xmrig | 2978f791894152af1cb7aefef96ae4e5aacb7b9e2ce3738fc48125351fedcd2e

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
Size 1.6MB
Sample240522-2h7pasbf56
SHA256 2978f791894152af1cb7aefef96ae4e5aacb7b9e2ce3738fc48125351fedcd2e
MD5 4d9bd6fc9c3fd032160b8993c9283d70
SHA1 056b858c9ee3d0b725511078d9ad89a4a213a671
SHA512 9b575f9455ec9cc96ca4eb27dd05be216f00fff69f06a6ebccab93a4e1174dc4a7d1fd03cce77976a01a437a4b90bfbbe429c2b0291f895f8753ec6e011305d4
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//x:RWWBibaY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4744-43-0x00007FF6BE5C0000-0x00007FF6BE911000-memory.dmp	xmrig
behavioral2/memory/2848-44-0x00007FF6B4C10000-0x00007FF6B4F61000-memory.dmp	xmrig
behavioral2/memory/2732-54-0x00007FF76B620000-0x00007FF76B971000-memory.dmp	xmrig
behavioral2/memory/2240-57-0x00007FF7260F0000-0x00007FF726441000-memory.dmp	xmrig
behavioral2/memory/4992-60-0x00007FF71F910000-0x00007FF71FC61000-memory.dmp	xmrig
behavioral2/memory/2236-61-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp	xmrig
behavioral2/memory/2660-83-0x00007FF762090000-0x00007FF7623E1000-memory.dmp	xmrig
behavioral2/memory/4088-77-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp	xmrig
behavioral2/memory/5108-145-0x00007FF7ACC60000-0x00007FF7ACFB1000-memory.dmp	xmrig
behavioral2/memory/4628-189-0x00007FF7D98A0000-0x00007FF7D9BF1000-memory.dmp	xmrig
behavioral2/memory/1192-194-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp	xmrig
behavioral2/memory/4072-196-0x00007FF69CF90000-0x00007FF69D2E1000-memory.dmp	xmrig
behavioral2/memory/500-195-0x00007FF65E600000-0x00007FF65E951000-memory.dmp	xmrig
behavioral2/memory/4196-192-0x00007FF7B1640000-0x00007FF7B1991000-memory.dmp	xmrig
behavioral2/memory/3740-191-0x00007FF66D4A0000-0x00007FF66D7F1000-memory.dmp	xmrig
behavioral2/memory/3104-175-0x00007FF610A40000-0x00007FF610D91000-memory.dmp	xmrig
behavioral2/memory/2880-160-0x00007FF7689F0000-0x00007FF768D41000-memory.dmp	xmrig
behavioral2/memory/1900-150-0x00007FF629BD0000-0x00007FF629F21000-memory.dmp	xmrig
behavioral2/memory/1008-131-0x00007FF7D6BA0000-0x00007FF7D6EF1000-memory.dmp	xmrig
behavioral2/memory/4088-1642-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp	xmrig
behavioral2/memory/1008-1964-0x00007FF7D6BA0000-0x00007FF7D6EF1000-memory.dmp	xmrig
behavioral2/memory/2928-1998-0x00007FF605210000-0x00007FF605561000-memory.dmp	xmrig
behavioral2/memory/692-2000-0x00007FF679B30000-0x00007FF679E81000-memory.dmp	xmrig
behavioral2/memory/2880-2035-0x00007FF7689F0000-0x00007FF768D41000-memory.dmp	xmrig
behavioral2/memory/2732-2097-0x00007FF76B620000-0x00007FF76B971000-memory.dmp	xmrig
behavioral2/memory/1336-2027-0x00007FF64ACE0000-0x00007FF64B031000-memory.dmp	xmrig
behavioral2/memory/4568-2006-0x00007FF707310000-0x00007FF707661000-memory.dmp	xmrig
behavioral2/memory/1900-2057-0x00007FF629BD0000-0x00007FF629F21000-memory.dmp	xmrig
behavioral2/memory/5108-2098-0x00007FF7ACC60000-0x00007FF7ACFB1000-memory.dmp	xmrig
behavioral2/memory/4628-2086-0x00007FF7D98A0000-0x00007FF7D9BF1000-memory.dmp	xmrig
behavioral2/memory/3104-2083-0x00007FF610A40000-0x00007FF610D91000-memory.dmp	xmrig
behavioral2/memory/4524-2080-0x00007FF722780000-0x00007FF722AD1000-memory.dmp	xmrig
behavioral2/memory/500-2075-0x00007FF65E600000-0x00007FF65E951000-memory.dmp	xmrig
behavioral2/memory/2388-2049-0x00007FF7F7310000-0x00007FF7F7661000-memory.dmp	xmrig
behavioral2/memory/3740-2046-0x00007FF66D4A0000-0x00007FF66D7F1000-memory.dmp	xmrig
behavioral2/memory/4196-2040-0x00007FF7B1640000-0x00007FF7B1991000-memory.dmp	xmrig
behavioral2/memory/4072-2008-0x00007FF69CF90000-0x00007FF69D2E1000-memory.dmp	xmrig
behavioral2/memory/2660-1960-0x00007FF762090000-0x00007FF7623E1000-memory.dmp	xmrig
behavioral2/memory/4696-1958-0x00007FF68A6D0000-0x00007FF68AA21000-memory.dmp	xmrig
behavioral2/memory/2184-1885-0x00007FF6EE6F0000-0x00007FF6EEA41000-memory.dmp	xmrig
behavioral2/memory/4744-1884-0x00007FF6BE5C0000-0x00007FF6BE911000-memory.dmp	xmrig
behavioral2/memory/4992-2178-0x00007FF71F910000-0x00007FF71FC61000-memory.dmp	xmrig
behavioral2/memory/2848-1879-0x00007FF6B4C10000-0x00007FF6B4F61000-memory.dmp	xmrig
behavioral2/memory/3736-1761-0x00007FF63D8B0000-0x00007FF63DC01000-memory.dmp	xmrig
behavioral2/memory/2236-1748-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp	xmrig
behavioral2/memory/1192-1680-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp	xmrig
behavioral2/memory/3736-1018-0x00007FF63D8B0000-0x00007FF63DC01000-memory.dmp	xmrig
behavioral2/memory/4984-2378-0x00007FF667C20000-0x00007FF667F71000-memory.dmp	xmrig
behavioral2/memory/4856-2383-0x00007FF6C5F20000-0x00007FF6C6271000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2236	dDEvcDT.exe
4088	FFkSwMs.exe
1192	WHROqeY.exe
3736	dRUZTnh.exe
2184	eHaHaxr.exe
4744	qLtIFio.exe
2848	kZylrma.exe
2732	pVHmqAy.exe
4992	iroXGYJ.exe
4696	uJvvgyp.exe
2660	bTMAEMB.exe
2928	CxDEuvy.exe
692	IYwwcPF.exe
1008	AKqlNDD.exe
4524	OPmyKZf.exe
5108	dYpWDEH.exe
1336	JnEoGop.exe
2388	gelGyOY.exe
1900	BETHSCF.exe
4568	SjlJrjj.exe
2880	CGaFyDn.exe
3104	ycXnkdD.exe
500	pKeQmFx.exe
4628	WpzROZs.exe
3740	GgSIeqR.exe
4072	XuvTLUJ.exe
4196	GSTbUtJ.exe
4856	HBTaBGR.exe
4984	gwAbogZ.exe
1300	ORCbEXB.exe
4252	drvVEGQ.exe
1040	CCyQwZN.exe
3228	SziTQZA.exe
4064	zeEtPhT.exe
2908	wHCpJbT.exe
376	NFNaKZm.exe
1416	frOSKsM.exe
3896	fgcQXif.exe
3540	wcmYtkc.exe
644	yrunEmW.exe
1172	sdAcGlU.exe
5052	IxiJRJh.exe
640	erTCKhQ.exe
4636	oMibGrV.exe
5080	BJriVnA.exe
4516	RzOYrwN.exe
4884	uKKciQj.exe
2788	gYzONTM.exe
3096	TSgPzIG.exe
4208	fAhxlfQ.exe
1136	ROCuCQN.exe
656	BvXPQUO.exe
964	ThRJiwI.exe
3844	ILxZxHw.exe
3368	gIlbvWK.exe
2172	AsuiRXF.exe
2460	oSvKvkH.exe
4892	xMVODDt.exe
1720	MYsBdKc.exe
552	ZwPxpTW.exe
2380	BSopqPl.exe
1104	JkaMYjL.exe
3232	mlOTIWw.exe
4704	pVbildu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2240-0-0x00007FF7260F0000-0x00007FF726441000-memory.dmp	upx
behavioral2/files/0x0008000000023256-4.dat	upx
behavioral2/memory/2236-9-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp	upx
behavioral2/files/0x0008000000023259-12.dat	upx
behavioral2/files/0x000800000002325e-19.dat	upx
behavioral2/files/0x000800000002325d-22.dat	upx
behavioral2/memory/3736-27-0x00007FF63D8B0000-0x00007FF63DC01000-memory.dmp	upx
behavioral2/files/0x000700000002325f-28.dat	upx
behavioral2/memory/2184-32-0x00007FF6EE6F0000-0x00007FF6EEA41000-memory.dmp	upx
behavioral2/memory/1192-21-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp	upx
behavioral2/memory/4088-17-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp	upx
behavioral2/files/0x000800000002325b-33.dat	upx
behavioral2/files/0x0007000000023260-39.dat	upx
behavioral2/memory/4744-43-0x00007FF6BE5C0000-0x00007FF6BE911000-memory.dmp	upx
behavioral2/memory/2848-44-0x00007FF6B4C10000-0x00007FF6B4F61000-memory.dmp	upx
behavioral2/files/0x0007000000023261-47.dat	upx
behavioral2/files/0x0007000000023262-52.dat	upx
behavioral2/memory/2732-54-0x00007FF76B620000-0x00007FF76B971000-memory.dmp	upx
behavioral2/files/0x0007000000023263-59.dat	upx
behavioral2/memory/2240-57-0x00007FF7260F0000-0x00007FF726441000-memory.dmp	upx
behavioral2/memory/4992-60-0x00007FF71F910000-0x00007FF71FC61000-memory.dmp	upx
behavioral2/memory/2236-61-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp	upx
behavioral2/files/0x0007000000023266-73.dat	upx
behavioral2/files/0x0007000000023265-80.dat	upx
behavioral2/files/0x0007000000023267-86.dat	upx
behavioral2/memory/2660-83-0x00007FF762090000-0x00007FF7623E1000-memory.dmp	upx
behavioral2/memory/4088-77-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp	upx
behavioral2/memory/2928-76-0x00007FF605210000-0x00007FF605561000-memory.dmp	upx
behavioral2/files/0x0007000000023264-74.dat	upx
behavioral2/memory/4696-72-0x00007FF68A6D0000-0x00007FF68AA21000-memory.dmp	upx
behavioral2/memory/692-93-0x00007FF679B30000-0x00007FF679E81000-memory.dmp	upx
behavioral2/memory/4524-105-0x00007FF722780000-0x00007FF722AD1000-memory.dmp	upx
behavioral2/files/0x000700000002326d-115.dat	upx
behavioral2/memory/5108-145-0x00007FF7ACC60000-0x00007FF7ACFB1000-memory.dmp	upx
behavioral2/files/0x0007000000023276-157.dat	upx
behavioral2/files/0x000700000002327a-176.dat	upx
behavioral2/memory/4628-189-0x00007FF7D98A0000-0x00007FF7D9BF1000-memory.dmp	upx
behavioral2/memory/1192-194-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp	upx
behavioral2/memory/4984-197-0x00007FF667C20000-0x00007FF667F71000-memory.dmp	upx
behavioral2/memory/4072-196-0x00007FF69CF90000-0x00007FF69D2E1000-memory.dmp	upx
behavioral2/memory/500-195-0x00007FF65E600000-0x00007FF65E951000-memory.dmp	upx
behavioral2/memory/4856-193-0x00007FF6C5F20000-0x00007FF6C6271000-memory.dmp	upx
behavioral2/memory/4196-192-0x00007FF7B1640000-0x00007FF7B1991000-memory.dmp	upx
behavioral2/memory/3740-191-0x00007FF66D4A0000-0x00007FF66D7F1000-memory.dmp	upx
behavioral2/files/0x0007000000023277-187.dat	upx
behavioral2/files/0x000700000002327d-186.dat	upx
behavioral2/files/0x0007000000023275-183.dat	upx
behavioral2/files/0x000700000002327c-181.dat	upx
behavioral2/files/0x0007000000023274-180.dat	upx
behavioral2/files/0x000700000002327b-179.dat	upx
behavioral2/memory/3104-175-0x00007FF610A40000-0x00007FF610D91000-memory.dmp	upx
behavioral2/files/0x0007000000023279-174.dat	upx
behavioral2/files/0x0007000000023278-173.dat	upx
behavioral2/files/0x0007000000023273-170.dat	upx
behavioral2/files/0x0007000000023272-165.dat	upx
behavioral2/files/0x0007000000023271-161.dat	upx
behavioral2/memory/2880-160-0x00007FF7689F0000-0x00007FF768D41000-memory.dmp	upx
behavioral2/memory/1900-150-0x00007FF629BD0000-0x00007FF629F21000-memory.dmp	upx
behavioral2/files/0x0007000000023270-132.dat	upx
behavioral2/memory/1008-131-0x00007FF7D6BA0000-0x00007FF7D6EF1000-memory.dmp	upx
behavioral2/files/0x000700000002326f-129.dat	upx
behavioral2/memory/4568-128-0x00007FF707310000-0x00007FF707661000-memory.dmp	upx
behavioral2/files/0x000700000002326b-125.dat	upx
behavioral2/files/0x000700000002326e-123.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BiQChiz.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\JDvlkRb.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\xJwySWH.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\qEBfCHT.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\BoBBumz.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\wyhnnoh.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\VwyheMf.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\absHcMR.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\pljhtoM.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\TtMPMor.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\TKPmLgc.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\gBVEPgS.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\dbKZvYH.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\ISxJuJh.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\aDXCNQr.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\UTgVnSj.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\kSFLjPD.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\gCCJjQq.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\oPRmfor.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\ewlcUBt.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\AyMupLl.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\BMOfmDH.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\FuhLbFH.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\XuXIaIo.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\fgcQXif.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\yeTBbfj.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\TsVULPl.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\fQPZfMk.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\SsUjQvQ.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\GeQBnIl.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\kifiljS.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\pVHmqAy.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\gSAbPrb.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\SjjOGRQ.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\aYOipty.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\VWayzgH.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\okDdQgY.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\KVDAAET.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\sOcsTjz.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\eScfoqw.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\nCNEjOC.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\oQGKouZ.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\BETHSCF.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\DXOBtiw.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\jsKyqkV.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\xOFcjLb.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\RvntKgQ.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\NZfFodb.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\CxDEuvy.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\gIlbvWK.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\cJwuMfz.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\bZFrQtc.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\GQvcYrg.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\NqrLSyf.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\xvlphWM.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\SdXZDfH.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\sysyVDx.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\hsuYUPX.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\szcvrXQ.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\eMMQWjS.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\kXYLUDd.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\NkbXrsw.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\VEFeJWI.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
File created	C:\Windows\System\xCeJBBo.exe	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2236	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	91
PID 2240 wrote to memory of 2236	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	91
PID 2240 wrote to memory of 4088	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	92
PID 2240 wrote to memory of 4088	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	92
PID 2240 wrote to memory of 1192	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	93
PID 2240 wrote to memory of 1192	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	93
PID 2240 wrote to memory of 3736	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	94
PID 2240 wrote to memory of 3736	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	94
PID 2240 wrote to memory of 2184	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	95
PID 2240 wrote to memory of 2184	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	95
PID 2240 wrote to memory of 4744	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	96
PID 2240 wrote to memory of 4744	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	96
PID 2240 wrote to memory of 2848	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	97
PID 2240 wrote to memory of 2848	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	97
PID 2240 wrote to memory of 2732	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	98
PID 2240 wrote to memory of 2732	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	98
PID 2240 wrote to memory of 4992	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	99
PID 2240 wrote to memory of 4992	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	99
PID 2240 wrote to memory of 4696	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	100
PID 2240 wrote to memory of 4696	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	100
PID 2240 wrote to memory of 2660	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	101
PID 2240 wrote to memory of 2660	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	101
PID 2240 wrote to memory of 2928	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	102
PID 2240 wrote to memory of 2928	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	102
PID 2240 wrote to memory of 692	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	103
PID 2240 wrote to memory of 692	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	103
PID 2240 wrote to memory of 1008	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	104
PID 2240 wrote to memory of 1008	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	104
PID 2240 wrote to memory of 4524	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	105
PID 2240 wrote to memory of 4524	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	105
PID 2240 wrote to memory of 5108	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	106
PID 2240 wrote to memory of 5108	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	106
PID 2240 wrote to memory of 1336	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	107
PID 2240 wrote to memory of 1336	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	107
PID 2240 wrote to memory of 2388	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	108
PID 2240 wrote to memory of 2388	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	108
PID 2240 wrote to memory of 1900	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	109
PID 2240 wrote to memory of 1900	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	109
PID 2240 wrote to memory of 4568	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	110
PID 2240 wrote to memory of 4568	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	110
PID 2240 wrote to memory of 2880	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	111
PID 2240 wrote to memory of 2880	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	111
PID 2240 wrote to memory of 3104	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	112
PID 2240 wrote to memory of 3104	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	112
PID 2240 wrote to memory of 500	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	113
PID 2240 wrote to memory of 500	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	113
PID 2240 wrote to memory of 4628	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	114
PID 2240 wrote to memory of 4628	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	114
PID 2240 wrote to memory of 3740	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	115
PID 2240 wrote to memory of 3740	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	115
PID 2240 wrote to memory of 4072	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	116
PID 2240 wrote to memory of 4072	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	116
PID 2240 wrote to memory of 4196	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	117
PID 2240 wrote to memory of 4196	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	117
PID 2240 wrote to memory of 4856	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	118
PID 2240 wrote to memory of 4856	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	118
PID 2240 wrote to memory of 4984	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	119
PID 2240 wrote to memory of 4984	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	119
PID 2240 wrote to memory of 1300	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	120
PID 2240 wrote to memory of 1300	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	120
PID 2240 wrote to memory of 4252	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	121
PID 2240 wrote to memory of 4252	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	121
PID 2240 wrote to memory of 1040	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	122
PID 2240 wrote to memory of 1040	2240	4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d9bd6fc9c3fd032160b8993c9283d70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System\dDEvcDT.exe
  C:\Windows\System\dDEvcDT.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\FFkSwMs.exe
  C:\Windows\System\FFkSwMs.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\WHROqeY.exe
  C:\Windows\System\WHROqeY.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\dRUZTnh.exe
  C:\Windows\System\dRUZTnh.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\eHaHaxr.exe
  C:\Windows\System\eHaHaxr.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\qLtIFio.exe
  C:\Windows\System\qLtIFio.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\kZylrma.exe
  C:\Windows\System\kZylrma.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\pVHmqAy.exe
  C:\Windows\System\pVHmqAy.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\iroXGYJ.exe
  C:\Windows\System\iroXGYJ.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\uJvvgyp.exe
  C:\Windows\System\uJvvgyp.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\bTMAEMB.exe
  C:\Windows\System\bTMAEMB.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\CxDEuvy.exe
  C:\Windows\System\CxDEuvy.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\IYwwcPF.exe
  C:\Windows\System\IYwwcPF.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\AKqlNDD.exe
  C:\Windows\System\AKqlNDD.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\OPmyKZf.exe
  C:\Windows\System\OPmyKZf.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\dYpWDEH.exe
  C:\Windows\System\dYpWDEH.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\JnEoGop.exe
  C:\Windows\System\JnEoGop.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\gelGyOY.exe
  C:\Windows\System\gelGyOY.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\BETHSCF.exe
  C:\Windows\System\BETHSCF.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\SjlJrjj.exe
  C:\Windows\System\SjlJrjj.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\CGaFyDn.exe
  C:\Windows\System\CGaFyDn.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ycXnkdD.exe
  C:\Windows\System\ycXnkdD.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\pKeQmFx.exe
  C:\Windows\System\pKeQmFx.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\WpzROZs.exe
  C:\Windows\System\WpzROZs.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\GgSIeqR.exe
  C:\Windows\System\GgSIeqR.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\XuvTLUJ.exe
  C:\Windows\System\XuvTLUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\GSTbUtJ.exe
  C:\Windows\System\GSTbUtJ.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\HBTaBGR.exe
  C:\Windows\System\HBTaBGR.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\gwAbogZ.exe
  C:\Windows\System\gwAbogZ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ORCbEXB.exe
  C:\Windows\System\ORCbEXB.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\drvVEGQ.exe
  C:\Windows\System\drvVEGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\CCyQwZN.exe
  C:\Windows\System\CCyQwZN.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\SziTQZA.exe
  C:\Windows\System\SziTQZA.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\zeEtPhT.exe
  C:\Windows\System\zeEtPhT.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\wHCpJbT.exe
  C:\Windows\System\wHCpJbT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\NFNaKZm.exe
  C:\Windows\System\NFNaKZm.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\frOSKsM.exe
  C:\Windows\System\frOSKsM.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\fgcQXif.exe
  C:\Windows\System\fgcQXif.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\wcmYtkc.exe
  C:\Windows\System\wcmYtkc.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\yrunEmW.exe
  C:\Windows\System\yrunEmW.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\sdAcGlU.exe
  C:\Windows\System\sdAcGlU.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\IxiJRJh.exe
  C:\Windows\System\IxiJRJh.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\erTCKhQ.exe
  C:\Windows\System\erTCKhQ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\oMibGrV.exe
  C:\Windows\System\oMibGrV.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\BJriVnA.exe
  C:\Windows\System\BJriVnA.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\RzOYrwN.exe
  C:\Windows\System\RzOYrwN.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\uKKciQj.exe
  C:\Windows\System\uKKciQj.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\gYzONTM.exe
  C:\Windows\System\gYzONTM.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\TSgPzIG.exe
  C:\Windows\System\TSgPzIG.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\fAhxlfQ.exe
  C:\Windows\System\fAhxlfQ.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\ROCuCQN.exe
  C:\Windows\System\ROCuCQN.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\BvXPQUO.exe
  C:\Windows\System\BvXPQUO.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\ThRJiwI.exe
  C:\Windows\System\ThRJiwI.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\gIlbvWK.exe
  C:\Windows\System\gIlbvWK.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\ILxZxHw.exe
  C:\Windows\System\ILxZxHw.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\AsuiRXF.exe
  C:\Windows\System\AsuiRXF.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\oSvKvkH.exe
  C:\Windows\System\oSvKvkH.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\xMVODDt.exe
  C:\Windows\System\xMVODDt.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\MYsBdKc.exe
  C:\Windows\System\MYsBdKc.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ZwPxpTW.exe
  C:\Windows\System\ZwPxpTW.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\BSopqPl.exe
  C:\Windows\System\BSopqPl.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\JkaMYjL.exe
  C:\Windows\System\JkaMYjL.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\mlOTIWw.exe
  C:\Windows\System\mlOTIWw.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\pVbildu.exe
  C:\Windows\System\pVbildu.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\MOOHnOC.exe
  C:\Windows\System\MOOHnOC.exe
  2⤵
  PID:2256
- C:\Windows\System\YDWRUOM.exe
  C:\Windows\System\YDWRUOM.exe
  2⤵
  PID:2292
- C:\Windows\System\MmhYdjI.exe
  C:\Windows\System\MmhYdjI.exe
  2⤵
  PID:924
- C:\Windows\System\SMmYYoN.exe
  C:\Windows\System\SMmYYoN.exe
  2⤵
  PID:2208
- C:\Windows\System\StBEWeW.exe
  C:\Windows\System\StBEWeW.exe
  2⤵
  PID:4060
- C:\Windows\System\PpBQsiA.exe
  C:\Windows\System\PpBQsiA.exe
  2⤵
  PID:1068
- C:\Windows\System\RhQTkBH.exe
  C:\Windows\System\RhQTkBH.exe
  2⤵
  PID:1812
- C:\Windows\System\HfxCmWr.exe
  C:\Windows\System\HfxCmWr.exe
  2⤵
  PID:2608
- C:\Windows\System\vbkbTiS.exe
  C:\Windows\System\vbkbTiS.exe
  2⤵
  PID:3508
- C:\Windows\System\WeAyBdB.exe
  C:\Windows\System\WeAyBdB.exe
  2⤵
  PID:3828
- C:\Windows\System\rGmrgVp.exe
  C:\Windows\System\rGmrgVp.exe
  2⤵
  PID:4476
- C:\Windows\System\xCeJBBo.exe
  C:\Windows\System\xCeJBBo.exe
  2⤵
  PID:2072
- C:\Windows\System\UVINIaH.exe
  C:\Windows\System\UVINIaH.exe
  2⤵
  PID:1188
- C:\Windows\System\DMrYhxx.exe
  C:\Windows\System\DMrYhxx.exe
  2⤵
  PID:2820
- C:\Windows\System\MZjVCYJ.exe
  C:\Windows\System\MZjVCYJ.exe
  2⤵
  PID:4396
- C:\Windows\System\DpbhpzG.exe
  C:\Windows\System\DpbhpzG.exe
  2⤵
  PID:684
- C:\Windows\System\MPZxJYV.exe
  C:\Windows\System\MPZxJYV.exe
  2⤵
  PID:788
- C:\Windows\System\ewlcUBt.exe
  C:\Windows\System\ewlcUBt.exe
  2⤵
  PID:3036
- C:\Windows\System\tdoUeDg.exe
  C:\Windows\System\tdoUeDg.exe
  2⤵
  PID:1164
- C:\Windows\System\qEBfCHT.exe
  C:\Windows\System\qEBfCHT.exe
  2⤵
  PID:4608
- C:\Windows\System\hUmfPpd.exe
  C:\Windows\System\hUmfPpd.exe
  2⤵
  PID:4624
- C:\Windows\System\QOjlPtd.exe
  C:\Windows\System\QOjlPtd.exe
  2⤵
  PID:5124
- C:\Windows\System\YvAgPxO.exe
  C:\Windows\System\YvAgPxO.exe
  2⤵
  PID:5144
- C:\Windows\System\BHXnYth.exe
  C:\Windows\System\BHXnYth.exe
  2⤵
  PID:5164
- C:\Windows\System\pOSDFih.exe
  C:\Windows\System\pOSDFih.exe
  2⤵
  PID:5184
- C:\Windows\System\EBDtTFf.exe
  C:\Windows\System\EBDtTFf.exe
  2⤵
  PID:5208
- C:\Windows\System\OLsRPDn.exe
  C:\Windows\System\OLsRPDn.exe
  2⤵
  PID:5228
- C:\Windows\System\oIjdZxl.exe
  C:\Windows\System\oIjdZxl.exe
  2⤵
  PID:5248
- C:\Windows\System\omreWJL.exe
  C:\Windows\System\omreWJL.exe
  2⤵
  PID:5268
- C:\Windows\System\rhrERqq.exe
  C:\Windows\System\rhrERqq.exe
  2⤵
  PID:5288
- C:\Windows\System\gGPxbiI.exe
  C:\Windows\System\gGPxbiI.exe
  2⤵
  PID:5308
- C:\Windows\System\frVcfsP.exe
  C:\Windows\System\frVcfsP.exe
  2⤵
  PID:5328
- C:\Windows\System\ZltYBYR.exe
  C:\Windows\System\ZltYBYR.exe
  2⤵
  PID:5344
- C:\Windows\System\LfcTWTu.exe
  C:\Windows\System\LfcTWTu.exe
  2⤵
  PID:5372
- C:\Windows\System\gBVEPgS.exe
  C:\Windows\System\gBVEPgS.exe
  2⤵
  PID:5396
- C:\Windows\System\LydWdqo.exe
  C:\Windows\System\LydWdqo.exe
  2⤵
  PID:5412
- C:\Windows\System\fWpfHQI.exe
  C:\Windows\System\fWpfHQI.exe
  2⤵
  PID:5440
- C:\Windows\System\spxNktV.exe
  C:\Windows\System\spxNktV.exe
  2⤵
  PID:5460
- C:\Windows\System\AcXNMgO.exe
  C:\Windows\System\AcXNMgO.exe
  2⤵
  PID:5476
- C:\Windows\System\CgOxaNy.exe
  C:\Windows\System\CgOxaNy.exe
  2⤵
  PID:5500
- C:\Windows\System\vVvjXhS.exe
  C:\Windows\System\vVvjXhS.exe
  2⤵
  PID:5520
- C:\Windows\System\gnvFfWG.exe
  C:\Windows\System\gnvFfWG.exe
  2⤵
  PID:5536
- C:\Windows\System\lEKYerZ.exe
  C:\Windows\System\lEKYerZ.exe
  2⤵
  PID:5560
- C:\Windows\System\RuEaJCr.exe
  C:\Windows\System\RuEaJCr.exe
  2⤵
  PID:5580
- C:\Windows\System\qZGFrDB.exe
  C:\Windows\System\qZGFrDB.exe
  2⤵
  PID:5604
- C:\Windows\System\yeTBbfj.exe
  C:\Windows\System\yeTBbfj.exe
  2⤵
  PID:5624
- C:\Windows\System\sOcsTjz.exe
  C:\Windows\System\sOcsTjz.exe
  2⤵
  PID:5648
- C:\Windows\System\KOBNwUM.exe
  C:\Windows\System\KOBNwUM.exe
  2⤵
  PID:5664
- C:\Windows\System\IATCIXQ.exe
  C:\Windows\System\IATCIXQ.exe
  2⤵
  PID:5688
- C:\Windows\System\HOzJeJD.exe
  C:\Windows\System\HOzJeJD.exe
  2⤵
  PID:5712
- C:\Windows\System\rOoOUBf.exe
  C:\Windows\System\rOoOUBf.exe
  2⤵
  PID:5736
- C:\Windows\System\uzYipbz.exe
  C:\Windows\System\uzYipbz.exe
  2⤵
  PID:5752
- C:\Windows\System\GjVPckE.exe
  C:\Windows\System\GjVPckE.exe
  2⤵
  PID:5772
- C:\Windows\System\mpqVIyb.exe
  C:\Windows\System\mpqVIyb.exe
  2⤵
  PID:5976
- C:\Windows\System\eYCAhkZ.exe
  C:\Windows\System\eYCAhkZ.exe
  2⤵
  PID:5996
- C:\Windows\System\sysyVDx.exe
  C:\Windows\System\sysyVDx.exe
  2⤵
  PID:6012
- C:\Windows\System\qYLbQeH.exe
  C:\Windows\System\qYLbQeH.exe
  2⤵
  PID:6032
- C:\Windows\System\tEhgwWb.exe
  C:\Windows\System\tEhgwWb.exe
  2⤵
  PID:6052
- C:\Windows\System\UvuLkKC.exe
  C:\Windows\System\UvuLkKC.exe
  2⤵
  PID:6072
- C:\Windows\System\MDeuAYP.exe
  C:\Windows\System\MDeuAYP.exe
  2⤵
  PID:6088
- C:\Windows\System\zHALmwf.exe
  C:\Windows\System\zHALmwf.exe
  2⤵
  PID:6108
- C:\Windows\System\EUOnsAQ.exe
  C:\Windows\System\EUOnsAQ.exe
  2⤵
  PID:6128
- C:\Windows\System\NqsUJGm.exe
  C:\Windows\System\NqsUJGm.exe
  2⤵
  PID:4400
- C:\Windows\System\VzaJdOK.exe
  C:\Windows\System\VzaJdOK.exe
  2⤵
  PID:3872
- C:\Windows\System\LvrtKIh.exe
  C:\Windows\System\LvrtKIh.exe
  2⤵
  PID:4480
- C:\Windows\System\hHkJBUm.exe
  C:\Windows\System\hHkJBUm.exe
  2⤵
  PID:5200
- C:\Windows\System\yDVCRZH.exe
  C:\Windows\System\yDVCRZH.exe
  2⤵
  PID:5320
- C:\Windows\System\YbWhYsw.exe
  C:\Windows\System\YbWhYsw.exe
  2⤵
  PID:5160
- C:\Windows\System\xtQtERU.exe
  C:\Windows\System\xtQtERU.exe
  2⤵
  PID:5176
- C:\Windows\System\ZUsqicc.exe
  C:\Windows\System\ZUsqicc.exe
  2⤵
  PID:5448
- C:\Windows\System\TFsGHOQ.exe
  C:\Windows\System\TFsGHOQ.exe
  2⤵
  PID:5576
- C:\Windows\System\FPziydC.exe
  C:\Windows\System\FPziydC.exe
  2⤵
  PID:5660
- C:\Windows\System\hsuYUPX.exe
  C:\Windows\System\hsuYUPX.exe
  2⤵
  PID:5316
- C:\Windows\System\ZBRdrwD.exe
  C:\Windows\System\ZBRdrwD.exe
  2⤵
  PID:5512
- C:\Windows\System\acNOklX.exe
  C:\Windows\System\acNOklX.exe
  2⤵
  PID:5420
- C:\Windows\System\BsjniSC.exe
  C:\Windows\System\BsjniSC.exe
  2⤵
  PID:5472
- C:\Windows\System\cJwuMfz.exe
  C:\Windows\System\cJwuMfz.exe
  2⤵
  PID:5780
- C:\Windows\System\GzGQoSz.exe
  C:\Windows\System\GzGQoSz.exe
  2⤵
  PID:5596
- C:\Windows\System\moOhtGD.exe
  C:\Windows\System\moOhtGD.exe
  2⤵
  PID:5656
- C:\Windows\System\sEpspKO.exe
  C:\Windows\System\sEpspKO.exe
  2⤵
  PID:6008
- C:\Windows\System\xTZZYXu.exe
  C:\Windows\System\xTZZYXu.exe
  2⤵
  PID:6064
- C:\Windows\System\EpdFoMX.exe
  C:\Windows\System\EpdFoMX.exe
  2⤵
  PID:5140
- C:\Windows\System\ppoOmos.exe
  C:\Windows\System\ppoOmos.exe
  2⤵
  PID:5244
- C:\Windows\System\kibAQRb.exe
  C:\Windows\System\kibAQRb.exe
  2⤵
  PID:5788
- C:\Windows\System\HoOZqIi.exe
  C:\Windows\System\HoOZqIi.exe
  2⤵
  PID:5340
- C:\Windows\System\zlpQtgn.exe
  C:\Windows\System\zlpQtgn.exe
  2⤵
  PID:6160
- C:\Windows\System\oMgSPIm.exe
  C:\Windows\System\oMgSPIm.exe
  2⤵
  PID:6180
- C:\Windows\System\GsTNbVp.exe
  C:\Windows\System\GsTNbVp.exe
  2⤵
  PID:6200
- C:\Windows\System\tYMuGkS.exe
  C:\Windows\System\tYMuGkS.exe
  2⤵
  PID:6224
- C:\Windows\System\wyvzAqy.exe
  C:\Windows\System\wyvzAqy.exe
  2⤵
  PID:6240
- C:\Windows\System\OHyvfmO.exe
  C:\Windows\System\OHyvfmO.exe
  2⤵
  PID:6264
- C:\Windows\System\qTIlrYC.exe
  C:\Windows\System\qTIlrYC.exe
  2⤵
  PID:6284
- C:\Windows\System\zTZKhek.exe
  C:\Windows\System\zTZKhek.exe
  2⤵
  PID:6300
- C:\Windows\System\QlnGdkv.exe
  C:\Windows\System\QlnGdkv.exe
  2⤵
  PID:6320
- C:\Windows\System\XpOniZV.exe
  C:\Windows\System\XpOniZV.exe
  2⤵
  PID:6344
- C:\Windows\System\OhcDAUb.exe
  C:\Windows\System\OhcDAUb.exe
  2⤵
  PID:6368
- C:\Windows\System\tzeLKVd.exe
  C:\Windows\System\tzeLKVd.exe
  2⤵
  PID:6388
- C:\Windows\System\yngEqRz.exe
  C:\Windows\System\yngEqRz.exe
  2⤵
  PID:6412
- C:\Windows\System\ztjcBLb.exe
  C:\Windows\System\ztjcBLb.exe
  2⤵
  PID:6432
- C:\Windows\System\NMSkPtu.exe
  C:\Windows\System\NMSkPtu.exe
  2⤵
  PID:6684
- C:\Windows\System\eTwcJpC.exe
  C:\Windows\System\eTwcJpC.exe
  2⤵
  PID:6708
- C:\Windows\System\vetvEng.exe
  C:\Windows\System\vetvEng.exe
  2⤵
  PID:6732
- C:\Windows\System\txCPDSL.exe
  C:\Windows\System\txCPDSL.exe
  2⤵
  PID:6752
- C:\Windows\System\VESqaYU.exe
  C:\Windows\System\VESqaYU.exe
  2⤵
  PID:6776
- C:\Windows\System\gSAbPrb.exe
  C:\Windows\System\gSAbPrb.exe
  2⤵
  PID:6792
- C:\Windows\System\DcsUNHl.exe
  C:\Windows\System\DcsUNHl.exe
  2⤵
  PID:6820
- C:\Windows\System\szcvrXQ.exe
  C:\Windows\System\szcvrXQ.exe
  2⤵
  PID:6844
- C:\Windows\System\MsEnCEh.exe
  C:\Windows\System\MsEnCEh.exe
  2⤵
  PID:6864
- C:\Windows\System\TRUETzU.exe
  C:\Windows\System\TRUETzU.exe
  2⤵
  PID:6888
- C:\Windows\System\YtxgNRl.exe
  C:\Windows\System\YtxgNRl.exe
  2⤵
  PID:6916
- C:\Windows\System\jAxdnkr.exe
  C:\Windows\System\jAxdnkr.exe
  2⤵
  PID:6932
- C:\Windows\System\GesoQaB.exe
  C:\Windows\System\GesoQaB.exe
  2⤵
  PID:6952
- C:\Windows\System\VDYmsVv.exe
  C:\Windows\System\VDYmsVv.exe
  2⤵
  PID:6968
- C:\Windows\System\ameooJJ.exe
  C:\Windows\System\ameooJJ.exe
  2⤵
  PID:6984
- C:\Windows\System\MubJLOL.exe
  C:\Windows\System\MubJLOL.exe
  2⤵
  PID:7000
- C:\Windows\System\MXOssBN.exe
  C:\Windows\System\MXOssBN.exe
  2⤵
  PID:7020
- C:\Windows\System\EpVlnNl.exe
  C:\Windows\System\EpVlnNl.exe
  2⤵
  PID:7052
- C:\Windows\System\OTFZIMD.exe
  C:\Windows\System\OTFZIMD.exe
  2⤵
  PID:7068
- C:\Windows\System\VhCEkQt.exe
  C:\Windows\System\VhCEkQt.exe
  2⤵
  PID:7084
- C:\Windows\System\byOZHnY.exe
  C:\Windows\System\byOZHnY.exe
  2⤵
  PID:7108
- C:\Windows\System\oWshles.exe
  C:\Windows\System\oWshles.exe
  2⤵
  PID:7128
- C:\Windows\System\ZqFWaOk.exe
  C:\Windows\System\ZqFWaOk.exe
  2⤵
  PID:7148
- C:\Windows\System\jcokUsr.exe
  C:\Windows\System\jcokUsr.exe
  2⤵
  PID:5276
- C:\Windows\System\hPWBWEQ.exe
  C:\Windows\System\hPWBWEQ.exe
  2⤵
  PID:5456
- C:\Windows\System\YbNXUmK.exe
  C:\Windows\System\YbNXUmK.exe
  2⤵
  PID:5468
- C:\Windows\System\AMlBvTB.exe
  C:\Windows\System\AMlBvTB.exe
  2⤵
  PID:5156
- C:\Windows\System\SLsrtoE.exe
  C:\Windows\System\SLsrtoE.exe
  2⤵
  PID:5620
- C:\Windows\System\dbKZvYH.exe
  C:\Windows\System\dbKZvYH.exe
  2⤵
  PID:6048
- C:\Windows\System\YHpNYFn.exe
  C:\Windows\System\YHpNYFn.exe
  2⤵
  PID:3272
- C:\Windows\System\uyWoECX.exe
  C:\Windows\System\uyWoECX.exe
  2⤵
  PID:5696
- C:\Windows\System\rTSbvUb.exe
  C:\Windows\System\rTSbvUb.exe
  2⤵
  PID:6236
- C:\Windows\System\bYsQoyk.exe
  C:\Windows\System\bYsQoyk.exe
  2⤵
  PID:5492
- C:\Windows\System\EMYuOYr.exe
  C:\Windows\System\EMYuOYr.exe
  2⤵
  PID:5960
- C:\Windows\System\JbsBIBo.exe
  C:\Windows\System\JbsBIBo.exe
  2⤵
  PID:6148
- C:\Windows\System\mSKjBla.exe
  C:\Windows\System\mSKjBla.exe
  2⤵
  PID:6248
- C:\Windows\System\CLJJkJb.exe
  C:\Windows\System\CLJJkJb.exe
  2⤵
  PID:6316
- C:\Windows\System\QZJjbDx.exe
  C:\Windows\System\QZJjbDx.exe
  2⤵
  PID:6408
- C:\Windows\System\wfJImoP.exe
  C:\Windows\System\wfJImoP.exe
  2⤵
  PID:6584
- C:\Windows\System\sZYwuDj.exe
  C:\Windows\System\sZYwuDj.exe
  2⤵
  PID:6600
- C:\Windows\System\OrniLBM.exe
  C:\Windows\System\OrniLBM.exe
  2⤵
  PID:2888
- C:\Windows\System\aIdjiMQ.exe
  C:\Windows\System\aIdjiMQ.exe
  2⤵
  PID:5680
- C:\Windows\System\PbnuaxF.exe
  C:\Windows\System\PbnuaxF.exe
  2⤵
  PID:6748
- C:\Windows\System\eMMQWjS.exe
  C:\Windows\System\eMMQWjS.exe
  2⤵
  PID:6784
- C:\Windows\System\AyMupLl.exe
  C:\Windows\System\AyMupLl.exe
  2⤵
  PID:6852
- C:\Windows\System\jkPBGYT.exe
  C:\Windows\System\jkPBGYT.exe
  2⤵
  PID:6540
- C:\Windows\System\QFVSAzo.exe
  C:\Windows\System\QFVSAzo.exe
  2⤵
  PID:7176
- C:\Windows\System\MAszbGH.exe
  C:\Windows\System\MAszbGH.exe
  2⤵
  PID:7196
- C:\Windows\System\WRjqOaL.exe
  C:\Windows\System\WRjqOaL.exe
  2⤵
  PID:7212
- C:\Windows\System\oziLWzh.exe
  C:\Windows\System\oziLWzh.exe
  2⤵
  PID:7236
- C:\Windows\System\YRZljyu.exe
  C:\Windows\System\YRZljyu.exe
  2⤵
  PID:7256
- C:\Windows\System\OKzdGBP.exe
  C:\Windows\System\OKzdGBP.exe
  2⤵
  PID:7276
- C:\Windows\System\DQzaYpD.exe
  C:\Windows\System\DQzaYpD.exe
  2⤵
  PID:7300
- C:\Windows\System\rLtAima.exe
  C:\Windows\System\rLtAima.exe
  2⤵
  PID:7320
- C:\Windows\System\ferxrsE.exe
  C:\Windows\System\ferxrsE.exe
  2⤵
  PID:7340
- C:\Windows\System\JJMEYiI.exe
  C:\Windows\System\JJMEYiI.exe
  2⤵
  PID:7356
- C:\Windows\System\pzwbtgY.exe
  C:\Windows\System\pzwbtgY.exe
  2⤵
  PID:7376
- C:\Windows\System\ZuIwVUe.exe
  C:\Windows\System\ZuIwVUe.exe
  2⤵
  PID:7392
- C:\Windows\System\bZFrQtc.exe
  C:\Windows\System\bZFrQtc.exe
  2⤵
  PID:7424
- C:\Windows\System\khjvwGV.exe
  C:\Windows\System\khjvwGV.exe
  2⤵
  PID:7444
- C:\Windows\System\VPLaCsh.exe
  C:\Windows\System\VPLaCsh.exe
  2⤵
  PID:7460
- C:\Windows\System\HaePlpy.exe
  C:\Windows\System\HaePlpy.exe
  2⤵
  PID:7488
- C:\Windows\System\JVYVzze.exe
  C:\Windows\System\JVYVzze.exe
  2⤵
  PID:7512
- C:\Windows\System\hJOzNaj.exe
  C:\Windows\System\hJOzNaj.exe
  2⤵
  PID:7532
- C:\Windows\System\ZfVIkvc.exe
  C:\Windows\System\ZfVIkvc.exe
  2⤵
  PID:7552
- C:\Windows\System\YQbogum.exe
  C:\Windows\System\YQbogum.exe
  2⤵
  PID:7568
- C:\Windows\System\TgbfzHi.exe
  C:\Windows\System\TgbfzHi.exe
  2⤵
  PID:7592
- C:\Windows\System\aaDaJLl.exe
  C:\Windows\System\aaDaJLl.exe
  2⤵
  PID:7608
- C:\Windows\System\vbKzOck.exe
  C:\Windows\System\vbKzOck.exe
  2⤵
  PID:7624
- C:\Windows\System\RgXlfkh.exe
  C:\Windows\System\RgXlfkh.exe
  2⤵
  PID:7644
- C:\Windows\System\NDpeVhS.exe
  C:\Windows\System\NDpeVhS.exe
  2⤵
  PID:7660
- C:\Windows\System\dxnZhSB.exe
  C:\Windows\System\dxnZhSB.exe
  2⤵
  PID:7680
- C:\Windows\System\TLaRqcr.exe
  C:\Windows\System\TLaRqcr.exe
  2⤵
  PID:7716
- C:\Windows\System\EbrvLcl.exe
  C:\Windows\System\EbrvLcl.exe
  2⤵
  PID:7744
- C:\Windows\System\jVBlbZH.exe
  C:\Windows\System\jVBlbZH.exe
  2⤵
  PID:7768
- C:\Windows\System\fWDwrwT.exe
  C:\Windows\System\fWDwrwT.exe
  2⤵
  PID:7792
- C:\Windows\System\BVGKtEd.exe
  C:\Windows\System\BVGKtEd.exe
  2⤵
  PID:7812
- C:\Windows\System\TizzQha.exe
  C:\Windows\System\TizzQha.exe
  2⤵
  PID:7832
- C:\Windows\System\odYnAgR.exe
  C:\Windows\System\odYnAgR.exe
  2⤵
  PID:7860
- C:\Windows\System\UMpYzsN.exe
  C:\Windows\System\UMpYzsN.exe
  2⤵
  PID:7884
- C:\Windows\System\aAfyvKH.exe
  C:\Windows\System\aAfyvKH.exe
  2⤵
  PID:7904
- C:\Windows\System\dBxOjaV.exe
  C:\Windows\System\dBxOjaV.exe
  2⤵
  PID:7928
- C:\Windows\System\AJGibJr.exe
  C:\Windows\System\AJGibJr.exe
  2⤵
  PID:7944
- C:\Windows\System\dUTajzO.exe
  C:\Windows\System\dUTajzO.exe
  2⤵
  PID:7964
- C:\Windows\System\xtkEuoB.exe
  C:\Windows\System\xtkEuoB.exe
  2⤵
  PID:8032
- C:\Windows\System\MJrpVgB.exe
  C:\Windows\System\MJrpVgB.exe
  2⤵
  PID:8052
- C:\Windows\System\QPhXhGK.exe
  C:\Windows\System\QPhXhGK.exe
  2⤵
  PID:8072
- C:\Windows\System\yrCtqOJ.exe
  C:\Windows\System\yrCtqOJ.exe
  2⤵
  PID:8092
- C:\Windows\System\vzFSziB.exe
  C:\Windows\System\vzFSziB.exe
  2⤵
  PID:8116
- C:\Windows\System\gapQOoP.exe
  C:\Windows\System\gapQOoP.exe
  2⤵
  PID:8136
- C:\Windows\System\OZWAiFO.exe
  C:\Windows\System\OZWAiFO.exe
  2⤵
  PID:8160
- C:\Windows\System\nGWPZUb.exe
  C:\Windows\System\nGWPZUb.exe
  2⤵
  PID:8180
- C:\Windows\System\nRJkNjG.exe
  C:\Windows\System\nRJkNjG.exe
  2⤵
  PID:4652
- C:\Windows\System\OBZaVYq.exe
  C:\Windows\System\OBZaVYq.exe
  2⤵
  PID:7124
- C:\Windows\System\ycszHdF.exe
  C:\Windows\System\ycszHdF.exe
  2⤵
  PID:7140
- C:\Windows\System\zmSbtXW.exe
  C:\Windows\System\zmSbtXW.exe
  2⤵
  PID:6096
- C:\Windows\System\XJBkXXo.exe
  C:\Windows\System\XJBkXXo.exe
  2⤵
  PID:5136
- C:\Windows\System\ZGDiyEg.exe
  C:\Windows\System\ZGDiyEg.exe
  2⤵
  PID:6272
- C:\Windows\System\dkzuhNN.exe
  C:\Windows\System\dkzuhNN.exe
  2⤵
  PID:6552
- C:\Windows\System\OgiVKUU.exe
  C:\Windows\System\OgiVKUU.exe
  2⤵
  PID:6928
- C:\Windows\System\eUXkUpf.exe
  C:\Windows\System\eUXkUpf.exe
  2⤵
  PID:6636
- C:\Windows\System\kDbUGRX.exe
  C:\Windows\System\kDbUGRX.exe
  2⤵
  PID:7048
- C:\Windows\System\hYfaaQl.exe
  C:\Windows\System\hYfaaQl.exe
  2⤵
  PID:6508
- C:\Windows\System\VsTatdZ.exe
  C:\Windows\System\VsTatdZ.exe
  2⤵
  PID:6836
- C:\Windows\System\MewvnGC.exe
  C:\Windows\System\MewvnGC.exe
  2⤵
  PID:7272
- C:\Windows\System\IFewRFs.exe
  C:\Windows\System\IFewRFs.exe
  2⤵
  PID:7348
- C:\Windows\System\hbKpfin.exe
  C:\Windows\System\hbKpfin.exe
  2⤵
  PID:6812
- C:\Windows\System\GQvcYrg.exe
  C:\Windows\System\GQvcYrg.exe
  2⤵
  PID:7528
- C:\Windows\System\bWmEnnS.exe
  C:\Windows\System\bWmEnnS.exe
  2⤵
  PID:8212
- C:\Windows\System\iJbwPUM.exe
  C:\Windows\System\iJbwPUM.exe
  2⤵
  PID:8232
- C:\Windows\System\UUeDeMT.exe
  C:\Windows\System\UUeDeMT.exe
  2⤵
  PID:8252
- C:\Windows\System\tNRrKNZ.exe
  C:\Windows\System\tNRrKNZ.exe
  2⤵
  PID:8268
- C:\Windows\System\BoBBumz.exe
  C:\Windows\System\BoBBumz.exe
  2⤵
  PID:8288
- C:\Windows\System\Fgncjjq.exe
  C:\Windows\System\Fgncjjq.exe
  2⤵
  PID:8304
- C:\Windows\System\SpALbyA.exe
  C:\Windows\System\SpALbyA.exe
  2⤵
  PID:8320
- C:\Windows\System\RlHKAxv.exe
  C:\Windows\System\RlHKAxv.exe
  2⤵
  PID:8336
- C:\Windows\System\eWzCZGD.exe
  C:\Windows\System\eWzCZGD.exe
  2⤵
  PID:8352
- C:\Windows\System\NqrLSyf.exe
  C:\Windows\System\NqrLSyf.exe
  2⤵
  PID:8368
- C:\Windows\System\yIjCDrk.exe
  C:\Windows\System\yIjCDrk.exe
  2⤵
  PID:8384
- C:\Windows\System\WqShuCP.exe
  C:\Windows\System\WqShuCP.exe
  2⤵
  PID:8400
- C:\Windows\System\mDaPJwl.exe
  C:\Windows\System\mDaPJwl.exe
  2⤵
  PID:8416
- C:\Windows\System\DoOvzLW.exe
  C:\Windows\System\DoOvzLW.exe
  2⤵
  PID:8436
- C:\Windows\System\ISxJuJh.exe
  C:\Windows\System\ISxJuJh.exe
  2⤵
  PID:8464
- C:\Windows\System\GJSghSZ.exe
  C:\Windows\System\GJSghSZ.exe
  2⤵
  PID:8480
- C:\Windows\System\LfjVkdK.exe
  C:\Windows\System\LfjVkdK.exe
  2⤵
  PID:8500
- C:\Windows\System\BObZsTT.exe
  C:\Windows\System\BObZsTT.exe
  2⤵
  PID:8520
- C:\Windows\System\GitZhbD.exe
  C:\Windows\System\GitZhbD.exe
  2⤵
  PID:8544
- C:\Windows\System\PnAhCNl.exe
  C:\Windows\System\PnAhCNl.exe
  2⤵
  PID:8564
- C:\Windows\System\BSfJoQy.exe
  C:\Windows\System\BSfJoQy.exe
  2⤵
  PID:8584
- C:\Windows\System\VbzwkwF.exe
  C:\Windows\System\VbzwkwF.exe
  2⤵
  PID:8604
- C:\Windows\System\ovbRxqM.exe
  C:\Windows\System\ovbRxqM.exe
  2⤵
  PID:8660
- C:\Windows\System\BMOfmDH.exe
  C:\Windows\System\BMOfmDH.exe
  2⤵
  PID:8676
- C:\Windows\System\RgXzAsH.exe
  C:\Windows\System\RgXzAsH.exe
  2⤵
  PID:8696
- C:\Windows\System\ovEwhLq.exe
  C:\Windows\System\ovEwhLq.exe
  2⤵
  PID:8712
- C:\Windows\System\uqCQiUh.exe
  C:\Windows\System\uqCQiUh.exe
  2⤵
  PID:8736
- C:\Windows\System\SuyHFbA.exe
  C:\Windows\System\SuyHFbA.exe
  2⤵
  PID:8756
- C:\Windows\System\UHzVeLh.exe
  C:\Windows\System\UHzVeLh.exe
  2⤵
  PID:8772
- C:\Windows\System\DXOBtiw.exe
  C:\Windows\System\DXOBtiw.exe
  2⤵
  PID:8800
- C:\Windows\System\cBjnwgG.exe
  C:\Windows\System\cBjnwgG.exe
  2⤵
  PID:8820
- C:\Windows\System\AMkRRTA.exe
  C:\Windows\System\AMkRRTA.exe
  2⤵
  PID:8836
- C:\Windows\System\gPFgXMv.exe
  C:\Windows\System\gPFgXMv.exe
  2⤵
  PID:8856
- C:\Windows\System\rugPWwp.exe
  C:\Windows\System\rugPWwp.exe
  2⤵
  PID:8876
- C:\Windows\System\dDaBIRL.exe
  C:\Windows\System\dDaBIRL.exe
  2⤵
  PID:8892
- C:\Windows\System\rQAucLZ.exe
  C:\Windows\System\rQAucLZ.exe
  2⤵
  PID:8912
- C:\Windows\System\mJKnuph.exe
  C:\Windows\System\mJKnuph.exe
  2⤵
  PID:8936
- C:\Windows\System\gsqbZAX.exe
  C:\Windows\System\gsqbZAX.exe
  2⤵
  PID:8956
- C:\Windows\System\qHGCtBc.exe
  C:\Windows\System\qHGCtBc.exe
  2⤵
  PID:8976
- C:\Windows\System\aDXCNQr.exe
  C:\Windows\System\aDXCNQr.exe
  2⤵
  PID:8996
- C:\Windows\System\SjjOGRQ.exe
  C:\Windows\System\SjjOGRQ.exe
  2⤵
  PID:9024
- C:\Windows\System\ddVnkNB.exe
  C:\Windows\System\ddVnkNB.exe
  2⤵
  PID:9040
- C:\Windows\System\ybVUxDv.exe
  C:\Windows\System\ybVUxDv.exe
  2⤵
  PID:9060
- C:\Windows\System\PtkuIAW.exe
  C:\Windows\System\PtkuIAW.exe
  2⤵
  PID:9080
- C:\Windows\System\iICpraf.exe
  C:\Windows\System\iICpraf.exe
  2⤵
  PID:9100
- C:\Windows\System\LHqAKjb.exe
  C:\Windows\System\LHqAKjb.exe
  2⤵
  PID:9120
- C:\Windows\System\YyVdLOU.exe
  C:\Windows\System\YyVdLOU.exe
  2⤵
  PID:9136
- C:\Windows\System\GUiZjEV.exe
  C:\Windows\System\GUiZjEV.exe
  2⤵
  PID:9160
- C:\Windows\System\EXNfEak.exe
  C:\Windows\System\EXNfEak.exe
  2⤵
  PID:9180
- C:\Windows\System\UzIMKGx.exe
  C:\Windows\System\UzIMKGx.exe
  2⤵
  PID:9208
- C:\Windows\System\dAydEFd.exe
  C:\Windows\System\dAydEFd.exe
  2⤵
  PID:7580
- C:\Windows\System\yTvYhfn.exe
  C:\Windows\System\yTvYhfn.exe
  2⤵
  PID:7632
- C:\Windows\System\krrKtDc.exe
  C:\Windows\System\krrKtDc.exe
  2⤵
  PID:7688
- C:\Windows\System\WinSrwI.exe
  C:\Windows\System\WinSrwI.exe
  2⤵
  PID:7752
- C:\Windows\System\LFkhAXx.exe
  C:\Windows\System\LFkhAXx.exe
  2⤵
  PID:3968
- C:\Windows\System\sCoVzJZ.exe
  C:\Windows\System\sCoVzJZ.exe
  2⤵
  PID:5552
- C:\Windows\System\ZJtukpI.exe
  C:\Windows\System\ZJtukpI.exe
  2⤵
  PID:7892
- C:\Windows\System\NKDKMWw.exe
  C:\Windows\System\NKDKMWw.exe
  2⤵
  PID:7960
- C:\Windows\System\OUYgYxK.exe
  C:\Windows\System\OUYgYxK.exe
  2⤵
  PID:6608
- C:\Windows\System\FCuHFoh.exe
  C:\Windows\System\FCuHFoh.exe
  2⤵
  PID:6772
- C:\Windows\System\vuIWKfE.exe
  C:\Windows\System\vuIWKfE.exe
  2⤵
  PID:6964
- C:\Windows\System\NByUxzH.exe
  C:\Windows\System\NByUxzH.exe
  2⤵
  PID:8016
- C:\Windows\System\QDgasXa.exe
  C:\Windows\System\QDgasXa.exe
  2⤵
  PID:7868
- C:\Windows\System\wxxZYBL.exe
  C:\Windows\System\wxxZYBL.exe
  2⤵
  PID:8048
- C:\Windows\System\RNZCpVF.exe
  C:\Windows\System\RNZCpVF.exe
  2⤵
  PID:4024
- C:\Windows\System\qXdQzDZ.exe
  C:\Windows\System\qXdQzDZ.exe
  2⤵
  PID:7312
- C:\Windows\System\nVGPJFU.exe
  C:\Windows\System\nVGPJFU.exe
  2⤵
  PID:7332
- C:\Windows\System\apOwCwo.exe
  C:\Windows\System\apOwCwo.exe
  2⤵
  PID:7384
- C:\Windows\System\aslvSBX.exe
  C:\Windows\System\aslvSBX.exe
  2⤵
  PID:7404
- C:\Windows\System\ssLltjR.exe
  C:\Windows\System\ssLltjR.exe
  2⤵
  PID:7028
- C:\Windows\System\IeMbHZP.exe
  C:\Windows\System\IeMbHZP.exe
  2⤵
  PID:7436
- C:\Windows\System\MomkFoQ.exe
  C:\Windows\System\MomkFoQ.exe
  2⤵
  PID:7496
- C:\Windows\System\lcXnIAN.exe
  C:\Windows\System\lcXnIAN.exe
  2⤵
  PID:8208
- C:\Windows\System\gCkvAEc.exe
  C:\Windows\System\gCkvAEc.exe
  2⤵
  PID:8244
- C:\Windows\System\bVDbPuu.exe
  C:\Windows\System\bVDbPuu.exe
  2⤵
  PID:7620
- C:\Windows\System\fxQFhbd.exe
  C:\Windows\System\fxQFhbd.exe
  2⤵
  PID:7656
- C:\Windows\System\HMyAFyi.exe
  C:\Windows\System\HMyAFyi.exe
  2⤵
  PID:8348
- C:\Windows\System\DABZJKp.exe
  C:\Windows\System\DABZJKp.exe
  2⤵
  PID:8408
- C:\Windows\System\BwDIXDC.exe
  C:\Windows\System\BwDIXDC.exe
  2⤵
  PID:8496
- C:\Windows\System\pXMHkFi.exe
  C:\Windows\System\pXMHkFi.exe
  2⤵
  PID:8540
- C:\Windows\System\IVfgoDc.exe
  C:\Windows\System\IVfgoDc.exe
  2⤵
  PID:9224
- C:\Windows\System\suDUiEc.exe
  C:\Windows\System\suDUiEc.exe
  2⤵
  PID:9248
- C:\Windows\System\bedVELH.exe
  C:\Windows\System\bedVELH.exe
  2⤵
  PID:9268
- C:\Windows\System\gvfLUdA.exe
  C:\Windows\System\gvfLUdA.exe
  2⤵
  PID:9292
- C:\Windows\System\jyuTsLY.exe
  C:\Windows\System\jyuTsLY.exe
  2⤵
  PID:9312
- C:\Windows\System\JNOctzq.exe
  C:\Windows\System\JNOctzq.exe
  2⤵
  PID:9332
- C:\Windows\System\qutFWQP.exe
  C:\Windows\System\qutFWQP.exe
  2⤵
  PID:9352
- C:\Windows\System\ZWraKJk.exe
  C:\Windows\System\ZWraKJk.exe
  2⤵
  PID:9368
- C:\Windows\System\RfPcnRT.exe
  C:\Windows\System\RfPcnRT.exe
  2⤵
  PID:9392
- C:\Windows\System\IuvNamY.exe
  C:\Windows\System\IuvNamY.exe
  2⤵
  PID:9416
- C:\Windows\System\KCryAbH.exe
  C:\Windows\System\KCryAbH.exe
  2⤵
  PID:9440
- C:\Windows\System\mJFsZkx.exe
  C:\Windows\System\mJFsZkx.exe
  2⤵
  PID:9476
- C:\Windows\System\BfmjMhE.exe
  C:\Windows\System\BfmjMhE.exe
  2⤵
  PID:9496
- C:\Windows\System\lCMTLFZ.exe
  C:\Windows\System\lCMTLFZ.exe
  2⤵
  PID:9512
- C:\Windows\System\hOkLUyk.exe
  C:\Windows\System\hOkLUyk.exe
  2⤵
  PID:9540
- C:\Windows\System\XoXTDEI.exe
  C:\Windows\System\XoXTDEI.exe
  2⤵
  PID:9560
- C:\Windows\System\CHXBiTb.exe
  C:\Windows\System\CHXBiTb.exe
  2⤵
  PID:9576
- C:\Windows\System\IaPQYaU.exe
  C:\Windows\System\IaPQYaU.exe
  2⤵
  PID:9600
- C:\Windows\System\BMdfteP.exe
  C:\Windows\System\BMdfteP.exe
  2⤵
  PID:9620
- C:\Windows\System\CXfAPac.exe
  C:\Windows\System\CXfAPac.exe
  2⤵
  PID:9640
- C:\Windows\System\oHvNzer.exe
  C:\Windows\System\oHvNzer.exe
  2⤵
  PID:9660
- C:\Windows\System\YFfMnHs.exe
  C:\Windows\System\YFfMnHs.exe
  2⤵
  PID:9680
- C:\Windows\System\FPLimDF.exe
  C:\Windows\System\FPLimDF.exe
  2⤵
  PID:9704
- C:\Windows\System\gqhXmso.exe
  C:\Windows\System\gqhXmso.exe
  2⤵
  PID:9724
- C:\Windows\System\TsVULPl.exe
  C:\Windows\System\TsVULPl.exe
  2⤵
  PID:9744
- C:\Windows\System\HVlLWJi.exe
  C:\Windows\System\HVlLWJi.exe
  2⤵
  PID:9764
- C:\Windows\System\PallmQO.exe
  C:\Windows\System\PallmQO.exe
  2⤵
  PID:9784
- C:\Windows\System\IyCqUDR.exe
  C:\Windows\System\IyCqUDR.exe
  2⤵
  PID:9804
- C:\Windows\System\SFZFfmU.exe
  C:\Windows\System\SFZFfmU.exe
  2⤵
  PID:9824
- C:\Windows\System\NLfELzZ.exe
  C:\Windows\System\NLfELzZ.exe
  2⤵
  PID:9848
- C:\Windows\System\koCTUKJ.exe
  C:\Windows\System\koCTUKJ.exe
  2⤵
  PID:9868
- C:\Windows\System\NwYlpaU.exe
  C:\Windows\System\NwYlpaU.exe
  2⤵
  PID:9888
- C:\Windows\System\xvlphWM.exe
  C:\Windows\System\xvlphWM.exe
  2⤵
  PID:9908
- C:\Windows\System\YphZpak.exe
  C:\Windows\System\YphZpak.exe
  2⤵
  PID:9928
- C:\Windows\System\LTpvNhU.exe
  C:\Windows\System\LTpvNhU.exe
  2⤵
  PID:9948
- C:\Windows\System\sDcgVYC.exe
  C:\Windows\System\sDcgVYC.exe
  2⤵
  PID:9964
- C:\Windows\System\nRQpqCp.exe
  C:\Windows\System\nRQpqCp.exe
  2⤵
  PID:9992
- C:\Windows\System\KhGWgRW.exe
  C:\Windows\System\KhGWgRW.exe
  2⤵
  PID:10012
- C:\Windows\System\FeTBjom.exe
  C:\Windows\System\FeTBjom.exe
  2⤵
  PID:10036
- C:\Windows\System\mcgnHwH.exe
  C:\Windows\System\mcgnHwH.exe
  2⤵
  PID:10056
- C:\Windows\System\LMwQNjM.exe
  C:\Windows\System\LMwQNjM.exe
  2⤵
  PID:10072
- C:\Windows\System\zyOiBiC.exe
  C:\Windows\System\zyOiBiC.exe
  2⤵
  PID:10096
- C:\Windows\System\iadWOvQ.exe
  C:\Windows\System\iadWOvQ.exe
  2⤵
  PID:10116
- C:\Windows\System\MzZNujE.exe
  C:\Windows\System\MzZNujE.exe
  2⤵
  PID:10136
- C:\Windows\System\bPVjYGn.exe
  C:\Windows\System\bPVjYGn.exe
  2⤵
  PID:10160
- C:\Windows\System\BXHQHuj.exe
  C:\Windows\System\BXHQHuj.exe
  2⤵
  PID:10180
- C:\Windows\System\INwBPCU.exe
  C:\Windows\System\INwBPCU.exe
  2⤵
  PID:10196
- C:\Windows\System\zXZsfFZ.exe
  C:\Windows\System\zXZsfFZ.exe
  2⤵
  PID:10216
- C:\Windows\System\WKErBLm.exe
  C:\Windows\System\WKErBLm.exe
  2⤵
  PID:5748
- C:\Windows\System\DCdeKwC.exe
  C:\Windows\System\DCdeKwC.exe
  2⤵
  PID:6172
- C:\Windows\System\xMHjJiP.exe
  C:\Windows\System\xMHjJiP.exe
  2⤵
  PID:7252
- C:\Windows\System\eMvTDPN.exe
  C:\Windows\System\eMvTDPN.exe
  2⤵
  PID:7952
- C:\Windows\System\AArKZij.exe
  C:\Windows\System\AArKZij.exe
  2⤵
  PID:8812
- C:\Windows\System\PKgNUAa.exe
  C:\Windows\System\PKgNUAa.exe
  2⤵
  PID:8124
- C:\Windows\System\IwDoNPW.exe
  C:\Windows\System\IwDoNPW.exe
  2⤵
  PID:8128
- C:\Windows\System\RsXsmtd.exe
  C:\Windows\System\RsXsmtd.exe
  2⤵
  PID:9032
- C:\Windows\System\THoTLPF.exe
  C:\Windows\System\THoTLPF.exe
  2⤵
  PID:7400
- C:\Windows\System\xOLtqFR.exe
  C:\Windows\System\xOLtqFR.exe
  2⤵
  PID:6632
- C:\Windows\System\EJPTdCa.exe
  C:\Windows\System\EJPTdCa.exe
  2⤵
  PID:7672
- C:\Windows\System\MwmFatp.exe
  C:\Windows\System\MwmFatp.exe
  2⤵
  PID:7316
- C:\Windows\System\eScfoqw.exe
  C:\Windows\System\eScfoqw.exe
  2⤵
  PID:7544
- C:\Windows\System\bAkKxuS.exe
  C:\Windows\System\bAkKxuS.exe
  2⤵
  PID:6544
- C:\Windows\System\PXnJDTI.exe
  C:\Windows\System\PXnJDTI.exe
  2⤵
  PID:10260
- C:\Windows\System\ewfMcyz.exe
  C:\Windows\System\ewfMcyz.exe
  2⤵
  PID:10280
- C:\Windows\System\sbKyxFh.exe
  C:\Windows\System\sbKyxFh.exe
  2⤵
  PID:10300
- C:\Windows\System\NHlmnYC.exe
  C:\Windows\System\NHlmnYC.exe
  2⤵
  PID:10320
- C:\Windows\System\XEyZYvg.exe
  C:\Windows\System\XEyZYvg.exe
  2⤵
  PID:10340
- C:\Windows\System\DKiZPCG.exe
  C:\Windows\System\DKiZPCG.exe
  2⤵
  PID:10360
- C:\Windows\System\uTAofoO.exe
  C:\Windows\System\uTAofoO.exe
  2⤵
  PID:10380
- C:\Windows\System\gdizwOM.exe
  C:\Windows\System\gdizwOM.exe
  2⤵
  PID:10404
- C:\Windows\System\xVFefMW.exe
  C:\Windows\System\xVFefMW.exe
  2⤵
  PID:10448
- C:\Windows\System\WZnXhiW.exe
  C:\Windows\System\WZnXhiW.exe
  2⤵
  PID:10464
- C:\Windows\System\NqEPbOi.exe
  C:\Windows\System\NqEPbOi.exe
  2⤵
  PID:10484
- C:\Windows\System\lCAQLim.exe
  C:\Windows\System\lCAQLim.exe
  2⤵
  PID:10500
- C:\Windows\System\xOFcjLb.exe
  C:\Windows\System\xOFcjLb.exe
  2⤵
  PID:10516
- C:\Windows\System\pnwNrSt.exe
  C:\Windows\System\pnwNrSt.exe
  2⤵
  PID:10532
- C:\Windows\System\oMSSWZm.exe
  C:\Windows\System\oMSSWZm.exe
  2⤵
  PID:10548
- C:\Windows\System\fQPZfMk.exe
  C:\Windows\System\fQPZfMk.exe
  2⤵
  PID:10572
- C:\Windows\System\kznEfKr.exe
  C:\Windows\System\kznEfKr.exe
  2⤵
  PID:10592
- C:\Windows\System\absHcMR.exe
  C:\Windows\System\absHcMR.exe
  2⤵
  PID:10612
- C:\Windows\System\jGWmfMa.exe
  C:\Windows\System\jGWmfMa.exe
  2⤵
  PID:10632
- C:\Windows\System\pDkGsnb.exe
  C:\Windows\System\pDkGsnb.exe
  2⤵
  PID:10648
- C:\Windows\System\deLFAAB.exe
  C:\Windows\System\deLFAAB.exe
  2⤵
  PID:10668
- C:\Windows\System\HJCWiKw.exe
  C:\Windows\System\HJCWiKw.exe
  2⤵
  PID:10688
- C:\Windows\System\eSLhrXe.exe
  C:\Windows\System\eSLhrXe.exe
  2⤵
  PID:10712
- C:\Windows\System\Gtfsbjm.exe
  C:\Windows\System\Gtfsbjm.exe
  2⤵
  PID:10740
- C:\Windows\System\eLPJasp.exe
  C:\Windows\System\eLPJasp.exe
  2⤵
  PID:10756
- C:\Windows\System\gCVCeCl.exe
  C:\Windows\System\gCVCeCl.exe
  2⤵
  PID:10776
- C:\Windows\System\ursSBSg.exe
  C:\Windows\System\ursSBSg.exe
  2⤵
  PID:10796
- C:\Windows\System\CKSswkr.exe
  C:\Windows\System\CKSswkr.exe
  2⤵
  PID:10820
- C:\Windows\System\znaxlGT.exe
  C:\Windows\System\znaxlGT.exe
  2⤵
  PID:10840
- C:\Windows\System\TecaRzO.exe
  C:\Windows\System\TecaRzO.exe
  2⤵
  PID:10860
- C:\Windows\System\XfPGNcO.exe
  C:\Windows\System\XfPGNcO.exe
  2⤵
  PID:10880
- C:\Windows\System\KWQMpvR.exe
  C:\Windows\System\KWQMpvR.exe
  2⤵
  PID:10904
- C:\Windows\System\ZPNPwgn.exe
  C:\Windows\System\ZPNPwgn.exe
  2⤵
  PID:10924
- C:\Windows\System\uIkapOP.exe
  C:\Windows\System\uIkapOP.exe
  2⤵
  PID:10948
- C:\Windows\System\oRcruHZ.exe
  C:\Windows\System\oRcruHZ.exe
  2⤵
  PID:10968
- C:\Windows\System\ZEznvGw.exe
  C:\Windows\System\ZEznvGw.exe
  2⤵
  PID:10992
- C:\Windows\System\dRwYYKs.exe
  C:\Windows\System\dRwYYKs.exe
  2⤵
  PID:11044
- C:\Windows\System\FuhLbFH.exe
  C:\Windows\System\FuhLbFH.exe
  2⤵
  PID:11064
- C:\Windows\System\moLaCnR.exe
  C:\Windows\System\moLaCnR.exe
  2⤵
  PID:11080
- C:\Windows\System\Bzapnaq.exe
  C:\Windows\System\Bzapnaq.exe
  2⤵
  PID:11100
- C:\Windows\System\dUdzZAz.exe
  C:\Windows\System\dUdzZAz.exe
  2⤵
  PID:11120
- C:\Windows\System\mIjatWh.exe
  C:\Windows\System\mIjatWh.exe
  2⤵
  PID:11140
- C:\Windows\System\cpSWINO.exe
  C:\Windows\System\cpSWINO.exe
  2⤵
  PID:11164
- C:\Windows\System\TuqzFoQ.exe
  C:\Windows\System\TuqzFoQ.exe
  2⤵
  PID:11180
- C:\Windows\System\RymPmFJ.exe
  C:\Windows\System\RymPmFJ.exe
  2⤵
  PID:11204
- C:\Windows\System\bWkFgjA.exe
  C:\Windows\System\bWkFgjA.exe
  2⤵
  PID:11228
- C:\Windows\System\hgRJBbK.exe
  C:\Windows\System\hgRJBbK.exe
  2⤵
  PID:11248
- C:\Windows\System\wJoDNht.exe
  C:\Windows\System\wJoDNht.exe
  2⤵
  PID:6152
- C:\Windows\System\xztZqLD.exe
  C:\Windows\System\xztZqLD.exe
  2⤵
  PID:2944
- C:\Windows\System\nVfZhME.exe
  C:\Windows\System\nVfZhME.exe
  2⤵
  PID:8380
- C:\Windows\System\PPTkOiu.exe
  C:\Windows\System\PPTkOiu.exe
  2⤵
  PID:8176
- C:\Windows\System\SRfJYnf.exe
  C:\Windows\System\SRfJYnf.exe
  2⤵
  PID:6648
- C:\Windows\System\KaPyCwA.exe
  C:\Windows\System\KaPyCwA.exe
  2⤵
  PID:8240
- C:\Windows\System\xRwHZcJ.exe
  C:\Windows\System\xRwHZcJ.exe
  2⤵
  PID:8316
- C:\Windows\System\utTuyOH.exe
  C:\Windows\System\utTuyOH.exe
  2⤵
  PID:7784
- C:\Windows\System\IYJJkuu.exe
  C:\Windows\System\IYJJkuu.exe
  2⤵
  PID:8560
- C:\Windows\System\aGskbDY.exe
  C:\Windows\System\aGskbDY.exe
  2⤵
  PID:9260
- C:\Windows\System\bpaqhpy.exe
  C:\Windows\System\bpaqhpy.exe
  2⤵
  PID:9360
- C:\Windows\System\MRBaUKf.exe
  C:\Windows\System\MRBaUKf.exe
  2⤵
  PID:9436
- C:\Windows\System\jEQFXZW.exe
  C:\Windows\System\jEQFXZW.exe
  2⤵
  PID:9556
- C:\Windows\System\YHgbwWc.exe
  C:\Windows\System\YHgbwWc.exe
  2⤵
  PID:8672
- C:\Windows\System\fAcBzTf.exe
  C:\Windows\System\fAcBzTf.exe
  2⤵
  PID:9712
- C:\Windows\System\NEBziKt.exe
  C:\Windows\System\NEBziKt.exe
  2⤵
  PID:8764
- C:\Windows\System\qRHMxDR.exe
  C:\Windows\System\qRHMxDR.exe
  2⤵
  PID:9776
- C:\Windows\System\nCNEjOC.exe
  C:\Windows\System\nCNEjOC.exe
  2⤵
  PID:9880
- C:\Windows\System\HjQiaCU.exe
  C:\Windows\System\HjQiaCU.exe
  2⤵
  PID:8924
- C:\Windows\System\XKmMkQk.exe
  C:\Windows\System\XKmMkQk.exe
  2⤵
  PID:8964
- C:\Windows\System\SNZUDLf.exe
  C:\Windows\System\SNZUDLf.exe
  2⤵
  PID:1980
- C:\Windows\System\BpnRKhI.exe
  C:\Windows\System\BpnRKhI.exe
  2⤵
  PID:10008
- C:\Windows\System\qgFOsgC.exe
  C:\Windows\System\qgFOsgC.exe
  2⤵
  PID:11276
- C:\Windows\System\iowlspN.exe
  C:\Windows\System\iowlspN.exe
  2⤵
  PID:11296
- C:\Windows\System\DgaeziF.exe
  C:\Windows\System\DgaeziF.exe
  2⤵
  PID:11312
- C:\Windows\System\Riroazh.exe
  C:\Windows\System\Riroazh.exe
  2⤵
  PID:11332
- C:\Windows\System\dBwBPZJ.exe
  C:\Windows\System\dBwBPZJ.exe
  2⤵
  PID:11360
- C:\Windows\System\gLcDEFL.exe
  C:\Windows\System\gLcDEFL.exe
  2⤵
  PID:11376
- C:\Windows\System\jykwbyU.exe
  C:\Windows\System\jykwbyU.exe
  2⤵
  PID:11404
- C:\Windows\System\kQiNPQw.exe
  C:\Windows\System\kQiNPQw.exe
  2⤵
  PID:11424
- C:\Windows\System\rLICCMS.exe
  C:\Windows\System\rLICCMS.exe
  2⤵
  PID:11444
- C:\Windows\System\wyhnnoh.exe
  C:\Windows\System\wyhnnoh.exe
  2⤵
  PID:11472
- C:\Windows\System\opHmwnu.exe
  C:\Windows\System\opHmwnu.exe
  2⤵
  PID:11496
- C:\Windows\System\EOTbFpp.exe
  C:\Windows\System\EOTbFpp.exe
  2⤵
  PID:11516
- C:\Windows\System\TsrdYWm.exe
  C:\Windows\System\TsrdYWm.exe
  2⤵
  PID:11536
- C:\Windows\System\boxLsBG.exe
  C:\Windows\System\boxLsBG.exe
  2⤵
  PID:11568
- C:\Windows\System\sNHDkib.exe
  C:\Windows\System\sNHDkib.exe
  2⤵
  PID:11592
- C:\Windows\System\oQGKouZ.exe
  C:\Windows\System\oQGKouZ.exe
  2⤵
  PID:11608
- C:\Windows\System\kSFLjPD.exe
  C:\Windows\System\kSFLjPD.exe
  2⤵
  PID:11628
- C:\Windows\System\BlYmTeY.exe
  C:\Windows\System\BlYmTeY.exe
  2⤵
  PID:11660
- C:\Windows\System\HvIgMfy.exe
  C:\Windows\System\HvIgMfy.exe
  2⤵
  PID:11688
- C:\Windows\System\bfVZJES.exe
  C:\Windows\System\bfVZJES.exe
  2⤵
  PID:11720
- C:\Windows\System\YffOdQi.exe
  C:\Windows\System\YffOdQi.exe
  2⤵
  PID:11744
- C:\Windows\System\NQKnxVG.exe
  C:\Windows\System\NQKnxVG.exe
  2⤵
  PID:11780
- C:\Windows\System\jbKOcVI.exe
  C:\Windows\System\jbKOcVI.exe
  2⤵
  PID:11808
- C:\Windows\System\qyydEVH.exe
  C:\Windows\System\qyydEVH.exe
  2⤵
  PID:11828
- C:\Windows\System\CIeBrIp.exe
  C:\Windows\System\CIeBrIp.exe
  2⤵
  PID:11848
- C:\Windows\System\VWayzgH.exe
  C:\Windows\System\VWayzgH.exe
  2⤵
  PID:11872
- C:\Windows\System\vfhDIUS.exe
  C:\Windows\System\vfhDIUS.exe
  2⤵
  PID:11892
- C:\Windows\System\TXDsbcc.exe
  C:\Windows\System\TXDsbcc.exe
  2⤵
  PID:11916
- C:\Windows\System\AontxNS.exe
  C:\Windows\System\AontxNS.exe
  2⤵
  PID:11940
- C:\Windows\System\HuENxUt.exe
  C:\Windows\System\HuENxUt.exe
  2⤵
  PID:7920
- C:\Windows\System\wkoiVrj.exe
  C:\Windows\System\wkoiVrj.exe
  2⤵
  PID:10236
- C:\Windows\System\tlOicgv.exe
  C:\Windows\System\tlOicgv.exe
  2⤵
  PID:8920
- C:\Windows\System\WHKWqra.exe
  C:\Windows\System\WHKWqra.exe
  2⤵
  PID:9096
- C:\Windows\System\zTMVZuJ.exe
  C:\Windows\System\zTMVZuJ.exe
  2⤵
  PID:7508
- C:\Windows\System\vLScklk.exe
  C:\Windows\System\vLScklk.exe
  2⤵
  PID:10256
- C:\Windows\System\SLMyGyA.exe
  C:\Windows\System\SLMyGyA.exe
  2⤵
  PID:11584
- C:\Windows\System\vgPXfvM.exe
  C:\Windows\System\vgPXfvM.exe
  2⤵
  PID:10444
- C:\Windows\System\ZShjzvO.exe
  C:\Windows\System\ZShjzvO.exe
  2⤵
  PID:10492
- C:\Windows\System\UqByoBK.exe
  C:\Windows\System\UqByoBK.exe
  2⤵
  PID:11696
- C:\Windows\System\fqUIPYA.exe
  C:\Windows\System\fqUIPYA.exe
  2⤵
  PID:10664
- C:\Windows\System\AXLqLQH.exe
  C:\Windows\System\AXLqLQH.exe
  2⤵
  PID:10704
- C:\Windows\System\XuXIaIo.exe
  C:\Windows\System\XuXIaIo.exe
  2⤵
  PID:11760
- C:\Windows\System\aYOipty.exe
  C:\Windows\System\aYOipty.exe
  2⤵
  PID:10832
- C:\Windows\System\QRZLMQS.exe
  C:\Windows\System\QRZLMQS.exe
  2⤵
  PID:10868
- C:\Windows\System\tkTTLqP.exe
  C:\Windows\System\tkTTLqP.exe
  2⤵
  PID:10932
- C:\Windows\System\emqgIlr.exe
  C:\Windows\System\emqgIlr.exe
  2⤵
  PID:10984
- C:\Windows\System\FRkmZax.exe
  C:\Windows\System\FRkmZax.exe
  2⤵
  PID:11964
- C:\Windows\System\iHghYLX.exe
  C:\Windows\System\iHghYLX.exe
  2⤵
  PID:11088
- C:\Windows\System\cAhCEpa.exe
  C:\Windows\System\cAhCEpa.exe
  2⤵
  PID:11128
- C:\Windows\System\KbOcsYE.exe
  C:\Windows\System\KbOcsYE.exe
  2⤵
  PID:11188
- C:\Windows\System\VwyheMf.exe
  C:\Windows\System\VwyheMf.exe
  2⤵
  PID:11244
- C:\Windows\System\QFbhAWf.exe
  C:\Windows\System\QFbhAWf.exe
  2⤵
  PID:7692
- C:\Windows\System\mCTJofL.exe
  C:\Windows\System\mCTJofL.exe
  2⤵
  PID:8412
- C:\Windows\System\oOxNGRw.exe
  C:\Windows\System\oOxNGRw.exe
  2⤵
  PID:9256
- C:\Windows\System\iNXzvzr.exe
  C:\Windows\System\iNXzvzr.exe
  2⤵
  PID:9412
- C:\Windows\System\SsUjQvQ.exe
  C:\Windows\System\SsUjQvQ.exe
  2⤵
  PID:9612
- C:\Windows\System\lsqISqf.exe
  C:\Windows\System\lsqISqf.exe
  2⤵
  PID:8788
- C:\Windows\System\efftfwz.exe
  C:\Windows\System\efftfwz.exe
  2⤵
  PID:8948
- C:\Windows\System\gCCJjQq.exe
  C:\Windows\System\gCCJjQq.exe
  2⤵
  PID:8040
- C:\Windows\System\HqaMNAj.exe
  C:\Windows\System\HqaMNAj.exe
  2⤵
  PID:12236
- C:\Windows\System\GeQBnIl.exe
  C:\Windows\System\GeQBnIl.exe
  2⤵
  PID:11288
- C:\Windows\System\lBGBjDp.exe
  C:\Windows\System\lBGBjDp.exe
  2⤵
  PID:8732
- C:\Windows\System\RvntKgQ.exe
  C:\Windows\System\RvntKgQ.exe
  2⤵
  PID:11528
- C:\Windows\System\XZDgsvS.exe
  C:\Windows\System\XZDgsvS.exe
  2⤵
  PID:11604
- C:\Windows\System\MlsvZWc.exe
  C:\Windows\System\MlsvZWc.exe
  2⤵
  PID:11668
- C:\Windows\System\HuuJRIH.exe
  C:\Windows\System\HuuJRIH.exe
  2⤵
  PID:11732
- C:\Windows\System\JpuhkqY.exe
  C:\Windows\System\JpuhkqY.exe
  2⤵
  PID:11824
- C:\Windows\System\DHTxVls.exe
  C:\Windows\System\DHTxVls.exe
  2⤵
  PID:11868
- C:\Windows\System\QFkQlDH.exe
  C:\Windows\System\QFkQlDH.exe
  2⤵
  PID:6520
- C:\Windows\System\mmtOGAy.exe
  C:\Windows\System\mmtOGAy.exe
  2⤵
  PID:2044
- C:\Windows\System\yftaNQf.exe
  C:\Windows\System\yftaNQf.exe
  2⤵
  PID:10288
- C:\Windows\System\NQUFBps.exe
  C:\Windows\System\NQUFBps.exe
  2⤵
  PID:12312
- C:\Windows\System\kifiljS.exe
  C:\Windows\System\kifiljS.exe
  2⤵
  PID:12332
- C:\Windows\System\ZACtryE.exe
  C:\Windows\System\ZACtryE.exe
  2⤵
  PID:12356
- C:\Windows\System\nUiXmIR.exe
  C:\Windows\System\nUiXmIR.exe
  2⤵
  PID:12380
- C:\Windows\System\FZCcSXA.exe
  C:\Windows\System\FZCcSXA.exe
  2⤵
  PID:12396
- C:\Windows\System\NxIwzkP.exe
  C:\Windows\System\NxIwzkP.exe
  2⤵
  PID:12416
- C:\Windows\System\iQUTbKt.exe
  C:\Windows\System\iQUTbKt.exe
  2⤵
  PID:12440
- C:\Windows\System\obJFHTW.exe
  C:\Windows\System\obJFHTW.exe
  2⤵
  PID:12460
- C:\Windows\System\pghTgVL.exe
  C:\Windows\System\pghTgVL.exe
  2⤵
  PID:12480
- C:\Windows\System\QRIsloL.exe
  C:\Windows\System\QRIsloL.exe
  2⤵
  PID:12512
- C:\Windows\System\SZApBgD.exe
  C:\Windows\System\SZApBgD.exe
  2⤵
  PID:12532
- C:\Windows\System\PwVEeHV.exe
  C:\Windows\System\PwVEeHV.exe
  2⤵
  PID:12552
- C:\Windows\System\OwtvEGr.exe
  C:\Windows\System\OwtvEGr.exe
  2⤵
  PID:12576
- C:\Windows\System\SdXZDfH.exe
  C:\Windows\System\SdXZDfH.exe
  2⤵
  PID:12596
- C:\Windows\System\bUNIZpF.exe
  C:\Windows\System\bUNIZpF.exe
  2⤵
  PID:13296
- C:\Windows\System\oqAbQNe.exe
  C:\Windows\System\oqAbQNe.exe
  2⤵
  PID:12920
- C:\Windows\System\pljhtoM.exe
  C:\Windows\System\pljhtoM.exe
  2⤵
  PID:9820
- C:\Windows\System\EsVxixu.exe
  C:\Windows\System\EsVxixu.exe
  2⤵
  PID:12968
- C:\Windows\System\MFkiwIB.exe
  C:\Windows\System\MFkiwIB.exe
  2⤵
  PID:7388
- C:\Windows\System\aDWBByn.exe
  C:\Windows\System\aDWBByn.exe
  2⤵
  PID:10244
- C:\Windows\System\qfyPlfe.exe
  C:\Windows\System\qfyPlfe.exe
  2⤵
  PID:10476
- C:\Windows\System\DOkSIXZ.exe
  C:\Windows\System\DOkSIXZ.exe
  2⤵
  PID:11708
- C:\Windows\System\BiQChiz.exe
  C:\Windows\System\BiQChiz.exe
  2⤵
  PID:10804
- C:\Windows\System\nJnUaUr.exe
  C:\Windows\System\nJnUaUr.exe
  2⤵
  PID:11176
- C:\Windows\System\VEFeJWI.exe
  C:\Windows\System\VEFeJWI.exe
  2⤵
  PID:7116
- C:\Windows\System\BWjBaNf.exe
  C:\Windows\System\BWjBaNf.exe
  2⤵
  PID:4916
- C:\Windows\System\gHrhgFu.exe
  C:\Windows\System\gHrhgFu.exe
  2⤵
  PID:9608
- C:\Windows\System\gCaKZvA.exe
  C:\Windows\System\gCaKZvA.exe
  2⤵
  PID:1432
- C:\Windows\System\kqdfSfx.exe
  C:\Windows\System\kqdfSfx.exe
  2⤵
  PID:2680
- C:\Windows\System\hYmRIyi.exe
  C:\Windows\System\hYmRIyi.exe
  2⤵
  PID:2216
- C:\Windows\System\YswAcOU.exe
  C:\Windows\System\YswAcOU.exe
  2⤵
  PID:12628
- C:\Windows\System\BodXCEF.exe
  C:\Windows\System\BodXCEF.exe
  2⤵
  PID:13324
- C:\Windows\System\gIGFpgR.exe
  C:\Windows\System\gIGFpgR.exe
  2⤵
  PID:13348
- C:\Windows\System\Jcvukpf.exe
  C:\Windows\System\Jcvukpf.exe
  2⤵
  PID:13376
- C:\Windows\System\LcbWZXT.exe
  C:\Windows\System\LcbWZXT.exe
  2⤵
  PID:13396
- C:\Windows\System\YnjVxCs.exe
  C:\Windows\System\YnjVxCs.exe
  2⤵
  PID:13420
- C:\Windows\System\nYzmALY.exe
  C:\Windows\System\nYzmALY.exe
  2⤵
  PID:13436
- C:\Windows\System\bnxnsra.exe
  C:\Windows\System\bnxnsra.exe
  2⤵
  PID:13476
- C:\Windows\System\pPxgLRL.exe
  C:\Windows\System\pPxgLRL.exe
  2⤵
  PID:13496
- C:\Windows\System\yifRyre.exe
  C:\Windows\System\yifRyre.exe
  2⤵
  PID:13520
- C:\Windows\System\ZXVQAqh.exe
  C:\Windows\System\ZXVQAqh.exe
  2⤵
  PID:13540
- C:\Windows\System\xfKdsmW.exe
  C:\Windows\System\xfKdsmW.exe
  2⤵
  PID:13564
- C:\Windows\System\PJCoQxR.exe
  C:\Windows\System\PJCoQxR.exe
  2⤵
  PID:13588
- C:\Windows\System\JObMQLT.exe
  C:\Windows\System\JObMQLT.exe
  2⤵
  PID:13608
- C:\Windows\System\TtMPMor.exe
  C:\Windows\System\TtMPMor.exe
  2⤵
  PID:13636
- C:\Windows\System\jsKyqkV.exe
  C:\Windows\System\jsKyqkV.exe
  2⤵
  PID:13676
- C:\Windows\System\UqSYhmK.exe
  C:\Windows\System\UqSYhmK.exe
  2⤵
  PID:13696
- C:\Windows\System\mAcOetA.exe
  C:\Windows\System\mAcOetA.exe
  2⤵
  PID:13712
- C:\Windows\System\ccZXuJf.exe
  C:\Windows\System\ccZXuJf.exe
  2⤵
  PID:13732
- C:\Windows\System\jGNfRBB.exe
  C:\Windows\System\jGNfRBB.exe
  2⤵
  PID:13752
- C:\Windows\System\ojQxgIZ.exe
  C:\Windows\System\ojQxgIZ.exe
  2⤵
  PID:14052
- C:\Windows\System\BhOhqCt.exe
  C:\Windows\System\BhOhqCt.exe
  2⤵
  PID:14068
- C:\Windows\System\tegCTth.exe
  C:\Windows\System\tegCTth.exe
  2⤵
  PID:14088
- C:\Windows\System\FZSzgGa.exe
  C:\Windows\System\FZSzgGa.exe
  2⤵
  PID:14108
- C:\Windows\System\TKPmLgc.exe
  C:\Windows\System\TKPmLgc.exe
  2⤵
  PID:14124
- C:\Windows\System\ByTHYXi.exe
  C:\Windows\System\ByTHYXi.exe
  2⤵
  PID:14144
- C:\Windows\System\hfUOoVm.exe
  C:\Windows\System\hfUOoVm.exe
  2⤵
  PID:14160
- C:\Windows\System\NsYgENN.exe
  C:\Windows\System\NsYgENN.exe
  2⤵
  PID:4124
- C:\Windows\System\akeGVNq.exe
  C:\Windows\System\akeGVNq.exe
  2⤵
  PID:11460
- C:\Windows\System\NRCnCkV.exe
  C:\Windows\System\NRCnCkV.exe
  2⤵
  PID:11768
- C:\Windows\System\Slyurhz.exe
  C:\Windows\System\Slyurhz.exe
  2⤵
  PID:11912
- C:\Windows\System\RmlqJwR.exe
  C:\Windows\System\RmlqJwR.exe
  2⤵
  PID:11348
- C:\Windows\System\rIiRyHH.exe
  C:\Windows\System\rIiRyHH.exe
  2⤵
  PID:12352
- C:\Windows\System\aZFSnNF.exe
  C:\Windows\System\aZFSnNF.exe
  2⤵
  PID:12452
- C:\Windows\System\yItCTTC.exe
  C:\Windows\System\yItCTTC.exe
  2⤵
  PID:4492
- C:\Windows\System\YUXauqE.exe
  C:\Windows\System\YUXauqE.exe
  2⤵
  PID:12996
- C:\Windows\System\ETRqGGn.exe
  C:\Windows\System\ETRqGGn.exe
  2⤵
  PID:8448
- C:\Windows\System\SVVvxVn.exe
  C:\Windows\System\SVVvxVn.exe
  2⤵
  PID:13272
- C:\Windows\System\DkvqaPL.exe
  C:\Windows\System\DkvqaPL.exe
  2⤵
  PID:12120
- C:\Windows\System\UrTBVHQ.exe
  C:\Windows\System\UrTBVHQ.exe
  2⤵
  PID:8476
- C:\Windows\System\wDLXepJ.exe
  C:\Windows\System\wDLXepJ.exe
  2⤵
  PID:4880
- C:\Windows\System\CSFQxsG.exe
  C:\Windows\System\CSFQxsG.exe
  2⤵
  PID:13464
- C:\Windows\System\STIsmlw.exe
  C:\Windows\System\STIsmlw.exe
  2⤵
  PID:10696
- C:\Windows\System\PrfUUau.exe
  C:\Windows\System\PrfUUau.exe
  2⤵
  PID:3392
- C:\Windows\System\LSBGfkp.exe
  C:\Windows\System\LSBGfkp.exe
  2⤵
  PID:11860
- C:\Windows\System\PYaDBVe.exe
  C:\Windows\System\PYaDBVe.exe
  2⤵
  PID:13384
- C:\Windows\System\meruFbt.exe
  C:\Windows\System\meruFbt.exe
  2⤵
  PID:13428
- C:\Windows\System\JflggSw.exe
  C:\Windows\System\JflggSw.exe
  2⤵
  PID:13952
- C:\Windows\System\UTgVnSj.exe
  C:\Windows\System\UTgVnSj.exe
  2⤵
  PID:8280
- C:\Windows\System\HMJFefD.exe
  C:\Windows\System\HMJFefD.exe
  2⤵
  PID:13556
- C:\Windows\System\eCnILAk.exe
  C:\Windows\System\eCnILAk.exe
  2⤵
  PID:13744
- C:\Windows\System\Jcjjzet.exe
  C:\Windows\System\Jcjjzet.exe
  2⤵
  PID:13780
- C:\Windows\System\NZfFodb.exe
  C:\Windows\System\NZfFodb.exe
  2⤵
  PID:14060
- C:\Windows\System\NFMMWIZ.exe
  C:\Windows\System\NFMMWIZ.exe
  2⤵
  PID:12340
- C:\Windows\System\PDwAiRw.exe
  C:\Windows\System\PDwAiRw.exe
  2⤵
  PID:3156
- C:\Windows\System\PcSQOck.exe
  C:\Windows\System\PcSQOck.exe
  2⤵
  PID:13844
- C:\Windows\System\iVxjuon.exe
  C:\Windows\System\iVxjuon.exe
  2⤵
  PID:13932
- C:\Windows\System\kiRfmPy.exe
  C:\Windows\System\kiRfmPy.exe
  2⤵
  PID:14044
- C:\Windows\System\DywbAJz.exe
  C:\Windows\System\DywbAJz.exe
  2⤵
  PID:2936
- C:\Windows\System\UVtADca.exe
  C:\Windows\System\UVtADca.exe
  2⤵
  PID:12964
- C:\Windows\System\bMMTliX.exe
  C:\Windows\System\bMMTliX.exe
  2⤵
  PID:11400
- C:\Windows\System\BnGwXrO.exe
  C:\Windows\System\BnGwXrO.exe
  2⤵
  PID:11268
- C:\Windows\System\ruZSqGu.exe
  C:\Windows\System\ruZSqGu.exe
  2⤵
  PID:1852
- C:\Windows\System\wSfpsAE.exe
  C:\Windows\System\wSfpsAE.exe
  2⤵
  PID:4756
- C:\Windows\System\DWjoySQ.exe
  C:\Windows\System\DWjoySQ.exe
  2⤵
  PID:12488
- C:\Windows\System\siYhwiP.exe
  C:\Windows\System\siYhwiP.exe
  2⤵
  PID:3268
- C:\Windows\System\okDdQgY.exe
  C:\Windows\System\okDdQgY.exe
  2⤵
  PID:10752
- C:\Windows\System\tXKdBTm.exe
  C:\Windows\System\tXKdBTm.exe
  2⤵
  PID:4964
- C:\Windows\System\AjhZQou.exe
  C:\Windows\System\AjhZQou.exe
  2⤵
  PID:900
- C:\Windows\System\IEMfnrh.exe
  C:\Windows\System\IEMfnrh.exe
  2⤵
  PID:2540
- C:\Windows\System\koPEogv.exe
  C:\Windows\System\koPEogv.exe
  2⤵
  PID:10368
- C:\Windows\System\OXdRvax.exe
  C:\Windows\System\OXdRvax.exe
  2⤵
  PID:13576
- C:\Windows\System\PrEIEOI.exe
  C:\Windows\System\PrEIEOI.exe
  2⤵
  PID:14368
- C:\Windows\System\UvzByeA.exe
  C:\Windows\System\UvzByeA.exe
  2⤵
  PID:14384
- C:\Windows\System\gBeqMeE.exe
  C:\Windows\System\gBeqMeE.exe
  2⤵
  PID:14404
- C:\Windows\System\JcbLCUc.exe
  C:\Windows\System\JcbLCUc.exe
  2⤵
  PID:14432
- C:\Windows\System\ekZBDMp.exe
  C:\Windows\System\ekZBDMp.exe
  2⤵
  PID:14452
- C:\Windows\System\kXYLUDd.exe
  C:\Windows\System\kXYLUDd.exe
  2⤵
  PID:14476
- C:\Windows\System\oRTDTMK.exe
  C:\Windows\System\oRTDTMK.exe
  2⤵
  PID:14496
- C:\Windows\System\QaDIPky.exe
  C:\Windows\System\QaDIPky.exe
  2⤵
  PID:14888
- C:\Windows\System\SAHzNnH.exe
  C:\Windows\System\SAHzNnH.exe
  2⤵
  PID:14928
- C:\Windows\System\nTfHAYS.exe
  C:\Windows\System\nTfHAYS.exe
  2⤵
  PID:14944
- C:\Windows\System\RmuSsvX.exe
  C:\Windows\System\RmuSsvX.exe
  2⤵
  PID:15000
- C:\Windows\System\bGAaihW.exe
  C:\Windows\System\bGAaihW.exe
  2⤵
  PID:15040
- C:\Windows\System\nLiqbjb.exe
  C:\Windows\System\nLiqbjb.exe
  2⤵
  PID:15056
- C:\Windows\System\enZBSIW.exe
  C:\Windows\System\enZBSIW.exe
  2⤵
  PID:15072
- C:\Windows\System\oPRmfor.exe
  C:\Windows\System\oPRmfor.exe
  2⤵
  PID:15092
- C:\Windows\System\CJyGrBT.exe
  C:\Windows\System\CJyGrBT.exe
  2⤵
  PID:15112
- C:\Windows\System\juHvNMl.exe
  C:\Windows\System\juHvNMl.exe
  2⤵
  PID:15144
- C:\Windows\System\eBdPKRs.exe
  C:\Windows\System\eBdPKRs.exe
  2⤵
  PID:15160
- C:\Windows\System\JgZURcc.exe
  C:\Windows\System\JgZURcc.exe
  2⤵
  PID:15188
- C:\Windows\System\KVDAAET.exe
  C:\Windows\System\KVDAAET.exe
  2⤵
  PID:15260
- C:\Windows\System\dbENgOt.exe
  C:\Windows\System\dbENgOt.exe
  2⤵
  PID:13132
- C:\Windows\System\VcuRJlR.exe
  C:\Windows\System\VcuRJlR.exe
  2⤵
  PID:12860
- C:\Windows\System\wayRWHh.exe
  C:\Windows\System\wayRWHh.exe
  2⤵
  PID:2892
- C:\Windows\System\ChroRpm.exe
  C:\Windows\System\ChroRpm.exe
  2⤵
  PID:2644
- C:\Windows\System\gFLRNzf.exe
  C:\Windows\System\gFLRNzf.exe
  2⤵
  PID:13764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:12700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=53532474917056 --process=260 /prefetch:7 --thread=4204
1⤵
PID:14064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AKqlNDD.exe

Path C:\Windows\System\AKqlNDD.exe
Size 1.6MB
SHA256 e663930479622a44b53b8ca36a985a259e8c920d5dcb490e7766322e8a361d91
MD5 de3d03c671f42144446985266c6ccf0a
SHA1 e375bbda7a2be727ad9d27d91dc09d3017dc5e2e
SHA512 09cdbaa75451a19c7d87e64fa769244e251d75ac4caf46cb435bdf0f4b23e3c1076e3174334c8edab4bf3a282e06f7bab6ebc36bcd215049c3315043cd8bccd0
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//o:RWWBiba7
MD5 SHA1 SHA512 SSDEEP

Submit Download

BETHSCF.exe

Path C:\Windows\System\BETHSCF.exe
Size 1.6MB
SHA256 9c9e914d44e78f185dcadd322416cb7bac0676df1b63747bb757f59407215802
MD5 fb2bee116ad6e6d7f17df0b5c2873685
SHA1 fa14c347a58242c623a0d8374a798f2e491dc4b0
SHA512 86ab2e3faa729bef2a5c098c86b9df9385b62c2225c019cbaafa5340d65b5fb433507988c207df1743f53bbe1701e78cf1e3dac9e6af5ffcb38028b5ad5e8c28
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//x8:RWWBiba3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCyQwZN.exe

Path C:\Windows\System\CCyQwZN.exe
Size 1.6MB
SHA256 f55e283b3d51f531792197ab8d423ef5eea47d1fec71779763e44caf223d14ce
MD5 4e0bf4a2a0e81c75deb37423ce651cad
SHA1 1f92062930f03218ecc10e72724af3df731468c3
SHA512 4ccf7283e857c181ea005d996e4ee0c1665b1a81a5b9cfd5a2a670c3137b59f78ce7c667c99d586c17eee04959aa5f5f0620f8eaaaeba2d7fda3f45f4a539f15
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//T:RWWBibak
MD5 SHA1 SHA512 SSDEEP

Submit Download

CGaFyDn.exe

Path C:\Windows\System\CGaFyDn.exe
Size 1.6MB
SHA256 e64b4bd3e73884501604c8ea5a3f8fac28b5b66ebb194119929a690df323c98e
MD5 6f92d80dd0a5e9af62b3f54eb23bccbe
SHA1 2de92777bcdbecd33ab410bb35db7da46be348c5
SHA512 221b3418afcc66e3c292a40bbda1896be2920acc3cbb64baed5e20b4fd55e5f2bf52744e32d704d2d0696afaf498d0c1345025ffee27f8b16b5ed393926b5e67
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//X:RWWBibau
MD5 SHA1 SHA512 SSDEEP

Submit Download

CxDEuvy.exe

Path C:\Windows\System\CxDEuvy.exe
Size 1.6MB
SHA256 4e47e0e09dd307b02335d4eb420b54dcfad99acfdd33e30064b6b58839697168
MD5 aae294f93bd4f42bc1d097db4f14f107
SHA1 441f8d07a728144656e0ed55d866b97475b25375
SHA512 2323b6801ef1779ed4f175bbd4e31b9efe8cc439b1312f82118cf5ea990ecc541d4b675bd75d798335beec4374b937bc2ba0d523af4fab95200234b82d3bf888
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//+:RWWBibah
MD5 SHA1 SHA512 SSDEEP

Submit Download

FFkSwMs.exe

Path C:\Windows\System\FFkSwMs.exe
Size 1.6MB
SHA256 ff542202a2344eb358c4f11d82382ab6a4939c05de9029e4a619bc84293447a3
MD5 005a30c2faf79db97c1e8f117f89714e
SHA1 1ff884a50ad6ab0cfb6a87c842b89a8f5b2c792a
SHA512 e2f4c6e96b4353e4cd747a9c17a9576c009a7ef06d104dfd6d2b582465ac6b5ae409b05c3745a3be1998c65586ef53e39257fcf99c4a3fa41ca40dbf48fb9d77
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//i:RWWBibat
MD5 SHA1 SHA512 SSDEEP

Submit Download

GSTbUtJ.exe

Path C:\Windows\System\GSTbUtJ.exe
Size 1.6MB
SHA256 01c137ebfa1c9100d5597c4d1c1d4fbe122a2c7215807267b3ce84f681ef864b
MD5 9be9aa3c783893b80af53ee3226355b3
SHA1 f0107b8e0dc06291b14b9a6b1c6612ce421f8aeb
SHA512 e2fed2d29ea5eb234b85af49b8891a5bfd88c200f29bcbd39b3c72e9f246a6665d752f1caed4c75c9f118ffed67de818e7f34c2be8d71a62de34a22e69464bf0
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//m:RWWBibaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

GgSIeqR.exe

Path C:\Windows\System\GgSIeqR.exe
Size 1.6MB
SHA256 3a3a3aca75ceda21bd4169fb282636f82385874b9f9e28a2c63266cef74051c5
MD5 710a29c2cd6f1df3f56708ab3b0d8928
SHA1 8ee1992d50a28b7de7770e8d45b63924d68dfe61
SHA512 4ea1ff33b8232fe531cba8b962ecfb100133ee5836b83fa8ca04475da839f75d980dd6f0d24aa9365d5c1115010a1216e70800de0a1f157c2b2aa6cd3a32415f
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//e:RWWBibar
MD5 SHA1 SHA512 SSDEEP

Submit Download

HBTaBGR.exe

Path C:\Windows\System\HBTaBGR.exe
Size 1.6MB
SHA256 7740b6323be2ad48496041f34307c56c3d78ed64064522cdf1d10e94da9a720c
MD5 82761c8ee9732636a0dc46dbea66e7c2
SHA1 ef84440ca1b5f8a37e848cb52c4b745a4cd6352f
SHA512 5ac81d1d9976d4f9837c0339b713634e548fd88961250122ae9943dc66a51ed3a722c475f609804ec1cd8f966fc9b1dd6787cbcc8a4aa0717d19ddd8f736475d
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//J:RWWBibaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

IYwwcPF.exe

Path C:\Windows\System\IYwwcPF.exe
Size 1.6MB
SHA256 d2fcc9ef5aae79ec4a29f70a2daf1c66ebd7f8a49d3aabca1fd29bd9f5a2a277
MD5 c23b7542f6d9a05e982cd63ad60dafc1
SHA1 05058c6ee80fb9b2db58bf3ba1d443c3f84dc92a
SHA512 9cd2d05b4e39dd1666e0bff56564c845cff3d434a8278dd0b0a5e74bf92d426b5c2437a4232f7358d0e6eea0d3e03e4a8630032215862ef5cd2574dc09244d5f
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//v:RWWBiba+
MD5 SHA1 SHA512 SSDEEP

Submit Download

JnEoGop.exe

Path C:\Windows\System\JnEoGop.exe
Size 1.6MB
SHA256 81cd70e51e0c0dc5824e6610b0d619e34f3b4571f44593fb83d0ecdb24f267d8
MD5 8548582824b4cf074802dc218147093c
SHA1 9b43283d87a70eb4177c4756776626daed6f2788
SHA512 ebf84a3c4bd4f1df7401351ca75bb0da199788a44a42627759e31c452de34eb3682d6d064090a1a97f73b5f2db97f8e4a3a4c111ca0e5f6247461f064ac9cc8f
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//P:RWWBiba2
MD5 SHA1 SHA512 SSDEEP

Submit Download

OPmyKZf.exe

Path C:\Windows\System\OPmyKZf.exe
Size 1.6MB
SHA256 50e0f4799bba80a50e282f02dad65818b9c933ad9d7b451bda1132be97ca76eb
MD5 f99a7efb2491015144fe390e26a4ffb7
SHA1 2fe39b9e4dedf9f9552207ebee25a74dec0b0ffd
SHA512 2de6db8ec4e94183fa887bf4dc77f3761ea4c21e2b67b02019199e9e34210b291546647e0fdfb7074d5086993ce78f49fadf6d8f88cd79a0e81ef937b73a15f1
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//7:RWWBiba+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ORCbEXB.exe

Path C:\Windows\System\ORCbEXB.exe
Size 1.6MB
SHA256 821f3d76849e87b1a4b7916140c9975d8e2c9c6ee86400fbe543ff37c5d12ad5
MD5 ba6ea091fa54875e19c28be5ab7a4ece
SHA1 62fb07516aeb0b3e5a5ef6717831da0a242bb4be
SHA512 20d5586bdd6b5965ac8b93a6db529f09cb6b2f4a5338734aae20b16b4b5f1da451ec67c2a2796981846907e92095533638ba5440fbd9c3456f3256920e351353
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//S:RWWBibap
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjlJrjj.exe

Path C:\Windows\System\SjlJrjj.exe
Size 1.6MB
SHA256 f0c09a157894b24041451702b560350e507b8b7e0239512900b5fb3aaf5adad5
MD5 4ae41d07f79195eb9cec334d3574db0f
SHA1 000b8e0ac3cbc98f6488e7f4fa4d6edeb9037524
SHA512 bd52388ea4555382654a6310eb767ba03451745daf98de67780b4ce2450b9eb0b64e1a9ab0057bc9c80bbc25014a4be81371df3dda6e7a2aace9b45e1d8fe5dd
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//9:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Submit Download

SziTQZA.exe

Path C:\Windows\System\SziTQZA.exe
Size 1.6MB
SHA256 1882c05d8087a8571e3e71c945b6a7b7bd7d480292a6dcda74a3c94996a47bca
MD5 d3f11f608ae31e59e417f2708ccf263b
SHA1 93c1e9ae514a7290eaf457bb2d54dc1062fd2d22
SHA512 7ee560a362b19066d7c1d353384ccb3da819926c142062b367e258155ac4e55657b55a9b78b78bcb346b86803099fb48c61c9dcc9aa62d2ba0cae09ed78997dd
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//h:RWWBibaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHROqeY.exe

Path C:\Windows\System\WHROqeY.exe
Size 1.6MB
SHA256 cf192c4c7ab764a91b09dd2482fec1a10a21dfab4b3651c8557c15407a1f23dc
MD5 b300905d359079e4eb7974361bf32724
SHA1 37ed402464e6997d0eda71e47589cf0744d5917c
SHA512 e154230587072b4b540bee465f76b2a5dd3549017366a319149ab091409e6a39df27ba0a778bb0d60ec7279be1bfc291cc342970ae653693b9db879e081e7e5a
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//5:RWWBiba4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WpzROZs.exe

Path C:\Windows\System\WpzROZs.exe
Size 1.6MB
SHA256 055812cf8183ab97d2579ab343e81efd7e3eb88b0c4fb27bd6b88132bb40f8d7
MD5 73f9af2cbbce1ae00e0202c29e619f85
SHA1 31377f28e0d2fa9c6b5f775c3de3398d638990ec
SHA512 32cc11b386e49666cf2e8ebff4b604592b0fb66343a841f10b56970c60ac5ea6d74c1f3ce68e4baa9ced7538c41a94503986e921cc19a502a87743fda8092f3c
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//N:RWWBibaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

XuvTLUJ.exe

Path C:\Windows\System\XuvTLUJ.exe
Size 1.6MB
SHA256 94f8328d5d18851f91b14916773aecddd9b75202d2fc2ff19316d3af7a0f18ee
MD5 576ab1cd4f591a8bc8df3c586b50de41
SHA1 9bfadd8e1f17b7aa0d901b46d5120fe00c6cb3fd
SHA512 7f4a6bd2ff3bab3044d3863d9710a5866d314b030c97edd14486ecdf13d6311783acd9374441d3115378a9d31fd225ea72a5f0193db77e4385f7c193946885d4
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//t:RWWBibaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

bTMAEMB.exe

Path C:\Windows\System\bTMAEMB.exe
Size 1.6MB
SHA256 7334534cbbc7d347139dc80f82c565758cb3c3ee784ee88ec37b8bcdfc31d2ed
MD5 51d6b165e91175d38ba0210604e3056d
SHA1 94481a4d384beaae4bc50a2af4b55fb6b68c3e69
SHA512 1cf5aea1e9b7382f16da7533bada6d99ea6977804bca184587b2d3c1a74faa2223a03ac3d2cb9da2ca42974584d6378e22523abe26d7ab2864297b8e5d31fc24
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//0:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dDEvcDT.exe

Path C:\Windows\System\dDEvcDT.exe
Size 1.6MB
SHA256 ad691a3adc2b3d441a36ca336339740de77826b346a67f14bb903ef922543d21
MD5 f35a77d44376fdc89abc4b599c3c5d70
SHA1 a4edebcc8594df44f78950a331898d8bcb310ddf
SHA512 a4f55828001c4136037ffa79d6899ae65d2cdb60c7f906397bb371c1f57742524695e5006691a4e35c86951f203521d9c466c6032e08a07a14b7cf22e8691028
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//M:RWWBibad
MD5 SHA1 SHA512 SSDEEP

Submit Download

dRUZTnh.exe

Path C:\Windows\System\dRUZTnh.exe
Size 1.6MB
SHA256 8c081154928eeeba052be276c2f3e233f966a0e8f1dd30d91d0626119222b823
MD5 97666fc80b1b7c8f102f29be568b35ee
SHA1 5427354d9e21d23bd61aeb00572b1b68ac212707
SHA512 75bf0deaf2e307138bf971aa26688755e71a51c81bc4721ee68b4b6a13512548b0bbefe78ca05d758381584386ca2880bdbf62dd4d7880a1bf7bbc6d55573e11
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//y:RWWBibaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dYpWDEH.exe

Path C:\Windows\System\dYpWDEH.exe
Size 1.6MB
SHA256 9a4308d839dec0805995ea0d38dae0d3abc760c73dc8527dfee8a922143ba606
MD5 285b7297ea0278dfce19efd30a4bad48
SHA1 cbce18784f01a7d66df981e4124fc3c97045b81b
SHA512 d79af96b9a7b31ba74446b1b6b7f2788d3b879d8f885f82e134436385c6ba9f81e3ebf3e38d4b528aef22d389e31b5455eb7b29dd5e78af9aedc6da613747e8c
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//l:RWWBibaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

drvVEGQ.exe

Path C:\Windows\System\drvVEGQ.exe
Size 1.6MB
SHA256 1ef394b84c9abbbfce35415d976d5648662c2926a3d0c5fe18bd85ff4d43c9b8
MD5 6fe78446cb353d809607731ba7e9e015
SHA1 ea981c1b312c1e38a976e00da3a4765479e41087
SHA512 7d5fed0af19ac5c38373bea01768979b26a1abbde8277038e4378e2d77970de52ff5525c77eb5afd36b9e80132342a872f774ba34a7e1ec52f29b2fb510db3ae
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//r0:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eHaHaxr.exe

Path C:\Windows\System\eHaHaxr.exe
Size 1.6MB
SHA256 f280b34393926051924c2c360b091bb2a7436aeaecb84aac4b4a02ced08f2545
MD5 bb102f872dec41efe224721de1157b4f
SHA1 6a61ac3609f68ea501d33e7fb56b0f77fe92b54b
SHA512 4fbe9142283f373dd3c459b4d387002e026de8b7cf4e6b33fd6816e3ca3268223a68a53234c490d8a28f05c90bf0f77a4a8764177425797ec8ec5d080f636b38
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//x:RWWBiba0
MD5 SHA1 SHA512 SSDEEP

Submit Download

gelGyOY.exe

Path C:\Windows\System\gelGyOY.exe
Size 1.6MB
SHA256 eab8b04e7dfab3253c0c682963e66042869a856b3ce1f92509a3df450732ed72
MD5 b31103bcdad3101b0022dc873dad3793
SHA1 78bacd32c8bd11b6b414e464f5fc4d26dcdecb2a
SHA512 a119ffc463a053d3bc749c907bf3f41c242ccab6e22fcbba989f4fa1c2f53f5eabcb5416b2165b3b661c29c7f7b70aa35d1d49f652c62ea38d7da4eb18921cbd
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//XX:RWWBiba4
MD5 SHA1 SHA512 SSDEEP

Submit Download

gwAbogZ.exe

Path C:\Windows\System\gwAbogZ.exe
Size 1.6MB
SHA256 4fad103c776744a06aca7765b0c2912962b1fe47a8711c9eae2c6677b3851103
MD5 ae5df05a5b8567cdbc6766657be0441d
SHA1 377a72ecd46b03e4bf8cb6e36b8f600a81d07a9f
SHA512 4ca1db5b3ae933147c22ff36bd7e944fb4d939c41c0c0eb16675d2fa5d5f00855efa4e26e34dccc4e3abd828cf7c984d69d613720c05f26f423c7e4ef91d55e6
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//s:RWWBibat
MD5 SHA1 SHA512 SSDEEP

Submit Download

iroXGYJ.exe

Path C:\Windows\System\iroXGYJ.exe
Size 1.6MB
SHA256 b20bf382fbd5167cb7667f9ad82462c68be3cd46c23d2890c8068715e79f8ffa
MD5 49826a8a095fcb6a6a9b1aa9ed0fc6dc
SHA1 8da8ded83a462e97476cac28692db268ffaad087
SHA512 02873c0a990346b7cf9334ca765b878d69e69c78087cd0ccbca85876a7f490d05efb181d146fc7a0d0805c742aef1177abb2063fa06c510cc153ecea95240c9a
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//L:RWWBibaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

kZylrma.exe

Path C:\Windows\System\kZylrma.exe
Size 1.6MB
SHA256 9204d423fcc6154289048910a682200789817381213e3cddc1470e6dae18d32a
MD5 0d61334fca58013c124a09844e413b99
SHA1 28330266c6a6ddff8434346aeb5d6f7f1a9988f7
SHA512 afacd635125eaff466c9bb5c1505b73dabd983c995608d7adb584d9ada03be03c85a98e87f3be6aaac33003560595296023804d558239134e5eb475885e9042d
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//c:RWWBibaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pKeQmFx.exe

Path C:\Windows\System\pKeQmFx.exe
Size 1.6MB
SHA256 f3e9081fddcc9bb66c02523c10618af7c68541ae1d409767c4b07c8eaf2b77a4
MD5 ef5499f1765f547e01de22345b98364b
SHA1 b8b624d8050a300c606d622809b3bcee409970a4
SHA512 a1873f67829c2c1cedf414a09d0c8d2deb9900a93090f6d05c010490caaed27d1d6a082d88a6a53c6eee3754e63ceb9ae3bab3be66ecec462443294af7cf19da
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//E:RWWBibap
MD5 SHA1 SHA512 SSDEEP

Submit Download

pVHmqAy.exe

Path C:\Windows\System\pVHmqAy.exe
Size 1.6MB
SHA256 b8a4b2138b124841ba67d7df2d0719be2477c6a1a4e74305578d6c88fc0b874b
MD5 c635e8ddf6321b996024ba9a42091f0c
SHA1 ccd6673217b8c9a033917872ff053a1e01845944
SHA512 ce67af5ab63714a1804e7f0d7cb707525cfa469377ae71232aeafd0c73ac2f215523516fb90f58479709e3841df92015875092c5c637419c88602ccbed5d72a2
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//w:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

qLtIFio.exe

Path C:\Windows\System\qLtIFio.exe
Size 1.6MB
SHA256 4c26042ac3cdd5fcaa9eb151110212ce360ff6322894bdd585e97d459fb55cea
MD5 7fa7f671f2af827f42d1b107d382a3ac
SHA1 8c079db7d96a9e2563567213a4163b42487f3197
SHA512 77c8bdcc12458ca0d513582c5fbb113480ef3f9913a082b969c3bf0087772e32bb283ec9f28c92dfab7ed1c83983fdd0009aff3d22a86809ec508b89f9f0bbca
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//g:RWWBibab
MD5 SHA1 SHA512 SSDEEP

Submit Download

uJvvgyp.exe

Path C:\Windows\System\uJvvgyp.exe
Size 1.6MB
SHA256 eebad86361b97de44f774fd1cb935b24c138e70d4b4225f0a424777735f22539
MD5 1e569f25e6a2f1d67ac042d23a67ed68
SHA1 93c653a51eb74e31031e8788de3e13c707234e4f
SHA512 f71cb931d2890e037df9607ef16c5a7a0b49f0137521566e151330c97487b0eaae85bd5de60391ac66f9b34d9b8a584958c7cc04ffabbdbd7f7ab645ae0e955b
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//3c:RWWBibaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wHCpJbT.exe

Path C:\Windows\System\wHCpJbT.exe
Size 1.6MB
SHA256 929e662505deba17f80afa967e98ce74bee6de4bc0bcee7b215116df2096b3e3
MD5 88e16b778b404abb95704d4af500343f
SHA1 42a6fb016a9097eb2432a2bb512c9af06f7b5c59
SHA512 9c0b72126fd641cfcf72b1885e59f3d87efcfa004a3a86239111cd1b8e6f491d7925b4c722e1294beb20f89bbda4ef40e7d4c104a95b5275db82de7fd3937a36
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//D:RWWBibaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ycXnkdD.exe

Path C:\Windows\System\ycXnkdD.exe
Size 1.6MB
SHA256 f59598e629576ebb062cdc2559ab39fde4cb340cc7ee596387043db3e11e641e
MD5 aba35841533573af065207549ee635c1
SHA1 208dfb02f4ca951d3d2a66c65499c66899ec6d20
SHA512 2b2a0db285200a0682caed9d67335bcf271df5dea1c10d125ea545b737f78deded98e7e97ff0f160dde5a7e002dc1247300e87ef131d3d1188f437aabfecafb4
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//s:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

zeEtPhT.exe

Path C:\Windows\System\zeEtPhT.exe
Size 1.6MB
SHA256 b8224c6a94ea6f7eb182041cf33b2b8667bacf5a36092b63ddecd93f0ca95888
MD5 3ff7ee4ac613c787797d6297f0750ea3
SHA1 0ebb683c4643d68e8c674a408bd675a72796705e
SHA512 3952dbc1dade63f55436667ab648c9c8fbcf949cc4d9a03edc8a10a40e31a3f29a02de8e5c835219f15dc1e4a9bd0f78e72fbf47aaa63079e971473185150c12
SSDEEP 49152:ROdWCCi7/rahOYilJ51subNWYyxVyY/s//p:RWWBibaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/500-2075-0x00007FF65E600000-0x00007FF65E951000-memory.dmp

Download

memory/500-195-0x00007FF65E600000-0x00007FF65E951000-memory.dmp

Download

memory/692-93-0x00007FF679B30000-0x00007FF679E81000-memory.dmp

Download

memory/692-2000-0x00007FF679B30000-0x00007FF679E81000-memory.dmp

Download

memory/1008-1964-0x00007FF7D6BA0000-0x00007FF7D6EF1000-memory.dmp

Download

memory/1008-131-0x00007FF7D6BA0000-0x00007FF7D6EF1000-memory.dmp

Download

memory/1192-194-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp

Download

memory/1192-1680-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp

Download

memory/1192-21-0x00007FF6297F0000-0x00007FF629B41000-memory.dmp

Download

memory/1336-112-0x00007FF64ACE0000-0x00007FF64B031000-memory.dmp

Download

memory/1336-2027-0x00007FF64ACE0000-0x00007FF64B031000-memory.dmp

Download

memory/1900-150-0x00007FF629BD0000-0x00007FF629F21000-memory.dmp

Download

memory/1900-2057-0x00007FF629BD0000-0x00007FF629F21000-memory.dmp

Download

memory/2184-1885-0x00007FF6EE6F0000-0x00007FF6EEA41000-memory.dmp

Download

memory/2184-32-0x00007FF6EE6F0000-0x00007FF6EEA41000-memory.dmp

Download

memory/2236-1748-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp

Download

memory/2236-9-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp

Download

memory/2236-61-0x00007FF6B3770000-0x00007FF6B3AC1000-memory.dmp

Download

memory/2240-0-0x00007FF7260F0000-0x00007FF726441000-memory.dmp

Download

memory/2240-57-0x00007FF7260F0000-0x00007FF726441000-memory.dmp

Download

memory/2240-1-0x000001F7D20F0000-0x000001F7D2100000-memory.dmp

Download

memory/2388-113-0x00007FF7F7310000-0x00007FF7F7661000-memory.dmp

Download

memory/2388-2049-0x00007FF7F7310000-0x00007FF7F7661000-memory.dmp

Download

memory/2660-83-0x00007FF762090000-0x00007FF7623E1000-memory.dmp

Download

memory/2660-1960-0x00007FF762090000-0x00007FF7623E1000-memory.dmp

Download

memory/2732-2097-0x00007FF76B620000-0x00007FF76B971000-memory.dmp

Download

memory/2732-54-0x00007FF76B620000-0x00007FF76B971000-memory.dmp

Download

memory/2848-1879-0x00007FF6B4C10000-0x00007FF6B4F61000-memory.dmp

Download

memory/2848-44-0x00007FF6B4C10000-0x00007FF6B4F61000-memory.dmp

Download

memory/2880-160-0x00007FF7689F0000-0x00007FF768D41000-memory.dmp

Download

memory/2880-2035-0x00007FF7689F0000-0x00007FF768D41000-memory.dmp

Download

memory/2928-1998-0x00007FF605210000-0x00007FF605561000-memory.dmp

Download

memory/2928-76-0x00007FF605210000-0x00007FF605561000-memory.dmp

Download

memory/3104-2083-0x00007FF610A40000-0x00007FF610D91000-memory.dmp

Download

memory/3104-175-0x00007FF610A40000-0x00007FF610D91000-memory.dmp

Download

memory/3736-27-0x00007FF63D8B0000-0x00007FF63DC01000-memory.dmp

Download

memory/3736-1018-0x00007FF63D8B0000-0x00007FF63DC01000-memory.dmp

Download

memory/3736-1761-0x00007FF63D8B0000-0x00007FF63DC01000-memory.dmp

Download

memory/3740-191-0x00007FF66D4A0000-0x00007FF66D7F1000-memory.dmp

Download

memory/3740-2046-0x00007FF66D4A0000-0x00007FF66D7F1000-memory.dmp

Download

memory/4072-196-0x00007FF69CF90000-0x00007FF69D2E1000-memory.dmp

Download

memory/4072-2008-0x00007FF69CF90000-0x00007FF69D2E1000-memory.dmp

Download

memory/4088-77-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp

Download

memory/4088-1642-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp

Download

memory/4088-17-0x00007FF609DF0000-0x00007FF60A141000-memory.dmp

Download

memory/4196-192-0x00007FF7B1640000-0x00007FF7B1991000-memory.dmp

Download

memory/4196-2040-0x00007FF7B1640000-0x00007FF7B1991000-memory.dmp

Download

memory/4524-105-0x00007FF722780000-0x00007FF722AD1000-memory.dmp

Download

memory/4524-2080-0x00007FF722780000-0x00007FF722AD1000-memory.dmp

Download

memory/4568-2006-0x00007FF707310000-0x00007FF707661000-memory.dmp

Download

memory/4568-128-0x00007FF707310000-0x00007FF707661000-memory.dmp

Download

memory/4628-189-0x00007FF7D98A0000-0x00007FF7D9BF1000-memory.dmp

Download

memory/4628-2086-0x00007FF7D98A0000-0x00007FF7D9BF1000-memory.dmp

Download

memory/4696-72-0x00007FF68A6D0000-0x00007FF68AA21000-memory.dmp

Download

memory/4696-1958-0x00007FF68A6D0000-0x00007FF68AA21000-memory.dmp

Download

memory/4744-43-0x00007FF6BE5C0000-0x00007FF6BE911000-memory.dmp

Download

memory/4744-1884-0x00007FF6BE5C0000-0x00007FF6BE911000-memory.dmp

Download

memory/4856-193-0x00007FF6C5F20000-0x00007FF6C6271000-memory.dmp

Download

memory/4856-2383-0x00007FF6C5F20000-0x00007FF6C6271000-memory.dmp

Download

memory/4984-197-0x00007FF667C20000-0x00007FF667F71000-memory.dmp

Download

memory/4984-2378-0x00007FF667C20000-0x00007FF667F71000-memory.dmp

Download

memory/4992-2178-0x00007FF71F910000-0x00007FF71FC61000-memory.dmp

Download

memory/4992-60-0x00007FF71F910000-0x00007FF71FC61000-memory.dmp

Download

memory/5108-145-0x00007FF7ACC60000-0x00007FF7ACFB1000-memory.dmp

Download

memory/5108-2098-0x00007FF7ACC60000-0x00007FF7ACFB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads