-memory.dmp

Download

memory/1616-2208-0x00007FF6014A0000-0x00007FF6017F4000-memory.dmp

Download

memory/2008-128-0x00007FF777320000-0x00007FF777674000-memory.dmp

Download

memory/2008-2207-0x00007FF777320000-0x00007FF777674000-memory.dmp

Download

memory/2008-1366-0x00007FF777320000-0x00007FF777674000-memory.dmp

Download

memory/2060-26-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp

Download

memory/2060-2191-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp

Download

memory/2060-144-0x00007FF74FDE0000-0x00007FF750134000-memory.dmp

Download

memory/2096-104-0x00007FF6CA0A0000-0x00007FF6CA3F4000-memory.dmp

Download

memory/2096-2203-0x00007FF6CA0A0000-0x00007FF6CA3F4000-memory.dmp

Download

memory/2136-2198-0x00007FF72C8E0000-0x00007FF72CC34000-memory.dmp

Download

memory/2136-93-0x00007FF72C8E0000-0x00007FF72CC34000-memory.dmp

Download

memory/2288-2199-0x00007FF74B9F0000-0x00007FF74BD44000-memory.dmp

Download

memory/2288-94-0x00007FF74B9F0000-0x00007FF74BD44000-memory.dmp

Download

memory/2560-107-0x00007FF699910000-0x00007FF699C64000-memory.dmp

Download

memory/2560-2202-0x00007FF699910000-0x00007FF699C64000-memory.dmp

Download

memory/2592-109-0x00007FF71FD30000-0x00007FF720084000-memory.dmp

Download

memory/2592-2189-0x00007FF71FD30000-0x00007FF720084000-memory.dmp

Download

memory/2592-14-0x00007FF71FD30000-0x00007FF720084000-memory.dmp

Download

memory/2600-2187-0x00007FF6302D0000-0x00007FF630624000-memory.dmp

Download

memory/2600-181-0x00007FF6302D0000-0x00007FF630624000-memory.dmp

Download

memory/2600-2215-0x00007FF6302D0000-0x00007FF630624000-memory.dmp

Download

memory/2804-58-0x00007FF7829E0000-0x00007FF782D34000-memory.dmp

Download

memory/2804-2195-0x00007FF7829E0000-0x00007FF782D34000-memory.dmp

Download

memory/2856-2204-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp

Download

memory/2856-115-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp

Download

memory/2856-1105-0x00007FF60FBD0000-0x00007FF60FF24000-memory.dmp

Download

memory/2880-156-0x00007FF654260000-0x00007FF6545B4000-memory.dmp

Download

memory/2880-2211-0x00007FF654260000-0x00007FF6545B4000-memory.dmp

Download

memory/2880-2184-0x00007FF654260000-0x00007FF6545B4000-memory.dmp

Download

memory/2916-116-0x00007FF742470000-0x00007FF7427C4000-memory.dmp

Download

memory/2916-2206-0x00007FF742470000-0x00007FF7427C4000-memory.dmp

Download

memory/2916-1106-0x00007FF742470000-0x00007FF7427C4000-memory.dmp

Download

memory/3148-2181-0x00007FF712B70000-0x00007FF712EC4000-memory.dmp

Download

memory/3148-2209-0x00007FF712B70000-0x00007FF712EC4000-memory.dmp

Download

memory/3148-138-0x00007FF712B70000-0x00007FF712EC4000-memory.dmp

Download

memory/3372-2201-0x00007FF773AF0000-0x00007FF773E44000-memory.dmp

Download

memory/3372-101-0x00007FF773AF0000-0x00007FF773E44000-memory.dmp

Download

memory/3728-2192-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp

Download

memory/3728-154-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp

Download

memory/3728-30-0x00007FF7F1080000-0x00007FF7F13D4000-memory.dmp

Download

memory/3972-168-0x00007FF76A5E0000-0x00007FF76A934000-memory.dmp

Download

memory/3972-2213-0x00007FF76A5E0000-0x00007FF76A934000-memory.dmp

Download

memory/3972-2185-0x00007FF76A5E0000-0x00007FF76A934000-memory.dmp

Download

memory/4184-2193-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp

Download

memory/4184-41-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp

Download

memory/4184-155-0x00007FF61C970000-0x00007FF61CCC4000-memory.dmp

Download

memory/4548-132-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp

Download

memory/4548-2190-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp

Download

memory/4548-16-0x00007FF60AC30000-0x00007FF60AF84000-memory.dmp

Download

memory/4812-193-0x00007FF667040000-0x00007FF667394000-memory.dmp

Download

memory/4812-60-0x00007FF667040000-0x00007FF667394000-memory.dmp

Download

memory/4812-2197-0x00007FF667040000-0x00007FF667394000-memory.dmp

Download

memory/4956-192-0x00007FF61B740000-0x00007FF61BA94000-memory.dmp

Download

memory/4956-2216-0x00007FF61B740000-0x00007FF61BA94000-memory.dmp

Download

memory/4964-2205-0x00007FF7AF0E0000-0x00007FF7AF434000-memory.dmp

Download

memory/4964-1685-0x00007FF7AF0E0000-0x00007FF7AF434000-memory.dmp

Download

memory/4964-120-0x00007FF7AF0E0000-0x00007FF7AF434000-memory.dmp

Download

memory/5100-2188-0x00007FF70D250000-0x00007FF70D5A4000-memory.dmp

Download

memory/5100-6-0x00007FF70D250000-0x00007FF70D5A4000-memory.dmp

Download

memory/5100-108-0x00007FF70D250000-0x00007FF70D5A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads