xmrig | c78c78ddb23c465d1584307ee5274645efd978efcab58838c93075a7d8ac5244

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
Size 2.1MB
Sample240524-fb1fradg2y
SHA256 c78c78ddb23c465d1584307ee5274645efd978efcab58838c93075a7d8ac5244
MD5 aa217b5f0ebb8f8364065ab9064982e0
SHA1 50830bf8b49050fc85823225928ce32404ed8b7c
SHA512 8fd6871a02b8dd192942cea0989c000868eab6e4de05046029417110fc781294f183343d4c22a9cc7a2a59e3f5336edb757247d10d1c955a5aefb8c21eb0abb7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTP:BemTLkNdfE0pZrQ/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/8-0-0x00007FF749090000-0x00007FF7493E4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023261-5.dat	xmrig
behavioral2/memory/5004-8-0x00007FF6FA630000-0x00007FF6FA984000-memory.dmp	xmrig
behavioral2/files/0x0008000000023264-10.dat	xmrig
behavioral2/files/0x0008000000023267-11.dat	xmrig
behavioral2/memory/2888-14-0x00007FF6525D0000-0x00007FF652924000-memory.dmp	xmrig
behavioral2/files/0x0008000000023269-21.dat	xmrig
behavioral2/memory/2384-24-0x00007FF7EF940000-0x00007FF7EFC94000-memory.dmp	xmrig
behavioral2/memory/516-26-0x00007FF6F5630000-0x00007FF6F5984000-memory.dmp	xmrig
behavioral2/files/0x000700000002326a-30.dat	xmrig
behavioral2/files/0x000700000002326b-40.dat	xmrig
behavioral2/files/0x000700000002326d-50.dat	xmrig
behavioral2/files/0x000700000002326e-55.dat	xmrig
behavioral2/files/0x000700000002326f-60.dat	xmrig
behavioral2/files/0x0007000000023272-74.dat	xmrig
behavioral2/files/0x0007000000023271-70.dat	xmrig
behavioral2/files/0x0007000000023273-80.dat	xmrig
behavioral2/files/0x0007000000023274-85.dat	xmrig
behavioral2/files/0x0007000000023275-90.dat	xmrig
behavioral2/files/0x0007000000023277-100.dat	xmrig
behavioral2/files/0x0007000000023279-110.dat	xmrig
behavioral2/files/0x000700000002327a-115.dat	xmrig
behavioral2/files/0x000700000002327b-119.dat	xmrig
behavioral2/files/0x000700000002327c-125.dat	xmrig
behavioral2/files/0x000700000002327d-130.dat	xmrig
behavioral2/files/0x000700000002327f-139.dat	xmrig
behavioral2/files/0x0007000000023280-145.dat	xmrig
behavioral2/files/0x0007000000023282-155.dat	xmrig
behavioral2/files/0x0007000000023283-160.dat	xmrig
behavioral2/files/0x0007000000023284-165.dat	xmrig
behavioral2/files/0x0007000000023281-150.dat	xmrig
behavioral2/files/0x000700000002327e-135.dat	xmrig
behavioral2/files/0x0007000000023278-105.dat	xmrig
behavioral2/memory/3912-230-0x00007FF7915E0000-0x00007FF791934000-memory.dmp	xmrig
behavioral2/files/0x0007000000023276-95.dat	xmrig
behavioral2/memory/1976-231-0x00007FF612270000-0x00007FF6125C4000-memory.dmp	xmrig
behavioral2/memory/3968-232-0x00007FF65A0C0000-0x00007FF65A414000-memory.dmp	xmrig
behavioral2/memory/940-234-0x00007FF693B80000-0x00007FF693ED4000-memory.dmp	xmrig
behavioral2/memory/2152-233-0x00007FF65FD60000-0x00007FF6600B4000-memory.dmp	xmrig
behavioral2/memory/2572-235-0x00007FF7FAF90000-0x00007FF7FB2E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023270-65.dat	xmrig
behavioral2/memory/916-236-0x00007FF7257B0000-0x00007FF725B04000-memory.dmp	xmrig
behavioral2/memory/4648-237-0x00007FF77C2D0000-0x00007FF77C624000-memory.dmp	xmrig
behavioral2/memory/3904-238-0x00007FF7B53D0000-0x00007FF7B5724000-memory.dmp	xmrig
behavioral2/memory/2124-239-0x00007FF68F8B0000-0x00007FF68FC04000-memory.dmp	xmrig
behavioral2/memory/752-241-0x00007FF6D0220000-0x00007FF6D0574000-memory.dmp	xmrig
behavioral2/memory/1076-240-0x00007FF7E9C10000-0x00007FF7E9F64000-memory.dmp	xmrig
behavioral2/files/0x000700000002326c-45.dat	xmrig
behavioral2/files/0x0008000000023265-35.dat	xmrig
behavioral2/memory/3452-242-0x00007FF6EE0D0000-0x00007FF6EE424000-memory.dmp	xmrig
behavioral2/memory/3764-246-0x00007FF725990000-0x00007FF725CE4000-memory.dmp	xmrig
behavioral2/memory/636-247-0x00007FF6A82C0000-0x00007FF6A8614000-memory.dmp	xmrig
behavioral2/memory/2648-248-0x00007FF6C4400000-0x00007FF6C4754000-memory.dmp	xmrig
behavioral2/memory/3320-249-0x00007FF796E00000-0x00007FF797154000-memory.dmp	xmrig
behavioral2/memory/2528-252-0x00007FF7070A0000-0x00007FF7073F4000-memory.dmp	xmrig
behavioral2/memory/3684-256-0x00007FF76FF90000-0x00007FF7702E4000-memory.dmp	xmrig
behavioral2/memory/732-253-0x00007FF63FDD0000-0x00007FF640124000-memory.dmp	xmrig
behavioral2/memory/2444-259-0x00007FF76F410000-0x00007FF76F764000-memory.dmp	xmrig
behavioral2/memory/3052-263-0x00007FF781970000-0x00007FF781CC4000-memory.dmp	xmrig
behavioral2/memory/924-260-0x00007FF690ED0000-0x00007FF691224000-memory.dmp	xmrig
behavioral2/memory/3572-264-0x00007FF7369C0000-0x00007FF736D14000-memory.dmp	xmrig
behavioral2/memory/2824-265-0x00007FF70E290000-0x00007FF70E5E4000-memory.dmp	xmrig
behavioral2/memory/5004-2039-0x00007FF6FA630000-0x00007FF6FA984000-memory.dmp	xmrig
behavioral2/memory/2888-2047-0x00007FF6525D0000-0x00007FF652924000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5004	FHnSXPr.exe
2888	vkMtBTj.exe
2384	lKRYrKl.exe
516	KgJzBPu.exe
3912	iMutirU.exe
1976	KXEmFsN.exe
3968	ZJPWBgs.exe
2152	AyPVxto.exe
940	hTGVeIb.exe
2572	CMXSWrM.exe
916	MzfjZVw.exe
4648	BAmAdtk.exe
3904	PwzhXef.exe
2124	IliMmXh.exe
1076	AFqSxEW.exe
752	PLIGzRJ.exe
3452	gCPYvhg.exe
3764	HSYGcAa.exe
636	eUrVYzu.exe
2648	drnRPQT.exe
3320	AYswVqB.exe
2528	pwYCjTW.exe
732	msQleeH.exe
3684	eCnbthI.exe
2444	dpdwzKK.exe
924	MyTqPoT.exe
3052	VREAFDq.exe
3572	VEilrXE.exe
2824	tvEPSIK.exe
3844	ktVcKec.exe
3536	qVOWwRn.exe
3044	dIDYvOb.exe
4072	OKKvyJA.exe
4372	nhZOICw.exe
1860	pmbZcLl.exe
1168	nxQrIeA.exe
3884	OLxSinE.exe
4332	qxWTXCO.exe
1776	bpzYKrf.exe
1508	lnQdkQh.exe
408	LpBZncr.exe
3112	wwAhaPy.exe
932	XzkWYQX.exe
1176	bOQpiIY.exe
3588	olbRoYE.exe
1792	YotBBxQ.exe
1156	DvxsKoT.exe
5012	QOwRJLy.exe
4508	SEpfqsy.exe
1296	bMeMdXC.exe
2240	PtDoJBF.exe
3644	owqmSNX.exe
512	DWosLGe.exe
1828	NNWdEOU.exe
4988	MSBPjJT.exe
1332	DdRNjzr.exe
540	dnSuaxi.exe
2192	sILDdzx.exe
4392	WzHdWhC.exe
2788	yWWAtrA.exe
2236	JpakmpU.exe
1160	lOQxZhc.exe
5032	KRJpMac.exe
3676	tqTbXEw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/8-0-0x00007FF749090000-0x00007FF7493E4000-memory.dmp	upx
behavioral2/files/0x0008000000023261-5.dat	upx
behavioral2/memory/5004-8-0x00007FF6FA630000-0x00007FF6FA984000-memory.dmp	upx
behavioral2/files/0x0008000000023264-10.dat	upx
behavioral2/files/0x0008000000023267-11.dat	upx
behavioral2/memory/2888-14-0x00007FF6525D0000-0x00007FF652924000-memory.dmp	upx
behavioral2/files/0x0008000000023269-21.dat	upx
behavioral2/memory/2384-24-0x00007FF7EF940000-0x00007FF7EFC94000-memory.dmp	upx
behavioral2/memory/516-26-0x00007FF6F5630000-0x00007FF6F5984000-memory.dmp	upx
behavioral2/files/0x000700000002326a-30.dat	upx
behavioral2/files/0x000700000002326b-40.dat	upx
behavioral2/files/0x000700000002326d-50.dat	upx
behavioral2/files/0x000700000002326e-55.dat	upx
behavioral2/files/0x000700000002326f-60.dat	upx
behavioral2/files/0x0007000000023272-74.dat	upx
behavioral2/files/0x0007000000023271-70.dat	upx
behavioral2/files/0x0007000000023273-80.dat	upx
behavioral2/files/0x0007000000023274-85.dat	upx
behavioral2/files/0x0007000000023275-90.dat	upx
behavioral2/files/0x0007000000023277-100.dat	upx
behavioral2/files/0x0007000000023279-110.dat	upx
behavioral2/files/0x000700000002327a-115.dat	upx
behavioral2/files/0x000700000002327b-119.dat	upx
behavioral2/files/0x000700000002327c-125.dat	upx
behavioral2/files/0x000700000002327d-130.dat	upx
behavioral2/files/0x000700000002327f-139.dat	upx
behavioral2/files/0x0007000000023280-145.dat	upx
behavioral2/files/0x0007000000023282-155.dat	upx
behavioral2/files/0x0007000000023283-160.dat	upx
behavioral2/files/0x0007000000023284-165.dat	upx
behavioral2/files/0x0007000000023281-150.dat	upx
behavioral2/files/0x000700000002327e-135.dat	upx
behavioral2/files/0x0007000000023278-105.dat	upx
behavioral2/memory/3912-230-0x00007FF7915E0000-0x00007FF791934000-memory.dmp	upx
behavioral2/files/0x0007000000023276-95.dat	upx
behavioral2/memory/1976-231-0x00007FF612270000-0x00007FF6125C4000-memory.dmp	upx
behavioral2/memory/3968-232-0x00007FF65A0C0000-0x00007FF65A414000-memory.dmp	upx
behavioral2/memory/940-234-0x00007FF693B80000-0x00007FF693ED4000-memory.dmp	upx
behavioral2/memory/2152-233-0x00007FF65FD60000-0x00007FF6600B4000-memory.dmp	upx
behavioral2/memory/2572-235-0x00007FF7FAF90000-0x00007FF7FB2E4000-memory.dmp	upx
behavioral2/files/0x0007000000023270-65.dat	upx
behavioral2/memory/916-236-0x00007FF7257B0000-0x00007FF725B04000-memory.dmp	upx
behavioral2/memory/4648-237-0x00007FF77C2D0000-0x00007FF77C624000-memory.dmp	upx
behavioral2/memory/3904-238-0x00007FF7B53D0000-0x00007FF7B5724000-memory.dmp	upx
behavioral2/memory/2124-239-0x00007FF68F8B0000-0x00007FF68FC04000-memory.dmp	upx
behavioral2/memory/752-241-0x00007FF6D0220000-0x00007FF6D0574000-memory.dmp	upx
behavioral2/memory/1076-240-0x00007FF7E9C10000-0x00007FF7E9F64000-memory.dmp	upx
behavioral2/files/0x000700000002326c-45.dat	upx
behavioral2/files/0x0008000000023265-35.dat	upx
behavioral2/memory/3452-242-0x00007FF6EE0D0000-0x00007FF6EE424000-memory.dmp	upx
behavioral2/memory/3764-246-0x00007FF725990000-0x00007FF725CE4000-memory.dmp	upx
behavioral2/memory/636-247-0x00007FF6A82C0000-0x00007FF6A8614000-memory.dmp	upx
behavioral2/memory/2648-248-0x00007FF6C4400000-0x00007FF6C4754000-memory.dmp	upx
behavioral2/memory/3320-249-0x00007FF796E00000-0x00007FF797154000-memory.dmp	upx
behavioral2/memory/2528-252-0x00007FF7070A0000-0x00007FF7073F4000-memory.dmp	upx
behavioral2/memory/3684-256-0x00007FF76FF90000-0x00007FF7702E4000-memory.dmp	upx
behavioral2/memory/732-253-0x00007FF63FDD0000-0x00007FF640124000-memory.dmp	upx
behavioral2/memory/2444-259-0x00007FF76F410000-0x00007FF76F764000-memory.dmp	upx
behavioral2/memory/3052-263-0x00007FF781970000-0x00007FF781CC4000-memory.dmp	upx
behavioral2/memory/924-260-0x00007FF690ED0000-0x00007FF691224000-memory.dmp	upx
behavioral2/memory/3572-264-0x00007FF7369C0000-0x00007FF736D14000-memory.dmp	upx
behavioral2/memory/2824-265-0x00007FF70E290000-0x00007FF70E5E4000-memory.dmp	upx
behavioral2/memory/5004-2039-0x00007FF6FA630000-0x00007FF6FA984000-memory.dmp	upx
behavioral2/memory/2888-2047-0x00007FF6525D0000-0x00007FF652924000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JpTATQk.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\QIzvlcq.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZgQUVPc.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\vMIdgHF.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\BAmAdtk.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\BzMPZMX.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\ndQdgjQ.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\jtTuSyM.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\FyIyzZS.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\FGZolVC.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\nHMozzd.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\KdiUMjX.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\IliMmXh.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\gUKPDdj.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\WgrDnLH.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\BSrVqcs.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\jDVpdRX.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\ueXNJgN.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\zhTjhVF.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\VCKSSGx.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\XfvLTkY.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\pNabtEI.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\fzrccJY.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\xFzoAYd.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\GHMLDTd.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\wAZbmQZ.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\JJwJVHC.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\pXEnBeY.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\CtVlyDy.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\EnIIjcC.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\BPMeUPS.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\KTeEQdm.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\WyevYqe.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\eUGVtTc.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\NQAKQXP.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\eLSDfxF.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\SgTinow.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\jyMEJwj.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\WWvYIpu.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\lluOtvK.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\emKGZwr.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\jbOtngF.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\IxyUBQy.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\oNPjVRo.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\NOoSntf.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\jGivWVv.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\pMKEjUI.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\aoLbOVY.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\OGSVxMT.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\npeZExL.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\uRJKoQx.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\bBXwERy.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\zNTNnjw.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\iJyZUng.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\pbrOTEV.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\SApyEIW.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\NjHlNqR.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\oWkLIFV.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\UrEyDmw.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\VDkIaHH.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\SbuegDG.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\NVqqUqx.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\MUTSakD.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
File created	C:\Windows\System\pEhNEgb.exe	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5004	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	90
PID 8 wrote to memory of 5004	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	90
PID 8 wrote to memory of 2888	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	91
PID 8 wrote to memory of 2888	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	91
PID 8 wrote to memory of 2384	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	92
PID 8 wrote to memory of 2384	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	92
PID 8 wrote to memory of 516	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	93
PID 8 wrote to memory of 516	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	93
PID 8 wrote to memory of 3912	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	94
PID 8 wrote to memory of 3912	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	94
PID 8 wrote to memory of 1976	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	95
PID 8 wrote to memory of 1976	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	95
PID 8 wrote to memory of 3968	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	96
PID 8 wrote to memory of 3968	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	96
PID 8 wrote to memory of 2152	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	97
PID 8 wrote to memory of 2152	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	97
PID 8 wrote to memory of 940	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	98
PID 8 wrote to memory of 940	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	98
PID 8 wrote to memory of 2572	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	99
PID 8 wrote to memory of 2572	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	99
PID 8 wrote to memory of 916	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	100
PID 8 wrote to memory of 916	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	100
PID 8 wrote to memory of 4648	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	101
PID 8 wrote to memory of 4648	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	101
PID 8 wrote to memory of 3904	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	102
PID 8 wrote to memory of 3904	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	102
PID 8 wrote to memory of 2124	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	103
PID 8 wrote to memory of 2124	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	103
PID 8 wrote to memory of 1076	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	104
PID 8 wrote to memory of 1076	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	104
PID 8 wrote to memory of 752	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	105
PID 8 wrote to memory of 752	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	105
PID 8 wrote to memory of 3452	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	106
PID 8 wrote to memory of 3452	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	106
PID 8 wrote to memory of 3764	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	107
PID 8 wrote to memory of 3764	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	107
PID 8 wrote to memory of 636	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	108
PID 8 wrote to memory of 636	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	108
PID 8 wrote to memory of 2648	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	109
PID 8 wrote to memory of 2648	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	109
PID 8 wrote to memory of 3320	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	110
PID 8 wrote to memory of 3320	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	110
PID 8 wrote to memory of 2528	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	111
PID 8 wrote to memory of 2528	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	111
PID 8 wrote to memory of 732	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	112
PID 8 wrote to memory of 732	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	112
PID 8 wrote to memory of 3684	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	113
PID 8 wrote to memory of 3684	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	113
PID 8 wrote to memory of 2444	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	114
PID 8 wrote to memory of 2444	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	114
PID 8 wrote to memory of 924	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	115
PID 8 wrote to memory of 924	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	115
PID 8 wrote to memory of 3052	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	116
PID 8 wrote to memory of 3052	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	116
PID 8 wrote to memory of 3572	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	117
PID 8 wrote to memory of 3572	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	117
PID 8 wrote to memory of 2824	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	118
PID 8 wrote to memory of 2824	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	118
PID 8 wrote to memory of 3844	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	119
PID 8 wrote to memory of 3844	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	119
PID 8 wrote to memory of 3536	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	120
PID 8 wrote to memory of 3536	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	120
PID 8 wrote to memory of 3044	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	121
PID 8 wrote to memory of 3044	8	aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aa217b5f0ebb8f8364065ab9064982e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\System\FHnSXPr.exe
  C:\Windows\System\FHnSXPr.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\vkMtBTj.exe
  C:\Windows\System\vkMtBTj.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\lKRYrKl.exe
  C:\Windows\System\lKRYrKl.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\KgJzBPu.exe
  C:\Windows\System\KgJzBPu.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\iMutirU.exe
  C:\Windows\System\iMutirU.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\KXEmFsN.exe
  C:\Windows\System\KXEmFsN.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\ZJPWBgs.exe
  C:\Windows\System\ZJPWBgs.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\AyPVxto.exe
  C:\Windows\System\AyPVxto.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\hTGVeIb.exe
  C:\Windows\System\hTGVeIb.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\CMXSWrM.exe
  C:\Windows\System\CMXSWrM.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\MzfjZVw.exe
  C:\Windows\System\MzfjZVw.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\BAmAdtk.exe
  C:\Windows\System\BAmAdtk.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\PwzhXef.exe
  C:\Windows\System\PwzhXef.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\IliMmXh.exe
  C:\Windows\System\IliMmXh.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\AFqSxEW.exe
  C:\Windows\System\AFqSxEW.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\PLIGzRJ.exe
  C:\Windows\System\PLIGzRJ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\gCPYvhg.exe
  C:\Windows\System\gCPYvhg.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\HSYGcAa.exe
  C:\Windows\System\HSYGcAa.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\eUrVYzu.exe
  C:\Windows\System\eUrVYzu.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\drnRPQT.exe
  C:\Windows\System\drnRPQT.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\AYswVqB.exe
  C:\Windows\System\AYswVqB.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\pwYCjTW.exe
  C:\Windows\System\pwYCjTW.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\msQleeH.exe
  C:\Windows\System\msQleeH.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\eCnbthI.exe
  C:\Windows\System\eCnbthI.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\dpdwzKK.exe
  C:\Windows\System\dpdwzKK.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\MyTqPoT.exe
  C:\Windows\System\MyTqPoT.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\VREAFDq.exe
  C:\Windows\System\VREAFDq.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\VEilrXE.exe
  C:\Windows\System\VEilrXE.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\tvEPSIK.exe
  C:\Windows\System\tvEPSIK.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ktVcKec.exe
  C:\Windows\System\ktVcKec.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\qVOWwRn.exe
  C:\Windows\System\qVOWwRn.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\dIDYvOb.exe
  C:\Windows\System\dIDYvOb.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\OKKvyJA.exe
  C:\Windows\System\OKKvyJA.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\nhZOICw.exe
  C:\Windows\System\nhZOICw.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\pmbZcLl.exe
  C:\Windows\System\pmbZcLl.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\nxQrIeA.exe
  C:\Windows\System\nxQrIeA.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\OLxSinE.exe
  C:\Windows\System\OLxSinE.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\qxWTXCO.exe
  C:\Windows\System\qxWTXCO.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\bpzYKrf.exe
  C:\Windows\System\bpzYKrf.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\lnQdkQh.exe
  C:\Windows\System\lnQdkQh.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\LpBZncr.exe
  C:\Windows\System\LpBZncr.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\wwAhaPy.exe
  C:\Windows\System\wwAhaPy.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\XzkWYQX.exe
  C:\Windows\System\XzkWYQX.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\bOQpiIY.exe
  C:\Windows\System\bOQpiIY.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\olbRoYE.exe
  C:\Windows\System\olbRoYE.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\YotBBxQ.exe
  C:\Windows\System\YotBBxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\DvxsKoT.exe
  C:\Windows\System\DvxsKoT.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\QOwRJLy.exe
  C:\Windows\System\QOwRJLy.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\SEpfqsy.exe
  C:\Windows\System\SEpfqsy.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\bMeMdXC.exe
  C:\Windows\System\bMeMdXC.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\PtDoJBF.exe
  C:\Windows\System\PtDoJBF.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\owqmSNX.exe
  C:\Windows\System\owqmSNX.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\DWosLGe.exe
  C:\Windows\System\DWosLGe.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\NNWdEOU.exe
  C:\Windows\System\NNWdEOU.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\MSBPjJT.exe
  C:\Windows\System\MSBPjJT.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\DdRNjzr.exe
  C:\Windows\System\DdRNjzr.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\dnSuaxi.exe
  C:\Windows\System\dnSuaxi.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\sILDdzx.exe
  C:\Windows\System\sILDdzx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\WzHdWhC.exe
  C:\Windows\System\WzHdWhC.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\yWWAtrA.exe
  C:\Windows\System\yWWAtrA.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\JpakmpU.exe
  C:\Windows\System\JpakmpU.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\lOQxZhc.exe
  C:\Windows\System\lOQxZhc.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\KRJpMac.exe
  C:\Windows\System\KRJpMac.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\tqTbXEw.exe
  C:\Windows\System\tqTbXEw.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\GbQRmRc.exe
  C:\Windows\System\GbQRmRc.exe
  2⤵
  PID:4348
- C:\Windows\System\oNVLhZb.exe
  C:\Windows\System\oNVLhZb.exe
  2⤵
  PID:2856
- C:\Windows\System\CAURIUC.exe
  C:\Windows\System\CAURIUC.exe
  2⤵
  PID:4100
- C:\Windows\System\etLWurl.exe
  C:\Windows\System\etLWurl.exe
  2⤵
  PID:2656
- C:\Windows\System\RdnPjVH.exe
  C:\Windows\System\RdnPjVH.exe
  2⤵
  PID:4740
- C:\Windows\System\cZlFQgS.exe
  C:\Windows\System\cZlFQgS.exe
  2⤵
  PID:1968
- C:\Windows\System\BSrVqcs.exe
  C:\Windows\System\BSrVqcs.exe
  2⤵
  PID:1612
- C:\Windows\System\ZyijUZg.exe
  C:\Windows\System\ZyijUZg.exe
  2⤵
  PID:2140
- C:\Windows\System\rPlidVv.exe
  C:\Windows\System\rPlidVv.exe
  2⤵
  PID:676
- C:\Windows\System\UUMKBTt.exe
  C:\Windows\System\UUMKBTt.exe
  2⤵
  PID:556
- C:\Windows\System\hqeLRlG.exe
  C:\Windows\System\hqeLRlG.exe
  2⤵
  PID:3364
- C:\Windows\System\ivtJJKC.exe
  C:\Windows\System\ivtJJKC.exe
  2⤵
  PID:920
- C:\Windows\System\pdidLhZ.exe
  C:\Windows\System\pdidLhZ.exe
  2⤵
  PID:1712
- C:\Windows\System\qvsbxYH.exe
  C:\Windows\System\qvsbxYH.exe
  2⤵
  PID:2836
- C:\Windows\System\bZLYsRU.exe
  C:\Windows\System\bZLYsRU.exe
  2⤵
  PID:2176
- C:\Windows\System\xycdzJA.exe
  C:\Windows\System\xycdzJA.exe
  2⤵
  PID:3048
- C:\Windows\System\HKNMfQg.exe
  C:\Windows\System\HKNMfQg.exe
  2⤵
  PID:4528
- C:\Windows\System\efhOkrt.exe
  C:\Windows\System\efhOkrt.exe
  2⤵
  PID:1004
- C:\Windows\System\SgTinow.exe
  C:\Windows\System\SgTinow.exe
  2⤵
  PID:1628
- C:\Windows\System\yRUmPPg.exe
  C:\Windows\System\yRUmPPg.exe
  2⤵
  PID:4620
- C:\Windows\System\jMoaljV.exe
  C:\Windows\System\jMoaljV.exe
  2⤵
  PID:4884
- C:\Windows\System\eaKqrry.exe
  C:\Windows\System\eaKqrry.exe
  2⤵
  PID:368
- C:\Windows\System\uXaiRvz.exe
  C:\Windows\System\uXaiRvz.exe
  2⤵
  PID:2880
- C:\Windows\System\wDtXMNO.exe
  C:\Windows\System\wDtXMNO.exe
  2⤵
  PID:3656
- C:\Windows\System\WCnTElv.exe
  C:\Windows\System\WCnTElv.exe
  2⤵
  PID:5148
- C:\Windows\System\kvcsYVL.exe
  C:\Windows\System\kvcsYVL.exe
  2⤵
  PID:5188
- C:\Windows\System\hdKrWtj.exe
  C:\Windows\System\hdKrWtj.exe
  2⤵
  PID:5216
- C:\Windows\System\KnCcFYz.exe
  C:\Windows\System\KnCcFYz.exe
  2⤵
  PID:5240
- C:\Windows\System\oYnVWAC.exe
  C:\Windows\System\oYnVWAC.exe
  2⤵
  PID:5256
- C:\Windows\System\fAhlfNX.exe
  C:\Windows\System\fAhlfNX.exe
  2⤵
  PID:5288
- C:\Windows\System\ApMAkOI.exe
  C:\Windows\System\ApMAkOI.exe
  2⤵
  PID:5316
- C:\Windows\System\wmIwGCW.exe
  C:\Windows\System\wmIwGCW.exe
  2⤵
  PID:5344
- C:\Windows\System\zPbiJtO.exe
  C:\Windows\System\zPbiJtO.exe
  2⤵
  PID:5384
- C:\Windows\System\RkbppQH.exe
  C:\Windows\System\RkbppQH.exe
  2⤵
  PID:5416
- C:\Windows\System\vOYLDhF.exe
  C:\Windows\System\vOYLDhF.exe
  2⤵
  PID:5444
- C:\Windows\System\XPBRdIo.exe
  C:\Windows\System\XPBRdIo.exe
  2⤵
  PID:5472
- C:\Windows\System\AdmnXyC.exe
  C:\Windows\System\AdmnXyC.exe
  2⤵
  PID:5500
- C:\Windows\System\MUTSakD.exe
  C:\Windows\System\MUTSakD.exe
  2⤵
  PID:5528
- C:\Windows\System\Quxldrq.exe
  C:\Windows\System\Quxldrq.exe
  2⤵
  PID:5556
- C:\Windows\System\eisgJAD.exe
  C:\Windows\System\eisgJAD.exe
  2⤵
  PID:5584
- C:\Windows\System\TJqPoyP.exe
  C:\Windows\System\TJqPoyP.exe
  2⤵
  PID:5612
- C:\Windows\System\VsHYhPv.exe
  C:\Windows\System\VsHYhPv.exe
  2⤵
  PID:5640
- C:\Windows\System\rqlYgeN.exe
  C:\Windows\System\rqlYgeN.exe
  2⤵
  PID:5668
- C:\Windows\System\aNhswFh.exe
  C:\Windows\System\aNhswFh.exe
  2⤵
  PID:5696
- C:\Windows\System\SDguxvs.exe
  C:\Windows\System\SDguxvs.exe
  2⤵
  PID:5712
- C:\Windows\System\QBxSWLS.exe
  C:\Windows\System\QBxSWLS.exe
  2⤵
  PID:5740
- C:\Windows\System\asyipEx.exe
  C:\Windows\System\asyipEx.exe
  2⤵
  PID:5756
- C:\Windows\System\oNPjVRo.exe
  C:\Windows\System\oNPjVRo.exe
  2⤵
  PID:5788
- C:\Windows\System\hBHvyRn.exe
  C:\Windows\System\hBHvyRn.exe
  2⤵
  PID:5808
- C:\Windows\System\TLYJGRz.exe
  C:\Windows\System\TLYJGRz.exe
  2⤵
  PID:5828
- C:\Windows\System\EHdWJhp.exe
  C:\Windows\System\EHdWJhp.exe
  2⤵
  PID:5852
- C:\Windows\System\UsHoWmF.exe
  C:\Windows\System\UsHoWmF.exe
  2⤵
  PID:5920
- C:\Windows\System\FOXurJK.exe
  C:\Windows\System\FOXurJK.exe
  2⤵
  PID:5936
- C:\Windows\System\qsUldUd.exe
  C:\Windows\System\qsUldUd.exe
  2⤵
  PID:5960
- C:\Windows\System\aftNEqj.exe
  C:\Windows\System\aftNEqj.exe
  2⤵
  PID:5980
- C:\Windows\System\NQAKQXP.exe
  C:\Windows\System\NQAKQXP.exe
  2⤵
  PID:6008
- C:\Windows\System\ovuCuTS.exe
  C:\Windows\System\ovuCuTS.exe
  2⤵
  PID:6036
- C:\Windows\System\bBXwERy.exe
  C:\Windows\System\bBXwERy.exe
  2⤵
  PID:6060
- C:\Windows\System\svlenVr.exe
  C:\Windows\System\svlenVr.exe
  2⤵
  PID:6076
- C:\Windows\System\sokdWZB.exe
  C:\Windows\System\sokdWZB.exe
  2⤵
  PID:6108
- C:\Windows\System\xQivfla.exe
  C:\Windows\System\xQivfla.exe
  2⤵
  PID:5140
- C:\Windows\System\JsSLFAH.exe
  C:\Windows\System\JsSLFAH.exe
  2⤵
  PID:5180
- C:\Windows\System\cKKUlpm.exe
  C:\Windows\System\cKKUlpm.exe
  2⤵
  PID:5264
- C:\Windows\System\WEseeig.exe
  C:\Windows\System\WEseeig.exe
  2⤵
  PID:5308
- C:\Windows\System\KBeoxVv.exe
  C:\Windows\System\KBeoxVv.exe
  2⤵
  PID:5364
- C:\Windows\System\XuIsAuQ.exe
  C:\Windows\System\XuIsAuQ.exe
  2⤵
  PID:5440
- C:\Windows\System\BWeYFhk.exe
  C:\Windows\System\BWeYFhk.exe
  2⤵
  PID:5548
- C:\Windows\System\CUYUQAq.exe
  C:\Windows\System\CUYUQAq.exe
  2⤵
  PID:5660
- C:\Windows\System\ieCbEWy.exe
  C:\Windows\System\ieCbEWy.exe
  2⤵
  PID:5708
- C:\Windows\System\OaSTloI.exe
  C:\Windows\System\OaSTloI.exe
  2⤵
  PID:5772
- C:\Windows\System\RfHvERy.exe
  C:\Windows\System\RfHvERy.exe
  2⤵
  PID:5816
- C:\Windows\System\mjmMOYM.exe
  C:\Windows\System\mjmMOYM.exe
  2⤵
  PID:5884
- C:\Windows\System\RKlWNvK.exe
  C:\Windows\System\RKlWNvK.exe
  2⤵
  PID:5948
- C:\Windows\System\zouEApD.exe
  C:\Windows\System\zouEApD.exe
  2⤵
  PID:6000
- C:\Windows\System\ogeFNJg.exe
  C:\Windows\System\ogeFNJg.exe
  2⤵
  PID:6100
- C:\Windows\System\mgINHjO.exe
  C:\Windows\System\mgINHjO.exe
  2⤵
  PID:5228
- C:\Windows\System\oSEjecQ.exe
  C:\Windows\System\oSEjecQ.exe
  2⤵
  PID:5284
- C:\Windows\System\kvnaVfc.exe
  C:\Windows\System\kvnaVfc.exe
  2⤵
  PID:5428
- C:\Windows\System\SkjlRHL.exe
  C:\Windows\System\SkjlRHL.exe
  2⤵
  PID:5636
- C:\Windows\System\NNNbSsi.exe
  C:\Windows\System\NNNbSsi.exe
  2⤵
  PID:5804
- C:\Windows\System\GETQwfz.exe
  C:\Windows\System\GETQwfz.exe
  2⤵
  PID:5916
- C:\Windows\System\aoLbOVY.exe
  C:\Windows\System\aoLbOVY.exe
  2⤵
  PID:5928
- C:\Windows\System\kQyUdHF.exe
  C:\Windows\System\kQyUdHF.exe
  2⤵
  PID:6132
- C:\Windows\System\uCcboWH.exe
  C:\Windows\System\uCcboWH.exe
  2⤵
  PID:5524
- C:\Windows\System\QturoQp.exe
  C:\Windows\System\QturoQp.exe
  2⤵
  PID:6052
- C:\Windows\System\GPwVhTs.exe
  C:\Windows\System\GPwVhTs.exe
  2⤵
  PID:5368
- C:\Windows\System\hzAilVu.exe
  C:\Windows\System\hzAilVu.exe
  2⤵
  PID:3020
- C:\Windows\System\XABdWMR.exe
  C:\Windows\System\XABdWMR.exe
  2⤵
  PID:6176
- C:\Windows\System\DeEFXEW.exe
  C:\Windows\System\DeEFXEW.exe
  2⤵
  PID:6200
- C:\Windows\System\JpTATQk.exe
  C:\Windows\System\JpTATQk.exe
  2⤵
  PID:6228
- C:\Windows\System\RFDzXGU.exe
  C:\Windows\System\RFDzXGU.exe
  2⤵
  PID:6252
- C:\Windows\System\OhLvJKw.exe
  C:\Windows\System\OhLvJKw.exe
  2⤵
  PID:6272
- C:\Windows\System\ZdwYgLm.exe
  C:\Windows\System\ZdwYgLm.exe
  2⤵
  PID:6316
- C:\Windows\System\MdOBdNI.exe
  C:\Windows\System\MdOBdNI.exe
  2⤵
  PID:6336
- C:\Windows\System\RvBPOEj.exe
  C:\Windows\System\RvBPOEj.exe
  2⤵
  PID:6356
- C:\Windows\System\rkUmkEx.exe
  C:\Windows\System\rkUmkEx.exe
  2⤵
  PID:6384
- C:\Windows\System\bTEBafq.exe
  C:\Windows\System\bTEBafq.exe
  2⤵
  PID:6408
- C:\Windows\System\BETiOci.exe
  C:\Windows\System\BETiOci.exe
  2⤵
  PID:6424
- C:\Windows\System\HuWONpM.exe
  C:\Windows\System\HuWONpM.exe
  2⤵
  PID:6452
- C:\Windows\System\OQijDbT.exe
  C:\Windows\System\OQijDbT.exe
  2⤵
  PID:6476
- C:\Windows\System\fGVKjwh.exe
  C:\Windows\System\fGVKjwh.exe
  2⤵
  PID:6512
- C:\Windows\System\tGYkffX.exe
  C:\Windows\System\tGYkffX.exe
  2⤵
  PID:6544
- C:\Windows\System\FNnRyQv.exe
  C:\Windows\System\FNnRyQv.exe
  2⤵
  PID:6592
- C:\Windows\System\AhdOxtx.exe
  C:\Windows\System\AhdOxtx.exe
  2⤵
  PID:6632
- C:\Windows\System\lrcJzIw.exe
  C:\Windows\System\lrcJzIw.exe
  2⤵
  PID:6656
- C:\Windows\System\vpxVLvx.exe
  C:\Windows\System\vpxVLvx.exe
  2⤵
  PID:6680
- C:\Windows\System\AJMdsvr.exe
  C:\Windows\System\AJMdsvr.exe
  2⤵
  PID:6708
- C:\Windows\System\HVCGceR.exe
  C:\Windows\System\HVCGceR.exe
  2⤵
  PID:6728
- C:\Windows\System\CjOldIg.exe
  C:\Windows\System\CjOldIg.exe
  2⤵
  PID:6748
- C:\Windows\System\bhhypCW.exe
  C:\Windows\System\bhhypCW.exe
  2⤵
  PID:6792
- C:\Windows\System\tQubiLq.exe
  C:\Windows\System\tQubiLq.exe
  2⤵
  PID:6812
- C:\Windows\System\uRrzYFz.exe
  C:\Windows\System\uRrzYFz.exe
  2⤵
  PID:6864
- C:\Windows\System\XcBGkOH.exe
  C:\Windows\System\XcBGkOH.exe
  2⤵
  PID:6892
- C:\Windows\System\LfXcrab.exe
  C:\Windows\System\LfXcrab.exe
  2⤵
  PID:6908
- C:\Windows\System\HKEQBsV.exe
  C:\Windows\System\HKEQBsV.exe
  2⤵
  PID:6936
- C:\Windows\System\QevgAvJ.exe
  C:\Windows\System\QevgAvJ.exe
  2⤵
  PID:6960
- C:\Windows\System\kMwFGHO.exe
  C:\Windows\System\kMwFGHO.exe
  2⤵
  PID:6980
- C:\Windows\System\WGWcjTT.exe
  C:\Windows\System\WGWcjTT.exe
  2⤵
  PID:7008
- C:\Windows\System\fjNbvhE.exe
  C:\Windows\System\fjNbvhE.exe
  2⤵
  PID:7040
- C:\Windows\System\wvktTaL.exe
  C:\Windows\System\wvktTaL.exe
  2⤵
  PID:7064
- C:\Windows\System\PitKbDk.exe
  C:\Windows\System\PitKbDk.exe
  2⤵
  PID:7092
- C:\Windows\System\rrZjPyq.exe
  C:\Windows\System\rrZjPyq.exe
  2⤵
  PID:7112
- C:\Windows\System\ALtlnkQ.exe
  C:\Windows\System\ALtlnkQ.exe
  2⤵
  PID:7144
- C:\Windows\System\ueXNJgN.exe
  C:\Windows\System\ueXNJgN.exe
  2⤵
  PID:6160
- C:\Windows\System\GHMLDTd.exe
  C:\Windows\System\GHMLDTd.exe
  2⤵
  PID:6216
- C:\Windows\System\kskiJDj.exe
  C:\Windows\System\kskiJDj.exe
  2⤵
  PID:6300
- C:\Windows\System\FyIyzZS.exe
  C:\Windows\System\FyIyzZS.exe
  2⤵
  PID:6344
- C:\Windows\System\oXfGUCL.exe
  C:\Windows\System\oXfGUCL.exe
  2⤵
  PID:6372
- C:\Windows\System\lDzOiIo.exe
  C:\Windows\System\lDzOiIo.exe
  2⤵
  PID:6496
- C:\Windows\System\PIJyOVt.exe
  C:\Windows\System\PIJyOVt.exe
  2⤵
  PID:6472
- C:\Windows\System\VhFEpZC.exe
  C:\Windows\System\VhFEpZC.exe
  2⤵
  PID:6604
- C:\Windows\System\MSNFGaS.exe
  C:\Windows\System\MSNFGaS.exe
  2⤵
  PID:6672
- C:\Windows\System\vhcIclh.exe
  C:\Windows\System\vhcIclh.exe
  2⤵
  PID:6676
- C:\Windows\System\PJXVuZE.exe
  C:\Windows\System\PJXVuZE.exe
  2⤵
  PID:6780
- C:\Windows\System\vNDNTKO.exe
  C:\Windows\System\vNDNTKO.exe
  2⤵
  PID:6804
- C:\Windows\System\pdVWIlB.exe
  C:\Windows\System\pdVWIlB.exe
  2⤵
  PID:6880
- C:\Windows\System\twEqSSG.exe
  C:\Windows\System\twEqSSG.exe
  2⤵
  PID:6148
- C:\Windows\System\zhTjhVF.exe
  C:\Windows\System\zhTjhVF.exe
  2⤵
  PID:7104
- C:\Windows\System\osIcgPS.exe
  C:\Windows\System\osIcgPS.exe
  2⤵
  PID:6220
- C:\Windows\System\lEHyZot.exe
  C:\Windows\System\lEHyZot.exe
  2⤵
  PID:6440
- C:\Windows\System\gvXrQUe.exe
  C:\Windows\System\gvXrQUe.exe
  2⤵
  PID:6524
- C:\Windows\System\dKxomxX.exe
  C:\Windows\System\dKxomxX.exe
  2⤵
  PID:6764
- C:\Windows\System\zxPGexx.exe
  C:\Windows\System\zxPGexx.exe
  2⤵
  PID:6852
- C:\Windows\System\NhMWZuV.exe
  C:\Windows\System\NhMWZuV.exe
  2⤵
  PID:7120
- C:\Windows\System\gluPubH.exe
  C:\Windows\System\gluPubH.exe
  2⤵
  PID:6280
- C:\Windows\System\LzYTwhm.exe
  C:\Windows\System\LzYTwhm.exe
  2⤵
  PID:6600
- C:\Windows\System\TFvzeij.exe
  C:\Windows\System\TFvzeij.exe
  2⤵
  PID:7084
- C:\Windows\System\KyEjWxo.exe
  C:\Windows\System\KyEjWxo.exe
  2⤵
  PID:6740
- C:\Windows\System\KWitDqd.exe
  C:\Windows\System\KWitDqd.exe
  2⤵
  PID:7184
- C:\Windows\System\SSCMcVo.exe
  C:\Windows\System\SSCMcVo.exe
  2⤵
  PID:7208
- C:\Windows\System\PDLlyQH.exe
  C:\Windows\System\PDLlyQH.exe
  2⤵
  PID:7244
- C:\Windows\System\vqXYvSP.exe
  C:\Windows\System\vqXYvSP.exe
  2⤵
  PID:7272
- C:\Windows\System\bkCOmgT.exe
  C:\Windows\System\bkCOmgT.exe
  2⤵
  PID:7300
- C:\Windows\System\wboGNTU.exe
  C:\Windows\System\wboGNTU.exe
  2⤵
  PID:7324
- C:\Windows\System\DZCUWCd.exe
  C:\Windows\System\DZCUWCd.exe
  2⤵
  PID:7352
- C:\Windows\System\NGtBGxD.exe
  C:\Windows\System\NGtBGxD.exe
  2⤵
  PID:7384
- C:\Windows\System\yfENChW.exe
  C:\Windows\System\yfENChW.exe
  2⤵
  PID:7408
- C:\Windows\System\RROFcpU.exe
  C:\Windows\System\RROFcpU.exe
  2⤵
  PID:7428
- C:\Windows\System\SQzxlmo.exe
  C:\Windows\System\SQzxlmo.exe
  2⤵
  PID:7464
- C:\Windows\System\wcChNWF.exe
  C:\Windows\System\wcChNWF.exe
  2⤵
  PID:7508
- C:\Windows\System\hBqbnJB.exe
  C:\Windows\System\hBqbnJB.exe
  2⤵
  PID:7532
- C:\Windows\System\NItpdjt.exe
  C:\Windows\System\NItpdjt.exe
  2⤵
  PID:7572
- C:\Windows\System\bwWnzsY.exe
  C:\Windows\System\bwWnzsY.exe
  2⤵
  PID:7600
- C:\Windows\System\QDkIazD.exe
  C:\Windows\System\QDkIazD.exe
  2⤵
  PID:7624
- C:\Windows\System\rllmGYl.exe
  C:\Windows\System\rllmGYl.exe
  2⤵
  PID:7652
- C:\Windows\System\OHyGROQ.exe
  C:\Windows\System\OHyGROQ.exe
  2⤵
  PID:7676
- C:\Windows\System\mzqcrOn.exe
  C:\Windows\System\mzqcrOn.exe
  2⤵
  PID:7708
- C:\Windows\System\DltEAKj.exe
  C:\Windows\System\DltEAKj.exe
  2⤵
  PID:7732
- C:\Windows\System\vEKnzLs.exe
  C:\Windows\System\vEKnzLs.exe
  2⤵
  PID:7760
- C:\Windows\System\NuFDQcG.exe
  C:\Windows\System\NuFDQcG.exe
  2⤵
  PID:7784
- C:\Windows\System\ydCTOiV.exe
  C:\Windows\System\ydCTOiV.exe
  2⤵
  PID:7844
- C:\Windows\System\olXIaQO.exe
  C:\Windows\System\olXIaQO.exe
  2⤵
  PID:7888
- C:\Windows\System\frztdsd.exe
  C:\Windows\System\frztdsd.exe
  2⤵
  PID:7908
- C:\Windows\System\qPGOgdE.exe
  C:\Windows\System\qPGOgdE.exe
  2⤵
  PID:7936
- C:\Windows\System\WzfoAcx.exe
  C:\Windows\System\WzfoAcx.exe
  2⤵
  PID:7952
- C:\Windows\System\tFihGwF.exe
  C:\Windows\System\tFihGwF.exe
  2⤵
  PID:7980
- C:\Windows\System\huIiHBw.exe
  C:\Windows\System\huIiHBw.exe
  2⤵
  PID:8004
- C:\Windows\System\JYpYyFs.exe
  C:\Windows\System\JYpYyFs.exe
  2⤵
  PID:8020
- C:\Windows\System\aaGVENl.exe
  C:\Windows\System\aaGVENl.exe
  2⤵
  PID:8044
- C:\Windows\System\PbPxOZv.exe
  C:\Windows\System\PbPxOZv.exe
  2⤵
  PID:8060
- C:\Windows\System\YVsGwjW.exe
  C:\Windows\System\YVsGwjW.exe
  2⤵
  PID:8076
- C:\Windows\System\xCsyKPM.exe
  C:\Windows\System\xCsyKPM.exe
  2⤵
  PID:8104
- C:\Windows\System\jiFRDfM.exe
  C:\Windows\System\jiFRDfM.exe
  2⤵
  PID:8128
- C:\Windows\System\tPQxqbQ.exe
  C:\Windows\System\tPQxqbQ.exe
  2⤵
  PID:8148
- C:\Windows\System\RQZKtDY.exe
  C:\Windows\System\RQZKtDY.exe
  2⤵
  PID:8172
- C:\Windows\System\ItRYRmH.exe
  C:\Windows\System\ItRYRmH.exe
  2⤵
  PID:7020
- C:\Windows\System\MUThSdN.exe
  C:\Windows\System\MUThSdN.exe
  2⤵
  PID:7220
- C:\Windows\System\ySXBwvz.exe
  C:\Windows\System\ySXBwvz.exe
  2⤵
  PID:7316
- C:\Windows\System\cDohyUj.exe
  C:\Windows\System\cDohyUj.exe
  2⤵
  PID:7336
- C:\Windows\System\yfLovsa.exe
  C:\Windows\System\yfLovsa.exe
  2⤵
  PID:7436
- C:\Windows\System\RQZTGyl.exe
  C:\Windows\System\RQZTGyl.exe
  2⤵
  PID:7544
- C:\Windows\System\jyMEJwj.exe
  C:\Windows\System\jyMEJwj.exe
  2⤵
  PID:7584
- C:\Windows\System\TOgAUtD.exe
  C:\Windows\System\TOgAUtD.exe
  2⤵
  PID:7720
- C:\Windows\System\EPYtrMK.exe
  C:\Windows\System\EPYtrMK.exe
  2⤵
  PID:7744
- C:\Windows\System\KhOSnHo.exe
  C:\Windows\System\KhOSnHo.exe
  2⤵
  PID:7308
- C:\Windows\System\SviTSfH.exe
  C:\Windows\System\SviTSfH.exe
  2⤵
  PID:7876
- C:\Windows\System\qMIoLTY.exe
  C:\Windows\System\qMIoLTY.exe
  2⤵
  PID:7920
- C:\Windows\System\aHInpzn.exe
  C:\Windows\System\aHInpzn.exe
  2⤵
  PID:7992
- C:\Windows\System\pbrOTEV.exe
  C:\Windows\System\pbrOTEV.exe
  2⤵
  PID:8072
- C:\Windows\System\MnpxoMR.exe
  C:\Windows\System\MnpxoMR.exe
  2⤵
  PID:8124
- C:\Windows\System\wwMpFtd.exe
  C:\Windows\System\wwMpFtd.exe
  2⤵
  PID:8140
- C:\Windows\System\NfmoGsS.exe
  C:\Windows\System\NfmoGsS.exe
  2⤵
  PID:7172
- C:\Windows\System\QIJJKws.exe
  C:\Windows\System\QIJJKws.exe
  2⤵
  PID:7264
- C:\Windows\System\vbGKhXt.exe
  C:\Windows\System\vbGKhXt.exe
  2⤵
  PID:7852
- C:\Windows\System\ClJIxgA.exe
  C:\Windows\System\ClJIxgA.exe
  2⤵
  PID:7368
- C:\Windows\System\NQYiAlQ.exe
  C:\Windows\System\NQYiAlQ.exe
  2⤵
  PID:7968
- C:\Windows\System\IJkrJgN.exe
  C:\Windows\System\IJkrJgN.exe
  2⤵
  PID:7748
- C:\Windows\System\TKWqrSs.exe
  C:\Windows\System\TKWqrSs.exe
  2⤵
  PID:7320
- C:\Windows\System\hIYKZUK.exe
  C:\Windows\System\hIYKZUK.exe
  2⤵
  PID:8208
- C:\Windows\System\dyDPBQV.exe
  C:\Windows\System\dyDPBQV.exe
  2⤵
  PID:8228
- C:\Windows\System\wXapXjZ.exe
  C:\Windows\System\wXapXjZ.exe
  2⤵
  PID:8252
- C:\Windows\System\sUxERdH.exe
  C:\Windows\System\sUxERdH.exe
  2⤵
  PID:8272
- C:\Windows\System\UkdsFgN.exe
  C:\Windows\System\UkdsFgN.exe
  2⤵
  PID:8304
- C:\Windows\System\gXoTHKi.exe
  C:\Windows\System\gXoTHKi.exe
  2⤵
  PID:8336
- C:\Windows\System\JNdJVDy.exe
  C:\Windows\System\JNdJVDy.exe
  2⤵
  PID:8356
- C:\Windows\System\Qovywvl.exe
  C:\Windows\System\Qovywvl.exe
  2⤵
  PID:8392
- C:\Windows\System\DZPgDIH.exe
  C:\Windows\System\DZPgDIH.exe
  2⤵
  PID:8412
- C:\Windows\System\QBAZvTp.exe
  C:\Windows\System\QBAZvTp.exe
  2⤵
  PID:8448
- C:\Windows\System\eGHMFUG.exe
  C:\Windows\System\eGHMFUG.exe
  2⤵
  PID:8472
- C:\Windows\System\LueDApg.exe
  C:\Windows\System\LueDApg.exe
  2⤵
  PID:8492
- C:\Windows\System\ZtZPHoH.exe
  C:\Windows\System\ZtZPHoH.exe
  2⤵
  PID:8520
- C:\Windows\System\sznFNJB.exe
  C:\Windows\System\sznFNJB.exe
  2⤵
  PID:8548
- C:\Windows\System\uIIiEtX.exe
  C:\Windows\System\uIIiEtX.exe
  2⤵
  PID:8580
- C:\Windows\System\eDmGKel.exe
  C:\Windows\System\eDmGKel.exe
  2⤵
  PID:8604
- C:\Windows\System\ruLxCYR.exe
  C:\Windows\System\ruLxCYR.exe
  2⤵
  PID:8628
- C:\Windows\System\eRKlYgs.exe
  C:\Windows\System\eRKlYgs.exe
  2⤵
  PID:8644
- C:\Windows\System\sShCfWs.exe
  C:\Windows\System\sShCfWs.exe
  2⤵
  PID:8668
- C:\Windows\System\JxhBuri.exe
  C:\Windows\System\JxhBuri.exe
  2⤵
  PID:8692
- C:\Windows\System\kooohLY.exe
  C:\Windows\System\kooohLY.exe
  2⤵
  PID:8728
- C:\Windows\System\tifHFSI.exe
  C:\Windows\System\tifHFSI.exe
  2⤵
  PID:8756
- C:\Windows\System\JQQQWYc.exe
  C:\Windows\System\JQQQWYc.exe
  2⤵
  PID:8780
- C:\Windows\System\EuiJGRa.exe
  C:\Windows\System\EuiJGRa.exe
  2⤵
  PID:8816
- C:\Windows\System\MMLswLa.exe
  C:\Windows\System\MMLswLa.exe
  2⤵
  PID:8840
- C:\Windows\System\lsDScVc.exe
  C:\Windows\System\lsDScVc.exe
  2⤵
  PID:8864
- C:\Windows\System\yNJjXcT.exe
  C:\Windows\System\yNJjXcT.exe
  2⤵
  PID:8888
- C:\Windows\System\krcWgXS.exe
  C:\Windows\System\krcWgXS.exe
  2⤵
  PID:8912
- C:\Windows\System\NbunvHl.exe
  C:\Windows\System\NbunvHl.exe
  2⤵
  PID:8936
- C:\Windows\System\jECadtU.exe
  C:\Windows\System\jECadtU.exe
  2⤵
  PID:8968
- C:\Windows\System\eEPUbpm.exe
  C:\Windows\System\eEPUbpm.exe
  2⤵
  PID:8996
- C:\Windows\System\eqitvVI.exe
  C:\Windows\System\eqitvVI.exe
  2⤵
  PID:9024
- C:\Windows\System\VLyFysw.exe
  C:\Windows\System\VLyFysw.exe
  2⤵
  PID:9056
- C:\Windows\System\cVJloAN.exe
  C:\Windows\System\cVJloAN.exe
  2⤵
  PID:9072
- C:\Windows\System\riXjiBh.exe
  C:\Windows\System\riXjiBh.exe
  2⤵
  PID:9096
- C:\Windows\System\VDkIaHH.exe
  C:\Windows\System\VDkIaHH.exe
  2⤵
  PID:9200
- C:\Windows\System\yoZAZKy.exe
  C:\Windows\System\yoZAZKy.exe
  2⤵
  PID:8116
- C:\Windows\System\zNTNnjw.exe
  C:\Windows\System\zNTNnjw.exe
  2⤵
  PID:8012
- C:\Windows\System\SbuegDG.exe
  C:\Windows\System\SbuegDG.exe
  2⤵
  PID:8248
- C:\Windows\System\PIpXIWM.exe
  C:\Windows\System\PIpXIWM.exe
  2⤵
  PID:8200
- C:\Windows\System\pEhNEgb.exe
  C:\Windows\System\pEhNEgb.exe
  2⤵
  PID:8236
- C:\Windows\System\OsYKOIc.exe
  C:\Windows\System\OsYKOIc.exe
  2⤵
  PID:7560
- C:\Windows\System\uVXzIxe.exe
  C:\Windows\System\uVXzIxe.exe
  2⤵
  PID:8468
- C:\Windows\System\eFydlrE.exe
  C:\Windows\System\eFydlrE.exe
  2⤵
  PID:8536
- C:\Windows\System\ccKooXm.exe
  C:\Windows\System\ccKooXm.exe
  2⤵
  PID:8480
- C:\Windows\System\ftiZWxW.exe
  C:\Windows\System\ftiZWxW.exe
  2⤵
  PID:8408
- C:\Windows\System\gBjBLLJ.exe
  C:\Windows\System\gBjBLLJ.exe
  2⤵
  PID:8600
- C:\Windows\System\QGnMleX.exe
  C:\Windows\System\QGnMleX.exe
  2⤵
  PID:8772
- C:\Windows\System\NVqqUqx.exe
  C:\Windows\System\NVqqUqx.exe
  2⤵
  PID:8660
- C:\Windows\System\ObKSXsv.exe
  C:\Windows\System\ObKSXsv.exe
  2⤵
  PID:9020
- C:\Windows\System\oVOaxQu.exe
  C:\Windows\System\oVOaxQu.exe
  2⤵
  PID:8748
- C:\Windows\System\KqkHzGD.exe
  C:\Windows\System\KqkHzGD.exe
  2⤵
  PID:8960
- C:\Windows\System\ZfykRzE.exe
  C:\Windows\System\ZfykRzE.exe
  2⤵
  PID:9160
- C:\Windows\System\ZwCExNP.exe
  C:\Windows\System\ZwCExNP.exe
  2⤵
  PID:8712
- C:\Windows\System\OXUHcLt.exe
  C:\Windows\System\OXUHcLt.exe
  2⤵
  PID:8688
- C:\Windows\System\hSwHUDy.exe
  C:\Windows\System\hSwHUDy.exe
  2⤵
  PID:8880
- C:\Windows\System\HjYMUxy.exe
  C:\Windows\System\HjYMUxy.exe
  2⤵
  PID:9196
- C:\Windows\System\jtTuSyM.exe
  C:\Windows\System\jtTuSyM.exe
  2⤵
  PID:8652
- C:\Windows\System\CYwDPHi.exe
  C:\Windows\System\CYwDPHi.exe
  2⤵
  PID:8500
- C:\Windows\System\RYSNKtw.exe
  C:\Windows\System\RYSNKtw.exe
  2⤵
  PID:8976
- C:\Windows\System\oYZHhGH.exe
  C:\Windows\System\oYZHhGH.exe
  2⤵
  PID:8804
- C:\Windows\System\gUKPDdj.exe
  C:\Windows\System\gUKPDdj.exe
  2⤵
  PID:9224
- C:\Windows\System\QPtHoQn.exe
  C:\Windows\System\QPtHoQn.exe
  2⤵
  PID:9248
- C:\Windows\System\KTeEQdm.exe
  C:\Windows\System\KTeEQdm.exe
  2⤵
  PID:9272
- C:\Windows\System\hCTdWhH.exe
  C:\Windows\System\hCTdWhH.exe
  2⤵
  PID:9296
- C:\Windows\System\hJkixZd.exe
  C:\Windows\System\hJkixZd.exe
  2⤵
  PID:9320
- C:\Windows\System\lizQfWz.exe
  C:\Windows\System\lizQfWz.exe
  2⤵
  PID:9336
- C:\Windows\System\dNpPBmg.exe
  C:\Windows\System\dNpPBmg.exe
  2⤵
  PID:9364
- C:\Windows\System\ETlmKgW.exe
  C:\Windows\System\ETlmKgW.exe
  2⤵
  PID:9384
- C:\Windows\System\SUXtFBy.exe
  C:\Windows\System\SUXtFBy.exe
  2⤵
  PID:9416
- C:\Windows\System\KqUsIfz.exe
  C:\Windows\System\KqUsIfz.exe
  2⤵
  PID:9440
- C:\Windows\System\WvhMfyQ.exe
  C:\Windows\System\WvhMfyQ.exe
  2⤵
  PID:9460
- C:\Windows\System\VABBZRI.exe
  C:\Windows\System\VABBZRI.exe
  2⤵
  PID:9480
- C:\Windows\System\YFVaPvq.exe
  C:\Windows\System\YFVaPvq.exe
  2⤵
  PID:9508
- C:\Windows\System\TwqcbGY.exe
  C:\Windows\System\TwqcbGY.exe
  2⤵
  PID:9532
- C:\Windows\System\gUnkfFf.exe
  C:\Windows\System\gUnkfFf.exe
  2⤵
  PID:9560
- C:\Windows\System\BkIAzHs.exe
  C:\Windows\System\BkIAzHs.exe
  2⤵
  PID:9584
- C:\Windows\System\XkPQmit.exe
  C:\Windows\System\XkPQmit.exe
  2⤵
  PID:9608
- C:\Windows\System\USqzhBp.exe
  C:\Windows\System\USqzhBp.exe
  2⤵
  PID:9632
- C:\Windows\System\xchdGIJ.exe
  C:\Windows\System\xchdGIJ.exe
  2⤵
  PID:9656
- C:\Windows\System\MKxfuXH.exe
  C:\Windows\System\MKxfuXH.exe
  2⤵
  PID:9684
- C:\Windows\System\hjgLWQP.exe
  C:\Windows\System\hjgLWQP.exe
  2⤵
  PID:9708
- C:\Windows\System\HkSemag.exe
  C:\Windows\System\HkSemag.exe
  2⤵
  PID:9740
- C:\Windows\System\xqzuosb.exe
  C:\Windows\System\xqzuosb.exe
  2⤵
  PID:9764
- C:\Windows\System\qQBQaZP.exe
  C:\Windows\System\qQBQaZP.exe
  2⤵
  PID:9820
- C:\Windows\System\YcdQFLi.exe
  C:\Windows\System\YcdQFLi.exe
  2⤵
  PID:9848
- C:\Windows\System\DHXSyDw.exe
  C:\Windows\System\DHXSyDw.exe
  2⤵
  PID:9872
- C:\Windows\System\pDunXOJ.exe
  C:\Windows\System\pDunXOJ.exe
  2⤵
  PID:9892
- C:\Windows\System\YCZBqrq.exe
  C:\Windows\System\YCZBqrq.exe
  2⤵
  PID:9916
- C:\Windows\System\SifIogC.exe
  C:\Windows\System\SifIogC.exe
  2⤵
  PID:9940
- C:\Windows\System\WWvYIpu.exe
  C:\Windows\System\WWvYIpu.exe
  2⤵
  PID:9972
- C:\Windows\System\DYGLDOQ.exe
  C:\Windows\System\DYGLDOQ.exe
  2⤵
  PID:9992
- C:\Windows\System\QIzvlcq.exe
  C:\Windows\System\QIzvlcq.exe
  2⤵
  PID:10024
- C:\Windows\System\QULlShS.exe
  C:\Windows\System\QULlShS.exe
  2⤵
  PID:10044
- C:\Windows\System\eQEUMrR.exe
  C:\Windows\System\eQEUMrR.exe
  2⤵
  PID:10068
- C:\Windows\System\DAZaomr.exe
  C:\Windows\System\DAZaomr.exe
  2⤵
  PID:10088
- C:\Windows\System\BadnDbS.exe
  C:\Windows\System\BadnDbS.exe
  2⤵
  PID:10108
- C:\Windows\System\IDnJCkj.exe
  C:\Windows\System\IDnJCkj.exe
  2⤵
  PID:10132
- C:\Windows\System\xjFfwQV.exe
  C:\Windows\System\xjFfwQV.exe
  2⤵
  PID:10156
- C:\Windows\System\yRMkDiq.exe
  C:\Windows\System\yRMkDiq.exe
  2⤵
  PID:10184
- C:\Windows\System\oLAISHL.exe
  C:\Windows\System\oLAISHL.exe
  2⤵
  PID:10208
- C:\Windows\System\JXlPMId.exe
  C:\Windows\System\JXlPMId.exe
  2⤵
  PID:8592
- C:\Windows\System\svGLyry.exe
  C:\Windows\System\svGLyry.exe
  2⤵
  PID:9264
- C:\Windows\System\JRAqRMd.exe
  C:\Windows\System\JRAqRMd.exe
  2⤵
  PID:9316
- C:\Windows\System\ZbBHRVv.exe
  C:\Windows\System\ZbBHRVv.exe
  2⤵
  PID:9360
- C:\Windows\System\SgYOSxV.exe
  C:\Windows\System\SgYOSxV.exe
  2⤵
  PID:9476
- C:\Windows\System\NnhzmfH.exe
  C:\Windows\System\NnhzmfH.exe
  2⤵
  PID:9556
- C:\Windows\System\ZOhUjrq.exe
  C:\Windows\System\ZOhUjrq.exe
  2⤵
  PID:9552
- C:\Windows\System\gNvVKNs.exe
  C:\Windows\System\gNvVKNs.exe
  2⤵
  PID:9648
- C:\Windows\System\MhQCqCl.exe
  C:\Windows\System\MhQCqCl.exe
  2⤵
  PID:9604
- C:\Windows\System\KZxWwhs.exe
  C:\Windows\System\KZxWwhs.exe
  2⤵
  PID:9860
- C:\Windows\System\xDgGAVX.exe
  C:\Windows\System\xDgGAVX.exe
  2⤵
  PID:10052
- C:\Windows\System\ttQYAPA.exe
  C:\Windows\System\ttQYAPA.exe
  2⤵
  PID:9932
- C:\Windows\System\NDxlHIw.exe
  C:\Windows\System\NDxlHIw.exe
  2⤵
  PID:9988
- C:\Windows\System\nisDanA.exe
  C:\Windows\System\nisDanA.exe
  2⤵
  PID:10060
- C:\Windows\System\CIGAdhZ.exe
  C:\Windows\System\CIGAdhZ.exe
  2⤵
  PID:10236
- C:\Windows\System\SDWzmWn.exe
  C:\Windows\System\SDWzmWn.exe
  2⤵
  PID:10164
- C:\Windows\System\LzrpuwO.exe
  C:\Windows\System\LzrpuwO.exe
  2⤵
  PID:10200
- C:\Windows\System\qJUcLmM.exe
  C:\Windows\System\qJUcLmM.exe
  2⤵
  PID:9504
- C:\Windows\System\fVhNXEG.exe
  C:\Windows\System\fVhNXEG.exe
  2⤵
  PID:10040
- C:\Windows\System\gNUvhZt.exe
  C:\Windows\System\gNUvhZt.exe
  2⤵
  PID:9528
- C:\Windows\System\noybNDe.exe
  C:\Windows\System\noybNDe.exe
  2⤵
  PID:9960
- C:\Windows\System\eKAcXRF.exe
  C:\Windows\System\eKAcXRF.exe
  2⤵
  PID:10152
- C:\Windows\System\FxpIEhF.exe
  C:\Windows\System\FxpIEhF.exe
  2⤵
  PID:7424
- C:\Windows\System\kwPjwCK.exe
  C:\Windows\System\kwPjwCK.exe
  2⤵
  PID:10252
- C:\Windows\System\qTNcXqg.exe
  C:\Windows\System\qTNcXqg.exe
  2⤵
  PID:10272
- C:\Windows\System\npKnBEv.exe
  C:\Windows\System\npKnBEv.exe
  2⤵
  PID:10308
- C:\Windows\System\GlYMEjl.exe
  C:\Windows\System\GlYMEjl.exe
  2⤵
  PID:10332
- C:\Windows\System\xDFHLTC.exe
  C:\Windows\System\xDFHLTC.exe
  2⤵
  PID:10356
- C:\Windows\System\tdjaAZg.exe
  C:\Windows\System\tdjaAZg.exe
  2⤵
  PID:10380
- C:\Windows\System\MBXUdIZ.exe
  C:\Windows\System\MBXUdIZ.exe
  2⤵
  PID:10404
- C:\Windows\System\ChGjfnk.exe
  C:\Windows\System\ChGjfnk.exe
  2⤵
  PID:10432
- C:\Windows\System\JiPQmPG.exe
  C:\Windows\System\JiPQmPG.exe
  2⤵
  PID:10460
- C:\Windows\System\bndbvAc.exe
  C:\Windows\System\bndbvAc.exe
  2⤵
  PID:10488
- C:\Windows\System\lluOtvK.exe
  C:\Windows\System\lluOtvK.exe
  2⤵
  PID:10516
- C:\Windows\System\prGIKnX.exe
  C:\Windows\System\prGIKnX.exe
  2⤵
  PID:10540
- C:\Windows\System\arXhMDU.exe
  C:\Windows\System\arXhMDU.exe
  2⤵
  PID:10584
- C:\Windows\System\WhJRHhH.exe
  C:\Windows\System\WhJRHhH.exe
  2⤵
  PID:10612
- C:\Windows\System\oWkLIFV.exe
  C:\Windows\System\oWkLIFV.exe
  2⤵
  PID:10632
- C:\Windows\System\oElJreg.exe
  C:\Windows\System\oElJreg.exe
  2⤵
  PID:10660
- C:\Windows\System\iIORWkU.exe
  C:\Windows\System\iIORWkU.exe
  2⤵
  PID:10680
- C:\Windows\System\BzMPZMX.exe
  C:\Windows\System\BzMPZMX.exe
  2⤵
  PID:10712
- C:\Windows\System\avoIUhV.exe
  C:\Windows\System\avoIUhV.exe
  2⤵
  PID:10780
- C:\Windows\System\FtlZEZZ.exe
  C:\Windows\System\FtlZEZZ.exe
  2⤵
  PID:10804
- C:\Windows\System\AQjACvg.exe
  C:\Windows\System\AQjACvg.exe
  2⤵
  PID:10832
- C:\Windows\System\JNVbPDS.exe
  C:\Windows\System\JNVbPDS.exe
  2⤵
  PID:10860
- C:\Windows\System\nshoFUh.exe
  C:\Windows\System\nshoFUh.exe
  2⤵
  PID:10884
- C:\Windows\System\pFNCzye.exe
  C:\Windows\System\pFNCzye.exe
  2⤵
  PID:10912
- C:\Windows\System\tFURfpP.exe
  C:\Windows\System\tFURfpP.exe
  2⤵
  PID:10944
- C:\Windows\System\FlaJiAt.exe
  C:\Windows\System\FlaJiAt.exe
  2⤵
  PID:10960
- C:\Windows\System\BlJhPjd.exe
  C:\Windows\System\BlJhPjd.exe
  2⤵
  PID:10996
- C:\Windows\System\UlQjovn.exe
  C:\Windows\System\UlQjovn.exe
  2⤵
  PID:11056
- C:\Windows\System\fvHdhMg.exe
  C:\Windows\System\fvHdhMg.exe
  2⤵
  PID:11084
- C:\Windows\System\IlZjaSY.exe
  C:\Windows\System\IlZjaSY.exe
  2⤵
  PID:11112
- C:\Windows\System\cDLLkYE.exe
  C:\Windows\System\cDLLkYE.exe
  2⤵
  PID:11136
- C:\Windows\System\dfbgMmk.exe
  C:\Windows\System\dfbgMmk.exe
  2⤵
  PID:11172
- C:\Windows\System\sKWgSAD.exe
  C:\Windows\System\sKWgSAD.exe
  2⤵
  PID:11208
- C:\Windows\System\HyEspyy.exe
  C:\Windows\System\HyEspyy.exe
  2⤵
  PID:11236
- C:\Windows\System\FGZolVC.exe
  C:\Windows\System\FGZolVC.exe
  2⤵
  PID:10292
- C:\Windows\System\RqmcDVa.exe
  C:\Windows\System\RqmcDVa.exe
  2⤵
  PID:10328
- C:\Windows\System\kUUBqXy.exe
  C:\Windows\System\kUUBqXy.exe
  2⤵
  PID:4040
- C:\Windows\System\NtHWvEI.exe
  C:\Windows\System\NtHWvEI.exe
  2⤵
  PID:10300
- C:\Windows\System\EIZsEOB.exe
  C:\Windows\System\EIZsEOB.exe
  2⤵
  PID:10320
- C:\Windows\System\uaBfJSm.exe
  C:\Windows\System\uaBfJSm.exe
  2⤵
  PID:10428
- C:\Windows\System\QWWOVbP.exe
  C:\Windows\System\QWWOVbP.exe
  2⤵
  PID:10580
- C:\Windows\System\lLcAbVc.exe
  C:\Windows\System\lLcAbVc.exe
  2⤵
  PID:3780
- C:\Windows\System\daLrFMl.exe
  C:\Windows\System\daLrFMl.exe
  2⤵
  PID:10400
- C:\Windows\System\xHqrVpi.exe
  C:\Windows\System\xHqrVpi.exe
  2⤵
  PID:3116
- C:\Windows\System\QAVmWnC.exe
  C:\Windows\System\QAVmWnC.exe
  2⤵
  PID:10720
- C:\Windows\System\ekffWgW.exe
  C:\Windows\System\ekffWgW.exe
  2⤵
  PID:10648
- C:\Windows\System\VOqMGIp.exe
  C:\Windows\System\VOqMGIp.exe
  2⤵
  PID:10800
- C:\Windows\System\ySZHBkW.exe
  C:\Windows\System\ySZHBkW.exe
  2⤵
  PID:10848
- C:\Windows\System\OzaYrVf.exe
  C:\Windows\System\OzaYrVf.exe
  2⤵
  PID:10904
- C:\Windows\System\vkvbHhi.exe
  C:\Windows\System\vkvbHhi.exe
  2⤵
  PID:10940
- C:\Windows\System\MHTyXos.exe
  C:\Windows\System\MHTyXos.exe
  2⤵
  PID:11012
- C:\Windows\System\YksNiQz.exe
  C:\Windows\System\YksNiQz.exe
  2⤵
  PID:9468
- C:\Windows\System\JZWNBGq.exe
  C:\Windows\System\JZWNBGq.exe
  2⤵
  PID:11104
- C:\Windows\System\NjHlNqR.exe
  C:\Windows\System\NjHlNqR.exe
  2⤵
  PID:3124
- C:\Windows\System\fEEOWlC.exe
  C:\Windows\System\fEEOWlC.exe
  2⤵
  PID:4416
- C:\Windows\System\tJfcglN.exe
  C:\Windows\System\tJfcglN.exe
  2⤵
  PID:10472
- C:\Windows\System\MgADaET.exe
  C:\Windows\System\MgADaET.exe
  2⤵
  PID:884
- C:\Windows\System\tVtNgrX.exe
  C:\Windows\System\tVtNgrX.exe
  2⤵
  PID:10452
- C:\Windows\System\pblJWup.exe
  C:\Windows\System\pblJWup.exe
  2⤵
  PID:10560
- C:\Windows\System\CqYmBXf.exe
  C:\Windows\System\CqYmBXf.exe
  2⤵
  PID:5092
- C:\Windows\System\lBQNXfW.exe
  C:\Windows\System\lBQNXfW.exe
  2⤵
  PID:11004
- C:\Windows\System\HLHAryU.exe
  C:\Windows\System\HLHAryU.exe
  2⤵
  PID:10676
- C:\Windows\System\WLThmmf.exe
  C:\Windows\System\WLThmmf.exe
  2⤵
  PID:4660
- C:\Windows\System\FLdjntE.exe
  C:\Windows\System\FLdjntE.exe
  2⤵
  PID:11108
- C:\Windows\System\FcbRqxl.exe
  C:\Windows\System\FcbRqxl.exe
  2⤵
  PID:11152
- C:\Windows\System\ndQdgjQ.exe
  C:\Windows\System\ndQdgjQ.exe
  2⤵
  PID:9600
- C:\Windows\System\mlXbDUN.exe
  C:\Windows\System\mlXbDUN.exe
  2⤵
  PID:3524
- C:\Windows\System\fncmDXE.exe
  C:\Windows\System\fncmDXE.exe
  2⤵
  PID:11284
- C:\Windows\System\TuQxmFn.exe
  C:\Windows\System\TuQxmFn.exe
  2⤵
  PID:11328
- C:\Windows\System\HWgAuMn.exe
  C:\Windows\System\HWgAuMn.exe
  2⤵
  PID:11344
- C:\Windows\System\fccOPpw.exe
  C:\Windows\System\fccOPpw.exe
  2⤵
  PID:11368
- C:\Windows\System\qDXCxtd.exe
  C:\Windows\System\qDXCxtd.exe
  2⤵
  PID:11388
- C:\Windows\System\UaYRtsX.exe
  C:\Windows\System\UaYRtsX.exe
  2⤵
  PID:11412
- C:\Windows\System\fIUEOwZ.exe
  C:\Windows\System\fIUEOwZ.exe
  2⤵
  PID:11440
- C:\Windows\System\QTtRnxH.exe
  C:\Windows\System\QTtRnxH.exe
  2⤵
  PID:11472
- C:\Windows\System\BPMeUPS.exe
  C:\Windows\System\BPMeUPS.exe
  2⤵
  PID:11500
- C:\Windows\System\rDlRwtN.exe
  C:\Windows\System\rDlRwtN.exe
  2⤵
  PID:11532
- C:\Windows\System\FxXtKqY.exe
  C:\Windows\System\FxXtKqY.exe
  2⤵
  PID:11616
- C:\Windows\System\DNzzssz.exe
  C:\Windows\System\DNzzssz.exe
  2⤵
  PID:11648
- C:\Windows\System\QoiiJTk.exe
  C:\Windows\System\QoiiJTk.exe
  2⤵
  PID:11672
- C:\Windows\System\oAaxcIh.exe
  C:\Windows\System\oAaxcIh.exe
  2⤵
  PID:11696
- C:\Windows\System\qChagrz.exe
  C:\Windows\System\qChagrz.exe
  2⤵
  PID:11936
- C:\Windows\System\PemdfOW.exe
  C:\Windows\System\PemdfOW.exe
  2⤵
  PID:11952
- C:\Windows\System\SeInWpl.exe
  C:\Windows\System\SeInWpl.exe
  2⤵
  PID:11968
- C:\Windows\System\PVcNwoj.exe
  C:\Windows\System\PVcNwoj.exe
  2⤵
  PID:11988
- C:\Windows\System\WIYoHga.exe
  C:\Windows\System\WIYoHga.exe
  2⤵
  PID:12016
- C:\Windows\System\oXmwTGd.exe
  C:\Windows\System\oXmwTGd.exe
  2⤵
  PID:12040
- C:\Windows\System\fHGCCAL.exe
  C:\Windows\System\fHGCCAL.exe
  2⤵
  PID:12064
- C:\Windows\System\auRYvEq.exe
  C:\Windows\System\auRYvEq.exe
  2⤵
  PID:12084
- C:\Windows\System\CkUphyf.exe
  C:\Windows\System\CkUphyf.exe
  2⤵
  PID:12100
- C:\Windows\System\dSYndjt.exe
  C:\Windows\System\dSYndjt.exe
  2⤵
  PID:12132
- C:\Windows\System\PbUEfNu.exe
  C:\Windows\System\PbUEfNu.exe
  2⤵
  PID:12160
- C:\Windows\System\qKexelk.exe
  C:\Windows\System\qKexelk.exe
  2⤵
  PID:12180
- C:\Windows\System\UtFXUHO.exe
  C:\Windows\System\UtFXUHO.exe
  2⤵
  PID:12204
- C:\Windows\System\jSNPnyv.exe
  C:\Windows\System\jSNPnyv.exe
  2⤵
  PID:12228
- C:\Windows\System\CtVlyDy.exe
  C:\Windows\System\CtVlyDy.exe
  2⤵
  PID:12244
- C:\Windows\System\tFvLeqk.exe
  C:\Windows\System\tFvLeqk.exe
  2⤵
  PID:12264
- C:\Windows\System\yDZrVMJ.exe
  C:\Windows\System\yDZrVMJ.exe
  2⤵
  PID:10932
- C:\Windows\System\eLSDfxF.exe
  C:\Windows\System\eLSDfxF.exe
  2⤵
  PID:9912
- C:\Windows\System\BNBxGKd.exe
  C:\Windows\System\BNBxGKd.exe
  2⤵
  PID:11336
- C:\Windows\System\KwLjBAl.exe
  C:\Windows\System\KwLjBAl.exe
  2⤵
  PID:10268
- C:\Windows\System\PYqsDSN.exe
  C:\Windows\System\PYqsDSN.exe
  2⤵
  PID:2860
- C:\Windows\System\IiYvwCZ.exe
  C:\Windows\System\IiYvwCZ.exe
  2⤵
  PID:11364
- C:\Windows\System\ZRmSYel.exe
  C:\Windows\System\ZRmSYel.exe
  2⤵
  PID:11408
- C:\Windows\System\lzuhwdU.exe
  C:\Windows\System\lzuhwdU.exe
  2⤵
  PID:11280
- C:\Windows\System\QyjCHnq.exe
  C:\Windows\System\QyjCHnq.exe
  2⤵
  PID:11292
- C:\Windows\System\SvYvCZR.exe
  C:\Windows\System\SvYvCZR.exe
  2⤵
  PID:11560
- C:\Windows\System\WudCJde.exe
  C:\Windows\System\WudCJde.exe
  2⤵
  PID:11528
- C:\Windows\System\mIJcVGT.exe
  C:\Windows\System\mIJcVGT.exe
  2⤵
  PID:11660
- C:\Windows\System\vhUmIeP.exe
  C:\Windows\System\vhUmIeP.exe
  2⤵
  PID:11708
- C:\Windows\System\GxEjqUr.exe
  C:\Windows\System\GxEjqUr.exe
  2⤵
  PID:11780
- C:\Windows\System\TtpOhiN.exe
  C:\Windows\System\TtpOhiN.exe
  2⤵
  PID:10064
- C:\Windows\System\cKCoexq.exe
  C:\Windows\System\cKCoexq.exe
  2⤵
  PID:11916
- C:\Windows\System\ClaUxDV.exe
  C:\Windows\System\ClaUxDV.exe
  2⤵
  PID:4004
- C:\Windows\System\sExnLbv.exe
  C:\Windows\System\sExnLbv.exe
  2⤵
  PID:2012
- C:\Windows\System\QGNFMRb.exe
  C:\Windows\System\QGNFMRb.exe
  2⤵
  PID:11964
- C:\Windows\System\EPflchy.exe
  C:\Windows\System\EPflchy.exe
  2⤵
  PID:12004
- C:\Windows\System\WgrDnLH.exe
  C:\Windows\System\WgrDnLH.exe
  2⤵
  PID:12072
- C:\Windows\System\VCKSSGx.exe
  C:\Windows\System\VCKSSGx.exe
  2⤵
  PID:12120
- C:\Windows\System\vsxMduX.exe
  C:\Windows\System\vsxMduX.exe
  2⤵
  PID:12200
- C:\Windows\System\DRQlacK.exe
  C:\Windows\System\DRQlacK.exe
  2⤵
  PID:10740
- C:\Windows\System\tSrdvoq.exe
  C:\Windows\System\tSrdvoq.exe
  2⤵
  PID:1908
- C:\Windows\System\Xzqcfbj.exe
  C:\Windows\System\Xzqcfbj.exe
  2⤵
  PID:11248
- C:\Windows\System\fCNYWBA.exe
  C:\Windows\System\fCNYWBA.exe
  2⤵
  PID:11308
- C:\Windows\System\VkkzuwR.exe
  C:\Windows\System\VkkzuwR.exe
  2⤵
  PID:10288
- C:\Windows\System\VbLcQcW.exe
  C:\Windows\System\VbLcQcW.exe
  2⤵
  PID:11664
- C:\Windows\System\jSUFJNG.exe
  C:\Windows\System\jSUFJNG.exe
  2⤵
  PID:11276
- C:\Windows\System\AEYdHux.exe
  C:\Windows\System\AEYdHux.exe
  2⤵
  PID:4564
- C:\Windows\System\iJyZUng.exe
  C:\Windows\System\iJyZUng.exe
  2⤵
  PID:11816
- C:\Windows\System\MdvBDRl.exe
  C:\Windows\System\MdvBDRl.exe
  2⤵
  PID:3900
- C:\Windows\System\XDoGWKu.exe
  C:\Windows\System\XDoGWKu.exe
  2⤵
  PID:12012
- C:\Windows\System\djORNiY.exe
  C:\Windows\System\djORNiY.exe
  2⤵
  PID:11932
- C:\Windows\System\FsbjCUv.exe
  C:\Windows\System\FsbjCUv.exe
  2⤵
  PID:11544
- C:\Windows\System\hDoLAtn.exe
  C:\Windows\System\hDoLAtn.exe
  2⤵
  PID:11584
- C:\Windows\System\wVQiUMq.exe
  C:\Windows\System\wVQiUMq.exe
  2⤵
  PID:11432
- C:\Windows\System\FUMIJAN.exe
  C:\Windows\System\FUMIJAN.exe
  2⤵
  PID:12296
- C:\Windows\System\XfvLTkY.exe
  C:\Windows\System\XfvLTkY.exe
  2⤵
  PID:12324
- C:\Windows\System\SYDZCgL.exe
  C:\Windows\System\SYDZCgL.exe
  2⤵
  PID:12352
- C:\Windows\System\GXYbuSe.exe
  C:\Windows\System\GXYbuSe.exe
  2⤵
  PID:12368
- C:\Windows\System\jIZyxOU.exe
  C:\Windows\System\jIZyxOU.exe
  2⤵
  PID:12388
- C:\Windows\System\HvwBhIN.exe
  C:\Windows\System\HvwBhIN.exe
  2⤵
  PID:12408
- C:\Windows\System\xirHgxp.exe
  C:\Windows\System\xirHgxp.exe
  2⤵
  PID:12436
- C:\Windows\System\aZpNbop.exe
  C:\Windows\System\aZpNbop.exe
  2⤵
  PID:12460
- C:\Windows\System\SygOLxG.exe
  C:\Windows\System\SygOLxG.exe
  2⤵
  PID:12484
- C:\Windows\System\XVbOtHy.exe
  C:\Windows\System\XVbOtHy.exe
  2⤵
  PID:12512
- C:\Windows\System\buOIpWV.exe
  C:\Windows\System\buOIpWV.exe
  2⤵
  PID:12536
- C:\Windows\System\HMoNnwG.exe
  C:\Windows\System\HMoNnwG.exe
  2⤵
  PID:12564
- C:\Windows\System\JVwrLQN.exe
  C:\Windows\System\JVwrLQN.exe
  2⤵
  PID:12592
- C:\Windows\System\qYjiHVX.exe
  C:\Windows\System\qYjiHVX.exe
  2⤵
  PID:12620
- C:\Windows\System\wAZbmQZ.exe
  C:\Windows\System\wAZbmQZ.exe
  2⤵
  PID:12644
- C:\Windows\System\CwRxzKJ.exe
  C:\Windows\System\CwRxzKJ.exe
  2⤵
  PID:12668
- C:\Windows\System\NIAZDre.exe
  C:\Windows\System\NIAZDre.exe
  2⤵
  PID:12696
- C:\Windows\System\vTtZqyi.exe
  C:\Windows\System\vTtZqyi.exe
  2⤵
  PID:12728
- C:\Windows\System\OGSVxMT.exe
  C:\Windows\System\OGSVxMT.exe
  2⤵
  PID:12752
- C:\Windows\System\FNnBMcf.exe
  C:\Windows\System\FNnBMcf.exe
  2⤵
  PID:12780
- C:\Windows\System\MnmPerZ.exe
  C:\Windows\System\MnmPerZ.exe
  2⤵
  PID:12808
- C:\Windows\System\TEENzDu.exe
  C:\Windows\System\TEENzDu.exe
  2⤵
  PID:12836
- C:\Windows\System\MRgOdyF.exe
  C:\Windows\System\MRgOdyF.exe
  2⤵
  PID:12856
- C:\Windows\System\XoZBVDN.exe
  C:\Windows\System\XoZBVDN.exe
  2⤵
  PID:12880
- C:\Windows\System\SSrZogK.exe
  C:\Windows\System\SSrZogK.exe
  2⤵
  PID:12956
- C:\Windows\System\QwGfhcp.exe
  C:\Windows\System\QwGfhcp.exe
  2⤵
  PID:12972
- C:\Windows\System\QOSVKCV.exe
  C:\Windows\System\QOSVKCV.exe
  2⤵
  PID:13008
- C:\Windows\System\LDHGHsP.exe
  C:\Windows\System\LDHGHsP.exe
  2⤵
  PID:13040
- C:\Windows\System\iUaGQeU.exe
  C:\Windows\System\iUaGQeU.exe
  2⤵
  PID:13064
- C:\Windows\System\ncKspRt.exe
  C:\Windows\System\ncKspRt.exe
  2⤵
  PID:13084
- C:\Windows\System\GAOoGKH.exe
  C:\Windows\System\GAOoGKH.exe
  2⤵
  PID:13120
- C:\Windows\System\uZYIOIW.exe
  C:\Windows\System\uZYIOIW.exe
  2⤵
  PID:13148
- C:\Windows\System\EwXYAvN.exe
  C:\Windows\System\EwXYAvN.exe
  2⤵
  PID:13180
- C:\Windows\System\vXEeiDR.exe
  C:\Windows\System\vXEeiDR.exe
  2⤵
  PID:13280
- C:\Windows\System\bAtykOZ.exe
  C:\Windows\System\bAtykOZ.exe
  2⤵
  PID:13296
- C:\Windows\System\RTlLjvT.exe
  C:\Windows\System\RTlLjvT.exe
  2⤵
  PID:11540
- C:\Windows\System\UNzibHn.exe
  C:\Windows\System\UNzibHn.exe
  2⤵
  PID:11848
- C:\Windows\System\MHpJpFV.exe
  C:\Windows\System\MHpJpFV.exe
  2⤵
  PID:12112
- C:\Windows\System\qqjjanY.exe
  C:\Windows\System\qqjjanY.exe
  2⤵
  PID:972
- C:\Windows\System\UhVQwes.exe
  C:\Windows\System\UhVQwes.exe
  2⤵
  PID:11808
- C:\Windows\System\juMAucC.exe
  C:\Windows\System\juMAucC.exe
  2⤵
  PID:1504
- C:\Windows\System\glBSpat.exe
  C:\Windows\System\glBSpat.exe
  2⤵
  PID:12472
- C:\Windows\System\YJdkMbC.exe
  C:\Windows\System\YJdkMbC.exe
  2⤵
  PID:2172
- C:\Windows\System\kfjykfE.exe
  C:\Windows\System\kfjykfE.exe
  2⤵
  PID:12640
- C:\Windows\System\dRtAQFD.exe
  C:\Windows\System\dRtAQFD.exe
  2⤵
  PID:12508
- C:\Windows\System\iceOPEk.exe
  C:\Windows\System\iceOPEk.exe
  2⤵
  PID:12572
- C:\Windows\System\pStLveA.exe
  C:\Windows\System\pStLveA.exe
  2⤵
  PID:12796
- C:\Windows\System\LxKEstj.exe
  C:\Windows\System\LxKEstj.exe
  2⤵
  PID:12532
- C:\Windows\System\NSjXmXn.exe
  C:\Windows\System\NSjXmXn.exe
  2⤵
  PID:12552
- C:\Windows\System\rkbsIry.exe
  C:\Windows\System\rkbsIry.exe
  2⤵
  PID:13052
- C:\Windows\System\YtZpLwL.exe
  C:\Windows\System\YtZpLwL.exe
  2⤵
  PID:13304
- C:\Windows\System\gZHENsQ.exe
  C:\Windows\System\gZHENsQ.exe
  2⤵
  PID:228
- C:\Windows\System\AMEIeKF.exe
  C:\Windows\System\AMEIeKF.exe
  2⤵
  PID:11300
- C:\Windows\System\sVMQeTH.exe
  C:\Windows\System\sVMQeTH.exe
  2⤵
  PID:4408
- C:\Windows\System\kIMJhQh.exe
  C:\Windows\System\kIMJhQh.exe
  2⤵
  PID:12404
- C:\Windows\System\iRnimrt.exe
  C:\Windows\System\iRnimrt.exe
  2⤵
  PID:12384
- C:\Windows\System\ZgQUVPc.exe
  C:\Windows\System\ZgQUVPc.exe
  2⤵
  PID:12692
- C:\Windows\System\emKGZwr.exe
  C:\Windows\System\emKGZwr.exe
  2⤵
  PID:12400
- C:\Windows\System\wMqhzcx.exe
  C:\Windows\System\wMqhzcx.exe
  2⤵
  PID:12560
- C:\Windows\System\fYVxCAM.exe
  C:\Windows\System\fYVxCAM.exe
  2⤵
  PID:12804
- C:\Windows\System\QWyyGPj.exe
  C:\Windows\System\QWyyGPj.exe
  2⤵
  PID:13072
- C:\Windows\System\pMKEjUI.exe
  C:\Windows\System\pMKEjUI.exe
  2⤵
  PID:400
- C:\Windows\System\BhRkoti.exe
  C:\Windows\System\BhRkoti.exe
  2⤵
  PID:4448
- C:\Windows\System\OWJQNGl.exe
  C:\Windows\System\OWJQNGl.exe
  2⤵
  PID:3708
- C:\Windows\System\HwVjuzr.exe
  C:\Windows\System\HwVjuzr.exe
  2⤵
  PID:12848
- C:\Windows\System\foYnMGw.exe
  C:\Windows\System\foYnMGw.exe
  2⤵
  PID:12652
- C:\Windows\System\cfuuAtw.exe
  C:\Windows\System\cfuuAtw.exe
  2⤵
  PID:2504
- C:\Windows\System\PCTEWhs.exe
  C:\Windows\System\PCTEWhs.exe
  2⤵
  PID:12968
- C:\Windows\System\mSILtgc.exe
  C:\Windows\System\mSILtgc.exe
  2⤵
  PID:13320
- C:\Windows\System\tFmYzEj.exe
  C:\Windows\System\tFmYzEj.exe
  2⤵
  PID:13352
- C:\Windows\System\OwlCFzn.exe
  C:\Windows\System\OwlCFzn.exe
  2⤵
  PID:13392
- C:\Windows\System\rlUopce.exe
  C:\Windows\System\rlUopce.exe
  2⤵
  PID:13420
- C:\Windows\System\wKaGPvd.exe
  C:\Windows\System\wKaGPvd.exe
  2⤵
  PID:13444
- C:\Windows\System\neTcCov.exe
  C:\Windows\System\neTcCov.exe
  2⤵
  PID:13468
- C:\Windows\System\GWYOTSN.exe
  C:\Windows\System\GWYOTSN.exe
  2⤵
  PID:13508
- C:\Windows\System\vJKQoiE.exe
  C:\Windows\System\vJKQoiE.exe
  2⤵
  PID:13560
- C:\Windows\System\kwfYHJR.exe
  C:\Windows\System\kwfYHJR.exe
  2⤵
  PID:13588
- C:\Windows\System\jGRCYbe.exe
  C:\Windows\System\jGRCYbe.exe
  2⤵
  PID:13616
- C:\Windows\System\jUYXoXd.exe
  C:\Windows\System\jUYXoXd.exe
  2⤵
  PID:13640
- C:\Windows\System\NZGAzoG.exe
  C:\Windows\System\NZGAzoG.exe
  2⤵
  PID:13672
- C:\Windows\System\SbnBdeD.exe
  C:\Windows\System\SbnBdeD.exe
  2⤵
  PID:13688
- C:\Windows\System\WyevYqe.exe
  C:\Windows\System\WyevYqe.exe
  2⤵
  PID:13704
- C:\Windows\System\xjEphfu.exe
  C:\Windows\System\xjEphfu.exe
  2⤵
  PID:13736
- C:\Windows\System\gPKCMqf.exe
  C:\Windows\System\gPKCMqf.exe
  2⤵
  PID:13760
- C:\Windows\System\qyjTEPs.exe
  C:\Windows\System\qyjTEPs.exe
  2⤵
  PID:13776
- C:\Windows\System\sdeUeaj.exe
  C:\Windows\System\sdeUeaj.exe
  2⤵
  PID:13804
- C:\Windows\System\lSsZVbH.exe
  C:\Windows\System\lSsZVbH.exe
  2⤵
  PID:13828
- C:\Windows\System\sMrpqic.exe
  C:\Windows\System\sMrpqic.exe
  2⤵
  PID:13860
- C:\Windows\System\KFxZods.exe
  C:\Windows\System\KFxZods.exe
  2⤵
  PID:13880
- C:\Windows\System\jfoBHLO.exe
  C:\Windows\System\jfoBHLO.exe
  2⤵
  PID:13896
- C:\Windows\System\VUHLQpU.exe
  C:\Windows\System\VUHLQpU.exe
  2⤵
  PID:13920
- C:\Windows\System\LuRBAle.exe
  C:\Windows\System\LuRBAle.exe
  2⤵
  PID:13944
- C:\Windows\System\jAiihxw.exe
  C:\Windows\System\jAiihxw.exe
  2⤵
  PID:13972
- C:\Windows\System\rtxNTfc.exe
  C:\Windows\System\rtxNTfc.exe
  2⤵
  PID:13996
- C:\Windows\System\GYFmUep.exe
  C:\Windows\System\GYFmUep.exe
  2⤵
  PID:14020
- C:\Windows\System\wQrWkaf.exe
  C:\Windows\System\wQrWkaf.exe
  2⤵
  PID:14044
- C:\Windows\System\pgUDVBc.exe
  C:\Windows\System\pgUDVBc.exe
  2⤵
  PID:14060
- C:\Windows\System\CBkBqzq.exe
  C:\Windows\System\CBkBqzq.exe
  2⤵
  PID:14088
- C:\Windows\System\xUEXaVP.exe
  C:\Windows\System\xUEXaVP.exe
  2⤵
  PID:14116
- C:\Windows\System\QCCmqWo.exe
  C:\Windows\System\QCCmqWo.exe
  2⤵
  PID:14132
- C:\Windows\System\btPshMx.exe
  C:\Windows\System\btPshMx.exe
  2⤵
  PID:14152
- C:\Windows\System\MAiyNVa.exe
  C:\Windows\System\MAiyNVa.exe
  2⤵
  PID:14176
- C:\Windows\System\aYgxnim.exe
  C:\Windows\System\aYgxnim.exe
  2⤵
  PID:14208
- C:\Windows\System\nucKOLy.exe
  C:\Windows\System\nucKOLy.exe
  2⤵
  PID:14228
- C:\Windows\System\LeQNJTp.exe
  C:\Windows\System\LeQNJTp.exe
  2⤵
  PID:14248
- C:\Windows\System\NpKJjvQ.exe
  C:\Windows\System\NpKJjvQ.exe
  2⤵
  PID:14268
- C:\Windows\System\ZYpnJDZ.exe
  C:\Windows\System\ZYpnJDZ.exe
  2⤵
  PID:14300
- C:\Windows\System\EnIIjcC.exe
  C:\Windows\System\EnIIjcC.exe
  2⤵
  PID:13800
- C:\Windows\System\nHMozzd.exe
  C:\Windows\System\nHMozzd.exe
  2⤵
  PID:13912
- C:\Windows\System\SbxUqUz.exe
  C:\Windows\System\SbxUqUz.exe
  2⤵
  PID:13852
- C:\Windows\System\fpANRfk.exe
  C:\Windows\System\fpANRfk.exe
  2⤵
  PID:13936
- C:\Windows\System\qUnNIRt.exe
  C:\Windows\System\qUnNIRt.exe
  2⤵
  PID:14076
- C:\Windows\System\AxITRsS.exe
  C:\Windows\System\AxITRsS.exe
  2⤵
  PID:14012
- C:\Windows\System\EjynhII.exe
  C:\Windows\System\EjynhII.exe
  2⤵
  PID:13376
- C:\Windows\System\MafMuSv.exe
  C:\Windows\System\MafMuSv.exe
  2⤵
  PID:1780
- C:\Windows\System\YHxnENt.exe
  C:\Windows\System\YHxnENt.exe
  2⤵
  PID:13404
- C:\Windows\System\eXkjcGz.exe
  C:\Windows\System\eXkjcGz.exe
  2⤵
  PID:13584
- C:\Windows\System\HRwcLHt.exe
  C:\Windows\System\HRwcLHt.exe
  2⤵
  PID:13656
- C:\Windows\System\KQReSfO.exe
  C:\Windows\System\KQReSfO.exe
  2⤵
  PID:5088
- C:\Windows\System\GMzcpCX.exe
  C:\Windows\System\GMzcpCX.exe
  2⤵
  PID:13668
- C:\Windows\System\pXzpzMG.exe
  C:\Windows\System\pXzpzMG.exe
  2⤵
  PID:13916
- C:\Windows\System\qwisGmR.exe
  C:\Windows\System\qwisGmR.exe
  2⤵
  PID:14172
- C:\Windows\System\bBatTwS.exe
  C:\Windows\System\bBatTwS.exe
  2⤵
  PID:1752
- C:\Windows\System\BcsrNEq.exe
  C:\Windows\System\BcsrNEq.exe
  2⤵
  PID:2372
- C:\Windows\System\zmeSIom.exe
  C:\Windows\System\zmeSIom.exe
  2⤵
  PID:4956
- C:\Windows\System\Fazxgxm.exe
  C:\Windows\System\Fazxgxm.exe
  2⤵
  PID:14108
- C:\Windows\System\zVEPtta.exe
  C:\Windows\System\zVEPtta.exe
  2⤵
  PID:13992
- C:\Windows\System\ikywFuP.exe
  C:\Windows\System\ikywFuP.exe
  2⤵
  PID:14240
- C:\Windows\System\UqoGxER.exe
  C:\Windows\System\UqoGxER.exe
  2⤵
  PID:4192
- C:\Windows\System\hGtNfOQ.exe
  C:\Windows\System\hGtNfOQ.exe
  2⤵
  PID:12792
- C:\Windows\System\foqwKse.exe
  C:\Windows\System\foqwKse.exe
  2⤵
  PID:14296
- C:\Windows\System\eUGVtTc.exe
  C:\Windows\System\eUGVtTc.exe
  2⤵
  PID:12504
- C:\Windows\System\qeGobZQ.exe
  C:\Windows\System\qeGobZQ.exe
  2⤵
  PID:864
- C:\Windows\System\OQeMlCX.exe
  C:\Windows\System\OQeMlCX.exe
  2⤵
  PID:3628
- C:\Windows\System\CtjIffH.exe
  C:\Windows\System\CtjIffH.exe
  2⤵
  PID:4892
- C:\Windows\System\IWsHCOH.exe
  C:\Windows\System\IWsHCOH.exe
  2⤵
  PID:14280
- C:\Windows\System\bqjJHgy.exe
  C:\Windows\System\bqjJHgy.exe
  2⤵
  PID:3272
- C:\Windows\System\JJwJVHC.exe
  C:\Windows\System\JJwJVHC.exe
  2⤵
  PID:4052
- C:\Windows\System\UULCQRY.exe
  C:\Windows\System\UULCQRY.exe
  2⤵
  PID:1124
- C:\Windows\System\kwtXlAQ.exe
  C:\Windows\System\kwtXlAQ.exe
  2⤵
  PID:2796
- C:\Windows\System\Kkdckqr.exe
  C:\Windows\System\Kkdckqr.exe
  2⤵
  PID:2892
- C:\Windows\System\WwsfaZx.exe
  C:\Windows\System\WwsfaZx.exe
  2⤵
  PID:10644
- C:\Windows\System\SOrERel.exe
  C:\Windows\System\SOrERel.exe
  2⤵
  PID:1152
- C:\Windows\System\NANykEe.exe
  C:\Windows\System\NANykEe.exe
  2⤵
  PID:3584
- C:\Windows\System\xyUwGVB.exe
  C:\Windows\System\xyUwGVB.exe
  2⤵
  PID:1072
- C:\Windows\System\jPRAvzG.exe
  C:\Windows\System\jPRAvzG.exe
  2⤵
  PID:13272
- C:\Windows\System\oPxJoZD.exe
  C:\Windows\System\oPxJoZD.exe
  2⤵
  PID:13796
- C:\Windows\System\tnVhGFn.exe
  C:\Windows\System\tnVhGFn.exe
  2⤵
  PID:1652
- C:\Windows\System\NtsSxak.exe
  C:\Windows\System\NtsSxak.exe
  2⤵
  PID:1704
- C:\Windows\System\itzXpLF.exe
  C:\Windows\System\itzXpLF.exe
  2⤵
  PID:3632
- C:\Windows\System\bPjcaix.exe
  C:\Windows\System\bPjcaix.exe
  2⤵
  PID:1032
- C:\Windows\System\nODzrey.exe
  C:\Windows\System\nODzrey.exe
  2⤵
  PID:5156
- C:\Windows\System\GFOfcPh.exe
  C:\Windows\System\GFOfcPh.exe
  2⤵
  PID:5296
- C:\Windows\System\yrekKfv.exe
  C:\Windows\System\yrekKfv.exe
  2⤵
  PID:5300
- C:\Windows\System\NEMSyCu.exe
  C:\Windows\System\NEMSyCu.exe
  2⤵
  PID:5356
- C:\Windows\System\jVbfqCs.exe
  C:\Windows\System\jVbfqCs.exe
  2⤵
  PID:5564
- C:\Windows\System\xnHzmeZ.exe
  C:\Windows\System\xnHzmeZ.exe
  2⤵
  PID:2644
- C:\Windows\System\ZhXzfjy.exe
  C:\Windows\System\ZhXzfjy.exe
  2⤵
  PID:4944
- C:\Windows\System\kHTbmtz.exe
  C:\Windows\System\kHTbmtz.exe
  2⤵
  PID:14100
- C:\Windows\System\wfWbyyB.exe
  C:\Windows\System\wfWbyyB.exe
  2⤵
  PID:3076
- C:\Windows\System\QvQfCZm.exe
  C:\Windows\System\QvQfCZm.exe
  2⤵
  PID:1684
- C:\Windows\System\LeSIbrB.exe
  C:\Windows\System\LeSIbrB.exe
  2⤵
  PID:4244
- C:\Windows\System\jbOtngF.exe
  C:\Windows\System\jbOtngF.exe
  2⤵
  PID:3156
- C:\Windows\System\ScnNurX.exe
  C:\Windows\System\ScnNurX.exe
  2⤵
  PID:4456
- C:\Windows\System\lQkdOuW.exe
  C:\Windows\System\lQkdOuW.exe
  2⤵
  PID:5404
- C:\Windows\System\PdsAASV.exe
  C:\Windows\System\PdsAASV.exe
  2⤵
  PID:10564
- C:\Windows\System\vMIdgHF.exe
  C:\Windows\System\vMIdgHF.exe
  2⤵
  PID:5172
- C:\Windows\System\blCJJcl.exe
  C:\Windows\System\blCJJcl.exe
  2⤵
  PID:5692
- C:\Windows\System\aOZHyDB.exe
  C:\Windows\System\aOZHyDB.exe
  2⤵
  PID:5376
- C:\Windows\System\luCZzcn.exe
  C:\Windows\System\luCZzcn.exe
  2⤵
  PID:5516
- C:\Windows\System\rDwGAgS.exe
  C:\Windows\System\rDwGAgS.exe
  2⤵
  PID:5432
- C:\Windows\System\npeZExL.exe
  C:\Windows\System\npeZExL.exe
  2⤵
  PID:4464
- C:\Windows\System\htueYoQ.exe
  C:\Windows\System\htueYoQ.exe
  2⤵
  PID:3180
- C:\Windows\System\PGZqrCO.exe
  C:\Windows\System\PGZqrCO.exe
  2⤵
  PID:5876
- C:\Windows\System\XtLsdax.exe
  C:\Windows\System\XtLsdax.exe
  2⤵
  PID:5632
- C:\Windows\System\xKmVIQT.exe
  C:\Windows\System\xKmVIQT.exe
  2⤵
  PID:1624
- C:\Windows\System\MLPQASd.exe
  C:\Windows\System\MLPQASd.exe
  2⤵
  PID:13460
- C:\Windows\System\JdvjAkx.exe
  C:\Windows\System\JdvjAkx.exe
  2⤵
  PID:6124
- C:\Windows\System\EUMruMA.exe
  C:\Windows\System\EUMruMA.exe
  2⤵
  PID:12776
- C:\Windows\System\omAsLIB.exe
  C:\Windows\System\omAsLIB.exe
  2⤵
  PID:6288
- C:\Windows\System\FeagWuU.exe
  C:\Windows\System\FeagWuU.exe
  2⤵
  PID:14400
- C:\Windows\System\IbLgCgT.exe
  C:\Windows\System\IbLgCgT.exe
  2⤵
  PID:14416
- C:\Windows\System\dYtIRtn.exe
  C:\Windows\System\dYtIRtn.exe
  2⤵
  PID:14440
- C:\Windows\System\cygQAsW.exe
  C:\Windows\System\cygQAsW.exe
  2⤵
  PID:14476
- C:\Windows\System\HsZZyml.exe
  C:\Windows\System\HsZZyml.exe
  2⤵
  PID:14500
- C:\Windows\System\dsRygsN.exe
  C:\Windows\System\dsRygsN.exe
  2⤵
  PID:14520
- C:\Windows\System\VGlqJIS.exe
  C:\Windows\System\VGlqJIS.exe
  2⤵
  PID:14540
- C:\Windows\System\PBpfqKY.exe
  C:\Windows\System\PBpfqKY.exe
  2⤵
  PID:14560
- C:\Windows\System\SGcodCm.exe
  C:\Windows\System\SGcodCm.exe
  2⤵
  PID:14588
- C:\Windows\System\oGOpTXf.exe
  C:\Windows\System\oGOpTXf.exe
  2⤵
  PID:14620
- C:\Windows\System\NRzBYvz.exe
  C:\Windows\System\NRzBYvz.exe
  2⤵
  PID:14708
- C:\Windows\System\DXnxrHp.exe
  C:\Windows\System\DXnxrHp.exe
  2⤵
  PID:14728
- C:\Windows\System\KSDmFrB.exe
  C:\Windows\System\KSDmFrB.exe
  2⤵
  PID:14784
- C:\Windows\System\NmEHvTB.exe
  C:\Windows\System\NmEHvTB.exe
  2⤵
  PID:14804
- C:\Windows\System\DoIZugP.exe
  C:\Windows\System\DoIZugP.exe
  2⤵
  PID:15040
- C:\Windows\System\cuWEDXL.exe
  C:\Windows\System\cuWEDXL.exe
  2⤵
  PID:15104
- C:\Windows\System\KdiUMjX.exe
  C:\Windows\System\KdiUMjX.exe
  2⤵
  PID:15128
- C:\Windows\System\LZbVurX.exe
  C:\Windows\System\LZbVurX.exe
  2⤵
  PID:15236
- C:\Windows\System\KedehdY.exe
  C:\Windows\System\KedehdY.exe
  2⤵
  PID:15252
- C:\Windows\System\nSvguMN.exe
  C:\Windows\System\nSvguMN.exe
  2⤵
  PID:15272
- C:\Windows\System\gXfOKVl.exe
  C:\Windows\System\gXfOKVl.exe
  2⤵
  PID:15328
- C:\Windows\System\asltKVD.exe
  C:\Windows\System\asltKVD.exe
  2⤵
  PID:15356
- C:\Windows\System\cxUdmTv.exe
  C:\Windows\System\cxUdmTv.exe
  2⤵
  PID:5732
- C:\Windows\System\IqniRmq.exe
  C:\Windows\System\IqniRmq.exe
  2⤵
  PID:13876
- C:\Windows\System\QZxuvbU.exe
  C:\Windows\System\QZxuvbU.exe
  2⤵
  PID:14796
- C:\Windows\System\SdMzrNJ.exe
  C:\Windows\System\SdMzrNJ.exe
  2⤵
  PID:14836
- C:\Windows\System\JvqXnqA.exe
  C:\Windows\System\JvqXnqA.exe
  2⤵
  PID:14860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3728 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AFqSxEW.exe

Path C:\Windows\System\AFqSxEW.exe
Size 2.1MB
SHA256 a699cf6d08fd49fcd456d2a335f6321d643d13c5461db598cd9159f05291b4c7
MD5 77bafedfb7da933dd12abaac0a3a36c5
SHA1 0cdac22220834d0c0e1df2316d958736f6017ea2
SHA512 c66897c145c21937ccb75b87399fe6bd4e640a7fe1c92351d2c54ede117aa569719e6abda1e84d6f1cc87a68a9e0b57c252115ab6ae9e71f8cbeb16d46c4c9d8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTY:BemTLkNdfE0pZrQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

AYswVqB.exe

Path C:\Windows\System\AYswVqB.exe
Size 2.1MB
SHA256 8d49a86bb0cd9d3bfda46fedf25e4af2e8cb34ed896a5210075815dc104aaa85
MD5 dd8780dc3c2d54844ae307898889a110
SHA1 abdf2e58221da4fedd02e3bdeee61ea07b669351
SHA512 fb0916a5228b90155fca66420dda372e5a18c46da964e9a6189b0325929f2fab6e23671f04c96d2516ba6182c2c0fddef996593e6017096ba78e1260d2a4e956
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTw:BemTLkNdfE0pZrQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AyPVxto.exe

Path C:\Windows\System\AyPVxto.exe
Size 2.1MB
SHA256 56cf3f8f55908daf6c937215532f7399acfe00241e4690b51a61167c105d5fcd
MD5 35705bfb962a35f9122519c19952a9bc
SHA1 aa59f1b2fd7feca3c6cfb3f7064f9521629a52c6
SHA512 3a3cdc8b58bd8997efc9fbade5bd940d1aca8cfaafdbd6c212a724247672f1e76fa276f0039916ae6ed5c91352ee049269fee70a42a0c17f8815d71d3daafdb1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTX:BemTLkNdfE0pZrQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

BAmAdtk.exe

Path C:\Windows\System\BAmAdtk.exe
Size 2.1MB
SHA256 87e4e117aad492430e57325eb11dc4f1c21b78325b73c45435063876e57d2866
MD5 b3c383136cd0b6acd33cf1fc61d1edcb
SHA1 9bea0fb7ed6c4845e89fb21a9393552cee5a383b
SHA512 7fad5eef50cb1ab9dee3d21a627b5424e3a5e40abf31775f78eba1bd72382424584442ed91e637ad0faf5297673ae75ea776ecc5c4928cd0a205c4d93b5143b1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTR:BemTLkNdfE0pZrQh
MD5 SHA1 SHA512 SSDEEP

Submit Download

CMXSWrM.exe

Path C:\Windows\System\CMXSWrM.exe
Size 2.1MB
SHA256 c912697efcbf4b000a13e9ad8beaef0942488303b13eade52d564f89ecb5e50b
MD5 afbfe68aed655a732d84b297afe9db4c
SHA1 08731cae5b1f0968524b61efa077038a1c3c48a4
SHA512 7493cd4eb005f633f545647cd8e9876d135ff0e803e71f652d3f3640c649a15b8e251c1245052875e2545be6ba5b71c838976a550a1a4793e1615390e7807ff9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTE:BemTLkNdfE0pZrQ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

FHnSXPr.exe

Path C:\Windows\System\FHnSXPr.exe
Size 2.1MB
SHA256 cfbf8624e892e1bcc3428a97be57e7f83925d3502a2a5507917800dfa099fd94
MD5 cc9f6c6a8b3ba9ad2131b5e820905482
SHA1 5dffc77221d6e48528a1e4a67c288c38392ea365
SHA512 8efcc4d267bde2718344fb21fc4d8817064d90dea3a4be226dcc92cb4c537863b6a68877510b85d28d9a60bd68698ac73c973b5006b59bde66a602be1ddcffa5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTO:BemTLkNdfE0pZrQe
MD5 SHA1 SHA512 SSDEEP

Submit Download

HSYGcAa.exe

Path C:\Windows\System\HSYGcAa.exe
Size 2.1MB
SHA256 0c5bebc49e7f375c48fee33ae369c6cc8e7d972f87377eff0337989999379c2a
MD5 f05d71cac7307f392f1eb1510bb7479c
SHA1 33b85014afb87b831e9922cfe282e5f724a9d7d3
SHA512 65be38bff74527dd2064b69a311dd096d4c9c9cd3c64ab0e143103bbc1e2dd4e664d428bf79faae8a7032190da7df3dfb8977b3169275edd2a1446aafd304cd1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTP:BemTLkNdfE0pZrQf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IliMmXh.exe

Path C:\Windows\System\IliMmXh.exe
Size 2.1MB
SHA256 1bf4c4904ec2ccfee6b3eafed09b4a3f1eba6fba591b906a2b9ea932d902df93
MD5 54a22b18d560773f6560198761bf5775
SHA1 cbd00ff5a81d93b1aef125b126d16a2b503e2495
SHA512 cf7084a849f1a45904fb91d7cac957e89c2b5a22319f33f588b3bd53dc6c4a571bce0067b8ca0ad7b0c4c9bf951304c64eaef7433bebe41b6bccea24d2003831
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTl:BemTLkNdfE0pZrQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

KXEmFsN.exe

Path C:\Windows\System\KXEmFsN.exe
Size 2.1MB
SHA256 196223f81f0cbf0f8a86c0a0de853fab919e62511d18ea831e5e02f56b49585a
MD5 b881c0416182f55a36d0dd3736c517f5
SHA1 06a99095e4254d4df264d0e2fbfda22a9c3b1d50
SHA512 8549dbdd3c724ad117ffda398ee417a26e3170343c237f4a2f4bba01f9923f6395f8a6ec2b5a996d2c2236389c8e9c1047c2d1e475a1b70ac2896d222c793334
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTz:BemTLkNdfE0pZrQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

KgJzBPu.exe

Path C:\Windows\System\KgJzBPu.exe
Size 2.1MB
SHA256 a3f893f054b5696c749aff571b0cd95f6a918b45e473e142eb2ad9537b590747
MD5 c8ed80a04c126734e1cc6ae96e5bae81
SHA1 77b94d374793b5bf3359ed382c8904c82d29caf6
SHA512 aae6192e6b0a542601cc94e8ef403cfcb26f455a7cc1e5c64b0cc532dcd1e8172bf24d79cb4d7fcbf3e72d74503d923a55f316153625175edad4350354d708ec
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppT8:BemTLkNdfE0pZrQM
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyTqPoT.exe

Path C:\Windows\System\MyTqPoT.exe
Size 2.1MB
SHA256 991c165a9de233b634c512c56ccf3d8fe1383c1ada98c549b69f65a14f654465
MD5 27ca4c8ce49979b7b1f7302de58754c3
SHA1 926fb22daecd145092ebd9705d3d1f8d27b43261
SHA512 7dad6f0a49e88eb14ee619f286b34cff1463879af556aad80774a7b842eedd29bbca6953adbd852fece9177aeae059f39bcce5e05452c569dae63e22fb44643e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTq:BemTLkNdfE0pZrQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

MzfjZVw.exe

Path C:\Windows\System\MzfjZVw.exe
Size 2.1MB
SHA256 4941dbd452af4324d753e2f80c3646b2460e386d5b5d4ffc54b9e9a9b03803e8
MD5 a9b91e0060114faa35207492ed32a849
SHA1 72fd75784df4b6638634544c74e103b5ae5f6035
SHA512 4b8638346808abc099756969e11458cdbe3491115d7f25a355987a2f2cea072913224c23ef1725a996eb225a800326ad3af28d883ad8280b08baa899165ec1e5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTZ:BemTLkNdfE0pZrQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

PLIGzRJ.exe

Path C:\Windows\System\PLIGzRJ.exe
Size 2.1MB
SHA256 0b3039c28f965e4bca9a8cbff0bac63af5f2fb75fbef77582e38ed89c3e1eaa6
MD5 77e9f327a5c05840e9bfc55533f24e95
SHA1 28c81ac234e811bfffee92b13bab24dffd2836c4
SHA512 b8cf15ebc8147175004f5efa7481c9b6d5c5a78634dc12e4239f50e5a9376a8993b5d4cdbce50651567afe0f5fd1fd300dc567be59722d7c82e8c54ab8953851
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTe:BemTLkNdfE0pZrQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

PwzhXef.exe

Path C:\Windows\System\PwzhXef.exe
Size 2.1MB
SHA256 60ea0ebba176ad99179765c69b61950adaf6f780f61faa9ec75ddb8677e85d23
MD5 654227c60bfede28baa7d987bfb7816a
SHA1 ceb266853f79154e632c7b20b6d2f6d309d11d2f
SHA512 93bf2a21ac285296d6f283d00b57a999943c3d1c62b96d1e2cc0453f727ba27a152959bbecb5eb9a184ed17ef89f932fcdcf33e0a2768276f8d815118922fbe1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppT9:BemTLkNdfE0pZrQN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VEilrXE.exe

Path C:\Windows\System\VEilrXE.exe
Size 2.1MB
SHA256 ad379f3f9a526eae10f91eaee45bc20fffc6b57e98282a63b583b65f62527ff6
MD5 bdb1f1a37dbab364190b8f6e901ceb00
SHA1 3ee8ac1b69b5362de4f5b5ade64c1228f367bd4f
SHA512 5617ed89cf7c5c243aea9b277a1c4c85fcbeb172f608190e1e7f35eff30f94399dec58c7d3b290b3085c6926f6f0094296221ddc4729ea3b2dc10a243eb42ee3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTC:BemTLkNdfE0pZrQy
MD5 SHA1 SHA512 SSDEEP

Submit Download

VREAFDq.exe

Path C:\Windows\System\VREAFDq.exe
Size 2.1MB
SHA256 5a8b3e8886fe68ed069523ee0b82f8b95bc227e5d29f5533b7ec9b131517a8b0
MD5 d8d4b004e3267e4356a551943efaa5a2
SHA1 a87f4dc768b699a020643f3c4f4596d20a503d93
SHA512 37f509a733a4d66f2ad8e90bedc595e0be8a94a881e2d7beb9addc44af91a1da37204b49f5e0fe39d93f1f3946e05324759f98697af2d8e62d35af261cdd1d65
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTY:BemTLkNdfE0pZrQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZJPWBgs.exe

Path C:\Windows\System\ZJPWBgs.exe
Size 2.1MB
SHA256 e5e8a26196e41c82658db44341bb8065604e547fc1817efbf37107a8060c3d0a
MD5 97ca843cd16b405ce07f32b28b6ea227
SHA1 467e4fa271ad28e4c0da556fc0fa0143008bec05
SHA512 2c7c22ec5cbdda11179b83faad9c2888d511cce0624975815cba36736873d47208fa91759ba0f3857e7d11a272341bc50fca00d3014029123725f653e2e6a56e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppT2:BemTLkNdfE0pZrQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dIDYvOb.exe

Path C:\Windows\System\dIDYvOb.exe
Size 2.1MB
SHA256 c6607b6076b9fcbc84295b73c3e29e1297543b8fa910c17fb691d0a7f2a148de
MD5 d4694841c6996132e5f4e7074a056cf7
SHA1 83ec5719e423d46c6f23d77fe23f9fc39ef2669b
SHA512 2d1619c19292d7184b52c0a39ac39921cc24e9aad2e139a42fa031cf4dbcddbeeddcfd77f66b9999fcbe2198dec59a976fdeeb9ad25e53039b9d2a490a50d3bd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTq:BemTLkNdfE0pZrQa
MD5 SHA1 SHA512 SSDEEP

Submit Download

dpdwzKK.exe

Path C:\Windows\System\dpdwzKK.exe
Size 2.1MB
SHA256 8624fc8dbf240bd9f13d392706dfbb4435269e7ac92604c8b5dd8ad123f8c9a4
MD5 77e59c3e5e4fee6cf26b7ab1e8853564
SHA1 787127e90be5843c256688e10eae1dc777939e09
SHA512 557d9bfeffe413bab296a9de430035dc93a24d58601718cd8b0779bcd582ede09017b50a8e9545ff9c944cb13d9965025284e40a1f330b7d61dfafb37668c0cb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTA:BemTLkNdfE0pZrQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

drnRPQT.exe

Path C:\Windows\System\drnRPQT.exe
Size 2.1MB
SHA256 7544ebc1fa1157b402720ecc3fcf4fb65efcd4283ce3471f519ad5d096f5b5d6
MD5 315e791e2605528baf2f096f043ca35a
SHA1 7033654d02e9fbbff39cda11ac89c1a8e3734a75
SHA512 1c15fe585d87a90a99b7d1c723a4ad0eaa31416d2dc464d987497fe1993b18a6d91a67d70eb441136848bc693212c2c7e7d1e6c46ef3334d5d5bd86a3f4e104c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTr:BemTLkNdfE0pZrQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

eCnbthI.exe

Path C:\Windows\System\eCnbthI.exe
Size 2.1MB
SHA256 19ed6f52678600989fdba3cd398a7193be59a9fd80a54a7f2d5a025296ffdd08
MD5 84006114790b608cb728a74780428060
SHA1 42dfe52b97f91663a876a694185272f70b4a359b
SHA512 d730ea01dcd8ae346bdf23af29ddb94b7d733d61a8b33bc04230d9013013f5d46a5310ef14d4e16bf362acee86290f1b6a4bfe2268fbd275173aa0e970a994f8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTY:BemTLkNdfE0pZrQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

eUrVYzu.exe

Path C:\Windows\System\eUrVYzu.exe
Size 2.1MB
SHA256 674fcb372bfa341541276fdb97b7559123c7f2d23b754164be22ec05e4498ead
MD5 8fedfafa7d7010303c985856ead05b0a
SHA1 c9bc00b0f128f0b9b545bbb7243085ef5d25aa00
SHA512 f9dcda0afe2da9c313d319b3c0389c9fde6cb71b882618eddb4044732218ec741a9e940a6dde0513b7e6c4448478bf1f5696620c4257ac40e8e7d9c108a5763e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppT1:BemTLkNdfE0pZrQF
MD5 SHA1 SHA512 SSDEEP

Submit Download

gCPYvhg.exe

Path C:\Windows\System\gCPYvhg.exe
Size 2.1MB
SHA256 bef3d7a01a19ca367e4d38235363d8a67cf0bfb717fe85e82951fba71a5d4882
MD5 c5b33f188cc6de217e6a9e0e37e7c71f
SHA1 984119d2b97d5b42413deb4299d8a2a168724b93
SHA512 42b4c9179399a21c15cd6626c620aa33ebf1bc632092784e5078d6d08cc7f0cbc3c6344b9c741be8501e11abc2cd17dd7d5869de058c28ef64c4b2d46f8deb65
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTP:BemTLkNdfE0pZrQf
MD5 SHA1 SHA512 SSDEEP

Submit Download

hTGVeIb.exe

Path C:\Windows\System\hTGVeIb.exe
Size 2.1MB
SHA256 02739b5b04dcce16a1a4c26db4f6792096e522025101bb8d238489f902d2d5d0
MD5 69554af611c5c2ceb17c630ce6a5e5a0
SHA1 03e446e406ba089fb23925acf4268309c47f6fe1
SHA512 1d5d53b8f228dbff7165923727f811996662ca9d5612905edc6e2343a10c75c4d48022b6ebaf8679ab94a0b6149c7a64420c15795a09c327790215ecbb6025e4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTR:BemTLkNdfE0pZrQh
MD5 SHA1 SHA512 SSDEEP

Submit Download

iMutirU.exe

Path C:\Windows\System\iMutirU.exe
Size 2.1MB
SHA256 5fdf345b39108044404ee7b30f8776a873b088edc3fc722fe3aed716ea230cf6
MD5 3a09436f94c785eeb37343f85b84ae46
SHA1 75313e8a2caa7fc716d0e599a9cdb59d134f48dc
SHA512 de58c382d1b9db066f5307ca15e94adc9f366bbffd6d2eab9edb1e944990fa1dcacec10ed5b0a3396d4a2e611541af1cfbc85b0fb2d60e27772f12afdae87177
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTL:BemTLkNdfE0pZrQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktVcKec.exe

Path C:\Windows\System\ktVcKec.exe
Size 2.1MB
SHA256 7c7c4e26b2060c5412527af2cf9d1a99e809bd3ccdafc7518a921b68467dc498
MD5 d2d65b3e8d283129ccdf43ee32b4d4f6
SHA1 3c62b264917af61880fe02b819c33e99810310ae
SHA512 2cd139fabf10ee41c073fca8feddd10e2aa234b3f80b389289c6e0a4a4078989cc65c727a65f49a2537bedbff55149463880c4be5d2bd2575f46743ea681c664
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTi:BemTLkNdfE0pZrQy
MD5 SHA1 SHA512 SSDEEP

Submit Download

lKRYrKl.exe

Path C:\Windows\System\lKRYrKl.exe
Size 2.1MB
SHA256 4ad332e28f224db713516c2d7c9f3731b64d97112f98ae42fe84c4a5a116b818
MD5 bab8712732494937815875b217d29cc2
SHA1 3e0e5b720a1e84ce4014bf504257d7bb87d88a04
SHA512 2f6b53d9c1e6b9888fd1f890a2beb4bc772507dad905a6fa9900efd7db9a0a9194d67e166ba2b45166a575a6a87d747cf8440b35260b81a33fd10f8d7b13edd0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTf:BemTLkNdfE0pZrQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

msQleeH.exe

Path C:\Windows\System\msQleeH.exe
Size 2.1MB
SHA256 c8f8e690ec70cb29bafc0d9da73baa006358afbc22722639d8ebed88cc8c1b51
MD5 4d23f2e2ca93baa7622668b14ac83201
SHA1 0b87b1d58918214db82cb6618deaa7ba79008315
SHA512 db5cee345093ee83113e8f7b80d858cbde5b28ed3a2ad4c9a30e834f9a657219beaf9ebffb452fbafe3d48f0cb36dc6db941c044215e03896c81a208f08155e9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTB:BemTLkNdfE0pZrQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwYCjTW.exe

Path C:\Windows\System\pwYCjTW.exe
Size 2.1MB
SHA256 c73ca4d2defdc6f02146567b0435546f5b9f7ba896100c5e36e3c23de4ad41c7
MD5 661da614af513c446d3fb8d1ed153489
SHA1 508e633920cf7296fcc0a28f68a2b9f369116079
SHA512 4aec01d932e32ea58d9f2c9df5389f39674c0b5881fc73e880afccc16a572bb1b017bbb62fbd20ef8496752d25f4a6584a031087093b02f8cff643d3258f9bde
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppT4:BemTLkNdfE0pZrQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

qVOWwRn.exe

Path C:\Windows\System\qVOWwRn.exe
Size 2.1MB
SHA256 4426f183bb607037b91c7c31bceee5f20b5305e033617b16006d1f9dcece287b
MD5 b45bd08c433c62e4272a4ac22bbe77ba
SHA1 cd5e452ff723d3207fd62da3ac317e882db2aac7
SHA512 d4399c79d4e80cb5b97ee848ab7e1fd7bfdce4bf5038c21e030bf7665972020b7dd24de9a87a9c7685152ee03f4dd43a015f05e6a5f21e4445fe900ff3867056
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppT0:BemTLkNdfE0pZrQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvEPSIK.exe

Path C:\Windows\System\tvEPSIK.exe
Size 2.1MB
SHA256 1dd5a2694110b47c6fbc43bc57ed27829b82560ed05e468fce9f79920ad5769a
MD5 391d6f7883a940d01f92fd645cdc5930
SHA1 b3a7b28e408751f8752047c2a50f232faccb61e7
SHA512 0264ac24044aab56592ca69ab3e7f7b2af9337a41b935db297dcddb5c98d9d60a5ab8880df2f16214622e807470e8f35597c03dda5084bf22298790f39c94859
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTT:BemTLkNdfE0pZrQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkMtBTj.exe

Path C:\Windows\System\vkMtBTj.exe
Size 2.1MB
SHA256 efab4da4ef3dc25f5b941e3dc15e13981fc5108d18053243ee0f40b3f8423ce1
MD5 9573292968c6a7b989edb0561fd1b6aa
SHA1 0b6747ef9b6139fce11335603242f0bbc30f2eab
SHA512 7375d9d66d18ae2d5dc1561afa684aac3a497b23823aeb942a3943c98fa0ab9eb6897e46d4428b7b6063d70c95c60d235bc2ec41b11281e484df59cfb02c9c85
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgoJsT2hppTc:BemTLkNdfE0pZrQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-1-0x000002734EC40000-0x000002734EC50000-memory.dmp

Download

memory/8-0-0x00007FF749090000-0x00007FF7493E4000-memory.dmp

Download

memory/516-26-0x00007FF6F5630000-0x00007FF6F5984000-memory.dmp

Download

memory/636-2187-0x00007FF6A82C0000-0x00007FF6A8614000-memory.dmp

Download

memory/636-247-0x00007FF6A82C0000-0x00007FF6A8614000-memory.dmp

Download

memory/732-253-0x00007FF63FDD0000-0x00007FF640124000-memory.dmp

Download

memory/732-2192-0x00007FF63FDD0000-0x00007FF640124000-memory.dmp

Download

memory/752-2167-0x00007FF6D0220000-0x00007FF6D0574000-memory.dmp

Download

memory/752-241-0x00007FF6D0220000-0x00007FF6D0574000-memory.dmp

Download

memory/916-2130-0x00007FF7257B0000-0x00007FF725B04000-memory.dmp

Download

memory/916-236-0x00007FF7257B0000-0x00007FF725B04000-memory.dmp

Download

memory/924-2194-0x00007FF690ED0000-0x00007FF691224000-memory.dmp

Download

memory/924-260-0x00007FF690ED0000-0x00007FF691224000-memory.dmp

Download

memory/940-2138-0x00007FF693B80000-0x00007FF693ED4000-memory.dmp

Download

memory/940-234-0x00007FF693B80000-0x00007FF693ED4000-memory.dmp

Download

memory/1076-2174-0x00007FF7E9C10000-0x00007FF7E9F64000-memory.dmp

Download

memory/1076-240-0x00007FF7E9C10000-0x00007FF7E9F64000-memory.dmp

Download

memory/1976-2096-0x00007FF612270000-0x00007FF6125C4000-memory.dmp

Download

memory/1976-231-0x00007FF612270000-0x00007FF6125C4000-memory.dmp

Download

memory/2124-239-0x00007FF68F8B0000-0x00007FF68FC04000-memory.dmp

Download

memory/2124-2162-0x00007FF68F8B0000-0x00007FF68FC04000-memory.dmp

Download

memory/2152-2100-0x00007FF65FD60000-0x00007FF6600B4000-memory.dmp

Download

memory/2152-233-0x00007FF65FD60000-0x00007FF6600B4000-memory.dmp

Download

memory/2384-2074-0x00007FF7EF940000-0x00007FF7EFC94000-memory.dmp

Download

memory/2384-24-0x00007FF7EF940000-0x00007FF7EFC94000-memory.dmp

Download

memory/2444-2189-0x00007FF76F410000-0x00007FF76F764000-memory.dmp

Download

memory/2444-259-0x00007FF76F410000-0x00007FF76F764000-memory.dmp

Download

memory/2528-252-0x00007FF7070A0000-0x00007FF7073F4000-memory.dmp

Download

memory/2528-2190-0x00007FF7070A0000-0x00007FF7073F4000-memory.dmp

Download

memory/2572-235-0x00007FF7FAF90000-0x00007FF7FB2E4000-memory.dmp

Download

memory/2572-2124-0x00007FF7FAF90000-0x00007FF7FB2E4000-memory.dmp

Download

memory/2648-248-0x00007FF6C4400000-0x00007FF6C4754000-memory.dmp

Download

memory/2648-2185-0x00007FF6C4400000-0x00007FF6C4754000-memory.dmp

Download

memory/2824-2206-0x00007FF70E290000-0x00007FF70E5E4000-memory.dmp

Download

memory/2824-265-0x00007FF70E290000-0x00007FF70E5E4000-memory.dmp

Download

memory/2888-2047-0x00007FF6525D0000-0x00007FF652924000-memory.dmp

Download

memory/2888-14-0x00007FF6525D0000-0x00007FF652924000-memory.dmp

Download

memory/3052-2193-0x00007FF781970000-0x00007FF781CC4000-memory.dmp

Download

memory/3052-263-0x00007FF781970000-0x00007FF781CC4000-memory.dmp

Download

memory/3320-249-0x00007FF796E00000-0x00007FF797154000-memory.dmp

Download

memory/3320-2188-0x00007FF796E00000-0x00007FF797154000-memory.dmp

Download

memory/3452-242-0x00007FF6EE0D0000-0x00007FF6EE424000-memory.dmp

Download

memory/3452-2183-0x00007FF6EE0D0000-0x00007FF6EE424000-memory.dmp

Download

memory/3572-264-0x00007FF7369C0000-0x00007FF736D14000-memory.dmp

Download

memory/3572-2202-0x00007FF7369C0000-0x00007FF736D14000-memory.dmp

Download

memory/3684-2191-0x00007FF76FF90000-0x00007FF7702E4000-memory.dmp

Download

memory/3684-256-0x00007FF76FF90000-0x00007FF7702E4000-memory.dmp

Download

memory/3764-2186-0x00007FF725990000-0x00007FF725CE4000-memory.dmp

Download

memory/3764-246-0x00007FF725990000-0x00007FF725CE4000-memory.dmp

Download

memory/3904-2165-0x00007FF7B53D0000-0x00007FF7B5724000-memory.dmp

Download

memory/3904-238-0x00007FF7B53D0000-0x00007FF7B5724000-memory.dmp

Download

memory/3912-230-0x00007FF7915E0000-0x00007FF791934000-memory.dmp

Download

memory/3912-2085-0x00007FF7915E0000-0x00007FF791934000-memory.dmp

Download

memory/3968-2161-0x00007FF65A0C0000-0x00007FF65A414000-memory.dmp

Download

memory/3968-232-0x00007FF65A0C0000-0x00007FF65A414000-memory.dmp

Download

memory/4648-2155-0x00007FF77C2D0000-0x00007FF77C624000-memory.dmp

Download

memory/4648-237-0x00007FF77C2D0000-0x00007FF77C624000-memory.dmp

Download

memory/5004-8-0x00007FF6FA630000-0x00007FF6FA984000-memory.dmp

Download

memory/5004-2039-0x00007FF6FA630000-0x00007FF6FA984000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads