xmrig | 0b3f1a6912d148c88b14fdc0d74030009a981a7d4e426511996e05487d9ceaba

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
Size 2.2MB
Sample240527-l34kdagh39
SHA256 0b3f1a6912d148c88b14fdc0d74030009a981a7d4e426511996e05487d9ceaba
MD5 6056de77d76db3311d6c5bd2b7b70700
SHA1 8595e0046188d0082ac354233a54797339d77210
SHA512 c7f90894c613e33d8ca6b56164ba982be3fa0a3d95247bbae8e5293f6186a05d0c768328c403ff58782c0ce6b5017e3979a9806111a83573e017873fee7b290a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEA:BemTLkNdfE0pZrV56utgv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4480-0-0x00007FF685800000-0x00007FF685B54000-memory.dmp	xmrig
behavioral2/files/0x000900000002324b-5.dat	xmrig
behavioral2/memory/3764-8-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023251-12.dat	xmrig
behavioral2/memory/4340-14-0x00007FF793AA0000-0x00007FF793DF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023252-10.dat	xmrig
behavioral2/memory/4648-20-0x00007FF68C750000-0x00007FF68CAA4000-memory.dmp	xmrig
behavioral2/files/0x000800000002324f-23.dat	xmrig
behavioral2/files/0x0007000000023253-27.dat	xmrig
behavioral2/memory/3656-28-0x00007FF6E6320000-0x00007FF6E6674000-memory.dmp	xmrig
behavioral2/memory/4956-32-0x00007FF6A9200000-0x00007FF6A9554000-memory.dmp	xmrig
behavioral2/files/0x0007000000023254-34.dat	xmrig
behavioral2/memory/4056-38-0x00007FF6E6190000-0x00007FF6E64E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023256-41.dat	xmrig
behavioral2/memory/5116-47-0x00007FF7A7920000-0x00007FF7A7C74000-memory.dmp	xmrig
behavioral2/memory/5044-48-0x00007FF613B60000-0x00007FF613EB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023257-45.dat	xmrig
behavioral2/files/0x000700000002325a-61.dat	xmrig
behavioral2/files/0x0007000000023259-59.dat	xmrig
behavioral2/memory/4480-64-0x00007FF685800000-0x00007FF685B54000-memory.dmp	xmrig
behavioral2/files/0x000700000002325b-71.dat	xmrig
behavioral2/files/0x000700000002325c-76.dat	xmrig
behavioral2/files/0x000700000002325f-90.dat	xmrig
behavioral2/files/0x0007000000023260-99.dat	xmrig
behavioral2/files/0x0007000000023265-121.dat	xmrig
behavioral2/files/0x0007000000023266-129.dat	xmrig
behavioral2/files/0x0007000000023267-134.dat	xmrig
behavioral2/files/0x000700000002326a-145.dat	xmrig
behavioral2/files/0x000700000002326d-161.dat	xmrig
behavioral2/memory/1212-311-0x00007FF7B8E90000-0x00007FF7B91E4000-memory.dmp	xmrig
behavioral2/memory/4452-316-0x00007FF6274C0000-0x00007FF627814000-memory.dmp	xmrig
behavioral2/memory/436-325-0x00007FF733230000-0x00007FF733584000-memory.dmp	xmrig
behavioral2/memory/2716-326-0x00007FF7BF490000-0x00007FF7BF7E4000-memory.dmp	xmrig
behavioral2/memory/4796-329-0x00007FF7CD4D0000-0x00007FF7CD824000-memory.dmp	xmrig
behavioral2/memory/5048-330-0x00007FF631EE0000-0x00007FF632234000-memory.dmp	xmrig
behavioral2/memory/4032-332-0x00007FF759560000-0x00007FF7598B4000-memory.dmp	xmrig
behavioral2/memory/3580-334-0x00007FF617350000-0x00007FF6176A4000-memory.dmp	xmrig
behavioral2/memory/4356-335-0x00007FF6A7B10000-0x00007FF6A7E64000-memory.dmp	xmrig
behavioral2/memory/1564-337-0x00007FF63D7A0000-0x00007FF63DAF4000-memory.dmp	xmrig
behavioral2/memory/3880-339-0x00007FF6ADEE0000-0x00007FF6AE234000-memory.dmp	xmrig
behavioral2/memory/1972-340-0x00007FF7ACEE0000-0x00007FF7AD234000-memory.dmp	xmrig
behavioral2/memory/3764-341-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp	xmrig
behavioral2/memory/4088-342-0x00007FF7F72A0000-0x00007FF7F75F4000-memory.dmp	xmrig
behavioral2/memory/1612-338-0x00007FF63E870000-0x00007FF63EBC4000-memory.dmp	xmrig
behavioral2/memory/1472-336-0x00007FF6818C0000-0x00007FF681C14000-memory.dmp	xmrig
behavioral2/memory/3780-333-0x00007FF6A0F30000-0x00007FF6A1284000-memory.dmp	xmrig
behavioral2/memory/3820-331-0x00007FF75EDA0000-0x00007FF75F0F4000-memory.dmp	xmrig
behavioral2/memory/3332-328-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp	xmrig
behavioral2/memory/4848-324-0x00007FF6304B0000-0x00007FF630804000-memory.dmp	xmrig
behavioral2/memory/5080-321-0x00007FF6846C0000-0x00007FF684A14000-memory.dmp	xmrig
behavioral2/files/0x000700000002326f-171.dat	xmrig
behavioral2/files/0x000700000002326e-166.dat	xmrig
behavioral2/files/0x000700000002326c-156.dat	xmrig
behavioral2/files/0x000700000002326b-151.dat	xmrig
behavioral2/files/0x0007000000023269-143.dat	xmrig
behavioral2/files/0x0007000000023268-138.dat	xmrig
behavioral2/files/0x0007000000023264-116.dat	xmrig
behavioral2/files/0x0007000000023263-111.dat	xmrig
behavioral2/files/0x0007000000023262-106.dat	xmrig
behavioral2/files/0x0007000000023261-101.dat	xmrig
behavioral2/files/0x000700000002325e-86.dat	xmrig
behavioral2/files/0x000700000002325d-81.dat	xmrig
behavioral2/memory/4804-56-0x00007FF747EE0000-0x00007FF748234000-memory.dmp	xmrig
behavioral2/files/0x0007000000023258-60.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3764	msBuEwm.exe
4340	aoIDVgJ.exe
4648	LkWmZNH.exe
3656	LxcXfNa.exe
4956	ZgNZrzL.exe
4056	AyXxHCx.exe
5116	qjuJGsX.exe
5044	iGhgFlR.exe
4804	gdABLrh.exe
1212	RwHxrmx.exe
4452	dNBGVMc.exe
4088	aPmipBX.exe
5080	uPjFWew.exe
4848	oiqGXdb.exe
436	YKnvjwu.exe
2716	TbFNSlb.exe
3332	foqfpAH.exe
4796	SQIfpHY.exe
5048	qxpCHyR.exe
3820	qtphWhL.exe
4032	zzUqtPo.exe
3780	SYdTeqy.exe
3580	QoAfjVi.exe
4356	FHYbVxM.exe
1472	KQvBwCp.exe
1564	Catxjgm.exe
1612	gWfWweB.exe
3880	zgCJLIr.exe
1972	cItdSyt.exe
4064	EjZhDYH.exe
4212	YAZYFuS.exe
4292	VMrvXHs.exe
4628	ypDQrkc.exe
2188	YqTXswi.exe
4308	rfwYsLR.exe
3604	aFgDvyc.exe
4568	AKCTcmD.exe
3132	kOakdAC.exe
2540	fPbRCeb.exe
1004	PDesKOj.exe
404	rzTtSLO.exe
3460	viyLlnS.exe
2084	KXJiEho.exe
4224	QpqbxcA.exe
5004	dEUJaZR.exe
1188	hhmoYgk.exe
4352	mFfLFwf.exe
564	mrZuono.exe
3776	xawhfYu.exe
1596	QJwvDxE.exe
4044	kltqCri.exe
4812	vSFmzqo.exe
2940	qJVORGK.exe
2856	yhcGrYo.exe
5012	HIJOkFf.exe
4908	ytvGKwM.exe
4528	RpVIdfe.exe
3668	SoYmnXA.exe
4924	EHOfwyG.exe
3356	RYELiDQ.exe
5136	qUwlNHs.exe
5172	WCiNAix.exe
5192	fARADhp.exe
5228	ghsrEIE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-0-0x00007FF685800000-0x00007FF685B54000-memory.dmp	upx
behavioral2/files/0x000900000002324b-5.dat	upx
behavioral2/memory/3764-8-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp	upx
behavioral2/files/0x0008000000023251-12.dat	upx
behavioral2/memory/4340-14-0x00007FF793AA0000-0x00007FF793DF4000-memory.dmp	upx
behavioral2/files/0x0007000000023252-10.dat	upx
behavioral2/memory/4648-20-0x00007FF68C750000-0x00007FF68CAA4000-memory.dmp	upx
behavioral2/files/0x000800000002324f-23.dat	upx
behavioral2/files/0x0007000000023253-27.dat	upx
behavioral2/memory/3656-28-0x00007FF6E6320000-0x00007FF6E6674000-memory.dmp	upx
behavioral2/memory/4956-32-0x00007FF6A9200000-0x00007FF6A9554000-memory.dmp	upx
behavioral2/files/0x0007000000023254-34.dat	upx
behavioral2/memory/4056-38-0x00007FF6E6190000-0x00007FF6E64E4000-memory.dmp	upx
behavioral2/files/0x0007000000023256-41.dat	upx
behavioral2/memory/5116-47-0x00007FF7A7920000-0x00007FF7A7C74000-memory.dmp	upx
behavioral2/memory/5044-48-0x00007FF613B60000-0x00007FF613EB4000-memory.dmp	upx
behavioral2/files/0x0007000000023257-45.dat	upx
behavioral2/files/0x000700000002325a-61.dat	upx
behavioral2/files/0x0007000000023259-59.dat	upx
behavioral2/memory/4480-64-0x00007FF685800000-0x00007FF685B54000-memory.dmp	upx
behavioral2/files/0x000700000002325b-71.dat	upx
behavioral2/files/0x000700000002325c-76.dat	upx
behavioral2/files/0x000700000002325f-90.dat	upx
behavioral2/files/0x0007000000023260-99.dat	upx
behavioral2/files/0x0007000000023265-121.dat	upx
behavioral2/files/0x0007000000023266-129.dat	upx
behavioral2/files/0x0007000000023267-134.dat	upx
behavioral2/files/0x000700000002326a-145.dat	upx
behavioral2/files/0x000700000002326d-161.dat	upx
behavioral2/memory/1212-311-0x00007FF7B8E90000-0x00007FF7B91E4000-memory.dmp	upx
behavioral2/memory/4452-316-0x00007FF6274C0000-0x00007FF627814000-memory.dmp	upx
behavioral2/memory/436-325-0x00007FF733230000-0x00007FF733584000-memory.dmp	upx
behavioral2/memory/2716-326-0x00007FF7BF490000-0x00007FF7BF7E4000-memory.dmp	upx
behavioral2/memory/4796-329-0x00007FF7CD4D0000-0x00007FF7CD824000-memory.dmp	upx
behavioral2/memory/5048-330-0x00007FF631EE0000-0x00007FF632234000-memory.dmp	upx
behavioral2/memory/4032-332-0x00007FF759560000-0x00007FF7598B4000-memory.dmp	upx
behavioral2/memory/3580-334-0x00007FF617350000-0x00007FF6176A4000-memory.dmp	upx
behavioral2/memory/4356-335-0x00007FF6A7B10000-0x00007FF6A7E64000-memory.dmp	upx
behavioral2/memory/1564-337-0x00007FF63D7A0000-0x00007FF63DAF4000-memory.dmp	upx
behavioral2/memory/3880-339-0x00007FF6ADEE0000-0x00007FF6AE234000-memory.dmp	upx
behavioral2/memory/1972-340-0x00007FF7ACEE0000-0x00007FF7AD234000-memory.dmp	upx
behavioral2/memory/3764-341-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp	upx
behavioral2/memory/4088-342-0x00007FF7F72A0000-0x00007FF7F75F4000-memory.dmp	upx
behavioral2/memory/1612-338-0x00007FF63E870000-0x00007FF63EBC4000-memory.dmp	upx
behavioral2/memory/1472-336-0x00007FF6818C0000-0x00007FF681C14000-memory.dmp	upx
behavioral2/memory/3780-333-0x00007FF6A0F30000-0x00007FF6A1284000-memory.dmp	upx
behavioral2/memory/3820-331-0x00007FF75EDA0000-0x00007FF75F0F4000-memory.dmp	upx
behavioral2/memory/3332-328-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp	upx
behavioral2/memory/4848-324-0x00007FF6304B0000-0x00007FF630804000-memory.dmp	upx
behavioral2/memory/5080-321-0x00007FF6846C0000-0x00007FF684A14000-memory.dmp	upx
behavioral2/files/0x000700000002326f-171.dat	upx
behavioral2/files/0x000700000002326e-166.dat	upx
behavioral2/files/0x000700000002326c-156.dat	upx
behavioral2/files/0x000700000002326b-151.dat	upx
behavioral2/files/0x0007000000023269-143.dat	upx
behavioral2/files/0x0007000000023268-138.dat	upx
behavioral2/files/0x0007000000023264-116.dat	upx
behavioral2/files/0x0007000000023263-111.dat	upx
behavioral2/files/0x0007000000023262-106.dat	upx
behavioral2/files/0x0007000000023261-101.dat	upx
behavioral2/files/0x000700000002325e-86.dat	upx
behavioral2/files/0x000700000002325d-81.dat	upx
behavioral2/memory/4804-56-0x00007FF747EE0000-0x00007FF748234000-memory.dmp	upx
behavioral2/files/0x0007000000023258-60.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vnObIFe.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\ktHRURM.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\wyWtSzx.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\szwXxGE.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\IYAHzmE.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\YKnvjwu.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\fuHeJoc.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\UpUeQZF.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\zXcmnHg.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\pTKWrDS.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\xyXEneK.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\beagsYE.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\DkDiJnz.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\LdCoruu.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\QTejMyS.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\lMAVGWF.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\EIaHiEQ.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\LqGWjqh.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\kFBUsRL.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\KQvBwCp.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\yVTxsjT.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\GLiYLUD.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\SAQtevr.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\LxcXfNa.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\BpuRXNR.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\yODwOHz.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\UHHDAcj.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\lZJkWtl.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\wFHPTUa.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\fvBZDPN.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\vGXgVSX.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\oTMnamW.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\rzTtSLO.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\EbItvoz.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\FnBkRUS.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\tPRLJHz.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\NLshZcl.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\OkUikjZ.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\xAFwBtg.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\gwoIzZv.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\UofoOdd.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\qXKsseg.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\whdizsC.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\bEMJHpS.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\hJgitoR.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\ayJKqqr.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\PwXkRZL.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\YFMiGCz.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\RlHaoTh.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\YOmizjv.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\dKJCvag.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\qFGwbQk.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\qxSxmtG.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\cfqfvWR.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\kyboHsH.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\CrHMGFo.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\xtRAPjX.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\zIBJcrg.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\uoihzDc.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\acrRnWP.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\TVoInbB.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\aFgDvyc.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\XKyUJNr.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
File created	C:\Windows\System\pKIwFEb.exe	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3764	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	93
PID 4480 wrote to memory of 3764	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	93
PID 4480 wrote to memory of 4340	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	94
PID 4480 wrote to memory of 4340	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	94
PID 4480 wrote to memory of 4648	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	95
PID 4480 wrote to memory of 4648	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	95
PID 4480 wrote to memory of 3656	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	96
PID 4480 wrote to memory of 3656	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	96
PID 4480 wrote to memory of 4956	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	97
PID 4480 wrote to memory of 4956	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	97
PID 4480 wrote to memory of 4056	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	98
PID 4480 wrote to memory of 4056	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	98
PID 4480 wrote to memory of 5116	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	99
PID 4480 wrote to memory of 5116	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	99
PID 4480 wrote to memory of 5044	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	100
PID 4480 wrote to memory of 5044	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	100
PID 4480 wrote to memory of 4804	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	101
PID 4480 wrote to memory of 4804	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	101
PID 4480 wrote to memory of 1212	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	102
PID 4480 wrote to memory of 1212	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	102
PID 4480 wrote to memory of 4452	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	103
PID 4480 wrote to memory of 4452	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	103
PID 4480 wrote to memory of 4088	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	104
PID 4480 wrote to memory of 4088	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	104
PID 4480 wrote to memory of 5080	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	105
PID 4480 wrote to memory of 5080	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	105
PID 4480 wrote to memory of 4848	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	106
PID 4480 wrote to memory of 4848	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	106
PID 4480 wrote to memory of 436	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	107
PID 4480 wrote to memory of 436	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	107
PID 4480 wrote to memory of 2716	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	108
PID 4480 wrote to memory of 2716	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	108
PID 4480 wrote to memory of 3332	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	109
PID 4480 wrote to memory of 3332	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	109
PID 4480 wrote to memory of 4796	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	110
PID 4480 wrote to memory of 4796	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	110
PID 4480 wrote to memory of 5048	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	111
PID 4480 wrote to memory of 5048	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	111
PID 4480 wrote to memory of 3820	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	112
PID 4480 wrote to memory of 3820	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	112
PID 4480 wrote to memory of 4032	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	113
PID 4480 wrote to memory of 4032	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	113
PID 4480 wrote to memory of 3780	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	114
PID 4480 wrote to memory of 3780	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	114
PID 4480 wrote to memory of 3580	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	115
PID 4480 wrote to memory of 3580	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	115
PID 4480 wrote to memory of 4356	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	116
PID 4480 wrote to memory of 4356	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	116
PID 4480 wrote to memory of 1472	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	117
PID 4480 wrote to memory of 1472	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	117
PID 4480 wrote to memory of 1564	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	118
PID 4480 wrote to memory of 1564	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	118
PID 4480 wrote to memory of 1612	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	119
PID 4480 wrote to memory of 1612	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	119
PID 4480 wrote to memory of 3880	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	120
PID 4480 wrote to memory of 3880	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	120
PID 4480 wrote to memory of 1972	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	121
PID 4480 wrote to memory of 1972	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	121
PID 4480 wrote to memory of 4064	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	122
PID 4480 wrote to memory of 4064	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	122
PID 4480 wrote to memory of 4212	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	123
PID 4480 wrote to memory of 4212	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	123
PID 4480 wrote to memory of 4292	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	124
PID 4480 wrote to memory of 4292	4480	6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6056de77d76db3311d6c5bd2b7b70700_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System\msBuEwm.exe
  C:\Windows\System\msBuEwm.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\aoIDVgJ.exe
  C:\Windows\System\aoIDVgJ.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\LkWmZNH.exe
  C:\Windows\System\LkWmZNH.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\LxcXfNa.exe
  C:\Windows\System\LxcXfNa.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\ZgNZrzL.exe
  C:\Windows\System\ZgNZrzL.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\AyXxHCx.exe
  C:\Windows\System\AyXxHCx.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\qjuJGsX.exe
  C:\Windows\System\qjuJGsX.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\iGhgFlR.exe
  C:\Windows\System\iGhgFlR.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\gdABLrh.exe
  C:\Windows\System\gdABLrh.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\RwHxrmx.exe
  C:\Windows\System\RwHxrmx.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\dNBGVMc.exe
  C:\Windows\System\dNBGVMc.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\aPmipBX.exe
  C:\Windows\System\aPmipBX.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\uPjFWew.exe
  C:\Windows\System\uPjFWew.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\oiqGXdb.exe
  C:\Windows\System\oiqGXdb.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\YKnvjwu.exe
  C:\Windows\System\YKnvjwu.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\TbFNSlb.exe
  C:\Windows\System\TbFNSlb.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\foqfpAH.exe
  C:\Windows\System\foqfpAH.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\SQIfpHY.exe
  C:\Windows\System\SQIfpHY.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\qxpCHyR.exe
  C:\Windows\System\qxpCHyR.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\qtphWhL.exe
  C:\Windows\System\qtphWhL.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\zzUqtPo.exe
  C:\Windows\System\zzUqtPo.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\SYdTeqy.exe
  C:\Windows\System\SYdTeqy.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\QoAfjVi.exe
  C:\Windows\System\QoAfjVi.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\FHYbVxM.exe
  C:\Windows\System\FHYbVxM.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\KQvBwCp.exe
  C:\Windows\System\KQvBwCp.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\Catxjgm.exe
  C:\Windows\System\Catxjgm.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\gWfWweB.exe
  C:\Windows\System\gWfWweB.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zgCJLIr.exe
  C:\Windows\System\zgCJLIr.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\cItdSyt.exe
  C:\Windows\System\cItdSyt.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\EjZhDYH.exe
  C:\Windows\System\EjZhDYH.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\YAZYFuS.exe
  C:\Windows\System\YAZYFuS.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\VMrvXHs.exe
  C:\Windows\System\VMrvXHs.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\ypDQrkc.exe
  C:\Windows\System\ypDQrkc.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\YqTXswi.exe
  C:\Windows\System\YqTXswi.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\rfwYsLR.exe
  C:\Windows\System\rfwYsLR.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\aFgDvyc.exe
  C:\Windows\System\aFgDvyc.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\AKCTcmD.exe
  C:\Windows\System\AKCTcmD.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\kOakdAC.exe
  C:\Windows\System\kOakdAC.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\fPbRCeb.exe
  C:\Windows\System\fPbRCeb.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\PDesKOj.exe
  C:\Windows\System\PDesKOj.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\rzTtSLO.exe
  C:\Windows\System\rzTtSLO.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\viyLlnS.exe
  C:\Windows\System\viyLlnS.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\KXJiEho.exe
  C:\Windows\System\KXJiEho.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\QpqbxcA.exe
  C:\Windows\System\QpqbxcA.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\dEUJaZR.exe
  C:\Windows\System\dEUJaZR.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\hhmoYgk.exe
  C:\Windows\System\hhmoYgk.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\mFfLFwf.exe
  C:\Windows\System\mFfLFwf.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\mrZuono.exe
  C:\Windows\System\mrZuono.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\xawhfYu.exe
  C:\Windows\System\xawhfYu.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\QJwvDxE.exe
  C:\Windows\System\QJwvDxE.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\kltqCri.exe
  C:\Windows\System\kltqCri.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\vSFmzqo.exe
  C:\Windows\System\vSFmzqo.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\qJVORGK.exe
  C:\Windows\System\qJVORGK.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\yhcGrYo.exe
  C:\Windows\System\yhcGrYo.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\HIJOkFf.exe
  C:\Windows\System\HIJOkFf.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\ytvGKwM.exe
  C:\Windows\System\ytvGKwM.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\RpVIdfe.exe
  C:\Windows\System\RpVIdfe.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\SoYmnXA.exe
  C:\Windows\System\SoYmnXA.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\EHOfwyG.exe
  C:\Windows\System\EHOfwyG.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\RYELiDQ.exe
  C:\Windows\System\RYELiDQ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\qUwlNHs.exe
  C:\Windows\System\qUwlNHs.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\WCiNAix.exe
  C:\Windows\System\WCiNAix.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\fARADhp.exe
  C:\Windows\System\fARADhp.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\ghsrEIE.exe
  C:\Windows\System\ghsrEIE.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\GCaTPoW.exe
  C:\Windows\System\GCaTPoW.exe
  2⤵
  PID:5248
- C:\Windows\System\jQOouAu.exe
  C:\Windows\System\jQOouAu.exe
  2⤵
  PID:5284
- C:\Windows\System\pLJACuI.exe
  C:\Windows\System\pLJACuI.exe
  2⤵
  PID:5312
- C:\Windows\System\EgZwwru.exe
  C:\Windows\System\EgZwwru.exe
  2⤵
  PID:5328
- C:\Windows\System\fbBOolz.exe
  C:\Windows\System\fbBOolz.exe
  2⤵
  PID:5356
- C:\Windows\System\yeuwAqf.exe
  C:\Windows\System\yeuwAqf.exe
  2⤵
  PID:5372
- C:\Windows\System\vlImWeN.exe
  C:\Windows\System\vlImWeN.exe
  2⤵
  PID:5408
- C:\Windows\System\szwXxGE.exe
  C:\Windows\System\szwXxGE.exe
  2⤵
  PID:5432
- C:\Windows\System\FKxuCIJ.exe
  C:\Windows\System\FKxuCIJ.exe
  2⤵
  PID:5468
- C:\Windows\System\bJZCYlX.exe
  C:\Windows\System\bJZCYlX.exe
  2⤵
  PID:5508
- C:\Windows\System\IAPaVOK.exe
  C:\Windows\System\IAPaVOK.exe
  2⤵
  PID:5524
- C:\Windows\System\MedIOKD.exe
  C:\Windows\System\MedIOKD.exe
  2⤵
  PID:5540
- C:\Windows\System\EIaHiEQ.exe
  C:\Windows\System\EIaHiEQ.exe
  2⤵
  PID:5556
- C:\Windows\System\OgrkPBl.exe
  C:\Windows\System\OgrkPBl.exe
  2⤵
  PID:5580
- C:\Windows\System\xhueGFy.exe
  C:\Windows\System\xhueGFy.exe
  2⤵
  PID:5612
- C:\Windows\System\DtWzwqV.exe
  C:\Windows\System\DtWzwqV.exe
  2⤵
  PID:5652
- C:\Windows\System\DXSGRyD.exe
  C:\Windows\System\DXSGRyD.exe
  2⤵
  PID:5676
- C:\Windows\System\lYizGYE.exe
  C:\Windows\System\lYizGYE.exe
  2⤵
  PID:5720
- C:\Windows\System\JjipeOT.exe
  C:\Windows\System\JjipeOT.exe
  2⤵
  PID:5768
- C:\Windows\System\IWJOUWq.exe
  C:\Windows\System\IWJOUWq.exe
  2⤵
  PID:5876
- C:\Windows\System\Pxslqui.exe
  C:\Windows\System\Pxslqui.exe
  2⤵
  PID:5904
- C:\Windows\System\HsjLEAB.exe
  C:\Windows\System\HsjLEAB.exe
  2⤵
  PID:5944
- C:\Windows\System\qMBoKOF.exe
  C:\Windows\System\qMBoKOF.exe
  2⤵
  PID:5960
- C:\Windows\System\lOkIWMq.exe
  C:\Windows\System\lOkIWMq.exe
  2⤵
  PID:5988
- C:\Windows\System\djrsSeS.exe
  C:\Windows\System\djrsSeS.exe
  2⤵
  PID:6032
- C:\Windows\System\XdNRquc.exe
  C:\Windows\System\XdNRquc.exe
  2⤵
  PID:6048
- C:\Windows\System\OGSWafT.exe
  C:\Windows\System\OGSWafT.exe
  2⤵
  PID:6088
- C:\Windows\System\OkUikjZ.exe
  C:\Windows\System\OkUikjZ.exe
  2⤵
  PID:6116
- C:\Windows\System\AxAJCeQ.exe
  C:\Windows\System\AxAJCeQ.exe
  2⤵
  PID:4620
- C:\Windows\System\LfqRGHa.exe
  C:\Windows\System\LfqRGHa.exe
  2⤵
  PID:3864
- C:\Windows\System\dcCpWAT.exe
  C:\Windows\System\dcCpWAT.exe
  2⤵
  PID:5164
- C:\Windows\System\WyYKsIM.exe
  C:\Windows\System\WyYKsIM.exe
  2⤵
  PID:5212
- C:\Windows\System\UHHDAcj.exe
  C:\Windows\System\UHHDAcj.exe
  2⤵
  PID:5276
- C:\Windows\System\jNkmghH.exe
  C:\Windows\System\jNkmghH.exe
  2⤵
  PID:5324
- C:\Windows\System\EPRWAOC.exe
  C:\Windows\System\EPRWAOC.exe
  2⤵
  PID:5384
- C:\Windows\System\EuSGqVL.exe
  C:\Windows\System\EuSGqVL.exe
  2⤵
  PID:5448
- C:\Windows\System\jnjhPgd.exe
  C:\Windows\System\jnjhPgd.exe
  2⤵
  PID:4360
- C:\Windows\System\TxcssVA.exe
  C:\Windows\System\TxcssVA.exe
  2⤵
  PID:5552
- C:\Windows\System\cypHKuS.exe
  C:\Windows\System\cypHKuS.exe
  2⤵
  PID:1448
- C:\Windows\System\bpYFiZm.exe
  C:\Windows\System\bpYFiZm.exe
  2⤵
  PID:4396
- C:\Windows\System\QGslRvc.exe
  C:\Windows\System\QGslRvc.exe
  2⤵
  PID:1056
- C:\Windows\System\lRgMQtP.exe
  C:\Windows\System\lRgMQtP.exe
  2⤵
  PID:672
- C:\Windows\System\evcXlmw.exe
  C:\Windows\System\evcXlmw.exe
  2⤵
  PID:5744
- C:\Windows\System\OxsIHTR.exe
  C:\Windows\System\OxsIHTR.exe
  2⤵
  PID:3832
- C:\Windows\System\RImOllh.exe
  C:\Windows\System\RImOllh.exe
  2⤵
  PID:4612
- C:\Windows\System\HMzVtDv.exe
  C:\Windows\System\HMzVtDv.exe
  2⤵
  PID:2164
- C:\Windows\System\JfvwelK.exe
  C:\Windows\System\JfvwelK.exe
  2⤵
  PID:3288
- C:\Windows\System\aAsBIiI.exe
  C:\Windows\System\aAsBIiI.exe
  2⤵
  PID:3364
- C:\Windows\System\ysytueS.exe
  C:\Windows\System\ysytueS.exe
  2⤵
  PID:5868
- C:\Windows\System\qapaMvc.exe
  C:\Windows\System\qapaMvc.exe
  2⤵
  PID:2348
- C:\Windows\System\xAFwBtg.exe
  C:\Windows\System\xAFwBtg.exe
  2⤵
  PID:5920
- C:\Windows\System\jLAofUW.exe
  C:\Windows\System\jLAofUW.exe
  2⤵
  PID:5800
- C:\Windows\System\qTmagMa.exe
  C:\Windows\System\qTmagMa.exe
  2⤵
  PID:5956
- C:\Windows\System\FFcEZiT.exe
  C:\Windows\System\FFcEZiT.exe
  2⤵
  PID:5824
- C:\Windows\System\sdqjHXA.exe
  C:\Windows\System\sdqjHXA.exe
  2⤵
  PID:5820
- C:\Windows\System\xDeaGJm.exe
  C:\Windows\System\xDeaGJm.exe
  2⤵
  PID:6044
- C:\Windows\System\DVNwcBx.exe
  C:\Windows\System\DVNwcBx.exe
  2⤵
  PID:5840
- C:\Windows\System\rpUsnws.exe
  C:\Windows\System\rpUsnws.exe
  2⤵
  PID:3684
- C:\Windows\System\OifjkOu.exe
  C:\Windows\System\OifjkOu.exe
  2⤵
  PID:5256
- C:\Windows\System\bySAkdK.exe
  C:\Windows\System\bySAkdK.exe
  2⤵
  PID:5404
- C:\Windows\System\VZekJlb.exe
  C:\Windows\System\VZekJlb.exe
  2⤵
  PID:5516
- C:\Windows\System\hTqZVrJ.exe
  C:\Windows\System\hTqZVrJ.exe
  2⤵
  PID:5872
- C:\Windows\System\CvUXPIM.exe
  C:\Windows\System\CvUXPIM.exe
  2⤵
  PID:5668
- C:\Windows\System\tGqLvwy.exe
  C:\Windows\System\tGqLvwy.exe
  2⤵
  PID:3836
- C:\Windows\System\JncoyxQ.exe
  C:\Windows\System\JncoyxQ.exe
  2⤵
  PID:368
- C:\Windows\System\Rfeiiqr.exe
  C:\Windows\System\Rfeiiqr.exe
  2⤵
  PID:4656
- C:\Windows\System\ZTSdJKi.exe
  C:\Windows\System\ZTSdJKi.exe
  2⤵
  PID:5984
- C:\Windows\System\wxRoGSg.exe
  C:\Windows\System\wxRoGSg.exe
  2⤵
  PID:3172
- C:\Windows\System\rCQEMbU.exe
  C:\Windows\System\rCQEMbU.exe
  2⤵
  PID:6128
- C:\Windows\System\fReOpHg.exe
  C:\Windows\System\fReOpHg.exe
  2⤵
  PID:5500
- C:\Windows\System\QGiDbJp.exe
  C:\Windows\System\QGiDbJp.exe
  2⤵
  PID:5632
- C:\Windows\System\SZWXsSo.exe
  C:\Windows\System\SZWXsSo.exe
  2⤵
  PID:5728
- C:\Windows\System\ayJKqqr.exe
  C:\Windows\System\ayJKqqr.exe
  2⤵
  PID:4692
- C:\Windows\System\OmQdIXF.exe
  C:\Windows\System\OmQdIXF.exe
  2⤵
  PID:5892
- C:\Windows\System\kGXwwrA.exe
  C:\Windows\System\kGXwwrA.exe
  2⤵
  PID:5348
- C:\Windows\System\JXTFZAV.exe
  C:\Windows\System\JXTFZAV.exe
  2⤵
  PID:6004
- C:\Windows\System\TFriduc.exe
  C:\Windows\System\TFriduc.exe
  2⤵
  PID:4500
- C:\Windows\System\QNlMEWl.exe
  C:\Windows\System\QNlMEWl.exe
  2⤵
  PID:6164
- C:\Windows\System\VPIZqsI.exe
  C:\Windows\System\VPIZqsI.exe
  2⤵
  PID:6196
- C:\Windows\System\sElKgJf.exe
  C:\Windows\System\sElKgJf.exe
  2⤵
  PID:6240
- C:\Windows\System\KwKcbgu.exe
  C:\Windows\System\KwKcbgu.exe
  2⤵
  PID:6272
- C:\Windows\System\qFGwbQk.exe
  C:\Windows\System\qFGwbQk.exe
  2⤵
  PID:6288
- C:\Windows\System\pemCVue.exe
  C:\Windows\System\pemCVue.exe
  2⤵
  PID:6308
- C:\Windows\System\KJRCKMv.exe
  C:\Windows\System\KJRCKMv.exe
  2⤵
  PID:6352
- C:\Windows\System\UdCZakt.exe
  C:\Windows\System\UdCZakt.exe
  2⤵
  PID:6368
- C:\Windows\System\YUcbUau.exe
  C:\Windows\System\YUcbUau.exe
  2⤵
  PID:6388
- C:\Windows\System\HuiUXSv.exe
  C:\Windows\System\HuiUXSv.exe
  2⤵
  PID:6440
- C:\Windows\System\mhvqeCA.exe
  C:\Windows\System\mhvqeCA.exe
  2⤵
  PID:6460
- C:\Windows\System\zlHvyKi.exe
  C:\Windows\System\zlHvyKi.exe
  2⤵
  PID:6484
- C:\Windows\System\BFCnnbm.exe
  C:\Windows\System\BFCnnbm.exe
  2⤵
  PID:6512
- C:\Windows\System\RPoPTeN.exe
  C:\Windows\System\RPoPTeN.exe
  2⤵
  PID:6540
- C:\Windows\System\QolXafs.exe
  C:\Windows\System\QolXafs.exe
  2⤵
  PID:6564
- C:\Windows\System\qkibalT.exe
  C:\Windows\System\qkibalT.exe
  2⤵
  PID:6588
- C:\Windows\System\FdiUvyv.exe
  C:\Windows\System\FdiUvyv.exe
  2⤵
  PID:6616
- C:\Windows\System\lyqWlwd.exe
  C:\Windows\System\lyqWlwd.exe
  2⤵
  PID:6652
- C:\Windows\System\YxLfxoA.exe
  C:\Windows\System\YxLfxoA.exe
  2⤵
  PID:6680
- C:\Windows\System\RXPhdts.exe
  C:\Windows\System\RXPhdts.exe
  2⤵
  PID:6720
- C:\Windows\System\UqDMrcU.exe
  C:\Windows\System\UqDMrcU.exe
  2⤵
  PID:6744
- C:\Windows\System\GnBtjjf.exe
  C:\Windows\System\GnBtjjf.exe
  2⤵
  PID:6768
- C:\Windows\System\mvZgPsp.exe
  C:\Windows\System\mvZgPsp.exe
  2⤵
  PID:6792
- C:\Windows\System\PwXkRZL.exe
  C:\Windows\System\PwXkRZL.exe
  2⤵
  PID:6828
- C:\Windows\System\qXKsseg.exe
  C:\Windows\System\qXKsseg.exe
  2⤵
  PID:6844
- C:\Windows\System\QZrrQjn.exe
  C:\Windows\System\QZrrQjn.exe
  2⤵
  PID:6876
- C:\Windows\System\kvpYouZ.exe
  C:\Windows\System\kvpYouZ.exe
  2⤵
  PID:6904
- C:\Windows\System\cLJhaLP.exe
  C:\Windows\System\cLJhaLP.exe
  2⤵
  PID:6932
- C:\Windows\System\RARclub.exe
  C:\Windows\System\RARclub.exe
  2⤵
  PID:6960
- C:\Windows\System\GkZhizk.exe
  C:\Windows\System\GkZhizk.exe
  2⤵
  PID:6988
- C:\Windows\System\LInyKEb.exe
  C:\Windows\System\LInyKEb.exe
  2⤵
  PID:7020
- C:\Windows\System\HqeLksd.exe
  C:\Windows\System\HqeLksd.exe
  2⤵
  PID:7044
- C:\Windows\System\oOJZXTo.exe
  C:\Windows\System\oOJZXTo.exe
  2⤵
  PID:7076
- C:\Windows\System\zpYVdwX.exe
  C:\Windows\System\zpYVdwX.exe
  2⤵
  PID:7096
- C:\Windows\System\wdYieBs.exe
  C:\Windows\System\wdYieBs.exe
  2⤵
  PID:7124
- C:\Windows\System\TJEZCoj.exe
  C:\Windows\System\TJEZCoj.exe
  2⤵
  PID:7144
- C:\Windows\System\gTIdwcE.exe
  C:\Windows\System\gTIdwcE.exe
  2⤵
  PID:6076
- C:\Windows\System\EzArDJP.exe
  C:\Windows\System\EzArDJP.exe
  2⤵
  PID:6208
- C:\Windows\System\HmSXEHp.exe
  C:\Windows\System\HmSXEHp.exe
  2⤵
  PID:6280
- C:\Windows\System\UkyHyGG.exe
  C:\Windows\System\UkyHyGG.exe
  2⤵
  PID:6324
- C:\Windows\System\sUABLUT.exe
  C:\Windows\System\sUABLUT.exe
  2⤵
  PID:6360
- C:\Windows\System\JhXmdXi.exe
  C:\Windows\System\JhXmdXi.exe
  2⤵
  PID:6424
- C:\Windows\System\wLDXpEB.exe
  C:\Windows\System\wLDXpEB.exe
  2⤵
  PID:6496
- C:\Windows\System\sEBSMDK.exe
  C:\Windows\System\sEBSMDK.exe
  2⤵
  PID:6580
- C:\Windows\System\ODSmCgB.exe
  C:\Windows\System\ODSmCgB.exe
  2⤵
  PID:6584
- C:\Windows\System\qxSxmtG.exe
  C:\Windows\System\qxSxmtG.exe
  2⤵
  PID:6660
- C:\Windows\System\tGXgyfe.exe
  C:\Windows\System\tGXgyfe.exe
  2⤵
  PID:6756
- C:\Windows\System\xEDdthy.exe
  C:\Windows\System\xEDdthy.exe
  2⤵
  PID:6784
- C:\Windows\System\faroiBA.exe
  C:\Windows\System\faroiBA.exe
  2⤵
  PID:6868
- C:\Windows\System\DJSSUEO.exe
  C:\Windows\System\DJSSUEO.exe
  2⤵
  PID:6924
- C:\Windows\System\wvmQdrA.exe
  C:\Windows\System\wvmQdrA.exe
  2⤵
  PID:6940
- C:\Windows\System\LibIyCo.exe
  C:\Windows\System\LibIyCo.exe
  2⤵
  PID:7036
- C:\Windows\System\AYXfxjY.exe
  C:\Windows\System\AYXfxjY.exe
  2⤵
  PID:7084
- C:\Windows\System\lfobAED.exe
  C:\Windows\System\lfobAED.exe
  2⤵
  PID:6180
- C:\Windows\System\jYZMlGZ.exe
  C:\Windows\System\jYZMlGZ.exe
  2⤵
  PID:1192
- C:\Windows\System\oaUNkfQ.exe
  C:\Windows\System\oaUNkfQ.exe
  2⤵
  PID:6384
- C:\Windows\System\TuqLMtb.exe
  C:\Windows\System\TuqLMtb.exe
  2⤵
  PID:6552
- C:\Windows\System\DiUQFwL.exe
  C:\Windows\System\DiUQFwL.exe
  2⤵
  PID:6532
- C:\Windows\System\OnGsyhj.exe
  C:\Windows\System\OnGsyhj.exe
  2⤵
  PID:6612
- C:\Windows\System\itaGwFf.exe
  C:\Windows\System\itaGwFf.exe
  2⤵
  PID:6892
- C:\Windows\System\uoihzDc.exe
  C:\Windows\System\uoihzDc.exe
  2⤵
  PID:3292
- C:\Windows\System\VCdLjSy.exe
  C:\Windows\System\VCdLjSy.exe
  2⤵
  PID:7160
- C:\Windows\System\ygamADh.exe
  C:\Windows\System\ygamADh.exe
  2⤵
  PID:7132
- C:\Windows\System\cfqfvWR.exe
  C:\Windows\System\cfqfvWR.exe
  2⤵
  PID:7156
- C:\Windows\System\BkzRvEX.exe
  C:\Windows\System\BkzRvEX.exe
  2⤵
  PID:7216
- C:\Windows\System\ZgLYzuU.exe
  C:\Windows\System\ZgLYzuU.exe
  2⤵
  PID:7232
- C:\Windows\System\OXfLsLp.exe
  C:\Windows\System\OXfLsLp.exe
  2⤵
  PID:7248
- C:\Windows\System\EEyOdyK.exe
  C:\Windows\System\EEyOdyK.exe
  2⤵
  PID:7264
- C:\Windows\System\zXcmnHg.exe
  C:\Windows\System\zXcmnHg.exe
  2⤵
  PID:7280
- C:\Windows\System\KyrIiMo.exe
  C:\Windows\System\KyrIiMo.exe
  2⤵
  PID:7300
- C:\Windows\System\nomKaXW.exe
  C:\Windows\System\nomKaXW.exe
  2⤵
  PID:7332
- C:\Windows\System\qNebWBX.exe
  C:\Windows\System\qNebWBX.exe
  2⤵
  PID:7356
- C:\Windows\System\IaCXRla.exe
  C:\Windows\System\IaCXRla.exe
  2⤵
  PID:7392
- C:\Windows\System\DYbrQoe.exe
  C:\Windows\System\DYbrQoe.exe
  2⤵
  PID:7408
- C:\Windows\System\AhLmtKz.exe
  C:\Windows\System\AhLmtKz.exe
  2⤵
  PID:7424
- C:\Windows\System\bxbyWfQ.exe
  C:\Windows\System\bxbyWfQ.exe
  2⤵
  PID:7448
- C:\Windows\System\EJBWYOk.exe
  C:\Windows\System\EJBWYOk.exe
  2⤵
  PID:7472
- C:\Windows\System\acIqvQr.exe
  C:\Windows\System\acIqvQr.exe
  2⤵
  PID:7500
- C:\Windows\System\dRnDJoJ.exe
  C:\Windows\System\dRnDJoJ.exe
  2⤵
  PID:7532
- C:\Windows\System\sDGyhLO.exe
  C:\Windows\System\sDGyhLO.exe
  2⤵
  PID:7560
- C:\Windows\System\vGXgVSX.exe
  C:\Windows\System\vGXgVSX.exe
  2⤵
  PID:7584
- C:\Windows\System\QkXSoci.exe
  C:\Windows\System\QkXSoci.exe
  2⤵
  PID:7612
- C:\Windows\System\sYAexmB.exe
  C:\Windows\System\sYAexmB.exe
  2⤵
  PID:7640
- C:\Windows\System\hhLXMnH.exe
  C:\Windows\System\hhLXMnH.exe
  2⤵
  PID:7668
- C:\Windows\System\Bbkneux.exe
  C:\Windows\System\Bbkneux.exe
  2⤵
  PID:7704
- C:\Windows\System\lgraxet.exe
  C:\Windows\System\lgraxet.exe
  2⤵
  PID:7728
- C:\Windows\System\fuHeJoc.exe
  C:\Windows\System\fuHeJoc.exe
  2⤵
  PID:7760
- C:\Windows\System\hzpBagm.exe
  C:\Windows\System\hzpBagm.exe
  2⤵
  PID:7788
- C:\Windows\System\kEcUNIW.exe
  C:\Windows\System\kEcUNIW.exe
  2⤵
  PID:7824
- C:\Windows\System\AGRcXNq.exe
  C:\Windows\System\AGRcXNq.exe
  2⤵
  PID:7844
- C:\Windows\System\nioECax.exe
  C:\Windows\System\nioECax.exe
  2⤵
  PID:7868
- C:\Windows\System\wXawcAA.exe
  C:\Windows\System\wXawcAA.exe
  2⤵
  PID:7888
- C:\Windows\System\dwYBqyH.exe
  C:\Windows\System\dwYBqyH.exe
  2⤵
  PID:7920
- C:\Windows\System\EeYlSNF.exe
  C:\Windows\System\EeYlSNF.exe
  2⤵
  PID:7948
- C:\Windows\System\vOCjbJE.exe
  C:\Windows\System\vOCjbJE.exe
  2⤵
  PID:7984
- C:\Windows\System\GIJvOFq.exe
  C:\Windows\System\GIJvOFq.exe
  2⤵
  PID:8004
- C:\Windows\System\ROLiiPj.exe
  C:\Windows\System\ROLiiPj.exe
  2⤵
  PID:8020
- C:\Windows\System\HlxBxjq.exe
  C:\Windows\System\HlxBxjq.exe
  2⤵
  PID:8044
- C:\Windows\System\PeyUzCZ.exe
  C:\Windows\System\PeyUzCZ.exe
  2⤵
  PID:8064
- C:\Windows\System\yVTxsjT.exe
  C:\Windows\System\yVTxsjT.exe
  2⤵
  PID:8080
- C:\Windows\System\oRurPEM.exe
  C:\Windows\System\oRurPEM.exe
  2⤵
  PID:8104
- C:\Windows\System\vzwgEdt.exe
  C:\Windows\System\vzwgEdt.exe
  2⤵
  PID:8132
- C:\Windows\System\RDhUWOT.exe
  C:\Windows\System\RDhUWOT.exe
  2⤵
  PID:8176
- C:\Windows\System\vHPliCn.exe
  C:\Windows\System\vHPliCn.exe
  2⤵
  PID:7176
- C:\Windows\System\FdkzTve.exe
  C:\Windows\System\FdkzTve.exe
  2⤵
  PID:7240
- C:\Windows\System\JnEiLPb.exe
  C:\Windows\System\JnEiLPb.exe
  2⤵
  PID:7256
- C:\Windows\System\kTfOAdn.exe
  C:\Windows\System\kTfOAdn.exe
  2⤵
  PID:7368
- C:\Windows\System\YBxxtic.exe
  C:\Windows\System\YBxxtic.exe
  2⤵
  PID:7404
- C:\Windows\System\iWiPJXR.exe
  C:\Windows\System\iWiPJXR.exe
  2⤵
  PID:7460
- C:\Windows\System\DNLZUyX.exe
  C:\Windows\System\DNLZUyX.exe
  2⤵
  PID:7484
- C:\Windows\System\KphAyGR.exe
  C:\Windows\System\KphAyGR.exe
  2⤵
  PID:7572
- C:\Windows\System\ebmPLMO.exe
  C:\Windows\System\ebmPLMO.exe
  2⤵
  PID:7632
- C:\Windows\System\gdEjYDQ.exe
  C:\Windows\System\gdEjYDQ.exe
  2⤵
  PID:7832
- C:\Windows\System\QahcKUm.exe
  C:\Windows\System\QahcKUm.exe
  2⤵
  PID:7724
- C:\Windows\System\UxAMXRa.exe
  C:\Windows\System\UxAMXRa.exe
  2⤵
  PID:7748
- C:\Windows\System\RoFTAIu.exe
  C:\Windows\System\RoFTAIu.exe
  2⤵
  PID:7956
- C:\Windows\System\gxfxLCl.exe
  C:\Windows\System\gxfxLCl.exe
  2⤵
  PID:8040
- C:\Windows\System\LdZOqpZ.exe
  C:\Windows\System\LdZOqpZ.exe
  2⤵
  PID:7900
- C:\Windows\System\GTmMemH.exe
  C:\Windows\System\GTmMemH.exe
  2⤵
  PID:8096
- C:\Windows\System\quvrCOJ.exe
  C:\Windows\System\quvrCOJ.exe
  2⤵
  PID:8056
- C:\Windows\System\jSyRAHk.exe
  C:\Windows\System\jSyRAHk.exe
  2⤵
  PID:7228
- C:\Windows\System\esmAxZD.exe
  C:\Windows\System\esmAxZD.exe
  2⤵
  PID:6376
- C:\Windows\System\DnYUkmP.exe
  C:\Windows\System\DnYUkmP.exe
  2⤵
  PID:7552
- C:\Windows\System\ZuHZOMN.exe
  C:\Windows\System\ZuHZOMN.exe
  2⤵
  PID:7440
- C:\Windows\System\fyabduy.exe
  C:\Windows\System\fyabduy.exe
  2⤵
  PID:7656
- C:\Windows\System\beagsYE.exe
  C:\Windows\System\beagsYE.exe
  2⤵
  PID:7932
- C:\Windows\System\RatTBeH.exe
  C:\Windows\System\RatTBeH.exe
  2⤵
  PID:8016
- C:\Windows\System\ppvZsBJ.exe
  C:\Windows\System\ppvZsBJ.exe
  2⤵
  PID:7972
- C:\Windows\System\pKlQXTD.exe
  C:\Windows\System\pKlQXTD.exe
  2⤵
  PID:8196
- C:\Windows\System\vjauCKa.exe
  C:\Windows\System\vjauCKa.exe
  2⤵
  PID:8228
- C:\Windows\System\FziiDjD.exe
  C:\Windows\System\FziiDjD.exe
  2⤵
  PID:8248
- C:\Windows\System\JvijVpJ.exe
  C:\Windows\System\JvijVpJ.exe
  2⤵
  PID:8268
- C:\Windows\System\RlxzZUM.exe
  C:\Windows\System\RlxzZUM.exe
  2⤵
  PID:8296
- C:\Windows\System\kyboHsH.exe
  C:\Windows\System\kyboHsH.exe
  2⤵
  PID:8320
- C:\Windows\System\UVHKOPb.exe
  C:\Windows\System\UVHKOPb.exe
  2⤵
  PID:8340
- C:\Windows\System\VWUSEca.exe
  C:\Windows\System\VWUSEca.exe
  2⤵
  PID:8372
- C:\Windows\System\DularEf.exe
  C:\Windows\System\DularEf.exe
  2⤵
  PID:8396
- C:\Windows\System\brAWjms.exe
  C:\Windows\System\brAWjms.exe
  2⤵
  PID:8420
- C:\Windows\System\jdyoDNN.exe
  C:\Windows\System\jdyoDNN.exe
  2⤵
  PID:8448
- C:\Windows\System\jwnIExI.exe
  C:\Windows\System\jwnIExI.exe
  2⤵
  PID:8476
- C:\Windows\System\QluDcvH.exe
  C:\Windows\System\QluDcvH.exe
  2⤵
  PID:8504
- C:\Windows\System\zaOqSRB.exe
  C:\Windows\System\zaOqSRB.exe
  2⤵
  PID:8528
- C:\Windows\System\uOpfpJJ.exe
  C:\Windows\System\uOpfpJJ.exe
  2⤵
  PID:8560
- C:\Windows\System\kekvHsp.exe
  C:\Windows\System\kekvHsp.exe
  2⤵
  PID:8588
- C:\Windows\System\MWkGkro.exe
  C:\Windows\System\MWkGkro.exe
  2⤵
  PID:8612
- C:\Windows\System\icEWhEZ.exe
  C:\Windows\System\icEWhEZ.exe
  2⤵
  PID:8644
- C:\Windows\System\MUDSnTZ.exe
  C:\Windows\System\MUDSnTZ.exe
  2⤵
  PID:8668
- C:\Windows\System\sHwMcVB.exe
  C:\Windows\System\sHwMcVB.exe
  2⤵
  PID:8700
- C:\Windows\System\IIforLz.exe
  C:\Windows\System\IIforLz.exe
  2⤵
  PID:8728
- C:\Windows\System\qZTwasz.exe
  C:\Windows\System\qZTwasz.exe
  2⤵
  PID:8752
- C:\Windows\System\vnObIFe.exe
  C:\Windows\System\vnObIFe.exe
  2⤵
  PID:8780
- C:\Windows\System\jRIAeSE.exe
  C:\Windows\System\jRIAeSE.exe
  2⤵
  PID:8808
- C:\Windows\System\QTejMyS.exe
  C:\Windows\System\QTejMyS.exe
  2⤵
  PID:8832
- C:\Windows\System\epLIPrb.exe
  C:\Windows\System\epLIPrb.exe
  2⤵
  PID:8860
- C:\Windows\System\SVZLXll.exe
  C:\Windows\System\SVZLXll.exe
  2⤵
  PID:8892
- C:\Windows\System\rGfcfev.exe
  C:\Windows\System\rGfcfev.exe
  2⤵
  PID:8916
- C:\Windows\System\LlFvGUc.exe
  C:\Windows\System\LlFvGUc.exe
  2⤵
  PID:8936
- C:\Windows\System\DkeDZvd.exe
  C:\Windows\System\DkeDZvd.exe
  2⤵
  PID:8960
- C:\Windows\System\iuRgIyj.exe
  C:\Windows\System\iuRgIyj.exe
  2⤵
  PID:9048
- C:\Windows\System\uflEfdu.exe
  C:\Windows\System\uflEfdu.exe
  2⤵
  PID:9072
- C:\Windows\System\smlBOsk.exe
  C:\Windows\System\smlBOsk.exe
  2⤵
  PID:9100
- C:\Windows\System\jDGJuXs.exe
  C:\Windows\System\jDGJuXs.exe
  2⤵
  PID:9128
- C:\Windows\System\ylzrESR.exe
  C:\Windows\System\ylzrESR.exe
  2⤵
  PID:9176
- C:\Windows\System\RnFxqKp.exe
  C:\Windows\System\RnFxqKp.exe
  2⤵
  PID:9200
- C:\Windows\System\xQVKtmB.exe
  C:\Windows\System\xQVKtmB.exe
  2⤵
  PID:7244
- C:\Windows\System\sADPULY.exe
  C:\Windows\System\sADPULY.exe
  2⤵
  PID:8184
- C:\Windows\System\nwbCpSU.exe
  C:\Windows\System\nwbCpSU.exe
  2⤵
  PID:8204
- C:\Windows\System\GOKpKEc.exe
  C:\Windows\System\GOKpKEc.exe
  2⤵
  PID:8404
- C:\Windows\System\GhoYzvG.exe
  C:\Windows\System\GhoYzvG.exe
  2⤵
  PID:7936
- C:\Windows\System\wwFFure.exe
  C:\Windows\System\wwFFure.exe
  2⤵
  PID:8244
- C:\Windows\System\WbMvqii.exe
  C:\Windows\System\WbMvqii.exe
  2⤵
  PID:8664
- C:\Windows\System\kdBLLCR.exe
  C:\Windows\System\kdBLLCR.exe
  2⤵
  PID:8724
- C:\Windows\System\TBpZasi.exe
  C:\Windows\System\TBpZasi.exe
  2⤵
  PID:8776
- C:\Windows\System\FxKeRiD.exe
  C:\Windows\System\FxKeRiD.exe
  2⤵
  PID:8804
- C:\Windows\System\hrnwqSe.exe
  C:\Windows\System\hrnwqSe.exe
  2⤵
  PID:8852
- C:\Windows\System\VDraduR.exe
  C:\Windows\System\VDraduR.exe
  2⤵
  PID:8736
- C:\Windows\System\ZCZOcGL.exe
  C:\Windows\System\ZCZOcGL.exe
  2⤵
  PID:8904
- C:\Windows\System\ARkCJBk.exe
  C:\Windows\System\ARkCJBk.exe
  2⤵
  PID:9092
- C:\Windows\System\djMJbNp.exe
  C:\Windows\System\djMJbNp.exe
  2⤵
  PID:7212
- C:\Windows\System\qdLzOzv.exe
  C:\Windows\System\qdLzOzv.exe
  2⤵
  PID:8264
- C:\Windows\System\xbBkYMq.exe
  C:\Windows\System\xbBkYMq.exe
  2⤵
  PID:8460
- C:\Windows\System\SiNjPxP.exe
  C:\Windows\System\SiNjPxP.exe
  2⤵
  PID:8412
- C:\Windows\System\bYzvTXE.exe
  C:\Windows\System\bYzvTXE.exe
  2⤵
  PID:8744
- C:\Windows\System\FYsKoDV.exe
  C:\Windows\System\FYsKoDV.exe
  2⤵
  PID:8540
- C:\Windows\System\lEGqVuf.exe
  C:\Windows\System\lEGqVuf.exe
  2⤵
  PID:8604
- C:\Windows\System\kJQIaZW.exe
  C:\Windows\System\kJQIaZW.exe
  2⤵
  PID:8876
- C:\Windows\System\pSItASX.exe
  C:\Windows\System\pSItASX.exe
  2⤵
  PID:8364
- C:\Windows\System\UilUigq.exe
  C:\Windows\System\UilUigq.exe
  2⤵
  PID:9140
- C:\Windows\System\JJoCvMF.exe
  C:\Windows\System\JJoCvMF.exe
  2⤵
  PID:8076
- C:\Windows\System\uiNrxxH.exe
  C:\Windows\System\uiNrxxH.exe
  2⤵
  PID:9004
- C:\Windows\System\gwoIzZv.exe
  C:\Windows\System\gwoIzZv.exe
  2⤵
  PID:7524
- C:\Windows\System\PoHBJCZ.exe
  C:\Windows\System\PoHBJCZ.exe
  2⤵
  PID:8716
- C:\Windows\System\sWnYjGN.exe
  C:\Windows\System\sWnYjGN.exe
  2⤵
  PID:9244
- C:\Windows\System\NFNzxCD.exe
  C:\Windows\System\NFNzxCD.exe
  2⤵
  PID:9272
- C:\Windows\System\KoMHauG.exe
  C:\Windows\System\KoMHauG.exe
  2⤵
  PID:9300
- C:\Windows\System\ysXhORe.exe
  C:\Windows\System\ysXhORe.exe
  2⤵
  PID:9336
- C:\Windows\System\tQDgzLR.exe
  C:\Windows\System\tQDgzLR.exe
  2⤵
  PID:9360
- C:\Windows\System\XPEOzwN.exe
  C:\Windows\System\XPEOzwN.exe
  2⤵
  PID:9392
- C:\Windows\System\vIzBkPq.exe
  C:\Windows\System\vIzBkPq.exe
  2⤵
  PID:9416
- C:\Windows\System\WfVjqKg.exe
  C:\Windows\System\WfVjqKg.exe
  2⤵
  PID:9432
- C:\Windows\System\xtPlSIn.exe
  C:\Windows\System\xtPlSIn.exe
  2⤵
  PID:9460
- C:\Windows\System\KehNDtI.exe
  C:\Windows\System\KehNDtI.exe
  2⤵
  PID:9476
- C:\Windows\System\PmzDszU.exe
  C:\Windows\System\PmzDszU.exe
  2⤵
  PID:9500
- C:\Windows\System\SFLefri.exe
  C:\Windows\System\SFLefri.exe
  2⤵
  PID:9524
- C:\Windows\System\pTKWrDS.exe
  C:\Windows\System\pTKWrDS.exe
  2⤵
  PID:9552
- C:\Windows\System\OJSgsNM.exe
  C:\Windows\System\OJSgsNM.exe
  2⤵
  PID:9576
- C:\Windows\System\FlLKmPf.exe
  C:\Windows\System\FlLKmPf.exe
  2⤵
  PID:9600
- C:\Windows\System\huMBYLJ.exe
  C:\Windows\System\huMBYLJ.exe
  2⤵
  PID:9632
- C:\Windows\System\rcddUgY.exe
  C:\Windows\System\rcddUgY.exe
  2⤵
  PID:9648
- C:\Windows\System\wOFqDJa.exe
  C:\Windows\System\wOFqDJa.exe
  2⤵
  PID:9676
- C:\Windows\System\yZsgxLa.exe
  C:\Windows\System\yZsgxLa.exe
  2⤵
  PID:9704
- C:\Windows\System\SHEKBUM.exe
  C:\Windows\System\SHEKBUM.exe
  2⤵
  PID:9736
- C:\Windows\System\IKoiIeo.exe
  C:\Windows\System\IKoiIeo.exe
  2⤵
  PID:9760
- C:\Windows\System\vrVsvRk.exe
  C:\Windows\System\vrVsvRk.exe
  2⤵
  PID:9784
- C:\Windows\System\aDdEwSl.exe
  C:\Windows\System\aDdEwSl.exe
  2⤵
  PID:9812
- C:\Windows\System\ntWtxvH.exe
  C:\Windows\System\ntWtxvH.exe
  2⤵
  PID:9832
- C:\Windows\System\YJApLhc.exe
  C:\Windows\System\YJApLhc.exe
  2⤵
  PID:9856
- C:\Windows\System\oLNIken.exe
  C:\Windows\System\oLNIken.exe
  2⤵
  PID:9872
- C:\Windows\System\qJBezyg.exe
  C:\Windows\System\qJBezyg.exe
  2⤵
  PID:9896
- C:\Windows\System\QzIaTUR.exe
  C:\Windows\System\QzIaTUR.exe
  2⤵
  PID:9924
- C:\Windows\System\tHUzwRl.exe
  C:\Windows\System\tHUzwRl.exe
  2⤵
  PID:9944
- C:\Windows\System\ebuzPLm.exe
  C:\Windows\System\ebuzPLm.exe
  2⤵
  PID:9968
- C:\Windows\System\ExQQaox.exe
  C:\Windows\System\ExQQaox.exe
  2⤵
  PID:9992
- C:\Windows\System\HaAjCMD.exe
  C:\Windows\System\HaAjCMD.exe
  2⤵
  PID:10224
- C:\Windows\System\DPjFTZz.exe
  C:\Windows\System\DPjFTZz.exe
  2⤵
  PID:8120
- C:\Windows\System\DQzVMDn.exe
  C:\Windows\System\DQzVMDn.exe
  2⤵
  PID:9260
- C:\Windows\System\jgaFggW.exe
  C:\Windows\System\jgaFggW.exe
  2⤵
  PID:9352
- C:\Windows\System\rvEUVOp.exe
  C:\Windows\System\rvEUVOp.exe
  2⤵
  PID:9312
- C:\Windows\System\LTbSvDR.exe
  C:\Windows\System\LTbSvDR.exe
  2⤵
  PID:9288
- C:\Windows\System\itzQjvv.exe
  C:\Windows\System\itzQjvv.exe
  2⤵
  PID:9472
- C:\Windows\System\sDiHaKG.exe
  C:\Windows\System\sDiHaKG.exe
  2⤵
  PID:9488
- C:\Windows\System\XhYjlKA.exe
  C:\Windows\System\XhYjlKA.exe
  2⤵
  PID:9608
- C:\Windows\System\tLgQlPl.exe
  C:\Windows\System\tLgQlPl.exe
  2⤵
  PID:9664
- C:\Windows\System\HcXoSAD.exe
  C:\Windows\System\HcXoSAD.exe
  2⤵
  PID:9724
- C:\Windows\System\llodbAN.exe
  C:\Windows\System\llodbAN.exe
  2⤵
  PID:9768
- C:\Windows\System\ysRNCLI.exe
  C:\Windows\System\ysRNCLI.exe
  2⤵
  PID:9804
- C:\Windows\System\JMikTfn.exe
  C:\Windows\System\JMikTfn.exe
  2⤵
  PID:9776
- C:\Windows\System\EWfRhlU.exe
  C:\Windows\System\EWfRhlU.exe
  2⤵
  PID:9800
- C:\Windows\System\wkFTsic.exe
  C:\Windows\System\wkFTsic.exe
  2⤵
  PID:10028
- C:\Windows\System\EkGQyyx.exe
  C:\Windows\System\EkGQyyx.exe
  2⤵
  PID:10156
- C:\Windows\System\clSMAtk.exe
  C:\Windows\System\clSMAtk.exe
  2⤵
  PID:10180
- C:\Windows\System\jnzTyyg.exe
  C:\Windows\System\jnzTyyg.exe
  2⤵
  PID:8032
- C:\Windows\System\niLsWAH.exe
  C:\Windows\System\niLsWAH.exe
  2⤵
  PID:1072
- C:\Windows\System\FgeBSCV.exe
  C:\Windows\System\FgeBSCV.exe
  2⤵
  PID:9348
- C:\Windows\System\cqthEVQ.exe
  C:\Windows\System\cqthEVQ.exe
  2⤵
  PID:9592
- C:\Windows\System\WVGybPQ.exe
  C:\Windows\System\WVGybPQ.exe
  2⤵
  PID:9520
- C:\Windows\System\kjciapz.exe
  C:\Windows\System\kjciapz.exe
  2⤵
  PID:9640
- C:\Windows\System\lhTDpTq.exe
  C:\Windows\System\lhTDpTq.exe
  2⤵
  PID:9560
- C:\Windows\System\TBPmLVF.exe
  C:\Windows\System\TBPmLVF.exe
  2⤵
  PID:9976
- C:\Windows\System\tsOYzfO.exe
  C:\Windows\System\tsOYzfO.exe
  2⤵
  PID:9864
- C:\Windows\System\QfLnctO.exe
  C:\Windows\System\QfLnctO.exe
  2⤵
  PID:10192
- C:\Windows\System\NEOHyxl.exe
  C:\Windows\System\NEOHyxl.exe
  2⤵
  PID:10236
- C:\Windows\System\gFUHDww.exe
  C:\Windows\System\gFUHDww.exe
  2⤵
  PID:9428
- C:\Windows\System\TsFfxoC.exe
  C:\Windows\System\TsFfxoC.exe
  2⤵
  PID:10256
- C:\Windows\System\ygzQmil.exe
  C:\Windows\System\ygzQmil.exe
  2⤵
  PID:10276
- C:\Windows\System\HQYLkei.exe
  C:\Windows\System\HQYLkei.exe
  2⤵
  PID:10304
- C:\Windows\System\mRFPpdx.exe
  C:\Windows\System\mRFPpdx.exe
  2⤵
  PID:10328
- C:\Windows\System\BRcJKip.exe
  C:\Windows\System\BRcJKip.exe
  2⤵
  PID:10360
- C:\Windows\System\jdYJHUk.exe
  C:\Windows\System\jdYJHUk.exe
  2⤵
  PID:10388
- C:\Windows\System\tAzOoqx.exe
  C:\Windows\System\tAzOoqx.exe
  2⤵
  PID:10408
- C:\Windows\System\dIkMIqB.exe
  C:\Windows\System\dIkMIqB.exe
  2⤵
  PID:10432
- C:\Windows\System\rpIhWyo.exe
  C:\Windows\System\rpIhWyo.exe
  2⤵
  PID:10460
- C:\Windows\System\VmoEnoz.exe
  C:\Windows\System\VmoEnoz.exe
  2⤵
  PID:10484
- C:\Windows\System\TxvyqXf.exe
  C:\Windows\System\TxvyqXf.exe
  2⤵
  PID:10512
- C:\Windows\System\mzpPXEh.exe
  C:\Windows\System\mzpPXEh.exe
  2⤵
  PID:10540
- C:\Windows\System\gHWowNq.exe
  C:\Windows\System\gHWowNq.exe
  2⤵
  PID:10572
- C:\Windows\System\ATxwtjD.exe
  C:\Windows\System\ATxwtjD.exe
  2⤵
  PID:10600
- C:\Windows\System\kxTHbuK.exe
  C:\Windows\System\kxTHbuK.exe
  2⤵
  PID:10628
- C:\Windows\System\ItMLVSF.exe
  C:\Windows\System\ItMLVSF.exe
  2⤵
  PID:10656
- C:\Windows\System\ZtwoOyj.exe
  C:\Windows\System\ZtwoOyj.exe
  2⤵
  PID:10684
- C:\Windows\System\MXtdEmP.exe
  C:\Windows\System\MXtdEmP.exe
  2⤵
  PID:10760
- C:\Windows\System\DrmhBsI.exe
  C:\Windows\System\DrmhBsI.exe
  2⤵
  PID:10804
- C:\Windows\System\OhSvJWO.exe
  C:\Windows\System\OhSvJWO.exe
  2⤵
  PID:10832
- C:\Windows\System\AvGtqvB.exe
  C:\Windows\System\AvGtqvB.exe
  2⤵
  PID:10872
- C:\Windows\System\xbYMaRO.exe
  C:\Windows\System\xbYMaRO.exe
  2⤵
  PID:10900
- C:\Windows\System\rplGwAi.exe
  C:\Windows\System\rplGwAi.exe
  2⤵
  PID:10928
- C:\Windows\System\ZFruoEG.exe
  C:\Windows\System\ZFruoEG.exe
  2⤵
  PID:10956
- C:\Windows\System\OqCmvlq.exe
  C:\Windows\System\OqCmvlq.exe
  2⤵
  PID:10984
- C:\Windows\System\gigVlED.exe
  C:\Windows\System\gigVlED.exe
  2⤵
  PID:11004
- C:\Windows\System\kFvnEKW.exe
  C:\Windows\System\kFvnEKW.exe
  2⤵
  PID:11020
- C:\Windows\System\DluAAdV.exe
  C:\Windows\System\DluAAdV.exe
  2⤵
  PID:11040
- C:\Windows\System\IYAHzmE.exe
  C:\Windows\System\IYAHzmE.exe
  2⤵
  PID:11060
- C:\Windows\System\syqwTOs.exe
  C:\Windows\System\syqwTOs.exe
  2⤵
  PID:11076
- C:\Windows\System\BGylcbZ.exe
  C:\Windows\System\BGylcbZ.exe
  2⤵
  PID:11148
- C:\Windows\System\NhZZWZi.exe
  C:\Windows\System\NhZZWZi.exe
  2⤵
  PID:11172
- C:\Windows\System\bvwkVpy.exe
  C:\Windows\System\bvwkVpy.exe
  2⤵
  PID:11204
- C:\Windows\System\ZazkijM.exe
  C:\Windows\System\ZazkijM.exe
  2⤵
  PID:11228
- C:\Windows\System\Ruwoqpj.exe
  C:\Windows\System\Ruwoqpj.exe
  2⤵
  PID:11256
- C:\Windows\System\gsJASfM.exe
  C:\Windows\System\gsJASfM.exe
  2⤵
  PID:9388
- C:\Windows\System\tAcgfsJ.exe
  C:\Windows\System\tAcgfsJ.exe
  2⤵
  PID:9548
- C:\Windows\System\hrrjHdC.exe
  C:\Windows\System\hrrjHdC.exe
  2⤵
  PID:10292
- C:\Windows\System\AvWemvv.exe
  C:\Windows\System\AvWemvv.exe
  2⤵
  PID:10640
- C:\Windows\System\vnHxUji.exe
  C:\Windows\System\vnHxUji.exe
  2⤵
  PID:10532
- C:\Windows\System\RPKaSyK.exe
  C:\Windows\System\RPKaSyK.exe
  2⤵
  PID:10752
- C:\Windows\System\EUFcLPi.exe
  C:\Windows\System\EUFcLPi.exe
  2⤵
  PID:10672
- C:\Windows\System\Bikjcal.exe
  C:\Windows\System\Bikjcal.exe
  2⤵
  PID:10916
- C:\Windows\System\MQtFMwG.exe
  C:\Windows\System\MQtFMwG.exe
  2⤵
  PID:10992
- C:\Windows\System\oOECQaC.exe
  C:\Windows\System\oOECQaC.exe
  2⤵
  PID:11036
- C:\Windows\System\VqyFDGE.exe
  C:\Windows\System\VqyFDGE.exe
  2⤵
  PID:11072
- C:\Windows\System\whdizsC.exe
  C:\Windows\System\whdizsC.exe
  2⤵
  PID:11168
- C:\Windows\System\MgYyfBD.exe
  C:\Windows\System\MgYyfBD.exe
  2⤵
  PID:11160
- C:\Windows\System\lgCNgCo.exe
  C:\Windows\System\lgCNgCo.exe
  2⤵
  PID:9660
- C:\Windows\System\DPbWDLN.exe
  C:\Windows\System\DPbWDLN.exe
  2⤵
  PID:11248
- C:\Windows\System\cdjCFpA.exe
  C:\Windows\System\cdjCFpA.exe
  2⤵
  PID:11212
- C:\Windows\System\CjLSqCP.exe
  C:\Windows\System\CjLSqCP.exe
  2⤵
  PID:10288
- C:\Windows\System\ZLmUnsa.exe
  C:\Windows\System\ZLmUnsa.exe
  2⤵
  PID:10728
- C:\Windows\System\qOjcRKW.exe
  C:\Windows\System\qOjcRKW.exe
  2⤵
  PID:10560
- C:\Windows\System\kKwcfqi.exe
  C:\Windows\System\kKwcfqi.exe
  2⤵
  PID:10840
- C:\Windows\System\nNEocMK.exe
  C:\Windows\System\nNEocMK.exe
  2⤵
  PID:10952
- C:\Windows\System\fwRrGgm.exe
  C:\Windows\System\fwRrGgm.exe
  2⤵
  PID:11164
- C:\Windows\System\vphVZfz.exe
  C:\Windows\System\vphVZfz.exe
  2⤵
  PID:1412
- C:\Windows\System\roZGhRH.exe
  C:\Windows\System\roZGhRH.exe
  2⤵
  PID:11252
- C:\Windows\System\vVXKahU.exe
  C:\Windows\System\vVXKahU.exe
  2⤵
  PID:10592
- C:\Windows\System\dCRHGIh.exe
  C:\Windows\System\dCRHGIh.exe
  2⤵
  PID:9848
- C:\Windows\System\csPsXCy.exe
  C:\Windows\System\csPsXCy.exe
  2⤵
  PID:11324
- C:\Windows\System\Bdrlkah.exe
  C:\Windows\System\Bdrlkah.exe
  2⤵
  PID:11348
- C:\Windows\System\YOmizjv.exe
  C:\Windows\System\YOmizjv.exe
  2⤵
  PID:11372
- C:\Windows\System\stIRvOI.exe
  C:\Windows\System\stIRvOI.exe
  2⤵
  PID:11400
- C:\Windows\System\zHSYeLe.exe
  C:\Windows\System\zHSYeLe.exe
  2⤵
  PID:11424
- C:\Windows\System\YUoanpu.exe
  C:\Windows\System\YUoanpu.exe
  2⤵
  PID:11448
- C:\Windows\System\vfTmceI.exe
  C:\Windows\System\vfTmceI.exe
  2⤵
  PID:11472
- C:\Windows\System\NkjaMoC.exe
  C:\Windows\System\NkjaMoC.exe
  2⤵
  PID:11500
- C:\Windows\System\GLiYLUD.exe
  C:\Windows\System\GLiYLUD.exe
  2⤵
  PID:11524
- C:\Windows\System\EPYSrTv.exe
  C:\Windows\System\EPYSrTv.exe
  2⤵
  PID:11552
- C:\Windows\System\TALRlHK.exe
  C:\Windows\System\TALRlHK.exe
  2⤵
  PID:11628
- C:\Windows\System\pPiGUiD.exe
  C:\Windows\System\pPiGUiD.exe
  2⤵
  PID:11656
- C:\Windows\System\fPhyHJb.exe
  C:\Windows\System\fPhyHJb.exe
  2⤵
  PID:11692
- C:\Windows\System\KQciGOm.exe
  C:\Windows\System\KQciGOm.exe
  2⤵
  PID:11712
- C:\Windows\System\bDoFgFV.exe
  C:\Windows\System\bDoFgFV.exe
  2⤵
  PID:11736
- C:\Windows\System\MDcemRb.exe
  C:\Windows\System\MDcemRb.exe
  2⤵
  PID:11756
- C:\Windows\System\vWuPgmi.exe
  C:\Windows\System\vWuPgmi.exe
  2⤵
  PID:11780
- C:\Windows\System\SMgJshw.exe
  C:\Windows\System\SMgJshw.exe
  2⤵
  PID:11800
- C:\Windows\System\EbItvoz.exe
  C:\Windows\System\EbItvoz.exe
  2⤵
  PID:11828
- C:\Windows\System\udtdjHZ.exe
  C:\Windows\System\udtdjHZ.exe
  2⤵
  PID:11856
- C:\Windows\System\pTsYolk.exe
  C:\Windows\System\pTsYolk.exe
  2⤵
  PID:11876
- C:\Windows\System\OxKLMAE.exe
  C:\Windows\System\OxKLMAE.exe
  2⤵
  PID:11900
- C:\Windows\System\EYQRnka.exe
  C:\Windows\System\EYQRnka.exe
  2⤵
  PID:11924
- C:\Windows\System\snXQGee.exe
  C:\Windows\System\snXQGee.exe
  2⤵
  PID:11952
- C:\Windows\System\YBJJzun.exe
  C:\Windows\System\YBJJzun.exe
  2⤵
  PID:11976
- C:\Windows\System\MXlbPUC.exe
  C:\Windows\System\MXlbPUC.exe
  2⤵
  PID:12000
- C:\Windows\System\rQkjzhL.exe
  C:\Windows\System\rQkjzhL.exe
  2⤵
  PID:12028
- C:\Windows\System\qeEhhTs.exe
  C:\Windows\System\qeEhhTs.exe
  2⤵
  PID:12048
- C:\Windows\System\acrRnWP.exe
  C:\Windows\System\acrRnWP.exe
  2⤵
  PID:12080
- C:\Windows\System\yiViJMZ.exe
  C:\Windows\System\yiViJMZ.exe
  2⤵
  PID:12108
- C:\Windows\System\SsVCpJz.exe
  C:\Windows\System\SsVCpJz.exe
  2⤵
  PID:12124
- C:\Windows\System\cnieCqQ.exe
  C:\Windows\System\cnieCqQ.exe
  2⤵
  PID:12148
- C:\Windows\System\nkxLdJE.exe
  C:\Windows\System\nkxLdJE.exe
  2⤵
  PID:12164
- C:\Windows\System\JFTziTC.exe
  C:\Windows\System\JFTziTC.exe
  2⤵
  PID:12184
- C:\Windows\System\eAsdIjH.exe
  C:\Windows\System\eAsdIjH.exe
  2⤵
  PID:12212
- C:\Windows\System\Bzrvhib.exe
  C:\Windows\System\Bzrvhib.exe
  2⤵
  PID:12232
- C:\Windows\System\mGmULme.exe
  C:\Windows\System\mGmULme.exe
  2⤵
  PID:12264
- C:\Windows\System\ImfKwRs.exe
  C:\Windows\System\ImfKwRs.exe
  2⤵
  PID:9408
- C:\Windows\System\BfHuRaU.exe
  C:\Windows\System\BfHuRaU.exe
  2⤵
  PID:11316
- C:\Windows\System\qXVuvJx.exe
  C:\Windows\System\qXVuvJx.exe
  2⤵
  PID:4376
- C:\Windows\System\UryQFYL.exe
  C:\Windows\System\UryQFYL.exe
  2⤵
  PID:11384
- C:\Windows\System\oJpdUxs.exe
  C:\Windows\System\oJpdUxs.exe
  2⤵
  PID:11392
- C:\Windows\System\bEMJHpS.exe
  C:\Windows\System\bEMJHpS.exe
  2⤵
  PID:11480
- C:\Windows\System\NxDRbIh.exe
  C:\Windows\System\NxDRbIh.exe
  2⤵
  PID:11544
- C:\Windows\System\fIAoixt.exe
  C:\Windows\System\fIAoixt.exe
  2⤵
  PID:11564
- C:\Windows\System\FnBkRUS.exe
  C:\Windows\System\FnBkRUS.exe
  2⤵
  PID:11648
- C:\Windows\System\iUFAMFZ.exe
  C:\Windows\System\iUFAMFZ.exe
  2⤵
  PID:11724
- C:\Windows\System\RDmYXEk.exe
  C:\Windows\System\RDmYXEk.exe
  2⤵
  PID:11732
- C:\Windows\System\qZmSWWb.exe
  C:\Windows\System\qZmSWWb.exe
  2⤵
  PID:11768
- C:\Windows\System\dBiHZel.exe
  C:\Windows\System\dBiHZel.exe
  2⤵
  PID:11908
- C:\Windows\System\EtNAWWs.exe
  C:\Windows\System\EtNAWWs.exe
  2⤵
  PID:11872
- C:\Windows\System\meoXGyl.exe
  C:\Windows\System\meoXGyl.exe
  2⤵
  PID:11964
- C:\Windows\System\UlaIHYw.exe
  C:\Windows\System\UlaIHYw.exe
  2⤵
  PID:11936
- C:\Windows\System\aOGXoDs.exe
  C:\Windows\System\aOGXoDs.exe
  2⤵
  PID:12036
- C:\Windows\System\AkArdyg.exe
  C:\Windows\System\AkArdyg.exe
  2⤵
  PID:12044
- C:\Windows\System\eimZqTO.exe
  C:\Windows\System\eimZqTO.exe
  2⤵
  PID:12208
- C:\Windows\System\LqGWjqh.exe
  C:\Windows\System\LqGWjqh.exe
  2⤵
  PID:10980
- C:\Windows\System\WrTSxux.exe
  C:\Windows\System\WrTSxux.exe
  2⤵
  PID:12180
- C:\Windows\System\wIkcyCf.exe
  C:\Windows\System\wIkcyCf.exe
  2⤵
  PID:12228
- C:\Windows\System\FLvBoTB.exe
  C:\Windows\System\FLvBoTB.exe
  2⤵
  PID:11596
- C:\Windows\System\KKqXWKT.exe
  C:\Windows\System\KKqXWKT.exe
  2⤵
  PID:11508
- C:\Windows\System\JvAPMGc.exe
  C:\Windows\System\JvAPMGc.exe
  2⤵
  PID:12316
- C:\Windows\System\rbkqaOO.exe
  C:\Windows\System\rbkqaOO.exe
  2⤵
  PID:12344
- C:\Windows\System\krDeejO.exe
  C:\Windows\System\krDeejO.exe
  2⤵
  PID:12368
- C:\Windows\System\RtOJBCu.exe
  C:\Windows\System\RtOJBCu.exe
  2⤵
  PID:12388
- C:\Windows\System\ZhZvPgw.exe
  C:\Windows\System\ZhZvPgw.exe
  2⤵
  PID:12416
- C:\Windows\System\iDjKpgq.exe
  C:\Windows\System\iDjKpgq.exe
  2⤵
  PID:12432
- C:\Windows\System\rkRgZnD.exe
  C:\Windows\System\rkRgZnD.exe
  2⤵
  PID:12456
- C:\Windows\System\TQSfEZM.exe
  C:\Windows\System\TQSfEZM.exe
  2⤵
  PID:12488
- C:\Windows\System\CVmjtSH.exe
  C:\Windows\System\CVmjtSH.exe
  2⤵
  PID:12508
- C:\Windows\System\bjJdBvt.exe
  C:\Windows\System\bjJdBvt.exe
  2⤵
  PID:12528
- C:\Windows\System\MqSuONR.exe
  C:\Windows\System\MqSuONR.exe
  2⤵
  PID:12560
- C:\Windows\System\hxiufDy.exe
  C:\Windows\System\hxiufDy.exe
  2⤵
  PID:12584
- C:\Windows\System\uUNinsq.exe
  C:\Windows\System\uUNinsq.exe
  2⤵
  PID:12616
- C:\Windows\System\ehQIIuH.exe
  C:\Windows\System\ehQIIuH.exe
  2⤵
  PID:12648
- C:\Windows\System\XKyUJNr.exe
  C:\Windows\System\XKyUJNr.exe
  2⤵
  PID:12672
- C:\Windows\System\MPuAsPE.exe
  C:\Windows\System\MPuAsPE.exe
  2⤵
  PID:12696
- C:\Windows\System\OLXAhop.exe
  C:\Windows\System\OLXAhop.exe
  2⤵
  PID:12724
- C:\Windows\System\yKOTvLL.exe
  C:\Windows\System\yKOTvLL.exe
  2⤵
  PID:12744
- C:\Windows\System\lZJkWtl.exe
  C:\Windows\System\lZJkWtl.exe
  2⤵
  PID:12768
- C:\Windows\System\ysJLfDV.exe
  C:\Windows\System\ysJLfDV.exe
  2⤵
  PID:12792
- C:\Windows\System\eREliRE.exe
  C:\Windows\System\eREliRE.exe
  2⤵
  PID:12824
- C:\Windows\System\oqRgHom.exe
  C:\Windows\System\oqRgHom.exe
  2⤵
  PID:12844
- C:\Windows\System\MNXMSSs.exe
  C:\Windows\System\MNXMSSs.exe
  2⤵
  PID:12876
- C:\Windows\System\aCGicxF.exe
  C:\Windows\System\aCGicxF.exe
  2⤵
  PID:12896
- C:\Windows\System\KrAqDHs.exe
  C:\Windows\System\KrAqDHs.exe
  2⤵
  PID:12924
- C:\Windows\System\VutqPAU.exe
  C:\Windows\System\VutqPAU.exe
  2⤵
  PID:12944
- C:\Windows\System\yZZirFG.exe
  C:\Windows\System\yZZirFG.exe
  2⤵
  PID:12984
- C:\Windows\System\RLpTSmA.exe
  C:\Windows\System\RLpTSmA.exe
  2⤵
  PID:13008
- C:\Windows\System\fjGzcZE.exe
  C:\Windows\System\fjGzcZE.exe
  2⤵
  PID:13040
- C:\Windows\System\mIgKRIh.exe
  C:\Windows\System\mIgKRIh.exe
  2⤵
  PID:13072
- C:\Windows\System\KGVujsT.exe
  C:\Windows\System\KGVujsT.exe
  2⤵
  PID:13096
- C:\Windows\System\aQahfmJ.exe
  C:\Windows\System\aQahfmJ.exe
  2⤵
  PID:13120
- C:\Windows\System\hbpUesk.exe
  C:\Windows\System\hbpUesk.exe
  2⤵
  PID:13144
- C:\Windows\System\PCUrIeo.exe
  C:\Windows\System\PCUrIeo.exe
  2⤵
  PID:13164
- C:\Windows\System\Hltpjnq.exe
  C:\Windows\System\Hltpjnq.exe
  2⤵
  PID:13192
- C:\Windows\System\XxnoiOB.exe
  C:\Windows\System\XxnoiOB.exe
  2⤵
  PID:13208
- C:\Windows\System\NmtpOXO.exe
  C:\Windows\System\NmtpOXO.exe
  2⤵
  PID:13228
- C:\Windows\System\QLeGcoo.exe
  C:\Windows\System\QLeGcoo.exe
  2⤵
  PID:13252
- C:\Windows\System\VoyzVqc.exe
  C:\Windows\System\VoyzVqc.exe
  2⤵
  PID:13276
- C:\Windows\System\FFmnNiR.exe
  C:\Windows\System\FFmnNiR.exe
  2⤵
  PID:13292
- C:\Windows\System\hAYxFrh.exe
  C:\Windows\System\hAYxFrh.exe
  2⤵
  PID:11824
- C:\Windows\System\BlWZaVm.exe
  C:\Windows\System\BlWZaVm.exe
  2⤵
  PID:11664
- C:\Windows\System\zsKRNcG.exe
  C:\Windows\System\zsKRNcG.exe
  2⤵
  PID:1236
- C:\Windows\System\kovWmbY.exe
  C:\Windows\System\kovWmbY.exe
  2⤵
  PID:12076
- C:\Windows\System\UZkKqra.exe
  C:\Windows\System\UZkKqra.exe
  2⤵
  PID:12068
- C:\Windows\System\YFMiGCz.exe
  C:\Windows\System\YFMiGCz.exe
  2⤵
  PID:12280
- C:\Windows\System\aMGTUxQ.exe
  C:\Windows\System\aMGTUxQ.exe
  2⤵
  PID:12340
- C:\Windows\System\dvngijp.exe
  C:\Windows\System\dvngijp.exe
  2⤵
  PID:1844
- C:\Windows\System\pgxqNxH.exe
  C:\Windows\System\pgxqNxH.exe
  2⤵
  PID:2484
- C:\Windows\System\DyeYBbq.exe
  C:\Windows\System\DyeYBbq.exe
  2⤵
  PID:12444
- C:\Windows\System\UfHNDAT.exe
  C:\Windows\System\UfHNDAT.exe
  2⤵
  PID:12908
- C:\Windows\System\QMMiUha.exe
  C:\Windows\System\QMMiUha.exe
  2⤵
  PID:12936
- C:\Windows\System\RUzEHQe.exe
  C:\Windows\System\RUzEHQe.exe
  2⤵
  PID:12836
- C:\Windows\System\ZLktgqi.exe
  C:\Windows\System\ZLktgqi.exe
  2⤵
  PID:12720
- C:\Windows\System\wFHPTUa.exe
  C:\Windows\System\wFHPTUa.exe
  2⤵
  PID:13092
- C:\Windows\System\QZEWEmF.exe
  C:\Windows\System\QZEWEmF.exe
  2⤵
  PID:4576
- C:\Windows\System\NpEpbHM.exe
  C:\Windows\System\NpEpbHM.exe
  2⤵
  PID:13024
- C:\Windows\System\dbKZpcz.exe
  C:\Windows\System\dbKZpcz.exe
  2⤵
  PID:13172
- C:\Windows\System\eENBNit.exe
  C:\Windows\System\eENBNit.exe
  2⤵
  PID:3468
- C:\Windows\System\YHyVANo.exe
  C:\Windows\System\YHyVANo.exe
  2⤵
  PID:13136
- C:\Windows\System\fKaMYMK.exe
  C:\Windows\System\fKaMYMK.exe
  2⤵
  PID:13204
- C:\Windows\System\RlHaoTh.exe
  C:\Windows\System\RlHaoTh.exe
  2⤵
  PID:13268
- C:\Windows\System\lQiMelL.exe
  C:\Windows\System\lQiMelL.exe
  2⤵
  PID:12360
- C:\Windows\System\ktHRURM.exe
  C:\Windows\System\ktHRURM.exe
  2⤵
  PID:12244
- C:\Windows\System\hGpBOqh.exe
  C:\Windows\System\hGpBOqh.exe
  2⤵
  PID:11396
- C:\Windows\System\ugAhEnd.exe
  C:\Windows\System\ugAhEnd.exe
  2⤵
  PID:12292
- C:\Windows\System\rCyQjKh.exe
  C:\Windows\System\rCyQjKh.exe
  2⤵
  PID:11896
- C:\Windows\System\PASRyED.exe
  C:\Windows\System\PASRyED.exe
  2⤵
  PID:4404
- C:\Windows\System\EfugTTx.exe
  C:\Windows\System\EfugTTx.exe
  2⤵
  PID:1484
- C:\Windows\System\QkRQnAd.exe
  C:\Windows\System\QkRQnAd.exe
  2⤵
  PID:12424
- C:\Windows\System\rTQuruC.exe
  C:\Windows\System\rTQuruC.exe
  2⤵
  PID:4604
- C:\Windows\System\OIhWCTx.exe
  C:\Windows\System\OIhWCTx.exe
  2⤵
  PID:2784
- C:\Windows\System\dOuNZKQ.exe
  C:\Windows\System\dOuNZKQ.exe
  2⤵
  PID:1332
- C:\Windows\System\jGEzeMH.exe
  C:\Windows\System\jGEzeMH.exe
  2⤵
  PID:2816
- C:\Windows\System\CTaGmse.exe
  C:\Windows\System\CTaGmse.exe
  2⤵
  PID:3812
- C:\Windows\System\SkQBtMR.exe
  C:\Windows\System\SkQBtMR.exe
  2⤵
  PID:1304
- C:\Windows\System\OYKmZDs.exe
  C:\Windows\System\OYKmZDs.exe
  2⤵
  PID:11488
- C:\Windows\System\CrHMGFo.exe
  C:\Windows\System\CrHMGFo.exe
  2⤵
  PID:5244
- C:\Windows\System\DBwkJPC.exe
  C:\Windows\System\DBwkJPC.exe
  2⤵
  PID:1268
- C:\Windows\System\jhMeOak.exe
  C:\Windows\System\jhMeOak.exe
  2⤵
  PID:12428
- C:\Windows\System\TzELTcw.exe
  C:\Windows\System\TzELTcw.exe
  2⤵
  PID:12632
- C:\Windows\System\VcRAeKX.exe
  C:\Windows\System\VcRAeKX.exe
  2⤵
  PID:13152
- C:\Windows\System\gajlivt.exe
  C:\Windows\System\gajlivt.exe
  2⤵
  PID:5160
- C:\Windows\System\rEbVtzN.exe
  C:\Windows\System\rEbVtzN.exe
  2⤵
  PID:4600
- C:\Windows\System\OxlKRWj.exe
  C:\Windows\System\OxlKRWj.exe
  2⤵
  PID:5216
- C:\Windows\System\uCeqTTC.exe
  C:\Windows\System\uCeqTTC.exe
  2⤵
  PID:1260
- C:\Windows\System\TjQgZMb.exe
  C:\Windows\System\TjQgZMb.exe
  2⤵
  PID:5456
- C:\Windows\System\WsYkKFD.exe
  C:\Windows\System\WsYkKFD.exe
  2⤵
  PID:13316
- C:\Windows\System\zxBjgxg.exe
  C:\Windows\System\zxBjgxg.exe
  2⤵
  PID:13332
- C:\Windows\System\mjSDbnB.exe
  C:\Windows\System\mjSDbnB.exe
  2⤵
  PID:13352
- C:\Windows\System\UWOIpYv.exe
  C:\Windows\System\UWOIpYv.exe
  2⤵
  PID:13384
- C:\Windows\System\buGocoZ.exe
  C:\Windows\System\buGocoZ.exe
  2⤵
  PID:13400
- C:\Windows\System\KdjKVaM.exe
  C:\Windows\System\KdjKVaM.exe
  2⤵
  PID:13416
- C:\Windows\System\iZVLuWL.exe
  C:\Windows\System\iZVLuWL.exe
  2⤵
  PID:13448
- C:\Windows\System\AWHUwbh.exe
  C:\Windows\System\AWHUwbh.exe
  2⤵
  PID:13476
- C:\Windows\System\WvJhzBy.exe
  C:\Windows\System\WvJhzBy.exe
  2⤵
  PID:13492
- C:\Windows\System\JNgiCcX.exe
  C:\Windows\System\JNgiCcX.exe
  2⤵
  PID:13520
- C:\Windows\System\nOuAMwP.exe
  C:\Windows\System\nOuAMwP.exe
  2⤵
  PID:13584
- C:\Windows\System\ZmfvcFq.exe
  C:\Windows\System\ZmfvcFq.exe
  2⤵
  PID:13620
- C:\Windows\System\EYrKrlR.exe
  C:\Windows\System\EYrKrlR.exe
  2⤵
  PID:13644
- C:\Windows\System\zJaeWwU.exe
  C:\Windows\System\zJaeWwU.exe
  2⤵
  PID:13668
- C:\Windows\System\fvBZDPN.exe
  C:\Windows\System\fvBZDPN.exe
  2⤵
  PID:13716
- C:\Windows\System\BpuRXNR.exe
  C:\Windows\System\BpuRXNR.exe
  2⤵
  PID:13736
- C:\Windows\System\QWlKUXb.exe
  C:\Windows\System\QWlKUXb.exe
  2⤵
  PID:13772
- C:\Windows\System\GNHTGRq.exe
  C:\Windows\System\GNHTGRq.exe
  2⤵
  PID:13796
- C:\Windows\System\UpUeQZF.exe
  C:\Windows\System\UpUeQZF.exe
  2⤵
  PID:13816
- C:\Windows\System\qTgbXqi.exe
  C:\Windows\System\qTgbXqi.exe
  2⤵
  PID:13856
- C:\Windows\System\GBaSSTh.exe
  C:\Windows\System\GBaSSTh.exe
  2⤵
  PID:13876
- C:\Windows\System\eEfQSRX.exe
  C:\Windows\System\eEfQSRX.exe
  2⤵
  PID:13904
- C:\Windows\System\DXnRwKk.exe
  C:\Windows\System\DXnRwKk.exe
  2⤵
  PID:13932
- C:\Windows\System\EcLVAQY.exe
  C:\Windows\System\EcLVAQY.exe
  2⤵
  PID:13984
- C:\Windows\System\yoDLeeI.exe
  C:\Windows\System\yoDLeeI.exe
  2⤵
  PID:14004
- C:\Windows\System\myXntJR.exe
  C:\Windows\System\myXntJR.exe
  2⤵
  PID:14024
- C:\Windows\System\jTTbDSC.exe
  C:\Windows\System\jTTbDSC.exe
  2⤵
  PID:14048
- C:\Windows\System\TZhbYbQ.exe
  C:\Windows\System\TZhbYbQ.exe
  2⤵
  PID:14072
- C:\Windows\System\TYMChaN.exe
  C:\Windows\System\TYMChaN.exe
  2⤵
  PID:14128
- C:\Windows\System\MtHoHzO.exe
  C:\Windows\System\MtHoHzO.exe
  2⤵
  PID:14156
- C:\Windows\System\wddzBYX.exe
  C:\Windows\System\wddzBYX.exe
  2⤵
  PID:14180
- C:\Windows\System\kFBUsRL.exe
  C:\Windows\System\kFBUsRL.exe
  2⤵
  PID:14204
- C:\Windows\System\UofoOdd.exe
  C:\Windows\System\UofoOdd.exe
  2⤵
  PID:14244
- C:\Windows\System\RYHVEaQ.exe
  C:\Windows\System\RYHVEaQ.exe
  2⤵
  PID:14264
- C:\Windows\System\hhfBSaE.exe
  C:\Windows\System\hhfBSaE.exe
  2⤵
  PID:12808
- C:\Windows\System\lMAVGWF.exe
  C:\Windows\System\lMAVGWF.exe
  2⤵
  PID:4492
- C:\Windows\System\fhVmoWD.exe
  C:\Windows\System\fhVmoWD.exe
  2⤵
  PID:13464
- C:\Windows\System\vodpEBN.exe
  C:\Windows\System\vodpEBN.exe
  2⤵
  PID:13504
- C:\Windows\System\EmTOluv.exe
  C:\Windows\System\EmTOluv.exe
  2⤵
  PID:13612
- C:\Windows\System\NBUqXOV.exe
  C:\Windows\System\NBUqXOV.exe
  2⤵
  PID:13576
- C:\Windows\System\ecQygpb.exe
  C:\Windows\System\ecQygpb.exe
  2⤵
  PID:13732
- C:\Windows\System\qPVlEBX.exe
  C:\Windows\System\qPVlEBX.exe
  2⤵
  PID:13712
- C:\Windows\System\zQTzHof.exe
  C:\Windows\System\zQTzHof.exe
  2⤵
  PID:14108
- C:\Windows\System\NMPqRaT.exe
  C:\Windows\System\NMPqRaT.exe
  2⤵
  PID:14152
- C:\Windows\System\YaCdXcd.exe
  C:\Windows\System\YaCdXcd.exe
  2⤵
  PID:2228
- C:\Windows\System\HVTSVkp.exe
  C:\Windows\System\HVTSVkp.exe
  2⤵
  PID:3144
- C:\Windows\System\jNjCzlP.exe
  C:\Windows\System\jNjCzlP.exe
  2⤵
  PID:13436
- C:\Windows\System\GRUUYXA.exe
  C:\Windows\System\GRUUYXA.exe
  2⤵
  PID:884
- C:\Windows\System\vQZDBwc.exe
  C:\Windows\System\vQZDBwc.exe
  2⤵
  PID:13896
- C:\Windows\System\PusNKlY.exe
  C:\Windows\System\PusNKlY.exe
  2⤵
  PID:13408
- C:\Windows\System\awizsGw.exe
  C:\Windows\System\awizsGw.exe
  2⤵
  PID:1232
- C:\Windows\System\vELeAmE.exe
  C:\Windows\System\vELeAmE.exe
  2⤵
  PID:13960
- C:\Windows\System\tGebyPb.exe
  C:\Windows\System\tGebyPb.exe
  2⤵
  PID:13852
- C:\Windows\System\xEwMtiR.exe
  C:\Windows\System\xEwMtiR.exe
  2⤵
  PID:14252
- C:\Windows\System\MemlNVg.exe
  C:\Windows\System\MemlNVg.exe
  2⤵
  PID:14164
- C:\Windows\System\HvXuiJn.exe
  C:\Windows\System\HvXuiJn.exe
  2⤵
  PID:3096
- C:\Windows\System\zSauOSZ.exe
  C:\Windows\System\zSauOSZ.exe
  2⤵
  PID:13788
- C:\Windows\System\MoQKegs.exe
  C:\Windows\System\MoQKegs.exe
  2⤵
  PID:13812
- C:\Windows\System\pOBYlCw.exe
  C:\Windows\System\pOBYlCw.exe
  2⤵
  PID:14044
- C:\Windows\System\hSBZICa.exe
  C:\Windows\System\hSBZICa.exe
  2⤵
  PID:14256
- C:\Windows\System\SAQtevr.exe
  C:\Windows\System\SAQtevr.exe
  2⤵
  PID:6000
- C:\Windows\System\YKyGPJb.exe
  C:\Windows\System\YKyGPJb.exe
  2⤵
  PID:14272
- C:\Windows\System\ZJDcIbb.exe
  C:\Windows\System\ZJDcIbb.exe
  2⤵
  PID:10216
- C:\Windows\System\BOccwxD.exe
  C:\Windows\System\BOccwxD.exe
  2⤵
  PID:3224
- C:\Windows\System\MCOKvmo.exe
  C:\Windows\System\MCOKvmo.exe
  2⤵
  PID:13940
- C:\Windows\System\RfjNwPf.exe
  C:\Windows\System\RfjNwPf.exe
  2⤵
  PID:6124
- C:\Windows\System\CvTJVBk.exe
  C:\Windows\System\CvTJVBk.exe
  2⤵
  PID:4916
- C:\Windows\System\baESFRn.exe
  C:\Windows\System\baESFRn.exe
  2⤵
  PID:4704
- C:\Windows\System\FkUlPko.exe
  C:\Windows\System\FkUlPko.exe
  2⤵
  PID:5912
- C:\Windows\System\JRwWwFW.exe
  C:\Windows\System\JRwWwFW.exe
  2⤵
  PID:14064
- C:\Windows\System\zkxFIpc.exe
  C:\Windows\System\zkxFIpc.exe
  2⤵
  PID:5576
- C:\Windows\System\GjFAIQP.exe
  C:\Windows\System\GjFAIQP.exe
  2⤵
  PID:1096
- C:\Windows\System\dnLGdLr.exe
  C:\Windows\System\dnLGdLr.exe
  2⤵
  PID:13376
- C:\Windows\System\LOghfmo.exe
  C:\Windows\System\LOghfmo.exe
  2⤵
  PID:4216
- C:\Windows\System\mnBWbjr.exe
  C:\Windows\System\mnBWbjr.exe
  2⤵
  PID:1544
- C:\Windows\System\yODwOHz.exe
  C:\Windows\System\yODwOHz.exe
  2⤵
  PID:3276
- C:\Windows\System\RzmanEN.exe
  C:\Windows\System\RzmanEN.exe
  2⤵
  PID:1436
- C:\Windows\System\VnwYnlE.exe
  C:\Windows\System\VnwYnlE.exe
  2⤵
  PID:6016
- C:\Windows\System\DlWRUFN.exe
  C:\Windows\System\DlWRUFN.exe
  2⤵
  PID:1124
- C:\Windows\System\wjULAlV.exe
  C:\Windows\System\wjULAlV.exe
  2⤵
  PID:2612
- C:\Windows\System\kTXScTc.exe
  C:\Windows\System\kTXScTc.exe
  2⤵
  PID:13764
- C:\Windows\System\nwqSfgB.exe
  C:\Windows\System\nwqSfgB.exe
  2⤵
  PID:3076
- C:\Windows\System\jjxmNXN.exe
  C:\Windows\System\jjxmNXN.exe
  2⤵
  PID:6056
- C:\Windows\System\QjrhZZD.exe
  C:\Windows\System\QjrhZZD.exe
  2⤵
  PID:6332
- C:\Windows\System\pbRcGaD.exe
  C:\Windows\System\pbRcGaD.exe
  2⤵
  PID:5292
- C:\Windows\System\lHHOwbM.exe
  C:\Windows\System\lHHOwbM.exe
  2⤵
  PID:4564
- C:\Windows\System\qzseywn.exe
  C:\Windows\System\qzseywn.exe
  2⤵
  PID:3520
- C:\Windows\System\sBJZDpY.exe
  C:\Windows\System\sBJZDpY.exe
  2⤵
  PID:5440
- C:\Windows\System\qOLFaOI.exe
  C:\Windows\System\qOLFaOI.exe
  2⤵
  PID:13968
- C:\Windows\System\MEysJcQ.exe
  C:\Windows\System\MEysJcQ.exe
  2⤵
  PID:6452
- C:\Windows\System\jHZZRPC.exe
  C:\Windows\System\jHZZRPC.exe
  2⤵
  PID:6560
- C:\Windows\System\yPhCPuG.exe
  C:\Windows\System\yPhCPuG.exe
  2⤵
  PID:14168
- C:\Windows\System\cqLfRze.exe
  C:\Windows\System\cqLfRze.exe
  2⤵
  PID:14300
- C:\Windows\System\HimuOoP.exe
  C:\Windows\System\HimuOoP.exe
  2⤵
  PID:6712
- C:\Windows\System\yIFlqKO.exe
  C:\Windows\System\yIFlqKO.exe
  2⤵
  PID:6944
- C:\Windows\System\CPcDCXm.exe
  C:\Windows\System\CPcDCXm.exe
  2⤵
  PID:7028
- C:\Windows\System\YiVKCwS.exe
  C:\Windows\System\YiVKCwS.exe
  2⤵
  PID:6156
- C:\Windows\System\ZFXQLPX.exe
  C:\Windows\System\ZFXQLPX.exe
  2⤵
  PID:6468
- C:\Windows\System\xyXEneK.exe
  C:\Windows\System\xyXEneK.exe
  2⤵
  PID:6780
- C:\Windows\System\YFWOMBJ.exe
  C:\Windows\System\YFWOMBJ.exe
  2⤵
  PID:6864
- C:\Windows\System\qsTHPCz.exe
  C:\Windows\System\qsTHPCz.exe
  2⤵
  PID:7032
- C:\Windows\System\CyYxTHE.exe
  C:\Windows\System\CyYxTHE.exe
  2⤵
  PID:6736
- C:\Windows\System\kLVNVAq.exe
  C:\Windows\System\kLVNVAq.exe
  2⤵
  PID:6920
- C:\Windows\System\lGqvzZM.exe
  C:\Windows\System\lGqvzZM.exe
  2⤵
  PID:7196
- C:\Windows\System\iKkiSoW.exe
  C:\Windows\System\iKkiSoW.exe
  2⤵
  PID:5476
- C:\Windows\System\RQoEYsq.exe
  C:\Windows\System\RQoEYsq.exe
  2⤵
  PID:5352
- C:\Windows\System\dKJCvag.exe
  C:\Windows\System\dKJCvag.exe
  2⤵
  PID:6996
- C:\Windows\System\SPpkKUh.exe
  C:\Windows\System\SPpkKUh.exe
  2⤵
  PID:6644
- C:\Windows\System\romzgVU.exe
  C:\Windows\System\romzgVU.exe
  2⤵
  PID:5260
- C:\Windows\System\lDBDCBO.exe
  C:\Windows\System\lDBDCBO.exe
  2⤵
  PID:5380
- C:\Windows\System\JSOaxcb.exe
  C:\Windows\System\JSOaxcb.exe
  2⤵
  PID:5608
- C:\Windows\System\BFJAsCO.exe
  C:\Windows\System\BFJAsCO.exe
  2⤵
  PID:5184
- C:\Windows\System\xtRAPjX.exe
  C:\Windows\System\xtRAPjX.exe
  2⤵
  PID:3576
- C:\Windows\System\AaztCyo.exe
  C:\Windows\System\AaztCyo.exe
  2⤵
  PID:5620
- C:\Windows\System\DZFXAyA.exe
  C:\Windows\System\DZFXAyA.exe
  2⤵
  PID:4864
- C:\Windows\System\wyMgjVy.exe
  C:\Windows\System\wyMgjVy.exe
  2⤵
  PID:13380
- C:\Windows\System\YTkjJbr.exe
  C:\Windows\System\YTkjJbr.exe
  2⤵
  PID:6400
- C:\Windows\System\yVWzuLW.exe
  C:\Windows\System\yVWzuLW.exe
  2⤵
  PID:5696
- C:\Windows\System\bsldmIm.exe
  C:\Windows\System\bsldmIm.exe
  2⤵
  PID:5752
- C:\Windows\System\BBZpGJV.exe
  C:\Windows\System\BBZpGJV.exe
  2⤵
  PID:5200
- C:\Windows\System\NzteRDS.exe
  C:\Windows\System\NzteRDS.exe
  2⤵
  PID:4892
- C:\Windows\System\DgMfemZ.exe
  C:\Windows\System\DgMfemZ.exe
  2⤵
  PID:5776
- C:\Windows\System\XQeTeXR.exe
  C:\Windows\System\XQeTeXR.exe
  2⤵
  PID:1468
- C:\Windows\System\WVKuKPT.exe
  C:\Windows\System\WVKuKPT.exe
  2⤵
  PID:7184
- C:\Windows\System\vwluQcq.exe
  C:\Windows\System\vwluQcq.exe
  2⤵
  PID:7180
- C:\Windows\System\tjJQczc.exe
  C:\Windows\System\tjJQczc.exe
  2⤵
  PID:5712
- C:\Windows\System\ldctcmh.exe
  C:\Windows\System\ldctcmh.exe
  2⤵
  PID:14240
- C:\Windows\System\yWJVcqB.exe
  C:\Windows\System\yWJVcqB.exe
  2⤵
  PID:5644
- C:\Windows\System\gqhUcQp.exe
  C:\Windows\System\gqhUcQp.exe
  2⤵
  PID:6664
- C:\Windows\System\TwGEeVh.exe
  C:\Windows\System\TwGEeVh.exe
  2⤵
  PID:5788
- C:\Windows\System\TVoInbB.exe
  C:\Windows\System\TVoInbB.exe
  2⤵
  PID:7192
- C:\Windows\System\jUeTAij.exe
  C:\Windows\System\jUeTAij.exe
  2⤵
  PID:6628
- C:\Windows\System\SbxajQq.exe
  C:\Windows\System\SbxajQq.exe
  2⤵
  PID:6340
- C:\Windows\System\jdazaGs.exe
  C:\Windows\System\jdazaGs.exe
  2⤵
  PID:14340
- C:\Windows\System\ponFEaX.exe
  C:\Windows\System\ponFEaX.exe
  2⤵
  PID:14368
- C:\Windows\System\uCnWpqo.exe
  C:\Windows\System\uCnWpqo.exe
  2⤵
  PID:14388
- C:\Windows\System\RpyyBBK.exe
  C:\Windows\System\RpyyBBK.exe
  2⤵
  PID:14452
- C:\Windows\System\tPRLJHz.exe
  C:\Windows\System\tPRLJHz.exe
  2⤵
  PID:14468
- C:\Windows\System\weoemgv.exe
  C:\Windows\System\weoemgv.exe
  2⤵
  PID:14488
- C:\Windows\System\AqoLbos.exe
  C:\Windows\System\AqoLbos.exe
  2⤵
  PID:14512
- C:\Windows\System\rnXvYcg.exe
  C:\Windows\System\rnXvYcg.exe
  2⤵
  PID:14540
- C:\Windows\System\qmaWWUP.exe
  C:\Windows\System\qmaWWUP.exe
  2⤵
  PID:14568
- C:\Windows\System\PmQSFzX.exe
  C:\Windows\System\PmQSFzX.exe
  2⤵
  PID:14596
- C:\Windows\System\SDwxbON.exe
  C:\Windows\System\SDwxbON.exe
  2⤵
  PID:14624
- C:\Windows\System\vHvNvyx.exe
  C:\Windows\System\vHvNvyx.exe
  2⤵
  PID:14644
- C:\Windows\System\cSRQLcG.exe
  C:\Windows\System\cSRQLcG.exe
  2⤵
  PID:14672
- C:\Windows\System\RDdwjHP.exe
  C:\Windows\System\RDdwjHP.exe
  2⤵
  PID:14700
- C:\Windows\System\evFyNKG.exe
  C:\Windows\System\evFyNKG.exe
  2⤵
  PID:14720
- C:\Windows\System\yQXowNS.exe
  C:\Windows\System\yQXowNS.exe
  2⤵
  PID:14744
- C:\Windows\System\FFpmuHU.exe
  C:\Windows\System\FFpmuHU.exe
  2⤵
  PID:14792
- C:\Windows\System\oRhKtxT.exe
  C:\Windows\System\oRhKtxT.exe
  2⤵
  PID:14820
- C:\Windows\System\QTmQjDC.exe
  C:\Windows\System\QTmQjDC.exe
  2⤵
  PID:14844
- C:\Windows\System\wyWtSzx.exe
  C:\Windows\System\wyWtSzx.exe
  2⤵
  PID:14876
- C:\Windows\System\dzBWNfv.exe
  C:\Windows\System\dzBWNfv.exe
  2⤵
  PID:14896
- C:\Windows\System\FonsbaW.exe
  C:\Windows\System\FonsbaW.exe
  2⤵
  PID:15092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5076 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:14140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AyXxHCx.exe

Path C:\Windows\System\AyXxHCx.exe
Size 2.2MB
SHA256 4e1a5b8087971b007cb3b62772a7945a824759f5bef59ba64261ff99e073ee4c
MD5 2461ea50e2db1d15d2026412d3a4608f
SHA1 bb01dc87f6bd63348744165a750b0357c67611e1
SHA512 49601043497f82625519df90cccbf99bfc83e3b641967fd70a2a08054d583d0fad8329b28e6f6ba2cf2e70eb3b3c9850d7869a44e87ce1dd2b9b3be87a2545a1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEV:BemTLkNdfE0pZrV56utgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Catxjgm.exe

Path C:\Windows\System\Catxjgm.exe
Size 2.2MB
SHA256 83501dc4ed96f42f490350464e2c265315452da593ec2651ea5c35ab5de161a0
MD5 f1c85e51ce2c90c2aa269e60da6b4205
SHA1 79a31b0f6d88cf62288ae4874a65edbb5341cd74
SHA512 4aac251d4bb5d1b76e16724601bcac7d52b474d550ae2076dfb90a6bf796544440c00e2c654016569d63e978fecded5db3a61926ca8d004e9d3a3e693b4772e6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEu:BemTLkNdfE0pZrV56utgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

EjZhDYH.exe

Path C:\Windows\System\EjZhDYH.exe
Size 2.2MB
SHA256 fab0a5c1e1b623706b0cc6cc3b0ded33dae85ea40557e517aa137e689a74ad44
MD5 19dd740697c8530c781da3f8c6f384b8
SHA1 5c2a519b705e436a515f2385a1cf25f7332e05bd
SHA512 f256d81264e2b21b8865a281261de527900af14c3516744602d71a25d2e91f204e851aca01a882ae07ccf0eec6d2607e75bd5b140e12e4b58436e172507743f5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEa:BemTLkNdfE0pZrV56utg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FHYbVxM.exe

Path C:\Windows\System\FHYbVxM.exe
Size 2.2MB
SHA256 d8c30b944b09a6b1b0a1e2e7d04872011d881c76ee89693487f2aa02cf9d63fd
MD5 e1be329f0917eeece006f52dcbc8797a
SHA1 91382288e9b0f3e65a3f03f1f554ac876d158d13
SHA512 8fcde03f65ab2b8733d4f58ce5c13aec45f60e650253555f30e62f7f0e124a8e68e8185480615fc7b91a810b6a3f912722b9a1dfdc606bb8413d70018c225067
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE7:BemTLkNdfE0pZrV56utgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

KQvBwCp.exe

Path C:\Windows\System\KQvBwCp.exe
Size 2.2MB
SHA256 f774fcc0ddae0faab45cd3e310fe466001e29dd829a8c5708bea8dc4d7f64351
MD5 95ce3662724963926a736798c650e47e
SHA1 0d1a3cee774ca84e40cfbfeeb8aa23ebc7225185
SHA512 5399c3d3f489f37253f4349f86463810dd546d0a409ce8e1d1155440335fd066b161d4fef35602043239ce58179db3533a701573c51c5d0b235ac3a0ed09ab01
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEW:BemTLkNdfE0pZrV56utgh
MD5 SHA1 SHA512 SSDEEP

Submit Download

LkWmZNH.exe

Path C:\Windows\System\LkWmZNH.exe
Size 2.2MB
SHA256 28e5b81ca87ec8d1c5b38b37a0eb0e89498448d85358cbf4e4a8f5a08ac98cee
MD5 1883d8c7074d9ea653f73afbb8589a02
SHA1 8f1f51f3df2dcb86df4413b4b4a235b614052a77
SHA512 eca7a05576acca4c43d68449c9cf4f0e48a263e6ad27d22fff137711dab092eecba865d691f24c2e311d03a6b5482da887152a370acd4c3a1c704fc27a7f0ed6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEh:BemTLkNdfE0pZrV56utgS
MD5 SHA1 SHA512 SSDEEP

Submit Download

LxcXfNa.exe

Path C:\Windows\System\LxcXfNa.exe
Size 2.2MB
SHA256 6d0fb1ff22cd8cebddae7048dce0c20c88ccbcb9585152f5c59921bc03734bbe
MD5 6889211b3261e76d8292fc65886e8099
SHA1 7d6fa7bc071c1467e6c569c23115b8c686f083f8
SHA512 cf0e3bd8b321dd3b1f32a92e2c291a779bf2d9a821a96fce3ed1d5eaddff63afdfc08d1c40fdff6079511b898cef05f819d69858f8e3ed3cb59f2e3c3be277ab
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE4:BemTLkNdfE0pZrV56utgJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QoAfjVi.exe

Path C:\Windows\System\QoAfjVi.exe
Size 2.2MB
SHA256 eb54f347f42d3e2f2d10c16a07ba5e760bb2d3ac4d22602ffacecf89a3fa6a56
MD5 b4339772f107fbc79629acf6a1009680
SHA1 d1f058764fc95a0ded6a74c29dc2c1d62695d754
SHA512 ff4437c24a2950ae76784406b4625260fe65cc9aba94208cef971baff8fac28d7ee6fd97aef37890108887cff6e5deb5e8411f7ec9ffc6ec61ac43bb1f17c3a3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE9:BemTLkNdfE0pZrV56utgi
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwHxrmx.exe

Path C:\Windows\System\RwHxrmx.exe
Size 2.2MB
SHA256 9990db5de8db61032ddcf61de0a2bd0ff6b0767a6863d2d3dcbd8390b1813008
MD5 c546ea3f84720b7fa432416edfec8699
SHA1 bfcc6d6d739b8670d083378dca84d6a747015d9c
SHA512 f1d257b98bffaf94c94fb2cbb80e2bccfac0c5e61da8f9187bf2332c4db63fbb909949410bda8c8113ddf85318f2ccabc2e49e02ed9eab31460f4836c8b4a721
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEP:BemTLkNdfE0pZrV56utg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQIfpHY.exe

Path C:\Windows\System\SQIfpHY.exe
Size 2.2MB
SHA256 a429b608873155d49bfc2139a596b1f0dc7758cf525bc626871cab90c1c4b58d
MD5 ef58a7595b8a7e07f555dab7b104adb4
SHA1 277d5b0a8b3dc2b801db0a1f3d95e85f02f08f13
SHA512 c4aa3e168fce62a12d8de9e5a443be7e84850e745dc2227aca34f8d2466682e33786b44e84469dceb75516eee2ef7f9e446807c4f5b37b98ad5b0cef1eb5cdc6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEJw:BemTLkNdfE0pZrV56utgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYdTeqy.exe

Path C:\Windows\System\SYdTeqy.exe
Size 2.2MB
SHA256 a33204acdff6fd6128496a90d8bf9daf81167621636b57400378c2a784d72888
MD5 ea5e2a9be3521e296ffa1ac83d9bdd9e
SHA1 044b3776e05a68299c7abb707d120622dde8f0eb
SHA512 3b4c85c89930f3ce4ac0aa53a9386437aced05069f87fbccc9492e375f9e802d6e3d71b9bae944a4c997d1ce7ead9f9a96dea9118d70a7b6e490d35c456513e9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEi:BemTLkNdfE0pZrV56utgv
MD5 SHA1 SHA512 SSDEEP

Submit Download

TbFNSlb.exe

Path C:\Windows\System\TbFNSlb.exe
Size 2.2MB
SHA256 9c618d66b5627eb462b703a6a2d3525d7104ef9890bfab005476e32450a4554d
MD5 fc16828dda469f946693be466b468601
SHA1 bbf6cba0b3acf27d605a15134771b244fadcbd1a
SHA512 1dbc8536c8190636bf1086c7d473ebd8cedb861f53c51c80c9fba20d6a387f8b285915553a4a46f58a00b16c19d787996ca5516e21ebf40a171d396ec007818e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEs:BemTLkNdfE0pZrV56utgZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMrvXHs.exe

Path C:\Windows\System\VMrvXHs.exe
Size 2.2MB
SHA256 16205d241a6156f3160e799c9e674706137e3746fce9667032e2e15459def059
MD5 ab0af1d7c3d6c3b5773d26c136ba0dc8
SHA1 42651d1a39d7f4e75b11649db6c022338c5a9c98
SHA512 4efe30de273bdec63e6b062c7be700556fb1d2d0a646150d530877e14a9ba66aa366d3fceaeb0b21bcbbe59885266c6c2161941195a11e9a691d952af5338245
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEb:BemTLkNdfE0pZrV56utgS
MD5 SHA1 SHA512 SSDEEP

Submit Download

YAZYFuS.exe

Path C:\Windows\System\YAZYFuS.exe
Size 2.2MB
SHA256 1554b333ee1c2ef4942d38153d12c187a456890b43bc9285ac75d15653e3c59c
MD5 24136a16ce452123da6e10c1c7abe01d
SHA1 84771bfdeb7286c91cefae7d44e441ff0c90281b
SHA512 9f1b479f6e945b99c611685cb967b14787c34bcd2517845d41b1f801024b52b0873e131ac6570c71852fa809ca551a33c1311a4873e34d3c656b6438a40581b8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEB:BemTLkNdfE0pZrV56utg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

YKnvjwu.exe

Path C:\Windows\System\YKnvjwu.exe
Size 2.2MB
SHA256 766e68f463f5bbb5c0d57a719f9c5758abba52364d97968ad1446e6d546be95d
MD5 be7c435bf85ea656afd063ea9ecd21f4
SHA1 09a3a06185c7298862a9dd2e92c3f398062754d9
SHA512 1c7ef96383ab79ccdfb80ecfa61c3b37c4c420e4dfa04cfcf24c002d5bcb18c64e6975d475a57b797085955f6c90e0ffffb5d39861d05751c0fc03200d949dc7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEQ:BemTLkNdfE0pZrV56utgT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZgNZrzL.exe

Path C:\Windows\System\ZgNZrzL.exe
Size 2.2MB
SHA256 8b87cc18360ea93d9fabdbef23551a9f1ef5baffae0118127b06514340835266
MD5 a730cacae43f54baddf737f1117a0f53
SHA1 976142d520cb9fe2226e414c53d9b10496ac34a7
SHA512 aef99a5d97dbf383d5618e1aae3d75e32ff92a7db5194b24a1c393bcb69f995d7344a2b3a2f101345eb9205331be6d296e4e4592db1d6f03430222b706104d66
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEg:BemTLkNdfE0pZrV56utgv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aPmipBX.exe

Path C:\Windows\System\aPmipBX.exe
Size 2.2MB
SHA256 8a1c2a8c43f3e24f6b17e72189dbb33addbbadf1191a516cb30fda1ce48479c7
MD5 4642188bd403d36206109369270a1eb5
SHA1 3524142736e97bffe23e6d7ac00aa2c40ff33c7d
SHA512 3f18701ccd686d5d305ff47d22a55aabc5b2d26ea50d53c8792b48861f943c886ddabfc52b7fbf61cee2d695cefe8bd1fe7ad982187678a6b8414c098f56c783
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEP:BemTLkNdfE0pZrV56utg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

aoIDVgJ.exe

Path C:\Windows\System\aoIDVgJ.exe
Size 2.2MB
SHA256 6761ca9aaade4fbcc17bdfd0ea66bcd3698c49270d9ed163e8c5bda1e31e0cf9
MD5 92e9e61e9cfb3b0dd710759488e3c352
SHA1 b2ee855a0a2f9ff4111a2a22c5a418a973673a58
SHA512 b9d0460a5259e5baf05293141d72357dba76cb26d02713010351b72e12584fcafbc366acde1ffa9f77a84ee25ae9353952f201ae942c09f4c861af1be61fb8ec
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEU:BemTLkNdfE0pZrV56utg9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cItdSyt.exe

Path C:\Windows\System\cItdSyt.exe
Size 2.2MB
SHA256 e8830797ad7a972028eacca65399ac5d93749beaaccaf3d6386695e6c988f935
MD5 dd1c5c82ce0597783352d91864420bc5
SHA1 23d178271c1fe3c7aa6d162da1e32a45dc10a4d4
SHA512 db39bec2ffe0f354214994e347cd845795e9fa5c7896157f70401978488359f4dbc99fb8e9ff050181fa4531bea622b59784fc644e197cf38223d6f92786650e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEP:BemTLkNdfE0pZrV56utgM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dNBGVMc.exe

Path C:\Windows\System\dNBGVMc.exe
Size 2.2MB
SHA256 9ab2d88253383556387a17fd19134c9a78ec8135a33f605fd5ec9613fb05b52f
MD5 b6eeaa3496740e633bb23984d960947a
SHA1 1c931878c5783d9885d66278e2bc93843795ea12
SHA512 73eaa03c36bcb040389585f55d313e6f270919996b0fa16f1f3ddb9a785e85b5254613308f66cb3650e33f834da3e71948d4113f8e2242886af1de809a80306a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEM:BemTLkNdfE0pZrV56utgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

foqfpAH.exe

Path C:\Windows\System\foqfpAH.exe
Size 2.2MB
SHA256 92ff907c1e96b2113a928a7b2fb10a74f38961eab9c053155d25706179c17a3a
MD5 5a206799cda95b2ef18de619af650a36
SHA1 3129e68d7ebf70b78905148fd2650373f9fdc9ed
SHA512 4542a52ff41f78e16c1767f87196f3c776b361796c50ce5c795f3666ec8dccc020a2644d26d28fad97ecabd9655dd6193520b0bcdceb8a31fcdfdc820cb8da70
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE7:BemTLkNdfE0pZrV56utgU
MD5 SHA1 SHA512 SSDEEP

Submit Download

gWfWweB.exe

Path C:\Windows\System\gWfWweB.exe
Size 2.2MB
SHA256 0f472b1a5b2e5d7dcbff6d912c19454ea1a9dea7f2d44667460d5a28a66f5f51
MD5 ffbdb99a7a4c78a87284809b9ba762e2
SHA1 6d766f58e197ab719897b64d342737b12d8c010e
SHA512 f5545d2aba367e53f8e790481f1df1c868d73f512ff874d551f7e806674d46547698dc131158662650f6a955b755aea5196299c12968b4a0ef692557716b8364
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEXT:BemTLkNdfE0pZrV56utgs
MD5 SHA1 SHA512 SSDEEP

Submit Download

gdABLrh.exe

Path C:\Windows\System\gdABLrh.exe
Size 2.2MB
SHA256 4b3c0c3b0bfda5e0627215683b655515c7d7aef60e6dcbe2c8168423f704aa71
MD5 aa9629966efad9b7da1e026173ce6cd9
SHA1 1decde63cd7d47e5ef7668c6b806d56bde3cbd8b
SHA512 772b181adfe9d2f376a53553b3604cf60f7acc7fe86a322a118b29efa89c62f88fe1a76ba58c27d390dbbfa26ea7f635c2a83c62f43a76b755ddc9aac1fa1762
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSET:BemTLkNdfE0pZrV56utgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

iGhgFlR.exe

Path C:\Windows\System\iGhgFlR.exe
Size 2.2MB
SHA256 210e307edf881c8ef8a350b4e199c238b6dea896d11e602a0a6937cbedd39806
MD5 f7c71478c5dae861531b62f2941a8a63
SHA1 c7f56ca1949e72ebaf7e16719453173fea4f2b77
SHA512 44156e591dd4f16ce1b0618a8e7cde78d72e9b8be03573e06022b253a065cd4006f6202555dacbb14181b85a70543693d59276da0b67e49730690be18a22234a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEq:BemTLkNdfE0pZrV56utgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

msBuEwm.exe

Path C:\Windows\System\msBuEwm.exe
Size 2.2MB
SHA256 17578e0c2f0e6d6ade9e281f5b5cedebef09da5f9c56f2c3a078c88730d0e7e4
MD5 2d51c907a1295bffb62259b18c3bc5f2
SHA1 58b20853351e2f5a977051a21fbe46f9050b3020
SHA512 a1dad57ea44aac62199200672a80b1606a50bbfc5506802632bad91f9b555b2bad564b518ee55658060d2f19e970e4012dfc8d3769eb4d4530b8e8c0e9d1ec41
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE3:BemTLkNdfE0pZrV56utgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

oiqGXdb.exe

Path C:\Windows\System\oiqGXdb.exe
Size 2.2MB
SHA256 f642423082b56824354e67d9adef307313a8f63ba9fc985edaeb8cb6baeff853
MD5 11bf80166cfe167dbcf29604ed3e4737
SHA1 0beea20a0b4bd04ff54de1f3cd28ffe67a157615
SHA512 6744f7cb4c424370eb034d94631a8e1c17a9c5bd89c78433b5f98610331e5af5c714dd99e41e4e80a3e463cb84287a075c9cfabd81589da30896fa7d59bea5a2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE2:BemTLkNdfE0pZrV56utg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qjuJGsX.exe

Path C:\Windows\System\qjuJGsX.exe
Size 2.2MB
SHA256 d5a930150a07b2be0389b80f1ecb00f9d1806a3c5d0711bb649f466d6cd4352e
MD5 98b5f21b82d9893e7ba7711d78162b07
SHA1 8fac802df512516274b8e180dd10346c4e830156
SHA512 f8d4d24c2544743e90d7c7c5efe8ea6bc4fb3840d740e62511dfbcfb82d4787945d19d76bf2b8b34ecf3f41e27fc4d61e8f9746eebd50bd70191491da91c4468
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEw:BemTLkNdfE0pZrV56utgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtphWhL.exe

Path C:\Windows\System\qtphWhL.exe
Size 2.2MB
SHA256 62097002c0e28174b2b8c39530d83e4005db0086e2480cadb6f1c32985a25e92
MD5 16f7d1b9d5d626e664073a287f904723
SHA1 378ee44f0032a60cde9dc5fdc077b2f38c585228
SHA512 f24cbe831b9fd850bd23cd3a5473c76d207c265971b93cd44c71678cc9c0d872217c5664a9e1b499728dab2f56d888050dbe000893855dc6559b32a73611cc14
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSET:BemTLkNdfE0pZrV56utgu
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxpCHyR.exe

Path C:\Windows\System\qxpCHyR.exe
Size 2.2MB
SHA256 c0361259d44be4d3b6825a9c78a0f777851420258d628d4d59d57842b06c6c51
MD5 15384f68e2ea1d5978cb8848afaaa5d5
SHA1 5261a816e3dde2b629a66a93a6d6566f979c046e
SHA512 c4e80c64fa845357f5e83c09728873aef41512afc438c1cc20194b4eecbb1fa966b38a045a7fedc1dd639c02a12d96cb30e6eec78b546acaf9a46e94b7453d1b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSET:BemTLkNdfE0pZrV56utgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

uPjFWew.exe

Path C:\Windows\System\uPjFWew.exe
Size 2.2MB
SHA256 af48fc93ff14d77fc8a57dd041cf38f784cec7a381ef570a1f1c3134bf3eab7c
MD5 4de38c82f865d6bb71da1250f6dfe403
SHA1 def6ffe1711830375eaedd962914b14b931a28dd
SHA512 1ba8b0e581189c475b9e7f5d3308f65169ed51de7b0599d2d2b09120ecfdc1f7ed5003a4991f61827c4f28367460bcc0173b089a5b22db378eac504323386047
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEO/:BemTLkNdfE0pZrV56utgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgCJLIr.exe

Path C:\Windows\System\zgCJLIr.exe
Size 2.2MB
SHA256 8eb8e2525516170249a5a00f2cc7f36626edd93cd941fb21861898e6e5bd2316
MD5 0a75297c0bca4a720eebd5cf6bdd3013
SHA1 a7117a505727d846d92cb3798039b0447252d823
SHA512 c3b00c5380b0aff44404ca10fcf22543c4aeccdc855f9e720bd296367b60d81baa058e5341f7ea40cac09f6f2c576c953a12e4482ac91b49090789536e0aaa4e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSEo:BemTLkNdfE0pZrV56utgl
MD5 SHA1 SHA512 SSDEEP

Submit Download

zzUqtPo.exe

Path C:\Windows\System\zzUqtPo.exe
Size 2.2MB
SHA256 2fb81fd283575ff6cbdf69d2be4a84bd2bd110af58f802762a1e257c74d39b6f
MD5 cb0768bd5cd346bce20d498b0fe30ea5
SHA1 1dde8ebd37b870c6c270da41e1f1d5f6d2960053
SHA512 44f85b7f597b75e3da3e6005d718b839531f3c4dfc3df7ff8180df4530472aa81fa1a6af443f3123e86909ab1fd79a3526d7a2217c6514b6408f1e0d11fc5403
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgWUbSE1:BemTLkNdfE0pZrV56utgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-325-0x00007FF733230000-0x00007FF733584000-memory.dmp

Download

memory/436-2183-0x00007FF733230000-0x00007FF733584000-memory.dmp

Download

memory/1212-311-0x00007FF7B8E90000-0x00007FF7B91E4000-memory.dmp

Download

memory/1212-2129-0x00007FF7B8E90000-0x00007FF7B91E4000-memory.dmp

Download

memory/1472-2245-0x00007FF6818C0000-0x00007FF681C14000-memory.dmp

Download

memory/1472-336-0x00007FF6818C0000-0x00007FF681C14000-memory.dmp

Download

memory/1564-337-0x00007FF63D7A0000-0x00007FF63DAF4000-memory.dmp

Download

memory/1564-2228-0x00007FF63D7A0000-0x00007FF63DAF4000-memory.dmp

Download

memory/1612-2231-0x00007FF63E870000-0x00007FF63EBC4000-memory.dmp

Download

memory/1612-338-0x00007FF63E870000-0x00007FF63EBC4000-memory.dmp

Download

memory/1972-2222-0x00007FF7ACEE0000-0x00007FF7AD234000-memory.dmp

Download

memory/1972-340-0x00007FF7ACEE0000-0x00007FF7AD234000-memory.dmp

Download

memory/2716-2204-0x00007FF7BF490000-0x00007FF7BF7E4000-memory.dmp

Download

memory/2716-326-0x00007FF7BF490000-0x00007FF7BF7E4000-memory.dmp

Download

memory/3332-328-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp

Download

memory/3332-2207-0x00007FF7CECC0000-0x00007FF7CF014000-memory.dmp

Download

memory/3580-2220-0x00007FF617350000-0x00007FF6176A4000-memory.dmp

Download

memory/3580-334-0x00007FF617350000-0x00007FF6176A4000-memory.dmp

Download

memory/3656-1197-0x00007FF6E6320000-0x00007FF6E6674000-memory.dmp

Download

memory/3656-28-0x00007FF6E6320000-0x00007FF6E6674000-memory.dmp

Download

memory/3656-1956-0x00007FF6E6320000-0x00007FF6E6674000-memory.dmp

Download

memory/3764-1877-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp

Download

memory/3764-341-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp

Download

memory/3764-8-0x00007FF74E4A0000-0x00007FF74E7F4000-memory.dmp

Download

memory/3780-2224-0x00007FF6A0F30000-0x00007FF6A1284000-memory.dmp

Download

memory/3780-333-0x00007FF6A0F30000-0x00007FF6A1284000-memory.dmp

Download

memory/3820-331-0x00007FF75EDA0000-0x00007FF75F0F4000-memory.dmp

Download

memory/3820-2211-0x00007FF75EDA0000-0x00007FF75F0F4000-memory.dmp

Download

memory/3880-2234-0x00007FF6ADEE0000-0x00007FF6AE234000-memory.dmp

Download

memory/3880-339-0x00007FF6ADEE0000-0x00007FF6AE234000-memory.dmp

Download

memory/4032-332-0x00007FF759560000-0x00007FF7598B4000-memory.dmp

Download

memory/4032-2214-0x00007FF759560000-0x00007FF7598B4000-memory.dmp

Download

memory/4056-38-0x00007FF6E6190000-0x00007FF6E64E4000-memory.dmp

Download

memory/4056-2085-0x00007FF6E6190000-0x00007FF6E64E4000-memory.dmp

Download

memory/4088-342-0x00007FF7F72A0000-0x00007FF7F75F4000-memory.dmp

Download

memory/4088-2146-0x00007FF7F72A0000-0x00007FF7F75F4000-memory.dmp

Download

memory/4340-1892-0x00007FF793AA0000-0x00007FF793DF4000-memory.dmp

Download

memory/4340-713-0x00007FF793AA0000-0x00007FF793DF4000-memory.dmp

Download

memory/4340-14-0x00007FF793AA0000-0x00007FF793DF4000-memory.dmp

Download

memory/4356-2223-0x00007FF6A7B10000-0x00007FF6A7E64000-memory.dmp

Download

memory/4356-335-0x00007FF6A7B10000-0x00007FF6A7E64000-memory.dmp

Download

memory/4452-2159-0x00007FF6274C0000-0x00007FF627814000-memory.dmp

Download

memory/4452-316-0x00007FF6274C0000-0x00007FF627814000-memory.dmp

Download

memory/4480-1-0x0000016854930000-0x0000016854940000-memory.dmp

Download

memory/4480-0-0x00007FF685800000-0x00007FF685B54000-memory.dmp

Download

memory/4480-64-0x00007FF685800000-0x00007FF685B54000-memory.dmp

Download

memory/4648-1194-0x00007FF68C750000-0x00007FF68CAA4000-memory.dmp

Download

memory/4648-20-0x00007FF68C750000-0x00007FF68CAA4000-memory.dmp

Download

memory/4648-1930-0x00007FF68C750000-0x00007FF68CAA4000-memory.dmp

Download

memory/4796-329-0x00007FF7CD4D0000-0x00007FF7CD824000-memory.dmp

Download

memory/4796-2203-0x00007FF7CD4D0000-0x00007FF7CD824000-memory.dmp

Download

memory/4804-2124-0x00007FF747EE0000-0x00007FF748234000-memory.dmp

Download

memory/4804-56-0x00007FF747EE0000-0x00007FF748234000-memory.dmp

Download

memory/4848-2202-0x00007FF6304B0000-0x00007FF630804000-memory.dmp

Download

memory/4848-324-0x00007FF6304B0000-0x00007FF630804000-memory.dmp

Download

memory/4956-1981-0x00007FF6A9200000-0x00007FF6A9554000-memory.dmp

Download

memory/4956-32-0x00007FF6A9200000-0x00007FF6A9554000-memory.dmp

Download

memory/5044-2116-0x00007FF613B60000-0x00007FF613EB4000-memory.dmp

Download

memory/5044-48-0x00007FF613B60000-0x00007FF613EB4000-memory.dmp

Download

memory/5048-2201-0x00007FF631EE0000-0x00007FF632234000-memory.dmp

Download

memory/5048-330-0x00007FF631EE0000-0x00007FF632234000-memory.dmp

Download

memory/5080-2161-0x00007FF6846C0000-0x00007FF684A14000-memory.dmp

Download

memory/5080-321-0x00007FF6846C0000-0x00007FF684A14000-memory.dmp

Download

memory/5116-47-0x00007FF7A7920000-0x00007FF7A7C74000-memory.dmp

Download

memory/5116-2091-0x00007FF7A7920000-0x00007FF7A7C74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads