xmrig | cc60959140a1c70587aefac000e8194c12854b268324d00c25cb4be20656bb51

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
Size

1.4MB
MD5

06cfdca80255a91408a6493141bf5b70
SHA1

03d6ccc1fe338bf2e7ff04c0510ace88aaf42e87
SHA256

cc60959140a1c70587aefac000e8194c12854b268324d00c25cb4be20656bb51
SHA512

92156370e3796e67664ee70447577457f45336a052ed5a0712ac4dc74ce286b0b808a1a4e381ecfd355f559a903dba71b4d5d259f7554b052c2583f9db358730
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727f8UhNnwSz7TD0SqKpTIr2ejZvU67NnX1vQnTzaf:ROdWCCi7/rahUUvlhqLr2+W4p

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral2/memory/3476-446-0x00007FF61EA60000-0x00007FF61EDB1000-memory.dmp	xmrig
behavioral2/memory/4968-452-0x00007FF609D10000-0x00007FF60A061000-memory.dmp	xmrig
behavioral2/memory/4812-461-0x00007FF7A26B0000-0x00007FF7A2A01000-memory.dmp	xmrig
behavioral2/memory/3080-483-0x00007FF651C30000-0x00007FF651F81000-memory.dmp	xmrig
behavioral2/memory/1096-479-0x00007FF740D70000-0x00007FF7410C1000-memory.dmp	xmrig
behavioral2/memory/4160-473-0x00007FF7F14F0000-0x00007FF7F1841000-memory.dmp	xmrig
behavioral2/memory/4168-468-0x00007FF749C50000-0x00007FF749FA1000-memory.dmp	xmrig
behavioral2/memory/3944-493-0x00007FF69B0E0000-0x00007FF69B431000-memory.dmp	xmrig
behavioral2/memory/5092-542-0x00007FF6311C0000-0x00007FF631511000-memory.dmp	xmrig
behavioral2/memory/3420-532-0x00007FF7D1400000-0x00007FF7D1751000-memory.dmp	xmrig
behavioral2/memory/1016-531-0x00007FF613AC0000-0x00007FF613E11000-memory.dmp	xmrig
behavioral2/memory/1776-522-0x00007FF636720000-0x00007FF636A71000-memory.dmp	xmrig
behavioral2/memory/2876-510-0x00007FF606BA0000-0x00007FF606EF1000-memory.dmp	xmrig
behavioral2/memory/1652-502-0x00007FF7E8DD0000-0x00007FF7E9121000-memory.dmp	xmrig
behavioral2/memory/4152-555-0x00007FF7F1570000-0x00007FF7F18C1000-memory.dmp	xmrig
behavioral2/memory/1780-596-0x00007FF722550000-0x00007FF7228A1000-memory.dmp	xmrig
behavioral2/memory/4836-613-0x00007FF64EFA0000-0x00007FF64F2F1000-memory.dmp	xmrig
behavioral2/memory/1416-618-0x00007FF6064A0000-0x00007FF6067F1000-memory.dmp	xmrig
behavioral2/memory/1972-606-0x00007FF7EE2A0000-0x00007FF7EE5F1000-memory.dmp	xmrig
behavioral2/memory/2612-600-0x00007FF6224C0000-0x00007FF622811000-memory.dmp	xmrig
behavioral2/memory/3092-569-0x00007FF680CE0000-0x00007FF681031000-memory.dmp	xmrig
behavioral2/memory/2104-552-0x00007FF76EF10000-0x00007FF76F261000-memory.dmp	xmrig
behavioral2/memory/1992-551-0x00007FF786FB0000-0x00007FF787301000-memory.dmp	xmrig
behavioral2/memory/32-548-0x00007FF7C5E00000-0x00007FF7C6151000-memory.dmp	xmrig
behavioral2/memory/5020-2169-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp	xmrig
behavioral2/memory/4804-2180-0x00007FF744420000-0x00007FF744771000-memory.dmp	xmrig
behavioral2/memory/2920-2181-0x00007FF7B15F0000-0x00007FF7B1941000-memory.dmp	xmrig
behavioral2/memory/1528-2179-0x00007FF725920000-0x00007FF725C71000-memory.dmp	xmrig
behavioral2/memory/5020-2213-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp	xmrig
behavioral2/memory/1528-2215-0x00007FF725920000-0x00007FF725C71000-memory.dmp	xmrig
behavioral2/memory/4804-2217-0x00007FF744420000-0x00007FF744771000-memory.dmp	xmrig
behavioral2/memory/4836-2228-0x00007FF64EFA0000-0x00007FF64F2F1000-memory.dmp	xmrig
behavioral2/memory/4812-2233-0x00007FF7A26B0000-0x00007FF7A2A01000-memory.dmp	xmrig
behavioral2/memory/4160-2235-0x00007FF7F14F0000-0x00007FF7F1841000-memory.dmp	xmrig
behavioral2/memory/1096-2237-0x00007FF740D70000-0x00007FF7410C1000-memory.dmp	xmrig
behavioral2/memory/4168-2231-0x00007FF749C50000-0x00007FF749FA1000-memory.dmp	xmrig
behavioral2/memory/4724-2229-0x00007FF705400000-0x00007FF705751000-memory.dmp	xmrig
behavioral2/memory/3476-2226-0x00007FF61EA60000-0x00007FF61EDB1000-memory.dmp	xmrig
behavioral2/memory/4968-2222-0x00007FF609D10000-0x00007FF60A061000-memory.dmp	xmrig
behavioral2/memory/1416-2219-0x00007FF6064A0000-0x00007FF6067F1000-memory.dmp	xmrig
behavioral2/memory/2920-2224-0x00007FF7B15F0000-0x00007FF7B1941000-memory.dmp	xmrig
behavioral2/memory/2104-2279-0x00007FF76EF10000-0x00007FF76F261000-memory.dmp	xmrig
behavioral2/memory/1780-2276-0x00007FF722550000-0x00007FF7228A1000-memory.dmp	xmrig
behavioral2/memory/1992-2274-0x00007FF786FB0000-0x00007FF787301000-memory.dmp	xmrig
behavioral2/memory/3420-2273-0x00007FF7D1400000-0x00007FF7D1751000-memory.dmp	xmrig
behavioral2/memory/3080-2271-0x00007FF651C30000-0x00007FF651F81000-memory.dmp	xmrig
behavioral2/memory/4152-2262-0x00007FF7F1570000-0x00007FF7F18C1000-memory.dmp	xmrig
behavioral2/memory/2612-2259-0x00007FF6224C0000-0x00007FF622811000-memory.dmp	xmrig
behavioral2/memory/1972-2258-0x00007FF7EE2A0000-0x00007FF7EE5F1000-memory.dmp	xmrig
behavioral2/memory/32-2254-0x00007FF7C5E00000-0x00007FF7C6151000-memory.dmp	xmrig
behavioral2/memory/3092-2252-0x00007FF680CE0000-0x00007FF681031000-memory.dmp	xmrig
behavioral2/memory/3944-2248-0x00007FF69B0E0000-0x00007FF69B431000-memory.dmp	xmrig
behavioral2/memory/1652-2246-0x00007FF7E8DD0000-0x00007FF7E9121000-memory.dmp	xmrig
behavioral2/memory/2876-2244-0x00007FF606BA0000-0x00007FF606EF1000-memory.dmp	xmrig
behavioral2/memory/1016-2240-0x00007FF613AC0000-0x00007FF613E11000-memory.dmp	xmrig
behavioral2/memory/5092-2250-0x00007FF6311C0000-0x00007FF631511000-memory.dmp	xmrig
behavioral2/memory/1776-2242-0x00007FF636720000-0x00007FF636A71000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5020	Imtvbpb.exe
1528	jEnBcWq.exe
4804	fJHwUTv.exe
4724	vhJWHuU.exe
2920	lBTtsbO.exe
4836	rzYRGaM.exe
3476	iJEVuQn.exe
4968	zeTnvbx.exe
1416	HZhDkqZ.exe
4812	jTJRnzB.exe
4168	ylMVbNy.exe
4160	VROIXUH.exe
1096	tNhhLyU.exe
3080	yRsoGtU.exe
3944	ixBeFuA.exe
1652	UhlCMsI.exe
2876	qVfKbjG.exe
1776	lPkXkaV.exe
1016	sCgVCgd.exe
3420	VjYiXEX.exe
5092	jqjcmsL.exe
32	bojEgGc.exe
1992	IFHLAiQ.exe
2104	PUrQVWc.exe
4152	KaxAZZQ.exe
3092	OHgWkxC.exe
1780	UKSmnAv.exe
2612	GOkTbaA.exe
1972	iplnypE.exe
1596	mJJJvPd.exe
4292	uIApXpc.exe
3000	QbeODQP.exe
1484	pzoSBYD.exe
2184	CVFOkQL.exe
4556	eeSLWCn.exe
1568	XwoxDIZ.exe
2824	KqRzcKw.exe
4416	InHbnYb.exe
2336	HzFUGBF.exe
3428	cnSMafh.exe
3960	kytYkeK.exe
4828	UGQnNyN.exe
4428	QTKHAWa.exe
4424	KXYMdAn.exe
688	FVawulX.exe
3544	dwjIXvB.exe
1428	WFfxkCN.exe
1260	wRzHNit.exe
2772	oFFDOZD.exe
4460	yHIcbOy.exe
3508	OKBIzSG.exe
4156	UOeImWD.exe
552	QYYwWQe.exe
5128	lXxwgeI.exe
5156	WrbdjNq.exe
5172	yLnElrQ.exe
5200	atdRDej.exe
5224	CfdexfG.exe
5256	TlSGnkY.exe
5284	JxysEvi.exe
5312	sAMCsWm.exe
5340	JDdUtcz.exe
5364	LqBugPP.exe
5396	UAovhkd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-0-0x00007FF7B6E90000-0x00007FF7B71E1000-memory.dmp	upx
behavioral2/memory/5020-11-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp	upx
behavioral2/files/0x000700000002353e-12.dat	upx
behavioral2/files/0x0007000000023541-25.dat	upx
behavioral2/files/0x0007000000023542-31.dat	upx
behavioral2/files/0x0007000000023544-41.dat	upx
behavioral2/memory/2920-47-0x00007FF7B15F0000-0x00007FF7B1941000-memory.dmp	upx
behavioral2/files/0x0007000000023549-68.dat	upx
behavioral2/files/0x000700000002354b-86.dat	upx
behavioral2/files/0x000700000002354d-96.dat	upx
behavioral2/files/0x0007000000023553-118.dat	upx
behavioral2/files/0x0007000000023554-131.dat	upx
behavioral2/files/0x0007000000023558-143.dat	upx
behavioral2/memory/3476-446-0x00007FF61EA60000-0x00007FF61EDB1000-memory.dmp	upx
behavioral2/memory/4968-452-0x00007FF609D10000-0x00007FF60A061000-memory.dmp	upx
behavioral2/memory/4812-461-0x00007FF7A26B0000-0x00007FF7A2A01000-memory.dmp	upx
behavioral2/memory/3080-483-0x00007FF651C30000-0x00007FF651F81000-memory.dmp	upx
behavioral2/memory/1096-479-0x00007FF740D70000-0x00007FF7410C1000-memory.dmp	upx
behavioral2/memory/4160-473-0x00007FF7F14F0000-0x00007FF7F1841000-memory.dmp	upx
behavioral2/memory/4168-468-0x00007FF749C50000-0x00007FF749FA1000-memory.dmp	upx
behavioral2/files/0x000700000002355d-168.dat	upx
behavioral2/files/0x000700000002355b-166.dat	upx
behavioral2/files/0x000700000002355c-163.dat	upx
behavioral2/files/0x000700000002355a-161.dat	upx
behavioral2/files/0x0007000000023559-156.dat	upx
behavioral2/files/0x0007000000023557-146.dat	upx
behavioral2/files/0x0007000000023556-141.dat	upx
behavioral2/files/0x0007000000023555-136.dat	upx
behavioral2/files/0x0007000000023552-121.dat	upx
behavioral2/files/0x0007000000023551-116.dat	upx
behavioral2/files/0x0007000000023550-111.dat	upx
behavioral2/files/0x000700000002354f-106.dat	upx
behavioral2/files/0x000700000002354e-101.dat	upx
behavioral2/files/0x000700000002354c-91.dat	upx
behavioral2/files/0x000700000002354a-81.dat	upx
behavioral2/files/0x0007000000023548-71.dat	upx
behavioral2/files/0x0007000000023547-66.dat	upx
behavioral2/files/0x0007000000023546-62.dat	upx
behavioral2/files/0x0007000000023545-56.dat	upx
behavioral2/files/0x0007000000023543-42.dat	upx
behavioral2/memory/4724-30-0x00007FF705400000-0x00007FF705751000-memory.dmp	upx
behavioral2/files/0x0007000000023540-29.dat	upx
behavioral2/files/0x000700000002353f-24.dat	upx
behavioral2/memory/4804-22-0x00007FF744420000-0x00007FF744771000-memory.dmp	upx
behavioral2/memory/1528-20-0x00007FF725920000-0x00007FF725C71000-memory.dmp	upx
behavioral2/files/0x000800000002353a-8.dat	upx
behavioral2/memory/3944-493-0x00007FF69B0E0000-0x00007FF69B431000-memory.dmp	upx
behavioral2/memory/5092-542-0x00007FF6311C0000-0x00007FF631511000-memory.dmp	upx
behavioral2/memory/3420-532-0x00007FF7D1400000-0x00007FF7D1751000-memory.dmp	upx
behavioral2/memory/1016-531-0x00007FF613AC0000-0x00007FF613E11000-memory.dmp	upx
behavioral2/memory/1776-522-0x00007FF636720000-0x00007FF636A71000-memory.dmp	upx
behavioral2/memory/2876-510-0x00007FF606BA0000-0x00007FF606EF1000-memory.dmp	upx
behavioral2/memory/1652-502-0x00007FF7E8DD0000-0x00007FF7E9121000-memory.dmp	upx
behavioral2/memory/4152-555-0x00007FF7F1570000-0x00007FF7F18C1000-memory.dmp	upx
behavioral2/memory/1780-596-0x00007FF722550000-0x00007FF7228A1000-memory.dmp	upx
behavioral2/memory/4836-613-0x00007FF64EFA0000-0x00007FF64F2F1000-memory.dmp	upx
behavioral2/memory/1416-618-0x00007FF6064A0000-0x00007FF6067F1000-memory.dmp	upx
behavioral2/memory/1972-606-0x00007FF7EE2A0000-0x00007FF7EE5F1000-memory.dmp	upx
behavioral2/memory/2612-600-0x00007FF6224C0000-0x00007FF622811000-memory.dmp	upx
behavioral2/memory/3092-569-0x00007FF680CE0000-0x00007FF681031000-memory.dmp	upx
behavioral2/memory/2104-552-0x00007FF76EF10000-0x00007FF76F261000-memory.dmp	upx
behavioral2/memory/1992-551-0x00007FF786FB0000-0x00007FF787301000-memory.dmp	upx
behavioral2/memory/32-548-0x00007FF7C5E00000-0x00007FF7C6151000-memory.dmp	upx
behavioral2/memory/5020-2169-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ixBeFuA.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sAMCsWm.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\fQoqsGs.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cpfaoIV.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\JxysEvi.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\gaOYxkx.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\KLjwuMY.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\MCPdoPQ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GdfcmuM.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\LDOOGKj.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\PUrQVWc.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\yLnElrQ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\xeayCat.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\jeBgxBK.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\jOHYUQh.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cdAzson.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GNgDvFg.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\iJEVuQn.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sCgVCgd.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\bXKRAQF.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\aXFUDTR.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CTOnQOZ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\SJSQzJc.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CkNNcWX.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\jBqnHIa.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cXuBbaQ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\aGuSTxX.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\hlrBGFf.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\YijdKWQ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\LafSdEX.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\OXOvkqj.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CcOImHg.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\hStUCJk.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\vIiLTMO.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cOtrjyH.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\WwVFvPT.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\DUqjZxc.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\fzIjECV.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\VQOpCYX.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CjinFoe.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CMpWVJD.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\WrrAwpu.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\BmRvcQM.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\RmGJmly.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\jniWKwG.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ehVOftn.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\xuyNaqN.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\uWyYxUL.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\mfmXscx.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ljTgdFR.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sOAxKSv.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\MjDkIAk.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\DzpoPxa.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\yarpMxP.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\UOeImWD.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\JDdUtcz.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\kcCWlNV.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\GsobAZl.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\lXxwgeI.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\vPDBsiA.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZyruUpy.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\WANuVLX.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\XFmBJeo.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\wPjHvZY.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 5020	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	91
PID 1620 wrote to memory of 5020	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	91
PID 1620 wrote to memory of 1528	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	92
PID 1620 wrote to memory of 1528	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	92
PID 1620 wrote to memory of 4804	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	93
PID 1620 wrote to memory of 4804	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	93
PID 1620 wrote to memory of 4724	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	94
PID 1620 wrote to memory of 4724	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	94
PID 1620 wrote to memory of 2920	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	95
PID 1620 wrote to memory of 2920	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	95
PID 1620 wrote to memory of 4836	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	96
PID 1620 wrote to memory of 4836	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	96
PID 1620 wrote to memory of 3476	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	97
PID 1620 wrote to memory of 3476	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	97
PID 1620 wrote to memory of 4968	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	98
PID 1620 wrote to memory of 4968	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	98
PID 1620 wrote to memory of 1416	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	99
PID 1620 wrote to memory of 1416	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	99
PID 1620 wrote to memory of 4812	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	100
PID 1620 wrote to memory of 4812	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	100
PID 1620 wrote to memory of 4168	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	101
PID 1620 wrote to memory of 4168	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	101
PID 1620 wrote to memory of 4160	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	102
PID 1620 wrote to memory of 4160	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	102
PID 1620 wrote to memory of 1096	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	103
PID 1620 wrote to memory of 1096	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	103
PID 1620 wrote to memory of 3080	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	104
PID 1620 wrote to memory of 3080	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	104
PID 1620 wrote to memory of 3944	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	105
PID 1620 wrote to memory of 3944	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	105
PID 1620 wrote to memory of 1652	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	106
PID 1620 wrote to memory of 1652	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	106
PID 1620 wrote to memory of 2876	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	107
PID 1620 wrote to memory of 2876	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	107
PID 1620 wrote to memory of 1776	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	108
PID 1620 wrote to memory of 1776	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	108
PID 1620 wrote to memory of 1016	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	109
PID 1620 wrote to memory of 1016	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	109
PID 1620 wrote to memory of 3420	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	110
PID 1620 wrote to memory of 3420	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	110
PID 1620 wrote to memory of 5092	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	111
PID 1620 wrote to memory of 5092	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	111
PID 1620 wrote to memory of 32	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	112
PID 1620 wrote to memory of 32	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	112
PID 1620 wrote to memory of 1992	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	113
PID 1620 wrote to memory of 1992	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	113
PID 1620 wrote to memory of 2104	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	114
PID 1620 wrote to memory of 2104	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	114
PID 1620 wrote to memory of 4152	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	115
PID 1620 wrote to memory of 4152	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	115
PID 1620 wrote to memory of 3092	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	116
PID 1620 wrote to memory of 3092	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	116
PID 1620 wrote to memory of 1780	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	117
PID 1620 wrote to memory of 1780	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	117
PID 1620 wrote to memory of 2612	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	118
PID 1620 wrote to memory of 2612	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	118
PID 1620 wrote to memory of 1972	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	119
PID 1620 wrote to memory of 1972	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	119
PID 1620 wrote to memory of 1596	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	120
PID 1620 wrote to memory of 1596	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	120
PID 1620 wrote to memory of 4292	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	121
PID 1620 wrote to memory of 4292	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	121
PID 1620 wrote to memory of 3000	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	122
PID 1620 wrote to memory of 3000	1620	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System\Imtvbpb.exe
  C:\Windows\System\Imtvbpb.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\jEnBcWq.exe
  C:\Windows\System\jEnBcWq.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\fJHwUTv.exe
  C:\Windows\System\fJHwUTv.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\vhJWHuU.exe
  C:\Windows\System\vhJWHuU.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\lBTtsbO.exe
  C:\Windows\System\lBTtsbO.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\rzYRGaM.exe
  C:\Windows\System\rzYRGaM.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\iJEVuQn.exe
  C:\Windows\System\iJEVuQn.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\zeTnvbx.exe
  C:\Windows\System\zeTnvbx.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\HZhDkqZ.exe
  C:\Windows\System\HZhDkqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\jTJRnzB.exe
  C:\Windows\System\jTJRnzB.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\ylMVbNy.exe
  C:\Windows\System\ylMVbNy.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\VROIXUH.exe
  C:\Windows\System\VROIXUH.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\tNhhLyU.exe
  C:\Windows\System\tNhhLyU.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\yRsoGtU.exe
  C:\Windows\System\yRsoGtU.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ixBeFuA.exe
  C:\Windows\System\ixBeFuA.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\UhlCMsI.exe
  C:\Windows\System\UhlCMsI.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\qVfKbjG.exe
  C:\Windows\System\qVfKbjG.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\lPkXkaV.exe
  C:\Windows\System\lPkXkaV.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\sCgVCgd.exe
  C:\Windows\System\sCgVCgd.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\VjYiXEX.exe
  C:\Windows\System\VjYiXEX.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\jqjcmsL.exe
  C:\Windows\System\jqjcmsL.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\bojEgGc.exe
  C:\Windows\System\bojEgGc.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\IFHLAiQ.exe
  C:\Windows\System\IFHLAiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\PUrQVWc.exe
  C:\Windows\System\PUrQVWc.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\KaxAZZQ.exe
  C:\Windows\System\KaxAZZQ.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\OHgWkxC.exe
  C:\Windows\System\OHgWkxC.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\UKSmnAv.exe
  C:\Windows\System\UKSmnAv.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\GOkTbaA.exe
  C:\Windows\System\GOkTbaA.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\iplnypE.exe
  C:\Windows\System\iplnypE.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\mJJJvPd.exe
  C:\Windows\System\mJJJvPd.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\uIApXpc.exe
  C:\Windows\System\uIApXpc.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\QbeODQP.exe
  C:\Windows\System\QbeODQP.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\pzoSBYD.exe
  C:\Windows\System\pzoSBYD.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\CVFOkQL.exe
  C:\Windows\System\CVFOkQL.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\eeSLWCn.exe
  C:\Windows\System\eeSLWCn.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\XwoxDIZ.exe
  C:\Windows\System\XwoxDIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\KqRzcKw.exe
  C:\Windows\System\KqRzcKw.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\InHbnYb.exe
  C:\Windows\System\InHbnYb.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\HzFUGBF.exe
  C:\Windows\System\HzFUGBF.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\cnSMafh.exe
  C:\Windows\System\cnSMafh.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\kytYkeK.exe
  C:\Windows\System\kytYkeK.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\UGQnNyN.exe
  C:\Windows\System\UGQnNyN.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\QTKHAWa.exe
  C:\Windows\System\QTKHAWa.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\KXYMdAn.exe
  C:\Windows\System\KXYMdAn.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\FVawulX.exe
  C:\Windows\System\FVawulX.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\dwjIXvB.exe
  C:\Windows\System\dwjIXvB.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\WFfxkCN.exe
  C:\Windows\System\WFfxkCN.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\wRzHNit.exe
  C:\Windows\System\wRzHNit.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\oFFDOZD.exe
  C:\Windows\System\oFFDOZD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\yHIcbOy.exe
  C:\Windows\System\yHIcbOy.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\OKBIzSG.exe
  C:\Windows\System\OKBIzSG.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\UOeImWD.exe
  C:\Windows\System\UOeImWD.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\QYYwWQe.exe
  C:\Windows\System\QYYwWQe.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\lXxwgeI.exe
  C:\Windows\System\lXxwgeI.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\WrbdjNq.exe
  C:\Windows\System\WrbdjNq.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\yLnElrQ.exe
  C:\Windows\System\yLnElrQ.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\atdRDej.exe
  C:\Windows\System\atdRDej.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\CfdexfG.exe
  C:\Windows\System\CfdexfG.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\TlSGnkY.exe
  C:\Windows\System\TlSGnkY.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\JxysEvi.exe
  C:\Windows\System\JxysEvi.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\sAMCsWm.exe
  C:\Windows\System\sAMCsWm.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\JDdUtcz.exe
  C:\Windows\System\JDdUtcz.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\LqBugPP.exe
  C:\Windows\System\LqBugPP.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\UAovhkd.exe
  C:\Windows\System\UAovhkd.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\WfCRPeP.exe
  C:\Windows\System\WfCRPeP.exe
  2⤵
  PID:5424
- C:\Windows\System\RAzAetl.exe
  C:\Windows\System\RAzAetl.exe
  2⤵
  PID:5452
- C:\Windows\System\msyJWwQ.exe
  C:\Windows\System\msyJWwQ.exe
  2⤵
  PID:5480
- C:\Windows\System\MdZiUsn.exe
  C:\Windows\System\MdZiUsn.exe
  2⤵
  PID:5508
- C:\Windows\System\rXGDdgB.exe
  C:\Windows\System\rXGDdgB.exe
  2⤵
  PID:5536
- C:\Windows\System\xeayCat.exe
  C:\Windows\System\xeayCat.exe
  2⤵
  PID:5564
- C:\Windows\System\QYCPJvO.exe
  C:\Windows\System\QYCPJvO.exe
  2⤵
  PID:5592
- C:\Windows\System\wPjHvZY.exe
  C:\Windows\System\wPjHvZY.exe
  2⤵
  PID:5620
- C:\Windows\System\ezXaKJA.exe
  C:\Windows\System\ezXaKJA.exe
  2⤵
  PID:5644
- C:\Windows\System\PPttqRG.exe
  C:\Windows\System\PPttqRG.exe
  2⤵
  PID:5676
- C:\Windows\System\xCHsxRO.exe
  C:\Windows\System\xCHsxRO.exe
  2⤵
  PID:5704
- C:\Windows\System\OHcgkVP.exe
  C:\Windows\System\OHcgkVP.exe
  2⤵
  PID:5732
- C:\Windows\System\GHTLbge.exe
  C:\Windows\System\GHTLbge.exe
  2⤵
  PID:5760
- C:\Windows\System\wCOSiLH.exe
  C:\Windows\System\wCOSiLH.exe
  2⤵
  PID:5788
- C:\Windows\System\Dimazad.exe
  C:\Windows\System\Dimazad.exe
  2⤵
  PID:5824
- C:\Windows\System\WmHNZCY.exe
  C:\Windows\System\WmHNZCY.exe
  2⤵
  PID:5844
- C:\Windows\System\ByNadye.exe
  C:\Windows\System\ByNadye.exe
  2⤵
  PID:5872
- C:\Windows\System\uqCOEzW.exe
  C:\Windows\System\uqCOEzW.exe
  2⤵
  PID:5900
- C:\Windows\System\DptBAlt.exe
  C:\Windows\System\DptBAlt.exe
  2⤵
  PID:5928
- C:\Windows\System\mMieMHp.exe
  C:\Windows\System\mMieMHp.exe
  2⤵
  PID:5956
- C:\Windows\System\OkCBhNr.exe
  C:\Windows\System\OkCBhNr.exe
  2⤵
  PID:5984
- C:\Windows\System\WiCImMG.exe
  C:\Windows\System\WiCImMG.exe
  2⤵
  PID:6012
- C:\Windows\System\Jgvstzl.exe
  C:\Windows\System\Jgvstzl.exe
  2⤵
  PID:6040
- C:\Windows\System\JTQdfFs.exe
  C:\Windows\System\JTQdfFs.exe
  2⤵
  PID:6068
- C:\Windows\System\cRQKegF.exe
  C:\Windows\System\cRQKegF.exe
  2⤵
  PID:6096
- C:\Windows\System\VKRVTwG.exe
  C:\Windows\System\VKRVTwG.exe
  2⤵
  PID:6120
- C:\Windows\System\ZyruUpy.exe
  C:\Windows\System\ZyruUpy.exe
  2⤵
  PID:4056
- C:\Windows\System\lhMTmeC.exe
  C:\Windows\System\lhMTmeC.exe
  2⤵
  PID:4232
- C:\Windows\System\AOEWIEb.exe
  C:\Windows\System\AOEWIEb.exe
  2⤵
  PID:4564
- C:\Windows\System\bnZGXMX.exe
  C:\Windows\System\bnZGXMX.exe
  2⤵
  PID:4956
- C:\Windows\System\tkuQjvK.exe
  C:\Windows\System\tkuQjvK.exe
  2⤵
  PID:4392
- C:\Windows\System\nBhxTGY.exe
  C:\Windows\System\nBhxTGY.exe
  2⤵
  PID:5184
- C:\Windows\System\gTgGGAL.exe
  C:\Windows\System\gTgGGAL.exe
  2⤵
  PID:5244
- C:\Windows\System\aMGodWQ.exe
  C:\Windows\System\aMGodWQ.exe
  2⤵
  PID:5300
- C:\Windows\System\DLhzsrG.exe
  C:\Windows\System\DLhzsrG.exe
  2⤵
  PID:5352
- C:\Windows\System\GcXjLhs.exe
  C:\Windows\System\GcXjLhs.exe
  2⤵
  PID:5408
- C:\Windows\System\UEhZCtC.exe
  C:\Windows\System\UEhZCtC.exe
  2⤵
  PID:5472
- C:\Windows\System\KzYHxeM.exe
  C:\Windows\System\KzYHxeM.exe
  2⤵
  PID:5528
- C:\Windows\System\oqZijQT.exe
  C:\Windows\System\oqZijQT.exe
  2⤵
  PID:4008
- C:\Windows\System\nGmLtxR.exe
  C:\Windows\System\nGmLtxR.exe
  2⤵
  PID:5660
- C:\Windows\System\yvpDRbL.exe
  C:\Windows\System\yvpDRbL.exe
  2⤵
  PID:2816
- C:\Windows\System\AKuJmxp.exe
  C:\Windows\System\AKuJmxp.exe
  2⤵
  PID:5752
- C:\Windows\System\CxAfjXG.exe
  C:\Windows\System\CxAfjXG.exe
  2⤵
  PID:2172
- C:\Windows\System\pFzYmiR.exe
  C:\Windows\System\pFzYmiR.exe
  2⤵
  PID:5860
- C:\Windows\System\vDstlra.exe
  C:\Windows\System\vDstlra.exe
  2⤵
  PID:5940
- C:\Windows\System\BZeyXeH.exe
  C:\Windows\System\BZeyXeH.exe
  2⤵
  PID:6000
- C:\Windows\System\sXkDssS.exe
  C:\Windows\System\sXkDssS.exe
  2⤵
  PID:6060
- C:\Windows\System\KWMYECk.exe
  C:\Windows\System\KWMYECk.exe
  2⤵
  PID:6116
- C:\Windows\System\FUypiDg.exe
  C:\Windows\System\FUypiDg.exe
  2⤵
  PID:4612
- C:\Windows\System\kcCWlNV.exe
  C:\Windows\System\kcCWlNV.exe
  2⤵
  PID:676
- C:\Windows\System\vALDNmM.exe
  C:\Windows\System\vALDNmM.exe
  2⤵
  PID:5164
- C:\Windows\System\mYEulvd.exe
  C:\Windows\System\mYEulvd.exe
  2⤵
  PID:5328
- C:\Windows\System\TzxDWyB.exe
  C:\Windows\System\TzxDWyB.exe
  2⤵
  PID:2256
- C:\Windows\System\pLfmraP.exe
  C:\Windows\System\pLfmraP.exe
  2⤵
  PID:5556
- C:\Windows\System\FmIFcQa.exe
  C:\Windows\System\FmIFcQa.exe
  2⤵
  PID:5612
- C:\Windows\System\Gspobux.exe
  C:\Windows\System\Gspobux.exe
  2⤵
  PID:5724
- C:\Windows\System\OXOvkqj.exe
  C:\Windows\System\OXOvkqj.exe
  2⤵
  PID:5108
- C:\Windows\System\gGFOtcZ.exe
  C:\Windows\System\gGFOtcZ.exe
  2⤵
  PID:5968
- C:\Windows\System\tyufVfG.exe
  C:\Windows\System\tyufVfG.exe
  2⤵
  PID:4296
- C:\Windows\System\nwbXvrG.exe
  C:\Windows\System\nwbXvrG.exe
  2⤵
  PID:4848
- C:\Windows\System\QMnMUUW.exe
  C:\Windows\System\QMnMUUW.exe
  2⤵
  PID:3324
- C:\Windows\System\sxqMERz.exe
  C:\Windows\System\sxqMERz.exe
  2⤵
  PID:5276
- C:\Windows\System\XoveeQB.exe
  C:\Windows\System\XoveeQB.exe
  2⤵
  PID:1700
- C:\Windows\System\jTtbVrx.exe
  C:\Windows\System\jTtbVrx.exe
  2⤵
  PID:464
- C:\Windows\System\WURkuYw.exe
  C:\Windows\System\WURkuYw.exe
  2⤵
  PID:1248
- C:\Windows\System\rSIENUz.exe
  C:\Windows\System\rSIENUz.exe
  2⤵
  PID:4728
- C:\Windows\System\pzlxGZo.exe
  C:\Windows\System\pzlxGZo.exe
  2⤵
  PID:3504
- C:\Windows\System\bXciWXu.exe
  C:\Windows\System\bXciWXu.exe
  2⤵
  PID:1472
- C:\Windows\System\pRUHcoX.exe
  C:\Windows\System\pRUHcoX.exe
  2⤵
  PID:3320
- C:\Windows\System\QPTEVrP.exe
  C:\Windows\System\QPTEVrP.exe
  2⤵
  PID:116
- C:\Windows\System\gtTEOiK.exe
  C:\Windows\System\gtTEOiK.exe
  2⤵
  PID:5464
- C:\Windows\System\EILxmeF.exe
  C:\Windows\System\EILxmeF.exe
  2⤵
  PID:4288
- C:\Windows\System\czLVnez.exe
  C:\Windows\System\czLVnez.exe
  2⤵
  PID:3052
- C:\Windows\System\OfxYnxS.exe
  C:\Windows\System\OfxYnxS.exe
  2⤵
  PID:232
- C:\Windows\System\TUjNgXV.exe
  C:\Windows\System\TUjNgXV.exe
  2⤵
  PID:1188
- C:\Windows\System\oFtsUXb.exe
  C:\Windows\System\oFtsUXb.exe
  2⤵
  PID:6156
- C:\Windows\System\SvWjENC.exe
  C:\Windows\System\SvWjENC.exe
  2⤵
  PID:6196
- C:\Windows\System\APqoOOf.exe
  C:\Windows\System\APqoOOf.exe
  2⤵
  PID:6228
- C:\Windows\System\DtPLsee.exe
  C:\Windows\System\DtPLsee.exe
  2⤵
  PID:6248
- C:\Windows\System\AxWTtvS.exe
  C:\Windows\System\AxWTtvS.exe
  2⤵
  PID:6276
- C:\Windows\System\fnFnmzA.exe
  C:\Windows\System\fnFnmzA.exe
  2⤵
  PID:6296
- C:\Windows\System\umsIKGi.exe
  C:\Windows\System\umsIKGi.exe
  2⤵
  PID:6312
- C:\Windows\System\ahzzNhJ.exe
  C:\Windows\System\ahzzNhJ.exe
  2⤵
  PID:6328
- C:\Windows\System\EtXytOc.exe
  C:\Windows\System\EtXytOc.exe
  2⤵
  PID:6380
- C:\Windows\System\BUBQFJx.exe
  C:\Windows\System\BUBQFJx.exe
  2⤵
  PID:6412
- C:\Windows\System\bAHMrwR.exe
  C:\Windows\System\bAHMrwR.exe
  2⤵
  PID:6428
- C:\Windows\System\nzOltKb.exe
  C:\Windows\System\nzOltKb.exe
  2⤵
  PID:6504
- C:\Windows\System\QDRownn.exe
  C:\Windows\System\QDRownn.exe
  2⤵
  PID:6532
- C:\Windows\System\cuSdikr.exe
  C:\Windows\System\cuSdikr.exe
  2⤵
  PID:6612
- C:\Windows\System\kmQBnKk.exe
  C:\Windows\System\kmQBnKk.exe
  2⤵
  PID:6628
- C:\Windows\System\aMpVLCs.exe
  C:\Windows\System\aMpVLCs.exe
  2⤵
  PID:6668
- C:\Windows\System\GfvqezU.exe
  C:\Windows\System\GfvqezU.exe
  2⤵
  PID:6740
- C:\Windows\System\GsobAZl.exe
  C:\Windows\System\GsobAZl.exe
  2⤵
  PID:6764
- C:\Windows\System\RMXjePh.exe
  C:\Windows\System\RMXjePh.exe
  2⤵
  PID:6780
- C:\Windows\System\iTzGiys.exe
  C:\Windows\System\iTzGiys.exe
  2⤵
  PID:6796
- C:\Windows\System\GVIbwXr.exe
  C:\Windows\System\GVIbwXr.exe
  2⤵
  PID:6816
- C:\Windows\System\JNquslY.exe
  C:\Windows\System\JNquslY.exe
  2⤵
  PID:6840
- C:\Windows\System\SwPIKEH.exe
  C:\Windows\System\SwPIKEH.exe
  2⤵
  PID:6908
- C:\Windows\System\vdUmyTP.exe
  C:\Windows\System\vdUmyTP.exe
  2⤵
  PID:6936
- C:\Windows\System\dEhVKXI.exe
  C:\Windows\System\dEhVKXI.exe
  2⤵
  PID:6952
- C:\Windows\System\uTPOqLE.exe
  C:\Windows\System\uTPOqLE.exe
  2⤵
  PID:6976
- C:\Windows\System\aywbuiG.exe
  C:\Windows\System\aywbuiG.exe
  2⤵
  PID:7004
- C:\Windows\System\CLHbFAx.exe
  C:\Windows\System\CLHbFAx.exe
  2⤵
  PID:7032
- C:\Windows\System\BqXRaxQ.exe
  C:\Windows\System\BqXRaxQ.exe
  2⤵
  PID:7064
- C:\Windows\System\GXCymgt.exe
  C:\Windows\System\GXCymgt.exe
  2⤵
  PID:7088
- C:\Windows\System\nXlozLY.exe
  C:\Windows\System\nXlozLY.exe
  2⤵
  PID:7116
- C:\Windows\System\kkalDnY.exe
  C:\Windows\System\kkalDnY.exe
  2⤵
  PID:7152
- C:\Windows\System\uOCsOEE.exe
  C:\Windows\System\uOCsOEE.exe
  2⤵
  PID:1832
- C:\Windows\System\hNDdRvj.exe
  C:\Windows\System\hNDdRvj.exe
  2⤵
  PID:5384
- C:\Windows\System\ENgcnxd.exe
  C:\Windows\System\ENgcnxd.exe
  2⤵
  PID:6340
- C:\Windows\System\UsDdrTQ.exe
  C:\Windows\System\UsDdrTQ.exe
  2⤵
  PID:6436
- C:\Windows\System\MhmLgIG.exe
  C:\Windows\System\MhmLgIG.exe
  2⤵
  PID:6308
- C:\Windows\System\DnxXpum.exe
  C:\Windows\System\DnxXpum.exe
  2⤵
  PID:6540
- C:\Windows\System\SGUzVcy.exe
  C:\Windows\System\SGUzVcy.exe
  2⤵
  PID:6732
- C:\Windows\System\ruKEMZE.exe
  C:\Windows\System\ruKEMZE.exe
  2⤵
  PID:6996
- C:\Windows\System\xedMIBc.exe
  C:\Windows\System\xedMIBc.exe
  2⤵
  PID:6948
- C:\Windows\System\FguLvgH.exe
  C:\Windows\System\FguLvgH.exe
  2⤵
  PID:6872
- C:\Windows\System\DKIIiZK.exe
  C:\Windows\System\DKIIiZK.exe
  2⤵
  PID:7048
- C:\Windows\System\iQoOYjm.exe
  C:\Windows\System\iQoOYjm.exe
  2⤵
  PID:7084
- C:\Windows\System\jniWKwG.exe
  C:\Windows\System\jniWKwG.exe
  2⤵
  PID:6152
- C:\Windows\System\xImacTz.exe
  C:\Windows\System\xImacTz.exe
  2⤵
  PID:6224
- C:\Windows\System\XGaTKQD.exe
  C:\Windows\System\XGaTKQD.exe
  2⤵
  PID:6304
- C:\Windows\System\VEmvYlT.exe
  C:\Windows\System\VEmvYlT.exe
  2⤵
  PID:6292
- C:\Windows\System\iSLDzpL.exe
  C:\Windows\System\iSLDzpL.exe
  2⤵
  PID:6724
- C:\Windows\System\UwTsfFF.exe
  C:\Windows\System\UwTsfFF.exe
  2⤵
  PID:6364
- C:\Windows\System\JiuJfgj.exe
  C:\Windows\System\JiuJfgj.exe
  2⤵
  PID:6968
- C:\Windows\System\YNzTvRw.exe
  C:\Windows\System\YNzTvRw.exe
  2⤵
  PID:6832
- C:\Windows\System\tLLOzFo.exe
  C:\Windows\System\tLLOzFo.exe
  2⤵
  PID:1704
- C:\Windows\System\YpzGGvl.exe
  C:\Windows\System\YpzGGvl.exe
  2⤵
  PID:6168
- C:\Windows\System\NUmPlpw.exe
  C:\Windows\System\NUmPlpw.exe
  2⤵
  PID:6760
- C:\Windows\System\rQYOgBj.exe
  C:\Windows\System\rQYOgBj.exe
  2⤵
  PID:6904
- C:\Windows\System\YYJSvoW.exe
  C:\Windows\System\YYJSvoW.exe
  2⤵
  PID:7180
- C:\Windows\System\DtwxsAU.exe
  C:\Windows\System\DtwxsAU.exe
  2⤵
  PID:7196
- C:\Windows\System\FQyjcui.exe
  C:\Windows\System\FQyjcui.exe
  2⤵
  PID:7216
- C:\Windows\System\dafWnXX.exe
  C:\Windows\System\dafWnXX.exe
  2⤵
  PID:7244
- C:\Windows\System\BDEqxHZ.exe
  C:\Windows\System\BDEqxHZ.exe
  2⤵
  PID:7260
- C:\Windows\System\qrSRcAg.exe
  C:\Windows\System\qrSRcAg.exe
  2⤵
  PID:7280
- C:\Windows\System\ydOdmds.exe
  C:\Windows\System\ydOdmds.exe
  2⤵
  PID:7296
- C:\Windows\System\BskMllW.exe
  C:\Windows\System\BskMllW.exe
  2⤵
  PID:7316
- C:\Windows\System\ntdcMJY.exe
  C:\Windows\System\ntdcMJY.exe
  2⤵
  PID:7348
- C:\Windows\System\qkBCvZt.exe
  C:\Windows\System\qkBCvZt.exe
  2⤵
  PID:7372
- C:\Windows\System\JSOOmrA.exe
  C:\Windows\System\JSOOmrA.exe
  2⤵
  PID:7392
- C:\Windows\System\jMhvZkg.exe
  C:\Windows\System\jMhvZkg.exe
  2⤵
  PID:7456
- C:\Windows\System\CcOImHg.exe
  C:\Windows\System\CcOImHg.exe
  2⤵
  PID:7476
- C:\Windows\System\tzrHfki.exe
  C:\Windows\System\tzrHfki.exe
  2⤵
  PID:7500
- C:\Windows\System\NDSTJIc.exe
  C:\Windows\System\NDSTJIc.exe
  2⤵
  PID:7520
- C:\Windows\System\cLeLfrn.exe
  C:\Windows\System\cLeLfrn.exe
  2⤵
  PID:7584
- C:\Windows\System\oYXaubn.exe
  C:\Windows\System\oYXaubn.exe
  2⤵
  PID:7604
- C:\Windows\System\oZkurET.exe
  C:\Windows\System\oZkurET.exe
  2⤵
  PID:7628
- C:\Windows\System\RALscsp.exe
  C:\Windows\System\RALscsp.exe
  2⤵
  PID:7648
- C:\Windows\System\WpPVJiu.exe
  C:\Windows\System\WpPVJiu.exe
  2⤵
  PID:7672
- C:\Windows\System\SQcVqcZ.exe
  C:\Windows\System\SQcVqcZ.exe
  2⤵
  PID:7716
- C:\Windows\System\xvXjBqe.exe
  C:\Windows\System\xvXjBqe.exe
  2⤵
  PID:7748
- C:\Windows\System\ybHshQx.exe
  C:\Windows\System\ybHshQx.exe
  2⤵
  PID:7772
- C:\Windows\System\jmAhIhE.exe
  C:\Windows\System\jmAhIhE.exe
  2⤵
  PID:7824
- C:\Windows\System\oUkRBhD.exe
  C:\Windows\System\oUkRBhD.exe
  2⤵
  PID:7864
- C:\Windows\System\ssNuBaF.exe
  C:\Windows\System\ssNuBaF.exe
  2⤵
  PID:7884
- C:\Windows\System\NZMcdmI.exe
  C:\Windows\System\NZMcdmI.exe
  2⤵
  PID:7908
- C:\Windows\System\MmOtRFb.exe
  C:\Windows\System\MmOtRFb.exe
  2⤵
  PID:7944
- C:\Windows\System\MVAbuPd.exe
  C:\Windows\System\MVAbuPd.exe
  2⤵
  PID:7972
- C:\Windows\System\fzIjECV.exe
  C:\Windows\System\fzIjECV.exe
  2⤵
  PID:7992
- C:\Windows\System\NeNuKyF.exe
  C:\Windows\System\NeNuKyF.exe
  2⤵
  PID:8012
- C:\Windows\System\IxkqHLn.exe
  C:\Windows\System\IxkqHLn.exe
  2⤵
  PID:8032
- C:\Windows\System\bXFcZSh.exe
  C:\Windows\System\bXFcZSh.exe
  2⤵
  PID:8076
- C:\Windows\System\cPwaTvE.exe
  C:\Windows\System\cPwaTvE.exe
  2⤵
  PID:8116
- C:\Windows\System\YdnXXLV.exe
  C:\Windows\System\YdnXXLV.exe
  2⤵
  PID:8136
- C:\Windows\System\GwYRaSM.exe
  C:\Windows\System\GwYRaSM.exe
  2⤵
  PID:8152
- C:\Windows\System\vnUpMdh.exe
  C:\Windows\System\vnUpMdh.exe
  2⤵
  PID:8180
- C:\Windows\System\onjFXzA.exe
  C:\Windows\System\onjFXzA.exe
  2⤵
  PID:6824
- C:\Windows\System\SRUzbkW.exe
  C:\Windows\System\SRUzbkW.exe
  2⤵
  PID:7204
- C:\Windows\System\NwhKoCg.exe
  C:\Windows\System\NwhKoCg.exe
  2⤵
  PID:7228
- C:\Windows\System\EqThWvr.exe
  C:\Windows\System\EqThWvr.exe
  2⤵
  PID:7292
- C:\Windows\System\zlbvybP.exe
  C:\Windows\System\zlbvybP.exe
  2⤵
  PID:7488
- C:\Windows\System\kkMSfKk.exe
  C:\Windows\System\kkMSfKk.exe
  2⤵
  PID:7432
- C:\Windows\System\RQlsWPS.exe
  C:\Windows\System\RQlsWPS.exe
  2⤵
  PID:7600
- C:\Windows\System\tlYAeyP.exe
  C:\Windows\System\tlYAeyP.exe
  2⤵
  PID:7612
- C:\Windows\System\mYzCcqk.exe
  C:\Windows\System\mYzCcqk.exe
  2⤵
  PID:7704
- C:\Windows\System\byPFPKB.exe
  C:\Windows\System\byPFPKB.exe
  2⤵
  PID:7744
- C:\Windows\System\oGFQRYw.exe
  C:\Windows\System\oGFQRYw.exe
  2⤵
  PID:7812
- C:\Windows\System\mPALTQU.exe
  C:\Windows\System\mPALTQU.exe
  2⤵
  PID:7892
- C:\Windows\System\gdISdxU.exe
  C:\Windows\System\gdISdxU.exe
  2⤵
  PID:7968
- C:\Windows\System\yAPjBYW.exe
  C:\Windows\System\yAPjBYW.exe
  2⤵
  PID:8048
- C:\Windows\System\gZiLkHj.exe
  C:\Windows\System\gZiLkHj.exe
  2⤵
  PID:8024
- C:\Windows\System\DPlXvkp.exe
  C:\Windows\System\DPlXvkp.exe
  2⤵
  PID:8068
- C:\Windows\System\tUYEfxE.exe
  C:\Windows\System\tUYEfxE.exe
  2⤵
  PID:7224
- C:\Windows\System\VLHHJbH.exe
  C:\Windows\System\VLHHJbH.exe
  2⤵
  PID:8188
- C:\Windows\System\GzDxZme.exe
  C:\Windows\System\GzDxZme.exe
  2⤵
  PID:7404
- C:\Windows\System\XHmihQl.exe
  C:\Windows\System\XHmihQl.exe
  2⤵
  PID:7516
- C:\Windows\System\DqcOTZb.exe
  C:\Windows\System\DqcOTZb.exe
  2⤵
  PID:7644
- C:\Windows\System\cRYOCYN.exe
  C:\Windows\System\cRYOCYN.exe
  2⤵
  PID:7956
- C:\Windows\System\vZtXsTD.exe
  C:\Windows\System\vZtXsTD.exe
  2⤵
  PID:8124
- C:\Windows\System\LwFaavd.exe
  C:\Windows\System\LwFaavd.exe
  2⤵
  PID:7308
- C:\Windows\System\vssxYLm.exe
  C:\Windows\System\vssxYLm.exe
  2⤵
  PID:7804
- C:\Windows\System\mAYwgar.exe
  C:\Windows\System\mAYwgar.exe
  2⤵
  PID:8100
- C:\Windows\System\RCAufUw.exe
  C:\Windows\System\RCAufUw.exe
  2⤵
  PID:7984
- C:\Windows\System\ehVOftn.exe
  C:\Windows\System\ehVOftn.exe
  2⤵
  PID:8212
- C:\Windows\System\sOAxKSv.exe
  C:\Windows\System\sOAxKSv.exe
  2⤵
  PID:8240
- C:\Windows\System\DkjFXBt.exe
  C:\Windows\System\DkjFXBt.exe
  2⤵
  PID:8260
- C:\Windows\System\XThkcBQ.exe
  C:\Windows\System\XThkcBQ.exe
  2⤵
  PID:8300
- C:\Windows\System\cXuBbaQ.exe
  C:\Windows\System\cXuBbaQ.exe
  2⤵
  PID:8320
- C:\Windows\System\zSsMwIp.exe
  C:\Windows\System\zSsMwIp.exe
  2⤵
  PID:8348
- C:\Windows\System\lzbUacZ.exe
  C:\Windows\System\lzbUacZ.exe
  2⤵
  PID:8372
- C:\Windows\System\yEtmYOG.exe
  C:\Windows\System\yEtmYOG.exe
  2⤵
  PID:8400
- C:\Windows\System\pRLJAJS.exe
  C:\Windows\System\pRLJAJS.exe
  2⤵
  PID:8432
- C:\Windows\System\JnxXrIW.exe
  C:\Windows\System\JnxXrIW.exe
  2⤵
  PID:8452
- C:\Windows\System\QJfQuEa.exe
  C:\Windows\System\QJfQuEa.exe
  2⤵
  PID:8552
- C:\Windows\System\lFyEaqW.exe
  C:\Windows\System\lFyEaqW.exe
  2⤵
  PID:8572
- C:\Windows\System\fYnSxSD.exe
  C:\Windows\System\fYnSxSD.exe
  2⤵
  PID:8592
- C:\Windows\System\yKJYYHl.exe
  C:\Windows\System\yKJYYHl.exe
  2⤵
  PID:8612
- C:\Windows\System\EpKJFeF.exe
  C:\Windows\System\EpKJFeF.exe
  2⤵
  PID:8636
- C:\Windows\System\KRhZiJf.exe
  C:\Windows\System\KRhZiJf.exe
  2⤵
  PID:8668
- C:\Windows\System\aGuSTxX.exe
  C:\Windows\System\aGuSTxX.exe
  2⤵
  PID:8684
- C:\Windows\System\iHViySq.exe
  C:\Windows\System\iHViySq.exe
  2⤵
  PID:8728
- C:\Windows\System\FklMZal.exe
  C:\Windows\System\FklMZal.exe
  2⤵
  PID:8748
- C:\Windows\System\wlHyFTV.exe
  C:\Windows\System\wlHyFTV.exe
  2⤵
  PID:8772
- C:\Windows\System\wmewSsp.exe
  C:\Windows\System\wmewSsp.exe
  2⤵
  PID:8800
- C:\Windows\System\wnzpdcR.exe
  C:\Windows\System\wnzpdcR.exe
  2⤵
  PID:8820
- C:\Windows\System\cJeAdoh.exe
  C:\Windows\System\cJeAdoh.exe
  2⤵
  PID:8844
- C:\Windows\System\nODgKwu.exe
  C:\Windows\System\nODgKwu.exe
  2⤵
  PID:8864
- C:\Windows\System\zVYZAsL.exe
  C:\Windows\System\zVYZAsL.exe
  2⤵
  PID:8892
- C:\Windows\System\Zgqjcic.exe
  C:\Windows\System\Zgqjcic.exe
  2⤵
  PID:8908
- C:\Windows\System\qovRnnY.exe
  C:\Windows\System\qovRnnY.exe
  2⤵
  PID:8940
- C:\Windows\System\fTYzTaj.exe
  C:\Windows\System\fTYzTaj.exe
  2⤵
  PID:8968
- C:\Windows\System\OfFAWWJ.exe
  C:\Windows\System\OfFAWWJ.exe
  2⤵
  PID:8988
- C:\Windows\System\HIUshZH.exe
  C:\Windows\System\HIUshZH.exe
  2⤵
  PID:9064
- C:\Windows\System\UgXWzyO.exe
  C:\Windows\System\UgXWzyO.exe
  2⤵
  PID:9100
- C:\Windows\System\MRBFwuZ.exe
  C:\Windows\System\MRBFwuZ.exe
  2⤵
  PID:9128
- C:\Windows\System\CdEKXeK.exe
  C:\Windows\System\CdEKXeK.exe
  2⤵
  PID:9148
- C:\Windows\System\ZUHXWHy.exe
  C:\Windows\System\ZUHXWHy.exe
  2⤵
  PID:9164
- C:\Windows\System\Pmogwxs.exe
  C:\Windows\System\Pmogwxs.exe
  2⤵
  PID:9204
- C:\Windows\System\AngHLQH.exe
  C:\Windows\System\AngHLQH.exe
  2⤵
  PID:7424
- C:\Windows\System\dGmGEhx.exe
  C:\Windows\System\dGmGEhx.exe
  2⤵
  PID:7356
- C:\Windows\System\vpqtrvH.exe
  C:\Windows\System\vpqtrvH.exe
  2⤵
  PID:8296
- C:\Windows\System\tUUTkNa.exe
  C:\Windows\System\tUUTkNa.exe
  2⤵
  PID:8360
- C:\Windows\System\SRsskcU.exe
  C:\Windows\System\SRsskcU.exe
  2⤵
  PID:8424
- C:\Windows\System\UeWZaYD.exe
  C:\Windows\System\UeWZaYD.exe
  2⤵
  PID:8488
- C:\Windows\System\gCLqmhu.exe
  C:\Windows\System\gCLqmhu.exe
  2⤵
  PID:8560
- C:\Windows\System\WujACoQ.exe
  C:\Windows\System\WujACoQ.exe
  2⤵
  PID:8608
- C:\Windows\System\UHWXMpZ.exe
  C:\Windows\System\UHWXMpZ.exe
  2⤵
  PID:8632
- C:\Windows\System\OmfgqnK.exe
  C:\Windows\System\OmfgqnK.exe
  2⤵
  PID:8712
- C:\Windows\System\oBIhWjA.exe
  C:\Windows\System\oBIhWjA.exe
  2⤵
  PID:8760
- C:\Windows\System\IbimjLU.exe
  C:\Windows\System\IbimjLU.exe
  2⤵
  PID:8816
- C:\Windows\System\IXMxbZG.exe
  C:\Windows\System\IXMxbZG.exe
  2⤵
  PID:8872
- C:\Windows\System\gmBduBw.exe
  C:\Windows\System\gmBduBw.exe
  2⤵
  PID:8984
- C:\Windows\System\yQjeKcD.exe
  C:\Windows\System\yQjeKcD.exe
  2⤵
  PID:9072
- C:\Windows\System\jthxUgn.exe
  C:\Windows\System\jthxUgn.exe
  2⤵
  PID:9108
- C:\Windows\System\cGUoARV.exe
  C:\Windows\System\cGUoARV.exe
  2⤵
  PID:9136
- C:\Windows\System\mXYJSob.exe
  C:\Windows\System\mXYJSob.exe
  2⤵
  PID:9192
- C:\Windows\System\zrAeeMt.exe
  C:\Windows\System\zrAeeMt.exe
  2⤵
  PID:8208
- C:\Windows\System\jeBgxBK.exe
  C:\Windows\System\jeBgxBK.exe
  2⤵
  PID:8384
- C:\Windows\System\OsMYwOI.exe
  C:\Windows\System\OsMYwOI.exe
  2⤵
  PID:8484
- C:\Windows\System\BrjSsDX.exe
  C:\Windows\System\BrjSsDX.exe
  2⤵
  PID:8600
- C:\Windows\System\qhyGNcP.exe
  C:\Windows\System\qhyGNcP.exe
  2⤵
  PID:8764
- C:\Windows\System\sQtHUmC.exe
  C:\Windows\System\sQtHUmC.exe
  2⤵
  PID:8900
- C:\Windows\System\AkXMQDv.exe
  C:\Windows\System\AkXMQDv.exe
  2⤵
  PID:9124
- C:\Windows\System\xaERXjl.exe
  C:\Windows\System\xaERXjl.exe
  2⤵
  PID:9140
- C:\Windows\System\rOLHTdE.exe
  C:\Windows\System\rOLHTdE.exe
  2⤵
  PID:8516
- C:\Windows\System\LNioEOl.exe
  C:\Windows\System\LNioEOl.exe
  2⤵
  PID:7000
- C:\Windows\System\jiNYbTD.exe
  C:\Windows\System\jiNYbTD.exe
  2⤵
  PID:9228
- C:\Windows\System\SpzvAko.exe
  C:\Windows\System\SpzvAko.exe
  2⤵
  PID:9248
- C:\Windows\System\NUhrmkZ.exe
  C:\Windows\System\NUhrmkZ.exe
  2⤵
  PID:9272
- C:\Windows\System\UbArNeE.exe
  C:\Windows\System\UbArNeE.exe
  2⤵
  PID:9288
- C:\Windows\System\IWSylYm.exe
  C:\Windows\System\IWSylYm.exe
  2⤵
  PID:9324
- C:\Windows\System\AkYCZBp.exe
  C:\Windows\System\AkYCZBp.exe
  2⤵
  PID:9364
- C:\Windows\System\hksTkUW.exe
  C:\Windows\System\hksTkUW.exe
  2⤵
  PID:9404
- C:\Windows\System\bXVKoiM.exe
  C:\Windows\System\bXVKoiM.exe
  2⤵
  PID:9420
- C:\Windows\System\TqeFsyV.exe
  C:\Windows\System\TqeFsyV.exe
  2⤵
  PID:9464
- C:\Windows\System\fQoqsGs.exe
  C:\Windows\System\fQoqsGs.exe
  2⤵
  PID:9484
- C:\Windows\System\QuBVhme.exe
  C:\Windows\System\QuBVhme.exe
  2⤵
  PID:9516
- C:\Windows\System\piYCJCk.exe
  C:\Windows\System\piYCJCk.exe
  2⤵
  PID:9544
- C:\Windows\System\xuyNaqN.exe
  C:\Windows\System\xuyNaqN.exe
  2⤵
  PID:9564
- C:\Windows\System\neYmhMW.exe
  C:\Windows\System\neYmhMW.exe
  2⤵
  PID:9584
- C:\Windows\System\sYcpoiM.exe
  C:\Windows\System\sYcpoiM.exe
  2⤵
  PID:9608
- C:\Windows\System\vkdoIaZ.exe
  C:\Windows\System\vkdoIaZ.exe
  2⤵
  PID:9624
- C:\Windows\System\UFhiHKD.exe
  C:\Windows\System\UFhiHKD.exe
  2⤵
  PID:9656
- C:\Windows\System\BYPDPEI.exe
  C:\Windows\System\BYPDPEI.exe
  2⤵
  PID:9676
- C:\Windows\System\rGOwXjt.exe
  C:\Windows\System\rGOwXjt.exe
  2⤵
  PID:9728
- C:\Windows\System\LbmBxZG.exe
  C:\Windows\System\LbmBxZG.exe
  2⤵
  PID:9752
- C:\Windows\System\WJlfRRp.exe
  C:\Windows\System\WJlfRRp.exe
  2⤵
  PID:9772
- C:\Windows\System\pCCZncd.exe
  C:\Windows\System\pCCZncd.exe
  2⤵
  PID:9792
- C:\Windows\System\BpxMQcd.exe
  C:\Windows\System\BpxMQcd.exe
  2⤵
  PID:9832
- C:\Windows\System\xcrHywv.exe
  C:\Windows\System\xcrHywv.exe
  2⤵
  PID:9852
- C:\Windows\System\HbXFFOc.exe
  C:\Windows\System\HbXFFOc.exe
  2⤵
  PID:9880
- C:\Windows\System\hlrBGFf.exe
  C:\Windows\System\hlrBGFf.exe
  2⤵
  PID:9928
- C:\Windows\System\SSjXRFx.exe
  C:\Windows\System\SSjXRFx.exe
  2⤵
  PID:9964
- C:\Windows\System\xCRaxNU.exe
  C:\Windows\System\xCRaxNU.exe
  2⤵
  PID:10000
- C:\Windows\System\gYNCWEH.exe
  C:\Windows\System\gYNCWEH.exe
  2⤵
  PID:10048
- C:\Windows\System\smWEQsQ.exe
  C:\Windows\System\smWEQsQ.exe
  2⤵
  PID:10076
- C:\Windows\System\MoCMRJu.exe
  C:\Windows\System\MoCMRJu.exe
  2⤵
  PID:10100
- C:\Windows\System\XLaladV.exe
  C:\Windows\System\XLaladV.exe
  2⤵
  PID:10116
- C:\Windows\System\rjWWUAq.exe
  C:\Windows\System\rjWWUAq.exe
  2⤵
  PID:10144
- C:\Windows\System\fLWAZnj.exe
  C:\Windows\System\fLWAZnj.exe
  2⤵
  PID:10160
- C:\Windows\System\JzaiOXv.exe
  C:\Windows\System\JzaiOXv.exe
  2⤵
  PID:10192
- C:\Windows\System\MjDkIAk.exe
  C:\Windows\System\MjDkIAk.exe
  2⤵
  PID:10208
- C:\Windows\System\builvwn.exe
  C:\Windows\System\builvwn.exe
  2⤵
  PID:10224
- C:\Windows\System\GaQWSnE.exe
  C:\Windows\System\GaQWSnE.exe
  2⤵
  PID:8744
- C:\Windows\System\wXnATPD.exe
  C:\Windows\System\wXnATPD.exe
  2⤵
  PID:9080
- C:\Windows\System\jIYVaEd.exe
  C:\Windows\System\jIYVaEd.exe
  2⤵
  PID:9280
- C:\Windows\System\jPwZNeS.exe
  C:\Windows\System\jPwZNeS.exe
  2⤵
  PID:9392
- C:\Windows\System\SwRKhRc.exe
  C:\Windows\System\SwRKhRc.exe
  2⤵
  PID:9356
- C:\Windows\System\lXAEXLT.exe
  C:\Windows\System\lXAEXLT.exe
  2⤵
  PID:9504
- C:\Windows\System\pvxuRnQ.exe
  C:\Windows\System\pvxuRnQ.exe
  2⤵
  PID:9604
- C:\Windows\System\VGRauzY.exe
  C:\Windows\System\VGRauzY.exe
  2⤵
  PID:9672
- C:\Windows\System\CIChfXD.exe
  C:\Windows\System\CIChfXD.exe
  2⤵
  PID:9736
- C:\Windows\System\PlbfNJj.exe
  C:\Windows\System\PlbfNJj.exe
  2⤵
  PID:9844
- C:\Windows\System\VIXVMfN.exe
  C:\Windows\System\VIXVMfN.exe
  2⤵
  PID:9888
- C:\Windows\System\LtxkDSe.exe
  C:\Windows\System\LtxkDSe.exe
  2⤵
  PID:9924
- C:\Windows\System\UaOHYiR.exe
  C:\Windows\System\UaOHYiR.exe
  2⤵
  PID:9996
- C:\Windows\System\zvKdbHd.exe
  C:\Windows\System\zvKdbHd.exe
  2⤵
  PID:10072
- C:\Windows\System\hStUCJk.exe
  C:\Windows\System\hStUCJk.exe
  2⤵
  PID:10200
- C:\Windows\System\qtTtPoT.exe
  C:\Windows\System\qtTtPoT.exe
  2⤵
  PID:10188
- C:\Windows\System\pRslWXf.exe
  C:\Windows\System\pRslWXf.exe
  2⤵
  PID:9240
- C:\Windows\System\elkdxoL.exe
  C:\Windows\System\elkdxoL.exe
  2⤵
  PID:9256
- C:\Windows\System\AuLkPCc.exe
  C:\Windows\System\AuLkPCc.exe
  2⤵
  PID:9648
- C:\Windows\System\KBjaByB.exe
  C:\Windows\System\KBjaByB.exe
  2⤵
  PID:9740
- C:\Windows\System\dSbOeQx.exe
  C:\Windows\System\dSbOeQx.exe
  2⤵
  PID:9876
- C:\Windows\System\VNkJoDO.exe
  C:\Windows\System\VNkJoDO.exe
  2⤵
  PID:9920
- C:\Windows\System\KigpiEx.exe
  C:\Windows\System\KigpiEx.exe
  2⤵
  PID:10184
- C:\Windows\System\CuGlcfb.exe
  C:\Windows\System\CuGlcfb.exe
  2⤵
  PID:9264
- C:\Windows\System\fKDiubj.exe
  C:\Windows\System\fKDiubj.exe
  2⤵
  PID:9380
- C:\Windows\System\WANuVLX.exe
  C:\Windows\System\WANuVLX.exe
  2⤵
  PID:9744
- C:\Windows\System\bDitdpO.exe
  C:\Windows\System\bDitdpO.exe
  2⤵
  PID:10244
- C:\Windows\System\cibQaUl.exe
  C:\Windows\System\cibQaUl.exe
  2⤵
  PID:10264
- C:\Windows\System\MYUnwki.exe
  C:\Windows\System\MYUnwki.exe
  2⤵
  PID:10312
- C:\Windows\System\OPSovgF.exe
  C:\Windows\System\OPSovgF.exe
  2⤵
  PID:10368
- C:\Windows\System\JJPCjkx.exe
  C:\Windows\System\JJPCjkx.exe
  2⤵
  PID:10388
- C:\Windows\System\SIBcJIc.exe
  C:\Windows\System\SIBcJIc.exe
  2⤵
  PID:10412
- C:\Windows\System\ryTlevd.exe
  C:\Windows\System\ryTlevd.exe
  2⤵
  PID:10436
- C:\Windows\System\pVPXAdU.exe
  C:\Windows\System\pVPXAdU.exe
  2⤵
  PID:10464
- C:\Windows\System\hkAxXvr.exe
  C:\Windows\System\hkAxXvr.exe
  2⤵
  PID:10484
- C:\Windows\System\PpdvyBe.exe
  C:\Windows\System\PpdvyBe.exe
  2⤵
  PID:10508
- C:\Windows\System\EKQePNr.exe
  C:\Windows\System\EKQePNr.exe
  2⤵
  PID:10532
- C:\Windows\System\rCzqxoI.exe
  C:\Windows\System\rCzqxoI.exe
  2⤵
  PID:10552
- C:\Windows\System\PTLsPmW.exe
  C:\Windows\System\PTLsPmW.exe
  2⤵
  PID:10572
- C:\Windows\System\PepyGfd.exe
  C:\Windows\System\PepyGfd.exe
  2⤵
  PID:10596
- C:\Windows\System\cYxpHyX.exe
  C:\Windows\System\cYxpHyX.exe
  2⤵
  PID:10636
- C:\Windows\System\MCPdoPQ.exe
  C:\Windows\System\MCPdoPQ.exe
  2⤵
  PID:10652
- C:\Windows\System\JMOuESL.exe
  C:\Windows\System\JMOuESL.exe
  2⤵
  PID:10716
- C:\Windows\System\hVeMSbx.exe
  C:\Windows\System\hVeMSbx.exe
  2⤵
  PID:10748
- C:\Windows\System\GUqXTIZ.exe
  C:\Windows\System\GUqXTIZ.exe
  2⤵
  PID:10780
- C:\Windows\System\NjLAKIm.exe
  C:\Windows\System\NjLAKIm.exe
  2⤵
  PID:10820
- C:\Windows\System\upGBddM.exe
  C:\Windows\System\upGBddM.exe
  2⤵
  PID:10852
- C:\Windows\System\TZeEsta.exe
  C:\Windows\System\TZeEsta.exe
  2⤵
  PID:10888
- C:\Windows\System\KiKFuTW.exe
  C:\Windows\System\KiKFuTW.exe
  2⤵
  PID:10912
- C:\Windows\System\HXZKmMd.exe
  C:\Windows\System\HXZKmMd.exe
  2⤵
  PID:10932
- C:\Windows\System\SkfsVnM.exe
  C:\Windows\System\SkfsVnM.exe
  2⤵
  PID:10972
- C:\Windows\System\GdfcmuM.exe
  C:\Windows\System\GdfcmuM.exe
  2⤵
  PID:10996
- C:\Windows\System\XTsIMqI.exe
  C:\Windows\System\XTsIMqI.exe
  2⤵
  PID:11016
- C:\Windows\System\jEiIzDy.exe
  C:\Windows\System\jEiIzDy.exe
  2⤵
  PID:11036
- C:\Windows\System\eEGnSYV.exe
  C:\Windows\System\eEGnSYV.exe
  2⤵
  PID:11052
- C:\Windows\System\jbsFjwc.exe
  C:\Windows\System\jbsFjwc.exe
  2⤵
  PID:11076
- C:\Windows\System\dCAintO.exe
  C:\Windows\System\dCAintO.exe
  2⤵
  PID:11116
- C:\Windows\System\vzjxVGh.exe
  C:\Windows\System\vzjxVGh.exe
  2⤵
  PID:11136
- C:\Windows\System\VQOpCYX.exe
  C:\Windows\System\VQOpCYX.exe
  2⤵
  PID:11160
- C:\Windows\System\fWENFdW.exe
  C:\Windows\System\fWENFdW.exe
  2⤵
  PID:11224
- C:\Windows\System\tzOPnii.exe
  C:\Windows\System\tzOPnii.exe
  2⤵
  PID:11244
- C:\Windows\System\enBQcpX.exe
  C:\Windows\System\enBQcpX.exe
  2⤵
  PID:9992
- C:\Windows\System\bXKRAQF.exe
  C:\Windows\System\bXKRAQF.exe
  2⤵
  PID:9636
- C:\Windows\System\kEfDfoc.exe
  C:\Windows\System\kEfDfoc.exe
  2⤵
  PID:10448
- C:\Windows\System\beooxgN.exe
  C:\Windows\System\beooxgN.exe
  2⤵
  PID:10584
- C:\Windows\System\XUgonRL.exe
  C:\Windows\System\XUgonRL.exe
  2⤵
  PID:10544
- C:\Windows\System\FqpBTPO.exe
  C:\Windows\System\FqpBTPO.exe
  2⤵
  PID:10628
- C:\Windows\System\cOtrjyH.exe
  C:\Windows\System\cOtrjyH.exe
  2⤵
  PID:10648
- C:\Windows\System\lemPokR.exe
  C:\Windows\System\lemPokR.exe
  2⤵
  PID:10700
- C:\Windows\System\uWyYxUL.exe
  C:\Windows\System\uWyYxUL.exe
  2⤵
  PID:10740
- C:\Windows\System\aXFUDTR.exe
  C:\Windows\System\aXFUDTR.exe
  2⤵
  PID:10804
- C:\Windows\System\vPDBsiA.exe
  C:\Windows\System\vPDBsiA.exe
  2⤵
  PID:10816
- C:\Windows\System\HLOVCmM.exe
  C:\Windows\System\HLOVCmM.exe
  2⤵
  PID:10864
- C:\Windows\System\LMFuGtQ.exe
  C:\Windows\System\LMFuGtQ.exe
  2⤵
  PID:10924
- C:\Windows\System\RPUFPXM.exe
  C:\Windows\System\RPUFPXM.exe
  2⤵
  PID:10948
- C:\Windows\System\OYmehhG.exe
  C:\Windows\System\OYmehhG.exe
  2⤵
  PID:10980
- C:\Windows\System\CMpWVJD.exe
  C:\Windows\System\CMpWVJD.exe
  2⤵
  PID:11024
- C:\Windows\System\ccWejtx.exe
  C:\Windows\System\ccWejtx.exe
  2⤵
  PID:11060
- C:\Windows\System\tFgWPEu.exe
  C:\Windows\System\tFgWPEu.exe
  2⤵
  PID:11072
- C:\Windows\System\hEeyiAK.exe
  C:\Windows\System\hEeyiAK.exe
  2⤵
  PID:11132
- C:\Windows\System\goIIoFi.exe
  C:\Windows\System\goIIoFi.exe
  2⤵
  PID:10152
- C:\Windows\System\DzpoPxa.exe
  C:\Windows\System\DzpoPxa.exe
  2⤵
  PID:10516
- C:\Windows\System\FuPSvLQ.exe
  C:\Windows\System\FuPSvLQ.exe
  2⤵
  PID:10252
- C:\Windows\System\BYtvvQU.exe
  C:\Windows\System\BYtvvQU.exe
  2⤵
  PID:10324
- C:\Windows\System\DoitkOl.exe
  C:\Windows\System\DoitkOl.exe
  2⤵
  PID:10848
- C:\Windows\System\EzKBNVc.exe
  C:\Windows\System\EzKBNVc.exe
  2⤵
  PID:10528
- C:\Windows\System\hgmejPA.exe
  C:\Windows\System\hgmejPA.exe
  2⤵
  PID:11084
- C:\Windows\System\pERmQFh.exe
  C:\Windows\System\pERmQFh.exe
  2⤵
  PID:11256
- C:\Windows\System\YijdKWQ.exe
  C:\Windows\System\YijdKWQ.exe
  2⤵
  PID:11268
- C:\Windows\System\KxSdeDr.exe
  C:\Windows\System\KxSdeDr.exe
  2⤵
  PID:11288
- C:\Windows\System\QyeogvR.exe
  C:\Windows\System\QyeogvR.exe
  2⤵
  PID:11364
- C:\Windows\System\JPVKaBy.exe
  C:\Windows\System\JPVKaBy.exe
  2⤵
  PID:11384
- C:\Windows\System\XKQIPpV.exe
  C:\Windows\System\XKQIPpV.exe
  2⤵
  PID:11416
- C:\Windows\System\ebwGSsk.exe
  C:\Windows\System\ebwGSsk.exe
  2⤵
  PID:11432
- C:\Windows\System\RzkMdWy.exe
  C:\Windows\System\RzkMdWy.exe
  2⤵
  PID:11456
- C:\Windows\System\CSLOlpL.exe
  C:\Windows\System\CSLOlpL.exe
  2⤵
  PID:11516
- C:\Windows\System\ySuKoAY.exe
  C:\Windows\System\ySuKoAY.exe
  2⤵
  PID:11540
- C:\Windows\System\yKFbbwT.exe
  C:\Windows\System\yKFbbwT.exe
  2⤵
  PID:11556
- C:\Windows\System\nKjaorv.exe
  C:\Windows\System\nKjaorv.exe
  2⤵
  PID:11588
- C:\Windows\System\wQAOhnO.exe
  C:\Windows\System\wQAOhnO.exe
  2⤵
  PID:11608
- C:\Windows\System\CjinFoe.exe
  C:\Windows\System\CjinFoe.exe
  2⤵
  PID:11628
- C:\Windows\System\JwUZycO.exe
  C:\Windows\System\JwUZycO.exe
  2⤵
  PID:11660
- C:\Windows\System\LHZLNPa.exe
  C:\Windows\System\LHZLNPa.exe
  2⤵
  PID:11684
- C:\Windows\System\KRaThpV.exe
  C:\Windows\System\KRaThpV.exe
  2⤵
  PID:11704
- C:\Windows\System\Esohjmf.exe
  C:\Windows\System\Esohjmf.exe
  2⤵
  PID:11724
- C:\Windows\System\JygWbFZ.exe
  C:\Windows\System\JygWbFZ.exe
  2⤵
  PID:11784
- C:\Windows\System\PWnaltQ.exe
  C:\Windows\System\PWnaltQ.exe
  2⤵
  PID:11804
- C:\Windows\System\CPPlqyF.exe
  C:\Windows\System\CPPlqyF.exe
  2⤵
  PID:11844
- C:\Windows\System\hMhoaNL.exe
  C:\Windows\System\hMhoaNL.exe
  2⤵
  PID:11868
- C:\Windows\System\GctCWnK.exe
  C:\Windows\System\GctCWnK.exe
  2⤵
  PID:11884
- C:\Windows\System\nmESQOe.exe
  C:\Windows\System\nmESQOe.exe
  2⤵
  PID:11920
- C:\Windows\System\FvaWSBL.exe
  C:\Windows\System\FvaWSBL.exe
  2⤵
  PID:11944
- C:\Windows\System\bAKnnIC.exe
  C:\Windows\System\bAKnnIC.exe
  2⤵
  PID:11988
- C:\Windows\System\fgUlAye.exe
  C:\Windows\System\fgUlAye.exe
  2⤵
  PID:12012
- C:\Windows\System\zVxruhP.exe
  C:\Windows\System\zVxruhP.exe
  2⤵
  PID:12032
- C:\Windows\System\hIBCNym.exe
  C:\Windows\System\hIBCNym.exe
  2⤵
  PID:12080
- C:\Windows\System\wZYEeJW.exe
  C:\Windows\System\wZYEeJW.exe
  2⤵
  PID:12108
- C:\Windows\System\rstMCkM.exe
  C:\Windows\System\rstMCkM.exe
  2⤵
  PID:12132
- C:\Windows\System\oVFJnwm.exe
  C:\Windows\System\oVFJnwm.exe
  2⤵
  PID:12152
- C:\Windows\System\gaOYxkx.exe
  C:\Windows\System\gaOYxkx.exe
  2⤵
  PID:12184
- C:\Windows\System\iHmjZBm.exe
  C:\Windows\System\iHmjZBm.exe
  2⤵
  PID:12204
- C:\Windows\System\cpfaoIV.exe
  C:\Windows\System\cpfaoIV.exe
  2⤵
  PID:12220
- C:\Windows\System\jiCjUeI.exe
  C:\Windows\System\jiCjUeI.exe
  2⤵
  PID:12240
- C:\Windows\System\teWbYxI.exe
  C:\Windows\System\teWbYxI.exe
  2⤵
  PID:12268
- C:\Windows\System\xbpSMlt.exe
  C:\Windows\System\xbpSMlt.exe
  2⤵
  PID:10768
- C:\Windows\System\CTOnQOZ.exe
  C:\Windows\System\CTOnQOZ.exe
  2⤵
  PID:9912
- C:\Windows\System\vyvZzaW.exe
  C:\Windows\System\vyvZzaW.exe
  2⤵
  PID:10988
- C:\Windows\System\DVSeryV.exe
  C:\Windows\System\DVSeryV.exe
  2⤵
  PID:11108
- C:\Windows\System\zAjEGdF.exe
  C:\Windows\System\zAjEGdF.exe
  2⤵
  PID:11308
- C:\Windows\System\nIfQKZs.exe
  C:\Windows\System\nIfQKZs.exe
  2⤵
  PID:11356
- C:\Windows\System\rgbgFBS.exe
  C:\Windows\System\rgbgFBS.exe
  2⤵
  PID:11496
- C:\Windows\System\gzOIYyC.exe
  C:\Windows\System\gzOIYyC.exe
  2⤵
  PID:11716
- C:\Windows\System\iuRMrsy.exe
  C:\Windows\System\iuRMrsy.exe
  2⤵
  PID:11700
- C:\Windows\System\KLkOlop.exe
  C:\Windows\System\KLkOlop.exe
  2⤵
  PID:11796
- C:\Windows\System\hjBbRJH.exe
  C:\Windows\System\hjBbRJH.exe
  2⤵
  PID:11832
- C:\Windows\System\fEHMNDB.exe
  C:\Windows\System\fEHMNDB.exe
  2⤵
  PID:11876
- C:\Windows\System\unPKmUr.exe
  C:\Windows\System\unPKmUr.exe
  2⤵
  PID:11996
- C:\Windows\System\ZCJtYFV.exe
  C:\Windows\System\ZCJtYFV.exe
  2⤵
  PID:12044
- C:\Windows\System\hTpJvtz.exe
  C:\Windows\System\hTpJvtz.exe
  2⤵
  PID:12096
- C:\Windows\System\VBvuIwY.exe
  C:\Windows\System\VBvuIwY.exe
  2⤵
  PID:12164
- C:\Windows\System\OhOxWpJ.exe
  C:\Windows\System\OhOxWpJ.exe
  2⤵
  PID:12276
- C:\Windows\System\pquZQGM.exe
  C:\Windows\System\pquZQGM.exe
  2⤵
  PID:12264
- C:\Windows\System\DQxxZsc.exe
  C:\Windows\System\DQxxZsc.exe
  2⤵
  PID:11048
- C:\Windows\System\GKPvdJt.exe
  C:\Windows\System\GKPvdJt.exe
  2⤵
  PID:11376
- C:\Windows\System\vlFVvDo.exe
  C:\Windows\System\vlFVvDo.exe
  2⤵
  PID:11548
- C:\Windows\System\iAGntAJ.exe
  C:\Windows\System\iAGntAJ.exe
  2⤵
  PID:11752
- C:\Windows\System\dwOCkij.exe
  C:\Windows\System\dwOCkij.exe
  2⤵
  PID:11764
- C:\Windows\System\MXFxaNu.exe
  C:\Windows\System\MXFxaNu.exe
  2⤵
  PID:11880
- C:\Windows\System\GuHBxSJ.exe
  C:\Windows\System\GuHBxSJ.exe
  2⤵
  PID:12148
- C:\Windows\System\SJSQzJc.exe
  C:\Windows\System\SJSQzJc.exe
  2⤵
  PID:12260
- C:\Windows\System\ykXYQkE.exe
  C:\Windows\System\ykXYQkE.exe
  2⤵
  PID:11504
- C:\Windows\System\vIiLTMO.exe
  C:\Windows\System\vIiLTMO.exe
  2⤵
  PID:11676
- C:\Windows\System\ckYioIA.exe
  C:\Windows\System\ckYioIA.exe
  2⤵
  PID:12124
- C:\Windows\System\bQNYPMb.exe
  C:\Windows\System\bQNYPMb.exe
  2⤵
  PID:12236
- C:\Windows\System\LafSdEX.exe
  C:\Windows\System\LafSdEX.exe
  2⤵
  PID:11960
- C:\Windows\System\WSECfYW.exe
  C:\Windows\System\WSECfYW.exe
  2⤵
  PID:12320
- C:\Windows\System\oryJuPY.exe
  C:\Windows\System\oryJuPY.exe
  2⤵
  PID:12352
- C:\Windows\System\FkLvXrC.exe
  C:\Windows\System\FkLvXrC.exe
  2⤵
  PID:12376
- C:\Windows\System\ynRDWmD.exe
  C:\Windows\System\ynRDWmD.exe
  2⤵
  PID:12392
- C:\Windows\System\faENojf.exe
  C:\Windows\System\faENojf.exe
  2⤵
  PID:12412
- C:\Windows\System\oqSRUUB.exe
  C:\Windows\System\oqSRUUB.exe
  2⤵
  PID:12448
- C:\Windows\System\FdpPCcr.exe
  C:\Windows\System\FdpPCcr.exe
  2⤵
  PID:12468
- C:\Windows\System\pRriLLv.exe
  C:\Windows\System\pRriLLv.exe
  2⤵
  PID:12492
- C:\Windows\System\kxzkaQp.exe
  C:\Windows\System\kxzkaQp.exe
  2⤵
  PID:12512
- C:\Windows\System\WrrAwpu.exe
  C:\Windows\System\WrrAwpu.exe
  2⤵
  PID:12532
- C:\Windows\System\nPfbVIJ.exe
  C:\Windows\System\nPfbVIJ.exe
  2⤵
  PID:12556
- C:\Windows\System\hGZVvxO.exe
  C:\Windows\System\hGZVvxO.exe
  2⤵
  PID:12600
- C:\Windows\System\HwOoMwy.exe
  C:\Windows\System\HwOoMwy.exe
  2⤵
  PID:12632
- C:\Windows\System\jJLgYmN.exe
  C:\Windows\System\jJLgYmN.exe
  2⤵
  PID:12664
- C:\Windows\System\AKojDou.exe
  C:\Windows\System\AKojDou.exe
  2⤵
  PID:12692
- C:\Windows\System\lIhUkDQ.exe
  C:\Windows\System\lIhUkDQ.exe
  2⤵
  PID:12716
- C:\Windows\System\jyZcUMM.exe
  C:\Windows\System\jyZcUMM.exe
  2⤵
  PID:12740
- C:\Windows\System\ZfRlBQN.exe
  C:\Windows\System\ZfRlBQN.exe
  2⤵
  PID:12756
- C:\Windows\System\yzUSIyE.exe
  C:\Windows\System\yzUSIyE.exe
  2⤵
  PID:12772
- C:\Windows\System\BmRvcQM.exe
  C:\Windows\System\BmRvcQM.exe
  2⤵
  PID:12816
- C:\Windows\System\VUAPVvx.exe
  C:\Windows\System\VUAPVvx.exe
  2⤵
  PID:12848
- C:\Windows\System\vDYWhdl.exe
  C:\Windows\System\vDYWhdl.exe
  2⤵
  PID:12872
- C:\Windows\System\EVmsCBs.exe
  C:\Windows\System\EVmsCBs.exe
  2⤵
  PID:12916
- C:\Windows\System\rcHQgCV.exe
  C:\Windows\System\rcHQgCV.exe
  2⤵
  PID:12948
- C:\Windows\System\ARaVaJs.exe
  C:\Windows\System\ARaVaJs.exe
  2⤵
  PID:12964
- C:\Windows\System\maaAvRE.exe
  C:\Windows\System\maaAvRE.exe
  2⤵
  PID:12984
- C:\Windows\System\TVABEpS.exe
  C:\Windows\System\TVABEpS.exe
  2⤵
  PID:13016
- C:\Windows\System\ABnCgZs.exe
  C:\Windows\System\ABnCgZs.exe
  2⤵
  PID:13040
- C:\Windows\System\qMqHqNA.exe
  C:\Windows\System\qMqHqNA.exe
  2⤵
  PID:13096
- C:\Windows\System\qxFtzhZ.exe
  C:\Windows\System\qxFtzhZ.exe
  2⤵
  PID:13164
- C:\Windows\System\nKyrXQx.exe
  C:\Windows\System\nKyrXQx.exe
  2⤵
  PID:13180
- C:\Windows\System\FNzMbaH.exe
  C:\Windows\System\FNzMbaH.exe
  2⤵
  PID:13196
- C:\Windows\System\sLpWEol.exe
  C:\Windows\System\sLpWEol.exe
  2⤵
  PID:13216
- C:\Windows\System\XFmBJeo.exe
  C:\Windows\System\XFmBJeo.exe
  2⤵
  PID:13240
- C:\Windows\System\xVrlpnT.exe
  C:\Windows\System\xVrlpnT.exe
  2⤵
  PID:13272
- C:\Windows\System\RgmmqEM.exe
  C:\Windows\System\RgmmqEM.exe
  2⤵
  PID:13292
- C:\Windows\System\zVYQGtb.exe
  C:\Windows\System\zVYQGtb.exe
  2⤵
  PID:13308
- C:\Windows\System\vHoPNwg.exe
  C:\Windows\System\vHoPNwg.exe
  2⤵
  PID:12372
- C:\Windows\System\NPEAYlS.exe
  C:\Windows\System\NPEAYlS.exe
  2⤵
  PID:11580
- C:\Windows\System\AkxtQZt.exe
  C:\Windows\System\AkxtQZt.exe
  2⤵
  PID:12432
- C:\Windows\System\nEAHiBc.exe
  C:\Windows\System\nEAHiBc.exe
  2⤵
  PID:12524
- C:\Windows\System\ByXNZhR.exe
  C:\Windows\System\ByXNZhR.exe
  2⤵
  PID:12528
- C:\Windows\System\mguGjDi.exe
  C:\Windows\System\mguGjDi.exe
  2⤵
  PID:12588
- C:\Windows\System\VBWNnHl.exe
  C:\Windows\System\VBWNnHl.exe
  2⤵
  PID:12624
- C:\Windows\System\dYCnWde.exe
  C:\Windows\System\dYCnWde.exe
  2⤵
  PID:12724
- C:\Windows\System\utYKcxw.exe
  C:\Windows\System\utYKcxw.exe
  2⤵
  PID:12808
- C:\Windows\System\FbElJPO.exe
  C:\Windows\System\FbElJPO.exe
  2⤵
  PID:12784
- C:\Windows\System\MMXKNvL.exe
  C:\Windows\System\MMXKNvL.exe
  2⤵
  PID:12824
- C:\Windows\System\fqBkBec.exe
  C:\Windows\System\fqBkBec.exe
  2⤵
  PID:12996
- C:\Windows\System\jpWsfOv.exe
  C:\Windows\System\jpWsfOv.exe
  2⤵
  PID:13036
- C:\Windows\System\ymDfXvG.exe
  C:\Windows\System\ymDfXvG.exe
  2⤵
  PID:13172
- C:\Windows\System\KlSgNZr.exe
  C:\Windows\System\KlSgNZr.exe
  2⤵
  PID:13232
- C:\Windows\System\RfPhXfR.exe
  C:\Windows\System\RfPhXfR.exe
  2⤵
  PID:13300
- C:\Windows\System\haeEMDs.exe
  C:\Windows\System\haeEMDs.exe
  2⤵
  PID:13304
- C:\Windows\System\abBanHt.exe
  C:\Windows\System\abBanHt.exe
  2⤵
  PID:12360
- C:\Windows\System\hjPkDZQ.exe
  C:\Windows\System\hjPkDZQ.exe
  2⤵
  PID:12520
- C:\Windows\System\CkNNcWX.exe
  C:\Windows\System\CkNNcWX.exe
  2⤵
  PID:12860
- C:\Windows\System\bWrajON.exe
  C:\Windows\System\bWrajON.exe
  2⤵
  PID:12908
- C:\Windows\System\DRRQEpX.exe
  C:\Windows\System\DRRQEpX.exe
  2⤵
  PID:13188
- C:\Windows\System\hveNFio.exe
  C:\Windows\System\hveNFio.exe
  2⤵
  PID:13208
- C:\Windows\System\iguoSYJ.exe
  C:\Windows\System\iguoSYJ.exe
  2⤵
  PID:12880
- C:\Windows\System\EyieDlS.exe
  C:\Windows\System\EyieDlS.exe
  2⤵
  PID:13060
- C:\Windows\System\enykYFQ.exe
  C:\Windows\System\enykYFQ.exe
  2⤵
  PID:13316
- C:\Windows\System\fQUuvYX.exe
  C:\Windows\System\fQUuvYX.exe
  2⤵
  PID:13336
- C:\Windows\System\eizFjLk.exe
  C:\Windows\System\eizFjLk.exe
  2⤵
  PID:13356
- C:\Windows\System\iXbyVig.exe
  C:\Windows\System\iXbyVig.exe
  2⤵
  PID:13376
- C:\Windows\System\RaCKdxz.exe
  C:\Windows\System\RaCKdxz.exe
  2⤵
  PID:13400
- C:\Windows\System\gfIirQR.exe
  C:\Windows\System\gfIirQR.exe
  2⤵
  PID:13444
- C:\Windows\System\euzvzHz.exe
  C:\Windows\System\euzvzHz.exe
  2⤵
  PID:13468
- C:\Windows\System\yYzyJnl.exe
  C:\Windows\System\yYzyJnl.exe
  2⤵
  PID:13488
- C:\Windows\System\CwwDtoL.exe
  C:\Windows\System\CwwDtoL.exe
  2⤵
  PID:13516
- C:\Windows\System\eJMQARJ.exe
  C:\Windows\System\eJMQARJ.exe
  2⤵
  PID:13536
- C:\Windows\System\XnnwNpW.exe
  C:\Windows\System\XnnwNpW.exe
  2⤵
  PID:13564
- C:\Windows\System\LDOOGKj.exe
  C:\Windows\System\LDOOGKj.exe
  2⤵
  PID:13596
- C:\Windows\System\FSGWOug.exe
  C:\Windows\System\FSGWOug.exe
  2⤵
  PID:13616
- C:\Windows\System\oEUkZgK.exe
  C:\Windows\System\oEUkZgK.exe
  2⤵
  PID:13644
- C:\Windows\System\VVsNDlA.exe
  C:\Windows\System\VVsNDlA.exe
  2⤵
  PID:13664
- C:\Windows\System\WjWBDJS.exe
  C:\Windows\System\WjWBDJS.exe
  2⤵
  PID:13700
- C:\Windows\System\dIWxBUk.exe
  C:\Windows\System\dIWxBUk.exe
  2⤵
  PID:13724
- C:\Windows\System\awLBVYe.exe
  C:\Windows\System\awLBVYe.exe
  2⤵
  PID:13740
- C:\Windows\System\PSAhYyu.exe
  C:\Windows\System\PSAhYyu.exe
  2⤵
  PID:13768
- C:\Windows\System\PpRKoDQ.exe
  C:\Windows\System\PpRKoDQ.exe
  2⤵
  PID:13792
- C:\Windows\System\jOHYUQh.exe
  C:\Windows\System\jOHYUQh.exe
  2⤵
  PID:13812
- C:\Windows\System\RiQcmAg.exe
  C:\Windows\System\RiQcmAg.exe
  2⤵
  PID:13856
- C:\Windows\System\SJVZbRD.exe
  C:\Windows\System\SJVZbRD.exe
  2⤵
  PID:13892
- C:\Windows\System\bKtkhxj.exe
  C:\Windows\System\bKtkhxj.exe
  2⤵
  PID:13916
- C:\Windows\System\jcvHgNK.exe
  C:\Windows\System\jcvHgNK.exe
  2⤵
  PID:13944
- C:\Windows\System\jXCXXOO.exe
  C:\Windows\System\jXCXXOO.exe
  2⤵
  PID:14000
- C:\Windows\System\rGNSYwQ.exe
  C:\Windows\System\rGNSYwQ.exe
  2⤵
  PID:14020
- C:\Windows\System\yarpMxP.exe
  C:\Windows\System\yarpMxP.exe
  2⤵
  PID:14040
- C:\Windows\System\eXlxTIe.exe
  C:\Windows\System\eXlxTIe.exe
  2⤵
  PID:14068
- C:\Windows\System\CwYUtXj.exe
  C:\Windows\System\CwYUtXj.exe
  2⤵
  PID:14100
- C:\Windows\System\SKZuuwe.exe
  C:\Windows\System\SKZuuwe.exe
  2⤵
  PID:14148
- C:\Windows\System\KYxdnEH.exe
  C:\Windows\System\KYxdnEH.exe
  2⤵
  PID:14168
- C:\Windows\System\rfjJiMu.exe
  C:\Windows\System\rfjJiMu.exe
  2⤵
  PID:14196
- C:\Windows\System\WhhDNGl.exe
  C:\Windows\System\WhhDNGl.exe
  2⤵
  PID:14220
- C:\Windows\System\eGZbCao.exe
  C:\Windows\System\eGZbCao.exe
  2⤵
  PID:14248
- C:\Windows\System\KLjwuMY.exe
  C:\Windows\System\KLjwuMY.exe
  2⤵
  PID:14268
- C:\Windows\System\YUQdsGm.exe
  C:\Windows\System\YUQdsGm.exe
  2⤵
  PID:14324
- C:\Windows\System\cdAzson.exe
  C:\Windows\System\cdAzson.exe
  2⤵
  PID:13156
- C:\Windows\System\AgtPBBq.exe
  C:\Windows\System\AgtPBBq.exe
  2⤵
  PID:13372
- C:\Windows\System\HPxzRLR.exe
  C:\Windows\System\HPxzRLR.exe
  2⤵
  PID:13452
- C:\Windows\System\ABUkfKl.exe
  C:\Windows\System\ABUkfKl.exe
  2⤵
  PID:13480
- C:\Windows\System\dponBqa.exe
  C:\Windows\System\dponBqa.exe
  2⤵
  PID:13528
- C:\Windows\System\bvSgNHg.exe
  C:\Windows\System\bvSgNHg.exe
  2⤵
  PID:13628
- C:\Windows\System\VJcqPLk.exe
  C:\Windows\System\VJcqPLk.exe
  2⤵
  PID:13672
- C:\Windows\System\RmGJmly.exe
  C:\Windows\System\RmGJmly.exe
  2⤵
  PID:2832
- C:\Windows\System\vHCkomI.exe
  C:\Windows\System\vHCkomI.exe
  2⤵
  PID:13720
- C:\Windows\System\QfIeLQQ.exe
  C:\Windows\System\QfIeLQQ.exe
  2⤵
  PID:13752
- C:\Windows\System\VLWcImZ.exe
  C:\Windows\System\VLWcImZ.exe
  2⤵
  PID:13788
- C:\Windows\System\XTuEtSU.exe
  C:\Windows\System\XTuEtSU.exe
  2⤵
  PID:2360
- C:\Windows\System\bzSFNnH.exe
  C:\Windows\System\bzSFNnH.exe
  2⤵
  PID:14012
- C:\Windows\System\hFgwrnb.exe
  C:\Windows\System\hFgwrnb.exe
  2⤵
  PID:14064
- C:\Windows\System\lFlbUMr.exe
  C:\Windows\System\lFlbUMr.exe
  2⤵
  PID:14128
- C:\Windows\System\iuFmLOq.exe
  C:\Windows\System\iuFmLOq.exe
  2⤵
  PID:14116
- C:\Windows\System\zOlnqOr.exe
  C:\Windows\System\zOlnqOr.exe
  2⤵
  PID:14188
- C:\Windows\System\BTdupKq.exe
  C:\Windows\System\BTdupKq.exe
  2⤵
  PID:14240
- C:\Windows\System\WwVFvPT.exe
  C:\Windows\System\WwVFvPT.exe
  2⤵
  PID:13288
- C:\Windows\System\gavlUYK.exe
  C:\Windows\System\gavlUYK.exe
  2⤵
  PID:12552
- C:\Windows\System\xDUVgfE.exe
  C:\Windows\System\xDUVgfE.exe
  2⤵
  PID:13432
- C:\Windows\System\FyWMCaq.exe
  C:\Windows\System\FyWMCaq.exe
  2⤵
  PID:13656
- C:\Windows\System\yuJSbzS.exe
  C:\Windows\System\yuJSbzS.exe
  2⤵
  PID:13660
- C:\Windows\System\dRiLlUY.exe
  C:\Windows\System\dRiLlUY.exe
  2⤵
  PID:13784
- C:\Windows\System\NuMjVdZ.exe
  C:\Windows\System\NuMjVdZ.exe
  2⤵
  PID:14080
- C:\Windows\System\CGQOApw.exe
  C:\Windows\System\CGQOApw.exe
  2⤵
  PID:13328
- C:\Windows\System\AGcDMlT.exe
  C:\Windows\System\AGcDMlT.exe
  2⤵
  PID:13580
- C:\Windows\System\DtTDpdN.exe
  C:\Windows\System\DtTDpdN.exe
  2⤵
  PID:12444
- C:\Windows\System\iaysboX.exe
  C:\Windows\System\iaysboX.exe
  2⤵
  PID:14176
- C:\Windows\System\iXHRYxV.exe
  C:\Windows\System\iXHRYxV.exe
  2⤵
  PID:13504
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13504 -s 248
    3⤵
    PID:15044
- C:\Windows\System\aGOPDDd.exe
  C:\Windows\System\aGOPDDd.exe
  2⤵
  PID:14360
- C:\Windows\System\gOKikKJ.exe
  C:\Windows\System\gOKikKJ.exe
  2⤵
  PID:14380
- C:\Windows\System\JVxtHyE.exe
  C:\Windows\System\JVxtHyE.exe
  2⤵
  PID:14404
- C:\Windows\System\SppOiLg.exe
  C:\Windows\System\SppOiLg.exe
  2⤵
  PID:14420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
1⤵
PID:5840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GOkTbaA.exe

Filesize
1.4MB

MD5
015d4b59332990717dc04d4f33cb511a

SHA1
ae38c2cc61181a3fc0d02d0419d255f244572a44

SHA256
d9734007e79e9e697f9e9389c8c423cf993def2560808edc5956deaa93a7cd8f

SHA512
a28c76a222bf03c6cad8f00eb97cc4ddf7f585845e50ba7a7a314a205cf74219a8a20f686a894523017b078342f8fd0d798bf68ca3d0d625c3e3a83146ed8484

Download Submit
C:\Windows\System\HZhDkqZ.exe

Filesize
1.4MB

MD5
1bb76aefcbda13febea9820bd8a2924a

SHA1
9a327b03d2cd5082deb5c2e359311fd0831e8e44

SHA256
2c5fd812dfa26da0263327ee4512cc4cff883d52adc8c3fe950657d79364c932

SHA512
99c84d5276f7b3f85de6cfeb00fc904139e92c1bab47e2d497c32002da9cb0c6a66d3fc175bc3728da3751317028d94dc42efc5f0b59644d7075259c1b5107b0

Download Submit
C:\Windows\System\IFHLAiQ.exe

Filesize
1.4MB

MD5
9f29b2fd18041a17a82075f5531145c7

SHA1
e93153a7cfb1caaac7a6f099c747912f0b6fb8a3

SHA256
bf6168d42e5272709bea19af81b219c649b40c71005b8de4872385ff736ef0dd

SHA512
a306f195fffbe7abfa05e69327228f2c7873030337735f24f90175058cc17e9d93e794ff5601f4be96e76e74c6167e0644bcd76bb33b01a20236e50919be7a26

Download Submit
C:\Windows\System\Imtvbpb.exe

Filesize
1.4MB

MD5
fa367bfd1112964e61794a22b5f9084a

SHA1
da84c925a6d96ebac9f1767e2562c516e4294b5b

SHA256
216a9be49823cff65b8e81677ebe498308966a8d845f7b26408d3ece24c4a8fe

SHA512
dc72fedf203abf720392ded6cb352f63dd4d32134cb07cb7ae62a4efc074cd3ddd1ae8244ec224bfa82d5f2e81f1404440b56661eb383ebabef09b0aac1f6d1e

Download Submit
C:\Windows\System\KaxAZZQ.exe

Filesize
1.4MB

MD5
dfb755e84bafea8050fd573cd0f323d2

SHA1
434f0cefb06b18d7cc92dd73bad31b9a5b1ba6b2

SHA256
bc4cbf22690dbaaf833708ef49c24a2d642505885008c98b2dfad946281a9eea

SHA512
a1b9e10751cfdd507098048decba3eef9ce25e431cdbf9d32a677cb4d8b5fbd0f118d5c5a6da6dbfbcfd9af4c5293ef59a1e177ab1e6446d267ccd8348fa0689

Download Submit
C:\Windows\System\OHgWkxC.exe

Filesize
1.4MB

MD5
0f1058c3fe4732a5ed848e6a7e8df4bf

SHA1
d0a11c72e04dfe65ae55927c039ee3c41c1a31b9

SHA256
edc96efffc6777776398003f9c8cb9f8020b289cceddd8029aa1e568c4717e8b

SHA512
2cd3bc279fa7a5c02d3d9006bffdb64a4dce4aca651a337bdb263442e50f7f7490822e6b1c6361d82fc21b7f3aa31bda71384ce2fe1cf22210dacaef2d6c9748

Download Submit
C:\Windows\System\PUrQVWc.exe

Filesize
1.4MB

MD5
1d08957f59c5e6e1536aaae2e07ea589

SHA1
c4834decaa2219da97ce50522ab314928e2c4b48

SHA256
26e5b5a09d1b5415af7b19e92d5a01b9086eeed6e11e813069167f62f4d33037

SHA512
25fd956024502252e45900c808d6b70cf94f7719d5badf27beef71659c723cdebf1847074038e947daea042624c6e719708a1d34663a3e0078a209a6ed415773

Download Submit
C:\Windows\System\QbeODQP.exe

Filesize
1.4MB

MD5
49a72d3cd449576abb5cbbbff7b8e624

SHA1
b86b86d3180ac05f35560ba896e373b00a12d198

SHA256
9e12540e85b5a7b7e2cffdf881bdd5ca081c36f720f80d078dfbab9844f986c2

SHA512
94c372a5d65586b963661ec020363e94039ad3cb6623ac62f9df551e2949cbe4be47b228d53f1568c565098398f0724c1cdbc0b74699ef3b2dda7215b1e90931

Download Submit
C:\Windows\System\UKSmnAv.exe

Filesize
1.4MB

MD5
32d69db2982d64678fb0150c48127523

SHA1
439285e33dd235f9aff0068e8ef9ab5fd78a285d

SHA256
eb14ab269af8f55e016f9088d844f68dde1563e09b1adc5d7cb718d4d4112af4

SHA512
178dc87e09bcb6000964f8332ccfeacdbc23321ab5b4d505233b4e06e8a306202ea2dec0fca00e0c8360e5174e7bb8efda0101147b6f3437848a6cb4d11995e9

Download Submit
C:\Windows\System\UhlCMsI.exe

Filesize
1.4MB

MD5
ba60d11bd10b58266b8caf541dcdc80b

SHA1
048769fc2817405bffca547a266525aa96f5144b

SHA256
7b782d04b787177ea92b5b45a2e9883b9715209a835f4edc62507b9367120534

SHA512
07faa69d7466d75d611bb9f2e6e1912ec329354dafef9dc79f68f189f1ac1fa3c6fbd268930dcaaba7357780c0dd84d16185d76729077c5b8f860886f2a7419b

Download Submit
C:\Windows\System\VROIXUH.exe

Filesize
1.4MB

MD5
e92249ea5e6bb10876826da87fd661d0

SHA1
56f3e5fa376457683b446a35046cd5e000f0582d

SHA256
fbf02907dfab239150652dfebe667335e3a46f42c539db3477bdfa5620eeeb9d

SHA512
28189fc984a0c5504426bd5c0858a80facf21961e7c492d40b628cf549e862a5220160d56e0de8d150d24d67ce0343bbfbf91ea7a36267f4f50e62a5824c2740

Download Submit
C:\Windows\System\VjYiXEX.exe

Filesize
1.4MB

MD5
e16a57795ca3bf25b8621349d191d4a4

SHA1
36760eb0344aafdea58504b0680380819c4aa557

SHA256
9c34ab3193643cf53951e181da4d1e5cb83dedb4ddbd1984c7d3fabc27965a6d

SHA512
24b84a75fb17c091cd085801a5ffab13c7d960a47326e40a48786d0df961e30bc08c938029027f2289048f635f4aa9ccbd334a05426152f3a0144f10865323fa

Download Submit
C:\Windows\System\bojEgGc.exe

Filesize
1.4MB

MD5
eaddd5804a3f768c83c93d30881fc135

SHA1
d67e8c06802d2e50db45a566f46585efdf85eac1

SHA256
7d7356409d599dce8d371b22447e69bbaccb129ae53e7945d87bbd6cfe75b86c

SHA512
3b4981bcadca6aa246f261e0a9d1f626fa45ec672241f04903d7a021701b7916a93b459ac6c781fe5111a2c316e2fe2a28296c2280c53e78bafa57a5295f54ff

Download Submit
C:\Windows\System\fJHwUTv.exe

Filesize
1.4MB

MD5
5ea5309066f96614fdcda9c65cd28bdd

SHA1
5ff77dfd542f2b971c0b76f92fb4e12094d7af37

SHA256
b5ebd2c76183575d0b3e17fc6209f1f3b73b45459f8d3e81fc59674d574b6d5d

SHA512
ecf77b59ddbd9ccdaad47a9e332814f6647b2d584939cc6efd2e76fa6a9045a9a6d8c22e56b3afa6a90844deecc30b2481ffd027b14cc3a5cbc6a475c083d4fc

Download Submit
C:\Windows\System\iJEVuQn.exe

Filesize
1.4MB

MD5
02291086b9b91e79d99ec056c3be7a33

SHA1
89a67e97bb672bad21e055efb9b822683d72553d

SHA256
050554293c0360b2e4b0499a60d822943e82849439ec9e38dc793b097e03d9ea

SHA512
a0a3bdcbeb2bdb672287cdfd8a1cd19cf0328a1bae16512da61435436b64b7d4bc24f0e6e4f0f01ac9092c9447243d9e7c4d07be9c86326280ee62aed77307d2

Download Submit
C:\Windows\System\iplnypE.exe

Filesize
1.4MB

MD5
99f0154a92842dd10fb9a7cd70a9d379

SHA1
4f326277c186d62e60cf2f0bd5fb7f7cebec8e3f

SHA256
c50b8d0d6696b83426709dd91b1a3afcc4d9f808159e32ca9720bc9f41238612

SHA512
79188ba23383964c1f8f6eeca16ca1bc6e0e3570c3c15bcd191c481c896162af3e1a0cceeee9f6f5f873f1a298f83a805f29a91741bb9d69274bcd27da36b01a

Download Submit
C:\Windows\System\ixBeFuA.exe

Filesize
1.4MB

MD5
b661db0e0a0430e2a73d4048652d04d0

SHA1
38ed6b2f262321b1440513000f971260a36fcc2d

SHA256
bf833ec83db202e09de6da0f2bc3cabd98124cf82a8ce2ad50e0f0b5fbf51b23

SHA512
990f3fdc813c8ffa60b67e6af0d0cf0a75fb47a967123562cbad32d1d6309803fec1c41069d7c6414f82483dbd8d139e8c57771dfd90f8e8cf2ffb5cf3138714

Download Submit
C:\Windows\System\jEnBcWq.exe

Filesize
1.4MB

MD5
be69cc114a3e822041be83cd4d461f79

SHA1
b44425e9582d4099ee474d3c62c10548f5ab1ee7

SHA256
6a74b804004275c936bfd7f61f4e9eaa24e5dde1ff12524f721bbc675560c098

SHA512
8eb8dea09bc600dfd538f12a33712c3883f964cd1e3e2d450ecf4b47a148bed700238503b469576658491100983a87c9ad15b5ba9293e6d901349e6a32d07dde

Download Submit
C:\Windows\System\jTJRnzB.exe

Filesize
1.4MB

MD5
2e59c59d209bcbafd3bbeb084428af0e

SHA1
2da4f4c51a3637a9b74e7758190a1d0c3266f91f

SHA256
013e75e93d062941d403a378bd8482a9fe37a6175dbe4f0951fc78e6e2499551

SHA512
7439be44fca47dc82c5ae50f5069cc14ac97c28301c9e1dd7235ca5275a67b2efd367654b611b4f37d4e3f78d158026943ff77e6f76018200e0bb90868306e29

Download Submit
C:\Windows\System\jqjcmsL.exe

Filesize
1.4MB

MD5
b0c493e1b4b008f2ab7b1d9527732ac3

SHA1
47ce3164d8476c1398a5c2555e6532e5d8bbb964

SHA256
73e4c0357a23ea9644d95a9870fbaae8908bcde7508dc61b41ae2b4d52dfb88d

SHA512
9f1d4a16d87b80319cb41e637f64038f4ed839000cd3610837175de9e7ecc53ebca10cf550c9e2e269ae635d73f0f6831ca3365eca31ad510fbe5b8ab63f877f

Download Submit
C:\Windows\System\lBTtsbO.exe

Filesize
1.4MB

MD5
4b4d592e5a670af6f5ea6654be0869af

SHA1
b1fc5b1f81bb4724e07bd683c4336dd03e927a1c

SHA256
56fef02aa59213b98ed56b0d83610ae22522c80fb706f9746a81534146b6f34e

SHA512
f4f21e1db0d99721d0f5be162f6d266418526ded6f5f97d531919254ad5c2f3d0bfd20ae225908f664a8e05899818b180bef277fdc69006212b480eb42a2e9ee

Download Submit
C:\Windows\System\lPkXkaV.exe

Filesize
1.4MB

MD5
6f3f10203d7a83c3d4b9ffd33666379a

SHA1
adaaeb4824462625678930898067506037c5b3e6

SHA256
a1ebf972004185262daf7fb17f7402a83537a94a7aa48b1ce66ea49d4225f486

SHA512
497dc4a07d0030c2dac66e772bd48ae8bdb0597f99a9837839ffaab6d3f4b738214725245d2c660f3a7ca9018bd17ea7c7f096aeac0255da482eb1ce5c047932

Download Submit
C:\Windows\System\mJJJvPd.exe

Filesize
1.4MB

MD5
fbd80877d5575659990389c74605d708

SHA1
9c989fdcb7ef6a0ee9d4bc88d9fb3b32fd5801ff

SHA256
f2ac90e378e83409651d26412024fb2c00910393573dd793b897b6e4c493e1dc

SHA512
8ce8bbbbfdb89b33fed20dab99f16b23f552e13fd8ae65e6bce014355ff36a6682a6ad6bae8a644a5d1ecb5802a4d3951571a118ff778f78ca7fa6cbf5eb78c6

Download Submit
C:\Windows\System\pzoSBYD.exe

Filesize
1.4MB

MD5
8b13de33b193b6ee3d5099f31106ec7d

SHA1
c737fef7456dc45f53f5d60ec87a488f847da484

SHA256
ef4a9fe0ca15d906892f2e677b41322a45eda34761af3c2e6fc6a8403774004a

SHA512
827fe43df6f11307219382e540c3f261feed59383a6401d2c6729c253f819a6242492e2832e5a4b5603b09c92109e6fc0cd081f816720de52c5e4bd2eaf7faf2

Download Submit
C:\Windows\System\qVfKbjG.exe

Filesize
1.4MB

MD5
768b5099c00fb522bc03ec36fb46dc25

SHA1
a20047ab8121e7fab6fe75f163e83d04cb054857

SHA256
743a279c03dca0c366c59046ec276ca7d956a46ea0600464dc2de5c1c4f9d3a8

SHA512
45d97eb7e13d69c45a4445408469f8029e5f8703068d70a5a9adcdecc3c80cb4e5182f28ac8874a7fc3fcbf6f5331f978da1669a6e49e0bbb1e2a9c6a68f5932

Download Submit
C:\Windows\System\rzYRGaM.exe

Filesize
1.4MB

MD5
4b0a82ca25d09c11970b0a0b648d65ed

SHA1
8955caf34a776e50296a5f7a5e130ecb5a0ce013

SHA256
517487084bdc899322ff9b1d98ba24356a507dfe0b72f731ad32580740db50f1

SHA512
5ade146e149bceddf3ca5b8238182340f704e1b0543976ced03e4629b546307eb3b8eef5b43b16817b3efa5c1501e7c3b6df2b3b83963725071ddabd12536694

Download Submit
C:\Windows\System\sCgVCgd.exe

Filesize
1.4MB

MD5
39b0ae23b60df1099baf886c1c1c4e24

SHA1
d2660b137032dff3c6417453e060c2408ce2d6aa

SHA256
add2d7b0c7908d7ac2a55e793332bc823e7d47dca35aca2aa77979521d974086

SHA512
f54f6313321a7a91ad27aeafa68ad61a91536d2fac5bebe74c943a97f691e6deb8899f942e7cedd428545b2a4290aff5ec6bdae558c0d8e75ad827833d27b9a3

Download Submit
C:\Windows\System\tNhhLyU.exe

Filesize
1.4MB

MD5
837c06602e5bac7057853f044cfdd488

SHA1
88b744ce874623729bb28e120167fdeea921197a

SHA256
eefa48c67010ec8ab5cf2df3b96416f9af2e9c2bed0563cd5f30d996de1c06e1

SHA512
f0136e108965a8b72a5a79f4c0887319a99fbdc34d513b01e3096f5012765f0a46b1f8520a2b8099f3ba6394df9a23b4a191ac606a6baaf8a5306ce0858736c7

Download Submit
C:\Windows\System\uIApXpc.exe

Filesize
1.4MB

MD5
e9937211bd742dcb51b9f1f53cef7fdd

SHA1
6912c1276abf1d4dcbbde05fc2919d73ef0d8202

SHA256
c94fcb3ba4b797f1a4a31a850c1d3bc9113de34a2edefa09b15ae0bdd5eec0bd

SHA512
6c0aa980792e1dd969c899f4c69e257acb2e379d91d910b7f18176240a425a9949933e451368f3c23c510cd7298a976d92030e34763130720925b310532705ee

Download Submit
C:\Windows\System\vhJWHuU.exe

Filesize
1.4MB

MD5
099d9fdb7eb16dfdadb6e7ecc2ef40b8

SHA1
4f78439d2cbde71365b4b69d5a2bdcbe6414ff20

SHA256
555fdca30adc55c267036744ff3ab026b6919adb51614c7e8551fb7780b7bd98

SHA512
b346cd1e37f018bb743e74711deb2269e73e0989bb84a5739d57b75b36aeeb86a237dbc7ef0f23566b67b7a57e1abd0c80e4e285df447bcc3505713122d5ad7c

Download Submit
C:\Windows\System\yRsoGtU.exe

Filesize
1.4MB

MD5
cd8dc7adf87db61fbef99ace41c5979d

SHA1
002974775a51d002c69bd122b750af082b6e928b

SHA256
313ce4bcf0bf96d175ca20fb656c578168a04554112661c7a708eadb0392a78f

SHA512
47cea1a27fcf239f892dffa5b95923fcb0162eb4c8c65bd54108332e4c311ab73abca6c4c642001e4ce275891b4d03bc19deb5f31858da1ea7586099fcd7c5d0

Download Submit
C:\Windows\System\ylMVbNy.exe

Filesize
1.4MB

MD5
2c3594744cfc57413f5b0dbf0a26cb99

SHA1
11914ea8c713e45ee601f90df3233b534232cfb2

SHA256
6820458eb08f0e4c1da45d91468e539307e9b3919162b6a428b2e52f92840ce8

SHA512
c84013b4707a216f604543859a135af38d0fa05642f841d0e7e79b19f12eabdcd3c9621823f687a28975671d4d463afff336b235ea3eaf153a242095334dd1fd

Download Submit
C:\Windows\System\zeTnvbx.exe

Filesize
1.4MB

MD5
ec659aa5b4e5daba32f93c4be1dc9fc3

SHA1
26bf34dffd6bc4479abd9928d17082d30fd8b776

SHA256
2cd1848b8f0540eaf405edce40425eae98fa3d1009e7d9ff37cbd03dc7478351

SHA512
a180e1bf02ab9567f5eb75798d7f74acfd3fd6d114377e8bab4c948e1f7f47517f759f1b8d257e8eb4e4aa9835afa110fc18cc214509044fb39f807f6816e1c0

Download Submit
memory/32-548-0x00007FF7C5E00000-0x00007FF7C6151000-memory.dmp

Filesize
3.3MB

Download
memory/32-2254-0x00007FF7C5E00000-0x00007FF7C6151000-memory.dmp

Filesize
3.3MB

Download
memory/1016-2240-0x00007FF613AC0000-0x00007FF613E11000-memory.dmp

Filesize
3.3MB

Download
memory/1016-531-0x00007FF613AC0000-0x00007FF613E11000-memory.dmp

Filesize
3.3MB

Download
memory/1096-479-0x00007FF740D70000-0x00007FF7410C1000-memory.dmp

Filesize
3.3MB

Download
memory/1096-2237-0x00007FF740D70000-0x00007FF7410C1000-memory.dmp

Filesize
3.3MB

Download
memory/1416-618-0x00007FF6064A0000-0x00007FF6067F1000-memory.dmp

Filesize
3.3MB

Download
memory/1416-2219-0x00007FF6064A0000-0x00007FF6067F1000-memory.dmp

Filesize
3.3MB

Download
memory/1528-2215-0x00007FF725920000-0x00007FF725C71000-memory.dmp

Filesize
3.3MB

Download
memory/1528-2179-0x00007FF725920000-0x00007FF725C71000-memory.dmp

Filesize
3.3MB

Download
memory/1528-20-0x00007FF725920000-0x00007FF725C71000-memory.dmp

Filesize
3.3MB

Download
memory/1620-1-0x00000225E1F40000-0x00000225E1F50000-memory.dmp

Filesize
64KB

Download
memory/1620-0-0x00007FF7B6E90000-0x00007FF7B71E1000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2246-0x00007FF7E8DD0000-0x00007FF7E9121000-memory.dmp

Filesize
3.3MB

Download
memory/1652-502-0x00007FF7E8DD0000-0x00007FF7E9121000-memory.dmp

Filesize
3.3MB

Download
memory/1776-522-0x00007FF636720000-0x00007FF636A71000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2242-0x00007FF636720000-0x00007FF636A71000-memory.dmp

Filesize
3.3MB

Download
memory/1780-2276-0x00007FF722550000-0x00007FF7228A1000-memory.dmp

Filesize
3.3MB

Download
memory/1780-596-0x00007FF722550000-0x00007FF7228A1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-2258-0x00007FF7EE2A0000-0x00007FF7EE5F1000-memory.dmp

Filesize
3.3MB

Download
memory/1972-606-0x00007FF7EE2A0000-0x00007FF7EE5F1000-memory.dmp

Filesize
3.3MB

Download
memory/1992-551-0x00007FF786FB0000-0x00007FF787301000-memory.dmp

Filesize
3.3MB

Download
memory/1992-2274-0x00007FF786FB0000-0x00007FF787301000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2279-0x00007FF76EF10000-0x00007FF76F261000-memory.dmp

Filesize
3.3MB

Download
memory/2104-552-0x00007FF76EF10000-0x00007FF76F261000-memory.dmp

Filesize
3.3MB

Download
memory/2612-2259-0x00007FF6224C0000-0x00007FF622811000-memory.dmp

Filesize
3.3MB

Download
memory/2612-600-0x00007FF6224C0000-0x00007FF622811000-memory.dmp

Filesize
3.3MB

Download
memory/2876-510-0x00007FF606BA0000-0x00007FF606EF1000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2244-0x00007FF606BA0000-0x00007FF606EF1000-memory.dmp

Filesize
3.3MB

Download
memory/2920-2181-0x00007FF7B15F0000-0x00007FF7B1941000-memory.dmp

Filesize
3.3MB

Download
memory/2920-47-0x00007FF7B15F0000-0x00007FF7B1941000-memory.dmp

Filesize
3.3MB

Download
memory/2920-2224-0x00007FF7B15F0000-0x00007FF7B1941000-memory.dmp

Filesize
3.3MB

Download
memory/3080-483-0x00007FF651C30000-0x00007FF651F81000-memory.dmp

Filesize
3.3MB

Download
memory/3080-2271-0x00007FF651C30000-0x00007FF651F81000-memory.dmp

Filesize
3.3MB

Download
memory/3092-569-0x00007FF680CE0000-0x00007FF681031000-memory.dmp

Filesize
3.3MB

Download
memory/3092-2252-0x00007FF680CE0000-0x00007FF681031000-memory.dmp

Filesize
3.3MB

Download
memory/3420-2273-0x00007FF7D1400000-0x00007FF7D1751000-memory.dmp

Filesize
3.3MB

Download
memory/3420-532-0x00007FF7D1400000-0x00007FF7D1751000-memory.dmp

Filesize
3.3MB

Download
memory/3476-446-0x00007FF61EA60000-0x00007FF61EDB1000-memory.dmp

Filesize
3.3MB

Download
memory/3476-2226-0x00007FF61EA60000-0x00007FF61EDB1000-memory.dmp

Filesize
3.3MB

Download
memory/3944-493-0x00007FF69B0E0000-0x00007FF69B431000-memory.dmp

Filesize
3.3MB

Download
memory/3944-2248-0x00007FF69B0E0000-0x00007FF69B431000-memory.dmp

Filesize
3.3MB

Download
memory/4152-2262-0x00007FF7F1570000-0x00007FF7F18C1000-memory.dmp

Filesize
3.3MB

Download
memory/4152-555-0x00007FF7F1570000-0x00007FF7F18C1000-memory.dmp

Filesize
3.3MB

Download
memory/4160-2235-0x00007FF7F14F0000-0x00007FF7F1841000-memory.dmp

Filesize
3.3MB

Download
memory/4160-473-0x00007FF7F14F0000-0x00007FF7F1841000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2231-0x00007FF749C50000-0x00007FF749FA1000-memory.dmp

Filesize
3.3MB

Download
memory/4168-468-0x00007FF749C50000-0x00007FF749FA1000-memory.dmp

Filesize
3.3MB

Download
memory/4724-2229-0x00007FF705400000-0x00007FF705751000-memory.dmp

Filesize
3.3MB

Download
memory/4724-30-0x00007FF705400000-0x00007FF705751000-memory.dmp

Filesize
3.3MB

Download
memory/4804-2217-0x00007FF744420000-0x00007FF744771000-memory.dmp

Filesize
3.3MB

Download
memory/4804-2180-0x00007FF744420000-0x00007FF744771000-memory.dmp

Filesize
3.3MB

Download
memory/4804-22-0x00007FF744420000-0x00007FF744771000-memory.dmp

Filesize
3.3MB

Download
memory/4812-461-0x00007FF7A26B0000-0x00007FF7A2A01000-memory.dmp

Filesize
3.3MB

Download
memory/4812-2233-0x00007FF7A26B0000-0x00007FF7A2A01000-memory.dmp

Filesize
3.3MB

Download
memory/4836-2228-0x00007FF64EFA0000-0x00007FF64F2F1000-memory.dmp

Filesize
3.3MB

Download
memory/4836-613-0x00007FF64EFA0000-0x00007FF64F2F1000-memory.dmp

Filesize
3.3MB

Download
memory/4968-2222-0x00007FF609D10000-0x00007FF60A061000-memory.dmp

Filesize
3.3MB

Download
memory/4968-452-0x00007FF609D10000-0x00007FF60A061000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2169-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2213-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp

Filesize
3.3MB

Download
memory/5020-11-0x00007FF6E3690000-0x00007FF6E39E1000-memory.dmp

Filesize
3.3MB

Download
memory/5092-542-0x00007FF6311C0000-0x00007FF631511000-memory.dmp

Filesize
3.3MB

Download
memory/5092-2250-0x00007FF6311C0000-0x00007FF631511000-memory.dmp

Filesize
3.3MB

Download