xmrig | 4dc89ac103b18f5a026f033d3f2e4a13ead812543cd275bdfa61907d5be0f3ff

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
Size 2.2MB
Sample240527-fg73sagg6v
SHA256 4dc89ac103b18f5a026f033d3f2e4a13ead812543cd275bdfa61907d5be0f3ff
MD5 1fda7c02c4fbb63b5b73cd28636b0250
SHA1 fa00c3d6087810532c892aeb7581c6850585c50f
SHA512 cd1b62f0e18855b9df346738745d9e54c447662858a863540abff9661b53dd9793bb2b013fe4c00007519a417b361c489c1ab8952bad470e50db4da9e414f2bf
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustW5:BemTLkNdfE0pZrT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1300-0-0x00007FF6F3600000-0x00007FF6F3954000-memory.dmp	xmrig
behavioral2/files/0x000e000000023240-5.dat	xmrig
behavioral2/files/0x000700000002326f-9.dat	xmrig
behavioral2/files/0x000800000002326e-11.dat	xmrig
behavioral2/memory/4984-20-0x00007FF631000000-0x00007FF631354000-memory.dmp	xmrig
behavioral2/files/0x0007000000023270-23.dat	xmrig
behavioral2/files/0x0007000000023271-27.dat	xmrig
behavioral2/memory/564-30-0x00007FF668CA0000-0x00007FF668FF4000-memory.dmp	xmrig
behavioral2/memory/1432-35-0x00007FF78CFC0000-0x00007FF78D314000-memory.dmp	xmrig
behavioral2/memory/3132-37-0x00007FF6B2960000-0x00007FF6B2CB4000-memory.dmp	xmrig
behavioral2/memory/2684-42-0x00007FF72A270000-0x00007FF72A5C4000-memory.dmp	xmrig
behavioral2/memory/1408-45-0x00007FF785A00000-0x00007FF785D54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023273-47.dat	xmrig
behavioral2/files/0x000800000002326c-46.dat	xmrig
behavioral2/files/0x0007000000023274-54.dat	xmrig
behavioral2/files/0x0007000000023276-61.dat	xmrig
behavioral2/files/0x0007000000023277-66.dat	xmrig
behavioral2/memory/1212-81-0x00007FF77CDD0000-0x00007FF77D124000-memory.dmp	xmrig
behavioral2/memory/3676-87-0x00007FF7BC7A0000-0x00007FF7BCAF4000-memory.dmp	xmrig
behavioral2/memory/684-91-0x00007FF704520000-0x00007FF704874000-memory.dmp	xmrig
behavioral2/memory/1068-92-0x00007FF756ED0000-0x00007FF757224000-memory.dmp	xmrig
behavioral2/memory/380-90-0x00007FF7F10A0000-0x00007FF7F13F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023278-88.dat	xmrig
behavioral2/files/0x000700000002327a-85.dat	xmrig
behavioral2/files/0x0007000000023279-83.dat	xmrig
behavioral2/memory/2996-82-0x00007FF6B6F30000-0x00007FF6B7284000-memory.dmp	xmrig
behavioral2/memory/8-73-0x00007FF69BDC0000-0x00007FF69C114000-memory.dmp	xmrig
behavioral2/files/0x0007000000023275-64.dat	xmrig
behavioral2/memory/3768-44-0x00007FF74BB10000-0x00007FF74BE64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023272-43.dat	xmrig
behavioral2/memory/1188-10-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002327b-95.dat	xmrig
behavioral2/files/0x000700000002327e-101.dat	xmrig
behavioral2/memory/3540-106-0x00007FF627760000-0x00007FF627AB4000-memory.dmp	xmrig
behavioral2/memory/1300-108-0x00007FF6F3600000-0x00007FF6F3954000-memory.dmp	xmrig
behavioral2/files/0x000700000002327f-111.dat	xmrig
behavioral2/memory/2712-113-0x00007FF67ABE0000-0x00007FF67AF34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023280-118.dat	xmrig
behavioral2/files/0x0007000000023282-125.dat	xmrig
behavioral2/files/0x0007000000023283-130.dat	xmrig
behavioral2/files/0x0007000000023284-136.dat	xmrig
behavioral2/files/0x0007000000023286-143.dat	xmrig
behavioral2/memory/1188-152-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023288-160.dat	xmrig
behavioral2/files/0x000700000002328c-173.dat	xmrig
behavioral2/files/0x000700000002328e-187.dat	xmrig
behavioral2/memory/1104-186-0x00007FF797F10000-0x00007FF798264000-memory.dmp	xmrig
behavioral2/memory/2388-246-0x00007FF7D7880000-0x00007FF7D7BD4000-memory.dmp	xmrig
behavioral2/memory/1912-259-0x00007FF7BA9E0000-0x00007FF7BAD34000-memory.dmp	xmrig
behavioral2/memory/1060-257-0x00007FF61C230000-0x00007FF61C584000-memory.dmp	xmrig
behavioral2/memory/4860-268-0x00007FF6E4720000-0x00007FF6E4A74000-memory.dmp	xmrig
behavioral2/memory/2112-272-0x00007FF7D6300000-0x00007FF7D6654000-memory.dmp	xmrig
behavioral2/memory/4964-271-0x00007FF737EE0000-0x00007FF738234000-memory.dmp	xmrig
behavioral2/memory/4828-266-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp	xmrig
behavioral2/memory/4988-264-0x00007FF6DF1E0000-0x00007FF6DF534000-memory.dmp	xmrig
behavioral2/memory/3348-263-0x00007FF6ED3D0000-0x00007FF6ED724000-memory.dmp	xmrig
behavioral2/files/0x000700000002328d-183.dat	xmrig
behavioral2/memory/3784-177-0x00007FF7C87B0000-0x00007FF7C8B04000-memory.dmp	xmrig
behavioral2/files/0x000700000002328a-176.dat	xmrig
behavioral2/files/0x0007000000023289-171.dat	xmrig
behavioral2/files/0x000700000002328b-170.dat	xmrig
behavioral2/memory/564-168-0x00007FF668CA0000-0x00007FF668FF4000-memory.dmp	xmrig
behavioral2/memory/4984-163-0x00007FF631000000-0x00007FF631354000-memory.dmp	xmrig
behavioral2/files/0x0007000000023287-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1188	zscsjqJ.exe
4984	rLWJcYX.exe
1432	MXyclHg.exe
564	mHLwTSk.exe
3132	OkkWGye.exe
2684	UTOMwts.exe
1408	ybGLSSv.exe
3768	ytxvclE.exe
8	BqHGAxt.exe
1212	EyekYDm.exe
2996	QwThdMk.exe
3676	MWfHdXS.exe
1068	ddrUFmc.exe
380	uwBSzsd.exe
684	kmFBMYM.exe
4908	XjjLRXE.exe
3540	eMwIHQo.exe
2712	uFQdCuN.exe
3784	ipBFLaq.exe
1104	wIvvsUu.exe
2388	sppXKlF.exe
1060	XxDtOkv.exe
1912	AavcBPy.exe
3348	mGGCCmE.exe
4988	LytFYcn.exe
4828	LYwaEYW.exe
4860	yIRzNFm.exe
4964	GXXyOrQ.exe
2112	glKjPsV.exe
3016	xOgNrcw.exe
2608	mtZZKpE.exe
1576	PKonLrF.exe
3232	IyjSisO.exe
4892	IEJPGEV.exe
3872	vDDydPm.exe
3220	NlQfMCP.exe
1936	hfzNEoo.exe
780	wbmrRfw.exe
1208	lbXtCVd.exe
4260	pJGsWIL.exe
3916	YiDzLvj.exe
3508	eHeHyjb.exe
1648	XIefgPB.exe
700	VmMbzWE.exe
4000	UDZxcrO.exe
4180	BVDTelk.exe
1548	QGJFmQa.exe
2468	wkjokPo.exe
2412	sWWGcGu.exe
2668	RKUYOlH.exe
3484	odFAZiN.exe
1728	iyTjgnQ.exe
3968	CHqSLBE.exe
4176	fpxngZh.exe
3940	ovpTodM.exe
4272	zCEvuQu.exe
1620	LYgcRES.exe
3080	rvNFgUG.exe
1436	vfbHDOI.exe
1700	ZybtVBE.exe
1972	NyJYPUu.exe
4568	wgjySCC.exe
3192	iqofaVP.exe
3200	KnWkklh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1300-0-0x00007FF6F3600000-0x00007FF6F3954000-memory.dmp	upx
behavioral2/files/0x000e000000023240-5.dat	upx
behavioral2/files/0x000700000002326f-9.dat	upx
behavioral2/files/0x000800000002326e-11.dat	upx
behavioral2/memory/4984-20-0x00007FF631000000-0x00007FF631354000-memory.dmp	upx
behavioral2/files/0x0007000000023270-23.dat	upx
behavioral2/files/0x0007000000023271-27.dat	upx
behavioral2/memory/564-30-0x00007FF668CA0000-0x00007FF668FF4000-memory.dmp	upx
behavioral2/memory/1432-35-0x00007FF78CFC0000-0x00007FF78D314000-memory.dmp	upx
behavioral2/memory/3132-37-0x00007FF6B2960000-0x00007FF6B2CB4000-memory.dmp	upx
behavioral2/memory/2684-42-0x00007FF72A270000-0x00007FF72A5C4000-memory.dmp	upx
behavioral2/memory/1408-45-0x00007FF785A00000-0x00007FF785D54000-memory.dmp	upx
behavioral2/files/0x0007000000023273-47.dat	upx
behavioral2/files/0x000800000002326c-46.dat	upx
behavioral2/files/0x0007000000023274-54.dat	upx
behavioral2/files/0x0007000000023276-61.dat	upx
behavioral2/files/0x0007000000023277-66.dat	upx
behavioral2/memory/1212-81-0x00007FF77CDD0000-0x00007FF77D124000-memory.dmp	upx
behavioral2/memory/3676-87-0x00007FF7BC7A0000-0x00007FF7BCAF4000-memory.dmp	upx
behavioral2/memory/684-91-0x00007FF704520000-0x00007FF704874000-memory.dmp	upx
behavioral2/memory/1068-92-0x00007FF756ED0000-0x00007FF757224000-memory.dmp	upx
behavioral2/memory/380-90-0x00007FF7F10A0000-0x00007FF7F13F4000-memory.dmp	upx
behavioral2/files/0x0007000000023278-88.dat	upx
behavioral2/files/0x000700000002327a-85.dat	upx
behavioral2/files/0x0007000000023279-83.dat	upx
behavioral2/memory/2996-82-0x00007FF6B6F30000-0x00007FF6B7284000-memory.dmp	upx
behavioral2/memory/8-73-0x00007FF69BDC0000-0x00007FF69C114000-memory.dmp	upx
behavioral2/files/0x0007000000023275-64.dat	upx
behavioral2/memory/3768-44-0x00007FF74BB10000-0x00007FF74BE64000-memory.dmp	upx
behavioral2/files/0x0007000000023272-43.dat	upx
behavioral2/memory/1188-10-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp	upx
behavioral2/files/0x000700000002327b-95.dat	upx
behavioral2/files/0x000700000002327e-101.dat	upx
behavioral2/memory/3540-106-0x00007FF627760000-0x00007FF627AB4000-memory.dmp	upx
behavioral2/memory/1300-108-0x00007FF6F3600000-0x00007FF6F3954000-memory.dmp	upx
behavioral2/files/0x000700000002327f-111.dat	upx
behavioral2/memory/2712-113-0x00007FF67ABE0000-0x00007FF67AF34000-memory.dmp	upx
behavioral2/files/0x0007000000023280-118.dat	upx
behavioral2/files/0x0007000000023282-125.dat	upx
behavioral2/files/0x0007000000023283-130.dat	upx
behavioral2/files/0x0007000000023284-136.dat	upx
behavioral2/files/0x0007000000023286-143.dat	upx
behavioral2/memory/1188-152-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp	upx
behavioral2/files/0x0007000000023288-160.dat	upx
behavioral2/files/0x000700000002328c-173.dat	upx
behavioral2/files/0x000700000002328e-187.dat	upx
behavioral2/memory/1104-186-0x00007FF797F10000-0x00007FF798264000-memory.dmp	upx
behavioral2/memory/2388-246-0x00007FF7D7880000-0x00007FF7D7BD4000-memory.dmp	upx
behavioral2/memory/1912-259-0x00007FF7BA9E0000-0x00007FF7BAD34000-memory.dmp	upx
behavioral2/memory/1060-257-0x00007FF61C230000-0x00007FF61C584000-memory.dmp	upx
behavioral2/memory/4860-268-0x00007FF6E4720000-0x00007FF6E4A74000-memory.dmp	upx
behavioral2/memory/2112-272-0x00007FF7D6300000-0x00007FF7D6654000-memory.dmp	upx
behavioral2/memory/4964-271-0x00007FF737EE0000-0x00007FF738234000-memory.dmp	upx
behavioral2/memory/4828-266-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp	upx
behavioral2/memory/4988-264-0x00007FF6DF1E0000-0x00007FF6DF534000-memory.dmp	upx
behavioral2/memory/3348-263-0x00007FF6ED3D0000-0x00007FF6ED724000-memory.dmp	upx
behavioral2/files/0x000700000002328d-183.dat	upx
behavioral2/memory/3784-177-0x00007FF7C87B0000-0x00007FF7C8B04000-memory.dmp	upx
behavioral2/files/0x000700000002328a-176.dat	upx
behavioral2/files/0x0007000000023289-171.dat	upx
behavioral2/files/0x000700000002328b-170.dat	upx
behavioral2/memory/564-168-0x00007FF668CA0000-0x00007FF668FF4000-memory.dmp	upx
behavioral2/memory/4984-163-0x00007FF631000000-0x00007FF631354000-memory.dmp	upx
behavioral2/files/0x0007000000023287-159.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tuqlKnV.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\lhsQWoz.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\zkYoCXr.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\VtMPYkX.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\TWjyBmf.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\CfFHAcN.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\pqNWuIW.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\hsQXtHp.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\ovpTodM.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\rbVjLvp.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\pCZipBE.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\zEYPZiE.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\brZbBNU.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\MKtJHPx.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\DXVfvce.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\oghGJkM.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\BtxrWIe.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\QWyoktT.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\oBTTRPf.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\rMDIylt.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\hiRhaKt.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\JRsbZhI.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\byebZnV.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\NHzepjv.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\xcwusNQ.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\PgUBgYY.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\TffDNOa.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\ZxuCATO.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\iqEtjdI.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\pWgLtBM.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\VJypgNM.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\BNPseML.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\bPiPHDM.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\tGRdzRP.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\fDKAHnI.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\PoNczFy.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\LoggKKC.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\eNzFpGC.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\bCEjKjO.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\FLNMEIF.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\FgnVnZf.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\CzatjLj.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\pJBcGBS.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\fVyAjSS.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\mGfWXOE.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\aYzsCZw.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\dfnDXok.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\eBGkxCu.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\EfAaVMu.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\HuslXyr.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\UZyJyFX.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\FCoGUJm.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\uDaMPep.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\hltxRCN.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\ArGHEJq.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\GCowBFH.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\dTANbrr.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\bDuGsEt.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\yHwQMte.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\OLxaDdj.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\sWWGcGu.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\kZoZvUa.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\pMVanwD.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
File created	C:\Windows\System\sppXKlF.exe	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1188	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	92
PID 1300 wrote to memory of 1188	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	92
PID 1300 wrote to memory of 4984	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	93
PID 1300 wrote to memory of 4984	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	93
PID 1300 wrote to memory of 1432	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	94
PID 1300 wrote to memory of 1432	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	94
PID 1300 wrote to memory of 564	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	95
PID 1300 wrote to memory of 564	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	95
PID 1300 wrote to memory of 3132	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	96
PID 1300 wrote to memory of 3132	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	96
PID 1300 wrote to memory of 2684	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	97
PID 1300 wrote to memory of 2684	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	97
PID 1300 wrote to memory of 1408	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	98
PID 1300 wrote to memory of 1408	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	98
PID 1300 wrote to memory of 3768	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	99
PID 1300 wrote to memory of 3768	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	99
PID 1300 wrote to memory of 8	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	100
PID 1300 wrote to memory of 8	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	100
PID 1300 wrote to memory of 1212	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	101
PID 1300 wrote to memory of 1212	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	101
PID 1300 wrote to memory of 2996	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	102
PID 1300 wrote to memory of 2996	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	102
PID 1300 wrote to memory of 3676	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	103
PID 1300 wrote to memory of 3676	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	103
PID 1300 wrote to memory of 1068	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	104
PID 1300 wrote to memory of 1068	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	104
PID 1300 wrote to memory of 380	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	105
PID 1300 wrote to memory of 380	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	105
PID 1300 wrote to memory of 684	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	106
PID 1300 wrote to memory of 684	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	106
PID 1300 wrote to memory of 4908	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	107
PID 1300 wrote to memory of 4908	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	107
PID 1300 wrote to memory of 3540	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	108
PID 1300 wrote to memory of 3540	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	108
PID 1300 wrote to memory of 2712	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	109
PID 1300 wrote to memory of 2712	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	109
PID 1300 wrote to memory of 3784	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	110
PID 1300 wrote to memory of 3784	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	110
PID 1300 wrote to memory of 1104	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	111
PID 1300 wrote to memory of 1104	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	111
PID 1300 wrote to memory of 2388	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	112
PID 1300 wrote to memory of 2388	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	112
PID 1300 wrote to memory of 1060	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	113
PID 1300 wrote to memory of 1060	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	113
PID 1300 wrote to memory of 1912	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	114
PID 1300 wrote to memory of 1912	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	114
PID 1300 wrote to memory of 3348	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	115
PID 1300 wrote to memory of 3348	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	115
PID 1300 wrote to memory of 4988	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	116
PID 1300 wrote to memory of 4988	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	116
PID 1300 wrote to memory of 4828	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	117
PID 1300 wrote to memory of 4828	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	117
PID 1300 wrote to memory of 4860	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	118
PID 1300 wrote to memory of 4860	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	118
PID 1300 wrote to memory of 4964	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	119
PID 1300 wrote to memory of 4964	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	119
PID 1300 wrote to memory of 2112	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	120
PID 1300 wrote to memory of 2112	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	120
PID 1300 wrote to memory of 3016	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	121
PID 1300 wrote to memory of 3016	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	121
PID 1300 wrote to memory of 2608	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	122
PID 1300 wrote to memory of 2608	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	122
PID 1300 wrote to memory of 1576	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	123
PID 1300 wrote to memory of 1576	1300	1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1fda7c02c4fbb63b5b73cd28636b0250_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System\zscsjqJ.exe
  C:\Windows\System\zscsjqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\rLWJcYX.exe
  C:\Windows\System\rLWJcYX.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\MXyclHg.exe
  C:\Windows\System\MXyclHg.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\mHLwTSk.exe
  C:\Windows\System\mHLwTSk.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\OkkWGye.exe
  C:\Windows\System\OkkWGye.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\UTOMwts.exe
  C:\Windows\System\UTOMwts.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ybGLSSv.exe
  C:\Windows\System\ybGLSSv.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\ytxvclE.exe
  C:\Windows\System\ytxvclE.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\BqHGAxt.exe
  C:\Windows\System\BqHGAxt.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\EyekYDm.exe
  C:\Windows\System\EyekYDm.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\QwThdMk.exe
  C:\Windows\System\QwThdMk.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\MWfHdXS.exe
  C:\Windows\System\MWfHdXS.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\ddrUFmc.exe
  C:\Windows\System\ddrUFmc.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\uwBSzsd.exe
  C:\Windows\System\uwBSzsd.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\kmFBMYM.exe
  C:\Windows\System\kmFBMYM.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\XjjLRXE.exe
  C:\Windows\System\XjjLRXE.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\eMwIHQo.exe
  C:\Windows\System\eMwIHQo.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\uFQdCuN.exe
  C:\Windows\System\uFQdCuN.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ipBFLaq.exe
  C:\Windows\System\ipBFLaq.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\wIvvsUu.exe
  C:\Windows\System\wIvvsUu.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\sppXKlF.exe
  C:\Windows\System\sppXKlF.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\XxDtOkv.exe
  C:\Windows\System\XxDtOkv.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\AavcBPy.exe
  C:\Windows\System\AavcBPy.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\mGGCCmE.exe
  C:\Windows\System\mGGCCmE.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\LytFYcn.exe
  C:\Windows\System\LytFYcn.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LYwaEYW.exe
  C:\Windows\System\LYwaEYW.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\yIRzNFm.exe
  C:\Windows\System\yIRzNFm.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\GXXyOrQ.exe
  C:\Windows\System\GXXyOrQ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\glKjPsV.exe
  C:\Windows\System\glKjPsV.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\xOgNrcw.exe
  C:\Windows\System\xOgNrcw.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\mtZZKpE.exe
  C:\Windows\System\mtZZKpE.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\PKonLrF.exe
  C:\Windows\System\PKonLrF.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\IyjSisO.exe
  C:\Windows\System\IyjSisO.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\IEJPGEV.exe
  C:\Windows\System\IEJPGEV.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\vDDydPm.exe
  C:\Windows\System\vDDydPm.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\NlQfMCP.exe
  C:\Windows\System\NlQfMCP.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\hfzNEoo.exe
  C:\Windows\System\hfzNEoo.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\wbmrRfw.exe
  C:\Windows\System\wbmrRfw.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\lbXtCVd.exe
  C:\Windows\System\lbXtCVd.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\pJGsWIL.exe
  C:\Windows\System\pJGsWIL.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\YiDzLvj.exe
  C:\Windows\System\YiDzLvj.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\eHeHyjb.exe
  C:\Windows\System\eHeHyjb.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\XIefgPB.exe
  C:\Windows\System\XIefgPB.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\VmMbzWE.exe
  C:\Windows\System\VmMbzWE.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\UDZxcrO.exe
  C:\Windows\System\UDZxcrO.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\BVDTelk.exe
  C:\Windows\System\BVDTelk.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\QGJFmQa.exe
  C:\Windows\System\QGJFmQa.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\wkjokPo.exe
  C:\Windows\System\wkjokPo.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\sWWGcGu.exe
  C:\Windows\System\sWWGcGu.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\RKUYOlH.exe
  C:\Windows\System\RKUYOlH.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\odFAZiN.exe
  C:\Windows\System\odFAZiN.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\iyTjgnQ.exe
  C:\Windows\System\iyTjgnQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\CHqSLBE.exe
  C:\Windows\System\CHqSLBE.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\fpxngZh.exe
  C:\Windows\System\fpxngZh.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\ovpTodM.exe
  C:\Windows\System\ovpTodM.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\zCEvuQu.exe
  C:\Windows\System\zCEvuQu.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\LYgcRES.exe
  C:\Windows\System\LYgcRES.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\rvNFgUG.exe
  C:\Windows\System\rvNFgUG.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\vfbHDOI.exe
  C:\Windows\System\vfbHDOI.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ZybtVBE.exe
  C:\Windows\System\ZybtVBE.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\NyJYPUu.exe
  C:\Windows\System\NyJYPUu.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\wgjySCC.exe
  C:\Windows\System\wgjySCC.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\iqofaVP.exe
  C:\Windows\System\iqofaVP.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\KnWkklh.exe
  C:\Windows\System\KnWkklh.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\sdAESmi.exe
  C:\Windows\System\sdAESmi.exe
  2⤵
  PID:552
- C:\Windows\System\aqXMAfA.exe
  C:\Windows\System\aqXMAfA.exe
  2⤵
  PID:332
- C:\Windows\System\nTDWdmY.exe
  C:\Windows\System\nTDWdmY.exe
  2⤵
  PID:2204
- C:\Windows\System\cMTiOFZ.exe
  C:\Windows\System\cMTiOFZ.exe
  2⤵
  PID:4308
- C:\Windows\System\fpsAdHd.exe
  C:\Windows\System\fpsAdHd.exe
  2⤵
  PID:3524
- C:\Windows\System\iNnxPRE.exe
  C:\Windows\System\iNnxPRE.exe
  2⤵
  PID:3792
- C:\Windows\System\HcRGBmi.exe
  C:\Windows\System\HcRGBmi.exe
  2⤵
  PID:3928
- C:\Windows\System\PYLBKMn.exe
  C:\Windows\System\PYLBKMn.exe
  2⤵
  PID:2172
- C:\Windows\System\DITcEKt.exe
  C:\Windows\System\DITcEKt.exe
  2⤵
  PID:3652
- C:\Windows\System\cNrSVeY.exe
  C:\Windows\System\cNrSVeY.exe
  2⤵
  PID:5132
- C:\Windows\System\iEQhTpu.exe
  C:\Windows\System\iEQhTpu.exe
  2⤵
  PID:5148
- C:\Windows\System\xHyXjxZ.exe
  C:\Windows\System\xHyXjxZ.exe
  2⤵
  PID:5176
- C:\Windows\System\kdaQXmb.exe
  C:\Windows\System\kdaQXmb.exe
  2⤵
  PID:5192
- C:\Windows\System\AFhcSgv.exe
  C:\Windows\System\AFhcSgv.exe
  2⤵
  PID:5208
- C:\Windows\System\gqmKSmI.exe
  C:\Windows\System\gqmKSmI.exe
  2⤵
  PID:5232
- C:\Windows\System\tjQlEPc.exe
  C:\Windows\System\tjQlEPc.exe
  2⤵
  PID:5260
- C:\Windows\System\fsIJuaF.exe
  C:\Windows\System\fsIJuaF.exe
  2⤵
  PID:5284
- C:\Windows\System\dFikMFG.exe
  C:\Windows\System\dFikMFG.exe
  2⤵
  PID:5312
- C:\Windows\System\kYxnGOJ.exe
  C:\Windows\System\kYxnGOJ.exe
  2⤵
  PID:5340
- C:\Windows\System\thhMKSK.exe
  C:\Windows\System\thhMKSK.exe
  2⤵
  PID:5368
- C:\Windows\System\FygIudX.exe
  C:\Windows\System\FygIudX.exe
  2⤵
  PID:5392
- C:\Windows\System\JRsbZhI.exe
  C:\Windows\System\JRsbZhI.exe
  2⤵
  PID:5424
- C:\Windows\System\DLuWdJH.exe
  C:\Windows\System\DLuWdJH.exe
  2⤵
  PID:5448
- C:\Windows\System\pWgLtBM.exe
  C:\Windows\System\pWgLtBM.exe
  2⤵
  PID:5476
- C:\Windows\System\GzmRuTw.exe
  C:\Windows\System\GzmRuTw.exe
  2⤵
  PID:5504
- C:\Windows\System\dCdRUDG.exe
  C:\Windows\System\dCdRUDG.exe
  2⤵
  PID:5536
- C:\Windows\System\JDAQqLC.exe
  C:\Windows\System\JDAQqLC.exe
  2⤵
  PID:5564
- C:\Windows\System\dHacFUE.exe
  C:\Windows\System\dHacFUE.exe
  2⤵
  PID:5588
- C:\Windows\System\wuVKyIp.exe
  C:\Windows\System\wuVKyIp.exe
  2⤵
  PID:5620
- C:\Windows\System\ljhVnuT.exe
  C:\Windows\System\ljhVnuT.exe
  2⤵
  PID:5648
- C:\Windows\System\aYSGtsV.exe
  C:\Windows\System\aYSGtsV.exe
  2⤵
  PID:5680
- C:\Windows\System\xfXApio.exe
  C:\Windows\System\xfXApio.exe
  2⤵
  PID:5700
- C:\Windows\System\AyoqRFl.exe
  C:\Windows\System\AyoqRFl.exe
  2⤵
  PID:5724
- C:\Windows\System\DXVfvce.exe
  C:\Windows\System\DXVfvce.exe
  2⤵
  PID:5756
- C:\Windows\System\WkjsdvZ.exe
  C:\Windows\System\WkjsdvZ.exe
  2⤵
  PID:5780
- C:\Windows\System\iVdNXVb.exe
  C:\Windows\System\iVdNXVb.exe
  2⤵
  PID:5796
- C:\Windows\System\AjfmyUA.exe
  C:\Windows\System\AjfmyUA.exe
  2⤵
  PID:5824
- C:\Windows\System\ogUoQAT.exe
  C:\Windows\System\ogUoQAT.exe
  2⤵
  PID:5856
- C:\Windows\System\viVXuTR.exe
  C:\Windows\System\viVXuTR.exe
  2⤵
  PID:5880
- C:\Windows\System\vVyCkph.exe
  C:\Windows\System\vVyCkph.exe
  2⤵
  PID:5916
- C:\Windows\System\rlvXpTH.exe
  C:\Windows\System\rlvXpTH.exe
  2⤵
  PID:5948
- C:\Windows\System\QpjNuZK.exe
  C:\Windows\System\QpjNuZK.exe
  2⤵
  PID:5972
- C:\Windows\System\THUqtYJ.exe
  C:\Windows\System\THUqtYJ.exe
  2⤵
  PID:6008
- C:\Windows\System\DVKJecf.exe
  C:\Windows\System\DVKJecf.exe
  2⤵
  PID:6024
- C:\Windows\System\nLWmWcp.exe
  C:\Windows\System\nLWmWcp.exe
  2⤵
  PID:6052
- C:\Windows\System\ngHTzwr.exe
  C:\Windows\System\ngHTzwr.exe
  2⤵
  PID:6076
- C:\Windows\System\jaIZsak.exe
  C:\Windows\System\jaIZsak.exe
  2⤵
  PID:6104
- C:\Windows\System\UzsGFLJ.exe
  C:\Windows\System\UzsGFLJ.exe
  2⤵
  PID:6124
- C:\Windows\System\ENXHnoh.exe
  C:\Windows\System\ENXHnoh.exe
  2⤵
  PID:5144
- C:\Windows\System\QOYEQlo.exe
  C:\Windows\System\QOYEQlo.exe
  2⤵
  PID:5204
- C:\Windows\System\uamfNTy.exe
  C:\Windows\System\uamfNTy.exe
  2⤵
  PID:5244
- C:\Windows\System\OTvsCaO.exe
  C:\Windows\System\OTvsCaO.exe
  2⤵
  PID:5272
- C:\Windows\System\FWZFuZn.exe
  C:\Windows\System\FWZFuZn.exe
  2⤵
  PID:5328
- C:\Windows\System\oxzBPQU.exe
  C:\Windows\System\oxzBPQU.exe
  2⤵
  PID:5416
- C:\Windows\System\bOMbvmh.exe
  C:\Windows\System\bOMbvmh.exe
  2⤵
  PID:5444
- C:\Windows\System\mqMFJle.exe
  C:\Windows\System\mqMFJle.exe
  2⤵
  PID:5524
- C:\Windows\System\knlmdWr.exe
  C:\Windows\System\knlmdWr.exe
  2⤵
  PID:3620
- C:\Windows\System\HrjfHHH.exe
  C:\Windows\System\HrjfHHH.exe
  2⤵
  PID:5664
- C:\Windows\System\kYiTLsd.exe
  C:\Windows\System\kYiTLsd.exe
  2⤵
  PID:5792
- C:\Windows\System\MMNtXcz.exe
  C:\Windows\System\MMNtXcz.exe
  2⤵
  PID:500
- C:\Windows\System\BUqBbBq.exe
  C:\Windows\System\BUqBbBq.exe
  2⤵
  PID:5876
- C:\Windows\System\gnggwCe.exe
  C:\Windows\System\gnggwCe.exe
  2⤵
  PID:5900
- C:\Windows\System\BFHwloa.exe
  C:\Windows\System\BFHwloa.exe
  2⤵
  PID:5888
- C:\Windows\System\CqqAuUG.exe
  C:\Windows\System\CqqAuUG.exe
  2⤵
  PID:3732
- C:\Windows\System\jlHQUsg.exe
  C:\Windows\System\jlHQUsg.exe
  2⤵
  PID:6036
- C:\Windows\System\UZyJyFX.exe
  C:\Windows\System\UZyJyFX.exe
  2⤵
  PID:5200
- C:\Windows\System\hRxhqXu.exe
  C:\Windows\System\hRxhqXu.exe
  2⤵
  PID:6096
- C:\Windows\System\wrGscVA.exe
  C:\Windows\System\wrGscVA.exe
  2⤵
  PID:1144
- C:\Windows\System\szYlrcS.exe
  C:\Windows\System\szYlrcS.exe
  2⤵
  PID:5364
- C:\Windows\System\yNfCpfJ.exe
  C:\Windows\System\yNfCpfJ.exe
  2⤵
  PID:5640
- C:\Windows\System\uIKiLDu.exe
  C:\Windows\System\uIKiLDu.exe
  2⤵
  PID:5576
- C:\Windows\System\VXqMxbN.exe
  C:\Windows\System\VXqMxbN.exe
  2⤵
  PID:5580
- C:\Windows\System\zdzLLsZ.exe
  C:\Windows\System\zdzLLsZ.exe
  2⤵
  PID:5688
- C:\Windows\System\ISUDFvx.exe
  C:\Windows\System\ISUDFvx.exe
  2⤵
  PID:5968
- C:\Windows\System\DWCjbxX.exe
  C:\Windows\System\DWCjbxX.exe
  2⤵
  PID:5988
- C:\Windows\System\jPvDcVb.exe
  C:\Windows\System\jPvDcVb.exe
  2⤵
  PID:5356
- C:\Windows\System\mCSqqhm.exe
  C:\Windows\System\mCSqqhm.exe
  2⤵
  PID:5552
- C:\Windows\System\zmoDUZS.exe
  C:\Windows\System\zmoDUZS.exe
  2⤵
  PID:4564
- C:\Windows\System\uSeGQVF.exe
  C:\Windows\System\uSeGQVF.exe
  2⤵
  PID:1092
- C:\Windows\System\fRxeEfv.exe
  C:\Windows\System\fRxeEfv.exe
  2⤵
  PID:5216
- C:\Windows\System\PyrqWZz.exe
  C:\Windows\System\PyrqWZz.exe
  2⤵
  PID:6168
- C:\Windows\System\ZGokXPr.exe
  C:\Windows\System\ZGokXPr.exe
  2⤵
  PID:6196
- C:\Windows\System\pJBcGBS.exe
  C:\Windows\System\pJBcGBS.exe
  2⤵
  PID:6224
- C:\Windows\System\cBxSMBP.exe
  C:\Windows\System\cBxSMBP.exe
  2⤵
  PID:6248
- C:\Windows\System\yMzbYMs.exe
  C:\Windows\System\yMzbYMs.exe
  2⤵
  PID:6276
- C:\Windows\System\hwPZoUB.exe
  C:\Windows\System\hwPZoUB.exe
  2⤵
  PID:6344
- C:\Windows\System\znREyUE.exe
  C:\Windows\System\znREyUE.exe
  2⤵
  PID:6376
- C:\Windows\System\DfrOiAD.exe
  C:\Windows\System\DfrOiAD.exe
  2⤵
  PID:6408
- C:\Windows\System\EkyGfHR.exe
  C:\Windows\System\EkyGfHR.exe
  2⤵
  PID:6444
- C:\Windows\System\rAnKWJg.exe
  C:\Windows\System\rAnKWJg.exe
  2⤵
  PID:6468
- C:\Windows\System\wnDywkQ.exe
  C:\Windows\System\wnDywkQ.exe
  2⤵
  PID:6496
- C:\Windows\System\gzkilKH.exe
  C:\Windows\System\gzkilKH.exe
  2⤵
  PID:6520
- C:\Windows\System\YIRwjKM.exe
  C:\Windows\System\YIRwjKM.exe
  2⤵
  PID:6548
- C:\Windows\System\CsFODNz.exe
  C:\Windows\System\CsFODNz.exe
  2⤵
  PID:6572
- C:\Windows\System\ArGHEJq.exe
  C:\Windows\System\ArGHEJq.exe
  2⤵
  PID:6608
- C:\Windows\System\bBDDiEv.exe
  C:\Windows\System\bBDDiEv.exe
  2⤵
  PID:6640
- C:\Windows\System\dqYOfPt.exe
  C:\Windows\System\dqYOfPt.exe
  2⤵
  PID:6664
- C:\Windows\System\VcdaZgl.exe
  C:\Windows\System\VcdaZgl.exe
  2⤵
  PID:6688
- C:\Windows\System\sSfszOX.exe
  C:\Windows\System\sSfszOX.exe
  2⤵
  PID:6724
- C:\Windows\System\FcOwWtk.exe
  C:\Windows\System\FcOwWtk.exe
  2⤵
  PID:6752
- C:\Windows\System\jPDRKNa.exe
  C:\Windows\System\jPDRKNa.exe
  2⤵
  PID:6780
- C:\Windows\System\rokhBGi.exe
  C:\Windows\System\rokhBGi.exe
  2⤵
  PID:6812
- C:\Windows\System\rUGhreu.exe
  C:\Windows\System\rUGhreu.exe
  2⤵
  PID:6844
- C:\Windows\System\YNjnMpP.exe
  C:\Windows\System\YNjnMpP.exe
  2⤵
  PID:6872
- C:\Windows\System\gEyPCzH.exe
  C:\Windows\System\gEyPCzH.exe
  2⤵
  PID:6904
- C:\Windows\System\tIcRIis.exe
  C:\Windows\System\tIcRIis.exe
  2⤵
  PID:6932
- C:\Windows\System\xDGLwEL.exe
  C:\Windows\System\xDGLwEL.exe
  2⤵
  PID:6956
- C:\Windows\System\aHunJGC.exe
  C:\Windows\System\aHunJGC.exe
  2⤵
  PID:6980
- C:\Windows\System\JtghmEj.exe
  C:\Windows\System\JtghmEj.exe
  2⤵
  PID:7012
- C:\Windows\System\MzVArHa.exe
  C:\Windows\System\MzVArHa.exe
  2⤵
  PID:7036
- C:\Windows\System\flddBmE.exe
  C:\Windows\System\flddBmE.exe
  2⤵
  PID:7068
- C:\Windows\System\sLddciB.exe
  C:\Windows\System\sLddciB.exe
  2⤵
  PID:7100
- C:\Windows\System\CbHgegJ.exe
  C:\Windows\System\CbHgegJ.exe
  2⤵
  PID:7124
- C:\Windows\System\MEJOEBX.exe
  C:\Windows\System\MEJOEBX.exe
  2⤵
  PID:7152
- C:\Windows\System\TbYJqwz.exe
  C:\Windows\System\TbYJqwz.exe
  2⤵
  PID:2300
- C:\Windows\System\bXlOTZZ.exe
  C:\Windows\System\bXlOTZZ.exe
  2⤵
  PID:6152
- C:\Windows\System\rbVjLvp.exe
  C:\Windows\System\rbVjLvp.exe
  2⤵
  PID:6212
- C:\Windows\System\zkYoCXr.exe
  C:\Windows\System\zkYoCXr.exe
  2⤵
  PID:6296
- C:\Windows\System\MPhPpDb.exe
  C:\Windows\System\MPhPpDb.exe
  2⤵
  PID:6384
- C:\Windows\System\EjlZaJs.exe
  C:\Windows\System\EjlZaJs.exe
  2⤵
  PID:6396
- C:\Windows\System\aeVEIAt.exe
  C:\Windows\System\aeVEIAt.exe
  2⤵
  PID:6460
- C:\Windows\System\yMZPchD.exe
  C:\Windows\System\yMZPchD.exe
  2⤵
  PID:6488
- C:\Windows\System\VDBpwRh.exe
  C:\Windows\System\VDBpwRh.exe
  2⤵
  PID:6604
- C:\Windows\System\VJypgNM.exe
  C:\Windows\System\VJypgNM.exe
  2⤵
  PID:6696
- C:\Windows\System\cDMwNNB.exe
  C:\Windows\System\cDMwNNB.exe
  2⤵
  PID:6712
- C:\Windows\System\iJPXCcG.exe
  C:\Windows\System\iJPXCcG.exe
  2⤵
  PID:6896
- C:\Windows\System\irUKXtR.exe
  C:\Windows\System\irUKXtR.exe
  2⤵
  PID:6976
- C:\Windows\System\meTDJCO.exe
  C:\Windows\System\meTDJCO.exe
  2⤵
  PID:7032
- C:\Windows\System\XgYYuHm.exe
  C:\Windows\System\XgYYuHm.exe
  2⤵
  PID:7052
- C:\Windows\System\KqgJxWN.exe
  C:\Windows\System\KqgJxWN.exe
  2⤵
  PID:7160
- C:\Windows\System\TYXGMrP.exe
  C:\Windows\System\TYXGMrP.exe
  2⤵
  PID:4952
- C:\Windows\System\masbHGv.exe
  C:\Windows\System\masbHGv.exe
  2⤵
  PID:1140
- C:\Windows\System\ULJDOzx.exe
  C:\Windows\System\ULJDOzx.exe
  2⤵
  PID:6432
- C:\Windows\System\zpFomdv.exe
  C:\Windows\System\zpFomdv.exe
  2⤵
  PID:6536
- C:\Windows\System\eQjTRVb.exe
  C:\Windows\System\eQjTRVb.exe
  2⤵
  PID:6568
- C:\Windows\System\JEBydwu.exe
  C:\Windows\System\JEBydwu.exe
  2⤵
  PID:6748
- C:\Windows\System\xWFBqnm.exe
  C:\Windows\System\xWFBqnm.exe
  2⤵
  PID:6944
- C:\Windows\System\YzFKqYw.exe
  C:\Windows\System\YzFKqYw.exe
  2⤵
  PID:7084
- C:\Windows\System\boZsxhW.exe
  C:\Windows\System\boZsxhW.exe
  2⤵
  PID:6528
- C:\Windows\System\TffDNOa.exe
  C:\Windows\System\TffDNOa.exe
  2⤵
  PID:7120
- C:\Windows\System\IsevrSv.exe
  C:\Windows\System\IsevrSv.exe
  2⤵
  PID:7088
- C:\Windows\System\VaiFSrK.exe
  C:\Windows\System\VaiFSrK.exe
  2⤵
  PID:7180
- C:\Windows\System\NUVmNVD.exe
  C:\Windows\System\NUVmNVD.exe
  2⤵
  PID:7200
- C:\Windows\System\NvikpxM.exe
  C:\Windows\System\NvikpxM.exe
  2⤵
  PID:7224
- C:\Windows\System\vUknoJt.exe
  C:\Windows\System\vUknoJt.exe
  2⤵
  PID:7252
- C:\Windows\System\IoDXYTK.exe
  C:\Windows\System\IoDXYTK.exe
  2⤵
  PID:7276
- C:\Windows\System\CfFHAcN.exe
  C:\Windows\System\CfFHAcN.exe
  2⤵
  PID:7292
- C:\Windows\System\YslfhJE.exe
  C:\Windows\System\YslfhJE.exe
  2⤵
  PID:7324
- C:\Windows\System\GUngjzv.exe
  C:\Windows\System\GUngjzv.exe
  2⤵
  PID:7348
- C:\Windows\System\LPNgGsb.exe
  C:\Windows\System\LPNgGsb.exe
  2⤵
  PID:7372
- C:\Windows\System\pqNWuIW.exe
  C:\Windows\System\pqNWuIW.exe
  2⤵
  PID:7392
- C:\Windows\System\RFDrUps.exe
  C:\Windows\System\RFDrUps.exe
  2⤵
  PID:7420
- C:\Windows\System\KoJSUBz.exe
  C:\Windows\System\KoJSUBz.exe
  2⤵
  PID:7452
- C:\Windows\System\skSKRbN.exe
  C:\Windows\System\skSKRbN.exe
  2⤵
  PID:7476
- C:\Windows\System\qIXTcFK.exe
  C:\Windows\System\qIXTcFK.exe
  2⤵
  PID:7520
- C:\Windows\System\iqEtjdI.exe
  C:\Windows\System\iqEtjdI.exe
  2⤵
  PID:7544
- C:\Windows\System\TgpohAC.exe
  C:\Windows\System\TgpohAC.exe
  2⤵
  PID:7572
- C:\Windows\System\MwLGjCg.exe
  C:\Windows\System\MwLGjCg.exe
  2⤵
  PID:7592
- C:\Windows\System\IkswCus.exe
  C:\Windows\System\IkswCus.exe
  2⤵
  PID:7620
- C:\Windows\System\YHYooOc.exe
  C:\Windows\System\YHYooOc.exe
  2⤵
  PID:7668
- C:\Windows\System\VcjqpHm.exe
  C:\Windows\System\VcjqpHm.exe
  2⤵
  PID:7696
- C:\Windows\System\jxayWWK.exe
  C:\Windows\System\jxayWWK.exe
  2⤵
  PID:7728
- C:\Windows\System\WhTSGEP.exe
  C:\Windows\System\WhTSGEP.exe
  2⤵
  PID:7764
- C:\Windows\System\WmRecqJ.exe
  C:\Windows\System\WmRecqJ.exe
  2⤵
  PID:7788
- C:\Windows\System\VtMPYkX.exe
  C:\Windows\System\VtMPYkX.exe
  2⤵
  PID:7812
- C:\Windows\System\bYoGrJy.exe
  C:\Windows\System\bYoGrJy.exe
  2⤵
  PID:7836
- C:\Windows\System\AptTXDv.exe
  C:\Windows\System\AptTXDv.exe
  2⤵
  PID:7852
- C:\Windows\System\tShdJsT.exe
  C:\Windows\System\tShdJsT.exe
  2⤵
  PID:7872
- C:\Windows\System\KyTsTdp.exe
  C:\Windows\System\KyTsTdp.exe
  2⤵
  PID:7896
- C:\Windows\System\jsSjUmw.exe
  C:\Windows\System\jsSjUmw.exe
  2⤵
  PID:7920
- C:\Windows\System\oghGJkM.exe
  C:\Windows\System\oghGJkM.exe
  2⤵
  PID:7952
- C:\Windows\System\HDheclh.exe
  C:\Windows\System\HDheclh.exe
  2⤵
  PID:7980
- C:\Windows\System\vEOHIzX.exe
  C:\Windows\System\vEOHIzX.exe
  2⤵
  PID:8016
- C:\Windows\System\qQasGsS.exe
  C:\Windows\System\qQasGsS.exe
  2⤵
  PID:8044
- C:\Windows\System\xnFdrXI.exe
  C:\Windows\System\xnFdrXI.exe
  2⤵
  PID:8076
- C:\Windows\System\rZTDQoM.exe
  C:\Windows\System\rZTDQoM.exe
  2⤵
  PID:8096
- C:\Windows\System\ulRVJMq.exe
  C:\Windows\System\ulRVJMq.exe
  2⤵
  PID:8124
- C:\Windows\System\SHmCuvh.exe
  C:\Windows\System\SHmCuvh.exe
  2⤵
  PID:8152
- C:\Windows\System\DWXlZMm.exe
  C:\Windows\System\DWXlZMm.exe
  2⤵
  PID:8184
- C:\Windows\System\aKdDoak.exe
  C:\Windows\System\aKdDoak.exe
  2⤵
  PID:7176
- C:\Windows\System\JqtsVxp.exe
  C:\Windows\System\JqtsVxp.exe
  2⤵
  PID:7240
- C:\Windows\System\AqzCcjT.exe
  C:\Windows\System\AqzCcjT.exe
  2⤵
  PID:7272
- C:\Windows\System\CcxPLmN.exe
  C:\Windows\System\CcxPLmN.exe
  2⤵
  PID:7364
- C:\Windows\System\hqzvNAp.exe
  C:\Windows\System\hqzvNAp.exe
  2⤵
  PID:7384
- C:\Windows\System\dfnDXok.exe
  C:\Windows\System\dfnDXok.exe
  2⤵
  PID:7488
- C:\Windows\System\lHAqqaJ.exe
  C:\Windows\System\lHAqqaJ.exe
  2⤵
  PID:7556
- C:\Windows\System\tGRdzRP.exe
  C:\Windows\System\tGRdzRP.exe
  2⤵
  PID:7616
- C:\Windows\System\byCVEqI.exe
  C:\Windows\System\byCVEqI.exe
  2⤵
  PID:7688
- C:\Windows\System\PPjJwcC.exe
  C:\Windows\System\PPjJwcC.exe
  2⤵
  PID:7804
- C:\Windows\System\dTANbrr.exe
  C:\Windows\System\dTANbrr.exe
  2⤵
  PID:7868
- C:\Windows\System\lPnbNQW.exe
  C:\Windows\System\lPnbNQW.exe
  2⤵
  PID:7908
- C:\Windows\System\xckjCvI.exe
  C:\Windows\System\xckjCvI.exe
  2⤵
  PID:7944
- C:\Windows\System\mGBMfnR.exe
  C:\Windows\System\mGBMfnR.exe
  2⤵
  PID:7916
- C:\Windows\System\sgYiuWC.exe
  C:\Windows\System\sgYiuWC.exe
  2⤵
  PID:8104
- C:\Windows\System\gPzNdrX.exe
  C:\Windows\System\gPzNdrX.exe
  2⤵
  PID:8072
- C:\Windows\System\ZYcNIYe.exe
  C:\Windows\System\ZYcNIYe.exe
  2⤵
  PID:6924
- C:\Windows\System\UPOoeOL.exe
  C:\Windows\System\UPOoeOL.exe
  2⤵
  PID:7388
- C:\Windows\System\OcStIxp.exe
  C:\Windows\System\OcStIxp.exe
  2⤵
  PID:7340
- C:\Windows\System\wiVHLsd.exe
  C:\Windows\System\wiVHLsd.exe
  2⤵
  PID:7652
- C:\Windows\System\maVtXZJ.exe
  C:\Windows\System\maVtXZJ.exe
  2⤵
  PID:7884
- C:\Windows\System\Yppshwb.exe
  C:\Windows\System\Yppshwb.exe
  2⤵
  PID:7864
- C:\Windows\System\DRbHoMa.exe
  C:\Windows\System\DRbHoMa.exe
  2⤵
  PID:7288
- C:\Windows\System\zwUSoIw.exe
  C:\Windows\System\zwUSoIw.exe
  2⤵
  PID:7588
- C:\Windows\System\BtxrWIe.exe
  C:\Windows\System\BtxrWIe.exe
  2⤵
  PID:7440
- C:\Windows\System\aQyWpLD.exe
  C:\Windows\System\aQyWpLD.exe
  2⤵
  PID:8196
- C:\Windows\System\fVyAjSS.exe
  C:\Windows\System\fVyAjSS.exe
  2⤵
  PID:8224
- C:\Windows\System\iSSLWbx.exe
  C:\Windows\System\iSSLWbx.exe
  2⤵
  PID:8244
- C:\Windows\System\uTMNsTI.exe
  C:\Windows\System\uTMNsTI.exe
  2⤵
  PID:8292
- C:\Windows\System\CRzRvec.exe
  C:\Windows\System\CRzRvec.exe
  2⤵
  PID:8320
- C:\Windows\System\bbCgejf.exe
  C:\Windows\System\bbCgejf.exe
  2⤵
  PID:8356
- C:\Windows\System\nGasoNk.exe
  C:\Windows\System\nGasoNk.exe
  2⤵
  PID:8376
- C:\Windows\System\VbfRSCZ.exe
  C:\Windows\System\VbfRSCZ.exe
  2⤵
  PID:8404
- C:\Windows\System\mxrTwgp.exe
  C:\Windows\System\mxrTwgp.exe
  2⤵
  PID:8428
- C:\Windows\System\WFpexxd.exe
  C:\Windows\System\WFpexxd.exe
  2⤵
  PID:8448
- C:\Windows\System\gNtQmdJ.exe
  C:\Windows\System\gNtQmdJ.exe
  2⤵
  PID:8480
- C:\Windows\System\SQXKLuI.exe
  C:\Windows\System\SQXKLuI.exe
  2⤵
  PID:8508
- C:\Windows\System\DDmDNji.exe
  C:\Windows\System\DDmDNji.exe
  2⤵
  PID:8536
- C:\Windows\System\dZlHmYQ.exe
  C:\Windows\System\dZlHmYQ.exe
  2⤵
  PID:8560
- C:\Windows\System\pmEeCoN.exe
  C:\Windows\System\pmEeCoN.exe
  2⤵
  PID:8592
- C:\Windows\System\hUnruFN.exe
  C:\Windows\System\hUnruFN.exe
  2⤵
  PID:8616
- C:\Windows\System\dgebBID.exe
  C:\Windows\System\dgebBID.exe
  2⤵
  PID:8644
- C:\Windows\System\laszTDB.exe
  C:\Windows\System\laszTDB.exe
  2⤵
  PID:8696
- C:\Windows\System\lxNWApa.exe
  C:\Windows\System\lxNWApa.exe
  2⤵
  PID:8712
- C:\Windows\System\BwJHfOD.exe
  C:\Windows\System\BwJHfOD.exe
  2⤵
  PID:8732
- C:\Windows\System\WyZvyfn.exe
  C:\Windows\System\WyZvyfn.exe
  2⤵
  PID:8760
- C:\Windows\System\FAwpcke.exe
  C:\Windows\System\FAwpcke.exe
  2⤵
  PID:8788
- C:\Windows\System\HuNDDpC.exe
  C:\Windows\System\HuNDDpC.exe
  2⤵
  PID:8812
- C:\Windows\System\kHaRdpP.exe
  C:\Windows\System\kHaRdpP.exe
  2⤵
  PID:8848
- C:\Windows\System\XkuHouC.exe
  C:\Windows\System\XkuHouC.exe
  2⤵
  PID:8872
- C:\Windows\System\QWyoktT.exe
  C:\Windows\System\QWyoktT.exe
  2⤵
  PID:8908
- C:\Windows\System\HdvNKUl.exe
  C:\Windows\System\HdvNKUl.exe
  2⤵
  PID:8936
- C:\Windows\System\RUTGkXJ.exe
  C:\Windows\System\RUTGkXJ.exe
  2⤵
  PID:8964
- C:\Windows\System\mPTREsD.exe
  C:\Windows\System\mPTREsD.exe
  2⤵
  PID:8984
- C:\Windows\System\jdtDWGU.exe
  C:\Windows\System\jdtDWGU.exe
  2⤵
  PID:9012
- C:\Windows\System\WPxAvSP.exe
  C:\Windows\System\WPxAvSP.exe
  2⤵
  PID:9040
- C:\Windows\System\tnbAqlG.exe
  C:\Windows\System\tnbAqlG.exe
  2⤵
  PID:9068
- C:\Windows\System\BklPTee.exe
  C:\Windows\System\BklPTee.exe
  2⤵
  PID:9092
- C:\Windows\System\lFaFexC.exe
  C:\Windows\System\lFaFexC.exe
  2⤵
  PID:9128
- C:\Windows\System\dNwentM.exe
  C:\Windows\System\dNwentM.exe
  2⤵
  PID:9148
- C:\Windows\System\iHqfayx.exe
  C:\Windows\System\iHqfayx.exe
  2⤵
  PID:9176
- C:\Windows\System\rRSfXyv.exe
  C:\Windows\System\rRSfXyv.exe
  2⤵
  PID:9196
- C:\Windows\System\ZCkcFNi.exe
  C:\Windows\System\ZCkcFNi.exe
  2⤵
  PID:7416
- C:\Windows\System\oBTTRPf.exe
  C:\Windows\System\oBTTRPf.exe
  2⤵
  PID:8236
- C:\Windows\System\qMNtFYg.exe
  C:\Windows\System\qMNtFYg.exe
  2⤵
  PID:8216
- C:\Windows\System\TFuiBPB.exe
  C:\Windows\System\TFuiBPB.exe
  2⤵
  PID:8336
- C:\Windows\System\yDgkaNQ.exe
  C:\Windows\System\yDgkaNQ.exe
  2⤵
  PID:8372
- C:\Windows\System\jYMLZKs.exe
  C:\Windows\System\jYMLZKs.exe
  2⤵
  PID:8520
- C:\Windows\System\bqVnqec.exe
  C:\Windows\System\bqVnqec.exe
  2⤵
  PID:8444
- C:\Windows\System\vUPuNSP.exe
  C:\Windows\System\vUPuNSP.exe
  2⤵
  PID:8660
- C:\Windows\System\kukuifq.exe
  C:\Windows\System\kukuifq.exe
  2⤵
  PID:8556
- C:\Windows\System\dzefrck.exe
  C:\Windows\System\dzefrck.exe
  2⤵
  PID:8612
- C:\Windows\System\DulyVRS.exe
  C:\Windows\System\DulyVRS.exe
  2⤵
  PID:8748
- C:\Windows\System\RAuRhqJ.exe
  C:\Windows\System\RAuRhqJ.exe
  2⤵
  PID:8892
- C:\Windows\System\SDhgFHF.exe
  C:\Windows\System\SDhgFHF.exe
  2⤵
  PID:8840
- C:\Windows\System\lsWhvjO.exe
  C:\Windows\System\lsWhvjO.exe
  2⤵
  PID:9004
- C:\Windows\System\QuFtgnV.exe
  C:\Windows\System\QuFtgnV.exe
  2⤵
  PID:8952
- C:\Windows\System\xLTVlUk.exe
  C:\Windows\System\xLTVlUk.exe
  2⤵
  PID:9116
- C:\Windows\System\SUIORRO.exe
  C:\Windows\System\SUIORRO.exe
  2⤵
  PID:9140
- C:\Windows\System\egCLTCF.exe
  C:\Windows\System\egCLTCF.exe
  2⤵
  PID:8092
- C:\Windows\System\WMLQKrL.exe
  C:\Windows\System\WMLQKrL.exe
  2⤵
  PID:7512
- C:\Windows\System\IRIvEwE.exe
  C:\Windows\System\IRIvEwE.exe
  2⤵
  PID:7216
- C:\Windows\System\uSRDIWY.exe
  C:\Windows\System\uSRDIWY.exe
  2⤵
  PID:8420
- C:\Windows\System\QovzFUL.exe
  C:\Windows\System\QovzFUL.exe
  2⤵
  PID:8384
- C:\Windows\System\uhmTPFj.exe
  C:\Windows\System\uhmTPFj.exe
  2⤵
  PID:8740
- C:\Windows\System\gfBOrti.exe
  C:\Windows\System\gfBOrti.exe
  2⤵
  PID:9020
- C:\Windows\System\ZxuCATO.exe
  C:\Windows\System\ZxuCATO.exe
  2⤵
  PID:8928
- C:\Windows\System\fRsDZSB.exe
  C:\Windows\System\fRsDZSB.exe
  2⤵
  PID:8032
- C:\Windows\System\IbCgubb.exe
  C:\Windows\System\IbCgubb.exe
  2⤵
  PID:9060
- C:\Windows\System\QgjuyzV.exe
  C:\Windows\System\QgjuyzV.exe
  2⤵
  PID:9220
- C:\Windows\System\kvZfQCq.exe
  C:\Windows\System\kvZfQCq.exe
  2⤵
  PID:9240
- C:\Windows\System\BnKvrFw.exe
  C:\Windows\System\BnKvrFw.exe
  2⤵
  PID:9276
- C:\Windows\System\nATkRgS.exe
  C:\Windows\System\nATkRgS.exe
  2⤵
  PID:9296
- C:\Windows\System\udOKRQw.exe
  C:\Windows\System\udOKRQw.exe
  2⤵
  PID:9316
- C:\Windows\System\poqrOnH.exe
  C:\Windows\System\poqrOnH.exe
  2⤵
  PID:9352
- C:\Windows\System\zbwrRCk.exe
  C:\Windows\System\zbwrRCk.exe
  2⤵
  PID:9372
- C:\Windows\System\lNvniEc.exe
  C:\Windows\System\lNvniEc.exe
  2⤵
  PID:9396
- C:\Windows\System\FakcDFl.exe
  C:\Windows\System\FakcDFl.exe
  2⤵
  PID:9572
- C:\Windows\System\TSQJCLc.exe
  C:\Windows\System\TSQJCLc.exe
  2⤵
  PID:9588
- C:\Windows\System\RanXtoo.exe
  C:\Windows\System\RanXtoo.exe
  2⤵
  PID:9616
- C:\Windows\System\TUvzNFD.exe
  C:\Windows\System\TUvzNFD.exe
  2⤵
  PID:9644
- C:\Windows\System\NZiHtbW.exe
  C:\Windows\System\NZiHtbW.exe
  2⤵
  PID:9672
- C:\Windows\System\iOFDpny.exe
  C:\Windows\System\iOFDpny.exe
  2⤵
  PID:9692
- C:\Windows\System\yRdnJDs.exe
  C:\Windows\System\yRdnJDs.exe
  2⤵
  PID:9720
- C:\Windows\System\yWlxUOL.exe
  C:\Windows\System\yWlxUOL.exe
  2⤵
  PID:9744
- C:\Windows\System\IqXnbMa.exe
  C:\Windows\System\IqXnbMa.exe
  2⤵
  PID:9760
- C:\Windows\System\WkLoeSD.exe
  C:\Windows\System\WkLoeSD.exe
  2⤵
  PID:9784
- C:\Windows\System\YEhECpB.exe
  C:\Windows\System\YEhECpB.exe
  2⤵
  PID:9812
- C:\Windows\System\WJjthGZ.exe
  C:\Windows\System\WJjthGZ.exe
  2⤵
  PID:9844
- C:\Windows\System\EHlPDdc.exe
  C:\Windows\System\EHlPDdc.exe
  2⤵
  PID:9872
- C:\Windows\System\qoitDJN.exe
  C:\Windows\System\qoitDJN.exe
  2⤵
  PID:9896
- C:\Windows\System\gfvxqdb.exe
  C:\Windows\System\gfvxqdb.exe
  2⤵
  PID:9924
- C:\Windows\System\rMDIylt.exe
  C:\Windows\System\rMDIylt.exe
  2⤵
  PID:9952
- C:\Windows\System\YAIwNEE.exe
  C:\Windows\System\YAIwNEE.exe
  2⤵
  PID:9972
- C:\Windows\System\cwuJpTk.exe
  C:\Windows\System\cwuJpTk.exe
  2⤵
  PID:10000
- C:\Windows\System\XkEQWTj.exe
  C:\Windows\System\XkEQWTj.exe
  2⤵
  PID:10028
- C:\Windows\System\tACdBwf.exe
  C:\Windows\System\tACdBwf.exe
  2⤵
  PID:10044
- C:\Windows\System\vzCtsYF.exe
  C:\Windows\System\vzCtsYF.exe
  2⤵
  PID:10068
- C:\Windows\System\sbElVwh.exe
  C:\Windows\System\sbElVwh.exe
  2⤵
  PID:10096
- C:\Windows\System\sKlnKbC.exe
  C:\Windows\System\sKlnKbC.exe
  2⤵
  PID:10132
- C:\Windows\System\lmvKcjG.exe
  C:\Windows\System\lmvKcjG.exe
  2⤵
  PID:10156
- C:\Windows\System\aZpNcbE.exe
  C:\Windows\System\aZpNcbE.exe
  2⤵
  PID:10180
- C:\Windows\System\Dhkykcv.exe
  C:\Windows\System\Dhkykcv.exe
  2⤵
  PID:10208
- C:\Windows\System\yxVfUsl.exe
  C:\Windows\System\yxVfUsl.exe
  2⤵
  PID:8972
- C:\Windows\System\hiRhaKt.exe
  C:\Windows\System\hiRhaKt.exe
  2⤵
  PID:8920
- C:\Windows\System\qVGsBFV.exe
  C:\Windows\System\qVGsBFV.exe
  2⤵
  PID:9236
- C:\Windows\System\nfqUCVq.exe
  C:\Windows\System\nfqUCVq.exe
  2⤵
  PID:8904
- C:\Windows\System\suTfzRX.exe
  C:\Windows\System\suTfzRX.exe
  2⤵
  PID:9368
- C:\Windows\System\QlfKNHF.exe
  C:\Windows\System\QlfKNHF.exe
  2⤵
  PID:9288
- C:\Windows\System\NZLemny.exe
  C:\Windows\System\NZLemny.exe
  2⤵
  PID:9308
- C:\Windows\System\BsdPQst.exe
  C:\Windows\System\BsdPQst.exe
  2⤵
  PID:9448
- C:\Windows\System\wbpgKjc.exe
  C:\Windows\System\wbpgKjc.exe
  2⤵
  PID:9488
- C:\Windows\System\UbwOQvq.exe
  C:\Windows\System\UbwOQvq.exe
  2⤵
  PID:7496
- C:\Windows\System\SQKIbQr.exe
  C:\Windows\System\SQKIbQr.exe
  2⤵
  PID:9632
- C:\Windows\System\yqsFLGG.exe
  C:\Windows\System\yqsFLGG.exe
  2⤵
  PID:9688
- C:\Windows\System\JsYjFKI.exe
  C:\Windows\System\JsYjFKI.exe
  2⤵
  PID:9756
- C:\Windows\System\BoFCgZo.exe
  C:\Windows\System\BoFCgZo.exe
  2⤵
  PID:9856
- C:\Windows\System\MSBuXLQ.exe
  C:\Windows\System\MSBuXLQ.exe
  2⤵
  PID:9968
- C:\Windows\System\dTQPVkD.exe
  C:\Windows\System\dTQPVkD.exe
  2⤵
  PID:10040
- C:\Windows\System\jzPegLk.exe
  C:\Windows\System\jzPegLk.exe
  2⤵
  PID:10036
- C:\Windows\System\HykSIzI.exe
  C:\Windows\System\HykSIzI.exe
  2⤵
  PID:10144
- C:\Windows\System\PQRadmw.exe
  C:\Windows\System\PQRadmw.exe
  2⤵
  PID:10232
- C:\Windows\System\zUUTloo.exe
  C:\Windows\System\zUUTloo.exe
  2⤵
  PID:10152
- C:\Windows\System\emmruIC.exe
  C:\Windows\System\emmruIC.exe
  2⤵
  PID:9324
- C:\Windows\System\UohHHXL.exe
  C:\Windows\System\UohHHXL.exe
  2⤵
  PID:9364
- C:\Windows\System\XjCcwlH.exe
  C:\Windows\System\XjCcwlH.exe
  2⤵
  PID:9528
- C:\Windows\System\UjzspIA.exe
  C:\Windows\System\UjzspIA.exe
  2⤵
  PID:9736
- C:\Windows\System\xprYaBt.exe
  C:\Windows\System\xprYaBt.exe
  2⤵
  PID:9752
- C:\Windows\System\ipHjxok.exe
  C:\Windows\System\ipHjxok.exe
  2⤵
  PID:9580
- C:\Windows\System\nhWtpAZ.exe
  C:\Windows\System\nhWtpAZ.exe
  2⤵
  PID:10016
- C:\Windows\System\EmOLehl.exe
  C:\Windows\System\EmOLehl.exe
  2⤵
  PID:9908
- C:\Windows\System\rrJxvHJ.exe
  C:\Windows\System\rrJxvHJ.exe
  2⤵
  PID:10080
- C:\Windows\System\dbOgubc.exe
  C:\Windows\System\dbOgubc.exe
  2⤵
  PID:9264
- C:\Windows\System\NyNtrKm.exe
  C:\Windows\System\NyNtrKm.exe
  2⤵
  PID:10256
- C:\Windows\System\uhvqdLk.exe
  C:\Windows\System\uhvqdLk.exe
  2⤵
  PID:10288
- C:\Windows\System\pvhwTBQ.exe
  C:\Windows\System\pvhwTBQ.exe
  2⤵
  PID:10312
- C:\Windows\System\cWXBoEc.exe
  C:\Windows\System\cWXBoEc.exe
  2⤵
  PID:10332
- C:\Windows\System\ocbUXcs.exe
  C:\Windows\System\ocbUXcs.exe
  2⤵
  PID:10356
- C:\Windows\System\XdXtUZC.exe
  C:\Windows\System\XdXtUZC.exe
  2⤵
  PID:10376
- C:\Windows\System\mwDAwxg.exe
  C:\Windows\System\mwDAwxg.exe
  2⤵
  PID:10412
- C:\Windows\System\BNPseML.exe
  C:\Windows\System\BNPseML.exe
  2⤵
  PID:10436
- C:\Windows\System\ZhCovNQ.exe
  C:\Windows\System\ZhCovNQ.exe
  2⤵
  PID:10460
- C:\Windows\System\VimTcSU.exe
  C:\Windows\System\VimTcSU.exe
  2⤵
  PID:10520
- C:\Windows\System\YTftkfo.exe
  C:\Windows\System\YTftkfo.exe
  2⤵
  PID:10540
- C:\Windows\System\wdNbbEk.exe
  C:\Windows\System\wdNbbEk.exe
  2⤵
  PID:10564
- C:\Windows\System\NvgItUq.exe
  C:\Windows\System\NvgItUq.exe
  2⤵
  PID:10588
- C:\Windows\System\mdmVpGD.exe
  C:\Windows\System\mdmVpGD.exe
  2⤵
  PID:10620
- C:\Windows\System\YBjuuFF.exe
  C:\Windows\System\YBjuuFF.exe
  2⤵
  PID:10652
- C:\Windows\System\ECxgyUd.exe
  C:\Windows\System\ECxgyUd.exe
  2⤵
  PID:10676
- C:\Windows\System\plNxuzz.exe
  C:\Windows\System\plNxuzz.exe
  2⤵
  PID:10700
- C:\Windows\System\iBtFERC.exe
  C:\Windows\System\iBtFERC.exe
  2⤵
  PID:10724
- C:\Windows\System\BXjdvGV.exe
  C:\Windows\System\BXjdvGV.exe
  2⤵
  PID:10756
- C:\Windows\System\bbOgDVa.exe
  C:\Windows\System\bbOgDVa.exe
  2⤵
  PID:10784
- C:\Windows\System\MbTQEbL.exe
  C:\Windows\System\MbTQEbL.exe
  2⤵
  PID:10816
- C:\Windows\System\DYFgAJy.exe
  C:\Windows\System\DYFgAJy.exe
  2⤵
  PID:10844
- C:\Windows\System\dmNKzxQ.exe
  C:\Windows\System\dmNKzxQ.exe
  2⤵
  PID:10876
- C:\Windows\System\dzyiPxt.exe
  C:\Windows\System\dzyiPxt.exe
  2⤵
  PID:10900
- C:\Windows\System\JynEbEt.exe
  C:\Windows\System\JynEbEt.exe
  2⤵
  PID:10928
- C:\Windows\System\JZaTppu.exe
  C:\Windows\System\JZaTppu.exe
  2⤵
  PID:10956
- C:\Windows\System\BifWVTy.exe
  C:\Windows\System\BifWVTy.exe
  2⤵
  PID:10976
- C:\Windows\System\hdxaDhr.exe
  C:\Windows\System\hdxaDhr.exe
  2⤵
  PID:11004
- C:\Windows\System\qqLOwtU.exe
  C:\Windows\System\qqLOwtU.exe
  2⤵
  PID:11028
- C:\Windows\System\AaPJJCa.exe
  C:\Windows\System\AaPJJCa.exe
  2⤵
  PID:11044
- C:\Windows\System\hvahcoa.exe
  C:\Windows\System\hvahcoa.exe
  2⤵
  PID:11068
- C:\Windows\System\TdKxiiQ.exe
  C:\Windows\System\TdKxiiQ.exe
  2⤵
  PID:11092
- C:\Windows\System\TzlxfkY.exe
  C:\Windows\System\TzlxfkY.exe
  2⤵
  PID:11116
- C:\Windows\System\tIJbDQR.exe
  C:\Windows\System\tIJbDQR.exe
  2⤵
  PID:11136
- C:\Windows\System\BVlHEEv.exe
  C:\Windows\System\BVlHEEv.exe
  2⤵
  PID:11152
- C:\Windows\System\rPpJjmD.exe
  C:\Windows\System\rPpJjmD.exe
  2⤵
  PID:11184
- C:\Windows\System\rYcyCZI.exe
  C:\Windows\System\rYcyCZI.exe
  2⤵
  PID:11208
- C:\Windows\System\pCZipBE.exe
  C:\Windows\System\pCZipBE.exe
  2⤵
  PID:11240
- C:\Windows\System\voshLWy.exe
  C:\Windows\System\voshLWy.exe
  2⤵
  PID:11260
- C:\Windows\System\UhHktHO.exe
  C:\Windows\System\UhHktHO.exe
  2⤵
  PID:10008
- C:\Windows\System\azhVJur.exe
  C:\Windows\System\azhVJur.exe
  2⤵
  PID:9708
- C:\Windows\System\bbzuJXv.exe
  C:\Windows\System\bbzuJXv.exe
  2⤵
  PID:10268
- C:\Windows\System\kpBoLVI.exe
  C:\Windows\System\kpBoLVI.exe
  2⤵
  PID:10248
- C:\Windows\System\gUkyEEi.exe
  C:\Windows\System\gUkyEEi.exe
  2⤵
  PID:10088
- C:\Windows\System\aeQzBHD.exe
  C:\Windows\System\aeQzBHD.exe
  2⤵
  PID:10396
- C:\Windows\System\UwZiesw.exe
  C:\Windows\System\UwZiesw.exe
  2⤵
  PID:10348
- C:\Windows\System\IjKJpwy.exe
  C:\Windows\System\IjKJpwy.exe
  2⤵
  PID:10552
- C:\Windows\System\oqVnoSC.exe
  C:\Windows\System\oqVnoSC.exe
  2⤵
  PID:10584
- C:\Windows\System\RyqVLkp.exe
  C:\Windows\System\RyqVLkp.exe
  2⤵
  PID:10532
- C:\Windows\System\VFdWuKi.exe
  C:\Windows\System\VFdWuKi.exe
  2⤵
  PID:10712
- C:\Windows\System\qhSkBhu.exe
  C:\Windows\System\qhSkBhu.exe
  2⤵
  PID:10628
- C:\Windows\System\RrTgeda.exe
  C:\Windows\System\RrTgeda.exe
  2⤵
  PID:10672
- C:\Windows\System\OTwqyRN.exe
  C:\Windows\System\OTwqyRN.exe
  2⤵
  PID:11128
- C:\Windows\System\PBlTXdk.exe
  C:\Windows\System\PBlTXdk.exe
  2⤵
  PID:10948
- C:\Windows\System\zKPsfNl.exe
  C:\Windows\System\zKPsfNl.exe
  2⤵
  PID:11192
- C:\Windows\System\VQVGQUd.exe
  C:\Windows\System\VQVGQUd.exe
  2⤵
  PID:9824
- C:\Windows\System\iPxDSBF.exe
  C:\Windows\System\iPxDSBF.exe
  2⤵
  PID:4064
- C:\Windows\System\cQzCtvs.exe
  C:\Windows\System\cQzCtvs.exe
  2⤵
  PID:11056
- C:\Windows\System\EZZoSER.exe
  C:\Windows\System\EZZoSER.exe
  2⤵
  PID:11284
- C:\Windows\System\ROZJIGD.exe
  C:\Windows\System\ROZJIGD.exe
  2⤵
  PID:11300
- C:\Windows\System\rhnwPHk.exe
  C:\Windows\System\rhnwPHk.exe
  2⤵
  PID:11324
- C:\Windows\System\BHCHKqP.exe
  C:\Windows\System\BHCHKqP.exe
  2⤵
  PID:11348
- C:\Windows\System\aiyabzH.exe
  C:\Windows\System\aiyabzH.exe
  2⤵
  PID:11368
- C:\Windows\System\UrQZBgK.exe
  C:\Windows\System\UrQZBgK.exe
  2⤵
  PID:11396
- C:\Windows\System\xUYurxC.exe
  C:\Windows\System\xUYurxC.exe
  2⤵
  PID:11428
- C:\Windows\System\yxjdKiS.exe
  C:\Windows\System\yxjdKiS.exe
  2⤵
  PID:11452
- C:\Windows\System\fOOFnWE.exe
  C:\Windows\System\fOOFnWE.exe
  2⤵
  PID:11476
- C:\Windows\System\MpDcAMz.exe
  C:\Windows\System\MpDcAMz.exe
  2⤵
  PID:11500
- C:\Windows\System\bDuGsEt.exe
  C:\Windows\System\bDuGsEt.exe
  2⤵
  PID:11524
- C:\Windows\System\dMAobCb.exe
  C:\Windows\System\dMAobCb.exe
  2⤵
  PID:11548
- C:\Windows\System\yeeXZYK.exe
  C:\Windows\System\yeeXZYK.exe
  2⤵
  PID:11576
- C:\Windows\System\QRouCoq.exe
  C:\Windows\System\QRouCoq.exe
  2⤵
  PID:11596
- C:\Windows\System\nJEZFkC.exe
  C:\Windows\System\nJEZFkC.exe
  2⤵
  PID:11628
- C:\Windows\System\ipWCxjQ.exe
  C:\Windows\System\ipWCxjQ.exe
  2⤵
  PID:11652
- C:\Windows\System\ADLgXsY.exe
  C:\Windows\System\ADLgXsY.exe
  2⤵
  PID:11680
- C:\Windows\System\QsHpYKw.exe
  C:\Windows\System\QsHpYKw.exe
  2⤵
  PID:11712
- C:\Windows\System\WDWtcia.exe
  C:\Windows\System\WDWtcia.exe
  2⤵
  PID:11752
- C:\Windows\System\SljEfwn.exe
  C:\Windows\System\SljEfwn.exe
  2⤵
  PID:11792
- C:\Windows\System\xOtopyR.exe
  C:\Windows\System\xOtopyR.exe
  2⤵
  PID:11832
- C:\Windows\System\QygfPYk.exe
  C:\Windows\System\QygfPYk.exe
  2⤵
  PID:11848
- C:\Windows\System\LRwWvRL.exe
  C:\Windows\System\LRwWvRL.exe
  2⤵
  PID:11880
- C:\Windows\System\vCmiCqZ.exe
  C:\Windows\System\vCmiCqZ.exe
  2⤵
  PID:11896
- C:\Windows\System\zhkzUgN.exe
  C:\Windows\System\zhkzUgN.exe
  2⤵
  PID:11924
- C:\Windows\System\faRyQzK.exe
  C:\Windows\System\faRyQzK.exe
  2⤵
  PID:11952
- C:\Windows\System\ymodkvW.exe
  C:\Windows\System\ymodkvW.exe
  2⤵
  PID:12012
- C:\Windows\System\cGplrUy.exe
  C:\Windows\System\cGplrUy.exe
  2⤵
  PID:12028
- C:\Windows\System\ledtkjm.exe
  C:\Windows\System\ledtkjm.exe
  2⤵
  PID:12068
- C:\Windows\System\UGLlYXA.exe
  C:\Windows\System\UGLlYXA.exe
  2⤵
  PID:12096
- C:\Windows\System\SYmTzsY.exe
  C:\Windows\System\SYmTzsY.exe
  2⤵
  PID:12124
- C:\Windows\System\TFUtVNZ.exe
  C:\Windows\System\TFUtVNZ.exe
  2⤵
  PID:12152
- C:\Windows\System\FEBdPwq.exe
  C:\Windows\System\FEBdPwq.exe
  2⤵
  PID:12184
- C:\Windows\System\MuBhjgZ.exe
  C:\Windows\System\MuBhjgZ.exe
  2⤵
  PID:12208
- C:\Windows\System\vcvTvbs.exe
  C:\Windows\System\vcvTvbs.exe
  2⤵
  PID:12240
- C:\Windows\System\oSUQnzN.exe
  C:\Windows\System\oSUQnzN.exe
  2⤵
  PID:12268
- C:\Windows\System\WIkZbYC.exe
  C:\Windows\System\WIkZbYC.exe
  2⤵
  PID:11104
- C:\Windows\System\feccXtO.exe
  C:\Windows\System\feccXtO.exe
  2⤵
  PID:11308
- C:\Windows\System\LiyTHYT.exe
  C:\Windows\System\LiyTHYT.exe
  2⤵
  PID:11316
- C:\Windows\System\GCowBFH.exe
  C:\Windows\System\GCowBFH.exe
  2⤵
  PID:11364
- C:\Windows\System\yHwQMte.exe
  C:\Windows\System\yHwQMte.exe
  2⤵
  PID:11448
- C:\Windows\System\hhlTKNk.exe
  C:\Windows\System\hhlTKNk.exe
  2⤵
  PID:11492
- C:\Windows\System\VtRYoWX.exe
  C:\Windows\System\VtRYoWX.exe
  2⤵
  PID:11648
- C:\Windows\System\OlRXRwg.exe
  C:\Windows\System\OlRXRwg.exe
  2⤵
  PID:11496
- C:\Windows\System\urZmAfb.exe
  C:\Windows\System\urZmAfb.exe
  2⤵
  PID:11636
- C:\Windows\System\ptKmgoo.exe
  C:\Windows\System\ptKmgoo.exe
  2⤵
  PID:11604
- C:\Windows\System\uBsVidW.exe
  C:\Windows\System\uBsVidW.exe
  2⤵
  PID:11784
- C:\Windows\System\WWhZaca.exe
  C:\Windows\System\WWhZaca.exe
  2⤵
  PID:11732
- C:\Windows\System\ZbglzMZ.exe
  C:\Windows\System\ZbglzMZ.exe
  2⤵
  PID:11864
- C:\Windows\System\kAUhdvV.exe
  C:\Windows\System\kAUhdvV.exe
  2⤵
  PID:11964
- C:\Windows\System\sIlSeIw.exe
  C:\Windows\System\sIlSeIw.exe
  2⤵
  PID:11892
- C:\Windows\System\KmntfqM.exe
  C:\Windows\System\KmntfqM.exe
  2⤵
  PID:11052
- C:\Windows\System\nfYOasP.exe
  C:\Windows\System\nfYOasP.exe
  2⤵
  PID:12196
- C:\Windows\System\xcLUbsq.exe
  C:\Windows\System\xcLUbsq.exe
  2⤵
  PID:12260
- C:\Windows\System\zizPFwE.exe
  C:\Windows\System\zizPFwE.exe
  2⤵
  PID:11412
- C:\Windows\System\fHNdmZl.exe
  C:\Windows\System\fHNdmZl.exe
  2⤵
  PID:11464
- C:\Windows\System\jiMqufI.exe
  C:\Windows\System\jiMqufI.exe
  2⤵
  PID:11664
- C:\Windows\System\fJWFlnT.exe
  C:\Windows\System\fJWFlnT.exe
  2⤵
  PID:11668
- C:\Windows\System\iavfCmS.exe
  C:\Windows\System\iavfCmS.exe
  2⤵
  PID:11860
- C:\Windows\System\wMLVjOU.exe
  C:\Windows\System\wMLVjOU.exe
  2⤵
  PID:11592
- C:\Windows\System\bCpMexf.exe
  C:\Windows\System\bCpMexf.exe
  2⤵
  PID:11840
- C:\Windows\System\SewNcXP.exe
  C:\Windows\System\SewNcXP.exe
  2⤵
  PID:12216
- C:\Windows\System\BMlENtu.exe
  C:\Windows\System\BMlENtu.exe
  2⤵
  PID:12316
- C:\Windows\System\ePHgpXF.exe
  C:\Windows\System\ePHgpXF.exe
  2⤵
  PID:12332
- C:\Windows\System\ggHFvXF.exe
  C:\Windows\System\ggHFvXF.exe
  2⤵
  PID:12364
- C:\Windows\System\kNbydjB.exe
  C:\Windows\System\kNbydjB.exe
  2⤵
  PID:12392
- C:\Windows\System\gNGjoMY.exe
  C:\Windows\System\gNGjoMY.exe
  2⤵
  PID:12428
- C:\Windows\System\beqQnnP.exe
  C:\Windows\System\beqQnnP.exe
  2⤵
  PID:12452
- C:\Windows\System\xOcxdub.exe
  C:\Windows\System\xOcxdub.exe
  2⤵
  PID:12468
- C:\Windows\System\IqpeIaQ.exe
  C:\Windows\System\IqpeIaQ.exe
  2⤵
  PID:12492
- C:\Windows\System\twXCcWA.exe
  C:\Windows\System\twXCcWA.exe
  2⤵
  PID:12520
- C:\Windows\System\rVBUBeU.exe
  C:\Windows\System\rVBUBeU.exe
  2⤵
  PID:12544
- C:\Windows\System\mgiWCgl.exe
  C:\Windows\System\mgiWCgl.exe
  2⤵
  PID:12568
- C:\Windows\System\YVMxJWu.exe
  C:\Windows\System\YVMxJWu.exe
  2⤵
  PID:12592
- C:\Windows\System\McJMtyW.exe
  C:\Windows\System\McJMtyW.exe
  2⤵
  PID:12620
- C:\Windows\System\OgGGEXT.exe
  C:\Windows\System\OgGGEXT.exe
  2⤵
  PID:12644
- C:\Windows\System\JWttDWn.exe
  C:\Windows\System\JWttDWn.exe
  2⤵
  PID:12668
- C:\Windows\System\sUpUpSP.exe
  C:\Windows\System\sUpUpSP.exe
  2⤵
  PID:12692
- C:\Windows\System\iqXJUiO.exe
  C:\Windows\System\iqXJUiO.exe
  2⤵
  PID:12724
- C:\Windows\System\rrdxJoh.exe
  C:\Windows\System\rrdxJoh.exe
  2⤵
  PID:12748
- C:\Windows\System\CFxbtWF.exe
  C:\Windows\System\CFxbtWF.exe
  2⤵
  PID:12772
- C:\Windows\System\cAFwKfz.exe
  C:\Windows\System\cAFwKfz.exe
  2⤵
  PID:12800
- C:\Windows\System\BDpiXVk.exe
  C:\Windows\System\BDpiXVk.exe
  2⤵
  PID:12828
- C:\Windows\System\ZztKaFl.exe
  C:\Windows\System\ZztKaFl.exe
  2⤵
  PID:12848
- C:\Windows\System\KxQHxWT.exe
  C:\Windows\System\KxQHxWT.exe
  2⤵
  PID:12880
- C:\Windows\System\uIymwZg.exe
  C:\Windows\System\uIymwZg.exe
  2⤵
  PID:12896
- C:\Windows\System\suLZpvm.exe
  C:\Windows\System\suLZpvm.exe
  2⤵
  PID:13076
- C:\Windows\System\etaroQc.exe
  C:\Windows\System\etaroQc.exe
  2⤵
  PID:13108
- C:\Windows\System\bWgpEXe.exe
  C:\Windows\System\bWgpEXe.exe
  2⤵
  PID:13144
- C:\Windows\System\GXxGKIs.exe
  C:\Windows\System\GXxGKIs.exe
  2⤵
  PID:13176
- C:\Windows\System\uEclcMl.exe
  C:\Windows\System\uEclcMl.exe
  2⤵
  PID:13212
- C:\Windows\System\IOpQTnR.exe
  C:\Windows\System\IOpQTnR.exe
  2⤵
  PID:13236
- C:\Windows\System\RrcCIFU.exe
  C:\Windows\System\RrcCIFU.exe
  2⤵
  PID:13272
- C:\Windows\System\owXoEyt.exe
  C:\Windows\System\owXoEyt.exe
  2⤵
  PID:13300
- C:\Windows\System\OjWjlvy.exe
  C:\Windows\System\OjWjlvy.exe
  2⤵
  PID:11844
- C:\Windows\System\zEYPZiE.exe
  C:\Windows\System\zEYPZiE.exe
  2⤵
  PID:12164
- C:\Windows\System\eBGkxCu.exe
  C:\Windows\System\eBGkxCu.exe
  2⤵
  PID:12236
- C:\Windows\System\fdKPtDO.exe
  C:\Windows\System\fdKPtDO.exe
  2⤵
  PID:12488
- C:\Windows\System\CZdEamk.exe
  C:\Windows\System\CZdEamk.exe
  2⤵
  PID:12324
- C:\Windows\System\bgZULvD.exe
  C:\Windows\System\bgZULvD.exe
  2⤵
  PID:12356
- C:\Windows\System\bPiPHDM.exe
  C:\Windows\System\bPiPHDM.exe
  2⤵
  PID:12404
- C:\Windows\System\kmUXgOp.exe
  C:\Windows\System\kmUXgOp.exe
  2⤵
  PID:12436
- C:\Windows\System\rubrlbE.exe
  C:\Windows\System\rubrlbE.exe
  2⤵
  PID:12460
- C:\Windows\System\cjOtjLe.exe
  C:\Windows\System\cjOtjLe.exe
  2⤵
  PID:12504
- C:\Windows\System\IBtFfAB.exe
  C:\Windows\System\IBtFfAB.exe
  2⤵
  PID:12536
- C:\Windows\System\PPmnabg.exe
  C:\Windows\System\PPmnabg.exe
  2⤵
  PID:12796
- C:\Windows\System\RKJpwYO.exe
  C:\Windows\System\RKJpwYO.exe
  2⤵
  PID:12632
- C:\Windows\System\jpNdfiI.exe
  C:\Windows\System\jpNdfiI.exe
  2⤵
  PID:12872
- C:\Windows\System\NXjcHSU.exe
  C:\Windows\System\NXjcHSU.exe
  2⤵
  PID:12684
- C:\Windows\System\UTUhDSj.exe
  C:\Windows\System\UTUhDSj.exe
  2⤵
  PID:12560
- C:\Windows\System\KJDEMqH.exe
  C:\Windows\System\KJDEMqH.exe
  2⤵
  PID:12932
- C:\Windows\System\WsVELeJ.exe
  C:\Windows\System\WsVELeJ.exe
  2⤵
  PID:3008
- C:\Windows\System\kbhyLJK.exe
  C:\Windows\System\kbhyLJK.exe
  2⤵
  PID:12744
- C:\Windows\System\EgFaICv.exe
  C:\Windows\System\EgFaICv.exe
  2⤵
  PID:13200
- C:\Windows\System\EOICPhx.exe
  C:\Windows\System\EOICPhx.exe
  2⤵
  PID:12912
- C:\Windows\System\DmRCZbY.exe
  C:\Windows\System\DmRCZbY.exe
  2⤵
  PID:12704
- C:\Windows\System\pIcgpMr.exe
  C:\Windows\System\pIcgpMr.exe
  2⤵
  PID:13164
- C:\Windows\System\roYlyDO.exe
  C:\Windows\System\roYlyDO.exe
  2⤵
  PID:13208
- C:\Windows\System\gwkXUiK.exe
  C:\Windows\System\gwkXUiK.exe
  2⤵
  PID:12820
- C:\Windows\System\LoggKKC.exe
  C:\Windows\System\LoggKKC.exe
  2⤵
  PID:11724
- C:\Windows\System\iTZsqXn.exe
  C:\Windows\System\iTZsqXn.exe
  2⤵
  PID:2332
- C:\Windows\System\QEOIebf.exe
  C:\Windows\System\QEOIebf.exe
  2⤵
  PID:4036
- C:\Windows\System\oUMIZHU.exe
  C:\Windows\System\oUMIZHU.exe
  2⤵
  PID:12652
- C:\Windows\System\wQWZgSK.exe
  C:\Windows\System\wQWZgSK.exe
  2⤵
  PID:12440
- C:\Windows\System\DfzKqEA.exe
  C:\Windows\System\DfzKqEA.exe
  2⤵
  PID:13332
- C:\Windows\System\mTBQgay.exe
  C:\Windows\System\mTBQgay.exe
  2⤵
  PID:13356
- C:\Windows\System\byebZnV.exe
  C:\Windows\System\byebZnV.exe
  2⤵
  PID:13380
- C:\Windows\System\FCoGUJm.exe
  C:\Windows\System\FCoGUJm.exe
  2⤵
  PID:13404
- C:\Windows\System\iemyDMh.exe
  C:\Windows\System\iemyDMh.exe
  2⤵
  PID:13436
- C:\Windows\System\HsegLwR.exe
  C:\Windows\System\HsegLwR.exe
  2⤵
  PID:13456
- C:\Windows\System\DwYPpiN.exe
  C:\Windows\System\DwYPpiN.exe
  2⤵
  PID:13480
- C:\Windows\System\gWsAZaC.exe
  C:\Windows\System\gWsAZaC.exe
  2⤵
  PID:13504
- C:\Windows\System\bbSCgpr.exe
  C:\Windows\System\bbSCgpr.exe
  2⤵
  PID:13524
- C:\Windows\System\GsADrKL.exe
  C:\Windows\System\GsADrKL.exe
  2⤵
  PID:13544
- C:\Windows\System\NRDjOzF.exe
  C:\Windows\System\NRDjOzF.exe
  2⤵
  PID:13572
- C:\Windows\System\GjPjdac.exe
  C:\Windows\System\GjPjdac.exe
  2⤵
  PID:13588
- C:\Windows\System\bCEjKjO.exe
  C:\Windows\System\bCEjKjO.exe
  2⤵
  PID:13616
- C:\Windows\System\zzRNFAv.exe
  C:\Windows\System\zzRNFAv.exe
  2⤵
  PID:13656
- C:\Windows\System\jRNpVBI.exe
  C:\Windows\System\jRNpVBI.exe
  2⤵
  PID:13748
- C:\Windows\System\jhltLeS.exe
  C:\Windows\System\jhltLeS.exe
  2⤵
  PID:13764
- C:\Windows\System\HnawzDe.exe
  C:\Windows\System\HnawzDe.exe
  2⤵
  PID:13792
- C:\Windows\System\iSIzkFk.exe
  C:\Windows\System\iSIzkFk.exe
  2⤵
  PID:13812
- C:\Windows\System\QFzHBvp.exe
  C:\Windows\System\QFzHBvp.exe
  2⤵
  PID:13836
- C:\Windows\System\nYicSXf.exe
  C:\Windows\System\nYicSXf.exe
  2⤵
  PID:13856
- C:\Windows\System\OLxaDdj.exe
  C:\Windows\System\OLxaDdj.exe
  2⤵
  PID:13880
- C:\Windows\System\cIoqmjI.exe
  C:\Windows\System\cIoqmjI.exe
  2⤵
  PID:13908
- C:\Windows\System\SFAAatx.exe
  C:\Windows\System\SFAAatx.exe
  2⤵
  PID:13944
- C:\Windows\System\khDPvqh.exe
  C:\Windows\System\khDPvqh.exe
  2⤵
  PID:13960
- C:\Windows\System\mVQVLZM.exe
  C:\Windows\System\mVQVLZM.exe
  2⤵
  PID:14024
- C:\Windows\System\lKmBhWg.exe
  C:\Windows\System\lKmBhWg.exe
  2⤵
  PID:14056
- C:\Windows\System\RUHWVfI.exe
  C:\Windows\System\RUHWVfI.exe
  2⤵
  PID:14088
- C:\Windows\System\eIQNeLp.exe
  C:\Windows\System\eIQNeLp.exe
  2⤵
  PID:14116
- C:\Windows\System\oSmrYvk.exe
  C:\Windows\System\oSmrYvk.exe
  2⤵
  PID:14144
- C:\Windows\System\udGguZQ.exe
  C:\Windows\System\udGguZQ.exe
  2⤵
  PID:14168
- C:\Windows\System\rBLWDum.exe
  C:\Windows\System\rBLWDum.exe
  2⤵
  PID:14196
- C:\Windows\System\nqitNAS.exe
  C:\Windows\System\nqitNAS.exe
  2⤵
  PID:14220
- C:\Windows\System\kdRFJeQ.exe
  C:\Windows\System\kdRFJeQ.exe
  2⤵
  PID:14240
- C:\Windows\System\LoOMcWO.exe
  C:\Windows\System\LoOMcWO.exe
  2⤵
  PID:14268
- C:\Windows\System\KEjhlJj.exe
  C:\Windows\System\KEjhlJj.exe
  2⤵
  PID:14316
- C:\Windows\System\tufpMcD.exe
  C:\Windows\System\tufpMcD.exe
  2⤵
  PID:13048
- C:\Windows\System\VINvbRP.exe
  C:\Windows\System\VINvbRP.exe
  2⤵
  PID:13352
- C:\Windows\System\FVXGwtu.exe
  C:\Windows\System\FVXGwtu.exe
  2⤵
  PID:12024
- C:\Windows\System\OGyiNTq.exe
  C:\Windows\System\OGyiNTq.exe
  2⤵
  PID:13424
- C:\Windows\System\CmOLlGv.exe
  C:\Windows\System\CmOLlGv.exe
  2⤵
  PID:13448
- C:\Windows\System\brZbBNU.exe
  C:\Windows\System\brZbBNU.exe
  2⤵
  PID:13344
- C:\Windows\System\KWTSFgk.exe
  C:\Windows\System\KWTSFgk.exe
  2⤵
  PID:13520
- C:\Windows\System\fAhZApA.exe
  C:\Windows\System\fAhZApA.exe
  2⤵
  PID:13568
- C:\Windows\System\obbzMXi.exe
  C:\Windows\System\obbzMXi.exe
  2⤵
  PID:13760
- C:\Windows\System\kiRbWbk.exe
  C:\Windows\System\kiRbWbk.exe
  2⤵
  PID:13612
- C:\Windows\System\EfAaVMu.exe
  C:\Windows\System\EfAaVMu.exe
  2⤵
  PID:13720
- C:\Windows\System\ujLMdgv.exe
  C:\Windows\System\ujLMdgv.exe
  2⤵
  PID:13696
- C:\Windows\System\kHmCOzZ.exe
  C:\Windows\System\kHmCOzZ.exe
  2⤵
  PID:13772
- C:\Windows\System\vciNYpu.exe
  C:\Windows\System\vciNYpu.exe
  2⤵
  PID:13868
- C:\Windows\System\llgXaSK.exe
  C:\Windows\System\llgXaSK.exe
  2⤵
  PID:13824
- C:\Windows\System\SKvdYbP.exe
  C:\Windows\System\SKvdYbP.exe
  2⤵
  PID:13924
- C:\Windows\System\UdAPTql.exe
  C:\Windows\System\UdAPTql.exe
  2⤵
  PID:14072
- C:\Windows\System\cjpHnio.exe
  C:\Windows\System\cjpHnio.exe
  2⤵
  PID:14104
- C:\Windows\System\rZHJEPU.exe
  C:\Windows\System\rZHJEPU.exe
  2⤵
  PID:14204
- C:\Windows\System\GiCBEgc.exe
  C:\Windows\System\GiCBEgc.exe
  2⤵
  PID:14192
- C:\Windows\System\YLEphne.exe
  C:\Windows\System\YLEphne.exe
  2⤵
  PID:14160
- C:\Windows\System\jOYByid.exe
  C:\Windows\System\jOYByid.exe
  2⤵
  PID:14276
- C:\Windows\System\rDcmcnq.exe
  C:\Windows\System\rDcmcnq.exe
  2⤵
  PID:13476
- C:\Windows\System\APqFtgb.exe
  C:\Windows\System\APqFtgb.exe
  2⤵
  PID:4980
- C:\Windows\System\QgZEZwO.exe
  C:\Windows\System\QgZEZwO.exe
  2⤵
  PID:13540
- C:\Windows\System\iDtmOwj.exe
  C:\Windows\System\iDtmOwj.exe
  2⤵
  PID:13900
- C:\Windows\System\qMzBhjt.exe
  C:\Windows\System\qMzBhjt.exe
  2⤵
  PID:14012
- C:\Windows\System\IFENNyi.exe
  C:\Windows\System\IFENNyi.exe
  2⤵
  PID:13852
- C:\Windows\System\PoNczFy.exe
  C:\Windows\System\PoNczFy.exe
  2⤵
  PID:13936
- C:\Windows\System\amiWNvv.exe
  C:\Windows\System\amiWNvv.exe
  2⤵
  PID:116
- C:\Windows\System\DYlXILl.exe
  C:\Windows\System\DYlXILl.exe
  2⤵
  PID:2600
- C:\Windows\System\ZdjBEUT.exe
  C:\Windows\System\ZdjBEUT.exe
  2⤵
  PID:14364
- C:\Windows\System\tbVYDDU.exe
  C:\Windows\System\tbVYDDU.exe
  2⤵
  PID:14388
- C:\Windows\System\iDVfeNC.exe
  C:\Windows\System\iDVfeNC.exe
  2⤵
  PID:14424
- C:\Windows\System\tpaVzLA.exe
  C:\Windows\System\tpaVzLA.exe
  2⤵
  PID:14452
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14452 -s 244
    3⤵
    PID:14740
- C:\Windows\System\NdvshiT.exe
  C:\Windows\System\NdvshiT.exe
  2⤵
  PID:14488
- C:\Windows\System\HRvDRvL.exe
  C:\Windows\System\HRvDRvL.exe
  2⤵
  PID:14800
- C:\Windows\System\JOdhrXW.exe
  C:\Windows\System\JOdhrXW.exe
  2⤵
  PID:14820
- C:\Windows\System\MKtJHPx.exe
  C:\Windows\System\MKtJHPx.exe
  2⤵
  PID:14840
- C:\Windows\System\FiBBBqA.exe
  C:\Windows\System\FiBBBqA.exe
  2⤵
  PID:14864
- C:\Windows\System\cLHBMQJ.exe
  C:\Windows\System\cLHBMQJ.exe
  2⤵
  PID:14884
- C:\Windows\System\VjnLMQe.exe
  C:\Windows\System\VjnLMQe.exe
  2⤵
  PID:14932
- C:\Windows\System\JAfnzdl.exe
  C:\Windows\System\JAfnzdl.exe
  2⤵
  PID:14956
- C:\Windows\System\uDaMPep.exe
  C:\Windows\System\uDaMPep.exe
  2⤵
  PID:15136
- C:\Windows\System\KTbEgpU.exe
  C:\Windows\System\KTbEgpU.exe
  2⤵
  PID:15156
- C:\Windows\System\hltxRCN.exe
  C:\Windows\System\hltxRCN.exe
  2⤵
  PID:15184
- C:\Windows\System\CpcPUWT.exe
  C:\Windows\System\CpcPUWT.exe
  2⤵
  PID:15200
- C:\Windows\System\dWCgkuB.exe
  C:\Windows\System\dWCgkuB.exe
  2⤵
  PID:15216
- C:\Windows\System\VHMpixL.exe
  C:\Windows\System\VHMpixL.exe
  2⤵
  PID:15244
- C:\Windows\System\HuslXyr.exe
  C:\Windows\System\HuslXyr.exe
  2⤵
  PID:15264
- C:\Windows\System\HVQxGSI.exe
  C:\Windows\System\HVQxGSI.exe
  2⤵
  PID:15284
- C:\Windows\System\eKYIZBx.exe
  C:\Windows\System\eKYIZBx.exe
  2⤵
  PID:15304
- C:\Windows\System\IoZwkYr.exe
  C:\Windows\System\IoZwkYr.exe
  2⤵
  PID:15328
- C:\Windows\System\tylvMOK.exe
  C:\Windows\System\tylvMOK.exe
  2⤵
  PID:15348
- C:\Windows\System\BueIdJY.exe
  C:\Windows\System\BueIdJY.exe
  2⤵
  PID:12892
- C:\Windows\System\AQwuuAv.exe
  C:\Windows\System\AQwuuAv.exe
  2⤵
  PID:13564
- C:\Windows\System\mGfWXOE.exe
  C:\Windows\System\mGfWXOE.exe
  2⤵
  PID:13320
- C:\Windows\System\sutanHY.exe
  C:\Windows\System\sutanHY.exe
  2⤵
  PID:2252
- C:\Windows\System\HnsCEKm.exe
  C:\Windows\System\HnsCEKm.exe
  2⤵
  PID:14896
- C:\Windows\System\lhsQWoz.exe
  C:\Windows\System\lhsQWoz.exe
  2⤵
  PID:15228
- C:\Windows\System\zMRzmEp.exe
  C:\Windows\System\zMRzmEp.exe
  2⤵
  PID:15256
- C:\Windows\System\eNzFpGC.exe
  C:\Windows\System\eNzFpGC.exe
  2⤵
  PID:15276
- C:\Windows\System\EzEKXJu.exe
  C:\Windows\System\EzEKXJu.exe
  2⤵
  PID:11224
- C:\Windows\System\usHwXDI.exe
  C:\Windows\System\usHwXDI.exe
  2⤵
  PID:1840
- C:\Windows\System\YprQwvp.exe
  C:\Windows\System\YprQwvp.exe
  2⤵
  PID:4028

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 10860 -i 10860 -h 512 -j 556 -s 560 -d 14792
1⤵
PID:13896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=138985144238272 --process=260 /prefetch:7 --thread=3520
1⤵
PID:14604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AavcBPy.exe

Path C:\Windows\System\AavcBPy.exe
Size 2.2MB
SHA256 aef683e517ac66be3ed5269458ce3d04b8b0390733591fbca015824232d31b3c
MD5 70208685d7a00b5edc5ce855c4fed9e5
SHA1 1b38de6f04873d1b021653e0d54ae8d42a8fd97c
SHA512 aa7af249ab74e33eb06256310600c9668fc0f22b7d0b45df9ab6f6ba8aed28eb7c87e34f13af1fb7d7458f8f7f3e12b3263e91882cbbdac3e0933f3844baaf45
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWA:BemTLkNdfE0pZrm
MD5 SHA1 SHA512 SSDEEP

Submit Download

BqHGAxt.exe

Path C:\Windows\System\BqHGAxt.exe
Size 2.2MB
SHA256 c41b4b53eaab8537fd657d8b3396fb5b6d29b194da5fa602cda26af74c5375da
MD5 cccfee71c141a01d83377dae5bb860d0
SHA1 6c0ad2416cee4d460b2343f6783f2a3624fb9cc3
SHA512 53ebdf7e3c41214708d24ab8914cb6294f4b484cff4751193acb8a457bde5df40068413a3091b2a6067953e620f456ca52b7e409e8f7ce2bf44edba0684a3903
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWD:BemTLkNdfE0pZrx
MD5 SHA1 SHA512 SSDEEP

Submit Download

EyekYDm.exe

Path C:\Windows\System\EyekYDm.exe
Size 2.2MB
SHA256 bd2f0218f43bc9c6489270b55e1caec278791794e4148b3069fd20393ebeb016
MD5 3d560012dadbe798fcf25f0605edfe4d
SHA1 4de676825d1deb098dad552385b83a5bfd8a1ce6
SHA512 6a8c53c62052552c5d6d82f67ec433fd7bd39efa39685f93f6bd61796904e93287b00b584d6dc165949ad343dd81fd99b78edd04b64f73625bfc64c047fba9aa
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWf:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GXXyOrQ.exe

Path C:\Windows\System\GXXyOrQ.exe
Size 2.2MB
SHA256 0461eb2d61e1f4eeb0cd87d9c2339f158643d527bab808651b3bae75525bc2f0
MD5 596ee9efd2b28a064c7373debce90168
SHA1 f7bfb9ddf64e6eafbf1d8837642189944439e837
SHA512 bda6daff2c563b64a5721daba91683fa2139237cd7ba3554301540027e406c449f77137cc44532bd816f0e543cbca526e24fd0de8ecf8ce265399e05f2254d23
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWG:BemTLkNdfE0pZr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

IyjSisO.exe

Path C:\Windows\System\IyjSisO.exe
Size 2.2MB
SHA256 395bbb103fa3fdcdb901ff9f1ebbe5dc0ed79c197f71035af23bce4fd6d55372
MD5 89685357b2a3c7959f161744133a94cc
SHA1 0584d8dd4d9e3e0aff3677adfe68e1f2e8c6f03a
SHA512 0c7aee203cdab87ba87dc2fd89296c62e0195d40e23acdbc1c67c1a65f431d43396140a6013bb7141d61fd3f6cab9cf1d64b705ae0d95a71df6ae3d7a6005bd1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWZn:BemTLkNdfE0pZrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYwaEYW.exe

Path C:\Windows\System\LYwaEYW.exe
Size 2.2MB
SHA256 37c94d8bd6892762a7e078edace0b85848c5bf2c369530ad0776609cfd3f64fe
MD5 626225c2d98e5036782ee6d73e11064f
SHA1 724e89a10a1aa4d9ff2f8d8cacdf14800d4f0e52
SHA512 1b26b8ab7b09e2347d6c4528b4b0a42f646c2852671acebd8d0ec23c7c526d593c99cd9ef026c5f4878b7eb043f5e09a2e8525e33837ae46a9198b9cd00dbad9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWI4:BemTLkNdfE0pZr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

LytFYcn.exe

Path C:\Windows\System\LytFYcn.exe
Size 2.2MB
SHA256 82530c1c7548ddcac6854eebc7590f7f3aa1f685f841a1bc31b0028ffe3fee9b
MD5 83e8d1bf52637a85fc13e690de834dbd
SHA1 2af717f20e5c0b8b6c2c6ad1c7036b7c207dbdf7
SHA512 8ad131609b6b48fdecd39a4af32199af008631ee16cace0f7eb54f9b33d14598aeab4bc734b6404fb560123d83da664258a036d2fe2a72accdaa9ae0708dab96
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWi:BemTLkNdfE0pZrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MWfHdXS.exe

Path C:\Windows\System\MWfHdXS.exe
Size 2.2MB
SHA256 b115831ccdaa97d12890c110b2968588f5b26bc99d481b22a7012f36aef9cceb
MD5 9e6e651b56c0d52001581b5ebcc98b00
SHA1 e86a7b05a71ff26ee2f5369633a0568efd8b18e4
SHA512 fe9bd63cb49cbe96fbe004a465fe8a931b9402110f0ae090338fb6391b0fb1001f09b53a6ae393494d655e38027292ea01f338cc407997109642bdfeb57faba5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWe:BemTLkNdfE0pZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXyclHg.exe

Path C:\Windows\System\MXyclHg.exe
Size 2.2MB
SHA256 4b70135c9dbfe3ede863e1d203134ae2f8e5fb956a70aa2ccb503bf651a62b64
MD5 1e9768c16c80bda0717794c2461f928f
SHA1 3a4489833d4343870b84a3d7191867d67af0d3a6
SHA512 5692f94d06a96df9705865f39178e09023890ef87893380361b8ae4ad1a45c39c79b917a001da7440b217bc888e19db262f76c820931f0d8aa86eed41e953768
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWy:BemTLkNdfE0pZrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OkkWGye.exe

Path C:\Windows\System\OkkWGye.exe
Size 2.2MB
SHA256 9b4c999d4a5926042db7b006a056fe72028638891679bde40592ee35c464b993
MD5 dca7c0fd5ae1dafd2f89e2a08a52a7b8
SHA1 53e8f5198c75e330ba54774d8fde28fbf825921e
SHA512 2d9e302ba0acf869a5d326bfc1b393515e6be3da65db22e0476b570f5817bf0024280980bbef1c00baf6cab586578fda7928753371eb0438afd20633615c44b9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWRl:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

PKonLrF.exe

Path C:\Windows\System\PKonLrF.exe
Size 2.2MB
SHA256 727f5d989c7da6d1278bb5f074f66846a88256db9491a54214b7ffedfbffcc48
MD5 ce5de307dac5eaeb4970ef2305244d82
SHA1 49f46be79e8b24c62d481ca34e0f514d58fdfb68
SHA512 942e4dfca0ebee05ebc7a6bfa0db233e6936088a9a9228e3b993443c2d0620d1c56d97d930346aa2a6acc994b88b2e6fc80c91fda9f7bf3d703ffc5e0b143323
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWw:BemTLkNdfE0pZr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwThdMk.exe

Path C:\Windows\System\QwThdMk.exe
Size 2.2MB
SHA256 29fe19ed3d80e99400ff7b1134bbd8dc7b95182a510f38a935e9a9635d52bf38
MD5 a2aa34c2902f4e2001cbf02cb17a7bc6
SHA1 b6d14a5d5a60016d40333f818c71c64c3dcc5ff5
SHA512 cf6eb3a421f06ba256d030cdb7ab36c7c20cd3d858aa66c6f334e44cbf561681ea496529d8ea44132d9f04a8cda9a02aca3111649e9719a1257d28303712b739
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustW1D:BemTLkNdfE0pZrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

UTOMwts.exe

Path C:\Windows\System\UTOMwts.exe
Size 2.2MB
SHA256 6bc7f63b28ebf6bc03c013f0511192ebfb6d73b2540755233d7df62b1dd90386
MD5 03a04a8550f783e721d3d5c4271b9843
SHA1 6f7f9eb375fb44dd87fb2f25086e0da21f66398f
SHA512 fa98e1c5f695db9189c6308777f2c24515ac0c98a2a3a60957059f2c9b50a01e07ec52573aa72d7fd706df3d814ead1ec44434efa8b6d6af30441d2dc4d2eaf5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWe:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

XjjLRXE.exe

Path C:\Windows\System\XjjLRXE.exe
Size 2.2MB
SHA256 1b9ec970205f2324ffc966cc2b17aca60bb936818600f2be6eec095f8f789880
MD5 57ca26a040c0e74cd09043e013429b8b
SHA1 20f953086e5861809951c1dd021d49bee6759948
SHA512 8b9139bd9471d285d3eaf8e6c693a0601f8d687f1330610a8dbad514423b6f9fd0f292ab8b399da730be7b183c9411c3a586f37f0a74571cc609fc3efbb37131
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustW2:BemTLkNdfE0pZrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxDtOkv.exe

Path C:\Windows\System\XxDtOkv.exe
Size 2.2MB
SHA256 4e4a5fac12978a00177990952f3cbfbc48f47abf4bf10d5174d4a863f31c0a50
MD5 73cee7d69ed3da9654f671865dbdfc12
SHA1 147b26bcdaa8bafb7d3b25761a3a8929d261a75a
SHA512 3e56d0c3274453ee078a39d95655eda3047e6db0fc81dc3f8d4ae6b9f4039e7b1c08c20ba01c009e6007d31896defa1c1d4ddfaa8de810628e5a5fb747ed9727
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustW9:BemTLkNdfE0pZr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ddrUFmc.exe

Path C:\Windows\System\ddrUFmc.exe
Size 2.2MB
SHA256 b7a4718f4255a03d3368d2ef1de4edeafbbf2b983a21f295709530f797da27d6
MD5 685a090975eb365f4c69aa2dce2fb0b2
SHA1 6e5844fc93a2acd63442ac9d502b4acfa5206b63
SHA512 d53110da351193f4a599c7c5000224cefd063aee386018d8ce9fdfc4635351eefbaf38ff794f382e233eaa92ec9959df88fa0c6c4bcef1064663945accf78789
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWe:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

eMwIHQo.exe

Path C:\Windows\System\eMwIHQo.exe
Size 2.2MB
SHA256 bbb9d162c54ab5b673221b12b81de0509eb7d905ad9825dbd11cca81cb25dcfc
MD5 40568102aa435ba746e8795f4405c83c
SHA1 e2697118c52292e2774a65c6bb28c015901f3345
SHA512 e40bc7eaa9b51a98389c66f1d2166d690f38b298089e38878ffdfdbd711b8896108bf56bdc8338a32ccad7864a28d93cb658be1a10e755bc07e9d25a2ccbd6af
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWg:BemTLkNdfE0pZry
MD5 SHA1 SHA512 SSDEEP

Submit Download

glKjPsV.exe

Path C:\Windows\System\glKjPsV.exe
Size 2.2MB
SHA256 2b5574337c24cde9253debf411072d400fddf8368e214a18649a80e5bc6ab5f7
MD5 79d3161e2a0462e42e20a63b7d81cf20
SHA1 48aae43a9fdd5f7d96a52435ab0a9dfb91747a43
SHA512 efbfbc6245e7911e81d5ba32c49c713e791d8ce604e094ffeee198d853c6cee2ebd22606b8db2cabd957b30bffac2b3abe20aa275447106bbf195c0caa1b4570
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWR:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipBFLaq.exe

Path C:\Windows\System\ipBFLaq.exe
Size 2.2MB
SHA256 2cc4978179e68847a2f9ddc73a770496ec06ddba1e34ecd8ff556f929ffaaf02
MD5 19b83aee5665925d1648798ebd10200a
SHA1 04ff2d097d97041a50cf3e5121548abe2ab5562a
SHA512 dd680a50b364559418cb0445f83e04f3d217d60e9c4649521923a80a93bd98beffaca908e986b112a35e40ac6092811b53314890e1f2550d112170ad6b7fa9ab
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWy:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmFBMYM.exe

Path C:\Windows\System\kmFBMYM.exe
Size 2.2MB
SHA256 79db7bc4a00a7107f6ac7b55c435fbc8e9900bc7d7cb99946aeb38e4c5e5e289
MD5 cbaf6ce3bce96a2aced10910b3955c6a
SHA1 5395c6a58eabf8aa405010cda75038e12a7bbb49
SHA512 1ee0e745f9bf2f6071c2af94f7180840ef596f40e11dbb6f84589f63e8a7288937a3db3b4650748554450e2aadbd4b200bb663d7b50c9097074f016d82d816ff
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWi:BemTLkNdfE0pZrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

mGGCCmE.exe

Path C:\Windows\System\mGGCCmE.exe
Size 2.2MB
SHA256 eff169fadc4e7a2ecb5ef64bfbb5f9385a5b740dfd40b4b92bafdc310ab49fa3
MD5 f503221607c0030b8dbe2e9a0d4ca7f4
SHA1 ac8dd481679ccbbb77b86a31c6cf3a5c95e5cf6b
SHA512 401b2c266c2afbaa1c5af668889c99ca50c8ccda44d23b1e51e1bdff59425efea0278a08fb509aa68c3cc52779307be5a73fd451eeecb7655278eabb264f5047
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWG:BemTLkNdfE0pZrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mHLwTSk.exe

Path C:\Windows\System\mHLwTSk.exe
Size 2.2MB
SHA256 d99c9c93982618ce4fce1875860207cd7dd8b1be959e5892d27c18f2f5445c4d
MD5 674f00f2f00dfe1b52e131cc6f580ca1
SHA1 a619ac2e10d9d5a895188793014fed209dd10635
SHA512 fe28fcb16f7e778a51d07f963847ce9cb77c03cca4297a037d2eafe46b5a140e7c04245412fdbf991ddfbee2c8806427ead602f7e375ba2006541b2ae5bc8897
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWv:BemTLkNdfE0pZrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtZZKpE.exe

Path C:\Windows\System\mtZZKpE.exe
Size 2.2MB
SHA256 517506054b2d5895ae71803835d7d926f3a1bdb4034d0b5adcaeb05d92f38e27
MD5 75a440bb41986660f96f8c5e171309d8
SHA1 d9d64f1929919aae4f203fdc6196817356f2c298
SHA512 aa3e16824da5c473b5cd1390606b56b038f8de0bd055c8c963ec812473cddd549b062b09e4b9911b1f4c5be412952ed8012240ea63f4bae9a59c448ed6632ae4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustW7:BemTLkNdfE0pZrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

rLWJcYX.exe

Path C:\Windows\System\rLWJcYX.exe
Size 2.2MB
SHA256 51aed8b02fb8a6b8371b2513449f7b6ce17199a8d99f4b0ba81748ff9e3af63d
MD5 cd658027d970611df93a48bd2aaeed4e
SHA1 6f8e2fe4d6c63dfaf126d02b7017f2e2147db977
SHA512 9f1f0e007efa3a933e033b7ba78dc6fafca91398b4d83b85f70e3ea609399689459ca9919b0593f1a5b817eca4136d80c9f746e53dd696725b6b0956c18b7833
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWq:BemTLkNdfE0pZr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sppXKlF.exe

Path C:\Windows\System\sppXKlF.exe
Size 2.2MB
SHA256 1909299c376d164e30ac9fcea3f33710f3a3f6636b5c6611190a6cf7a41c3a65
MD5 c8b2e8b8ce5007297479dc5e93aac5ab
SHA1 0ba55b03b6f363f232697958bd2b17100447f494
SHA512 1ad7d9638708519dab84f6c7a9e9341ab773a438efd2df7a1fc8fd213dc966a38d01ba8f243bb3f9a8436cb4f62241893d37a2b3c9e2a2f1df7db0b3986b2887
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWO:BemTLkNdfE0pZrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

uFQdCuN.exe

Path C:\Windows\System\uFQdCuN.exe
Size 2.2MB
SHA256 8b6fbaffcca1813dbad3f826608a35023b55e2a6656ec6bf2969f166bb215bc7
MD5 5cd79db273d69718a63529851ab79964
SHA1 3ac2c98e848c38d41182bd7518705015032bd581
SHA512 b933947f5aa05545c507fcdddd98166941d34bb6420c6ac2698fecc9a7b68a7d46743372baafd077018e22d7bf710ba9eab97eb1f807239d0f6f9d59f06321f1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWe:BemTLkNdfE0pZrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

uwBSzsd.exe

Path C:\Windows\System\uwBSzsd.exe
Size 2.2MB
SHA256 8e8c9d70ed15e58a4d1c1d153a38dc8b2a856a3946e66049a3a7fab7cb064549
MD5 df86bf4f9db66013c1953f8e2e361920
SHA1 31df31214aecbd9644c7126934791200cd01658a
SHA512 fd04b92486c371351fd09e08d96eafe23ce6199dce906c8d343a91dfdf55f289a03131a3c6953d80165a2d726b02fbe65fdcf958eba26f20c5b815b830f4e639
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustW3:BemTLkNdfE0pZr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wIvvsUu.exe

Path C:\Windows\System\wIvvsUu.exe
Size 2.2MB
SHA256 b6034b3efe8c2704ab46fb1cc3f1227bd79283f95c7de257baa0caf42fefa42d
MD5 c99c61a4a86ac93b222bc768068b0331
SHA1 aa8caab6d80db5e48f802c129dfa7052afd58eed
SHA512 4ecfea992ad1172fc45d28a6a51c84d180be86c55fdb4129dc63f1250262586f6032859d78ba5a91e33c853d9f242caf29dc469ea92edded0ad0f983e1285c36
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWi:BemTLkNdfE0pZrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

xOgNrcw.exe

Path C:\Windows\System\xOgNrcw.exe
Size 2.2MB
SHA256 72744f358aa06549ddfb94b5f11541e98a70fdc1086ca66533d185f4c92e8269
MD5 9ada89dd93c754e81194c41b56d9e0c5
SHA1 12f0b68658cd49b6b89a98375bf357509c12e8f0
SHA512 56bf6719ed7df8a1f660941b2bd8b5ba4b6fb6f69a2e92e7b0ca6ef5b0a08e128f14760be11c87edd53662795a4aea61bf2ee50468dfea9e1f9943a0a7c7b7a8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWT:BemTLkNdfE0pZrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

yIRzNFm.exe

Path C:\Windows\System\yIRzNFm.exe
Size 2.2MB
SHA256 9a33eee52de46a1cdd3f15d93065a483751f2ca2d123818d4c4f9b7b2680aee6
MD5 2ce0165ed2dc717c80e5041896da922d
SHA1 040aae1cfd3e5381a6ec29dfea8c1d4a799e9248
SHA512 0a17329376a2cd05a7bed61386a12e878bf1fef69a1e2cda98910bd4a1b9d647e8671bc19f2fef49f09a86a3156a8370aadc7c5de6e3483a363f5a73697bff1c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWMB:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybGLSSv.exe

Path C:\Windows\System\ybGLSSv.exe
Size 2.2MB
SHA256 a947e7a80376fdd271b0e97fc752fb60ec69db6540ef2bf78115cb3ea824e9db
MD5 704e0f3350ac949363798a99c16f5323
SHA1 ed4e0438802595e43e3cf15bf79aa7c26eb032d3
SHA512 9c0e9db45e87642b6d6d108bc4c048fcd3ad0fcd19c41e4df13e39f3633fc2d701c13de2aef377f90734ca593f9e89301d77e571c7836b39bc0ce6c65fa20a34
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWF:BemTLkNdfE0pZrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ytxvclE.exe

Path C:\Windows\System\ytxvclE.exe
Size 2.2MB
SHA256 9fb159d6aad93664614dbc41055e2a5fba9bc0eb980a8c30a86974d40889aebb
MD5 83fa81291bd615ad3c6394467ff727a5
SHA1 2beee32aff6fb33b7fab2d37a934049c1089c215
SHA512 a84c9212925d8c281bfb5af7592685513ab49cf46c5673ba00255e88a13cfc9c6f7f645855ea5ce014010759259ffbdddd07a8b0dbc8785341a889d370c1cc01
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWH:BemTLkNdfE0pZr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

zscsjqJ.exe

Path C:\Windows\System\zscsjqJ.exe
Size 2.2MB
SHA256 b7aa2ad995c6f1a54d0222983fc10aa0ef8d00abb80d125ebfbbbfbd14f66f22
MD5 d03d06c0a1984231dfca4606b904703d
SHA1 327e23f1d5daccbf45f92a73ac0e36b8bad7f426
SHA512 ac5202095f86bb835559971855bb36c8268c0d1023ba74bc5ac591a6d762ec909a5e0ef2abbcde23106c6ed443300eebd07921f1ff02600c83979ce87eb5082f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6oustWO:BemTLkNdfE0pZrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-2132-0x00007FF69BDC0000-0x00007FF69C114000-memory.dmp

Download

memory/8-73-0x00007FF69BDC0000-0x00007FF69C114000-memory.dmp

Download

memory/380-90-0x00007FF7F10A0000-0x00007FF7F13F4000-memory.dmp

Download

memory/380-2137-0x00007FF7F10A0000-0x00007FF7F13F4000-memory.dmp

Download

memory/564-168-0x00007FF668CA0000-0x00007FF668FF4000-memory.dmp

Download

memory/564-30-0x00007FF668CA0000-0x00007FF668FF4000-memory.dmp

Download

memory/684-91-0x00007FF704520000-0x00007FF704874000-memory.dmp

Download

memory/684-2136-0x00007FF704520000-0x00007FF704874000-memory.dmp

Download

memory/1060-2326-0x00007FF61C230000-0x00007FF61C584000-memory.dmp

Download

memory/1060-257-0x00007FF61C230000-0x00007FF61C584000-memory.dmp

Download

memory/1068-92-0x00007FF756ED0000-0x00007FF757224000-memory.dmp

Download

memory/1068-2138-0x00007FF756ED0000-0x00007FF757224000-memory.dmp

Download

memory/1104-186-0x00007FF797F10000-0x00007FF798264000-memory.dmp

Download

memory/1104-2322-0x00007FF797F10000-0x00007FF798264000-memory.dmp

Download

memory/1188-152-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp

Download

memory/1188-10-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp

Download

memory/1188-2071-0x00007FF6B9090000-0x00007FF6B93E4000-memory.dmp

Download

memory/1212-81-0x00007FF77CDD0000-0x00007FF77D124000-memory.dmp

Download

memory/1212-2131-0x00007FF77CDD0000-0x00007FF77D124000-memory.dmp

Download

memory/1300-108-0x00007FF6F3600000-0x00007FF6F3954000-memory.dmp

Download

memory/1300-0-0x00007FF6F3600000-0x00007FF6F3954000-memory.dmp

Download

memory/1300-1-0x0000021B0F670000-0x0000021B0F680000-memory.dmp

Download

memory/1408-2127-0x00007FF785A00000-0x00007FF785D54000-memory.dmp

Download

memory/1408-45-0x00007FF785A00000-0x00007FF785D54000-memory.dmp

Download

memory/1408-1418-0x00007FF785A00000-0x00007FF785D54000-memory.dmp

Download

memory/1432-35-0x00007FF78CFC0000-0x00007FF78D314000-memory.dmp

Download

memory/1432-2080-0x00007FF78CFC0000-0x00007FF78D314000-memory.dmp

Download

memory/1912-2330-0x00007FF7BA9E0000-0x00007FF7BAD34000-memory.dmp

Download

memory/1912-259-0x00007FF7BA9E0000-0x00007FF7BAD34000-memory.dmp

Download

memory/2112-2332-0x00007FF7D6300000-0x00007FF7D6654000-memory.dmp

Download

memory/2112-272-0x00007FF7D6300000-0x00007FF7D6654000-memory.dmp

Download

memory/2388-2324-0x00007FF7D7880000-0x00007FF7D7BD4000-memory.dmp

Download

memory/2388-246-0x00007FF7D7880000-0x00007FF7D7BD4000-memory.dmp

Download

memory/2684-662-0x00007FF72A270000-0x00007FF72A5C4000-memory.dmp

Download

memory/2684-42-0x00007FF72A270000-0x00007FF72A5C4000-memory.dmp

Download

memory/2712-113-0x00007FF67ABE0000-0x00007FF67AF34000-memory.dmp

Download

memory/2712-2321-0x00007FF67ABE0000-0x00007FF67AF34000-memory.dmp

Download

memory/2996-82-0x00007FF6B6F30000-0x00007FF6B7284000-memory.dmp

Download

memory/2996-2134-0x00007FF6B6F30000-0x00007FF6B7284000-memory.dmp

Download

memory/3132-37-0x00007FF6B2960000-0x00007FF6B2CB4000-memory.dmp

Download

memory/3132-2097-0x00007FF6B2960000-0x00007FF6B2CB4000-memory.dmp

Download

memory/3348-2329-0x00007FF6ED3D0000-0x00007FF6ED724000-memory.dmp

Download

memory/3348-263-0x00007FF6ED3D0000-0x00007FF6ED724000-memory.dmp

Download

memory/3540-106-0x00007FF627760000-0x00007FF627AB4000-memory.dmp

Download

memory/3540-2320-0x00007FF627760000-0x00007FF627AB4000-memory.dmp

Download

memory/3676-87-0x00007FF7BC7A0000-0x00007FF7BCAF4000-memory.dmp

Download

memory/3676-2133-0x00007FF7BC7A0000-0x00007FF7BCAF4000-memory.dmp

Download

memory/3768-44-0x00007FF74BB10000-0x00007FF74BE64000-memory.dmp

Download

memory/3768-1417-0x00007FF74BB10000-0x00007FF74BE64000-memory.dmp

Download

memory/3784-177-0x00007FF7C87B0000-0x00007FF7C8B04000-memory.dmp

Download

memory/3784-2323-0x00007FF7C87B0000-0x00007FF7C8B04000-memory.dmp

Download

memory/4828-266-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp

Download

memory/4828-2328-0x00007FF652E90000-0x00007FF6531E4000-memory.dmp

Download

memory/4860-268-0x00007FF6E4720000-0x00007FF6E4A74000-memory.dmp

Download

memory/4860-2325-0x00007FF6E4720000-0x00007FF6E4A74000-memory.dmp

Download

memory/4908-2319-0x00007FF6E5F20000-0x00007FF6E6274000-memory.dmp

Download

memory/4908-100-0x00007FF6E5F20000-0x00007FF6E6274000-memory.dmp

Download

memory/4964-271-0x00007FF737EE0000-0x00007FF738234000-memory.dmp

Download

memory/4964-2331-0x00007FF737EE0000-0x00007FF738234000-memory.dmp

Download

memory/4984-163-0x00007FF631000000-0x00007FF631354000-memory.dmp

Download

memory/4984-20-0x00007FF631000000-0x00007FF631354000-memory.dmp

Download

memory/4988-2327-0x00007FF6DF1E0000-0x00007FF6DF534000-memory.dmp

Download

memory/4988-264-0x00007FF6DF1E0000-0x00007FF6DF534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads