xmrig | 01ce900c573c5b95d6aaa660af2494013d6e94d632332c1524eacc133d5f78eb

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
Size 2.2MB
Sample240528-b3dc3sbb53
SHA256 01ce900c573c5b95d6aaa660af2494013d6e94d632332c1524eacc133d5f78eb
MD5 2c00bc5ea517e036f1527a3104dbf810
SHA1 b74c6d0b5f5c1fd2f7bfe02afd06dc04d6ad669f
SHA512 78996b019d5267a9a3a265675e58f8af400b26f693eb33f5e25d57401526255eac79f3e1a3aaafa39a5ef08b047201d517a308182b7aba69ab93cc6b1d6f79f5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoq:BemTLkNdfE0pZrV56utgG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3152-0-0x00007FF6323A0000-0x00007FF6326F4000-memory.dmp	xmrig
behavioral2/files/0x000900000002324b-5.dat	xmrig
behavioral2/memory/3528-8-0x00007FF725320000-0x00007FF725674000-memory.dmp	xmrig
behavioral2/files/0x0008000000023251-11.dat	xmrig
behavioral2/memory/696-14-0x00007FF648940000-0x00007FF648C94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023252-10.dat	xmrig
behavioral2/memory/5076-20-0x00007FF6965D0000-0x00007FF696924000-memory.dmp	xmrig
behavioral2/files/0x000800000002324f-22.dat	xmrig
behavioral2/memory/4308-26-0x00007FF6A4020000-0x00007FF6A4374000-memory.dmp	xmrig
behavioral2/files/0x0007000000023253-28.dat	xmrig
behavioral2/memory/4248-30-0x00007FF73B910000-0x00007FF73BC64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023254-36.dat	xmrig
behavioral2/memory/4060-38-0x00007FF7B8DB0000-0x00007FF7B9104000-memory.dmp	xmrig
behavioral2/files/0x0007000000023256-41.dat	xmrig
behavioral2/files/0x0007000000023257-47.dat	xmrig
behavioral2/memory/3224-44-0x00007FF62AA90000-0x00007FF62ADE4000-memory.dmp	xmrig
behavioral2/memory/5044-52-0x00007FF70C3B0000-0x00007FF70C704000-memory.dmp	xmrig
behavioral2/files/0x0007000000023258-53.dat	xmrig
behavioral2/files/0x0007000000023259-58.dat	xmrig
behavioral2/memory/3528-62-0x00007FF725320000-0x00007FF725674000-memory.dmp	xmrig
behavioral2/memory/2540-67-0x00007FF6FC4B0000-0x00007FF6FC804000-memory.dmp	xmrig
behavioral2/files/0x000700000002325b-70.dat	xmrig
behavioral2/files/0x000700000002325a-72.dat	xmrig
behavioral2/files/0x000700000002325c-80.dat	xmrig
behavioral2/files/0x000700000002325d-85.dat	xmrig
behavioral2/files/0x000700000002325e-90.dat	xmrig
behavioral2/files/0x0007000000023263-115.dat	xmrig
behavioral2/files/0x0007000000023265-125.dat	xmrig
behavioral2/files/0x0007000000023267-138.dat	xmrig
behavioral2/files/0x000700000002326a-150.dat	xmrig
behavioral2/files/0x000700000002326b-155.dat	xmrig
behavioral2/files/0x000700000002326c-160.dat	xmrig
behavioral2/memory/2084-342-0x00007FF72B750000-0x00007FF72BAA4000-memory.dmp	xmrig
behavioral2/memory/3056-348-0x00007FF71F990000-0x00007FF71FCE4000-memory.dmp	xmrig
behavioral2/memory/4092-351-0x00007FF78A490000-0x00007FF78A7E4000-memory.dmp	xmrig
behavioral2/memory/1768-353-0x00007FF78FE60000-0x00007FF7901B4000-memory.dmp	xmrig
behavioral2/memory/3884-356-0x00007FF785780000-0x00007FF785AD4000-memory.dmp	xmrig
behavioral2/memory/1564-359-0x00007FF798500000-0x00007FF798854000-memory.dmp	xmrig
behavioral2/memory/2784-361-0x00007FF637F90000-0x00007FF6382E4000-memory.dmp	xmrig
behavioral2/memory/2232-363-0x00007FF6AF300000-0x00007FF6AF654000-memory.dmp	xmrig
behavioral2/memory/3048-362-0x00007FF7CACB0000-0x00007FF7CB004000-memory.dmp	xmrig
behavioral2/memory/2008-360-0x00007FF7A4270000-0x00007FF7A45C4000-memory.dmp	xmrig
behavioral2/memory/1860-358-0x00007FF7FB0C0000-0x00007FF7FB414000-memory.dmp	xmrig
behavioral2/memory/3428-357-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp	xmrig
behavioral2/memory/5012-355-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp	xmrig
behavioral2/memory/4892-352-0x00007FF624530000-0x00007FF624884000-memory.dmp	xmrig
behavioral2/memory/3332-345-0x00007FF7BAF50000-0x00007FF7BB2A4000-memory.dmp	xmrig
behavioral2/memory/4284-339-0x00007FF6303A0000-0x00007FF6306F4000-memory.dmp	xmrig
behavioral2/memory/1688-338-0x00007FF7C4B80000-0x00007FF7C4ED4000-memory.dmp	xmrig
behavioral2/memory/5076-333-0x00007FF6965D0000-0x00007FF696924000-memory.dmp	xmrig
behavioral2/files/0x000700000002326f-175.dat	xmrig
behavioral2/files/0x000700000002326e-170.dat	xmrig
behavioral2/files/0x000700000002326d-167.dat	xmrig
behavioral2/files/0x0007000000023269-145.dat	xmrig
behavioral2/files/0x0007000000023268-140.dat	xmrig
behavioral2/files/0x0007000000023266-130.dat	xmrig
behavioral2/files/0x0007000000023264-120.dat	xmrig
behavioral2/files/0x0007000000023262-110.dat	xmrig
behavioral2/files/0x0007000000023261-105.dat	xmrig
behavioral2/files/0x0007000000023260-100.dat	xmrig
behavioral2/files/0x000700000002325f-95.dat	xmrig
behavioral2/memory/1436-74-0x00007FF7958F0000-0x00007FF795C44000-memory.dmp	xmrig
behavioral2/memory/4052-71-0x00007FF67CFE0000-0x00007FF67D334000-memory.dmp	xmrig
behavioral2/memory/4780-60-0x00007FF7C8CD0000-0x00007FF7C9024000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3528	aZUFIwf.exe
696	AMNGFKC.exe
5076	xkBhxiW.exe
4308	XxjZUOT.exe
4248	xhVlyOC.exe
4060	ykXtyZD.exe
3224	vKlCRYm.exe
5044	LcuGqVS.exe
4780	bzHQdlg.exe
2540	sqtsXGH.exe
4052	eXtHMnT.exe
1436	KkiTHIZ.exe
1688	riGxGoc.exe
4284	mAsfrnA.exe
2084	psgxnIO.exe
3332	qFQTWBy.exe
3056	XXEoVyN.exe
4092	yFArIQa.exe
4892	LzyHDjI.exe
1768	LefpnEZ.exe
5012	kJRHUgq.exe
3884	dELakcO.exe
3428	DbCtoij.exe
1860	xLjcqCf.exe
1564	bFXsPzu.exe
2008	PIhgmXt.exe
2784	umhMmsH.exe
3048	AfnKgaT.exe
2232	dAhUchr.exe
4136	CTVVhNZ.exe
4292	SoiDSfI.exe
112	gQQLeuP.exe
3104	EoTXwpp.exe
2324	fIKSWmy.exe
4128	NTzbmGI.exe
3576	pcsdDgA.exe
3228	IqMsbRy.exe
2720	ZqJmbrn.exe
4024	tEeVPsN.exe
4076	QvRLaWK.exe
4972	ESFSpwe.exe
2980	mQSPFgb.exe
2568	kIBPmaV.exe
4900	JIAdogc.exe
1828	bJExhGv.exe
3840	mMoxmlQ.exe
2612	XwubvxX.exe
5020	yDEFgSA.exe
4340	wdVCuJP.exe
3876	OoCduux.exe
3484	cZqJjzL.exe
3384	eBTSbaw.exe
1884	jVISmDZ.exe
2484	aEPPtMf.exe
2080	RapbATH.exe
4324	PILSwuj.exe
3488	Zwdqaak.exe
5152	UihtUcz.exe
5180	nWgngOA.exe
5208	etsQMCM.exe
5236	lOAfBBi.exe
5264	uzTypMu.exe
5292	gHdoiWh.exe
5316	wjpVZjf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x00007FF6323A0000-0x00007FF6326F4000-memory.dmp	upx
behavioral2/files/0x000900000002324b-5.dat	upx
behavioral2/memory/3528-8-0x00007FF725320000-0x00007FF725674000-memory.dmp	upx
behavioral2/files/0x0008000000023251-11.dat	upx
behavioral2/memory/696-14-0x00007FF648940000-0x00007FF648C94000-memory.dmp	upx
behavioral2/files/0x0007000000023252-10.dat	upx
behavioral2/memory/5076-20-0x00007FF6965D0000-0x00007FF696924000-memory.dmp	upx
behavioral2/files/0x000800000002324f-22.dat	upx
behavioral2/memory/4308-26-0x00007FF6A4020000-0x00007FF6A4374000-memory.dmp	upx
behavioral2/files/0x0007000000023253-28.dat	upx
behavioral2/memory/4248-30-0x00007FF73B910000-0x00007FF73BC64000-memory.dmp	upx
behavioral2/files/0x0007000000023254-36.dat	upx
behavioral2/memory/4060-38-0x00007FF7B8DB0000-0x00007FF7B9104000-memory.dmp	upx
behavioral2/files/0x0007000000023256-41.dat	upx
behavioral2/files/0x0007000000023257-47.dat	upx
behavioral2/memory/3224-44-0x00007FF62AA90000-0x00007FF62ADE4000-memory.dmp	upx
behavioral2/memory/5044-52-0x00007FF70C3B0000-0x00007FF70C704000-memory.dmp	upx
behavioral2/files/0x0007000000023258-53.dat	upx
behavioral2/files/0x0007000000023259-58.dat	upx
behavioral2/memory/3528-62-0x00007FF725320000-0x00007FF725674000-memory.dmp	upx
behavioral2/memory/2540-67-0x00007FF6FC4B0000-0x00007FF6FC804000-memory.dmp	upx
behavioral2/files/0x000700000002325b-70.dat	upx
behavioral2/files/0x000700000002325a-72.dat	upx
behavioral2/files/0x000700000002325c-80.dat	upx
behavioral2/files/0x000700000002325d-85.dat	upx
behavioral2/files/0x000700000002325e-90.dat	upx
behavioral2/files/0x0007000000023263-115.dat	upx
behavioral2/files/0x0007000000023265-125.dat	upx
behavioral2/files/0x0007000000023267-138.dat	upx
behavioral2/files/0x000700000002326a-150.dat	upx
behavioral2/files/0x000700000002326b-155.dat	upx
behavioral2/files/0x000700000002326c-160.dat	upx
behavioral2/memory/2084-342-0x00007FF72B750000-0x00007FF72BAA4000-memory.dmp	upx
behavioral2/memory/3056-348-0x00007FF71F990000-0x00007FF71FCE4000-memory.dmp	upx
behavioral2/memory/4092-351-0x00007FF78A490000-0x00007FF78A7E4000-memory.dmp	upx
behavioral2/memory/1768-353-0x00007FF78FE60000-0x00007FF7901B4000-memory.dmp	upx
behavioral2/memory/3884-356-0x00007FF785780000-0x00007FF785AD4000-memory.dmp	upx
behavioral2/memory/1564-359-0x00007FF798500000-0x00007FF798854000-memory.dmp	upx
behavioral2/memory/2784-361-0x00007FF637F90000-0x00007FF6382E4000-memory.dmp	upx
behavioral2/memory/2232-363-0x00007FF6AF300000-0x00007FF6AF654000-memory.dmp	upx
behavioral2/memory/3048-362-0x00007FF7CACB0000-0x00007FF7CB004000-memory.dmp	upx
behavioral2/memory/2008-360-0x00007FF7A4270000-0x00007FF7A45C4000-memory.dmp	upx
behavioral2/memory/1860-358-0x00007FF7FB0C0000-0x00007FF7FB414000-memory.dmp	upx
behavioral2/memory/3428-357-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp	upx
behavioral2/memory/5012-355-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp	upx
behavioral2/memory/4892-352-0x00007FF624530000-0x00007FF624884000-memory.dmp	upx
behavioral2/memory/3332-345-0x00007FF7BAF50000-0x00007FF7BB2A4000-memory.dmp	upx
behavioral2/memory/4284-339-0x00007FF6303A0000-0x00007FF6306F4000-memory.dmp	upx
behavioral2/memory/1688-338-0x00007FF7C4B80000-0x00007FF7C4ED4000-memory.dmp	upx
behavioral2/memory/5076-333-0x00007FF6965D0000-0x00007FF696924000-memory.dmp	upx
behavioral2/files/0x000700000002326f-175.dat	upx
behavioral2/files/0x000700000002326e-170.dat	upx
behavioral2/files/0x000700000002326d-167.dat	upx
behavioral2/files/0x0007000000023269-145.dat	upx
behavioral2/files/0x0007000000023268-140.dat	upx
behavioral2/files/0x0007000000023266-130.dat	upx
behavioral2/files/0x0007000000023264-120.dat	upx
behavioral2/files/0x0007000000023262-110.dat	upx
behavioral2/files/0x0007000000023261-105.dat	upx
behavioral2/files/0x0007000000023260-100.dat	upx
behavioral2/files/0x000700000002325f-95.dat	upx
behavioral2/memory/1436-74-0x00007FF7958F0000-0x00007FF795C44000-memory.dmp	upx
behavioral2/memory/4052-71-0x00007FF67CFE0000-0x00007FF67D334000-memory.dmp	upx
behavioral2/memory/4780-60-0x00007FF7C8CD0000-0x00007FF7C9024000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mFqewTb.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\uvfHzCw.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\mGnwlFe.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\gQQLeuP.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\gMlZdcg.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\GWwiRGO.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\DNOQejz.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\rXeowbH.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\HlFnxvA.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\WmUamyh.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\VjemvAv.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\afwdcsa.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\KFcPkZG.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\YAuyzbz.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\AxAyDct.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\CweQgGM.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\qFQTWBy.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\CTPUDeM.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\EiexBzL.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\BjGfwna.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\gfNDLnC.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\ZKzrcPW.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\lgfBVSg.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\tkusHuE.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\umNJeMX.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\KQhPxah.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\SwrsDKt.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\vYPjFAx.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\WFmlbNa.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\RLkCCrT.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\yJmZeOm.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\KkiTHIZ.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\MKfqota.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\foHNWgY.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\jFmxQTc.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\MFLhRot.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\pyCYVlC.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\cdWqbZH.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\fqSHcGH.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\ZcXvSGR.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\IrpAkNY.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\dAhUchr.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\gDTWSzf.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\bYrBRwI.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\lGTiUpi.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\xvdsOhe.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\ghkmEaZ.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\ecSXRph.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\NpWLpBR.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\ukSTjUl.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\eXtHMnT.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\XQlNqdS.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\QryIcrj.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\gwTcFcj.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\XagDiQn.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\aXAXAji.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\xeqfiuJ.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\tGCwNpv.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\tdrAsGb.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\sGguSgZ.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\YDzLVEH.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\rbIrdZe.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\CtPDdyN.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
File created	C:\Windows\System\yscXMYL.exe	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3528	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	93
PID 3152 wrote to memory of 3528	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	93
PID 3152 wrote to memory of 696	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	94
PID 3152 wrote to memory of 696	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	94
PID 3152 wrote to memory of 5076	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	95
PID 3152 wrote to memory of 5076	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	95
PID 3152 wrote to memory of 4308	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	96
PID 3152 wrote to memory of 4308	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	96
PID 3152 wrote to memory of 4248	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	97
PID 3152 wrote to memory of 4248	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	97
PID 3152 wrote to memory of 4060	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	98
PID 3152 wrote to memory of 4060	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	98
PID 3152 wrote to memory of 3224	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	99
PID 3152 wrote to memory of 3224	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	99
PID 3152 wrote to memory of 5044	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	100
PID 3152 wrote to memory of 5044	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	100
PID 3152 wrote to memory of 4780	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	101
PID 3152 wrote to memory of 4780	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	101
PID 3152 wrote to memory of 2540	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	102
PID 3152 wrote to memory of 2540	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	102
PID 3152 wrote to memory of 4052	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	103
PID 3152 wrote to memory of 4052	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	103
PID 3152 wrote to memory of 1436	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	104
PID 3152 wrote to memory of 1436	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	104
PID 3152 wrote to memory of 1688	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	105
PID 3152 wrote to memory of 1688	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	105
PID 3152 wrote to memory of 4284	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	106
PID 3152 wrote to memory of 4284	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	106
PID 3152 wrote to memory of 2084	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	107
PID 3152 wrote to memory of 2084	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	107
PID 3152 wrote to memory of 3332	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	108
PID 3152 wrote to memory of 3332	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	108
PID 3152 wrote to memory of 3056	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	109
PID 3152 wrote to memory of 3056	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	109
PID 3152 wrote to memory of 4092	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	110
PID 3152 wrote to memory of 4092	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	110
PID 3152 wrote to memory of 4892	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	111
PID 3152 wrote to memory of 4892	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	111
PID 3152 wrote to memory of 1768	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	112
PID 3152 wrote to memory of 1768	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	112
PID 3152 wrote to memory of 5012	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	113
PID 3152 wrote to memory of 5012	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	113
PID 3152 wrote to memory of 3884	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	114
PID 3152 wrote to memory of 3884	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	114
PID 3152 wrote to memory of 3428	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	115
PID 3152 wrote to memory of 3428	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	115
PID 3152 wrote to memory of 1860	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	116
PID 3152 wrote to memory of 1860	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	116
PID 3152 wrote to memory of 1564	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	117
PID 3152 wrote to memory of 1564	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	117
PID 3152 wrote to memory of 2008	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	118
PID 3152 wrote to memory of 2008	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	118
PID 3152 wrote to memory of 2784	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	119
PID 3152 wrote to memory of 2784	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	119
PID 3152 wrote to memory of 3048	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	120
PID 3152 wrote to memory of 3048	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	120
PID 3152 wrote to memory of 2232	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	121
PID 3152 wrote to memory of 2232	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	121
PID 3152 wrote to memory of 4136	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	122
PID 3152 wrote to memory of 4136	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	122
PID 3152 wrote to memory of 4292	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	123
PID 3152 wrote to memory of 4292	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	123
PID 3152 wrote to memory of 112	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	124
PID 3152 wrote to memory of 112	3152	2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2c00bc5ea517e036f1527a3104dbf810_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\System\aZUFIwf.exe
  C:\Windows\System\aZUFIwf.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\AMNGFKC.exe
  C:\Windows\System\AMNGFKC.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\xkBhxiW.exe
  C:\Windows\System\xkBhxiW.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\XxjZUOT.exe
  C:\Windows\System\XxjZUOT.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\xhVlyOC.exe
  C:\Windows\System\xhVlyOC.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\ykXtyZD.exe
  C:\Windows\System\ykXtyZD.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\vKlCRYm.exe
  C:\Windows\System\vKlCRYm.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\LcuGqVS.exe
  C:\Windows\System\LcuGqVS.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\bzHQdlg.exe
  C:\Windows\System\bzHQdlg.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\sqtsXGH.exe
  C:\Windows\System\sqtsXGH.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\eXtHMnT.exe
  C:\Windows\System\eXtHMnT.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\KkiTHIZ.exe
  C:\Windows\System\KkiTHIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\riGxGoc.exe
  C:\Windows\System\riGxGoc.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\mAsfrnA.exe
  C:\Windows\System\mAsfrnA.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\psgxnIO.exe
  C:\Windows\System\psgxnIO.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qFQTWBy.exe
  C:\Windows\System\qFQTWBy.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\XXEoVyN.exe
  C:\Windows\System\XXEoVyN.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\yFArIQa.exe
  C:\Windows\System\yFArIQa.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\LzyHDjI.exe
  C:\Windows\System\LzyHDjI.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\LefpnEZ.exe
  C:\Windows\System\LefpnEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\kJRHUgq.exe
  C:\Windows\System\kJRHUgq.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dELakcO.exe
  C:\Windows\System\dELakcO.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\DbCtoij.exe
  C:\Windows\System\DbCtoij.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\xLjcqCf.exe
  C:\Windows\System\xLjcqCf.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\bFXsPzu.exe
  C:\Windows\System\bFXsPzu.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\PIhgmXt.exe
  C:\Windows\System\PIhgmXt.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\umhMmsH.exe
  C:\Windows\System\umhMmsH.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\AfnKgaT.exe
  C:\Windows\System\AfnKgaT.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\dAhUchr.exe
  C:\Windows\System\dAhUchr.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\CTVVhNZ.exe
  C:\Windows\System\CTVVhNZ.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\SoiDSfI.exe
  C:\Windows\System\SoiDSfI.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\gQQLeuP.exe
  C:\Windows\System\gQQLeuP.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\EoTXwpp.exe
  C:\Windows\System\EoTXwpp.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\fIKSWmy.exe
  C:\Windows\System\fIKSWmy.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\NTzbmGI.exe
  C:\Windows\System\NTzbmGI.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\pcsdDgA.exe
  C:\Windows\System\pcsdDgA.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\IqMsbRy.exe
  C:\Windows\System\IqMsbRy.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\ZqJmbrn.exe
  C:\Windows\System\ZqJmbrn.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\tEeVPsN.exe
  C:\Windows\System\tEeVPsN.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\QvRLaWK.exe
  C:\Windows\System\QvRLaWK.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\ESFSpwe.exe
  C:\Windows\System\ESFSpwe.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\mQSPFgb.exe
  C:\Windows\System\mQSPFgb.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\kIBPmaV.exe
  C:\Windows\System\kIBPmaV.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JIAdogc.exe
  C:\Windows\System\JIAdogc.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\bJExhGv.exe
  C:\Windows\System\bJExhGv.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\mMoxmlQ.exe
  C:\Windows\System\mMoxmlQ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\XwubvxX.exe
  C:\Windows\System\XwubvxX.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\yDEFgSA.exe
  C:\Windows\System\yDEFgSA.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\wdVCuJP.exe
  C:\Windows\System\wdVCuJP.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\OoCduux.exe
  C:\Windows\System\OoCduux.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\cZqJjzL.exe
  C:\Windows\System\cZqJjzL.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\eBTSbaw.exe
  C:\Windows\System\eBTSbaw.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\jVISmDZ.exe
  C:\Windows\System\jVISmDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\aEPPtMf.exe
  C:\Windows\System\aEPPtMf.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\RapbATH.exe
  C:\Windows\System\RapbATH.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\PILSwuj.exe
  C:\Windows\System\PILSwuj.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\Zwdqaak.exe
  C:\Windows\System\Zwdqaak.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\UihtUcz.exe
  C:\Windows\System\UihtUcz.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\nWgngOA.exe
  C:\Windows\System\nWgngOA.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\etsQMCM.exe
  C:\Windows\System\etsQMCM.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\lOAfBBi.exe
  C:\Windows\System\lOAfBBi.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\uzTypMu.exe
  C:\Windows\System\uzTypMu.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\gHdoiWh.exe
  C:\Windows\System\gHdoiWh.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\wjpVZjf.exe
  C:\Windows\System\wjpVZjf.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\NsSufIx.exe
  C:\Windows\System\NsSufIx.exe
  2⤵
  PID:5336
- C:\Windows\System\fvdLzwG.exe
  C:\Windows\System\fvdLzwG.exe
  2⤵
  PID:5376
- C:\Windows\System\oHAfQlT.exe
  C:\Windows\System\oHAfQlT.exe
  2⤵
  PID:5396
- C:\Windows\System\vVuVcII.exe
  C:\Windows\System\vVuVcII.exe
  2⤵
  PID:5432
- C:\Windows\System\MrQvHRq.exe
  C:\Windows\System\MrQvHRq.exe
  2⤵
  PID:5452
- C:\Windows\System\TIjUVvF.exe
  C:\Windows\System\TIjUVvF.exe
  2⤵
  PID:5480
- C:\Windows\System\pfdcnBS.exe
  C:\Windows\System\pfdcnBS.exe
  2⤵
  PID:5504
- C:\Windows\System\ZaYStkk.exe
  C:\Windows\System\ZaYStkk.exe
  2⤵
  PID:5544
- C:\Windows\System\ZMjqfWb.exe
  C:\Windows\System\ZMjqfWb.exe
  2⤵
  PID:5572
- C:\Windows\System\jSrltuE.exe
  C:\Windows\System\jSrltuE.exe
  2⤵
  PID:5600
- C:\Windows\System\DuVOPhY.exe
  C:\Windows\System\DuVOPhY.exe
  2⤵
  PID:5616
- C:\Windows\System\AwfGNhb.exe
  C:\Windows\System\AwfGNhb.exe
  2⤵
  PID:5632
- C:\Windows\System\YfIrGST.exe
  C:\Windows\System\YfIrGST.exe
  2⤵
  PID:5656
- C:\Windows\System\PlFCFCG.exe
  C:\Windows\System\PlFCFCG.exe
  2⤵
  PID:5676
- C:\Windows\System\HMNLmBk.exe
  C:\Windows\System\HMNLmBk.exe
  2⤵
  PID:5700
- C:\Windows\System\GJYmDSf.exe
  C:\Windows\System\GJYmDSf.exe
  2⤵
  PID:5728
- C:\Windows\System\ThjOXAG.exe
  C:\Windows\System\ThjOXAG.exe
  2⤵
  PID:5756
- C:\Windows\System\lbQCLVQ.exe
  C:\Windows\System\lbQCLVQ.exe
  2⤵
  PID:5784
- C:\Windows\System\mDmyNrN.exe
  C:\Windows\System\mDmyNrN.exe
  2⤵
  PID:5812
- C:\Windows\System\OTFlXXv.exe
  C:\Windows\System\OTFlXXv.exe
  2⤵
  PID:5844
- C:\Windows\System\xNqelxK.exe
  C:\Windows\System\xNqelxK.exe
  2⤵
  PID:5880
- C:\Windows\System\abAuKEv.exe
  C:\Windows\System\abAuKEv.exe
  2⤵
  PID:5916
- C:\Windows\System\fvsmOKa.exe
  C:\Windows\System\fvsmOKa.exe
  2⤵
  PID:5956
- C:\Windows\System\LLdOHEv.exe
  C:\Windows\System\LLdOHEv.exe
  2⤵
  PID:5996
- C:\Windows\System\eaJJhJa.exe
  C:\Windows\System\eaJJhJa.exe
  2⤵
  PID:6020
- C:\Windows\System\SsbPKTd.exe
  C:\Windows\System\SsbPKTd.exe
  2⤵
  PID:6048
- C:\Windows\System\zVBjXDz.exe
  C:\Windows\System\zVBjXDz.exe
  2⤵
  PID:4216
- C:\Windows\System\cGagLcp.exe
  C:\Windows\System\cGagLcp.exe
  2⤵
  PID:1304
- C:\Windows\System\lgfBVSg.exe
  C:\Windows\System\lgfBVSg.exe
  2⤵
  PID:4956
- C:\Windows\System\lXEaboA.exe
  C:\Windows\System\lXEaboA.exe
  2⤵
  PID:5164
- C:\Windows\System\FXzCkGh.exe
  C:\Windows\System\FXzCkGh.exe
  2⤵
  PID:5284
- C:\Windows\System\dijgwqk.exe
  C:\Windows\System\dijgwqk.exe
  2⤵
  PID:5332
- C:\Windows\System\mGZVzMv.exe
  C:\Windows\System\mGZVzMv.exe
  2⤵
  PID:5424
- C:\Windows\System\mXPloAD.exe
  C:\Windows\System\mXPloAD.exe
  2⤵
  PID:5444
- C:\Windows\System\MSfzyeP.exe
  C:\Windows\System\MSfzyeP.exe
  2⤵
  PID:5556
- C:\Windows\System\NPreiWl.exe
  C:\Windows\System\NPreiWl.exe
  2⤵
  PID:1448
- C:\Windows\System\hmBTXbR.exe
  C:\Windows\System\hmBTXbR.exe
  2⤵
  PID:5644
- C:\Windows\System\RsouCdp.exe
  C:\Windows\System\RsouCdp.exe
  2⤵
  PID:5692
- C:\Windows\System\ElLLvmz.exe
  C:\Windows\System\ElLLvmz.exe
  2⤵
  PID:5744
- C:\Windows\System\CsDZvGR.exe
  C:\Windows\System\CsDZvGR.exe
  2⤵
  PID:4564
- C:\Windows\System\qIHEYoc.exe
  C:\Windows\System\qIHEYoc.exe
  2⤵
  PID:2948
- C:\Windows\System\vrqwaKv.exe
  C:\Windows\System\vrqwaKv.exe
  2⤵
  PID:4504
- C:\Windows\System\DNbyQjW.exe
  C:\Windows\System\DNbyQjW.exe
  2⤵
  PID:1208
- C:\Windows\System\BwmHMEw.exe
  C:\Windows\System\BwmHMEw.exe
  2⤵
  PID:5968
- C:\Windows\System\raHbTxT.exe
  C:\Windows\System\raHbTxT.exe
  2⤵
  PID:6016
- C:\Windows\System\tBawWWV.exe
  C:\Windows\System\tBawWWV.exe
  2⤵
  PID:3904
- C:\Windows\System\sfpKmRi.exe
  C:\Windows\System\sfpKmRi.exe
  2⤵
  PID:6104
- C:\Windows\System\ItIZcug.exe
  C:\Windows\System\ItIZcug.exe
  2⤵
  PID:4412
- C:\Windows\System\ANLRDHV.exe
  C:\Windows\System\ANLRDHV.exe
  2⤵
  PID:456
- C:\Windows\System\wFmiOEl.exe
  C:\Windows\System\wFmiOEl.exe
  2⤵
  PID:1260
- C:\Windows\System\kFipWbh.exe
  C:\Windows\System\kFipWbh.exe
  2⤵
  PID:4528
- C:\Windows\System\MMoPkVX.exe
  C:\Windows\System\MMoPkVX.exe
  2⤵
  PID:3292
- C:\Windows\System\KTTdbPN.exe
  C:\Windows\System\KTTdbPN.exe
  2⤵
  PID:4044
- C:\Windows\System\iJjQMBw.exe
  C:\Windows\System\iJjQMBw.exe
  2⤵
  PID:5144
- C:\Windows\System\umwbEVB.exe
  C:\Windows\System\umwbEVB.exe
  2⤵
  PID:5384
- C:\Windows\System\FdQnyZE.exe
  C:\Windows\System\FdQnyZE.exe
  2⤵
  PID:1212
- C:\Windows\System\WNgPFBq.exe
  C:\Windows\System\WNgPFBq.exe
  2⤵
  PID:3392
- C:\Windows\System\pYeBAPi.exe
  C:\Windows\System\pYeBAPi.exe
  2⤵
  PID:6028
- C:\Windows\System\qnWlYzw.exe
  C:\Windows\System\qnWlYzw.exe
  2⤵
  PID:4848
- C:\Windows\System\CRctlFx.exe
  C:\Windows\System\CRctlFx.exe
  2⤵
  PID:5772
- C:\Windows\System\lJiKIbE.exe
  C:\Windows\System\lJiKIbE.exe
  2⤵
  PID:6124
- C:\Windows\System\CkTfulb.exe
  C:\Windows\System\CkTfulb.exe
  2⤵
  PID:5828
- C:\Windows\System\istlZpk.exe
  C:\Windows\System\istlZpk.exe
  2⤵
  PID:436
- C:\Windows\System\LavKiqQ.exe
  C:\Windows\System\LavKiqQ.exe
  2⤵
  PID:5928
- C:\Windows\System\fBTpBPc.exe
  C:\Windows\System\fBTpBPc.exe
  2⤵
  PID:3180
- C:\Windows\System\DVCYKOt.exe
  C:\Windows\System\DVCYKOt.exe
  2⤵
  PID:3092
- C:\Windows\System\mugZlpz.exe
  C:\Windows\System\mugZlpz.exe
  2⤵
  PID:4320
- C:\Windows\System\qHQcbOq.exe
  C:\Windows\System\qHQcbOq.exe
  2⤵
  PID:5172
- C:\Windows\System\HlLmmyB.exe
  C:\Windows\System\HlLmmyB.exe
  2⤵
  PID:4904
- C:\Windows\System\GWathko.exe
  C:\Windows\System\GWathko.exe
  2⤵
  PID:4360
- C:\Windows\System\pMAxhxC.exe
  C:\Windows\System\pMAxhxC.exe
  2⤵
  PID:6120
- C:\Windows\System\MDzrPJx.exe
  C:\Windows\System\MDzrPJx.exe
  2⤵
  PID:5892
- C:\Windows\System\Zvfnhgc.exe
  C:\Windows\System\Zvfnhgc.exe
  2⤵
  PID:5988
- C:\Windows\System\KulWRfr.exe
  C:\Windows\System\KulWRfr.exe
  2⤵
  PID:4584
- C:\Windows\System\kFGWgWY.exe
  C:\Windows\System\kFGWgWY.exe
  2⤵
  PID:5672
- C:\Windows\System\shXAADG.exe
  C:\Windows\System\shXAADG.exe
  2⤵
  PID:5900
- C:\Windows\System\hnQnACd.exe
  C:\Windows\System\hnQnACd.exe
  2⤵
  PID:672
- C:\Windows\System\DcxUbpu.exe
  C:\Windows\System\DcxUbpu.exe
  2⤵
  PID:6152
- C:\Windows\System\vlcjGBw.exe
  C:\Windows\System\vlcjGBw.exe
  2⤵
  PID:6180
- C:\Windows\System\BoyGfZy.exe
  C:\Windows\System\BoyGfZy.exe
  2⤵
  PID:6204
- C:\Windows\System\aZVrYaJ.exe
  C:\Windows\System\aZVrYaJ.exe
  2⤵
  PID:6244
- C:\Windows\System\gosdcLM.exe
  C:\Windows\System\gosdcLM.exe
  2⤵
  PID:6272
- C:\Windows\System\ibLYBkd.exe
  C:\Windows\System\ibLYBkd.exe
  2⤵
  PID:6292
- C:\Windows\System\TpGbIee.exe
  C:\Windows\System\TpGbIee.exe
  2⤵
  PID:6332
- C:\Windows\System\asMPxgO.exe
  C:\Windows\System\asMPxgO.exe
  2⤵
  PID:6360
- C:\Windows\System\xXLpBpq.exe
  C:\Windows\System\xXLpBpq.exe
  2⤵
  PID:6380
- C:\Windows\System\pwtVwqj.exe
  C:\Windows\System\pwtVwqj.exe
  2⤵
  PID:6408
- C:\Windows\System\JYzlSYy.exe
  C:\Windows\System\JYzlSYy.exe
  2⤵
  PID:6432
- C:\Windows\System\cBCULyf.exe
  C:\Windows\System\cBCULyf.exe
  2⤵
  PID:6476
- C:\Windows\System\hBuQNQD.exe
  C:\Windows\System\hBuQNQD.exe
  2⤵
  PID:6504
- C:\Windows\System\AzKeGTz.exe
  C:\Windows\System\AzKeGTz.exe
  2⤵
  PID:6532
- C:\Windows\System\tOXAyGk.exe
  C:\Windows\System\tOXAyGk.exe
  2⤵
  PID:6552
- C:\Windows\System\pjCCNpD.exe
  C:\Windows\System\pjCCNpD.exe
  2⤵
  PID:6584
- C:\Windows\System\WRJDJzY.exe
  C:\Windows\System\WRJDJzY.exe
  2⤵
  PID:6604
- C:\Windows\System\CTPUDeM.exe
  C:\Windows\System\CTPUDeM.exe
  2⤵
  PID:6620
- C:\Windows\System\LnoxgvE.exe
  C:\Windows\System\LnoxgvE.exe
  2⤵
  PID:6648
- C:\Windows\System\vSZOtLf.exe
  C:\Windows\System\vSZOtLf.exe
  2⤵
  PID:6680
- C:\Windows\System\eIsYFzk.exe
  C:\Windows\System\eIsYFzk.exe
  2⤵
  PID:6708
- C:\Windows\System\OEzswnN.exe
  C:\Windows\System\OEzswnN.exe
  2⤵
  PID:6740
- C:\Windows\System\LgJGCII.exe
  C:\Windows\System\LgJGCII.exe
  2⤵
  PID:6760
- C:\Windows\System\CtjuVKo.exe
  C:\Windows\System\CtjuVKo.exe
  2⤵
  PID:6792
- C:\Windows\System\CtzZjSt.exe
  C:\Windows\System\CtzZjSt.exe
  2⤵
  PID:6816
- C:\Windows\System\FIgjYsC.exe
  C:\Windows\System\FIgjYsC.exe
  2⤵
  PID:6876
- C:\Windows\System\JiGwpYE.exe
  C:\Windows\System\JiGwpYE.exe
  2⤵
  PID:6904
- C:\Windows\System\jcvIAnX.exe
  C:\Windows\System\jcvIAnX.exe
  2⤵
  PID:6932
- C:\Windows\System\gNMuZLi.exe
  C:\Windows\System\gNMuZLi.exe
  2⤵
  PID:6960
- C:\Windows\System\KtyefOy.exe
  C:\Windows\System\KtyefOy.exe
  2⤵
  PID:6976
- C:\Windows\System\uCvcRjy.exe
  C:\Windows\System\uCvcRjy.exe
  2⤵
  PID:7012
- C:\Windows\System\guLUitP.exe
  C:\Windows\System\guLUitP.exe
  2⤵
  PID:7044
- C:\Windows\System\KRYlnHv.exe
  C:\Windows\System\KRYlnHv.exe
  2⤵
  PID:7068
- C:\Windows\System\rbIrdZe.exe
  C:\Windows\System\rbIrdZe.exe
  2⤵
  PID:7088
- C:\Windows\System\tikhHrj.exe
  C:\Windows\System\tikhHrj.exe
  2⤵
  PID:7132
- C:\Windows\System\BUNsBlc.exe
  C:\Windows\System\BUNsBlc.exe
  2⤵
  PID:7164
- C:\Windows\System\HWzogLH.exe
  C:\Windows\System\HWzogLH.exe
  2⤵
  PID:6164
- C:\Windows\System\AMkKPyn.exe
  C:\Windows\System\AMkKPyn.exe
  2⤵
  PID:6196
- C:\Windows\System\MRZeVry.exe
  C:\Windows\System\MRZeVry.exe
  2⤵
  PID:6288
- C:\Windows\System\xIsKtxU.exe
  C:\Windows\System\xIsKtxU.exe
  2⤵
  PID:6340
- C:\Windows\System\JYScTxP.exe
  C:\Windows\System\JYScTxP.exe
  2⤵
  PID:6372
- C:\Windows\System\YsvxAzw.exe
  C:\Windows\System\YsvxAzw.exe
  2⤵
  PID:6400
- C:\Windows\System\flXUuCp.exe
  C:\Windows\System\flXUuCp.exe
  2⤵
  PID:6524
- C:\Windows\System\MFLhRot.exe
  C:\Windows\System\MFLhRot.exe
  2⤵
  PID:6568
- C:\Windows\System\SKLmSHQ.exe
  C:\Windows\System\SKLmSHQ.exe
  2⤵
  PID:6616
- C:\Windows\System\aPKVSqj.exe
  C:\Windows\System\aPKVSqj.exe
  2⤵
  PID:6700
- C:\Windows\System\lartlBH.exe
  C:\Windows\System\lartlBH.exe
  2⤵
  PID:6724
- C:\Windows\System\xkyWpfF.exe
  C:\Windows\System\xkyWpfF.exe
  2⤵
  PID:6808
- C:\Windows\System\YXSPOuJ.exe
  C:\Windows\System\YXSPOuJ.exe
  2⤵
  PID:6892
- C:\Windows\System\RTRAvsr.exe
  C:\Windows\System\RTRAvsr.exe
  2⤵
  PID:6956
- C:\Windows\System\nluXJeo.exe
  C:\Windows\System\nluXJeo.exe
  2⤵
  PID:6996
- C:\Windows\System\vgjLsKp.exe
  C:\Windows\System\vgjLsKp.exe
  2⤵
  PID:7060
- C:\Windows\System\vaNeELH.exe
  C:\Windows\System\vaNeELH.exe
  2⤵
  PID:7120
- C:\Windows\System\NgZAgvX.exe
  C:\Windows\System\NgZAgvX.exe
  2⤵
  PID:6192
- C:\Windows\System\rSqlnfh.exe
  C:\Windows\System\rSqlnfh.exe
  2⤵
  PID:6260
- C:\Windows\System\mOAaIsW.exe
  C:\Windows\System\mOAaIsW.exe
  2⤵
  PID:6368
- C:\Windows\System\uBwJCZE.exe
  C:\Windows\System\uBwJCZE.exe
  2⤵
  PID:6636
- C:\Windows\System\oYPsfVn.exe
  C:\Windows\System\oYPsfVn.exe
  2⤵
  PID:6696
- C:\Windows\System\nwzMzLq.exe
  C:\Windows\System\nwzMzLq.exe
  2⤵
  PID:6900
- C:\Windows\System\vQVLqRy.exe
  C:\Windows\System\vQVLqRy.exe
  2⤵
  PID:6968
- C:\Windows\System\VihIfWq.exe
  C:\Windows\System\VihIfWq.exe
  2⤵
  PID:7152
- C:\Windows\System\qTMvvXI.exe
  C:\Windows\System\qTMvvXI.exe
  2⤵
  PID:6572
- C:\Windows\System\iomcDwO.exe
  C:\Windows\System\iomcDwO.exe
  2⤵
  PID:6308
- C:\Windows\System\KPNLUjK.exe
  C:\Windows\System\KPNLUjK.exe
  2⤵
  PID:7040
- C:\Windows\System\FMoAxPb.exe
  C:\Windows\System\FMoAxPb.exe
  2⤵
  PID:6916
- C:\Windows\System\dhaShVZ.exe
  C:\Windows\System\dhaShVZ.exe
  2⤵
  PID:7184
- C:\Windows\System\pLRTgdN.exe
  C:\Windows\System\pLRTgdN.exe
  2⤵
  PID:7212
- C:\Windows\System\GSCTaQE.exe
  C:\Windows\System\GSCTaQE.exe
  2⤵
  PID:7244
- C:\Windows\System\TgqhznY.exe
  C:\Windows\System\TgqhznY.exe
  2⤵
  PID:7280
- C:\Windows\System\NyCIgPw.exe
  C:\Windows\System\NyCIgPw.exe
  2⤵
  PID:7304
- C:\Windows\System\ChawxVL.exe
  C:\Windows\System\ChawxVL.exe
  2⤵
  PID:7404
- C:\Windows\System\fXXHjts.exe
  C:\Windows\System\fXXHjts.exe
  2⤵
  PID:7420
- C:\Windows\System\ecSXRph.exe
  C:\Windows\System\ecSXRph.exe
  2⤵
  PID:7448
- C:\Windows\System\ZLxjnqE.exe
  C:\Windows\System\ZLxjnqE.exe
  2⤵
  PID:7464
- C:\Windows\System\qAmkzyg.exe
  C:\Windows\System\qAmkzyg.exe
  2⤵
  PID:7488
- C:\Windows\System\jZSaRbh.exe
  C:\Windows\System\jZSaRbh.exe
  2⤵
  PID:7504
- C:\Windows\System\wYKFaQd.exe
  C:\Windows\System\wYKFaQd.exe
  2⤵
  PID:7532
- C:\Windows\System\KiFygdp.exe
  C:\Windows\System\KiFygdp.exe
  2⤵
  PID:7556
- C:\Windows\System\dcYTUjs.exe
  C:\Windows\System\dcYTUjs.exe
  2⤵
  PID:7572
- C:\Windows\System\JCmgfVm.exe
  C:\Windows\System\JCmgfVm.exe
  2⤵
  PID:7592
- C:\Windows\System\NdumAJo.exe
  C:\Windows\System\NdumAJo.exe
  2⤵
  PID:7616
- C:\Windows\System\JAWZFkI.exe
  C:\Windows\System\JAWZFkI.exe
  2⤵
  PID:7636
- C:\Windows\System\ooZiimT.exe
  C:\Windows\System\ooZiimT.exe
  2⤵
  PID:7652
- C:\Windows\System\uolxgqE.exe
  C:\Windows\System\uolxgqE.exe
  2⤵
  PID:7676
- C:\Windows\System\CuUhzBb.exe
  C:\Windows\System\CuUhzBb.exe
  2⤵
  PID:7704
- C:\Windows\System\JXliUlu.exe
  C:\Windows\System\JXliUlu.exe
  2⤵
  PID:7728
- C:\Windows\System\mWGgTdQ.exe
  C:\Windows\System\mWGgTdQ.exe
  2⤵
  PID:7748
- C:\Windows\System\bYjayEd.exe
  C:\Windows\System\bYjayEd.exe
  2⤵
  PID:7780
- C:\Windows\System\KPYSTrN.exe
  C:\Windows\System\KPYSTrN.exe
  2⤵
  PID:7808
- C:\Windows\System\dsIqMWe.exe
  C:\Windows\System\dsIqMWe.exe
  2⤵
  PID:7832
- C:\Windows\System\UHPvCDG.exe
  C:\Windows\System\UHPvCDG.exe
  2⤵
  PID:7856
- C:\Windows\System\SyzzEpc.exe
  C:\Windows\System\SyzzEpc.exe
  2⤵
  PID:7884
- C:\Windows\System\JTiMCMw.exe
  C:\Windows\System\JTiMCMw.exe
  2⤵
  PID:7980
- C:\Windows\System\CtPDdyN.exe
  C:\Windows\System\CtPDdyN.exe
  2⤵
  PID:8008
- C:\Windows\System\puUXGiA.exe
  C:\Windows\System\puUXGiA.exe
  2⤵
  PID:8032
- C:\Windows\System\tiMzLjB.exe
  C:\Windows\System\tiMzLjB.exe
  2⤵
  PID:8060
- C:\Windows\System\MCQFLvO.exe
  C:\Windows\System\MCQFLvO.exe
  2⤵
  PID:8088
- C:\Windows\System\tGCwNpv.exe
  C:\Windows\System\tGCwNpv.exe
  2⤵
  PID:8112
- C:\Windows\System\PjeCASl.exe
  C:\Windows\System\PjeCASl.exe
  2⤵
  PID:8140
- C:\Windows\System\tsJNbqd.exe
  C:\Windows\System\tsJNbqd.exe
  2⤵
  PID:8168
- C:\Windows\System\OquydjN.exe
  C:\Windows\System\OquydjN.exe
  2⤵
  PID:8188
- C:\Windows\System\XAXsrqw.exe
  C:\Windows\System\XAXsrqw.exe
  2⤵
  PID:7200
- C:\Windows\System\GEdIKaT.exe
  C:\Windows\System\GEdIKaT.exe
  2⤵
  PID:7148
- C:\Windows\System\EReLucG.exe
  C:\Windows\System\EReLucG.exe
  2⤵
  PID:7296
- C:\Windows\System\VkkTmRT.exe
  C:\Windows\System\VkkTmRT.exe
  2⤵
  PID:7444
- C:\Windows\System\NoBrQII.exe
  C:\Windows\System\NoBrQII.exe
  2⤵
  PID:7500
- C:\Windows\System\QtvqhVF.exe
  C:\Windows\System\QtvqhVF.exe
  2⤵
  PID:7456
- C:\Windows\System\dtBvBDG.exe
  C:\Windows\System\dtBvBDG.exe
  2⤵
  PID:7552
- C:\Windows\System\sMuDFOJ.exe
  C:\Windows\System\sMuDFOJ.exe
  2⤵
  PID:7568
- C:\Windows\System\tnDlLrN.exe
  C:\Windows\System\tnDlLrN.exe
  2⤵
  PID:7768
- C:\Windows\System\ehuXiES.exe
  C:\Windows\System\ehuXiES.exe
  2⤵
  PID:7880
- C:\Windows\System\hHmqcMe.exe
  C:\Windows\System\hHmqcMe.exe
  2⤵
  PID:7904
- C:\Windows\System\lfhpSqR.exe
  C:\Windows\System\lfhpSqR.exe
  2⤵
  PID:7160
- C:\Windows\System\LDIiWbo.exe
  C:\Windows\System\LDIiWbo.exe
  2⤵
  PID:7992
- C:\Windows\System\azlNCzP.exe
  C:\Windows\System\azlNCzP.exe
  2⤵
  PID:8044
- C:\Windows\System\lEjIukC.exe
  C:\Windows\System\lEjIukC.exe
  2⤵
  PID:8176
- C:\Windows\System\HEhMcFA.exe
  C:\Windows\System\HEhMcFA.exe
  2⤵
  PID:8180
- C:\Windows\System\QHvkNqd.exe
  C:\Windows\System\QHvkNqd.exe
  2⤵
  PID:7792
- C:\Windows\System\WHipUMp.exe
  C:\Windows\System\WHipUMp.exe
  2⤵
  PID:8016
- C:\Windows\System\VjemvAv.exe
  C:\Windows\System\VjemvAv.exe
  2⤵
  PID:7936
- C:\Windows\System\NydfmmR.exe
  C:\Windows\System\NydfmmR.exe
  2⤵
  PID:8100
- C:\Windows\System\oNESqcB.exe
  C:\Windows\System\oNESqcB.exe
  2⤵
  PID:7180
- C:\Windows\System\BpgiUrF.exe
  C:\Windows\System\BpgiUrF.exe
  2⤵
  PID:7544
- C:\Windows\System\nqalcRp.exe
  C:\Windows\System\nqalcRp.exe
  2⤵
  PID:8136
- C:\Windows\System\wWKSnOw.exe
  C:\Windows\System\wWKSnOw.exe
  2⤵
  PID:8200
- C:\Windows\System\nojcImD.exe
  C:\Windows\System\nojcImD.exe
  2⤵
  PID:8224
- C:\Windows\System\WQtfmtI.exe
  C:\Windows\System\WQtfmtI.exe
  2⤵
  PID:8252
- C:\Windows\System\PaHXLyO.exe
  C:\Windows\System\PaHXLyO.exe
  2⤵
  PID:8276
- C:\Windows\System\tmeLYtU.exe
  C:\Windows\System\tmeLYtU.exe
  2⤵
  PID:8300
- C:\Windows\System\yugsplq.exe
  C:\Windows\System\yugsplq.exe
  2⤵
  PID:8328
- C:\Windows\System\gxlcgnb.exe
  C:\Windows\System\gxlcgnb.exe
  2⤵
  PID:8352
- C:\Windows\System\RlepQpt.exe
  C:\Windows\System\RlepQpt.exe
  2⤵
  PID:8388
- C:\Windows\System\OYBiBoc.exe
  C:\Windows\System\OYBiBoc.exe
  2⤵
  PID:8416
- C:\Windows\System\hhJAdsW.exe
  C:\Windows\System\hhJAdsW.exe
  2⤵
  PID:8440
- C:\Windows\System\EmdfHLQ.exe
  C:\Windows\System\EmdfHLQ.exe
  2⤵
  PID:8472
- C:\Windows\System\YSnhjbK.exe
  C:\Windows\System\YSnhjbK.exe
  2⤵
  PID:8496
- C:\Windows\System\BkszIMW.exe
  C:\Windows\System\BkszIMW.exe
  2⤵
  PID:8528
- C:\Windows\System\fTxMxJX.exe
  C:\Windows\System\fTxMxJX.exe
  2⤵
  PID:8552
- C:\Windows\System\MbTgvay.exe
  C:\Windows\System\MbTgvay.exe
  2⤵
  PID:8576
- C:\Windows\System\pPyjjHY.exe
  C:\Windows\System\pPyjjHY.exe
  2⤵
  PID:8600
- C:\Windows\System\IsXyJFe.exe
  C:\Windows\System\IsXyJFe.exe
  2⤵
  PID:8636
- C:\Windows\System\EvkqEhm.exe
  C:\Windows\System\EvkqEhm.exe
  2⤵
  PID:8660
- C:\Windows\System\bMcIXLy.exe
  C:\Windows\System\bMcIXLy.exe
  2⤵
  PID:8692
- C:\Windows\System\NsDzPYc.exe
  C:\Windows\System\NsDzPYc.exe
  2⤵
  PID:8712
- C:\Windows\System\LKirWLq.exe
  C:\Windows\System\LKirWLq.exe
  2⤵
  PID:8728
- C:\Windows\System\WsJgwPF.exe
  C:\Windows\System\WsJgwPF.exe
  2⤵
  PID:8756
- C:\Windows\System\iYHhKGu.exe
  C:\Windows\System\iYHhKGu.exe
  2⤵
  PID:8784
- C:\Windows\System\LbYbrIe.exe
  C:\Windows\System\LbYbrIe.exe
  2⤵
  PID:8812
- C:\Windows\System\afwdcsa.exe
  C:\Windows\System\afwdcsa.exe
  2⤵
  PID:8828
- C:\Windows\System\cgMweFm.exe
  C:\Windows\System\cgMweFm.exe
  2⤵
  PID:8856
- C:\Windows\System\cKeZDSJ.exe
  C:\Windows\System\cKeZDSJ.exe
  2⤵
  PID:8872
- C:\Windows\System\ULDTRea.exe
  C:\Windows\System\ULDTRea.exe
  2⤵
  PID:8896
- C:\Windows\System\kShWLfP.exe
  C:\Windows\System\kShWLfP.exe
  2⤵
  PID:8928
- C:\Windows\System\GiTbwTL.exe
  C:\Windows\System\GiTbwTL.exe
  2⤵
  PID:8952
- C:\Windows\System\rPVEJAL.exe
  C:\Windows\System\rPVEJAL.exe
  2⤵
  PID:8984
- C:\Windows\System\XBWUQEt.exe
  C:\Windows\System\XBWUQEt.exe
  2⤵
  PID:9004
- C:\Windows\System\aQGaKAG.exe
  C:\Windows\System\aQGaKAG.exe
  2⤵
  PID:9036
- C:\Windows\System\idxhWME.exe
  C:\Windows\System\idxhWME.exe
  2⤵
  PID:9108
- C:\Windows\System\mTMCPJI.exe
  C:\Windows\System\mTMCPJI.exe
  2⤵
  PID:9136
- C:\Windows\System\OtvKfvv.exe
  C:\Windows\System\OtvKfvv.exe
  2⤵
  PID:9160
- C:\Windows\System\NgUforG.exe
  C:\Windows\System\NgUforG.exe
  2⤵
  PID:9188
- C:\Windows\System\YlQKdZy.exe
  C:\Windows\System\YlQKdZy.exe
  2⤵
  PID:9208
- C:\Windows\System\lnccenS.exe
  C:\Windows\System\lnccenS.exe
  2⤵
  PID:7264
- C:\Windows\System\qpxIYHO.exe
  C:\Windows\System\qpxIYHO.exe
  2⤵
  PID:8244
- C:\Windows\System\NWlZLaF.exe
  C:\Windows\System\NWlZLaF.exe
  2⤵
  PID:8320
- C:\Windows\System\nubeljo.exe
  C:\Windows\System\nubeljo.exe
  2⤵
  PID:8508
- C:\Windows\System\fswxbzu.exe
  C:\Windows\System\fswxbzu.exe
  2⤵
  PID:8456
- C:\Windows\System\oWgVCFw.exe
  C:\Windows\System\oWgVCFw.exe
  2⤵
  PID:8572
- C:\Windows\System\UamlaAh.exe
  C:\Windows\System\UamlaAh.exe
  2⤵
  PID:8652
- C:\Windows\System\NpWLpBR.exe
  C:\Windows\System\NpWLpBR.exe
  2⤵
  PID:8748
- C:\Windows\System\isgUZlM.exe
  C:\Windows\System\isgUZlM.exe
  2⤵
  PID:8772
- C:\Windows\System\fgJTFVY.exe
  C:\Windows\System\fgJTFVY.exe
  2⤵
  PID:8820
- C:\Windows\System\ZlONnBe.exe
  C:\Windows\System\ZlONnBe.exe
  2⤵
  PID:8904
- C:\Windows\System\xCldeKK.exe
  C:\Windows\System\xCldeKK.exe
  2⤵
  PID:8972
- C:\Windows\System\dqDUbqS.exe
  C:\Windows\System\dqDUbqS.exe
  2⤵
  PID:8992
- C:\Windows\System\JhEnJvl.exe
  C:\Windows\System\JhEnJvl.exe
  2⤵
  PID:9076
- C:\Windows\System\HFyOzdt.exe
  C:\Windows\System\HFyOzdt.exe
  2⤵
  PID:9152
- C:\Windows\System\USKXsVR.exe
  C:\Windows\System\USKXsVR.exe
  2⤵
  PID:8236
- C:\Windows\System\qKekWKl.exe
  C:\Windows\System\qKekWKl.exe
  2⤵
  PID:9200
- C:\Windows\System\NzdvdeV.exe
  C:\Windows\System\NzdvdeV.exe
  2⤵
  PID:8348
- C:\Windows\System\TcRQidN.exe
  C:\Windows\System\TcRQidN.exe
  2⤵
  PID:8452
- C:\Windows\System\nwHNsLH.exe
  C:\Windows\System\nwHNsLH.exe
  2⤵
  PID:8596
- C:\Windows\System\qCevgxH.exe
  C:\Windows\System\qCevgxH.exe
  2⤵
  PID:8808
- C:\Windows\System\NriTxKn.exe
  C:\Windows\System\NriTxKn.exe
  2⤵
  PID:8844
- C:\Windows\System\ywJkmvQ.exe
  C:\Windows\System\ywJkmvQ.exe
  2⤵
  PID:9180
- C:\Windows\System\nvFvYbd.exe
  C:\Windows\System\nvFvYbd.exe
  2⤵
  PID:9224
- C:\Windows\System\wGGdYZE.exe
  C:\Windows\System\wGGdYZE.exe
  2⤵
  PID:9244
- C:\Windows\System\NKfOrhJ.exe
  C:\Windows\System\NKfOrhJ.exe
  2⤵
  PID:9276
- C:\Windows\System\cNUJuYJ.exe
  C:\Windows\System\cNUJuYJ.exe
  2⤵
  PID:9296
- C:\Windows\System\haHSbLB.exe
  C:\Windows\System\haHSbLB.exe
  2⤵
  PID:9320
- C:\Windows\System\pyCYVlC.exe
  C:\Windows\System\pyCYVlC.exe
  2⤵
  PID:9344
- C:\Windows\System\QhCpoad.exe
  C:\Windows\System\QhCpoad.exe
  2⤵
  PID:9364
- C:\Windows\System\DRbFzTj.exe
  C:\Windows\System\DRbFzTj.exe
  2⤵
  PID:9396
- C:\Windows\System\ZghMFsN.exe
  C:\Windows\System\ZghMFsN.exe
  2⤵
  PID:9420
- C:\Windows\System\gDTWSzf.exe
  C:\Windows\System\gDTWSzf.exe
  2⤵
  PID:9448
- C:\Windows\System\NVZStmL.exe
  C:\Windows\System\NVZStmL.exe
  2⤵
  PID:9468
- C:\Windows\System\pgFTUzK.exe
  C:\Windows\System\pgFTUzK.exe
  2⤵
  PID:9500
- C:\Windows\System\tkusHuE.exe
  C:\Windows\System\tkusHuE.exe
  2⤵
  PID:9528
- C:\Windows\System\HhIJIMX.exe
  C:\Windows\System\HhIJIMX.exe
  2⤵
  PID:9564
- C:\Windows\System\KYtftnj.exe
  C:\Windows\System\KYtftnj.exe
  2⤵
  PID:9588
- C:\Windows\System\XlphPAY.exe
  C:\Windows\System\XlphPAY.exe
  2⤵
  PID:9616
- C:\Windows\System\DBfLIwf.exe
  C:\Windows\System\DBfLIwf.exe
  2⤵
  PID:9648
- C:\Windows\System\GnIdgfq.exe
  C:\Windows\System\GnIdgfq.exe
  2⤵
  PID:9676
- C:\Windows\System\cKkjFvV.exe
  C:\Windows\System\cKkjFvV.exe
  2⤵
  PID:9712
- C:\Windows\System\zruMqbR.exe
  C:\Windows\System\zruMqbR.exe
  2⤵
  PID:9736
- C:\Windows\System\hxFrxCX.exe
  C:\Windows\System\hxFrxCX.exe
  2⤵
  PID:9756
- C:\Windows\System\zeLJaQR.exe
  C:\Windows\System\zeLJaQR.exe
  2⤵
  PID:9780
- C:\Windows\System\FeiLlfl.exe
  C:\Windows\System\FeiLlfl.exe
  2⤵
  PID:9808
- C:\Windows\System\GJVwZcW.exe
  C:\Windows\System\GJVwZcW.exe
  2⤵
  PID:9832
- C:\Windows\System\dJOKzxT.exe
  C:\Windows\System\dJOKzxT.exe
  2⤵
  PID:9860
- C:\Windows\System\gwTcFcj.exe
  C:\Windows\System\gwTcFcj.exe
  2⤵
  PID:9880
- C:\Windows\System\DcCbmyS.exe
  C:\Windows\System\DcCbmyS.exe
  2⤵
  PID:9912
- C:\Windows\System\TkdHzYo.exe
  C:\Windows\System\TkdHzYo.exe
  2⤵
  PID:9936
- C:\Windows\System\DiALSrV.exe
  C:\Windows\System\DiALSrV.exe
  2⤵
  PID:9956
- C:\Windows\System\UXRxjSf.exe
  C:\Windows\System\UXRxjSf.exe
  2⤵
  PID:9976
- C:\Windows\System\ixBIdSt.exe
  C:\Windows\System\ixBIdSt.exe
  2⤵
  PID:10000
- C:\Windows\System\QUpkzAK.exe
  C:\Windows\System\QUpkzAK.exe
  2⤵
  PID:10020
- C:\Windows\System\iddTZEJ.exe
  C:\Windows\System\iddTZEJ.exe
  2⤵
  PID:10044
- C:\Windows\System\SgEtmGo.exe
  C:\Windows\System\SgEtmGo.exe
  2⤵
  PID:10076
- C:\Windows\System\bywdEOc.exe
  C:\Windows\System\bywdEOc.exe
  2⤵
  PID:10100
- C:\Windows\System\cdWqbZH.exe
  C:\Windows\System\cdWqbZH.exe
  2⤵
  PID:10128
- C:\Windows\System\VgXDcYV.exe
  C:\Windows\System\VgXDcYV.exe
  2⤵
  PID:10144
- C:\Windows\System\OijeovR.exe
  C:\Windows\System\OijeovR.exe
  2⤵
  PID:10168
- C:\Windows\System\bYrBRwI.exe
  C:\Windows\System\bYrBRwI.exe
  2⤵
  PID:10204
- C:\Windows\System\tdrAsGb.exe
  C:\Windows\System\tdrAsGb.exe
  2⤵
  PID:10228
- C:\Windows\System\Ovokpgp.exe
  C:\Windows\System\Ovokpgp.exe
  2⤵
  PID:8752
- C:\Windows\System\rDIScOi.exe
  C:\Windows\System\rDIScOi.exe
  2⤵
  PID:8916
- C:\Windows\System\mwnuScN.exe
  C:\Windows\System\mwnuScN.exe
  2⤵
  PID:9172
- C:\Windows\System\NmCVkBZ.exe
  C:\Windows\System\NmCVkBZ.exe
  2⤵
  PID:9292
- C:\Windows\System\jloVMaX.exe
  C:\Windows\System\jloVMaX.exe
  2⤵
  PID:9308
- C:\Windows\System\tuKohht.exe
  C:\Windows\System\tuKohht.exe
  2⤵
  PID:9416
- C:\Windows\System\reBTDgA.exe
  C:\Windows\System\reBTDgA.exe
  2⤵
  PID:9380
- C:\Windows\System\EiexBzL.exe
  C:\Windows\System\EiexBzL.exe
  2⤵
  PID:9632
- C:\Windows\System\iUtxtak.exe
  C:\Windows\System\iUtxtak.exe
  2⤵
  PID:9580
- C:\Windows\System\BjGfwna.exe
  C:\Windows\System\BjGfwna.exe
  2⤵
  PID:9520
- C:\Windows\System\cAFGFDH.exe
  C:\Windows\System\cAFGFDH.exe
  2⤵
  PID:9768
- C:\Windows\System\HWHkvXt.exe
  C:\Windows\System\HWHkvXt.exe
  2⤵
  PID:9844
- C:\Windows\System\lmUvyGO.exe
  C:\Windows\System\lmUvyGO.exe
  2⤵
  PID:9788
- C:\Windows\System\yscXMYL.exe
  C:\Windows\System\yscXMYL.exe
  2⤵
  PID:9928
- C:\Windows\System\RHjVAEU.exe
  C:\Windows\System\RHjVAEU.exe
  2⤵
  PID:3124
- C:\Windows\System\gJPRIwv.exe
  C:\Windows\System\gJPRIwv.exe
  2⤵
  PID:9992
- C:\Windows\System\qdXuPHk.exe
  C:\Windows\System\qdXuPHk.exe
  2⤵
  PID:10092
- C:\Windows\System\aXAXAji.exe
  C:\Windows\System\aXAXAji.exe
  2⤵
  PID:10016
- C:\Windows\System\wKfVcPF.exe
  C:\Windows\System\wKfVcPF.exe
  2⤵
  PID:10184
- C:\Windows\System\UhLzGqs.exe
  C:\Windows\System\UhLzGqs.exe
  2⤵
  PID:9952
- C:\Windows\System\SKDuVdg.exe
  C:\Windows\System\SKDuVdg.exe
  2⤵
  PID:10160
- C:\Windows\System\SmdAYtR.exe
  C:\Windows\System\SmdAYtR.exe
  2⤵
  PID:9548
- C:\Windows\System\IzitRJb.exe
  C:\Windows\System\IzitRJb.exe
  2⤵
  PID:9560
- C:\Windows\System\BYAgHPD.exe
  C:\Windows\System\BYAgHPD.exe
  2⤵
  PID:9060
- C:\Windows\System\cApWLKq.exe
  C:\Windows\System\cApWLKq.exe
  2⤵
  PID:9484
- C:\Windows\System\QSSwKge.exe
  C:\Windows\System\QSSwKge.exe
  2⤵
  PID:9672
- C:\Windows\System\FEfRVZG.exe
  C:\Windows\System\FEfRVZG.exe
  2⤵
  PID:5028
- C:\Windows\System\XoQpqYO.exe
  C:\Windows\System\XoQpqYO.exe
  2⤵
  PID:10040
- C:\Windows\System\HHRIEWJ.exe
  C:\Windows\System\HHRIEWJ.exe
  2⤵
  PID:10248
- C:\Windows\System\eiSoUth.exe
  C:\Windows\System\eiSoUth.exe
  2⤵
  PID:10280
- C:\Windows\System\xoGLjMf.exe
  C:\Windows\System\xoGLjMf.exe
  2⤵
  PID:10308
- C:\Windows\System\vacZJob.exe
  C:\Windows\System\vacZJob.exe
  2⤵
  PID:10332
- C:\Windows\System\dJFPZDt.exe
  C:\Windows\System\dJFPZDt.exe
  2⤵
  PID:10360
- C:\Windows\System\cxVkiQz.exe
  C:\Windows\System\cxVkiQz.exe
  2⤵
  PID:10448
- C:\Windows\System\szoJbWS.exe
  C:\Windows\System\szoJbWS.exe
  2⤵
  PID:10476
- C:\Windows\System\sQitSAD.exe
  C:\Windows\System\sQitSAD.exe
  2⤵
  PID:10500
- C:\Windows\System\pSvtcas.exe
  C:\Windows\System\pSvtcas.exe
  2⤵
  PID:10528
- C:\Windows\System\VGqWBdb.exe
  C:\Windows\System\VGqWBdb.exe
  2⤵
  PID:10568
- C:\Windows\System\bCnyelD.exe
  C:\Windows\System\bCnyelD.exe
  2⤵
  PID:10612
- C:\Windows\System\DzNPvmK.exe
  C:\Windows\System\DzNPvmK.exe
  2⤵
  PID:10640
- C:\Windows\System\NZlJSLs.exe
  C:\Windows\System\NZlJSLs.exe
  2⤵
  PID:10660
- C:\Windows\System\lGTiUpi.exe
  C:\Windows\System\lGTiUpi.exe
  2⤵
  PID:10684
- C:\Windows\System\eTFNHnO.exe
  C:\Windows\System\eTFNHnO.exe
  2⤵
  PID:10720
- C:\Windows\System\HlFnxvA.exe
  C:\Windows\System\HlFnxvA.exe
  2⤵
  PID:10744
- C:\Windows\System\DqSsBJP.exe
  C:\Windows\System\DqSsBJP.exe
  2⤵
  PID:10776
- C:\Windows\System\dZRfKUg.exe
  C:\Windows\System\dZRfKUg.exe
  2⤵
  PID:10800
- C:\Windows\System\pQVPGdl.exe
  C:\Windows\System\pQVPGdl.exe
  2⤵
  PID:10836
- C:\Windows\System\EdcHkdu.exe
  C:\Windows\System\EdcHkdu.exe
  2⤵
  PID:10856
- C:\Windows\System\WPHuGPP.exe
  C:\Windows\System\WPHuGPP.exe
  2⤵
  PID:10872
- C:\Windows\System\eUHzCfg.exe
  C:\Windows\System\eUHzCfg.exe
  2⤵
  PID:10888
- C:\Windows\System\YmXrhPW.exe
  C:\Windows\System\YmXrhPW.exe
  2⤵
  PID:10912
- C:\Windows\System\vkYdIiJ.exe
  C:\Windows\System\vkYdIiJ.exe
  2⤵
  PID:10932
- C:\Windows\System\OPduduD.exe
  C:\Windows\System\OPduduD.exe
  2⤵
  PID:10968
- C:\Windows\System\GeAAkuO.exe
  C:\Windows\System\GeAAkuO.exe
  2⤵
  PID:10988
- C:\Windows\System\HHoqgYQ.exe
  C:\Windows\System\HHoqgYQ.exe
  2⤵
  PID:11020
- C:\Windows\System\eGDpMPv.exe
  C:\Windows\System\eGDpMPv.exe
  2⤵
  PID:11048
- C:\Windows\System\QeDyKAc.exe
  C:\Windows\System\QeDyKAc.exe
  2⤵
  PID:11064
- C:\Windows\System\pzciFqT.exe
  C:\Windows\System\pzciFqT.exe
  2⤵
  PID:11084
- C:\Windows\System\kkWDcfY.exe
  C:\Windows\System\kkWDcfY.exe
  2⤵
  PID:11108
- C:\Windows\System\iFUKzLO.exe
  C:\Windows\System\iFUKzLO.exe
  2⤵
  PID:11132
- C:\Windows\System\RDLpwha.exe
  C:\Windows\System\RDLpwha.exe
  2⤵
  PID:11148
- C:\Windows\System\MepuNxX.exe
  C:\Windows\System\MepuNxX.exe
  2⤵
  PID:11176
- C:\Windows\System\JyjBhnw.exe
  C:\Windows\System\JyjBhnw.exe
  2⤵
  PID:11196
- C:\Windows\System\eWlbBVC.exe
  C:\Windows\System\eWlbBVC.exe
  2⤵
  PID:8936
- C:\Windows\System\eeDIhOC.exe
  C:\Windows\System\eeDIhOC.exe
  2⤵
  PID:9824
- C:\Windows\System\YCtNjxq.exe
  C:\Windows\System\YCtNjxq.exe
  2⤵
  PID:4540
- C:\Windows\System\gRlbFos.exe
  C:\Windows\System\gRlbFos.exe
  2⤵
  PID:9256
- C:\Windows\System\MVDZaHU.exe
  C:\Windows\System\MVDZaHU.exe
  2⤵
  PID:9432
- C:\Windows\System\rrvJCvR.exe
  C:\Windows\System\rrvJCvR.exe
  2⤵
  PID:3604
- C:\Windows\System\qRPSayl.exe
  C:\Windows\System\qRPSayl.exe
  2⤵
  PID:10324
- C:\Windows\System\XGCGGBU.exe
  C:\Windows\System\XGCGGBU.exe
  2⤵
  PID:10352
- C:\Windows\System\nnebxiK.exe
  C:\Windows\System\nnebxiK.exe
  2⤵
  PID:10492
- C:\Windows\System\xsRrWin.exe
  C:\Windows\System\xsRrWin.exe
  2⤵
  PID:10536
- C:\Windows\System\fqSHcGH.exe
  C:\Windows\System\fqSHcGH.exe
  2⤵
  PID:10580
- C:\Windows\System\XagDiQn.exe
  C:\Windows\System\XagDiQn.exe
  2⤵
  PID:10816
- C:\Windows\System\gaxHaWY.exe
  C:\Windows\System\gaxHaWY.exe
  2⤵
  PID:10952
- C:\Windows\System\pUcQNYp.exe
  C:\Windows\System\pUcQNYp.exe
  2⤵
  PID:10668
- C:\Windows\System\VQURqKl.exe
  C:\Windows\System\VQURqKl.exe
  2⤵
  PID:11056
- C:\Windows\System\ZcXvSGR.exe
  C:\Windows\System\ZcXvSGR.exe
  2⤵
  PID:11192
- C:\Windows\System\HWPcpzy.exe
  C:\Windows\System\HWPcpzy.exe
  2⤵
  PID:11204
- C:\Windows\System\KrjgKQg.exe
  C:\Windows\System\KrjgKQg.exe
  2⤵
  PID:11104
- C:\Windows\System\GVsLXRC.exe
  C:\Windows\System\GVsLXRC.exe
  2⤵
  PID:11124
- C:\Windows\System\QLbVnVC.exe
  C:\Windows\System\QLbVnVC.exe
  2⤵
  PID:9828
- C:\Windows\System\MhmkoJD.exe
  C:\Windows\System\MhmkoJD.exe
  2⤵
  PID:9796
- C:\Windows\System\BPJzFOA.exe
  C:\Windows\System\BPJzFOA.exe
  2⤵
  PID:9384
- C:\Windows\System\DszslVN.exe
  C:\Windows\System\DszslVN.exe
  2⤵
  PID:10652
- C:\Windows\System\wbHnHBR.exe
  C:\Windows\System\wbHnHBR.exe
  2⤵
  PID:10460
- C:\Windows\System\HGmWrKA.exe
  C:\Windows\System\HGmWrKA.exe
  2⤵
  PID:10980
- C:\Windows\System\jaoEJUM.exe
  C:\Windows\System\jaoEJUM.exe
  2⤵
  PID:10348
- C:\Windows\System\jlajLRj.exe
  C:\Windows\System\jlajLRj.exe
  2⤵
  PID:10740
- C:\Windows\System\UrerzgQ.exe
  C:\Windows\System\UrerzgQ.exe
  2⤵
  PID:11288
- C:\Windows\System\TmkRtNx.exe
  C:\Windows\System\TmkRtNx.exe
  2⤵
  PID:11324
- C:\Windows\System\VczToOK.exe
  C:\Windows\System\VczToOK.exe
  2⤵
  PID:11352
- C:\Windows\System\UruPnFi.exe
  C:\Windows\System\UruPnFi.exe
  2⤵
  PID:11384
- C:\Windows\System\enPxvEt.exe
  C:\Windows\System\enPxvEt.exe
  2⤵
  PID:11416
- C:\Windows\System\JlTYopU.exe
  C:\Windows\System\JlTYopU.exe
  2⤵
  PID:11444
- C:\Windows\System\waMwVFf.exe
  C:\Windows\System\waMwVFf.exe
  2⤵
  PID:11500
- C:\Windows\System\QGYnBHS.exe
  C:\Windows\System\QGYnBHS.exe
  2⤵
  PID:11524
- C:\Windows\System\hvVPyOy.exe
  C:\Windows\System\hvVPyOy.exe
  2⤵
  PID:11556
- C:\Windows\System\AbVEFKc.exe
  C:\Windows\System\AbVEFKc.exe
  2⤵
  PID:11576
- C:\Windows\System\OYWXrEs.exe
  C:\Windows\System\OYWXrEs.exe
  2⤵
  PID:11600
- C:\Windows\System\VAKVDaw.exe
  C:\Windows\System\VAKVDaw.exe
  2⤵
  PID:11616
- C:\Windows\System\dgjZEYu.exe
  C:\Windows\System\dgjZEYu.exe
  2⤵
  PID:11648
- C:\Windows\System\FvMrbJu.exe
  C:\Windows\System\FvMrbJu.exe
  2⤵
  PID:11672
- C:\Windows\System\uuhOFdy.exe
  C:\Windows\System\uuhOFdy.exe
  2⤵
  PID:11704
- C:\Windows\System\vwPQmWJ.exe
  C:\Windows\System\vwPQmWJ.exe
  2⤵
  PID:11736
- C:\Windows\System\eKuhRah.exe
  C:\Windows\System\eKuhRah.exe
  2⤵
  PID:11752
- C:\Windows\System\vwGaupP.exe
  C:\Windows\System\vwGaupP.exe
  2⤵
  PID:11772
- C:\Windows\System\FShXbiK.exe
  C:\Windows\System\FShXbiK.exe
  2⤵
  PID:11804
- C:\Windows\System\hxPBdft.exe
  C:\Windows\System\hxPBdft.exe
  2⤵
  PID:11832
- C:\Windows\System\GFqnAYw.exe
  C:\Windows\System\GFqnAYw.exe
  2⤵
  PID:11876
- C:\Windows\System\MHVUjWH.exe
  C:\Windows\System\MHVUjWH.exe
  2⤵
  PID:11896
- C:\Windows\System\OUfydgn.exe
  C:\Windows\System\OUfydgn.exe
  2⤵
  PID:11936
- C:\Windows\System\IrpAkNY.exe
  C:\Windows\System\IrpAkNY.exe
  2⤵
  PID:11968
- C:\Windows\System\XGbkEQf.exe
  C:\Windows\System\XGbkEQf.exe
  2⤵
  PID:12004
- C:\Windows\System\YkzMMGi.exe
  C:\Windows\System\YkzMMGi.exe
  2⤵
  PID:12024
- C:\Windows\System\RErChDF.exe
  C:\Windows\System\RErChDF.exe
  2⤵
  PID:12052
- C:\Windows\System\DnRpQWC.exe
  C:\Windows\System\DnRpQWC.exe
  2⤵
  PID:12076
- C:\Windows\System\dMsxdQa.exe
  C:\Windows\System\dMsxdQa.exe
  2⤵
  PID:12096
- C:\Windows\System\vvdMZTU.exe
  C:\Windows\System\vvdMZTU.exe
  2⤵
  PID:12120
- C:\Windows\System\kNvjuEQ.exe
  C:\Windows\System\kNvjuEQ.exe
  2⤵
  PID:12144
- C:\Windows\System\VbdcjkG.exe
  C:\Windows\System\VbdcjkG.exe
  2⤵
  PID:12168
- C:\Windows\System\csytFUF.exe
  C:\Windows\System\csytFUF.exe
  2⤵
  PID:12200
- C:\Windows\System\jVXWpTp.exe
  C:\Windows\System\jVXWpTp.exe
  2⤵
  PID:12276
- C:\Windows\System\tVchvIF.exe
  C:\Windows\System\tVchvIF.exe
  2⤵
  PID:10900
- C:\Windows\System\rEiQKeO.exe
  C:\Windows\System\rEiQKeO.exe
  2⤵
  PID:11272
- C:\Windows\System\WNZWnjr.exe
  C:\Windows\System\WNZWnjr.exe
  2⤵
  PID:10756
- C:\Windows\System\pOOiaYa.exe
  C:\Windows\System\pOOiaYa.exe
  2⤵
  PID:11452
- C:\Windows\System\UyqPJMU.exe
  C:\Windows\System\UyqPJMU.exe
  2⤵
  PID:11512
- C:\Windows\System\bhDwYjl.exe
  C:\Windows\System\bhDwYjl.exe
  2⤵
  PID:11496
- C:\Windows\System\sQeXbsZ.exe
  C:\Windows\System\sQeXbsZ.exe
  2⤵
  PID:11544
- C:\Windows\System\kMyiLmK.exe
  C:\Windows\System\kMyiLmK.exe
  2⤵
  PID:11728
- C:\Windows\System\YBaVKhS.exe
  C:\Windows\System\YBaVKhS.exe
  2⤵
  PID:9176
- C:\Windows\System\BSrPMCT.exe
  C:\Windows\System\BSrPMCT.exe
  2⤵
  PID:11800
- C:\Windows\System\GxkmsKy.exe
  C:\Windows\System\GxkmsKy.exe
  2⤵
  PID:11928
- C:\Windows\System\sqokUAr.exe
  C:\Windows\System\sqokUAr.exe
  2⤵
  PID:11964
- C:\Windows\System\HaPjTyU.exe
  C:\Windows\System\HaPjTyU.exe
  2⤵
  PID:11904
- C:\Windows\System\ZAyTbTz.exe
  C:\Windows\System\ZAyTbTz.exe
  2⤵
  PID:12084
- C:\Windows\System\QeGvGlE.exe
  C:\Windows\System\QeGvGlE.exe
  2⤵
  PID:12184
- C:\Windows\System\WmUamyh.exe
  C:\Windows\System\WmUamyh.exe
  2⤵
  PID:12040
- C:\Windows\System\pXtPCzQ.exe
  C:\Windows\System\pXtPCzQ.exe
  2⤵
  PID:11960
- C:\Windows\System\mFPmrzg.exe
  C:\Windows\System\mFPmrzg.exe
  2⤵
  PID:10560
- C:\Windows\System\GWwiRGO.exe
  C:\Windows\System\GWwiRGO.exe
  2⤵
  PID:12140
- C:\Windows\System\opagSKu.exe
  C:\Windows\System\opagSKu.exe
  2⤵
  PID:11432
- C:\Windows\System\ZSakdGJ.exe
  C:\Windows\System\ZSakdGJ.exe
  2⤵
  PID:11596
- C:\Windows\System\iyYoZNa.exe
  C:\Windows\System\iyYoZNa.exe
  2⤵
  PID:11612
- C:\Windows\System\qePYfFs.exe
  C:\Windows\System\qePYfFs.exe
  2⤵
  PID:11792
- C:\Windows\System\ppSpElh.exe
  C:\Windows\System\ppSpElh.exe
  2⤵
  PID:12044
- C:\Windows\System\sLriagL.exe
  C:\Windows\System\sLriagL.exe
  2⤵
  PID:12012
- C:\Windows\System\qrcyBZO.exe
  C:\Windows\System\qrcyBZO.exe
  2⤵
  PID:12156
- C:\Windows\System\PWWGzgW.exe
  C:\Windows\System\PWWGzgW.exe
  2⤵
  PID:12252
- C:\Windows\System\KFcPkZG.exe
  C:\Windows\System\KFcPkZG.exe
  2⤵
  PID:12312
- C:\Windows\System\oxGhoqe.exe
  C:\Windows\System\oxGhoqe.exe
  2⤵
  PID:12332
- C:\Windows\System\mgQohPv.exe
  C:\Windows\System\mgQohPv.exe
  2⤵
  PID:12364
- C:\Windows\System\YcfcSLY.exe
  C:\Windows\System\YcfcSLY.exe
  2⤵
  PID:12388
- C:\Windows\System\XQmSKIb.exe
  C:\Windows\System\XQmSKIb.exe
  2⤵
  PID:12412
- C:\Windows\System\vYPjFAx.exe
  C:\Windows\System\vYPjFAx.exe
  2⤵
  PID:12436
- C:\Windows\System\ZCVUTUE.exe
  C:\Windows\System\ZCVUTUE.exe
  2⤵
  PID:12464
- C:\Windows\System\YlWgzdt.exe
  C:\Windows\System\YlWgzdt.exe
  2⤵
  PID:12484
- C:\Windows\System\WFmlbNa.exe
  C:\Windows\System\WFmlbNa.exe
  2⤵
  PID:12504
- C:\Windows\System\VyCYVvN.exe
  C:\Windows\System\VyCYVvN.exe
  2⤵
  PID:12532
- C:\Windows\System\UndLVXJ.exe
  C:\Windows\System\UndLVXJ.exe
  2⤵
  PID:12556
- C:\Windows\System\cYGIYSQ.exe
  C:\Windows\System\cYGIYSQ.exe
  2⤵
  PID:12584
- C:\Windows\System\fZUfrCz.exe
  C:\Windows\System\fZUfrCz.exe
  2⤵
  PID:12608
- C:\Windows\System\mFqewTb.exe
  C:\Windows\System\mFqewTb.exe
  2⤵
  PID:12628
- C:\Windows\System\GICjpnm.exe
  C:\Windows\System\GICjpnm.exe
  2⤵
  PID:12660
- C:\Windows\System\fJoBlFY.exe
  C:\Windows\System\fJoBlFY.exe
  2⤵
  PID:12680
- C:\Windows\System\UBmFmrD.exe
  C:\Windows\System\UBmFmrD.exe
  2⤵
  PID:12760
- C:\Windows\System\MdxVIqt.exe
  C:\Windows\System\MdxVIqt.exe
  2⤵
  PID:12776
- C:\Windows\System\pWsfdDy.exe
  C:\Windows\System\pWsfdDy.exe
  2⤵
  PID:12808
- C:\Windows\System\keOtotR.exe
  C:\Windows\System\keOtotR.exe
  2⤵
  PID:12836
- C:\Windows\System\meYbNZU.exe
  C:\Windows\System\meYbNZU.exe
  2⤵
  PID:13084
- C:\Windows\System\jiJFzcQ.exe
  C:\Windows\System\jiJFzcQ.exe
  2⤵
  PID:13120
- C:\Windows\System\EsPVESX.exe
  C:\Windows\System\EsPVESX.exe
  2⤵
  PID:13136
- C:\Windows\System\yiftZNL.exe
  C:\Windows\System\yiftZNL.exe
  2⤵
  PID:13160
- C:\Windows\System\ebRseaO.exe
  C:\Windows\System\ebRseaO.exe
  2⤵
  PID:13180
- C:\Windows\System\rOaDoFB.exe
  C:\Windows\System\rOaDoFB.exe
  2⤵
  PID:13208
- C:\Windows\System\OOIMhIv.exe
  C:\Windows\System\OOIMhIv.exe
  2⤵
  PID:13228
- C:\Windows\System\xEzpvta.exe
  C:\Windows\System\xEzpvta.exe
  2⤵
  PID:13244
- C:\Windows\System\oMULZXh.exe
  C:\Windows\System\oMULZXh.exe
  2⤵
  PID:13260
- C:\Windows\System\loynMCO.exe
  C:\Windows\System\loynMCO.exe
  2⤵
  PID:13288
- C:\Windows\System\dxqElJH.exe
  C:\Windows\System\dxqElJH.exe
  2⤵
  PID:13308
- C:\Windows\System\niJEstT.exe
  C:\Windows\System\niJEstT.exe
  2⤵
  PID:11320
- C:\Windows\System\ttKbaaa.exe
  C:\Windows\System\ttKbaaa.exe
  2⤵
  PID:12116
- C:\Windows\System\uFTjrwa.exe
  C:\Windows\System\uFTjrwa.exe
  2⤵
  PID:4028
- C:\Windows\System\AmDbKLH.exe
  C:\Windows\System\AmDbKLH.exe
  2⤵
  PID:12356
- C:\Windows\System\tyaJtRT.exe
  C:\Windows\System\tyaJtRT.exe
  2⤵
  PID:12420
- C:\Windows\System\plXPhtD.exe
  C:\Windows\System\plXPhtD.exe
  2⤵
  PID:12448
- C:\Windows\System\RTPtLlk.exe
  C:\Windows\System\RTPtLlk.exe
  2⤵
  PID:12516
- C:\Windows\System\pguFArO.exe
  C:\Windows\System\pguFArO.exe
  2⤵
  PID:12648
- C:\Windows\System\cegMvZJ.exe
  C:\Windows\System\cegMvZJ.exe
  2⤵
  PID:12328
- C:\Windows\System\PTCWnuu.exe
  C:\Windows\System\PTCWnuu.exe
  2⤵
  PID:12384
- C:\Windows\System\QBMktOi.exe
  C:\Windows\System\QBMktOi.exe
  2⤵
  PID:12624
- C:\Windows\System\ZEConOa.exe
  C:\Windows\System\ZEConOa.exe
  2⤵
  PID:12572
- C:\Windows\System\WUPRlYb.exe
  C:\Windows\System\WUPRlYb.exe
  2⤵
  PID:12756
- C:\Windows\System\TWmcqjb.exe
  C:\Windows\System\TWmcqjb.exe
  2⤵
  PID:12772
- C:\Windows\System\MKfqota.exe
  C:\Windows\System\MKfqota.exe
  2⤵
  PID:3572
- C:\Windows\System\KBzKpTm.exe
  C:\Windows\System\KBzKpTm.exe
  2⤵
  PID:2716
- C:\Windows\System\eQHiTeg.exe
  C:\Windows\System\eQHiTeg.exe
  2⤵
  PID:12976
- C:\Windows\System\LPWoEGg.exe
  C:\Windows\System\LPWoEGg.exe
  2⤵
  PID:2852
- C:\Windows\System\WSghICm.exe
  C:\Windows\System\WSghICm.exe
  2⤵
  PID:32
- C:\Windows\System\gaIEsKH.exe
  C:\Windows\System\gaIEsKH.exe
  2⤵
  PID:4200
- C:\Windows\System\vfISrqu.exe
  C:\Windows\System\vfISrqu.exe
  2⤵
  PID:4312
- C:\Windows\System\YaVfgsG.exe
  C:\Windows\System\YaVfgsG.exe
  2⤵
  PID:4080
- C:\Windows\System\NBgOyUl.exe
  C:\Windows\System\NBgOyUl.exe
  2⤵
  PID:12856
- C:\Windows\System\OVZZJod.exe
  C:\Windows\System\OVZZJod.exe
  2⤵
  PID:3812
- C:\Windows\System\HeXyzEq.exe
  C:\Windows\System\HeXyzEq.exe
  2⤵
  PID:2724
- C:\Windows\System\zdUAjQH.exe
  C:\Windows\System\zdUAjQH.exe
  2⤵
  PID:440
- C:\Windows\System\FvRnhin.exe
  C:\Windows\System\FvRnhin.exe
  2⤵
  PID:13172
- C:\Windows\System\bjlFZPw.exe
  C:\Windows\System\bjlFZPw.exe
  2⤵
  PID:3288
- C:\Windows\System\vbqWqeX.exe
  C:\Windows\System\vbqWqeX.exe
  2⤵
  PID:12072
- C:\Windows\System\uEoLTYm.exe
  C:\Windows\System\uEoLTYm.exe
  2⤵
  PID:13236
- C:\Windows\System\jLHxWjl.exe
  C:\Windows\System\jLHxWjl.exe
  2⤵
  PID:13300
- C:\Windows\System\cpoTKEE.exe
  C:\Windows\System\cpoTKEE.exe
  2⤵
  PID:11888
- C:\Windows\System\nBddhoz.exe
  C:\Windows\System\nBddhoz.exe
  2⤵
  PID:11348
- C:\Windows\System\MqVzxId.exe
  C:\Windows\System\MqVzxId.exe
  2⤵
  PID:12744
- C:\Windows\System\HuDonzX.exe
  C:\Windows\System\HuDonzX.exe
  2⤵
  PID:11788
- C:\Windows\System\ufTtZvu.exe
  C:\Windows\System\ufTtZvu.exe
  2⤵
  PID:1124
- C:\Windows\System\ziZzsiF.exe
  C:\Windows\System\ziZzsiF.exe
  2⤵
  PID:12820
- C:\Windows\System\rOgjltl.exe
  C:\Windows\System\rOgjltl.exe
  2⤵
  PID:13020
- C:\Windows\System\dIgPpTj.exe
  C:\Windows\System\dIgPpTj.exe
  2⤵
  PID:1992
- C:\Windows\System\ITrEGXG.exe
  C:\Windows\System\ITrEGXG.exe
  2⤵
  PID:3896
- C:\Windows\System\xqxMkkp.exe
  C:\Windows\System\xqxMkkp.exe
  2⤵
  PID:1572
- C:\Windows\System\QjItWdG.exe
  C:\Windows\System\QjItWdG.exe
  2⤵
  PID:5428
- C:\Windows\System\QLHjtFs.exe
  C:\Windows\System\QLHjtFs.exe
  2⤵
  PID:13200
- C:\Windows\System\NIHDrNi.exe
  C:\Windows\System\NIHDrNi.exe
  2⤵
  PID:5568
- C:\Windows\System\xvdsOhe.exe
  C:\Windows\System\xvdsOhe.exe
  2⤵
  PID:4480
- C:\Windows\System\zoxDrYm.exe
  C:\Windows\System\zoxDrYm.exe
  2⤵
  PID:2932
- C:\Windows\System\yizRTYt.exe
  C:\Windows\System\yizRTYt.exe
  2⤵
  PID:5148
- C:\Windows\System\iRVEaLl.exe
  C:\Windows\System\iRVEaLl.exe
  2⤵
  PID:13216
- C:\Windows\System\VSqqoPC.exe
  C:\Windows\System\VSqqoPC.exe
  2⤵
  PID:12348
- C:\Windows\System\yMMWuFO.exe
  C:\Windows\System\yMMWuFO.exe
  2⤵
  PID:12496
- C:\Windows\System\ZRgnbMG.exe
  C:\Windows\System\ZRgnbMG.exe
  2⤵
  PID:5360
- C:\Windows\System\YAuyzbz.exe
  C:\Windows\System\YAuyzbz.exe
  2⤵
  PID:4536
- C:\Windows\System\YkpvPYt.exe
  C:\Windows\System\YkpvPYt.exe
  2⤵
  PID:3500
- C:\Windows\System\uvfHzCw.exe
  C:\Windows\System\uvfHzCw.exe
  2⤵
  PID:13092
- C:\Windows\System\ZGCNVsZ.exe
  C:\Windows\System\ZGCNVsZ.exe
  2⤵
  PID:4640
- C:\Windows\System\wonDcdu.exe
  C:\Windows\System\wonDcdu.exe
  2⤵
  PID:5596
- C:\Windows\System\HHynQrg.exe
  C:\Windows\System\HHynQrg.exe
  2⤵
  PID:12480
- C:\Windows\System\KQhPxah.exe
  C:\Windows\System\KQhPxah.exe
  2⤵
  PID:5288
- C:\Windows\System\PpQAvCg.exe
  C:\Windows\System\PpQAvCg.exe
  2⤵
  PID:12892
- C:\Windows\System\EQUSUId.exe
  C:\Windows\System\EQUSUId.exe
  2⤵
  PID:13152
- C:\Windows\System\hLhADBC.exe
  C:\Windows\System\hLhADBC.exe
  2⤵
  PID:13332
- C:\Windows\System\xvifBus.exe
  C:\Windows\System\xvifBus.exe
  2⤵
  PID:13360
- C:\Windows\System\QorEkeB.exe
  C:\Windows\System\QorEkeB.exe
  2⤵
  PID:13388
- C:\Windows\System\GNmiGMG.exe
  C:\Windows\System\GNmiGMG.exe
  2⤵
  PID:13408
- C:\Windows\System\xmXXNAz.exe
  C:\Windows\System\xmXXNAz.exe
  2⤵
  PID:13432
- C:\Windows\System\KJrszce.exe
  C:\Windows\System\KJrszce.exe
  2⤵
  PID:13456
- C:\Windows\System\GrpRQzk.exe
  C:\Windows\System\GrpRQzk.exe
  2⤵
  PID:13480
- C:\Windows\System\kxTWvYc.exe
  C:\Windows\System\kxTWvYc.exe
  2⤵
  PID:13504
- C:\Windows\System\pNojiqe.exe
  C:\Windows\System\pNojiqe.exe
  2⤵
  PID:13520
- C:\Windows\System\nZRlbdM.exe
  C:\Windows\System\nZRlbdM.exe
  2⤵
  PID:13548
- C:\Windows\System\GJixqLS.exe
  C:\Windows\System\GJixqLS.exe
  2⤵
  PID:13568
- C:\Windows\System\tmWMxoE.exe
  C:\Windows\System\tmWMxoE.exe
  2⤵
  PID:13592
- C:\Windows\System\lgMGtVO.exe
  C:\Windows\System\lgMGtVO.exe
  2⤵
  PID:13612
- C:\Windows\System\umCuZIA.exe
  C:\Windows\System\umCuZIA.exe
  2⤵
  PID:13636
- C:\Windows\System\yhsZVsu.exe
  C:\Windows\System\yhsZVsu.exe
  2⤵
  PID:13652
- C:\Windows\System\vDelVTb.exe
  C:\Windows\System\vDelVTb.exe
  2⤵
  PID:13676
- C:\Windows\System\WGOJDju.exe
  C:\Windows\System\WGOJDju.exe
  2⤵
  PID:13700
- C:\Windows\System\bRXevVj.exe
  C:\Windows\System\bRXevVj.exe
  2⤵
  PID:13736
- C:\Windows\System\BbAnxLS.exe
  C:\Windows\System\BbAnxLS.exe
  2⤵
  PID:13760
- C:\Windows\System\pxJArPl.exe
  C:\Windows\System\pxJArPl.exe
  2⤵
  PID:13784
- C:\Windows\System\CfELlzx.exe
  C:\Windows\System\CfELlzx.exe
  2⤵
  PID:13812
- C:\Windows\System\URLjwcf.exe
  C:\Windows\System\URLjwcf.exe
  2⤵
  PID:13828
- C:\Windows\System\oLhOpZV.exe
  C:\Windows\System\oLhOpZV.exe
  2⤵
  PID:13852
- C:\Windows\System\ekeFTmx.exe
  C:\Windows\System\ekeFTmx.exe
  2⤵
  PID:13876
- C:\Windows\System\wZojrmS.exe
  C:\Windows\System\wZojrmS.exe
  2⤵
  PID:13900
- C:\Windows\System\qdmARYO.exe
  C:\Windows\System\qdmARYO.exe
  2⤵
  PID:13924
- C:\Windows\System\daTeLPi.exe
  C:\Windows\System\daTeLPi.exe
  2⤵
  PID:13956
- C:\Windows\System\rtKTGJr.exe
  C:\Windows\System\rtKTGJr.exe
  2⤵
  PID:14032
- C:\Windows\System\HLSyXHR.exe
  C:\Windows\System\HLSyXHR.exe
  2⤵
  PID:14064
- C:\Windows\System\YcViAiR.exe
  C:\Windows\System\YcViAiR.exe
  2⤵
  PID:14080
- C:\Windows\System\oNidsHC.exe
  C:\Windows\System\oNidsHC.exe
  2⤵
  PID:14108
- C:\Windows\System\LLcvrWS.exe
  C:\Windows\System\LLcvrWS.exe
  2⤵
  PID:14156
- C:\Windows\System\iRUepyH.exe
  C:\Windows\System\iRUepyH.exe
  2⤵
  PID:14180
- C:\Windows\System\qnmBzzm.exe
  C:\Windows\System\qnmBzzm.exe
  2⤵
  PID:14220
- C:\Windows\System\bHUoUoi.exe
  C:\Windows\System\bHUoUoi.exe
  2⤵
  PID:14236
- C:\Windows\System\nDfuXvn.exe
  C:\Windows\System\nDfuXvn.exe
  2⤵
  PID:14256
- C:\Windows\System\vomilpf.exe
  C:\Windows\System\vomilpf.exe
  2⤵
  PID:14272
- C:\Windows\System\vRURaDp.exe
  C:\Windows\System\vRURaDp.exe
  2⤵
  PID:14288
- C:\Windows\System\ItnGWQY.exe
  C:\Windows\System\ItnGWQY.exe
  2⤵
  PID:14316
- C:\Windows\System\SGTigpB.exe
  C:\Windows\System\SGTigpB.exe
  2⤵
  PID:5176
- C:\Windows\System\dhApKqi.exe
  C:\Windows\System\dhApKqi.exe
  2⤵
  PID:5196
- C:\Windows\System\zyeEOZL.exe
  C:\Windows\System\zyeEOZL.exe
  2⤵
  PID:14196
- C:\Windows\System\FTTZTaF.exe
  C:\Windows\System\FTTZTaF.exe
  2⤵
  PID:14076
- C:\Windows\System\KrfVBKG.exe
  C:\Windows\System\KrfVBKG.exe
  2⤵
  PID:14124
- C:\Windows\System\KpSZtWh.exe
  C:\Windows\System\KpSZtWh.exe
  2⤵
  PID:14228
- C:\Windows\System\rpHMwRL.exe
  C:\Windows\System\rpHMwRL.exe
  2⤵
  PID:14280
- C:\Windows\System\JYYhBEe.exe
  C:\Windows\System\JYYhBEe.exe
  2⤵
  PID:13792
- C:\Windows\System\CIYeGGZ.exe
  C:\Windows\System\CIYeGGZ.exe
  2⤵
  PID:13648
- C:\Windows\System\DQFYBbG.exe
  C:\Windows\System\DQFYBbG.exe
  2⤵
  PID:13500
- C:\Windows\System\GXldTzh.exe
  C:\Windows\System\GXldTzh.exe
  2⤵
  PID:14128
- C:\Windows\System\UtcEqYH.exe
  C:\Windows\System\UtcEqYH.exe
  2⤵
  PID:13800
- C:\Windows\System\ZwoCgfu.exe
  C:\Windows\System\ZwoCgfu.exe
  2⤵
  PID:13952
- C:\Windows\System\gMlZdcg.exe
  C:\Windows\System\gMlZdcg.exe
  2⤵
  PID:14024
- C:\Windows\System\VCzVyXf.exe
  C:\Windows\System\VCzVyXf.exe
  2⤵
  PID:14176
- C:\Windows\System\VUVuXma.exe
  C:\Windows\System\VUVuXma.exe
  2⤵
  PID:14300
- C:\Windows\System\eKCuLbb.exe
  C:\Windows\System\eKCuLbb.exe
  2⤵
  PID:11000
- C:\Windows\System\XTFZGUd.exe
  C:\Windows\System\XTFZGUd.exe
  2⤵
  PID:2436
- C:\Windows\System\kUdtoTW.exe
  C:\Windows\System\kUdtoTW.exe
  2⤵
  PID:13404
- C:\Windows\System\hpEximX.exe
  C:\Windows\System\hpEximX.exe
  2⤵
  PID:1240
- C:\Windows\System\lzBNjdi.exe
  C:\Windows\System\lzBNjdi.exe
  2⤵
  PID:5136
- C:\Windows\System\dYshaTW.exe
  C:\Windows\System\dYshaTW.exe
  2⤵
  PID:5468
- C:\Windows\System\UfTCJpq.exe
  C:\Windows\System\UfTCJpq.exe
  2⤵
  PID:5524
- C:\Windows\System\OPeSOLr.exe
  C:\Windows\System\OPeSOLr.exe
  2⤵
  PID:14100
- C:\Windows\System\fMceAoz.exe
  C:\Windows\System\fMceAoz.exe
  2⤵
  PID:2856
- C:\Windows\System\TxICIJa.exe
  C:\Windows\System\TxICIJa.exe
  2⤵
  PID:2668
- C:\Windows\System\uRDWAEM.exe
  C:\Windows\System\uRDWAEM.exe
  2⤵
  PID:4020
- C:\Windows\System\AhARPiM.exe
  C:\Windows\System\AhARPiM.exe
  2⤵
  PID:14052
- C:\Windows\System\hrfIrxJ.exe
  C:\Windows\System\hrfIrxJ.exe
  2⤵
  PID:13912
- C:\Windows\System\wUVpsRs.exe
  C:\Windows\System\wUVpsRs.exe
  2⤵
  PID:5272
- C:\Windows\System\JBhEOyw.exe
  C:\Windows\System\JBhEOyw.exe
  2⤵
  PID:14104
- C:\Windows\System\ZUPDZGj.exe
  C:\Windows\System\ZUPDZGj.exe
  2⤵
  PID:4912
- C:\Windows\System\zjXOusV.exe
  C:\Windows\System\zjXOusV.exe
  2⤵
  PID:5628
- C:\Windows\System\XQlNqdS.exe
  C:\Windows\System\XQlNqdS.exe
  2⤵
  PID:2108
- C:\Windows\System\QjvkIsO.exe
  C:\Windows\System\QjvkIsO.exe
  2⤵
  PID:4632
- C:\Windows\System\FiTzwVG.exe
  C:\Windows\System\FiTzwVG.exe
  2⤵
  PID:5612
- C:\Windows\System\ZTPBGCN.exe
  C:\Windows\System\ZTPBGCN.exe
  2⤵
  PID:3084
- C:\Windows\System\NNcZRlc.exe
  C:\Windows\System\NNcZRlc.exe
  2⤵
  PID:4888
- C:\Windows\System\xkUOrRB.exe
  C:\Windows\System\xkUOrRB.exe
  2⤵
  PID:6116
- C:\Windows\System\TFhfZrv.exe
  C:\Windows\System\TFhfZrv.exe
  2⤵
  PID:5876
- C:\Windows\System\btnMcdL.exe
  C:\Windows\System\btnMcdL.exe
  2⤵
  PID:6188
- C:\Windows\System\wuaXlgQ.exe
  C:\Windows\System\wuaXlgQ.exe
  2⤵
  PID:6220
- C:\Windows\System\qjQAOoT.exe
  C:\Windows\System\qjQAOoT.exe
  2⤵
  PID:6088
- C:\Windows\System\ENuGdEy.exe
  C:\Windows\System\ENuGdEy.exe
  2⤵
  PID:4396
- C:\Windows\System\JCkIoOe.exe
  C:\Windows\System\JCkIoOe.exe
  2⤵
  PID:14340
- C:\Windows\System\cYatDmM.exe
  C:\Windows\System\cYatDmM.exe
  2⤵
  PID:14376
- C:\Windows\System\ZtnlKuO.exe
  C:\Windows\System\ZtnlKuO.exe
  2⤵
  PID:14396
- C:\Windows\System\omCwayi.exe
  C:\Windows\System\omCwayi.exe
  2⤵
  PID:14420
- C:\Windows\System\dyGnhUf.exe
  C:\Windows\System\dyGnhUf.exe
  2⤵
  PID:14444
- C:\Windows\System\fcNUITl.exe
  C:\Windows\System\fcNUITl.exe
  2⤵
  PID:14468
- C:\Windows\System\OQHMkLm.exe
  C:\Windows\System\OQHMkLm.exe
  2⤵
  PID:14488
- C:\Windows\System\dTMwrVc.exe
  C:\Windows\System\dTMwrVc.exe
  2⤵
  PID:14504
- C:\Windows\System\GLILbSA.exe
  C:\Windows\System\GLILbSA.exe
  2⤵
  PID:14524
- C:\Windows\System\cibUpuM.exe
  C:\Windows\System\cibUpuM.exe
  2⤵
  PID:14568
- C:\Windows\System\SXrcgeK.exe
  C:\Windows\System\SXrcgeK.exe
  2⤵
  PID:14588
- C:\Windows\System\QmzCAAg.exe
  C:\Windows\System\QmzCAAg.exe
  2⤵
  PID:14648
- C:\Windows\System\RkGeBis.exe
  C:\Windows\System\RkGeBis.exe
  2⤵
  PID:14688
- C:\Windows\System\vfNoAFj.exe
  C:\Windows\System\vfNoAFj.exe
  2⤵
  PID:14712
- C:\Windows\System\SVKXMth.exe
  C:\Windows\System\SVKXMth.exe
  2⤵
  PID:14736
- C:\Windows\System\hYuLKtl.exe
  C:\Windows\System\hYuLKtl.exe
  2⤵
  PID:14768
- C:\Windows\System\duMZdaR.exe
  C:\Windows\System\duMZdaR.exe
  2⤵
  PID:14792
- C:\Windows\System\AxAyDct.exe
  C:\Windows\System\AxAyDct.exe
  2⤵
  PID:14812
- C:\Windows\System\wyjwvaA.exe
  C:\Windows\System\wyjwvaA.exe
  2⤵
  PID:14848
- C:\Windows\System\wGoACmP.exe
  C:\Windows\System\wGoACmP.exe
  2⤵
  PID:14872
- C:\Windows\System\KilzhtP.exe
  C:\Windows\System\KilzhtP.exe
  2⤵
  PID:14892
- C:\Windows\System\QMuLHwU.exe
  C:\Windows\System\QMuLHwU.exe
  2⤵
  PID:14924
- C:\Windows\System\TGatSnm.exe
  C:\Windows\System\TGatSnm.exe
  2⤵
  PID:15032
- C:\Windows\System\VKPVFHY.exe
  C:\Windows\System\VKPVFHY.exe
  2⤵
  PID:15052
- C:\Windows\System\MYnYMJf.exe
  C:\Windows\System\MYnYMJf.exe
  2⤵
  PID:15068
- C:\Windows\System\NrFFwyU.exe
  C:\Windows\System\NrFFwyU.exe
  2⤵
  PID:15092
- C:\Windows\System\sUiZFAl.exe
  C:\Windows\System\sUiZFAl.exe
  2⤵
  PID:15132
- C:\Windows\System\bUTkKlg.exe
  C:\Windows\System\bUTkKlg.exe
  2⤵
  PID:15168
- C:\Windows\System\UnMZtbH.exe
  C:\Windows\System\UnMZtbH.exe
  2⤵
  PID:15260
- C:\Windows\System\ukSTjUl.exe
  C:\Windows\System\ukSTjUl.exe
  2⤵
  PID:15280
- C:\Windows\System\usjwsdp.exe
  C:\Windows\System\usjwsdp.exe
  2⤵
  PID:15308
- C:\Windows\System\SmrFGZs.exe
  C:\Windows\System\SmrFGZs.exe
  2⤵
  PID:15332
- C:\Windows\System\rsVuAqZ.exe
  C:\Windows\System\rsVuAqZ.exe
  2⤵
  PID:3836
- C:\Windows\System\UUmyaMN.exe
  C:\Windows\System\UUmyaMN.exe
  2⤵
  PID:4204
- C:\Windows\System\jsVxJtO.exe
  C:\Windows\System\jsVxJtO.exe
  2⤵
  PID:6232
- C:\Windows\System\rhpxOZv.exe
  C:\Windows\System\rhpxOZv.exe
  2⤵
  PID:3992
- C:\Windows\System\nGqlZky.exe
  C:\Windows\System\nGqlZky.exe
  2⤵
  PID:14360
- C:\Windows\System\GpMfalu.exe
  C:\Windows\System\GpMfalu.exe
  2⤵
  PID:14584
- C:\Windows\System\vndWNBQ.exe
  C:\Windows\System\vndWNBQ.exe
  2⤵
  PID:14620
- C:\Windows\System\FQLBywr.exe
  C:\Windows\System\FQLBywr.exe
  2⤵
  PID:14784
- C:\Windows\System\RAIFtUj.exe
  C:\Windows\System\RAIFtUj.exe
  2⤵
  PID:14700
- C:\Windows\System\jSnxOyi.exe
  C:\Windows\System\jSnxOyi.exe
  2⤵
  PID:15064
- C:\Windows\System\cfJdNfQ.exe
  C:\Windows\System\cfJdNfQ.exe
  2⤵
  PID:14864
- C:\Windows\System\PilVntp.exe
  C:\Windows\System\PilVntp.exe
  2⤵
  PID:14904
- C:\Windows\System\ghkmEaZ.exe
  C:\Windows\System\ghkmEaZ.exe
  2⤵
  PID:15148
- C:\Windows\System\SDnVFWY.exe
  C:\Windows\System\SDnVFWY.exe
  2⤵
  PID:6628
- C:\Windows\System\BsEuxXP.exe
  C:\Windows\System\BsEuxXP.exe
  2⤵
  PID:15352
- C:\Windows\System\jwgPntP.exe
  C:\Windows\System\jwgPntP.exe
  2⤵
  PID:6240
- C:\Windows\System\DQAqmMM.exe
  C:\Windows\System\DQAqmMM.exe
  2⤵
  PID:3768
- C:\Windows\System\QqHhIby.exe
  C:\Windows\System\QqHhIby.exe
  2⤵
  PID:5300
- C:\Windows\System\SFzxNaV.exe
  C:\Windows\System\SFzxNaV.exe
  2⤵
  PID:5980
- C:\Windows\System\ZXHZpGN.exe
  C:\Windows\System\ZXHZpGN.exe
  2⤵
  PID:7968
- C:\Windows\System\gfjBbUf.exe
  C:\Windows\System\gfjBbUf.exe
  2⤵
  PID:6920
- C:\Windows\System\ndHFCjf.exe
  C:\Windows\System\ndHFCjf.exe
  2⤵
  PID:464
- C:\Windows\System\JpHqlBS.exe
  C:\Windows\System\JpHqlBS.exe
  2⤵
  PID:14404
- C:\Windows\System\MtVQalj.exe
  C:\Windows\System\MtVQalj.exe
  2⤵
  PID:7096
- C:\Windows\System\eZHUPpe.exe
  C:\Windows\System\eZHUPpe.exe
  2⤵
  PID:14580
- C:\Windows\System\iZxskZD.exe
  C:\Windows\System\iZxskZD.exe
  2⤵
  PID:14416
- C:\Windows\System\OzYLEUT.exe
  C:\Windows\System\OzYLEUT.exe
  2⤵
  PID:6036
- C:\Windows\System\qcBGOaI.exe
  C:\Windows\System\qcBGOaI.exe
  2⤵
  PID:14760
- C:\Windows\System\pWMHhbJ.exe
  C:\Windows\System\pWMHhbJ.exe
  2⤵
  PID:15104
- C:\Windows\System\xbkgPYQ.exe
  C:\Windows\System\xbkgPYQ.exe
  2⤵
  PID:15080
- C:\Windows\System\tChIGbT.exe
  C:\Windows\System\tChIGbT.exe
  2⤵
  PID:7260
- C:\Windows\System\MOeJkSW.exe
  C:\Windows\System\MOeJkSW.exe
  2⤵
  PID:15120
- C:\Windows\System\yJmZeOm.exe
  C:\Windows\System\yJmZeOm.exe
  2⤵
  PID:15288
- C:\Windows\System\CRPcBVh.exe
  C:\Windows\System\CRPcBVh.exe
  2⤵
  PID:15180
- C:\Windows\System\dvPKkBp.exe
  C:\Windows\System\dvPKkBp.exe
  2⤵
  PID:14980
- C:\Windows\System\YNtBAGH.exe
  C:\Windows\System\YNtBAGH.exe
  2⤵
  PID:6560
- C:\Windows\System\SEEKyHe.exe
  C:\Windows\System\SEEKyHe.exe
  2⤵
  PID:7440
- C:\Windows\System\piDziVw.exe
  C:\Windows\System\piDziVw.exe
  2⤵
  PID:5792
- C:\Windows\System\xoIFIDT.exe
  C:\Windows\System\xoIFIDT.exe
  2⤵
  PID:6720
- C:\Windows\System\cPOFNLO.exe
  C:\Windows\System\cPOFNLO.exe
  2⤵
  PID:15324
- C:\Windows\System\fqwsfYN.exe
  C:\Windows\System\fqwsfYN.exe
  2⤵
  PID:3432
- C:\Windows\System\sigPdvB.exe
  C:\Windows\System\sigPdvB.exe
  2⤵
  PID:15256
- C:\Windows\System\rFIvYdd.exe
  C:\Windows\System\rFIvYdd.exe
  2⤵
  PID:15356
- C:\Windows\System\GhpsQAQ.exe
  C:\Windows\System\GhpsQAQ.exe
  2⤵
  PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:13272

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 2616 -ip 2616
1⤵
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AMNGFKC.exe

Path C:\Windows\System\AMNGFKC.exe
Size 2.2MB
SHA256 b8048f60acabdd38d6eff9cebbc05f9f792acbe45c405a3e7c2e17cae6e78d9f
MD5 8bccbcd5645d229465aff6725881bc39
SHA1 ec18f4d9d6f1a2eaaacbf3cc79ed8d8bbdf1b5e2
SHA512 f46da8536e3109f1036270351c1fe44d9eae84bbb4dd226579289eeed547464dad12db64286776731e65cadb64c4565be6c4dd2fd2d3f80e509b87ec9d5f825d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo7:BemTLkNdfE0pZrV56utgH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AfnKgaT.exe

Path C:\Windows\System\AfnKgaT.exe
Size 2.2MB
SHA256 9c795755bee921469ec38f6f226859f8809bd7c36e1c5ded477a7929cafc5a66
MD5 bc6d3f9b53ddbe12b4826bdca36fa5c5
SHA1 515621b395544de083bd6854d10441ed0a07c76f
SHA512 c79ef4b066fad36d00cbdec299a3ef2089955d4bd1ef5eb288303cd031ebd40333253922f68a19effb94daa66909cb3f94de02efaf0c2a33e43d2cc4da9961de
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo2:BemTLkNdfE0pZrV56utga
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTVVhNZ.exe

Path C:\Windows\System\CTVVhNZ.exe
Size 2.2MB
SHA256 7b8bf636a437ea9b70795e0ee0e7b4c1fd83633e2ef138c91a380165dc9d996e
MD5 de0e9f07221c66a60f7c040b37811cb0
SHA1 0137993cd3f9f4451a56586dfde7330eec7e6ff2
SHA512 f6c0c2935fed6070c051098e44512d4823511a7cb5411c5a63419975c293c4776e1edeac72b3aa826b54c5de181002a94417b2c213cd77b7a877a2d6c43d84d1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoQ:BemTLkNdfE0pZrV56utgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

DbCtoij.exe

Path C:\Windows\System\DbCtoij.exe
Size 2.2MB
SHA256 9f501806e6c0d9de2bd6afe509b51a514db7183e2170cb6081430b044d128397
MD5 11b0902dccfc349f510ae7dde4aabb27
SHA1 01109bc910ae5ae5b692b3849229dfdfb2674572
SHA512 5cd063a3dd822607118aa3315ddad6af29ace4e7c886301d7c6d727b62c00921abb1114d0668b1a7ec44b9591363395884a6c24e1e50bc36f26d677d82c3f4bc
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoL:BemTLkNdfE0pZrV56utg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

KkiTHIZ.exe

Path C:\Windows\System\KkiTHIZ.exe
Size 2.2MB
SHA256 6c58cfed793f8f217c341a2b1f100fe28e0eb4dc15e31f1d18873d484f4b32dd
MD5 2b883cabf182cb452a6424eeeebc09a5
SHA1 5f8fede7f2eb93faa6340b7d7ff61ff3d949c8bd
SHA512 3f4d20264a388653ef641da93ab4b515a722df2643ee25d552642bcb2b921e12c9540ddabab15253de9d1c093aaa08cb0661475ab25e39ac51cf62fac608c52b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPov:BemTLkNdfE0pZrV56utgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

LcuGqVS.exe

Path C:\Windows\System\LcuGqVS.exe
Size 2.2MB
SHA256 f2a350cd2df2fd21b794ae0d0c3f614fc10fa06c7d162c54e5805ef20824cc87
MD5 b8d1d41791f8e1ff5deb27be302fa3ce
SHA1 6d2ea1819d2c3916111dd8630afa34a7d4789190
SHA512 13d04823eed9dbe42ec1d765cf259dddd79e02ee67fb0610be2c16c5f571fa248a5cbb7c985139b85565473d1887f37a462c169531ecf764ad6bc1564959daba
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoD:BemTLkNdfE0pZrV56utgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LefpnEZ.exe

Path C:\Windows\System\LefpnEZ.exe
Size 2.2MB
SHA256 49d6da98c40102c72ef8040559caefbdae139c9e26df222df317b0c701c9ca8e
MD5 cb7fcba7b32e234c50414359ad8d804b
SHA1 1232398fbbc03b174e423199cd700c99810a744c
SHA512 137f1f9ae16acb9c8574c89eed474994d814e9ecd2ebeac6552484b48a27f1623b3b63a992181043c0112b5c68c41718f214d3e5b5c1ab8d69844c7cd1c1a7bb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoj:BemTLkNdfE0pZrV56utg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LzyHDjI.exe

Path C:\Windows\System\LzyHDjI.exe
Size 2.2MB
SHA256 92d0e2f7da38bd85a4b7bc7c11c29faa3738fd6b85a529eaa7ca1e6388981cfb
MD5 b8ccb7f31503877dccdaa9a5420e1495
SHA1 538e6c5b8f4c6e2e801aa12a8aea9686b535ac29
SHA512 2fca936185b3370d113760bc4d48cd280abb4bb499cfcbfc9c385235fa3ace3b989c2125eb9414774a171562144a98375a26700820ca287048fe2407b258cab0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoS:BemTLkNdfE0pZrV56utgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

PIhgmXt.exe

Path C:\Windows\System\PIhgmXt.exe
Size 2.2MB
SHA256 03542310eabe1a82a8ce697a404e2c16ed5c84a67f0f10eadf893436bb70da0b
MD5 83604611bdec18d62518a222f05f0f48
SHA1 31cc89082b60e6a6882888aba37894407d26c042
SHA512 581ddbb3672cc473844e4e759d85e2a8122d8ae780bbbfa222a49d3ffeb4610f95eb18706bf125d23a10460356c1dd7f2fc81684b0ca751df96d4787288865a1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo0:BemTLkNdfE0pZrV56utgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SoiDSfI.exe

Path C:\Windows\System\SoiDSfI.exe
Size 2.2MB
SHA256 9f5e93fda3868433cf0adb7bb4ed9a2f2cb24134c0df448a2f8971c05e9c10c2
MD5 05c09c079750e33ae93740966a985e4a
SHA1 5e2e0b4371e3019e855ad3e8bb8c955dc1bc5848
SHA512 2782a5903db3afef70aa342aca8f5fbe680a7f9efa9083cad094482e94aa336313cf09043003c025178df7cebcae0f6185b9c0f0e4b683e43c8d5020e3dc9760
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoo:BemTLkNdfE0pZrV56utg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

XXEoVyN.exe

Path C:\Windows\System\XXEoVyN.exe
Size 2.2MB
SHA256 72b821431c7d40b8fda7e55e6c09aecbdb6b36199a8579a50ed1160c2a0f9f8b
MD5 b4c7357d7182074c89504f06ed84fce3
SHA1 a33c5c478f7334ca3d0f16b7911bfc5ce9b3d581
SHA512 77d32e6f78b4f3d25ade73f5bd9d476fcb0de033b4d450cd90d5dfd48167ac2d72862ce240ac0474763f46371f5283cc8798a7579be720d4ce0fd36dbc7f114d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoX:BemTLkNdfE0pZrV56utgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxjZUOT.exe

Path C:\Windows\System\XxjZUOT.exe
Size 2.2MB
SHA256 8b1ab8cacbbcb0071542013b3cf42383bf5855ff8d533486c19475bec328936a
MD5 7ae61cea59d4f5e0a218645a717ca1d2
SHA1 fd6e7e1aaa9c8b8114aa147bce472db84feccb2c
SHA512 b6d520a55ce95d50f8e2cfcafce5110d43941bf99972224ef69e9dafa828dca40ec367391d7036fa345d465c19c42e835d6242bc7484ad642deefbc949cf7962
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPor:BemTLkNdfE0pZrV56utgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

aZUFIwf.exe

Path C:\Windows\System\aZUFIwf.exe
Size 2.2MB
SHA256 327fffa87092aec7ce43dee3664b77965950b3112b6dd64c1ecce5c99ff53574
MD5 dda15f5e630b9d25bcfae313617df37f
SHA1 015da1949a9935bfd581b44446c83c0615087f5b
SHA512 f306fb3f5aafeb97decd198ea5872ec85eadc76a32d08eb68aad825e5c39cb2abb7cbc0b831dd0926eda965a70dca339c0fcc36118dca03cb7d47da16c90d188
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoa:BemTLkNdfE0pZrV56utgO
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFXsPzu.exe

Path C:\Windows\System\bFXsPzu.exe
Size 2.2MB
SHA256 49512ef8efb66fc930d301e5af4a3e5d7f5ef753ff97bf712b29032bf33bf473
MD5 aa5d258bba101a4d278f544dbec46d83
SHA1 2ffa8ab09145f370d62e2ecf73b16b6452fc99b7
SHA512 c63356ef81a0bffe7773492c7fb50f13c1cdfe58ced41a2257537ec8f31006753294b215c87cc601a27fb0e38d9edd9e058c0c419cfdaebfaaae3d943f5f8488
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoA:BemTLkNdfE0pZrV56utg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzHQdlg.exe

Path C:\Windows\System\bzHQdlg.exe
Size 2.2MB
SHA256 9a82bbd5d5b73a8b8180e322602b3c054f90602ef7262df6c911ff9bcc8fcbb3
MD5 505ed25a8eb3a1aa228e4f6f48d784b3
SHA1 7edd7be6b3f860bb6c97c6264da410f516467476
SHA512 29cec1ad45df17192759a2c8f63476b689bc46d017b8366dc9c89a2d30322080e01b8269bb53f4bbb10e00e4b9d075bb8be9f6b3c3fb36e404c448d14a436dec
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoF:BemTLkNdfE0pZrV56utg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

dAhUchr.exe

Path C:\Windows\System\dAhUchr.exe
Size 2.2MB
SHA256 e18bc82c92572953a5b2c8c8f3f7eb215c39901366489aa1c7cca29331be1ad1
MD5 a42637b4e18d77436ce6506406788bd7
SHA1 cd235521bc21411dcf3ab8f2feaee597e92d8cbe
SHA512 3e3acb2877da9cb6fc8f0efbec731c2d05659d1c5b51b166930b9ec9561c8c089c3f9e8fce2b920bd6e50d80b16cb2b853364e532ba0f58867e21086f165720c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoM:BemTLkNdfE0pZrV56utg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dELakcO.exe

Path C:\Windows\System\dELakcO.exe
Size 2.2MB
SHA256 b67201ee2bf485ee45090ec0f229361ded7bf0a3a3ba63d8370fa87851b31cee
MD5 691cc3b20d5cf6783c808fc3398822be
SHA1 161727b0e3e81771253efed245de7f5fc20d80d6
SHA512 2e22f59b645840b999fd55b6f7e441d15c17b0c341a814c5022fa94ed5af4df6fa5053cb29af95c85f5cc8f6fac5e9a176f42d0356c405c14872fc0785a055bd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoS:BemTLkNdfE0pZrV56utgO
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXtHMnT.exe

Path C:\Windows\System\eXtHMnT.exe
Size 2.2MB
SHA256 a3f7aa1c5f65c33d594de919d297fe7f9da24411309006307abb32743bb7a90f
MD5 92d6c15a8a4d3daa008c7e43738731d2
SHA1 98282e1179bd4aeccaa80f5ff625fc3157faa421
SHA512 6503436815c2d8c2cc9296e6eb365ab41e5280c1fd933cf56c2c8c2ab2cbc789f5572e961ba5afbdfcdae621159eb17f80fbf50eb33a9fc6ae6ca66a7eece16d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoL:BemTLkNdfE0pZrV56utgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

gQQLeuP.exe

Path C:\Windows\System\gQQLeuP.exe
Size 2.2MB
SHA256 44763f1e085da7880c29b3668e80bd60d6d2c6936753092cf167994f3914ff9b
MD5 0c5ab949840e89cc0369f1892b1bf25e
SHA1 a6b5cf9862c6533c4c3d8de6a60dfe5c633da1ba
SHA512 183505005594263b4f6501a56fb98ef43b9851bdd112720214d3d6890bac81d7b78a798ce67ada3a12b4d0cde3bce31f8ed38799ac84e2e35118fee1a82cbee4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPok:BemTLkNdfE0pZrV56utg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

kJRHUgq.exe

Path C:\Windows\System\kJRHUgq.exe
Size 2.2MB
SHA256 3f22a048dd1c45f83037549cf2a87fcc3c2703a31993c636d9239d13b22dac42
MD5 aa9d9cb5590e83d372bea3fb5e7c70b6
SHA1 811ef00304ac6639899ec68ba0c237ca5480cc78
SHA512 d0602d66f0fa99c0c2e1046a60cda286f3232ef350ba181d63494f9268e45af8bc7753ddd274c5f2bf54961ce636619289c8e705feecaced631ecc6d53f4c056
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo0v:BemTLkNdfE0pZrV56utg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAsfrnA.exe

Path C:\Windows\System\mAsfrnA.exe
Size 2.2MB
SHA256 bf20b6bcb2583a35da874b7fe52b4b39774e80e895a42cd29db395869d9cc12a
MD5 44dc1812cdfd0aeea996180dca340eb7
SHA1 13afac47a5d1fa75678b816a7edf0128bcafcdc6
SHA512 9cd70845940b52d7a2e7c11b75dd85ed4ed5831b725e4f96c059c5bb81c4eb0d2c79ca172be8b09d713af27f286f92cb1285268bde6ba1c6ec37fc46b1393d25
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPos:BemTLkNdfE0pZrV56utgo
MD5 SHA1 SHA512 SSDEEP

Submit Download

psgxnIO.exe

Path C:\Windows\System\psgxnIO.exe
Size 2.2MB
SHA256 88d191e4d4493c95f0d1c622178504534068deeff4db89b7fc68e7d9ca1a937c
MD5 cfcad1c784b140c1e50574d2b5bb7309
SHA1 36cf8c202452ed8cb08f527ae103c6ac5e40a622
SHA512 9e73021480675d5c2d3529393fa25f46aa9d6bcd2f889e3120835f6d813a32db487c5f197ab51459ff3c62564aee5a65c874e8f60571bcf77b9bb3f0e89843f0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo7P:BemTLkNdfE0pZrV56utgH
MD5 SHA1 SHA512 SSDEEP

Submit Download

qFQTWBy.exe

Path C:\Windows\System\qFQTWBy.exe
Size 2.2MB
SHA256 527bf71e3ba2fc18d79fdd7b34dfdc9424e8dfeb31a5b573d7ec7134ab4a279d
MD5 545b826a570d22fe6e62e26a784ec06b
SHA1 082bd950804fbb90faff6836ffb468606dea8dd9
SHA512 ad095e9c4d178325c7e8030a63fc37d8c4c60cc621a6e4f3203cbe6d7d7a14f0534765b61c4d04d406720eb78cc87ac0e1c5a4fd66634e12bacf5436dfb77b41
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPou:BemTLkNdfE0pZrV56utgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

riGxGoc.exe

Path C:\Windows\System\riGxGoc.exe
Size 2.2MB
SHA256 0d094c3ad4a4513653f2ba6fa2781727317d0b8242c91c46e7a7d4c62abc1a50
MD5 0de2899b659dd357b75772f881904675
SHA1 50a0044cda5aa05ba2e045fa4341ec29a2cadf4e
SHA512 80a439feacf7d776c6b166ee6ce90526fe82aab3acdc00afd91a40ae0dbb45de0e4feb017d4e0956e2ec7305a85f6a7b742e5e2b43410387c6633968b9d526b3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo0:BemTLkNdfE0pZrV56utgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqtsXGH.exe

Path C:\Windows\System\sqtsXGH.exe
Size 2.2MB
SHA256 09f3bc9b2799f43aa42116b821b7ad36b82e63bc9ef4315837575379b24e7581
MD5 493055c6f228492ea4961661423f1bc4
SHA1 6835aa7e507f07ffb1780675116f612aa0e39015
SHA512 f834d1d4710afb16742a647adab8bf3334d788c802e60c4335350145967ccec182f7cad31d3bd91b1ba37829ba2f600771c40dc879100adbbf295dadf6b02b30
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPok:BemTLkNdfE0pZrV56utgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

umhMmsH.exe

Path C:\Windows\System\umhMmsH.exe
Size 2.2MB
SHA256 a8166b4f0834dc5f592980f25f53f30064439aca39e0e60a1bfd87807c05843d
MD5 69aab9c068e4341976f576dc4dedd7e8
SHA1 8dbe1713ea7a79c57442281ade9b1c93e336bab6
SHA512 ef00b12fb50a9b989d4ec49e0e303604136b8b10c27b12c9ceb9fb297917dd7931d3f8d39fdd65e212d873df2a00a9460ecb0f9cf547a2444dc7f4bb0bfb7b2e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoY:BemTLkNdfE0pZrV56utgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

vKlCRYm.exe

Path C:\Windows\System\vKlCRYm.exe
Size 2.2MB
SHA256 c6c4341020c6341e73f0ba3b3e94031c27cce076a357b25c04b13393e77138a2
MD5 b174f00011b3429f0c1fddba7718f80c
SHA1 9d8adcc8b1c4eed851d07584492651844aa21a48
SHA512 83b710dac473edefedbde71f7d6af9af9988fa2c00046d02b40ccd686e273cd35da85bbab94e0457b5abd3a2ce8745b90b5893459f8147f1c01c18e82cec8c7c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoa:BemTLkNdfE0pZrV56utgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLjcqCf.exe

Path C:\Windows\System\xLjcqCf.exe
Size 2.2MB
SHA256 809e76bb4b4d0b0bbbccd342681f172a19bcefce264ff5c95fc165d8937b0684
MD5 a96c25b6b3c2792748eb1932f126749c
SHA1 fb8f830690cc43943d8d3aca6922413635e83ef2
SHA512 7f181ba989d45edcb9f36238a1bd44537800d8055ea3a0ae8b11f86bc0961e7d1508751aab0cc453c5735d59a79d475cc9ff705ac3a89b7a4221886ce1581694
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPo1:BemTLkNdfE0pZrV56utgx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xhVlyOC.exe

Path C:\Windows\System\xhVlyOC.exe
Size 2.2MB
SHA256 f2e41c2fe8cb80abdcb28b4435e4684e91c7d5450921fe788902fa06c5ed72c6
MD5 78e09794b9063c131ce5e8c48888ca07
SHA1 89f472a43cd0593728db2647e6976a031b086806
SHA512 0facefa6bd939982fab7f67a8af1c740572af0083de824be0aced1696a1409568b5ce3f5b75c150f91123d61963c60d0352cd021ebe5401882d935b71a75edda
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoA:BemTLkNdfE0pZrV56utg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkBhxiW.exe

Path C:\Windows\System\xkBhxiW.exe
Size 2.2MB
SHA256 2d11bf6f9a8bab2caa1573ad869d8d65725eb86e2af5b28546a7a260cd778c48
MD5 5dc445235b09019f95f75fe247ac2472
SHA1 e8c971190f876217c163a88962a1b2ee6d4ea507
SHA512 153f7ed6c4e4416921c44a4e43d5d5984f32d21575f0a18051f838c1b4771af41bb6685425d7a08811346d7cc894820c7598ee84b5ccfbaab98a79864ef1876d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoE:BemTLkNdfE0pZrV56utgA
MD5 SHA1 SHA512 SSDEEP

Submit Download

yFArIQa.exe

Path C:\Windows\System\yFArIQa.exe
Size 2.2MB
SHA256 4bae2bc84a3ca401c91312e18a306387cf398e9e4a0517ffd527303483f7e2c2
MD5 a032c98d89c4df47139307c03f269234
SHA1 cc2d243cc4225b68d46c0e562f0d3aefa95ae8a0
SHA512 586be9d9cbce5b1362478fe2540dbaf644e34399e1d529e103d9094f86f38260014fd84f2708b2f35b20f7ca2bf20a98e3eec0e4df4208bad157b00d8a31e1ff
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPos:BemTLkNdfE0pZrV56utgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ykXtyZD.exe

Path C:\Windows\System\ykXtyZD.exe
Size 2.2MB
SHA256 ce3d2cfb66366a1813e8bd98140d37c12a99fb3eaa0b4977e1a2434e2aa8e22f
MD5 60726cdd6c6266e4d5295abb40dbe5cf
SHA1 4aad0f2ade86941e6b4ecbec6072c1ae3f1e2ea2
SHA512 4eec8d6e2f70dfb01d12d5923f124a0a650cd623ad6d58883f2aabfb1f9457cdbc0fec990bdb8690b9e9f68a0e67f62c940b18671fd2929cd7f1f183dafeedd5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoh:BemTLkNdfE0pZrV56utgV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/696-1723-0x00007FF648940000-0x00007FF648C94000-memory.dmp

Download

memory/696-14-0x00007FF648940000-0x00007FF648C94000-memory.dmp

Download

memory/1436-2128-0x00007FF7958F0000-0x00007FF795C44000-memory.dmp

Download

memory/1436-74-0x00007FF7958F0000-0x00007FF795C44000-memory.dmp

Download

memory/1564-359-0x00007FF798500000-0x00007FF798854000-memory.dmp

Download

memory/1564-2158-0x00007FF798500000-0x00007FF798854000-memory.dmp

Download

memory/1688-338-0x00007FF7C4B80000-0x00007FF7C4ED4000-memory.dmp

Download

memory/1688-2129-0x00007FF7C4B80000-0x00007FF7C4ED4000-memory.dmp

Download

memory/1768-353-0x00007FF78FE60000-0x00007FF7901B4000-memory.dmp

Download

memory/1768-2148-0x00007FF78FE60000-0x00007FF7901B4000-memory.dmp

Download

memory/1860-358-0x00007FF7FB0C0000-0x00007FF7FB414000-memory.dmp

Download

memory/1860-2159-0x00007FF7FB0C0000-0x00007FF7FB414000-memory.dmp

Download

memory/2008-360-0x00007FF7A4270000-0x00007FF7A45C4000-memory.dmp

Download

memory/2008-2161-0x00007FF7A4270000-0x00007FF7A45C4000-memory.dmp

Download

memory/2084-2130-0x00007FF72B750000-0x00007FF72BAA4000-memory.dmp

Download

memory/2084-342-0x00007FF72B750000-0x00007FF72BAA4000-memory.dmp

Download

memory/2232-2183-0x00007FF6AF300000-0x00007FF6AF654000-memory.dmp

Download

memory/2232-363-0x00007FF6AF300000-0x00007FF6AF654000-memory.dmp

Download

memory/2540-67-0x00007FF6FC4B0000-0x00007FF6FC804000-memory.dmp

Download

memory/2540-2126-0x00007FF6FC4B0000-0x00007FF6FC804000-memory.dmp

Download

memory/2784-2160-0x00007FF637F90000-0x00007FF6382E4000-memory.dmp

Download

memory/2784-361-0x00007FF637F90000-0x00007FF6382E4000-memory.dmp

Download

memory/3048-2162-0x00007FF7CACB0000-0x00007FF7CB004000-memory.dmp

Download

memory/3048-362-0x00007FF7CACB0000-0x00007FF7CB004000-memory.dmp

Download

memory/3056-348-0x00007FF71F990000-0x00007FF71FCE4000-memory.dmp

Download

memory/3056-2135-0x00007FF71F990000-0x00007FF71FCE4000-memory.dmp

Download

memory/3152-56-0x00007FF6323A0000-0x00007FF6326F4000-memory.dmp

Download

memory/3152-0-0x00007FF6323A0000-0x00007FF6326F4000-memory.dmp

Download

memory/3152-1-0x00000244464C0000-0x00000244464D0000-memory.dmp

Download

memory/3224-2103-0x00007FF62AA90000-0x00007FF62ADE4000-memory.dmp

Download

memory/3224-44-0x00007FF62AA90000-0x00007FF62ADE4000-memory.dmp

Download

memory/3332-345-0x00007FF7BAF50000-0x00007FF7BB2A4000-memory.dmp

Download

memory/3332-2134-0x00007FF7BAF50000-0x00007FF7BB2A4000-memory.dmp

Download

memory/3428-2150-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp

Download

memory/3428-357-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp

Download

memory/3528-62-0x00007FF725320000-0x00007FF725674000-memory.dmp

Download

memory/3528-1713-0x00007FF725320000-0x00007FF725674000-memory.dmp

Download

memory/3528-8-0x00007FF725320000-0x00007FF725674000-memory.dmp

Download

memory/3884-2141-0x00007FF785780000-0x00007FF785AD4000-memory.dmp

Download

memory/3884-356-0x00007FF785780000-0x00007FF785AD4000-memory.dmp

Download

memory/4052-71-0x00007FF67CFE0000-0x00007FF67D334000-memory.dmp

Download

memory/4052-2127-0x00007FF67CFE0000-0x00007FF67D334000-memory.dmp

Download

memory/4060-38-0x00007FF7B8DB0000-0x00007FF7B9104000-memory.dmp

Download

memory/4060-2088-0x00007FF7B8DB0000-0x00007FF7B9104000-memory.dmp

Download

memory/4092-351-0x00007FF78A490000-0x00007FF78A7E4000-memory.dmp

Download

memory/4092-2137-0x00007FF78A490000-0x00007FF78A7E4000-memory.dmp

Download

memory/4248-2071-0x00007FF73B910000-0x00007FF73BC64000-memory.dmp

Download

memory/4248-1344-0x00007FF73B910000-0x00007FF73BC64000-memory.dmp

Download

memory/4248-30-0x00007FF73B910000-0x00007FF73BC64000-memory.dmp

Download

memory/4284-339-0x00007FF6303A0000-0x00007FF6306F4000-memory.dmp

Download

memory/4284-2132-0x00007FF6303A0000-0x00007FF6306F4000-memory.dmp

Download

memory/4308-26-0x00007FF6A4020000-0x00007FF6A4374000-memory.dmp

Download

memory/4308-2011-0x00007FF6A4020000-0x00007FF6A4374000-memory.dmp

Download

memory/4780-60-0x00007FF7C8CD0000-0x00007FF7C9024000-memory.dmp

Download

memory/4780-2125-0x00007FF7C8CD0000-0x00007FF7C9024000-memory.dmp

Download

memory/4892-2138-0x00007FF624530000-0x00007FF624884000-memory.dmp

Download

memory/4892-352-0x00007FF624530000-0x00007FF624884000-memory.dmp

Download

memory/5012-355-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp

Download

memory/5012-2146-0x00007FF719DE0000-0x00007FF71A134000-memory.dmp

Download

memory/5044-2120-0x00007FF70C3B0000-0x00007FF70C704000-memory.dmp

Download

memory/5044-52-0x00007FF70C3B0000-0x00007FF70C704000-memory.dmp

Download

memory/5076-1983-0x00007FF6965D0000-0x00007FF696924000-memory.dmp

Download

memory/5076-20-0x00007FF6965D0000-0x00007FF696924000-memory.dmp

Download

memory/5076-333-0x00007FF6965D0000-0x00007FF696924000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads