xmrig | 92f55b68727449d6e9925ee763531f3a805d6d8f0ca9213e67404aa52c413e24

Analysis

max time kernel
127s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
Size 1.9MB
Sample240525-s8texshe6z
SHA256 92f55b68727449d6e9925ee763531f3a805d6d8f0ca9213e67404aa52c413e24
MD5 78410ac2dad0bf052aa42d3017299660
SHA1 944e369bb51841f6eb8eda5c7ea7735e9a759c84
SHA512 e567c0cba5a7f5d849c2d775f29fcf544d646ae30ef90a1bf7507146efaf7cd47c84e3c011645535fd559a5e9918817dab85c390688e07f4dc5382e56f9fde66
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTy:RWWBib356utgE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 52 IoCs

miner

resource	yara_rule
behavioral2/memory/3684-19-0x00007FF7B43F0000-0x00007FF7B4741000-memory.dmp	xmrig
behavioral2/memory/4960-239-0x00007FF769C40000-0x00007FF769F91000-memory.dmp	xmrig
behavioral2/memory/3712-244-0x00007FF7C05B0000-0x00007FF7C0901000-memory.dmp	xmrig
behavioral2/memory/560-264-0x00007FF73BD20000-0x00007FF73C071000-memory.dmp	xmrig
behavioral2/memory/4816-301-0x00007FF696B50000-0x00007FF696EA1000-memory.dmp	xmrig
behavioral2/memory/4616-312-0x00007FF696D70000-0x00007FF6970C1000-memory.dmp	xmrig
behavioral2/memory/468-317-0x00007FF6EED10000-0x00007FF6EF061000-memory.dmp	xmrig
behavioral2/memory/4188-315-0x00007FF641500000-0x00007FF641851000-memory.dmp	xmrig
behavioral2/memory/1928-314-0x00007FF66EC50000-0x00007FF66EFA1000-memory.dmp	xmrig
behavioral2/memory/1932-313-0x00007FF7EE630000-0x00007FF7EE981000-memory.dmp	xmrig
behavioral2/memory/3352-300-0x00007FF6B71D0000-0x00007FF6B7521000-memory.dmp	xmrig
behavioral2/memory/2980-294-0x00007FF6830D0000-0x00007FF683421000-memory.dmp	xmrig
behavioral2/memory/4948-292-0x00007FF76E380000-0x00007FF76E6D1000-memory.dmp	xmrig
behavioral2/memory/4444-291-0x00007FF68A4F0000-0x00007FF68A841000-memory.dmp	xmrig
behavioral2/memory/1068-238-0x00007FF6B0E90000-0x00007FF6B11E1000-memory.dmp	xmrig
behavioral2/memory/2564-199-0x00007FF7308C0000-0x00007FF730C11000-memory.dmp	xmrig
behavioral2/memory/436-183-0x00007FF6945D0000-0x00007FF694921000-memory.dmp	xmrig
behavioral2/memory/2092-138-0x00007FF67F790000-0x00007FF67FAE1000-memory.dmp	xmrig
behavioral2/memory/4980-113-0x00007FF6EDD40000-0x00007FF6EE091000-memory.dmp	xmrig
behavioral2/memory/1980-109-0x00007FF601820000-0x00007FF601B71000-memory.dmp	xmrig
behavioral2/memory/4440-81-0x00007FF6568D0000-0x00007FF656C21000-memory.dmp	xmrig
behavioral2/memory/1512-2150-0x00007FF737F60000-0x00007FF7382B1000-memory.dmp	xmrig
behavioral2/memory/2756-2251-0x00007FF722AF0000-0x00007FF722E41000-memory.dmp	xmrig
behavioral2/memory/3684-2253-0x00007FF7B43F0000-0x00007FF7B4741000-memory.dmp	xmrig
behavioral2/memory/2756-2255-0x00007FF722AF0000-0x00007FF722E41000-memory.dmp	xmrig
behavioral2/memory/3352-2257-0x00007FF6B71D0000-0x00007FF6B7521000-memory.dmp	xmrig
behavioral2/memory/4776-2259-0x00007FF6929C0000-0x00007FF692D11000-memory.dmp	xmrig
behavioral2/memory/4816-2262-0x00007FF696B50000-0x00007FF696EA1000-memory.dmp	xmrig
behavioral2/memory/1672-2263-0x00007FF72C680000-0x00007FF72C9D1000-memory.dmp	xmrig
behavioral2/memory/596-2267-0x00007FF78FBA0000-0x00007FF78FEF1000-memory.dmp	xmrig
behavioral2/memory/3168-2271-0x00007FF6E7320000-0x00007FF6E7671000-memory.dmp	xmrig
behavioral2/memory/4440-2270-0x00007FF6568D0000-0x00007FF656C21000-memory.dmp	xmrig
behavioral2/memory/2860-2265-0x00007FF7B5010000-0x00007FF7B5361000-memory.dmp	xmrig
behavioral2/memory/1980-2273-0x00007FF601820000-0x00007FF601B71000-memory.dmp	xmrig
behavioral2/memory/5064-2290-0x00007FF719AA0000-0x00007FF719DF1000-memory.dmp	xmrig
behavioral2/memory/1928-2291-0x00007FF66EC50000-0x00007FF66EFA1000-memory.dmp	xmrig
behavioral2/memory/2564-2293-0x00007FF7308C0000-0x00007FF730C11000-memory.dmp	xmrig
behavioral2/memory/3712-2297-0x00007FF7C05B0000-0x00007FF7C0901000-memory.dmp	xmrig
behavioral2/memory/4948-2305-0x00007FF76E380000-0x00007FF76E6D1000-memory.dmp	xmrig
behavioral2/memory/2980-2308-0x00007FF6830D0000-0x00007FF683421000-memory.dmp	xmrig
behavioral2/memory/4960-2303-0x00007FF769C40000-0x00007FF769F91000-memory.dmp	xmrig
behavioral2/memory/4444-2301-0x00007FF68A4F0000-0x00007FF68A841000-memory.dmp	xmrig
behavioral2/memory/1068-2299-0x00007FF6B0E90000-0x00007FF6B11E1000-memory.dmp	xmrig
behavioral2/memory/560-2295-0x00007FF73BD20000-0x00007FF73C071000-memory.dmp	xmrig
behavioral2/memory/2132-2288-0x00007FF6E7000000-0x00007FF6E7351000-memory.dmp	xmrig
behavioral2/memory/4188-2285-0x00007FF641500000-0x00007FF641851000-memory.dmp	xmrig
behavioral2/memory/1932-2282-0x00007FF7EE630000-0x00007FF7EE981000-memory.dmp	xmrig
behavioral2/memory/4980-2280-0x00007FF6EDD40000-0x00007FF6EE091000-memory.dmp	xmrig
behavioral2/memory/2092-2278-0x00007FF67F790000-0x00007FF67FAE1000-memory.dmp	xmrig
behavioral2/memory/4616-2284-0x00007FF696D70000-0x00007FF6970C1000-memory.dmp	xmrig
behavioral2/memory/436-2276-0x00007FF6945D0000-0x00007FF694921000-memory.dmp	xmrig
behavioral2/memory/468-2351-0x00007FF6EED10000-0x00007FF6EF061000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2756	NULVMys.exe
3684	ffCNrAQ.exe
4776	rtJLRrv.exe
3352	TvwAFAb.exe
1672	pgRjgsH.exe
3168	jiSrQHD.exe
4816	tUggDWy.exe
596	vxFpLvO.exe
2860	zNvnIld.exe
4440	iFEtYvb.exe
4616	XtGhsKT.exe
5064	pIssODa.exe
1980	ILiAqbw.exe
1932	DRvcEwK.exe
4980	neKUfUp.exe
2092	WlTpQgV.exe
2132	XUqWVDh.exe
436	kWvZhJk.exe
1928	PZqhNof.exe
4188	EwBBWGk.exe
2564	kXwoWte.exe
1068	bTdgvcI.exe
4960	gQySJEq.exe
3712	GtBNWwq.exe
560	uGViINh.exe
4444	aDxYwmN.exe
468	HGpojMt.exe
4948	JeUvIUQ.exe
2980	nVKnpZq.exe
2440	LZjovCK.exe
4916	ZNnqgiA.exe
384	XXtyOFW.exe
4416	gFETVsS.exe
4860	giVLnfl.exe
4872	PuyQDNs.exe
208	WZyOVBF.exe
1276	ncbrNjz.exe
4104	bEASMjX.exe
3096	rSDHoWj.exe
1924	RJAagVT.exe
3600	ucREqQB.exe
2232	mljEstn.exe
4168	sowtCAv.exe
2156	oAmQOfW.exe
2260	VCeYFZQ.exe
2928	hrpFqtw.exe
3512	KzYExNG.exe
2276	rUIrXXd.exe
3596	jDOBHzq.exe
1868	IvwIGtd.exe
772	iCsMGOq.exe
1952	mneJAHv.exe
1488	phYJtWr.exe
2220	uAUxbSS.exe
2708	yZBnnBo.exe
4076	cnvwZaI.exe
4072	khbKunv.exe
4376	nwwSiFm.exe
4364	hlHCSTO.exe
716	SkKAftd.exe
4544	HuhpJQZ.exe
3984	QIZkUgk.exe
4552	eBUZLOY.exe
3324	rRWHeMp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1512-0-0x00007FF737F60000-0x00007FF7382B1000-memory.dmp	upx
behavioral2/files/0x000800000002340d-5.dat	upx
behavioral2/files/0x0007000000023412-7.dat	upx
behavioral2/files/0x0007000000023413-24.dat	upx
behavioral2/memory/3684-19-0x00007FF7B43F0000-0x00007FF7B4741000-memory.dmp	upx
behavioral2/memory/4776-27-0x00007FF6929C0000-0x00007FF692D11000-memory.dmp	upx
behavioral2/files/0x0007000000023417-34.dat	upx
behavioral2/files/0x0007000000023419-46.dat	upx
behavioral2/memory/596-52-0x00007FF78FBA0000-0x00007FF78FEF1000-memory.dmp	upx
behavioral2/files/0x000700000002341f-84.dat	upx
behavioral2/files/0x000700000002341d-90.dat	upx
behavioral2/files/0x0007000000023422-105.dat	upx
behavioral2/files/0x0007000000023429-129.dat	upx
behavioral2/files/0x0007000000023426-169.dat	upx
behavioral2/files/0x0007000000023435-213.dat	upx
behavioral2/memory/4960-239-0x00007FF769C40000-0x00007FF769F91000-memory.dmp	upx
behavioral2/memory/3712-244-0x00007FF7C05B0000-0x00007FF7C0901000-memory.dmp	upx
behavioral2/memory/560-264-0x00007FF73BD20000-0x00007FF73C071000-memory.dmp	upx
behavioral2/memory/4816-301-0x00007FF696B50000-0x00007FF696EA1000-memory.dmp	upx
behavioral2/memory/4616-312-0x00007FF696D70000-0x00007FF6970C1000-memory.dmp	upx
behavioral2/memory/468-317-0x00007FF6EED10000-0x00007FF6EF061000-memory.dmp	upx
behavioral2/memory/4188-315-0x00007FF641500000-0x00007FF641851000-memory.dmp	upx
behavioral2/memory/1928-314-0x00007FF66EC50000-0x00007FF66EFA1000-memory.dmp	upx
behavioral2/memory/1932-313-0x00007FF7EE630000-0x00007FF7EE981000-memory.dmp	upx
behavioral2/memory/3352-300-0x00007FF6B71D0000-0x00007FF6B7521000-memory.dmp	upx
behavioral2/memory/2980-294-0x00007FF6830D0000-0x00007FF683421000-memory.dmp	upx
behavioral2/memory/4948-292-0x00007FF76E380000-0x00007FF76E6D1000-memory.dmp	upx
behavioral2/memory/4444-291-0x00007FF68A4F0000-0x00007FF68A841000-memory.dmp	upx
behavioral2/memory/1068-238-0x00007FF6B0E90000-0x00007FF6B11E1000-memory.dmp	upx
behavioral2/files/0x000700000002342c-210.dat	upx
behavioral2/memory/2564-199-0x00007FF7308C0000-0x00007FF730C11000-memory.dmp	upx
behavioral2/files/0x0007000000023427-196.dat	upx
behavioral2/files/0x0007000000023432-193.dat	upx
behavioral2/memory/436-183-0x00007FF6945D0000-0x00007FF694921000-memory.dmp	upx
behavioral2/files/0x0007000000023431-180.dat	upx
behavioral2/files/0x0007000000023428-166.dat	upx
behavioral2/files/0x0007000000023425-164.dat	upx
behavioral2/files/0x0007000000023424-162.dat	upx
behavioral2/files/0x0007000000023430-157.dat	upx
behavioral2/files/0x000700000002342a-156.dat	upx
behavioral2/memory/2132-155-0x00007FF6E7000000-0x00007FF6E7351000-memory.dmp	upx
behavioral2/files/0x000700000002342f-154.dat	upx
behavioral2/files/0x0007000000023423-152.dat	upx
behavioral2/files/0x000700000002342e-150.dat	upx
behavioral2/files/0x000700000002342d-148.dat	upx
behavioral2/files/0x000800000002340e-147.dat	upx
behavioral2/files/0x000700000002342b-143.dat	upx
behavioral2/memory/2092-138-0x00007FF67F790000-0x00007FF67FAE1000-memory.dmp	upx
behavioral2/files/0x000700000002341b-124.dat	upx
behavioral2/files/0x0007000000023421-117.dat	upx
behavioral2/files/0x0007000000023420-115.dat	upx
behavioral2/memory/4980-113-0x00007FF6EDD40000-0x00007FF6EE091000-memory.dmp	upx
behavioral2/memory/1980-109-0x00007FF601820000-0x00007FF601B71000-memory.dmp	upx
behavioral2/files/0x000700000002341e-93.dat	upx
behavioral2/files/0x000700000002341a-88.dat	upx
behavioral2/memory/5064-87-0x00007FF719AA0000-0x00007FF719DF1000-memory.dmp	upx
behavioral2/memory/4440-81-0x00007FF6568D0000-0x00007FF656C21000-memory.dmp	upx
behavioral2/files/0x000700000002341c-75.dat	upx
behavioral2/memory/2860-74-0x00007FF7B5010000-0x00007FF7B5361000-memory.dmp	upx
behavioral2/files/0x0007000000023418-59.dat	upx
behavioral2/memory/3168-48-0x00007FF6E7320000-0x00007FF6E7671000-memory.dmp	upx
behavioral2/memory/1672-47-0x00007FF72C680000-0x00007FF72C9D1000-memory.dmp	upx
behavioral2/files/0x0007000000023416-44.dat	upx
behavioral2/files/0x0007000000023415-42.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vXkRKHN.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\JiVCXjN.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\vuUXhtf.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\rRWHeMp.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\KYNvKfK.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\QtKbZpx.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\jVEvrfs.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\QboyGAO.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\vVmFelv.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\vJKJwwN.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\UtCGOhy.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\FdohtVY.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\LcNngfT.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\BFbllVW.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\AChXPMZ.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\vjyPKbd.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\eYNzgFi.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\pzzrpru.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\PcmcCrI.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\nSvHLYy.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\EyfiizB.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\TqIYJem.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\GtBNWwq.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\cJhVrCh.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\iYqjCTF.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\cBBRkWh.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\QIZkUgk.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\UhsaDrW.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\rjnlydk.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\CqvFege.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\wxgdJKe.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\kUJesdp.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\dXKMlyT.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\rkPVfbc.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\BmvonGb.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\RkGaNmQ.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\ruXZkKN.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\jAvBYAn.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\MAtaSaE.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\CsaxFbE.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\dBDUwvd.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\ucFUpvl.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\IrxOaTz.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\AjPiMqy.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\WzBdzcq.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\PabxwTR.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\yfdvoVy.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\xTeSypA.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\bTeqQPD.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\rMjRvhv.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\zNvnIld.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\neKUfUp.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\Jizygdt.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\idwhHTL.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\raucONz.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\UnCCOsR.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\HmFjxXV.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\mljEstn.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\AtpiOgq.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\QOzWIEL.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\YBQDmxO.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\LxUMMMj.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\OQNqejP.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
File created	C:\Windows\System\rWUEMEj.exe	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2756	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	84
PID 1512 wrote to memory of 2756	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	84
PID 1512 wrote to memory of 3684	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	85
PID 1512 wrote to memory of 3684	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	85
PID 1512 wrote to memory of 4776	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	86
PID 1512 wrote to memory of 4776	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	86
PID 1512 wrote to memory of 3352	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	87
PID 1512 wrote to memory of 3352	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	87
PID 1512 wrote to memory of 1672	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	88
PID 1512 wrote to memory of 1672	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	88
PID 1512 wrote to memory of 3168	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	89
PID 1512 wrote to memory of 3168	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	89
PID 1512 wrote to memory of 4816	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	90
PID 1512 wrote to memory of 4816	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	90
PID 1512 wrote to memory of 596	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	91
PID 1512 wrote to memory of 596	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	91
PID 1512 wrote to memory of 2860	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	92
PID 1512 wrote to memory of 2860	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	92
PID 1512 wrote to memory of 4440	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	93
PID 1512 wrote to memory of 4440	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	93
PID 1512 wrote to memory of 4616	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	94
PID 1512 wrote to memory of 4616	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	94
PID 1512 wrote to memory of 5064	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	95
PID 1512 wrote to memory of 5064	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	95
PID 1512 wrote to memory of 1980	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	96
PID 1512 wrote to memory of 1980	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	96
PID 1512 wrote to memory of 1932	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	97
PID 1512 wrote to memory of 1932	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	97
PID 1512 wrote to memory of 4980	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	98
PID 1512 wrote to memory of 4980	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	98
PID 1512 wrote to memory of 2092	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	99
PID 1512 wrote to memory of 2092	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	99
PID 1512 wrote to memory of 2132	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	100
PID 1512 wrote to memory of 2132	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	100
PID 1512 wrote to memory of 436	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	101
PID 1512 wrote to memory of 436	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	101
PID 1512 wrote to memory of 1928	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	102
PID 1512 wrote to memory of 1928	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	102
PID 1512 wrote to memory of 4188	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	103
PID 1512 wrote to memory of 4188	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	103
PID 1512 wrote to memory of 2564	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	104
PID 1512 wrote to memory of 2564	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	104
PID 1512 wrote to memory of 1068	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	105
PID 1512 wrote to memory of 1068	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	105
PID 1512 wrote to memory of 4960	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	106
PID 1512 wrote to memory of 4960	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	106
PID 1512 wrote to memory of 3712	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	107
PID 1512 wrote to memory of 3712	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	107
PID 1512 wrote to memory of 560	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	108
PID 1512 wrote to memory of 560	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	108
PID 1512 wrote to memory of 4444	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	109
PID 1512 wrote to memory of 4444	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	109
PID 1512 wrote to memory of 4416	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	110
PID 1512 wrote to memory of 4416	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	110
PID 1512 wrote to memory of 468	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	111
PID 1512 wrote to memory of 468	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	111
PID 1512 wrote to memory of 4948	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	112
PID 1512 wrote to memory of 4948	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	112
PID 1512 wrote to memory of 2980	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	113
PID 1512 wrote to memory of 2980	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	113
PID 1512 wrote to memory of 2440	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	114
PID 1512 wrote to memory of 2440	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	114
PID 1512 wrote to memory of 4916	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	115
PID 1512 wrote to memory of 4916	1512	78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\78410ac2dad0bf052aa42d3017299660_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\System\NULVMys.exe
  C:\Windows\System\NULVMys.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\ffCNrAQ.exe
  C:\Windows\System\ffCNrAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\rtJLRrv.exe
  C:\Windows\System\rtJLRrv.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\TvwAFAb.exe
  C:\Windows\System\TvwAFAb.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\pgRjgsH.exe
  C:\Windows\System\pgRjgsH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\jiSrQHD.exe
  C:\Windows\System\jiSrQHD.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\tUggDWy.exe
  C:\Windows\System\tUggDWy.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\vxFpLvO.exe
  C:\Windows\System\vxFpLvO.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\zNvnIld.exe
  C:\Windows\System\zNvnIld.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\iFEtYvb.exe
  C:\Windows\System\iFEtYvb.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\XtGhsKT.exe
  C:\Windows\System\XtGhsKT.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\pIssODa.exe
  C:\Windows\System\pIssODa.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ILiAqbw.exe
  C:\Windows\System\ILiAqbw.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\DRvcEwK.exe
  C:\Windows\System\DRvcEwK.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\neKUfUp.exe
  C:\Windows\System\neKUfUp.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\WlTpQgV.exe
  C:\Windows\System\WlTpQgV.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\XUqWVDh.exe
  C:\Windows\System\XUqWVDh.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\kWvZhJk.exe
  C:\Windows\System\kWvZhJk.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\PZqhNof.exe
  C:\Windows\System\PZqhNof.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\EwBBWGk.exe
  C:\Windows\System\EwBBWGk.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\kXwoWte.exe
  C:\Windows\System\kXwoWte.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bTdgvcI.exe
  C:\Windows\System\bTdgvcI.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\gQySJEq.exe
  C:\Windows\System\gQySJEq.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\GtBNWwq.exe
  C:\Windows\System\GtBNWwq.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\uGViINh.exe
  C:\Windows\System\uGViINh.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\aDxYwmN.exe
  C:\Windows\System\aDxYwmN.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\gFETVsS.exe
  C:\Windows\System\gFETVsS.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\HGpojMt.exe
  C:\Windows\System\HGpojMt.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\JeUvIUQ.exe
  C:\Windows\System\JeUvIUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\nVKnpZq.exe
  C:\Windows\System\nVKnpZq.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\LZjovCK.exe
  C:\Windows\System\LZjovCK.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ZNnqgiA.exe
  C:\Windows\System\ZNnqgiA.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\XXtyOFW.exe
  C:\Windows\System\XXtyOFW.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\giVLnfl.exe
  C:\Windows\System\giVLnfl.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\PuyQDNs.exe
  C:\Windows\System\PuyQDNs.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\WZyOVBF.exe
  C:\Windows\System\WZyOVBF.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\rUIrXXd.exe
  C:\Windows\System\rUIrXXd.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\IvwIGtd.exe
  C:\Windows\System\IvwIGtd.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\ncbrNjz.exe
  C:\Windows\System\ncbrNjz.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bEASMjX.exe
  C:\Windows\System\bEASMjX.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\rSDHoWj.exe
  C:\Windows\System\rSDHoWj.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\RJAagVT.exe
  C:\Windows\System\RJAagVT.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\ucREqQB.exe
  C:\Windows\System\ucREqQB.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\mljEstn.exe
  C:\Windows\System\mljEstn.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\sowtCAv.exe
  C:\Windows\System\sowtCAv.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\oAmQOfW.exe
  C:\Windows\System\oAmQOfW.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\VCeYFZQ.exe
  C:\Windows\System\VCeYFZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\hrpFqtw.exe
  C:\Windows\System\hrpFqtw.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\KzYExNG.exe
  C:\Windows\System\KzYExNG.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\jDOBHzq.exe
  C:\Windows\System\jDOBHzq.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\iCsMGOq.exe
  C:\Windows\System\iCsMGOq.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\mneJAHv.exe
  C:\Windows\System\mneJAHv.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\phYJtWr.exe
  C:\Windows\System\phYJtWr.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\uAUxbSS.exe
  C:\Windows\System\uAUxbSS.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\yZBnnBo.exe
  C:\Windows\System\yZBnnBo.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\cnvwZaI.exe
  C:\Windows\System\cnvwZaI.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\khbKunv.exe
  C:\Windows\System\khbKunv.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\nwwSiFm.exe
  C:\Windows\System\nwwSiFm.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\hlHCSTO.exe
  C:\Windows\System\hlHCSTO.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\SkKAftd.exe
  C:\Windows\System\SkKAftd.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\HuhpJQZ.exe
  C:\Windows\System\HuhpJQZ.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\QIZkUgk.exe
  C:\Windows\System\QIZkUgk.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\eBUZLOY.exe
  C:\Windows\System\eBUZLOY.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\rRWHeMp.exe
  C:\Windows\System\rRWHeMp.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\ZDCusjs.exe
  C:\Windows\System\ZDCusjs.exe
  2⤵
  PID:1844
- C:\Windows\System\GHsGfIZ.exe
  C:\Windows\System\GHsGfIZ.exe
  2⤵
  PID:2864
- C:\Windows\System\UubRjiR.exe
  C:\Windows\System\UubRjiR.exe
  2⤵
  PID:4924
- C:\Windows\System\NzUzRUo.exe
  C:\Windows\System\NzUzRUo.exe
  2⤵
  PID:1676
- C:\Windows\System\UVTqWHu.exe
  C:\Windows\System\UVTqWHu.exe
  2⤵
  PID:1428
- C:\Windows\System\eJWTtXL.exe
  C:\Windows\System\eJWTtXL.exe
  2⤵
  PID:3744
- C:\Windows\System\cIYMCvK.exe
  C:\Windows\System\cIYMCvK.exe
  2⤵
  PID:4968
- C:\Windows\System\ucppoWJ.exe
  C:\Windows\System\ucppoWJ.exe
  2⤵
  PID:1884
- C:\Windows\System\nMEHZuS.exe
  C:\Windows\System\nMEHZuS.exe
  2⤵
  PID:5128
- C:\Windows\System\SxAOGeX.exe
  C:\Windows\System\SxAOGeX.exe
  2⤵
  PID:5372
- C:\Windows\System\nZLfZDK.exe
  C:\Windows\System\nZLfZDK.exe
  2⤵
  PID:5396
- C:\Windows\System\ykYiRSm.exe
  C:\Windows\System\ykYiRSm.exe
  2⤵
  PID:5536
- C:\Windows\System\IrxOaTz.exe
  C:\Windows\System\IrxOaTz.exe
  2⤵
  PID:5556
- C:\Windows\System\KYNvKfK.exe
  C:\Windows\System\KYNvKfK.exe
  2⤵
  PID:5584
- C:\Windows\System\BFTRRLM.exe
  C:\Windows\System\BFTRRLM.exe
  2⤵
  PID:5616
- C:\Windows\System\ixvXycn.exe
  C:\Windows\System\ixvXycn.exe
  2⤵
  PID:5636
- C:\Windows\System\QooufYx.exe
  C:\Windows\System\QooufYx.exe
  2⤵
  PID:5652
- C:\Windows\System\glufHvi.exe
  C:\Windows\System\glufHvi.exe
  2⤵
  PID:5672
- C:\Windows\System\QcLKPLs.exe
  C:\Windows\System\QcLKPLs.exe
  2⤵
  PID:5696
- C:\Windows\System\ygXGVAQ.exe
  C:\Windows\System\ygXGVAQ.exe
  2⤵
  PID:5724
- C:\Windows\System\bnlYZth.exe
  C:\Windows\System\bnlYZth.exe
  2⤵
  PID:5744
- C:\Windows\System\rAdYaUh.exe
  C:\Windows\System\rAdYaUh.exe
  2⤵
  PID:5772
- C:\Windows\System\FTgTSOr.exe
  C:\Windows\System\FTgTSOr.exe
  2⤵
  PID:5796
- C:\Windows\System\iYBIJdK.exe
  C:\Windows\System\iYBIJdK.exe
  2⤵
  PID:5816
- C:\Windows\System\sTMDIXn.exe
  C:\Windows\System\sTMDIXn.exe
  2⤵
  PID:5840
- C:\Windows\System\QjWkpAP.exe
  C:\Windows\System\QjWkpAP.exe
  2⤵
  PID:5864
- C:\Windows\System\POGgdsn.exe
  C:\Windows\System\POGgdsn.exe
  2⤵
  PID:5892
- C:\Windows\System\yYbjcMP.exe
  C:\Windows\System\yYbjcMP.exe
  2⤵
  PID:5916
- C:\Windows\System\PmwvuPQ.exe
  C:\Windows\System\PmwvuPQ.exe
  2⤵
  PID:5940
- C:\Windows\System\wCtKFxs.exe
  C:\Windows\System\wCtKFxs.exe
  2⤵
  PID:5960
- C:\Windows\System\xBElTEx.exe
  C:\Windows\System\xBElTEx.exe
  2⤵
  PID:5980
- C:\Windows\System\ZojRDLq.exe
  C:\Windows\System\ZojRDLq.exe
  2⤵
  PID:6000
- C:\Windows\System\WTGUbkl.exe
  C:\Windows\System\WTGUbkl.exe
  2⤵
  PID:6028
- C:\Windows\System\AjPiMqy.exe
  C:\Windows\System\AjPiMqy.exe
  2⤵
  PID:6052
- C:\Windows\System\dNYznnC.exe
  C:\Windows\System\dNYznnC.exe
  2⤵
  PID:6072
- C:\Windows\System\UeNWxua.exe
  C:\Windows\System\UeNWxua.exe
  2⤵
  PID:6100
- C:\Windows\System\MVoeVfi.exe
  C:\Windows\System\MVoeVfi.exe
  2⤵
  PID:6124
- C:\Windows\System\bnqpsnB.exe
  C:\Windows\System\bnqpsnB.exe
  2⤵
  PID:2772
- C:\Windows\System\cMLuqoA.exe
  C:\Windows\System\cMLuqoA.exe
  2⤵
  PID:4984
- C:\Windows\System\HBbQvlG.exe
  C:\Windows\System\HBbQvlG.exe
  2⤵
  PID:3396
- C:\Windows\System\JkRzIel.exe
  C:\Windows\System\JkRzIel.exe
  2⤵
  PID:1972
- C:\Windows\System\AsQgJtJ.exe
  C:\Windows\System\AsQgJtJ.exe
  2⤵
  PID:3644
- C:\Windows\System\kwPCnmu.exe
  C:\Windows\System\kwPCnmu.exe
  2⤵
  PID:4492
- C:\Windows\System\hUcFWYw.exe
  C:\Windows\System\hUcFWYw.exe
  2⤵
  PID:1692
- C:\Windows\System\RNaNciO.exe
  C:\Windows\System\RNaNciO.exe
  2⤵
  PID:1080
- C:\Windows\System\xhUdDeP.exe
  C:\Windows\System\xhUdDeP.exe
  2⤵
  PID:5188
- C:\Windows\System\LmmPrNe.exe
  C:\Windows\System\LmmPrNe.exe
  2⤵
  PID:3448
- C:\Windows\System\YnaXkCI.exe
  C:\Windows\System\YnaXkCI.exe
  2⤵
  PID:1224
- C:\Windows\System\WzBdzcq.exe
  C:\Windows\System\WzBdzcq.exe
  2⤵
  PID:324
- C:\Windows\System\TEExegg.exe
  C:\Windows\System\TEExegg.exe
  2⤵
  PID:924
- C:\Windows\System\oHssmME.exe
  C:\Windows\System\oHssmME.exe
  2⤵
  PID:2900
- C:\Windows\System\LrODUWz.exe
  C:\Windows\System\LrODUWz.exe
  2⤵
  PID:1776
- C:\Windows\System\mdTRvqh.exe
  C:\Windows\System\mdTRvqh.exe
  2⤵
  PID:4988
- C:\Windows\System\eNHizfy.exe
  C:\Windows\System\eNHizfy.exe
  2⤵
  PID:5328
- C:\Windows\System\QbmuDij.exe
  C:\Windows\System\QbmuDij.exe
  2⤵
  PID:5388
- C:\Windows\System\FwbkKaE.exe
  C:\Windows\System\FwbkKaE.exe
  2⤵
  PID:4840
- C:\Windows\System\UZSyhcW.exe
  C:\Windows\System\UZSyhcW.exe
  2⤵
  PID:220
- C:\Windows\System\NMCGDcP.exe
  C:\Windows\System\NMCGDcP.exe
  2⤵
  PID:4856
- C:\Windows\System\KKufGgB.exe
  C:\Windows\System\KKufGgB.exe
  2⤵
  PID:552
- C:\Windows\System\miQdHgw.exe
  C:\Windows\System\miQdHgw.exe
  2⤵
  PID:2336
- C:\Windows\System\KPJQFJl.exe
  C:\Windows\System\KPJQFJl.exe
  2⤵
  PID:2348
- C:\Windows\System\XPgKmIf.exe
  C:\Windows\System\XPgKmIf.exe
  2⤵
  PID:3336
- C:\Windows\System\BmvonGb.exe
  C:\Windows\System\BmvonGb.exe
  2⤵
  PID:1308
- C:\Windows\System\OMvzdGl.exe
  C:\Windows\System\OMvzdGl.exe
  2⤵
  PID:3468
- C:\Windows\System\rXtZyzm.exe
  C:\Windows\System\rXtZyzm.exe
  2⤵
  PID:404
- C:\Windows\System\WahbKxe.exe
  C:\Windows\System\WahbKxe.exe
  2⤵
  PID:392
- C:\Windows\System\CHYjAWv.exe
  C:\Windows\System\CHYjAWv.exe
  2⤵
  PID:1476
- C:\Windows\System\bVJkKjo.exe
  C:\Windows\System\bVJkKjo.exe
  2⤵
  PID:1404
- C:\Windows\System\PabxwTR.exe
  C:\Windows\System\PabxwTR.exe
  2⤵
  PID:3500
- C:\Windows\System\EZWVrTy.exe
  C:\Windows\System\EZWVrTy.exe
  2⤵
  PID:5316
- C:\Windows\System\WSlmGXc.exe
  C:\Windows\System\WSlmGXc.exe
  2⤵
  PID:5468
- C:\Windows\System\qCTSBft.exe
  C:\Windows\System\qCTSBft.exe
  2⤵
  PID:5576
- C:\Windows\System\EkKKAiJ.exe
  C:\Windows\System\EkKKAiJ.exe
  2⤵
  PID:5628
- C:\Windows\System\wnasTeM.exe
  C:\Windows\System\wnasTeM.exe
  2⤵
  PID:5708
- C:\Windows\System\xxGYedq.exe
  C:\Windows\System\xxGYedq.exe
  2⤵
  PID:5668
- C:\Windows\System\vSpGSkF.exe
  C:\Windows\System\vSpGSkF.exe
  2⤵
  PID:5736
- C:\Windows\System\CqvFege.exe
  C:\Windows\System\CqvFege.exe
  2⤵
  PID:5860
- C:\Windows\System\BXbohFx.exe
  C:\Windows\System\BXbohFx.exe
  2⤵
  PID:5784
- C:\Windows\System\GxxxMkS.exe
  C:\Windows\System\GxxxMkS.exe
  2⤵
  PID:5956
- C:\Windows\System\vJyBYtC.exe
  C:\Windows\System\vJyBYtC.exe
  2⤵
  PID:5996
- C:\Windows\System\PVERFYA.exe
  C:\Windows\System\PVERFYA.exe
  2⤵
  PID:6068
- C:\Windows\System\ZUQWkHM.exe
  C:\Windows\System\ZUQWkHM.exe
  2⤵
  PID:6020
- C:\Windows\System\aDnccMm.exe
  C:\Windows\System\aDnccMm.exe
  2⤵
  PID:2896
- C:\Windows\System\vVmFelv.exe
  C:\Windows\System\vVmFelv.exe
  2⤵
  PID:6092
- C:\Windows\System\XXFgXaR.exe
  C:\Windows\System\XXFgXaR.exe
  2⤵
  PID:4700
- C:\Windows\System\qJZNiUJ.exe
  C:\Windows\System\qJZNiUJ.exe
  2⤵
  PID:5280
- C:\Windows\System\RkGaNmQ.exe
  C:\Windows\System\RkGaNmQ.exe
  2⤵
  PID:3632
- C:\Windows\System\MiMmooX.exe
  C:\Windows\System\MiMmooX.exe
  2⤵
  PID:4404
- C:\Windows\System\yivCpDI.exe
  C:\Windows\System\yivCpDI.exe
  2⤵
  PID:2096
- C:\Windows\System\MjtYZAW.exe
  C:\Windows\System\MjtYZAW.exe
  2⤵
  PID:5076
- C:\Windows\System\ruXZkKN.exe
  C:\Windows\System\ruXZkKN.exe
  2⤵
  PID:544
- C:\Windows\System\AcZcDAT.exe
  C:\Windows\System\AcZcDAT.exe
  2⤵
  PID:2308
- C:\Windows\System\CobLnyp.exe
  C:\Windows\System\CobLnyp.exe
  2⤵
  PID:4356
- C:\Windows\System\EkVEjMV.exe
  C:\Windows\System\EkVEjMV.exe
  2⤵
  PID:2496
- C:\Windows\System\wPCkImY.exe
  C:\Windows\System\wPCkImY.exe
  2⤵
  PID:2988
- C:\Windows\System\jWeVqVg.exe
  C:\Windows\System\jWeVqVg.exe
  2⤵
  PID:5428
- C:\Windows\System\dXTlJSK.exe
  C:\Windows\System\dXTlJSK.exe
  2⤵
  PID:5712
- C:\Windows\System\VXrRBqH.exe
  C:\Windows\System\VXrRBqH.exe
  2⤵
  PID:5848
- C:\Windows\System\ILMvydB.exe
  C:\Windows\System\ILMvydB.exe
  2⤵
  PID:6120
- C:\Windows\System\CcQRcnR.exe
  C:\Windows\System\CcQRcnR.exe
  2⤵
  PID:4016
- C:\Windows\System\ThxlLHg.exe
  C:\Windows\System\ThxlLHg.exe
  2⤵
  PID:5204
- C:\Windows\System\FEZoHpn.exe
  C:\Windows\System\FEZoHpn.exe
  2⤵
  PID:2004
- C:\Windows\System\UsEnhnc.exe
  C:\Windows\System\UsEnhnc.exe
  2⤵
  PID:5972
- C:\Windows\System\AtpiOgq.exe
  C:\Windows\System\AtpiOgq.exe
  2⤵
  PID:6156
- C:\Windows\System\PGDouFN.exe
  C:\Windows\System\PGDouFN.exe
  2⤵
  PID:6180
- C:\Windows\System\hmwdmiY.exe
  C:\Windows\System\hmwdmiY.exe
  2⤵
  PID:6204
- C:\Windows\System\FzscsxA.exe
  C:\Windows\System\FzscsxA.exe
  2⤵
  PID:6228
- C:\Windows\System\gApNJqo.exe
  C:\Windows\System\gApNJqo.exe
  2⤵
  PID:6252
- C:\Windows\System\wxgdJKe.exe
  C:\Windows\System\wxgdJKe.exe
  2⤵
  PID:6280
- C:\Windows\System\OzGZZsw.exe
  C:\Windows\System\OzGZZsw.exe
  2⤵
  PID:6300
- C:\Windows\System\oXeQwQr.exe
  C:\Windows\System\oXeQwQr.exe
  2⤵
  PID:6320
- C:\Windows\System\EyfiizB.exe
  C:\Windows\System\EyfiizB.exe
  2⤵
  PID:6348
- C:\Windows\System\WZvVeNY.exe
  C:\Windows\System\WZvVeNY.exe
  2⤵
  PID:6372
- C:\Windows\System\SQBOday.exe
  C:\Windows\System\SQBOday.exe
  2⤵
  PID:6396
- C:\Windows\System\zzPHtLy.exe
  C:\Windows\System\zzPHtLy.exe
  2⤵
  PID:6416
- C:\Windows\System\EBbzudw.exe
  C:\Windows\System\EBbzudw.exe
  2⤵
  PID:6436
- C:\Windows\System\ewslGwe.exe
  C:\Windows\System\ewslGwe.exe
  2⤵
  PID:6460
- C:\Windows\System\REVpssZ.exe
  C:\Windows\System\REVpssZ.exe
  2⤵
  PID:6484
- C:\Windows\System\qmZoAjd.exe
  C:\Windows\System\qmZoAjd.exe
  2⤵
  PID:6504
- C:\Windows\System\DYdcTsq.exe
  C:\Windows\System\DYdcTsq.exe
  2⤵
  PID:6532
- C:\Windows\System\gaGABAM.exe
  C:\Windows\System\gaGABAM.exe
  2⤵
  PID:6552
- C:\Windows\System\fzHjyUI.exe
  C:\Windows\System\fzHjyUI.exe
  2⤵
  PID:6576
- C:\Windows\System\lOBgdCN.exe
  C:\Windows\System\lOBgdCN.exe
  2⤵
  PID:6596
- C:\Windows\System\HcmpFHK.exe
  C:\Windows\System\HcmpFHK.exe
  2⤵
  PID:6620
- C:\Windows\System\CvHaBGK.exe
  C:\Windows\System\CvHaBGK.exe
  2⤵
  PID:6644
- C:\Windows\System\VcIPjCl.exe
  C:\Windows\System\VcIPjCl.exe
  2⤵
  PID:6664
- C:\Windows\System\XAkMxZg.exe
  C:\Windows\System\XAkMxZg.exe
  2⤵
  PID:6692
- C:\Windows\System\LWDSshe.exe
  C:\Windows\System\LWDSshe.exe
  2⤵
  PID:6716
- C:\Windows\System\yDpaNHW.exe
  C:\Windows\System\yDpaNHW.exe
  2⤵
  PID:6740
- C:\Windows\System\wUVXlMo.exe
  C:\Windows\System\wUVXlMo.exe
  2⤵
  PID:6760
- C:\Windows\System\CusQRPD.exe
  C:\Windows\System\CusQRPD.exe
  2⤵
  PID:6788
- C:\Windows\System\NHGEBKi.exe
  C:\Windows\System\NHGEBKi.exe
  2⤵
  PID:6816
- C:\Windows\System\hOqUNbd.exe
  C:\Windows\System\hOqUNbd.exe
  2⤵
  PID:6912
- C:\Windows\System\KbzScdQ.exe
  C:\Windows\System\KbzScdQ.exe
  2⤵
  PID:6944
- C:\Windows\System\sJuKgmS.exe
  C:\Windows\System\sJuKgmS.exe
  2⤵
  PID:6964
- C:\Windows\System\EYEqOUl.exe
  C:\Windows\System\EYEqOUl.exe
  2⤵
  PID:6984
- C:\Windows\System\bSMaNdG.exe
  C:\Windows\System\bSMaNdG.exe
  2⤵
  PID:7008
- C:\Windows\System\vJKJwwN.exe
  C:\Windows\System\vJKJwwN.exe
  2⤵
  PID:7028
- C:\Windows\System\kXkTuFS.exe
  C:\Windows\System\kXkTuFS.exe
  2⤵
  PID:7052
- C:\Windows\System\HJfdgeC.exe
  C:\Windows\System\HJfdgeC.exe
  2⤵
  PID:7080
- C:\Windows\System\iEcHqya.exe
  C:\Windows\System\iEcHqya.exe
  2⤵
  PID:7100
- C:\Windows\System\zEmDyOD.exe
  C:\Windows\System\zEmDyOD.exe
  2⤵
  PID:7120
- C:\Windows\System\DTTDuxO.exe
  C:\Windows\System\DTTDuxO.exe
  2⤵
  PID:7148
- C:\Windows\System\GvEImLl.exe
  C:\Windows\System\GvEImLl.exe
  2⤵
  PID:5312
- C:\Windows\System\vXkRKHN.exe
  C:\Windows\System\vXkRKHN.exe
  2⤵
  PID:3004
- C:\Windows\System\pmMBBcT.exe
  C:\Windows\System\pmMBBcT.exe
  2⤵
  PID:5884
- C:\Windows\System\OUNKllA.exe
  C:\Windows\System\OUNKllA.exe
  2⤵
  PID:6048
- C:\Windows\System\LzGGApc.exe
  C:\Windows\System\LzGGApc.exe
  2⤵
  PID:5912
- C:\Windows\System\FNwEmMF.exe
  C:\Windows\System\FNwEmMF.exe
  2⤵
  PID:5924
- C:\Windows\System\dwftYej.exe
  C:\Windows\System\dwftYej.exe
  2⤵
  PID:6272
- C:\Windows\System\hpseRCC.exe
  C:\Windows\System\hpseRCC.exe
  2⤵
  PID:6356
- C:\Windows\System\HoOAasw.exe
  C:\Windows\System\HoOAasw.exe
  2⤵
  PID:3088
- C:\Windows\System\UhOLUTn.exe
  C:\Windows\System\UhOLUTn.exe
  2⤵
  PID:5368
- C:\Windows\System\iVQFEJh.exe
  C:\Windows\System\iVQFEJh.exe
  2⤵
  PID:2948
- C:\Windows\System\QOzWIEL.exe
  C:\Windows\System\QOzWIEL.exe
  2⤵
  PID:868
- C:\Windows\System\iFQTXSd.exe
  C:\Windows\System\iFQTXSd.exe
  2⤵
  PID:6196
- C:\Windows\System\TqIYJem.exe
  C:\Windows\System\TqIYJem.exe
  2⤵
  PID:6628
- C:\Windows\System\kPRTyWk.exe
  C:\Windows\System\kPRTyWk.exe
  2⤵
  PID:1516
- C:\Windows\System\GBcCKWp.exe
  C:\Windows\System\GBcCKWp.exe
  2⤵
  PID:6832
- C:\Windows\System\ajfktgY.exe
  C:\Windows\System\ajfktgY.exe
  2⤵
  PID:6804
- C:\Windows\System\bwKXpum.exe
  C:\Windows\System\bwKXpum.exe
  2⤵
  PID:6780
- C:\Windows\System\vjyPKbd.exe
  C:\Windows\System\vjyPKbd.exe
  2⤵
  PID:6524
- C:\Windows\System\lgnrhZI.exe
  C:\Windows\System\lgnrhZI.exe
  2⤵
  PID:7140
- C:\Windows\System\ULIxzrH.exe
  C:\Windows\System\ULIxzrH.exe
  2⤵
  PID:5624
- C:\Windows\System\PsOEMEG.exe
  C:\Windows\System\PsOEMEG.exe
  2⤵
  PID:6924
- C:\Windows\System\XGoCgBk.exe
  C:\Windows\System\XGoCgBk.exe
  2⤵
  PID:5740
- C:\Windows\System\jmGGKqG.exe
  C:\Windows\System\jmGGKqG.exe
  2⤵
  PID:6564
- C:\Windows\System\voZRgov.exe
  C:\Windows\System\voZRgov.exe
  2⤵
  PID:3996
- C:\Windows\System\wyagFck.exe
  C:\Windows\System\wyagFck.exe
  2⤵
  PID:6992
- C:\Windows\System\bvWXjoT.exe
  C:\Windows\System\bvWXjoT.exe
  2⤵
  PID:7088
- C:\Windows\System\DCraMJO.exe
  C:\Windows\System\DCraMJO.exe
  2⤵
  PID:7092
- C:\Windows\System\ClHeuTa.exe
  C:\Windows\System\ClHeuTa.exe
  2⤵
  PID:3924
- C:\Windows\System\UhsaDrW.exe
  C:\Windows\System\UhsaDrW.exe
  2⤵
  PID:7176
- C:\Windows\System\yfdvoVy.exe
  C:\Windows\System\yfdvoVy.exe
  2⤵
  PID:7200
- C:\Windows\System\dNOSiWr.exe
  C:\Windows\System\dNOSiWr.exe
  2⤵
  PID:7232
- C:\Windows\System\mcWkkaG.exe
  C:\Windows\System\mcWkkaG.exe
  2⤵
  PID:7248
- C:\Windows\System\dYFfUOk.exe
  C:\Windows\System\dYFfUOk.exe
  2⤵
  PID:7272
- C:\Windows\System\eYNzgFi.exe
  C:\Windows\System\eYNzgFi.exe
  2⤵
  PID:7296
- C:\Windows\System\LiYnUnN.exe
  C:\Windows\System\LiYnUnN.exe
  2⤵
  PID:7320
- C:\Windows\System\UjlRVGF.exe
  C:\Windows\System\UjlRVGF.exe
  2⤵
  PID:7352
- C:\Windows\System\umopoyx.exe
  C:\Windows\System\umopoyx.exe
  2⤵
  PID:7380
- C:\Windows\System\kvJmyEP.exe
  C:\Windows\System\kvJmyEP.exe
  2⤵
  PID:7396
- C:\Windows\System\kCwIfuZ.exe
  C:\Windows\System\kCwIfuZ.exe
  2⤵
  PID:7416
- C:\Windows\System\zqWRnKv.exe
  C:\Windows\System\zqWRnKv.exe
  2⤵
  PID:7432
- C:\Windows\System\jsuUzMF.exe
  C:\Windows\System\jsuUzMF.exe
  2⤵
  PID:7452
- C:\Windows\System\kJvPCOe.exe
  C:\Windows\System\kJvPCOe.exe
  2⤵
  PID:7484
- C:\Windows\System\ltedcdW.exe
  C:\Windows\System\ltedcdW.exe
  2⤵
  PID:7504
- C:\Windows\System\HTCogxi.exe
  C:\Windows\System\HTCogxi.exe
  2⤵
  PID:7540
- C:\Windows\System\zmHUAWX.exe
  C:\Windows\System\zmHUAWX.exe
  2⤵
  PID:7564
- C:\Windows\System\vKEdpsG.exe
  C:\Windows\System\vKEdpsG.exe
  2⤵
  PID:7592
- C:\Windows\System\FnwCIvJ.exe
  C:\Windows\System\FnwCIvJ.exe
  2⤵
  PID:7612
- C:\Windows\System\xTeSypA.exe
  C:\Windows\System\xTeSypA.exe
  2⤵
  PID:7640
- C:\Windows\System\QZZuptK.exe
  C:\Windows\System\QZZuptK.exe
  2⤵
  PID:7668
- C:\Windows\System\DRHwUbv.exe
  C:\Windows\System\DRHwUbv.exe
  2⤵
  PID:7692
- C:\Windows\System\UtCGOhy.exe
  C:\Windows\System\UtCGOhy.exe
  2⤵
  PID:7716
- C:\Windows\System\SDcBibD.exe
  C:\Windows\System\SDcBibD.exe
  2⤵
  PID:7732
- C:\Windows\System\YBQDmxO.exe
  C:\Windows\System\YBQDmxO.exe
  2⤵
  PID:7760
- C:\Windows\System\YutopbY.exe
  C:\Windows\System\YutopbY.exe
  2⤵
  PID:7784
- C:\Windows\System\qaowPMq.exe
  C:\Windows\System\qaowPMq.exe
  2⤵
  PID:7808
- C:\Windows\System\cNwWiny.exe
  C:\Windows\System\cNwWiny.exe
  2⤵
  PID:7828
- C:\Windows\System\XMENzPn.exe
  C:\Windows\System\XMENzPn.exe
  2⤵
  PID:7848
- C:\Windows\System\MCObcWn.exe
  C:\Windows\System\MCObcWn.exe
  2⤵
  PID:7876
- C:\Windows\System\RFJhWNG.exe
  C:\Windows\System\RFJhWNG.exe
  2⤵
  PID:7892
- C:\Windows\System\fUpaPGx.exe
  C:\Windows\System\fUpaPGx.exe
  2⤵
  PID:7916
- C:\Windows\System\PlLGVJC.exe
  C:\Windows\System\PlLGVJC.exe
  2⤵
  PID:7940
- C:\Windows\System\FeJwMnf.exe
  C:\Windows\System\FeJwMnf.exe
  2⤵
  PID:7964
- C:\Windows\System\QtKbZpx.exe
  C:\Windows\System\QtKbZpx.exe
  2⤵
  PID:7992
- C:\Windows\System\LZYvIPR.exe
  C:\Windows\System\LZYvIPR.exe
  2⤵
  PID:8016
- C:\Windows\System\OmwsANd.exe
  C:\Windows\System\OmwsANd.exe
  2⤵
  PID:8040
- C:\Windows\System\uePQNab.exe
  C:\Windows\System\uePQNab.exe
  2⤵
  PID:8064
- C:\Windows\System\LRGsOPn.exe
  C:\Windows\System\LRGsOPn.exe
  2⤵
  PID:8084
- C:\Windows\System\PmWZkoE.exe
  C:\Windows\System\PmWZkoE.exe
  2⤵
  PID:8108
- C:\Windows\System\NfBMbXy.exe
  C:\Windows\System\NfBMbXy.exe
  2⤵
  PID:8128
- C:\Windows\System\YIQDjUA.exe
  C:\Windows\System\YIQDjUA.exe
  2⤵
  PID:8156
- C:\Windows\System\srztfBc.exe
  C:\Windows\System\srztfBc.exe
  2⤵
  PID:8180
- C:\Windows\System\YQOjZJz.exe
  C:\Windows\System\YQOjZJz.exe
  2⤵
  PID:6148
- C:\Windows\System\ZObrpWZ.exe
  C:\Windows\System\ZObrpWZ.exe
  2⤵
  PID:6236
- C:\Windows\System\JiVCXjN.exe
  C:\Windows\System\JiVCXjN.exe
  2⤵
  PID:6548
- C:\Windows\System\MNqjzom.exe
  C:\Windows\System\MNqjzom.exe
  2⤵
  PID:7024
- C:\Windows\System\oTDUSzL.exe
  C:\Windows\System\oTDUSzL.exe
  2⤵
  PID:7192
- C:\Windows\System\aPMQiEr.exe
  C:\Windows\System\aPMQiEr.exe
  2⤵
  PID:432
- C:\Windows\System\wLplnba.exe
  C:\Windows\System\wLplnba.exe
  2⤵
  PID:7368
- C:\Windows\System\DRTdjyY.exe
  C:\Windows\System\DRTdjyY.exe
  2⤵
  PID:7428
- C:\Windows\System\vMzMrtk.exe
  C:\Windows\System\vMzMrtk.exe
  2⤵
  PID:6412
- C:\Windows\System\NLMDqKp.exe
  C:\Windows\System\NLMDqKp.exe
  2⤵
  PID:1832
- C:\Windows\System\vNninpw.exe
  C:\Windows\System\vNninpw.exe
  2⤵
  PID:6468
- C:\Windows\System\ocZjcyt.exe
  C:\Windows\System\ocZjcyt.exe
  2⤵
  PID:7500
- C:\Windows\System\pgEMtiX.exe
  C:\Windows\System\pgEMtiX.exe
  2⤵
  PID:6940
- C:\Windows\System\dfhvIrp.exe
  C:\Windows\System\dfhvIrp.exe
  2⤵
  PID:7576
- C:\Windows\System\EhABTIL.exe
  C:\Windows\System\EhABTIL.exe
  2⤵
  PID:7628
- C:\Windows\System\LxUMMMj.exe
  C:\Windows\System\LxUMMMj.exe
  2⤵
  PID:7708
- C:\Windows\System\fikrWiI.exe
  C:\Windows\System\fikrWiI.exe
  2⤵
  PID:7800
- C:\Windows\System\ybeqCWe.exe
  C:\Windows\System\ybeqCWe.exe
  2⤵
  PID:7884
- C:\Windows\System\vAqRHXv.exe
  C:\Windows\System\vAqRHXv.exe
  2⤵
  PID:8000
- C:\Windows\System\TfhoIeN.exe
  C:\Windows\System\TfhoIeN.exe
  2⤵
  PID:8116
- C:\Windows\System\bTeqQPD.exe
  C:\Windows\System\bTeqQPD.exe
  2⤵
  PID:4328
- C:\Windows\System\Wnaecdr.exe
  C:\Windows\System\Wnaecdr.exe
  2⤵
  PID:8212
- C:\Windows\System\VDRfBtU.exe
  C:\Windows\System\VDRfBtU.exe
  2⤵
  PID:8236
- C:\Windows\System\VAfjSMx.exe
  C:\Windows\System\VAfjSMx.exe
  2⤵
  PID:8260
- C:\Windows\System\hKfXtmE.exe
  C:\Windows\System\hKfXtmE.exe
  2⤵
  PID:8280
- C:\Windows\System\QYMWTdj.exe
  C:\Windows\System\QYMWTdj.exe
  2⤵
  PID:8304
- C:\Windows\System\sKPkiOG.exe
  C:\Windows\System\sKPkiOG.exe
  2⤵
  PID:8324
- C:\Windows\System\RotnaEk.exe
  C:\Windows\System\RotnaEk.exe
  2⤵
  PID:8352
- C:\Windows\System\IDAyafM.exe
  C:\Windows\System\IDAyafM.exe
  2⤵
  PID:8372
- C:\Windows\System\xvTCxSQ.exe
  C:\Windows\System\xvTCxSQ.exe
  2⤵
  PID:8400
- C:\Windows\System\ebNFKDb.exe
  C:\Windows\System\ebNFKDb.exe
  2⤵
  PID:8420
- C:\Windows\System\lTrukZg.exe
  C:\Windows\System\lTrukZg.exe
  2⤵
  PID:8448
- C:\Windows\System\JIutXaW.exe
  C:\Windows\System\JIutXaW.exe
  2⤵
  PID:8472
- C:\Windows\System\azurGyM.exe
  C:\Windows\System\azurGyM.exe
  2⤵
  PID:8496
- C:\Windows\System\OKZoZcg.exe
  C:\Windows\System\OKZoZcg.exe
  2⤵
  PID:8516
- C:\Windows\System\rIKzTGL.exe
  C:\Windows\System\rIKzTGL.exe
  2⤵
  PID:8536
- C:\Windows\System\mApcFCE.exe
  C:\Windows\System\mApcFCE.exe
  2⤵
  PID:8564
- C:\Windows\System\DVDHLau.exe
  C:\Windows\System\DVDHLau.exe
  2⤵
  PID:8588
- C:\Windows\System\kUJesdp.exe
  C:\Windows\System\kUJesdp.exe
  2⤵
  PID:8612
- C:\Windows\System\yTyvpcX.exe
  C:\Windows\System\yTyvpcX.exe
  2⤵
  PID:8636
- C:\Windows\System\tzTWoCG.exe
  C:\Windows\System\tzTWoCG.exe
  2⤵
  PID:8660
- C:\Windows\System\OxOPEzb.exe
  C:\Windows\System\OxOPEzb.exe
  2⤵
  PID:8680
- C:\Windows\System\gxceqQO.exe
  C:\Windows\System\gxceqQO.exe
  2⤵
  PID:8700
- C:\Windows\System\IjHEbkv.exe
  C:\Windows\System\IjHEbkv.exe
  2⤵
  PID:8728
- C:\Windows\System\jAvBYAn.exe
  C:\Windows\System\jAvBYAn.exe
  2⤵
  PID:8748
- C:\Windows\System\ZrZHGYY.exe
  C:\Windows\System\ZrZHGYY.exe
  2⤵
  PID:8772
- C:\Windows\System\VNLtZsO.exe
  C:\Windows\System\VNLtZsO.exe
  2⤵
  PID:8792
- C:\Windows\System\PnfFYdE.exe
  C:\Windows\System\PnfFYdE.exe
  2⤵
  PID:8816
- C:\Windows\System\RwePyjw.exe
  C:\Windows\System\RwePyjw.exe
  2⤵
  PID:8840
- C:\Windows\System\agIeLwm.exe
  C:\Windows\System\agIeLwm.exe
  2⤵
  PID:8860
- C:\Windows\System\PerFEuh.exe
  C:\Windows\System\PerFEuh.exe
  2⤵
  PID:8884
- C:\Windows\System\wuMHhDI.exe
  C:\Windows\System\wuMHhDI.exe
  2⤵
  PID:8904
- C:\Windows\System\vxQwYiw.exe
  C:\Windows\System\vxQwYiw.exe
  2⤵
  PID:8928
- C:\Windows\System\NZtcvag.exe
  C:\Windows\System\NZtcvag.exe
  2⤵
  PID:8956
- C:\Windows\System\iZVLkiC.exe
  C:\Windows\System\iZVLkiC.exe
  2⤵
  PID:8980
- C:\Windows\System\kRuxdMT.exe
  C:\Windows\System\kRuxdMT.exe
  2⤵
  PID:9016
- C:\Windows\System\JGXltLh.exe
  C:\Windows\System\JGXltLh.exe
  2⤵
  PID:9040
- C:\Windows\System\pPVJMmX.exe
  C:\Windows\System\pPVJMmX.exe
  2⤵
  PID:9064
- C:\Windows\System\EmcPiRz.exe
  C:\Windows\System\EmcPiRz.exe
  2⤵
  PID:9084
- C:\Windows\System\OQNqejP.exe
  C:\Windows\System\OQNqejP.exe
  2⤵
  PID:9108
- C:\Windows\System\vuzmSni.exe
  C:\Windows\System\vuzmSni.exe
  2⤵
  PID:9128
- C:\Windows\System\GoCZBXQ.exe
  C:\Windows\System\GoCZBXQ.exe
  2⤵
  PID:9148
- C:\Windows\System\WhngEQn.exe
  C:\Windows\System\WhngEQn.exe
  2⤵
  PID:9172
- C:\Windows\System\zrnGCrI.exe
  C:\Windows\System\zrnGCrI.exe
  2⤵
  PID:9196
- C:\Windows\System\XHpFCYF.exe
  C:\Windows\System\XHpFCYF.exe
  2⤵
  PID:9212
- C:\Windows\System\SwEYnAe.exe
  C:\Windows\System\SwEYnAe.exe
  2⤵
  PID:7600
- C:\Windows\System\CfsjqmG.exe
  C:\Windows\System\CfsjqmG.exe
  2⤵
  PID:8172
- C:\Windows\System\JfjYtVl.exe
  C:\Windows\System\JfjYtVl.exe
  2⤵
  PID:7264
- C:\Windows\System\aGzXtgb.exe
  C:\Windows\System\aGzXtgb.exe
  2⤵
  PID:7688
- C:\Windows\System\OHLxSru.exe
  C:\Windows\System\OHLxSru.exe
  2⤵
  PID:7768
- C:\Windows\System\wtDBpsL.exe
  C:\Windows\System\wtDBpsL.exe
  2⤵
  PID:7408
- C:\Windows\System\YuDbAVO.exe
  C:\Windows\System\YuDbAVO.exe
  2⤵
  PID:7856
- C:\Windows\System\yUiUhbM.exe
  C:\Windows\System\yUiUhbM.exe
  2⤵
  PID:7932
- C:\Windows\System\DrAqVyO.exe
  C:\Windows\System\DrAqVyO.exe
  2⤵
  PID:8008
- C:\Windows\System\JjrWftM.exe
  C:\Windows\System\JjrWftM.exe
  2⤵
  PID:8076
- C:\Windows\System\EgdrGUR.exe
  C:\Windows\System\EgdrGUR.exe
  2⤵
  PID:7548
- C:\Windows\System\JNtlUgm.exe
  C:\Windows\System\JNtlUgm.exe
  2⤵
  PID:8188
- C:\Windows\System\BpTWluF.exe
  C:\Windows\System\BpTWluF.exe
  2⤵
  PID:8348
- C:\Windows\System\tatPznp.exe
  C:\Windows\System\tatPznp.exe
  2⤵
  PID:6728
- C:\Windows\System\msfbEpv.exe
  C:\Windows\System\msfbEpv.exe
  2⤵
  PID:7700
- C:\Windows\System\pTeGgYe.exe
  C:\Windows\System\pTeGgYe.exe
  2⤵
  PID:7212
- C:\Windows\System\epGWxyu.exe
  C:\Windows\System\epGWxyu.exe
  2⤵
  PID:7392
- C:\Windows\System\grNvbXE.exe
  C:\Windows\System\grNvbXE.exe
  2⤵
  PID:8576
- C:\Windows\System\kYaSvsl.exe
  C:\Windows\System\kYaSvsl.exe
  2⤵
  PID:8628
- C:\Windows\System\FGdcgmH.exe
  C:\Windows\System\FGdcgmH.exe
  2⤵
  PID:8652
- C:\Windows\System\dhATQQc.exe
  C:\Windows\System\dhATQQc.exe
  2⤵
  PID:8692
- C:\Windows\System\cBVmgAc.exe
  C:\Windows\System\cBVmgAc.exe
  2⤵
  PID:7460
- C:\Windows\System\ZsdmPEi.exe
  C:\Windows\System\ZsdmPEi.exe
  2⤵
  PID:8148
- C:\Windows\System\qafWyWH.exe
  C:\Windows\System\qafWyWH.exe
  2⤵
  PID:8868
- C:\Windows\System\zZEgDch.exe
  C:\Windows\System\zZEgDch.exe
  2⤵
  PID:8896
- C:\Windows\System\zQABEDS.exe
  C:\Windows\System\zQABEDS.exe
  2⤵
  PID:9220
- C:\Windows\System\xRfbxaw.exe
  C:\Windows\System\xRfbxaw.exe
  2⤵
  PID:9248
- C:\Windows\System\Ecjokru.exe
  C:\Windows\System\Ecjokru.exe
  2⤵
  PID:9272
- C:\Windows\System\xINuers.exe
  C:\Windows\System\xINuers.exe
  2⤵
  PID:9292
- C:\Windows\System\EtOSEeN.exe
  C:\Windows\System\EtOSEeN.exe
  2⤵
  PID:9324
- C:\Windows\System\iVnSWWd.exe
  C:\Windows\System\iVnSWWd.exe
  2⤵
  PID:9344
- C:\Windows\System\FpwOrzl.exe
  C:\Windows\System\FpwOrzl.exe
  2⤵
  PID:9364
- C:\Windows\System\loILrQK.exe
  C:\Windows\System\loILrQK.exe
  2⤵
  PID:9384
- C:\Windows\System\KyyZoHL.exe
  C:\Windows\System\KyyZoHL.exe
  2⤵
  PID:9408
- C:\Windows\System\XxwUVbx.exe
  C:\Windows\System\XxwUVbx.exe
  2⤵
  PID:9432
- C:\Windows\System\aWKmXyu.exe
  C:\Windows\System\aWKmXyu.exe
  2⤵
  PID:9456
- C:\Windows\System\YOVWxXw.exe
  C:\Windows\System\YOVWxXw.exe
  2⤵
  PID:9476
- C:\Windows\System\KMylJpj.exe
  C:\Windows\System\KMylJpj.exe
  2⤵
  PID:9496
- C:\Windows\System\XVcdEcd.exe
  C:\Windows\System\XVcdEcd.exe
  2⤵
  PID:9524
- C:\Windows\System\CqLaOoR.exe
  C:\Windows\System\CqLaOoR.exe
  2⤵
  PID:9544
- C:\Windows\System\nZQroDg.exe
  C:\Windows\System\nZQroDg.exe
  2⤵
  PID:9568
- C:\Windows\System\fUPPMmO.exe
  C:\Windows\System\fUPPMmO.exe
  2⤵
  PID:9596
- C:\Windows\System\RoSrrhE.exe
  C:\Windows\System\RoSrrhE.exe
  2⤵
  PID:9616
- C:\Windows\System\naOPwnV.exe
  C:\Windows\System\naOPwnV.exe
  2⤵
  PID:9640
- C:\Windows\System\csIurMe.exe
  C:\Windows\System\csIurMe.exe
  2⤵
  PID:9660
- C:\Windows\System\WKqAyoc.exe
  C:\Windows\System\WKqAyoc.exe
  2⤵
  PID:9684
- C:\Windows\System\HNinnaV.exe
  C:\Windows\System\HNinnaV.exe
  2⤵
  PID:9708
- C:\Windows\System\ErPPNoW.exe
  C:\Windows\System\ErPPNoW.exe
  2⤵
  PID:9732
- C:\Windows\System\gcUJwAD.exe
  C:\Windows\System\gcUJwAD.exe
  2⤵
  PID:9756
- C:\Windows\System\jVEvrfs.exe
  C:\Windows\System\jVEvrfs.exe
  2⤵
  PID:9784
- C:\Windows\System\wjyBNme.exe
  C:\Windows\System\wjyBNme.exe
  2⤵
  PID:9808
- C:\Windows\System\WXAFnJp.exe
  C:\Windows\System\WXAFnJp.exe
  2⤵
  PID:9832
- C:\Windows\System\iYqjCTF.exe
  C:\Windows\System\iYqjCTF.exe
  2⤵
  PID:9856
- C:\Windows\System\raucONz.exe
  C:\Windows\System\raucONz.exe
  2⤵
  PID:9876
- C:\Windows\System\EmaxTeP.exe
  C:\Windows\System\EmaxTeP.exe
  2⤵
  PID:9900
- C:\Windows\System\lqsUBEG.exe
  C:\Windows\System\lqsUBEG.exe
  2⤵
  PID:9920
- C:\Windows\System\LYLMNDx.exe
  C:\Windows\System\LYLMNDx.exe
  2⤵
  PID:9944
- C:\Windows\System\gqYiJJw.exe
  C:\Windows\System\gqYiJJw.exe
  2⤵
  PID:9964
- C:\Windows\System\unLcGwT.exe
  C:\Windows\System\unLcGwT.exe
  2⤵
  PID:9988
- C:\Windows\System\isMSlMf.exe
  C:\Windows\System\isMSlMf.exe
  2⤵
  PID:10012
- C:\Windows\System\VAMBSJm.exe
  C:\Windows\System\VAMBSJm.exe
  2⤵
  PID:10036
- C:\Windows\System\UnCCOsR.exe
  C:\Windows\System\UnCCOsR.exe
  2⤵
  PID:10060
- C:\Windows\System\ucAZLxL.exe
  C:\Windows\System\ucAZLxL.exe
  2⤵
  PID:10084
- C:\Windows\System\finsoDl.exe
  C:\Windows\System\finsoDl.exe
  2⤵
  PID:10100
- C:\Windows\System\XjCMntB.exe
  C:\Windows\System\XjCMntB.exe
  2⤵
  PID:10116
- C:\Windows\System\dXKMlyT.exe
  C:\Windows\System\dXKMlyT.exe
  2⤵
  PID:10140
- C:\Windows\System\PviankN.exe
  C:\Windows\System\PviankN.exe
  2⤵
  PID:10164
- C:\Windows\System\fGwZmnt.exe
  C:\Windows\System\fGwZmnt.exe
  2⤵
  PID:10188
- C:\Windows\System\UaMRvfR.exe
  C:\Windows\System\UaMRvfR.exe
  2⤵
  PID:10208
- C:\Windows\System\rTMqVjq.exe
  C:\Windows\System\rTMqVjq.exe
  2⤵
  PID:10236
- C:\Windows\System\VMviUPn.exe
  C:\Windows\System\VMviUPn.exe
  2⤵
  PID:6956
- C:\Windows\System\KavArVN.exe
  C:\Windows\System\KavArVN.exe
  2⤵
  PID:8944
- C:\Windows\System\QboyGAO.exe
  C:\Windows\System\QboyGAO.exe
  2⤵
  PID:8316
- C:\Windows\System\FoydWpQ.exe
  C:\Windows\System\FoydWpQ.exe
  2⤵
  PID:9284
- C:\Windows\System\mrIjIzL.exe
  C:\Windows\System\mrIjIzL.exe
  2⤵
  PID:9444
- C:\Windows\System\eAeAdhY.exe
  C:\Windows\System\eAeAdhY.exe
  2⤵
  PID:6960
- C:\Windows\System\iprKgTV.exe
  C:\Windows\System\iprKgTV.exe
  2⤵
  PID:8572
- C:\Windows\System\uTaLFUa.exe
  C:\Windows\System\uTaLFUa.exe
  2⤵
  PID:8708
- C:\Windows\System\QZjBCty.exe
  C:\Windows\System\QZjBCty.exe
  2⤵
  PID:8428
- C:\Windows\System\Bsiwdcc.exe
  C:\Windows\System\Bsiwdcc.exe
  2⤵
  PID:8460
- C:\Windows\System\XoHYpex.exe
  C:\Windows\System\XoHYpex.exe
  2⤵
  PID:10224
- C:\Windows\System\fyvJaxm.exe
  C:\Windows\System\fyvJaxm.exe
  2⤵
  PID:8808
- C:\Windows\System\rnhVOwd.exe
  C:\Windows\System\rnhVOwd.exe
  2⤵
  PID:10264
- C:\Windows\System\GTtYmll.exe
  C:\Windows\System\GTtYmll.exe
  2⤵
  PID:10292
- C:\Windows\System\rWUEMEj.exe
  C:\Windows\System\rWUEMEj.exe
  2⤵
  PID:10312
- C:\Windows\System\XUfORmL.exe
  C:\Windows\System\XUfORmL.exe
  2⤵
  PID:10344
- C:\Windows\System\ZyocqUB.exe
  C:\Windows\System\ZyocqUB.exe
  2⤵
  PID:10368
- C:\Windows\System\NBaJiBi.exe
  C:\Windows\System\NBaJiBi.exe
  2⤵
  PID:10388
- C:\Windows\System\xDshNCi.exe
  C:\Windows\System\xDshNCi.exe
  2⤵
  PID:10416
- C:\Windows\System\ogDTaOA.exe
  C:\Windows\System\ogDTaOA.exe
  2⤵
  PID:10436
- C:\Windows\System\eWloeBN.exe
  C:\Windows\System\eWloeBN.exe
  2⤵
  PID:10468
- C:\Windows\System\DKaoQWe.exe
  C:\Windows\System\DKaoQWe.exe
  2⤵
  PID:10496
- C:\Windows\System\nTFLDxF.exe
  C:\Windows\System\nTFLDxF.exe
  2⤵
  PID:10516
- C:\Windows\System\xgneXzj.exe
  C:\Windows\System\xgneXzj.exe
  2⤵
  PID:10540
- C:\Windows\System\WsAgSrJ.exe
  C:\Windows\System\WsAgSrJ.exe
  2⤵
  PID:10576
- C:\Windows\System\SOVTCNt.exe
  C:\Windows\System\SOVTCNt.exe
  2⤵
  PID:10600
- C:\Windows\System\fJaGacy.exe
  C:\Windows\System\fJaGacy.exe
  2⤵
  PID:10624
- C:\Windows\System\DhJyGsG.exe
  C:\Windows\System\DhJyGsG.exe
  2⤵
  PID:10660
- C:\Windows\System\AaVSrKP.exe
  C:\Windows\System\AaVSrKP.exe
  2⤵
  PID:10684
- C:\Windows\System\tAPnjFW.exe
  C:\Windows\System\tAPnjFW.exe
  2⤵
  PID:10708
- C:\Windows\System\OHpUjNn.exe
  C:\Windows\System\OHpUjNn.exe
  2⤵
  PID:10736
- C:\Windows\System\GqFWcAP.exe
  C:\Windows\System\GqFWcAP.exe
  2⤵
  PID:10760
- C:\Windows\System\gsqSEcJ.exe
  C:\Windows\System\gsqSEcJ.exe
  2⤵
  PID:10784
- C:\Windows\System\ZwquLfl.exe
  C:\Windows\System\ZwquLfl.exe
  2⤵
  PID:10808
- C:\Windows\System\MaSkFvn.exe
  C:\Windows\System\MaSkFvn.exe
  2⤵
  PID:10828
- C:\Windows\System\DLFIqRu.exe
  C:\Windows\System\DLFIqRu.exe
  2⤵
  PID:10852
- C:\Windows\System\kkwFWGW.exe
  C:\Windows\System\kkwFWGW.exe
  2⤵
  PID:10876
- C:\Windows\System\cWmrCym.exe
  C:\Windows\System\cWmrCym.exe
  2⤵
  PID:10900
- C:\Windows\System\MAtaSaE.exe
  C:\Windows\System\MAtaSaE.exe
  2⤵
  PID:10924
- C:\Windows\System\CsaxFbE.exe
  C:\Windows\System\CsaxFbE.exe
  2⤵
  PID:10940
- C:\Windows\System\wFKcHdZ.exe
  C:\Windows\System\wFKcHdZ.exe
  2⤵
  PID:10956
- C:\Windows\System\dBDUwvd.exe
  C:\Windows\System\dBDUwvd.exe
  2⤵
  PID:10972
- C:\Windows\System\GyBSngk.exe
  C:\Windows\System\GyBSngk.exe
  2⤵
  PID:10992
- C:\Windows\System\gbrFblI.exe
  C:\Windows\System\gbrFblI.exe
  2⤵
  PID:11012
- C:\Windows\System\NCfokCo.exe
  C:\Windows\System\NCfokCo.exe
  2⤵
  PID:11036
- C:\Windows\System\dqAIQrA.exe
  C:\Windows\System\dqAIQrA.exe
  2⤵
  PID:11056
- C:\Windows\System\srVuMKA.exe
  C:\Windows\System\srVuMKA.exe
  2⤵
  PID:11084
- C:\Windows\System\YDjjBvn.exe
  C:\Windows\System\YDjjBvn.exe
  2⤵
  PID:11104
- C:\Windows\System\YITnjfW.exe
  C:\Windows\System\YITnjfW.exe
  2⤵
  PID:11132
- C:\Windows\System\WZxTWTY.exe
  C:\Windows\System\WZxTWTY.exe
  2⤵
  PID:11160
- C:\Windows\System\lzelUqg.exe
  C:\Windows\System\lzelUqg.exe
  2⤵
  PID:11184
- C:\Windows\System\iYruhGp.exe
  C:\Windows\System\iYruhGp.exe
  2⤵
  PID:11220
- C:\Windows\System\BBoGxiY.exe
  C:\Windows\System\BBoGxiY.exe
  2⤵
  PID:11244
- C:\Windows\System\xKGbWBj.exe
  C:\Windows\System\xKGbWBj.exe
  2⤵
  PID:11260
- C:\Windows\System\xfZyOfV.exe
  C:\Windows\System\xfZyOfV.exe
  2⤵
  PID:9028
- C:\Windows\System\FDGenXa.exe
  C:\Windows\System\FDGenXa.exe
  2⤵
  PID:9124
- C:\Windows\System\EBpLGdo.exe
  C:\Windows\System\EBpLGdo.exe
  2⤵
  PID:4248
- C:\Windows\System\FcHHpbF.exe
  C:\Windows\System\FcHHpbF.exe
  2⤵
  PID:9608
- C:\Windows\System\HHoNoZz.exe
  C:\Windows\System\HHoNoZz.exe
  2⤵
  PID:9656
- C:\Windows\System\ZWjVnjV.exe
  C:\Windows\System\ZWjVnjV.exe
  2⤵
  PID:9716
- C:\Windows\System\LwFvJjG.exe
  C:\Windows\System\LwFvJjG.exe
  2⤵
  PID:9776
- C:\Windows\System\jAlAdyq.exe
  C:\Windows\System\jAlAdyq.exe
  2⤵
  PID:9824
- C:\Windows\System\PIsCCvc.exe
  C:\Windows\System\PIsCCvc.exe
  2⤵
  PID:9868
- C:\Windows\System\RDHaLOr.exe
  C:\Windows\System\RDHaLOr.exe
  2⤵
  PID:9916
- C:\Windows\System\WjYshgD.exe
  C:\Windows\System\WjYshgD.exe
  2⤵
  PID:10008
- C:\Windows\System\YgrYwJP.exe
  C:\Windows\System\YgrYwJP.exe
  2⤵
  PID:10072
- C:\Windows\System\FdohtVY.exe
  C:\Windows\System\FdohtVY.exe
  2⤵
  PID:8604
- C:\Windows\System\qogcCXc.exe
  C:\Windows\System\qogcCXc.exe
  2⤵
  PID:8512
- C:\Windows\System\ucFUpvl.exe
  C:\Windows\System\ucFUpvl.exe
  2⤵
  PID:6652
- C:\Windows\System\REEZLqc.exe
  C:\Windows\System\REEZLqc.exe
  2⤵
  PID:8056
- C:\Windows\System\Npyycpq.exe
  C:\Windows\System\Npyycpq.exe
  2⤵
  PID:10308
- C:\Windows\System\aeINJdh.exe
  C:\Windows\System\aeINJdh.exe
  2⤵
  PID:9336
- C:\Windows\System\WjrpNkb.exe
  C:\Windows\System\WjrpNkb.exe
  2⤵
  PID:9400
- C:\Windows\System\WfZDyxQ.exe
  C:\Windows\System\WfZDyxQ.exe
  2⤵
  PID:8552
- C:\Windows\System\rZEUXJb.exe
  C:\Windows\System\rZEUXJb.exe
  2⤵
  PID:10596
- C:\Windows\System\jrgfBzc.exe
  C:\Windows\System\jrgfBzc.exe
  2⤵
  PID:10616
- C:\Windows\System\zaPjNMe.exe
  C:\Windows\System\zaPjNMe.exe
  2⤵
  PID:7840
- C:\Windows\System\ixdClKO.exe
  C:\Windows\System\ixdClKO.exe
  2⤵
  PID:9536
- C:\Windows\System\pWqxwJB.exe
  C:\Windows\System\pWqxwJB.exe
  2⤵
  PID:10720
- C:\Windows\System\uskIvng.exe
  C:\Windows\System\uskIvng.exe
  2⤵
  PID:10744
- C:\Windows\System\UUnXmPE.exe
  C:\Windows\System\UUnXmPE.exe
  2⤵
  PID:11288
- C:\Windows\System\VEUEbUy.exe
  C:\Windows\System\VEUEbUy.exe
  2⤵
  PID:11636
- C:\Windows\System\HmFjxXV.exe
  C:\Windows\System\HmFjxXV.exe
  2⤵
  PID:11652
- C:\Windows\System\WkBwPut.exe
  C:\Windows\System\WkBwPut.exe
  2⤵
  PID:11668
- C:\Windows\System\lxRgkeW.exe
  C:\Windows\System\lxRgkeW.exe
  2⤵
  PID:11684
- C:\Windows\System\exfXawR.exe
  C:\Windows\System\exfXawR.exe
  2⤵
  PID:11700
- C:\Windows\System\SqXPUIa.exe
  C:\Windows\System\SqXPUIa.exe
  2⤵
  PID:11716
- C:\Windows\System\zoBrUAb.exe
  C:\Windows\System\zoBrUAb.exe
  2⤵
  PID:11740
- C:\Windows\System\aApVPnw.exe
  C:\Windows\System\aApVPnw.exe
  2⤵
  PID:11764
- C:\Windows\System\ZBFENUt.exe
  C:\Windows\System\ZBFENUt.exe
  2⤵
  PID:11780
- C:\Windows\System\VMcHWgu.exe
  C:\Windows\System\VMcHWgu.exe
  2⤵
  PID:11808
- C:\Windows\System\OgLLkKH.exe
  C:\Windows\System\OgLLkKH.exe
  2⤵
  PID:11832
- C:\Windows\System\XxNfluG.exe
  C:\Windows\System\XxNfluG.exe
  2⤵
  PID:11856
- C:\Windows\System\PgQVZrc.exe
  C:\Windows\System\PgQVZrc.exe
  2⤵
  PID:11880
- C:\Windows\System\vuUXhtf.exe
  C:\Windows\System\vuUXhtf.exe
  2⤵
  PID:11908
- C:\Windows\System\XYfVxWW.exe
  C:\Windows\System\XYfVxWW.exe
  2⤵
  PID:11932
- C:\Windows\System\sPVxumM.exe
  C:\Windows\System\sPVxumM.exe
  2⤵
  PID:11960
- C:\Windows\System\KeLuUgV.exe
  C:\Windows\System\KeLuUgV.exe
  2⤵
  PID:11984
- C:\Windows\System\NhpkUit.exe
  C:\Windows\System\NhpkUit.exe
  2⤵
  PID:12008
- C:\Windows\System\dISCnlb.exe
  C:\Windows\System\dISCnlb.exe
  2⤵
  PID:12032
- C:\Windows\System\wbhHqNc.exe
  C:\Windows\System\wbhHqNc.exe
  2⤵
  PID:12064
- C:\Windows\System\zGONJoe.exe
  C:\Windows\System\zGONJoe.exe
  2⤵
  PID:12092
- C:\Windows\System\BIFxecb.exe
  C:\Windows\System\BIFxecb.exe
  2⤵
  PID:12120
- C:\Windows\System\KbmIxyS.exe
  C:\Windows\System\KbmIxyS.exe
  2⤵
  PID:12140
- C:\Windows\System\IZvXxgT.exe
  C:\Windows\System\IZvXxgT.exe
  2⤵
  PID:12156
- C:\Windows\System\HiBJzKw.exe
  C:\Windows\System\HiBJzKw.exe
  2⤵
  PID:12180
- C:\Windows\System\shfSAiS.exe
  C:\Windows\System\shfSAiS.exe
  2⤵
  PID:12204
- C:\Windows\System\QYFHNsI.exe
  C:\Windows\System\QYFHNsI.exe
  2⤵
  PID:12232
- C:\Windows\System\hYKHKHv.exe
  C:\Windows\System\hYKHKHv.exe
  2⤵
  PID:12256
- C:\Windows\System\fKRlSQm.exe
  C:\Windows\System\fKRlSQm.exe
  2⤵
  PID:12280
- C:\Windows\System\LYnVxyz.exe
  C:\Windows\System\LYnVxyz.exe
  2⤵
  PID:9792
- C:\Windows\System\MipJWIG.exe
  C:\Windows\System\MipJWIG.exe
  2⤵
  PID:780
- C:\Windows\System\TLMfskD.exe
  C:\Windows\System\TLMfskD.exe
  2⤵
  PID:9952
- C:\Windows\System\pzzrpru.exe
  C:\Windows\System\pzzrpru.exe
  2⤵
  PID:11052
- C:\Windows\System\qLRVZRP.exe
  C:\Windows\System\qLRVZRP.exe
  2⤵
  PID:11192
- C:\Windows\System\xFwlApY.exe
  C:\Windows\System\xFwlApY.exe
  2⤵
  PID:10124
- C:\Windows\System\Qyzhxlu.exe
  C:\Windows\System\Qyzhxlu.exe
  2⤵
  PID:10172
- C:\Windows\System\sKBPtJV.exe
  C:\Windows\System\sKBPtJV.exe
  2⤵
  PID:8760
- C:\Windows\System\EZVTnjs.exe
  C:\Windows\System\EZVTnjs.exe
  2⤵
  PID:10256
- C:\Windows\System\KbitotJ.exe
  C:\Windows\System\KbitotJ.exe
  2⤵
  PID:10284
- C:\Windows\System\ykiSGps.exe
  C:\Windows\System\ykiSGps.exe
  2⤵
  PID:10376
- C:\Windows\System\VlqKVhN.exe
  C:\Windows\System\VlqKVhN.exe
  2⤵
  PID:10512
- C:\Windows\System\rMjRvhv.exe
  C:\Windows\System\rMjRvhv.exe
  2⤵
  PID:10780
- C:\Windows\System\rUyShFM.exe
  C:\Windows\System\rUyShFM.exe
  2⤵
  PID:10888
- C:\Windows\System\ZreRmrv.exe
  C:\Windows\System\ZreRmrv.exe
  2⤵
  PID:10948
- C:\Windows\System\YaHqiYi.exe
  C:\Windows\System\YaHqiYi.exe
  2⤵
  PID:11344
- C:\Windows\System\wyifuyp.exe
  C:\Windows\System\wyifuyp.exe
  2⤵
  PID:11408
- C:\Windows\System\PcmcCrI.exe
  C:\Windows\System\PcmcCrI.exe
  2⤵
  PID:9024
- C:\Windows\System\WAmQwUd.exe
  C:\Windows\System\WAmQwUd.exe
  2⤵
  PID:3900
- C:\Windows\System\TxpAFiO.exe
  C:\Windows\System\TxpAFiO.exe
  2⤵
  PID:8676
- C:\Windows\System\ttNihut.exe
  C:\Windows\System\ttNihut.exe
  2⤵
  PID:11464
- C:\Windows\System\dzMIhZa.exe
  C:\Windows\System\dzMIhZa.exe
  2⤵
  PID:9912
- C:\Windows\System\vVdUaAg.exe
  C:\Windows\System\vVdUaAg.exe
  2⤵
  PID:9316
- C:\Windows\System\dIvoHJL.exe
  C:\Windows\System\dIvoHJL.exe
  2⤵
  PID:10460
- C:\Windows\System\dIcpbwY.exe
  C:\Windows\System\dIcpbwY.exe
  2⤵
  PID:10504
- C:\Windows\System\iljNaJH.exe
  C:\Windows\System\iljNaJH.exe
  2⤵
  PID:11276
- C:\Windows\System\cDknlem.exe
  C:\Windows\System\cDknlem.exe
  2⤵
  PID:9468
- C:\Windows\System\ZGDWbSj.exe
  C:\Windows\System\ZGDWbSj.exe
  2⤵
  PID:10352
- C:\Windows\System\reeKirr.exe
  C:\Windows\System\reeKirr.exe
  2⤵
  PID:10868
- C:\Windows\System\aoDpwjK.exe
  C:\Windows\System\aoDpwjK.exe
  2⤵
  PID:12296
- C:\Windows\System\iYMOfiU.exe
  C:\Windows\System\iYMOfiU.exe
  2⤵
  PID:12320
- C:\Windows\System\fMaSWnN.exe
  C:\Windows\System\fMaSWnN.exe
  2⤵
  PID:12352
- C:\Windows\System\WBruPXB.exe
  C:\Windows\System\WBruPXB.exe
  2⤵
  PID:12372
- C:\Windows\System\gNCtGEw.exe
  C:\Windows\System\gNCtGEw.exe
  2⤵
  PID:12388
- C:\Windows\System\XUqExFA.exe
  C:\Windows\System\XUqExFA.exe
  2⤵
  PID:12408
- C:\Windows\System\bucbygn.exe
  C:\Windows\System\bucbygn.exe
  2⤵
  PID:12424
- C:\Windows\System\ceinHAD.exe
  C:\Windows\System\ceinHAD.exe
  2⤵
  PID:12440
- C:\Windows\System\fnyCgHs.exe
  C:\Windows\System\fnyCgHs.exe
  2⤵
  PID:12460
- C:\Windows\System\moAlJDQ.exe
  C:\Windows\System\moAlJDQ.exe
  2⤵
  PID:12476
- C:\Windows\System\QlQQqaf.exe
  C:\Windows\System\QlQQqaf.exe
  2⤵
  PID:12492
- C:\Windows\System\TMEAksT.exe
  C:\Windows\System\TMEAksT.exe
  2⤵
  PID:12508
- C:\Windows\System\YRYPXvR.exe
  C:\Windows\System\YRYPXvR.exe
  2⤵
  PID:12536
- C:\Windows\System\aafTaeR.exe
  C:\Windows\System\aafTaeR.exe
  2⤵
  PID:12560
- C:\Windows\System\tHHhvkW.exe
  C:\Windows\System\tHHhvkW.exe
  2⤵
  PID:12580
- C:\Windows\System\nYLaYjj.exe
  C:\Windows\System\nYLaYjj.exe
  2⤵
  PID:12600
- C:\Windows\System\PyYdFNj.exe
  C:\Windows\System\PyYdFNj.exe
  2⤵
  PID:12628
- C:\Windows\System\wgnhCnq.exe
  C:\Windows\System\wgnhCnq.exe
  2⤵
  PID:12656
- C:\Windows\System\Jizygdt.exe
  C:\Windows\System\Jizygdt.exe
  2⤵
  PID:12672
- C:\Windows\System\ZtuGKyE.exe
  C:\Windows\System\ZtuGKyE.exe
  2⤵
  PID:12692
- C:\Windows\System\vTzKbfQ.exe
  C:\Windows\System\vTzKbfQ.exe
  2⤵
  PID:12716
- C:\Windows\System\MUBWOcd.exe
  C:\Windows\System\MUBWOcd.exe
  2⤵
  PID:12740
- C:\Windows\System\ojSqBxy.exe
  C:\Windows\System\ojSqBxy.exe
  2⤵
  PID:12768
- C:\Windows\System\BxJKpot.exe
  C:\Windows\System\BxJKpot.exe
  2⤵
  PID:12792
- C:\Windows\System\lVVvvTd.exe
  C:\Windows\System\lVVvvTd.exe
  2⤵
  PID:12816
- C:\Windows\System\amUiIRT.exe
  C:\Windows\System\amUiIRT.exe
  2⤵
  PID:12844
- C:\Windows\System\rjnlydk.exe
  C:\Windows\System\rjnlydk.exe
  2⤵
  PID:12864
- C:\Windows\System\ResFxQz.exe
  C:\Windows\System\ResFxQz.exe
  2⤵
  PID:12888
- C:\Windows\System\yPCBDTo.exe
  C:\Windows\System\yPCBDTo.exe
  2⤵
  PID:12912
- C:\Windows\System\TPAktaQ.exe
  C:\Windows\System\TPAktaQ.exe
  2⤵
  PID:12940
- C:\Windows\System\jiyWdKc.exe
  C:\Windows\System\jiyWdKc.exe
  2⤵
  PID:12964
- C:\Windows\System\uJFPiMY.exe
  C:\Windows\System\uJFPiMY.exe
  2⤵
  PID:12988
- C:\Windows\System\xANFIwZ.exe
  C:\Windows\System\xANFIwZ.exe
  2⤵
  PID:13016
- C:\Windows\System\GqkhwdL.exe
  C:\Windows\System\GqkhwdL.exe
  2⤵
  PID:13032
- C:\Windows\System\dUCpyQD.exe
  C:\Windows\System\dUCpyQD.exe
  2⤵
  PID:13056
- C:\Windows\System\xdHsOXr.exe
  C:\Windows\System\xdHsOXr.exe
  2⤵
  PID:13084
- C:\Windows\System\sRYNUQf.exe
  C:\Windows\System\sRYNUQf.exe
  2⤵
  PID:13108
- C:\Windows\System\afOyTDv.exe
  C:\Windows\System\afOyTDv.exe
  2⤵
  PID:13128
- C:\Windows\System\CxRKdIl.exe
  C:\Windows\System\CxRKdIl.exe
  2⤵
  PID:13148
- C:\Windows\System\QcgyvvQ.exe
  C:\Windows\System\QcgyvvQ.exe
  2⤵
  PID:13176
- C:\Windows\System\SKwNmYe.exe
  C:\Windows\System\SKwNmYe.exe
  2⤵
  PID:13204
- C:\Windows\System\mmZDHRg.exe
  C:\Windows\System\mmZDHRg.exe
  2⤵
  PID:13224
- C:\Windows\System\qXYlNQC.exe
  C:\Windows\System\qXYlNQC.exe
  2⤵
  PID:13248
- C:\Windows\System\bSoAXEs.exe
  C:\Windows\System\bSoAXEs.exe
  2⤵
  PID:13264
- C:\Windows\System\Hwfmsaj.exe
  C:\Windows\System\Hwfmsaj.exe
  2⤵
  PID:13284
- C:\Windows\System\LcNngfT.exe
  C:\Windows\System\LcNngfT.exe
  2⤵
  PID:13308
- C:\Windows\System\GlbNeEf.exe
  C:\Windows\System\GlbNeEf.exe
  2⤵
  PID:11848
- C:\Windows\System\qnKPgfm.exe
  C:\Windows\System\qnKPgfm.exe
  2⤵
  PID:11348
- C:\Windows\System\aRkraJv.exe
  C:\Windows\System\aRkraJv.exe
  2⤵
  PID:11996
- C:\Windows\System\kFdbrJN.exe
  C:\Windows\System\kFdbrJN.exe
  2⤵
  PID:11256
- C:\Windows\System\QiqWkRt.exe
  C:\Windows\System\QiqWkRt.exe
  2⤵
  PID:12196
- C:\Windows\System\LKzcNxZ.exe
  C:\Windows\System\LKzcNxZ.exe
  2⤵
  PID:10756
- C:\Windows\System\VKaFLwb.exe
  C:\Windows\System\VKaFLwb.exe
  2⤵
  PID:11476
- C:\Windows\System\hpEGwTV.exe
  C:\Windows\System\hpEGwTV.exe
  2⤵
  PID:11176
- C:\Windows\System\cKikxYZ.exe
  C:\Windows\System\cKikxYZ.exe
  2⤵
  PID:10272
- C:\Windows\System\RBDpOZh.exe
  C:\Windows\System\RBDpOZh.exe
  2⤵
  PID:10380
- C:\Windows\System\RWqfjtk.exe
  C:\Windows\System\RWqfjtk.exe
  2⤵
  PID:3188
- C:\Windows\System\idwhHTL.exe
  C:\Windows\System\idwhHTL.exe
  2⤵
  PID:9492
- C:\Windows\System\UTThxUJ.exe
  C:\Windows\System\UTThxUJ.exe
  2⤵
  PID:9100
- C:\Windows\System\rCoZGsC.exe
  C:\Windows\System\rCoZGsC.exe
  2⤵
  PID:10408
- C:\Windows\System\eCGXVgs.exe
  C:\Windows\System\eCGXVgs.exe
  2⤵
  PID:5760
- C:\Windows\System\xbinQUd.exe
  C:\Windows\System\xbinQUd.exe
  2⤵
  PID:8360
- C:\Windows\System\GwTRzuU.exe
  C:\Windows\System\GwTRzuU.exe
  2⤵
  PID:11624
- C:\Windows\System\ihtLDJO.exe
  C:\Windows\System\ihtLDJO.exe
  2⤵
  PID:9268
- C:\Windows\System\eIoAqHG.exe
  C:\Windows\System\eIoAqHG.exe
  2⤵
  PID:11208
- C:\Windows\System\BFbllVW.exe
  C:\Windows\System\BFbllVW.exe
  2⤵
  PID:10844
- C:\Windows\System\ffcsdLw.exe
  C:\Windows\System\ffcsdLw.exe
  2⤵
  PID:11096
- C:\Windows\System\orjzODN.exe
  C:\Windows\System\orjzODN.exe
  2⤵
  PID:11660
- C:\Windows\System\OXBEgzT.exe
  C:\Windows\System\OXBEgzT.exe
  2⤵
  PID:11676
- C:\Windows\System\aQbgMWc.exe
  C:\Windows\System\aQbgMWc.exe
  2⤵
  PID:12312
- C:\Windows\System\bnaXaJM.exe
  C:\Windows\System\bnaXaJM.exe
  2⤵
  PID:11816
- C:\Windows\System\BIAGOvD.exe
  C:\Windows\System\BIAGOvD.exe
  2⤵
  PID:13328
- C:\Windows\System\IhVjUpD.exe
  C:\Windows\System\IhVjUpD.exe
  2⤵
  PID:13344
- C:\Windows\System\gVlpxSC.exe
  C:\Windows\System\gVlpxSC.exe
  2⤵
  PID:13364
- C:\Windows\System\Syhqjqz.exe
  C:\Windows\System\Syhqjqz.exe
  2⤵
  PID:13384
- C:\Windows\System\tlkBnuO.exe
  C:\Windows\System\tlkBnuO.exe
  2⤵
  PID:13408
- C:\Windows\System\QvvhjCC.exe
  C:\Windows\System\QvvhjCC.exe
  2⤵
  PID:13428
- C:\Windows\System\dUKgTQl.exe
  C:\Windows\System\dUKgTQl.exe
  2⤵
  PID:13452
- C:\Windows\System\bxUyFxP.exe
  C:\Windows\System\bxUyFxP.exe
  2⤵
  PID:13472
- C:\Windows\System\EVnbzJY.exe
  C:\Windows\System\EVnbzJY.exe
  2⤵
  PID:13496
- C:\Windows\System\RqAeahN.exe
  C:\Windows\System\RqAeahN.exe
  2⤵
  PID:13516
- C:\Windows\System\aOUbfZC.exe
  C:\Windows\System\aOUbfZC.exe
  2⤵
  PID:13536
- C:\Windows\System\PYONVJB.exe
  C:\Windows\System\PYONVJB.exe
  2⤵
  PID:13556
- C:\Windows\System\IHnyDHR.exe
  C:\Windows\System\IHnyDHR.exe
  2⤵
  PID:13576
- C:\Windows\System\rkPVfbc.exe
  C:\Windows\System\rkPVfbc.exe
  2⤵
  PID:13596
- C:\Windows\System\bKGFzpZ.exe
  C:\Windows\System\bKGFzpZ.exe
  2⤵
  PID:13620
- C:\Windows\System\AGprxkX.exe
  C:\Windows\System\AGprxkX.exe
  2⤵
  PID:13644
- C:\Windows\System\ltJKcVQ.exe
  C:\Windows\System\ltJKcVQ.exe
  2⤵
  PID:13668
- C:\Windows\System\ChbFEhL.exe
  C:\Windows\System\ChbFEhL.exe
  2⤵
  PID:13688
- C:\Windows\System\qziYTST.exe
  C:\Windows\System\qziYTST.exe
  2⤵
  PID:13712
- C:\Windows\System\yShccat.exe
  C:\Windows\System\yShccat.exe
  2⤵
  PID:13732
- C:\Windows\System\aIqpDYo.exe
  C:\Windows\System\aIqpDYo.exe
  2⤵
  PID:13756
- C:\Windows\System\WNoYbLo.exe
  C:\Windows\System\WNoYbLo.exe
  2⤵
  PID:13780
- C:\Windows\System\yaCDmrM.exe
  C:\Windows\System\yaCDmrM.exe
  2⤵
  PID:13820
- C:\Windows\System\AChXPMZ.exe
  C:\Windows\System\AChXPMZ.exe
  2⤵
  PID:13836
- C:\Windows\System\bSsGaxc.exe
  C:\Windows\System\bSsGaxc.exe
  2⤵
  PID:13864
- C:\Windows\System\UIIMSZf.exe
  C:\Windows\System\UIIMSZf.exe
  2⤵
  PID:13888
- C:\Windows\System\EqlkyxU.exe
  C:\Windows\System\EqlkyxU.exe
  2⤵
  PID:13904
- C:\Windows\System\baEirTL.exe
  C:\Windows\System\baEirTL.exe
  2⤵
  PID:13920
- C:\Windows\System\YdOXnxP.exe
  C:\Windows\System\YdOXnxP.exe
  2⤵
  PID:13940
- C:\Windows\System\siLKMrr.exe
  C:\Windows\System\siLKMrr.exe
  2⤵
  PID:13972
- C:\Windows\System\wsxSIuG.exe
  C:\Windows\System\wsxSIuG.exe
  2⤵
  PID:13996
- C:\Windows\System\cBBRkWh.exe
  C:\Windows\System\cBBRkWh.exe
  2⤵
  PID:14020
- C:\Windows\System\ouxuPkM.exe
  C:\Windows\System\ouxuPkM.exe
  2⤵
  PID:14044
- C:\Windows\System\ZlHBVVS.exe
  C:\Windows\System\ZlHBVVS.exe
  2⤵
  PID:14064
- C:\Windows\System\pOCWWOr.exe
  C:\Windows\System\pOCWWOr.exe
  2⤵
  PID:14092
- C:\Windows\System\klYZDSl.exe
  C:\Windows\System\klYZDSl.exe
  2⤵
  PID:14112
- C:\Windows\System\VPFhuWl.exe
  C:\Windows\System\VPFhuWl.exe
  2⤵
  PID:14140
- C:\Windows\System\bvQcpDE.exe
  C:\Windows\System\bvQcpDE.exe
  2⤵
  PID:14160
- C:\Windows\System\wWwPAlA.exe
  C:\Windows\System\wWwPAlA.exe
  2⤵
  PID:14180
- C:\Windows\System\ZQnwZIc.exe
  C:\Windows\System\ZQnwZIc.exe
  2⤵
  PID:14200
- C:\Windows\System\xySvmVk.exe
  C:\Windows\System\xySvmVk.exe
  2⤵
  PID:14220
- C:\Windows\System\LBVhvJO.exe
  C:\Windows\System\LBVhvJO.exe
  2⤵
  PID:14244
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14244 -s 248
    3⤵
    PID:11104
- C:\Windows\System\NmDlgfY.exe
  C:\Windows\System\NmDlgfY.exe
  2⤵
  PID:14264
- C:\Windows\System\jvFzghS.exe
  C:\Windows\System\jvFzghS.exe
  2⤵
  PID:14284
- C:\Windows\System\rmTGABD.exe
  C:\Windows\System\rmTGABD.exe
  2⤵
  PID:14308
- C:\Windows\System\DNGLlsw.exe
  C:\Windows\System\DNGLlsw.exe
  2⤵
  PID:14332
- C:\Windows\System\loLGKad.exe
  C:\Windows\System\loLGKad.exe
  2⤵
  PID:12500
- C:\Windows\System\vNWpNAg.exe
  C:\Windows\System\vNWpNAg.exe
  2⤵
  PID:11968
- C:\Windows\System\dqSmdQb.exe
  C:\Windows\System\dqSmdQb.exe
  2⤵
  PID:12044
- C:\Windows\System\vXjXdeC.exe
  C:\Windows\System\vXjXdeC.exe
  2⤵
  PID:12640
- C:\Windows\System\uUJtAeX.exe
  C:\Windows\System\uUJtAeX.exe
  2⤵
  PID:12752
- C:\Windows\System\bmLVYCV.exe
  C:\Windows\System\bmLVYCV.exe
  2⤵
  PID:12264
- C:\Windows\System\vLDxQRp.exe
  C:\Windows\System\vLDxQRp.exe
  2⤵
  PID:12812
- C:\Windows\System\toJYlmj.exe
  C:\Windows\System\toJYlmj.exe
  2⤵
  PID:9940
- C:\Windows\System\GQkJsIF.exe
  C:\Windows\System\GQkJsIF.exe
  2⤵
  PID:11500
- C:\Windows\System\cJhVrCh.exe
  C:\Windows\System\cJhVrCh.exe
  2⤵
  PID:10152
- C:\Windows\System\BJYySFj.exe
  C:\Windows\System\BJYySFj.exe
  2⤵
  PID:7560
- C:\Windows\System\TnRewxi.exe
  C:\Windows\System\TnRewxi.exe
  2⤵
  PID:13168
- C:\Windows\System\zxpsTxJ.exe
  C:\Windows\System\zxpsTxJ.exe
  2⤵
  PID:13192
- C:\Windows\System\eQqZdGo.exe
  C:\Windows\System\eQqZdGo.exe
  2⤵
  PID:13244
- C:\Windows\System\UphAdcB.exe
  C:\Windows\System\UphAdcB.exe
  2⤵
  PID:10204
- C:\Windows\System\PSFBiyw.exe
  C:\Windows\System\PSFBiyw.exe
  2⤵
  PID:10428
- C:\Windows\System\gCAeSaW.exe
  C:\Windows\System\gCAeSaW.exe
  2⤵
  PID:3656
- C:\Windows\System\UXMCBIu.exe
  C:\Windows\System\UXMCBIu.exe
  2⤵
  PID:8968

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:13428

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:14308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DRvcEwK.exe

Path C:\Windows\System\DRvcEwK.exe
Size 1.9MB
SHA256 b7691d0b958faf404e2b5ad79ca61d80c88e4d61debc61a77985d13013c99366
MD5 4e90c7b3b09344da1a64a736c92fce17
SHA1 ad2c24f750aa182cc202f69876cbcf29ead8b9ca
SHA512 9419043e24cdda7bd9a963406ff4f53980a179c88fbd2d5acd4ab6914b458ea504bc5418803fc3e847cc541a50669688a24b482cfd564d3671e964a7600ccb5e
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTH:RWWBib356utgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

EwBBWGk.exe

Path C:\Windows\System\EwBBWGk.exe
Size 1.9MB
SHA256 19b095c429343f42520b579535d1334f45aa1e1f1de165c7b031100f7ad15e36
MD5 bb69fdf352ea7a1e1ea12d4c84ebff01
SHA1 301460739411b65fa9565d51d32b996cf7d99b27
SHA512 21436da7eb1319a690bc79628eb5de4a8227e7c3d50d7f5983e9c3f7c26eaf6f809b01226df52e4e47cad318bae71a5fc254912324a4a4a61017f61f0387947c
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTm:RWWBib356utg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

GtBNWwq.exe

Path C:\Windows\System\GtBNWwq.exe
Size 1.9MB
SHA256 94fcac60add2a56902cb32aa87dff2bd8dfebd016d4fe741889c8ac19c10d738
MD5 bed69174cf61ba15eb6548e5f1c36f5a
SHA1 96538ffeedadf91995291ba156ef414351d8dfd2
SHA512 05fec3a0cfb04ebef84dd24bb0ae02939781bb124568f5c62de15b5e12adda525a58ea96504195ab79f41b389b9fc75fd905ada1ffa5fb44d7e9400a3f26549a
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjT6:RWWBib356utgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

HGpojMt.exe

Path C:\Windows\System\HGpojMt.exe
Size 1.9MB
SHA256 eddb7ae192401c63e09162880b0175868566e3203f46a70fa537a2cae12061f4
MD5 a58e2bc5617b60243ada8f5df4467e5a
SHA1 4fa09850e1cf70635354b72fab296e0c7c96665d
SHA512 8f7e9c90633086eed29964b4be9875f457806c8168ab8c8c846ae409779800d37bb21dfecd42800635714b4b8b67b8e89c0b4c11ffea5ff96e557e29e4d9b171
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTc:RWWBib356utga
MD5 SHA1 SHA512 SSDEEP

Submit Download

ILiAqbw.exe

Path C:\Windows\System\ILiAqbw.exe
Size 1.9MB
SHA256 cc31a1d7151602c1e9ee59c3d8fe0af8198d61910f7dbca5bbedf82859ec4aeb
MD5 3c0a7987fd9d26d9e1012617d424d627
SHA1 66ac721219f444bc09cd152c9610c293ecc0534d
SHA512 b10781f8a7a8b261900b205c9fe9c61ff1e4367f44f361b66f45facfd34aa937fca9efd6acde6cab2bcaf3404299d1f7dd8c88018e39ab90efb1739e8912d1a0
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjT8:RWWBib356utgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

JeUvIUQ.exe

Path C:\Windows\System\JeUvIUQ.exe
Size 1.9MB
SHA256 660bee4c1c6b125fd7aa5cca230bc0ec719d6d0f8dcff20480c2b4831f3f9401
MD5 424e07dedc66c0d7c6dbf33b08ac289f
SHA1 03b46a1677f9df7180a3b071c7e9da94ea8573bb
SHA512 dca6789fabb60c886eeaa1484170f764034206ed4edd30c44fa274e8b0bc6edbe12f6eef9aa6d88111e3526bf3722007265bf583e202e1baf78f8f765281ba3b
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjT1:RWWBib356utgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

LZjovCK.exe

Path C:\Windows\System\LZjovCK.exe
Size 1.9MB
SHA256 78fd782e62ead2acb711b83e48043430e2695f698e12c4483645f7212d720a19
MD5 5c8b2bb7aaca6d790d7c7a0db7ae406d
SHA1 49990c98697acc3c7ff8da446bd40a18721f444e
SHA512 3e2d736b391d04c5d0a8f0ddbaeb84510e4c744ce6aa0a1abd18712893ec922c9a9525f763bc859e0d4e5e7280c725f84d90a49f2b0e2b80939ae892a20696e6
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTp:RWWBib356utg3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NULVMys.exe

Path C:\Windows\System\NULVMys.exe
Size 1.9MB
SHA256 5af917f20db436de065091f1b67c46ed22a35c460d503c0ddee0e3e342240a33
MD5 34fbc1d4baaff61a799f3a25bd94ebee
SHA1 ab1625c7ec6e245cefebfeb97c9565accf2db6cd
SHA512 4cd486bf3d337fc07fb496f26e62750570f20d0838579b8cc93a6058209f5e7c48f3531e6ca59d8af60017b25483a3b0e92c37d4980c02c16ab708664a39b9cb
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTM:RWWBib356utge
MD5 SHA1 SHA512 SSDEEP

Submit Download

PZqhNof.exe

Path C:\Windows\System\PZqhNof.exe
Size 1.9MB
SHA256 913a1dc1ba92f5cad23ac12d7f4e196191602432b14054e2fe241ce0562f2f54
MD5 7224a6cf89c65870cf0d72dd1d10b806
SHA1 cca821dd980b253900e4b36c25e5dccbf803602d
SHA512 11eeaf32981af186e544130b500b8c42298da5edea7fca773db31ce18916142363ae86b29a13f72ec49a2a65799b6f27816a88a9bdc7f8aa28467ee3e3c1ea60
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTD:RWWBib356utgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

PuyQDNs.exe

Path C:\Windows\System\PuyQDNs.exe
Size 1.9MB
SHA256 d95e06fa642223a773adbd2a1646190a8cfd88f1a580caab51ce5634f1dd7995
MD5 cddf8b916d52b3deafbf13dcaad89c38
SHA1 bfaa16b5b2e9c5368e41a60042eee8f4a9532efd
SHA512 3a71799abe0b17dfdc44a8820784c3e170e8f28335782584b4f716139e0a80a818b944c3e504c1eadcba43b36482a0442d8435279ad93a56d2db1679078d77cd
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTI:RWWBib356utgS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TvwAFAb.exe

Path C:\Windows\System\TvwAFAb.exe
Size 1.9MB
SHA256 ecd4b5230082c4a941b729d89d3a23f743808c0874ec3722d1ba10fba32a52aa
MD5 a4c0e2256f648d9653460ecac5503102
SHA1 8847842157ba17af77400a973de524a0062e747b
SHA512 bf70d20f592100b463895321b9cfca0682234b1d39d7194d227b8288b93035ca13043cd4a799a46aea6e9b3b06034c5a763e98a4ad9f939f562038b48f08b358
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTj:RWWBib356utgV
MD5 SHA1 SHA512 SSDEEP

Submit Download

WZyOVBF.exe

Path C:\Windows\System\WZyOVBF.exe
Size 1.9MB
SHA256 aeb400337c8a57b472d80ca4029f60326927c0358096e5411a8043ffa0de07b4
MD5 b180c84b6c273462e8521641ce1427df
SHA1 dd73e98b7b5433263099acd433cf9e9316c0d199
SHA512 3695f93a9c54e9b51e95ca389c5b669a7c7acc42609b0573dfcbaa8c19e86f5a87a49099096335d6e93f02b45339501d0644c0723de0ee64ccd442c3aaecb110
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTNa:RWWBib356utgW
MD5 SHA1 SHA512 SSDEEP

Submit Download

WlTpQgV.exe

Path C:\Windows\System\WlTpQgV.exe
Size 1.9MB
SHA256 b22628eeed57b128d9b058d96844a8ec9c05913fcb95e14ec5246c6b6c8be2c0
MD5 b66af72047ab8743e4ff678b25efa48e
SHA1 8be5374cdcad10e4d330b252f97bc4596ff93db3
SHA512 836d9cee5ec2f69df07fca7cf0229c5fa94d396ef8e1a1dee420e7a765e7cb362a258441b8adcf56cf9033a9587559f5ff44ad4ef8075d3b176f1da8107b9e60
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTp:RWWBib356utgH
MD5 SHA1 SHA512 SSDEEP

Submit Download

XUqWVDh.exe

Path C:\Windows\System\XUqWVDh.exe
Size 1.9MB
SHA256 866d94390a89575f61c40e46c42f3e0b96b1eb353a230a51b29197c6da43181d
MD5 dba3d9dc15c7173fdb2d4b3b34b764fc
SHA1 4fbe328f7ac36fca8876ef4a35ebb18c6dc56fd3
SHA512 041018ea2ed246cf31a326b166870b21b392a83676dc7494516e3138d7ead8bc6a28be32453ad255a99b2aaab38923ae29d9cafe77e1c355de3c6c3152c1c440
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTL:RWWBib356utg9
MD5 SHA1 SHA512 SSDEEP

Submit Download

XXtyOFW.exe

Path C:\Windows\System\XXtyOFW.exe
Size 1.9MB
SHA256 27b9678a5c53ceb5d6d147a06d21c4fb0f5235b054ba83191f138b8b37daeb5a
MD5 53b62385ef5d2936cdf2fed5ed9f0f86
SHA1 67d2826890ea9f9c895342130b5bd4566aecb639
SHA512 ef1ae2133a7a531df7b5a4d7881c855c979f8207ea322a0dd1168a5d487d1e4346244a9126ae75a51c33581e5bcbe53d5711094c906d8e7e544c3b0124e172b8
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTjF:RWWBib356utgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

XtGhsKT.exe

Path C:\Windows\System\XtGhsKT.exe
Size 1.9MB
SHA256 e15be381d7f2dac306a3022df3353de671bc96277fec38baae4cc6db6814c00f
MD5 bd7bd0849167280314f81e3e6d2582c5
SHA1 ca99143c7a51f2b8acb999c2b2ebfccb3b26ddab
SHA512 10eceb20ba7ed7416c48314b69210ec6a0455b614a5742b78cb1534bf4e446182a8c6114eb3fe554ee0fd6ac3045cb3e7890ad860ad1f6dfeac4f18fd0820cfd
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTj:RWWBib356utgV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZNnqgiA.exe

Path C:\Windows\System\ZNnqgiA.exe
Size 1.9MB
SHA256 0922321218e7dc22202dd8f25da1849e04e1ed6d1119dd7b24f5fc22cd309e87
MD5 0fa45a0047d3b2e2df9af2b946371055
SHA1 03761d8dd5f0f921b012a6d873a44f08da8cc6c4
SHA512 58f867b8ca9d82e1d0bad2a3de67eaed1c619b700fa5077ce9e63a88a9fcbbad3d0096bb20bbea389b2900d0a6c9aa97269c7247905682cbab97b8f51367a843
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTg:RWWBib356utgW
MD5 SHA1 SHA512 SSDEEP

Submit Download

aDxYwmN.exe

Path C:\Windows\System\aDxYwmN.exe
Size 1.9MB
SHA256 6e169b893fb0fe62c99f6274068cccc059200d1f1e61232f43281308af838a71
MD5 38b808c5d4b68716799a8d5efab6d309
SHA1 ad0d476d6c7653fff1246949c1152d8a4d653d4c
SHA512 14f54fa00753dbf076dc78765c65fdfcfe2a721a19ee5b427bea8813909add8838cffad0067bcfe13c0af16dcbe244f24f9d7839ded21c86fa35481736aeb8ea
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTQ:RWWBib356utg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

bTdgvcI.exe

Path C:\Windows\System\bTdgvcI.exe
Size 1.9MB
SHA256 a87ced083c182c3422d0b32f6dbbb1f1e682c9eb490b813d8f399859ff903a1b
MD5 284616dd22648519c291d5c17a4e9a89
SHA1 a8d45649f76d0216ee4b71ea402b7bfe5826db40
SHA512 2647d2ac2d01cc02b2f7f38e71d492aba16a1fd3f427f56dc0737f9c35b3a5fac758ab500aa9c8ef142bdc38dcae9fcb9af26f0421df74a6550fa1bc0cbb2bc1
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjT9:RWWBib356utgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffCNrAQ.exe

Path C:\Windows\System\ffCNrAQ.exe
Size 1.9MB
SHA256 f1fe224a2fefcf69b912d100c205f1e962b9677bb3c10766bcbc5b62ee2a781f
MD5 775aa632931e8a7ad2fa29578bf23563
SHA1 aababe8728d9938973daa98cb122e912cf5555d4
SHA512 0af9da3ed36a9f4389215b9b9a1ce8eddc7c2a7d4b328d7b47f1b3133c518fe39833f9da189306943874f834d49e8b1f7d14a6a25f2106e8d07115dddffc2f78
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTh:RWWBib356utgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

gFETVsS.exe

Path C:\Windows\System\gFETVsS.exe
Size 1.9MB
SHA256 7b407c1a50b6008c66c08963c52c42e9ab1d62cdb55c137dc9364b43cfe15436
MD5 e8efa1cf0de1edd3687e5fb5f856e4ee
SHA1 33567563c6f53d4d1d71e7e278697badd8741cf8
SHA512 a39eb469da2fca47fd6ccfacf63bc73ccd25c880bc08a5e4a4bc8ce43043b140c8f812f64599d4fbcb11ab7de3704405be58a72addbe7f8ca3c5ace17dac23c5
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTN:RWWBib356utgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

gQySJEq.exe

Path C:\Windows\System\gQySJEq.exe
Size 1.9MB
SHA256 7689375d5d1cd9da51cf74e3ce24a77985a494591bb3a5c1267462c78ed56962
MD5 c185a0ded5371326998fde33096fa7e3
SHA1 76abd6141e26f489c4aca5cb9e7ad46718f2f97c
SHA512 44edf7eb43d69c08750fdb9225c1226f99ecb05beb3048cedcee3a0c945cfdf0f1d9678b225e9edb2c05178baa26a8e58e31c7e25bd2215ee9041f5dd5a7843c
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTF:RWWBib356utgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

giVLnfl.exe

Path C:\Windows\System\giVLnfl.exe
Size 1.9MB
SHA256 1e019aac78517f5e9f71e7803e3fe02449fac1b64a1991870e618ee4190c0b9a
MD5 f8e1dbaea851da2bf5c2a0d1e5c0a775
SHA1 be663e3afaf58b58124b937e6ead473a93e39f1f
SHA512 0eb1d1d8c7cf7d30fd9358848214c5cf8ed818f741b3600f254a335ead9c745e50aac17abe0887ea6da565781fab10bf3d09c41247122cc3b5b5adbb301067d7
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTm:RWWBib356utgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

iFEtYvb.exe

Path C:\Windows\System\iFEtYvb.exe
Size 1.9MB
SHA256 948b9535ae9cec6eeb162a8578d7abbd048a9c4a39fad993646632f78edf62ed
MD5 736a8b1abf8f1696e19eef257569b2d2
SHA1 b4bcdb0791a05baa76db09552e4811ad72660c4c
SHA512 394e574b1a1112c0ffbcb9c8d58f0b741cf3f83a73ce66ca84449362c66ce027409cd818b839eac5ca3ad315dfa0fe237c37ec883b1f14a358f7f177ea941955
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTp:RWWBib356utgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

jiSrQHD.exe

Path C:\Windows\System\jiSrQHD.exe
Size 1.9MB
SHA256 967beb1ef17167dcc90dbb7c5baf04009b7ce1c64375fb66961b68a16fa56255
MD5 a98b8333cf09fbd12614bb13f468d2b4
SHA1 5183c7b715ae9c7a09bb5e57fed9a9fe27171142
SHA512 80c2e4b3999b9933f4182a257440a61058c523b439423c74cda61390b9f30154a8f3237c7ef8e3bf21aa94a9da9e3aca45b74991f4584c2568b035dcbf4b0490
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTs:RWWBib356utge
MD5 SHA1 SHA512 SSDEEP

Submit Download

kWvZhJk.exe

Path C:\Windows\System\kWvZhJk.exe
Size 1.9MB
SHA256 9c6790da627c2f673dac46a96a5078ad72cd285f919d06803a2d412d153322ba
MD5 26350c7c2bf313c7513d22eb64a8bd67
SHA1 728cc66f392d38c5b83c11381a1aa0a29f71b13b
SHA512 7528becb9d799fffc3241a56ce8d71f63c1157723b4c6a9cead90b08ba0208850680abaaadde84318059310a3a7107eff06c3ed5c612e6857082fedebb85ae73
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTa:RWWBib356utg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

kXwoWte.exe

Path C:\Windows\System\kXwoWte.exe
Size 1.9MB
SHA256 0f6c1ae057507001cfd055fec81fe0b8810a299f7db1b4180bbbe214edab4742
MD5 25c7c4123da127adf47e2c1be2729040
SHA1 234666c837b561ea70bb13695906a7baaeac2bd7
SHA512 ffe230084ab4baf111c7440f4235c4d02bc729ca7e13616319c05aacfceaa882b3c323f5621c8c0df85c3f2a73250d8861ddbd07181d954c8116b55f21c3f4ca
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTu:RWWBib356utg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nVKnpZq.exe

Path C:\Windows\System\nVKnpZq.exe
Size 1.9MB
SHA256 0a573b655bda02fb0f173eaef6cc88289f7fc98ad2c68de592e27fe7414de47b
MD5 0f2540207a06f231c4eb2834f4c577eb
SHA1 f6fade41344b0dda1582e6cb6f9a57cc9f0dcc38
SHA512 1e0ea803a1ae8a75593402a28bc1b13ff5db1ad3eb8e2711cea937fae0a348634ee4db1c50abac69d2355d60d84daf5cb1eb628d2f66f0b22e70fceb1c0da88e
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjT0u:RWWBib356utg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ncbrNjz.exe

Path C:\Windows\System\ncbrNjz.exe
Size 1.9MB
SHA256 abffd4c607dcd0466a6d8e3582b0f17b686d4580a4cd4bae9bf7aaa71da86167
MD5 774660678d57885d514f6253e06b5117
SHA1 4378f1d4980463950f08847aea7f645948702af5
SHA512 19d017f39e0cf56a1adc11d04ed7eb91950d777f04fb644643ae5a10f421a6f9ad7377a92bb238c052dea1e5124b68944596e67e5f9c89b55fc4bf9eb192e6a3
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTb:RWWBib356utgx
MD5 SHA1 SHA512 SSDEEP

Submit Download

neKUfUp.exe

Path C:\Windows\System\neKUfUp.exe
Size 1.9MB
SHA256 639877575c98e2932a7a468580c8f9e7f614cf58c2c42fe2d0e1f1b95f1addbe
MD5 7b6bfad1957abb586bd88e07b0ae198f
SHA1 913656c6243d7c5ce2ec7a8b9e235b9ff96c2941
SHA512 a228e70e5ce2362f4d2c11a86d0e91fd4245390c5784f676635d5f599c6ca52ff04edcaafd2d785c91c6bb7112596f768012b5f1b265dab3ff2f7a78cfa57ea6
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTr:RWWBib356utgl
MD5 SHA1 SHA512 SSDEEP

Submit Download

pIssODa.exe

Path C:\Windows\System\pIssODa.exe
Size 1.9MB
SHA256 57c224b4e75b4748c824387bde942461419777588f6776709e322ba18e1020db
MD5 fe762cd92a5b84da3c8f4f78c4118f50
SHA1 85b987d42195d51a5c86b71e88f2e32bb55a1bc5
SHA512 ce4d2053b23f5d04c91a6b28abf03f84f5fb64ec4e01456343c0eaf68af0874328846d4087ad066df25efe3c38af776fc7104c940b605c3eff17cfaee1871432
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjT0:RWWBib356utgy
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgRjgsH.exe

Path C:\Windows\System\pgRjgsH.exe
Size 1.9MB
SHA256 16a606e99073d8216096d21544a0db766a97c135dbf1c6114e9d234b7579bd9d
MD5 78ffc07e5bceced5855027a1d5f06bea
SHA1 e5332e3578543121037b764192a1b941f53f3584
SHA512 fe964821b58669f6341ed72c71a07a7728b229038ff1b253853f22c553b701270e30ada0207fb66e5413bdbce291c6e52bb9850073837f587f39ce7a388f2667
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTk:RWWBib356utge
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtJLRrv.exe

Path C:\Windows\System\rtJLRrv.exe
Size 1.9MB
SHA256 75c47db18e9fba034f5394c3338790fef25d1b34316bb2cad757ccc8dfefcc71
MD5 41a45a63cf7e4c923bc6b637500b70f2
SHA1 da9ec4f727b1ab2ef4621cce9bc49ba4834a86b4
SHA512 3ce1e3a598880b8bbf8fab4b83f6465e509d5667d1f398fafd4f97424cfc45fb543cb4f26216ee8502d3f5c960ad17dfc42f22973abd162be4e6c8f0aeab5c8d
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTD:RWWBib356utgZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tUggDWy.exe

Path C:\Windows\System\tUggDWy.exe
Size 1.9MB
SHA256 7c1733a9d8384ce3e558ed08b1a49780ae9b4e32d307bb9d0fe04c15cb68c041
MD5 881fafc6f6df153a2c2fff5f5e5e2944
SHA1 39cfbf1dc6611235db703d8df41ec44ffdcb4d9f
SHA512 d491bf1828cba9a54f63e16570565a7a16ab950693fe5174fed52a86a24b6c2e8adc26e05b5ccc3ac23d12a24d73fc75fceb5bb9cdf5933967b73150be0cb1f2
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTk:RWWBib356utgm
MD5 SHA1 SHA512 SSDEEP

Submit Download

uGViINh.exe

Path C:\Windows\System\uGViINh.exe
Size 1.9MB
SHA256 ebb707acf89f10e76f3db6af9bff71e726a29ab2e37a0ceba064fb7b786963ad
MD5 0b8c38cff4bdcb098b25fc711dd502f0
SHA1 df46af57e63d144e3c10cb6f82b0c5381aa646f5
SHA512 0f5f101b383221db5fc9753fc89c4d0760e09e60664a678b1b52a20d5b0e92ff325e8f0c08bf960aceddb0c15f5b6f3b1fef4e0cd6a16064c921e32d5c1f5c76
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTC:RWWBib356utg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vxFpLvO.exe

Path C:\Windows\System\vxFpLvO.exe
Size 1.9MB
SHA256 12c7d49fd5a3cc35a385822a8e831a4fa973a0259af39a88d8d3303706c63a0a
MD5 9f20287c7fb14fdb35e38687e540358b
SHA1 4183da03a8b426df0034db69cdc2a7427b94b621
SHA512 566b555c5faf2b3d468e924cec8507ae8080043ee9e2921d865e163f3f222e488f023e1237d7114516a80a9f803606adf821ad3d499edb4ac1bf72d078f78368
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTx:RWWBib356utgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

zNvnIld.exe

Path C:\Windows\System\zNvnIld.exe
Size 1.9MB
SHA256 c59b5179fe85518b9d3fe84ba66d38261baa08b8730f6496a251f564b15d489e
MD5 18d9b88af72a07d5880f3df78540e26d
SHA1 6d64ca36bba864b295b03b37714890c61ec2d3b7
SHA512 47254a271a605a1725fb2dbedb9d9d3e1ccdefdaef555489e57a8ac3377e2179615064a5c2eace9a2ef86e9fc1b7b6d67f13a730352c7925671a35a76b1cf331
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEd2hXnn6ebUtjTS:RWWBib356utgk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-183-0x00007FF6945D0000-0x00007FF694921000-memory.dmp

Download

memory/436-2276-0x00007FF6945D0000-0x00007FF694921000-memory.dmp

Download

memory/468-317-0x00007FF6EED10000-0x00007FF6EF061000-memory.dmp

Download

memory/468-2351-0x00007FF6EED10000-0x00007FF6EF061000-memory.dmp

Download

memory/560-264-0x00007FF73BD20000-0x00007FF73C071000-memory.dmp

Download

memory/560-2295-0x00007FF73BD20000-0x00007FF73C071000-memory.dmp

Download

memory/596-2267-0x00007FF78FBA0000-0x00007FF78FEF1000-memory.dmp

Download

memory/596-52-0x00007FF78FBA0000-0x00007FF78FEF1000-memory.dmp

Download

memory/1068-2299-0x00007FF6B0E90000-0x00007FF6B11E1000-memory.dmp

Download

memory/1068-238-0x00007FF6B0E90000-0x00007FF6B11E1000-memory.dmp

Download

memory/1512-2150-0x00007FF737F60000-0x00007FF7382B1000-memory.dmp

Download

memory/1512-0-0x00007FF737F60000-0x00007FF7382B1000-memory.dmp

Download

memory/1512-1-0x0000014E9D1A0000-0x0000014E9D1B0000-memory.dmp

Download

memory/1672-2263-0x00007FF72C680000-0x00007FF72C9D1000-memory.dmp

Download

memory/1672-47-0x00007FF72C680000-0x00007FF72C9D1000-memory.dmp

Download

memory/1928-2291-0x00007FF66EC50000-0x00007FF66EFA1000-memory.dmp

Download

memory/1928-314-0x00007FF66EC50000-0x00007FF66EFA1000-memory.dmp

Download

memory/1932-313-0x00007FF7EE630000-0x00007FF7EE981000-memory.dmp

Download

memory/1932-2282-0x00007FF7EE630000-0x00007FF7EE981000-memory.dmp

Download

memory/1980-109-0x00007FF601820000-0x00007FF601B71000-memory.dmp

Download

memory/1980-2273-0x00007FF601820000-0x00007FF601B71000-memory.dmp

Download

memory/2092-2278-0x00007FF67F790000-0x00007FF67FAE1000-memory.dmp

Download

memory/2092-138-0x00007FF67F790000-0x00007FF67FAE1000-memory.dmp

Download

memory/2132-2288-0x00007FF6E7000000-0x00007FF6E7351000-memory.dmp

Download

memory/2132-155-0x00007FF6E7000000-0x00007FF6E7351000-memory.dmp

Download

memory/2564-199-0x00007FF7308C0000-0x00007FF730C11000-memory.dmp

Download

memory/2564-2293-0x00007FF7308C0000-0x00007FF730C11000-memory.dmp

Download

memory/2756-2251-0x00007FF722AF0000-0x00007FF722E41000-memory.dmp

Download

memory/2756-2255-0x00007FF722AF0000-0x00007FF722E41000-memory.dmp

Download

memory/2756-10-0x00007FF722AF0000-0x00007FF722E41000-memory.dmp

Download

memory/2860-74-0x00007FF7B5010000-0x00007FF7B5361000-memory.dmp

Download

memory/2860-2265-0x00007FF7B5010000-0x00007FF7B5361000-memory.dmp

Download

memory/2980-294-0x00007FF6830D0000-0x00007FF683421000-memory.dmp

Download

memory/2980-2308-0x00007FF6830D0000-0x00007FF683421000-memory.dmp

Download

memory/3168-2271-0x00007FF6E7320000-0x00007FF6E7671000-memory.dmp

Download

memory/3168-48-0x00007FF6E7320000-0x00007FF6E7671000-memory.dmp

Download

memory/3352-2257-0x00007FF6B71D0000-0x00007FF6B7521000-memory.dmp

Download

memory/3352-300-0x00007FF6B71D0000-0x00007FF6B7521000-memory.dmp

Download

memory/3684-19-0x00007FF7B43F0000-0x00007FF7B4741000-memory.dmp

Download

memory/3684-2253-0x00007FF7B43F0000-0x00007FF7B4741000-memory.dmp

Download

memory/3712-2297-0x00007FF7C05B0000-0x00007FF7C0901000-memory.dmp

Download

memory/3712-244-0x00007FF7C05B0000-0x00007FF7C0901000-memory.dmp

Download

memory/4188-2285-0x00007FF641500000-0x00007FF641851000-memory.dmp

Download

memory/4188-315-0x00007FF641500000-0x00007FF641851000-memory.dmp

Download

memory/4440-2270-0x00007FF6568D0000-0x00007FF656C21000-memory.dmp

Download

memory/4440-81-0x00007FF6568D0000-0x00007FF656C21000-memory.dmp

Download

memory/4444-291-0x00007FF68A4F0000-0x00007FF68A841000-memory.dmp

Download

memory/4444-2301-0x00007FF68A4F0000-0x00007FF68A841000-memory.dmp

Download

memory/4616-312-0x00007FF696D70000-0x00007FF6970C1000-memory.dmp

Download

memory/4616-2284-0x00007FF696D70000-0x00007FF6970C1000-memory.dmp

Download

memory/4776-2259-0x00007FF6929C0000-0x00007FF692D11000-memory.dmp

Download

memory/4776-27-0x00007FF6929C0000-0x00007FF692D11000-memory.dmp

Download

memory/4816-301-0x00007FF696B50000-0x00007FF696EA1000-memory.dmp

Download

memory/4816-2262-0x00007FF696B50000-0x00007FF696EA1000-memory.dmp

Download

memory/4948-2305-0x00007FF76E380000-0x00007FF76E6D1000-memory.dmp

Download

memory/4948-292-0x00007FF76E380000-0x00007FF76E6D1000-memory.dmp

Download

memory/4960-239-0x00007FF769C40000-0x00007FF769F91000-memory.dmp

Download

memory/4960-2303-0x00007FF769C40000-0x00007FF769F91000-memory.dmp

Download

memory/4980-2280-0x00007FF6EDD40000-0x00007FF6EE091000-memory.dmp

Download

memory/4980-113-0x00007FF6EDD40000-0x00007FF6EE091000-memory.dmp

Download

memory/5064-87-0x00007FF719AA0000-0x00007FF719DF1000-memory.dmp

Download

memory/5064-2290-0x00007FF719AA0000-0x00007FF719DF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads