xmrig | 6b4f1886c97a717be861098c26db28537cfe18d09c2778728d974f4d6270b3a9

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
Size 2.5MB
Sample240519-b5rcqacb26
SHA256 6b4f1886c97a717be861098c26db28537cfe18d09c2778728d974f4d6270b3a9
MD5 48eba4c0089c1d2cff3a509b10062770
SHA1 dde5fc0d751f25a0540560785e38c43117e98c04
SHA512 7c0f294ae439535972bccc47b604d88e4333c8c34b8d9bb49b505d9853fc9c3e98979123938ed089545f3ecf98cae3343f91489d5e712cf246ebd81665d35313
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJZ:BemTLkNdfE0pZr3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4868-0-0x00007FF6C1710000-0x00007FF6C1A64000-memory.dmp	xmrig
behavioral2/files/0x000a00000002328e-7.dat	xmrig
behavioral2/files/0x000700000002341d-6.dat	xmrig
behavioral2/files/0x000700000002341e-21.dat	xmrig
behavioral2/memory/944-23-0x00007FF6B87D0000-0x00007FF6B8B24000-memory.dmp	xmrig
behavioral2/memory/2848-24-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp	xmrig
behavioral2/memory/3976-22-0x00007FF75B1D0000-0x00007FF75B524000-memory.dmp	xmrig
behavioral2/memory/4600-18-0x00007FF79CA80000-0x00007FF79CDD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-11.dat	xmrig
behavioral2/files/0x000700000002341f-28.dat	xmrig
behavioral2/files/0x0009000000023415-40.dat	xmrig
behavioral2/memory/884-42-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-38.dat	xmrig
behavioral2/memory/1824-43-0x00007FF6750B0000-0x00007FF675404000-memory.dmp	xmrig
behavioral2/memory/2092-47-0x00007FF6C9390000-0x00007FF6C96E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-50.dat	xmrig
behavioral2/files/0x0007000000023422-54.dat	xmrig
behavioral2/memory/1952-52-0x00007FF6F9C10000-0x00007FF6F9F64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-59.dat	xmrig
behavioral2/memory/3908-67-0x00007FF6837F0000-0x00007FF683B44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-72.dat	xmrig
behavioral2/memory/5068-80-0x00007FF665CE0000-0x00007FF666034000-memory.dmp	xmrig
behavioral2/memory/2068-89-0x00007FF67D7A0000-0x00007FF67DAF4000-memory.dmp	xmrig
behavioral2/memory/1352-93-0x00007FF6C4330000-0x00007FF6C4684000-memory.dmp	xmrig
behavioral2/memory/2328-95-0x00007FF70CD90000-0x00007FF70D0E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-103.dat	xmrig
behavioral2/files/0x0007000000023428-101.dat	xmrig
behavioral2/files/0x000700000002342a-99.dat	xmrig
behavioral2/files/0x0007000000023429-97.dat	xmrig
behavioral2/memory/4964-96-0x00007FF7E4AE0000-0x00007FF7E4E34000-memory.dmp	xmrig
behavioral2/memory/3684-94-0x00007FF72B3F0000-0x00007FF72B744000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-83.dat	xmrig
behavioral2/memory/3868-79-0x00007FF69C300000-0x00007FF69C654000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-77.dat	xmrig
behavioral2/memory/4868-73-0x00007FF6C1710000-0x00007FF6C1A64000-memory.dmp	xmrig
behavioral2/memory/4976-61-0x00007FF7B3ED0000-0x00007FF7B4224000-memory.dmp	xmrig
behavioral2/files/0x000800000002342d-111.dat	xmrig
behavioral2/memory/2848-132-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp	xmrig
behavioral2/memory/540-139-0x00007FF67DD00000-0x00007FF67E054000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-149.dat	xmrig
behavioral2/files/0x0007000000023432-147.dat	xmrig
behavioral2/files/0x0007000000023433-145.dat	xmrig
behavioral2/files/0x0007000000023431-142.dat	xmrig
behavioral2/files/0x0007000000023435-160.dat	xmrig
behavioral2/files/0x0009000000023388-164.dat	xmrig
behavioral2/memory/1928-179-0x00007FF6A1E40000-0x00007FF6A2194000-memory.dmp	xmrig
behavioral2/files/0x000800000002339e-187.dat	xmrig
behavioral2/memory/1664-193-0x00007FF780E40000-0x00007FF781194000-memory.dmp	xmrig
behavioral2/memory/2824-192-0x00007FF79B050000-0x00007FF79B3A4000-memory.dmp	xmrig
behavioral2/memory/1196-191-0x00007FF7E1EB0000-0x00007FF7E2204000-memory.dmp	xmrig
behavioral2/files/0x00080000000233a0-189.dat	xmrig
behavioral2/files/0x000900000002339d-185.dat	xmrig
behavioral2/memory/4536-184-0x00007FF6C4F60000-0x00007FF6C52B4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023391-182.dat	xmrig
behavioral2/memory/440-181-0x00007FF7EDFE0000-0x00007FF7EE334000-memory.dmp	xmrig
behavioral2/memory/3548-180-0x00007FF7FCDE0000-0x00007FF7FD134000-memory.dmp	xmrig
behavioral2/memory/4440-178-0x00007FF675610000-0x00007FF675964000-memory.dmp	xmrig
behavioral2/files/0x000900000002338e-173.dat	xmrig
behavioral2/files/0x000800000002342f-130.dat	xmrig
behavioral2/files/0x0007000000023430-127.dat	xmrig
behavioral2/memory/2368-126-0x00007FF7F68A0000-0x00007FF7F6BF4000-memory.dmp	xmrig
behavioral2/memory/3916-123-0x00007FF6D6D50000-0x00007FF6D70A4000-memory.dmp	xmrig
behavioral2/memory/3424-118-0x00007FF69ADF0000-0x00007FF69B144000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-112.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4600	CKxiRlh.exe
3976	sMOnxYP.exe
944	QhjWTuo.exe
2848	hTBioaH.exe
884	WzoUZtc.exe
2092	QpWkMWX.exe
1824	QVwXeWz.exe
1952	vVnGsfK.exe
4976	yPiwYGX.exe
3908	cyjxBti.exe
3868	TDxfnfh.exe
2068	AndWitq.exe
5068	QBLUOYI.exe
2328	qzITbNn.exe
1352	ziMXwiW.exe
4964	KmQScyA.exe
3684	MSElJiO.exe
3424	gjajDbG.exe
3916	PYgdoZb.exe
540	bxkzeDc.exe
2368	cCHxRnX.exe
1196	noAcoIp.exe
2824	vpxVQPu.exe
4440	vUTzIHj.exe
1664	ryMczek.exe
1928	WgPsnMm.exe
3548	meoOHIW.exe
440	PSsRkOs.exe
4536	BgCgghI.exe
2056	WStNoCN.exe
644	ZJnyhvj.exe
3008	rYtxbIL.exe
4768	cgWMNwt.exe
1368	TqNiYSM.exe
4992	gPGmIom.exe
4660	FMhYHEp.exe
1236	pmGFhWQ.exe
1616	aREiLQc.exe
4940	DreTEhY.exe
3492	fZQKaxj.exe
1520	iSMWudl.exe
3984	JFoVoto.exe
2488	yrMWEvy.exe
2712	OdEIjVQ.exe
2940	GURZzzg.exe
3084	MMZClrM.exe
2800	mPKuLvE.exe
1652	RoaXjAm.exe
2760	UyHeuWx.exe
2212	kvsHoSE.exe
3076	CAYWgII.exe
3456	SUOOkUy.exe
4280	KeVbRMO.exe
5052	TPjatLl.exe
3828	rBMJXYN.exe
4064	peLQsef.exe
4336	OnkIZrH.exe
1744	aVhQrFW.exe
3928	vRvhnMN.exe
4860	AQEMwhe.exe
4808	NsAVbcx.exe
3152	oGOrfeA.exe
4784	ugywCNc.exe
3516	GfESOOV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4868-0-0x00007FF6C1710000-0x00007FF6C1A64000-memory.dmp	upx
behavioral2/files/0x000a00000002328e-7.dat	upx
behavioral2/files/0x000700000002341d-6.dat	upx
behavioral2/files/0x000700000002341e-21.dat	upx
behavioral2/memory/944-23-0x00007FF6B87D0000-0x00007FF6B8B24000-memory.dmp	upx
behavioral2/memory/2848-24-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp	upx
behavioral2/memory/3976-22-0x00007FF75B1D0000-0x00007FF75B524000-memory.dmp	upx
behavioral2/memory/4600-18-0x00007FF79CA80000-0x00007FF79CDD4000-memory.dmp	upx
behavioral2/files/0x000700000002341c-11.dat	upx
behavioral2/files/0x000700000002341f-28.dat	upx
behavioral2/files/0x0009000000023415-40.dat	upx
behavioral2/memory/884-42-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp	upx
behavioral2/files/0x0007000000023420-38.dat	upx
behavioral2/memory/1824-43-0x00007FF6750B0000-0x00007FF675404000-memory.dmp	upx
behavioral2/memory/2092-47-0x00007FF6C9390000-0x00007FF6C96E4000-memory.dmp	upx
behavioral2/files/0x0007000000023421-50.dat	upx
behavioral2/files/0x0007000000023422-54.dat	upx
behavioral2/memory/1952-52-0x00007FF6F9C10000-0x00007FF6F9F64000-memory.dmp	upx
behavioral2/files/0x0007000000023423-59.dat	upx
behavioral2/memory/3908-67-0x00007FF6837F0000-0x00007FF683B44000-memory.dmp	upx
behavioral2/files/0x0007000000023425-72.dat	upx
behavioral2/memory/5068-80-0x00007FF665CE0000-0x00007FF666034000-memory.dmp	upx
behavioral2/memory/2068-89-0x00007FF67D7A0000-0x00007FF67DAF4000-memory.dmp	upx
behavioral2/memory/1352-93-0x00007FF6C4330000-0x00007FF6C4684000-memory.dmp	upx
behavioral2/memory/2328-95-0x00007FF70CD90000-0x00007FF70D0E4000-memory.dmp	upx
behavioral2/files/0x000700000002342b-103.dat	upx
behavioral2/files/0x0007000000023428-101.dat	upx
behavioral2/files/0x000700000002342a-99.dat	upx
behavioral2/files/0x0007000000023429-97.dat	upx
behavioral2/memory/4964-96-0x00007FF7E4AE0000-0x00007FF7E4E34000-memory.dmp	upx
behavioral2/memory/3684-94-0x00007FF72B3F0000-0x00007FF72B744000-memory.dmp	upx
behavioral2/files/0x0007000000023427-83.dat	upx
behavioral2/memory/3868-79-0x00007FF69C300000-0x00007FF69C654000-memory.dmp	upx
behavioral2/files/0x0007000000023426-77.dat	upx
behavioral2/memory/4868-73-0x00007FF6C1710000-0x00007FF6C1A64000-memory.dmp	upx
behavioral2/memory/4976-61-0x00007FF7B3ED0000-0x00007FF7B4224000-memory.dmp	upx
behavioral2/files/0x000800000002342d-111.dat	upx
behavioral2/memory/2848-132-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp	upx
behavioral2/memory/540-139-0x00007FF67DD00000-0x00007FF67E054000-memory.dmp	upx
behavioral2/files/0x0007000000023434-149.dat	upx
behavioral2/files/0x0007000000023432-147.dat	upx
behavioral2/files/0x0007000000023433-145.dat	upx
behavioral2/files/0x0007000000023431-142.dat	upx
behavioral2/files/0x0007000000023435-160.dat	upx
behavioral2/files/0x0009000000023388-164.dat	upx
behavioral2/memory/1928-179-0x00007FF6A1E40000-0x00007FF6A2194000-memory.dmp	upx
behavioral2/files/0x000800000002339e-187.dat	upx
behavioral2/memory/1664-193-0x00007FF780E40000-0x00007FF781194000-memory.dmp	upx
behavioral2/memory/2824-192-0x00007FF79B050000-0x00007FF79B3A4000-memory.dmp	upx
behavioral2/memory/1196-191-0x00007FF7E1EB0000-0x00007FF7E2204000-memory.dmp	upx
behavioral2/files/0x00080000000233a0-189.dat	upx
behavioral2/files/0x000900000002339d-185.dat	upx
behavioral2/memory/4536-184-0x00007FF6C4F60000-0x00007FF6C52B4000-memory.dmp	upx
behavioral2/files/0x0009000000023391-182.dat	upx
behavioral2/memory/440-181-0x00007FF7EDFE0000-0x00007FF7EE334000-memory.dmp	upx
behavioral2/memory/3548-180-0x00007FF7FCDE0000-0x00007FF7FD134000-memory.dmp	upx
behavioral2/memory/4440-178-0x00007FF675610000-0x00007FF675964000-memory.dmp	upx
behavioral2/files/0x000900000002338e-173.dat	upx
behavioral2/files/0x000800000002342f-130.dat	upx
behavioral2/files/0x0007000000023430-127.dat	upx
behavioral2/memory/2368-126-0x00007FF7F68A0000-0x00007FF7F6BF4000-memory.dmp	upx
behavioral2/memory/3916-123-0x00007FF6D6D50000-0x00007FF6D70A4000-memory.dmp	upx
behavioral2/memory/3424-118-0x00007FF69ADF0000-0x00007FF69B144000-memory.dmp	upx
behavioral2/files/0x000700000002342c-112.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zYwmbBN.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\FWefbXW.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\iAbqnfs.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\AlPnAoj.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\IbYevwU.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\XRVpRpa.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\iYrUQGE.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\hgzQZTH.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\fHJUori.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\FEtVUkj.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\URQhHGw.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\QpWkMWX.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\TPjatLl.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\PpitVtS.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\WFZoNTs.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\GNKYvcu.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\sWutAwr.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\MdWHyaw.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\tDEiDBU.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\iNSJuGF.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\BYMCuFY.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\AARrECC.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\wLGaazv.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\qBjXUpY.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\xrUZnbq.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\yMgNTgC.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\UcjCZcx.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\UBMsrax.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\UVvtlCE.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\TdXRFmG.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\usyZrif.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\AshyLCs.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\aJsObQI.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\ovoDFcb.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\pkDEbsh.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\YYFLfiK.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\lDNDyXA.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\Trmgcpc.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\NtNUHUL.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\ZIUiRgI.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\RrmQtBO.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\FjCnICz.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\OnkIZrH.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\rCDrsQB.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\xTUUaDp.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\lGEzJdQ.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\XuxLOMN.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\JFPwyUv.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\inzbIOz.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\GIVFHPv.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\VpYNOKq.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\hkDTDky.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\qWQxPxx.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\lzSbsyp.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\PfghPWw.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\SylgPKO.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\SzbdHFc.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\SfuWKAx.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\rCmrxbX.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\FsSVrYZ.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\XuKMdOR.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\HNMxzQo.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\HrKWmOI.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
File created	C:\Windows\System\RqkljJw.exe	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4600	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	84
PID 4868 wrote to memory of 4600	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	84
PID 4868 wrote to memory of 3976	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	85
PID 4868 wrote to memory of 3976	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	85
PID 4868 wrote to memory of 944	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	86
PID 4868 wrote to memory of 944	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	86
PID 4868 wrote to memory of 2848	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	87
PID 4868 wrote to memory of 2848	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	87
PID 4868 wrote to memory of 884	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	88
PID 4868 wrote to memory of 884	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	88
PID 4868 wrote to memory of 2092	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	89
PID 4868 wrote to memory of 2092	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	89
PID 4868 wrote to memory of 1824	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	90
PID 4868 wrote to memory of 1824	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	90
PID 4868 wrote to memory of 1952	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	91
PID 4868 wrote to memory of 1952	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	91
PID 4868 wrote to memory of 4976	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	92
PID 4868 wrote to memory of 4976	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	92
PID 4868 wrote to memory of 3908	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	93
PID 4868 wrote to memory of 3908	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	93
PID 4868 wrote to memory of 3868	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	94
PID 4868 wrote to memory of 3868	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	94
PID 4868 wrote to memory of 2068	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	95
PID 4868 wrote to memory of 2068	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	95
PID 4868 wrote to memory of 5068	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	96
PID 4868 wrote to memory of 5068	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	96
PID 4868 wrote to memory of 2328	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	97
PID 4868 wrote to memory of 2328	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	97
PID 4868 wrote to memory of 1352	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	98
PID 4868 wrote to memory of 1352	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	98
PID 4868 wrote to memory of 4964	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	99
PID 4868 wrote to memory of 4964	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	99
PID 4868 wrote to memory of 3684	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	101
PID 4868 wrote to memory of 3684	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	101
PID 4868 wrote to memory of 3424	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	104
PID 4868 wrote to memory of 3424	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	104
PID 4868 wrote to memory of 3916	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	105
PID 4868 wrote to memory of 3916	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	105
PID 4868 wrote to memory of 540	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	106
PID 4868 wrote to memory of 540	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	106
PID 4868 wrote to memory of 2368	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	108
PID 4868 wrote to memory of 2368	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	108
PID 4868 wrote to memory of 1196	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	109
PID 4868 wrote to memory of 1196	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	109
PID 4868 wrote to memory of 2824	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	110
PID 4868 wrote to memory of 2824	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	110
PID 4868 wrote to memory of 4440	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	111
PID 4868 wrote to memory of 4440	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	111
PID 4868 wrote to memory of 1664	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	112
PID 4868 wrote to memory of 1664	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	112
PID 4868 wrote to memory of 1928	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	113
PID 4868 wrote to memory of 1928	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	113
PID 4868 wrote to memory of 3548	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	114
PID 4868 wrote to memory of 3548	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	114
PID 4868 wrote to memory of 440	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	115
PID 4868 wrote to memory of 440	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	115
PID 4868 wrote to memory of 4536	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	116
PID 4868 wrote to memory of 4536	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	116
PID 4868 wrote to memory of 2056	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	117
PID 4868 wrote to memory of 2056	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	117
PID 4868 wrote to memory of 644	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	118
PID 4868 wrote to memory of 644	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	118
PID 4868 wrote to memory of 3008	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	119
PID 4868 wrote to memory of 3008	4868	48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe	119

C:\Users\Admin\AppData\Local\Temp\48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48eba4c0089c1d2cff3a509b10062770_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\System\CKxiRlh.exe
  C:\Windows\System\CKxiRlh.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\sMOnxYP.exe
  C:\Windows\System\sMOnxYP.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\QhjWTuo.exe
  C:\Windows\System\QhjWTuo.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\hTBioaH.exe
  C:\Windows\System\hTBioaH.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\WzoUZtc.exe
  C:\Windows\System\WzoUZtc.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\QpWkMWX.exe
  C:\Windows\System\QpWkMWX.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\QVwXeWz.exe
  C:\Windows\System\QVwXeWz.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\vVnGsfK.exe
  C:\Windows\System\vVnGsfK.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\yPiwYGX.exe
  C:\Windows\System\yPiwYGX.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\cyjxBti.exe
  C:\Windows\System\cyjxBti.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\TDxfnfh.exe
  C:\Windows\System\TDxfnfh.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\AndWitq.exe
  C:\Windows\System\AndWitq.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\QBLUOYI.exe
  C:\Windows\System\QBLUOYI.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\qzITbNn.exe
  C:\Windows\System\qzITbNn.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ziMXwiW.exe
  C:\Windows\System\ziMXwiW.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\KmQScyA.exe
  C:\Windows\System\KmQScyA.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\MSElJiO.exe
  C:\Windows\System\MSElJiO.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\gjajDbG.exe
  C:\Windows\System\gjajDbG.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\PYgdoZb.exe
  C:\Windows\System\PYgdoZb.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\bxkzeDc.exe
  C:\Windows\System\bxkzeDc.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\cCHxRnX.exe
  C:\Windows\System\cCHxRnX.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\noAcoIp.exe
  C:\Windows\System\noAcoIp.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\vpxVQPu.exe
  C:\Windows\System\vpxVQPu.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\vUTzIHj.exe
  C:\Windows\System\vUTzIHj.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\ryMczek.exe
  C:\Windows\System\ryMczek.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\WgPsnMm.exe
  C:\Windows\System\WgPsnMm.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\meoOHIW.exe
  C:\Windows\System\meoOHIW.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\PSsRkOs.exe
  C:\Windows\System\PSsRkOs.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\BgCgghI.exe
  C:\Windows\System\BgCgghI.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\WStNoCN.exe
  C:\Windows\System\WStNoCN.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ZJnyhvj.exe
  C:\Windows\System\ZJnyhvj.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\rYtxbIL.exe
  C:\Windows\System\rYtxbIL.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\cgWMNwt.exe
  C:\Windows\System\cgWMNwt.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\TqNiYSM.exe
  C:\Windows\System\TqNiYSM.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\gPGmIom.exe
  C:\Windows\System\gPGmIom.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\FMhYHEp.exe
  C:\Windows\System\FMhYHEp.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\pmGFhWQ.exe
  C:\Windows\System\pmGFhWQ.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\aREiLQc.exe
  C:\Windows\System\aREiLQc.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\DreTEhY.exe
  C:\Windows\System\DreTEhY.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\fZQKaxj.exe
  C:\Windows\System\fZQKaxj.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\iSMWudl.exe
  C:\Windows\System\iSMWudl.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\JFoVoto.exe
  C:\Windows\System\JFoVoto.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\yrMWEvy.exe
  C:\Windows\System\yrMWEvy.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\OdEIjVQ.exe
  C:\Windows\System\OdEIjVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\GURZzzg.exe
  C:\Windows\System\GURZzzg.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\MMZClrM.exe
  C:\Windows\System\MMZClrM.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\mPKuLvE.exe
  C:\Windows\System\mPKuLvE.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\RoaXjAm.exe
  C:\Windows\System\RoaXjAm.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\UyHeuWx.exe
  C:\Windows\System\UyHeuWx.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\kvsHoSE.exe
  C:\Windows\System\kvsHoSE.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\CAYWgII.exe
  C:\Windows\System\CAYWgII.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\SUOOkUy.exe
  C:\Windows\System\SUOOkUy.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\KeVbRMO.exe
  C:\Windows\System\KeVbRMO.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\TPjatLl.exe
  C:\Windows\System\TPjatLl.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\rBMJXYN.exe
  C:\Windows\System\rBMJXYN.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\peLQsef.exe
  C:\Windows\System\peLQsef.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\aVhQrFW.exe
  C:\Windows\System\aVhQrFW.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\OnkIZrH.exe
  C:\Windows\System\OnkIZrH.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\vRvhnMN.exe
  C:\Windows\System\vRvhnMN.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\AQEMwhe.exe
  C:\Windows\System\AQEMwhe.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\NsAVbcx.exe
  C:\Windows\System\NsAVbcx.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\oGOrfeA.exe
  C:\Windows\System\oGOrfeA.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\ugywCNc.exe
  C:\Windows\System\ugywCNc.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\GfESOOV.exe
  C:\Windows\System\GfESOOV.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\bHYiNil.exe
  C:\Windows\System\bHYiNil.exe
  2⤵
  PID:5004
- C:\Windows\System\qRYIwSa.exe
  C:\Windows\System\qRYIwSa.exe
  2⤵
  PID:688
- C:\Windows\System\CJaEiPw.exe
  C:\Windows\System\CJaEiPw.exe
  2⤵
  PID:3992
- C:\Windows\System\KRROEWQ.exe
  C:\Windows\System\KRROEWQ.exe
  2⤵
  PID:3556
- C:\Windows\System\okPstkk.exe
  C:\Windows\System\okPstkk.exe
  2⤵
  PID:3256
- C:\Windows\System\ZfCzDmt.exe
  C:\Windows\System\ZfCzDmt.exe
  2⤵
  PID:4108
- C:\Windows\System\KBwKTOx.exe
  C:\Windows\System\KBwKTOx.exe
  2⤵
  PID:1976
- C:\Windows\System\STTDcAw.exe
  C:\Windows\System\STTDcAw.exe
  2⤵
  PID:4952
- C:\Windows\System\MjQpatp.exe
  C:\Windows\System\MjQpatp.exe
  2⤵
  PID:4548
- C:\Windows\System\oFDhydg.exe
  C:\Windows\System\oFDhydg.exe
  2⤵
  PID:3692
- C:\Windows\System\UNCrWlC.exe
  C:\Windows\System\UNCrWlC.exe
  2⤵
  PID:4676
- C:\Windows\System\fHCcZnd.exe
  C:\Windows\System\fHCcZnd.exe
  2⤵
  PID:2500
- C:\Windows\System\xzovJvh.exe
  C:\Windows\System\xzovJvh.exe
  2⤵
  PID:1512
- C:\Windows\System\vXqEmKe.exe
  C:\Windows\System\vXqEmKe.exe
  2⤵
  PID:4192
- C:\Windows\System\srGiNKk.exe
  C:\Windows\System\srGiNKk.exe
  2⤵
  PID:5136
- C:\Windows\System\LjpQpFW.exe
  C:\Windows\System\LjpQpFW.exe
  2⤵
  PID:5156
- C:\Windows\System\HNMxzQo.exe
  C:\Windows\System\HNMxzQo.exe
  2⤵
  PID:5188
- C:\Windows\System\wBajVlW.exe
  C:\Windows\System\wBajVlW.exe
  2⤵
  PID:5204
- C:\Windows\System\FvGrTvA.exe
  C:\Windows\System\FvGrTvA.exe
  2⤵
  PID:5240
- C:\Windows\System\HrKWmOI.exe
  C:\Windows\System\HrKWmOI.exe
  2⤵
  PID:5272
- C:\Windows\System\rTawrJA.exe
  C:\Windows\System\rTawrJA.exe
  2⤵
  PID:5304
- C:\Windows\System\xEJtlAN.exe
  C:\Windows\System\xEJtlAN.exe
  2⤵
  PID:5320
- C:\Windows\System\EJzOtdz.exe
  C:\Windows\System\EJzOtdz.exe
  2⤵
  PID:5348
- C:\Windows\System\pfgDeEM.exe
  C:\Windows\System\pfgDeEM.exe
  2⤵
  PID:5368
- C:\Windows\System\VVZDsKc.exe
  C:\Windows\System\VVZDsKc.exe
  2⤵
  PID:5400
- C:\Windows\System\mxhNocY.exe
  C:\Windows\System\mxhNocY.exe
  2⤵
  PID:5444
- C:\Windows\System\OSUbiSb.exe
  C:\Windows\System\OSUbiSb.exe
  2⤵
  PID:5472
- C:\Windows\System\WVGUHqS.exe
  C:\Windows\System\WVGUHqS.exe
  2⤵
  PID:5512
- C:\Windows\System\UDFlGrG.exe
  C:\Windows\System\UDFlGrG.exe
  2⤵
  PID:5556
- C:\Windows\System\qlSfDJO.exe
  C:\Windows\System\qlSfDJO.exe
  2⤵
  PID:5592
- C:\Windows\System\sRuxlUm.exe
  C:\Windows\System\sRuxlUm.exe
  2⤵
  PID:5608
- C:\Windows\System\FOXlmme.exe
  C:\Windows\System\FOXlmme.exe
  2⤵
  PID:5632
- C:\Windows\System\Pcazjge.exe
  C:\Windows\System\Pcazjge.exe
  2⤵
  PID:5680
- C:\Windows\System\srMnTlc.exe
  C:\Windows\System\srMnTlc.exe
  2⤵
  PID:5704
- C:\Windows\System\oCCTaFU.exe
  C:\Windows\System\oCCTaFU.exe
  2⤵
  PID:5724
- C:\Windows\System\IkpoRQz.exe
  C:\Windows\System\IkpoRQz.exe
  2⤵
  PID:5760
- C:\Windows\System\ARngTYw.exe
  C:\Windows\System\ARngTYw.exe
  2⤵
  PID:5788
- C:\Windows\System\JuMgAwP.exe
  C:\Windows\System\JuMgAwP.exe
  2⤵
  PID:5832
- C:\Windows\System\YYFLfiK.exe
  C:\Windows\System\YYFLfiK.exe
  2⤵
  PID:5856
- C:\Windows\System\lDNDyXA.exe
  C:\Windows\System\lDNDyXA.exe
  2⤵
  PID:5880
- C:\Windows\System\ZPVxcGm.exe
  C:\Windows\System\ZPVxcGm.exe
  2⤵
  PID:5904
- C:\Windows\System\qWDfjAL.exe
  C:\Windows\System\qWDfjAL.exe
  2⤵
  PID:5932
- C:\Windows\System\jeRYsQb.exe
  C:\Windows\System\jeRYsQb.exe
  2⤵
  PID:5968
- C:\Windows\System\hiTbTML.exe
  C:\Windows\System\hiTbTML.exe
  2⤵
  PID:6000
- C:\Windows\System\mezrOTC.exe
  C:\Windows\System\mezrOTC.exe
  2⤵
  PID:6028
- C:\Windows\System\JsZTBRG.exe
  C:\Windows\System\JsZTBRG.exe
  2⤵
  PID:6044
- C:\Windows\System\tjooLjv.exe
  C:\Windows\System\tjooLjv.exe
  2⤵
  PID:6072
- C:\Windows\System\DnGjeCw.exe
  C:\Windows\System\DnGjeCw.exe
  2⤵
  PID:6120
- C:\Windows\System\BYvRsLA.exe
  C:\Windows\System\BYvRsLA.exe
  2⤵
  PID:5132
- C:\Windows\System\AoGrpUn.exe
  C:\Windows\System\AoGrpUn.exe
  2⤵
  PID:3700
- C:\Windows\System\DzbgDrf.exe
  C:\Windows\System\DzbgDrf.exe
  2⤵
  PID:5248
- C:\Windows\System\YFNEXyg.exe
  C:\Windows\System\YFNEXyg.exe
  2⤵
  PID:5300
- C:\Windows\System\rxIgFBc.exe
  C:\Windows\System\rxIgFBc.exe
  2⤵
  PID:5420
- C:\Windows\System\fhhNRve.exe
  C:\Windows\System\fhhNRve.exe
  2⤵
  PID:5440
- C:\Windows\System\PSgjFje.exe
  C:\Windows\System\PSgjFje.exe
  2⤵
  PID:5492
- C:\Windows\System\aIFwKDq.exe
  C:\Windows\System\aIFwKDq.exe
  2⤵
  PID:5548
- C:\Windows\System\TxUsdzK.exe
  C:\Windows\System\TxUsdzK.exe
  2⤵
  PID:5624
- C:\Windows\System\KlyOUqc.exe
  C:\Windows\System\KlyOUqc.exe
  2⤵
  PID:5720
- C:\Windows\System\UGijXYy.exe
  C:\Windows\System\UGijXYy.exe
  2⤵
  PID:5828
- C:\Windows\System\SQtxfrE.exe
  C:\Windows\System\SQtxfrE.exe
  2⤵
  PID:5892
- C:\Windows\System\DPkGNHK.exe
  C:\Windows\System\DPkGNHK.exe
  2⤵
  PID:5944
- C:\Windows\System\AltufCp.exe
  C:\Windows\System\AltufCp.exe
  2⤵
  PID:6016
- C:\Windows\System\PLVypSh.exe
  C:\Windows\System\PLVypSh.exe
  2⤵
  PID:6060
- C:\Windows\System\AGVIPPk.exe
  C:\Windows\System\AGVIPPk.exe
  2⤵
  PID:6140
- C:\Windows\System\YafEXyo.exe
  C:\Windows\System\YafEXyo.exe
  2⤵
  PID:5216
- C:\Windows\System\epttLuR.exe
  C:\Windows\System\epttLuR.exe
  2⤵
  PID:5384
- C:\Windows\System\xkLdgtV.exe
  C:\Windows\System\xkLdgtV.exe
  2⤵
  PID:5572
- C:\Windows\System\yNZVJFD.exe
  C:\Windows\System\yNZVJFD.exe
  2⤵
  PID:5756
- C:\Windows\System\MBkVpds.exe
  C:\Windows\System\MBkVpds.exe
  2⤵
  PID:5916
- C:\Windows\System\NmvdPRm.exe
  C:\Windows\System\NmvdPRm.exe
  2⤵
  PID:5992
- C:\Windows\System\jbJvXBC.exe
  C:\Windows\System\jbJvXBC.exe
  2⤵
  PID:5360
- C:\Windows\System\bAtLHuA.exe
  C:\Windows\System\bAtLHuA.exe
  2⤵
  PID:5576
- C:\Windows\System\PELpdXJ.exe
  C:\Windows\System\PELpdXJ.exe
  2⤵
  PID:5952
- C:\Windows\System\qgNlLaL.exe
  C:\Windows\System\qgNlLaL.exe
  2⤵
  PID:5872
- C:\Windows\System\rCDrsQB.exe
  C:\Windows\System\rCDrsQB.exe
  2⤵
  PID:5504
- C:\Windows\System\fdXdisj.exe
  C:\Windows\System\fdXdisj.exe
  2⤵
  PID:6172
- C:\Windows\System\gUnFcwB.exe
  C:\Windows\System\gUnFcwB.exe
  2⤵
  PID:6200
- C:\Windows\System\kMtjHab.exe
  C:\Windows\System\kMtjHab.exe
  2⤵
  PID:6228
- C:\Windows\System\tuFvAel.exe
  C:\Windows\System\tuFvAel.exe
  2⤵
  PID:6304
- C:\Windows\System\pMEtOCJ.exe
  C:\Windows\System\pMEtOCJ.exe
  2⤵
  PID:6324
- C:\Windows\System\eKBXbIY.exe
  C:\Windows\System\eKBXbIY.exe
  2⤵
  PID:6352
- C:\Windows\System\muYTyfv.exe
  C:\Windows\System\muYTyfv.exe
  2⤵
  PID:6376
- C:\Windows\System\cZbxHXJ.exe
  C:\Windows\System\cZbxHXJ.exe
  2⤵
  PID:6408
- C:\Windows\System\XmGXYcL.exe
  C:\Windows\System\XmGXYcL.exe
  2⤵
  PID:6440
- C:\Windows\System\VjAbNgC.exe
  C:\Windows\System\VjAbNgC.exe
  2⤵
  PID:6468
- C:\Windows\System\AlPnAoj.exe
  C:\Windows\System\AlPnAoj.exe
  2⤵
  PID:6496
- C:\Windows\System\PqfJfqD.exe
  C:\Windows\System\PqfJfqD.exe
  2⤵
  PID:6532
- C:\Windows\System\kBMHMlR.exe
  C:\Windows\System\kBMHMlR.exe
  2⤵
  PID:6556
- C:\Windows\System\GRuszaj.exe
  C:\Windows\System\GRuszaj.exe
  2⤵
  PID:6588
- C:\Windows\System\PpitVtS.exe
  C:\Windows\System\PpitVtS.exe
  2⤵
  PID:6620
- C:\Windows\System\MkzPTdk.exe
  C:\Windows\System\MkzPTdk.exe
  2⤵
  PID:6640
- C:\Windows\System\QOFGLhH.exe
  C:\Windows\System\QOFGLhH.exe
  2⤵
  PID:6668
- C:\Windows\System\dsJrXbx.exe
  C:\Windows\System\dsJrXbx.exe
  2⤵
  PID:6684
- C:\Windows\System\ymrQbTC.exe
  C:\Windows\System\ymrQbTC.exe
  2⤵
  PID:6720
- C:\Windows\System\XuxLOMN.exe
  C:\Windows\System\XuxLOMN.exe
  2⤵
  PID:6748
- C:\Windows\System\MmnoZtu.exe
  C:\Windows\System\MmnoZtu.exe
  2⤵
  PID:6772
- C:\Windows\System\hZxMcru.exe
  C:\Windows\System\hZxMcru.exe
  2⤵
  PID:6812
- C:\Windows\System\ivSQdRG.exe
  C:\Windows\System\ivSQdRG.exe
  2⤵
  PID:6836
- C:\Windows\System\GtMZgff.exe
  C:\Windows\System\GtMZgff.exe
  2⤵
  PID:6868
- C:\Windows\System\GWdCOHk.exe
  C:\Windows\System\GWdCOHk.exe
  2⤵
  PID:6892
- C:\Windows\System\JzgDhnN.exe
  C:\Windows\System\JzgDhnN.exe
  2⤵
  PID:6920
- C:\Windows\System\znFhbaG.exe
  C:\Windows\System\znFhbaG.exe
  2⤵
  PID:6948
- C:\Windows\System\xrUZnbq.exe
  C:\Windows\System\xrUZnbq.exe
  2⤵
  PID:6980
- C:\Windows\System\YfkMElW.exe
  C:\Windows\System\YfkMElW.exe
  2⤵
  PID:7004
- C:\Windows\System\zoaGRBG.exe
  C:\Windows\System\zoaGRBG.exe
  2⤵
  PID:7032
- C:\Windows\System\kOdaKjG.exe
  C:\Windows\System\kOdaKjG.exe
  2⤵
  PID:7068
- C:\Windows\System\fpsuohC.exe
  C:\Windows\System\fpsuohC.exe
  2⤵
  PID:7116
- C:\Windows\System\gsOFBjw.exe
  C:\Windows\System\gsOFBjw.exe
  2⤵
  PID:7148
- C:\Windows\System\HugSIQS.exe
  C:\Windows\System\HugSIQS.exe
  2⤵
  PID:6192
- C:\Windows\System\VaCjDLT.exe
  C:\Windows\System\VaCjDLT.exe
  2⤵
  PID:2904
- C:\Windows\System\fgXghqF.exe
  C:\Windows\System\fgXghqF.exe
  2⤵
  PID:6332
- C:\Windows\System\GmkLByv.exe
  C:\Windows\System\GmkLByv.exe
  2⤵
  PID:6388
- C:\Windows\System\BnQWiXK.exe
  C:\Windows\System\BnQWiXK.exe
  2⤵
  PID:6428
- C:\Windows\System\oRpDPDq.exe
  C:\Windows\System\oRpDPDq.exe
  2⤵
  PID:6540
- C:\Windows\System\pwtPeDe.exe
  C:\Windows\System\pwtPeDe.exe
  2⤵
  PID:6608
- C:\Windows\System\SbRwwEw.exe
  C:\Windows\System\SbRwwEw.exe
  2⤵
  PID:6660
- C:\Windows\System\BXdZMKK.exe
  C:\Windows\System\BXdZMKK.exe
  2⤵
  PID:6696
- C:\Windows\System\ztvaGuW.exe
  C:\Windows\System\ztvaGuW.exe
  2⤵
  PID:6800
- C:\Windows\System\KkKLQVB.exe
  C:\Windows\System\KkKLQVB.exe
  2⤵
  PID:6856
- C:\Windows\System\oNvAIhy.exe
  C:\Windows\System\oNvAIhy.exe
  2⤵
  PID:6932
- C:\Windows\System\AmLqtwg.exe
  C:\Windows\System\AmLqtwg.exe
  2⤵
  PID:6988
- C:\Windows\System\oPWseRP.exe
  C:\Windows\System\oPWseRP.exe
  2⤵
  PID:5920
- C:\Windows\System\PfghPWw.exe
  C:\Windows\System\PfghPWw.exe
  2⤵
  PID:7128
- C:\Windows\System\MyzUEbM.exe
  C:\Windows\System\MyzUEbM.exe
  2⤵
  PID:6216
- C:\Windows\System\SMmEeYT.exe
  C:\Windows\System\SMmEeYT.exe
  2⤵
  PID:6368
- C:\Windows\System\TmEoQSw.exe
  C:\Windows\System\TmEoQSw.exe
  2⤵
  PID:6492
- C:\Windows\System\reVTdmJ.exe
  C:\Windows\System\reVTdmJ.exe
  2⤵
  PID:6652
- C:\Windows\System\xcIOPFQ.exe
  C:\Windows\System\xcIOPFQ.exe
  2⤵
  PID:6728
- C:\Windows\System\UhEfGpF.exe
  C:\Windows\System\UhEfGpF.exe
  2⤵
  PID:6912
- C:\Windows\System\wEAuJCw.exe
  C:\Windows\System\wEAuJCw.exe
  2⤵
  PID:7028
- C:\Windows\System\tWybigX.exe
  C:\Windows\System\tWybigX.exe
  2⤵
  PID:6312
- C:\Windows\System\mVCqAER.exe
  C:\Windows\System\mVCqAER.exe
  2⤵
  PID:6636
- C:\Windows\System\OQQClLx.exe
  C:\Windows\System\OQQClLx.exe
  2⤵
  PID:6884
- C:\Windows\System\dKwtNzS.exe
  C:\Windows\System\dKwtNzS.exe
  2⤵
  PID:6416
- C:\Windows\System\LGzGPXG.exe
  C:\Windows\System\LGzGPXG.exe
  2⤵
  PID:6168
- C:\Windows\System\hIaIWRf.exe
  C:\Windows\System\hIaIWRf.exe
  2⤵
  PID:7172
- C:\Windows\System\lzXvOAQ.exe
  C:\Windows\System\lzXvOAQ.exe
  2⤵
  PID:7200
- C:\Windows\System\ltSxEMb.exe
  C:\Windows\System\ltSxEMb.exe
  2⤵
  PID:7228
- C:\Windows\System\fepntHM.exe
  C:\Windows\System\fepntHM.exe
  2⤵
  PID:7252
- C:\Windows\System\WnpDgNw.exe
  C:\Windows\System\WnpDgNw.exe
  2⤵
  PID:7284
- C:\Windows\System\oEpgyaj.exe
  C:\Windows\System\oEpgyaj.exe
  2⤵
  PID:7312
- C:\Windows\System\kKpcGJX.exe
  C:\Windows\System\kKpcGJX.exe
  2⤵
  PID:7336
- C:\Windows\System\tyoChQc.exe
  C:\Windows\System\tyoChQc.exe
  2⤵
  PID:7368
- C:\Windows\System\FIuHzAg.exe
  C:\Windows\System\FIuHzAg.exe
  2⤵
  PID:7392
- C:\Windows\System\kwirZAH.exe
  C:\Windows\System\kwirZAH.exe
  2⤵
  PID:7416
- C:\Windows\System\GWhLjHd.exe
  C:\Windows\System\GWhLjHd.exe
  2⤵
  PID:7444
- C:\Windows\System\NmSgJLn.exe
  C:\Windows\System\NmSgJLn.exe
  2⤵
  PID:7468
- C:\Windows\System\DHuWnOg.exe
  C:\Windows\System\DHuWnOg.exe
  2⤵
  PID:7508
- C:\Windows\System\IbYevwU.exe
  C:\Windows\System\IbYevwU.exe
  2⤵
  PID:7532
- C:\Windows\System\VIlvobw.exe
  C:\Windows\System\VIlvobw.exe
  2⤵
  PID:7560
- C:\Windows\System\rAzZzGF.exe
  C:\Windows\System\rAzZzGF.exe
  2⤵
  PID:7588
- C:\Windows\System\JeaHuLb.exe
  C:\Windows\System\JeaHuLb.exe
  2⤵
  PID:7616
- C:\Windows\System\TvEbkVd.exe
  C:\Windows\System\TvEbkVd.exe
  2⤵
  PID:7648
- C:\Windows\System\GgCpxzA.exe
  C:\Windows\System\GgCpxzA.exe
  2⤵
  PID:7672
- C:\Windows\System\wKQLBxi.exe
  C:\Windows\System\wKQLBxi.exe
  2⤵
  PID:7700
- C:\Windows\System\eQdmVPv.exe
  C:\Windows\System\eQdmVPv.exe
  2⤵
  PID:7728
- C:\Windows\System\HldZxox.exe
  C:\Windows\System\HldZxox.exe
  2⤵
  PID:7760
- C:\Windows\System\JXxmBMl.exe
  C:\Windows\System\JXxmBMl.exe
  2⤵
  PID:7784
- C:\Windows\System\VoerhHO.exe
  C:\Windows\System\VoerhHO.exe
  2⤵
  PID:7812
- C:\Windows\System\SylgPKO.exe
  C:\Windows\System\SylgPKO.exe
  2⤵
  PID:7844
- C:\Windows\System\gzSDuql.exe
  C:\Windows\System\gzSDuql.exe
  2⤵
  PID:7868
- C:\Windows\System\OqvlDyE.exe
  C:\Windows\System\OqvlDyE.exe
  2⤵
  PID:7892
- C:\Windows\System\CrxCSvX.exe
  C:\Windows\System\CrxCSvX.exe
  2⤵
  PID:7912
- C:\Windows\System\TNbCbRn.exe
  C:\Windows\System\TNbCbRn.exe
  2⤵
  PID:7952
- C:\Windows\System\XIzCGMi.exe
  C:\Windows\System\XIzCGMi.exe
  2⤵
  PID:7980
- C:\Windows\System\AWfsIoO.exe
  C:\Windows\System\AWfsIoO.exe
  2⤵
  PID:7244
- C:\Windows\System\laNaEHO.exe
  C:\Windows\System\laNaEHO.exe
  2⤵
  PID:7276
- C:\Windows\System\SzbdHFc.exe
  C:\Windows\System\SzbdHFc.exe
  2⤵
  PID:7348
- C:\Windows\System\xjIEfQk.exe
  C:\Windows\System\xjIEfQk.exe
  2⤵
  PID:7412
- C:\Windows\System\NBhAkYK.exe
  C:\Windows\System\NBhAkYK.exe
  2⤵
  PID:7488
- C:\Windows\System\kKilLLN.exe
  C:\Windows\System\kKilLLN.exe
  2⤵
  PID:7544
- C:\Windows\System\Trmgcpc.exe
  C:\Windows\System\Trmgcpc.exe
  2⤵
  PID:7612
- C:\Windows\System\aqfRWKJ.exe
  C:\Windows\System\aqfRWKJ.exe
  2⤵
  PID:7668
- C:\Windows\System\yMgNTgC.exe
  C:\Windows\System\yMgNTgC.exe
  2⤵
  PID:4492
- C:\Windows\System\iXSGlwu.exe
  C:\Windows\System\iXSGlwu.exe
  2⤵
  PID:7768
- C:\Windows\System\fzyunGj.exe
  C:\Windows\System\fzyunGj.exe
  2⤵
  PID:7824
- C:\Windows\System\aveufrG.exe
  C:\Windows\System\aveufrG.exe
  2⤵
  PID:7900
- C:\Windows\System\zVwToor.exe
  C:\Windows\System\zVwToor.exe
  2⤵
  PID:7972
- C:\Windows\System\NxyZhfq.exe
  C:\Windows\System\NxyZhfq.exe
  2⤵
  PID:8024
- C:\Windows\System\LOFOqJD.exe
  C:\Windows\System\LOFOqJD.exe
  2⤵
  PID:8052
- C:\Windows\System\tcZmYNM.exe
  C:\Windows\System\tcZmYNM.exe
  2⤵
  PID:8080
- C:\Windows\System\CKNaRtF.exe
  C:\Windows\System\CKNaRtF.exe
  2⤵
  PID:8108
- C:\Windows\System\lmIhNDP.exe
  C:\Windows\System\lmIhNDP.exe
  2⤵
  PID:8136
- C:\Windows\System\LmbYRcG.exe
  C:\Windows\System\LmbYRcG.exe
  2⤵
  PID:8152
- C:\Windows\System\hczPGVB.exe
  C:\Windows\System\hczPGVB.exe
  2⤵
  PID:8184
- C:\Windows\System\AARrECC.exe
  C:\Windows\System\AARrECC.exe
  2⤵
  PID:7264
- C:\Windows\System\vSVIioW.exe
  C:\Windows\System\vSVIioW.exe
  2⤵
  PID:7388
- C:\Windows\System\GIVFHPv.exe
  C:\Windows\System\GIVFHPv.exe
  2⤵
  PID:7572
- C:\Windows\System\AkPOjFp.exe
  C:\Windows\System\AkPOjFp.exe
  2⤵
  PID:7712
- C:\Windows\System\PQQnHMG.exe
  C:\Windows\System\PQQnHMG.exe
  2⤵
  PID:6160
- C:\Windows\System\HzGCPQT.exe
  C:\Windows\System\HzGCPQT.exe
  2⤵
  PID:6132
- C:\Windows\System\jSqbLgB.exe
  C:\Windows\System\jSqbLgB.exe
  2⤵
  PID:7828
- C:\Windows\System\MGUtDrJ.exe
  C:\Windows\System\MGUtDrJ.exe
  2⤵
  PID:7928
- C:\Windows\System\rrirzEY.exe
  C:\Windows\System\rrirzEY.exe
  2⤵
  PID:8064
- C:\Windows\System\QzNQnUN.exe
  C:\Windows\System\QzNQnUN.exe
  2⤵
  PID:8120
- C:\Windows\System\JizpUuh.exe
  C:\Windows\System\JizpUuh.exe
  2⤵
  PID:8148
- C:\Windows\System\ZPeXcmr.exe
  C:\Windows\System\ZPeXcmr.exe
  2⤵
  PID:7428
- C:\Windows\System\wvWnEgY.exe
  C:\Windows\System\wvWnEgY.exe
  2⤵
  PID:7656
- C:\Windows\System\jiNYiZx.exe
  C:\Windows\System\jiNYiZx.exe
  2⤵
  PID:2344
- C:\Windows\System\tsKdwKM.exe
  C:\Windows\System\tsKdwKM.exe
  2⤵
  PID:1204
- C:\Windows\System\PWzfhMK.exe
  C:\Windows\System\PWzfhMK.exe
  2⤵
  PID:7208
- C:\Windows\System\KmWGQzP.exe
  C:\Windows\System\KmWGQzP.exe
  2⤵
  PID:6268
- C:\Windows\System\JFPwyUv.exe
  C:\Windows\System\JFPwyUv.exe
  2⤵
  PID:8008
- C:\Windows\System\oTvXwcA.exe
  C:\Windows\System\oTvXwcA.exe
  2⤵
  PID:8200
- C:\Windows\System\hjVnUEN.exe
  C:\Windows\System\hjVnUEN.exe
  2⤵
  PID:8228
- C:\Windows\System\tpRverO.exe
  C:\Windows\System\tpRverO.exe
  2⤵
  PID:8268
- C:\Windows\System\lHrYseS.exe
  C:\Windows\System\lHrYseS.exe
  2⤵
  PID:8296
- C:\Windows\System\DzHNvcU.exe
  C:\Windows\System\DzHNvcU.exe
  2⤵
  PID:8344
- C:\Windows\System\aSUqMfh.exe
  C:\Windows\System\aSUqMfh.exe
  2⤵
  PID:8360
- C:\Windows\System\MJxrUYD.exe
  C:\Windows\System\MJxrUYD.exe
  2⤵
  PID:8392
- C:\Windows\System\wWcXYgN.exe
  C:\Windows\System\wWcXYgN.exe
  2⤵
  PID:8428
- C:\Windows\System\iYrUQGE.exe
  C:\Windows\System\iYrUQGE.exe
  2⤵
  PID:8452
- C:\Windows\System\RBfhARr.exe
  C:\Windows\System\RBfhARr.exe
  2⤵
  PID:8480
- C:\Windows\System\nvgeaBo.exe
  C:\Windows\System\nvgeaBo.exe
  2⤵
  PID:8520
- C:\Windows\System\ebzsJJS.exe
  C:\Windows\System\ebzsJJS.exe
  2⤵
  PID:8536
- C:\Windows\System\LmPHXTm.exe
  C:\Windows\System\LmPHXTm.exe
  2⤵
  PID:8576
- C:\Windows\System\naiZyDx.exe
  C:\Windows\System\naiZyDx.exe
  2⤵
  PID:8592
- C:\Windows\System\aDImhbb.exe
  C:\Windows\System\aDImhbb.exe
  2⤵
  PID:8608
- C:\Windows\System\xTUUaDp.exe
  C:\Windows\System\xTUUaDp.exe
  2⤵
  PID:8652
- C:\Windows\System\MTucMIZ.exe
  C:\Windows\System\MTucMIZ.exe
  2⤵
  PID:8680
- C:\Windows\System\jxzrJmF.exe
  C:\Windows\System\jxzrJmF.exe
  2⤵
  PID:8716
- C:\Windows\System\oVbjxkS.exe
  C:\Windows\System\oVbjxkS.exe
  2⤵
  PID:8736
- C:\Windows\System\KTudiNi.exe
  C:\Windows\System\KTudiNi.exe
  2⤵
  PID:8788
- C:\Windows\System\hgzQZTH.exe
  C:\Windows\System\hgzQZTH.exe
  2⤵
  PID:8828
- C:\Windows\System\tWzIJQu.exe
  C:\Windows\System\tWzIJQu.exe
  2⤵
  PID:8852
- C:\Windows\System\wcurRpe.exe
  C:\Windows\System\wcurRpe.exe
  2⤵
  PID:8888
- C:\Windows\System\DEVUzgI.exe
  C:\Windows\System\DEVUzgI.exe
  2⤵
  PID:8904
- C:\Windows\System\UBMsrax.exe
  C:\Windows\System\UBMsrax.exe
  2⤵
  PID:8940
- C:\Windows\System\DElRzdE.exe
  C:\Windows\System\DElRzdE.exe
  2⤵
  PID:8984
- C:\Windows\System\ZixFGsa.exe
  C:\Windows\System\ZixFGsa.exe
  2⤵
  PID:9032
- C:\Windows\System\lHtgPVH.exe
  C:\Windows\System\lHtgPVH.exe
  2⤵
  PID:9048
- C:\Windows\System\dGTepir.exe
  C:\Windows\System\dGTepir.exe
  2⤵
  PID:9072
- C:\Windows\System\SbXpGyp.exe
  C:\Windows\System\SbXpGyp.exe
  2⤵
  PID:9108
- C:\Windows\System\mvEDqye.exe
  C:\Windows\System\mvEDqye.exe
  2⤵
  PID:9132
- C:\Windows\System\OzXjKDh.exe
  C:\Windows\System\OzXjKDh.exe
  2⤵
  PID:9148
- C:\Windows\System\VPHONSf.exe
  C:\Windows\System\VPHONSf.exe
  2⤵
  PID:9196
- C:\Windows\System\GNNvgRy.exe
  C:\Windows\System\GNNvgRy.exe
  2⤵
  PID:8012
- C:\Windows\System\OgvhkQY.exe
  C:\Windows\System\OgvhkQY.exe
  2⤵
  PID:8280
- C:\Windows\System\rSWLCVJ.exe
  C:\Windows\System\rSWLCVJ.exe
  2⤵
  PID:8352
- C:\Windows\System\FohGBcf.exe
  C:\Windows\System\FohGBcf.exe
  2⤵
  PID:8416
- C:\Windows\System\BdUvVJN.exe
  C:\Windows\System\BdUvVJN.exe
  2⤵
  PID:8496
- C:\Windows\System\HTZnkNf.exe
  C:\Windows\System\HTZnkNf.exe
  2⤵
  PID:4760
- C:\Windows\System\ipxofZr.exe
  C:\Windows\System\ipxofZr.exe
  2⤵
  PID:8552
- C:\Windows\System\kaCzatw.exe
  C:\Windows\System\kaCzatw.exe
  2⤵
  PID:1988
- C:\Windows\System\DorPDtT.exe
  C:\Windows\System\DorPDtT.exe
  2⤵
  PID:8696
- C:\Windows\System\SIVfSGG.exe
  C:\Windows\System\SIVfSGG.exe
  2⤵
  PID:8808
- C:\Windows\System\sSrhoYj.exe
  C:\Windows\System\sSrhoYj.exe
  2⤵
  PID:8884
- C:\Windows\System\NtNUHUL.exe
  C:\Windows\System\NtNUHUL.exe
  2⤵
  PID:8932
- C:\Windows\System\mHkxxAR.exe
  C:\Windows\System\mHkxxAR.exe
  2⤵
  PID:8336
- C:\Windows\System\FgTRKEh.exe
  C:\Windows\System\FgTRKEh.exe
  2⤵
  PID:8304
- C:\Windows\System\xMAeBwN.exe
  C:\Windows\System\xMAeBwN.exe
  2⤵
  PID:9104
- C:\Windows\System\rMgkDJw.exe
  C:\Windows\System\rMgkDJw.exe
  2⤵
  PID:7752
- C:\Windows\System\XgmMYQQ.exe
  C:\Windows\System\XgmMYQQ.exe
  2⤵
  PID:9212
- C:\Windows\System\hTdFoyr.exe
  C:\Windows\System\hTdFoyr.exe
  2⤵
  PID:8328
- C:\Windows\System\Dxvfmic.exe
  C:\Windows\System\Dxvfmic.exe
  2⤵
  PID:8516
- C:\Windows\System\LerRfIG.exe
  C:\Windows\System\LerRfIG.exe
  2⤵
  PID:8588
- C:\Windows\System\AzCpVEw.exe
  C:\Windows\System\AzCpVEw.exe
  2⤵
  PID:8760
- C:\Windows\System\DcLolXN.exe
  C:\Windows\System\DcLolXN.exe
  2⤵
  PID:8900
- C:\Windows\System\YEuqIFg.exe
  C:\Windows\System\YEuqIFg.exe
  2⤵
  PID:8796
- C:\Windows\System\AshyLCs.exe
  C:\Windows\System\AshyLCs.exe
  2⤵
  PID:9140
- C:\Windows\System\yBnAbWB.exe
  C:\Windows\System\yBnAbWB.exe
  2⤵
  PID:8188
- C:\Windows\System\zhAfNgw.exe
  C:\Windows\System\zhAfNgw.exe
  2⤵
  PID:8708
- C:\Windows\System\LzILKpS.exe
  C:\Windows\System\LzILKpS.exe
  2⤵
  PID:9056
- C:\Windows\System\LeEjavt.exe
  C:\Windows\System\LeEjavt.exe
  2⤵
  PID:8584
- C:\Windows\System\knsdCQW.exe
  C:\Windows\System\knsdCQW.exe
  2⤵
  PID:8532
- C:\Windows\System\JJMnovH.exe
  C:\Windows\System\JJMnovH.exe
  2⤵
  PID:9244
- C:\Windows\System\gbDUrXf.exe
  C:\Windows\System\gbDUrXf.exe
  2⤵
  PID:9272
- C:\Windows\System\nkmKqqO.exe
  C:\Windows\System\nkmKqqO.exe
  2⤵
  PID:9300
- C:\Windows\System\pmRiZkr.exe
  C:\Windows\System\pmRiZkr.exe
  2⤵
  PID:9328
- C:\Windows\System\UpaowFT.exe
  C:\Windows\System\UpaowFT.exe
  2⤵
  PID:9352
- C:\Windows\System\wZgnvaD.exe
  C:\Windows\System\wZgnvaD.exe
  2⤵
  PID:9384
- C:\Windows\System\mJWPbUY.exe
  C:\Windows\System\mJWPbUY.exe
  2⤵
  PID:9412
- C:\Windows\System\nODGxlh.exe
  C:\Windows\System\nODGxlh.exe
  2⤵
  PID:9440
- C:\Windows\System\HLfPBzG.exe
  C:\Windows\System\HLfPBzG.exe
  2⤵
  PID:9468
- C:\Windows\System\QJQCafM.exe
  C:\Windows\System\QJQCafM.exe
  2⤵
  PID:9496
- C:\Windows\System\hLQkDSX.exe
  C:\Windows\System\hLQkDSX.exe
  2⤵
  PID:9524
- C:\Windows\System\fHJUori.exe
  C:\Windows\System\fHJUori.exe
  2⤵
  PID:9552
- C:\Windows\System\ccLKRye.exe
  C:\Windows\System\ccLKRye.exe
  2⤵
  PID:9596
- C:\Windows\System\pgwFtHi.exe
  C:\Windows\System\pgwFtHi.exe
  2⤵
  PID:9624
- C:\Windows\System\HNTDIYN.exe
  C:\Windows\System\HNTDIYN.exe
  2⤵
  PID:9652
- C:\Windows\System\opJstoo.exe
  C:\Windows\System\opJstoo.exe
  2⤵
  PID:9680
- C:\Windows\System\AQViZHT.exe
  C:\Windows\System\AQViZHT.exe
  2⤵
  PID:9708
- C:\Windows\System\IbTQbhY.exe
  C:\Windows\System\IbTQbhY.exe
  2⤵
  PID:9736
- C:\Windows\System\FjfQZQZ.exe
  C:\Windows\System\FjfQZQZ.exe
  2⤵
  PID:9764
- C:\Windows\System\VpYNOKq.exe
  C:\Windows\System\VpYNOKq.exe
  2⤵
  PID:9792
- C:\Windows\System\fZCVzPq.exe
  C:\Windows\System\fZCVzPq.exe
  2⤵
  PID:9820
- C:\Windows\System\cTUVIvs.exe
  C:\Windows\System\cTUVIvs.exe
  2⤵
  PID:9848
- C:\Windows\System\xiSsbed.exe
  C:\Windows\System\xiSsbed.exe
  2⤵
  PID:9876
- C:\Windows\System\buJPGpW.exe
  C:\Windows\System\buJPGpW.exe
  2⤵
  PID:9904
- C:\Windows\System\EJQgukx.exe
  C:\Windows\System\EJQgukx.exe
  2⤵
  PID:9932
- C:\Windows\System\GQjeMFR.exe
  C:\Windows\System\GQjeMFR.exe
  2⤵
  PID:9960
- C:\Windows\System\RmDwUjR.exe
  C:\Windows\System\RmDwUjR.exe
  2⤵
  PID:9988
- C:\Windows\System\FEtVUkj.exe
  C:\Windows\System\FEtVUkj.exe
  2⤵
  PID:10016
- C:\Windows\System\KifAqcw.exe
  C:\Windows\System\KifAqcw.exe
  2⤵
  PID:10044
- C:\Windows\System\BwnpoMc.exe
  C:\Windows\System\BwnpoMc.exe
  2⤵
  PID:10076
- C:\Windows\System\hkDTDky.exe
  C:\Windows\System\hkDTDky.exe
  2⤵
  PID:10104
- C:\Windows\System\nsWMvbJ.exe
  C:\Windows\System\nsWMvbJ.exe
  2⤵
  PID:10132
- C:\Windows\System\WEiZoQb.exe
  C:\Windows\System\WEiZoQb.exe
  2⤵
  PID:10160
- C:\Windows\System\TSuChcS.exe
  C:\Windows\System\TSuChcS.exe
  2⤵
  PID:10188
- C:\Windows\System\URQhHGw.exe
  C:\Windows\System\URQhHGw.exe
  2⤵
  PID:10216
- C:\Windows\System\ZTlPNiX.exe
  C:\Windows\System\ZTlPNiX.exe
  2⤵
  PID:8980
- C:\Windows\System\BhuvPLk.exe
  C:\Windows\System\BhuvPLk.exe
  2⤵
  PID:9240
- C:\Windows\System\knbZlhL.exe
  C:\Windows\System\knbZlhL.exe
  2⤵
  PID:9292
- C:\Windows\System\JfwejXY.exe
  C:\Windows\System\JfwejXY.exe
  2⤵
  PID:9336
- C:\Windows\System\BfvTMDz.exe
  C:\Windows\System\BfvTMDz.exe
  2⤵
  PID:9380
- C:\Windows\System\dthLRkU.exe
  C:\Windows\System\dthLRkU.exe
  2⤵
  PID:9480
- C:\Windows\System\CQjPhUs.exe
  C:\Windows\System\CQjPhUs.exe
  2⤵
  PID:9564
- C:\Windows\System\hrUaXIg.exe
  C:\Windows\System\hrUaXIg.exe
  2⤵
  PID:9648
- C:\Windows\System\GvUQRCb.exe
  C:\Windows\System\GvUQRCb.exe
  2⤵
  PID:9720
- C:\Windows\System\MPprEPJ.exe
  C:\Windows\System\MPprEPJ.exe
  2⤵
  PID:9804
- C:\Windows\System\frPTAgm.exe
  C:\Windows\System\frPTAgm.exe
  2⤵
  PID:9844
- C:\Windows\System\DUGkDWx.exe
  C:\Windows\System\DUGkDWx.exe
  2⤵
  PID:9900
- C:\Windows\System\GsheCnn.exe
  C:\Windows\System\GsheCnn.exe
  2⤵
  PID:10000
- C:\Windows\System\wXXcorh.exe
  C:\Windows\System\wXXcorh.exe
  2⤵
  PID:10040
- C:\Windows\System\VauhHZV.exe
  C:\Windows\System\VauhHZV.exe
  2⤵
  PID:10100
- C:\Windows\System\gYbtdnE.exe
  C:\Windows\System\gYbtdnE.exe
  2⤵
  PID:10204
- C:\Windows\System\PjsqYcr.exe
  C:\Windows\System\PjsqYcr.exe
  2⤵
  PID:9264
- C:\Windows\System\kbKtuDO.exe
  C:\Windows\System\kbKtuDO.exe
  2⤵
  PID:9316
- C:\Windows\System\mYhWAHw.exe
  C:\Windows\System\mYhWAHw.exe
  2⤵
  PID:9508
- C:\Windows\System\MdeLrJA.exe
  C:\Windows\System\MdeLrJA.exe
  2⤵
  PID:9676
- C:\Windows\System\bigsdpN.exe
  C:\Windows\System\bigsdpN.exe
  2⤵
  PID:9788
- C:\Windows\System\aJOGiXP.exe
  C:\Windows\System\aJOGiXP.exe
  2⤵
  PID:10012
- C:\Windows\System\hUJslEn.exe
  C:\Windows\System\hUJslEn.exe
  2⤵
  PID:10180
- C:\Windows\System\rkEBDqy.exe
  C:\Windows\System\rkEBDqy.exe
  2⤵
  PID:10236
- C:\Windows\System\FCvWRTY.exe
  C:\Windows\System\FCvWRTY.exe
  2⤵
  PID:9620
- C:\Windows\System\yFjBoss.exe
  C:\Windows\System\yFjBoss.exe
  2⤵
  PID:10068
- C:\Windows\System\qWQxPxx.exe
  C:\Windows\System\qWQxPxx.exe
  2⤵
  PID:9408
- C:\Windows\System\WMssIKv.exe
  C:\Windows\System\WMssIKv.exe
  2⤵
  PID:10228
- C:\Windows\System\BkpNUmx.exe
  C:\Windows\System\BkpNUmx.exe
  2⤵
  PID:9956
- C:\Windows\System\JQdjTJB.exe
  C:\Windows\System\JQdjTJB.exe
  2⤵
  PID:10284
- C:\Windows\System\xApFYak.exe
  C:\Windows\System\xApFYak.exe
  2⤵
  PID:10316
- C:\Windows\System\EKBTlcD.exe
  C:\Windows\System\EKBTlcD.exe
  2⤵
  PID:10360
- C:\Windows\System\usyZrif.exe
  C:\Windows\System\usyZrif.exe
  2⤵
  PID:10376
- C:\Windows\System\UGvHwRT.exe
  C:\Windows\System\UGvHwRT.exe
  2⤵
  PID:10404
- C:\Windows\System\vUZFFui.exe
  C:\Windows\System\vUZFFui.exe
  2⤵
  PID:10432
- C:\Windows\System\qOgNWFN.exe
  C:\Windows\System\qOgNWFN.exe
  2⤵
  PID:10460
- C:\Windows\System\NHGtXyg.exe
  C:\Windows\System\NHGtXyg.exe
  2⤵
  PID:10488
- C:\Windows\System\jBUsVWy.exe
  C:\Windows\System\jBUsVWy.exe
  2⤵
  PID:10516
- C:\Windows\System\iMopvWE.exe
  C:\Windows\System\iMopvWE.exe
  2⤵
  PID:10544
- C:\Windows\System\YTWtzRA.exe
  C:\Windows\System\YTWtzRA.exe
  2⤵
  PID:10588
- C:\Windows\System\zrSDFve.exe
  C:\Windows\System\zrSDFve.exe
  2⤵
  PID:10616
- C:\Windows\System\ICcFOCH.exe
  C:\Windows\System\ICcFOCH.exe
  2⤵
  PID:10664
- C:\Windows\System\LhioSJo.exe
  C:\Windows\System\LhioSJo.exe
  2⤵
  PID:10692
- C:\Windows\System\lzSbsyp.exe
  C:\Windows\System\lzSbsyp.exe
  2⤵
  PID:10732
- C:\Windows\System\gSBuTtd.exe
  C:\Windows\System\gSBuTtd.exe
  2⤵
  PID:10760
- C:\Windows\System\wRBncFP.exe
  C:\Windows\System\wRBncFP.exe
  2⤵
  PID:10788
- C:\Windows\System\RqkljJw.exe
  C:\Windows\System\RqkljJw.exe
  2⤵
  PID:10808
- C:\Windows\System\qotCgzN.exe
  C:\Windows\System\qotCgzN.exe
  2⤵
  PID:10852
- C:\Windows\System\ZTcPeqr.exe
  C:\Windows\System\ZTcPeqr.exe
  2⤵
  PID:10884
- C:\Windows\System\hZRSild.exe
  C:\Windows\System\hZRSild.exe
  2⤵
  PID:10912
- C:\Windows\System\lNenArd.exe
  C:\Windows\System\lNenArd.exe
  2⤵
  PID:10940
- C:\Windows\System\XfxAQKb.exe
  C:\Windows\System\XfxAQKb.exe
  2⤵
  PID:10976
- C:\Windows\System\cXjQxBp.exe
  C:\Windows\System\cXjQxBp.exe
  2⤵
  PID:11004
- C:\Windows\System\hptuTht.exe
  C:\Windows\System\hptuTht.exe
  2⤵
  PID:11032
- C:\Windows\System\CXcsUgL.exe
  C:\Windows\System\CXcsUgL.exe
  2⤵
  PID:11060
- C:\Windows\System\mECSzWI.exe
  C:\Windows\System\mECSzWI.exe
  2⤵
  PID:11088
- C:\Windows\System\FSMkUki.exe
  C:\Windows\System\FSMkUki.exe
  2⤵
  PID:11120
- C:\Windows\System\LArCsXw.exe
  C:\Windows\System\LArCsXw.exe
  2⤵
  PID:11144
- C:\Windows\System\cfUzvVX.exe
  C:\Windows\System\cfUzvVX.exe
  2⤵
  PID:11172
- C:\Windows\System\HJtZFHC.exe
  C:\Windows\System\HJtZFHC.exe
  2⤵
  PID:11212
- C:\Windows\System\wLGaazv.exe
  C:\Windows\System\wLGaazv.exe
  2⤵
  PID:11228
- C:\Windows\System\PVOAdws.exe
  C:\Windows\System\PVOAdws.exe
  2⤵
  PID:11256
- C:\Windows\System\oVctLpj.exe
  C:\Windows\System\oVctLpj.exe
  2⤵
  PID:10280
- C:\Windows\System\lfOPHdB.exe
  C:\Windows\System\lfOPHdB.exe
  2⤵
  PID:10356
- C:\Windows\System\gwMeKPo.exe
  C:\Windows\System\gwMeKPo.exe
  2⤵
  PID:10400
- C:\Windows\System\cXxMElY.exe
  C:\Windows\System\cXxMElY.exe
  2⤵
  PID:10456
- C:\Windows\System\ZIUiRgI.exe
  C:\Windows\System\ZIUiRgI.exe
  2⤵
  PID:10528
- C:\Windows\System\ieJSkrF.exe
  C:\Windows\System\ieJSkrF.exe
  2⤵
  PID:10604
- C:\Windows\System\zLPJiAj.exe
  C:\Windows\System\zLPJiAj.exe
  2⤵
  PID:10684
- C:\Windows\System\hCvkpgu.exe
  C:\Windows\System\hCvkpgu.exe
  2⤵
  PID:10776
- C:\Windows\System\PCHKiFW.exe
  C:\Windows\System\PCHKiFW.exe
  2⤵
  PID:10836
- C:\Windows\System\OGyvijb.exe
  C:\Windows\System\OGyvijb.exe
  2⤵
  PID:10932
- C:\Windows\System\aJsObQI.exe
  C:\Windows\System\aJsObQI.exe
  2⤵
  PID:11016
- C:\Windows\System\Hwxtwfc.exe
  C:\Windows\System\Hwxtwfc.exe
  2⤵
  PID:11072
- C:\Windows\System\hxbXiWo.exe
  C:\Windows\System\hxbXiWo.exe
  2⤵
  PID:11108
- C:\Windows\System\sWutAwr.exe
  C:\Windows\System\sWutAwr.exe
  2⤵
  PID:11224
- C:\Windows\System\BNnlwxH.exe
  C:\Windows\System\BNnlwxH.exe
  2⤵
  PID:10276
- C:\Windows\System\MJGnFMm.exe
  C:\Windows\System\MJGnFMm.exe
  2⤵
  PID:10388
- C:\Windows\System\aunIaHB.exe
  C:\Windows\System\aunIaHB.exe
  2⤵
  PID:10640
- C:\Windows\System\FSTgVgH.exe
  C:\Windows\System\FSTgVgH.exe
  2⤵
  PID:10804
- C:\Windows\System\pZxEwBi.exe
  C:\Windows\System\pZxEwBi.exe
  2⤵
  PID:10956
- C:\Windows\System\CYoCeag.exe
  C:\Windows\System\CYoCeag.exe
  2⤵
  PID:11104
- C:\Windows\System\BAbvanS.exe
  C:\Windows\System\BAbvanS.exe
  2⤵
  PID:10372
- C:\Windows\System\DMANKjn.exe
  C:\Windows\System\DMANKjn.exe
  2⤵
  PID:10572
- C:\Windows\System\umDEPot.exe
  C:\Windows\System\umDEPot.exe
  2⤵
  PID:11024
- C:\Windows\System\VRgLPIN.exe
  C:\Windows\System\VRgLPIN.exe
  2⤵
  PID:856
- C:\Windows\System\FSjutzH.exe
  C:\Windows\System\FSjutzH.exe
  2⤵
  PID:11188
- C:\Windows\System\pBEeUFe.exe
  C:\Windows\System\pBEeUFe.exe
  2⤵
  PID:4208
- C:\Windows\System\lyBvHdI.exe
  C:\Windows\System\lyBvHdI.exe
  2⤵
  PID:11244
- C:\Windows\System\IpLugOd.exe
  C:\Windows\System\IpLugOd.exe
  2⤵
  PID:1148
- C:\Windows\System\BBcVDDI.exe
  C:\Windows\System\BBcVDDI.exe
  2⤵
  PID:3704
- C:\Windows\System\fIYRhRN.exe
  C:\Windows\System\fIYRhRN.exe
  2⤵
  PID:11288
- C:\Windows\System\tfXnbEy.exe
  C:\Windows\System\tfXnbEy.exe
  2⤵
  PID:11316
- C:\Windows\System\rWBoaju.exe
  C:\Windows\System\rWBoaju.exe
  2⤵
  PID:11344
- C:\Windows\System\oxCuUeF.exe
  C:\Windows\System\oxCuUeF.exe
  2⤵
  PID:11372
- C:\Windows\System\iBKySJq.exe
  C:\Windows\System\iBKySJq.exe
  2⤵
  PID:11400
- C:\Windows\System\MMTwrQT.exe
  C:\Windows\System\MMTwrQT.exe
  2⤵
  PID:11428
- C:\Windows\System\XRVpRpa.exe
  C:\Windows\System\XRVpRpa.exe
  2⤵
  PID:11456
- C:\Windows\System\CIWBcpg.exe
  C:\Windows\System\CIWBcpg.exe
  2⤵
  PID:11472
- C:\Windows\System\RXEXJIb.exe
  C:\Windows\System\RXEXJIb.exe
  2⤵
  PID:11500
- C:\Windows\System\ZemSHjB.exe
  C:\Windows\System\ZemSHjB.exe
  2⤵
  PID:11536
- C:\Windows\System\iGwYsOG.exe
  C:\Windows\System\iGwYsOG.exe
  2⤵
  PID:11568
- C:\Windows\System\WFZoNTs.exe
  C:\Windows\System\WFZoNTs.exe
  2⤵
  PID:11584
- C:\Windows\System\OEAtxyM.exe
  C:\Windows\System\OEAtxyM.exe
  2⤵
  PID:11604
- C:\Windows\System\ovoDFcb.exe
  C:\Windows\System\ovoDFcb.exe
  2⤵
  PID:11652
- C:\Windows\System\stZaJdb.exe
  C:\Windows\System\stZaJdb.exe
  2⤵
  PID:11680
- C:\Windows\System\ZQYiAJd.exe
  C:\Windows\System\ZQYiAJd.exe
  2⤵
  PID:11696
- C:\Windows\System\AtnQldW.exe
  C:\Windows\System\AtnQldW.exe
  2⤵
  PID:11732
- C:\Windows\System\LdZeyQR.exe
  C:\Windows\System\LdZeyQR.exe
  2⤵
  PID:11764
- C:\Windows\System\pkDEbsh.exe
  C:\Windows\System\pkDEbsh.exe
  2⤵
  PID:11788
- C:\Windows\System\zYwmbBN.exe
  C:\Windows\System\zYwmbBN.exe
  2⤵
  PID:11808
- C:\Windows\System\inzbIOz.exe
  C:\Windows\System\inzbIOz.exe
  2⤵
  PID:11848
- C:\Windows\System\CwGZyLJ.exe
  C:\Windows\System\CwGZyLJ.exe
  2⤵
  PID:11876
- C:\Windows\System\vTWdCzW.exe
  C:\Windows\System\vTWdCzW.exe
  2⤵
  PID:11904
- C:\Windows\System\NQpbeXE.exe
  C:\Windows\System\NQpbeXE.exe
  2⤵
  PID:11924
- C:\Windows\System\fvaoNTm.exe
  C:\Windows\System\fvaoNTm.exe
  2⤵
  PID:11948
- C:\Windows\System\pKeTGQe.exe
  C:\Windows\System\pKeTGQe.exe
  2⤵
  PID:11968
- C:\Windows\System\XFcTIeB.exe
  C:\Windows\System\XFcTIeB.exe
  2⤵
  PID:11988
- C:\Windows\System\IFvedgN.exe
  C:\Windows\System\IFvedgN.exe
  2⤵
  PID:12040
- C:\Windows\System\SXOGXZN.exe
  C:\Windows\System\SXOGXZN.exe
  2⤵
  PID:12072
- C:\Windows\System\CEaUMIG.exe
  C:\Windows\System\CEaUMIG.exe
  2⤵
  PID:12104
- C:\Windows\System\rAftfNT.exe
  C:\Windows\System\rAftfNT.exe
  2⤵
  PID:12132
- C:\Windows\System\fHjEvdw.exe
  C:\Windows\System\fHjEvdw.exe
  2⤵
  PID:12160
- C:\Windows\System\TNaqqsL.exe
  C:\Windows\System\TNaqqsL.exe
  2⤵
  PID:12188
- C:\Windows\System\JyaFbeL.exe
  C:\Windows\System\JyaFbeL.exe
  2⤵
  PID:12204
- C:\Windows\System\NEFLWlz.exe
  C:\Windows\System\NEFLWlz.exe
  2⤵
  PID:12232
- C:\Windows\System\MHwIlQg.exe
  C:\Windows\System\MHwIlQg.exe
  2⤵
  PID:12264
- C:\Windows\System\yvprBPP.exe
  C:\Windows\System\yvprBPP.exe
  2⤵
  PID:11304
- C:\Windows\System\OwWZDCC.exe
  C:\Windows\System\OwWZDCC.exe
  2⤵
  PID:11360
- C:\Windows\System\TiOeiix.exe
  C:\Windows\System\TiOeiix.exe
  2⤵
  PID:11424
- C:\Windows\System\evehbjT.exe
  C:\Windows\System\evehbjT.exe
  2⤵
  PID:11464
- C:\Windows\System\OUhrNYL.exe
  C:\Windows\System\OUhrNYL.exe
  2⤵
  PID:11560
- C:\Windows\System\OIPBMUC.exe
  C:\Windows\System\OIPBMUC.exe
  2⤵
  PID:11632
- C:\Windows\System\iPIxIxJ.exe
  C:\Windows\System\iPIxIxJ.exe
  2⤵
  PID:11692
- C:\Windows\System\xnCFjuh.exe
  C:\Windows\System\xnCFjuh.exe
  2⤵
  PID:11760
- C:\Windows\System\KhRpTEQ.exe
  C:\Windows\System\KhRpTEQ.exe
  2⤵
  PID:11844
- C:\Windows\System\lmWXlbx.exe
  C:\Windows\System\lmWXlbx.exe
  2⤵
  PID:11896
- C:\Windows\System\xhSxSFs.exe
  C:\Windows\System\xhSxSFs.exe
  2⤵
  PID:11956
- C:\Windows\System\jpXxVdk.exe
  C:\Windows\System\jpXxVdk.exe
  2⤵
  PID:12032
- C:\Windows\System\mLIZMAi.exe
  C:\Windows\System\mLIZMAi.exe
  2⤵
  PID:12080
- C:\Windows\System\pcGqEOb.exe
  C:\Windows\System\pcGqEOb.exe
  2⤵
  PID:12128
- C:\Windows\System\eeACOdH.exe
  C:\Windows\System\eeACOdH.exe
  2⤵
  PID:12196
- C:\Windows\System\FWefbXW.exe
  C:\Windows\System\FWefbXW.exe
  2⤵
  PID:12244
- C:\Windows\System\FtkaCAQ.exe
  C:\Windows\System\FtkaCAQ.exe
  2⤵
  PID:11384
- C:\Windows\System\ZeVmznj.exe
  C:\Windows\System\ZeVmznj.exe
  2⤵
  PID:11520
- C:\Windows\System\onaSLho.exe
  C:\Windows\System\onaSLho.exe
  2⤵
  PID:11688
- C:\Windows\System\fBOTnqn.exe
  C:\Windows\System\fBOTnqn.exe
  2⤵
  PID:11860
- C:\Windows\System\YmMAQza.exe
  C:\Windows\System\YmMAQza.exe
  2⤵
  PID:12016
- C:\Windows\System\EXmKCHo.exe
  C:\Windows\System\EXmKCHo.exe
  2⤵
  PID:12124
- C:\Windows\System\TkBdnTH.exe
  C:\Windows\System\TkBdnTH.exe
  2⤵
  PID:10248
- C:\Windows\System\ZIMkhMk.exe
  C:\Windows\System\ZIMkhMk.exe
  2⤵
  PID:11576
- C:\Windows\System\PLYCvQp.exe
  C:\Windows\System\PLYCvQp.exe
  2⤵
  PID:11912
- C:\Windows\System\zJylFZo.exe
  C:\Windows\System\zJylFZo.exe
  2⤵
  PID:12284
- C:\Windows\System\iDrkaUm.exe
  C:\Windows\System\iDrkaUm.exe
  2⤵
  PID:12152
- C:\Windows\System\UmRCjxU.exe
  C:\Windows\System\UmRCjxU.exe
  2⤵
  PID:11796
- C:\Windows\System\qECDeuo.exe
  C:\Windows\System\qECDeuo.exe
  2⤵
  PID:12324
- C:\Windows\System\OfSMQBu.exe
  C:\Windows\System\OfSMQBu.exe
  2⤵
  PID:12352
- C:\Windows\System\abLppLd.exe
  C:\Windows\System\abLppLd.exe
  2⤵
  PID:12380
- C:\Windows\System\EMKXfUv.exe
  C:\Windows\System\EMKXfUv.exe
  2⤵
  PID:12408
- C:\Windows\System\jZvvwQQ.exe
  C:\Windows\System\jZvvwQQ.exe
  2⤵
  PID:12436
- C:\Windows\System\hEuAsPL.exe
  C:\Windows\System\hEuAsPL.exe
  2⤵
  PID:12464
- C:\Windows\System\ZFYQwgL.exe
  C:\Windows\System\ZFYQwgL.exe
  2⤵
  PID:12504
- C:\Windows\System\lysGRng.exe
  C:\Windows\System\lysGRng.exe
  2⤵
  PID:12520
- C:\Windows\System\NmPJzoW.exe
  C:\Windows\System\NmPJzoW.exe
  2⤵
  PID:12548
- C:\Windows\System\ulOpRON.exe
  C:\Windows\System\ulOpRON.exe
  2⤵
  PID:12576
- C:\Windows\System\ltyRMwb.exe
  C:\Windows\System\ltyRMwb.exe
  2⤵
  PID:12604
- C:\Windows\System\bqOPppx.exe
  C:\Windows\System\bqOPppx.exe
  2⤵
  PID:12620
- C:\Windows\System\QaEblTT.exe
  C:\Windows\System\QaEblTT.exe
  2⤵
  PID:12660
- C:\Windows\System\oCGfMtE.exe
  C:\Windows\System\oCGfMtE.exe
  2⤵
  PID:12688
- C:\Windows\System\cZmBBAB.exe
  C:\Windows\System\cZmBBAB.exe
  2⤵
  PID:12716
- C:\Windows\System\KMgldNZ.exe
  C:\Windows\System\KMgldNZ.exe
  2⤵
  PID:12744
- C:\Windows\System\VNGkItf.exe
  C:\Windows\System\VNGkItf.exe
  2⤵
  PID:12768
- C:\Windows\System\CQekSzE.exe
  C:\Windows\System\CQekSzE.exe
  2⤵
  PID:12800
- C:\Windows\System\QjYVRMi.exe
  C:\Windows\System\QjYVRMi.exe
  2⤵
  PID:12828
- C:\Windows\System\eVCzLfS.exe
  C:\Windows\System\eVCzLfS.exe
  2⤵
  PID:12860
- C:\Windows\System\aimVKnM.exe
  C:\Windows\System\aimVKnM.exe
  2⤵
  PID:12888
- C:\Windows\System\sRaMVOU.exe
  C:\Windows\System\sRaMVOU.exe
  2⤵
  PID:12916
- C:\Windows\System\wuiCVre.exe
  C:\Windows\System\wuiCVre.exe
  2⤵
  PID:12944
- C:\Windows\System\KXUudGy.exe
  C:\Windows\System\KXUudGy.exe
  2⤵
  PID:12972
- C:\Windows\System\RrmQtBO.exe
  C:\Windows\System\RrmQtBO.exe
  2⤵
  PID:13000
- C:\Windows\System\RueJYqu.exe
  C:\Windows\System\RueJYqu.exe
  2⤵
  PID:13028
- C:\Windows\System\gveRExW.exe
  C:\Windows\System\gveRExW.exe
  2⤵
  PID:13056
- C:\Windows\System\srVEkxE.exe
  C:\Windows\System\srVEkxE.exe
  2⤵
  PID:13084
- C:\Windows\System\RTuJBGi.exe
  C:\Windows\System\RTuJBGi.exe
  2⤵
  PID:13116
- C:\Windows\System\UBunXaS.exe
  C:\Windows\System\UBunXaS.exe
  2⤵
  PID:13164
- C:\Windows\System\rYAnTTR.exe
  C:\Windows\System\rYAnTTR.exe
  2⤵
  PID:13188
- C:\Windows\System\xkirsIc.exe
  C:\Windows\System\xkirsIc.exe
  2⤵
  PID:13220
- C:\Windows\System\oxtQGVh.exe
  C:\Windows\System\oxtQGVh.exe
  2⤵
  PID:13252
- C:\Windows\System\JDvjVlH.exe
  C:\Windows\System\JDvjVlH.exe
  2⤵
  PID:13280
- C:\Windows\System\SfuWKAx.exe
  C:\Windows\System\SfuWKAx.exe
  2⤵
  PID:13308
- C:\Windows\System\lMQDjIT.exe
  C:\Windows\System\lMQDjIT.exe
  2⤵
  PID:12320
- C:\Windows\System\LgYZQhA.exe
  C:\Windows\System\LgYZQhA.exe
  2⤵
  PID:12392
- C:\Windows\System\pkmsPmR.exe
  C:\Windows\System\pkmsPmR.exe
  2⤵
  PID:12460
- C:\Windows\System\KafDpmW.exe
  C:\Windows\System\KafDpmW.exe
  2⤵
  PID:4880
- C:\Windows\System\KflKnMl.exe
  C:\Windows\System\KflKnMl.exe
  2⤵
  PID:8764
- C:\Windows\System\uhPDFLe.exe
  C:\Windows\System\uhPDFLe.exe
  2⤵
  PID:2532
- C:\Windows\System\kdQbhXb.exe
  C:\Windows\System\kdQbhXb.exe
  2⤵
  PID:12488
- C:\Windows\System\dSnRHzY.exe
  C:\Windows\System\dSnRHzY.exe
  2⤵
  PID:12544
- C:\Windows\System\xXEVQYU.exe
  C:\Windows\System\xXEVQYU.exe
  2⤵
  PID:12572
- C:\Windows\System\lGEzJdQ.exe
  C:\Windows\System\lGEzJdQ.exe
  2⤵
  PID:1420
- C:\Windows\System\hzvtfnq.exe
  C:\Windows\System\hzvtfnq.exe
  2⤵
  PID:12656
- C:\Windows\System\CUwLNzg.exe
  C:\Windows\System\CUwLNzg.exe
  2⤵
  PID:12712
- C:\Windows\System\Edpiyij.exe
  C:\Windows\System\Edpiyij.exe
  2⤵
  PID:12752
- C:\Windows\System\SfpCTgd.exe
  C:\Windows\System\SfpCTgd.exe
  2⤵
  PID:12840
- C:\Windows\System\kAVNhCJ.exe
  C:\Windows\System\kAVNhCJ.exe
  2⤵
  PID:12904
- C:\Windows\System\uPQhmEF.exe
  C:\Windows\System\uPQhmEF.exe
  2⤵
  PID:12992
- C:\Windows\System\GZEmVrI.exe
  C:\Windows\System\GZEmVrI.exe
  2⤵
  PID:13036
- C:\Windows\System\JBZRRjI.exe
  C:\Windows\System\JBZRRjI.exe
  2⤵
  PID:13104
- C:\Windows\System\DGPtqiw.exe
  C:\Windows\System\DGPtqiw.exe
  2⤵
  PID:13244
- C:\Windows\System\JaqlmMn.exe
  C:\Windows\System\JaqlmMn.exe
  2⤵
  PID:13292
- C:\Windows\System\RvigZVq.exe
  C:\Windows\System\RvigZVq.exe
  2⤵
  PID:12376
- C:\Windows\System\ibPCrfG.exe
  C:\Windows\System\ibPCrfG.exe
  2⤵
  PID:4832
- C:\Windows\System\OdSPLNN.exe
  C:\Windows\System\OdSPLNN.exe
  2⤵
  PID:12516
- C:\Windows\System\SSwPTaL.exe
  C:\Windows\System\SSwPTaL.exe
  2⤵
  PID:12632
- C:\Windows\System\wRbbRFl.exe
  C:\Windows\System\wRbbRFl.exe
  2⤵
  PID:12876
- C:\Windows\System\VawrkBr.exe
  C:\Windows\System\VawrkBr.exe
  2⤵
  PID:12968
- C:\Windows\System\SPanGNN.exe
  C:\Windows\System\SPanGNN.exe
  2⤵
  PID:13180
- C:\Windows\System\gSIVONl.exe
  C:\Windows\System\gSIVONl.exe
  2⤵
  PID:12344
- C:\Windows\System\mDLWWSw.exe
  C:\Windows\System\mDLWWSw.exe
  2⤵
  PID:900
- C:\Windows\System\CveoTsA.exe
  C:\Windows\System\CveoTsA.exe
  2⤵
  PID:10800
- C:\Windows\System\VstuThB.exe
  C:\Windows\System\VstuThB.exe
  2⤵
  PID:13076
- C:\Windows\System\TsQafYA.exe
  C:\Windows\System\TsQafYA.exe
  2⤵
  PID:12456
- C:\Windows\System\KDJULGC.exe
  C:\Windows\System\KDJULGC.exe
  2⤵
  PID:12600
- C:\Windows\System\oOICNzp.exe
  C:\Windows\System\oOICNzp.exe
  2⤵
  PID:12568
- C:\Windows\System\ifQTwbo.exe
  C:\Windows\System\ifQTwbo.exe
  2⤵
  PID:13332
- C:\Windows\System\ItXeRGe.exe
  C:\Windows\System\ItXeRGe.exe
  2⤵
  PID:13360
- C:\Windows\System\rMXmIYP.exe
  C:\Windows\System\rMXmIYP.exe
  2⤵
  PID:13388
- C:\Windows\System\SRNQCxY.exe
  C:\Windows\System\SRNQCxY.exe
  2⤵
  PID:13416
- C:\Windows\System\CBsSAxU.exe
  C:\Windows\System\CBsSAxU.exe
  2⤵
  PID:13444
- C:\Windows\System\LorCbXc.exe
  C:\Windows\System\LorCbXc.exe
  2⤵
  PID:13472
- C:\Windows\System\WadSqkG.exe
  C:\Windows\System\WadSqkG.exe
  2⤵
  PID:13500
- C:\Windows\System\JJLHufo.exe
  C:\Windows\System\JJLHufo.exe
  2⤵
  PID:13516
- C:\Windows\System\QAymQgq.exe
  C:\Windows\System\QAymQgq.exe
  2⤵
  PID:13532
- C:\Windows\System\QOwqbVu.exe
  C:\Windows\System\QOwqbVu.exe
  2⤵
  PID:13556
- C:\Windows\System\AlTjboD.exe
  C:\Windows\System\AlTjboD.exe
  2⤵
  PID:13604
- C:\Windows\System\wppRIGR.exe
  C:\Windows\System\wppRIGR.exe
  2⤵
  PID:13624
- C:\Windows\System\ZALEJlV.exe
  C:\Windows\System\ZALEJlV.exe
  2⤵
  PID:13656
- C:\Windows\System\kpIWLZc.exe
  C:\Windows\System\kpIWLZc.exe
  2⤵
  PID:13692
- C:\Windows\System\MinUGuA.exe
  C:\Windows\System\MinUGuA.exe
  2⤵
  PID:13716
- C:\Windows\System\GXSKKMj.exe
  C:\Windows\System\GXSKKMj.exe
  2⤵
  PID:13744
- C:\Windows\System\BRGOsyL.exe
  C:\Windows\System\BRGOsyL.exe
  2⤵
  PID:13760
- C:\Windows\System\OGUhhDk.exe
  C:\Windows\System\OGUhhDk.exe
  2⤵
  PID:13796
- C:\Windows\System\mEkSCAL.exe
  C:\Windows\System\mEkSCAL.exe
  2⤵
  PID:13816
- C:\Windows\System\AhQhRAW.exe
  C:\Windows\System\AhQhRAW.exe
  2⤵
  PID:13856
- C:\Windows\System\hGacTzU.exe
  C:\Windows\System\hGacTzU.exe
  2⤵
  PID:13884
- C:\Windows\System\qBjXUpY.exe
  C:\Windows\System\qBjXUpY.exe
  2⤵
  PID:13924
- C:\Windows\System\dsiTwcI.exe
  C:\Windows\System\dsiTwcI.exe
  2⤵
  PID:13952
- C:\Windows\System\NNfKgDp.exe
  C:\Windows\System\NNfKgDp.exe
  2⤵
  PID:13980
- C:\Windows\System\wtRbuWv.exe
  C:\Windows\System\wtRbuWv.exe
  2⤵
  PID:14008
- C:\Windows\System\iZtqGva.exe
  C:\Windows\System\iZtqGva.exe
  2⤵
  PID:14028
- C:\Windows\System\LDSscXD.exe
  C:\Windows\System\LDSscXD.exe
  2⤵
  PID:14064
- C:\Windows\System\XnXtfjK.exe
  C:\Windows\System\XnXtfjK.exe
  2⤵
  PID:14080
- C:\Windows\System\skVmUmx.exe
  C:\Windows\System\skVmUmx.exe
  2⤵
  PID:14120
- C:\Windows\System\IxqBqXB.exe
  C:\Windows\System\IxqBqXB.exe
  2⤵
  PID:14148
- C:\Windows\System\IhduUFO.exe
  C:\Windows\System\IhduUFO.exe
  2⤵
  PID:14176
- C:\Windows\System\gZbdddc.exe
  C:\Windows\System\gZbdddc.exe
  2⤵
  PID:14204
- C:\Windows\System\ZCNMPrp.exe
  C:\Windows\System\ZCNMPrp.exe
  2⤵
  PID:14232
- C:\Windows\System\cDwGruh.exe
  C:\Windows\System\cDwGruh.exe
  2⤵
  PID:14256
- C:\Windows\System\OsIJIdF.exe
  C:\Windows\System\OsIJIdF.exe
  2⤵
  PID:14284
- C:\Windows\System\JdIrhaZ.exe
  C:\Windows\System\JdIrhaZ.exe
  2⤵
  PID:14308
- C:\Windows\System\qZdvTVf.exe
  C:\Windows\System\qZdvTVf.exe
  2⤵
  PID:13356
- C:\Windows\System\JkWeqOk.exe
  C:\Windows\System\JkWeqOk.exe
  2⤵
  PID:13400
- C:\Windows\System\jaoQcww.exe
  C:\Windows\System\jaoQcww.exe
  2⤵
  PID:13460
- C:\Windows\System\wUkeVoG.exe
  C:\Windows\System\wUkeVoG.exe
  2⤵
  PID:13528
- C:\Windows\System\qfPbQsd.exe
  C:\Windows\System\qfPbQsd.exe
  2⤵
  PID:13580
- C:\Windows\System\wTqjWFi.exe
  C:\Windows\System\wTqjWFi.exe
  2⤵
  PID:13636
- C:\Windows\System\VPzAdGh.exe
  C:\Windows\System\VPzAdGh.exe
  2⤵
  PID:13756
- C:\Windows\System\vrBziex.exe
  C:\Windows\System\vrBziex.exe
  2⤵
  PID:13788
- C:\Windows\System\qRhCsal.exe
  C:\Windows\System\qRhCsal.exe
  2⤵
  PID:13540
- C:\Windows\System\LzrEGHk.exe
  C:\Windows\System\LzrEGHk.exe
  2⤵
  PID:13908
- C:\Windows\System\UrEZegS.exe
  C:\Windows\System\UrEZegS.exe
  2⤵
  PID:13992
- C:\Windows\System\oqDLJGr.exe
  C:\Windows\System\oqDLJGr.exe
  2⤵
  PID:14056
- C:\Windows\System\yhnbZmB.exe
  C:\Windows\System\yhnbZmB.exe
  2⤵
  PID:14116
- C:\Windows\System\CDFdTJR.exe
  C:\Windows\System\CDFdTJR.exe
  2⤵
  PID:4560
- C:\Windows\System\XuKMdOR.exe
  C:\Windows\System\XuKMdOR.exe
  2⤵
  PID:4444
- C:\Windows\System\uWppFta.exe
  C:\Windows\System\uWppFta.exe
  2⤵
  PID:14240
- C:\Windows\System\UVvtlCE.exe
  C:\Windows\System\UVvtlCE.exe
  2⤵
  PID:14300
- C:\Windows\System\vDqZjjH.exe
  C:\Windows\System\vDqZjjH.exe
  2⤵
  PID:13376
- C:\Windows\System\wiFlQYj.exe
  C:\Windows\System\wiFlQYj.exe
  2⤵
  PID:13524
- C:\Windows\System\OOqDuJL.exe
  C:\Windows\System\OOqDuJL.exe
  2⤵
  PID:13708
- C:\Windows\System\DVwEXDu.exe
  C:\Windows\System\DVwEXDu.exe
  2⤵
  PID:13836
- C:\Windows\System\ZeWsXxj.exe
  C:\Windows\System\ZeWsXxj.exe
  2⤵
  PID:13976
- C:\Windows\System\IuZguim.exe
  C:\Windows\System\IuZguim.exe
  2⤵
  PID:14160
- C:\Windows\System\QBuejPs.exe
  C:\Windows\System\QBuejPs.exe
  2⤵
  PID:14220
- C:\Windows\System\pSRfAIi.exe
  C:\Windows\System\pSRfAIi.exe
  2⤵
  PID:13320
- C:\Windows\System\ijvHFqU.exe
  C:\Windows\System\ijvHFqU.exe
  2⤵
  PID:13772
- C:\Windows\System\iNSJuGF.exe
  C:\Windows\System\iNSJuGF.exe
  2⤵
  PID:14112
- C:\Windows\System\MdWHyaw.exe
  C:\Windows\System\MdWHyaw.exe
  2⤵
  PID:14296
- C:\Windows\System\CZoXXBm.exe
  C:\Windows\System\CZoXXBm.exe
  2⤵
  PID:14196
- C:\Windows\System\uzbirvR.exe
  C:\Windows\System\uzbirvR.exe
  2⤵
  PID:14344
- C:\Windows\System\QczdEUl.exe
  C:\Windows\System\QczdEUl.exe
  2⤵
  PID:14360
- C:\Windows\System\myRqgvg.exe
  C:\Windows\System\myRqgvg.exe
  2⤵
  PID:14396
- C:\Windows\System\xbFhdiV.exe
  C:\Windows\System\xbFhdiV.exe
  2⤵
  PID:14428
- C:\Windows\System\aaHTFGy.exe
  C:\Windows\System\aaHTFGy.exe
  2⤵
  PID:14456
- C:\Windows\System\nFHmWwQ.exe
  C:\Windows\System\nFHmWwQ.exe
  2⤵
  PID:14472
- C:\Windows\System\KGUOIzI.exe
  C:\Windows\System\KGUOIzI.exe
  2⤵
  PID:14504
- C:\Windows\System\jutOaEF.exe
  C:\Windows\System\jutOaEF.exe
  2⤵
  PID:14528
- C:\Windows\System\vofWDKp.exe
  C:\Windows\System\vofWDKp.exe
  2⤵
  PID:14552
- C:\Windows\System\ArjGWBY.exe
  C:\Windows\System\ArjGWBY.exe
  2⤵
  PID:14584
- C:\Windows\System\ckdSvob.exe
  C:\Windows\System\ckdSvob.exe
  2⤵
  PID:14612
- C:\Windows\System\fWhSdRV.exe
  C:\Windows\System\fWhSdRV.exe
  2⤵
  PID:14640
- C:\Windows\System\rCmrxbX.exe
  C:\Windows\System\rCmrxbX.exe
  2⤵
  PID:14668
- C:\Windows\System\TdXRFmG.exe
  C:\Windows\System\TdXRFmG.exe
  2⤵
  PID:14688
- C:\Windows\System\FsSVrYZ.exe
  C:\Windows\System\FsSVrYZ.exe
  2⤵
  PID:14724
- C:\Windows\System\CgIBmrr.exe
  C:\Windows\System\CgIBmrr.exe
  2⤵
  PID:14752
- C:\Windows\System\WDKPyux.exe
  C:\Windows\System\WDKPyux.exe
  2⤵
  PID:14780
- C:\Windows\System\dmRtlFD.exe
  C:\Windows\System\dmRtlFD.exe
  2⤵
  PID:14808
- C:\Windows\System\AflVxED.exe
  C:\Windows\System\AflVxED.exe
  2⤵
  PID:14840
- C:\Windows\System\UcjCZcx.exe
  C:\Windows\System\UcjCZcx.exe
  2⤵
  PID:14876
- C:\Windows\System\ZWClMya.exe
  C:\Windows\System\ZWClMya.exe
  2⤵
  PID:14900
- C:\Windows\System\MnFRDPo.exe
  C:\Windows\System\MnFRDPo.exe
  2⤵
  PID:14924
- C:\Windows\System\IAAwNrm.exe
  C:\Windows\System\IAAwNrm.exe
  2⤵
  PID:14952
- C:\Windows\System\mUbzBOt.exe
  C:\Windows\System\mUbzBOt.exe
  2⤵
  PID:14972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AndWitq.exe

Path C:\Windows\System\AndWitq.exe
Size 2.5MB
SHA256 aee4209ee49ad06c62f0a6d6176bcd285281ed98b64f71c882a96d15a924dd5b
MD5 182248ed82503a68f70f21f9ffe3c1d1
SHA1 1be886b98e50c258325ded19ae346c8fc92157e3
SHA512 3b2885cca4e928638905bd4f364f7254b6c2a2b5eba53c23988b4b75c738ed557cd99c28bb54100a4d82ae194b7fa0fb8f7991c1dfd69f8d417dec6b95be269e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJt:BemTLkNdfE0pZrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

BgCgghI.exe

Path C:\Windows\System\BgCgghI.exe
Size 2.5MB
SHA256 fe10d07f940660408d98816c11117ecd16f16f4482d123562f7cbf573bb0860f
MD5 aca3fdb714b46a72e94419dd93d58936
SHA1 c375336f12f2fed36f192bb4d6ddbb4ec131ae03
SHA512 85f218bdc82d37088bf5c80b2fafd6019036356415708677d98a3415a77e5e09308344c067d70166db82d6d25809784a84b3586b71584fe5e064a27e5e939806
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ9:BemTLkNdfE0pZrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CKxiRlh.exe

Path C:\Windows\System\CKxiRlh.exe
Size 2.5MB
SHA256 d90fd9dd83d4014befeff5f9baaef82e8d97ad257bccb70d18d583c28ee74345
MD5 699de0d6b5656261daba7fe6016cef15
SHA1 5743c7f923ace2b3bc25472b172ce49341580d91
SHA512 f165c09226daf559135bfde04dd4ed4972d9650e7ab2654ae5b436fa541cf30fe66cb2bf6e8ece368ceeed399d10a8681bed42566c9f82fdbb82e645fb8ae3f6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJD:BemTLkNdfE0pZrB
MD5 SHA1 SHA512 SSDEEP

Submit Download

KmQScyA.exe

Path C:\Windows\System\KmQScyA.exe
Size 2.5MB
SHA256 4d240cb59acbc64cfa8716dcca8c9594d048cdd5fbb8f25b47994ac35149ab0e
MD5 7cae6435893528d3f3974a09caacd5cc
SHA1 d8828e4c62cb1032e88b73d9fd28b541a22fb06a
SHA512 0aa21a198355cde2e60f026722bfdcdebe6fc4d9226d0899a251297aedeebdc78d1952a669750e233cc07ff5bcf245bec44efb97952e74abe11ea19e25623144
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJCj:BemTLkNdfE0pZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSElJiO.exe

Path C:\Windows\System\MSElJiO.exe
Size 2.5MB
SHA256 b28bfbb302be84e37b0cee28fc5ecc43509c4873629c465128cb5ac2d8583cff
MD5 8c390763759e7ee5333b518b669fedc3
SHA1 1880efa06d5b51780f5995611acb21e3d0c60436
SHA512 17fea35b982f51c7e4d490932e20d2e7b03b4932cd9d9ca3f2591287f57c716453dc96ed016e24cb8012272df90cf0d308b8d19914c96e4c587b9f774a3d0f6c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJH:BemTLkNdfE0pZrh
MD5 SHA1 SHA512 SSDEEP

Submit Download

PSsRkOs.exe

Path C:\Windows\System\PSsRkOs.exe
Size 2.5MB
SHA256 0bb1529359a1be50bbf8616028790d4a76f740713a82aac3acfdacbfe975ea5f
MD5 403a8baf74b22dac6f7f3158e86243bf
SHA1 d4ff9d5ee0d80883ccb5e81f971f389e0fe6b6af
SHA512 f3e9850551cae6724b88485a14f2bf900ec43613d57563002de792c74d99c028667f714d82278eba89d69478a58cf18084b0b7b421d2fdb2ff34dc5a3c0f38cd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJN:BemTLkNdfE0pZr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PYgdoZb.exe

Path C:\Windows\System\PYgdoZb.exe
Size 2.5MB
SHA256 092ca0d10370bf594c8a7bc0938605ca78ee4f155de06f87a43ad9fdd75e4065
MD5 93ae33f9e4eb3772368587e1fb032199
SHA1 cef168e4833900ec97de2af004b02089b498ed25
SHA512 080a19444cfee6e17f0ad9bccb39d8a1c4fa78b3e354beaeac0eb259f39a7ca71027fef74597bb6c628d15623317539e914fa499e73c37d5adc628d1b96ff499
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ7:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

QBLUOYI.exe

Path C:\Windows\System\QBLUOYI.exe
Size 2.5MB
SHA256 2ef540f7519513d2ff6ce953a4e9a004bb643c85d8688cc0eb146c1e28976da2
MD5 1c3e034d0f2cb4c321a17640d9216921
SHA1 8778055d3d5f6be29c3cdf3029cdf0b0144dd356
SHA512 2fe5c2e8bebd1700b4fb268286a0c6dffc07d13a8cfdb87064191d2215a4b479d97f0fe4f2b9a2793f01a01a8589ac6f9299ac3900422de4cad4aadbdb97a299
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ9:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

QVwXeWz.exe

Path C:\Windows\System\QVwXeWz.exe
Size 2.5MB
SHA256 28c4bb469fd2531075e90e1fdef58d9ff8f196d4a4eb90027ae15fd4b37ebd48
MD5 293c86fffdbd2277bdbf5d66b277d473
SHA1 8da46aba5b83d85c43bcf0a43700bfea884f98e0
SHA512 5ba944880abba98402e72b05fa282e0d38e0637c297570366f2a6c9a4f09f2ab6755ef9fae32728bad81ba948956ab6890eb6b5a9895b70e47d9e97b24a6e843
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJu:BemTLkNdfE0pZrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

QhjWTuo.exe

Path C:\Windows\System\QhjWTuo.exe
Size 2.5MB
SHA256 6f9531b8c228b762c4ebe0741eb8ff5e49998152db1e75768e7548cd275d1147
MD5 e9201cc298b54309ed928fcaa924edef
SHA1 b8e393097cb938dc244264cf2a90ea65e67fc2c7
SHA512 0e5cd48e8535c75b425b4a121d45265950286dacae220944c86bcb0bbd54132bfb8c81aa448147bff618e02019ddc32875c48a555436553b738d32f0785a6bec
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJB:BemTLkNdfE0pZrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

QpWkMWX.exe

Path C:\Windows\System\QpWkMWX.exe
Size 2.5MB
SHA256 ad878660781963ff7385a6949fe9f4292876ec6a2e601a216c82ed85fc71d77e
MD5 6c8829d6e905f5764f64e2dd3b5b1b3a
SHA1 5a778221352efbe6673052b1c830c092087030ec
SHA512 3cc87555a8d6d7aab6e00a3663a1755d65feb3a05d026fcf706cd1dde57b1b65cb2569cdb4aaa680dde5d01b3293ff63b2f59e0d10209019ab4165320f3247cf
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJM:BemTLkNdfE0pZru
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDxfnfh.exe

Path C:\Windows\System\TDxfnfh.exe
Size 2.5MB
SHA256 b7a0b886e705d419aab8bf95eec660b4faf803de1bb42c85a6af5ae8efc062a9
MD5 cd69dc7b3217123cb1c37a5fd3c13cf8
SHA1 2ee47b9b3d39fef82ec3d14cf28c257707d45ccd
SHA512 3f495a8a955cad268821215f64fb97cc2e823f744bfab3e802abae8dc8a5af8a52d4b8e5a5462106cb3ecda80d9ce14e09253e9b30f9b1a698e36db0680ad1cb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJQ:BemTLkNdfE0pZr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

WStNoCN.exe

Path C:\Windows\System\WStNoCN.exe
Size 2.5MB
SHA256 8a1a89a3554ab9c4a9a888834e8f420e1bc2fff8bca243ed2dac8be8e7a4c5f2
MD5 9ae481abac614ae9ec744da4858efbd9
SHA1 74fee9daf243541bc1f95123fda6dfd95bd997b4
SHA512 b02fba64e6b0febd2413163fe6fe74611f2a6614a9c4297568f4bdb414034d6f9c7caf6113916d444f00d5398f6ce78efbaee16f0c7c80f347536050e649d7b4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJU:BemTLkNdfE0pZr6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WgPsnMm.exe

Path C:\Windows\System\WgPsnMm.exe
Size 2.5MB
SHA256 bf9541ec94f8d62ef3494bdc1d3869e1c54e40c133532bcec98b3289658039ce
MD5 ed7f12d0458ae0ff99b93f1d22f0102e
SHA1 67048149abc636dfc7105573867bab356dd518f8
SHA512 e611db26e9ff487ee2c32526f08088c9904f45d5d5bb065984100e803668c625ae83ba1d7ec364b94b0b76949158fd913885fa68715295e91f1a871e26714174
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ9:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

WzoUZtc.exe

Path C:\Windows\System\WzoUZtc.exe
Size 2.5MB
SHA256 062afd4ca56f03b682fb1ec75af0704ed60cb3e451e8418e4b00cb9e72892929
MD5 104e8c9359a0d424bd208a2736d225ea
SHA1 619a3fb755f655bf17d720b6001c189eab356756
SHA512 b3f6218a0eae35e40482e0ed75b58e2f5b1bebfd3d166d414908ec4bc88354fa341f71847707a384442e71be9bd750af3ef0e9881a9f1ea77dcd9cf927db91cd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJy:BemTLkNdfE0pZrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZJnyhvj.exe

Path C:\Windows\System\ZJnyhvj.exe
Size 2.5MB
SHA256 52c4ac324798f4aa86baf2c9f5dc8e917cf03f5fadc867042e21d36141a18d38
MD5 a936404fb92e4162844a5e6a0a1c3774
SHA1 dc38d237d79457ba3399d26af6d585bbabb235e4
SHA512 74944a2ee7e007fd419e2931ce6c7e95c222ab0eccde8b6a2d5088206c1f9dc05c5c2253a5b065df2ec089f7836e625766047151ce501056f33f6fb5d1d08163
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJt:BemTLkNdfE0pZrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bxkzeDc.exe

Path C:\Windows\System\bxkzeDc.exe
Size 2.5MB
SHA256 aa5610034a7d8f17979226ac8fcdf0c0704b04febf70a19ca54ec46fd02c1345
MD5 46d683d8a31ccb2a543a61f601ba29df
SHA1 90636bcbc36199fdfaef008dde943be308b1fa9a
SHA512 883f001d6330a7fdc4a125102fdb9e21d3fb147a493c8e17b7147d483a108eaded416655257603d669c85d889f7636bbe4064d5f6fbd1add1ca88e9b743a26e0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJp:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

cCHxRnX.exe

Path C:\Windows\System\cCHxRnX.exe
Size 2.5MB
SHA256 bed42dcdaf3c7dedaf2c125bf6ff818a7015c1db261c2d99aafd88e8bf5ff921
MD5 9de389575eb4d6269748bd150a5f32e0
SHA1 16f0bd9bc51bd986c8199a156442b843ca5e80ec
SHA512 d38665ec5eb0edf293297fc1854b5108482666c76acbeb10ebb21f97783e917ca89f538a11a0de092a8bdf3f7539a8c476362f613e8cd19cb0f230f1396400b9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJe:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

cyjxBti.exe

Path C:\Windows\System\cyjxBti.exe
Size 2.5MB
SHA256 bd7ae4290ead46f7c1e71c2b0ad52ab5efbf590bc51fb6731c9a226cf98c42d3
MD5 0c5a6b1a177eb91ad5fe516eac78acf0
SHA1 7077b047cf2f81478a5619ad073107a191ed3e78
SHA512 3a98f262782c26d1af07f611b630c3c1f8b3557589167403a40fd2fa4ed335be9bcb79589e64ecb6c5d2c3a075cbf693ec33e983edeeeb81657323293d937f45
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJD:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

gjajDbG.exe

Path C:\Windows\System\gjajDbG.exe
Size 2.5MB
SHA256 911127d0cf9f6f84e3442d061bcbbe9d79c9fb06ea329fbdff1395066cd28636
MD5 91f461a29c26a03784b597d3b8a9130c
SHA1 129803a9590d7a7b67cecb1008aa458ed93f4f4e
SHA512 d5c10e50545d7fd66503eee1f66665801e195230a6dc9234425cef5087074f1197196dc2f1eb5da759faa291d6ad36e00635443388e6dbfec978b4a6e563dca2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ6:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

hTBioaH.exe

Path C:\Windows\System\hTBioaH.exe
Size 2.5MB
SHA256 e0431c2658919e575351d153d958a6120fc32323877051657eceecd57055e9c7
MD5 2c5f3b5c8d957ab02c362b8627febe47
SHA1 a9dc67fdf87f25696c3287da824788bb53bd0439
SHA512 707ae57e71a61cfd8aadf82ea3feddf9f90f38a7b0b22fb727a6cd9c16062aea45d30c4f2251e253690209b98c98d719e3dd8101ca17927e97559292a0302d63
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJV:BemTLkNdfE0pZrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

meoOHIW.exe

Path C:\Windows\System\meoOHIW.exe
Size 2.5MB
SHA256 2b45e47df22a7e3143652dfb8c0fc4039b89bc9cfcc3a87b92d5aeba8d534f39
MD5 9519142c8ed99b944f002ff154dc95aa
SHA1 af2782c36762caad419ad705d1be4ddf37708a48
SHA512 fd1f26ebddc7028d03e8d6411b2db3976f3ed4e68e6a4136efe69dd42783753a7ef16d0c9410c9bd3299705a422aa53a5e315c2a019a71233465c54166778aae
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ/:BemTLkNdfE0pZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

noAcoIp.exe

Path C:\Windows\System\noAcoIp.exe
Size 2.5MB
SHA256 597cf466e4c57a324dc20d092d0314885f97c228b6520199708f72e74896f2b1
MD5 c4d91c8562bd1f1ff76edb237c0d4345
SHA1 53370e0dcdede04ddcb1d8700d6ca04c526648ce
SHA512 264d37c8986b0cd8b88da981c6d67248983271e72f52904c19a941694d76c0ee0b8afcbee8e70220e6ca7b643a176dd3447adda28ea7f5efb4124e84e4abecef
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJB:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzITbNn.exe

Path C:\Windows\System\qzITbNn.exe
Size 2.5MB
SHA256 9bdbc9328ef46bf8218ca3fcb526eacf6784c29de49b10e1d75ccfd21b4db240
MD5 2c1415feb0c7ae7c2f4fc7eb37eeea2a
SHA1 4fd768c3d416c1c629beb7e023f4a580c873914d
SHA512 2a13ef8aa2b63ff68a9457d4f987eb68bec7f2947213a93cdfbb47815adf49d252e79803ca9ed930e38d445556500c6308451d43b609ca30f531a6a29a30a97b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ2:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

rYtxbIL.exe

Path C:\Windows\System\rYtxbIL.exe
Size 2.5MB
SHA256 fbe4b7088ee5a971c542d34638c8ea5f0f245ddc984118ccca970a1de5df2e87
MD5 21cb496dc3e9ea000d6e54239aaf9454
SHA1 d8c53dfb7a24f47f4908e2ec24b5b947d16afb04
SHA512 d27722510d96d6ab0a55ae249af429b7d19033b56c0abff4a614065c299ef08d36a41419aa5ecd143a03c9c2b6c7719319abec90f2c0838008870804dce2158b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJz:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ryMczek.exe

Path C:\Windows\System\ryMczek.exe
Size 2.5MB
SHA256 63c9c1782fd735528e4037aabe781ab099cabae875dea2cbd89f2e67df544187
MD5 5039040ff1d388373be0935e240d55f3
SHA1 2557dd04499b3acddc7fddef918eed7dd676e40b
SHA512 72d5d41ac07c6f41cbbc5295d16998a79427e125cff1794e1cf39bf3740e2a9fee5ca176031cb2d1d2500e43613b6f1f5aa87a788e2ca8fbb39c41140774f012
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ8:BemTLkNdfE0pZrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

sMOnxYP.exe

Path C:\Windows\System\sMOnxYP.exe
Size 2.5MB
SHA256 770c8a227c31aaf31e1eaea7ac0c969cd527313a899e3844c8ec6a9340502b01
MD5 1ae76800be5f23d23857986f302d725f
SHA1 76daa809932722f785c7990e51280e96816899d7
SHA512 dc4cb343e761d7089247bdbdb0722867c4cc31dae046dc70fce8b25b0dc42c73cd2fe22d3f83cb631d9886852bd8ed8743e8e02e69f46e4f26e7ff42b938160e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ1:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vUTzIHj.exe

Path C:\Windows\System\vUTzIHj.exe
Size 2.5MB
SHA256 e61aaca26489f27bc4997fce635ee624f57f3f17db592ca8e2aa7e3ac26495cd
MD5 f53194e4f82d5e20fb2a9edc7bf4a79a
SHA1 6fc6849df9d447b5d2dcb50e53fa0c8437b84dc2
SHA512 64ae03e8db69b0bf3c26f0e260a38ffb439db14ea641e9b147d78ffac2d07b7b7e97d101fb90605d439ca516f344fe49f7e55c374216ad6c879446b66d2050ce
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJp:BemTLkNdfE0pZrX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vVnGsfK.exe

Path C:\Windows\System\vVnGsfK.exe
Size 2.5MB
SHA256 b022d02e4d7556c2e31e9be199633ca4ad7bc7e9db196ac45dbacf253c77679d
MD5 6029e11486b7ecef16ba8011f51cf6f0
SHA1 5f48d8c772b5353ed28e8da69016a60c04c5744b
SHA512 004280aa4a3a59a424b52c3af81942284dfeb1be7dfafa899a1fe1589d2cda1cd6becb3a8ce148e206b29fb39e2e7f00a522d96f2b86a328191de2a9030672f7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ9:BemTLkNdfE0pZrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vpxVQPu.exe

Path C:\Windows\System\vpxVQPu.exe
Size 2.5MB
SHA256 a7c259043375cb6fc52cff4f41cf2a06744883ea24cefe460b89988c1898d53a
MD5 b2fcb96bc726e5bf5c573361c586dc4d
SHA1 901dca64226a4e3feb97a2d6d83e6451cc0de146
SHA512 e0e3187b47b18632ba4d863ee31f7eb31972e32e7ed0c91958351a3b9a74c62b8670a4f2af239fb0552b3c022759485e8a37285fca324f376b8de346cb8bec2d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ1:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yPiwYGX.exe

Path C:\Windows\System\yPiwYGX.exe
Size 2.5MB
SHA256 2891cfa41c61fa89856c3eaf0726f0b261a9b1776c582fa866b090e912a6d3d1
MD5 c7bfb3034a48c0b0211a84e579afca45
SHA1 4c717d0c7e1564bc02a06efe7ed86ad449294ed2
SHA512 70bb40021b58e84e6dc927e29ba49dac8ef3119e0570412c3c5ccffdb2bc6a8d968087bc452c5d1eb7f4e1cb56f919a796d9316db3029978effe838a0f263c00
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJo:BemTLkNdfE0pZrK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ziMXwiW.exe

Path C:\Windows\System\ziMXwiW.exe
Size 2.5MB
SHA256 89cf2bac465c08af2c935de33e69c2b8665e943c7dc8a9db9b80785700fe697e
MD5 b7e5f777837a2c767fa062e0c710bfb3
SHA1 5743004d5630661b6a05aeff6074cfe40c355591
SHA512 5a15a10eca884fba80c9075e1a1bbb890e44896699a4401efec0c5ab8d45b1b06cf9eed075e4bf83f11e1202ee6a5399e38b0c1bdcd69e643de861e127d0184a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSdzw6SUz8dLJ8:BemTLkNdfE0pZrm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-2222-0x00007FF7EDFE0000-0x00007FF7EE334000-memory.dmp

Download

memory/440-181-0x00007FF7EDFE0000-0x00007FF7EE334000-memory.dmp

Download

memory/540-2215-0x00007FF67DD00000-0x00007FF67E054000-memory.dmp

Download

memory/540-139-0x00007FF67DD00000-0x00007FF67E054000-memory.dmp

Download

memory/884-2199-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp

Download

memory/884-42-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp

Download

memory/944-23-0x00007FF6B87D0000-0x00007FF6B8B24000-memory.dmp

Download

memory/944-2197-0x00007FF6B87D0000-0x00007FF6B8B24000-memory.dmp

Download

memory/1196-2219-0x00007FF7E1EB0000-0x00007FF7E2204000-memory.dmp

Download

memory/1196-191-0x00007FF7E1EB0000-0x00007FF7E2204000-memory.dmp

Download

memory/1352-93-0x00007FF6C4330000-0x00007FF6C4684000-memory.dmp

Download

memory/1352-2209-0x00007FF6C4330000-0x00007FF6C4684000-memory.dmp

Download

memory/1352-2189-0x00007FF6C4330000-0x00007FF6C4684000-memory.dmp

Download

memory/1664-193-0x00007FF780E40000-0x00007FF781194000-memory.dmp

Download

memory/1664-2216-0x00007FF780E40000-0x00007FF781194000-memory.dmp

Download

memory/1824-43-0x00007FF6750B0000-0x00007FF675404000-memory.dmp

Download

memory/1824-2200-0x00007FF6750B0000-0x00007FF675404000-memory.dmp

Download

memory/1928-179-0x00007FF6A1E40000-0x00007FF6A2194000-memory.dmp

Download

memory/1928-2221-0x00007FF6A1E40000-0x00007FF6A2194000-memory.dmp

Download

memory/1952-52-0x00007FF6F9C10000-0x00007FF6F9F64000-memory.dmp

Download

memory/1952-874-0x00007FF6F9C10000-0x00007FF6F9F64000-memory.dmp

Download

memory/1952-2203-0x00007FF6F9C10000-0x00007FF6F9F64000-memory.dmp

Download

memory/2068-2206-0x00007FF67D7A0000-0x00007FF67DAF4000-memory.dmp

Download

memory/2068-89-0x00007FF67D7A0000-0x00007FF67DAF4000-memory.dmp

Download

memory/2092-47-0x00007FF6C9390000-0x00007FF6C96E4000-memory.dmp

Download

memory/2092-2201-0x00007FF6C9390000-0x00007FF6C96E4000-memory.dmp

Download

memory/2328-95-0x00007FF70CD90000-0x00007FF70D0E4000-memory.dmp

Download

memory/2328-2191-0x00007FF70CD90000-0x00007FF70D0E4000-memory.dmp

Download

memory/2328-2211-0x00007FF70CD90000-0x00007FF70D0E4000-memory.dmp

Download

memory/2368-126-0x00007FF7F68A0000-0x00007FF7F6BF4000-memory.dmp

Download

memory/2368-2193-0x00007FF7F68A0000-0x00007FF7F6BF4000-memory.dmp

Download

memory/2368-2214-0x00007FF7F68A0000-0x00007FF7F6BF4000-memory.dmp

Download

memory/2824-2218-0x00007FF79B050000-0x00007FF79B3A4000-memory.dmp

Download

memory/2824-192-0x00007FF79B050000-0x00007FF79B3A4000-memory.dmp

Download

memory/2848-24-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp

Download

memory/2848-132-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp

Download

memory/2848-2198-0x00007FF6913A0000-0x00007FF6916F4000-memory.dmp

Download

memory/3424-118-0x00007FF69ADF0000-0x00007FF69B144000-memory.dmp

Download

memory/3424-2212-0x00007FF69ADF0000-0x00007FF69B144000-memory.dmp

Download

memory/3548-180-0x00007FF7FCDE0000-0x00007FF7FD134000-memory.dmp

Download

memory/3548-2220-0x00007FF7FCDE0000-0x00007FF7FD134000-memory.dmp

Download

memory/3684-2190-0x00007FF72B3F0000-0x00007FF72B744000-memory.dmp

Download

memory/3684-94-0x00007FF72B3F0000-0x00007FF72B744000-memory.dmp

Download

memory/3684-2210-0x00007FF72B3F0000-0x00007FF72B744000-memory.dmp

Download

memory/3868-2205-0x00007FF69C300000-0x00007FF69C654000-memory.dmp

Download

memory/3868-79-0x00007FF69C300000-0x00007FF69C654000-memory.dmp

Download

memory/3908-67-0x00007FF6837F0000-0x00007FF683B44000-memory.dmp

Download

memory/3908-2204-0x00007FF6837F0000-0x00007FF683B44000-memory.dmp

Download

memory/3916-2213-0x00007FF6D6D50000-0x00007FF6D70A4000-memory.dmp

Download

memory/3916-123-0x00007FF6D6D50000-0x00007FF6D70A4000-memory.dmp

Download

memory/3976-2196-0x00007FF75B1D0000-0x00007FF75B524000-memory.dmp

Download

memory/3976-22-0x00007FF75B1D0000-0x00007FF75B524000-memory.dmp

Download

memory/4440-178-0x00007FF675610000-0x00007FF675964000-memory.dmp

Download

memory/4440-2194-0x00007FF675610000-0x00007FF675964000-memory.dmp

Download

memory/4440-2217-0x00007FF675610000-0x00007FF675964000-memory.dmp

Download

memory/4536-2223-0x00007FF6C4F60000-0x00007FF6C52B4000-memory.dmp

Download

memory/4536-184-0x00007FF6C4F60000-0x00007FF6C52B4000-memory.dmp

Download

memory/4600-18-0x00007FF79CA80000-0x00007FF79CDD4000-memory.dmp

Download

memory/4600-2195-0x00007FF79CA80000-0x00007FF79CDD4000-memory.dmp

Download

memory/4868-0-0x00007FF6C1710000-0x00007FF6C1A64000-memory.dmp

Download

memory/4868-73-0x00007FF6C1710000-0x00007FF6C1A64000-memory.dmp

Download

memory/4868-1-0x0000020433270000-0x0000020433280000-memory.dmp

Download

memory/4964-2208-0x00007FF7E4AE0000-0x00007FF7E4E34000-memory.dmp

Download

memory/4964-96-0x00007FF7E4AE0000-0x00007FF7E4E34000-memory.dmp

Download

memory/4964-2192-0x00007FF7E4AE0000-0x00007FF7E4E34000-memory.dmp

Download

memory/4976-2202-0x00007FF7B3ED0000-0x00007FF7B4224000-memory.dmp

Download

memory/4976-61-0x00007FF7B3ED0000-0x00007FF7B4224000-memory.dmp

Download

memory/5068-80-0x00007FF665CE0000-0x00007FF666034000-memory.dmp

Download

memory/5068-1884-0x00007FF665CE0000-0x00007FF666034000-memory.dmp

Download

memory/5068-2207-0x00007FF665CE0000-0x00007FF666034000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads