xmrig | be83d2e3abc30b0321647dc84c20f546a3a219297e1855f10f5b29d1d48b7de0

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
Size 2.1MB
Sample240603-qsdcnahd79
SHA256 be83d2e3abc30b0321647dc84c20f546a3a219297e1855f10f5b29d1d48b7de0
MD5 a507971eeac9e1289408dc50e13a17b0
SHA1 3707f01d98bbf270378bc086adbd2596524d4300
SHA512 d06f0794f892a991acc54f744f14c81a5794c9fa89d6f609e728374efbfe4df920f5d78f12f10b8c2f954ac922d1101a007f709202828ed915e5844fe8f6578a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNq:BemTLkNdfE0pZrV56utgk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5064-0-0x00007FF75A1C0000-0x00007FF75A514000-memory.dmp	xmrig
behavioral2/files/0x0008000000023272-5.dat	xmrig
behavioral2/memory/2016-8-0x00007FF7424B0000-0x00007FF742804000-memory.dmp	xmrig
behavioral2/files/0x0008000000023276-10.dat	xmrig
behavioral2/memory/2672-14-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp	xmrig
behavioral2/files/0x0008000000023277-11.dat	xmrig
behavioral2/memory/1404-20-0x00007FF714000000-0x00007FF714354000-memory.dmp	xmrig
behavioral2/files/0x0008000000023279-22.dat	xmrig
behavioral2/files/0x000800000002327a-29.dat	xmrig
behavioral2/memory/4172-28-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp	xmrig
behavioral2/files/0x000700000002327b-34.dat	xmrig
behavioral2/memory/1904-35-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002327c-37.dat	xmrig
behavioral2/memory/1580-38-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp	xmrig
behavioral2/files/0x000700000002327d-47.dat	xmrig
behavioral2/memory/3700-53-0x00007FF701C20000-0x00007FF701F74000-memory.dmp	xmrig
behavioral2/files/0x000700000002327f-55.dat	xmrig
behavioral2/files/0x000700000002327e-58.dat	xmrig
behavioral2/memory/5064-60-0x00007FF75A1C0000-0x00007FF75A514000-memory.dmp	xmrig
behavioral2/files/0x0007000000023280-67.dat	xmrig
behavioral2/files/0x0007000000023281-72.dat	xmrig
behavioral2/files/0x0007000000023282-77.dat	xmrig
behavioral2/files/0x0007000000023284-84.dat	xmrig
behavioral2/memory/412-86-0x00007FF7F8470000-0x00007FF7F87C4000-memory.dmp	xmrig
behavioral2/memory/2720-89-0x00007FF76C9F0000-0x00007FF76CD44000-memory.dmp	xmrig
behavioral2/memory/2296-88-0x00007FF7A9870000-0x00007FF7A9BC4000-memory.dmp	xmrig
behavioral2/memory/2516-87-0x00007FF61A7D0000-0x00007FF61AB24000-memory.dmp	xmrig
behavioral2/memory/1164-85-0x00007FF7C6AA0000-0x00007FF7C6DF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023283-81.dat	xmrig
behavioral2/memory/3560-61-0x00007FF6D68A0000-0x00007FF6D6BF4000-memory.dmp	xmrig
behavioral2/memory/4476-56-0x00007FF697B60000-0x00007FF697EB4000-memory.dmp	xmrig
behavioral2/memory/2104-43-0x00007FF664120000-0x00007FF664474000-memory.dmp	xmrig
behavioral2/files/0x0007000000023287-102.dat	xmrig
behavioral2/files/0x000700000002328b-116.dat	xmrig
behavioral2/memory/3532-123-0x00007FF6652A0000-0x00007FF6655F4000-memory.dmp	xmrig
behavioral2/memory/2092-130-0x00007FF79D790000-0x00007FF79DAE4000-memory.dmp	xmrig
behavioral2/files/0x000700000002328c-135.dat	xmrig
behavioral2/files/0x000700000002328d-139.dat	xmrig
behavioral2/memory/836-144-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp	xmrig
behavioral2/memory/4172-148-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp	xmrig
behavioral2/memory/4900-150-0x00007FF6FD740000-0x00007FF6FDA94000-memory.dmp	xmrig
behavioral2/memory/1904-152-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002328f-154.dat	xmrig
behavioral2/memory/4292-153-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp	xmrig
behavioral2/memory/4780-151-0x00007FF7639F0000-0x00007FF763D44000-memory.dmp	xmrig
behavioral2/memory/3052-149-0x00007FF6925E0000-0x00007FF692934000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-138.dat	xmrig
behavioral2/memory/1092-136-0x00007FF6EA0E0000-0x00007FF6EA434000-memory.dmp	xmrig
behavioral2/files/0x0007000000023289-133.dat	xmrig
behavioral2/memory/3648-129-0x00007FF63F680000-0x00007FF63F9D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002328a-127.dat	xmrig
behavioral2/files/0x0007000000023288-114.dat	xmrig
behavioral2/memory/1812-113-0x00007FF7E3D00000-0x00007FF7E4054000-memory.dmp	xmrig
behavioral2/files/0x0007000000023285-103.dat	xmrig
behavioral2/memory/2672-98-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp	xmrig
behavioral2/files/0x0007000000023290-160.dat	xmrig
behavioral2/memory/1580-162-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp	xmrig
behavioral2/memory/3676-163-0x00007FF7CC0A0000-0x00007FF7CC3F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023291-165.dat	xmrig
behavioral2/memory/1972-169-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023292-173.dat	xmrig
behavioral2/files/0x0007000000023293-179.dat	xmrig
behavioral2/memory/632-184-0x00007FF771080000-0x00007FF7713D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023294-190.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2016	mmFZAJO.exe
2672	GqZqYnk.exe
1404	URZHqQC.exe
4172	SvPztIj.exe
1904	UJGGWbL.exe
1580	OYmVnJD.exe
2104	AbbAsLr.exe
3700	VrRNifa.exe
4476	IumvVOZ.exe
3560	RITCdto.exe
1164	kXGprIu.exe
412	ffyqPWY.exe
2516	IhyWIeF.exe
2296	QAVZmyf.exe
2720	qvhuiVb.exe
1812	QwZMztc.exe
1092	emPEWaK.exe
836	wwvQLpY.exe
3532	rhlcpoY.exe
3052	AswKqMJ.exe
3648	ZfLdgXj.exe
2092	ImiyWtm.exe
4900	QcpUZwT.exe
4780	yWvgwXb.exe
4292	SARZupS.exe
3676	NRGzynl.exe
1972	glSpcKH.exe
632	EDSHqpd.exe
2768	DfCevkr.exe
4508	oqORwIr.exe
4764	IwGkVbY.exe
2248	tlKJlgc.exe
3996	GLvioiy.exe
4348	tRRfJXD.exe
212	lgZUnfm.exe
4296	kogbNBI.exe
4484	PGbOXgH.exe
4796	pKGdFIb.exe
1400	REhczwe.exe
2960	ccyVdiA.exe
1416	lwogswh.exe
1708	kxIEvAs.exe
1744	QkGlITN.exe
4160	ldCVpUo.exe
4124	XUqeqjW.exe
3984	UZRyvFK.exe
4768	FwolDWw.exe
4776	HjMBiUB.exe
4224	qfaprki.exe
4584	krICXyR.exe
4492	ocIxNHP.exe
3488	SASpoah.exe
1424	wrMiFLY.exe
4164	YYOlGNp.exe
3508	cZGjYzI.exe
912	jSiHRTW.exe
4392	ZTNOZJn.exe
3732	IGQnoLS.exe
3040	THoTBtv.exe
1192	QyqxpYI.exe
1128	UOpAwCj.exe
4644	IGCESxe.exe
2916	EtymDYl.exe
2632	BlEtjJr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5064-0-0x00007FF75A1C0000-0x00007FF75A514000-memory.dmp	upx
behavioral2/files/0x0008000000023272-5.dat	upx
behavioral2/memory/2016-8-0x00007FF7424B0000-0x00007FF742804000-memory.dmp	upx
behavioral2/files/0x0008000000023276-10.dat	upx
behavioral2/memory/2672-14-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp	upx
behavioral2/files/0x0008000000023277-11.dat	upx
behavioral2/memory/1404-20-0x00007FF714000000-0x00007FF714354000-memory.dmp	upx
behavioral2/files/0x0008000000023279-22.dat	upx
behavioral2/files/0x000800000002327a-29.dat	upx
behavioral2/memory/4172-28-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp	upx
behavioral2/files/0x000700000002327b-34.dat	upx
behavioral2/memory/1904-35-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp	upx
behavioral2/files/0x000700000002327c-37.dat	upx
behavioral2/memory/1580-38-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp	upx
behavioral2/files/0x000700000002327d-47.dat	upx
behavioral2/memory/3700-53-0x00007FF701C20000-0x00007FF701F74000-memory.dmp	upx
behavioral2/files/0x000700000002327f-55.dat	upx
behavioral2/files/0x000700000002327e-58.dat	upx
behavioral2/memory/5064-60-0x00007FF75A1C0000-0x00007FF75A514000-memory.dmp	upx
behavioral2/files/0x0007000000023280-67.dat	upx
behavioral2/files/0x0007000000023281-72.dat	upx
behavioral2/files/0x0007000000023282-77.dat	upx
behavioral2/files/0x0007000000023284-84.dat	upx
behavioral2/memory/412-86-0x00007FF7F8470000-0x00007FF7F87C4000-memory.dmp	upx
behavioral2/memory/2720-89-0x00007FF76C9F0000-0x00007FF76CD44000-memory.dmp	upx
behavioral2/memory/2296-88-0x00007FF7A9870000-0x00007FF7A9BC4000-memory.dmp	upx
behavioral2/memory/2516-87-0x00007FF61A7D0000-0x00007FF61AB24000-memory.dmp	upx
behavioral2/memory/1164-85-0x00007FF7C6AA0000-0x00007FF7C6DF4000-memory.dmp	upx
behavioral2/files/0x0007000000023283-81.dat	upx
behavioral2/memory/3560-61-0x00007FF6D68A0000-0x00007FF6D6BF4000-memory.dmp	upx
behavioral2/memory/4476-56-0x00007FF697B60000-0x00007FF697EB4000-memory.dmp	upx
behavioral2/memory/2104-43-0x00007FF664120000-0x00007FF664474000-memory.dmp	upx
behavioral2/files/0x0007000000023287-102.dat	upx
behavioral2/files/0x000700000002328b-116.dat	upx
behavioral2/memory/3532-123-0x00007FF6652A0000-0x00007FF6655F4000-memory.dmp	upx
behavioral2/memory/2092-130-0x00007FF79D790000-0x00007FF79DAE4000-memory.dmp	upx
behavioral2/files/0x000700000002328c-135.dat	upx
behavioral2/files/0x000700000002328d-139.dat	upx
behavioral2/memory/836-144-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp	upx
behavioral2/memory/4172-148-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp	upx
behavioral2/memory/4900-150-0x00007FF6FD740000-0x00007FF6FDA94000-memory.dmp	upx
behavioral2/memory/1904-152-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp	upx
behavioral2/files/0x000700000002328f-154.dat	upx
behavioral2/memory/4292-153-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp	upx
behavioral2/memory/4780-151-0x00007FF7639F0000-0x00007FF763D44000-memory.dmp	upx
behavioral2/memory/3052-149-0x00007FF6925E0000-0x00007FF692934000-memory.dmp	upx
behavioral2/files/0x000700000002328e-138.dat	upx
behavioral2/memory/1092-136-0x00007FF6EA0E0000-0x00007FF6EA434000-memory.dmp	upx
behavioral2/files/0x0007000000023289-133.dat	upx
behavioral2/memory/3648-129-0x00007FF63F680000-0x00007FF63F9D4000-memory.dmp	upx
behavioral2/files/0x000700000002328a-127.dat	upx
behavioral2/files/0x0007000000023288-114.dat	upx
behavioral2/memory/1812-113-0x00007FF7E3D00000-0x00007FF7E4054000-memory.dmp	upx
behavioral2/files/0x0007000000023285-103.dat	upx
behavioral2/memory/2672-98-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp	upx
behavioral2/files/0x0007000000023290-160.dat	upx
behavioral2/memory/1580-162-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp	upx
behavioral2/memory/3676-163-0x00007FF7CC0A0000-0x00007FF7CC3F4000-memory.dmp	upx
behavioral2/files/0x0007000000023291-165.dat	upx
behavioral2/memory/1972-169-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp	upx
behavioral2/files/0x0007000000023292-173.dat	upx
behavioral2/files/0x0007000000023293-179.dat	upx
behavioral2/memory/632-184-0x00007FF771080000-0x00007FF7713D4000-memory.dmp	upx
behavioral2/files/0x0007000000023294-190.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LNvAgVp.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\eTcLqVr.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\UOpAwCj.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\uTCaeVd.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\jtuxoTF.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\mDqtOKf.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\fGHYTdG.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\uNetFSt.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\DmRZWSz.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\twzWKNw.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\ITClJMH.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\ABoVsxH.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\qzjOQwY.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\KpqxPTf.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\qfaprki.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\uIVKvCp.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\SrIrsjz.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\EtRWReE.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\DVxQhZL.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\bcLvUyZ.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\wzpzYaQ.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\JQJCkbz.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\wwvQLpY.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\SARZupS.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\CaxHEya.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\hZmbHix.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\sKfsVJV.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\tUeHMLB.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\itctMKJ.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\XsVvkNz.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\NgjLVHa.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\rXmKBFH.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\YMJXAmi.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\XytBpdz.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\OwaYUhg.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\kioKTSP.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\SKmWHHA.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\fLyDBHP.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\jcWGoJN.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\YYOlGNp.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\NHRPJAE.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\wnkztVI.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\hkmCBOD.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\vFlJcvI.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\AfIswOY.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\iQcqcZg.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\DIFGjDx.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\KjWVbFR.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\rXVEOzr.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\XCPTfzG.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\mNfiUXi.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\jSiHRTW.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\tQpPeif.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\IlTOQTo.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\EcbsrGL.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\nUBeYlz.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\aftFaoJ.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\slywCvM.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZNeKHOc.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\OUjMjAs.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\FvLEzvd.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\MdHtlxD.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\jRqHaKm.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
File created	C:\Windows\System\fzmPGIv.exe	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2016	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	92
PID 5064 wrote to memory of 2016	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	92
PID 5064 wrote to memory of 2672	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	93
PID 5064 wrote to memory of 2672	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	93
PID 5064 wrote to memory of 1404	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	94
PID 5064 wrote to memory of 1404	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	94
PID 5064 wrote to memory of 4172	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	95
PID 5064 wrote to memory of 4172	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	95
PID 5064 wrote to memory of 1904	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	96
PID 5064 wrote to memory of 1904	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	96
PID 5064 wrote to memory of 1580	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	97
PID 5064 wrote to memory of 1580	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	97
PID 5064 wrote to memory of 2104	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	98
PID 5064 wrote to memory of 2104	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	98
PID 5064 wrote to memory of 3700	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	99
PID 5064 wrote to memory of 3700	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	99
PID 5064 wrote to memory of 4476	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	100
PID 5064 wrote to memory of 4476	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	100
PID 5064 wrote to memory of 3560	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	101
PID 5064 wrote to memory of 3560	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	101
PID 5064 wrote to memory of 1164	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	102
PID 5064 wrote to memory of 1164	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	102
PID 5064 wrote to memory of 412	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	103
PID 5064 wrote to memory of 412	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	103
PID 5064 wrote to memory of 2516	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	104
PID 5064 wrote to memory of 2516	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	104
PID 5064 wrote to memory of 2296	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	105
PID 5064 wrote to memory of 2296	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	105
PID 5064 wrote to memory of 2720	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	106
PID 5064 wrote to memory of 2720	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	106
PID 5064 wrote to memory of 1812	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	107
PID 5064 wrote to memory of 1812	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	107
PID 5064 wrote to memory of 1092	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	108
PID 5064 wrote to memory of 1092	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	108
PID 5064 wrote to memory of 836	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	109
PID 5064 wrote to memory of 836	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	109
PID 5064 wrote to memory of 3648	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	110
PID 5064 wrote to memory of 3648	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	110
PID 5064 wrote to memory of 3532	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	111
PID 5064 wrote to memory of 3532	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	111
PID 5064 wrote to memory of 3052	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	112
PID 5064 wrote to memory of 3052	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	112
PID 5064 wrote to memory of 2092	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	113
PID 5064 wrote to memory of 2092	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	113
PID 5064 wrote to memory of 4780	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	114
PID 5064 wrote to memory of 4780	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	114
PID 5064 wrote to memory of 4900	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	115
PID 5064 wrote to memory of 4900	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	115
PID 5064 wrote to memory of 4292	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	116
PID 5064 wrote to memory of 4292	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	116
PID 5064 wrote to memory of 3676	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	117
PID 5064 wrote to memory of 3676	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	117
PID 5064 wrote to memory of 1972	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	118
PID 5064 wrote to memory of 1972	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	118
PID 5064 wrote to memory of 632	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	119
PID 5064 wrote to memory of 632	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	119
PID 5064 wrote to memory of 2768	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	120
PID 5064 wrote to memory of 2768	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	120
PID 5064 wrote to memory of 4508	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	121
PID 5064 wrote to memory of 4508	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	121
PID 5064 wrote to memory of 4764	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	122
PID 5064 wrote to memory of 4764	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	122
PID 5064 wrote to memory of 2248	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	123
PID 5064 wrote to memory of 2248	5064	a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a507971eeac9e1289408dc50e13a17b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\System\mmFZAJO.exe
  C:\Windows\System\mmFZAJO.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\GqZqYnk.exe
  C:\Windows\System\GqZqYnk.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\URZHqQC.exe
  C:\Windows\System\URZHqQC.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\SvPztIj.exe
  C:\Windows\System\SvPztIj.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\UJGGWbL.exe
  C:\Windows\System\UJGGWbL.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\OYmVnJD.exe
  C:\Windows\System\OYmVnJD.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\AbbAsLr.exe
  C:\Windows\System\AbbAsLr.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\VrRNifa.exe
  C:\Windows\System\VrRNifa.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\IumvVOZ.exe
  C:\Windows\System\IumvVOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\RITCdto.exe
  C:\Windows\System\RITCdto.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\kXGprIu.exe
  C:\Windows\System\kXGprIu.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\ffyqPWY.exe
  C:\Windows\System\ffyqPWY.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\IhyWIeF.exe
  C:\Windows\System\IhyWIeF.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\QAVZmyf.exe
  C:\Windows\System\QAVZmyf.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\qvhuiVb.exe
  C:\Windows\System\qvhuiVb.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\QwZMztc.exe
  C:\Windows\System\QwZMztc.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\emPEWaK.exe
  C:\Windows\System\emPEWaK.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\wwvQLpY.exe
  C:\Windows\System\wwvQLpY.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\ZfLdgXj.exe
  C:\Windows\System\ZfLdgXj.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\rhlcpoY.exe
  C:\Windows\System\rhlcpoY.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\AswKqMJ.exe
  C:\Windows\System\AswKqMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ImiyWtm.exe
  C:\Windows\System\ImiyWtm.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\yWvgwXb.exe
  C:\Windows\System\yWvgwXb.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\QcpUZwT.exe
  C:\Windows\System\QcpUZwT.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\SARZupS.exe
  C:\Windows\System\SARZupS.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\NRGzynl.exe
  C:\Windows\System\NRGzynl.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\glSpcKH.exe
  C:\Windows\System\glSpcKH.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\EDSHqpd.exe
  C:\Windows\System\EDSHqpd.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\DfCevkr.exe
  C:\Windows\System\DfCevkr.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\oqORwIr.exe
  C:\Windows\System\oqORwIr.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\IwGkVbY.exe
  C:\Windows\System\IwGkVbY.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\tlKJlgc.exe
  C:\Windows\System\tlKJlgc.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\GLvioiy.exe
  C:\Windows\System\GLvioiy.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\tRRfJXD.exe
  C:\Windows\System\tRRfJXD.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\lgZUnfm.exe
  C:\Windows\System\lgZUnfm.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\kogbNBI.exe
  C:\Windows\System\kogbNBI.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\PGbOXgH.exe
  C:\Windows\System\PGbOXgH.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\pKGdFIb.exe
  C:\Windows\System\pKGdFIb.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\REhczwe.exe
  C:\Windows\System\REhczwe.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\ccyVdiA.exe
  C:\Windows\System\ccyVdiA.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\lwogswh.exe
  C:\Windows\System\lwogswh.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\kxIEvAs.exe
  C:\Windows\System\kxIEvAs.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\QkGlITN.exe
  C:\Windows\System\QkGlITN.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ldCVpUo.exe
  C:\Windows\System\ldCVpUo.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\XUqeqjW.exe
  C:\Windows\System\XUqeqjW.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\UZRyvFK.exe
  C:\Windows\System\UZRyvFK.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\FwolDWw.exe
  C:\Windows\System\FwolDWw.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\HjMBiUB.exe
  C:\Windows\System\HjMBiUB.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\qfaprki.exe
  C:\Windows\System\qfaprki.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\krICXyR.exe
  C:\Windows\System\krICXyR.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\ocIxNHP.exe
  C:\Windows\System\ocIxNHP.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\SASpoah.exe
  C:\Windows\System\SASpoah.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\wrMiFLY.exe
  C:\Windows\System\wrMiFLY.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\YYOlGNp.exe
  C:\Windows\System\YYOlGNp.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\jSiHRTW.exe
  C:\Windows\System\jSiHRTW.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\cZGjYzI.exe
  C:\Windows\System\cZGjYzI.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ZTNOZJn.exe
  C:\Windows\System\ZTNOZJn.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\IGQnoLS.exe
  C:\Windows\System\IGQnoLS.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\THoTBtv.exe
  C:\Windows\System\THoTBtv.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QyqxpYI.exe
  C:\Windows\System\QyqxpYI.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\UOpAwCj.exe
  C:\Windows\System\UOpAwCj.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\IGCESxe.exe
  C:\Windows\System\IGCESxe.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\EtymDYl.exe
  C:\Windows\System\EtymDYl.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\BlEtjJr.exe
  C:\Windows\System\BlEtjJr.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\vQPfctK.exe
  C:\Windows\System\vQPfctK.exe
  2⤵
  PID:3324
- C:\Windows\System\YFmwtgk.exe
  C:\Windows\System\YFmwtgk.exe
  2⤵
  PID:3952
- C:\Windows\System\CdphHgx.exe
  C:\Windows\System\CdphHgx.exe
  2⤵
  PID:1288
- C:\Windows\System\KeBEdQs.exe
  C:\Windows\System\KeBEdQs.exe
  2⤵
  PID:3320
- C:\Windows\System\sbqyiqF.exe
  C:\Windows\System\sbqyiqF.exe
  2⤵
  PID:448
- C:\Windows\System\ypbEyUP.exe
  C:\Windows\System\ypbEyUP.exe
  2⤵
  PID:4312
- C:\Windows\System\Carktyp.exe
  C:\Windows\System\Carktyp.exe
  2⤵
  PID:4532
- C:\Windows\System\lEKlNaz.exe
  C:\Windows\System\lEKlNaz.exe
  2⤵
  PID:4564
- C:\Windows\System\YodWVaF.exe
  C:\Windows\System\YodWVaF.exe
  2⤵
  PID:4788
- C:\Windows\System\XLBMEyz.exe
  C:\Windows\System\XLBMEyz.exe
  2⤵
  PID:1988
- C:\Windows\System\uNetFSt.exe
  C:\Windows\System\uNetFSt.exe
  2⤵
  PID:4440
- C:\Windows\System\qzASzvc.exe
  C:\Windows\System\qzASzvc.exe
  2⤵
  PID:1100
- C:\Windows\System\uIVKvCp.exe
  C:\Windows\System\uIVKvCp.exe
  2⤵
  PID:2136
- C:\Windows\System\uUCsIlK.exe
  C:\Windows\System\uUCsIlK.exe
  2⤵
  PID:4264
- C:\Windows\System\EnbdOyX.exe
  C:\Windows\System\EnbdOyX.exe
  2⤵
  PID:4660
- C:\Windows\System\KUDXVHB.exe
  C:\Windows\System\KUDXVHB.exe
  2⤵
  PID:3152
- C:\Windows\System\SmrfmNn.exe
  C:\Windows\System\SmrfmNn.exe
  2⤵
  PID:5128
- C:\Windows\System\WaJDXan.exe
  C:\Windows\System\WaJDXan.exe
  2⤵
  PID:5164
- C:\Windows\System\ukGPtsU.exe
  C:\Windows\System\ukGPtsU.exe
  2⤵
  PID:5192
- C:\Windows\System\IpHkcMo.exe
  C:\Windows\System\IpHkcMo.exe
  2⤵
  PID:5236
- C:\Windows\System\YMJXAmi.exe
  C:\Windows\System\YMJXAmi.exe
  2⤵
  PID:5252
- C:\Windows\System\iolyCse.exe
  C:\Windows\System\iolyCse.exe
  2⤵
  PID:5280
- C:\Windows\System\eQCGjVf.exe
  C:\Windows\System\eQCGjVf.exe
  2⤵
  PID:5308
- C:\Windows\System\xDnOQRP.exe
  C:\Windows\System\xDnOQRP.exe
  2⤵
  PID:5332
- C:\Windows\System\pJimrtw.exe
  C:\Windows\System\pJimrtw.exe
  2⤵
  PID:5368
- C:\Windows\System\JMtjwwE.exe
  C:\Windows\System\JMtjwwE.exe
  2⤵
  PID:5396
- C:\Windows\System\PHbTCsW.exe
  C:\Windows\System\PHbTCsW.exe
  2⤵
  PID:5424
- C:\Windows\System\uuLJcyk.exe
  C:\Windows\System\uuLJcyk.exe
  2⤵
  PID:5452
- C:\Windows\System\KoeYFza.exe
  C:\Windows\System\KoeYFza.exe
  2⤵
  PID:5480
- C:\Windows\System\ZNeKHOc.exe
  C:\Windows\System\ZNeKHOc.exe
  2⤵
  PID:5508
- C:\Windows\System\IjbQNCp.exe
  C:\Windows\System\IjbQNCp.exe
  2⤵
  PID:5536
- C:\Windows\System\jugFqMk.exe
  C:\Windows\System\jugFqMk.exe
  2⤵
  PID:5564
- C:\Windows\System\CXEonBq.exe
  C:\Windows\System\CXEonBq.exe
  2⤵
  PID:5592
- C:\Windows\System\uDSGPUb.exe
  C:\Windows\System\uDSGPUb.exe
  2⤵
  PID:5620
- C:\Windows\System\SrIrsjz.exe
  C:\Windows\System\SrIrsjz.exe
  2⤵
  PID:5652
- C:\Windows\System\ytEoBkw.exe
  C:\Windows\System\ytEoBkw.exe
  2⤵
  PID:5672
- C:\Windows\System\wttSpqs.exe
  C:\Windows\System\wttSpqs.exe
  2⤵
  PID:5708
- C:\Windows\System\vZuczLi.exe
  C:\Windows\System\vZuczLi.exe
  2⤵
  PID:5736
- C:\Windows\System\WvhGxzK.exe
  C:\Windows\System\WvhGxzK.exe
  2⤵
  PID:5756
- C:\Windows\System\QrebpZV.exe
  C:\Windows\System\QrebpZV.exe
  2⤵
  PID:5780
- C:\Windows\System\lObZVdv.exe
  C:\Windows\System\lObZVdv.exe
  2⤵
  PID:5820
- C:\Windows\System\jtbhHzS.exe
  C:\Windows\System\jtbhHzS.exe
  2⤵
  PID:5844
- C:\Windows\System\XKXQrfu.exe
  C:\Windows\System\XKXQrfu.exe
  2⤵
  PID:5872
- C:\Windows\System\QplHLOi.exe
  C:\Windows\System\QplHLOi.exe
  2⤵
  PID:5900
- C:\Windows\System\RetfmLi.exe
  C:\Windows\System\RetfmLi.exe
  2⤵
  PID:5928
- C:\Windows\System\CVOPKYi.exe
  C:\Windows\System\CVOPKYi.exe
  2⤵
  PID:5952
- C:\Windows\System\iCZkyxM.exe
  C:\Windows\System\iCZkyxM.exe
  2⤵
  PID:5984
- C:\Windows\System\lYrHLkt.exe
  C:\Windows\System\lYrHLkt.exe
  2⤵
  PID:6012
- C:\Windows\System\UpEczde.exe
  C:\Windows\System\UpEczde.exe
  2⤵
  PID:6036
- C:\Windows\System\mklvgaR.exe
  C:\Windows\System\mklvgaR.exe
  2⤵
  PID:6052
- C:\Windows\System\ADCkiYh.exe
  C:\Windows\System\ADCkiYh.exe
  2⤵
  PID:6068
- C:\Windows\System\hBnxCBF.exe
  C:\Windows\System\hBnxCBF.exe
  2⤵
  PID:6088
- C:\Windows\System\oYmaRrr.exe
  C:\Windows\System\oYmaRrr.exe
  2⤵
  PID:6112
- C:\Windows\System\okDNAKB.exe
  C:\Windows\System\okDNAKB.exe
  2⤵
  PID:4268
- C:\Windows\System\nvZPVhk.exe
  C:\Windows\System\nvZPVhk.exe
  2⤵
  PID:5160
- C:\Windows\System\wDfueIA.exe
  C:\Windows\System\wDfueIA.exe
  2⤵
  PID:5208
- C:\Windows\System\BQwpvlf.exe
  C:\Windows\System\BQwpvlf.exe
  2⤵
  PID:5316
- C:\Windows\System\ZuJzNWE.exe
  C:\Windows\System\ZuJzNWE.exe
  2⤵
  PID:5392
- C:\Windows\System\IdDRNVo.exe
  C:\Windows\System\IdDRNVo.exe
  2⤵
  PID:5444
- C:\Windows\System\udryXmg.exe
  C:\Windows\System\udryXmg.exe
  2⤵
  PID:5500
- C:\Windows\System\mmcrHBi.exe
  C:\Windows\System\mmcrHBi.exe
  2⤵
  PID:5576
- C:\Windows\System\hAjwbcY.exe
  C:\Windows\System\hAjwbcY.exe
  2⤵
  PID:5644
- C:\Windows\System\OhpOmRd.exe
  C:\Windows\System\OhpOmRd.exe
  2⤵
  PID:5720
- C:\Windows\System\fgXQijZ.exe
  C:\Windows\System\fgXQijZ.exe
  2⤵
  PID:5768
- C:\Windows\System\dCeZmrd.exe
  C:\Windows\System\dCeZmrd.exe
  2⤵
  PID:5840
- C:\Windows\System\wmaNitI.exe
  C:\Windows\System\wmaNitI.exe
  2⤵
  PID:5920
- C:\Windows\System\eLwWoEO.exe
  C:\Windows\System\eLwWoEO.exe
  2⤵
  PID:5964
- C:\Windows\System\vloNMhE.exe
  C:\Windows\System\vloNMhE.exe
  2⤵
  PID:6044
- C:\Windows\System\DwCReSA.exe
  C:\Windows\System\DwCReSA.exe
  2⤵
  PID:6108
- C:\Windows\System\CaxHEya.exe
  C:\Windows\System\CaxHEya.exe
  2⤵
  PID:5156
- C:\Windows\System\zAAcJlO.exe
  C:\Windows\System\zAAcJlO.exe
  2⤵
  PID:5352
- C:\Windows\System\QOpLNHQ.exe
  C:\Windows\System\QOpLNHQ.exe
  2⤵
  PID:5704
- C:\Windows\System\cZIlSnJ.exe
  C:\Windows\System\cZIlSnJ.exe
  2⤵
  PID:5832
- C:\Windows\System\nJtoyfH.exe
  C:\Windows\System\nJtoyfH.exe
  2⤵
  PID:6060
- C:\Windows\System\SwUnfAB.exe
  C:\Windows\System\SwUnfAB.exe
  2⤵
  PID:6132
- C:\Windows\System\lfzrhWk.exe
  C:\Windows\System\lfzrhWk.exe
  2⤵
  PID:5752
- C:\Windows\System\jdUpnKq.exe
  C:\Windows\System\jdUpnKq.exe
  2⤵
  PID:5888
- C:\Windows\System\YHQodGI.exe
  C:\Windows\System\YHQodGI.exe
  2⤵
  PID:5692
- C:\Windows\System\ucnBDTr.exe
  C:\Windows\System\ucnBDTr.exe
  2⤵
  PID:6156
- C:\Windows\System\quJpoUL.exe
  C:\Windows\System\quJpoUL.exe
  2⤵
  PID:6188
- C:\Windows\System\hKwfsJL.exe
  C:\Windows\System\hKwfsJL.exe
  2⤵
  PID:6216
- C:\Windows\System\rNKeQev.exe
  C:\Windows\System\rNKeQev.exe
  2⤵
  PID:6244
- C:\Windows\System\oGkgHta.exe
  C:\Windows\System\oGkgHta.exe
  2⤵
  PID:6276
- C:\Windows\System\dbWByVX.exe
  C:\Windows\System\dbWByVX.exe
  2⤵
  PID:6304
- C:\Windows\System\RygjBTD.exe
  C:\Windows\System\RygjBTD.exe
  2⤵
  PID:6336
- C:\Windows\System\VvNHQnO.exe
  C:\Windows\System\VvNHQnO.exe
  2⤵
  PID:6364
- C:\Windows\System\DNqtUQW.exe
  C:\Windows\System\DNqtUQW.exe
  2⤵
  PID:6396
- C:\Windows\System\roDGDyQ.exe
  C:\Windows\System\roDGDyQ.exe
  2⤵
  PID:6420
- C:\Windows\System\MmRQiyh.exe
  C:\Windows\System\MmRQiyh.exe
  2⤵
  PID:6464
- C:\Windows\System\jMTyHZh.exe
  C:\Windows\System\jMTyHZh.exe
  2⤵
  PID:6492
- C:\Windows\System\dpTgTdi.exe
  C:\Windows\System\dpTgTdi.exe
  2⤵
  PID:6520
- C:\Windows\System\FaSPoAV.exe
  C:\Windows\System\FaSPoAV.exe
  2⤵
  PID:6560
- C:\Windows\System\rjZJgaz.exe
  C:\Windows\System\rjZJgaz.exe
  2⤵
  PID:6576
- C:\Windows\System\CLogBuI.exe
  C:\Windows\System\CLogBuI.exe
  2⤵
  PID:6604
- C:\Windows\System\QhZQfal.exe
  C:\Windows\System\QhZQfal.exe
  2⤵
  PID:6624
- C:\Windows\System\CyRjPPE.exe
  C:\Windows\System\CyRjPPE.exe
  2⤵
  PID:6656
- C:\Windows\System\BbJvQaZ.exe
  C:\Windows\System\BbJvQaZ.exe
  2⤵
  PID:6684
- C:\Windows\System\KTycMNQ.exe
  C:\Windows\System\KTycMNQ.exe
  2⤵
  PID:6712
- C:\Windows\System\qwjSBXc.exe
  C:\Windows\System\qwjSBXc.exe
  2⤵
  PID:6740
- C:\Windows\System\pepeDEk.exe
  C:\Windows\System\pepeDEk.exe
  2⤵
  PID:6772
- C:\Windows\System\zSOYHKC.exe
  C:\Windows\System\zSOYHKC.exe
  2⤵
  PID:6808
- C:\Windows\System\eryfYLl.exe
  C:\Windows\System\eryfYLl.exe
  2⤵
  PID:6836
- C:\Windows\System\EhuVGUo.exe
  C:\Windows\System\EhuVGUo.exe
  2⤵
  PID:6868
- C:\Windows\System\hFayVmU.exe
  C:\Windows\System\hFayVmU.exe
  2⤵
  PID:6896
- C:\Windows\System\pHDbEEQ.exe
  C:\Windows\System\pHDbEEQ.exe
  2⤵
  PID:6924
- C:\Windows\System\gnxgIOU.exe
  C:\Windows\System\gnxgIOU.exe
  2⤵
  PID:6952
- C:\Windows\System\fCAWzKA.exe
  C:\Windows\System\fCAWzKA.exe
  2⤵
  PID:6980
- C:\Windows\System\TtUpaJs.exe
  C:\Windows\System\TtUpaJs.exe
  2⤵
  PID:7008
- C:\Windows\System\RhDIdzA.exe
  C:\Windows\System\RhDIdzA.exe
  2⤵
  PID:7036
- C:\Windows\System\kEAJEyO.exe
  C:\Windows\System\kEAJEyO.exe
  2⤵
  PID:7064
- C:\Windows\System\uUcUatz.exe
  C:\Windows\System\uUcUatz.exe
  2⤵
  PID:7092
- C:\Windows\System\eTigYIi.exe
  C:\Windows\System\eTigYIi.exe
  2⤵
  PID:7120
- C:\Windows\System\ZOMcAAm.exe
  C:\Windows\System\ZOMcAAm.exe
  2⤵
  PID:7148
- C:\Windows\System\VmmXcZB.exe
  C:\Windows\System\VmmXcZB.exe
  2⤵
  PID:5436
- C:\Windows\System\iQcqcZg.exe
  C:\Windows\System\iQcqcZg.exe
  2⤵
  PID:6184
- C:\Windows\System\oJwazlX.exe
  C:\Windows\System\oJwazlX.exe
  2⤵
  PID:6284
- C:\Windows\System\fKrxJCD.exe
  C:\Windows\System\fKrxJCD.exe
  2⤵
  PID:6332
- C:\Windows\System\EYCeVFt.exe
  C:\Windows\System\EYCeVFt.exe
  2⤵
  PID:6408
- C:\Windows\System\IlGAoBY.exe
  C:\Windows\System\IlGAoBY.exe
  2⤵
  PID:6476
- C:\Windows\System\qXPfddm.exe
  C:\Windows\System\qXPfddm.exe
  2⤵
  PID:6532
- C:\Windows\System\IsjNnbG.exe
  C:\Windows\System\IsjNnbG.exe
  2⤵
  PID:6588
- C:\Windows\System\LvRtOhj.exe
  C:\Windows\System\LvRtOhj.exe
  2⤵
  PID:6680
- C:\Windows\System\agFZZQP.exe
  C:\Windows\System\agFZZQP.exe
  2⤵
  PID:6708
- C:\Windows\System\pUyWYEX.exe
  C:\Windows\System\pUyWYEX.exe
  2⤵
  PID:6788
- C:\Windows\System\GkXFdLX.exe
  C:\Windows\System\GkXFdLX.exe
  2⤵
  PID:6852
- C:\Windows\System\auVwSNa.exe
  C:\Windows\System\auVwSNa.exe
  2⤵
  PID:6916
- C:\Windows\System\UlBfjkl.exe
  C:\Windows\System\UlBfjkl.exe
  2⤵
  PID:7024
- C:\Windows\System\kUiKUNF.exe
  C:\Windows\System\kUiKUNF.exe
  2⤵
  PID:7084
- C:\Windows\System\vkZoFac.exe
  C:\Windows\System\vkZoFac.exe
  2⤵
  PID:5548
- C:\Windows\System\XtCEYyO.exe
  C:\Windows\System\XtCEYyO.exe
  2⤵
  PID:6180
- C:\Windows\System\lmqWhAs.exe
  C:\Windows\System\lmqWhAs.exe
  2⤵
  PID:6348
- C:\Windows\System\AkbPhAf.exe
  C:\Windows\System\AkbPhAf.exe
  2⤵
  PID:6456
- C:\Windows\System\XxFOFsQ.exe
  C:\Windows\System\XxFOFsQ.exe
  2⤵
  PID:6572
- C:\Windows\System\TGUrnpc.exe
  C:\Windows\System\TGUrnpc.exe
  2⤵
  PID:6748
- C:\Windows\System\sSJdeny.exe
  C:\Windows\System\sSJdeny.exe
  2⤵
  PID:6824
- C:\Windows\System\QjQsNJT.exe
  C:\Windows\System\QjQsNJT.exe
  2⤵
  PID:7000
- C:\Windows\System\tTpWOvQ.exe
  C:\Windows\System\tTpWOvQ.exe
  2⤵
  PID:7076
- C:\Windows\System\NHRPJAE.exe
  C:\Windows\System\NHRPJAE.exe
  2⤵
  PID:7144
- C:\Windows\System\ApWwItp.exe
  C:\Windows\System\ApWwItp.exe
  2⤵
  PID:6644
- C:\Windows\System\hjTAeSa.exe
  C:\Windows\System\hjTAeSa.exe
  2⤵
  PID:6948
- C:\Windows\System\qnNrSFM.exe
  C:\Windows\System\qnNrSFM.exe
  2⤵
  PID:6516
- C:\Windows\System\miXcTUt.exe
  C:\Windows\System\miXcTUt.exe
  2⤵
  PID:7180
- C:\Windows\System\IEMdrLx.exe
  C:\Windows\System\IEMdrLx.exe
  2⤵
  PID:7200
- C:\Windows\System\DmRZWSz.exe
  C:\Windows\System\DmRZWSz.exe
  2⤵
  PID:7228
- C:\Windows\System\dqqTlKz.exe
  C:\Windows\System\dqqTlKz.exe
  2⤵
  PID:7260
- C:\Windows\System\OqnPVRk.exe
  C:\Windows\System\OqnPVRk.exe
  2⤵
  PID:7292
- C:\Windows\System\dOhbFxt.exe
  C:\Windows\System\dOhbFxt.exe
  2⤵
  PID:7308
- C:\Windows\System\iWKexNd.exe
  C:\Windows\System\iWKexNd.exe
  2⤵
  PID:7328
- C:\Windows\System\ddnJzDZ.exe
  C:\Windows\System\ddnJzDZ.exe
  2⤵
  PID:7348
- C:\Windows\System\LNvAgVp.exe
  C:\Windows\System\LNvAgVp.exe
  2⤵
  PID:7368
- C:\Windows\System\zKzQvRz.exe
  C:\Windows\System\zKzQvRz.exe
  2⤵
  PID:7392
- C:\Windows\System\gDXFeyi.exe
  C:\Windows\System\gDXFeyi.exe
  2⤵
  PID:7544
- C:\Windows\System\UOJuPpN.exe
  C:\Windows\System\UOJuPpN.exe
  2⤵
  PID:7568
- C:\Windows\System\qeloyOm.exe
  C:\Windows\System\qeloyOm.exe
  2⤵
  PID:7612
- C:\Windows\System\cpPoBGH.exe
  C:\Windows\System\cpPoBGH.exe
  2⤵
  PID:7644
- C:\Windows\System\DcpTtri.exe
  C:\Windows\System\DcpTtri.exe
  2⤵
  PID:7672
- C:\Windows\System\OUjMjAs.exe
  C:\Windows\System\OUjMjAs.exe
  2⤵
  PID:7688
- C:\Windows\System\XBOjBAb.exe
  C:\Windows\System\XBOjBAb.exe
  2⤵
  PID:7716
- C:\Windows\System\UPkSfwA.exe
  C:\Windows\System\UPkSfwA.exe
  2⤵
  PID:7744
- C:\Windows\System\orBIrbq.exe
  C:\Windows\System\orBIrbq.exe
  2⤵
  PID:7772
- C:\Windows\System\hGnyiUD.exe
  C:\Windows\System\hGnyiUD.exe
  2⤵
  PID:7800
- C:\Windows\System\XoFxmFK.exe
  C:\Windows\System\XoFxmFK.exe
  2⤵
  PID:7828
- C:\Windows\System\DWpvGau.exe
  C:\Windows\System\DWpvGau.exe
  2⤵
  PID:7848
- C:\Windows\System\IuXNrVn.exe
  C:\Windows\System\IuXNrVn.exe
  2⤵
  PID:7876
- C:\Windows\System\FJvVRzA.exe
  C:\Windows\System\FJvVRzA.exe
  2⤵
  PID:7912
- C:\Windows\System\spwkWBm.exe
  C:\Windows\System\spwkWBm.exe
  2⤵
  PID:7932
- C:\Windows\System\pLRsFSm.exe
  C:\Windows\System\pLRsFSm.exe
  2⤵
  PID:7960
- C:\Windows\System\hQQhdkz.exe
  C:\Windows\System\hQQhdkz.exe
  2⤵
  PID:7988
- C:\Windows\System\ykNBhEQ.exe
  C:\Windows\System\ykNBhEQ.exe
  2⤵
  PID:8012
- C:\Windows\System\XCmrBhU.exe
  C:\Windows\System\XCmrBhU.exe
  2⤵
  PID:8028
- C:\Windows\System\GkDqfJg.exe
  C:\Windows\System\GkDqfJg.exe
  2⤵
  PID:8056
- C:\Windows\System\eBZNorE.exe
  C:\Windows\System\eBZNorE.exe
  2⤵
  PID:8092
- C:\Windows\System\auoXBKe.exe
  C:\Windows\System\auoXBKe.exe
  2⤵
  PID:8116
- C:\Windows\System\eGIcnMV.exe
  C:\Windows\System\eGIcnMV.exe
  2⤵
  PID:8136
- C:\Windows\System\KaPRJAl.exe
  C:\Windows\System\KaPRJAl.exe
  2⤵
  PID:8172
- C:\Windows\System\BzojILk.exe
  C:\Windows\System\BzojILk.exe
  2⤵
  PID:7164
- C:\Windows\System\TEYETwV.exe
  C:\Windows\System\TEYETwV.exe
  2⤵
  PID:7244
- C:\Windows\System\XytBpdz.exe
  C:\Windows\System\XytBpdz.exe
  2⤵
  PID:7304
- C:\Windows\System\eTcLqVr.exe
  C:\Windows\System\eTcLqVr.exe
  2⤵
  PID:7316
- C:\Windows\System\TaDMJTk.exe
  C:\Windows\System\TaDMJTk.exe
  2⤵
  PID:7384
- C:\Windows\System\IOcOhII.exe
  C:\Windows\System\IOcOhII.exe
  2⤵
  PID:7476
- C:\Windows\System\BwaYwZb.exe
  C:\Windows\System\BwaYwZb.exe
  2⤵
  PID:4996
- C:\Windows\System\cmjBITM.exe
  C:\Windows\System\cmjBITM.exe
  2⤵
  PID:6292
- C:\Windows\System\OwaYUhg.exe
  C:\Windows\System\OwaYUhg.exe
  2⤵
  PID:7680
- C:\Windows\System\AQYWyDw.exe
  C:\Windows\System\AQYWyDw.exe
  2⤵
  PID:7728
- C:\Windows\System\UOIKLoL.exe
  C:\Windows\System\UOIKLoL.exe
  2⤵
  PID:7812
- C:\Windows\System\idCEZvH.exe
  C:\Windows\System\idCEZvH.exe
  2⤵
  PID:7872
- C:\Windows\System\naaAbFJ.exe
  C:\Windows\System\naaAbFJ.exe
  2⤵
  PID:7928
- C:\Windows\System\gPByYGB.exe
  C:\Windows\System\gPByYGB.exe
  2⤵
  PID:8112
- C:\Windows\System\YzoFTDy.exe
  C:\Windows\System\YzoFTDy.exe
  2⤵
  PID:8188
- C:\Windows\System\iVbtWBc.exe
  C:\Windows\System\iVbtWBc.exe
  2⤵
  PID:7172
- C:\Windows\System\KyoGrSB.exe
  C:\Windows\System\KyoGrSB.exe
  2⤵
  PID:7220
- C:\Windows\System\wduknLO.exe
  C:\Windows\System\wduknLO.exe
  2⤵
  PID:7344
- C:\Windows\System\jdgKKWV.exe
  C:\Windows\System\jdgKKWV.exe
  2⤵
  PID:7552
- C:\Windows\System\tLvliHT.exe
  C:\Windows\System\tLvliHT.exe
  2⤵
  PID:7708
- C:\Windows\System\xWIqQIy.exe
  C:\Windows\System\xWIqQIy.exe
  2⤵
  PID:7904
- C:\Windows\System\ZVDzJfy.exe
  C:\Windows\System\ZVDzJfy.exe
  2⤵
  PID:8104
- C:\Windows\System\nClYNKV.exe
  C:\Windows\System\nClYNKV.exe
  2⤵
  PID:1112
- C:\Windows\System\CMkqqmV.exe
  C:\Windows\System\CMkqqmV.exe
  2⤵
  PID:4608
- C:\Windows\System\nwyMVqf.exe
  C:\Windows\System\nwyMVqf.exe
  2⤵
  PID:8088
- C:\Windows\System\pEbmwXZ.exe
  C:\Windows\System\pEbmwXZ.exe
  2⤵
  PID:8200
- C:\Windows\System\ObrwwYL.exe
  C:\Windows\System\ObrwwYL.exe
  2⤵
  PID:8224
- C:\Windows\System\sfnQyuD.exe
  C:\Windows\System\sfnQyuD.exe
  2⤵
  PID:8252
- C:\Windows\System\gygZIsY.exe
  C:\Windows\System\gygZIsY.exe
  2⤵
  PID:8284
- C:\Windows\System\fzmPGIv.exe
  C:\Windows\System\fzmPGIv.exe
  2⤵
  PID:8316
- C:\Windows\System\ZgHlwMB.exe
  C:\Windows\System\ZgHlwMB.exe
  2⤵
  PID:8336
- C:\Windows\System\nfqWdYm.exe
  C:\Windows\System\nfqWdYm.exe
  2⤵
  PID:8368
- C:\Windows\System\ITkgxbg.exe
  C:\Windows\System\ITkgxbg.exe
  2⤵
  PID:8396
- C:\Windows\System\hZmbHix.exe
  C:\Windows\System\hZmbHix.exe
  2⤵
  PID:8416
- C:\Windows\System\ndSSZIm.exe
  C:\Windows\System\ndSSZIm.exe
  2⤵
  PID:8444
- C:\Windows\System\wnNJvxe.exe
  C:\Windows\System\wnNJvxe.exe
  2⤵
  PID:8468
- C:\Windows\System\boXgTti.exe
  C:\Windows\System\boXgTti.exe
  2⤵
  PID:8496
- C:\Windows\System\nWxqhwd.exe
  C:\Windows\System\nWxqhwd.exe
  2⤵
  PID:8524
- C:\Windows\System\iapCWwf.exe
  C:\Windows\System\iapCWwf.exe
  2⤵
  PID:8548
- C:\Windows\System\ovOPhPp.exe
  C:\Windows\System\ovOPhPp.exe
  2⤵
  PID:8580
- C:\Windows\System\PnxXlGl.exe
  C:\Windows\System\PnxXlGl.exe
  2⤵
  PID:8608
- C:\Windows\System\HaSpXld.exe
  C:\Windows\System\HaSpXld.exe
  2⤵
  PID:8632
- C:\Windows\System\AyJAVWA.exe
  C:\Windows\System\AyJAVWA.exe
  2⤵
  PID:8660
- C:\Windows\System\Bjaunnp.exe
  C:\Windows\System\Bjaunnp.exe
  2⤵
  PID:8684
- C:\Windows\System\NjOSWhp.exe
  C:\Windows\System\NjOSWhp.exe
  2⤵
  PID:8712
- C:\Windows\System\AOlmKOL.exe
  C:\Windows\System\AOlmKOL.exe
  2⤵
  PID:8736
- C:\Windows\System\oOVKXfp.exe
  C:\Windows\System\oOVKXfp.exe
  2⤵
  PID:8764
- C:\Windows\System\NIIohHH.exe
  C:\Windows\System\NIIohHH.exe
  2⤵
  PID:8788
- C:\Windows\System\veZkslZ.exe
  C:\Windows\System\veZkslZ.exe
  2⤵
  PID:8816
- C:\Windows\System\BtbKzMg.exe
  C:\Windows\System\BtbKzMg.exe
  2⤵
  PID:8840
- C:\Windows\System\awDswFi.exe
  C:\Windows\System\awDswFi.exe
  2⤵
  PID:8872
- C:\Windows\System\fyaTPxS.exe
  C:\Windows\System\fyaTPxS.exe
  2⤵
  PID:8896
- C:\Windows\System\sKfsVJV.exe
  C:\Windows\System\sKfsVJV.exe
  2⤵
  PID:8928
- C:\Windows\System\MlDQTXk.exe
  C:\Windows\System\MlDQTXk.exe
  2⤵
  PID:8952
- C:\Windows\System\nnvZHAX.exe
  C:\Windows\System\nnvZHAX.exe
  2⤵
  PID:8980
- C:\Windows\System\rdoUKOL.exe
  C:\Windows\System\rdoUKOL.exe
  2⤵
  PID:9008
- C:\Windows\System\SklClND.exe
  C:\Windows\System\SklClND.exe
  2⤵
  PID:9036
- C:\Windows\System\zJLtHVv.exe
  C:\Windows\System\zJLtHVv.exe
  2⤵
  PID:9064
- C:\Windows\System\BfqDOnd.exe
  C:\Windows\System\BfqDOnd.exe
  2⤵
  PID:9092
- C:\Windows\System\vraxPQk.exe
  C:\Windows\System\vraxPQk.exe
  2⤵
  PID:9116
- C:\Windows\System\eELZTVs.exe
  C:\Windows\System\eELZTVs.exe
  2⤵
  PID:9148
- C:\Windows\System\GxYURFW.exe
  C:\Windows\System\GxYURFW.exe
  2⤵
  PID:9172
- C:\Windows\System\BAZDRln.exe
  C:\Windows\System\BAZDRln.exe
  2⤵
  PID:9200
- C:\Windows\System\qDPWqDG.exe
  C:\Windows\System\qDPWqDG.exe
  2⤵
  PID:7360
- C:\Windows\System\ipBiRFn.exe
  C:\Windows\System\ipBiRFn.exe
  2⤵
  PID:8248
- C:\Windows\System\BBWxQLn.exe
  C:\Windows\System\BBWxQLn.exe
  2⤵
  PID:8332
- C:\Windows\System\PAAuakF.exe
  C:\Windows\System\PAAuakF.exe
  2⤵
  PID:8440
- C:\Windows\System\wnkztVI.exe
  C:\Windows\System\wnkztVI.exe
  2⤵
  PID:8272
- C:\Windows\System\yJPquzB.exe
  C:\Windows\System\yJPquzB.exe
  2⤵
  PID:8476
- C:\Windows\System\Lcffdam.exe
  C:\Windows\System\Lcffdam.exe
  2⤵
  PID:8380
- C:\Windows\System\uoMuBLN.exe
  C:\Windows\System\uoMuBLN.exe
  2⤵
  PID:8628
- C:\Windows\System\piqbWaW.exe
  C:\Windows\System\piqbWaW.exe
  2⤵
  PID:8540
- C:\Windows\System\UgYWYZw.exe
  C:\Windows\System\UgYWYZw.exe
  2⤵
  PID:8592
- C:\Windows\System\jbJjqAh.exe
  C:\Windows\System\jbJjqAh.exe
  2⤵
  PID:8652
- C:\Windows\System\nWCdMis.exe
  C:\Windows\System\nWCdMis.exe
  2⤵
  PID:8808
- C:\Windows\System\hkmCBOD.exe
  C:\Windows\System\hkmCBOD.exe
  2⤵
  PID:8860
- C:\Windows\System\hdnuwrm.exe
  C:\Windows\System\hdnuwrm.exe
  2⤵
  PID:8904
- C:\Windows\System\hIGNDnk.exe
  C:\Windows\System\hIGNDnk.exe
  2⤵
  PID:9076
- C:\Windows\System\NIoWCjK.exe
  C:\Windows\System\NIoWCjK.exe
  2⤵
  PID:8972
- C:\Windows\System\tUeHMLB.exe
  C:\Windows\System\tUeHMLB.exe
  2⤵
  PID:9160
- C:\Windows\System\DewpqaT.exe
  C:\Windows\System\DewpqaT.exe
  2⤵
  PID:9196
- C:\Windows\System\WCRgvue.exe
  C:\Windows\System\WCRgvue.exe
  2⤵
  PID:9108
- C:\Windows\System\irWfouh.exe
  C:\Windows\System\irWfouh.exe
  2⤵
  PID:8216
- C:\Windows\System\kioKTSP.exe
  C:\Windows\System\kioKTSP.exe
  2⤵
  PID:8388
- C:\Windows\System\HwCmBOL.exe
  C:\Windows\System\HwCmBOL.exe
  2⤵
  PID:8132
- C:\Windows\System\KaFVuFA.exe
  C:\Windows\System\KaFVuFA.exe
  2⤵
  PID:9060
- C:\Windows\System\AZKNsoB.exe
  C:\Windows\System\AZKNsoB.exe
  2⤵
  PID:9232
- C:\Windows\System\IaQlonE.exe
  C:\Windows\System\IaQlonE.exe
  2⤵
  PID:9264
- C:\Windows\System\vwvTBfc.exe
  C:\Windows\System\vwvTBfc.exe
  2⤵
  PID:9288
- C:\Windows\System\qkyEQmu.exe
  C:\Windows\System\qkyEQmu.exe
  2⤵
  PID:9316
- C:\Windows\System\cBVknFO.exe
  C:\Windows\System\cBVknFO.exe
  2⤵
  PID:9352
- C:\Windows\System\mLrCYiK.exe
  C:\Windows\System\mLrCYiK.exe
  2⤵
  PID:9380
- C:\Windows\System\kJCsNvR.exe
  C:\Windows\System\kJCsNvR.exe
  2⤵
  PID:9408
- C:\Windows\System\KNuCmnv.exe
  C:\Windows\System\KNuCmnv.exe
  2⤵
  PID:9428
- C:\Windows\System\zOFHuBh.exe
  C:\Windows\System\zOFHuBh.exe
  2⤵
  PID:9452
- C:\Windows\System\ZiJopqH.exe
  C:\Windows\System\ZiJopqH.exe
  2⤵
  PID:9476
- C:\Windows\System\imrRMbq.exe
  C:\Windows\System\imrRMbq.exe
  2⤵
  PID:9504
- C:\Windows\System\ZjWRELD.exe
  C:\Windows\System\ZjWRELD.exe
  2⤵
  PID:9524
- C:\Windows\System\ChcEGvV.exe
  C:\Windows\System\ChcEGvV.exe
  2⤵
  PID:9556
- C:\Windows\System\ZisyCRT.exe
  C:\Windows\System\ZisyCRT.exe
  2⤵
  PID:9580
- C:\Windows\System\smRzGQi.exe
  C:\Windows\System\smRzGQi.exe
  2⤵
  PID:9604
- C:\Windows\System\zUaRwgS.exe
  C:\Windows\System\zUaRwgS.exe
  2⤵
  PID:9628
- C:\Windows\System\QctoWNI.exe
  C:\Windows\System\QctoWNI.exe
  2⤵
  PID:9656
- C:\Windows\System\gHZAYnV.exe
  C:\Windows\System\gHZAYnV.exe
  2⤵
  PID:9684
- C:\Windows\System\ttHLsiV.exe
  C:\Windows\System\ttHLsiV.exe
  2⤵
  PID:9708
- C:\Windows\System\vFlJcvI.exe
  C:\Windows\System\vFlJcvI.exe
  2⤵
  PID:9736
- C:\Windows\System\wzpzYaQ.exe
  C:\Windows\System\wzpzYaQ.exe
  2⤵
  PID:9764
- C:\Windows\System\VvInpTV.exe
  C:\Windows\System\VvInpTV.exe
  2⤵
  PID:9792
- C:\Windows\System\wQjnIEo.exe
  C:\Windows\System\wQjnIEo.exe
  2⤵
  PID:9816
- C:\Windows\System\jKSrFka.exe
  C:\Windows\System\jKSrFka.exe
  2⤵
  PID:9848
- C:\Windows\System\iPWGUTm.exe
  C:\Windows\System\iPWGUTm.exe
  2⤵
  PID:9876
- C:\Windows\System\VVpTikg.exe
  C:\Windows\System\VVpTikg.exe
  2⤵
  PID:9904
- C:\Windows\System\VmviVMC.exe
  C:\Windows\System\VmviVMC.exe
  2⤵
  PID:9928
- C:\Windows\System\twzWKNw.exe
  C:\Windows\System\twzWKNw.exe
  2⤵
  PID:9948
- C:\Windows\System\UYMaGBC.exe
  C:\Windows\System\UYMaGBC.exe
  2⤵
  PID:9980
- C:\Windows\System\ITClJMH.exe
  C:\Windows\System\ITClJMH.exe
  2⤵
  PID:10004
- C:\Windows\System\bWDwpRp.exe
  C:\Windows\System\bWDwpRp.exe
  2⤵
  PID:10032
- C:\Windows\System\uLdOFLx.exe
  C:\Windows\System\uLdOFLx.exe
  2⤵
  PID:10056
- C:\Windows\System\GoTeeeT.exe
  C:\Windows\System\GoTeeeT.exe
  2⤵
  PID:10088
- C:\Windows\System\YOFYpUT.exe
  C:\Windows\System\YOFYpUT.exe
  2⤵
  PID:10120
- C:\Windows\System\uTCaeVd.exe
  C:\Windows\System\uTCaeVd.exe
  2⤵
  PID:10144
- C:\Windows\System\rRroEZW.exe
  C:\Windows\System\rRroEZW.exe
  2⤵
  PID:10176
- C:\Windows\System\sexjfFL.exe
  C:\Windows\System\sexjfFL.exe
  2⤵
  PID:10204
- C:\Windows\System\TgbGrOu.exe
  C:\Windows\System\TgbGrOu.exe
  2⤵
  PID:10228
- C:\Windows\System\tvyxpWm.exe
  C:\Windows\System\tvyxpWm.exe
  2⤵
  PID:8512
- C:\Windows\System\MdcQJjT.exe
  C:\Windows\System\MdcQJjT.exe
  2⤵
  PID:8676
- C:\Windows\System\HCvbxfw.exe
  C:\Windows\System\HCvbxfw.exe
  2⤵
  PID:9260
- C:\Windows\System\nIBMRdi.exe
  C:\Windows\System\nIBMRdi.exe
  2⤵
  PID:8568
- C:\Windows\System\qtKqWEs.exe
  C:\Windows\System\qtKqWEs.exe
  2⤵
  PID:8996
- C:\Windows\System\bJRrQKQ.exe
  C:\Windows\System\bJRrQKQ.exe
  2⤵
  PID:9004
- C:\Windows\System\tjCVHKB.exe
  C:\Windows\System\tjCVHKB.exe
  2⤵
  PID:9416
- C:\Windows\System\sdbtbMi.exe
  C:\Windows\System\sdbtbMi.exe
  2⤵
  PID:7176
- C:\Windows\System\KBfNVgl.exe
  C:\Windows\System\KBfNVgl.exe
  2⤵
  PID:9280
- C:\Windows\System\UzuphsZ.exe
  C:\Windows\System\UzuphsZ.exe
  2⤵
  PID:9536
- C:\Windows\System\mbOgFSJ.exe
  C:\Windows\System\mbOgFSJ.exe
  2⤵
  PID:9552
- C:\Windows\System\SKmWHHA.exe
  C:\Windows\System\SKmWHHA.exe
  2⤵
  PID:9700
- C:\Windows\System\EkSMfRh.exe
  C:\Windows\System\EkSMfRh.exe
  2⤵
  PID:9568
- C:\Windows\System\PfolNet.exe
  C:\Windows\System\PfolNet.exe
  2⤵
  PID:9624
- C:\Windows\System\MgPXpLW.exe
  C:\Windows\System\MgPXpLW.exe
  2⤵
  PID:9892
- C:\Windows\System\uoGOhEd.exe
  C:\Windows\System\uoGOhEd.exe
  2⤵
  PID:9808
- C:\Windows\System\UaChwfD.exe
  C:\Windows\System\UaChwfD.exe
  2⤵
  PID:10080
- C:\Windows\System\vbrvqBQ.exe
  C:\Windows\System\vbrvqBQ.exe
  2⤵
  PID:10136
- C:\Windows\System\DJdgkox.exe
  C:\Windows\System\DJdgkox.exe
  2⤵
  PID:736
- C:\Windows\System\zjyyjfq.exe
  C:\Windows\System\zjyyjfq.exe
  2⤵
  PID:9940
- C:\Windows\System\BDEepqS.exe
  C:\Windows\System\BDEepqS.exe
  2⤵
  PID:10020
- C:\Windows\System\MusNBeS.exe
  C:\Windows\System\MusNBeS.exe
  2⤵
  PID:9836
- C:\Windows\System\yvbWuOO.exe
  C:\Windows\System\yvbWuOO.exe
  2⤵
  PID:10140
- C:\Windows\System\MOXZYEx.exe
  C:\Windows\System\MOXZYEx.exe
  2⤵
  PID:8276
- C:\Windows\System\UdBuIKY.exe
  C:\Windows\System\UdBuIKY.exe
  2⤵
  PID:8668
- C:\Windows\System\AFNjiSw.exe
  C:\Windows\System\AFNjiSw.exe
  2⤵
  PID:9492
- C:\Windows\System\VchLmsJ.exe
  C:\Windows\System\VchLmsJ.exe
  2⤵
  PID:10300
- C:\Windows\System\ZbGroBN.exe
  C:\Windows\System\ZbGroBN.exe
  2⤵
  PID:10332
- C:\Windows\System\SNngGcS.exe
  C:\Windows\System\SNngGcS.exe
  2⤵
  PID:10384
- C:\Windows\System\rkCGuCS.exe
  C:\Windows\System\rkCGuCS.exe
  2⤵
  PID:10424
- C:\Windows\System\ttWfjkG.exe
  C:\Windows\System\ttWfjkG.exe
  2⤵
  PID:10452
- C:\Windows\System\OdimuPy.exe
  C:\Windows\System\OdimuPy.exe
  2⤵
  PID:10476
- C:\Windows\System\vcieogW.exe
  C:\Windows\System\vcieogW.exe
  2⤵
  PID:10504
- C:\Windows\System\PUFjOJF.exe
  C:\Windows\System\PUFjOJF.exe
  2⤵
  PID:10524
- C:\Windows\System\isnBDcI.exe
  C:\Windows\System\isnBDcI.exe
  2⤵
  PID:10632
- C:\Windows\System\IRxqXbr.exe
  C:\Windows\System\IRxqXbr.exe
  2⤵
  PID:10648
- C:\Windows\System\mLdRrjl.exe
  C:\Windows\System\mLdRrjl.exe
  2⤵
  PID:10672
- C:\Windows\System\RGsPCFT.exe
  C:\Windows\System\RGsPCFT.exe
  2⤵
  PID:10712
- C:\Windows\System\vPqprpN.exe
  C:\Windows\System\vPqprpN.exe
  2⤵
  PID:10728
- C:\Windows\System\VXrCUQG.exe
  C:\Windows\System\VXrCUQG.exe
  2⤵
  PID:10744
- C:\Windows\System\ubtqwIp.exe
  C:\Windows\System\ubtqwIp.exe
  2⤵
  PID:10772
- C:\Windows\System\doqbePs.exe
  C:\Windows\System\doqbePs.exe
  2⤵
  PID:10788
- C:\Windows\System\TlSTBTk.exe
  C:\Windows\System\TlSTBTk.exe
  2⤵
  PID:10804
- C:\Windows\System\JbppWlM.exe
  C:\Windows\System\JbppWlM.exe
  2⤵
  PID:10824
- C:\Windows\System\ABoVsxH.exe
  C:\Windows\System\ABoVsxH.exe
  2⤵
  PID:10856
- C:\Windows\System\HsoNsKR.exe
  C:\Windows\System\HsoNsKR.exe
  2⤵
  PID:10884
- C:\Windows\System\viYQwqR.exe
  C:\Windows\System\viYQwqR.exe
  2⤵
  PID:10904
- C:\Windows\System\DIFGjDx.exe
  C:\Windows\System\DIFGjDx.exe
  2⤵
  PID:10920
- C:\Windows\System\CKOQEUS.exe
  C:\Windows\System\CKOQEUS.exe
  2⤵
  PID:10996
- C:\Windows\System\ZYpaIpb.exe
  C:\Windows\System\ZYpaIpb.exe
  2⤵
  PID:11016
- C:\Windows\System\DDsOmCW.exe
  C:\Windows\System\DDsOmCW.exe
  2⤵
  PID:11036
- C:\Windows\System\imDCozk.exe
  C:\Windows\System\imDCozk.exe
  2⤵
  PID:11076
- C:\Windows\System\tQpPeif.exe
  C:\Windows\System\tQpPeif.exe
  2⤵
  PID:11096
- C:\Windows\System\tyVbYow.exe
  C:\Windows\System\tyVbYow.exe
  2⤵
  PID:11124
- C:\Windows\System\sflyEUQ.exe
  C:\Windows\System\sflyEUQ.exe
  2⤵
  PID:11148
- C:\Windows\System\IyZaiGJ.exe
  C:\Windows\System\IyZaiGJ.exe
  2⤵
  PID:11176
- C:\Windows\System\ylxsDYq.exe
  C:\Windows\System\ylxsDYq.exe
  2⤵
  PID:11196
- C:\Windows\System\BjfTwak.exe
  C:\Windows\System\BjfTwak.exe
  2⤵
  PID:11220
- C:\Windows\System\lxMcXwy.exe
  C:\Windows\System\lxMcXwy.exe
  2⤵
  PID:11236
- C:\Windows\System\WzfBOvG.exe
  C:\Windows\System\WzfBOvG.exe
  2⤵
  PID:11260
- C:\Windows\System\AjiQeKI.exe
  C:\Windows\System\AjiQeKI.exe
  2⤵
  PID:10196
- C:\Windows\System\AJXdUCT.exe
  C:\Windows\System\AJXdUCT.exe
  2⤵
  PID:4364
- C:\Windows\System\OiIRJCu.exe
  C:\Windows\System\OiIRJCu.exe
  2⤵
  PID:10360
- C:\Windows\System\szgyHkp.exe
  C:\Windows\System\szgyHkp.exe
  2⤵
  PID:9496
- C:\Windows\System\hVinlro.exe
  C:\Windows\System\hVinlro.exe
  2⤵
  PID:10344
- C:\Windows\System\gzqfZVF.exe
  C:\Windows\System\gzqfZVF.exe
  2⤵
  PID:10324
- C:\Windows\System\CMGAWzE.exe
  C:\Windows\System\CMGAWzE.exe
  2⤵
  PID:10380
- C:\Windows\System\bBgKKEx.exe
  C:\Windows\System\bBgKKEx.exe
  2⤵
  PID:10420
- C:\Windows\System\XvhGYqd.exe
  C:\Windows\System\XvhGYqd.exe
  2⤵
  PID:10532
- C:\Windows\System\llpxOkw.exe
  C:\Windows\System\llpxOkw.exe
  2⤵
  PID:10492
- C:\Windows\System\GYPUggW.exe
  C:\Windows\System\GYPUggW.exe
  2⤵
  PID:10724
- C:\Windows\System\XRFJhoN.exe
  C:\Windows\System\XRFJhoN.exe
  2⤵
  PID:10768
- C:\Windows\System\NkBlpvg.exe
  C:\Windows\System\NkBlpvg.exe
  2⤵
  PID:10692
- C:\Windows\System\PMzDWdm.exe
  C:\Windows\System\PMzDWdm.exe
  2⤵
  PID:10720
- C:\Windows\System\jtBcKIh.exe
  C:\Windows\System\jtBcKIh.exe
  2⤵
  PID:2980
- C:\Windows\System\bmzVBqZ.exe
  C:\Windows\System\bmzVBqZ.exe
  2⤵
  PID:10780
- C:\Windows\System\znSgusr.exe
  C:\Windows\System\znSgusr.exe
  2⤵
  PID:10916
- C:\Windows\System\jikkyXw.exe
  C:\Windows\System\jikkyXw.exe
  2⤵
  PID:10936
- C:\Windows\System\EsvYjBJ.exe
  C:\Windows\System\EsvYjBJ.exe
  2⤵
  PID:11056
- C:\Windows\System\JqgcBOQ.exe
  C:\Windows\System\JqgcBOQ.exe
  2⤵
  PID:11108
- C:\Windows\System\LgBchMu.exe
  C:\Windows\System\LgBchMu.exe
  2⤵
  PID:11024
- C:\Windows\System\UYqbhOS.exe
  C:\Windows\System\UYqbhOS.exe
  2⤵
  PID:10412
- C:\Windows\System\cefjjMf.exe
  C:\Windows\System\cefjjMf.exe
  2⤵
  PID:10684
- C:\Windows\System\eavOhxa.exe
  C:\Windows\System\eavOhxa.exe
  2⤵
  PID:10840
- C:\Windows\System\mWwOoOl.exe
  C:\Windows\System\mWwOoOl.exe
  2⤵
  PID:10512
- C:\Windows\System\ieIKZIV.exe
  C:\Windows\System\ieIKZIV.exe
  2⤵
  PID:11272
- C:\Windows\System\xIrrkBk.exe
  C:\Windows\System\xIrrkBk.exe
  2⤵
  PID:11288
- C:\Windows\System\fwmUGCb.exe
  C:\Windows\System\fwmUGCb.exe
  2⤵
  PID:11320
- C:\Windows\System\xeCyCzX.exe
  C:\Windows\System\xeCyCzX.exe
  2⤵
  PID:11336
- C:\Windows\System\hJUvGUF.exe
  C:\Windows\System\hJUvGUF.exe
  2⤵
  PID:11372
- C:\Windows\System\aPoWGeT.exe
  C:\Windows\System\aPoWGeT.exe
  2⤵
  PID:11396
- C:\Windows\System\XAonSZC.exe
  C:\Windows\System\XAonSZC.exe
  2⤵
  PID:11424
- C:\Windows\System\DUSXagF.exe
  C:\Windows\System\DUSXagF.exe
  2⤵
  PID:11440
- C:\Windows\System\QgTtKYB.exe
  C:\Windows\System\QgTtKYB.exe
  2⤵
  PID:11464
- C:\Windows\System\oWaoOTQ.exe
  C:\Windows\System\oWaoOTQ.exe
  2⤵
  PID:11488
- C:\Windows\System\EtRWReE.exe
  C:\Windows\System\EtRWReE.exe
  2⤵
  PID:11512
- C:\Windows\System\ryXuknB.exe
  C:\Windows\System\ryXuknB.exe
  2⤵
  PID:11544
- C:\Windows\System\utHjyvE.exe
  C:\Windows\System\utHjyvE.exe
  2⤵
  PID:11564
- C:\Windows\System\kVnEmQJ.exe
  C:\Windows\System\kVnEmQJ.exe
  2⤵
  PID:11588
- C:\Windows\System\KjWVbFR.exe
  C:\Windows\System\KjWVbFR.exe
  2⤵
  PID:11612
- C:\Windows\System\UZycbvV.exe
  C:\Windows\System\UZycbvV.exe
  2⤵
  PID:11632
- C:\Windows\System\hkuxjaL.exe
  C:\Windows\System\hkuxjaL.exe
  2⤵
  PID:11660
- C:\Windows\System\mTHJoTP.exe
  C:\Windows\System\mTHJoTP.exe
  2⤵
  PID:11676
- C:\Windows\System\CCwoLLR.exe
  C:\Windows\System\CCwoLLR.exe
  2⤵
  PID:11708
- C:\Windows\System\PotWEuc.exe
  C:\Windows\System\PotWEuc.exe
  2⤵
  PID:11736
- C:\Windows\System\FKtEoGz.exe
  C:\Windows\System\FKtEoGz.exe
  2⤵
  PID:11756
- C:\Windows\System\alEDpXo.exe
  C:\Windows\System\alEDpXo.exe
  2⤵
  PID:11776
- C:\Windows\System\GbrqKMb.exe
  C:\Windows\System\GbrqKMb.exe
  2⤵
  PID:11800
- C:\Windows\System\lqUfvAZ.exe
  C:\Windows\System\lqUfvAZ.exe
  2⤵
  PID:11828
- C:\Windows\System\DnVyqIW.exe
  C:\Windows\System\DnVyqIW.exe
  2⤵
  PID:11844
- C:\Windows\System\TzxIjFb.exe
  C:\Windows\System\TzxIjFb.exe
  2⤵
  PID:11868
- C:\Windows\System\rXVEOzr.exe
  C:\Windows\System\rXVEOzr.exe
  2⤵
  PID:11888
- C:\Windows\System\tDyObmP.exe
  C:\Windows\System\tDyObmP.exe
  2⤵
  PID:11912
- C:\Windows\System\NTUkHmF.exe
  C:\Windows\System\NTUkHmF.exe
  2⤵
  PID:11936
- C:\Windows\System\NwLHiOG.exe
  C:\Windows\System\NwLHiOG.exe
  2⤵
  PID:11956
- C:\Windows\System\HajyVTc.exe
  C:\Windows\System\HajyVTc.exe
  2⤵
  PID:2004
- C:\Windows\System\nQZmgMp.exe
  C:\Windows\System\nQZmgMp.exe
  2⤵
  PID:10836
- C:\Windows\System\VwAFDZK.exe
  C:\Windows\System\VwAFDZK.exe
  2⤵
  PID:11340
- C:\Windows\System\aboBCrv.exe
  C:\Windows\System\aboBCrv.exe
  2⤵
  PID:11156
- C:\Windows\System\qzjOQwY.exe
  C:\Windows\System\qzjOQwY.exe
  2⤵
  PID:11484
- C:\Windows\System\egwpgIN.exe
  C:\Windows\System\egwpgIN.exe
  2⤵
  PID:11284
- C:\Windows\System\TMcmSmP.exe
  C:\Windows\System\TMcmSmP.exe
  2⤵
  PID:11536
- C:\Windows\System\ABebiZc.exe
  C:\Windows\System\ABebiZc.exe
  2⤵
  PID:11580
- C:\Windows\System\MsCnhXc.exe
  C:\Windows\System\MsCnhXc.exe
  2⤵
  PID:11644
- C:\Windows\System\YollHBX.exe
  C:\Windows\System\YollHBX.exe
  2⤵
  PID:11700
- C:\Windows\System\BVpuJEg.exe
  C:\Windows\System\BVpuJEg.exe
  2⤵
  PID:11356
- C:\Windows\System\uspCeDy.exe
  C:\Windows\System\uspCeDy.exe
  2⤵
  PID:11768
- C:\Windows\System\bLoRvqw.exe
  C:\Windows\System\bLoRvqw.exe
  2⤵
  PID:11788
- C:\Windows\System\FvLEzvd.exe
  C:\Windows\System\FvLEzvd.exe
  2⤵
  PID:11924
- C:\Windows\System\LLkYhfY.exe
  C:\Windows\System\LLkYhfY.exe
  2⤵
  PID:12088
- C:\Windows\System\hlGNewf.exe
  C:\Windows\System\hlGNewf.exe
  2⤵
  PID:12072
- C:\Windows\System\MdHtlxD.exe
  C:\Windows\System\MdHtlxD.exe
  2⤵
  PID:12128
- C:\Windows\System\uWrYNfY.exe
  C:\Windows\System\uWrYNfY.exe
  2⤵
  PID:7388
- C:\Windows\System\LpeYKrY.exe
  C:\Windows\System\LpeYKrY.exe
  2⤵
  PID:11204
- C:\Windows\System\kmYAJyU.exe
  C:\Windows\System\kmYAJyU.exe
  2⤵
  PID:10708
- C:\Windows\System\faCtsey.exe
  C:\Windows\System\faCtsey.exe
  2⤵
  PID:2308
- C:\Windows\System\RvVFwQO.exe
  C:\Windows\System\RvVFwQO.exe
  2⤵
  PID:10628
- C:\Windows\System\MvQveur.exe
  C:\Windows\System\MvQveur.exe
  2⤵
  PID:9780
- C:\Windows\System\swSMSzE.exe
  C:\Windows\System\swSMSzE.exe
  2⤵
  PID:11576
- C:\Windows\System\kqxFOuV.exe
  C:\Windows\System\kqxFOuV.exe
  2⤵
  PID:11412
- C:\Windows\System\zvKeCLK.exe
  C:\Windows\System\zvKeCLK.exe
  2⤵
  PID:10292
- C:\Windows\System\XsVvkNz.exe
  C:\Windows\System\XsVvkNz.exe
  2⤵
  PID:11528
- C:\Windows\System\xByowiO.exe
  C:\Windows\System\xByowiO.exe
  2⤵
  PID:11900
- C:\Windows\System\OeySJbM.exe
  C:\Windows\System\OeySJbM.exe
  2⤵
  PID:11744
- C:\Windows\System\ehmgtjt.exe
  C:\Windows\System\ehmgtjt.exe
  2⤵
  PID:11968
- C:\Windows\System\zyIiIGA.exe
  C:\Windows\System\zyIiIGA.exe
  2⤵
  PID:12220
- C:\Windows\System\qGGapMc.exe
  C:\Windows\System\qGGapMc.exe
  2⤵
  PID:10644
- C:\Windows\System\UkpeBER.exe
  C:\Windows\System\UkpeBER.exe
  2⤵
  PID:10820
- C:\Windows\System\pyCloSe.exe
  C:\Windows\System\pyCloSe.exe
  2⤵
  PID:10900
- C:\Windows\System\daCogHP.exe
  C:\Windows\System\daCogHP.exe
  2⤵
  PID:11656
- C:\Windows\System\ybCkSnz.exe
  C:\Windows\System\ybCkSnz.exe
  2⤵
  PID:11304
- C:\Windows\System\wDAJvUP.exe
  C:\Windows\System\wDAJvUP.exe
  2⤵
  PID:11648
- C:\Windows\System\rrnItqG.exe
  C:\Windows\System\rrnItqG.exe
  2⤵
  PID:10352
- C:\Windows\System\wLzNnwK.exe
  C:\Windows\System\wLzNnwK.exe
  2⤵
  PID:12436
- C:\Windows\System\bZZNYNR.exe
  C:\Windows\System\bZZNYNR.exe
  2⤵
  PID:12476
- C:\Windows\System\pQAvfKq.exe
  C:\Windows\System\pQAvfKq.exe
  2⤵
  PID:12504
- C:\Windows\System\ekZKDfG.exe
  C:\Windows\System\ekZKDfG.exe
  2⤵
  PID:12528
- C:\Windows\System\tzWMsDQ.exe
  C:\Windows\System\tzWMsDQ.exe
  2⤵
  PID:12548
- C:\Windows\System\FhpgCqf.exe
  C:\Windows\System\FhpgCqf.exe
  2⤵
  PID:12564
- C:\Windows\System\VumMfSK.exe
  C:\Windows\System\VumMfSK.exe
  2⤵
  PID:12580
- C:\Windows\System\LQESczH.exe
  C:\Windows\System\LQESczH.exe
  2⤵
  PID:12600
- C:\Windows\System\jnUmvdT.exe
  C:\Windows\System\jnUmvdT.exe
  2⤵
  PID:12616
- C:\Windows\System\XCPTfzG.exe
  C:\Windows\System\XCPTfzG.exe
  2⤵
  PID:12632
- C:\Windows\System\ByAYtwH.exe
  C:\Windows\System\ByAYtwH.exe
  2⤵
  PID:12656
- C:\Windows\System\pVCNKWC.exe
  C:\Windows\System\pVCNKWC.exe
  2⤵
  PID:12676
- C:\Windows\System\hBupScS.exe
  C:\Windows\System\hBupScS.exe
  2⤵
  PID:12696
- C:\Windows\System\LoCLGlh.exe
  C:\Windows\System\LoCLGlh.exe
  2⤵
  PID:12724
- C:\Windows\System\RVZkJGa.exe
  C:\Windows\System\RVZkJGa.exe
  2⤵
  PID:12748
- C:\Windows\System\dxLuORx.exe
  C:\Windows\System\dxLuORx.exe
  2⤵
  PID:12768
- C:\Windows\System\wmYDPtX.exe
  C:\Windows\System\wmYDPtX.exe
  2⤵
  PID:12800
- C:\Windows\System\ZhnjgpK.exe
  C:\Windows\System\ZhnjgpK.exe
  2⤵
  PID:12828
- C:\Windows\System\bWiJLtU.exe
  C:\Windows\System\bWiJLtU.exe
  2⤵
  PID:12848
- C:\Windows\System\NhHrHzV.exe
  C:\Windows\System\NhHrHzV.exe
  2⤵
  PID:12876
- C:\Windows\System\jRqHaKm.exe
  C:\Windows\System\jRqHaKm.exe
  2⤵
  PID:12900
- C:\Windows\System\FhGHHUK.exe
  C:\Windows\System\FhGHHUK.exe
  2⤵
  PID:12924
- C:\Windows\System\BHcpsKp.exe
  C:\Windows\System\BHcpsKp.exe
  2⤵
  PID:12944
- C:\Windows\System\EcbsrGL.exe
  C:\Windows\System\EcbsrGL.exe
  2⤵
  PID:12968
- C:\Windows\System\bIasarI.exe
  C:\Windows\System\bIasarI.exe
  2⤵
  PID:12992
- C:\Windows\System\zkzNtPh.exe
  C:\Windows\System\zkzNtPh.exe
  2⤵
  PID:13020
- C:\Windows\System\LOAagNP.exe
  C:\Windows\System\LOAagNP.exe
  2⤵
  PID:13060
- C:\Windows\System\rhtkFBh.exe
  C:\Windows\System\rhtkFBh.exe
  2⤵
  PID:13076
- C:\Windows\System\RxknAnM.exe
  C:\Windows\System\RxknAnM.exe
  2⤵
  PID:13100
- C:\Windows\System\CUPnMmT.exe
  C:\Windows\System\CUPnMmT.exe
  2⤵
  PID:13116
- C:\Windows\System\WVQUpFs.exe
  C:\Windows\System\WVQUpFs.exe
  2⤵
  PID:13140
- C:\Windows\System\hCoTSWr.exe
  C:\Windows\System\hCoTSWr.exe
  2⤵
  PID:13164
- C:\Windows\System\vbdoFcb.exe
  C:\Windows\System\vbdoFcb.exe
  2⤵
  PID:13180
- C:\Windows\System\jFFnTrC.exe
  C:\Windows\System\jFFnTrC.exe
  2⤵
  PID:13196
- C:\Windows\System\KgSeeOC.exe
  C:\Windows\System\KgSeeOC.exe
  2⤵
  PID:13212
- C:\Windows\System\erXRLtI.exe
  C:\Windows\System\erXRLtI.exe
  2⤵
  PID:13232
- C:\Windows\System\SgMIMBA.exe
  C:\Windows\System\SgMIMBA.exe
  2⤵
  PID:13252
- C:\Windows\System\oMqRoMn.exe
  C:\Windows\System\oMqRoMn.exe
  2⤵
  PID:12036
- C:\Windows\System\lFbSADV.exe
  C:\Windows\System\lFbSADV.exe
  2⤵
  PID:10284
- C:\Windows\System\VNWTzEp.exe
  C:\Windows\System\VNWTzEp.exe
  2⤵
  PID:12460
- C:\Windows\System\XolwWQd.exe
  C:\Windows\System\XolwWQd.exe
  2⤵
  PID:12496
- C:\Windows\System\gSvLlTm.exe
  C:\Windows\System\gSvLlTm.exe
  2⤵
  PID:12608
- C:\Windows\System\RtkNrHV.exe
  C:\Windows\System\RtkNrHV.exe
  2⤵
  PID:12524
- C:\Windows\System\sCJtqpI.exe
  C:\Windows\System\sCJtqpI.exe
  2⤵
  PID:12716
- C:\Windows\System\uIRrsAG.exe
  C:\Windows\System\uIRrsAG.exe
  2⤵
  PID:12872
- C:\Windows\System\Yyfoaoj.exe
  C:\Windows\System\Yyfoaoj.exe
  2⤵
  PID:12740
- C:\Windows\System\CZCCnNr.exe
  C:\Windows\System\CZCCnNr.exe
  2⤵
  PID:13056
- C:\Windows\System\YVFKuur.exe
  C:\Windows\System\YVFKuur.exe
  2⤵
  PID:12836
- C:\Windows\System\cTQFTHG.exe
  C:\Windows\System\cTQFTHG.exe
  2⤵
  PID:13264
- C:\Windows\System\qSTwTXm.exe
  C:\Windows\System\qSTwTXm.exe
  2⤵
  PID:12980
- C:\Windows\System\xpFtdnw.exe
  C:\Windows\System\xpFtdnw.exe
  2⤵
  PID:13016
- C:\Windows\System\OYwIGda.exe
  C:\Windows\System\OYwIGda.exe
  2⤵
  PID:13092
- C:\Windows\System\HOcPBcJ.exe
  C:\Windows\System\HOcPBcJ.exe
  2⤵
  PID:13136
- C:\Windows\System\IANZOSj.exe
  C:\Windows\System\IANZOSj.exe
  2⤵
  PID:13204
- C:\Windows\System\BXbWmIG.exe
  C:\Windows\System\BXbWmIG.exe
  2⤵
  PID:13324
- C:\Windows\System\AlzheTf.exe
  C:\Windows\System\AlzheTf.exe
  2⤵
  PID:13352
- C:\Windows\System\IBOckvg.exe
  C:\Windows\System\IBOckvg.exe
  2⤵
  PID:13380
- C:\Windows\System\IlTOQTo.exe
  C:\Windows\System\IlTOQTo.exe
  2⤵
  PID:13408
- C:\Windows\System\nhQTnYk.exe
  C:\Windows\System\nhQTnYk.exe
  2⤵
  PID:13432
- C:\Windows\System\bwHPPJN.exe
  C:\Windows\System\bwHPPJN.exe
  2⤵
  PID:13448
- C:\Windows\System\ntcDIYc.exe
  C:\Windows\System\ntcDIYc.exe
  2⤵
  PID:13472
- C:\Windows\System\VTsjZig.exe
  C:\Windows\System\VTsjZig.exe
  2⤵
  PID:13492
- C:\Windows\System\DVxQhZL.exe
  C:\Windows\System\DVxQhZL.exe
  2⤵
  PID:13524
- C:\Windows\System\pPyajjw.exe
  C:\Windows\System\pPyajjw.exe
  2⤵
  PID:13560
- C:\Windows\System\trtzAxR.exe
  C:\Windows\System\trtzAxR.exe
  2⤵
  PID:13588
- C:\Windows\System\wvHppeC.exe
  C:\Windows\System\wvHppeC.exe
  2⤵
  PID:13612
- C:\Windows\System\AkEMFyx.exe
  C:\Windows\System\AkEMFyx.exe
  2⤵
  PID:13636
- C:\Windows\System\PWiLYnP.exe
  C:\Windows\System\PWiLYnP.exe
  2⤵
  PID:13668
- C:\Windows\System\SyZkxst.exe
  C:\Windows\System\SyZkxst.exe
  2⤵
  PID:13684
- C:\Windows\System\AtkzRZH.exe
  C:\Windows\System\AtkzRZH.exe
  2⤵
  PID:13716
- C:\Windows\System\wsfJudG.exe
  C:\Windows\System\wsfJudG.exe
  2⤵
  PID:13820
- C:\Windows\System\XGfXxBp.exe
  C:\Windows\System\XGfXxBp.exe
  2⤵
  PID:13840
- C:\Windows\System\THJfHiQ.exe
  C:\Windows\System\THJfHiQ.exe
  2⤵
  PID:13872
- C:\Windows\System\WbpPmea.exe
  C:\Windows\System\WbpPmea.exe
  2⤵
  PID:13920
- C:\Windows\System\AnwUGxk.exe
  C:\Windows\System\AnwUGxk.exe
  2⤵
  PID:13944
- C:\Windows\System\gWdRqNV.exe
  C:\Windows\System\gWdRqNV.exe
  2⤵
  PID:13964
- C:\Windows\System\SqXELzM.exe
  C:\Windows\System\SqXELzM.exe
  2⤵
  PID:13980
- C:\Windows\System\jTJnDCd.exe
  C:\Windows\System\jTJnDCd.exe
  2⤵
  PID:13996
- C:\Windows\System\XLlvIAo.exe
  C:\Windows\System\XLlvIAo.exe
  2⤵
  PID:14012
- C:\Windows\System\TFGPiei.exe
  C:\Windows\System\TFGPiei.exe
  2⤵
  PID:14048
- C:\Windows\System\AnVFWfA.exe
  C:\Windows\System\AnVFWfA.exe
  2⤵
  PID:14064
- C:\Windows\System\ZtzIBEI.exe
  C:\Windows\System\ZtzIBEI.exe
  2⤵
  PID:14084
- C:\Windows\System\QVijHAt.exe
  C:\Windows\System\QVijHAt.exe
  2⤵
  PID:14116
- C:\Windows\System\PtVFvZK.exe
  C:\Windows\System\PtVFvZK.exe
  2⤵
  PID:14136
- C:\Windows\System\TbViwLG.exe
  C:\Windows\System\TbViwLG.exe
  2⤵
  PID:14176
- C:\Windows\System\SpKwymu.exe
  C:\Windows\System\SpKwymu.exe
  2⤵
  PID:12516
- C:\Windows\System\VNLATtB.exe
  C:\Windows\System\VNLATtB.exe
  2⤵
  PID:4536
- C:\Windows\System\XQlTSff.exe
  C:\Windows\System\XQlTSff.exe
  2⤵
  PID:12760
- C:\Windows\System\zCAzerM.exe
  C:\Windows\System\zCAzerM.exe
  2⤵
  PID:13292
- C:\Windows\System\FDYDyTG.exe
  C:\Windows\System\FDYDyTG.exe
  2⤵
  PID:13220
- C:\Windows\System\AOJMlds.exe
  C:\Windows\System\AOJMlds.exe
  2⤵
  PID:13420
- C:\Windows\System\FEAVrCe.exe
  C:\Windows\System\FEAVrCe.exe
  2⤵
  PID:4856
- C:\Windows\System\GudmYvh.exe
  C:\Windows\System\GudmYvh.exe
  2⤵
  PID:13360
- C:\Windows\System\sIQfzcw.exe
  C:\Windows\System\sIQfzcw.exe
  2⤵
  PID:13544
- C:\Windows\System\AZJVzax.exe
  C:\Windows\System\AZJVzax.exe
  2⤵
  PID:13400
- C:\Windows\System\VRtJjpM.exe
  C:\Windows\System\VRtJjpM.exe
  2⤵
  PID:13532
- C:\Windows\System\RnkVDXZ.exe
  C:\Windows\System\RnkVDXZ.exe
  2⤵
  PID:13608
- C:\Windows\System\qpibeTy.exe
  C:\Windows\System\qpibeTy.exe
  2⤵
  PID:13696
- C:\Windows\System\RALJaqe.exe
  C:\Windows\System\RALJaqe.exe
  2⤵
  PID:13868
- C:\Windows\System\yYkfcoW.exe
  C:\Windows\System\yYkfcoW.exe
  2⤵
  PID:13828
- C:\Windows\System\DPQaOmv.exe
  C:\Windows\System\DPQaOmv.exe
  2⤵
  PID:4284
- C:\Windows\System\IpKvOdN.exe
  C:\Windows\System\IpKvOdN.exe
  2⤵
  PID:2908
- C:\Windows\System\JQJCkbz.exe
  C:\Windows\System\JQJCkbz.exe
  2⤵
  PID:4368
- C:\Windows\System\hStudjg.exe
  C:\Windows\System\hStudjg.exe
  2⤵
  PID:13992
- C:\Windows\System\GfpzCGC.exe
  C:\Windows\System\GfpzCGC.exe
  2⤵
  PID:13928
- C:\Windows\System\byNtpEz.exe
  C:\Windows\System\byNtpEz.exe
  2⤵
  PID:14108
- C:\Windows\System\SkGlGzq.exe
  C:\Windows\System\SkGlGzq.exe
  2⤵
  PID:14060
- C:\Windows\System\QFqksVB.exe
  C:\Windows\System\QFqksVB.exe
  2⤵
  PID:14020
- C:\Windows\System\AfIswOY.exe
  C:\Windows\System\AfIswOY.exe
  2⤵
  PID:14148
- C:\Windows\System\nUBeYlz.exe
  C:\Windows\System\nUBeYlz.exe
  2⤵
  PID:14260
- C:\Windows\System\WdhDuLF.exe
  C:\Windows\System\WdhDuLF.exe
  2⤵
  PID:14304
- C:\Windows\System\kTqbRmb.exe
  C:\Windows\System\kTqbRmb.exe
  2⤵
  PID:12812
- C:\Windows\System\JJLrAHi.exe
  C:\Windows\System\JJLrAHi.exe
  2⤵
  PID:12712
- C:\Windows\System\fDeyThr.exe
  C:\Windows\System\fDeyThr.exe
  2⤵
  PID:11672
- C:\Windows\System\efBLqja.exe
  C:\Windows\System\efBLqja.exe
  2⤵
  PID:4864
- C:\Windows\System\fLyDBHP.exe
  C:\Windows\System\fLyDBHP.exe
  2⤵
  PID:3432
- C:\Windows\System\bcLvUyZ.exe
  C:\Windows\System\bcLvUyZ.exe
  2⤵
  PID:13676
- C:\Windows\System\mNfiUXi.exe
  C:\Windows\System\mNfiUXi.exe
  2⤵
  PID:1480
- C:\Windows\System\yKfwelQ.exe
  C:\Windows\System\yKfwelQ.exe
  2⤵
  PID:14112
- C:\Windows\System\cOaqWab.exe
  C:\Windows\System\cOaqWab.exe
  2⤵
  PID:216
- C:\Windows\System\bOfwjrF.exe
  C:\Windows\System\bOfwjrF.exe
  2⤵
  PID:2744
- C:\Windows\System\ORJnqjn.exe
  C:\Windows\System\ORJnqjn.exe
  2⤵
  PID:12780
- C:\Windows\System\KXwsrHV.exe
  C:\Windows\System\KXwsrHV.exe
  2⤵
  PID:2988
- C:\Windows\System\KEcvLIg.exe
  C:\Windows\System\KEcvLIg.exe
  2⤵
  PID:3556
- C:\Windows\System\yAgWPHV.exe
  C:\Windows\System\yAgWPHV.exe
  2⤵
  PID:2556
- C:\Windows\System\OJtRXYN.exe
  C:\Windows\System\OJtRXYN.exe
  2⤵
  PID:4496
- C:\Windows\System\hblHriB.exe
  C:\Windows\System\hblHriB.exe
  2⤵
  PID:12796
- C:\Windows\System\LftgThZ.exe
  C:\Windows\System\LftgThZ.exe
  2⤵
  PID:3136
- C:\Windows\System\scabsFa.exe
  C:\Windows\System\scabsFa.exe
  2⤵
  PID:5216
- C:\Windows\System\VACVndO.exe
  C:\Windows\System\VACVndO.exe
  2⤵
  PID:13540
- C:\Windows\System\mDqtOKf.exe
  C:\Windows\System\mDqtOKf.exe
  2⤵
  PID:13660
- C:\Windows\System\mmDOEGK.exe
  C:\Windows\System\mmDOEGK.exe
  2⤵
  PID:13280
- C:\Windows\System\jtuxoTF.exe
  C:\Windows\System\jtuxoTF.exe
  2⤵
  PID:13816
- C:\Windows\System\xnFUdvg.exe
  C:\Windows\System\xnFUdvg.exe
  2⤵
  PID:3976
- C:\Windows\System\QoXMYjy.exe
  C:\Windows\System\QoXMYjy.exe
  2⤵
  PID:872
- C:\Windows\System\HHTcMJx.exe
  C:\Windows\System\HHTcMJx.exe
  2⤵
  PID:5440
- C:\Windows\System\QlsnQXW.exe
  C:\Windows\System\QlsnQXW.exe
  2⤵
  PID:12916
- C:\Windows\System\tXEYogB.exe
  C:\Windows\System\tXEYogB.exe
  2⤵
  PID:5524
- C:\Windows\System\PAAFsMF.exe
  C:\Windows\System\PAAFsMF.exe
  2⤵
  PID:13424
- C:\Windows\System\kZvspUY.exe
  C:\Windows\System\kZvspUY.exe
  2⤵
  PID:5572
- C:\Windows\System\aftFaoJ.exe
  C:\Windows\System\aftFaoJ.exe
  2⤵
  PID:5640
- C:\Windows\System\NgjLVHa.exe
  C:\Windows\System\NgjLVHa.exe
  2⤵
  PID:2020
- C:\Windows\System\TWAxnij.exe
  C:\Windows\System\TWAxnij.exe
  2⤵
  PID:5788
- C:\Windows\System\ARORZFy.exe
  C:\Windows\System\ARORZFy.exe
  2⤵
  PID:1240
- C:\Windows\System\jFiSIBD.exe
  C:\Windows\System\jFiSIBD.exe
  2⤵
  PID:5940
- C:\Windows\System\QYUZXJE.exe
  C:\Windows\System\QYUZXJE.exe
  2⤵
  PID:5980
- C:\Windows\System\SgTPZct.exe
  C:\Windows\System\SgTPZct.exe
  2⤵
  PID:4940
- C:\Windows\System\KjLOGXw.exe
  C:\Windows\System\KjLOGXw.exe
  2⤵
  PID:14368
- C:\Windows\System\zZVEslk.exe
  C:\Windows\System\zZVEslk.exe
  2⤵
  PID:14388
- C:\Windows\System\xSykSkb.exe
  C:\Windows\System\xSykSkb.exe
  2⤵
  PID:14420
- C:\Windows\System\vdwmdou.exe
  C:\Windows\System\vdwmdou.exe
  2⤵
  PID:14456
- C:\Windows\System\iZBqHqt.exe
  C:\Windows\System\iZBqHqt.exe
  2⤵
  PID:14476
- C:\Windows\System\BeoRpHx.exe
  C:\Windows\System\BeoRpHx.exe
  2⤵
  PID:14500
- C:\Windows\System\PCeqVsv.exe
  C:\Windows\System\PCeqVsv.exe
  2⤵
  PID:14520
- C:\Windows\System\itctMKJ.exe
  C:\Windows\System\itctMKJ.exe
  2⤵
  PID:14536
- C:\Windows\System\BImIcWH.exe
  C:\Windows\System\BImIcWH.exe
  2⤵
  PID:14556
- C:\Windows\System\mrUeFwd.exe
  C:\Windows\System\mrUeFwd.exe
  2⤵
  PID:14640
- C:\Windows\System\whJSNSm.exe
  C:\Windows\System\whJSNSm.exe
  2⤵
  PID:14660
- C:\Windows\System\ZLlNhfT.exe
  C:\Windows\System\ZLlNhfT.exe
  2⤵
  PID:14736
- C:\Windows\System\BGHoCKB.exe
  C:\Windows\System\BGHoCKB.exe
  2⤵
  PID:14752
- C:\Windows\System\BtqEiAg.exe
  C:\Windows\System\BtqEiAg.exe
  2⤵
  PID:14768
- C:\Windows\System\CUjnDUu.exe
  C:\Windows\System\CUjnDUu.exe
  2⤵
  PID:14796
- C:\Windows\System\zXRAkjS.exe
  C:\Windows\System\zXRAkjS.exe
  2⤵
  PID:14832
- C:\Windows\System\EDUoJPa.exe
  C:\Windows\System\EDUoJPa.exe
  2⤵
  PID:14856
- C:\Windows\System\ZpxdmWl.exe
  C:\Windows\System\ZpxdmWl.exe
  2⤵
  PID:14884
- C:\Windows\System\mQZzXxl.exe
  C:\Windows\System\mQZzXxl.exe
  2⤵
  PID:14904
- C:\Windows\System\yhLxhUL.exe
  C:\Windows\System\yhLxhUL.exe
  2⤵
  PID:14936
- C:\Windows\System\ZzKqpnu.exe
  C:\Windows\System\ZzKqpnu.exe
  2⤵
  PID:14964
- C:\Windows\System\aIgkriB.exe
  C:\Windows\System\aIgkriB.exe
  2⤵
  PID:14996
- C:\Windows\System\jcWGoJN.exe
  C:\Windows\System\jcWGoJN.exe
  2⤵
  PID:15076
- C:\Windows\System\NklKaBF.exe
  C:\Windows\System\NklKaBF.exe
  2⤵
  PID:15224
- C:\Windows\System\OfEPrkn.exe
  C:\Windows\System\OfEPrkn.exe
  2⤵
  PID:15240
- C:\Windows\System\fGHYTdG.exe
  C:\Windows\System\fGHYTdG.exe
  2⤵
  PID:15264
- C:\Windows\System\EcgmPTo.exe
  C:\Windows\System\EcgmPTo.exe
  2⤵
  PID:15284
- C:\Windows\System\gfdRejW.exe
  C:\Windows\System\gfdRejW.exe
  2⤵
  PID:5468
- C:\Windows\System\yJbxIlD.exe
  C:\Windows\System\yJbxIlD.exe
  2⤵
  PID:5544
- C:\Windows\System\FBZojNT.exe
  C:\Windows\System\FBZojNT.exe
  2⤵
  PID:8144
- C:\Windows\System\CytwXRn.exe
  C:\Windows\System\CytwXRn.exe
  2⤵
  PID:4152
- C:\Windows\System\VADejQF.exe
  C:\Windows\System\VADejQF.exe
  2⤵
  PID:3808
- C:\Windows\System\GycxLnq.exe
  C:\Windows\System\GycxLnq.exe
  2⤵
  PID:2544
- C:\Windows\System\hAXkKOs.exe
  C:\Windows\System\hAXkKOs.exe
  2⤵
  PID:14408
- C:\Windows\System\NwFpiIe.exe
  C:\Windows\System\NwFpiIe.exe
  2⤵
  PID:5176
- C:\Windows\System\nFqzEdr.exe
  C:\Windows\System\nFqzEdr.exe
  2⤵
  PID:12448
- C:\Windows\System\CwXNtsc.exe
  C:\Windows\System\CwXNtsc.exe
  2⤵
  PID:6256
- C:\Windows\System\WUfNatp.exe
  C:\Windows\System\WUfNatp.exe
  2⤵
  PID:6344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:10416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AbbAsLr.exe

Path C:\Windows\System\AbbAsLr.exe
Size 2.1MB
SHA256 f79bd7bcf054e3c5f9cb087b739cc665d802617b01a790acf12a2e31a86e3f63
MD5 154c258cec40e1bf63cf1f391227c8e5
SHA1 6925684f86371ba7cf838e694dfd2c6a81940af2
SHA512 35c38c07244bcc20df75fe3badf8a49047a5d94ee66a8dfeb542687695a5c548cd8a898b45bb62a0e9a16d5804992e3697f24e52bb1809febb2a43bc252a56ae
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNG:BemTLkNdfE0pZrV56utgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

AswKqMJ.exe

Path C:\Windows\System\AswKqMJ.exe
Size 2.1MB
SHA256 cf5e0d59ec2c9e3a129143eeb69b76821ec8b9d4163274e5a11ec7b004d25510
MD5 0c2247e158847f5ab0314ef22169e777
SHA1 412f5aa53f3e83944dac95796d95d63bfc48b12f
SHA512 60133cb7bb9a75ecd3c96eec7f94bf0fceb9f418975e9978f864c95eb41d92629f3105c7f498f472dde7a522f4666f1a2f1338b8e549043f2a9595add2042dd2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNN:BemTLkNdfE0pZrV56utgX
MD5 SHA1 SHA512 SSDEEP

Submit Download

DfCevkr.exe

Path C:\Windows\System\DfCevkr.exe
Size 2.1MB
SHA256 f8249874fd6442a21a820f226166f3c8df376f1078bd84eaaf9e962b54c72307
MD5 13df0b0d7a24a05ad400047ad3d19cbd
SHA1 2351595ae31b485dd36dca6dca8aa5a806ad5d7c
SHA512 986d7459477a09ebc0fa072dfeeda245d5a1d898900ea7efb9f0fe37628843b5e21e54e2f663d24f67ae921a6158cdebfe89753d02ec16a040a825e57262edc8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNE:BemTLkNdfE0pZrV56utgu
MD5 SHA1 SHA512 SSDEEP

Submit Download

EDSHqpd.exe

Path C:\Windows\System\EDSHqpd.exe
Size 2.1MB
SHA256 21df8fb89ba6f031b77d9f6923c5f9cad3374bd554d7875d3576935f6e851208
MD5 6530205dfdfab1b38cf301af0cd7ade4
SHA1 d3506b1e8b40a14e73ad8e80097f5aeeaa96f472
SHA512 1cde90f85043d58c08692f6cac0030b0660ccc06884d6c56b9b3ea035c5a488cd1dfe5807f22f872fcea693022c9a9f82ddec1c47badf3ce9a9c4d84fc2aaff9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNbA:BemTLkNdfE0pZrV56utg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

GLvioiy.exe

Path C:\Windows\System\GLvioiy.exe
Size 2.1MB
SHA256 4337294fac10da8651424baf534281154aa2ca2a00ce96cdba4b87bdbab44bb0
MD5 cec64aeec562989b98332cdc74c5834a
SHA1 c7123677e76cb75cf41043d5afef69bea3f71287
SHA512 ecd597f817f80bb03920029828631fd4a9f864c6d6fa57915439c6c6eea4ccc0ea59194c19b7f645609b83ac16c2ae5d12815c914abc41f22407390962e80ad6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoN8:BemTLkNdfE0pZrV56utga
MD5 SHA1 SHA512 SSDEEP

Submit Download

GqZqYnk.exe

Path C:\Windows\System\GqZqYnk.exe
Size 2.1MB
SHA256 06a490b0b14689f1747558ab02fda9f6d41433d76a0ec51d91c3d7e7fd5c85a1
MD5 67d1ba4c308a2ad8115e490386e5228e
SHA1 bec1d68905978be1a2bc72512f349c945ab827cb
SHA512 77a6a28655cb439e8f668df9e1f599076e42a95c985f7e98c83f75e91353e4a4642cf969f46516e51affa6c869b4f1570879104271f14efac3656b462beacbae
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNt:BemTLkNdfE0pZrV56utgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

IhyWIeF.exe

Path C:\Windows\System\IhyWIeF.exe
Size 2.1MB
SHA256 e05379a5645487afa06105fd9dac5be6d43eb18a84d40200a63fb874af1828d1
MD5 bed14ed8558b2ce666caa0852710044a
SHA1 bddade0f64d810cd59505f458a1ad27d65a27c32
SHA512 d939454de52b57eab796e7365e5aff6c3c22425f0583fc83cec25c2560b221f1a64ff17c4300fc8bcd477b86e2a1b16f8595645556038fa519b2c6e7083ab9a3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNA:BemTLkNdfE0pZrV56utgO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImiyWtm.exe

Path C:\Windows\System\ImiyWtm.exe
Size 2.1MB
SHA256 c54b219d29672a548ecca991440115ab2103a961c82f4c75860da465492d16a6
MD5 4abad2b430d932228685c5b194eef5cc
SHA1 a799ba4b2847a9add26e90765fe6ae3870fa4544
SHA512 2da53c9b3a898f0673e30921cb3cec11eba659a7699e484e6b2de4033eee28a14adb6e15e4062262a847fef7ebd209668990b7a81ec9996707bbe8db75d96678
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNJ:BemTLkNdfE0pZrV56utgH
MD5 SHA1 SHA512 SSDEEP

Submit Download

IumvVOZ.exe

Path C:\Windows\System\IumvVOZ.exe
Size 2.1MB
SHA256 39b1659e799c1a135315c220c727f3b2353accc93e3addb3974c7aa54558dfaf
MD5 e693bbd890dbc30fbf114a036ac09b8c
SHA1 6c04759ed453b555fe3b188310b8705ee690c6cf
SHA512 3cba1a1622f47408cc1d172085c49ba94659d3880b2dfee2b5043591e79cd68f071d1f3ea966e9538a5ed042c8b3c9e72da8ffdb7f16742dfb1cea7257bfe987
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNU:BemTLkNdfE0pZrV56utg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

IwGkVbY.exe

Path C:\Windows\System\IwGkVbY.exe
Size 2.1MB
SHA256 ebd0693c27b3fd80e2428fe8940c66a70fd720cd430b001252eb89c5a43c4695
MD5 760d6946f6897de4aaed954da1589cbe
SHA1 2b275594f351a4b1ffa0f964ab2799356427f284
SHA512 7127bdb6663a17c8206b4b72c65691e7fcfeff5fb105e5294d493310cf52925b0cd1a0fd6f95bf27800189c907d3b8806360c8436428009224744a82dee3bf22
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNK:BemTLkNdfE0pZrV56utgU
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRGzynl.exe

Path C:\Windows\System\NRGzynl.exe
Size 2.1MB
SHA256 c170d9028bfd65d7e5418c191f723252d19b96adb7c34c5ed7d57a19dc89277e
MD5 650c2bde0e05f7a9ffce01bfc810406e
SHA1 572a617daf02c24b61ceee42566cf54d4a3c7812
SHA512 9a15e59d513e62af14dce7d328d20727aa4234c3564a49d05ba2023963eb3e4adaa9d3af83f1493442034811c4a4792f303b5a59c38b8d8d6adcc286b281352e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNA:BemTLkNdfE0pZrV56utgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

OYmVnJD.exe

Path C:\Windows\System\OYmVnJD.exe
Size 2.1MB
SHA256 f29739356691f4bd1a374b268492ac52c8aaed49d582568541a58a615cd10db6
MD5 e16dcd2bec265c1026e8d4e0ebdc0799
SHA1 5780b32eda97d9a2a06d872d9843a07aa51d149e
SHA512 3710a13287bd540ceef4093b8fca4522ae9285d34a54e9e26833fdb569af3755a3510f599e729b2a578e59d85591da143d0def61ccb2950c9db677c09a6d2a83
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNa:BemTLkNdfE0pZrV56utg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

QAVZmyf.exe

Path C:\Windows\System\QAVZmyf.exe
Size 2.1MB
SHA256 47e5ef35fd15cd48cc1d781b7343a593ca6217e3e2b5e421d18b12c035505b46
MD5 f53927cda91f8ae20ba25ae2d0616788
SHA1 3ad89f92a1d951632cfa44f5ffb8e5a1273b92c2
SHA512 c26673a2631c831582b83e490ea5ae33280c92026fbf3e805de2880f91e8432eb402ac369fdf07856b5f0cf6be099d8c4a831a92b6c6cfc51659c1d2b44fad2d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNf:BemTLkNdfE0pZrV56utg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

QcpUZwT.exe

Path C:\Windows\System\QcpUZwT.exe
Size 2.1MB
SHA256 9d7cd2c5f1ac0780f56ae387e6c50a0a831df1eb51fffcc4dd1af7e98483027f
MD5 768c68462978b96db59caf5044d93d65
SHA1 c69200d018de1871ea405dc6f6da88aee6792da5
SHA512 25f0cec8657a75939e7bcaf4f25175e3bc4798585c1de81c4ce398e5c81c8e26f414565d640ef257da39525985e5a2bd3df623848f9f71898261147a14fb4c5b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNW:BemTLkNdfE0pZrV56utg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwZMztc.exe

Path C:\Windows\System\QwZMztc.exe
Size 2.1MB
SHA256 8df22b79c9a0517474121b5df6ef78e5b038fd38473a13fec0decb964facc09b
MD5 573b9f21cff23096e71c2890301b1b98
SHA1 b327edd24cbec55bdfa68175fd78869df2aeb846
SHA512 48f6b323acf352c68614e7a1f480f60e0dc013b71be4f9ecc096e8c932243dc03e7174dd3c6a2f5ddc453426a9039556c6db1c85b251e66c9c8c96b6cb5db0e6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNj:BemTLkNdfE0pZrV56utgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RITCdto.exe

Path C:\Windows\System\RITCdto.exe
Size 2.1MB
SHA256 dcbbddf5de1feaa152c4763834b16b0a87d716bd5e57b88b0985d9b63c307c52
MD5 cf2f775d5bae2c5d5708eb66a47bfbbc
SHA1 ca24154489532d9b31d5d37f459e3bd1dc8241a5
SHA512 d8dd96ae0d972bb60d176e081a2e9059e6c7cd2c635e0f3a2c5c0977c6c0ee2a10d59a388805570dd9ca58415a7fa22d90aa6c468a5db9f49796135c2aa09d23
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNX:BemTLkNdfE0pZrV56utgt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SARZupS.exe

Path C:\Windows\System\SARZupS.exe
Size 2.1MB
SHA256 61f572438b676e70dc6903b0a5883f00ad438491c06640e286bb7eca1228b70f
MD5 ff86bb3c7c11c3e15a4549a23c42f4d9
SHA1 39e138cffa84e55b61534243ef7b0499b8386641
SHA512 26a70636fac7c0f01ffd2f6a643bf0d40b8dcff99e430967daf45d165f551f6d76069b4474c8da3fd0bab89dffe4a37845f4a4e38c0f1b4b78907c12166fe5a6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNs:BemTLkNdfE0pZrV56utg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SvPztIj.exe

Path C:\Windows\System\SvPztIj.exe
Size 2.1MB
SHA256 d3dfbe95217e1eb3ab5681c9bbe9f789404ecf32012fcbec64cfb900c6816ac6
MD5 793880d35bf94db9ae84d7f643290cd7
SHA1 460c369f886055e8a61948ca7d9036c9e0ea9dac
SHA512 dccd2406454ddbee84f46fa4afa1ff418dfab99b6b6d1d29fcd57f861316f8e14cf81db063d6fb90ae8420563a6cb25a953ae778c2d4e19ebbf2a469ff012099
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNM:BemTLkNdfE0pZrV56utg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

UJGGWbL.exe

Path C:\Windows\System\UJGGWbL.exe
Size 2.1MB
SHA256 768b98120f3635fbc8780423f48f0c21de7ddb87685e56a22113011c7ecbd64b
MD5 bd77f3599151a6348bf464a9137d4eb7
SHA1 1b93b9e92c54f113960c7ededb59d63ef1a906aa
SHA512 ea922335ee9295caa53babd42ed350b6ef3aa662adc5b1f3cb02c907fd7ae37fb5b8f3a5e347eb3d518d93000200c8240a5b78df45a4839118311651e3ccc9f8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNi:BemTLkNdfE0pZrV56utgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

URZHqQC.exe

Path C:\Windows\System\URZHqQC.exe
Size 2.1MB
SHA256 09203c94668a914ab6b869e90b50d086a582410af1f1932144ac7da345e75307
MD5 3934124c3b36be23f6fd61ac57bb31ad
SHA1 3e3d5420e9bc08fa076de69c078e56c927673291
SHA512 4596da02d98f2ad23925466f503c0ac742836a8e207753d55c7257f1f9a674ae704571ad9e38f1ee2bcf8d7da058abc4840969af89b3421998c01f61f375cdd0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNZ:BemTLkNdfE0pZrV56utgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

VrRNifa.exe

Path C:\Windows\System\VrRNifa.exe
Size 2.1MB
SHA256 992fd88900ddbb8bb4459f394e20b519785c9c655b582a1b68edfc5a9c541276
MD5 977905164bf72b832efe6e48219e6a73
SHA1 ad0c9cc80b1e080962ca1b8c2332438a318b0089
SHA512 c65528d48828e0cd29d5f39b7120330186e699b2b30a51a477d04f9160f3e33c5715d119fe63da42948505374e9cedc14213381c333dfc73ec72688ac5cc69b2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNv:BemTLkNdfE0pZrV56utgR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZfLdgXj.exe

Path C:\Windows\System\ZfLdgXj.exe
Size 2.1MB
SHA256 0466c808705a8548c5c162f3b82dbcfc7f8976f29d659d37cfde693ba293af33
MD5 35ae8add9012387e1da2148a2a709ff7
SHA1 0907cfc543df12c5290f42c54f0953ada644f336
SHA512 698f148054f9d8531efb94251092f9205b2e377eba950abc7adfe97e674123308d8cbded7f1e8080bfb5c8dad0b3ba1425e064c3a000b91fd56e97b1689e37b8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNd:BemTLkNdfE0pZrV56utgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

emPEWaK.exe

Path C:\Windows\System\emPEWaK.exe
Size 2.1MB
SHA256 1db842c6e37adffe6144da5f0b1d80129ac03fcb834d17f480dd3054ebb4fc58
MD5 e0728001c218fe9ef953b8e07902212e
SHA1 b8fae6e79c719172b8178fd655aa64b7ff76c38e
SHA512 5c852c2d1805f4832953697df6fc5ca31be507281b6db83ed65781c0553f21355568ce2175ec2157882ec5965e0c5be87752da7c9b0c6b8fae9b1c38699c237c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNi:BemTLkNdfE0pZrV56utgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffyqPWY.exe

Path C:\Windows\System\ffyqPWY.exe
Size 2.1MB
SHA256 6ba7bdb38a8644f0275fdf9c5b148ad699af539c2f902362283a35d065772df4
MD5 6f1d7d94a09ae5b493c023da718348fd
SHA1 3a47e057a1f28467a9959c1171bda62c748bd198
SHA512 43212df0e2a452147ff555f2e37f25433c9c0d0d0dd9239a1e68a1e248c65f513ca64b8335b60600b241b7e30927d6816c53e24ff1ba2fa887fb506691628883
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoN6:BemTLkNdfE0pZrV56utgM
MD5 SHA1 SHA512 SSDEEP

Submit Download

glSpcKH.exe

Path C:\Windows\System\glSpcKH.exe
Size 2.1MB
SHA256 e7134060a9fb2c34948109a9c9d4f8a8e7ac415ec34c110473812abcfcb27351
MD5 b90870df659c5dbc8149aa47dd165530
SHA1 9e00e6ebd8d792f4da47af2c57356f536b7dff55
SHA512 0c819af10c84cd7332cb00afd32df7545084abb5955413ddbc294e7070ab8e3d90561ccfedb07293f673537001f181fc432d9bbb10b9463d7c836c6f5574c00b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNj:BemTLkNdfE0pZrV56utgt
MD5 SHA1 SHA512 SSDEEP

Submit Download

kXGprIu.exe

Path C:\Windows\System\kXGprIu.exe
Size 2.1MB
SHA256 93016dd3d098cd295620b2dba1e345ca291dc741ff2f2e071c6988c878455b72
MD5 1e1a5ebbeda0b1f98e3ade46102ce913
SHA1 605fa0da3226ac6ec4eb0378edf8f48da34fba83
SHA512 b8b9d1db89e1c848be209eb80c3b2021848a6e86f3ed708ff0f9ca1679aa115d21c28030b17ed3ca3af0be3972c3b0adc6942aac042f7fbb831575684a5ff4fb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoN4:BemTLkNdfE0pZrV56utga
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmFZAJO.exe

Path C:\Windows\System\mmFZAJO.exe
Size 2.1MB
SHA256 555e80e427c03b005e9698ace8d7a087707c29bc4a6699e0594e27e516b64427
MD5 4bc5dc4d2e2d54251dfacfdcd0f97ac5
SHA1 2efa931e64b498fe5bea6a24f7c84d423589e169
SHA512 0b27b4b14cd732eb7325fb60252e18fd4099c752e26803be71f75aaf77da16e1e1c2e87b26d6aaf3bde26bddc766cbc54660ff9d33e239ed2f6610e556ac280a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNC:BemTLkNdfE0pZrV56utgk
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqORwIr.exe

Path C:\Windows\System\oqORwIr.exe
Size 2.1MB
SHA256 c58bb18c52208b58dcb991ec684d37da1664eb8b8b87d48c1267ad26e7d28507
MD5 a3dff26ee3ba8a59fac275e866363d53
SHA1 e22b5aba204fd5af5188c25e8c64f67934b6f0f5
SHA512 87b1cc5053a4d557e37dc917abb5d3aa0598471aa42e153326805a6a11ec84c36126cc78f68da9e68aaa97e2ab74f0da9b6e9390fd78e211d1923a9b0458f9da
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNQ:BemTLkNdfE0pZrV56utgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvhuiVb.exe

Path C:\Windows\System\qvhuiVb.exe
Size 2.1MB
SHA256 56353c790efca1200fcde77b2d80542fa4d0d92be9617262498f07b61d8ea196
MD5 3b50488cd4f8c8122b99c2026b90577b
SHA1 9177a623a7f3b62cdc3108833603124ab583cc4a
SHA512 456dd93d2941913663206a51a03cd240ac33d4143f80db6fe472e6d53b0972f9ec6601fa3aebf251d460987bdd1ca88b91b06662108f3a67e590540ea90f4f0f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNb:BemTLkNdfE0pZrV56utg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhlcpoY.exe

Path C:\Windows\System\rhlcpoY.exe
Size 2.1MB
SHA256 2a4a6a8a139047b53a0782d2095afe0264bf9eb6576d5b46bde3c2bbe288fba7
MD5 eb21e08062797be7ce372e25ad902355
SHA1 bda7af81ad679d5510e4a962b85440086f745373
SHA512 d0141e3f31ed49c845deb32c37fd986a5c73606c71006b55d97b39eda39b0db5bf2f8972e2d1cd00270e273e5bc6cc6da3a5cd30c4d3f35427ce7258545a0bda
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNg:BemTLkNdfE0pZrV56utgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tlKJlgc.exe

Path C:\Windows\System\tlKJlgc.exe
Size 2.1MB
SHA256 5a97d5062943d5f9d0a9721b1ef8808f6f254f44f4fad967606441a07c71ed94
MD5 025f41e7ccd3144182cae68b34d19d3c
SHA1 fee1234f36224125ddc7a98a42abeb64dc66dfcd
SHA512 1d75c324b1bb962c1db395a57743380f6d563b9f0736bd8ec44e784d70f9e74afa69733854a6ee77e5e8398974e13fb0010e037ff9351c91418e0ada537b6b4c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoN/:BemTLkNdfE0pZrV56utgJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wwvQLpY.exe

Path C:\Windows\System\wwvQLpY.exe
Size 2.1MB
SHA256 3e78b126ac2065323901a8eddd875e48531c089dfdbed65cac892a7b0646f4fa
MD5 6d85380311778bc9cf83217153fd0025
SHA1 2d1523039f62ccbb3d115810496269976f1e7232
SHA512 0738da39abef166ea67c3225fff7ad323cbc292785d976f713dadf546e6ba86d809e1df60877b97facd6266982223d366940508c6d8eca7b812f2287fc540dfa
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNm:BemTLkNdfE0pZrV56utg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

yWvgwXb.exe

Path C:\Windows\System\yWvgwXb.exe
Size 2.1MB
SHA256 e791ed40f0b3c0bd83a5ff5c3413b61b0b30dde016a6b4009c852e36722206f3
MD5 6852799f1afb28704b133a53781083e6
SHA1 57f184017cfa1a4d9496e51a822bbff72b19934c
SHA512 1eabc2ff34506474a8059fd2dfdcba9aa5efc2ba06059ff2117877c15c0be76a6a39596b1359d73a00d54752e4ea196532c06466e3e6a18b26cf093b3daeb386
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdM/QxtgPoNZ:BemTLkNdfE0pZrV56utgT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-86-0x00007FF7F8470000-0x00007FF7F87C4000-memory.dmp

Download

memory/412-1814-0x00007FF7F8470000-0x00007FF7F87C4000-memory.dmp

Download

memory/632-2297-0x00007FF771080000-0x00007FF7713D4000-memory.dmp

Download

memory/632-184-0x00007FF771080000-0x00007FF7713D4000-memory.dmp

Download

memory/836-2079-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp

Download

memory/836-144-0x00007FF7D8A60000-0x00007FF7D8DB4000-memory.dmp

Download

memory/1092-2081-0x00007FF6EA0E0000-0x00007FF6EA434000-memory.dmp

Download

memory/1092-136-0x00007FF6EA0E0000-0x00007FF6EA434000-memory.dmp

Download

memory/1164-1811-0x00007FF7C6AA0000-0x00007FF7C6DF4000-memory.dmp

Download

memory/1164-85-0x00007FF7C6AA0000-0x00007FF7C6DF4000-memory.dmp

Download

memory/1404-1691-0x00007FF714000000-0x00007FF714354000-memory.dmp

Download

memory/1404-20-0x00007FF714000000-0x00007FF714354000-memory.dmp

Download

memory/1580-162-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp

Download

memory/1580-1803-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp

Download

memory/1580-38-0x00007FF6F4540000-0x00007FF6F4894000-memory.dmp

Download

memory/1812-113-0x00007FF7E3D00000-0x00007FF7E4054000-memory.dmp

Download

memory/1812-2058-0x00007FF7E3D00000-0x00007FF7E4054000-memory.dmp

Download

memory/1904-35-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp

Download

memory/1904-152-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp

Download

memory/1904-1802-0x00007FF6B9E70000-0x00007FF6BA1C4000-memory.dmp

Download

memory/1972-169-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp

Download

memory/1972-2296-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp

Download

memory/2016-1642-0x00007FF7424B0000-0x00007FF742804000-memory.dmp

Download

memory/2016-8-0x00007FF7424B0000-0x00007FF742804000-memory.dmp

Download

memory/2092-2106-0x00007FF79D790000-0x00007FF79DAE4000-memory.dmp

Download

memory/2092-1542-0x00007FF79D790000-0x00007FF79DAE4000-memory.dmp

Download

memory/2092-130-0x00007FF79D790000-0x00007FF79DAE4000-memory.dmp

Download

memory/2104-43-0x00007FF664120000-0x00007FF664474000-memory.dmp

Download

memory/2104-1804-0x00007FF664120000-0x00007FF664474000-memory.dmp

Download

memory/2104-176-0x00007FF664120000-0x00007FF664474000-memory.dmp

Download

memory/2296-1323-0x00007FF7A9870000-0x00007FF7A9BC4000-memory.dmp

Download

memory/2296-2040-0x00007FF7A9870000-0x00007FF7A9BC4000-memory.dmp

Download

memory/2296-88-0x00007FF7A9870000-0x00007FF7A9BC4000-memory.dmp

Download

memory/2516-87-0x00007FF61A7D0000-0x00007FF61AB24000-memory.dmp

Download

memory/2516-1820-0x00007FF61A7D0000-0x00007FF61AB24000-memory.dmp

Download

memory/2672-98-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp

Download

memory/2672-1668-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp

Download

memory/2672-14-0x00007FF70EF10000-0x00007FF70F264000-memory.dmp

Download

memory/2720-89-0x00007FF76C9F0000-0x00007FF76CD44000-memory.dmp

Download

memory/2720-1348-0x00007FF76C9F0000-0x00007FF76CD44000-memory.dmp

Download

memory/2720-2052-0x00007FF76C9F0000-0x00007FF76CD44000-memory.dmp

Download

memory/2768-185-0x00007FF7EA900000-0x00007FF7EAC54000-memory.dmp

Download

memory/2768-2298-0x00007FF7EA900000-0x00007FF7EAC54000-memory.dmp

Download

memory/3052-2091-0x00007FF6925E0000-0x00007FF692934000-memory.dmp

Download

memory/3052-149-0x00007FF6925E0000-0x00007FF692934000-memory.dmp

Download

memory/3532-123-0x00007FF6652A0000-0x00007FF6655F4000-memory.dmp

Download

memory/3532-747-0x00007FF6652A0000-0x00007FF6655F4000-memory.dmp

Download

memory/3532-2121-0x00007FF6652A0000-0x00007FF6655F4000-memory.dmp

Download

memory/3560-61-0x00007FF6D68A0000-0x00007FF6D6BF4000-memory.dmp

Download

memory/3560-740-0x00007FF6D68A0000-0x00007FF6D6BF4000-memory.dmp

Download

memory/3560-1808-0x00007FF6D68A0000-0x00007FF6D6BF4000-memory.dmp

Download

memory/3648-1393-0x00007FF63F680000-0x00007FF63F9D4000-memory.dmp

Download

memory/3648-2096-0x00007FF63F680000-0x00007FF63F9D4000-memory.dmp

Download

memory/3648-129-0x00007FF63F680000-0x00007FF63F9D4000-memory.dmp

Download

memory/3676-163-0x00007FF7CC0A0000-0x00007FF7CC3F4000-memory.dmp

Download

memory/3700-1781-0x00007FF701C20000-0x00007FF701F74000-memory.dmp

Download

memory/3700-53-0x00007FF701C20000-0x00007FF701F74000-memory.dmp

Download

memory/4172-1753-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp

Download

memory/4172-28-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp

Download

memory/4172-148-0x00007FF6A05D0000-0x00007FF6A0924000-memory.dmp

Download

memory/4292-153-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp

Download

memory/4292-2114-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp

Download

memory/4476-189-0x00007FF697B60000-0x00007FF697EB4000-memory.dmp

Download

memory/4476-1817-0x00007FF697B60000-0x00007FF697EB4000-memory.dmp

Download

memory/4476-56-0x00007FF697B60000-0x00007FF697EB4000-memory.dmp

Download

memory/4780-2094-0x00007FF7639F0000-0x00007FF763D44000-memory.dmp

Download

memory/4780-151-0x00007FF7639F0000-0x00007FF763D44000-memory.dmp

Download

memory/4900-2100-0x00007FF6FD740000-0x00007FF6FDA94000-memory.dmp

Download

memory/4900-150-0x00007FF6FD740000-0x00007FF6FDA94000-memory.dmp

Download

memory/5064-60-0x00007FF75A1C0000-0x00007FF75A514000-memory.dmp

Download

memory/5064-0-0x00007FF75A1C0000-0x00007FF75A514000-memory.dmp

Download

memory/5064-1-0x000001AFF5FB0000-0x000001AFF5FC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads