xmrig | 2df48592fac5fea2c585bcb2fd10c4179e90d0f5d35e3e7f26a900a621f0bda0

Analysis

max time kernel
127s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
Size 1.5MB
Sample240518-jfamnshh7x
SHA256 2df48592fac5fea2c585bcb2fd10c4179e90d0f5d35e3e7f26a900a621f0bda0
MD5 ac4d323ee98030ceab861a470dccd960
SHA1 d2d7e5ffd108366a5dd1ca696ad559812cdc444b
SHA512 01890de95409858c4dd131238e68ab0489886131e163819206785b2fb79527be18b038864e92a802595f772321f9dacdd287f17b6f7b819af28cb22be9dc8712
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgP:ROdWCCi7/rahOYkZtg94V8XRTgXe8P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/3848-236-0x00007FF61A5C0000-0x00007FF61A911000-memory.dmp	xmrig
behavioral2/memory/3400-282-0x00007FF774450000-0x00007FF7747A1000-memory.dmp	xmrig
behavioral2/memory/1616-377-0x00007FF6EB800000-0x00007FF6EBB51000-memory.dmp	xmrig
behavioral2/memory/3372-404-0x00007FF7296B0000-0x00007FF729A01000-memory.dmp	xmrig
behavioral2/memory/804-436-0x00007FF78FC70000-0x00007FF78FFC1000-memory.dmp	xmrig
behavioral2/memory/3008-493-0x00007FF7A8360000-0x00007FF7A86B1000-memory.dmp	xmrig
behavioral2/memory/4836-496-0x00007FF7D28E0000-0x00007FF7D2C31000-memory.dmp	xmrig
behavioral2/memory/2144-572-0x00007FF680B20000-0x00007FF680E71000-memory.dmp	xmrig
behavioral2/memory/1064-571-0x00007FF6A16F0000-0x00007FF6A1A41000-memory.dmp	xmrig
behavioral2/memory/1240-570-0x00007FF603CE0000-0x00007FF604031000-memory.dmp	xmrig
behavioral2/memory/4120-569-0x00007FF667CC0000-0x00007FF668011000-memory.dmp	xmrig
behavioral2/memory/1652-568-0x00007FF7350A0000-0x00007FF7353F1000-memory.dmp	xmrig
behavioral2/memory/4228-567-0x00007FF6EA5C0000-0x00007FF6EA911000-memory.dmp	xmrig
behavioral2/memory/1708-566-0x00007FF7D76D0000-0x00007FF7D7A21000-memory.dmp	xmrig
behavioral2/memory/1000-540-0x00007FF6ED620000-0x00007FF6ED971000-memory.dmp	xmrig
behavioral2/memory/3376-405-0x00007FF6BB620000-0x00007FF6BB971000-memory.dmp	xmrig
behavioral2/memory/4124-348-0x00007FF69FF60000-0x00007FF6A02B1000-memory.dmp	xmrig
behavioral2/memory/1996-346-0x00007FF7544C0000-0x00007FF754811000-memory.dmp	xmrig
behavioral2/memory/2740-316-0x00007FF625040000-0x00007FF625391000-memory.dmp	xmrig
behavioral2/memory/852-306-0x00007FF7BD380000-0x00007FF7BD6D1000-memory.dmp	xmrig
behavioral2/memory/2816-237-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp	xmrig
behavioral2/memory/4996-225-0x00007FF667690000-0x00007FF6679E1000-memory.dmp	xmrig
behavioral2/memory/3284-2156-0x00007FF7311F0000-0x00007FF731541000-memory.dmp	xmrig
behavioral2/memory/4840-2255-0x00007FF7CF4E0000-0x00007FF7CF831000-memory.dmp	xmrig
behavioral2/memory/672-2259-0x00007FF6CBF70000-0x00007FF6CC2C1000-memory.dmp	xmrig
behavioral2/memory/2436-2261-0x00007FF69ADE0000-0x00007FF69B131000-memory.dmp	xmrig
behavioral2/memory/1908-2260-0x00007FF630A30000-0x00007FF630D81000-memory.dmp	xmrig
behavioral2/memory/4316-2258-0x00007FF6FE8D0000-0x00007FF6FEC21000-memory.dmp	xmrig
behavioral2/memory/4144-2257-0x00007FF6DF5C0000-0x00007FF6DF911000-memory.dmp	xmrig
behavioral2/memory/2252-2256-0x00007FF6146D0000-0x00007FF614A21000-memory.dmp	xmrig
behavioral2/memory/4840-2295-0x00007FF7CF4E0000-0x00007FF7CF831000-memory.dmp	xmrig
behavioral2/memory/2252-2301-0x00007FF6146D0000-0x00007FF614A21000-memory.dmp	xmrig
behavioral2/memory/4228-2306-0x00007FF6EA5C0000-0x00007FF6EA911000-memory.dmp	xmrig
behavioral2/memory/4144-2313-0x00007FF6DF5C0000-0x00007FF6DF911000-memory.dmp	xmrig
behavioral2/memory/4316-2316-0x00007FF6FE8D0000-0x00007FF6FEC21000-memory.dmp	xmrig
behavioral2/memory/2816-2322-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp	xmrig
behavioral2/memory/1908-2324-0x00007FF630A30000-0x00007FF630D81000-memory.dmp	xmrig
behavioral2/memory/4120-2320-0x00007FF667CC0000-0x00007FF668011000-memory.dmp	xmrig
behavioral2/memory/672-2318-0x00007FF6CBF70000-0x00007FF6CC2C1000-memory.dmp	xmrig
behavioral2/memory/1652-2310-0x00007FF7350A0000-0x00007FF7353F1000-memory.dmp	xmrig
behavioral2/memory/2436-2326-0x00007FF69ADE0000-0x00007FF69B131000-memory.dmp	xmrig
behavioral2/memory/4996-2332-0x00007FF667690000-0x00007FF6679E1000-memory.dmp	xmrig
behavioral2/memory/1064-2354-0x00007FF6A16F0000-0x00007FF6A1A41000-memory.dmp	xmrig
behavioral2/memory/852-2356-0x00007FF7BD380000-0x00007FF7BD6D1000-memory.dmp	xmrig
behavioral2/memory/2144-2359-0x00007FF680B20000-0x00007FF680E71000-memory.dmp	xmrig
behavioral2/memory/4836-2362-0x00007FF7D28E0000-0x00007FF7D2C31000-memory.dmp	xmrig
behavioral2/memory/1996-2366-0x00007FF7544C0000-0x00007FF754811000-memory.dmp	xmrig
behavioral2/memory/4124-2353-0x00007FF69FF60000-0x00007FF6A02B1000-memory.dmp	xmrig
behavioral2/memory/1616-2350-0x00007FF6EB800000-0x00007FF6EBB51000-memory.dmp	xmrig
behavioral2/memory/2740-2349-0x00007FF625040000-0x00007FF625391000-memory.dmp	xmrig
behavioral2/memory/3372-2346-0x00007FF7296B0000-0x00007FF729A01000-memory.dmp	xmrig
behavioral2/memory/3376-2344-0x00007FF6BB620000-0x00007FF6BB971000-memory.dmp	xmrig
behavioral2/memory/1000-2342-0x00007FF6ED620000-0x00007FF6ED971000-memory.dmp	xmrig
behavioral2/memory/1708-2340-0x00007FF7D76D0000-0x00007FF7D7A21000-memory.dmp	xmrig
behavioral2/memory/3848-2339-0x00007FF61A5C0000-0x00007FF61A911000-memory.dmp	xmrig
behavioral2/memory/3400-2337-0x00007FF774450000-0x00007FF7747A1000-memory.dmp	xmrig
behavioral2/memory/804-2335-0x00007FF78FC70000-0x00007FF78FFC1000-memory.dmp	xmrig
behavioral2/memory/1240-2330-0x00007FF603CE0000-0x00007FF604031000-memory.dmp	xmrig
behavioral2/memory/3008-2328-0x00007FF7A8360000-0x00007FF7A86B1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4840	vhtIExL.exe
2252	gegVXAl.exe
4144	HZHdxND.exe
4228	VGOhlBC.exe
1652	yTBkAkg.exe
4316	dzHGFxi.exe
672	HKHiuOl.exe
1908	idJbjqe.exe
2436	bnkFXux.exe
4996	inezltd.exe
4120	YlqGAzW.exe
1240	mPZLCVP.exe
3848	lutRjPD.exe
2816	avAxHyH.exe
3400	JORxJoq.exe
1064	lXrssua.exe
852	fwQDCKY.exe
2740	JVGwrbT.exe
1996	KdjYKuY.exe
4124	FlSSspA.exe
1616	iCTXJbs.exe
3372	gkjvPRN.exe
3376	swoabeT.exe
804	UCwQEgc.exe
3008	BGXPOJI.exe
2144	sVOutVB.exe
4836	dAPLgjS.exe
1000	LxqXfmy.exe
1708	ylOiSuY.exe
2160	CSJSgJE.exe
3304	lkPgLPd.exe
4696	SGsCMDn.exe
4100	zxHjgio.exe
4160	WgznCBN.exe
1228	hsXENWa.exe
2540	LBHmzSP.exe
2112	pimupVJ.exe
2136	FyjvsLH.exe
2244	ZOFBZGZ.exe
1264	iAlCAjA.exe
2440	GuFtrdf.exe
916	jehIsgO.exe
2504	wokBkhU.exe
228	IASnZgS.exe
4600	AsqMpWB.exe
3740	nXgExQY.exe
4844	PRcIOBR.exe
3420	zraaXFq.exe
4828	tCznrdE.exe
3156	dYOotbh.exe
3036	pUPttUG.exe
1268	wNNjgaE.exe
3344	rtLTJko.exe
4132	xSxrxUM.exe
380	VEJdyyH.exe
844	ULZltOP.exe
3988	iuAhZed.exe
5144	UzrJqfC.exe
5172	dFKPFfM.exe
4288	KwTcIHN.exe
5192	EOERkJb.exe
5216	vObmkqm.exe
5236	TIrCnst.exe
5252	edQjYHo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3284-0-0x00007FF7311F0000-0x00007FF731541000-memory.dmp	upx
behavioral2/files/0x00080000000235be-5.dat	upx
behavioral2/memory/4840-10-0x00007FF7CF4E0000-0x00007FF7CF831000-memory.dmp	upx
behavioral2/files/0x00070000000235c6-37.dat	upx
behavioral2/files/0x00070000000235c4-18.dat	upx
behavioral2/files/0x00070000000235c7-84.dat	upx
behavioral2/files/0x00070000000235d8-155.dat	upx
behavioral2/files/0x00070000000235ea-210.dat	upx
behavioral2/memory/3848-236-0x00007FF61A5C0000-0x00007FF61A911000-memory.dmp	upx
behavioral2/memory/3400-282-0x00007FF774450000-0x00007FF7747A1000-memory.dmp	upx
behavioral2/memory/1616-377-0x00007FF6EB800000-0x00007FF6EBB51000-memory.dmp	upx
behavioral2/memory/3372-404-0x00007FF7296B0000-0x00007FF729A01000-memory.dmp	upx
behavioral2/memory/804-436-0x00007FF78FC70000-0x00007FF78FFC1000-memory.dmp	upx
behavioral2/memory/3008-493-0x00007FF7A8360000-0x00007FF7A86B1000-memory.dmp	upx
behavioral2/memory/4836-496-0x00007FF7D28E0000-0x00007FF7D2C31000-memory.dmp	upx
behavioral2/memory/2144-572-0x00007FF680B20000-0x00007FF680E71000-memory.dmp	upx
behavioral2/memory/1064-571-0x00007FF6A16F0000-0x00007FF6A1A41000-memory.dmp	upx
behavioral2/memory/1240-570-0x00007FF603CE0000-0x00007FF604031000-memory.dmp	upx
behavioral2/memory/4120-569-0x00007FF667CC0000-0x00007FF668011000-memory.dmp	upx
behavioral2/memory/1652-568-0x00007FF7350A0000-0x00007FF7353F1000-memory.dmp	upx
behavioral2/memory/4228-567-0x00007FF6EA5C0000-0x00007FF6EA911000-memory.dmp	upx
behavioral2/memory/1708-566-0x00007FF7D76D0000-0x00007FF7D7A21000-memory.dmp	upx
behavioral2/memory/1000-540-0x00007FF6ED620000-0x00007FF6ED971000-memory.dmp	upx
behavioral2/memory/3376-405-0x00007FF6BB620000-0x00007FF6BB971000-memory.dmp	upx
behavioral2/memory/4124-348-0x00007FF69FF60000-0x00007FF6A02B1000-memory.dmp	upx
behavioral2/memory/1996-346-0x00007FF7544C0000-0x00007FF754811000-memory.dmp	upx
behavioral2/memory/2740-316-0x00007FF625040000-0x00007FF625391000-memory.dmp	upx
behavioral2/memory/852-306-0x00007FF7BD380000-0x00007FF7BD6D1000-memory.dmp	upx
behavioral2/memory/2816-237-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp	upx
behavioral2/memory/4996-225-0x00007FF667690000-0x00007FF6679E1000-memory.dmp	upx
behavioral2/files/0x00070000000235e9-207.dat	upx
behavioral2/files/0x00070000000235d7-203.dat	upx
behavioral2/files/0x00070000000235d6-200.dat	upx
behavioral2/files/0x00070000000235d5-192.dat	upx
behavioral2/files/0x00070000000235e8-191.dat	upx
behavioral2/files/0x00070000000235e7-187.dat	upx
behavioral2/files/0x00070000000235d4-177.dat	upx
behavioral2/files/0x00070000000235e5-175.dat	upx
behavioral2/files/0x00070000000235d2-173.dat	upx
behavioral2/files/0x00070000000235d1-171.dat	upx
behavioral2/memory/2436-168-0x00007FF69ADE0000-0x00007FF69B131000-memory.dmp	upx
behavioral2/files/0x00070000000235e2-167.dat	upx
behavioral2/files/0x00070000000235e0-161.dat	upx
behavioral2/files/0x00070000000235df-160.dat	upx
behavioral2/files/0x00070000000235de-158.dat	upx
behavioral2/files/0x00070000000235dd-148.dat	upx
behavioral2/files/0x00070000000235dc-147.dat	upx
behavioral2/files/0x00070000000235e6-176.dat	upx
behavioral2/files/0x00070000000235db-136.dat	upx
behavioral2/files/0x00070000000235cd-133.dat	upx
behavioral2/files/0x00070000000235ca-128.dat	upx
behavioral2/files/0x00070000000235c9-125.dat	upx
behavioral2/files/0x00070000000235da-124.dat	upx
behavioral2/files/0x00070000000235e1-163.dat	upx
behavioral2/files/0x00070000000235d9-118.dat	upx
behavioral2/memory/1908-117-0x00007FF630A30000-0x00007FF630D81000-memory.dmp	upx
behavioral2/files/0x00070000000235cc-110.dat	upx
behavioral2/files/0x00070000000235cf-146.dat	upx
behavioral2/files/0x00070000000235ce-99.dat	upx
behavioral2/files/0x00070000000235d3-94.dat	upx
behavioral2/files/0x00070000000235d0-87.dat	upx
behavioral2/memory/672-78-0x00007FF6CBF70000-0x00007FF6CC2C1000-memory.dmp	upx
behavioral2/files/0x00070000000235cb-66.dat	upx
behavioral2/files/0x00070000000235c5-63.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gQiQtVv.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\OBWrRtc.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\MyZbMLI.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\LHaKZiV.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\RpDwlvV.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\nEoyJcU.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\cCqhosa.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\mdVlFIN.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\nkBKgEL.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\kqVgeML.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\LJhtHMy.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\EFTpGfN.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\MOsHieN.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\lCOrqhB.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\UcplFcg.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\EmcFWgE.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\OEBonHo.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\FjvcbFX.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\NIOEpJF.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\gegVXAl.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\RlJJzaR.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\WDpjJvK.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\aXqKFJU.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\GeCkIRD.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\mOavlgM.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\pDCZLej.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\HcSCBJJ.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\pNpvqkf.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\vhtIExL.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\RVJDesZ.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\LgIdjqq.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\SthNjMR.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\KSfWgKl.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\pwpoaLQ.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\duQGyzs.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\ePfgIyz.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\nkRGmFd.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\dYcHKfQ.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\DYzJMpY.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\tNgOMRj.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\FNFmktY.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\QxUcQIp.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\HZHdxND.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\kXFXfGz.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\vtuXCNN.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\nXMKMKu.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\NEfPfAk.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\asMrGCh.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\bUJfzxY.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\QMkwaxa.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\wwSUCVG.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\yvGehbq.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\BJGgSUs.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\inezltd.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\SNWjLXl.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\IKegist.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\hqFSDzr.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\odEqxWd.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\QbtEmLa.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\kvQeWJy.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\oPHNCgj.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\NUJOTDq.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\jzLMsCT.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
File created	C:\Windows\System\wFFbMsJ.exe	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4840	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	91
PID 3284 wrote to memory of 4840	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	91
PID 3284 wrote to memory of 2252	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	92
PID 3284 wrote to memory of 2252	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	92
PID 3284 wrote to memory of 4144	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	93
PID 3284 wrote to memory of 4144	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	93
PID 3284 wrote to memory of 4228	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	94
PID 3284 wrote to memory of 4228	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	94
PID 3284 wrote to memory of 1652	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	95
PID 3284 wrote to memory of 1652	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	95
PID 3284 wrote to memory of 4316	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	96
PID 3284 wrote to memory of 4316	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	96
PID 3284 wrote to memory of 672	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	97
PID 3284 wrote to memory of 672	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	97
PID 3284 wrote to memory of 1908	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	98
PID 3284 wrote to memory of 1908	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	98
PID 3284 wrote to memory of 2436	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	99
PID 3284 wrote to memory of 2436	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	99
PID 3284 wrote to memory of 4996	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	100
PID 3284 wrote to memory of 4996	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	100
PID 3284 wrote to memory of 4120	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	101
PID 3284 wrote to memory of 4120	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	101
PID 3284 wrote to memory of 1240	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	102
PID 3284 wrote to memory of 1240	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	102
PID 3284 wrote to memory of 3848	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	103
PID 3284 wrote to memory of 3848	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	103
PID 3284 wrote to memory of 2816	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	104
PID 3284 wrote to memory of 2816	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	104
PID 3284 wrote to memory of 3400	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	105
PID 3284 wrote to memory of 3400	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	105
PID 3284 wrote to memory of 1064	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	106
PID 3284 wrote to memory of 1064	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	106
PID 3284 wrote to memory of 852	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	107
PID 3284 wrote to memory of 852	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	107
PID 3284 wrote to memory of 2740	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	108
PID 3284 wrote to memory of 2740	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	108
PID 3284 wrote to memory of 1996	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	109
PID 3284 wrote to memory of 1996	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	109
PID 3284 wrote to memory of 4124	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	110
PID 3284 wrote to memory of 4124	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	110
PID 3284 wrote to memory of 1616	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	111
PID 3284 wrote to memory of 1616	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	111
PID 3284 wrote to memory of 3372	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	112
PID 3284 wrote to memory of 3372	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	112
PID 3284 wrote to memory of 3376	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	113
PID 3284 wrote to memory of 3376	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	113
PID 3284 wrote to memory of 804	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	114
PID 3284 wrote to memory of 804	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	114
PID 3284 wrote to memory of 3008	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	115
PID 3284 wrote to memory of 3008	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	115
PID 3284 wrote to memory of 2144	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	116
PID 3284 wrote to memory of 2144	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	116
PID 3284 wrote to memory of 4836	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	117
PID 3284 wrote to memory of 4836	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	117
PID 3284 wrote to memory of 1000	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	118
PID 3284 wrote to memory of 1000	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	118
PID 3284 wrote to memory of 1708	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	119
PID 3284 wrote to memory of 1708	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	119
PID 3284 wrote to memory of 2160	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	120
PID 3284 wrote to memory of 2160	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	120
PID 3284 wrote to memory of 3304	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	121
PID 3284 wrote to memory of 3304	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	121
PID 3284 wrote to memory of 4696	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	122
PID 3284 wrote to memory of 4696	3284	ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ac4d323ee98030ceab861a470dccd960_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\System\vhtIExL.exe
  C:\Windows\System\vhtIExL.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\gegVXAl.exe
  C:\Windows\System\gegVXAl.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\HZHdxND.exe
  C:\Windows\System\HZHdxND.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\VGOhlBC.exe
  C:\Windows\System\VGOhlBC.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\yTBkAkg.exe
  C:\Windows\System\yTBkAkg.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\dzHGFxi.exe
  C:\Windows\System\dzHGFxi.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\HKHiuOl.exe
  C:\Windows\System\HKHiuOl.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\idJbjqe.exe
  C:\Windows\System\idJbjqe.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\bnkFXux.exe
  C:\Windows\System\bnkFXux.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\inezltd.exe
  C:\Windows\System\inezltd.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\YlqGAzW.exe
  C:\Windows\System\YlqGAzW.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\mPZLCVP.exe
  C:\Windows\System\mPZLCVP.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\lutRjPD.exe
  C:\Windows\System\lutRjPD.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\avAxHyH.exe
  C:\Windows\System\avAxHyH.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\JORxJoq.exe
  C:\Windows\System\JORxJoq.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\lXrssua.exe
  C:\Windows\System\lXrssua.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\fwQDCKY.exe
  C:\Windows\System\fwQDCKY.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\JVGwrbT.exe
  C:\Windows\System\JVGwrbT.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\KdjYKuY.exe
  C:\Windows\System\KdjYKuY.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FlSSspA.exe
  C:\Windows\System\FlSSspA.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\iCTXJbs.exe
  C:\Windows\System\iCTXJbs.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\gkjvPRN.exe
  C:\Windows\System\gkjvPRN.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\swoabeT.exe
  C:\Windows\System\swoabeT.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\UCwQEgc.exe
  C:\Windows\System\UCwQEgc.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\BGXPOJI.exe
  C:\Windows\System\BGXPOJI.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\sVOutVB.exe
  C:\Windows\System\sVOutVB.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\dAPLgjS.exe
  C:\Windows\System\dAPLgjS.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\LxqXfmy.exe
  C:\Windows\System\LxqXfmy.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ylOiSuY.exe
  C:\Windows\System\ylOiSuY.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\CSJSgJE.exe
  C:\Windows\System\CSJSgJE.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\lkPgLPd.exe
  C:\Windows\System\lkPgLPd.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\SGsCMDn.exe
  C:\Windows\System\SGsCMDn.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\zxHjgio.exe
  C:\Windows\System\zxHjgio.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\WgznCBN.exe
  C:\Windows\System\WgznCBN.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\IASnZgS.exe
  C:\Windows\System\IASnZgS.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\AsqMpWB.exe
  C:\Windows\System\AsqMpWB.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\hsXENWa.exe
  C:\Windows\System\hsXENWa.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\LBHmzSP.exe
  C:\Windows\System\LBHmzSP.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\pimupVJ.exe
  C:\Windows\System\pimupVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\FyjvsLH.exe
  C:\Windows\System\FyjvsLH.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ZOFBZGZ.exe
  C:\Windows\System\ZOFBZGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\iAlCAjA.exe
  C:\Windows\System\iAlCAjA.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\KwTcIHN.exe
  C:\Windows\System\KwTcIHN.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\GuFtrdf.exe
  C:\Windows\System\GuFtrdf.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\jehIsgO.exe
  C:\Windows\System\jehIsgO.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\wokBkhU.exe
  C:\Windows\System\wokBkhU.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\nXgExQY.exe
  C:\Windows\System\nXgExQY.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\PRcIOBR.exe
  C:\Windows\System\PRcIOBR.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\zraaXFq.exe
  C:\Windows\System\zraaXFq.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\tCznrdE.exe
  C:\Windows\System\tCznrdE.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\dYOotbh.exe
  C:\Windows\System\dYOotbh.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\pUPttUG.exe
  C:\Windows\System\pUPttUG.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\wNNjgaE.exe
  C:\Windows\System\wNNjgaE.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\rtLTJko.exe
  C:\Windows\System\rtLTJko.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\xSxrxUM.exe
  C:\Windows\System\xSxrxUM.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\VEJdyyH.exe
  C:\Windows\System\VEJdyyH.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ULZltOP.exe
  C:\Windows\System\ULZltOP.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\iuAhZed.exe
  C:\Windows\System\iuAhZed.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\UzrJqfC.exe
  C:\Windows\System\UzrJqfC.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\dFKPFfM.exe
  C:\Windows\System\dFKPFfM.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\EOERkJb.exe
  C:\Windows\System\EOERkJb.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\vObmkqm.exe
  C:\Windows\System\vObmkqm.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\TIrCnst.exe
  C:\Windows\System\TIrCnst.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\edQjYHo.exe
  C:\Windows\System\edQjYHo.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\JTjHCLi.exe
  C:\Windows\System\JTjHCLi.exe
  2⤵
  PID:5280
- C:\Windows\System\HnUcMVc.exe
  C:\Windows\System\HnUcMVc.exe
  2⤵
  PID:5296
- C:\Windows\System\HoLUdLW.exe
  C:\Windows\System\HoLUdLW.exe
  2⤵
  PID:5320
- C:\Windows\System\pODSbzt.exe
  C:\Windows\System\pODSbzt.exe
  2⤵
  PID:5392
- C:\Windows\System\aCWegKp.exe
  C:\Windows\System\aCWegKp.exe
  2⤵
  PID:5416
- C:\Windows\System\QiYOrck.exe
  C:\Windows\System\QiYOrck.exe
  2⤵
  PID:5440
- C:\Windows\System\gjVVqce.exe
  C:\Windows\System\gjVVqce.exe
  2⤵
  PID:5460
- C:\Windows\System\huFbaxZ.exe
  C:\Windows\System\huFbaxZ.exe
  2⤵
  PID:5484
- C:\Windows\System\tFgKlof.exe
  C:\Windows\System\tFgKlof.exe
  2⤵
  PID:5508
- C:\Windows\System\inmKvku.exe
  C:\Windows\System\inmKvku.exe
  2⤵
  PID:5524
- C:\Windows\System\qmwZnuq.exe
  C:\Windows\System\qmwZnuq.exe
  2⤵
  PID:5544
- C:\Windows\System\EeVGylP.exe
  C:\Windows\System\EeVGylP.exe
  2⤵
  PID:5564
- C:\Windows\System\njSFYhL.exe
  C:\Windows\System\njSFYhL.exe
  2⤵
  PID:5588
- C:\Windows\System\gwWDcCk.exe
  C:\Windows\System\gwWDcCk.exe
  2⤵
  PID:5604
- C:\Windows\System\FQTZFyV.exe
  C:\Windows\System\FQTZFyV.exe
  2⤵
  PID:5632
- C:\Windows\System\lorJjAg.exe
  C:\Windows\System\lorJjAg.exe
  2⤵
  PID:5648
- C:\Windows\System\TOUPwqY.exe
  C:\Windows\System\TOUPwqY.exe
  2⤵
  PID:5672
- C:\Windows\System\wFFbMsJ.exe
  C:\Windows\System\wFFbMsJ.exe
  2⤵
  PID:5912
- C:\Windows\System\odEqxWd.exe
  C:\Windows\System\odEqxWd.exe
  2⤵
  PID:5928
- C:\Windows\System\laPnDvH.exe
  C:\Windows\System\laPnDvH.exe
  2⤵
  PID:5948
- C:\Windows\System\JWikYAn.exe
  C:\Windows\System\JWikYAn.exe
  2⤵
  PID:5972
- C:\Windows\System\WKOVwNO.exe
  C:\Windows\System\WKOVwNO.exe
  2⤵
  PID:5988
- C:\Windows\System\NQpUofX.exe
  C:\Windows\System\NQpUofX.exe
  2⤵
  PID:6012
- C:\Windows\System\HonMHQH.exe
  C:\Windows\System\HonMHQH.exe
  2⤵
  PID:6036
- C:\Windows\System\PFmjFZa.exe
  C:\Windows\System\PFmjFZa.exe
  2⤵
  PID:6052
- C:\Windows\System\MgaWfhn.exe
  C:\Windows\System\MgaWfhn.exe
  2⤵
  PID:6068
- C:\Windows\System\ooJfcYx.exe
  C:\Windows\System\ooJfcYx.exe
  2⤵
  PID:6084
- C:\Windows\System\RlJJzaR.exe
  C:\Windows\System\RlJJzaR.exe
  2⤵
  PID:6104
- C:\Windows\System\rjOaekf.exe
  C:\Windows\System\rjOaekf.exe
  2⤵
  PID:3516
- C:\Windows\System\MXGyWnZ.exe
  C:\Windows\System\MXGyWnZ.exe
  2⤵
  PID:2208
- C:\Windows\System\UtHBRHG.exe
  C:\Windows\System\UtHBRHG.exe
  2⤵
  PID:2356
- C:\Windows\System\wIlmSBP.exe
  C:\Windows\System\wIlmSBP.exe
  2⤵
  PID:4924
- C:\Windows\System\tIsvGyR.exe
  C:\Windows\System\tIsvGyR.exe
  2⤵
  PID:2964
- C:\Windows\System\GPzwZMt.exe
  C:\Windows\System\GPzwZMt.exe
  2⤵
  PID:4532
- C:\Windows\System\hBSwslG.exe
  C:\Windows\System\hBSwslG.exe
  2⤵
  PID:1620
- C:\Windows\System\MFpSDKS.exe
  C:\Windows\System\MFpSDKS.exe
  2⤵
  PID:1108
- C:\Windows\System\EfJDwci.exe
  C:\Windows\System\EfJDwci.exe
  2⤵
  PID:4112
- C:\Windows\System\uAejFqA.exe
  C:\Windows\System\uAejFqA.exe
  2⤵
  PID:3972
- C:\Windows\System\MtMQFSr.exe
  C:\Windows\System\MtMQFSr.exe
  2⤵
  PID:5124
- C:\Windows\System\KsSYdZr.exe
  C:\Windows\System\KsSYdZr.exe
  2⤵
  PID:5156
- C:\Windows\System\gbptuXR.exe
  C:\Windows\System\gbptuXR.exe
  2⤵
  PID:5212
- C:\Windows\System\EwuRhWE.exe
  C:\Windows\System\EwuRhWE.exe
  2⤵
  PID:5248
- C:\Windows\System\XZKzzcD.exe
  C:\Windows\System\XZKzzcD.exe
  2⤵
  PID:5308
- C:\Windows\System\ekmPilM.exe
  C:\Windows\System\ekmPilM.exe
  2⤵
  PID:6076
- C:\Windows\System\FANuHpX.exe
  C:\Windows\System\FANuHpX.exe
  2⤵
  PID:5496
- C:\Windows\System\YMGeslv.exe
  C:\Windows\System\YMGeslv.exe
  2⤵
  PID:5468
- C:\Windows\System\PRAUxYn.exe
  C:\Windows\System\PRAUxYn.exe
  2⤵
  PID:5412
- C:\Windows\System\mdVlFIN.exe
  C:\Windows\System\mdVlFIN.exe
  2⤵
  PID:5920
- C:\Windows\System\oalbBPW.exe
  C:\Windows\System\oalbBPW.exe
  2⤵
  PID:6164
- C:\Windows\System\YriISZO.exe
  C:\Windows\System\YriISZO.exe
  2⤵
  PID:6180
- C:\Windows\System\rAeMVOe.exe
  C:\Windows\System\rAeMVOe.exe
  2⤵
  PID:6204
- C:\Windows\System\mOavlgM.exe
  C:\Windows\System\mOavlgM.exe
  2⤵
  PID:6224
- C:\Windows\System\hNhxvfq.exe
  C:\Windows\System\hNhxvfq.exe
  2⤵
  PID:6256
- C:\Windows\System\RPgZzqo.exe
  C:\Windows\System\RPgZzqo.exe
  2⤵
  PID:6272
- C:\Windows\System\YFynesS.exe
  C:\Windows\System\YFynesS.exe
  2⤵
  PID:6288
- C:\Windows\System\gYjOiZK.exe
  C:\Windows\System\gYjOiZK.exe
  2⤵
  PID:6308
- C:\Windows\System\QMkwaxa.exe
  C:\Windows\System\QMkwaxa.exe
  2⤵
  PID:6392
- C:\Windows\System\ohhELrh.exe
  C:\Windows\System\ohhELrh.exe
  2⤵
  PID:6416
- C:\Windows\System\eLeVSdE.exe
  C:\Windows\System\eLeVSdE.exe
  2⤵
  PID:6432
- C:\Windows\System\wfuAcal.exe
  C:\Windows\System\wfuAcal.exe
  2⤵
  PID:6448
- C:\Windows\System\qGMwCWP.exe
  C:\Windows\System\qGMwCWP.exe
  2⤵
  PID:6476
- C:\Windows\System\vydxYox.exe
  C:\Windows\System\vydxYox.exe
  2⤵
  PID:6496
- C:\Windows\System\OtFoyCG.exe
  C:\Windows\System\OtFoyCG.exe
  2⤵
  PID:6512
- C:\Windows\System\fCiXiWK.exe
  C:\Windows\System\fCiXiWK.exe
  2⤵
  PID:6536
- C:\Windows\System\qHlIZlm.exe
  C:\Windows\System\qHlIZlm.exe
  2⤵
  PID:6564
- C:\Windows\System\QAfrFzI.exe
  C:\Windows\System\QAfrFzI.exe
  2⤵
  PID:6584
- C:\Windows\System\tSOXuSX.exe
  C:\Windows\System\tSOXuSX.exe
  2⤵
  PID:6600
- C:\Windows\System\kvQeWJy.exe
  C:\Windows\System\kvQeWJy.exe
  2⤵
  PID:6628
- C:\Windows\System\kcFRTRH.exe
  C:\Windows\System\kcFRTRH.exe
  2⤵
  PID:6644
- C:\Windows\System\iKCYyeF.exe
  C:\Windows\System\iKCYyeF.exe
  2⤵
  PID:6664
- C:\Windows\System\RIjTFZq.exe
  C:\Windows\System\RIjTFZq.exe
  2⤵
  PID:6688
- C:\Windows\System\HxDPclm.exe
  C:\Windows\System\HxDPclm.exe
  2⤵
  PID:6708
- C:\Windows\System\nEoyJcU.exe
  C:\Windows\System\nEoyJcU.exe
  2⤵
  PID:6732
- C:\Windows\System\vfxIkQQ.exe
  C:\Windows\System\vfxIkQQ.exe
  2⤵
  PID:6748
- C:\Windows\System\WDpjJvK.exe
  C:\Windows\System\WDpjJvK.exe
  2⤵
  PID:6772
- C:\Windows\System\dHaTfFC.exe
  C:\Windows\System\dHaTfFC.exe
  2⤵
  PID:6796
- C:\Windows\System\amiGpEc.exe
  C:\Windows\System\amiGpEc.exe
  2⤵
  PID:6836
- C:\Windows\System\ifxSbJM.exe
  C:\Windows\System\ifxSbJM.exe
  2⤵
  PID:6872
- C:\Windows\System\cfhqGEz.exe
  C:\Windows\System\cfhqGEz.exe
  2⤵
  PID:6892
- C:\Windows\System\CgBCuoK.exe
  C:\Windows\System\CgBCuoK.exe
  2⤵
  PID:6908
- C:\Windows\System\MWxiPCM.exe
  C:\Windows\System\MWxiPCM.exe
  2⤵
  PID:6924
- C:\Windows\System\QwiOVCg.exe
  C:\Windows\System\QwiOVCg.exe
  2⤵
  PID:6940
- C:\Windows\System\HzUzXMi.exe
  C:\Windows\System\HzUzXMi.exe
  2⤵
  PID:6960
- C:\Windows\System\SNpKsMl.exe
  C:\Windows\System\SNpKsMl.exe
  2⤵
  PID:6980
- C:\Windows\System\dhPCuTb.exe
  C:\Windows\System\dhPCuTb.exe
  2⤵
  PID:7004
- C:\Windows\System\DNOAWtZ.exe
  C:\Windows\System\DNOAWtZ.exe
  2⤵
  PID:7024
- C:\Windows\System\qWiALXH.exe
  C:\Windows\System\qWiALXH.exe
  2⤵
  PID:7044
- C:\Windows\System\oFwYVBH.exe
  C:\Windows\System\oFwYVBH.exe
  2⤵
  PID:7068
- C:\Windows\System\dcOVJhm.exe
  C:\Windows\System\dcOVJhm.exe
  2⤵
  PID:7092
- C:\Windows\System\auFVBKl.exe
  C:\Windows\System\auFVBKl.exe
  2⤵
  PID:7120
- C:\Windows\System\ocleDSm.exe
  C:\Windows\System\ocleDSm.exe
  2⤵
  PID:7136
- C:\Windows\System\OhxJVIL.exe
  C:\Windows\System\OhxJVIL.exe
  2⤵
  PID:7156
- C:\Windows\System\pglDDUL.exe
  C:\Windows\System\pglDDUL.exe
  2⤵
  PID:6020
- C:\Windows\System\CmEQNph.exe
  C:\Windows\System\CmEQNph.exe
  2⤵
  PID:5968
- C:\Windows\System\CbAMSSn.exe
  C:\Windows\System\CbAMSSn.exe
  2⤵
  PID:6044
- C:\Windows\System\nkBKgEL.exe
  C:\Windows\System\nkBKgEL.exe
  2⤵
  PID:6060
- C:\Windows\System\OZwBHRF.exe
  C:\Windows\System\OZwBHRF.exe
  2⤵
  PID:2352
- C:\Windows\System\gaZFHdd.exe
  C:\Windows\System\gaZFHdd.exe
  2⤵
  PID:6220
- C:\Windows\System\Atgiuny.exe
  C:\Windows\System\Atgiuny.exe
  2⤵
  PID:3324
- C:\Windows\System\XfFuMlX.exe
  C:\Windows\System\XfFuMlX.exe
  2⤵
  PID:5640
- C:\Windows\System\hlSpwIm.exe
  C:\Windows\System\hlSpwIm.exe
  2⤵
  PID:3432
- C:\Windows\System\kJyCRxk.exe
  C:\Windows\System\kJyCRxk.exe
  2⤵
  PID:5184
- C:\Windows\System\PBfxSPw.exe
  C:\Windows\System\PBfxSPw.exe
  2⤵
  PID:5304
- C:\Windows\System\wtsWxbE.exe
  C:\Windows\System\wtsWxbE.exe
  2⤵
  PID:5476
- C:\Windows\System\sxCUlfX.exe
  C:\Windows\System\sxCUlfX.exe
  2⤵
  PID:5520
- C:\Windows\System\VLismCY.exe
  C:\Windows\System\VLismCY.exe
  2⤵
  PID:6428
- C:\Windows\System\SNESxRR.exe
  C:\Windows\System\SNESxRR.exe
  2⤵
  PID:6472
- C:\Windows\System\FfDDycc.exe
  C:\Windows\System\FfDDycc.exe
  2⤵
  PID:6572
- C:\Windows\System\BhkhRHU.exe
  C:\Windows\System\BhkhRHU.exe
  2⤵
  PID:6280
- C:\Windows\System\DVFYSnQ.exe
  C:\Windows\System\DVFYSnQ.exe
  2⤵
  PID:6640
- C:\Windows\System\WIZDHjg.exe
  C:\Windows\System\WIZDHjg.exe
  2⤵
  PID:6716
- C:\Windows\System\WEAunEa.exe
  C:\Windows\System\WEAunEa.exe
  2⤵
  PID:6672
- C:\Windows\System\AegDJUp.exe
  C:\Windows\System\AegDJUp.exe
  2⤵
  PID:6792
- C:\Windows\System\JLeZcdN.exe
  C:\Windows\System\JLeZcdN.exe
  2⤵
  PID:5984
- C:\Windows\System\IcRLNDz.exe
  C:\Windows\System\IcRLNDz.exe
  2⤵
  PID:6064
- C:\Windows\System\SNWjLXl.exe
  C:\Windows\System\SNWjLXl.exe
  2⤵
  PID:6384
- C:\Windows\System\AzrChWQ.exe
  C:\Windows\System\AzrChWQ.exe
  2⤵
  PID:6368
- C:\Windows\System\KzPSWKS.exe
  C:\Windows\System\KzPSWKS.exe
  2⤵
  PID:6528
- C:\Windows\System\HqkabDK.exe
  C:\Windows\System\HqkabDK.exe
  2⤵
  PID:4536
- C:\Windows\System\uzPkfYK.exe
  C:\Windows\System\uzPkfYK.exe
  2⤵
  PID:6684
- C:\Windows\System\HuEhWgU.exe
  C:\Windows\System\HuEhWgU.exe
  2⤵
  PID:4072
- C:\Windows\System\BfNYdcJ.exe
  C:\Windows\System\BfNYdcJ.exe
  2⤵
  PID:2548
- C:\Windows\System\NeDQBcm.exe
  C:\Windows\System\NeDQBcm.exe
  2⤵
  PID:6900
- C:\Windows\System\XuGHVAN.exe
  C:\Windows\System\XuGHVAN.exe
  2⤵
  PID:6932
- C:\Windows\System\VlyvAwz.exe
  C:\Windows\System\VlyvAwz.exe
  2⤵
  PID:6956
- C:\Windows\System\ObDOOWl.exe
  C:\Windows\System\ObDOOWl.exe
  2⤵
  PID:6992
- C:\Windows\System\UAbVErF.exe
  C:\Windows\System\UAbVErF.exe
  2⤵
  PID:4088
- C:\Windows\System\xeYvHpJ.exe
  C:\Windows\System\xeYvHpJ.exe
  2⤵
  PID:7080
- C:\Windows\System\QtlTreK.exe
  C:\Windows\System\QtlTreK.exe
  2⤵
  PID:7128
- C:\Windows\System\CMJORiY.exe
  C:\Windows\System\CMJORiY.exe
  2⤵
  PID:3132
- C:\Windows\System\dYcHKfQ.exe
  C:\Windows\System\dYcHKfQ.exe
  2⤵
  PID:6704
- C:\Windows\System\bqyfbqt.exe
  C:\Windows\System\bqyfbqt.exe
  2⤵
  PID:5616
- C:\Windows\System\gqHXOJS.exe
  C:\Windows\System\gqHXOJS.exe
  2⤵
  PID:7436
- C:\Windows\System\gfUsTON.exe
  C:\Windows\System\gfUsTON.exe
  2⤵
  PID:7452
- C:\Windows\System\aXqKFJU.exe
  C:\Windows\System\aXqKFJU.exe
  2⤵
  PID:7468
- C:\Windows\System\ekdLmzj.exe
  C:\Windows\System\ekdLmzj.exe
  2⤵
  PID:7484
- C:\Windows\System\cNVbzMw.exe
  C:\Windows\System\cNVbzMw.exe
  2⤵
  PID:7500
- C:\Windows\System\mBbDNtn.exe
  C:\Windows\System\mBbDNtn.exe
  2⤵
  PID:7516
- C:\Windows\System\LvsunNC.exe
  C:\Windows\System\LvsunNC.exe
  2⤵
  PID:7532
- C:\Windows\System\NATTyjf.exe
  C:\Windows\System\NATTyjf.exe
  2⤵
  PID:7548
- C:\Windows\System\SJNPhVx.exe
  C:\Windows\System\SJNPhVx.exe
  2⤵
  PID:7564
- C:\Windows\System\HWkYUsK.exe
  C:\Windows\System\HWkYUsK.exe
  2⤵
  PID:7580
- C:\Windows\System\rbsygwY.exe
  C:\Windows\System\rbsygwY.exe
  2⤵
  PID:7596
- C:\Windows\System\ZrKvcFR.exe
  C:\Windows\System\ZrKvcFR.exe
  2⤵
  PID:7612
- C:\Windows\System\QWmnvJe.exe
  C:\Windows\System\QWmnvJe.exe
  2⤵
  PID:7628
- C:\Windows\System\iNKxlKL.exe
  C:\Windows\System\iNKxlKL.exe
  2⤵
  PID:7648
- C:\Windows\System\YAaUtPo.exe
  C:\Windows\System\YAaUtPo.exe
  2⤵
  PID:7664
- C:\Windows\System\WVPDGEh.exe
  C:\Windows\System\WVPDGEh.exe
  2⤵
  PID:7680
- C:\Windows\System\PHKfses.exe
  C:\Windows\System\PHKfses.exe
  2⤵
  PID:7696
- C:\Windows\System\wdfCDfn.exe
  C:\Windows\System\wdfCDfn.exe
  2⤵
  PID:7712
- C:\Windows\System\ftYiDCh.exe
  C:\Windows\System\ftYiDCh.exe
  2⤵
  PID:7728
- C:\Windows\System\yCorHOX.exe
  C:\Windows\System\yCorHOX.exe
  2⤵
  PID:7772
- C:\Windows\System\uJWBPri.exe
  C:\Windows\System\uJWBPri.exe
  2⤵
  PID:7808
- C:\Windows\System\FnWFrtn.exe
  C:\Windows\System\FnWFrtn.exe
  2⤵
  PID:7852
- C:\Windows\System\CmYmmBS.exe
  C:\Windows\System\CmYmmBS.exe
  2⤵
  PID:7868
- C:\Windows\System\artTgWk.exe
  C:\Windows\System\artTgWk.exe
  2⤵
  PID:7888
- C:\Windows\System\BMOsTVP.exe
  C:\Windows\System\BMOsTVP.exe
  2⤵
  PID:7912
- C:\Windows\System\PtewVnL.exe
  C:\Windows\System\PtewVnL.exe
  2⤵
  PID:7932
- C:\Windows\System\UmpWctG.exe
  C:\Windows\System\UmpWctG.exe
  2⤵
  PID:7972
- C:\Windows\System\JkbyJpY.exe
  C:\Windows\System\JkbyJpY.exe
  2⤵
  PID:7988
- C:\Windows\System\HSmeNAA.exe
  C:\Windows\System\HSmeNAA.exe
  2⤵
  PID:8012
- C:\Windows\System\LHaKZiV.exe
  C:\Windows\System\LHaKZiV.exe
  2⤵
  PID:8032
- C:\Windows\System\YgJTUmz.exe
  C:\Windows\System\YgJTUmz.exe
  2⤵
  PID:8052
- C:\Windows\System\yWNddzC.exe
  C:\Windows\System\yWNddzC.exe
  2⤵
  PID:8068
- C:\Windows\System\kqVgeML.exe
  C:\Windows\System\kqVgeML.exe
  2⤵
  PID:8088
- C:\Windows\System\aGnDfcL.exe
  C:\Windows\System\aGnDfcL.exe
  2⤵
  PID:8108
- C:\Windows\System\yOqLNnA.exe
  C:\Windows\System\yOqLNnA.exe
  2⤵
  PID:8128
- C:\Windows\System\ceNgFIF.exe
  C:\Windows\System\ceNgFIF.exe
  2⤵
  PID:8148
- C:\Windows\System\jIHsBOw.exe
  C:\Windows\System\jIHsBOw.exe
  2⤵
  PID:8168
- C:\Windows\System\SpJnHkB.exe
  C:\Windows\System\SpJnHkB.exe
  2⤵
  PID:8188
- C:\Windows\System\OEBonHo.exe
  C:\Windows\System\OEBonHo.exe
  2⤵
  PID:5656
- C:\Windows\System\nXMKMKu.exe
  C:\Windows\System\nXMKMKu.exe
  2⤵
  PID:6508
- C:\Windows\System\eCuwfal.exe
  C:\Windows\System\eCuwfal.exe
  2⤵
  PID:8204
- C:\Windows\System\uXxxhFg.exe
  C:\Windows\System\uXxxhFg.exe
  2⤵
  PID:8224
- C:\Windows\System\YZGYqtn.exe
  C:\Windows\System\YZGYqtn.exe
  2⤵
  PID:8244
- C:\Windows\System\IHSnNSv.exe
  C:\Windows\System\IHSnNSv.exe
  2⤵
  PID:8264
- C:\Windows\System\oPHNCgj.exe
  C:\Windows\System\oPHNCgj.exe
  2⤵
  PID:8284
- C:\Windows\System\MGumyjN.exe
  C:\Windows\System\MGumyjN.exe
  2⤵
  PID:8304
- C:\Windows\System\uTbblQK.exe
  C:\Windows\System\uTbblQK.exe
  2⤵
  PID:8324
- C:\Windows\System\lpGdONF.exe
  C:\Windows\System\lpGdONF.exe
  2⤵
  PID:8344
- C:\Windows\System\pRwUOeL.exe
  C:\Windows\System\pRwUOeL.exe
  2⤵
  PID:8364
- C:\Windows\System\HEuFkXs.exe
  C:\Windows\System\HEuFkXs.exe
  2⤵
  PID:8384
- C:\Windows\System\ivzrnGu.exe
  C:\Windows\System\ivzrnGu.exe
  2⤵
  PID:8404
- C:\Windows\System\hpmyWAm.exe
  C:\Windows\System\hpmyWAm.exe
  2⤵
  PID:8420
- C:\Windows\System\aiEBWSU.exe
  C:\Windows\System\aiEBWSU.exe
  2⤵
  PID:8436
- C:\Windows\System\rETgvvz.exe
  C:\Windows\System\rETgvvz.exe
  2⤵
  PID:8452
- C:\Windows\System\aszoYnp.exe
  C:\Windows\System\aszoYnp.exe
  2⤵
  PID:8468
- C:\Windows\System\FjvcbFX.exe
  C:\Windows\System\FjvcbFX.exe
  2⤵
  PID:8484
- C:\Windows\System\ybCWCjo.exe
  C:\Windows\System\ybCWCjo.exe
  2⤵
  PID:8500
- C:\Windows\System\RVJVOvZ.exe
  C:\Windows\System\RVJVOvZ.exe
  2⤵
  PID:8516
- C:\Windows\System\dvPXGDI.exe
  C:\Windows\System\dvPXGDI.exe
  2⤵
  PID:8576
- C:\Windows\System\NpHUYmc.exe
  C:\Windows\System\NpHUYmc.exe
  2⤵
  PID:8592
- C:\Windows\System\grMIhyk.exe
  C:\Windows\System\grMIhyk.exe
  2⤵
  PID:8612
- C:\Windows\System\LDdBJCN.exe
  C:\Windows\System\LDdBJCN.exe
  2⤵
  PID:8632
- C:\Windows\System\ydgzddR.exe
  C:\Windows\System\ydgzddR.exe
  2⤵
  PID:8656
- C:\Windows\System\atljGNw.exe
  C:\Windows\System\atljGNw.exe
  2⤵
  PID:8672
- C:\Windows\System\pikuwSp.exe
  C:\Windows\System\pikuwSp.exe
  2⤵
  PID:8692
- C:\Windows\System\uZriByX.exe
  C:\Windows\System\uZriByX.exe
  2⤵
  PID:8712
- C:\Windows\System\ueqcTAd.exe
  C:\Windows\System\ueqcTAd.exe
  2⤵
  PID:8732
- C:\Windows\System\eGsHYtM.exe
  C:\Windows\System\eGsHYtM.exe
  2⤵
  PID:8748
- C:\Windows\System\ROLjaLW.exe
  C:\Windows\System\ROLjaLW.exe
  2⤵
  PID:8764
- C:\Windows\System\iLPmVLG.exe
  C:\Windows\System\iLPmVLG.exe
  2⤵
  PID:8780
- C:\Windows\System\DCqVdUH.exe
  C:\Windows\System\DCqVdUH.exe
  2⤵
  PID:8796
- C:\Windows\System\aydVHpL.exe
  C:\Windows\System\aydVHpL.exe
  2⤵
  PID:8812
- C:\Windows\System\FHaIQiv.exe
  C:\Windows\System\FHaIQiv.exe
  2⤵
  PID:8864
- C:\Windows\System\QzIUmxP.exe
  C:\Windows\System\QzIUmxP.exe
  2⤵
  PID:8888
- C:\Windows\System\qMHVIUb.exe
  C:\Windows\System\qMHVIUb.exe
  2⤵
  PID:8912
- C:\Windows\System\FJJwKjg.exe
  C:\Windows\System\FJJwKjg.exe
  2⤵
  PID:8928
- C:\Windows\System\XjUppDT.exe
  C:\Windows\System\XjUppDT.exe
  2⤵
  PID:8952
- C:\Windows\System\CCVEsmn.exe
  C:\Windows\System\CCVEsmn.exe
  2⤵
  PID:8976
- C:\Windows\System\bhDWGrT.exe
  C:\Windows\System\bhDWGrT.exe
  2⤵
  PID:8996
- C:\Windows\System\FyByaoA.exe
  C:\Windows\System\FyByaoA.exe
  2⤵
  PID:9020
- C:\Windows\System\fBJlleh.exe
  C:\Windows\System\fBJlleh.exe
  2⤵
  PID:9040
- C:\Windows\System\VPYCllA.exe
  C:\Windows\System\VPYCllA.exe
  2⤵
  PID:9064
- C:\Windows\System\jtbCFfl.exe
  C:\Windows\System\jtbCFfl.exe
  2⤵
  PID:9080
- C:\Windows\System\OBWrRtc.exe
  C:\Windows\System\OBWrRtc.exe
  2⤵
  PID:9104
- C:\Windows\System\PLnIfRU.exe
  C:\Windows\System\PLnIfRU.exe
  2⤵
  PID:9128
- C:\Windows\System\qIuRpon.exe
  C:\Windows\System\qIuRpon.exe
  2⤵
  PID:9176
- C:\Windows\System\WwhmtOM.exe
  C:\Windows\System\WwhmtOM.exe
  2⤵
  PID:9204
- C:\Windows\System\vSanZyU.exe
  C:\Windows\System\vSanZyU.exe
  2⤵
  PID:7288
- C:\Windows\System\joiBGPs.exe
  C:\Windows\System\joiBGPs.exe
  2⤵
  PID:7928
- C:\Windows\System\EexmYnA.exe
  C:\Windows\System\EexmYnA.exe
  2⤵
  PID:7952
- C:\Windows\System\pDCZLej.exe
  C:\Windows\System\pDCZLej.exe
  2⤵
  PID:7980
- C:\Windows\System\nHkHSuS.exe
  C:\Windows\System\nHkHSuS.exe
  2⤵
  PID:7264
- C:\Windows\System\MVkIwmq.exe
  C:\Windows\System\MVkIwmq.exe
  2⤵
  PID:8064
- C:\Windows\System\QMFgTZv.exe
  C:\Windows\System\QMFgTZv.exe
  2⤵
  PID:7268
- C:\Windows\System\CGlBBWh.exe
  C:\Windows\System\CGlBBWh.exe
  2⤵
  PID:8164
- C:\Windows\System\oKyGNgb.exe
  C:\Windows\System\oKyGNgb.exe
  2⤵
  PID:8252
- C:\Windows\System\gybjoOw.exe
  C:\Windows\System\gybjoOw.exe
  2⤵
  PID:8296
- C:\Windows\System\sZgGyxA.exe
  C:\Windows\System\sZgGyxA.exe
  2⤵
  PID:8360
- C:\Windows\System\wwSUCVG.exe
  C:\Windows\System\wwSUCVG.exe
  2⤵
  PID:5080
- C:\Windows\System\tNgOMRj.exe
  C:\Windows\System\tNgOMRj.exe
  2⤵
  PID:7152
- C:\Windows\System\eQRrjRz.exe
  C:\Windows\System\eQRrjRz.exe
  2⤵
  PID:6804
- C:\Windows\System\yfPSnmP.exe
  C:\Windows\System\yfPSnmP.exe
  2⤵
  PID:6556
- C:\Windows\System\UjkntHw.exe
  C:\Windows\System\UjkntHw.exe
  2⤵
  PID:7056
- C:\Windows\System\NEfPfAk.exe
  C:\Windows\System\NEfPfAk.exe
  2⤵
  PID:5612
- C:\Windows\System\NxHrUSY.exe
  C:\Windows\System\NxHrUSY.exe
  2⤵
  PID:8740
- C:\Windows\System\dmtguqm.exe
  C:\Windows\System\dmtguqm.exe
  2⤵
  PID:3692
- C:\Windows\System\PngvHGS.exe
  C:\Windows\System\PngvHGS.exe
  2⤵
  PID:8340
- C:\Windows\System\PcPlLMl.exe
  C:\Windows\System\PcPlLMl.exe
  2⤵
  PID:8380
- C:\Windows\System\TVLdRwf.exe
  C:\Windows\System\TVLdRwf.exe
  2⤵
  PID:7448
- C:\Windows\System\cJkULeS.exe
  C:\Windows\System\cJkULeS.exe
  2⤵
  PID:7496
- C:\Windows\System\RlrfQTQ.exe
  C:\Windows\System\RlrfQTQ.exe
  2⤵
  PID:8948
- C:\Windows\System\hvkFvGz.exe
  C:\Windows\System\hvkFvGz.exe
  2⤵
  PID:9036
- C:\Windows\System\EeEufPS.exe
  C:\Windows\System\EeEufPS.exe
  2⤵
  PID:9112
- C:\Windows\System\DuRGeyg.exe
  C:\Windows\System\DuRGeyg.exe
  2⤵
  PID:9228
- C:\Windows\System\ImOKATM.exe
  C:\Windows\System\ImOKATM.exe
  2⤵
  PID:9248
- C:\Windows\System\yqQMCOr.exe
  C:\Windows\System\yqQMCOr.exe
  2⤵
  PID:9268
- C:\Windows\System\VipGRTf.exe
  C:\Windows\System\VipGRTf.exe
  2⤵
  PID:9296
- C:\Windows\System\nQNMEvo.exe
  C:\Windows\System\nQNMEvo.exe
  2⤵
  PID:9316
- C:\Windows\System\IKegist.exe
  C:\Windows\System\IKegist.exe
  2⤵
  PID:9352
- C:\Windows\System\XoAbTJk.exe
  C:\Windows\System\XoAbTJk.exe
  2⤵
  PID:9372
- C:\Windows\System\IohlTft.exe
  C:\Windows\System\IohlTft.exe
  2⤵
  PID:9400
- C:\Windows\System\kstvHzT.exe
  C:\Windows\System\kstvHzT.exe
  2⤵
  PID:9420
- C:\Windows\System\DIXIjCJ.exe
  C:\Windows\System\DIXIjCJ.exe
  2⤵
  PID:9440
- C:\Windows\System\PomAJAE.exe
  C:\Windows\System\PomAJAE.exe
  2⤵
  PID:9468
- C:\Windows\System\lqhMyet.exe
  C:\Windows\System\lqhMyet.exe
  2⤵
  PID:9484
- C:\Windows\System\cKDtYzq.exe
  C:\Windows\System\cKDtYzq.exe
  2⤵
  PID:9500
- C:\Windows\System\ZBPqQvX.exe
  C:\Windows\System\ZBPqQvX.exe
  2⤵
  PID:9516
- C:\Windows\System\EmcFWgE.exe
  C:\Windows\System\EmcFWgE.exe
  2⤵
  PID:9532
- C:\Windows\System\oCXdOgx.exe
  C:\Windows\System\oCXdOgx.exe
  2⤵
  PID:9560
- C:\Windows\System\IwPjyhf.exe
  C:\Windows\System\IwPjyhf.exe
  2⤵
  PID:9576
- C:\Windows\System\OHKbOOY.exe
  C:\Windows\System\OHKbOOY.exe
  2⤵
  PID:9592
- C:\Windows\System\EHbPxhv.exe
  C:\Windows\System\EHbPxhv.exe
  2⤵
  PID:9612
- C:\Windows\System\GNRFjJH.exe
  C:\Windows\System\GNRFjJH.exe
  2⤵
  PID:9632
- C:\Windows\System\lUFFJWm.exe
  C:\Windows\System\lUFFJWm.exe
  2⤵
  PID:9656
- C:\Windows\System\TYiknAx.exe
  C:\Windows\System\TYiknAx.exe
  2⤵
  PID:9676
- C:\Windows\System\yGgklWt.exe
  C:\Windows\System\yGgklWt.exe
  2⤵
  PID:9696
- C:\Windows\System\kcapPty.exe
  C:\Windows\System\kcapPty.exe
  2⤵
  PID:9716
- C:\Windows\System\dcICleb.exe
  C:\Windows\System\dcICleb.exe
  2⤵
  PID:9736
- C:\Windows\System\YmndiDM.exe
  C:\Windows\System\YmndiDM.exe
  2⤵
  PID:9760
- C:\Windows\System\QSDFTOg.exe
  C:\Windows\System\QSDFTOg.exe
  2⤵
  PID:9784
- C:\Windows\System\niWGBku.exe
  C:\Windows\System\niWGBku.exe
  2⤵
  PID:9804
- C:\Windows\System\PeiUYEY.exe
  C:\Windows\System\PeiUYEY.exe
  2⤵
  PID:9820
- C:\Windows\System\jgjMnYW.exe
  C:\Windows\System\jgjMnYW.exe
  2⤵
  PID:9844
- C:\Windows\System\YUlPIfC.exe
  C:\Windows\System\YUlPIfC.exe
  2⤵
  PID:9868
- C:\Windows\System\cNJLiMb.exe
  C:\Windows\System\cNJLiMb.exe
  2⤵
  PID:9892
- C:\Windows\System\VBSMIVL.exe
  C:\Windows\System\VBSMIVL.exe
  2⤵
  PID:9916
- C:\Windows\System\jWnMFlQ.exe
  C:\Windows\System\jWnMFlQ.exe
  2⤵
  PID:9940
- C:\Windows\System\AwQAyBh.exe
  C:\Windows\System\AwQAyBh.exe
  2⤵
  PID:9964
- C:\Windows\System\HCsQwtQ.exe
  C:\Windows\System\HCsQwtQ.exe
  2⤵
  PID:9984
- C:\Windows\System\hUkOWQL.exe
  C:\Windows\System\hUkOWQL.exe
  2⤵
  PID:10008
- C:\Windows\System\DliujLC.exe
  C:\Windows\System\DliujLC.exe
  2⤵
  PID:10032
- C:\Windows\System\KqcNcKq.exe
  C:\Windows\System\KqcNcKq.exe
  2⤵
  PID:10052
- C:\Windows\System\ifYqBRi.exe
  C:\Windows\System\ifYqBRi.exe
  2⤵
  PID:10072
- C:\Windows\System\FIVXMmb.exe
  C:\Windows\System\FIVXMmb.exe
  2⤵
  PID:10092
- C:\Windows\System\yIMTdLQ.exe
  C:\Windows\System\yIMTdLQ.exe
  2⤵
  PID:10120
- C:\Windows\System\ghEfKgc.exe
  C:\Windows\System\ghEfKgc.exe
  2⤵
  PID:10140
- C:\Windows\System\UxfIuPC.exe
  C:\Windows\System\UxfIuPC.exe
  2⤵
  PID:10164
- C:\Windows\System\DYzJMpY.exe
  C:\Windows\System\DYzJMpY.exe
  2⤵
  PID:10184
- C:\Windows\System\SovbWYT.exe
  C:\Windows\System\SovbWYT.exe
  2⤵
  PID:10200
- C:\Windows\System\qcLwSZX.exe
  C:\Windows\System\qcLwSZX.exe
  2⤵
  PID:10220
- C:\Windows\System\ViEhaxO.exe
  C:\Windows\System\ViEhaxO.exe
  2⤵
  PID:7540
- C:\Windows\System\dZSULWo.exe
  C:\Windows\System\dZSULWo.exe
  2⤵
  PID:7592
- C:\Windows\System\JnLbEfT.exe
  C:\Windows\System\JnLbEfT.exe
  2⤵
  PID:7624
- C:\Windows\System\MQGMTji.exe
  C:\Windows\System\MQGMTji.exe
  2⤵
  PID:7672
- C:\Windows\System\cCsIbqJ.exe
  C:\Windows\System\cCsIbqJ.exe
  2⤵
  PID:7720
- C:\Windows\System\bfrVPyF.exe
  C:\Windows\System\bfrVPyF.exe
  2⤵
  PID:7784
- C:\Windows\System\ggGuyII.exe
  C:\Windows\System\ggGuyII.exe
  2⤵
  PID:8684
- C:\Windows\System\HSCuYoD.exe
  C:\Windows\System\HSCuYoD.exe
  2⤵
  PID:8688
- C:\Windows\System\yvGehbq.exe
  C:\Windows\System\yvGehbq.exe
  2⤵
  PID:6412
- C:\Windows\System\EamZUfL.exe
  C:\Windows\System\EamZUfL.exe
  2⤵
  PID:8356
- C:\Windows\System\dxmVOHn.exe
  C:\Windows\System\dxmVOHn.exe
  2⤵
  PID:4788
- C:\Windows\System\UduacsL.exe
  C:\Windows\System\UduacsL.exe
  2⤵
  PID:8428
- C:\Windows\System\asMrGCh.exe
  C:\Windows\System\asMrGCh.exe
  2⤵
  PID:8476
- C:\Windows\System\SLZZFvf.exe
  C:\Windows\System\SLZZFvf.exe
  2⤵
  PID:9016
- C:\Windows\System\OaqGDWU.exe
  C:\Windows\System\OaqGDWU.exe
  2⤵
  PID:9004
- C:\Windows\System\wlNUxOk.exe
  C:\Windows\System\wlNUxOk.exe
  2⤵
  PID:9136
- C:\Windows\System\UOGYAtr.exe
  C:\Windows\System\UOGYAtr.exe
  2⤵
  PID:10244
- C:\Windows\System\LJhtHMy.exe
  C:\Windows\System\LJhtHMy.exe
  2⤵
  PID:10260
- C:\Windows\System\BJGgSUs.exe
  C:\Windows\System\BJGgSUs.exe
  2⤵
  PID:10280
- C:\Windows\System\wLRKBsd.exe
  C:\Windows\System\wLRKBsd.exe
  2⤵
  PID:10308
- C:\Windows\System\DMfqdXx.exe
  C:\Windows\System\DMfqdXx.exe
  2⤵
  PID:10328
- C:\Windows\System\wbMxRgD.exe
  C:\Windows\System\wbMxRgD.exe
  2⤵
  PID:10344
- C:\Windows\System\IWEYUSy.exe
  C:\Windows\System\IWEYUSy.exe
  2⤵
  PID:10360
- C:\Windows\System\NuKRMpT.exe
  C:\Windows\System\NuKRMpT.exe
  2⤵
  PID:10380
- C:\Windows\System\AgHgMNL.exe
  C:\Windows\System\AgHgMNL.exe
  2⤵
  PID:10412
- C:\Windows\System\KFhaWdQ.exe
  C:\Windows\System\KFhaWdQ.exe
  2⤵
  PID:10428
- C:\Windows\System\LujbhcI.exe
  C:\Windows\System\LujbhcI.exe
  2⤵
  PID:10444
- C:\Windows\System\OxnwFfV.exe
  C:\Windows\System\OxnwFfV.exe
  2⤵
  PID:10460
- C:\Windows\System\RrGZIMA.exe
  C:\Windows\System\RrGZIMA.exe
  2⤵
  PID:10476
- C:\Windows\System\grRkXWh.exe
  C:\Windows\System\grRkXWh.exe
  2⤵
  PID:10496
- C:\Windows\System\NUJOTDq.exe
  C:\Windows\System\NUJOTDq.exe
  2⤵
  PID:10516
- C:\Windows\System\yAoxkOQ.exe
  C:\Windows\System\yAoxkOQ.exe
  2⤵
  PID:10540
- C:\Windows\System\sZZcsIx.exe
  C:\Windows\System\sZZcsIx.exe
  2⤵
  PID:10560
- C:\Windows\System\xIntzLn.exe
  C:\Windows\System\xIntzLn.exe
  2⤵
  PID:10580
- C:\Windows\System\eFzBDQv.exe
  C:\Windows\System\eFzBDQv.exe
  2⤵
  PID:10596
- C:\Windows\System\gXQTSeR.exe
  C:\Windows\System\gXQTSeR.exe
  2⤵
  PID:10620
- C:\Windows\System\eNMVaaC.exe
  C:\Windows\System\eNMVaaC.exe
  2⤵
  PID:10644
- C:\Windows\System\wYbxpzT.exe
  C:\Windows\System\wYbxpzT.exe
  2⤵
  PID:10660
- C:\Windows\System\udhrEig.exe
  C:\Windows\System\udhrEig.exe
  2⤵
  PID:10684
- C:\Windows\System\lnbGBem.exe
  C:\Windows\System\lnbGBem.exe
  2⤵
  PID:10704
- C:\Windows\System\CcUGiNJ.exe
  C:\Windows\System\CcUGiNJ.exe
  2⤵
  PID:10732
- C:\Windows\System\FXCSiVN.exe
  C:\Windows\System\FXCSiVN.exe
  2⤵
  PID:10752
- C:\Windows\System\phAHSlJ.exe
  C:\Windows\System\phAHSlJ.exe
  2⤵
  PID:10776
- C:\Windows\System\DawfUet.exe
  C:\Windows\System\DawfUet.exe
  2⤵
  PID:10796
- C:\Windows\System\SWNhjow.exe
  C:\Windows\System\SWNhjow.exe
  2⤵
  PID:10832
- C:\Windows\System\SGSraPF.exe
  C:\Windows\System\SGSraPF.exe
  2⤵
  PID:10856
- C:\Windows\System\lvFWkKi.exe
  C:\Windows\System\lvFWkKi.exe
  2⤵
  PID:10880
- C:\Windows\System\HTJLHMC.exe
  C:\Windows\System\HTJLHMC.exe
  2⤵
  PID:10900
- C:\Windows\System\zpppGPR.exe
  C:\Windows\System\zpppGPR.exe
  2⤵
  PID:10924
- C:\Windows\System\BtQwSll.exe
  C:\Windows\System\BtQwSll.exe
  2⤵
  PID:10948
- C:\Windows\System\SUrlzJe.exe
  C:\Windows\System\SUrlzJe.exe
  2⤵
  PID:10972
- C:\Windows\System\nuHYiSH.exe
  C:\Windows\System\nuHYiSH.exe
  2⤵
  PID:10992
- C:\Windows\System\rmCrLVr.exe
  C:\Windows\System\rmCrLVr.exe
  2⤵
  PID:11016
- C:\Windows\System\RrNiuOk.exe
  C:\Windows\System\RrNiuOk.exe
  2⤵
  PID:11032
- C:\Windows\System\KlkyRWt.exe
  C:\Windows\System\KlkyRWt.exe
  2⤵
  PID:11052
- C:\Windows\System\KrGespj.exe
  C:\Windows\System\KrGespj.exe
  2⤵
  PID:11068
- C:\Windows\System\LgBnIiI.exe
  C:\Windows\System\LgBnIiI.exe
  2⤵
  PID:11096
- C:\Windows\System\xLVlOxF.exe
  C:\Windows\System\xLVlOxF.exe
  2⤵
  PID:11120
- C:\Windows\System\jTfvcfH.exe
  C:\Windows\System\jTfvcfH.exe
  2⤵
  PID:11140
- C:\Windows\System\OueYqYH.exe
  C:\Windows\System\OueYqYH.exe
  2⤵
  PID:11164
- C:\Windows\System\kOiDQmk.exe
  C:\Windows\System\kOiDQmk.exe
  2⤵
  PID:11188
- C:\Windows\System\TfUTRWX.exe
  C:\Windows\System\TfUTRWX.exe
  2⤵
  PID:9528
- C:\Windows\System\LgIdjqq.exe
  C:\Windows\System\LgIdjqq.exe
  2⤵
  PID:9572
- C:\Windows\System\cCqhosa.exe
  C:\Windows\System\cCqhosa.exe
  2⤵
  PID:9608
- C:\Windows\System\dwbcclB.exe
  C:\Windows\System\dwbcclB.exe
  2⤵
  PID:8624
- C:\Windows\System\CiJjGFr.exe
  C:\Windows\System\CiJjGFr.exe
  2⤵
  PID:9664
- C:\Windows\System\PsAwYwL.exe
  C:\Windows\System\PsAwYwL.exe
  2⤵
  PID:9704
- C:\Windows\System\NlGXaeV.exe
  C:\Windows\System\NlGXaeV.exe
  2⤵
  PID:9756
- C:\Windows\System\iIDDAXa.exe
  C:\Windows\System\iIDDAXa.exe
  2⤵
  PID:8708
- C:\Windows\System\lTSITbs.exe
  C:\Windows\System\lTSITbs.exe
  2⤵
  PID:9812
- C:\Windows\System\NxieLqd.exe
  C:\Windows\System\NxieLqd.exe
  2⤵
  PID:9860
- C:\Windows\System\IphXHcK.exe
  C:\Windows\System\IphXHcK.exe
  2⤵
  PID:9908
- C:\Windows\System\wxoxWKm.exe
  C:\Windows\System\wxoxWKm.exe
  2⤵
  PID:9952
- C:\Windows\System\ePfgIyz.exe
  C:\Windows\System\ePfgIyz.exe
  2⤵
  PID:10004
- C:\Windows\System\OJBYavG.exe
  C:\Windows\System\OJBYavG.exe
  2⤵
  PID:8272
- C:\Windows\System\eBQMhJW.exe
  C:\Windows\System\eBQMhJW.exe
  2⤵
  PID:10128
- C:\Windows\System\NMCbAoH.exe
  C:\Windows\System\NMCbAoH.exe
  2⤵
  PID:1960
- C:\Windows\System\qXUXBAg.exe
  C:\Windows\System\qXUXBAg.exe
  2⤵
  PID:10192
- C:\Windows\System\tvraKzM.exe
  C:\Windows\System\tvraKzM.exe
  2⤵
  PID:7608
- C:\Windows\System\yNcwRxX.exe
  C:\Windows\System\yNcwRxX.exe
  2⤵
  PID:7744
- C:\Windows\System\mlzCJUD.exe
  C:\Windows\System\mlzCJUD.exe
  2⤵
  PID:8840
- C:\Windows\System\TBGitJA.exe
  C:\Windows\System\TBGitJA.exe
  2⤵
  PID:8884
- C:\Windows\System\GaarzgX.exe
  C:\Windows\System\GaarzgX.exe
  2⤵
  PID:8920
- C:\Windows\System\kuIkzoz.exe
  C:\Windows\System\kuIkzoz.exe
  2⤵
  PID:8988
- C:\Windows\System\xaBjrbO.exe
  C:\Windows\System\xaBjrbO.exe
  2⤵
  PID:9244
- C:\Windows\System\vuPRRSW.exe
  C:\Windows\System\vuPRRSW.exe
  2⤵
  PID:9332
- C:\Windows\System\KRcMKpb.exe
  C:\Windows\System\KRcMKpb.exe
  2⤵
  PID:4220
- C:\Windows\System\imtwjPh.exe
  C:\Windows\System\imtwjPh.exe
  2⤵
  PID:10296
- C:\Windows\System\qQPLZbi.exe
  C:\Windows\System\qQPLZbi.exe
  2⤵
  PID:9476
- C:\Windows\System\AzFUrEz.exe
  C:\Windows\System\AzFUrEz.exe
  2⤵
  PID:10456
- C:\Windows\System\IdEMxiv.exe
  C:\Windows\System\IdEMxiv.exe
  2⤵
  PID:9160
- C:\Windows\System\nOqlBPK.exe
  C:\Windows\System\nOqlBPK.exe
  2⤵
  PID:10552
- C:\Windows\System\QIDxAiS.exe
  C:\Windows\System\QIDxAiS.exe
  2⤵
  PID:11272
- C:\Windows\System\tnRwiNH.exe
  C:\Windows\System\tnRwiNH.exe
  2⤵
  PID:11296
- C:\Windows\System\kydqOIt.exe
  C:\Windows\System\kydqOIt.exe
  2⤵
  PID:11440
- C:\Windows\System\UHAnTza.exe
  C:\Windows\System\UHAnTza.exe
  2⤵
  PID:11460
- C:\Windows\System\TnNfJkK.exe
  C:\Windows\System\TnNfJkK.exe
  2⤵
  PID:11484
- C:\Windows\System\huQqjgg.exe
  C:\Windows\System\huQqjgg.exe
  2⤵
  PID:11508
- C:\Windows\System\FwNxikr.exe
  C:\Windows\System\FwNxikr.exe
  2⤵
  PID:11536
- C:\Windows\System\JSkPyQR.exe
  C:\Windows\System\JSkPyQR.exe
  2⤵
  PID:11556
- C:\Windows\System\qikHiWI.exe
  C:\Windows\System\qikHiWI.exe
  2⤵
  PID:11576
- C:\Windows\System\aXLgUkQ.exe
  C:\Windows\System\aXLgUkQ.exe
  2⤵
  PID:11600
- C:\Windows\System\uNnSUoX.exe
  C:\Windows\System\uNnSUoX.exe
  2⤵
  PID:11620
- C:\Windows\System\UZfWGGG.exe
  C:\Windows\System\UZfWGGG.exe
  2⤵
  PID:11640
- C:\Windows\System\lnJExaB.exe
  C:\Windows\System\lnJExaB.exe
  2⤵
  PID:11664
- C:\Windows\System\BvzQNga.exe
  C:\Windows\System\BvzQNga.exe
  2⤵
  PID:11688
- C:\Windows\System\DJpwHOn.exe
  C:\Windows\System\DJpwHOn.exe
  2⤵
  PID:11704
- C:\Windows\System\dCfEtwq.exe
  C:\Windows\System\dCfEtwq.exe
  2⤵
  PID:11720
- C:\Windows\System\Eftamzd.exe
  C:\Windows\System\Eftamzd.exe
  2⤵
  PID:11744
- C:\Windows\System\mAVLRqf.exe
  C:\Windows\System\mAVLRqf.exe
  2⤵
  PID:11760
- C:\Windows\System\tBaoQVL.exe
  C:\Windows\System\tBaoQVL.exe
  2⤵
  PID:11780
- C:\Windows\System\WLmoUBk.exe
  C:\Windows\System\WLmoUBk.exe
  2⤵
  PID:11800
- C:\Windows\System\wQXfDOR.exe
  C:\Windows\System\wQXfDOR.exe
  2⤵
  PID:11820
- C:\Windows\System\RubykgS.exe
  C:\Windows\System\RubykgS.exe
  2⤵
  PID:11856
- C:\Windows\System\BLjPCYn.exe
  C:\Windows\System\BLjPCYn.exe
  2⤵
  PID:11876
- C:\Windows\System\IXqoTpK.exe
  C:\Windows\System\IXqoTpK.exe
  2⤵
  PID:11892
- C:\Windows\System\TMEvEsh.exe
  C:\Windows\System\TMEvEsh.exe
  2⤵
  PID:11908
- C:\Windows\System\nkRGmFd.exe
  C:\Windows\System\nkRGmFd.exe
  2⤵
  PID:11928
- C:\Windows\System\qYevDxw.exe
  C:\Windows\System\qYevDxw.exe
  2⤵
  PID:11944
- C:\Windows\System\dtdIerG.exe
  C:\Windows\System\dtdIerG.exe
  2⤵
  PID:12000
- C:\Windows\System\eFlNrbL.exe
  C:\Windows\System\eFlNrbL.exe
  2⤵
  PID:12024
- C:\Windows\System\BrmaFuy.exe
  C:\Windows\System\BrmaFuy.exe
  2⤵
  PID:12048
- C:\Windows\System\XGXZQuc.exe
  C:\Windows\System\XGXZQuc.exe
  2⤵
  PID:12076
- C:\Windows\System\earYuYW.exe
  C:\Windows\System\earYuYW.exe
  2⤵
  PID:12096
- C:\Windows\System\nUmodWq.exe
  C:\Windows\System\nUmodWq.exe
  2⤵
  PID:12120
- C:\Windows\System\NFTQFgG.exe
  C:\Windows\System\NFTQFgG.exe
  2⤵
  PID:12144
- C:\Windows\System\WkzHLey.exe
  C:\Windows\System\WkzHLey.exe
  2⤵
  PID:12164
- C:\Windows\System\FCQhNPI.exe
  C:\Windows\System\FCQhNPI.exe
  2⤵
  PID:12192
- C:\Windows\System\aiJEZyI.exe
  C:\Windows\System\aiJEZyI.exe
  2⤵
  PID:12208
- C:\Windows\System\jkcFOsU.exe
  C:\Windows\System\jkcFOsU.exe
  2⤵
  PID:12228
- C:\Windows\System\glyzNAB.exe
  C:\Windows\System\glyzNAB.exe
  2⤵
  PID:12252
- C:\Windows\System\zWlFEbd.exe
  C:\Windows\System\zWlFEbd.exe
  2⤵
  PID:12272
- C:\Windows\System\kkOUnPV.exe
  C:\Windows\System\kkOUnPV.exe
  2⤵
  PID:10628
- C:\Windows\System\CqTsaFv.exe
  C:\Windows\System\CqTsaFv.exe
  2⤵
  PID:10700
- C:\Windows\System\oRlZAVa.exe
  C:\Windows\System\oRlZAVa.exe
  2⤵
  PID:8156
- C:\Windows\System\hqFSDzr.exe
  C:\Windows\System\hqFSDzr.exe
  2⤵
  PID:10892
- C:\Windows\System\kWctPlK.exe
  C:\Windows\System\kWctPlK.exe
  2⤵
  PID:10112
- C:\Windows\System\LOKpSEN.exe
  C:\Windows\System\LOKpSEN.exe
  2⤵
  PID:3512
- C:\Windows\System\zaxeUdE.exe
  C:\Windows\System\zaxeUdE.exe
  2⤵
  PID:10176
- C:\Windows\System\LkNZJHm.exe
  C:\Windows\System\LkNZJHm.exe
  2⤵
  PID:1252
- C:\Windows\System\DawtUdD.exe
  C:\Windows\System\DawtUdD.exe
  2⤵
  PID:6988
- C:\Windows\System\zbmgqGa.exe
  C:\Windows\System\zbmgqGa.exe
  2⤵
  PID:6916
- C:\Windows\System\tWYmkRd.exe
  C:\Windows\System\tWYmkRd.exe
  2⤵
  PID:3628
- C:\Windows\System\dSHLbgh.exe
  C:\Windows\System\dSHLbgh.exe
  2⤵
  PID:8180
- C:\Windows\System\NIOEpJF.exe
  C:\Windows\System\NIOEpJF.exe
  2⤵
  PID:8220
- C:\Windows\System\nzYBQSb.exe
  C:\Windows\System\nzYBQSb.exe
  2⤵
  PID:8808
- C:\Windows\System\rMrhoaR.exe
  C:\Windows\System\rMrhoaR.exe
  2⤵
  PID:7492
- C:\Windows\System\ydVXBZy.exe
  C:\Windows\System\ydVXBZy.exe
  2⤵
  PID:9224
- C:\Windows\System\SScfSJN.exe
  C:\Windows\System\SScfSJN.exe
  2⤵
  PID:8232
- C:\Windows\System\cDQZlOt.exe
  C:\Windows\System\cDQZlOt.exe
  2⤵
  PID:9192
- C:\Windows\System\dMmtUqc.exe
  C:\Windows\System\dMmtUqc.exe
  2⤵
  PID:8496
- C:\Windows\System\Dbcmoxq.exe
  C:\Windows\System\Dbcmoxq.exe
  2⤵
  PID:9824
- C:\Windows\System\BaeLVrt.exe
  C:\Windows\System\BaeLVrt.exe
  2⤵
  PID:9364
- C:\Windows\System\OhzMlJR.exe
  C:\Windows\System\OhzMlJR.exe
  2⤵
  PID:9392
- C:\Windows\System\MiCbieD.exe
  C:\Windows\System\MiCbieD.exe
  2⤵
  PID:10016
- C:\Windows\System\CmxScgU.exe
  C:\Windows\System\CmxScgU.exe
  2⤵
  PID:10064
- C:\Windows\System\wzKvpSP.exe
  C:\Windows\System\wzKvpSP.exe
  2⤵
  PID:10300
- C:\Windows\System\jzLMsCT.exe
  C:\Windows\System\jzLMsCT.exe
  2⤵
  PID:10356
- C:\Windows\System\fvgiwbx.exe
  C:\Windows\System\fvgiwbx.exe
  2⤵
  PID:9604
- C:\Windows\System\FXaXsbT.exe
  C:\Windows\System\FXaXsbT.exe
  2⤵
  PID:9644
- C:\Windows\System\KwYSWOX.exe
  C:\Windows\System\KwYSWOX.exe
  2⤵
  PID:12312
- C:\Windows\System\qNSNcVF.exe
  C:\Windows\System\qNSNcVF.exe
  2⤵
  PID:12332
- C:\Windows\System\YMrXykn.exe
  C:\Windows\System\YMrXykn.exe
  2⤵
  PID:12356
- C:\Windows\System\glCQfHZ.exe
  C:\Windows\System\glCQfHZ.exe
  2⤵
  PID:12376
- C:\Windows\System\xEwfEJN.exe
  C:\Windows\System\xEwfEJN.exe
  2⤵
  PID:12396
- C:\Windows\System\BCekvzu.exe
  C:\Windows\System\BCekvzu.exe
  2⤵
  PID:12420
- C:\Windows\System\osEqRMX.exe
  C:\Windows\System\osEqRMX.exe
  2⤵
  PID:12440
- C:\Windows\System\rwngxcE.exe
  C:\Windows\System\rwngxcE.exe
  2⤵
  PID:12468
- C:\Windows\System\SthNjMR.exe
  C:\Windows\System\SthNjMR.exe
  2⤵
  PID:12492
- C:\Windows\System\FsaAaKK.exe
  C:\Windows\System\FsaAaKK.exe
  2⤵
  PID:12512
- C:\Windows\System\MXrixfd.exe
  C:\Windows\System\MXrixfd.exe
  2⤵
  PID:12536
- C:\Windows\System\UUZGOqQ.exe
  C:\Windows\System\UUZGOqQ.exe
  2⤵
  PID:12556
- C:\Windows\System\KhuammQ.exe
  C:\Windows\System\KhuammQ.exe
  2⤵
  PID:12580
- C:\Windows\System\MFCHPbe.exe
  C:\Windows\System\MFCHPbe.exe
  2⤵
  PID:12600
- C:\Windows\System\WSJSECg.exe
  C:\Windows\System\WSJSECg.exe
  2⤵
  PID:12624
- C:\Windows\System\cRzAehy.exe
  C:\Windows\System\cRzAehy.exe
  2⤵
  PID:12644
- C:\Windows\System\yWQtbjw.exe
  C:\Windows\System\yWQtbjw.exe
  2⤵
  PID:12664
- C:\Windows\System\EonfteV.exe
  C:\Windows\System\EonfteV.exe
  2⤵
  PID:12688
- C:\Windows\System\QbtEmLa.exe
  C:\Windows\System\QbtEmLa.exe
  2⤵
  PID:12708
- C:\Windows\System\mfzZPYh.exe
  C:\Windows\System\mfzZPYh.exe
  2⤵
  PID:12752
- C:\Windows\System\fmkWCil.exe
  C:\Windows\System\fmkWCil.exe
  2⤵
  PID:12780
- C:\Windows\System\LKzDyJD.exe
  C:\Windows\System\LKzDyJD.exe
  2⤵
  PID:12796
- C:\Windows\System\IuKvcGQ.exe
  C:\Windows\System\IuKvcGQ.exe
  2⤵
  PID:12824
- C:\Windows\System\UcplFcg.exe
  C:\Windows\System\UcplFcg.exe
  2⤵
  PID:12848
- C:\Windows\System\mZniRlv.exe
  C:\Windows\System\mZniRlv.exe
  2⤵
  PID:12876
- C:\Windows\System\EFTpGfN.exe
  C:\Windows\System\EFTpGfN.exe
  2⤵
  PID:12900
- C:\Windows\System\LjrlWsU.exe
  C:\Windows\System\LjrlWsU.exe
  2⤵
  PID:12916
- C:\Windows\System\jtbNNyW.exe
  C:\Windows\System\jtbNNyW.exe
  2⤵
  PID:12940
- C:\Windows\System\ugaeXoG.exe
  C:\Windows\System\ugaeXoG.exe
  2⤵
  PID:12960
- C:\Windows\System\YatWari.exe
  C:\Windows\System\YatWari.exe
  2⤵
  PID:12980
- C:\Windows\System\DrSVHbG.exe
  C:\Windows\System\DrSVHbG.exe
  2⤵
  PID:13004
- C:\Windows\System\erQuPxA.exe
  C:\Windows\System\erQuPxA.exe
  2⤵
  PID:13028
- C:\Windows\System\QnVnmkM.exe
  C:\Windows\System\QnVnmkM.exe
  2⤵
  PID:13048
- C:\Windows\System\jLUNAmg.exe
  C:\Windows\System\jLUNAmg.exe
  2⤵
  PID:13072
- C:\Windows\System\kUcEMUi.exe
  C:\Windows\System\kUcEMUi.exe
  2⤵
  PID:13092
- C:\Windows\System\jeTPKBV.exe
  C:\Windows\System\jeTPKBV.exe
  2⤵
  PID:13112
- C:\Windows\System\hYrwQVb.exe
  C:\Windows\System\hYrwQVb.exe
  2⤵
  PID:13136
- C:\Windows\System\cvHftYT.exe
  C:\Windows\System\cvHftYT.exe
  2⤵
  PID:13156
- C:\Windows\System\BczQQpw.exe
  C:\Windows\System\BczQQpw.exe
  2⤵
  PID:13176
- C:\Windows\System\GvWfhhK.exe
  C:\Windows\System\GvWfhhK.exe
  2⤵
  PID:13200
- C:\Windows\System\GRHwLWn.exe
  C:\Windows\System\GRHwLWn.exe
  2⤵
  PID:13220
- C:\Windows\System\ltEBZma.exe
  C:\Windows\System\ltEBZma.exe
  2⤵
  PID:13240
- C:\Windows\System\EgltnDx.exe
  C:\Windows\System\EgltnDx.exe
  2⤵
  PID:13264
- C:\Windows\System\IGEDKee.exe
  C:\Windows\System\IGEDKee.exe
  2⤵
  PID:13288
- C:\Windows\System\xobZxtR.exe
  C:\Windows\System\xobZxtR.exe
  2⤵
  PID:13308
- C:\Windows\System\KWKSOuV.exe
  C:\Windows\System\KWKSOuV.exe
  2⤵
  PID:10592
- C:\Windows\System\ztmXSAC.exe
  C:\Windows\System\ztmXSAC.exe
  2⤵
  PID:4796
- C:\Windows\System\isGwKJq.exe
  C:\Windows\System\isGwKJq.exe
  2⤵
  PID:11320
- C:\Windows\System\edcSgqH.exe
  C:\Windows\System\edcSgqH.exe
  2⤵
  PID:10724
- C:\Windows\System\ilyfuOa.exe
  C:\Windows\System\ilyfuOa.exe
  2⤵
  PID:10748
- C:\Windows\System\cTNswtt.exe
  C:\Windows\System\cTNswtt.exe
  2⤵
  PID:10764
- C:\Windows\System\RjWpjju.exe
  C:\Windows\System\RjWpjju.exe
  2⤵
  PID:10808
- C:\Windows\System\UnQtXDS.exe
  C:\Windows\System\UnQtXDS.exe
  2⤵
  PID:11404
- C:\Windows\System\CITyJWt.exe
  C:\Windows\System\CITyJWt.exe
  2⤵
  PID:10936
- C:\Windows\System\yGotZLK.exe
  C:\Windows\System\yGotZLK.exe
  2⤵
  PID:10108
- C:\Windows\System\TpUOaqR.exe
  C:\Windows\System\TpUOaqR.exe
  2⤵
  PID:11476
- C:\Windows\System\uIkaRgZ.exe
  C:\Windows\System\uIkaRgZ.exe
  2⤵
  PID:11568
- C:\Windows\System\blcqQJl.exe
  C:\Windows\System\blcqQJl.exe
  2⤵
  PID:11672
- C:\Windows\System\EjJkVaP.exe
  C:\Windows\System\EjJkVaP.exe
  2⤵
  PID:11136
- C:\Windows\System\WUiKnDe.exe
  C:\Windows\System\WUiKnDe.exe
  2⤵
  PID:11172
- C:\Windows\System\uHwvEuS.exe
  C:\Windows\System\uHwvEuS.exe
  2⤵
  PID:2084
- C:\Windows\System\UeAEmYX.exe
  C:\Windows\System\UeAEmYX.exe
  2⤵
  PID:8020
- C:\Windows\System\FHxLuSC.exe
  C:\Windows\System\FHxLuSC.exe
  2⤵
  PID:7968
- C:\Windows\System\iwflbrm.exe
  C:\Windows\System\iwflbrm.exe
  2⤵
  PID:8116
- C:\Windows\System\gZSFvIm.exe
  C:\Windows\System\gZSFvIm.exe
  2⤵
  PID:7280
- C:\Windows\System\SkgSzMg.exe
  C:\Windows\System\SkgSzMg.exe
  2⤵
  PID:13328
- C:\Windows\System\qFaUMjJ.exe
  C:\Windows\System\qFaUMjJ.exe
  2⤵
  PID:13352
- C:\Windows\System\liXQOci.exe
  C:\Windows\System\liXQOci.exe
  2⤵
  PID:13372
- C:\Windows\System\sYguLjE.exe
  C:\Windows\System\sYguLjE.exe
  2⤵
  PID:13396
- C:\Windows\System\SrzXuOM.exe
  C:\Windows\System\SrzXuOM.exe
  2⤵
  PID:13412
- C:\Windows\System\bfHZdcf.exe
  C:\Windows\System\bfHZdcf.exe
  2⤵
  PID:13432
- C:\Windows\System\GMxBimB.exe
  C:\Windows\System\GMxBimB.exe
  2⤵
  PID:13456
- C:\Windows\System\ALbfBPC.exe
  C:\Windows\System\ALbfBPC.exe
  2⤵
  PID:13472
- C:\Windows\System\MyZbMLI.exe
  C:\Windows\System\MyZbMLI.exe
  2⤵
  PID:13492
- C:\Windows\System\UeKnOSl.exe
  C:\Windows\System\UeKnOSl.exe
  2⤵
  PID:13524
- C:\Windows\System\YSikNOv.exe
  C:\Windows\System\YSikNOv.exe
  2⤵
  PID:13548
- C:\Windows\System\QAvHhbC.exe
  C:\Windows\System\QAvHhbC.exe
  2⤵
  PID:13572
- C:\Windows\System\wWKzlaR.exe
  C:\Windows\System\wWKzlaR.exe
  2⤵
  PID:13596
- C:\Windows\System\ZaXsULN.exe
  C:\Windows\System\ZaXsULN.exe
  2⤵
  PID:13612
- C:\Windows\System\NbJqfoe.exe
  C:\Windows\System\NbJqfoe.exe
  2⤵
  PID:13628
- C:\Windows\System\mbLPutR.exe
  C:\Windows\System\mbLPutR.exe
  2⤵
  PID:13648
- C:\Windows\System\frHFHkH.exe
  C:\Windows\System\frHFHkH.exe
  2⤵
  PID:13668
- C:\Windows\System\Ttrjdgo.exe
  C:\Windows\System\Ttrjdgo.exe
  2⤵
  PID:13684
- C:\Windows\System\uXWFXZd.exe
  C:\Windows\System\uXWFXZd.exe
  2⤵
  PID:13704
- C:\Windows\System\emUfaXs.exe
  C:\Windows\System\emUfaXs.exe
  2⤵
  PID:13732
- C:\Windows\System\MOsHieN.exe
  C:\Windows\System\MOsHieN.exe
  2⤵
  PID:13752
- C:\Windows\System\wfQsdYo.exe
  C:\Windows\System\wfQsdYo.exe
  2⤵
  PID:13768
- C:\Windows\System\WBBMqBN.exe
  C:\Windows\System\WBBMqBN.exe
  2⤵
  PID:13792
- C:\Windows\System\zJIoOEj.exe
  C:\Windows\System\zJIoOEj.exe
  2⤵
  PID:13812
- C:\Windows\System\vzOWUTL.exe
  C:\Windows\System\vzOWUTL.exe
  2⤵
  PID:13832
- C:\Windows\System\mNwveVv.exe
  C:\Windows\System\mNwveVv.exe
  2⤵
  PID:13856
- C:\Windows\System\KQdWUdL.exe
  C:\Windows\System\KQdWUdL.exe
  2⤵
  PID:13876
- C:\Windows\System\JYYPTNU.exe
  C:\Windows\System\JYYPTNU.exe
  2⤵
  PID:13896
- C:\Windows\System\dmyohMu.exe
  C:\Windows\System\dmyohMu.exe
  2⤵
  PID:13920
- C:\Windows\System\tpeHXgP.exe
  C:\Windows\System\tpeHXgP.exe
  2⤵
  PID:13944
- C:\Windows\System\XUQhqSH.exe
  C:\Windows\System\XUQhqSH.exe
  2⤵
  PID:13964
- C:\Windows\System\duQGyzs.exe
  C:\Windows\System\duQGyzs.exe
  2⤵
  PID:13984
- C:\Windows\System\OklzfTW.exe
  C:\Windows\System\OklzfTW.exe
  2⤵
  PID:14008
- C:\Windows\System\hIzbZeJ.exe
  C:\Windows\System\hIzbZeJ.exe
  2⤵
  PID:14032
- C:\Windows\System\ApfGEwS.exe
  C:\Windows\System\ApfGEwS.exe
  2⤵
  PID:14056
- C:\Windows\System\CaYRenE.exe
  C:\Windows\System\CaYRenE.exe
  2⤵
  PID:14076
- C:\Windows\System\bUJfzxY.exe
  C:\Windows\System\bUJfzxY.exe
  2⤵
  PID:14100
- C:\Windows\System\nCTkTuf.exe
  C:\Windows\System\nCTkTuf.exe
  2⤵
  PID:14120
- C:\Windows\System\KSfWgKl.exe
  C:\Windows\System\KSfWgKl.exe
  2⤵
  PID:14148
- C:\Windows\System\pwpoaLQ.exe
  C:\Windows\System\pwpoaLQ.exe
  2⤵
  PID:14176
- C:\Windows\System\musyWix.exe
  C:\Windows\System\musyWix.exe
  2⤵
  PID:14196
- C:\Windows\System\xLivZQB.exe
  C:\Windows\System\xLivZQB.exe
  2⤵
  PID:14224
- C:\Windows\System\cnGdNGP.exe
  C:\Windows\System\cnGdNGP.exe
  2⤵
  PID:14244
- C:\Windows\System\zceQsIu.exe
  C:\Windows\System\zceQsIu.exe
  2⤵
  PID:14268
- C:\Windows\System\CkxwJyx.exe
  C:\Windows\System\CkxwJyx.exe
  2⤵
  PID:14288
- C:\Windows\System\jygDzgE.exe
  C:\Windows\System\jygDzgE.exe
  2⤵
  PID:14304
- C:\Windows\System\kzWCPWV.exe
  C:\Windows\System\kzWCPWV.exe
  2⤵
  PID:14328
- C:\Windows\System\xuRBARy.exe
  C:\Windows\System\xuRBARy.exe
  2⤵
  PID:12224
- C:\Windows\System\slsqFEn.exe
  C:\Windows\System\slsqFEn.exe
  2⤵
  PID:12260
- C:\Windows\System\QTTeluU.exe
  C:\Windows\System\QTTeluU.exe
  2⤵
  PID:10608
- C:\Windows\System\mvlIxiq.exe
  C:\Windows\System\mvlIxiq.exe
  2⤵
  PID:10696
- C:\Windows\System\ENctGYb.exe
  C:\Windows\System\ENctGYb.exe
  2⤵
  PID:9260
- C:\Windows\System\yfGXIoW.exe
  C:\Windows\System\yfGXIoW.exe
  2⤵
  PID:3100
- C:\Windows\System\lvEWheB.exe
  C:\Windows\System\lvEWheB.exe
  2⤵
  PID:8292
- C:\Windows\System\wglXmpX.exe
  C:\Windows\System\wglXmpX.exe
  2⤵
  PID:10236
- C:\Windows\System\xwMCRyh.exe
  C:\Windows\System\xwMCRyh.exe
  2⤵
  PID:4980
- C:\Windows\System\oGvOukp.exe
  C:\Windows\System\oGvOukp.exe
  2⤵
  PID:6032
- C:\Windows\System\nBsXpNp.exe
  C:\Windows\System\nBsXpNp.exe
  2⤵
  PID:7644
- C:\Windows\System\UilzSyp.exe
  C:\Windows\System\UilzSyp.exe
  2⤵
  PID:9384
- C:\Windows\System\VYYdYRs.exe
  C:\Windows\System\VYYdYRs.exe
  2⤵
  PID:10420
- C:\Windows\System\tYUggHM.exe
  C:\Windows\System\tYUggHM.exe
  2⤵
  PID:3460
- C:\Windows\System\kXFXfGz.exe
  C:\Windows\System\kXFXfGz.exe
  2⤵
  PID:10504
- C:\Windows\System\mnKJjRw.exe
  C:\Windows\System\mnKJjRw.exe
  2⤵
  PID:9640
- C:\Windows\System\PgTZjEc.exe
  C:\Windows\System\PgTZjEc.exe
  2⤵
  PID:12304
- C:\Windows\System\RBjpLPe.exe
  C:\Windows\System\RBjpLPe.exe
  2⤵
  PID:12340
- C:\Windows\System\QExqoZe.exe
  C:\Windows\System\QExqoZe.exe
  2⤵
  PID:10588
- C:\Windows\System\TPbFWBn.exe
  C:\Windows\System\TPbFWBn.exe
  2⤵
  PID:12504
- C:\Windows\System\ncqOYtC.exe
  C:\Windows\System\ncqOYtC.exe
  2⤵
  PID:14348
- C:\Windows\System\EQbDUfb.exe
  C:\Windows\System\EQbDUfb.exe
  2⤵
  PID:14372
- C:\Windows\System\EtstcSo.exe
  C:\Windows\System\EtstcSo.exe
  2⤵
  PID:14392
- C:\Windows\System\AliXguR.exe
  C:\Windows\System\AliXguR.exe
  2⤵
  PID:14408
- C:\Windows\System\cXUMezE.exe
  C:\Windows\System\cXUMezE.exe
  2⤵
  PID:14432
- C:\Windows\System\udwjAfB.exe
  C:\Windows\System\udwjAfB.exe
  2⤵
  PID:14464
- C:\Windows\System\FNFmktY.exe
  C:\Windows\System\FNFmktY.exe
  2⤵
  PID:14488
- C:\Windows\System\LvxuNbC.exe
  C:\Windows\System\LvxuNbC.exe
  2⤵
  PID:14512
- C:\Windows\System\FAITVYv.exe
  C:\Windows\System\FAITVYv.exe
  2⤵
  PID:14528
- C:\Windows\System\dBhHqRZ.exe
  C:\Windows\System\dBhHqRZ.exe
  2⤵
  PID:14552
- C:\Windows\System\BZIPDKk.exe
  C:\Windows\System\BZIPDKk.exe
  2⤵
  PID:14572
- C:\Windows\System\nTTuArx.exe
  C:\Windows\System\nTTuArx.exe
  2⤵
  PID:14600
- C:\Windows\System\yTwBJyT.exe
  C:\Windows\System\yTwBJyT.exe
  2⤵
  PID:15256
- C:\Windows\System\xcJYXxx.exe
  C:\Windows\System\xcJYXxx.exe
  2⤵
  PID:15272
- C:\Windows\System\vtuXCNN.exe
  C:\Windows\System\vtuXCNN.exe
  2⤵
  PID:15292
- C:\Windows\System\TyJmoJB.exe
  C:\Windows\System\TyJmoJB.exe
  2⤵
  PID:15316
- C:\Windows\System\QeNCRJr.exe
  C:\Windows\System\QeNCRJr.exe
  2⤵
  PID:15348
- C:\Windows\System\xuiOCzR.exe
  C:\Windows\System\xuiOCzR.exe
  2⤵
  PID:12552
- C:\Windows\System\znRmruE.exe
  C:\Windows\System\znRmruE.exe
  2⤵
  PID:12632
- C:\Windows\System\udmWKsa.exe
  C:\Windows\System\udmWKsa.exe
  2⤵
  PID:10840
- C:\Windows\System\OBmbdPz.exe
  C:\Windows\System\OBmbdPz.exe
  2⤵
  PID:12764
- C:\Windows\System\hZPsPvf.exe
  C:\Windows\System\hZPsPvf.exe
  2⤵
  PID:12840
- C:\Windows\System\XnaBNfI.exe
  C:\Windows\System\XnaBNfI.exe
  2⤵
  PID:11468
- C:\Windows\System\jBONCEf.exe
  C:\Windows\System\jBONCEf.exe
  2⤵
  PID:10984
- C:\Windows\System\wAPXtKF.exe
  C:\Windows\System\wAPXtKF.exe
  2⤵
  PID:11572
- C:\Windows\System\LLyMnJP.exe
  C:\Windows\System\LLyMnJP.exe
  2⤵
  PID:11776
- C:\Windows\System\iClkJCK.exe
  C:\Windows\System\iClkJCK.exe
  2⤵
  PID:11216
- C:\Windows\System\SeFkpyC.exe
  C:\Windows\System\SeFkpyC.exe
  2⤵
  PID:11256
- C:\Windows\System\GknOlGo.exe
  C:\Windows\System\GknOlGo.exe
  2⤵
  PID:8608
- C:\Windows\System\xwjXnAz.exe
  C:\Windows\System\xwjXnAz.exe
  2⤵
  PID:9800
- C:\Windows\System\tITHBXw.exe
  C:\Windows\System\tITHBXw.exe
  2⤵
  PID:1724
- C:\Windows\System\gFaYNWG.exe
  C:\Windows\System\gFaYNWG.exe
  2⤵
  PID:13916
- C:\Windows\System\MxbGNgV.exe
  C:\Windows\System\MxbGNgV.exe
  2⤵
  PID:13992
- C:\Windows\System\gzQswhD.exe
  C:\Windows\System\gzQswhD.exe
  2⤵
  PID:14072
- C:\Windows\System\tfvrmin.exe
  C:\Windows\System\tfvrmin.exe
  2⤵
  PID:14128
- C:\Windows\System\VywbXRd.exe
  C:\Windows\System\VywbXRd.exe
  2⤵
  PID:14240
- C:\Windows\System\cSgQnfG.exe
  C:\Windows\System\cSgQnfG.exe
  2⤵
  PID:13384
- C:\Windows\System\rHeYBYS.exe
  C:\Windows\System\rHeYBYS.exe
  2⤵
  PID:11900
- C:\Windows\System\CpVXCJw.exe
  C:\Windows\System\CpVXCJw.exe
  2⤵
  PID:11424
- C:\Windows\System\HcSCBJJ.exe
  C:\Windows\System\HcSCBJJ.exe
  2⤵
  PID:10636
- C:\Windows\System\kLboPnB.exe
  C:\Windows\System\kLboPnB.exe
  2⤵
  PID:11516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
1⤵
PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BGXPOJI.exe

Path C:\Windows\System\BGXPOJI.exe
Size 1.5MB
SHA256 02975472f249c63bb90b4273aadbcf626abb593237f3fad474088057502e9139
MD5 d03d9cc5b025801ed44f5664ccf3b51c
SHA1 d4621dc8cf1de67edc2a882e3201c6d74d146175
SHA512 2199c39a80b8d0dd9faefbb3c271fcc3e8abc76bc962631c73acde4fdab0c9506d66a4949779f3d257cb6dc4bb8d305378d21ef944ba9d9d514c6a0ebcd4d1e7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg2:ROdWCCi7/rahOYkZtg94V8XRTgXe82
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSJSgJE.exe

Path C:\Windows\System\CSJSgJE.exe
Size 1.5MB
SHA256 d1b880eb11760e39ff2e8efed3c3d951b091992cc4bb15a892631cf09f2c9400
MD5 78e8bab9f4d683bc6f17f72239df06ad
SHA1 72b4f29512f6fc063813a967210f28ba675a077f
SHA512 33f7ed9a62e4928dae03a7ed10081c0fb77189094ae3d85a60e6a798dfd386e5b0926a5c8543e9cfcfd0445e2ffde339ca7af4c8febc21449b4c4707fa916d4a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgh:ROdWCCi7/rahOYkZtg94V8XRTgXe8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlSSspA.exe

Path C:\Windows\System\FlSSspA.exe
Size 1.5MB
SHA256 b499d23259094a28b31dbab83c5ffdd5f19c924cfb8f3bf7f40bdc12402a6c2f
MD5 8f55c32fadc7205841b6098a2b0a0806
SHA1 8d6fa6eb2dd26045e7ae56ea1b26f160c7905e20
SHA512 3c0cfeeeb7747e67bda4b9eb209db05d3800bb31b7c76126fef394ca4ed700e3623d3d8c3f487b4427e049b8c0803a908f373f629f76c5a2d209a70edfda4061
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg2:ROdWCCi7/rahOYkZtg94V8XRTgXe82
MD5 SHA1 SHA512 SSDEEP

Submit Download

FyjvsLH.exe

Path C:\Windows\System\FyjvsLH.exe
Size 1.5MB
SHA256 758708d28eb5c7dd0c33462220371001b637021c3866232b8f523f6f75da984d
MD5 49acfa490fd57932f7abf29c81012cf4
SHA1 2d12a98903713ca504f5fadd39d01cec8a2eb3d5
SHA512 0c4a6087121f326457f7455804da9d7a3a52f42b42a39102f979230701dba179238bb202fa47a1fa5142996f20d9639038eb17d2e49adc2bd074f15843b81c4d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg1:ROdWCCi7/rahOYkZtg94V8XRTgXe8yi
MD5 SHA1 SHA512 SSDEEP

Submit Download

HKHiuOl.exe

Path C:\Windows\System\HKHiuOl.exe
Size 1.5MB
SHA256 690f52b750f2476cda9b6db05622942f6e43890e89c50bd2a0dbcb6b523bcd6c
MD5 6110d786c25a55950e1f95088b6478d5
SHA1 cbf38794d10c40a2c7b72e13c8fb7f44e1618ca0
SHA512 7a372d3747eb7deffc2724543a2e4708c6ef35531b2fe77be56e3c08b5b4b56f9e4baf1e4f81114cd2df5a0eef8c8129da0e11c7ad623b11f8d1433c7cb9b204
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgH:ROdWCCi7/rahOYkZtg94V8XRTgXe8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

HZHdxND.exe

Path C:\Windows\System\HZHdxND.exe
Size 1.5MB
SHA256 f50ea21c4f6f722b19f2f6738ad30161c07da75b7414f1a1b0a6f3b7309c5154
MD5 d311972e3825e46884d2c9620d22ebf8
SHA1 13a36ebc6a8cb50340849d83e39f2efd88ed7ee4
SHA512 ddc6f1dc3e56572f9404246e2dc0e5d6c731018b452929e5e0d8baa78b2101edfbfa858f37c79840be4be35dee5f245776b7f586766c8a125c15f4765d8b3e03
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgF:ROdWCCi7/rahOYkZtg94V8XRTgXe8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

JORxJoq.exe

Path C:\Windows\System\JORxJoq.exe
Size 1.5MB
SHA256 4ed4513d710dd17afb01414ca43b968d664298559c0286573d8a9b7e6eb05494
MD5 7ceb86e52d709e14c24a48268821cf55
SHA1 53e74e81e25698cc46f95c6d686f314b546150fa
SHA512 2d021daafae39ef6bddfc682a7f8d06b758211300f62383b7a1d627860a88b317f01fc801c596b5c487c4d5a9a5d48124df657a3280d00621a6e1ca794d89205
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgv:ROdWCCi7/rahOYkZtg94V8XRTgXe8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

JVGwrbT.exe

Path C:\Windows\System\JVGwrbT.exe
Size 1.5MB
SHA256 0e40184726fa137dd61aced7ddc40b9ed4c3d1132e1e957cd72fc25da9cbda8a
MD5 98e2e0938b84467f1b20e4585cd51d39
SHA1 1a01e9c031458302f7d9921212c8eae153490a55
SHA512 0d9db8c1dbd1ebed5c12350d0085e2afe81fae735381f6fc62a5dec1e932dcf66b7b1ff8da878e97d3bc336f5973a41006021a49287cc98e50a9488c91473dc1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgM:ROdWCCi7/rahOYkZtg94V8XRTgXe8M
MD5 SHA1 SHA512 SSDEEP

Submit Download

KdjYKuY.exe

Path C:\Windows\System\KdjYKuY.exe
Size 1.5MB
SHA256 3561484da0cada5c8d649079296437dc02236cd466d705543dd1ecb053ac3a9e
MD5 3f43e8fe0a5087517099e7c08687c38e
SHA1 e4ac617570ead56bd8f8b063c76a8704617d9343
SHA512 9b62bfab38dc1f581f4fd5810456901d4de4329141171f66c8ad2d510d89fe7666f956b730080124882aa9aaa6b9ced5699a59768ced2b33ac40196bf20adfc8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgp:ROdWCCi7/rahOYkZtg94V8XRTgXe8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

LBHmzSP.exe

Path C:\Windows\System\LBHmzSP.exe
Size 1.5MB
SHA256 93fb007f0ab9d777eea6b120299c2eff6d60c7668e8865a944c206587a6a58df
MD5 2394e6a58a19205f6929e2c745836116
SHA1 3828222f4817df774c6b3287992e16b1b293e383
SHA512 e4dd4d02c9549270a4d13620404c84576d9b31030ec5dd185b501fa5668558fffac09d9f7c640e4b3db5e6aa2a51a037826b5fac04d45f01174a1d7c77651dfc
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgr:ROdWCCi7/rahOYkZtg94V8XRTgXe8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

LxqXfmy.exe

Path C:\Windows\System\LxqXfmy.exe
Size 1.5MB
SHA256 202f15c7df0b241a41545ec05e1214706cbf57a1eaa3ee338626ad9f1bca7a40
MD5 2e779aa55900a78bc91080b5bfa8da4f
SHA1 fabd73faf201f5d3942cb095234c619c8e885ef9
SHA512 acf45f6d2f1f891c60926aa508b5c7ccdd30923912454c70859eae256246c3428741a950e75c61ba9474ffde4693720ec78b1fae764f03b8ea91694ba7edcb0c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgt:ROdWCCi7/rahOYkZtg94V8XRTgXe8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

SGsCMDn.exe

Path C:\Windows\System\SGsCMDn.exe
Size 1.5MB
SHA256 1c82f9217665fdb6000e75cfe64334b7abc3aaf77b1936d5c60867cb3b5dd2b8
MD5 d41ffa01e00b2c799c8242be4f8c3cd8
SHA1 dbbcde0b97f71aac053610186000750e4f3b8304
SHA512 f8645f908718ebfadd1f579d0fcd65072c8f7042b4df953752fcada68b9c077394adcc79015cd9aa53d308a69d80b119511b52908fde01d2acc302cb25f0d92c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg2:ROdWCCi7/rahOYkZtg94V8XRTgXe8t8
MD5 SHA1 SHA512 SSDEEP

Submit Download

UCwQEgc.exe

Path C:\Windows\System\UCwQEgc.exe
Size 1.5MB
SHA256 d2dacd1620695d801b2ee5d5f5e1d22dc98ca2392e9ee1cdc648ed2252f8f4f4
MD5 1a32fd7f4c4f383ca8f0390e6ece346c
SHA1 a3d92954b70e73d393d8f699e4eb0afbfded8633
SHA512 64955afade82ff47bbdbb668f749e5380959c823a1c097c14ee69fdb741e2ddd84908d330f35b394aec6c6d29417f03b20001bc13278efb7ca007fae22ae1b1f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITga:ROdWCCi7/rahOYkZtg94V8XRTgXe8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

VGOhlBC.exe

Path C:\Windows\System\VGOhlBC.exe
Size 1.5MB
SHA256 f96b353b76f06a4ef0582b339c6ba4ecbf342211e974873c9eee8a3d5b218850
MD5 e6ac1c2b04d397a5de4c5c953a52b9a5
SHA1 9ae175d8b63ee4ca53984db95010cd59e0009903
SHA512 57d4936289a34badc5202a45ea2bb7c5d6a4136c46e057d52d07424cebc3a290e609a0b72c90ac5d07354e8f7628939d6387b0d3451c9c452597b0f592ef2907
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgw:ROdWCCi7/rahOYkZtg94V8XRTgXe8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

WgznCBN.exe

Path C:\Windows\System\WgznCBN.exe
Size 1.5MB
SHA256 939d779cdb0315956170c7e04357e4009bd6e488b24280934c78f7ebb1d23bbf
MD5 9d74759880cac7930c623cbbae1bfc2b
SHA1 3d9f2d6be483da6538247e84e14d65186581a984
SHA512 d37bd2a402ed33b313de15928467a7ac30afc7d820f62e138fe67d48559f76144a4bdd49bf3abb8f01bf6c9ad9913e243733e0fa066c17425b7cab4176768387
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgi:ROdWCCi7/rahOYkZtg94V8XRTgXe8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

YlqGAzW.exe

Path C:\Windows\System\YlqGAzW.exe
Size 1.5MB
SHA256 60acc006841ad74c5abcbed9c1afdaf6aab7aa8d4070b1907d1a1d0dbd068ccb
MD5 8c11ab3183f7045ef99c5f59fd663dc9
SHA1 80281e572478dee3964e9c7f45e209415dedc37a
SHA512 5535a1dcc0d6cf40a253c38c0793b249c275372d4594a7e56485c8ee09187421b06343e323b0caaadcc9d38f9490d2dd5b01bb613e45d970d239b2bd58970f74
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgV:ROdWCCi7/rahOYkZtg94V8XRTgXe8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZOFBZGZ.exe

Path C:\Windows\System\ZOFBZGZ.exe
Size 1.5MB
SHA256 3a90565887641563be633b097e371c1999119849ffc2bd697b382d1bb5c81b48
MD5 5794a85c14e395954675f1ebe6c169fa
SHA1 cc7c9a3b4d6664877381048e281d1f37dea413a8
SHA512 096ce68895d45bae1654ee742769a914f3a85639f4d889f2f5a0cc9ec20d44fa596e43300ccf5cbaa2f149cc627fb7bfd43aec3b6e0363ac0214092c757c30b1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgZ:ROdWCCi7/rahOYkZtg94V8XRTgXe8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

avAxHyH.exe

Path C:\Windows\System\avAxHyH.exe
Size 1.5MB
SHA256 51b1b770f2702e40217441d881a7f4910d5978450a38c0c957fae6f2fac419e0
MD5 d08bea6ef50f85ad00a0af069e71a244
SHA1 42cc772c84a506426f960712f4c6cd4c1a752972
SHA512 16697d5335e92c649d31c4f830238a3c2040f3fa03abbacda8be649085ab95764f8df65ca0de6c00649d522fbca06b043d5f6c3cf5ba62b6be138f63f12893eb
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgk:ROdWCCi7/rahOYkZtg94V8XRTgXe8k
MD5 SHA1 SHA512 SSDEEP

Submit Download

bnkFXux.exe

Path C:\Windows\System\bnkFXux.exe
Size 1.5MB
SHA256 da68a2e30d8ca9472e5dddf96f81858a2f319ebaca30f77608709049f596ce54
MD5 b239ad7a95a3fe3b9a8bf4707d1e169f
SHA1 5a9ecb42f33b89bcf4b49e29928aa0d3d5c640c2
SHA512 bfb28f30de48ee598429541a64cbe20be2fecb715047a48376d0384d152be0fcec0ce36a887e8064cc160da6dfd1d0ddb9d09d03f0b564bff612f18931c00f57
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgQ:ROdWCCi7/rahOYkZtg94V8XRTgXe8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dAPLgjS.exe

Path C:\Windows\System\dAPLgjS.exe
Size 1.5MB
SHA256 df85a619840e3c01adfc1ee027edb1c34993f7d4deccabe9330d35da24555ce7
MD5 d22559293213afd4e9e7a13803b9b428
SHA1 e2681cd49032fa56b7efbb4a1de30c85368f6cdf
SHA512 8d5c82dade28b7c22971569cd403daf151897303b026ad25e3498f57b94aa2adcf2ec2abe0fd551330ad0c3b99d34abf8fc4a9b822eb9404d78931a2ff5d02a7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgw:ROdWCCi7/rahOYkZtg94V8XRTgXe8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

dzHGFxi.exe

Path C:\Windows\System\dzHGFxi.exe
Size 1.5MB
SHA256 28374c8113c3fe5aeeaa6287a306625e36fa035742bf9f632eff3f6b9b6399f9
MD5 32381607e3d45a6f8f53eb6c89ea2d33
SHA1 cf2da5bacf0e11e1aede1f5c5997f603e68568ba
SHA512 64cdeab917c87a59980786a22a64f342e5f7f61b4122652d9db216a9e6f5eb33c436220e866d616761608b13024d2a510bf5bfeab58688512ca2c78810a9ad0e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgt:ROdWCCi7/rahOYkZtg94V8XRTgXe8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwQDCKY.exe

Path C:\Windows\System\fwQDCKY.exe
Size 1.5MB
SHA256 a3b3fd4ef1c05ef405b3ecce3c225a4d23df517ebdba236af0efe8afbec23f45
MD5 503645d100262855e5946baf40b58e90
SHA1 3e5a659ebba84cc2e075da0818d9a42c46d8aa56
SHA512 5529b886f63ec6130335c28ce538db2b325fff0b22cfd8c8ea4d89765ce08c007df851f44769ac372ffc4626274cf1f118b050859030885ee25e481b29c8d02a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgX:ROdWCCi7/rahOYkZtg94V8XRTgXe8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

gegVXAl.exe

Path C:\Windows\System\gegVXAl.exe
Size 1.5MB
SHA256 a1462899e3f884a991dbaac3fd4f686282c66761b558f16b63ddced33cc200d3
MD5 577f99528302c9ccca447660eab2885d
SHA1 fa2333448d6fff19234a87b641f544176622eda9
SHA512 41b39eac1b782f6488d5d2f45e98a3d2b01b57da08a37c232977f8606bc74f67b63416b03f10412bcf92d1ac8c3f20a12e778c6c3efd733c6de652f02325f220
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgu:ROdWCCi7/rahOYkZtg94V8XRTgXe8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkjvPRN.exe

Path C:\Windows\System\gkjvPRN.exe
Size 1.5MB
SHA256 5806c5af88a898844d270f68cbaf768294aa687bdcc64527cf65a62e237be80e
MD5 1b7b63d44bdde557b762f967ec6ca85f
SHA1 625cc21befd69431f508361c0beda94243f85fba
SHA512 b87ddd5a258dd315d52caad4064e255921764f659a0da70d440ca44fbdc1e56395be94ae0d828803750b2d9b6aff39e63180bf811212f36abefa749f1340c03c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg3:ROdWCCi7/rahOYkZtg94V8XRTgXe83
MD5 SHA1 SHA512 SSDEEP

Submit Download

hsXENWa.exe

Path C:\Windows\System\hsXENWa.exe
Size 1.5MB
SHA256 2dd7f99389302218787833829ff7bf52b12f73f9b857b3f89dd35cba914c9877
MD5 38c1e4e395f7257d5577a95530b62b4e
SHA1 95bbc705839e8d4dbdc9be4992870b0078418fb0
SHA512 f2ecd9eb2da4e9aa6f4b41ec2402824ea3d26dd091c179e1e9735d598662c012bb1fb4acb7a1fb60ab99bcfa69aa1c58a39cbc1389c4cb5a7c3310a66be20df5
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgC:ROdWCCi7/rahOYkZtg94V8XRTgXe8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

iAlCAjA.exe

Path C:\Windows\System\iAlCAjA.exe
Size 1.5MB
SHA256 db040d44d85a3060b5fcbfe747f04cf9496f4cb764aa3aa631362a93608024c4
MD5 374053bfe5adfc3176ed4589d6be0901
SHA1 a2d20910387e07a0616c975748050db3912c3965
SHA512 7abcc7b60277027f4419a7f0e1f6e7dff9779c7359c92c3875eb8993c3b78c6af4b65ec1730360aa6250027e41da8deed1e5c0c2efeb260f17adfb630e409c64
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITge:ROdWCCi7/rahOYkZtg94V8XRTgXe8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

iCTXJbs.exe

Path C:\Windows\System\iCTXJbs.exe
Size 1.5MB
SHA256 0830ef54af22459885d99f8b90458b65b43b33da5a2c6579c931985b57030c4a
MD5 4f154fccac753e861d205fb00e89e92f
SHA1 51528c1df306042f79c9e577f9561f04b9afda67
SHA512 1d0950a991ca45582f2d0a9c8bd6b39552d68252c73afc89315f339f7550aeb865f8111ff7d82fc11b3ca79768a9b1d9bcebef9f11d8777a55013322c40baba8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgm:ROdWCCi7/rahOYkZtg94V8XRTgXe8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

idJbjqe.exe

Path C:\Windows\System\idJbjqe.exe
Size 1.5MB
SHA256 c5b555121f386a28249f84e29a1464e9fdf0b416110f968795781a5998d0c0f2
MD5 c3611297a1251256c4931ddbdc224ebc
SHA1 c625219c5ab09a846d6e2466d14da0b936e17c13
SHA512 98590756389718eb8694eb8be57590d013c9d61abaf46cb24f2eb247be762ddbab08133b9059850ac91ba6b003cf43c891adac2feae72afeafc8fc7532c8d2f1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgl:ROdWCCi7/rahOYkZtg94V8XRTgXe8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

inezltd.exe

Path C:\Windows\System\inezltd.exe
Size 1.5MB
SHA256 66c015ebd5ed868a3708c42b4820edacb34e3d8677355b120cbeabf0fa5f216d
MD5 39c073eaf16d24d4d6e863ee20a25327
SHA1 d5ad404c0bfa7cf4518c81308b9d3d4197589255
SHA512 1a64c4c44848e6f7af2cdfaab491becb4f7748f61167bc1af45e1d4bc83d52a64f6c421dc064554fe77795104065f5531d103faf67e42a1a9b9aa72011eb2c75
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgj:ROdWCCi7/rahOYkZtg94V8XRTgXe8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

lXrssua.exe

Path C:\Windows\System\lXrssua.exe
Size 1.5MB
SHA256 f9058866bd40c9d6fad2df6740b7db0b14a56bb9f2d4db662667dc42400e32c7
MD5 aefbd8fdb0a2823923e43118448a4ed7
SHA1 a31240b00d467c49adcfa4cc32d4a1bcfec952ab
SHA512 d9c5773542e1dcaa84c93c7dafc3edbba8203c50a16948238bfb8ca2d2e5cb3a3868ba048c1f4544cb88a9572ba026f6ae4935e6e5119a78ba69b2eb3ff349e1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgG:ROdWCCi7/rahOYkZtg94V8XRTgXe8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

lkPgLPd.exe

Path C:\Windows\System\lkPgLPd.exe
Size 1.5MB
SHA256 b2d7c21d99f48db65657bb212d15b42c0e9f55acfef2eb602ab2f7cc42d51f0e
MD5 c8418496c16d871229c2b0d2bad57ad6
SHA1 2fc5b50a540827e424da410811e5396cdf0c29e0
SHA512 0d6c54f40995557d3f11a687c34ec938305bd9a69c9174e565e01b654282f8ad5b4bdb1db27badea8d57459050d0622f0d311d81e4a770b79bd5c165c3f9a8b9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg+:ROdWCCi7/rahOYkZtg94V8XRTgXe8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

lutRjPD.exe

Path C:\Windows\System\lutRjPD.exe
Size 1.5MB
SHA256 0c2665e75e4817bacf91df9880d9fa4f0c6eee7c2d1e976318cc06b3e47c8c54
MD5 d7c72a054d57c3706dc2e83d7e7869f1
SHA1 e4c529894a99bdccfc3a2dc3b461150a2e1c6702
SHA512 9ac318515457aab631402af1d29626b4cc02af83a7ffeb50f2aa82ded954120f066adc8a1ce1562eb48a84754edbb1e9bcc2b111bc69eaa8111bfdf0dcd7709d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgb:ROdWCCi7/rahOYkZtg94V8XRTgXe8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

mPZLCVP.exe

Path C:\Windows\System\mPZLCVP.exe
Size 1.5MB
SHA256 6e305327a0fbec06cf0c3bc1c1b63e79d87408c4b156145b00a1789d686133cb
MD5 544665cad00b66e3bf036516594cffdb
SHA1 d0d5a61fd5af548bdf009f951a31572e8c6342bf
SHA512 b63ba63dc2b4b8d3eaa7c7b311b95e50533d8cdf73606ae619fbb18ddfe94b37a64f324c46a44e732ff9cd8b5fec6478726b7f03b97309484e182557d43c1539
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg5:ROdWCCi7/rahOYkZtg94V8XRTgXe85
MD5 SHA1 SHA512 SSDEEP

Submit Download

pimupVJ.exe

Path C:\Windows\System\pimupVJ.exe
Size 1.5MB
SHA256 ca713022a38cb328085818d5873475cace37e43bd8ae7ff2e805c90cadeac83b
MD5 ff5aa2beba743e57f8ec18205e9c92f7
SHA1 fcbb21d5cd5a4707bc0c744e26e05cc87fd7fef4
SHA512 81de73828d2f7d2429461f70dfbb49d0bcb90c33614fd8ebc9aab641bac79a49b839b79d8f37228db7eab6d984b94e22363d9469aba10ae147bbe263f7a50842
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgR:ROdWCCi7/rahOYkZtg94V8XRTgXe8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

sVOutVB.exe

Path C:\Windows\System\sVOutVB.exe
Size 1.5MB
SHA256 fc5097ef65a72f89816875c3f0a84a0d29b3a6f7a5989006188abcd83658e426
MD5 b20b83c28f2fa7b8784807ad1d3e7d94
SHA1 c5722053fab214b50246af3d1a561c0b255b090f
SHA512 d81160b0096a6b5d48487b18ffe413ec909cae6f59bd08833ab7472a08f7f9949a5202ee2a9cdfe9e9d8a95de9edb44bf14e34ebcd7b956ce3a15370a198f922
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgC:ROdWCCi7/rahOYkZtg94V8XRTgXe8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

swoabeT.exe

Path C:\Windows\System\swoabeT.exe
Size 1.5MB
SHA256 ec0b602e18f3598f55222d1fee5e5a28b6c873ecd2602b1526b310aec6a3011a
MD5 8d40a6cbc87094fb85f4957e8d53a75c
SHA1 ffddd472c1fc9647d86ec2d642bce946af437326
SHA512 961b3d1eba6a1c47e0578252c62ce0cc5c3f90166aaca5eb60d4a0adf86f068c15247c13b1c39c0ecfc55bfbfa712522f1a8b875571221af91430a1e5251bba6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgP:ROdWCCi7/rahOYkZtg94V8XRTgXe8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

vhtIExL.exe

Path C:\Windows\System\vhtIExL.exe
Size 1.5MB
SHA256 71f8c8f90d1658d2d412a884f0ce31d2f80aceccd8566384705cb01bc8876eec
MD5 e0d2c0088ff5f95963f4eb61009aa5d7
SHA1 98ef421d526570ee0e860beb47973fd9c1be4084
SHA512 6154cc41e4ec9b38f27984ce3e2257a5e3b7803044030d0b0aab4faa23d85105f3c0bb6164369f716b2dc2385b2193728f66ccd5f250db631d9bc49e94acc3d9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgT:ROdWCCi7/rahOYkZtg94V8XRTgXe8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

yTBkAkg.exe

Path C:\Windows\System\yTBkAkg.exe
Size 1.5MB
SHA256 31c46a4a38ed59ee9747c31e3fa27df190918c0594cbdf93b15e34e056b41a37
MD5 e723bdbfd52506ed5f36f625c464e85c
SHA1 85c8857e62c76655948a5f52433ca91aee9307ef
SHA512 a3fbdb94cbbb8e2967fea5ddbfbd55f3630e16f632f0a72a750c89c6ab8d5ae21b47ea201a471e172998d6146d0c10eaaedaa055a70fec642abbef5c9576dd2d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITg4:ROdWCCi7/rahOYkZtg94V8XRTgXe84
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylOiSuY.exe

Path C:\Windows\System\ylOiSuY.exe
Size 1.5MB
SHA256 73e1f699246ec62fecbb606fd543f3fddbb34d402d570ff98f87bc7be53e28ae
MD5 37b5d0c3de57a7da5120400f4ed5ab1c
SHA1 71dacf726f826d909c7da0740c25c411344a7d03
SHA512 71316a07d589252770ec22ba903cc0aef622b99c65a2d8fa90e01bf517223686f586bea6d4c349c709cde206aadee5775ac3c4c9c31ef58e688661811019eef0
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgA:ROdWCCi7/rahOYkZtg94V8XRTgXe8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxHjgio.exe

Path C:\Windows\System\zxHjgio.exe
Size 1.5MB
SHA256 01286e8e0cc8e6d9bc19f188ebfbe943307b856efbf208c16d24f69f0ae8fdd9
MD5 2a9368dd60c9d5a428faf81dfa0674fb
SHA1 4548289b5f62bec74440aa3e0aac4d92f5715441
SHA512 a512875718a7049dff9475ad193372f6908f8b834385c15e997216349d1e8ca8f82526c9f48b3e895b61fc2a7df60e82fea53c83eb1ad361e1e3b8192544216f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFu3PzZtvIaUniop03bV8Uc69ITgw:ROdWCCi7/rahOYkZtg94V8XRTgXe8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-78-0x00007FF6CBF70000-0x00007FF6CC2C1000-memory.dmp

Download

memory/672-2259-0x00007FF6CBF70000-0x00007FF6CC2C1000-memory.dmp

Download

memory/672-2318-0x00007FF6CBF70000-0x00007FF6CC2C1000-memory.dmp

Download

memory/804-2335-0x00007FF78FC70000-0x00007FF78FFC1000-memory.dmp

Download

memory/804-436-0x00007FF78FC70000-0x00007FF78FFC1000-memory.dmp

Download

memory/852-2356-0x00007FF7BD380000-0x00007FF7BD6D1000-memory.dmp

Download

memory/852-306-0x00007FF7BD380000-0x00007FF7BD6D1000-memory.dmp

Download

memory/1000-540-0x00007FF6ED620000-0x00007FF6ED971000-memory.dmp

Download

memory/1000-2342-0x00007FF6ED620000-0x00007FF6ED971000-memory.dmp

Download

memory/1064-2354-0x00007FF6A16F0000-0x00007FF6A1A41000-memory.dmp

Download

memory/1064-571-0x00007FF6A16F0000-0x00007FF6A1A41000-memory.dmp

Download

memory/1240-570-0x00007FF603CE0000-0x00007FF604031000-memory.dmp

Download

memory/1240-2330-0x00007FF603CE0000-0x00007FF604031000-memory.dmp

Download

memory/1616-2350-0x00007FF6EB800000-0x00007FF6EBB51000-memory.dmp

Download

memory/1616-377-0x00007FF6EB800000-0x00007FF6EBB51000-memory.dmp

Download

memory/1652-2310-0x00007FF7350A0000-0x00007FF7353F1000-memory.dmp

Download

memory/1652-568-0x00007FF7350A0000-0x00007FF7353F1000-memory.dmp

Download

memory/1708-2340-0x00007FF7D76D0000-0x00007FF7D7A21000-memory.dmp

Download

memory/1708-566-0x00007FF7D76D0000-0x00007FF7D7A21000-memory.dmp

Download

memory/1908-117-0x00007FF630A30000-0x00007FF630D81000-memory.dmp

Download

memory/1908-2324-0x00007FF630A30000-0x00007FF630D81000-memory.dmp

Download

memory/1908-2260-0x00007FF630A30000-0x00007FF630D81000-memory.dmp

Download

memory/1996-346-0x00007FF7544C0000-0x00007FF754811000-memory.dmp

Download

memory/1996-2366-0x00007FF7544C0000-0x00007FF754811000-memory.dmp

Download

memory/2144-2359-0x00007FF680B20000-0x00007FF680E71000-memory.dmp

Download

memory/2144-572-0x00007FF680B20000-0x00007FF680E71000-memory.dmp

Download

memory/2252-22-0x00007FF6146D0000-0x00007FF614A21000-memory.dmp

Download

memory/2252-2301-0x00007FF6146D0000-0x00007FF614A21000-memory.dmp

Download

memory/2252-2256-0x00007FF6146D0000-0x00007FF614A21000-memory.dmp

Download

memory/2436-2261-0x00007FF69ADE0000-0x00007FF69B131000-memory.dmp

Download

memory/2436-2326-0x00007FF69ADE0000-0x00007FF69B131000-memory.dmp

Download

memory/2436-168-0x00007FF69ADE0000-0x00007FF69B131000-memory.dmp

Download

memory/2740-316-0x00007FF625040000-0x00007FF625391000-memory.dmp

Download

memory/2740-2349-0x00007FF625040000-0x00007FF625391000-memory.dmp

Download

memory/2816-2322-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp

Download

memory/2816-237-0x00007FF7739E0000-0x00007FF773D31000-memory.dmp

Download

memory/3008-2328-0x00007FF7A8360000-0x00007FF7A86B1000-memory.dmp

Download

memory/3008-493-0x00007FF7A8360000-0x00007FF7A86B1000-memory.dmp

Download

memory/3284-2156-0x00007FF7311F0000-0x00007FF731541000-memory.dmp

Download

memory/3284-1-0x000001F04DC50000-0x000001F04DC60000-memory.dmp

Download

memory/3284-0-0x00007FF7311F0000-0x00007FF731541000-memory.dmp

Download

memory/3372-2346-0x00007FF7296B0000-0x00007FF729A01000-memory.dmp

Download

memory/3372-404-0x00007FF7296B0000-0x00007FF729A01000-memory.dmp

Download

memory/3376-405-0x00007FF6BB620000-0x00007FF6BB971000-memory.dmp

Download

memory/3376-2344-0x00007FF6BB620000-0x00007FF6BB971000-memory.dmp

Download

memory/3400-2337-0x00007FF774450000-0x00007FF7747A1000-memory.dmp

Download

memory/3400-282-0x00007FF774450000-0x00007FF7747A1000-memory.dmp

Download

memory/3848-2339-0x00007FF61A5C0000-0x00007FF61A911000-memory.dmp

Download

memory/3848-236-0x00007FF61A5C0000-0x00007FF61A911000-memory.dmp

Download

memory/4120-2320-0x00007FF667CC0000-0x00007FF668011000-memory.dmp

Download

memory/4120-569-0x00007FF667CC0000-0x00007FF668011000-memory.dmp

Download

memory/4124-2353-0x00007FF69FF60000-0x00007FF6A02B1000-memory.dmp

Download

memory/4124-348-0x00007FF69FF60000-0x00007FF6A02B1000-memory.dmp

Download

memory/4144-30-0x00007FF6DF5C0000-0x00007FF6DF911000-memory.dmp

Download

memory/4144-2257-0x00007FF6DF5C0000-0x00007FF6DF911000-memory.dmp

Download

memory/4144-2313-0x00007FF6DF5C0000-0x00007FF6DF911000-memory.dmp

Download

memory/4228-567-0x00007FF6EA5C0000-0x00007FF6EA911000-memory.dmp

Download

memory/4228-2306-0x00007FF6EA5C0000-0x00007FF6EA911000-memory.dmp

Download

memory/4316-2316-0x00007FF6FE8D0000-0x00007FF6FEC21000-memory.dmp

Download

memory/4316-2258-0x00007FF6FE8D0000-0x00007FF6FEC21000-memory.dmp

Download

memory/4316-51-0x00007FF6FE8D0000-0x00007FF6FEC21000-memory.dmp

Download

memory/4836-2362-0x00007FF7D28E0000-0x00007FF7D2C31000-memory.dmp

Download

memory/4836-496-0x00007FF7D28E0000-0x00007FF7D2C31000-memory.dmp

Download

memory/4840-2255-0x00007FF7CF4E0000-0x00007FF7CF831000-memory.dmp

Download

memory/4840-2295-0x00007FF7CF4E0000-0x00007FF7CF831000-memory.dmp

Download

memory/4840-10-0x00007FF7CF4E0000-0x00007FF7CF831000-memory.dmp

Download

memory/4996-2332-0x00007FF667690000-0x00007FF6679E1000-memory.dmp

Download

memory/4996-225-0x00007FF667690000-0x00007FF6679E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads