xmrig | 313b2ad9df5f34d5fe14413200e565c4e8d91dc75925e65abd94adf37bc50e10

Analysis

max time kernel
148s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
Size 2.2MB
Sample240518-e8v2vscb96
SHA256 313b2ad9df5f34d5fe14413200e565c4e8d91dc75925e65abd94adf37bc50e10
MD5 8e16d29096fd99a3f4ee15bb7777fcd0
SHA1 25d682a552af611e9798eb6aa34d70ec5ec06319
SHA512 49844bc25a113aa6f15ad6bfc4ea229eb7e163284bf726d437ac7d6be755213722e40768ce2cc21dede2d48e2f8a667988ddfec893544235941199304c1f7504
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx726:BemTLkNdfE0pZry
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2584-0-0x00007FF6B5F30000-0x00007FF6B6284000-memory.dmp	xmrig
behavioral2/files/0x000a00000002345c-6.dat	xmrig
behavioral2/files/0x0007000000023464-12.dat	xmrig
behavioral2/files/0x0007000000023465-17.dat	xmrig
behavioral2/memory/60-30-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-29.dat	xmrig
behavioral2/memory/3164-42-0x00007FF6C6F60000-0x00007FF6C72B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002346b-50.dat	xmrig
behavioral2/files/0x000700000002346a-53.dat	xmrig
behavioral2/memory/892-52-0x00007FF6BED40000-0x00007FF6BF094000-memory.dmp	xmrig
behavioral2/memory/4440-51-0x00007FF687170000-0x00007FF6874C4000-memory.dmp	xmrig
behavioral2/memory/4200-49-0x00007FF774F00000-0x00007FF775254000-memory.dmp	xmrig
behavioral2/files/0x0007000000023467-47.dat	xmrig
behavioral2/files/0x0007000000023469-41.dat	xmrig
behavioral2/memory/3140-40-0x00007FF6DDFB0000-0x00007FF6DE304000-memory.dmp	xmrig
behavioral2/files/0x0007000000023466-34.dat	xmrig
behavioral2/memory/1208-33-0x00007FF6535F0000-0x00007FF653944000-memory.dmp	xmrig
behavioral2/memory/3732-31-0x00007FF753D40000-0x00007FF754094000-memory.dmp	xmrig
behavioral2/files/0x000700000002346c-60.dat	xmrig
behavioral2/files/0x0008000000023461-66.dat	xmrig
behavioral2/memory/1952-64-0x00007FF6440D0000-0x00007FF644424000-memory.dmp	xmrig
behavioral2/files/0x000700000002346e-72.dat	xmrig
behavioral2/files/0x000700000002346f-76.dat	xmrig
behavioral2/files/0x0007000000023470-85.dat	xmrig
behavioral2/memory/4936-92-0x00007FF792200000-0x00007FF792554000-memory.dmp	xmrig
behavioral2/memory/2664-97-0x00007FF722760000-0x00007FF722AB4000-memory.dmp	xmrig
behavioral2/memory/1548-101-0x00007FF6D2E60000-0x00007FF6D31B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023473-102.dat	xmrig
behavioral2/memory/2004-100-0x00007FF6CD5B0000-0x00007FF6CD904000-memory.dmp	xmrig
behavioral2/files/0x0007000000023472-94.dat	xmrig
behavioral2/memory/4508-93-0x00007FF7DC610000-0x00007FF7DC964000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-91.dat	xmrig
behavioral2/memory/4976-90-0x00007FF6BD950000-0x00007FF6BDCA4000-memory.dmp	xmrig
behavioral2/memory/2540-70-0x00007FF750BB0000-0x00007FF750F04000-memory.dmp	xmrig
behavioral2/memory/2928-15-0x00007FF63B7F0000-0x00007FF63BB44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023474-110.dat	xmrig
behavioral2/memory/2720-124-0x00007FF751110000-0x00007FF751464000-memory.dmp	xmrig
behavioral2/files/0x0007000000023478-131.dat	xmrig
behavioral2/memory/2840-135-0x00007FF6A0920000-0x00007FF6A0C74000-memory.dmp	xmrig
behavioral2/files/0x000700000002347b-145.dat	xmrig
behavioral2/files/0x000700000002347d-152.dat	xmrig
behavioral2/memory/4240-164-0x00007FF73C640000-0x00007FF73C994000-memory.dmp	xmrig
behavioral2/memory/1584-168-0x00007FF6BF090000-0x00007FF6BF3E4000-memory.dmp	xmrig
behavioral2/memory/2028-170-0x00007FF68AE90000-0x00007FF68B1E4000-memory.dmp	xmrig
behavioral2/memory/4824-169-0x00007FF6D21B0000-0x00007FF6D2504000-memory.dmp	xmrig
behavioral2/memory/3732-165-0x00007FF753D40000-0x00007FF754094000-memory.dmp	xmrig
behavioral2/files/0x000700000002347e-163.dat	xmrig
behavioral2/files/0x0007000000023479-159.dat	xmrig
behavioral2/files/0x000700000002347a-158.dat	xmrig
behavioral2/files/0x000700000002347c-157.dat	xmrig
behavioral2/memory/3436-154-0x00007FF668770000-0x00007FF668AC4000-memory.dmp	xmrig
behavioral2/memory/1656-153-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	xmrig
behavioral2/memory/3476-148-0x00007FF7C8060000-0x00007FF7C83B4000-memory.dmp	xmrig
behavioral2/memory/1208-147-0x00007FF6535F0000-0x00007FF653944000-memory.dmp	xmrig
behavioral2/memory/60-146-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp	xmrig
behavioral2/memory/4868-139-0x00007FF7043E0000-0x00007FF704734000-memory.dmp	xmrig
behavioral2/files/0x0007000000023476-130.dat	xmrig
behavioral2/memory/1172-126-0x00007FF6C1230000-0x00007FF6C1584000-memory.dmp	xmrig
behavioral2/files/0x0007000000023477-123.dat	xmrig
behavioral2/memory/2584-117-0x00007FF6B5F30000-0x00007FF6B6284000-memory.dmp	xmrig
behavioral2/files/0x0007000000023475-113.dat	xmrig
behavioral2/files/0x000700000002347f-183.dat	xmrig
behavioral2/files/0x0007000000023480-191.dat	xmrig
behavioral2/files/0x0007000000023481-195.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2928	llEFYLA.exe
60	GbKMqin.exe
3164	etkqTJg.exe
3732	vKTHaRL.exe
1208	dIicfJa.exe
3140	EGGqyOB.exe
4200	zwMPoSx.exe
4440	NjvxcMO.exe
892	lGovqYe.exe
1952	CNlIeME.exe
2540	HWiiAzF.exe
4976	UoJVfrz.exe
4936	cZoViAb.exe
4508	vQTxxgp.exe
2664	ypGdcXf.exe
2004	jesXTIs.exe
1548	HMSGDUR.exe
2720	gxSggag.exe
1172	ixYgSiD.exe
3476	StvZEfi.exe
2840	GyRxUpt.exe
1656	rNDIBXD.exe
4868	PIWkITp.exe
1584	WZSsYZb.exe
3436	hrYhZGa.exe
4824	pEhMfSk.exe
4240	qLAQSfb.exe
2028	DKveNyF.exe
2772	cpWHynr.exe
4724	cBRvkii.exe
1268	hrigVoi.exe
628	HtsKHod.exe
4468	QUPXTRf.exe
2120	vgAfGGP.exe
756	MSKAGyY.exe
3880	nizFJlf.exe
4600	tthMxKq.exe
1780	UsviCUL.exe
616	eTOrBex.exe
3240	WpjmOWr.exe
3608	qmEOWCl.exe
2424	xVPlVAa.exe
4108	jJMCCzw.exe
552	kTlJlRZ.exe
3896	YKgnJiW.exe
4416	dfTQIKR.exe
5064	JkXNoBJ.exe
440	oIBTyyp.exe
220	ZsYIgEG.exe
920	PozMlNG.exe
4500	ixNcRjA.exe
3832	myKkvJD.exe
3384	uVwhQcl.exe
888	asjKPLH.exe
3024	EIlhWJV.exe
2856	VNElBeI.exe
1528	WvbwvMN.exe
2596	eJXQuHG.exe
4536	VbpjCdy.exe
4528	XUymKQp.exe
4560	OUVARow.exe
2400	lluvDmm.exe
4020	ZpNgADD.exe
4916	MwSGvVq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2584-0-0x00007FF6B5F30000-0x00007FF6B6284000-memory.dmp	upx
behavioral2/files/0x000a00000002345c-6.dat	upx
behavioral2/files/0x0007000000023464-12.dat	upx
behavioral2/files/0x0007000000023465-17.dat	upx
behavioral2/memory/60-30-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp	upx
behavioral2/files/0x0007000000023468-29.dat	upx
behavioral2/memory/3164-42-0x00007FF6C6F60000-0x00007FF6C72B4000-memory.dmp	upx
behavioral2/files/0x000700000002346b-50.dat	upx
behavioral2/files/0x000700000002346a-53.dat	upx
behavioral2/memory/892-52-0x00007FF6BED40000-0x00007FF6BF094000-memory.dmp	upx
behavioral2/memory/4440-51-0x00007FF687170000-0x00007FF6874C4000-memory.dmp	upx
behavioral2/memory/4200-49-0x00007FF774F00000-0x00007FF775254000-memory.dmp	upx
behavioral2/files/0x0007000000023467-47.dat	upx
behavioral2/files/0x0007000000023469-41.dat	upx
behavioral2/memory/3140-40-0x00007FF6DDFB0000-0x00007FF6DE304000-memory.dmp	upx
behavioral2/files/0x0007000000023466-34.dat	upx
behavioral2/memory/1208-33-0x00007FF6535F0000-0x00007FF653944000-memory.dmp	upx
behavioral2/memory/3732-31-0x00007FF753D40000-0x00007FF754094000-memory.dmp	upx
behavioral2/files/0x000700000002346c-60.dat	upx
behavioral2/files/0x0008000000023461-66.dat	upx
behavioral2/memory/1952-64-0x00007FF6440D0000-0x00007FF644424000-memory.dmp	upx
behavioral2/files/0x000700000002346e-72.dat	upx
behavioral2/files/0x000700000002346f-76.dat	upx
behavioral2/files/0x0007000000023470-85.dat	upx
behavioral2/memory/4936-92-0x00007FF792200000-0x00007FF792554000-memory.dmp	upx
behavioral2/memory/2664-97-0x00007FF722760000-0x00007FF722AB4000-memory.dmp	upx
behavioral2/memory/1548-101-0x00007FF6D2E60000-0x00007FF6D31B4000-memory.dmp	upx
behavioral2/files/0x0007000000023473-102.dat	upx
behavioral2/memory/2004-100-0x00007FF6CD5B0000-0x00007FF6CD904000-memory.dmp	upx
behavioral2/files/0x0007000000023472-94.dat	upx
behavioral2/memory/4508-93-0x00007FF7DC610000-0x00007FF7DC964000-memory.dmp	upx
behavioral2/files/0x0007000000023471-91.dat	upx
behavioral2/memory/4976-90-0x00007FF6BD950000-0x00007FF6BDCA4000-memory.dmp	upx
behavioral2/memory/2540-70-0x00007FF750BB0000-0x00007FF750F04000-memory.dmp	upx
behavioral2/memory/2928-15-0x00007FF63B7F0000-0x00007FF63BB44000-memory.dmp	upx
behavioral2/files/0x0007000000023474-110.dat	upx
behavioral2/memory/2720-124-0x00007FF751110000-0x00007FF751464000-memory.dmp	upx
behavioral2/files/0x0007000000023478-131.dat	upx
behavioral2/memory/2840-135-0x00007FF6A0920000-0x00007FF6A0C74000-memory.dmp	upx
behavioral2/files/0x000700000002347b-145.dat	upx
behavioral2/files/0x000700000002347d-152.dat	upx
behavioral2/memory/4240-164-0x00007FF73C640000-0x00007FF73C994000-memory.dmp	upx
behavioral2/memory/1584-168-0x00007FF6BF090000-0x00007FF6BF3E4000-memory.dmp	upx
behavioral2/memory/2028-170-0x00007FF68AE90000-0x00007FF68B1E4000-memory.dmp	upx
behavioral2/memory/4824-169-0x00007FF6D21B0000-0x00007FF6D2504000-memory.dmp	upx
behavioral2/memory/3732-165-0x00007FF753D40000-0x00007FF754094000-memory.dmp	upx
behavioral2/files/0x000700000002347e-163.dat	upx
behavioral2/files/0x0007000000023479-159.dat	upx
behavioral2/files/0x000700000002347a-158.dat	upx
behavioral2/files/0x000700000002347c-157.dat	upx
behavioral2/memory/3436-154-0x00007FF668770000-0x00007FF668AC4000-memory.dmp	upx
behavioral2/memory/1656-153-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	upx
behavioral2/memory/3476-148-0x00007FF7C8060000-0x00007FF7C83B4000-memory.dmp	upx
behavioral2/memory/1208-147-0x00007FF6535F0000-0x00007FF653944000-memory.dmp	upx
behavioral2/memory/60-146-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp	upx
behavioral2/memory/4868-139-0x00007FF7043E0000-0x00007FF704734000-memory.dmp	upx
behavioral2/files/0x0007000000023476-130.dat	upx
behavioral2/memory/1172-126-0x00007FF6C1230000-0x00007FF6C1584000-memory.dmp	upx
behavioral2/files/0x0007000000023477-123.dat	upx
behavioral2/memory/2584-117-0x00007FF6B5F30000-0x00007FF6B6284000-memory.dmp	upx
behavioral2/files/0x0007000000023475-113.dat	upx
behavioral2/files/0x000700000002347f-183.dat	upx
behavioral2/files/0x0007000000023480-191.dat	upx
behavioral2/files/0x0007000000023481-195.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZOyLCPS.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\LwOhjwz.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\lROduIh.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\AVdYdSk.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\vTfgTMo.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\nMMrnRG.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\vlXwCLC.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\SjgsBde.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\aJJGfru.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\SJEibJg.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\skFyoba.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZzOcMak.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\jpPSBLl.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\eTHsalu.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\OsIMRPx.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\AtYzbce.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\nTPnAQE.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\jnQwYYT.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\VZrggHO.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\rNDIBXD.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\oERrPbE.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\SBFxYtj.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\YalZMae.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\moCOMdk.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\kDopWXm.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\YNXWvZL.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\bYTMeiA.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\tsXoLbu.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\rvirYdV.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\GobbNxo.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\GkYWsCB.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\buRETzJ.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\tQYcHxJ.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\LdaRMyu.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\mZoCtMV.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\gXaoBZr.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\IvTvoQl.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\xqIICkd.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\caQMcsO.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\WVglemd.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\uiYeExD.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\NsmISwq.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\OyfEUCI.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\saWrEvS.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\gaXSmzh.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZNABmmo.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\KnJgoqI.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\bzUyAlF.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\ucUMbef.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\xtMXSpJ.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\trUuaDl.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\ynaCTAt.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\vNtHWUB.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\kFnGXAD.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\ajAFjnO.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\JBXUkxb.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\OHwoqmM.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\PozMlNG.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\qnEzTXI.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\DoEagtW.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\lczvklf.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\FIXOZhC.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\QTrtMZo.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
File created	C:\Windows\System\FpeEiCs.exe	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2928	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	84
PID 2584 wrote to memory of 2928	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	84
PID 2584 wrote to memory of 60	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	85
PID 2584 wrote to memory of 60	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	85
PID 2584 wrote to memory of 3164	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	86
PID 2584 wrote to memory of 3164	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	86
PID 2584 wrote to memory of 3732	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	87
PID 2584 wrote to memory of 3732	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	87
PID 2584 wrote to memory of 1208	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	88
PID 2584 wrote to memory of 1208	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	88
PID 2584 wrote to memory of 3140	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	89
PID 2584 wrote to memory of 3140	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	89
PID 2584 wrote to memory of 4200	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	90
PID 2584 wrote to memory of 4200	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	90
PID 2584 wrote to memory of 4440	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	91
PID 2584 wrote to memory of 4440	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	91
PID 2584 wrote to memory of 892	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	92
PID 2584 wrote to memory of 892	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	92
PID 2584 wrote to memory of 1952	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	93
PID 2584 wrote to memory of 1952	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	93
PID 2584 wrote to memory of 2540	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	94
PID 2584 wrote to memory of 2540	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	94
PID 2584 wrote to memory of 4976	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	95
PID 2584 wrote to memory of 4976	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	95
PID 2584 wrote to memory of 4936	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	96
PID 2584 wrote to memory of 4936	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	96
PID 2584 wrote to memory of 4508	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	97
PID 2584 wrote to memory of 4508	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	97
PID 2584 wrote to memory of 2664	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	98
PID 2584 wrote to memory of 2664	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	98
PID 2584 wrote to memory of 2004	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	99
PID 2584 wrote to memory of 2004	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	99
PID 2584 wrote to memory of 1548	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	100
PID 2584 wrote to memory of 1548	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	100
PID 2584 wrote to memory of 2720	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	103
PID 2584 wrote to memory of 2720	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	103
PID 2584 wrote to memory of 1172	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	104
PID 2584 wrote to memory of 1172	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	104
PID 2584 wrote to memory of 3476	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	105
PID 2584 wrote to memory of 3476	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	105
PID 2584 wrote to memory of 2840	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	106
PID 2584 wrote to memory of 2840	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	106
PID 2584 wrote to memory of 1656	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	107
PID 2584 wrote to memory of 1656	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	107
PID 2584 wrote to memory of 4868	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	108
PID 2584 wrote to memory of 4868	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	108
PID 2584 wrote to memory of 1584	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	109
PID 2584 wrote to memory of 1584	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	109
PID 2584 wrote to memory of 3436	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	110
PID 2584 wrote to memory of 3436	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	110
PID 2584 wrote to memory of 4824	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	111
PID 2584 wrote to memory of 4824	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	111
PID 2584 wrote to memory of 4240	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	112
PID 2584 wrote to memory of 4240	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	112
PID 2584 wrote to memory of 2028	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	113
PID 2584 wrote to memory of 2028	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	113
PID 2584 wrote to memory of 2772	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	114
PID 2584 wrote to memory of 2772	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	114
PID 2584 wrote to memory of 4724	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	116
PID 2584 wrote to memory of 4724	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	116
PID 2584 wrote to memory of 1268	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	118
PID 2584 wrote to memory of 1268	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	118
PID 2584 wrote to memory of 628	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	119
PID 2584 wrote to memory of 628	2584	8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe	119

C:\Users\Admin\AppData\Local\Temp\8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e16d29096fd99a3f4ee15bb7777fcd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\System\llEFYLA.exe
  C:\Windows\System\llEFYLA.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\GbKMqin.exe
  C:\Windows\System\GbKMqin.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\etkqTJg.exe
  C:\Windows\System\etkqTJg.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\vKTHaRL.exe
  C:\Windows\System\vKTHaRL.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\dIicfJa.exe
  C:\Windows\System\dIicfJa.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\EGGqyOB.exe
  C:\Windows\System\EGGqyOB.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\zwMPoSx.exe
  C:\Windows\System\zwMPoSx.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\NjvxcMO.exe
  C:\Windows\System\NjvxcMO.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\lGovqYe.exe
  C:\Windows\System\lGovqYe.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\CNlIeME.exe
  C:\Windows\System\CNlIeME.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\HWiiAzF.exe
  C:\Windows\System\HWiiAzF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\UoJVfrz.exe
  C:\Windows\System\UoJVfrz.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\cZoViAb.exe
  C:\Windows\System\cZoViAb.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\vQTxxgp.exe
  C:\Windows\System\vQTxxgp.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\ypGdcXf.exe
  C:\Windows\System\ypGdcXf.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\jesXTIs.exe
  C:\Windows\System\jesXTIs.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\HMSGDUR.exe
  C:\Windows\System\HMSGDUR.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\gxSggag.exe
  C:\Windows\System\gxSggag.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ixYgSiD.exe
  C:\Windows\System\ixYgSiD.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\StvZEfi.exe
  C:\Windows\System\StvZEfi.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\GyRxUpt.exe
  C:\Windows\System\GyRxUpt.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\rNDIBXD.exe
  C:\Windows\System\rNDIBXD.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\PIWkITp.exe
  C:\Windows\System\PIWkITp.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\WZSsYZb.exe
  C:\Windows\System\WZSsYZb.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\hrYhZGa.exe
  C:\Windows\System\hrYhZGa.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\pEhMfSk.exe
  C:\Windows\System\pEhMfSk.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\qLAQSfb.exe
  C:\Windows\System\qLAQSfb.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\DKveNyF.exe
  C:\Windows\System\DKveNyF.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\cpWHynr.exe
  C:\Windows\System\cpWHynr.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\cBRvkii.exe
  C:\Windows\System\cBRvkii.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\hrigVoi.exe
  C:\Windows\System\hrigVoi.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\HtsKHod.exe
  C:\Windows\System\HtsKHod.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\QUPXTRf.exe
  C:\Windows\System\QUPXTRf.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\vgAfGGP.exe
  C:\Windows\System\vgAfGGP.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\MSKAGyY.exe
  C:\Windows\System\MSKAGyY.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\nizFJlf.exe
  C:\Windows\System\nizFJlf.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\tthMxKq.exe
  C:\Windows\System\tthMxKq.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\UsviCUL.exe
  C:\Windows\System\UsviCUL.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\eTOrBex.exe
  C:\Windows\System\eTOrBex.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\WpjmOWr.exe
  C:\Windows\System\WpjmOWr.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\qmEOWCl.exe
  C:\Windows\System\qmEOWCl.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\xVPlVAa.exe
  C:\Windows\System\xVPlVAa.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\jJMCCzw.exe
  C:\Windows\System\jJMCCzw.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\kTlJlRZ.exe
  C:\Windows\System\kTlJlRZ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\YKgnJiW.exe
  C:\Windows\System\YKgnJiW.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\dfTQIKR.exe
  C:\Windows\System\dfTQIKR.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\JkXNoBJ.exe
  C:\Windows\System\JkXNoBJ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\oIBTyyp.exe
  C:\Windows\System\oIBTyyp.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\ZsYIgEG.exe
  C:\Windows\System\ZsYIgEG.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\PozMlNG.exe
  C:\Windows\System\PozMlNG.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ixNcRjA.exe
  C:\Windows\System\ixNcRjA.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\myKkvJD.exe
  C:\Windows\System\myKkvJD.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\uVwhQcl.exe
  C:\Windows\System\uVwhQcl.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\asjKPLH.exe
  C:\Windows\System\asjKPLH.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\EIlhWJV.exe
  C:\Windows\System\EIlhWJV.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\VNElBeI.exe
  C:\Windows\System\VNElBeI.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WvbwvMN.exe
  C:\Windows\System\WvbwvMN.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\eJXQuHG.exe
  C:\Windows\System\eJXQuHG.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VbpjCdy.exe
  C:\Windows\System\VbpjCdy.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\XUymKQp.exe
  C:\Windows\System\XUymKQp.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\OUVARow.exe
  C:\Windows\System\OUVARow.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\lluvDmm.exe
  C:\Windows\System\lluvDmm.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ZpNgADD.exe
  C:\Windows\System\ZpNgADD.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\MwSGvVq.exe
  C:\Windows\System\MwSGvVq.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\vNtHWUB.exe
  C:\Windows\System\vNtHWUB.exe
  2⤵
  PID:3372
- C:\Windows\System\BdZHUQF.exe
  C:\Windows\System\BdZHUQF.exe
  2⤵
  PID:4996
- C:\Windows\System\aLhrKSc.exe
  C:\Windows\System\aLhrKSc.exe
  2⤵
  PID:3000
- C:\Windows\System\DcItaVq.exe
  C:\Windows\System\DcItaVq.exe
  2⤵
  PID:3916
- C:\Windows\System\GdRFcNr.exe
  C:\Windows\System\GdRFcNr.exe
  2⤵
  PID:1324
- C:\Windows\System\nsTNgbW.exe
  C:\Windows\System\nsTNgbW.exe
  2⤵
  PID:4680
- C:\Windows\System\ozNZjWd.exe
  C:\Windows\System\ozNZjWd.exe
  2⤵
  PID:1984
- C:\Windows\System\GGfqTRp.exe
  C:\Windows\System\GGfqTRp.exe
  2⤵
  PID:4192
- C:\Windows\System\MJXlkSA.exe
  C:\Windows\System\MJXlkSA.exe
  2⤵
  PID:1632
- C:\Windows\System\VUaIiEc.exe
  C:\Windows\System\VUaIiEc.exe
  2⤵
  PID:2960
- C:\Windows\System\swbfSRK.exe
  C:\Windows\System\swbfSRK.exe
  2⤵
  PID:3664
- C:\Windows\System\DginIOf.exe
  C:\Windows\System\DginIOf.exe
  2⤵
  PID:5144
- C:\Windows\System\xRqVJEP.exe
  C:\Windows\System\xRqVJEP.exe
  2⤵
  PID:5180
- C:\Windows\System\qBayeFv.exe
  C:\Windows\System\qBayeFv.exe
  2⤵
  PID:5200
- C:\Windows\System\LOwiwln.exe
  C:\Windows\System\LOwiwln.exe
  2⤵
  PID:5232
- C:\Windows\System\gkdKrQC.exe
  C:\Windows\System\gkdKrQC.exe
  2⤵
  PID:5288
- C:\Windows\System\KYmTYik.exe
  C:\Windows\System\KYmTYik.exe
  2⤵
  PID:5304
- C:\Windows\System\mZoCtMV.exe
  C:\Windows\System\mZoCtMV.exe
  2⤵
  PID:5332
- C:\Windows\System\pLDdxpC.exe
  C:\Windows\System\pLDdxpC.exe
  2⤵
  PID:5364
- C:\Windows\System\dLlYcqD.exe
  C:\Windows\System\dLlYcqD.exe
  2⤵
  PID:5400
- C:\Windows\System\oYaWaPF.exe
  C:\Windows\System\oYaWaPF.exe
  2⤵
  PID:5432
- C:\Windows\System\cXrIduI.exe
  C:\Windows\System\cXrIduI.exe
  2⤵
  PID:5460
- C:\Windows\System\TMjFSZN.exe
  C:\Windows\System\TMjFSZN.exe
  2⤵
  PID:5496
- C:\Windows\System\dmlOJKr.exe
  C:\Windows\System\dmlOJKr.exe
  2⤵
  PID:5516
- C:\Windows\System\rDnwqmd.exe
  C:\Windows\System\rDnwqmd.exe
  2⤵
  PID:5544
- C:\Windows\System\LqafKit.exe
  C:\Windows\System\LqafKit.exe
  2⤵
  PID:5572
- C:\Windows\System\SEpAoap.exe
  C:\Windows\System\SEpAoap.exe
  2⤵
  PID:5600
- C:\Windows\System\QeblRkc.exe
  C:\Windows\System\QeblRkc.exe
  2⤵
  PID:5628
- C:\Windows\System\jCbAvrz.exe
  C:\Windows\System\jCbAvrz.exe
  2⤵
  PID:5660
- C:\Windows\System\OyfEUCI.exe
  C:\Windows\System\OyfEUCI.exe
  2⤵
  PID:5684
- C:\Windows\System\saWrEvS.exe
  C:\Windows\System\saWrEvS.exe
  2⤵
  PID:5712
- C:\Windows\System\JDAKYbR.exe
  C:\Windows\System\JDAKYbR.exe
  2⤵
  PID:5740
- C:\Windows\System\OYYdPvQ.exe
  C:\Windows\System\OYYdPvQ.exe
  2⤵
  PID:5772
- C:\Windows\System\ArMAjVC.exe
  C:\Windows\System\ArMAjVC.exe
  2⤵
  PID:5800
- C:\Windows\System\lczvklf.exe
  C:\Windows\System\lczvklf.exe
  2⤵
  PID:5828
- C:\Windows\System\fkfYwRY.exe
  C:\Windows\System\fkfYwRY.exe
  2⤵
  PID:5856
- C:\Windows\System\fVKxnJi.exe
  C:\Windows\System\fVKxnJi.exe
  2⤵
  PID:5884
- C:\Windows\System\kLwrzbA.exe
  C:\Windows\System\kLwrzbA.exe
  2⤵
  PID:5912
- C:\Windows\System\bINLcdz.exe
  C:\Windows\System\bINLcdz.exe
  2⤵
  PID:5940
- C:\Windows\System\eSDUDZM.exe
  C:\Windows\System\eSDUDZM.exe
  2⤵
  PID:5976
- C:\Windows\System\UsFMlXf.exe
  C:\Windows\System\UsFMlXf.exe
  2⤵
  PID:6016
- C:\Windows\System\UjTlKHa.exe
  C:\Windows\System\UjTlKHa.exe
  2⤵
  PID:6052
- C:\Windows\System\QygPGxV.exe
  C:\Windows\System\QygPGxV.exe
  2⤵
  PID:6084
- C:\Windows\System\RaDvvrr.exe
  C:\Windows\System\RaDvvrr.exe
  2⤵
  PID:6116
- C:\Windows\System\AgmorAQ.exe
  C:\Windows\System\AgmorAQ.exe
  2⤵
  PID:5128
- C:\Windows\System\wuLnBaG.exe
  C:\Windows\System\wuLnBaG.exe
  2⤵
  PID:2956
- C:\Windows\System\EMILPki.exe
  C:\Windows\System\EMILPki.exe
  2⤵
  PID:4836
- C:\Windows\System\FhZefuj.exe
  C:\Windows\System\FhZefuj.exe
  2⤵
  PID:5296
- C:\Windows\System\ykntDHz.exe
  C:\Windows\System\ykntDHz.exe
  2⤵
  PID:5384
- C:\Windows\System\Xpyvxkt.exe
  C:\Windows\System\Xpyvxkt.exe
  2⤵
  PID:5452
- C:\Windows\System\MbtmEUk.exe
  C:\Windows\System\MbtmEUk.exe
  2⤵
  PID:5512
- C:\Windows\System\TtrYJlg.exe
  C:\Windows\System\TtrYJlg.exe
  2⤵
  PID:5568
- C:\Windows\System\pqvqzqg.exe
  C:\Windows\System\pqvqzqg.exe
  2⤵
  PID:5624
- C:\Windows\System\gaXSmzh.exe
  C:\Windows\System\gaXSmzh.exe
  2⤵
  PID:5696
- C:\Windows\System\kmMldSs.exe
  C:\Windows\System\kmMldSs.exe
  2⤵
  PID:5784
- C:\Windows\System\HLYFyRV.exe
  C:\Windows\System\HLYFyRV.exe
  2⤵
  PID:5840
- C:\Windows\System\PdYVRbL.exe
  C:\Windows\System\PdYVRbL.exe
  2⤵
  PID:5908
- C:\Windows\System\kSDPrDq.exe
  C:\Windows\System\kSDPrDq.exe
  2⤵
  PID:6012
- C:\Windows\System\xGJXhwr.exe
  C:\Windows\System\xGJXhwr.exe
  2⤵
  PID:6096
- C:\Windows\System\HTQrrRD.exe
  C:\Windows\System\HTQrrRD.exe
  2⤵
  PID:5156
- C:\Windows\System\QTzLhKi.exe
  C:\Windows\System\QTzLhKi.exe
  2⤵
  PID:5300
- C:\Windows\System\SgeaERo.exe
  C:\Windows\System\SgeaERo.exe
  2⤵
  PID:5556
- C:\Windows\System\FxZlpMj.exe
  C:\Windows\System\FxZlpMj.exe
  2⤵
  PID:5676
- C:\Windows\System\rpYNysz.exe
  C:\Windows\System\rpYNysz.exe
  2⤵
  PID:5824
- C:\Windows\System\riahiva.exe
  C:\Windows\System\riahiva.exe
  2⤵
  PID:5996
- C:\Windows\System\YSpeMNp.exe
  C:\Windows\System\YSpeMNp.exe
  2⤵
  PID:5212
- C:\Windows\System\qnEzTXI.exe
  C:\Windows\System\qnEzTXI.exe
  2⤵
  PID:5620
- C:\Windows\System\NaAobyL.exe
  C:\Windows\System\NaAobyL.exe
  2⤵
  PID:5972
- C:\Windows\System\vkhQPgf.exe
  C:\Windows\System\vkhQPgf.exe
  2⤵
  PID:5936
- C:\Windows\System\BzgKHzJ.exe
  C:\Windows\System\BzgKHzJ.exe
  2⤵
  PID:6164
- C:\Windows\System\ZOyLCPS.exe
  C:\Windows\System\ZOyLCPS.exe
  2⤵
  PID:6192
- C:\Windows\System\IQIaEOw.exe
  C:\Windows\System\IQIaEOw.exe
  2⤵
  PID:6224
- C:\Windows\System\ShOpnJd.exe
  C:\Windows\System\ShOpnJd.exe
  2⤵
  PID:6252
- C:\Windows\System\VFcEVrA.exe
  C:\Windows\System\VFcEVrA.exe
  2⤵
  PID:6280
- C:\Windows\System\JQicXzG.exe
  C:\Windows\System\JQicXzG.exe
  2⤵
  PID:6308
- C:\Windows\System\klizygc.exe
  C:\Windows\System\klizygc.exe
  2⤵
  PID:6336
- C:\Windows\System\znlofDb.exe
  C:\Windows\System\znlofDb.exe
  2⤵
  PID:6364
- C:\Windows\System\QaYnjJA.exe
  C:\Windows\System\QaYnjJA.exe
  2⤵
  PID:6392
- C:\Windows\System\bSgEepJ.exe
  C:\Windows\System\bSgEepJ.exe
  2⤵
  PID:6420
- C:\Windows\System\VnRYeAA.exe
  C:\Windows\System\VnRYeAA.exe
  2⤵
  PID:6436
- C:\Windows\System\UPlshHC.exe
  C:\Windows\System\UPlshHC.exe
  2⤵
  PID:6452
- C:\Windows\System\rXsPspy.exe
  C:\Windows\System\rXsPspy.exe
  2⤵
  PID:6492
- C:\Windows\System\ymPqjsg.exe
  C:\Windows\System\ymPqjsg.exe
  2⤵
  PID:6532
- C:\Windows\System\veuIRLC.exe
  C:\Windows\System\veuIRLC.exe
  2⤵
  PID:6560
- C:\Windows\System\rQkLPxA.exe
  C:\Windows\System\rQkLPxA.exe
  2⤵
  PID:6592
- C:\Windows\System\vlXwCLC.exe
  C:\Windows\System\vlXwCLC.exe
  2⤵
  PID:6620
- C:\Windows\System\SjgsBde.exe
  C:\Windows\System\SjgsBde.exe
  2⤵
  PID:6648
- C:\Windows\System\GlVYUuW.exe
  C:\Windows\System\GlVYUuW.exe
  2⤵
  PID:6680
- C:\Windows\System\XfqwZoe.exe
  C:\Windows\System\XfqwZoe.exe
  2⤵
  PID:6712
- C:\Windows\System\NRRStPF.exe
  C:\Windows\System\NRRStPF.exe
  2⤵
  PID:6740
- C:\Windows\System\OiQABJy.exe
  C:\Windows\System\OiQABJy.exe
  2⤵
  PID:6780
- C:\Windows\System\sfrJWrm.exe
  C:\Windows\System\sfrJWrm.exe
  2⤵
  PID:6796
- C:\Windows\System\vaqBfyW.exe
  C:\Windows\System\vaqBfyW.exe
  2⤵
  PID:6824
- C:\Windows\System\KzxJswV.exe
  C:\Windows\System\KzxJswV.exe
  2⤵
  PID:6856
- C:\Windows\System\OqyQkxT.exe
  C:\Windows\System\OqyQkxT.exe
  2⤵
  PID:6884
- C:\Windows\System\sLaVNWy.exe
  C:\Windows\System\sLaVNWy.exe
  2⤵
  PID:6912
- C:\Windows\System\jFJAlrD.exe
  C:\Windows\System\jFJAlrD.exe
  2⤵
  PID:6940
- C:\Windows\System\yVZZDlI.exe
  C:\Windows\System\yVZZDlI.exe
  2⤵
  PID:6968
- C:\Windows\System\INvdAjs.exe
  C:\Windows\System\INvdAjs.exe
  2⤵
  PID:6996
- C:\Windows\System\vmbrDwK.exe
  C:\Windows\System\vmbrDwK.exe
  2⤵
  PID:7024
- C:\Windows\System\hLlUnBW.exe
  C:\Windows\System\hLlUnBW.exe
  2⤵
  PID:7052
- C:\Windows\System\XuRgMTA.exe
  C:\Windows\System\XuRgMTA.exe
  2⤵
  PID:7084
- C:\Windows\System\XtMYoan.exe
  C:\Windows\System\XtMYoan.exe
  2⤵
  PID:7112
- C:\Windows\System\GQFiDgh.exe
  C:\Windows\System\GQFiDgh.exe
  2⤵
  PID:7140
- C:\Windows\System\NumOAle.exe
  C:\Windows\System\NumOAle.exe
  2⤵
  PID:5796
- C:\Windows\System\cnFtmfG.exe
  C:\Windows\System\cnFtmfG.exe
  2⤵
  PID:6208
- C:\Windows\System\mFuYEvd.exe
  C:\Windows\System\mFuYEvd.exe
  2⤵
  PID:6268
- C:\Windows\System\mlVBZAr.exe
  C:\Windows\System\mlVBZAr.exe
  2⤵
  PID:6328
- C:\Windows\System\IvWBcKF.exe
  C:\Windows\System\IvWBcKF.exe
  2⤵
  PID:6404
- C:\Windows\System\aSzDrEl.exe
  C:\Windows\System\aSzDrEl.exe
  2⤵
  PID:6464
- C:\Windows\System\xNlZbpA.exe
  C:\Windows\System\xNlZbpA.exe
  2⤵
  PID:6544
- C:\Windows\System\LLnUrqY.exe
  C:\Windows\System\LLnUrqY.exe
  2⤵
  PID:6612
- C:\Windows\System\gffMzpV.exe
  C:\Windows\System\gffMzpV.exe
  2⤵
  PID:6672
- C:\Windows\System\LwOhjwz.exe
  C:\Windows\System\LwOhjwz.exe
  2⤵
  PID:6756
- C:\Windows\System\HMqkBlk.exe
  C:\Windows\System\HMqkBlk.exe
  2⤵
  PID:6816
- C:\Windows\System\pYIlYPQ.exe
  C:\Windows\System\pYIlYPQ.exe
  2⤵
  PID:6876
- C:\Windows\System\cZtOJpr.exe
  C:\Windows\System\cZtOJpr.exe
  2⤵
  PID:6936
- C:\Windows\System\wgvitBs.exe
  C:\Windows\System\wgvitBs.exe
  2⤵
  PID:7008
- C:\Windows\System\GPCKsmE.exe
  C:\Windows\System\GPCKsmE.exe
  2⤵
  PID:7076
- C:\Windows\System\FfFJRvC.exe
  C:\Windows\System\FfFJRvC.exe
  2⤵
  PID:7132
- C:\Windows\System\butosYC.exe
  C:\Windows\System\butosYC.exe
  2⤵
  PID:6188
- C:\Windows\System\zsBFHAH.exe
  C:\Windows\System\zsBFHAH.exe
  2⤵
  PID:6360
- C:\Windows\System\ikbSvTU.exe
  C:\Windows\System\ikbSvTU.exe
  2⤵
  PID:6512
- C:\Windows\System\yqteMIY.exe
  C:\Windows\System\yqteMIY.exe
  2⤵
  PID:6676
- C:\Windows\System\KkexBMr.exe
  C:\Windows\System\KkexBMr.exe
  2⤵
  PID:6808
- C:\Windows\System\SDmChuX.exe
  C:\Windows\System\SDmChuX.exe
  2⤵
  PID:6984
- C:\Windows\System\EttWXfR.exe
  C:\Windows\System\EttWXfR.exe
  2⤵
  PID:7060
- C:\Windows\System\BAAYMnH.exe
  C:\Windows\System\BAAYMnH.exe
  2⤵
  PID:6332
- C:\Windows\System\djadRMO.exe
  C:\Windows\System\djadRMO.exe
  2⤵
  PID:6732
- C:\Windows\System\tsXoLbu.exe
  C:\Windows\System\tsXoLbu.exe
  2⤵
  PID:7104
- C:\Windows\System\jBQbXbk.exe
  C:\Windows\System\jBQbXbk.exe
  2⤵
  PID:6664
- C:\Windows\System\ZoUgcuG.exe
  C:\Windows\System\ZoUgcuG.exe
  2⤵
  PID:7048
- C:\Windows\System\qajLUXr.exe
  C:\Windows\System\qajLUXr.exe
  2⤵
  PID:7196
- C:\Windows\System\xqIICkd.exe
  C:\Windows\System\xqIICkd.exe
  2⤵
  PID:7224
- C:\Windows\System\smXCyHN.exe
  C:\Windows\System\smXCyHN.exe
  2⤵
  PID:7252
- C:\Windows\System\TfelHbP.exe
  C:\Windows\System\TfelHbP.exe
  2⤵
  PID:7288
- C:\Windows\System\aJJGfru.exe
  C:\Windows\System\aJJGfru.exe
  2⤵
  PID:7316
- C:\Windows\System\tEdjuSH.exe
  C:\Windows\System\tEdjuSH.exe
  2⤵
  PID:7344
- C:\Windows\System\nOObuhO.exe
  C:\Windows\System\nOObuhO.exe
  2⤵
  PID:7372
- C:\Windows\System\Pttslnf.exe
  C:\Windows\System\Pttslnf.exe
  2⤵
  PID:7400
- C:\Windows\System\CEeObna.exe
  C:\Windows\System\CEeObna.exe
  2⤵
  PID:7428
- C:\Windows\System\RQFidiZ.exe
  C:\Windows\System\RQFidiZ.exe
  2⤵
  PID:7456
- C:\Windows\System\CHNGckE.exe
  C:\Windows\System\CHNGckE.exe
  2⤵
  PID:7484
- C:\Windows\System\TtVuDRR.exe
  C:\Windows\System\TtVuDRR.exe
  2⤵
  PID:7512
- C:\Windows\System\IHszHNI.exe
  C:\Windows\System\IHszHNI.exe
  2⤵
  PID:7540
- C:\Windows\System\CbxnaPe.exe
  C:\Windows\System\CbxnaPe.exe
  2⤵
  PID:7568
- C:\Windows\System\fMxRLvd.exe
  C:\Windows\System\fMxRLvd.exe
  2⤵
  PID:7596
- C:\Windows\System\jZrVrSe.exe
  C:\Windows\System\jZrVrSe.exe
  2⤵
  PID:7624
- C:\Windows\System\DyBbWIX.exe
  C:\Windows\System\DyBbWIX.exe
  2⤵
  PID:7652
- C:\Windows\System\BnWNbyq.exe
  C:\Windows\System\BnWNbyq.exe
  2⤵
  PID:7680
- C:\Windows\System\YqsXMcl.exe
  C:\Windows\System\YqsXMcl.exe
  2⤵
  PID:7708
- C:\Windows\System\qmkRebl.exe
  C:\Windows\System\qmkRebl.exe
  2⤵
  PID:7736
- C:\Windows\System\KnZZTEk.exe
  C:\Windows\System\KnZZTEk.exe
  2⤵
  PID:7764
- C:\Windows\System\xjSXKna.exe
  C:\Windows\System\xjSXKna.exe
  2⤵
  PID:7792
- C:\Windows\System\UrFOUtb.exe
  C:\Windows\System\UrFOUtb.exe
  2⤵
  PID:7824
- C:\Windows\System\WbmmcaR.exe
  C:\Windows\System\WbmmcaR.exe
  2⤵
  PID:7852
- C:\Windows\System\gFWNayx.exe
  C:\Windows\System\gFWNayx.exe
  2⤵
  PID:7880
- C:\Windows\System\GtvApvT.exe
  C:\Windows\System\GtvApvT.exe
  2⤵
  PID:7908
- C:\Windows\System\mJhucZm.exe
  C:\Windows\System\mJhucZm.exe
  2⤵
  PID:7936
- C:\Windows\System\DpRTvRG.exe
  C:\Windows\System\DpRTvRG.exe
  2⤵
  PID:7964
- C:\Windows\System\rSdkzxr.exe
  C:\Windows\System\rSdkzxr.exe
  2⤵
  PID:7992
- C:\Windows\System\tQHNKcT.exe
  C:\Windows\System\tQHNKcT.exe
  2⤵
  PID:8020
- C:\Windows\System\rlMWrCi.exe
  C:\Windows\System\rlMWrCi.exe
  2⤵
  PID:8048
- C:\Windows\System\kojkmIl.exe
  C:\Windows\System\kojkmIl.exe
  2⤵
  PID:8076
- C:\Windows\System\fEuWeES.exe
  C:\Windows\System\fEuWeES.exe
  2⤵
  PID:8104
- C:\Windows\System\QNdDlud.exe
  C:\Windows\System\QNdDlud.exe
  2⤵
  PID:8132
- C:\Windows\System\ZzuilhZ.exe
  C:\Windows\System\ZzuilhZ.exe
  2⤵
  PID:8160
- C:\Windows\System\ndsjqPa.exe
  C:\Windows\System\ndsjqPa.exe
  2⤵
  PID:8188
- C:\Windows\System\ZEeCQSy.exe
  C:\Windows\System\ZEeCQSy.exe
  2⤵
  PID:7216
- C:\Windows\System\guQrNiV.exe
  C:\Windows\System\guQrNiV.exe
  2⤵
  PID:7284
- C:\Windows\System\ZqtLtlt.exe
  C:\Windows\System\ZqtLtlt.exe
  2⤵
  PID:7364
- C:\Windows\System\ZzOcMak.exe
  C:\Windows\System\ZzOcMak.exe
  2⤵
  PID:7424
- C:\Windows\System\JhIMMjW.exe
  C:\Windows\System\JhIMMjW.exe
  2⤵
  PID:7496
- C:\Windows\System\etfcKNd.exe
  C:\Windows\System\etfcKNd.exe
  2⤵
  PID:7560
- C:\Windows\System\dtxkTRl.exe
  C:\Windows\System\dtxkTRl.exe
  2⤵
  PID:7620
- C:\Windows\System\JsPhZfB.exe
  C:\Windows\System\JsPhZfB.exe
  2⤵
  PID:7692
- C:\Windows\System\unWvTQg.exe
  C:\Windows\System\unWvTQg.exe
  2⤵
  PID:7756
- C:\Windows\System\UBszxEG.exe
  C:\Windows\System\UBszxEG.exe
  2⤵
  PID:7820
- C:\Windows\System\GmodhyD.exe
  C:\Windows\System\GmodhyD.exe
  2⤵
  PID:7812
- C:\Windows\System\fflvYbp.exe
  C:\Windows\System\fflvYbp.exe
  2⤵
  PID:7948
- C:\Windows\System\EeANGvG.exe
  C:\Windows\System\EeANGvG.exe
  2⤵
  PID:8012
- C:\Windows\System\cueUseo.exe
  C:\Windows\System\cueUseo.exe
  2⤵
  PID:8068
- C:\Windows\System\bJkszHC.exe
  C:\Windows\System\bJkszHC.exe
  2⤵
  PID:8144
- C:\Windows\System\oRArSeW.exe
  C:\Windows\System\oRArSeW.exe
  2⤵
  PID:7208
- C:\Windows\System\RJFgHcj.exe
  C:\Windows\System\RJFgHcj.exe
  2⤵
  PID:7356
- C:\Windows\System\iVYCVwi.exe
  C:\Windows\System\iVYCVwi.exe
  2⤵
  PID:7532
- C:\Windows\System\EYTIryZ.exe
  C:\Windows\System\EYTIryZ.exe
  2⤵
  PID:7648
- C:\Windows\System\kUeSSJq.exe
  C:\Windows\System\kUeSSJq.exe
  2⤵
  PID:7808
- C:\Windows\System\Jjfvrqc.exe
  C:\Windows\System\Jjfvrqc.exe
  2⤵
  PID:7932
- C:\Windows\System\BbNjuxo.exe
  C:\Windows\System\BbNjuxo.exe
  2⤵
  PID:8116
- C:\Windows\System\uIYpiQN.exe
  C:\Windows\System\uIYpiQN.exe
  2⤵
  PID:7312
- C:\Windows\System\VuGGIuK.exe
  C:\Windows\System\VuGGIuK.exe
  2⤵
  PID:7608
- C:\Windows\System\ibyhCvr.exe
  C:\Windows\System\ibyhCvr.exe
  2⤵
  PID:7928
- C:\Windows\System\OdiaBBS.exe
  C:\Windows\System\OdiaBBS.exe
  2⤵
  PID:7480
- C:\Windows\System\UVuGxtr.exe
  C:\Windows\System\UVuGxtr.exe
  2⤵
  PID:8072
- C:\Windows\System\cOPluLP.exe
  C:\Windows\System\cOPluLP.exe
  2⤵
  PID:8200
- C:\Windows\System\dCGRBjn.exe
  C:\Windows\System\dCGRBjn.exe
  2⤵
  PID:8228
- C:\Windows\System\chkIqYv.exe
  C:\Windows\System\chkIqYv.exe
  2⤵
  PID:8256
- C:\Windows\System\upzzfRi.exe
  C:\Windows\System\upzzfRi.exe
  2⤵
  PID:8308
- C:\Windows\System\WNbEVUy.exe
  C:\Windows\System\WNbEVUy.exe
  2⤵
  PID:8356
- C:\Windows\System\FlPUHaS.exe
  C:\Windows\System\FlPUHaS.exe
  2⤵
  PID:8388
- C:\Windows\System\qNGVaOu.exe
  C:\Windows\System\qNGVaOu.exe
  2⤵
  PID:8420
- C:\Windows\System\KeICQHR.exe
  C:\Windows\System\KeICQHR.exe
  2⤵
  PID:8460
- C:\Windows\System\SSsGUBv.exe
  C:\Windows\System\SSsGUBv.exe
  2⤵
  PID:8496
- C:\Windows\System\VfwHifd.exe
  C:\Windows\System\VfwHifd.exe
  2⤵
  PID:8548
- C:\Windows\System\cJHlARR.exe
  C:\Windows\System\cJHlARR.exe
  2⤵
  PID:8572
- C:\Windows\System\rcROqMN.exe
  C:\Windows\System\rcROqMN.exe
  2⤵
  PID:8600
- C:\Windows\System\BwvyiJN.exe
  C:\Windows\System\BwvyiJN.exe
  2⤵
  PID:8668
- C:\Windows\System\rXDrGuJ.exe
  C:\Windows\System\rXDrGuJ.exe
  2⤵
  PID:8720
- C:\Windows\System\xdMqvdS.exe
  C:\Windows\System\xdMqvdS.exe
  2⤵
  PID:8748
- C:\Windows\System\gkUryKO.exe
  C:\Windows\System\gkUryKO.exe
  2⤵
  PID:8776
- C:\Windows\System\KUHcBDE.exe
  C:\Windows\System\KUHcBDE.exe
  2⤵
  PID:8808
- C:\Windows\System\PvSqkXN.exe
  C:\Windows\System\PvSqkXN.exe
  2⤵
  PID:8828
- C:\Windows\System\VJRAVEr.exe
  C:\Windows\System\VJRAVEr.exe
  2⤵
  PID:8860
- C:\Windows\System\caQMcsO.exe
  C:\Windows\System\caQMcsO.exe
  2⤵
  PID:8892
- C:\Windows\System\kFnGXAD.exe
  C:\Windows\System\kFnGXAD.exe
  2⤵
  PID:8928
- C:\Windows\System\XHXQXeg.exe
  C:\Windows\System\XHXQXeg.exe
  2⤵
  PID:8948
- C:\Windows\System\wWsAxUl.exe
  C:\Windows\System\wWsAxUl.exe
  2⤵
  PID:8964
- C:\Windows\System\ySzMJEb.exe
  C:\Windows\System\ySzMJEb.exe
  2⤵
  PID:9052
- C:\Windows\System\rotBqKG.exe
  C:\Windows\System\rotBqKG.exe
  2⤵
  PID:9068
- C:\Windows\System\mBAsACY.exe
  C:\Windows\System\mBAsACY.exe
  2⤵
  PID:9096
- C:\Windows\System\IeQgztD.exe
  C:\Windows\System\IeQgztD.exe
  2⤵
  PID:9124
- C:\Windows\System\BtkmBTm.exe
  C:\Windows\System\BtkmBTm.exe
  2⤵
  PID:9152
- C:\Windows\System\fWFshNN.exe
  C:\Windows\System\fWFshNN.exe
  2⤵
  PID:9180
- C:\Windows\System\aTRViuZ.exe
  C:\Windows\System\aTRViuZ.exe
  2⤵
  PID:9212
- C:\Windows\System\wKAnzYs.exe
  C:\Windows\System\wKAnzYs.exe
  2⤵
  PID:8252
- C:\Windows\System\nmPipGf.exe
  C:\Windows\System\nmPipGf.exe
  2⤵
  PID:8352
- C:\Windows\System\tSipfTq.exe
  C:\Windows\System\tSipfTq.exe
  2⤵
  PID:8432
- C:\Windows\System\KvMkkgm.exe
  C:\Windows\System\KvMkkgm.exe
  2⤵
  PID:8524
- C:\Windows\System\oERrPbE.exe
  C:\Windows\System\oERrPbE.exe
  2⤵
  PID:8568
- C:\Windows\System\KgwdiyM.exe
  C:\Windows\System\KgwdiyM.exe
  2⤵
  PID:8736
- C:\Windows\System\tTSjgiS.exe
  C:\Windows\System\tTSjgiS.exe
  2⤵
  PID:8764
- C:\Windows\System\HeaOgst.exe
  C:\Windows\System\HeaOgst.exe
  2⤵
  PID:8848
- C:\Windows\System\FWMUGqb.exe
  C:\Windows\System\FWMUGqb.exe
  2⤵
  PID:8924
- C:\Windows\System\EGhhwkk.exe
  C:\Windows\System\EGhhwkk.exe
  2⤵
  PID:8976
- C:\Windows\System\mSXlMrL.exe
  C:\Windows\System\mSXlMrL.exe
  2⤵
  PID:9084
- C:\Windows\System\LlTXqFn.exe
  C:\Windows\System\LlTXqFn.exe
  2⤵
  PID:9144
- C:\Windows\System\UUauRzX.exe
  C:\Windows\System\UUauRzX.exe
  2⤵
  PID:9208
- C:\Windows\System\YalZMae.exe
  C:\Windows\System\YalZMae.exe
  2⤵
  PID:8380
- C:\Windows\System\AXQVODZ.exe
  C:\Windows\System\AXQVODZ.exe
  2⤵
  PID:8564
- C:\Windows\System\OvpIUat.exe
  C:\Windows\System\OvpIUat.exe
  2⤵
  PID:8760
- C:\Windows\System\NUcbMvn.exe
  C:\Windows\System\NUcbMvn.exe
  2⤵
  PID:8956
- C:\Windows\System\ajAFjnO.exe
  C:\Windows\System\ajAFjnO.exe
  2⤵
  PID:9108
- C:\Windows\System\XSBmROH.exe
  C:\Windows\System\XSBmROH.exe
  2⤵
  PID:8684
- C:\Windows\System\AVdYdSk.exe
  C:\Windows\System\AVdYdSk.exe
  2⤵
  PID:8688
- C:\Windows\System\lItDhEm.exe
  C:\Windows\System\lItDhEm.exe
  2⤵
  PID:8512
- C:\Windows\System\nmKvIbC.exe
  C:\Windows\System\nmKvIbC.exe
  2⤵
  PID:9000
- C:\Windows\System\sZFxayX.exe
  C:\Windows\System\sZFxayX.exe
  2⤵
  PID:9044
- C:\Windows\System\urdtbxG.exe
  C:\Windows\System\urdtbxG.exe
  2⤵
  PID:8444
- C:\Windows\System\TcuGWti.exe
  C:\Windows\System\TcuGWti.exe
  2⤵
  PID:8492
- C:\Windows\System\WVglemd.exe
  C:\Windows\System\WVglemd.exe
  2⤵
  PID:9252
- C:\Windows\System\cnXHVcp.exe
  C:\Windows\System\cnXHVcp.exe
  2⤵
  PID:9296
- C:\Windows\System\BJmjMsB.exe
  C:\Windows\System\BJmjMsB.exe
  2⤵
  PID:9324
- C:\Windows\System\uiYeExD.exe
  C:\Windows\System\uiYeExD.exe
  2⤵
  PID:9352
- C:\Windows\System\uQbFRTa.exe
  C:\Windows\System\uQbFRTa.exe
  2⤵
  PID:9384
- C:\Windows\System\RJeLORe.exe
  C:\Windows\System\RJeLORe.exe
  2⤵
  PID:9412
- C:\Windows\System\qQRTvFt.exe
  C:\Windows\System\qQRTvFt.exe
  2⤵
  PID:9440
- C:\Windows\System\vwHuaTm.exe
  C:\Windows\System\vwHuaTm.exe
  2⤵
  PID:9468
- C:\Windows\System\qvqnXOa.exe
  C:\Windows\System\qvqnXOa.exe
  2⤵
  PID:9496
- C:\Windows\System\CcakIrJ.exe
  C:\Windows\System\CcakIrJ.exe
  2⤵
  PID:9524
- C:\Windows\System\wfsTIHW.exe
  C:\Windows\System\wfsTIHW.exe
  2⤵
  PID:9552
- C:\Windows\System\tlcIqyb.exe
  C:\Windows\System\tlcIqyb.exe
  2⤵
  PID:9580
- C:\Windows\System\CRSBByg.exe
  C:\Windows\System\CRSBByg.exe
  2⤵
  PID:9608
- C:\Windows\System\WBdNGBA.exe
  C:\Windows\System\WBdNGBA.exe
  2⤵
  PID:9640
- C:\Windows\System\aatzoML.exe
  C:\Windows\System\aatzoML.exe
  2⤵
  PID:9668
- C:\Windows\System\nEiiRKg.exe
  C:\Windows\System\nEiiRKg.exe
  2⤵
  PID:9696
- C:\Windows\System\xAcwRyM.exe
  C:\Windows\System\xAcwRyM.exe
  2⤵
  PID:9724
- C:\Windows\System\WrfFQBd.exe
  C:\Windows\System\WrfFQBd.exe
  2⤵
  PID:9752
- C:\Windows\System\NHocLDf.exe
  C:\Windows\System\NHocLDf.exe
  2⤵
  PID:9780
- C:\Windows\System\mPwarHh.exe
  C:\Windows\System\mPwarHh.exe
  2⤵
  PID:9808
- C:\Windows\System\DltniTw.exe
  C:\Windows\System\DltniTw.exe
  2⤵
  PID:9836
- C:\Windows\System\RCvCpZS.exe
  C:\Windows\System\RCvCpZS.exe
  2⤵
  PID:9864
- C:\Windows\System\gXaoBZr.exe
  C:\Windows\System\gXaoBZr.exe
  2⤵
  PID:9892
- C:\Windows\System\BtEgSPO.exe
  C:\Windows\System\BtEgSPO.exe
  2⤵
  PID:9920
- C:\Windows\System\SBFxYtj.exe
  C:\Windows\System\SBFxYtj.exe
  2⤵
  PID:9948
- C:\Windows\System\bjrTUnz.exe
  C:\Windows\System\bjrTUnz.exe
  2⤵
  PID:9976
- C:\Windows\System\wpmXctn.exe
  C:\Windows\System\wpmXctn.exe
  2⤵
  PID:10004
- C:\Windows\System\sQcbYrC.exe
  C:\Windows\System\sQcbYrC.exe
  2⤵
  PID:10032
- C:\Windows\System\jpPSBLl.exe
  C:\Windows\System\jpPSBLl.exe
  2⤵
  PID:10060
- C:\Windows\System\qqpFDGZ.exe
  C:\Windows\System\qqpFDGZ.exe
  2⤵
  PID:10088
- C:\Windows\System\bXQnDjx.exe
  C:\Windows\System\bXQnDjx.exe
  2⤵
  PID:10116
- C:\Windows\System\FkMYYIl.exe
  C:\Windows\System\FkMYYIl.exe
  2⤵
  PID:10140
- C:\Windows\System\gPbZGzz.exe
  C:\Windows\System\gPbZGzz.exe
  2⤵
  PID:10172
- C:\Windows\System\XBEgWcU.exe
  C:\Windows\System\XBEgWcU.exe
  2⤵
  PID:10200
- C:\Windows\System\sbYmYqj.exe
  C:\Windows\System\sbYmYqj.exe
  2⤵
  PID:10228
- C:\Windows\System\MkVlyJg.exe
  C:\Windows\System\MkVlyJg.exe
  2⤵
  PID:9240
- C:\Windows\System\rFLeWzE.exe
  C:\Windows\System\rFLeWzE.exe
  2⤵
  PID:9316
- C:\Windows\System\Pcgdpsk.exe
  C:\Windows\System\Pcgdpsk.exe
  2⤵
  PID:9380
- C:\Windows\System\fMsotgg.exe
  C:\Windows\System\fMsotgg.exe
  2⤵
  PID:9432
- C:\Windows\System\MiNVvoC.exe
  C:\Windows\System\MiNVvoC.exe
  2⤵
  PID:9488
- C:\Windows\System\vZvBuxo.exe
  C:\Windows\System\vZvBuxo.exe
  2⤵
  PID:9548
- C:\Windows\System\EIRYbwh.exe
  C:\Windows\System\EIRYbwh.exe
  2⤵
  PID:9360
- C:\Windows\System\aQMdgkt.exe
  C:\Windows\System\aQMdgkt.exe
  2⤵
  PID:9604
- C:\Windows\System\DTpUuaY.exe
  C:\Windows\System\DTpUuaY.exe
  2⤵
  PID:9680
- C:\Windows\System\eadtIRx.exe
  C:\Windows\System\eadtIRx.exe
  2⤵
  PID:9720
- C:\Windows\System\DoEagtW.exe
  C:\Windows\System\DoEagtW.exe
  2⤵
  PID:9776
- C:\Windows\System\vIWQetQ.exe
  C:\Windows\System\vIWQetQ.exe
  2⤵
  PID:9852
- C:\Windows\System\nkfByGl.exe
  C:\Windows\System\nkfByGl.exe
  2⤵
  PID:9912
- C:\Windows\System\frEbmWL.exe
  C:\Windows\System\frEbmWL.exe
  2⤵
  PID:9972
- C:\Windows\System\mRETASc.exe
  C:\Windows\System\mRETASc.exe
  2⤵
  PID:10028
- C:\Windows\System\xDYNrnP.exe
  C:\Windows\System\xDYNrnP.exe
  2⤵
  PID:10104
- C:\Windows\System\yQYJkUr.exe
  C:\Windows\System\yQYJkUr.exe
  2⤵
  PID:10132
- C:\Windows\System\pndCmya.exe
  C:\Windows\System\pndCmya.exe
  2⤵
  PID:10212
- C:\Windows\System\kwCMiDi.exe
  C:\Windows\System\kwCMiDi.exe
  2⤵
  PID:9308
- C:\Windows\System\xfflqSQ.exe
  C:\Windows\System\xfflqSQ.exe
  2⤵
  PID:9424
- C:\Windows\System\nBpXPzd.exe
  C:\Windows\System\nBpXPzd.exe
  2⤵
  PID:9236
- C:\Windows\System\uqKEQsx.exe
  C:\Windows\System\uqKEQsx.exe
  2⤵
  PID:9660
- C:\Windows\System\SNtKaGk.exe
  C:\Windows\System\SNtKaGk.exe
  2⤵
  PID:9772
- C:\Windows\System\hqLhTVG.exe
  C:\Windows\System\hqLhTVG.exe
  2⤵
  PID:9908
- C:\Windows\System\eTHsalu.exe
  C:\Windows\System\eTHsalu.exe
  2⤵
  PID:10052
- C:\Windows\System\FgfwUhr.exe
  C:\Windows\System\FgfwUhr.exe
  2⤵
  PID:10192
- C:\Windows\System\FIXOZhC.exe
  C:\Windows\System\FIXOZhC.exe
  2⤵
  PID:9408
- C:\Windows\System\RxkjfsK.exe
  C:\Windows\System\RxkjfsK.exe
  2⤵
  PID:9708
- C:\Windows\System\kVoNaeN.exe
  C:\Windows\System\kVoNaeN.exe
  2⤵
  PID:10136
- C:\Windows\System\FdaWIhJ.exe
  C:\Windows\System\FdaWIhJ.exe
  2⤵
  PID:4592
- C:\Windows\System\nestMCT.exe
  C:\Windows\System\nestMCT.exe
  2⤵
  PID:4264
- C:\Windows\System\VYObEyF.exe
  C:\Windows\System\VYObEyF.exe
  2⤵
  PID:1452
- C:\Windows\System\OuzZDFH.exe
  C:\Windows\System\OuzZDFH.exe
  2⤵
  PID:2940
- C:\Windows\System\xsFGBck.exe
  C:\Windows\System\xsFGBck.exe
  2⤵
  PID:4484
- C:\Windows\System\NuHjsdN.exe
  C:\Windows\System\NuHjsdN.exe
  2⤵
  PID:4424
- C:\Windows\System\RxRixkl.exe
  C:\Windows\System\RxRixkl.exe
  2⤵
  PID:4548
- C:\Windows\System\tJGJJpR.exe
  C:\Windows\System\tJGJJpR.exe
  2⤵
  PID:5352
- C:\Windows\System\pszwGnc.exe
  C:\Windows\System\pszwGnc.exe
  2⤵
  PID:2200
- C:\Windows\System\CCFjohY.exe
  C:\Windows\System\CCFjohY.exe
  2⤵
  PID:2496
- C:\Windows\System\hzWTJzV.exe
  C:\Windows\System\hzWTJzV.exe
  2⤵
  PID:10268
- C:\Windows\System\ZoLpDmM.exe
  C:\Windows\System\ZoLpDmM.exe
  2⤵
  PID:10296
- C:\Windows\System\JUBTDYL.exe
  C:\Windows\System\JUBTDYL.exe
  2⤵
  PID:10324
- C:\Windows\System\jPEmBeV.exe
  C:\Windows\System\jPEmBeV.exe
  2⤵
  PID:10352
- C:\Windows\System\eGyQBwt.exe
  C:\Windows\System\eGyQBwt.exe
  2⤵
  PID:10368
- C:\Windows\System\dGXqOZq.exe
  C:\Windows\System\dGXqOZq.exe
  2⤵
  PID:10408
- C:\Windows\System\BptVUAb.exe
  C:\Windows\System\BptVUAb.exe
  2⤵
  PID:10436
- C:\Windows\System\qENOUfZ.exe
  C:\Windows\System\qENOUfZ.exe
  2⤵
  PID:10464
- C:\Windows\System\qmOrjHB.exe
  C:\Windows\System\qmOrjHB.exe
  2⤵
  PID:10492
- C:\Windows\System\HIAcjeM.exe
  C:\Windows\System\HIAcjeM.exe
  2⤵
  PID:10536
- C:\Windows\System\RCEqmcs.exe
  C:\Windows\System\RCEqmcs.exe
  2⤵
  PID:10552
- C:\Windows\System\tqNJmuN.exe
  C:\Windows\System\tqNJmuN.exe
  2⤵
  PID:10580
- C:\Windows\System\gPAfxGG.exe
  C:\Windows\System\gPAfxGG.exe
  2⤵
  PID:10608
- C:\Windows\System\lEaJgFV.exe
  C:\Windows\System\lEaJgFV.exe
  2⤵
  PID:10640
- C:\Windows\System\NtQGxpA.exe
  C:\Windows\System\NtQGxpA.exe
  2⤵
  PID:10672
- C:\Windows\System\vTfgTMo.exe
  C:\Windows\System\vTfgTMo.exe
  2⤵
  PID:10700
- C:\Windows\System\VFjRUkd.exe
  C:\Windows\System\VFjRUkd.exe
  2⤵
  PID:10716
- C:\Windows\System\miWQDxq.exe
  C:\Windows\System\miWQDxq.exe
  2⤵
  PID:10744
- C:\Windows\System\lROduIh.exe
  C:\Windows\System\lROduIh.exe
  2⤵
  PID:10780
- C:\Windows\System\EeEUtPH.exe
  C:\Windows\System\EeEUtPH.exe
  2⤵
  PID:10812
- C:\Windows\System\ugeULNJ.exe
  C:\Windows\System\ugeULNJ.exe
  2⤵
  PID:10828
- C:\Windows\System\ykSrZJI.exe
  C:\Windows\System\ykSrZJI.exe
  2⤵
  PID:10868
- C:\Windows\System\bCVARDj.exe
  C:\Windows\System\bCVARDj.exe
  2⤵
  PID:10896
- C:\Windows\System\FaOtVFc.exe
  C:\Windows\System\FaOtVFc.exe
  2⤵
  PID:10912
- C:\Windows\System\aMZvDSN.exe
  C:\Windows\System\aMZvDSN.exe
  2⤵
  PID:10952
- C:\Windows\System\ENdzBnv.exe
  C:\Windows\System\ENdzBnv.exe
  2⤵
  PID:10968
- C:\Windows\System\nBWEsGn.exe
  C:\Windows\System\nBWEsGn.exe
  2⤵
  PID:10992
- C:\Windows\System\MQwgHAj.exe
  C:\Windows\System\MQwgHAj.exe
  2⤵
  PID:11020
- C:\Windows\System\bhXTFgt.exe
  C:\Windows\System\bhXTFgt.exe
  2⤵
  PID:11044
- C:\Windows\System\cMVuVgj.exe
  C:\Windows\System\cMVuVgj.exe
  2⤵
  PID:11076
- C:\Windows\System\AfdYlwQ.exe
  C:\Windows\System\AfdYlwQ.exe
  2⤵
  PID:11104
- C:\Windows\System\GWnshHe.exe
  C:\Windows\System\GWnshHe.exe
  2⤵
  PID:11128
- C:\Windows\System\HfKRPkT.exe
  C:\Windows\System\HfKRPkT.exe
  2⤵
  PID:11176
- C:\Windows\System\YTYqCTi.exe
  C:\Windows\System\YTYqCTi.exe
  2⤵
  PID:11196
- C:\Windows\System\sMaXiir.exe
  C:\Windows\System\sMaXiir.exe
  2⤵
  PID:11224
- C:\Windows\System\antMLMu.exe
  C:\Windows\System\antMLMu.exe
  2⤵
  PID:11248
- C:\Windows\System\HjxfDYK.exe
  C:\Windows\System\HjxfDYK.exe
  2⤵
  PID:10288
- C:\Windows\System\JBXUkxb.exe
  C:\Windows\System\JBXUkxb.exe
  2⤵
  PID:1032
- C:\Windows\System\YOobnlh.exe
  C:\Windows\System\YOobnlh.exe
  2⤵
  PID:10420
- C:\Windows\System\dwselDD.exe
  C:\Windows\System\dwselDD.exe
  2⤵
  PID:10504
- C:\Windows\System\YXiKiiP.exe
  C:\Windows\System\YXiKiiP.exe
  2⤵
  PID:10548
- C:\Windows\System\KITCUCs.exe
  C:\Windows\System\KITCUCs.exe
  2⤵
  PID:10592
- C:\Windows\System\FwsFwsP.exe
  C:\Windows\System\FwsFwsP.exe
  2⤵
  PID:10668
- C:\Windows\System\IvTvoQl.exe
  C:\Windows\System\IvTvoQl.exe
  2⤵
  PID:10788
- C:\Windows\System\SXJAkgZ.exe
  C:\Windows\System\SXJAkgZ.exe
  2⤵
  PID:10820
- C:\Windows\System\KJQGoce.exe
  C:\Windows\System\KJQGoce.exe
  2⤵
  PID:10904
- C:\Windows\System\XDFakyD.exe
  C:\Windows\System\XDFakyD.exe
  2⤵
  PID:10948
- C:\Windows\System\nMMrnRG.exe
  C:\Windows\System\nMMrnRG.exe
  2⤵
  PID:4848
- C:\Windows\System\vGPSnww.exe
  C:\Windows\System\vGPSnww.exe
  2⤵
  PID:11016
- C:\Windows\System\pRhtLkD.exe
  C:\Windows\System\pRhtLkD.exe
  2⤵
  PID:4776
- C:\Windows\System\qWYCuIe.exe
  C:\Windows\System\qWYCuIe.exe
  2⤵
  PID:11064
- C:\Windows\System\GMXSSEu.exe
  C:\Windows\System\GMXSSEu.exe
  2⤵
  PID:11088
- C:\Windows\System\XcciYKs.exe
  C:\Windows\System\XcciYKs.exe
  2⤵
  PID:11168
- C:\Windows\System\FgxEEzk.exe
  C:\Windows\System\FgxEEzk.exe
  2⤵
  PID:11260
- C:\Windows\System\QTrtMZo.exe
  C:\Windows\System\QTrtMZo.exe
  2⤵
  PID:10400
- C:\Windows\System\QtsUcpp.exe
  C:\Windows\System\QtsUcpp.exe
  2⤵
  PID:10480
- C:\Windows\System\KGsuOEZ.exe
  C:\Windows\System\KGsuOEZ.exe
  2⤵
  PID:4244
- C:\Windows\System\VaFSvml.exe
  C:\Windows\System\VaFSvml.exe
  2⤵
  PID:10604
- C:\Windows\System\OsIMRPx.exe
  C:\Windows\System\OsIMRPx.exe
  2⤵
  PID:10708
- C:\Windows\System\DSKaIQD.exe
  C:\Windows\System\DSKaIQD.exe
  2⤵
  PID:4292
- C:\Windows\System\qDHqvCb.exe
  C:\Windows\System\qDHqvCb.exe
  2⤵
  PID:3280
- C:\Windows\System\okqYfHo.exe
  C:\Windows\System\okqYfHo.exe
  2⤵
  PID:11052
- C:\Windows\System\QyeMNoP.exe
  C:\Windows\System\QyeMNoP.exe
  2⤵
  PID:11164
- C:\Windows\System\NIfInJV.exe
  C:\Windows\System\NIfInJV.exe
  2⤵
  PID:10344
- C:\Windows\System\tZTClbk.exe
  C:\Windows\System\tZTClbk.exe
  2⤵
  PID:11004
- C:\Windows\System\IseQxNu.exe
  C:\Windows\System\IseQxNu.exe
  2⤵
  PID:11032
- C:\Windows\System\egIjacF.exe
  C:\Windows\System\egIjacF.exe
  2⤵
  PID:10392
- C:\Windows\System\sbSuzMD.exe
  C:\Windows\System\sbSuzMD.exe
  2⤵
  PID:4376
- C:\Windows\System\hbntMOG.exe
  C:\Windows\System\hbntMOG.exe
  2⤵
  PID:11304
- C:\Windows\System\YlmtGdk.exe
  C:\Windows\System\YlmtGdk.exe
  2⤵
  PID:11332
- C:\Windows\System\egMFiLq.exe
  C:\Windows\System\egMFiLq.exe
  2⤵
  PID:11364
- C:\Windows\System\shvDVbq.exe
  C:\Windows\System\shvDVbq.exe
  2⤵
  PID:11388
- C:\Windows\System\zDBuKHT.exe
  C:\Windows\System\zDBuKHT.exe
  2⤵
  PID:11416
- C:\Windows\System\SmoHUEE.exe
  C:\Windows\System\SmoHUEE.exe
  2⤵
  PID:11444
- C:\Windows\System\TPcFyWi.exe
  C:\Windows\System\TPcFyWi.exe
  2⤵
  PID:11472
- C:\Windows\System\JAgTRyZ.exe
  C:\Windows\System\JAgTRyZ.exe
  2⤵
  PID:11500
- C:\Windows\System\boaaGNY.exe
  C:\Windows\System\boaaGNY.exe
  2⤵
  PID:11528
- C:\Windows\System\aFWlInQ.exe
  C:\Windows\System\aFWlInQ.exe
  2⤵
  PID:11568
- C:\Windows\System\ZfAugkc.exe
  C:\Windows\System\ZfAugkc.exe
  2⤵
  PID:11588
- C:\Windows\System\uimyDYT.exe
  C:\Windows\System\uimyDYT.exe
  2⤵
  PID:11612
- C:\Windows\System\DcqhNrv.exe
  C:\Windows\System\DcqhNrv.exe
  2⤵
  PID:11636
- C:\Windows\System\SJEibJg.exe
  C:\Windows\System\SJEibJg.exe
  2⤵
  PID:11656
- C:\Windows\System\NxlNErL.exe
  C:\Windows\System\NxlNErL.exe
  2⤵
  PID:11708
- C:\Windows\System\cUEFlsw.exe
  C:\Windows\System\cUEFlsw.exe
  2⤵
  PID:11736
- C:\Windows\System\PkWNxex.exe
  C:\Windows\System\PkWNxex.exe
  2⤵
  PID:11764
- C:\Windows\System\wGFBsaS.exe
  C:\Windows\System\wGFBsaS.exe
  2⤵
  PID:11780
- C:\Windows\System\bzcTane.exe
  C:\Windows\System\bzcTane.exe
  2⤵
  PID:11796
- C:\Windows\System\avUvBHq.exe
  C:\Windows\System\avUvBHq.exe
  2⤵
  PID:11820
- C:\Windows\System\iufHorS.exe
  C:\Windows\System\iufHorS.exe
  2⤵
  PID:11868
- C:\Windows\System\yPRelQY.exe
  C:\Windows\System\yPRelQY.exe
  2⤵
  PID:11892
- C:\Windows\System\KZvuHmR.exe
  C:\Windows\System\KZvuHmR.exe
  2⤵
  PID:11920
- C:\Windows\System\CvdXtLW.exe
  C:\Windows\System\CvdXtLW.exe
  2⤵
  PID:11948
- C:\Windows\System\xSGUOHw.exe
  C:\Windows\System\xSGUOHw.exe
  2⤵
  PID:11988
- C:\Windows\System\xQSSGFY.exe
  C:\Windows\System\xQSSGFY.exe
  2⤵
  PID:12016
- C:\Windows\System\CqZqOgQ.exe
  C:\Windows\System\CqZqOgQ.exe
  2⤵
  PID:12044
- C:\Windows\System\OltFnwM.exe
  C:\Windows\System\OltFnwM.exe
  2⤵
  PID:12072
- C:\Windows\System\oMJUAUi.exe
  C:\Windows\System\oMJUAUi.exe
  2⤵
  PID:12092
- C:\Windows\System\wGDtSHd.exe
  C:\Windows\System\wGDtSHd.exe
  2⤵
  PID:12128
- C:\Windows\System\lOjlNWL.exe
  C:\Windows\System\lOjlNWL.exe
  2⤵
  PID:12156
- C:\Windows\System\VtHWkQl.exe
  C:\Windows\System\VtHWkQl.exe
  2⤵
  PID:12176
- C:\Windows\System\xtMXSpJ.exe
  C:\Windows\System\xtMXSpJ.exe
  2⤵
  PID:12200
- C:\Windows\System\kHIXWBl.exe
  C:\Windows\System\kHIXWBl.exe
  2⤵
  PID:12240
- C:\Windows\System\lcVvGEA.exe
  C:\Windows\System\lcVvGEA.exe
  2⤵
  PID:12268
- C:\Windows\System\vTceaCT.exe
  C:\Windows\System\vTceaCT.exe
  2⤵
  PID:11144
- C:\Windows\System\DxHuwwm.exe
  C:\Windows\System\DxHuwwm.exe
  2⤵
  PID:11272
- C:\Windows\System\wLprVzz.exe
  C:\Windows\System\wLprVzz.exe
  2⤵
  PID:11372
- C:\Windows\System\blzZPsZ.exe
  C:\Windows\System\blzZPsZ.exe
  2⤵
  PID:11408
- C:\Windows\System\AQdoRRF.exe
  C:\Windows\System\AQdoRRF.exe
  2⤵
  PID:11488
- C:\Windows\System\fsSYfAn.exe
  C:\Windows\System\fsSYfAn.exe
  2⤵
  PID:11512
- C:\Windows\System\dnVogcP.exe
  C:\Windows\System\dnVogcP.exe
  2⤵
  PID:11596
- C:\Windows\System\ZqHgznV.exe
  C:\Windows\System\ZqHgznV.exe
  2⤵
  PID:11692
- C:\Windows\System\fcjZaJZ.exe
  C:\Windows\System\fcjZaJZ.exe
  2⤵
  PID:11724
- C:\Windows\System\trUuaDl.exe
  C:\Windows\System\trUuaDl.exe
  2⤵
  PID:11788
- C:\Windows\System\WMXLaoG.exe
  C:\Windows\System\WMXLaoG.exe
  2⤵
  PID:11816
- C:\Windows\System\tcBckSn.exe
  C:\Windows\System\tcBckSn.exe
  2⤵
  PID:11904
- C:\Windows\System\fTwpugl.exe
  C:\Windows\System\fTwpugl.exe
  2⤵
  PID:11964
- C:\Windows\System\IaGiaxU.exe
  C:\Windows\System\IaGiaxU.exe
  2⤵
  PID:12032
- C:\Windows\System\DxflRYy.exe
  C:\Windows\System\DxflRYy.exe
  2⤵
  PID:12104
- C:\Windows\System\AnhUbJQ.exe
  C:\Windows\System\AnhUbJQ.exe
  2⤵
  PID:12216
- C:\Windows\System\cJoYxfq.exe
  C:\Windows\System\cJoYxfq.exe
  2⤵
  PID:12260
- C:\Windows\System\spTAeaw.exe
  C:\Windows\System\spTAeaw.exe
  2⤵
  PID:10312
- C:\Windows\System\yazkHZg.exe
  C:\Windows\System\yazkHZg.exe
  2⤵
  PID:11484
- C:\Windows\System\molrihT.exe
  C:\Windows\System\molrihT.exe
  2⤵
  PID:11620
- C:\Windows\System\NsmISwq.exe
  C:\Windows\System\NsmISwq.exe
  2⤵
  PID:11840
- C:\Windows\System\JceHulj.exe
  C:\Windows\System\JceHulj.exe
  2⤵
  PID:12000
- C:\Windows\System\cJQurNb.exe
  C:\Windows\System\cJQurNb.exe
  2⤵
  PID:12004
- C:\Windows\System\wTKLuOM.exe
  C:\Windows\System\wTKLuOM.exe
  2⤵
  PID:12192
- C:\Windows\System\bDVxIvI.exe
  C:\Windows\System\bDVxIvI.exe
  2⤵
  PID:11468
- C:\Windows\System\zWtBwPe.exe
  C:\Windows\System\zWtBwPe.exe
  2⤵
  PID:11888
- C:\Windows\System\VXBgPxb.exe
  C:\Windows\System\VXBgPxb.exe
  2⤵
  PID:12080
- C:\Windows\System\rIDgtPI.exe
  C:\Windows\System\rIDgtPI.exe
  2⤵
  PID:3088
- C:\Windows\System\BhglcZc.exe
  C:\Windows\System\BhglcZc.exe
  2⤵
  PID:11760
- C:\Windows\System\OHwoqmM.exe
  C:\Windows\System\OHwoqmM.exe
  2⤵
  PID:12144
- C:\Windows\System\rvirYdV.exe
  C:\Windows\System\rvirYdV.exe
  2⤵
  PID:11356
- C:\Windows\System\vQYlPOg.exe
  C:\Windows\System\vQYlPOg.exe
  2⤵
  PID:12340
- C:\Windows\System\NHRaTtF.exe
  C:\Windows\System\NHRaTtF.exe
  2⤵
  PID:12368
- C:\Windows\System\pzOnIwo.exe
  C:\Windows\System\pzOnIwo.exe
  2⤵
  PID:12400
- C:\Windows\System\YQIvNUa.exe
  C:\Windows\System\YQIvNUa.exe
  2⤵
  PID:12420
- C:\Windows\System\uwWpnPF.exe
  C:\Windows\System\uwWpnPF.exe
  2⤵
  PID:12456
- C:\Windows\System\iNZskTY.exe
  C:\Windows\System\iNZskTY.exe
  2⤵
  PID:12480
- C:\Windows\System\ZAXGvqW.exe
  C:\Windows\System\ZAXGvqW.exe
  2⤵
  PID:12520
- C:\Windows\System\UXjdHCu.exe
  C:\Windows\System\UXjdHCu.exe
  2⤵
  PID:12540
- C:\Windows\System\BoOJNUT.exe
  C:\Windows\System\BoOJNUT.exe
  2⤵
  PID:12564
- C:\Windows\System\fWtxrFz.exe
  C:\Windows\System\fWtxrFz.exe
  2⤵
  PID:12604
- C:\Windows\System\FpeEiCs.exe
  C:\Windows\System\FpeEiCs.exe
  2⤵
  PID:12620
- C:\Windows\System\FHepDPU.exe
  C:\Windows\System\FHepDPU.exe
  2⤵
  PID:12648
- C:\Windows\System\AtYzbce.exe
  C:\Windows\System\AtYzbce.exe
  2⤵
  PID:12672
- C:\Windows\System\cnvKBOx.exe
  C:\Windows\System\cnvKBOx.exe
  2⤵
  PID:12696
- C:\Windows\System\rRHorFU.exe
  C:\Windows\System\rRHorFU.exe
  2⤵
  PID:12748
- C:\Windows\System\KzayKjs.exe
  C:\Windows\System\KzayKjs.exe
  2⤵
  PID:12772
- C:\Windows\System\nWpKKPB.exe
  C:\Windows\System\nWpKKPB.exe
  2⤵
  PID:12792
- C:\Windows\System\VtOJqoh.exe
  C:\Windows\System\VtOJqoh.exe
  2⤵
  PID:12820
- C:\Windows\System\CPArkzv.exe
  C:\Windows\System\CPArkzv.exe
  2⤵
  PID:12852
- C:\Windows\System\mZhPBiG.exe
  C:\Windows\System\mZhPBiG.exe
  2⤵
  PID:12892
- C:\Windows\System\fWheSdP.exe
  C:\Windows\System\fWheSdP.exe
  2⤵
  PID:12920
- C:\Windows\System\AQlRRvg.exe
  C:\Windows\System\AQlRRvg.exe
  2⤵
  PID:12940
- C:\Windows\System\KwwNnos.exe
  C:\Windows\System\KwwNnos.exe
  2⤵
  PID:12964
- C:\Windows\System\vCNqKNc.exe
  C:\Windows\System\vCNqKNc.exe
  2⤵
  PID:12996
- C:\Windows\System\UUyOXzg.exe
  C:\Windows\System\UUyOXzg.exe
  2⤵
  PID:13032
- C:\Windows\System\xnbMuPv.exe
  C:\Windows\System\xnbMuPv.exe
  2⤵
  PID:13060
- C:\Windows\System\qTWegkE.exe
  C:\Windows\System\qTWegkE.exe
  2⤵
  PID:13088
- C:\Windows\System\fixNKgz.exe
  C:\Windows\System\fixNKgz.exe
  2⤵
  PID:13108
- C:\Windows\System\EIXBxXJ.exe
  C:\Windows\System\EIXBxXJ.exe
  2⤵
  PID:13124
- C:\Windows\System\loGycvj.exe
  C:\Windows\System\loGycvj.exe
  2⤵
  PID:13164
- C:\Windows\System\NQKAFxC.exe
  C:\Windows\System\NQKAFxC.exe
  2⤵
  PID:13188
- C:\Windows\System\gQMpViG.exe
  C:\Windows\System\gQMpViG.exe
  2⤵
  PID:13212
- C:\Windows\System\GkYWsCB.exe
  C:\Windows\System\GkYWsCB.exe
  2⤵
  PID:13248
- C:\Windows\System\nTPnAQE.exe
  C:\Windows\System\nTPnAQE.exe
  2⤵
  PID:13272
- C:\Windows\System\nlkdheq.exe
  C:\Windows\System\nlkdheq.exe
  2⤵
  PID:13296
- C:\Windows\System\hruOjOw.exe
  C:\Windows\System\hruOjOw.exe
  2⤵
  PID:12328
- C:\Windows\System\svJafWp.exe
  C:\Windows\System\svJafWp.exe
  2⤵
  PID:12408
- C:\Windows\System\yPEZxKQ.exe
  C:\Windows\System\yPEZxKQ.exe
  2⤵
  PID:12468
- C:\Windows\System\dMLBSzW.exe
  C:\Windows\System\dMLBSzW.exe
  2⤵
  PID:12500
- C:\Windows\System\ReHNaYn.exe
  C:\Windows\System\ReHNaYn.exe
  2⤵
  PID:12616
- C:\Windows\System\IMtAHNb.exe
  C:\Windows\System\IMtAHNb.exe
  2⤵
  PID:12668
- C:\Windows\System\ynyVMEe.exe
  C:\Windows\System\ynyVMEe.exe
  2⤵
  PID:2460
- C:\Windows\System\UjIhgSq.exe
  C:\Windows\System\UjIhgSq.exe
  2⤵
  PID:12788
- C:\Windows\System\vjYjwHf.exe
  C:\Windows\System\vjYjwHf.exe
  2⤵
  PID:12812
- C:\Windows\System\buRETzJ.exe
  C:\Windows\System\buRETzJ.exe
  2⤵
  PID:12868
- C:\Windows\System\hILrpjn.exe
  C:\Windows\System\hILrpjn.exe
  2⤵
  PID:12908
- C:\Windows\System\zlFIUnZ.exe
  C:\Windows\System\zlFIUnZ.exe
  2⤵
  PID:12980
- C:\Windows\System\moCOMdk.exe
  C:\Windows\System\moCOMdk.exe
  2⤵
  PID:2324
- C:\Windows\System\FGERlpC.exe
  C:\Windows\System\FGERlpC.exe
  2⤵
  PID:13044
- C:\Windows\System\DgHSKzQ.exe
  C:\Windows\System\DgHSKzQ.exe
  2⤵
  PID:13156
- C:\Windows\System\aLwletv.exe
  C:\Windows\System\aLwletv.exe
  2⤵
  PID:13232
- C:\Windows\System\CWgLbjF.exe
  C:\Windows\System\CWgLbjF.exe
  2⤵
  PID:12320
- C:\Windows\System\xJHvQZv.exe
  C:\Windows\System\xJHvQZv.exe
  2⤵
  PID:13284
- C:\Windows\System\PEwaLAT.exe
  C:\Windows\System\PEwaLAT.exe
  2⤵
  PID:12584
- C:\Windows\System\kWQqVnE.exe
  C:\Windows\System\kWQqVnE.exe
  2⤵
  PID:12680
- C:\Windows\System\gwkyWgB.exe
  C:\Windows\System\gwkyWgB.exe
  2⤵
  PID:12848
- C:\Windows\System\JOcqpgm.exe
  C:\Windows\System\JOcqpgm.exe
  2⤵
  PID:12936
- C:\Windows\System\PqXENUt.exe
  C:\Windows\System\PqXENUt.exe
  2⤵
  PID:13076
- C:\Windows\System\NEYztXk.exe
  C:\Windows\System\NEYztXk.exe
  2⤵
  PID:12316
- C:\Windows\System\VbDlCwZ.exe
  C:\Windows\System\VbDlCwZ.exe
  2⤵
  PID:12472
- C:\Windows\System\Bwlvxzs.exe
  C:\Windows\System\Bwlvxzs.exe
  2⤵
  PID:12664
- C:\Windows\System\kFFXPTg.exe
  C:\Windows\System\kFFXPTg.exe
  2⤵
  PID:13120
- C:\Windows\System\WoMEWtn.exe
  C:\Windows\System\WoMEWtn.exe
  2⤵
  PID:12596
- C:\Windows\System\DHIpxaK.exe
  C:\Windows\System\DHIpxaK.exe
  2⤵
  PID:13332
- C:\Windows\System\dbqnWBF.exe
  C:\Windows\System\dbqnWBF.exe
  2⤵
  PID:13356
- C:\Windows\System\YgSlhVN.exe
  C:\Windows\System\YgSlhVN.exe
  2⤵
  PID:13388
- C:\Windows\System\vkNAAgV.exe
  C:\Windows\System\vkNAAgV.exe
  2⤵
  PID:13420
- C:\Windows\System\gWUYbKS.exe
  C:\Windows\System\gWUYbKS.exe
  2⤵
  PID:13440
- C:\Windows\System\RRJbtXS.exe
  C:\Windows\System\RRJbtXS.exe
  2⤵
  PID:13464
- C:\Windows\System\gzfIUEX.exe
  C:\Windows\System\gzfIUEX.exe
  2⤵
  PID:13484
- C:\Windows\System\pYcMgqT.exe
  C:\Windows\System\pYcMgqT.exe
  2⤵
  PID:13516
- C:\Windows\System\ismztoU.exe
  C:\Windows\System\ismztoU.exe
  2⤵
  PID:13548
- C:\Windows\System\KiFXFbb.exe
  C:\Windows\System\KiFXFbb.exe
  2⤵
  PID:13588
- C:\Windows\System\TdLxlpp.exe
  C:\Windows\System\TdLxlpp.exe
  2⤵
  PID:13620
- C:\Windows\System\RbUfNOc.exe
  C:\Windows\System\RbUfNOc.exe
  2⤵
  PID:13648
- C:\Windows\System\rWbxlzm.exe
  C:\Windows\System\rWbxlzm.exe
  2⤵
  PID:13676
- C:\Windows\System\VtidqTv.exe
  C:\Windows\System\VtidqTv.exe
  2⤵
  PID:13704
- C:\Windows\System\ANCaLsN.exe
  C:\Windows\System\ANCaLsN.exe
  2⤵
  PID:13732
- C:\Windows\System\Sersxto.exe
  C:\Windows\System\Sersxto.exe
  2⤵
  PID:13748
- C:\Windows\System\BlsaDly.exe
  C:\Windows\System\BlsaDly.exe
  2⤵
  PID:13776
- C:\Windows\System\NrnnxLr.exe
  C:\Windows\System\NrnnxLr.exe
  2⤵
  PID:13792
- C:\Windows\System\XCHNgHW.exe
  C:\Windows\System\XCHNgHW.exe
  2⤵
  PID:13808
- C:\Windows\System\KuGWXHc.exe
  C:\Windows\System\KuGWXHc.exe
  2⤵
  PID:13824
- C:\Windows\System\VnVACXG.exe
  C:\Windows\System\VnVACXG.exe
  2⤵
  PID:13844
- C:\Windows\System\vWSPuRE.exe
  C:\Windows\System\vWSPuRE.exe
  2⤵
  PID:13860
- C:\Windows\System\DbhCfHV.exe
  C:\Windows\System\DbhCfHV.exe
  2⤵
  PID:13876
- C:\Windows\System\epaApXy.exe
  C:\Windows\System\epaApXy.exe
  2⤵
  PID:13892
- C:\Windows\System\KnJgoqI.exe
  C:\Windows\System\KnJgoqI.exe
  2⤵
  PID:13932
- C:\Windows\System\XAFqCjz.exe
  C:\Windows\System\XAFqCjz.exe
  2⤵
  PID:13976
- C:\Windows\System\bGEvRBJ.exe
  C:\Windows\System\bGEvRBJ.exe
  2⤵
  PID:14028
- C:\Windows\System\sIgHDEh.exe
  C:\Windows\System\sIgHDEh.exe
  2⤵
  PID:14064
- C:\Windows\System\EajqwER.exe
  C:\Windows\System\EajqwER.exe
  2⤵
  PID:14080
- C:\Windows\System\aynmpjB.exe
  C:\Windows\System\aynmpjB.exe
  2⤵
  PID:14096
- C:\Windows\System\eBMGHDC.exe
  C:\Windows\System\eBMGHDC.exe
  2⤵
  PID:14168
- C:\Windows\System\ZXpyJuM.exe
  C:\Windows\System\ZXpyJuM.exe
  2⤵
  PID:14212
- C:\Windows\System\EvIOQGu.exe
  C:\Windows\System\EvIOQGu.exe
  2⤵
  PID:14240
- C:\Windows\System\oOJEExX.exe
  C:\Windows\System\oOJEExX.exe
  2⤵
  PID:14268
- C:\Windows\System\liGlXfY.exe
  C:\Windows\System\liGlXfY.exe
  2⤵
  PID:14296
- C:\Windows\System\YbQMQZw.exe
  C:\Windows\System\YbQMQZw.exe
  2⤵
  PID:14324
- C:\Windows\System\JEMatrq.exe
  C:\Windows\System\JEMatrq.exe
  2⤵
  PID:13328
- C:\Windows\System\EgswruX.exe
  C:\Windows\System\EgswruX.exe
  2⤵
  PID:13352
- C:\Windows\System\MQuxvfy.exe
  C:\Windows\System\MQuxvfy.exe
  2⤵
  PID:13456
- C:\Windows\System\HdMPyDM.exe
  C:\Windows\System\HdMPyDM.exe
  2⤵
  PID:13508
- C:\Windows\System\ScrdLpr.exe
  C:\Windows\System\ScrdLpr.exe
  2⤵
  PID:13580
- C:\Windows\System\zXlsDvs.exe
  C:\Windows\System\zXlsDvs.exe
  2⤵
  PID:13612
- C:\Windows\System\bzUyAlF.exe
  C:\Windows\System\bzUyAlF.exe
  2⤵
  PID:13668
- C:\Windows\System\IZwvppP.exe
  C:\Windows\System\IZwvppP.exe
  2⤵
  PID:13744
- C:\Windows\System\yNhDMJJ.exe
  C:\Windows\System\yNhDMJJ.exe
  2⤵
  PID:13816
- C:\Windows\System\goJBatJ.exe
  C:\Windows\System\goJBatJ.exe
  2⤵
  PID:13884
- C:\Windows\System\kDopWXm.exe
  C:\Windows\System\kDopWXm.exe
  2⤵
  PID:13988
- C:\Windows\System\ZwnqHPU.exe
  C:\Windows\System\ZwnqHPU.exe
  2⤵
  PID:13940
- C:\Windows\System\NZLSyme.exe
  C:\Windows\System\NZLSyme.exe
  2⤵
  PID:13992
- C:\Windows\System\aGWaJJp.exe
  C:\Windows\System\aGWaJJp.exe
  2⤵
  PID:416
- C:\Windows\System\ozCEcdw.exe
  C:\Windows\System\ozCEcdw.exe
  2⤵
  PID:14180
- C:\Windows\System\tfbxoHy.exe
  C:\Windows\System\tfbxoHy.exe
  2⤵
  PID:14228
- C:\Windows\System\YeCLZys.exe
  C:\Windows\System\YeCLZys.exe
  2⤵
  PID:14280
- C:\Windows\System\eVIhSWk.exe
  C:\Windows\System\eVIhSWk.exe
  2⤵
  PID:13176
- C:\Windows\System\auwyrkt.exe
  C:\Windows\System\auwyrkt.exe
  2⤵
  PID:13428
- C:\Windows\System\BnexCXn.exe
  C:\Windows\System\BnexCXn.exe
  2⤵
  PID:13664
- C:\Windows\System\gWdqQGz.exe
  C:\Windows\System\gWdqQGz.exe
  2⤵
  PID:13724
- C:\Windows\System\OrEXvCz.exe
  C:\Windows\System\OrEXvCz.exe
  2⤵
  PID:13916
- C:\Windows\System\ucUMbef.exe
  C:\Windows\System\ucUMbef.exe
  2⤵
  PID:14036
- C:\Windows\System\wQBLqLV.exe
  C:\Windows\System\wQBLqLV.exe
  2⤵
  PID:380
- C:\Windows\System\cLxnmEg.exe
  C:\Windows\System\cLxnmEg.exe
  2⤵
  PID:14208
- C:\Windows\System\PtHypii.exe
  C:\Windows\System\PtHypii.exe
  2⤵
  PID:14316
- C:\Windows\System\rMLwVNk.exe
  C:\Windows\System\rMLwVNk.exe
  2⤵
  PID:13720
- C:\Windows\System\hVQcWFg.exe
  C:\Windows\System\hVQcWFg.exe
  2⤵
  PID:13972
- C:\Windows\System\DBwRBWn.exe
  C:\Windows\System\DBwRBWn.exe
  2⤵
  PID:14256
- C:\Windows\System\Ukitwoa.exe
  C:\Windows\System\Ukitwoa.exe
  2⤵
  PID:12816
- C:\Windows\System\yWbesMX.exe
  C:\Windows\System\yWbesMX.exe
  2⤵
  PID:14352
- C:\Windows\System\qvpUupK.exe
  C:\Windows\System\qvpUupK.exe
  2⤵
  PID:14388
- C:\Windows\System\wITKhCf.exe
  C:\Windows\System\wITKhCf.exe
  2⤵
  PID:14416
- C:\Windows\System\ynaCTAt.exe
  C:\Windows\System\ynaCTAt.exe
  2⤵
  PID:14444
- C:\Windows\System\KLvDQdh.exe
  C:\Windows\System\KLvDQdh.exe
  2⤵
  PID:14460
- C:\Windows\System\LBBHfHh.exe
  C:\Windows\System\LBBHfHh.exe
  2⤵
  PID:14476
- C:\Windows\System\JfXFJje.exe
  C:\Windows\System\JfXFJje.exe
  2⤵
  PID:14496
- C:\Windows\System\jWGcgbC.exe
  C:\Windows\System\jWGcgbC.exe
  2⤵
  PID:14516
- C:\Windows\System\yhtKjDB.exe
  C:\Windows\System\yhtKjDB.exe
  2⤵
  PID:14540
- C:\Windows\System\tQYcHxJ.exe
  C:\Windows\System\tQYcHxJ.exe
  2⤵
  PID:14580
- C:\Windows\System\nFHiaZF.exe
  C:\Windows\System\nFHiaZF.exe
  2⤵
  PID:14616
- C:\Windows\System\dGHJlwK.exe
  C:\Windows\System\dGHJlwK.exe
  2⤵
  PID:14644
- C:\Windows\System\FVEhPVB.exe
  C:\Windows\System\FVEhPVB.exe
  2⤵
  PID:14688
- C:\Windows\System\rfTVUEx.exe
  C:\Windows\System\rfTVUEx.exe
  2⤵
  PID:14728
- C:\Windows\System\ZNABmmo.exe
  C:\Windows\System\ZNABmmo.exe
  2⤵
  PID:14744
- C:\Windows\System\SHjXPTS.exe
  C:\Windows\System\SHjXPTS.exe
  2⤵
  PID:14784
- C:\Windows\System\AwoXCYd.exe
  C:\Windows\System\AwoXCYd.exe
  2⤵
  PID:14808
- C:\Windows\System\jrtfsYx.exe
  C:\Windows\System\jrtfsYx.exe
  2⤵
  PID:14828
- C:\Windows\System\Tljzoxz.exe
  C:\Windows\System\Tljzoxz.exe
  2⤵
  PID:14868
- C:\Windows\System\OLLZjMC.exe
  C:\Windows\System\OLLZjMC.exe
  2⤵
  PID:14892
- C:\Windows\System\OMAeAXX.exe
  C:\Windows\System\OMAeAXX.exe
  2⤵
  PID:14912
- C:\Windows\System\ITHokQO.exe
  C:\Windows\System\ITHokQO.exe
  2⤵
  PID:14952
- C:\Windows\System\pBbOleY.exe
  C:\Windows\System\pBbOleY.exe
  2⤵
  PID:14972
- C:\Windows\System\mamNDPy.exe
  C:\Windows\System\mamNDPy.exe
  2⤵
  PID:14996
- C:\Windows\System\rNJQtoo.exe
  C:\Windows\System\rNJQtoo.exe
  2⤵
  PID:15024

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:8444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CNlIeME.exe

Path C:\Windows\System\CNlIeME.exe
Size 2.2MB
SHA256 ee67d413f0dd5cb7885e16d178ac82e26bc6073e0cd923bf728d431318f81f1a
MD5 f3eb83a3897179b315b62dc94126eb95
SHA1 0c55244292bd8a2a35273d5051932cdf5b9c0f92
SHA512 c0e48c0ba3e69b9bab88b575be5d69ba7916c67bb969250cc61fcea32795c54a31d1cfecf286a91d4ada33793a8a4e005e195d6c96196d8b9dde2188eb39d9c0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72j:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

DKveNyF.exe

Path C:\Windows\System\DKveNyF.exe
Size 2.2MB
SHA256 1b9e74bbe43d73614dddfba196e68330311dbec40d1ea05674ba5ceb19307399
MD5 fdb4ffdaf553fa1662f3ff3bcbc91314
SHA1 2d57fd9bb6fee9b3f219139fe3f3a88458d25bbc
SHA512 4d8ebf19e9ddacad26608c3299c62c41239138d0477ee77d05d419dfb44db6d004d81a0d4193e9e76756df39341fc97132d52aa60f61eeb7eb866741d7ccaeef
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx722:BemTLkNdfE0pZre
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGGqyOB.exe

Path C:\Windows\System\EGGqyOB.exe
Size 2.2MB
SHA256 34c31476202a831f33bf10248a6faf8410cba3aab6c9b1bc61c439890c4bea18
MD5 e05ce053be47a6e3671ff311d02dd459
SHA1 14c33bb8867b121ebb6ade525c97ba324edee3cd
SHA512 67bcc653f519c559a28a7b2ad6f03ff2d90746a91a6ad2a321baa59479c02034452bcb62d0ce5a73a5481ee53fbe33c6dd8b5da182f05b855e2d90bfa1db68e0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72K:BemTLkNdfE0pZri
MD5 SHA1 SHA512 SSDEEP

Submit Download

GbKMqin.exe

Path C:\Windows\System\GbKMqin.exe
Size 2.2MB
SHA256 a767a15b2407b54e12bf3ca9b09e6f1c0b51843b367fe37e95990086ab16adf8
MD5 ae5dc099c951c1e951930707dd1d48d9
SHA1 408194af93391a041e697bda84307105b6c2ae71
SHA512 3c996e29db7db6aa4e87d428e0981949463338c86551d1d424770adb1c056bdccc1dada3fc87cb585529e40a8871dd9dd7684a1a7b78aa3b748917249a7adac7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72p:BemTLkNdfE0pZrh
MD5 SHA1 SHA512 SSDEEP

Submit Download

GyRxUpt.exe

Path C:\Windows\System\GyRxUpt.exe
Size 2.2MB
SHA256 37211e4239fd3dbc6a0054d5396cfb78d848a471eec050805d4f7ad272cd6a19
MD5 538b50be1c1a4ff91fb2c0bd2e7899c8
SHA1 ad1877098241e60234c168afe274bf570cd1ffd5
SHA512 dc19b08e4963614452bd5e2bf3b65c3cf53c449d8a6d50d13a266b3b871914984e5156b3887443212baf4b328fb56abaa7ec246c0d760e607e25bbb4500ce60a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72o:BemTLkNdfE0pZrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMSGDUR.exe

Path C:\Windows\System\HMSGDUR.exe
Size 2.2MB
SHA256 04c3f310e3a98bfe981a83306dbd0a7e0e9dbe87199be3a7d4e89e70c9f82183
MD5 456cf1594cd313e5cd486ccea5089376
SHA1 894d6722e79795d6b1914b59751afdaacba62442
SHA512 9aca04050c292d9bd9172b00a11a24ba73cf57013f0038ff633c0b85e0ff0eb66b4a1bda4796d3674ef5ee3babefd7bcfc97bc7f62d9cc0d62c0d46c70d29a65
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72A:BemTLkNdfE0pZr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

HWiiAzF.exe

Path C:\Windows\System\HWiiAzF.exe
Size 2.2MB
SHA256 6c145559da06f0c03ccc57e334cabab8a5c2a24fedda90af036d3f1a5e13b5d9
MD5 28b54f9abc1acdbd7a753f948ef8a067
SHA1 174ebda75bbde9fa57d64d4e39e9dd943d957833
SHA512 4e8cf75873147a745c77c40d6ecc1eacd235a4358ab1865d27b1ee903157db76f58c707599155eebf72eec515ddbac75a60b113d365de26a312ed60bdf7cefa2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72j:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

HtsKHod.exe

Path C:\Windows\System\HtsKHod.exe
Size 2.2MB
SHA256 4252a9371fcf07f38caec7407c3fb64cba6efcd2c21aea4f7c837e40f61075af
MD5 1ee28d76fceb95965b8ccfe62c7f40af
SHA1 878a7a05813c6420ba13f62102db10b3d1772c7d
SHA512 52f8952fecaaeb60f9abe0459243ff85a2dace049b2e0b8928f7a6400b35e24d77966108b7094c23b9b2e8a4edd06f576caee3c2fba7e4b7d140ecc612217d42
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72O:BemTLkNdfE0pZrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

NjvxcMO.exe

Path C:\Windows\System\NjvxcMO.exe
Size 2.2MB
SHA256 5163d3f02567583d8624e12ccfbd0351931de9c1143a91f36e6ab5841f364ff8
MD5 1b4fa068a280cb282fe98d9a74611689
SHA1 da85bb0f3e6dfea109b1236ae2460f930dba3ae3
SHA512 98da0b2595dd6c2109da2f04d292e50da1eab8599aa24a00b1d9e5fe5ee61a6e649bade86dc5da3d1e71bb1c2d7887cec82aed1aacc779b371ce776293a8fa91
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72y:BemTLkNdfE0pZrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

PIWkITp.exe

Path C:\Windows\System\PIWkITp.exe
Size 2.2MB
SHA256 aab293283bb0d4f9e94d74e6524633a5a1e81f35547957ddc179a8c0f9f5e3c5
MD5 0907332893e50460ca9c2771021b3412
SHA1 627426b3ce6e7f3974cd8a859aa960ed5eb0f629
SHA512 b840d52a4acb5c3e26b36d5a96b405a0d2417fde4451311a7eceac3eadc434612b0855be3da487bc2c976b9e942bc9294bcb513be49b9941787a5303cdd747f4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx723:BemTLkNdfE0pZrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

StvZEfi.exe

Path C:\Windows\System\StvZEfi.exe
Size 2.2MB
SHA256 c5ff6d27dc3fd8672c07236e457ac99e4721f7f236bd150a12b384b0b6a1e3ad
MD5 dcf66c9f17c3f971740d4b17b9da6a4e
SHA1 ced1a58b936fb21a8fe62904c2cfeab4ccb9ba9f
SHA512 7eee3610a89e6bba5c395386bbf32620416258e346a4a3438d8b96d89b4d8052fb5405521e1f81b58be6463a4f2329cf6a0906ecf12f467f6adca2a111a7a383
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72F:BemTLkNdfE0pZrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

UoJVfrz.exe

Path C:\Windows\System\UoJVfrz.exe
Size 2.2MB
SHA256 5e56f0a23f5dabeb83f3bac6e221a4fe7af05322909ebd4fcdb275fcfbe18d53
MD5 5cb9669ba3833794ff32f3feaf105c6b
SHA1 333bb28f37c4fbffd6b85521d12ae348eac01d14
SHA512 070ff40cde21568a829bdc1f8601222ed215f33baadeb6290ff0cb157b45b4ac88f8803c8814b08d3822f397eaf7c97fd26b69fd2011ff6ec80e366aad461ee1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx726:BemTLkNdfE0pZri
MD5 SHA1 SHA512 SSDEEP

Submit Download

WZSsYZb.exe

Path C:\Windows\System\WZSsYZb.exe
Size 2.2MB
SHA256 fda7aeacc0a37c2f24da5c2b95327e868ea2af62ed2a07aa2911276a97c59654
MD5 6671099e15b5e762252cd8787dab9541
SHA1 35ffe50b8ea9acda29ff771305e9b8d519bd865c
SHA512 0a0ccbcb9031bcdedf1b179b24d436b343b1d87c3c2a0b9f4af0263dc1791b355aee56906411fbbb3ed60cfa511a7768f60cb012a446854a4297981615977d3e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72b:BemTLkNdfE0pZrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBRvkii.exe

Path C:\Windows\System\cBRvkii.exe
Size 2.2MB
SHA256 0126e07deadc465041bf1ceba059d6c57178ec33443963f4d62a11083e953cc4
MD5 970194885215b0dad98d636e53549b5f
SHA1 cabb4983e856db7127a8d62fb32ec286fb51d031
SHA512 60ac846460257e43af62952a0d7e250bb3c5b7efa3f580df2db6d552c37e4df4897c70d4ce6a73c12c3fac5e489f6034e37eebfb4059c895dde7e2c19414ab0e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72B:BemTLkNdfE0pZr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZoViAb.exe

Path C:\Windows\System\cZoViAb.exe
Size 2.2MB
SHA256 867a5e89c60375123e6e5e04f9f75af45aea395a814e406dc30a8d05d7cd2725
MD5 785d304022a8a2d70f57b9225e75dbab
SHA1 34b488e2b9cb5668466bc2bb7e0fc0d696f933f7
SHA512 2763bcdeaf29801bd720add23da4470f5ae7a47b1c2a08a56b12acec0d723799e345c8b4f04651adb62dbba02c4d09541681854e4bc33e175f1e1250717929db
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx723:BemTLkNdfE0pZrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpWHynr.exe

Path C:\Windows\System\cpWHynr.exe
Size 2.2MB
SHA256 5d9c0b0b6a9e2a37ec018f31480582633c6647ab49cb0429513de312634eb6d9
MD5 348acee3ffc634f07ffdb6f427205c60
SHA1 14291bd02674cb2879747f24249fd9f9cb4e0cf8
SHA512 64885f8386ab138ad36a71c994ce08eaba181f88d881308a8dcce38c68eabc119ef5ac0e4ddddedb2ad3b4c0fd52fdad45915721dcdb197f6b12903e79692996
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72S:BemTLkNdfE0pZrK
MD5 SHA1 SHA512 SSDEEP

Submit Download

dIicfJa.exe

Path C:\Windows\System\dIicfJa.exe
Size 2.2MB
SHA256 78f49351a5d89b4bdb80ac867751c6a19f4e296dc0277fb8328a80e44bd3314a
MD5 cd7239524e918d5b3231f6554a816e61
SHA1 987c3a22faf698b2cf865b74c0a0ea43f7a05857
SHA512 0e7f8c2b488ffcb2ee73a95b4b46c2924a02c718f42bc58637c79714cf6e15013fc3db462b8062da93fabb463b61bf6e492aa2608d3a78ba3d75c4fbbc2c16bf
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72z:BemTLkNdfE0pZrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

etkqTJg.exe

Path C:\Windows\System\etkqTJg.exe
Size 2.2MB
SHA256 abedbec55f449fab2a186e33d1f53149226b527b789a7c28d2a81a8933acd0c1
MD5 ca85be6b7dc08b7b573bb4e02624a4af
SHA1 98fa0c41003fb88c250a373614f5a4da336de6bc
SHA512 b7a70d77ac5584f4215138dff82752832ce9589eb0ab79683aae6f62f319b25bb2452457a4722623ef0cfddcfafc92fd79534768abd851c775243e3206817aec
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72D:BemTLkNdfE0pZrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gxSggag.exe

Path C:\Windows\System\gxSggag.exe
Size 2.2MB
SHA256 5bffede39a78c5d2bd18e85e40cc86687a8496464eaaee7af67df0e9cd1f740f
MD5 143eb5d3dd29ee4d591655ad3bbe7811
SHA1 70df8a21620aabfaf34c496cea4d93145bf3fa1b
SHA512 6248cafe3c5b41ab393ca9eec6b4f80976771b83639d4091d641c559e11c2ce38f4330ab83d457611f48bda8031b1eda2598c54500d648873bf00e8c4c8fd4e5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx722G:BemTLkNdfE0pZr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrYhZGa.exe

Path C:\Windows\System\hrYhZGa.exe
Size 2.2MB
SHA256 1fa1c3b9156c8a9e94a8e0d9d59d081e8ba908712e43b931f3d917ecb6d0a420
MD5 b6324887ef11a286d01ed7b10db5ac03
SHA1 6645dd566a41464ee1a71162b1147301bf57c2fb
SHA512 e76b29eba4ad658de5e59ea4118650076cb6eae62db50ccc11475c92cf1e37f25c13f84b85cd6beb597c530023e5a2c078cd9eab6f66e407b7d4be0bf9bbd833
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx729:BemTLkNdfE0pZrF
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrigVoi.exe

Path C:\Windows\System\hrigVoi.exe
Size 2.2MB
SHA256 6289109cf66ed0de2acb420bb300f65253f9fcca8524aa1716fd06e50d875be0
MD5 71cb5059c3d54e13bbc777fbc7a4b537
SHA1 39fc7b102ef156ba8ab1696704e357cd9062e67c
SHA512 2ca27a3a5d9eaf6938e5749dbcf2274fb9fbbf67853d3c61b4ea5b88b90c5cdf6f6f00de0a57cba0e6e5035024ff32622c5b97cb204f3bbb90ab14612bd75c21
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx720:BemTLkNdfE0pZrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixYgSiD.exe

Path C:\Windows\System\ixYgSiD.exe
Size 2.2MB
SHA256 4bfd09465839b755cabecb17db6aa284d38128e348bbf299419b4710eaa23735
MD5 3fce1eba363bcc6626b144e86106c58c
SHA1 e9deef22045cba244dd6bc0cd3d29b3ba7c6aeb5
SHA512 702b63b758fb912b721592e5f1ab4d5869a62a4c0b7fecd6c390c1179908c8fb2f063cb851db31ba18cfa845085b9394741b9cec5b05f6cac15e8a7a418bea49
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72cy:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

jesXTIs.exe

Path C:\Windows\System\jesXTIs.exe
Size 2.2MB
SHA256 9ecfb5845ad2b324a7f0d66048f0d222dce2dc027626ab746eab8e6e39bfa2e7
MD5 dbb37c1683836d8d61b0f6bd8560e6ff
SHA1 2114319100dfd257046fe4c53457e4c53bb333c3
SHA512 ab9b63d895f2a2a34039633f0f07bee0eafd576d3b29a9a7b59c38560b4606b00463b1d5b67857a873bb4af0234a88e8b9e8292d21cdcfb01b09dfdaf99fb2d5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72c:BemTLkNdfE0pZrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

lGovqYe.exe

Path C:\Windows\System\lGovqYe.exe
Size 2.2MB
SHA256 0b834cc0e16617fe2608a7e13221c513196bc5dbe160b832d2ca8917260c94c7
MD5 99ad6e781026c78944814370e74cf07d
SHA1 4028558dafb374d0278b6adb26ed9b8c7bcbcba0
SHA512 d1994f72b7c5a3ea24c59e065ead6573c9a4150795226b85ef3083c33ad6b7011783507366a53a45d4800bf111b1454e592d0b13533a2494c88f34f76b575a65
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72n:BemTLkNdfE0pZrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

llEFYLA.exe

Path C:\Windows\System\llEFYLA.exe
Size 2.2MB
SHA256 12224123415e91da315573dcd42f1136a7c1cc2a7fa82708033959d35c21a855
MD5 6fc52ab502975da345eece2d70b97f7e
SHA1 b08d1ab471d4a5de9adc80639c54c50b2eab4cef
SHA512 10c63d0f7de4b47e5765f95a35608338b9ad240af8cad20591a55b5c7b9c54510a0ea8b33def0a87f70c3b72a6fa421fd1c8d5d48939b076cf6eebcf7c3acf8a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72Q:BemTLkNdfE0pZr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

pEhMfSk.exe

Path C:\Windows\System\pEhMfSk.exe
Size 2.2MB
SHA256 83d086c11b16ffecd0775945416117bde7b05fb9639116a47bd85a30370fe4c7
MD5 0e7e872e0d0866451be0a5dbb3066e8c
SHA1 80e6c6b5739d58fabe63292452232640d994fde2
SHA512 188e83882b43cb0973135d87b1d9bb58dec1711f45cbda0ca79632cd03b8d0d859f4a2647b386a8cfec39c9bdc46d6aa29e7edee5d030c9eb91bd30eb0c4e2d8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx720:BemTLkNdfE0pZrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

qLAQSfb.exe

Path C:\Windows\System\qLAQSfb.exe
Size 2.2MB
SHA256 f8b341805950da97026bd2873d947dc4eead87ea6e48e95470ad0c4023c48400
MD5 66c28d49540e32be63579b5051e4ccad
SHA1 3f1903439c7a15ce9686075fe79a9fe27da0e89f
SHA512 363b07065a913fa63c89bf1cebbefb83eaa36062f01ace3a2da665567b4193cfa39a7a69dcaed28e9286f3146b3544e79b6b838d6655891350922a767248cf24
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72z:BemTLkNdfE0pZrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rNDIBXD.exe

Path C:\Windows\System\rNDIBXD.exe
Size 2.2MB
SHA256 4dd1e5265084c561748fc4f63117d63a3057322d9eeb9c6b6e66d28165fc78fe
MD5 330ddbb11dc87327059f77353445c94c
SHA1 7752167437370d2d8fb3e50ac46d4dd8649ee5d3
SHA512 e8908605f03d094ad28660fb8505686edca47dab2042872755011824a2644573930ed406446a4949ea771bdf9f98aa4c758305d3474f093283ece95d6d91bf9f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx729:BemTLkNdfE0pZr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

vKTHaRL.exe

Path C:\Windows\System\vKTHaRL.exe
Size 2.2MB
SHA256 446960a4416e73bb79cdb356823327ff884552ab3025706e629cd7d27c79489d
MD5 7e846cf6820b53e630944bdc11017327
SHA1 10a13d757dbbcb1245b3da40b46aa250b43bebd6
SHA512 c63cb96525cbd55347ef7c6f6a4203e5c224b601a2050fcc2f5657a164c91bc4df349380e740b77556a38f5b325a2e7cab27c097737f98c8c26deb44e42459ac
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx720:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vQTxxgp.exe

Path C:\Windows\System\vQTxxgp.exe
Size 2.2MB
SHA256 5cba864609a5a0ff0c071b8e0b0be96833d2b7768bd3af3b9b56ad905dee4228
MD5 21c6a20e7c6f79d6c619b441a73fd5c1
SHA1 6cb6ff2f436c3749a56b2ab351388e6251bf365f
SHA512 30e9d0763ea4b38bf35c9faca025af339bc92d582e3dbc23a57ba3111f18113a23f9dd9a55f594b88d04cbc57bae8175c707ac025ebda4c826a0cfd5dd2be0b4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72M:BemTLkNdfE0pZrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ypGdcXf.exe

Path C:\Windows\System\ypGdcXf.exe
Size 2.2MB
SHA256 3f6b128c1e989ccede408f8811185a11f98082f2bb174b56affac72b147c6a45
MD5 1b41a22f86d4119f98db318e2aa6ddd5
SHA1 a4928c7456180cd3f572daa416a728fcda591597
SHA512 9f2b8e8d45be4562424dee092657f0b8b5cde9ac5ee6e3fd3531817af4718e067a1101faef1bc96feabfae92d8adb47c47c3191eaa3fba28299d6c7049db68a6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72D:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

zwMPoSx.exe

Path C:\Windows\System\zwMPoSx.exe
Size 2.2MB
SHA256 45b24cc616394ad1fa95759d79f1faf64dc2b7276e25e7167f4e0078385ca985
MD5 acf466259b531a661a06435e80b9c604
SHA1 4b3cb958e97824867f15b774812bfdaac0476408
SHA512 04091bdcef608b6386d27e5de257381d7af74191fc660b3ac3edb769ec4e77cb9de53dc3d7090e40aaaf6c4922d2e32970acfe036d037e18869eb7c186f7c721
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ANXx72yx:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-146-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp

Download

memory/60-30-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp

Download

memory/60-2238-0x00007FF75C6C0000-0x00007FF75CA14000-memory.dmp

Download

memory/892-2244-0x00007FF6BED40000-0x00007FF6BF094000-memory.dmp

Download

memory/892-905-0x00007FF6BED40000-0x00007FF6BF094000-memory.dmp

Download

memory/892-52-0x00007FF6BED40000-0x00007FF6BF094000-memory.dmp

Download

memory/1172-2255-0x00007FF6C1230000-0x00007FF6C1584000-memory.dmp

Download

memory/1172-126-0x00007FF6C1230000-0x00007FF6C1584000-memory.dmp

Download

memory/1208-33-0x00007FF6535F0000-0x00007FF653944000-memory.dmp

Download

memory/1208-2243-0x00007FF6535F0000-0x00007FF653944000-memory.dmp

Download

memory/1208-147-0x00007FF6535F0000-0x00007FF653944000-memory.dmp

Download

memory/1548-101-0x00007FF6D2E60000-0x00007FF6D31B4000-memory.dmp

Download

memory/1548-2253-0x00007FF6D2E60000-0x00007FF6D31B4000-memory.dmp

Download

memory/1584-2259-0x00007FF6BF090000-0x00007FF6BF3E4000-memory.dmp

Download

memory/1584-168-0x00007FF6BF090000-0x00007FF6BF3E4000-memory.dmp

Download

memory/1656-2257-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp

Download

memory/1656-153-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp

Download

memory/1952-2246-0x00007FF6440D0000-0x00007FF644424000-memory.dmp

Download

memory/1952-64-0x00007FF6440D0000-0x00007FF644424000-memory.dmp

Download

memory/2004-1655-0x00007FF6CD5B0000-0x00007FF6CD904000-memory.dmp

Download

memory/2004-100-0x00007FF6CD5B0000-0x00007FF6CD904000-memory.dmp

Download

memory/2004-2252-0x00007FF6CD5B0000-0x00007FF6CD904000-memory.dmp

Download

memory/2028-2235-0x00007FF68AE90000-0x00007FF68B1E4000-memory.dmp

Download

memory/2028-2263-0x00007FF68AE90000-0x00007FF68B1E4000-memory.dmp

Download

memory/2028-170-0x00007FF68AE90000-0x00007FF68B1E4000-memory.dmp

Download

memory/2540-70-0x00007FF750BB0000-0x00007FF750F04000-memory.dmp

Download

memory/2540-2247-0x00007FF750BB0000-0x00007FF750F04000-memory.dmp

Download

memory/2584-0-0x00007FF6B5F30000-0x00007FF6B6284000-memory.dmp

Download

memory/2584-117-0x00007FF6B5F30000-0x00007FF6B6284000-memory.dmp

Download

memory/2584-1-0x0000027428210000-0x0000027428220000-memory.dmp

Download

memory/2664-2068-0x00007FF722760000-0x00007FF722AB4000-memory.dmp

Download

memory/2664-2251-0x00007FF722760000-0x00007FF722AB4000-memory.dmp

Download

memory/2664-97-0x00007FF722760000-0x00007FF722AB4000-memory.dmp

Download

memory/2720-2254-0x00007FF751110000-0x00007FF751464000-memory.dmp

Download

memory/2720-124-0x00007FF751110000-0x00007FF751464000-memory.dmp

Download

memory/2772-187-0x00007FF7CA0C0000-0x00007FF7CA414000-memory.dmp

Download

memory/2772-2265-0x00007FF7CA0C0000-0x00007FF7CA414000-memory.dmp

Download

memory/2772-2236-0x00007FF7CA0C0000-0x00007FF7CA414000-memory.dmp

Download

memory/2840-2256-0x00007FF6A0920000-0x00007FF6A0C74000-memory.dmp

Download

memory/2840-135-0x00007FF6A0920000-0x00007FF6A0C74000-memory.dmp

Download

memory/2928-15-0x00007FF63B7F0000-0x00007FF63BB44000-memory.dmp

Download

memory/2928-2237-0x00007FF63B7F0000-0x00007FF63BB44000-memory.dmp

Download

memory/3140-40-0x00007FF6DDFB0000-0x00007FF6DE304000-memory.dmp

Download

memory/3140-2241-0x00007FF6DDFB0000-0x00007FF6DE304000-memory.dmp

Download

memory/3164-2239-0x00007FF6C6F60000-0x00007FF6C72B4000-memory.dmp

Download

memory/3164-42-0x00007FF6C6F60000-0x00007FF6C72B4000-memory.dmp

Download

memory/3436-154-0x00007FF668770000-0x00007FF668AC4000-memory.dmp

Download

memory/3436-2234-0x00007FF668770000-0x00007FF668AC4000-memory.dmp

Download

memory/3436-2260-0x00007FF668770000-0x00007FF668AC4000-memory.dmp

Download

memory/3476-148-0x00007FF7C8060000-0x00007FF7C83B4000-memory.dmp

Download

memory/3476-2258-0x00007FF7C8060000-0x00007FF7C83B4000-memory.dmp

Download

memory/3732-2240-0x00007FF753D40000-0x00007FF754094000-memory.dmp

Download

memory/3732-31-0x00007FF753D40000-0x00007FF754094000-memory.dmp

Download

memory/3732-165-0x00007FF753D40000-0x00007FF754094000-memory.dmp

Download

memory/4200-2242-0x00007FF774F00000-0x00007FF775254000-memory.dmp

Download

memory/4200-49-0x00007FF774F00000-0x00007FF775254000-memory.dmp

Download

memory/4240-2233-0x00007FF73C640000-0x00007FF73C994000-memory.dmp

Download

memory/4240-2264-0x00007FF73C640000-0x00007FF73C994000-memory.dmp

Download

memory/4240-164-0x00007FF73C640000-0x00007FF73C994000-memory.dmp

Download

memory/4440-2245-0x00007FF687170000-0x00007FF6874C4000-memory.dmp

Download

memory/4440-51-0x00007FF687170000-0x00007FF6874C4000-memory.dmp

Download

memory/4440-180-0x00007FF687170000-0x00007FF6874C4000-memory.dmp

Download

memory/4508-93-0x00007FF7DC610000-0x00007FF7DC964000-memory.dmp

Download

memory/4508-2250-0x00007FF7DC610000-0x00007FF7DC964000-memory.dmp

Download

memory/4824-169-0x00007FF6D21B0000-0x00007FF6D2504000-memory.dmp

Download

memory/4824-2261-0x00007FF6D21B0000-0x00007FF6D2504000-memory.dmp

Download

memory/4868-2262-0x00007FF7043E0000-0x00007FF704734000-memory.dmp

Download

memory/4868-2232-0x00007FF7043E0000-0x00007FF704734000-memory.dmp

Download

memory/4868-139-0x00007FF7043E0000-0x00007FF704734000-memory.dmp

Download

memory/4936-92-0x00007FF792200000-0x00007FF792554000-memory.dmp

Download

memory/4936-2249-0x00007FF792200000-0x00007FF792554000-memory.dmp

Download

memory/4976-2248-0x00007FF6BD950000-0x00007FF6BDCA4000-memory.dmp

Download

memory/4976-90-0x00007FF6BD950000-0x00007FF6BDCA4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads