xmrig | 5fcebf540167a4acec746614e58a146e1a2517e5e5c2fa0accbbff17cc95c412

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
Size 1.9MB
Sample240614-ecrdsstgnc
SHA256 5fcebf540167a4acec746614e58a146e1a2517e5e5c2fa0accbbff17cc95c412
MD5 9fc6e892cb40257b387a3f5c933b7350
SHA1 96a16f198534387ba32b247fa19f08b057018994
SHA512 5d3d3c79894ba4eaa68e100f773d814a723be7bc80e1e8244665f038dea021564bf091cc4435c2ffbe8ac337bab43bf295deabf7c7a0593a660aae927f19cee9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQ5:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/536-0-0x00007FF6456A0000-0x00007FF6459F4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233ec-5.dat	xmrig
behavioral2/files/0x00070000000233f0-11.dat	xmrig
behavioral2/files/0x00070000000233f1-17.dat	xmrig
behavioral2/memory/224-15-0x00007FF6FFFE0000-0x00007FF700334000-memory.dmp	xmrig
behavioral2/memory/4048-8-0x00007FF7D9680000-0x00007FF7D99D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f2-24.dat	xmrig
behavioral2/memory/2256-22-0x00007FF6B47F0000-0x00007FF6B4B44000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f3-30.dat	xmrig
behavioral2/files/0x00070000000233f4-42.dat	xmrig
behavioral2/files/0x00080000000233ed-54.dat	xmrig
behavioral2/memory/3068-51-0x00007FF60EB40000-0x00007FF60EE94000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f6-60.dat	xmrig
behavioral2/files/0x00070000000233f8-66.dat	xmrig
behavioral2/memory/2012-62-0x00007FF6DA530000-0x00007FF6DA884000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-56.dat	xmrig
behavioral2/memory/4200-55-0x00007FF7C7FE0000-0x00007FF7C8334000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-48.dat	xmrig
behavioral2/memory/4928-47-0x00007FF6050C0000-0x00007FF605414000-memory.dmp	xmrig
behavioral2/memory/3288-44-0x00007FF7E66E0000-0x00007FF7E6A34000-memory.dmp	xmrig
behavioral2/memory/2040-34-0x00007FF675650000-0x00007FF6759A4000-memory.dmp	xmrig
behavioral2/memory/4244-28-0x00007FF6B2F60000-0x00007FF6B32B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f9-73.dat	xmrig
behavioral2/memory/1896-70-0x00007FF604650000-0x00007FF6049A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-74.dat	xmrig
behavioral2/files/0x00070000000233fb-81.dat	xmrig
behavioral2/files/0x00070000000233fd-88.dat	xmrig
behavioral2/files/0x00070000000233fe-108.dat	xmrig
behavioral2/files/0x0007000000023403-122.dat	xmrig
behavioral2/files/0x0007000000023409-152.dat	xmrig
behavioral2/files/0x000700000002340a-165.dat	xmrig
behavioral2/files/0x000700000002340e-177.dat	xmrig
behavioral2/memory/3084-504-0x00007FF7B4D80000-0x00007FF7B50D4000-memory.dmp	xmrig
behavioral2/memory/3968-505-0x00007FF688EC0000-0x00007FF689214000-memory.dmp	xmrig
behavioral2/memory/2508-506-0x00007FF6A47D0000-0x00007FF6A4B24000-memory.dmp	xmrig
behavioral2/memory/4004-507-0x00007FF7F3670000-0x00007FF7F39C4000-memory.dmp	xmrig
behavioral2/memory/1324-508-0x00007FF6DB360000-0x00007FF6DB6B4000-memory.dmp	xmrig
behavioral2/memory/540-522-0x00007FF6898D0000-0x00007FF689C24000-memory.dmp	xmrig
behavioral2/memory/3628-557-0x00007FF7DCC80000-0x00007FF7DCFD4000-memory.dmp	xmrig
behavioral2/memory/4072-555-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp	xmrig
behavioral2/memory/4604-549-0x00007FF7789E0000-0x00007FF778D34000-memory.dmp	xmrig
behavioral2/memory/4376-541-0x00007FF6038D0000-0x00007FF603C24000-memory.dmp	xmrig
behavioral2/memory/2848-537-0x00007FF6090D0000-0x00007FF609424000-memory.dmp	xmrig
behavioral2/memory/1932-529-0x00007FF6984E0000-0x00007FF698834000-memory.dmp	xmrig
behavioral2/memory/2004-515-0x00007FF606B90000-0x00007FF606EE4000-memory.dmp	xmrig
behavioral2/memory/3124-510-0x00007FF6A50F0000-0x00007FF6A5444000-memory.dmp	xmrig
behavioral2/memory/1844-509-0x00007FF67FCC0000-0x00007FF680014000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-175.dat	xmrig
behavioral2/files/0x000700000002340d-172.dat	xmrig
behavioral2/files/0x000700000002340b-170.dat	xmrig
behavioral2/files/0x0007000000023408-155.dat	xmrig
behavioral2/files/0x0007000000023407-150.dat	xmrig
behavioral2/files/0x0007000000023406-145.dat	xmrig
behavioral2/files/0x0007000000023405-140.dat	xmrig
behavioral2/files/0x0007000000023404-135.dat	xmrig
behavioral2/files/0x0007000000023402-125.dat	xmrig
behavioral2/files/0x0007000000023401-120.dat	xmrig
behavioral2/memory/2772-570-0x00007FF76B2C0000-0x00007FF76B614000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-113.dat	xmrig
behavioral2/files/0x00070000000233ff-105.dat	xmrig
behavioral2/memory/3444-94-0x00007FF767BB0000-0x00007FF767F04000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-93.dat	xmrig
behavioral2/memory/4348-87-0x00007FF7BDBC0000-0x00007FF7BDF14000-memory.dmp	xmrig
behavioral2/memory/536-82-0x00007FF6456A0000-0x00007FF6459F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4048	gqLGfRs.exe
224	mHsyTqO.exe
2256	WMmnkpf.exe
4244	WvTRhwC.exe
2040	CviEpeR.exe
3288	IBFTExy.exe
4928	xxgZxhb.exe
3068	XClGdVU.exe
4200	XDksxMR.exe
2012	cBSouml.exe
1896	sonPqNT.exe
4348	VLclOhk.exe
3444	ZboUVHm.exe
3084	ajlVvXp.exe
3968	ctmfSGk.exe
2508	gqtSMni.exe
2772	zYGDRTT.exe
4004	PpadpqT.exe
1324	OVlFTed.exe
1844	aRalYuQ.exe
3124	OrvFYpR.exe
2004	iijERLq.exe
540	jhmBnTT.exe
1932	yvbDMeT.exe
2848	XgLInNV.exe
4376	dnSSywO.exe
4604	JzhwAGd.exe
4072	IEmlqIY.exe
3628	nHxONxb.exe
1108	OfBPuBN.exe
1692	CWuhFVw.exe
2164	kEeOqta.exe
1640	xSiaSSh.exe
4288	LpvrTyy.exe
3896	hETVcgR.exe
1308	rNFPmkM.exe
2800	CyucoXA.exe
4628	pVsDxNj.exe
3816	GIXZbTb.exe
3944	qkFOosf.exe
1816	AbLmEeC.exe
5092	xMVczWU.exe
4908	PXCVHZr.exe
3572	LuYUkcY.exe
2656	USyoVGl.exe
2312	GBDczqZ.exe
4232	SbazGHm.exe
2324	kLerSWg.exe
776	tEqzgiL.exe
2776	odnafiO.exe
2288	BoJBftb.exe
2412	cXmhSsV.exe
2916	BSdzCbb.exe
5108	jSbAOox.exe
4444	QmLLxNh.exe
2472	keuEqdW.exe
1292	DkdKwmI.exe
4780	IUikoJX.exe
1788	uxxjzzP.exe
1448	dQChSCO.exe
2264	BMRjvsO.exe
4920	bDptaQk.exe
3820	pDncUoE.exe
2240	qJpMLhL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/536-0-0x00007FF6456A0000-0x00007FF6459F4000-memory.dmp	upx
behavioral2/files/0x00080000000233ec-5.dat	upx
behavioral2/files/0x00070000000233f0-11.dat	upx
behavioral2/files/0x00070000000233f1-17.dat	upx
behavioral2/memory/224-15-0x00007FF6FFFE0000-0x00007FF700334000-memory.dmp	upx
behavioral2/memory/4048-8-0x00007FF7D9680000-0x00007FF7D99D4000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-24.dat	upx
behavioral2/memory/2256-22-0x00007FF6B47F0000-0x00007FF6B4B44000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-30.dat	upx
behavioral2/files/0x00070000000233f4-42.dat	upx
behavioral2/files/0x00080000000233ed-54.dat	upx
behavioral2/memory/3068-51-0x00007FF60EB40000-0x00007FF60EE94000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-60.dat	upx
behavioral2/files/0x00070000000233f8-66.dat	upx
behavioral2/memory/2012-62-0x00007FF6DA530000-0x00007FF6DA884000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-56.dat	upx
behavioral2/memory/4200-55-0x00007FF7C7FE0000-0x00007FF7C8334000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-48.dat	upx
behavioral2/memory/4928-47-0x00007FF6050C0000-0x00007FF605414000-memory.dmp	upx
behavioral2/memory/3288-44-0x00007FF7E66E0000-0x00007FF7E6A34000-memory.dmp	upx
behavioral2/memory/2040-34-0x00007FF675650000-0x00007FF6759A4000-memory.dmp	upx
behavioral2/memory/4244-28-0x00007FF6B2F60000-0x00007FF6B32B4000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-73.dat	upx
behavioral2/memory/1896-70-0x00007FF604650000-0x00007FF6049A4000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-74.dat	upx
behavioral2/files/0x00070000000233fb-81.dat	upx
behavioral2/files/0x00070000000233fd-88.dat	upx
behavioral2/files/0x00070000000233fe-108.dat	upx
behavioral2/files/0x0007000000023403-122.dat	upx
behavioral2/files/0x0007000000023409-152.dat	upx
behavioral2/files/0x000700000002340a-165.dat	upx
behavioral2/files/0x000700000002340e-177.dat	upx
behavioral2/memory/3084-504-0x00007FF7B4D80000-0x00007FF7B50D4000-memory.dmp	upx
behavioral2/memory/3968-505-0x00007FF688EC0000-0x00007FF689214000-memory.dmp	upx
behavioral2/memory/2508-506-0x00007FF6A47D0000-0x00007FF6A4B24000-memory.dmp	upx
behavioral2/memory/4004-507-0x00007FF7F3670000-0x00007FF7F39C4000-memory.dmp	upx
behavioral2/memory/1324-508-0x00007FF6DB360000-0x00007FF6DB6B4000-memory.dmp	upx
behavioral2/memory/540-522-0x00007FF6898D0000-0x00007FF689C24000-memory.dmp	upx
behavioral2/memory/3628-557-0x00007FF7DCC80000-0x00007FF7DCFD4000-memory.dmp	upx
behavioral2/memory/4072-555-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp	upx
behavioral2/memory/4604-549-0x00007FF7789E0000-0x00007FF778D34000-memory.dmp	upx
behavioral2/memory/4376-541-0x00007FF6038D0000-0x00007FF603C24000-memory.dmp	upx
behavioral2/memory/2848-537-0x00007FF6090D0000-0x00007FF609424000-memory.dmp	upx
behavioral2/memory/1932-529-0x00007FF6984E0000-0x00007FF698834000-memory.dmp	upx
behavioral2/memory/2004-515-0x00007FF606B90000-0x00007FF606EE4000-memory.dmp	upx
behavioral2/memory/3124-510-0x00007FF6A50F0000-0x00007FF6A5444000-memory.dmp	upx
behavioral2/memory/1844-509-0x00007FF67FCC0000-0x00007FF680014000-memory.dmp	upx
behavioral2/files/0x000700000002340c-175.dat	upx
behavioral2/files/0x000700000002340d-172.dat	upx
behavioral2/files/0x000700000002340b-170.dat	upx
behavioral2/files/0x0007000000023408-155.dat	upx
behavioral2/files/0x0007000000023407-150.dat	upx
behavioral2/files/0x0007000000023406-145.dat	upx
behavioral2/files/0x0007000000023405-140.dat	upx
behavioral2/files/0x0007000000023404-135.dat	upx
behavioral2/files/0x0007000000023402-125.dat	upx
behavioral2/files/0x0007000000023401-120.dat	upx
behavioral2/memory/2772-570-0x00007FF76B2C0000-0x00007FF76B614000-memory.dmp	upx
behavioral2/files/0x0007000000023400-113.dat	upx
behavioral2/files/0x00070000000233ff-105.dat	upx
behavioral2/memory/3444-94-0x00007FF767BB0000-0x00007FF767F04000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-93.dat	upx
behavioral2/memory/4348-87-0x00007FF7BDBC0000-0x00007FF7BDF14000-memory.dmp	upx
behavioral2/memory/536-82-0x00007FF6456A0000-0x00007FF6459F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NEXhAwd.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\LNvbPae.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\waPJEeY.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\OrvFYpR.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\owwUZKC.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\AVbiwkc.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\nPsjfCQ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\xxgZxhb.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\DcAIGsM.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\rXfrdwM.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\RCveeea.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\HoxcEoU.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\ZRtWjGb.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\rpqIsMN.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\kQmYySQ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\bWWklpX.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\BoJBftb.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\rOjZbLU.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\tOsbShl.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\sZgUrjB.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\fgTijTP.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\DSurQWM.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\oMxbTrg.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\cXCaiBA.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\raftbxB.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\AwZUTID.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\SytqNBe.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\kMPubeZ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\xJfqslr.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\gxSdeqQ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\luoAdLc.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\nFKVHej.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\ZTJXiYv.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\zaxpcGr.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\oucBQFu.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\kLerSWg.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\kDSdrNo.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\qYvRMNo.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\XqncPhe.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\aQePlHL.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\QXmVtAQ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\zPPScvf.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\XuOEDmS.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\fIRYnCQ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\CrtQqZx.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\WRQbeXq.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\oBoBaMU.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\baIpLOx.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\OZvWbsy.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\lzxYylZ.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\oTWEitT.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\BFxzzWw.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\WvTRhwC.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\EedXrSm.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\AYvLaKE.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\hucoYUM.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\pRuXwmv.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\YLtBafx.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\AIemPjL.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\LBGYJmP.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\LerEqFV.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\WuspwVS.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\OEFUgEw.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
File created	C:\Windows\System\cqWucXk.exe	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4048	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	82
PID 536 wrote to memory of 4048	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	82
PID 536 wrote to memory of 224	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	83
PID 536 wrote to memory of 224	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	83
PID 536 wrote to memory of 2256	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	84
PID 536 wrote to memory of 2256	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	84
PID 536 wrote to memory of 4244	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	85
PID 536 wrote to memory of 4244	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	85
PID 536 wrote to memory of 2040	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	86
PID 536 wrote to memory of 2040	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	86
PID 536 wrote to memory of 3288	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	87
PID 536 wrote to memory of 3288	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	87
PID 536 wrote to memory of 4928	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	88
PID 536 wrote to memory of 4928	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	88
PID 536 wrote to memory of 3068	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	89
PID 536 wrote to memory of 3068	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	89
PID 536 wrote to memory of 4200	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	90
PID 536 wrote to memory of 4200	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	90
PID 536 wrote to memory of 2012	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	91
PID 536 wrote to memory of 2012	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	91
PID 536 wrote to memory of 1896	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	92
PID 536 wrote to memory of 1896	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	92
PID 536 wrote to memory of 4348	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	93
PID 536 wrote to memory of 4348	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	93
PID 536 wrote to memory of 3444	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	94
PID 536 wrote to memory of 3444	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	94
PID 536 wrote to memory of 3084	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	95
PID 536 wrote to memory of 3084	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	95
PID 536 wrote to memory of 3968	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	96
PID 536 wrote to memory of 3968	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	96
PID 536 wrote to memory of 2508	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	97
PID 536 wrote to memory of 2508	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	97
PID 536 wrote to memory of 2772	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	98
PID 536 wrote to memory of 2772	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	98
PID 536 wrote to memory of 4004	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	99
PID 536 wrote to memory of 4004	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	99
PID 536 wrote to memory of 1324	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	100
PID 536 wrote to memory of 1324	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	100
PID 536 wrote to memory of 1844	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	101
PID 536 wrote to memory of 1844	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	101
PID 536 wrote to memory of 3124	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	102
PID 536 wrote to memory of 3124	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	102
PID 536 wrote to memory of 2004	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	103
PID 536 wrote to memory of 2004	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	103
PID 536 wrote to memory of 540	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	104
PID 536 wrote to memory of 540	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	104
PID 536 wrote to memory of 1932	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	105
PID 536 wrote to memory of 1932	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	105
PID 536 wrote to memory of 2848	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	106
PID 536 wrote to memory of 2848	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	106
PID 536 wrote to memory of 4376	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	107
PID 536 wrote to memory of 4376	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	107
PID 536 wrote to memory of 4604	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	108
PID 536 wrote to memory of 4604	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	108
PID 536 wrote to memory of 4072	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	109
PID 536 wrote to memory of 4072	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	109
PID 536 wrote to memory of 3628	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	110
PID 536 wrote to memory of 3628	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	110
PID 536 wrote to memory of 1108	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	111
PID 536 wrote to memory of 1108	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	111
PID 536 wrote to memory of 1692	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	112
PID 536 wrote to memory of 1692	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	112
PID 536 wrote to memory of 2164	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	113
PID 536 wrote to memory of 2164	536	9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9fc6e892cb40257b387a3f5c933b7350_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System\gqLGfRs.exe
  C:\Windows\System\gqLGfRs.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\mHsyTqO.exe
  C:\Windows\System\mHsyTqO.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\WMmnkpf.exe
  C:\Windows\System\WMmnkpf.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\WvTRhwC.exe
  C:\Windows\System\WvTRhwC.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\CviEpeR.exe
  C:\Windows\System\CviEpeR.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\IBFTExy.exe
  C:\Windows\System\IBFTExy.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\xxgZxhb.exe
  C:\Windows\System\xxgZxhb.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\XClGdVU.exe
  C:\Windows\System\XClGdVU.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\XDksxMR.exe
  C:\Windows\System\XDksxMR.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\cBSouml.exe
  C:\Windows\System\cBSouml.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\sonPqNT.exe
  C:\Windows\System\sonPqNT.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\VLclOhk.exe
  C:\Windows\System\VLclOhk.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\ZboUVHm.exe
  C:\Windows\System\ZboUVHm.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ajlVvXp.exe
  C:\Windows\System\ajlVvXp.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\ctmfSGk.exe
  C:\Windows\System\ctmfSGk.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\gqtSMni.exe
  C:\Windows\System\gqtSMni.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\zYGDRTT.exe
  C:\Windows\System\zYGDRTT.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\PpadpqT.exe
  C:\Windows\System\PpadpqT.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\OVlFTed.exe
  C:\Windows\System\OVlFTed.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\aRalYuQ.exe
  C:\Windows\System\aRalYuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\OrvFYpR.exe
  C:\Windows\System\OrvFYpR.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\iijERLq.exe
  C:\Windows\System\iijERLq.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\jhmBnTT.exe
  C:\Windows\System\jhmBnTT.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\yvbDMeT.exe
  C:\Windows\System\yvbDMeT.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\XgLInNV.exe
  C:\Windows\System\XgLInNV.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\dnSSywO.exe
  C:\Windows\System\dnSSywO.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\JzhwAGd.exe
  C:\Windows\System\JzhwAGd.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\IEmlqIY.exe
  C:\Windows\System\IEmlqIY.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\nHxONxb.exe
  C:\Windows\System\nHxONxb.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\OfBPuBN.exe
  C:\Windows\System\OfBPuBN.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\CWuhFVw.exe
  C:\Windows\System\CWuhFVw.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\kEeOqta.exe
  C:\Windows\System\kEeOqta.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\xSiaSSh.exe
  C:\Windows\System\xSiaSSh.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\LpvrTyy.exe
  C:\Windows\System\LpvrTyy.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\hETVcgR.exe
  C:\Windows\System\hETVcgR.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\rNFPmkM.exe
  C:\Windows\System\rNFPmkM.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\CyucoXA.exe
  C:\Windows\System\CyucoXA.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\pVsDxNj.exe
  C:\Windows\System\pVsDxNj.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\GIXZbTb.exe
  C:\Windows\System\GIXZbTb.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\qkFOosf.exe
  C:\Windows\System\qkFOosf.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\AbLmEeC.exe
  C:\Windows\System\AbLmEeC.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\xMVczWU.exe
  C:\Windows\System\xMVczWU.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\PXCVHZr.exe
  C:\Windows\System\PXCVHZr.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\LuYUkcY.exe
  C:\Windows\System\LuYUkcY.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\USyoVGl.exe
  C:\Windows\System\USyoVGl.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\GBDczqZ.exe
  C:\Windows\System\GBDczqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\SbazGHm.exe
  C:\Windows\System\SbazGHm.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\kLerSWg.exe
  C:\Windows\System\kLerSWg.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\tEqzgiL.exe
  C:\Windows\System\tEqzgiL.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\odnafiO.exe
  C:\Windows\System\odnafiO.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\BoJBftb.exe
  C:\Windows\System\BoJBftb.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\cXmhSsV.exe
  C:\Windows\System\cXmhSsV.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\BSdzCbb.exe
  C:\Windows\System\BSdzCbb.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jSbAOox.exe
  C:\Windows\System\jSbAOox.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\QmLLxNh.exe
  C:\Windows\System\QmLLxNh.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\keuEqdW.exe
  C:\Windows\System\keuEqdW.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\DkdKwmI.exe
  C:\Windows\System\DkdKwmI.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\IUikoJX.exe
  C:\Windows\System\IUikoJX.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\uxxjzzP.exe
  C:\Windows\System\uxxjzzP.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\dQChSCO.exe
  C:\Windows\System\dQChSCO.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\BMRjvsO.exe
  C:\Windows\System\BMRjvsO.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\bDptaQk.exe
  C:\Windows\System\bDptaQk.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\pDncUoE.exe
  C:\Windows\System\pDncUoE.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\qJpMLhL.exe
  C:\Windows\System\qJpMLhL.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\LKsYVQZ.exe
  C:\Windows\System\LKsYVQZ.exe
  2⤵
  PID:4740
- C:\Windows\System\tXruYPb.exe
  C:\Windows\System\tXruYPb.exe
  2⤵
  PID:988
- C:\Windows\System\gcRJmjD.exe
  C:\Windows\System\gcRJmjD.exe
  2⤵
  PID:3088
- C:\Windows\System\tWSbkFT.exe
  C:\Windows\System\tWSbkFT.exe
  2⤵
  PID:2560
- C:\Windows\System\NpDFBBa.exe
  C:\Windows\System\NpDFBBa.exe
  2⤵
  PID:1984
- C:\Windows\System\vxGxaRW.exe
  C:\Windows\System\vxGxaRW.exe
  2⤵
  PID:5128
- C:\Windows\System\nXgmBQX.exe
  C:\Windows\System\nXgmBQX.exe
  2⤵
  PID:5156
- C:\Windows\System\iEqLgfR.exe
  C:\Windows\System\iEqLgfR.exe
  2⤵
  PID:5184
- C:\Windows\System\AIemPjL.exe
  C:\Windows\System\AIemPjL.exe
  2⤵
  PID:5212
- C:\Windows\System\LNLnrhU.exe
  C:\Windows\System\LNLnrhU.exe
  2⤵
  PID:5240
- C:\Windows\System\ZWePySh.exe
  C:\Windows\System\ZWePySh.exe
  2⤵
  PID:5268
- C:\Windows\System\FdaEtnh.exe
  C:\Windows\System\FdaEtnh.exe
  2⤵
  PID:5296
- C:\Windows\System\XBeuDjU.exe
  C:\Windows\System\XBeuDjU.exe
  2⤵
  PID:5324
- C:\Windows\System\NUdOUCV.exe
  C:\Windows\System\NUdOUCV.exe
  2⤵
  PID:5352
- C:\Windows\System\waPJEeY.exe
  C:\Windows\System\waPJEeY.exe
  2⤵
  PID:5380
- C:\Windows\System\dvZCnTw.exe
  C:\Windows\System\dvZCnTw.exe
  2⤵
  PID:5408
- C:\Windows\System\dFcXYsL.exe
  C:\Windows\System\dFcXYsL.exe
  2⤵
  PID:5436
- C:\Windows\System\HbYzGCo.exe
  C:\Windows\System\HbYzGCo.exe
  2⤵
  PID:5464
- C:\Windows\System\HGxsibt.exe
  C:\Windows\System\HGxsibt.exe
  2⤵
  PID:5492
- C:\Windows\System\qXDnKGG.exe
  C:\Windows\System\qXDnKGG.exe
  2⤵
  PID:5520
- C:\Windows\System\RmLsrga.exe
  C:\Windows\System\RmLsrga.exe
  2⤵
  PID:5548
- C:\Windows\System\HoxcEoU.exe
  C:\Windows\System\HoxcEoU.exe
  2⤵
  PID:5576
- C:\Windows\System\MRfkEMT.exe
  C:\Windows\System\MRfkEMT.exe
  2⤵
  PID:5600
- C:\Windows\System\RCveeea.exe
  C:\Windows\System\RCveeea.exe
  2⤵
  PID:5632
- C:\Windows\System\XsCNDrM.exe
  C:\Windows\System\XsCNDrM.exe
  2⤵
  PID:5660
- C:\Windows\System\SJySHur.exe
  C:\Windows\System\SJySHur.exe
  2⤵
  PID:5688
- C:\Windows\System\owwUZKC.exe
  C:\Windows\System\owwUZKC.exe
  2⤵
  PID:5716
- C:\Windows\System\swyTbFm.exe
  C:\Windows\System\swyTbFm.exe
  2⤵
  PID:5744
- C:\Windows\System\ZTJXiYv.exe
  C:\Windows\System\ZTJXiYv.exe
  2⤵
  PID:5772
- C:\Windows\System\kGnrdOJ.exe
  C:\Windows\System\kGnrdOJ.exe
  2⤵
  PID:5800
- C:\Windows\System\hwoxAHf.exe
  C:\Windows\System\hwoxAHf.exe
  2⤵
  PID:5828
- C:\Windows\System\Axlooug.exe
  C:\Windows\System\Axlooug.exe
  2⤵
  PID:5856
- C:\Windows\System\LCKHEzf.exe
  C:\Windows\System\LCKHEzf.exe
  2⤵
  PID:5884
- C:\Windows\System\OaKiNhH.exe
  C:\Windows\System\OaKiNhH.exe
  2⤵
  PID:5912
- C:\Windows\System\KKZfSLS.exe
  C:\Windows\System\KKZfSLS.exe
  2⤵
  PID:5940
- C:\Windows\System\BcWodyJ.exe
  C:\Windows\System\BcWodyJ.exe
  2⤵
  PID:5964
- C:\Windows\System\PYejSCo.exe
  C:\Windows\System\PYejSCo.exe
  2⤵
  PID:5992
- C:\Windows\System\KyIEHSz.exe
  C:\Windows\System\KyIEHSz.exe
  2⤵
  PID:6024
- C:\Windows\System\AkTSFFl.exe
  C:\Windows\System\AkTSFFl.exe
  2⤵
  PID:6048
- C:\Windows\System\AzjLHde.exe
  C:\Windows\System\AzjLHde.exe
  2⤵
  PID:6080
- C:\Windows\System\xuVFkxL.exe
  C:\Windows\System\xuVFkxL.exe
  2⤵
  PID:6108
- C:\Windows\System\qzMmzOy.exe
  C:\Windows\System\qzMmzOy.exe
  2⤵
  PID:6136
- C:\Windows\System\akPqias.exe
  C:\Windows\System\akPqias.exe
  2⤵
  PID:6168
- C:\Windows\System\wPHYgxw.exe
  C:\Windows\System\wPHYgxw.exe
  2⤵
  PID:6196
- C:\Windows\System\xhjavKo.exe
  C:\Windows\System\xhjavKo.exe
  2⤵
  PID:6224
- C:\Windows\System\agcGGIL.exe
  C:\Windows\System\agcGGIL.exe
  2⤵
  PID:6252
- C:\Windows\System\asuEYom.exe
  C:\Windows\System\asuEYom.exe
  2⤵
  PID:6280
- C:\Windows\System\GUUAAmR.exe
  C:\Windows\System\GUUAAmR.exe
  2⤵
  PID:6308
- C:\Windows\System\FhfCCVr.exe
  C:\Windows\System\FhfCCVr.exe
  2⤵
  PID:6336
- C:\Windows\System\HIZktEh.exe
  C:\Windows\System\HIZktEh.exe
  2⤵
  PID:6364
- C:\Windows\System\GOFYuxU.exe
  C:\Windows\System\GOFYuxU.exe
  2⤵
  PID:6392
- C:\Windows\System\nFKVHej.exe
  C:\Windows\System\nFKVHej.exe
  2⤵
  PID:6420
- C:\Windows\System\xAzILXQ.exe
  C:\Windows\System\xAzILXQ.exe
  2⤵
  PID:6448
- C:\Windows\System\rkgAYbg.exe
  C:\Windows\System\rkgAYbg.exe
  2⤵
  PID:6476
- C:\Windows\System\uAZYwuU.exe
  C:\Windows\System\uAZYwuU.exe
  2⤵
  PID:6504
- C:\Windows\System\evTDkYy.exe
  C:\Windows\System\evTDkYy.exe
  2⤵
  PID:6532
- C:\Windows\System\vCBoJgJ.exe
  C:\Windows\System\vCBoJgJ.exe
  2⤵
  PID:6560
- C:\Windows\System\fmENHrP.exe
  C:\Windows\System\fmENHrP.exe
  2⤵
  PID:6588
- C:\Windows\System\DULQyvC.exe
  C:\Windows\System\DULQyvC.exe
  2⤵
  PID:6616
- C:\Windows\System\lSyQkGq.exe
  C:\Windows\System\lSyQkGq.exe
  2⤵
  PID:6644
- C:\Windows\System\LBGYJmP.exe
  C:\Windows\System\LBGYJmP.exe
  2⤵
  PID:6672
- C:\Windows\System\ZVYKuoW.exe
  C:\Windows\System\ZVYKuoW.exe
  2⤵
  PID:6700
- C:\Windows\System\bxwIzfP.exe
  C:\Windows\System\bxwIzfP.exe
  2⤵
  PID:6728
- C:\Windows\System\oypAjyQ.exe
  C:\Windows\System\oypAjyQ.exe
  2⤵
  PID:6756
- C:\Windows\System\YOEQjPC.exe
  C:\Windows\System\YOEQjPC.exe
  2⤵
  PID:6784
- C:\Windows\System\raftbxB.exe
  C:\Windows\System\raftbxB.exe
  2⤵
  PID:6812
- C:\Windows\System\hkofppq.exe
  C:\Windows\System\hkofppq.exe
  2⤵
  PID:6840
- C:\Windows\System\CGKWyUg.exe
  C:\Windows\System\CGKWyUg.exe
  2⤵
  PID:6868
- C:\Windows\System\vyZGikx.exe
  C:\Windows\System\vyZGikx.exe
  2⤵
  PID:6896
- C:\Windows\System\rDqMvQS.exe
  C:\Windows\System\rDqMvQS.exe
  2⤵
  PID:6924
- C:\Windows\System\CNlHAZM.exe
  C:\Windows\System\CNlHAZM.exe
  2⤵
  PID:6952
- C:\Windows\System\vlkvPCl.exe
  C:\Windows\System\vlkvPCl.exe
  2⤵
  PID:6980
- C:\Windows\System\FCNqRNi.exe
  C:\Windows\System\FCNqRNi.exe
  2⤵
  PID:7008
- C:\Windows\System\JXwDNFh.exe
  C:\Windows\System\JXwDNFh.exe
  2⤵
  PID:7036
- C:\Windows\System\mKyjsDJ.exe
  C:\Windows\System\mKyjsDJ.exe
  2⤵
  PID:7064
- C:\Windows\System\arXFebj.exe
  C:\Windows\System\arXFebj.exe
  2⤵
  PID:7092
- C:\Windows\System\LerEqFV.exe
  C:\Windows\System\LerEqFV.exe
  2⤵
  PID:7120
- C:\Windows\System\VpwEYPx.exe
  C:\Windows\System\VpwEYPx.exe
  2⤵
  PID:7148
- C:\Windows\System\KkzlVVY.exe
  C:\Windows\System\KkzlVVY.exe
  2⤵
  PID:4804
- C:\Windows\System\MWaasrn.exe
  C:\Windows\System\MWaasrn.exe
  2⤵
  PID:5872
- C:\Windows\System\MPcNaQg.exe
  C:\Windows\System\MPcNaQg.exe
  2⤵
  PID:5840
- C:\Windows\System\CbPZoyw.exe
  C:\Windows\System\CbPZoyw.exe
  2⤵
  PID:5784
- C:\Windows\System\zxVvySa.exe
  C:\Windows\System\zxVvySa.exe
  2⤵
  PID:5736
- C:\Windows\System\riDvHRg.exe
  C:\Windows\System\riDvHRg.exe
  2⤵
  PID:5676
- C:\Windows\System\rwbbiQq.exe
  C:\Windows\System\rwbbiQq.exe
  2⤵
  PID:5616
- C:\Windows\System\FGwKqZT.exe
  C:\Windows\System\FGwKqZT.exe
  2⤵
  PID:5564
- C:\Windows\System\uFOpVAz.exe
  C:\Windows\System\uFOpVAz.exe
  2⤵
  PID:5484
- C:\Windows\System\wkotxWb.exe
  C:\Windows\System\wkotxWb.exe
  2⤵
  PID:5400
- C:\Windows\System\cTvcnQj.exe
  C:\Windows\System\cTvcnQj.exe
  2⤵
  PID:5336
- C:\Windows\System\GyPhJxn.exe
  C:\Windows\System\GyPhJxn.exe
  2⤵
  PID:5228
- C:\Windows\System\zzUjvzM.exe
  C:\Windows\System\zzUjvzM.exe
  2⤵
  PID:5176
- C:\Windows\System\EBkvmUI.exe
  C:\Windows\System\EBkvmUI.exe
  2⤵
  PID:1568
- C:\Windows\System\uqGkoLZ.exe
  C:\Windows\System\uqGkoLZ.exe
  2⤵
  PID:3828
- C:\Windows\System\fKzJLWl.exe
  C:\Windows\System\fKzJLWl.exe
  2⤵
  PID:1344
- C:\Windows\System\JnEnpnV.exe
  C:\Windows\System\JnEnpnV.exe
  2⤵
  PID:3328
- C:\Windows\System\rOjZbLU.exe
  C:\Windows\System\rOjZbLU.exe
  2⤵
  PID:4560
- C:\Windows\System\GqNGhbo.exe
  C:\Windows\System\GqNGhbo.exe
  2⤵
  PID:436
- C:\Windows\System\wSuVwlb.exe
  C:\Windows\System\wSuVwlb.exe
  2⤵
  PID:4944
- C:\Windows\System\nmEJysJ.exe
  C:\Windows\System\nmEJysJ.exe
  2⤵
  PID:1376
- C:\Windows\System\AIGKaLq.exe
  C:\Windows\System\AIGKaLq.exe
  2⤵
  PID:2860
- C:\Windows\System\qgmGOiW.exe
  C:\Windows\System\qgmGOiW.exe
  2⤵
  PID:1148
- C:\Windows\System\hsjebeC.exe
  C:\Windows\System\hsjebeC.exe
  2⤵
  PID:2400
- C:\Windows\System\gxSdeqQ.exe
  C:\Windows\System\gxSdeqQ.exe
  2⤵
  PID:2340
- C:\Windows\System\ZRtWjGb.exe
  C:\Windows\System\ZRtWjGb.exe
  2⤵
  PID:3564
- C:\Windows\System\QmupbWk.exe
  C:\Windows\System\QmupbWk.exe
  2⤵
  PID:2424
- C:\Windows\System\yxHHDCC.exe
  C:\Windows\System\yxHHDCC.exe
  2⤵
  PID:1300
- C:\Windows\System\AwZUTID.exe
  C:\Windows\System\AwZUTID.exe
  2⤵
  PID:1548
- C:\Windows\System\VndmDpM.exe
  C:\Windows\System\VndmDpM.exe
  2⤵
  PID:4124
- C:\Windows\System\xAdIHBh.exe
  C:\Windows\System\xAdIHBh.exe
  2⤵
  PID:1208
- C:\Windows\System\WwYNQcN.exe
  C:\Windows\System\WwYNQcN.exe
  2⤵
  PID:4960
- C:\Windows\System\SytqNBe.exe
  C:\Windows\System\SytqNBe.exe
  2⤵
  PID:4776
- C:\Windows\System\HTbyXOs.exe
  C:\Windows\System\HTbyXOs.exe
  2⤵
  PID:6068
- C:\Windows\System\vLDLAiM.exe
  C:\Windows\System\vLDLAiM.exe
  2⤵
  PID:6128
- C:\Windows\System\ypEKXeC.exe
  C:\Windows\System\ypEKXeC.exe
  2⤵
  PID:6208
- C:\Windows\System\xaBeXNj.exe
  C:\Windows\System\xaBeXNj.exe
  2⤵
  PID:6268
- C:\Windows\System\WwNwsDl.exe
  C:\Windows\System\WwNwsDl.exe
  2⤵
  PID:6324
- C:\Windows\System\ltZtxwu.exe
  C:\Windows\System\ltZtxwu.exe
  2⤵
  PID:6404
- C:\Windows\System\jfHQdRi.exe
  C:\Windows\System\jfHQdRi.exe
  2⤵
  PID:3320
- C:\Windows\System\krtGrVS.exe
  C:\Windows\System\krtGrVS.exe
  2⤵
  PID:6516
- C:\Windows\System\kPMxwXp.exe
  C:\Windows\System\kPMxwXp.exe
  2⤵
  PID:6552
- C:\Windows\System\RQnEKHd.exe
  C:\Windows\System\RQnEKHd.exe
  2⤵
  PID:6604
- C:\Windows\System\USLWEem.exe
  C:\Windows\System\USLWEem.exe
  2⤵
  PID:6660
- C:\Windows\System\DjoGPAE.exe
  C:\Windows\System\DjoGPAE.exe
  2⤵
  PID:6716
- C:\Windows\System\WlVVxMq.exe
  C:\Windows\System\WlVVxMq.exe
  2⤵
  PID:6796
- C:\Windows\System\rpqIsMN.exe
  C:\Windows\System\rpqIsMN.exe
  2⤵
  PID:6860
- C:\Windows\System\RLhpivU.exe
  C:\Windows\System\RLhpivU.exe
  2⤵
  PID:6936
- C:\Windows\System\RkHRsFe.exe
  C:\Windows\System\RkHRsFe.exe
  2⤵
  PID:6992
- C:\Windows\System\hpSXQDE.exe
  C:\Windows\System\hpSXQDE.exe
  2⤵
  PID:5096
- C:\Windows\System\CreNbwM.exe
  C:\Windows\System\CreNbwM.exe
  2⤵
  PID:4936
- C:\Windows\System\VvujzHB.exe
  C:\Windows\System\VvujzHB.exe
  2⤵
  PID:7084
- C:\Windows\System\lVjRtYy.exe
  C:\Windows\System\lVjRtYy.exe
  2⤵
  PID:7112
- C:\Windows\System\EedXrSm.exe
  C:\Windows\System\EedXrSm.exe
  2⤵
  PID:1760
- C:\Windows\System\YCrDkUm.exe
  C:\Windows\System\YCrDkUm.exe
  2⤵
  PID:4784
- C:\Windows\System\QBHtPRh.exe
  C:\Windows\System\QBHtPRh.exe
  2⤵
  PID:5024
- C:\Windows\System\yUpHGlE.exe
  C:\Windows\System\yUpHGlE.exe
  2⤵
  PID:6044
- C:\Windows\System\MIGqIZn.exe
  C:\Windows\System\MIGqIZn.exe
  2⤵
  PID:5812
- C:\Windows\System\AYvLaKE.exe
  C:\Windows\System\AYvLaKE.exe
  2⤵
  PID:5644
- C:\Windows\System\rwNtQNs.exe
  C:\Windows\System\rwNtQNs.exe
  2⤵
  PID:5508
- C:\Windows\System\WtlmDdY.exe
  C:\Windows\System\WtlmDdY.exe
  2⤵
  PID:5284
- C:\Windows\System\waZTDjt.exe
  C:\Windows\System\waZTDjt.exe
  2⤵
  PID:5112
- C:\Windows\System\vGFuWHb.exe
  C:\Windows\System\vGFuWHb.exe
  2⤵
  PID:4304
- C:\Windows\System\CEsEcTN.exe
  C:\Windows\System\CEsEcTN.exe
  2⤵
  PID:4428
- C:\Windows\System\VKkDqLf.exe
  C:\Windows\System\VKkDqLf.exe
  2⤵
  PID:5952
- C:\Windows\System\CxHVtDN.exe
  C:\Windows\System\CxHVtDN.exe
  2⤵
  PID:5452
- C:\Windows\System\UJSdHnI.exe
  C:\Windows\System\UJSdHnI.exe
  2⤵
  PID:4496
- C:\Windows\System\YGtjzie.exe
  C:\Windows\System\YGtjzie.exe
  2⤵
  PID:4488
- C:\Windows\System\KmFCHYy.exe
  C:\Windows\System\KmFCHYy.exe
  2⤵
  PID:4544
- C:\Windows\System\lJcEzTG.exe
  C:\Windows\System\lJcEzTG.exe
  2⤵
  PID:4756
- C:\Windows\System\DILCTVc.exe
  C:\Windows\System\DILCTVc.exe
  2⤵
  PID:3596
- C:\Windows\System\dOuqbQW.exe
  C:\Windows\System\dOuqbQW.exe
  2⤵
  PID:744
- C:\Windows\System\luoAdLc.exe
  C:\Windows\System\luoAdLc.exe
  2⤵
  PID:2168
- C:\Windows\System\ttpUxUf.exe
  C:\Windows\System\ttpUxUf.exe
  2⤵
  PID:6184
- C:\Windows\System\WwWtdLx.exe
  C:\Windows\System\WwWtdLx.exe
  2⤵
  PID:6320
- C:\Windows\System\hucoYUM.exe
  C:\Windows\System\hucoYUM.exe
  2⤵
  PID:6496
- C:\Windows\System\YUgXqEF.exe
  C:\Windows\System\YUgXqEF.exe
  2⤵
  PID:6576
- C:\Windows\System\dKAdtiG.exe
  C:\Windows\System\dKAdtiG.exe
  2⤵
  PID:6688
- C:\Windows\System\nHzpozE.exe
  C:\Windows\System\nHzpozE.exe
  2⤵
  PID:6824
- C:\Windows\System\XvRRsoF.exe
  C:\Windows\System\XvRRsoF.exe
  2⤵
  PID:6944
- C:\Windows\System\qqynrDU.exe
  C:\Windows\System\qqynrDU.exe
  2⤵
  PID:7048
- C:\Windows\System\lxCGXkO.exe
  C:\Windows\System\lxCGXkO.exe
  2⤵
  PID:1052
- C:\Windows\System\LfCuVlZ.exe
  C:\Windows\System\LfCuVlZ.exe
  2⤵
  PID:2652
- C:\Windows\System\Vthzgeg.exe
  C:\Windows\System\Vthzgeg.exe
  2⤵
  PID:5896
- C:\Windows\System\DtzmGJr.exe
  C:\Windows\System\DtzmGJr.exe
  2⤵
  PID:5368
- C:\Windows\System\hsYpviT.exe
  C:\Windows\System\hsYpviT.exe
  2⤵
  PID:5204
- C:\Windows\System\ZLCljqu.exe
  C:\Windows\System\ZLCljqu.exe
  2⤵
  PID:5960
- C:\Windows\System\gqvyLlO.exe
  C:\Windows\System\gqvyLlO.exe
  2⤵
  PID:2416
- C:\Windows\System\ISzhhdC.exe
  C:\Windows\System\ISzhhdC.exe
  2⤵
  PID:5100
- C:\Windows\System\JeHCZzO.exe
  C:\Windows\System\JeHCZzO.exe
  2⤵
  PID:3932
- C:\Windows\System\DvxzJOw.exe
  C:\Windows\System\DvxzJOw.exe
  2⤵
  PID:6124
- C:\Windows\System\dVSTxyE.exe
  C:\Windows\System\dVSTxyE.exe
  2⤵
  PID:6432
- C:\Windows\System\GCnNUag.exe
  C:\Windows\System\GCnNUag.exe
  2⤵
  PID:6832
- C:\Windows\System\oBoBaMU.exe
  C:\Windows\System\oBoBaMU.exe
  2⤵
  PID:7052
- C:\Windows\System\hhXxcqB.exe
  C:\Windows\System\hhXxcqB.exe
  2⤵
  PID:5104
- C:\Windows\System\UlJSMLz.exe
  C:\Windows\System\UlJSMLz.exe
  2⤵
  PID:4432
- C:\Windows\System\fMtyAEN.exe
  C:\Windows\System\fMtyAEN.exe
  2⤵
  PID:4196
- C:\Windows\System\bcOXjnp.exe
  C:\Windows\System\bcOXjnp.exe
  2⤵
  PID:2384
- C:\Windows\System\BVoyZOg.exe
  C:\Windows\System\BVoyZOg.exe
  2⤵
  PID:6684
- C:\Windows\System\MKbfDdd.exe
  C:\Windows\System\MKbfDdd.exe
  2⤵
  PID:3508
- C:\Windows\System\YllRsHQ.exe
  C:\Windows\System\YllRsHQ.exe
  2⤵
  PID:3032
- C:\Windows\System\fIRYnCQ.exe
  C:\Windows\System\fIRYnCQ.exe
  2⤵
  PID:5592
- C:\Windows\System\HwvFEVn.exe
  C:\Windows\System\HwvFEVn.exe
  2⤵
  PID:7176
- C:\Windows\System\tOsbShl.exe
  C:\Windows\System\tOsbShl.exe
  2⤵
  PID:7204
- C:\Windows\System\MHztgDd.exe
  C:\Windows\System\MHztgDd.exe
  2⤵
  PID:7220
- C:\Windows\System\SJBcxWp.exe
  C:\Windows\System\SJBcxWp.exe
  2⤵
  PID:7248
- C:\Windows\System\bXrGmKy.exe
  C:\Windows\System\bXrGmKy.exe
  2⤵
  PID:7264
- C:\Windows\System\NtuOiaS.exe
  C:\Windows\System\NtuOiaS.exe
  2⤵
  PID:7316
- C:\Windows\System\KsebYik.exe
  C:\Windows\System\KsebYik.exe
  2⤵
  PID:7344
- C:\Windows\System\QQuXBtu.exe
  C:\Windows\System\QQuXBtu.exe
  2⤵
  PID:7376
- C:\Windows\System\zkTVoya.exe
  C:\Windows\System\zkTVoya.exe
  2⤵
  PID:7392
- C:\Windows\System\WuspwVS.exe
  C:\Windows\System\WuspwVS.exe
  2⤵
  PID:7420
- C:\Windows\System\xYMrlRd.exe
  C:\Windows\System\xYMrlRd.exe
  2⤵
  PID:7460
- C:\Windows\System\YHfaPFN.exe
  C:\Windows\System\YHfaPFN.exe
  2⤵
  PID:7488
- C:\Windows\System\pwxQXYF.exe
  C:\Windows\System\pwxQXYF.exe
  2⤵
  PID:7504
- C:\Windows\System\ZrKlMWw.exe
  C:\Windows\System\ZrKlMWw.exe
  2⤵
  PID:7544
- C:\Windows\System\AGOySTk.exe
  C:\Windows\System\AGOySTk.exe
  2⤵
  PID:7572
- C:\Windows\System\TXOZjHv.exe
  C:\Windows\System\TXOZjHv.exe
  2⤵
  PID:7600
- C:\Windows\System\QgRzPcx.exe
  C:\Windows\System\QgRzPcx.exe
  2⤵
  PID:7616
- C:\Windows\System\azLgqRR.exe
  C:\Windows\System\azLgqRR.exe
  2⤵
  PID:7644
- C:\Windows\System\rfjUbgJ.exe
  C:\Windows\System\rfjUbgJ.exe
  2⤵
  PID:7684
- C:\Windows\System\kmEByVT.exe
  C:\Windows\System\kmEByVT.exe
  2⤵
  PID:7712
- C:\Windows\System\YbHKxdr.exe
  C:\Windows\System\YbHKxdr.exe
  2⤵
  PID:7728
- C:\Windows\System\oIWcFOt.exe
  C:\Windows\System\oIWcFOt.exe
  2⤵
  PID:7756
- C:\Windows\System\RLBJfQA.exe
  C:\Windows\System\RLBJfQA.exe
  2⤵
  PID:7788
- C:\Windows\System\AyCrDYf.exe
  C:\Windows\System\AyCrDYf.exe
  2⤵
  PID:7824
- C:\Windows\System\awDTDSv.exe
  C:\Windows\System\awDTDSv.exe
  2⤵
  PID:7840
- C:\Windows\System\kfTyyBx.exe
  C:\Windows\System\kfTyyBx.exe
  2⤵
  PID:7880
- C:\Windows\System\VxQKtzT.exe
  C:\Windows\System\VxQKtzT.exe
  2⤵
  PID:7908
- C:\Windows\System\QawYokB.exe
  C:\Windows\System\QawYokB.exe
  2⤵
  PID:7936
- C:\Windows\System\OkjiAEV.exe
  C:\Windows\System\OkjiAEV.exe
  2⤵
  PID:7956
- C:\Windows\System\NgAgnLG.exe
  C:\Windows\System\NgAgnLG.exe
  2⤵
  PID:7984
- C:\Windows\System\cqBoWMI.exe
  C:\Windows\System\cqBoWMI.exe
  2⤵
  PID:8012
- C:\Windows\System\ENUPijt.exe
  C:\Windows\System\ENUPijt.exe
  2⤵
  PID:8036
- C:\Windows\System\frDYUPQ.exe
  C:\Windows\System\frDYUPQ.exe
  2⤵
  PID:8076
- C:\Windows\System\xhHrjRp.exe
  C:\Windows\System\xhHrjRp.exe
  2⤵
  PID:8096
- C:\Windows\System\NEXhAwd.exe
  C:\Windows\System\NEXhAwd.exe
  2⤵
  PID:8132
- C:\Windows\System\yNiueSc.exe
  C:\Windows\System\yNiueSc.exe
  2⤵
  PID:8164
- C:\Windows\System\VhXXGdE.exe
  C:\Windows\System\VhXXGdE.exe
  2⤵
  PID:2724
- C:\Windows\System\kUtKZMI.exe
  C:\Windows\System\kUtKZMI.exe
  2⤵
  PID:7216
- C:\Windows\System\ZUURmSs.exe
  C:\Windows\System\ZUURmSs.exe
  2⤵
  PID:7260
- C:\Windows\System\kQmYySQ.exe
  C:\Windows\System\kQmYySQ.exe
  2⤵
  PID:7364
- C:\Windows\System\ePsRIwq.exe
  C:\Windows\System\ePsRIwq.exe
  2⤵
  PID:7416
- C:\Windows\System\lEpGgVR.exe
  C:\Windows\System\lEpGgVR.exe
  2⤵
  PID:7484
- C:\Windows\System\cKqxHkv.exe
  C:\Windows\System\cKqxHkv.exe
  2⤵
  PID:7520
- C:\Windows\System\WGJjsnX.exe
  C:\Windows\System\WGJjsnX.exe
  2⤵
  PID:7612
- C:\Windows\System\IhtsACP.exe
  C:\Windows\System\IhtsACP.exe
  2⤵
  PID:7640
- C:\Windows\System\lWRNZvQ.exe
  C:\Windows\System\lWRNZvQ.exe
  2⤵
  PID:7676
- C:\Windows\System\yfTjALC.exe
  C:\Windows\System\yfTjALC.exe
  2⤵
  PID:7740
- C:\Windows\System\WVULDUd.exe
  C:\Windows\System\WVULDUd.exe
  2⤵
  PID:7904
- C:\Windows\System\KxifReU.exe
  C:\Windows\System\KxifReU.exe
  2⤵
  PID:7932
- C:\Windows\System\RNaoVWm.exe
  C:\Windows\System\RNaoVWm.exe
  2⤵
  PID:8008
- C:\Windows\System\KAdzYTx.exe
  C:\Windows\System\KAdzYTx.exe
  2⤵
  PID:8068
- C:\Windows\System\ZxhFTJb.exe
  C:\Windows\System\ZxhFTJb.exe
  2⤵
  PID:8160
- C:\Windows\System\DUGziBZ.exe
  C:\Windows\System\DUGziBZ.exe
  2⤵
  PID:4676
- C:\Windows\System\jcNzkrI.exe
  C:\Windows\System\jcNzkrI.exe
  2⤵
  PID:7384
- C:\Windows\System\yTNuPxk.exe
  C:\Windows\System\yTNuPxk.exe
  2⤵
  PID:7564
- C:\Windows\System\kDSdrNo.exe
  C:\Windows\System\kDSdrNo.exe
  2⤵
  PID:7628
- C:\Windows\System\XglOZLO.exe
  C:\Windows\System\XglOZLO.exe
  2⤵
  PID:7800
- C:\Windows\System\HqpwghS.exe
  C:\Windows\System\HqpwghS.exe
  2⤵
  PID:7992
- C:\Windows\System\xogYvVt.exe
  C:\Windows\System\xogYvVt.exe
  2⤵
  PID:8028
- C:\Windows\System\OEFUgEw.exe
  C:\Windows\System\OEFUgEw.exe
  2⤵
  PID:7236
- C:\Windows\System\tIHWpFl.exe
  C:\Windows\System\tIHWpFl.exe
  2⤵
  PID:7556
- C:\Windows\System\hVqoXZe.exe
  C:\Windows\System\hVqoXZe.exe
  2⤵
  PID:7944
- C:\Windows\System\NqlrrsD.exe
  C:\Windows\System\NqlrrsD.exe
  2⤵
  PID:7200
- C:\Windows\System\lQAJCUy.exe
  C:\Windows\System\lQAJCUy.exe
  2⤵
  PID:7892
- C:\Windows\System\InFZMfS.exe
  C:\Windows\System\InFZMfS.exe
  2⤵
  PID:8204
- C:\Windows\System\BXvHhAg.exe
  C:\Windows\System\BXvHhAg.exe
  2⤵
  PID:8220
- C:\Windows\System\FDznNzU.exe
  C:\Windows\System\FDznNzU.exe
  2⤵
  PID:8244
- C:\Windows\System\Clmeyvw.exe
  C:\Windows\System\Clmeyvw.exe
  2⤵
  PID:8260
- C:\Windows\System\PiWBNnv.exe
  C:\Windows\System\PiWBNnv.exe
  2⤵
  PID:8284
- C:\Windows\System\FCFrtaV.exe
  C:\Windows\System\FCFrtaV.exe
  2⤵
  PID:8308
- C:\Windows\System\JzUPfES.exe
  C:\Windows\System\JzUPfES.exe
  2⤵
  PID:8356
- C:\Windows\System\bMWcAFO.exe
  C:\Windows\System\bMWcAFO.exe
  2⤵
  PID:8392
- C:\Windows\System\zdsUlpR.exe
  C:\Windows\System\zdsUlpR.exe
  2⤵
  PID:8456
- C:\Windows\System\oJlnKJR.exe
  C:\Windows\System\oJlnKJR.exe
  2⤵
  PID:8484
- C:\Windows\System\xJQXVQE.exe
  C:\Windows\System\xJQXVQE.exe
  2⤵
  PID:8508
- C:\Windows\System\nsINKUl.exe
  C:\Windows\System\nsINKUl.exe
  2⤵
  PID:8552
- C:\Windows\System\FyvtxSb.exe
  C:\Windows\System\FyvtxSb.exe
  2⤵
  PID:8576
- C:\Windows\System\heCPJSs.exe
  C:\Windows\System\heCPJSs.exe
  2⤵
  PID:8604
- C:\Windows\System\LdxTALh.exe
  C:\Windows\System\LdxTALh.exe
  2⤵
  PID:8644
- C:\Windows\System\vwqBeio.exe
  C:\Windows\System\vwqBeio.exe
  2⤵
  PID:8660
- C:\Windows\System\PVnXQlb.exe
  C:\Windows\System\PVnXQlb.exe
  2⤵
  PID:8688
- C:\Windows\System\eDQoFnN.exe
  C:\Windows\System\eDQoFnN.exe
  2⤵
  PID:8728
- C:\Windows\System\VYHzwtm.exe
  C:\Windows\System\VYHzwtm.exe
  2⤵
  PID:8756
- C:\Windows\System\feuMFhJ.exe
  C:\Windows\System\feuMFhJ.exe
  2⤵
  PID:8772
- C:\Windows\System\VepLkLS.exe
  C:\Windows\System\VepLkLS.exe
  2⤵
  PID:8812
- C:\Windows\System\zyPGSHc.exe
  C:\Windows\System\zyPGSHc.exe
  2⤵
  PID:8836
- C:\Windows\System\TbhrUXL.exe
  C:\Windows\System\TbhrUXL.exe
  2⤵
  PID:8872
- C:\Windows\System\kGwsuNp.exe
  C:\Windows\System\kGwsuNp.exe
  2⤵
  PID:8888
- C:\Windows\System\gNMUiNu.exe
  C:\Windows\System\gNMUiNu.exe
  2⤵
  PID:8928
- C:\Windows\System\baIpLOx.exe
  C:\Windows\System\baIpLOx.exe
  2⤵
  PID:8956
- C:\Windows\System\uVKSkSn.exe
  C:\Windows\System\uVKSkSn.exe
  2⤵
  PID:8984
- C:\Windows\System\UFFygOs.exe
  C:\Windows\System\UFFygOs.exe
  2⤵
  PID:9000
- C:\Windows\System\gvNFPcx.exe
  C:\Windows\System\gvNFPcx.exe
  2⤵
  PID:9028
- C:\Windows\System\qYvRMNo.exe
  C:\Windows\System\qYvRMNo.exe
  2⤵
  PID:9064
- C:\Windows\System\tlqdNEQ.exe
  C:\Windows\System\tlqdNEQ.exe
  2⤵
  PID:9084
- C:\Windows\System\geZbker.exe
  C:\Windows\System\geZbker.exe
  2⤵
  PID:9112
- C:\Windows\System\mIzibde.exe
  C:\Windows\System\mIzibde.exe
  2⤵
  PID:9140
- C:\Windows\System\LihmmNg.exe
  C:\Windows\System\LihmmNg.exe
  2⤵
  PID:9180
- C:\Windows\System\bywDisy.exe
  C:\Windows\System\bywDisy.exe
  2⤵
  PID:9208
- C:\Windows\System\CPMYRAM.exe
  C:\Windows\System\CPMYRAM.exe
  2⤵
  PID:8232
- C:\Windows\System\BzHnLhH.exe
  C:\Windows\System\BzHnLhH.exe
  2⤵
  PID:8216
- C:\Windows\System\pVOQTQp.exe
  C:\Windows\System\pVOQTQp.exe
  2⤵
  PID:8304
- C:\Windows\System\BfosQUJ.exe
  C:\Windows\System\BfosQUJ.exe
  2⤵
  PID:8416
- C:\Windows\System\UqqZzdq.exe
  C:\Windows\System\UqqZzdq.exe
  2⤵
  PID:8444
- C:\Windows\System\JlYkqmK.exe
  C:\Windows\System\JlYkqmK.exe
  2⤵
  PID:8500
- C:\Windows\System\XqncPhe.exe
  C:\Windows\System\XqncPhe.exe
  2⤵
  PID:8560
- C:\Windows\System\kjdcqlm.exe
  C:\Windows\System\kjdcqlm.exe
  2⤵
  PID:8636
- C:\Windows\System\baQIqqu.exe
  C:\Windows\System\baQIqqu.exe
  2⤵
  PID:8684
- C:\Windows\System\TgSTrKJ.exe
  C:\Windows\System\TgSTrKJ.exe
  2⤵
  PID:8720
- C:\Windows\System\UOVHoxV.exe
  C:\Windows\System\UOVHoxV.exe
  2⤵
  PID:8800
- C:\Windows\System\IYyIqhY.exe
  C:\Windows\System\IYyIqhY.exe
  2⤵
  PID:8824
- C:\Windows\System\FTKVGVW.exe
  C:\Windows\System\FTKVGVW.exe
  2⤵
  PID:8880
- C:\Windows\System\DhGlUQd.exe
  C:\Windows\System\DhGlUQd.exe
  2⤵
  PID:8972
- C:\Windows\System\LNvbPae.exe
  C:\Windows\System\LNvbPae.exe
  2⤵
  PID:9052
- C:\Windows\System\sCirCHw.exe
  C:\Windows\System\sCirCHw.exe
  2⤵
  PID:9100
- C:\Windows\System\rucfXMW.exe
  C:\Windows\System\rucfXMW.exe
  2⤵
  PID:9168
- C:\Windows\System\RGVBHaK.exe
  C:\Windows\System\RGVBHaK.exe
  2⤵
  PID:8148
- C:\Windows\System\wZknQtS.exe
  C:\Windows\System\wZknQtS.exe
  2⤵
  PID:8240
- C:\Windows\System\SavGyVR.exe
  C:\Windows\System\SavGyVR.exe
  2⤵
  PID:8496
- C:\Windows\System\FZtsMoM.exe
  C:\Windows\System\FZtsMoM.exe
  2⤵
  PID:8616
- C:\Windows\System\gymHYAa.exe
  C:\Windows\System\gymHYAa.exe
  2⤵
  PID:8752
- C:\Windows\System\mkPNvKA.exe
  C:\Windows\System\mkPNvKA.exe
  2⤵
  PID:8944
- C:\Windows\System\VERoyFC.exe
  C:\Windows\System\VERoyFC.exe
  2⤵
  PID:9016
- C:\Windows\System\sPIQPut.exe
  C:\Windows\System\sPIQPut.exe
  2⤵
  PID:896
- C:\Windows\System\KsRAgWm.exe
  C:\Windows\System\KsRAgWm.exe
  2⤵
  PID:8292
- C:\Windows\System\FadBNdh.exe
  C:\Windows\System\FadBNdh.exe
  2⤵
  PID:8384
- C:\Windows\System\mOeIvfo.exe
  C:\Windows\System\mOeIvfo.exe
  2⤵
  PID:8920
- C:\Windows\System\XNMJkYR.exe
  C:\Windows\System\XNMJkYR.exe
  2⤵
  PID:9204
- C:\Windows\System\ZvDhNtz.exe
  C:\Windows\System\ZvDhNtz.exe
  2⤵
  PID:9076
- C:\Windows\System\BHscIdQ.exe
  C:\Windows\System\BHscIdQ.exe
  2⤵
  PID:9220
- C:\Windows\System\LLWVZnH.exe
  C:\Windows\System\LLWVZnH.exe
  2⤵
  PID:9244
- C:\Windows\System\xhnPJbp.exe
  C:\Windows\System\xhnPJbp.exe
  2⤵
  PID:9284
- C:\Windows\System\cqWucXk.exe
  C:\Windows\System\cqWucXk.exe
  2⤵
  PID:9300
- C:\Windows\System\cKIitbG.exe
  C:\Windows\System\cKIitbG.exe
  2⤵
  PID:9328
- C:\Windows\System\CteXrTq.exe
  C:\Windows\System\CteXrTq.exe
  2⤵
  PID:9356
- C:\Windows\System\LJbpzzW.exe
  C:\Windows\System\LJbpzzW.exe
  2⤵
  PID:9384
- C:\Windows\System\lRJUTxK.exe
  C:\Windows\System\lRJUTxK.exe
  2⤵
  PID:9412
- C:\Windows\System\jBUiLYj.exe
  C:\Windows\System\jBUiLYj.exe
  2⤵
  PID:9444
- C:\Windows\System\zaxpcGr.exe
  C:\Windows\System\zaxpcGr.exe
  2⤵
  PID:9468
- C:\Windows\System\xIBvXHe.exe
  C:\Windows\System\xIBvXHe.exe
  2⤵
  PID:9496
- C:\Windows\System\KFobTnx.exe
  C:\Windows\System\KFobTnx.exe
  2⤵
  PID:9516
- C:\Windows\System\UPypByz.exe
  C:\Windows\System\UPypByz.exe
  2⤵
  PID:9552
- C:\Windows\System\cLVPzsz.exe
  C:\Windows\System\cLVPzsz.exe
  2⤵
  PID:9580
- C:\Windows\System\werXZUO.exe
  C:\Windows\System\werXZUO.exe
  2⤵
  PID:9608
- C:\Windows\System\aQePlHL.exe
  C:\Windows\System\aQePlHL.exe
  2⤵
  PID:9636
- C:\Windows\System\GbgjKVS.exe
  C:\Windows\System\GbgjKVS.exe
  2⤵
  PID:9676
- C:\Windows\System\wkhHLhz.exe
  C:\Windows\System\wkhHLhz.exe
  2⤵
  PID:9704
- C:\Windows\System\lFVPlGF.exe
  C:\Windows\System\lFVPlGF.exe
  2⤵
  PID:9724
- C:\Windows\System\fKpduXZ.exe
  C:\Windows\System\fKpduXZ.exe
  2⤵
  PID:9752
- C:\Windows\System\mjcgMdZ.exe
  C:\Windows\System\mjcgMdZ.exe
  2⤵
  PID:9780
- C:\Windows\System\EFZFarL.exe
  C:\Windows\System\EFZFarL.exe
  2⤵
  PID:9808
- C:\Windows\System\SjVHIwk.exe
  C:\Windows\System\SjVHIwk.exe
  2⤵
  PID:9836
- C:\Windows\System\FInwJZm.exe
  C:\Windows\System\FInwJZm.exe
  2⤵
  PID:9864
- C:\Windows\System\cvGGQui.exe
  C:\Windows\System\cvGGQui.exe
  2⤵
  PID:9904
- C:\Windows\System\IZWcxHs.exe
  C:\Windows\System\IZWcxHs.exe
  2⤵
  PID:9932
- C:\Windows\System\QXmVtAQ.exe
  C:\Windows\System\QXmVtAQ.exe
  2⤵
  PID:9960
- C:\Windows\System\UDyGqjK.exe
  C:\Windows\System\UDyGqjK.exe
  2⤵
  PID:9988
- C:\Windows\System\VjOtLbc.exe
  C:\Windows\System\VjOtLbc.exe
  2⤵
  PID:10012
- C:\Windows\System\dOCryBO.exe
  C:\Windows\System\dOCryBO.exe
  2⤵
  PID:10044
- C:\Windows\System\aXdVlQy.exe
  C:\Windows\System\aXdVlQy.exe
  2⤵
  PID:10060
- C:\Windows\System\kgXXLoa.exe
  C:\Windows\System\kgXXLoa.exe
  2⤵
  PID:10084
- C:\Windows\System\enhiEsD.exe
  C:\Windows\System\enhiEsD.exe
  2⤵
  PID:10116
- C:\Windows\System\RFkzYfv.exe
  C:\Windows\System\RFkzYfv.exe
  2⤵
  PID:10144
- C:\Windows\System\lYthsES.exe
  C:\Windows\System\lYthsES.exe
  2⤵
  PID:10184
- C:\Windows\System\PBJZzUy.exe
  C:\Windows\System\PBJZzUy.exe
  2⤵
  PID:10204
- C:\Windows\System\SUUGZih.exe
  C:\Windows\System\SUUGZih.exe
  2⤵
  PID:10232
- C:\Windows\System\wFYKSnU.exe
  C:\Windows\System\wFYKSnU.exe
  2⤵
  PID:9260
- C:\Windows\System\sZgUrjB.exe
  C:\Windows\System\sZgUrjB.exe
  2⤵
  PID:9324
- C:\Windows\System\nGifFIJ.exe
  C:\Windows\System\nGifFIJ.exe
  2⤵
  PID:9396
- C:\Windows\System\LoIJhTe.exe
  C:\Windows\System\LoIJhTe.exe
  2⤵
  PID:9460
- C:\Windows\System\YYJMVom.exe
  C:\Windows\System\YYJMVom.exe
  2⤵
  PID:9532
- C:\Windows\System\GlbQSBv.exe
  C:\Windows\System\GlbQSBv.exe
  2⤵
  PID:9572
- C:\Windows\System\LjhYQcL.exe
  C:\Windows\System\LjhYQcL.exe
  2⤵
  PID:9628
- C:\Windows\System\jQhYsgd.exe
  C:\Windows\System\jQhYsgd.exe
  2⤵
  PID:9688
- C:\Windows\System\FXdEaIP.exe
  C:\Windows\System\FXdEaIP.exe
  2⤵
  PID:9792
- C:\Windows\System\AVbiwkc.exe
  C:\Windows\System\AVbiwkc.exe
  2⤵
  PID:9820
- C:\Windows\System\rnOGQqI.exe
  C:\Windows\System\rnOGQqI.exe
  2⤵
  PID:9880
- C:\Windows\System\CBZYkAj.exe
  C:\Windows\System\CBZYkAj.exe
  2⤵
  PID:3776
- C:\Windows\System\YmaMXvn.exe
  C:\Windows\System\YmaMXvn.exe
  2⤵
  PID:9976
- C:\Windows\System\pniWLDL.exe
  C:\Windows\System\pniWLDL.exe
  2⤵
  PID:10036
- C:\Windows\System\ckCjGCX.exe
  C:\Windows\System\ckCjGCX.exe
  2⤵
  PID:10104
- C:\Windows\System\ZFrvxba.exe
  C:\Windows\System\ZFrvxba.exe
  2⤵
  PID:10192
- C:\Windows\System\BgxmDph.exe
  C:\Windows\System\BgxmDph.exe
  2⤵
  PID:1444
- C:\Windows\System\DEXsHft.exe
  C:\Windows\System\DEXsHft.exe
  2⤵
  PID:9340
- C:\Windows\System\RLprsjn.exe
  C:\Windows\System\RLprsjn.exe
  2⤵
  PID:9464
- C:\Windows\System\nmTSWAr.exe
  C:\Windows\System\nmTSWAr.exe
  2⤵
  PID:9672
- C:\Windows\System\eoQJDIe.exe
  C:\Windows\System\eoQJDIe.exe
  2⤵
  PID:9852
- C:\Windows\System\FVfoOBE.exe
  C:\Windows\System\FVfoOBE.exe
  2⤵
  PID:9948
- C:\Windows\System\osVHiCT.exe
  C:\Windows\System\osVHiCT.exe
  2⤵
  PID:10076
- C:\Windows\System\oucBQFu.exe
  C:\Windows\System\oucBQFu.exe
  2⤵
  PID:10180
- C:\Windows\System\OBWlkSH.exe
  C:\Windows\System\OBWlkSH.exe
  2⤵
  PID:9536
- C:\Windows\System\zPPScvf.exe
  C:\Windows\System\zPPScvf.exe
  2⤵
  PID:9768
- C:\Windows\System\lnCoYlq.exe
  C:\Windows\System\lnCoYlq.exe
  2⤵
  PID:10128
- C:\Windows\System\WxgzSVT.exe
  C:\Windows\System\WxgzSVT.exe
  2⤵
  PID:9320
- C:\Windows\System\OZvWbsy.exe
  C:\Windows\System\OZvWbsy.exe
  2⤵
  PID:9372
- C:\Windows\System\AjhkZdI.exe
  C:\Windows\System\AjhkZdI.exe
  2⤵
  PID:10280
- C:\Windows\System\unlIlKt.exe
  C:\Windows\System\unlIlKt.exe
  2⤵
  PID:10308
- C:\Windows\System\XFAiXRI.exe
  C:\Windows\System\XFAiXRI.exe
  2⤵
  PID:10332
- C:\Windows\System\POsnAGg.exe
  C:\Windows\System\POsnAGg.exe
  2⤵
  PID:10360
- C:\Windows\System\cGKNkMH.exe
  C:\Windows\System\cGKNkMH.exe
  2⤵
  PID:10392
- C:\Windows\System\uXqTnCp.exe
  C:\Windows\System\uXqTnCp.exe
  2⤵
  PID:10420
- C:\Windows\System\XuOEDmS.exe
  C:\Windows\System\XuOEDmS.exe
  2⤵
  PID:10448
- C:\Windows\System\GTlBmPO.exe
  C:\Windows\System\GTlBmPO.exe
  2⤵
  PID:10476
- C:\Windows\System\CqKhhru.exe
  C:\Windows\System\CqKhhru.exe
  2⤵
  PID:10504
- C:\Windows\System\pRuXwmv.exe
  C:\Windows\System\pRuXwmv.exe
  2⤵
  PID:10520
- C:\Windows\System\ZHiKVTE.exe
  C:\Windows\System\ZHiKVTE.exe
  2⤵
  PID:10536
- C:\Windows\System\ZHozshI.exe
  C:\Windows\System\ZHozshI.exe
  2⤵
  PID:10560
- C:\Windows\System\qNSyWBk.exe
  C:\Windows\System\qNSyWBk.exe
  2⤵
  PID:10580
- C:\Windows\System\vGkqwNg.exe
  C:\Windows\System\vGkqwNg.exe
  2⤵
  PID:10608
- C:\Windows\System\MrCeTMu.exe
  C:\Windows\System\MrCeTMu.exe
  2⤵
  PID:10628
- C:\Windows\System\wudpKIM.exe
  C:\Windows\System\wudpKIM.exe
  2⤵
  PID:10648
- C:\Windows\System\mnvRKQg.exe
  C:\Windows\System\mnvRKQg.exe
  2⤵
  PID:10676
- C:\Windows\System\irTRDWc.exe
  C:\Windows\System\irTRDWc.exe
  2⤵
  PID:10728
- C:\Windows\System\gyyxAUZ.exe
  C:\Windows\System\gyyxAUZ.exe
  2⤵
  PID:10756
- C:\Windows\System\AXqzhQS.exe
  C:\Windows\System\AXqzhQS.exe
  2⤵
  PID:10792
- C:\Windows\System\gxAsBee.exe
  C:\Windows\System\gxAsBee.exe
  2⤵
  PID:10824
- C:\Windows\System\lzxYylZ.exe
  C:\Windows\System\lzxYylZ.exe
  2⤵
  PID:10856
- C:\Windows\System\pfXdQUO.exe
  C:\Windows\System\pfXdQUO.exe
  2⤵
  PID:10884
- C:\Windows\System\HBAkSbM.exe
  C:\Windows\System\HBAkSbM.exe
  2⤵
  PID:10912
- C:\Windows\System\zYDifcu.exe
  C:\Windows\System\zYDifcu.exe
  2⤵
  PID:10952
- C:\Windows\System\IHNAAYH.exe
  C:\Windows\System\IHNAAYH.exe
  2⤵
  PID:10976
- C:\Windows\System\UENFGin.exe
  C:\Windows\System\UENFGin.exe
  2⤵
  PID:11016
- C:\Windows\System\lKOsXuu.exe
  C:\Windows\System\lKOsXuu.exe
  2⤵
  PID:11044
- C:\Windows\System\UJvdhMN.exe
  C:\Windows\System\UJvdhMN.exe
  2⤵
  PID:11060
- C:\Windows\System\SnMIEfM.exe
  C:\Windows\System\SnMIEfM.exe
  2⤵
  PID:11088
- C:\Windows\System\mlgExpL.exe
  C:\Windows\System\mlgExpL.exe
  2⤵
  PID:11128
- C:\Windows\System\phqEEUM.exe
  C:\Windows\System\phqEEUM.exe
  2⤵
  PID:11156
- C:\Windows\System\THzWhXO.exe
  C:\Windows\System\THzWhXO.exe
  2⤵
  PID:11172
- C:\Windows\System\VscAmmJ.exe
  C:\Windows\System\VscAmmJ.exe
  2⤵
  PID:11200
- C:\Windows\System\iSNzZon.exe
  C:\Windows\System\iSNzZon.exe
  2⤵
  PID:11240
- C:\Windows\System\WRQbeXq.exe
  C:\Windows\System\WRQbeXq.exe
  2⤵
  PID:11256
- C:\Windows\System\KVFoGrb.exe
  C:\Windows\System\KVFoGrb.exe
  2⤵
  PID:10260
- C:\Windows\System\fmHCdrp.exe
  C:\Windows\System\fmHCdrp.exe
  2⤵
  PID:10352
- C:\Windows\System\kXGbLQH.exe
  C:\Windows\System\kXGbLQH.exe
  2⤵
  PID:10380
- C:\Windows\System\GWMPmud.exe
  C:\Windows\System\GWMPmud.exe
  2⤵
  PID:10488
- C:\Windows\System\hauTKZS.exe
  C:\Windows\System\hauTKZS.exe
  2⤵
  PID:10568
- C:\Windows\System\ozSPVFd.exe
  C:\Windows\System\ozSPVFd.exe
  2⤵
  PID:10592
- C:\Windows\System\kiNdkPb.exe
  C:\Windows\System\kiNdkPb.exe
  2⤵
  PID:10704
- C:\Windows\System\FwdYLzd.exe
  C:\Windows\System\FwdYLzd.exe
  2⤵
  PID:10748
- C:\Windows\System\dcRsRmS.exe
  C:\Windows\System\dcRsRmS.exe
  2⤵
  PID:10836
- C:\Windows\System\epjLxAw.exe
  C:\Windows\System\epjLxAw.exe
  2⤵
  PID:10844
- C:\Windows\System\DuSiVdv.exe
  C:\Windows\System\DuSiVdv.exe
  2⤵
  PID:10944
- C:\Windows\System\ZdDOfEW.exe
  C:\Windows\System\ZdDOfEW.exe
  2⤵
  PID:11012
- C:\Windows\System\SmBIZbn.exe
  C:\Windows\System\SmBIZbn.exe
  2⤵
  PID:11056
- C:\Windows\System\vjBIpcF.exe
  C:\Windows\System\vjBIpcF.exe
  2⤵
  PID:2924
- C:\Windows\System\kMPubeZ.exe
  C:\Windows\System\kMPubeZ.exe
  2⤵
  PID:11168
- C:\Windows\System\HtnpFKH.exe
  C:\Windows\System\HtnpFKH.exe
  2⤵
  PID:928
- C:\Windows\System\aMThmMJ.exe
  C:\Windows\System\aMThmMJ.exe
  2⤵
  PID:10024
- C:\Windows\System\pfDrSmH.exe
  C:\Windows\System\pfDrSmH.exe
  2⤵
  PID:10344
- C:\Windows\System\KeFSTCN.exe
  C:\Windows\System\KeFSTCN.exe
  2⤵
  PID:10528
- C:\Windows\System\LxmPzhm.exe
  C:\Windows\System\LxmPzhm.exe
  2⤵
  PID:10636
- C:\Windows\System\KtOEHkK.exe
  C:\Windows\System\KtOEHkK.exe
  2⤵
  PID:10872
- C:\Windows\System\TJSQfIU.exe
  C:\Windows\System\TJSQfIU.exe
  2⤵
  PID:10972
- C:\Windows\System\iRrpcny.exe
  C:\Windows\System\iRrpcny.exe
  2⤵
  PID:11248
- C:\Windows\System\RafeDGY.exe
  C:\Windows\System\RafeDGY.exe
  2⤵
  PID:11252
- C:\Windows\System\JJIkgAG.exe
  C:\Windows\System\JJIkgAG.exe
  2⤵
  PID:10644
- C:\Windows\System\TZkfTMI.exe
  C:\Windows\System\TZkfTMI.exe
  2⤵
  PID:10996
- C:\Windows\System\FXZcjkq.exe
  C:\Windows\System\FXZcjkq.exe
  2⤵
  PID:10292
- C:\Windows\System\yflIOdN.exe
  C:\Windows\System\yflIOdN.exe
  2⤵
  PID:11076
- C:\Windows\System\JsWZeXR.exe
  C:\Windows\System\JsWZeXR.exe
  2⤵
  PID:11140
- C:\Windows\System\hEusFDX.exe
  C:\Windows\System\hEusFDX.exe
  2⤵
  PID:11284
- C:\Windows\System\AfbFRTt.exe
  C:\Windows\System\AfbFRTt.exe
  2⤵
  PID:11324
- C:\Windows\System\WpbvCWJ.exe
  C:\Windows\System\WpbvCWJ.exe
  2⤵
  PID:11352
- C:\Windows\System\LUUqhsj.exe
  C:\Windows\System\LUUqhsj.exe
  2⤵
  PID:11368
- C:\Windows\System\fgTijTP.exe
  C:\Windows\System\fgTijTP.exe
  2⤵
  PID:11396
- C:\Windows\System\RjVaeSY.exe
  C:\Windows\System\RjVaeSY.exe
  2⤵
  PID:11420
- C:\Windows\System\mJHeLWu.exe
  C:\Windows\System\mJHeLWu.exe
  2⤵
  PID:11452
- C:\Windows\System\jrkXAoY.exe
  C:\Windows\System\jrkXAoY.exe
  2⤵
  PID:11480
- C:\Windows\System\YNWIgUB.exe
  C:\Windows\System\YNWIgUB.exe
  2⤵
  PID:11504
- C:\Windows\System\ixmeWYL.exe
  C:\Windows\System\ixmeWYL.exe
  2⤵
  PID:11536
- C:\Windows\System\lSkDJHz.exe
  C:\Windows\System\lSkDJHz.exe
  2⤵
  PID:11564
- C:\Windows\System\qEgvDEG.exe
  C:\Windows\System\qEgvDEG.exe
  2⤵
  PID:11592
- C:\Windows\System\sTPhwoc.exe
  C:\Windows\System\sTPhwoc.exe
  2⤵
  PID:11620
- C:\Windows\System\PQibeDe.exe
  C:\Windows\System\PQibeDe.exe
  2⤵
  PID:11652
- C:\Windows\System\GAzAMdB.exe
  C:\Windows\System\GAzAMdB.exe
  2⤵
  PID:11668
- C:\Windows\System\XrqGNKI.exe
  C:\Windows\System\XrqGNKI.exe
  2⤵
  PID:11720
- C:\Windows\System\LwIeMME.exe
  C:\Windows\System\LwIeMME.exe
  2⤵
  PID:11736
- C:\Windows\System\xkzilHu.exe
  C:\Windows\System\xkzilHu.exe
  2⤵
  PID:11764
- C:\Windows\System\oTWEitT.exe
  C:\Windows\System\oTWEitT.exe
  2⤵
  PID:11792
- C:\Windows\System\kLZHiCt.exe
  C:\Windows\System\kLZHiCt.exe
  2⤵
  PID:11832
- C:\Windows\System\cDnvsjq.exe
  C:\Windows\System\cDnvsjq.exe
  2⤵
  PID:11860
- C:\Windows\System\EdyZPVf.exe
  C:\Windows\System\EdyZPVf.exe
  2⤵
  PID:11884
- C:\Windows\System\fHpSCCE.exe
  C:\Windows\System\fHpSCCE.exe
  2⤵
  PID:11904
- C:\Windows\System\dnkQyjf.exe
  C:\Windows\System\dnkQyjf.exe
  2⤵
  PID:11936
- C:\Windows\System\uRSYpwI.exe
  C:\Windows\System\uRSYpwI.exe
  2⤵
  PID:11960
- C:\Windows\System\GsRhHGr.exe
  C:\Windows\System\GsRhHGr.exe
  2⤵
  PID:11988
- C:\Windows\System\Pdvcqsh.exe
  C:\Windows\System\Pdvcqsh.exe
  2⤵
  PID:12028
- C:\Windows\System\IjLqdDH.exe
  C:\Windows\System\IjLqdDH.exe
  2⤵
  PID:12056
- C:\Windows\System\uEYdGTp.exe
  C:\Windows\System\uEYdGTp.exe
  2⤵
  PID:12084
- C:\Windows\System\jrckSVa.exe
  C:\Windows\System\jrckSVa.exe
  2⤵
  PID:12112
- C:\Windows\System\aRafMct.exe
  C:\Windows\System\aRafMct.exe
  2⤵
  PID:12140
- C:\Windows\System\YNoieIU.exe
  C:\Windows\System\YNoieIU.exe
  2⤵
  PID:12160
- C:\Windows\System\NHixwDh.exe
  C:\Windows\System\NHixwDh.exe
  2⤵
  PID:12192
- C:\Windows\System\tvPoiST.exe
  C:\Windows\System\tvPoiST.exe
  2⤵
  PID:12228
- C:\Windows\System\zLhFWIR.exe
  C:\Windows\System\zLhFWIR.exe
  2⤵
  PID:12256
- C:\Windows\System\tNHSgmu.exe
  C:\Windows\System\tNHSgmu.exe
  2⤵
  PID:12272
- C:\Windows\System\HlUhGGr.exe
  C:\Windows\System\HlUhGGr.exe
  2⤵
  PID:11280
- C:\Windows\System\CbDysMD.exe
  C:\Windows\System\CbDysMD.exe
  2⤵
  PID:11344
- C:\Windows\System\AxpDPOA.exe
  C:\Windows\System\AxpDPOA.exe
  2⤵
  PID:11384
- C:\Windows\System\DWSXUOv.exe
  C:\Windows\System\DWSXUOv.exe
  2⤵
  PID:11428
- C:\Windows\System\OfKnMYr.exe
  C:\Windows\System\OfKnMYr.exe
  2⤵
  PID:11520
- C:\Windows\System\RBiGCfj.exe
  C:\Windows\System\RBiGCfj.exe
  2⤵
  PID:11608
- C:\Windows\System\kYxLZcp.exe
  C:\Windows\System\kYxLZcp.exe
  2⤵
  PID:11692
- C:\Windows\System\jMysJXT.exe
  C:\Windows\System\jMysJXT.exe
  2⤵
  PID:11756
- C:\Windows\System\gxTsorL.exe
  C:\Windows\System\gxTsorL.exe
  2⤵
  PID:11828
- C:\Windows\System\oDqKQNo.exe
  C:\Windows\System\oDqKQNo.exe
  2⤵
  PID:11896
- C:\Windows\System\PaSXDNZ.exe
  C:\Windows\System\PaSXDNZ.exe
  2⤵
  PID:11952
- C:\Windows\System\eXHdgQE.exe
  C:\Windows\System\eXHdgQE.exe
  2⤵
  PID:12040
- C:\Windows\System\QvHqjpu.exe
  C:\Windows\System\QvHqjpu.exe
  2⤵
  PID:12076
- C:\Windows\System\LdypSit.exe
  C:\Windows\System\LdypSit.exe
  2⤵
  PID:12132
- C:\Windows\System\gMShQwj.exe
  C:\Windows\System\gMShQwj.exe
  2⤵
  PID:12208
- C:\Windows\System\SZBAIbG.exe
  C:\Windows\System\SZBAIbG.exe
  2⤵
  PID:12284
- C:\Windows\System\bFZKQVN.exe
  C:\Windows\System\bFZKQVN.exe
  2⤵
  PID:11340
- C:\Windows\System\BFxzzWw.exe
  C:\Windows\System\BFxzzWw.exe
  2⤵
  PID:11580
- C:\Windows\System\mvhAPxP.exe
  C:\Windows\System\mvhAPxP.exe
  2⤵
  PID:11784
- C:\Windows\System\hABbRUB.exe
  C:\Windows\System\hABbRUB.exe
  2⤵
  PID:11972
- C:\Windows\System\YWyvACR.exe
  C:\Windows\System\YWyvACR.exe
  2⤵
  PID:12052
- C:\Windows\System\bWWklpX.exe
  C:\Windows\System\bWWklpX.exe
  2⤵
  PID:12184
- C:\Windows\System\nKzyauM.exe
  C:\Windows\System\nKzyauM.exe
  2⤵
  PID:11552
- C:\Windows\System\LAfgXtN.exe
  C:\Windows\System\LAfgXtN.exe
  2⤵
  PID:11696
- C:\Windows\System\xJfqslr.exe
  C:\Windows\System\xJfqslr.exe
  2⤵
  PID:12172
- C:\Windows\System\IBJHTRm.exe
  C:\Windows\System\IBJHTRm.exe
  2⤵
  PID:11272
- C:\Windows\System\PpWsrcg.exe
  C:\Windows\System\PpWsrcg.exe
  2⤵
  PID:12296
- C:\Windows\System\OHkOMCg.exe
  C:\Windows\System\OHkOMCg.exe
  2⤵
  PID:12324
- C:\Windows\System\VehKlCg.exe
  C:\Windows\System\VehKlCg.exe
  2⤵
  PID:12352
- C:\Windows\System\BOfbxWd.exe
  C:\Windows\System\BOfbxWd.exe
  2⤵
  PID:12372
- C:\Windows\System\tLtKWnf.exe
  C:\Windows\System\tLtKWnf.exe
  2⤵
  PID:12388
- C:\Windows\System\CfvwdGk.exe
  C:\Windows\System\CfvwdGk.exe
  2⤵
  PID:12416
- C:\Windows\System\CUhsBAa.exe
  C:\Windows\System\CUhsBAa.exe
  2⤵
  PID:12480
- C:\Windows\System\bNjDYRf.exe
  C:\Windows\System\bNjDYRf.exe
  2⤵
  PID:12516
- C:\Windows\System\rcrhTDB.exe
  C:\Windows\System\rcrhTDB.exe
  2⤵
  PID:12532
- C:\Windows\System\SeRMsJI.exe
  C:\Windows\System\SeRMsJI.exe
  2⤵
  PID:12572
- C:\Windows\System\hFZPsNL.exe
  C:\Windows\System\hFZPsNL.exe
  2⤵
  PID:12600
- C:\Windows\System\fWrrNag.exe
  C:\Windows\System\fWrrNag.exe
  2⤵
  PID:12616
- C:\Windows\System\ggDeYVg.exe
  C:\Windows\System\ggDeYVg.exe
  2⤵
  PID:12648
- C:\Windows\System\OAvGHWD.exe
  C:\Windows\System\OAvGHWD.exe
  2⤵
  PID:12684
- C:\Windows\System\QWpshnG.exe
  C:\Windows\System\QWpshnG.exe
  2⤵
  PID:12704
- C:\Windows\System\HGAalUj.exe
  C:\Windows\System\HGAalUj.exe
  2⤵
  PID:12744
- C:\Windows\System\wXcWtof.exe
  C:\Windows\System\wXcWtof.exe
  2⤵
  PID:12772
- C:\Windows\System\KmxgMBD.exe
  C:\Windows\System\KmxgMBD.exe
  2⤵
  PID:12788
- C:\Windows\System\UWSJvMT.exe
  C:\Windows\System\UWSJvMT.exe
  2⤵
  PID:12828
- C:\Windows\System\GMlaLTO.exe
  C:\Windows\System\GMlaLTO.exe
  2⤵
  PID:12856
- C:\Windows\System\DCTVrvS.exe
  C:\Windows\System\DCTVrvS.exe
  2⤵
  PID:12884
- C:\Windows\System\NOULBBc.exe
  C:\Windows\System\NOULBBc.exe
  2⤵
  PID:12900
- C:\Windows\System\KrFTHpt.exe
  C:\Windows\System\KrFTHpt.exe
  2⤵
  PID:12940
- C:\Windows\System\EzgTpJI.exe
  C:\Windows\System\EzgTpJI.exe
  2⤵
  PID:12956
- C:\Windows\System\NJTdhrp.exe
  C:\Windows\System\NJTdhrp.exe
  2⤵
  PID:12996
- C:\Windows\System\itmlnrt.exe
  C:\Windows\System\itmlnrt.exe
  2⤵
  PID:13024
- C:\Windows\System\lCdCZGN.exe
  C:\Windows\System\lCdCZGN.exe
  2⤵
  PID:13052
- C:\Windows\System\DbEIIKK.exe
  C:\Windows\System\DbEIIKK.exe
  2⤵
  PID:13080
- C:\Windows\System\BCMwuXV.exe
  C:\Windows\System\BCMwuXV.exe
  2⤵
  PID:13108
- C:\Windows\System\RKZxgFa.exe
  C:\Windows\System\RKZxgFa.exe
  2⤵
  PID:13136
- C:\Windows\System\CwpupUH.exe
  C:\Windows\System\CwpupUH.exe
  2⤵
  PID:13164
- C:\Windows\System\dmrpVMy.exe
  C:\Windows\System\dmrpVMy.exe
  2⤵
  PID:13184
- C:\Windows\System\zSofSeO.exe
  C:\Windows\System\zSofSeO.exe
  2⤵
  PID:13208
- C:\Windows\System\EFSXJlM.exe
  C:\Windows\System\EFSXJlM.exe
  2⤵
  PID:13240
- C:\Windows\System\unSHVSg.exe
  C:\Windows\System\unSHVSg.exe
  2⤵
  PID:13276
- C:\Windows\System\LuAEchJ.exe
  C:\Windows\System\LuAEchJ.exe
  2⤵
  PID:13300
- C:\Windows\System\QpBuEdD.exe
  C:\Windows\System\QpBuEdD.exe
  2⤵
  PID:11316
- C:\Windows\System\yuUZqYV.exe
  C:\Windows\System\yuUZqYV.exe
  2⤵
  PID:12368
- C:\Windows\System\DSurQWM.exe
  C:\Windows\System\DSurQWM.exe
  2⤵
  PID:12408
- C:\Windows\System\tHuobqQ.exe
  C:\Windows\System\tHuobqQ.exe
  2⤵
  PID:12512
- C:\Windows\System\gsIgjhM.exe
  C:\Windows\System\gsIgjhM.exe
  2⤵
  PID:12596
- C:\Windows\System\QVRiSUG.exe
  C:\Windows\System\QVRiSUG.exe
  2⤵
  PID:12672
- C:\Windows\System\ZYfZnPt.exe
  C:\Windows\System\ZYfZnPt.exe
  2⤵
  PID:12712
- C:\Windows\System\YMyGNXl.exe
  C:\Windows\System\YMyGNXl.exe
  2⤵
  PID:12812
- C:\Windows\System\jHUvVAn.exe
  C:\Windows\System\jHUvVAn.exe
  2⤵
  PID:12840
- C:\Windows\System\mMNJtup.exe
  C:\Windows\System\mMNJtup.exe
  2⤵
  PID:12892
- C:\Windows\System\uPEIHjY.exe
  C:\Windows\System\uPEIHjY.exe
  2⤵
  PID:12936
- C:\Windows\System\StTsiLw.exe
  C:\Windows\System\StTsiLw.exe
  2⤵
  PID:12988
- C:\Windows\System\yTQppsV.exe
  C:\Windows\System\yTQppsV.exe
  2⤵
  PID:13072
- C:\Windows\System\hUuuEZo.exe
  C:\Windows\System\hUuuEZo.exe
  2⤵
  PID:13120
- C:\Windows\System\iLKeIZb.exe
  C:\Windows\System\iLKeIZb.exe
  2⤵
  PID:13172
- C:\Windows\System\RhGnmCY.exe
  C:\Windows\System\RhGnmCY.exe
  2⤵
  PID:13284
- C:\Windows\System\UusfAul.exe
  C:\Windows\System\UusfAul.exe
  2⤵
  PID:12316
- C:\Windows\System\MyGpNiD.exe
  C:\Windows\System\MyGpNiD.exe
  2⤵
  PID:12508
- C:\Windows\System\ZlsRXtJ.exe
  C:\Windows\System\ZlsRXtJ.exe
  2⤵
  PID:12680
- C:\Windows\System\JaXJHxL.exe
  C:\Windows\System\JaXJHxL.exe
  2⤵
  PID:12820
- C:\Windows\System\iBrmpIT.exe
  C:\Windows\System\iBrmpIT.exe
  2⤵
  PID:13104
- C:\Windows\System\YBdSUND.exe
  C:\Windows\System\YBdSUND.exe
  2⤵
  PID:13048
- C:\Windows\System\RVwrDpa.exe
  C:\Windows\System\RVwrDpa.exe
  2⤵
  PID:12452
- C:\Windows\System\AGCncjf.exe
  C:\Windows\System\AGCncjf.exe
  2⤵
  PID:12740
- C:\Windows\System\hFsSrvZ.exe
  C:\Windows\System\hFsSrvZ.exe
  2⤵
  PID:13020
- C:\Windows\System\GzZCmrk.exe
  C:\Windows\System\GzZCmrk.exe
  2⤵
  PID:12136
- C:\Windows\System\jAakOud.exe
  C:\Windows\System\jAakOud.exe
  2⤵
  PID:13096
- C:\Windows\System\FInriJt.exe
  C:\Windows\System\FInriJt.exe
  2⤵
  PID:13328
- C:\Windows\System\KcxtTOL.exe
  C:\Windows\System\KcxtTOL.exe
  2⤵
  PID:13368
- C:\Windows\System\qJKqIdZ.exe
  C:\Windows\System\qJKqIdZ.exe
  2⤵
  PID:13396
- C:\Windows\System\bQOxsBx.exe
  C:\Windows\System\bQOxsBx.exe
  2⤵
  PID:13412
- C:\Windows\System\ItvGphG.exe
  C:\Windows\System\ItvGphG.exe
  2⤵
  PID:13436
- C:\Windows\System\DcAIGsM.exe
  C:\Windows\System\DcAIGsM.exe
  2⤵
  PID:13456
- C:\Windows\System\fyVofzJ.exe
  C:\Windows\System\fyVofzJ.exe
  2⤵
  PID:13484
- C:\Windows\System\BummznA.exe
  C:\Windows\System\BummznA.exe
  2⤵
  PID:13512
- C:\Windows\System\vcvNJni.exe
  C:\Windows\System\vcvNJni.exe
  2⤵
  PID:13564
- C:\Windows\System\ekZJCjZ.exe
  C:\Windows\System\ekZJCjZ.exe
  2⤵
  PID:13592
- C:\Windows\System\VsrgFzL.exe
  C:\Windows\System\VsrgFzL.exe
  2⤵
  PID:13616
- C:\Windows\System\CrtQqZx.exe
  C:\Windows\System\CrtQqZx.exe
  2⤵
  PID:13636
- C:\Windows\System\uGrrApP.exe
  C:\Windows\System\uGrrApP.exe
  2⤵
  PID:13664
- C:\Windows\System\iwHtMdj.exe
  C:\Windows\System\iwHtMdj.exe
  2⤵
  PID:13680
- C:\Windows\System\spBqGia.exe
  C:\Windows\System\spBqGia.exe
  2⤵
  PID:13720
- C:\Windows\System\fwcqnHq.exe
  C:\Windows\System\fwcqnHq.exe
  2⤵
  PID:13748
- C:\Windows\System\oMxbTrg.exe
  C:\Windows\System\oMxbTrg.exe
  2⤵
  PID:13780
- C:\Windows\System\sSugNrM.exe
  C:\Windows\System\sSugNrM.exe
  2⤵
  PID:13804
- C:\Windows\System\ZMjRlNQ.exe
  C:\Windows\System\ZMjRlNQ.exe
  2⤵
  PID:13824
- C:\Windows\System\bVHqRrT.exe
  C:\Windows\System\bVHqRrT.exe
  2⤵
  PID:13860
- C:\Windows\System\tYzuKQY.exe
  C:\Windows\System\tYzuKQY.exe
  2⤵
  PID:13892
- C:\Windows\System\cHDOixz.exe
  C:\Windows\System\cHDOixz.exe
  2⤵
  PID:13916
- C:\Windows\System\jRKAIya.exe
  C:\Windows\System\jRKAIya.exe
  2⤵
  PID:13944
- C:\Windows\System\gVwRLTu.exe
  C:\Windows\System\gVwRLTu.exe
  2⤵
  PID:13976
- C:\Windows\System\RqzGqrZ.exe
  C:\Windows\System\RqzGqrZ.exe
  2⤵
  PID:14000
- C:\Windows\System\nvMOLrq.exe
  C:\Windows\System\nvMOLrq.exe
  2⤵
  PID:14044
- C:\Windows\System\ruXRoQm.exe
  C:\Windows\System\ruXRoQm.exe
  2⤵
  PID:14060
- C:\Windows\System\xdOBMjD.exe
  C:\Windows\System\xdOBMjD.exe
  2⤵
  PID:14076
- C:\Windows\System\jgozzDv.exe
  C:\Windows\System\jgozzDv.exe
  2⤵
  PID:14120
- C:\Windows\System\iuVELKI.exe
  C:\Windows\System\iuVELKI.exe
  2⤵
  PID:14140
- C:\Windows\System\XWOmdha.exe
  C:\Windows\System\XWOmdha.exe
  2⤵
  PID:14168
- C:\Windows\System\cXCaiBA.exe
  C:\Windows\System\cXCaiBA.exe
  2⤵
  PID:14188
- C:\Windows\System\YVUwgVx.exe
  C:\Windows\System\YVUwgVx.exe
  2⤵
  PID:14216
- C:\Windows\System\zQQaETI.exe
  C:\Windows\System\zQQaETI.exe
  2⤵
  PID:14248
- C:\Windows\System\cNoTRLu.exe
  C:\Windows\System\cNoTRLu.exe
  2⤵
  PID:14276
- C:\Windows\System\cQcHJnU.exe
  C:\Windows\System\cQcHJnU.exe
  2⤵
  PID:14308
- C:\Windows\System\YQmwwJK.exe
  C:\Windows\System\YQmwwJK.exe
  2⤵
  PID:13320
- C:\Windows\System\fhmaLCi.exe
  C:\Windows\System\fhmaLCi.exe
  2⤵
  PID:13404
- C:\Windows\System\vgvaqYQ.exe
  C:\Windows\System\vgvaqYQ.exe
  2⤵
  PID:13428
- C:\Windows\System\ddnBnLW.exe
  C:\Windows\System\ddnBnLW.exe
  2⤵
  PID:13500
- C:\Windows\System\xsuPmbx.exe
  C:\Windows\System\xsuPmbx.exe
  2⤵
  PID:13580
- C:\Windows\System\xotvGvo.exe
  C:\Windows\System\xotvGvo.exe
  2⤵
  PID:13632
- C:\Windows\System\UKhsiSj.exe
  C:\Windows\System\UKhsiSj.exe
  2⤵
  PID:13712
- C:\Windows\System\ZWzQpfP.exe
  C:\Windows\System\ZWzQpfP.exe
  2⤵
  PID:13760
- C:\Windows\System\nlDyRgS.exe
  C:\Windows\System\nlDyRgS.exe
  2⤵
  PID:13844
- C:\Windows\System\ZRkFFav.exe
  C:\Windows\System\ZRkFFav.exe
  2⤵
  PID:13884
- C:\Windows\System\apZwDws.exe
  C:\Windows\System\apZwDws.exe
  2⤵
  PID:13960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CWuhFVw.exe

Path C:\Windows\System\CWuhFVw.exe
Size 1.9MB
SHA256 70ca2ad9d72711bbcf3cdaf802bfa954b664df45c0716f5cfd41a1d4e06f2dd2
MD5 ab7f134b9a69ad96e385cd6bb654ff91
SHA1 e028d2bc4af30f14ad5d20ce2bb390b051858551
SHA512 ff1fdc9004c159d5d5af2bc78ffa8a9b6dbdcacb5f6b2f613c5eb05d42a097c745f1999c7a9e954f786196af547244f1e755527e0ab478a7dd1cde728ebf9c4f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQc:BemTLkNdfE0pZra
MD5 SHA1 SHA512 SSDEEP

Submit Download

CviEpeR.exe

Path C:\Windows\System\CviEpeR.exe
Size 1.9MB
SHA256 defc52ca226137e8be265f70377791dee2f70f81d78f720db64695d7276216a2
MD5 3f899fc4def9564af6068b3e9045cd2b
SHA1 30b0bdc5af7199620e966fe5e2397bc589e44db4
SHA512 c5fc5e7c6864570cec24e935b4b927e2f649d7e0f290882dd5f4d58fed1ffbd1650e49c8a7090f00c7a680d5223046f03087b062ead41648ce7a7ff686ce330d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQn:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBFTExy.exe

Path C:\Windows\System\IBFTExy.exe
Size 1.9MB
SHA256 94475346b6ec65ac8ca9b0c01e74c87ee56b51ff79e71542ddf8b79896ac6052
MD5 56025a8dc0fb6ee1f3fea20d2d88dcd5
SHA1 c98817bf5145b8aa0437c1fe0cf420210e47cd31
SHA512 39bf8deb41c67cdaf43ef099f316af1f84282a4f66df4304187525c9a7db60495bf176612d6e2de9a71b65c929f22155818214e7b6ecdad97a2369adc114c1ae
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQU:BemTLkNdfE0pZr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

IEmlqIY.exe

Path C:\Windows\System\IEmlqIY.exe
Size 1.9MB
SHA256 01be30404935039b6809f6265a3ba40e2df421e2649fbd9e23d4af6874d7a04d
MD5 73d2c8097022ebf392c7763e2eb59874
SHA1 fea0b48ba404b0b123565730435eeadb810763e2
SHA512 5f476a52b560dbfc225101342332f17fbba10373b0e1b0373a88754e55b373fe65ecf30782137a938e6a2db0018426762bed549325859fa9b8b0d8c98741e2fd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQz:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

JzhwAGd.exe

Path C:\Windows\System\JzhwAGd.exe
Size 1.9MB
SHA256 b14300596366767ae110767714a2ae36d68ce1574e9eddba4ac6431ff0f5cfd8
MD5 322d61739d5e39efe9102dcf95a18c47
SHA1 2a9aa13f7f2b86115d8ed49c5e956d1bf1ca8d9e
SHA512 bb9fee07ce3bacc4c616fdd4b71ff79499e191396fbe589120902e96c63a772a26418059c89ce538570e819aacdb3f95f7fb771294504cb15770308f5c19a1ba
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQt:BemTLkNdfE0pZrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

OVlFTed.exe

Path C:\Windows\System\OVlFTed.exe
Size 1.9MB
SHA256 da57bf399bfc22330f9df32b9cb2a0cd6f22646cc80ac8fff41581505dbb51a8
MD5 7f1fabd356d2347d3c8a15570495f08e
SHA1 951ceed89c62a7566b04ca85141d5aec2b49a8ad
SHA512 20f611b6acb4733aed45984b118db37f1e7085fd950597a2416fdaf24478f4f33a64e0628786978e51c9e06270e4c9813fe439b7fd14bfa94ae551a9100158eb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQe:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfBPuBN.exe

Path C:\Windows\System\OfBPuBN.exe
Size 1.9MB
SHA256 0bb10e8905213f49fa64a648ab4a617d8b6ef299bff63aeb339cfad1fc4b038a
MD5 da4bd8d66a7dae46613842be6af5b276
SHA1 ef9427ee00cfef803eec3303b8c3a79cd5f1d5d7
SHA512 ce006bad2ebe00cf336f483486c10b1c5f1a540a3391f5a262de9877c7a03382b43950f37fdbbbf224da2f7a2bd4a17cb8a270e0b4705d2b9c1c5cce76eef797
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQL:BemTLkNdfE0pZrR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OrvFYpR.exe

Path C:\Windows\System\OrvFYpR.exe
Size 1.9MB
SHA256 c6561ccac8ea90ce68265eb83f1880047723372a1ef0a078a6cd8ad03cbac0a7
MD5 87d1df8735ef7bbce1226d5f0b6a5683
SHA1 6aa04a0340c5095571064a73ab4aa77bec6a918d
SHA512 02aa1fb30086f85625dbddf6f71cf36952bfe9e11bee47b8c611e99d0ea6d0a416f9f6bfd382beb5556f4f9c1cb3eee1ad72452fede31792e3eea396617812bb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQu:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PpadpqT.exe

Path C:\Windows\System\PpadpqT.exe
Size 1.9MB
SHA256 660ea24ea5d849aff43420568b8d6cd7e624a015fef53efd4c45149e955643bc
MD5 a11d6a77b158d93aafd6c663c0842ee4
SHA1 f65fdb210353fff1ba672601083dddc278f182f4
SHA512 7009e5d2e359aa332ac7f53ac2a2b0978544dcefa823561c7fff861f4121741cf72d3050b76bc00f23fa0268d84ad0576cd1e7011fe44257ede3bd1bfba0b524
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQN:BemTLkNdfE0pZrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

VLclOhk.exe

Path C:\Windows\System\VLclOhk.exe
Size 1.9MB
SHA256 ebe8420e2d336343569dedc598040bc877b4499a3e1852656ec3792ea324eb18
MD5 1cb457d160d5e19d1eb6c9362adeb9d6
SHA1 b31a54350d9d71b8e0c17adb389e6f165df6db4a
SHA512 f70231cf3d68eb8b2db285b6e2dd9f8bea750f008be748f9fcea6f37bc5024da5b4bb38c6b6c27c72b331856fef48f5ced5ada0fc8fe284e007310c913dbf216
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQ2:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMmnkpf.exe

Path C:\Windows\System\WMmnkpf.exe
Size 1.9MB
SHA256 d490598fce9937ec400abd8bef37246e2a91b3c5ed4870f7d1e16b39d109ce1f
MD5 39a909b6e6b55fad4f905593d8496e4b
SHA1 56fcd680a85e5bc140281ac384d90f3c140a82c4
SHA512 8d38f38cc6eaa8487bf0646ee47185fa482dbe129c4f89008ed548383e1d8e17634b5f4612f89bd47dad109d8bc053801069352f7b4cc194042e7cbb230c5c7d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQH:BemTLkNdfE0pZrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WvTRhwC.exe

Path C:\Windows\System\WvTRhwC.exe
Size 1.9MB
SHA256 55078d3afdec3414b866a8b3ade9a3beb337786e7b20fdf1367f49ad29c37c67
MD5 84aeea4a412722a2c067f95bdefc65f3
SHA1 e6d33296c2c6f086cb6c4707fa4691d13df0cb9d
SHA512 568208b1c67d8d99e065bbcf5e59a19df99e0546e05896c89ec60632a2f755a0914bad10a7c4d6211fd1dd1344d7f8932babc6785a46800b2edd30a743e7d667
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQM:BemTLkNdfE0pZra
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClGdVU.exe

Path C:\Windows\System\XClGdVU.exe
Size 1.9MB
SHA256 fcc43ec81aac19db7197bc9dc944041d7780a1c45aa958fefb3e41d22f452966
MD5 18ff9e17858f1c283f8f174faf0d95c8
SHA1 04a311314a4f454cb4ee6619830ad44010ad8b3a
SHA512 eb3a296b7d1ed67337104892ed91394666b9d19b33e268bfb6628a784638bc751aaeeb9a62f1ecaf23bdccc8230c95606e8bc8491c7e6e5cb013fef3626eac4c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQH:BemTLkNdfE0pZrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XDksxMR.exe

Path C:\Windows\System\XDksxMR.exe
Size 1.9MB
SHA256 685ae1ce01fd02488d282b550b22aca0d066742b673cd523ed42250076d10d5c
MD5 d7c121e0e583150c7cabb86687ca5636
SHA1 a8bc1221978abe09f60329f832cd7b28c08c6b8b
SHA512 030db47dee3585107961c5f39391c48b925269222d889a1f5bf1fc1ffc3f1db17645f62380a0bde0e3000ce8f4f4315c1859c364c05dfb44bb69124836d40f48
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQ/:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

XgLInNV.exe

Path C:\Windows\System\XgLInNV.exe
Size 1.9MB
SHA256 7226006b20f0b70bc3a720ab63c7f174ce029d90ec8c93cdf2c01d5ff5cd1bb0
MD5 f96e445d7547aec91c106227d83d9c97
SHA1 c817593c44a527e64a0fab9887ac7444b924894f
SHA512 628953ed4ff2e654b1beeac8c44a9c37227d1cb932f71d087206477aec62758657743f2e7e8828c80752f438242a99814d911f6497fe5fa49930bd48afa193ef
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQe:BemTLkNdfE0pZrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZboUVHm.exe

Path C:\Windows\System\ZboUVHm.exe
Size 1.9MB
SHA256 f46ac77f57e52c17aa048d7d0c783a9295209804bfffa3f27a0587f6e4696929
MD5 a75a10aae8c00021a5def766077b6895
SHA1 fab706265744d8438b8298eb80af39d41448dcf8
SHA512 658fd67a5973b0cca46fd4543205440dba75b480cf9344b3d405e0d9fbc047625eb8fa45aa7884a7a3e500e039f0fc59495d77d38a5b5e25d69484a3471373b5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQl:BemTLkNdfE0pZr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

aRalYuQ.exe

Path C:\Windows\System\aRalYuQ.exe
Size 1.9MB
SHA256 4c92de22520f7828fda6bd28a567accaf9a885a6155c6dda842078bd1f5448b8
MD5 976702095e534904913f6fdd0b86f9ff
SHA1 c9f8f3d2b223e09323d9a68f0b2eebbded14cbd0
SHA512 8633e60c003de9881680aebb7046b0940321235db0d545b49f5f958f67ed2ab48d4946f01e02c7f914f9e740806c600c3c527070c1d6edeefa6cd366c6fe4d84
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQO:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajlVvXp.exe

Path C:\Windows\System\ajlVvXp.exe
Size 1.9MB
SHA256 cf9f3d83a29d3238c22f792dae9063857fe4850cfaa63fbcce724326130473f3
MD5 111442b90e6d2d93a58c13f4595d270b
SHA1 d0edd332da3243cd1e81b9cbf43d0c66c1fa1081
SHA512 0208b1c10a948335afb275e1562aeed11d80dfe10a299e13efb493fe0bb9e976db5d63d4d1911fa93b68ce75a2187c49b5690869c45316654e11aa82faa57f2c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQh:BemTLkNdfE0pZrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBSouml.exe

Path C:\Windows\System\cBSouml.exe
Size 1.9MB
SHA256 55a5e75ec37475c8fbff3ced9d63c616c647bc8408965962adb9185f0eda518f
MD5 98f7628bdff5da140a13fbf89678562d
SHA1 fc30a12969e82c500fb69a373eda48efa9b5251c
SHA512 d76251d24624b9c13f48c956f5e0bfb2a2b9edcefefee86e11adb3f0559d72343f925b6cbb5f46ca4f37a18e4204a1b8ac510517eecbcec74d7bd98fa815653e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQD:BemTLkNdfE0pZrR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ctmfSGk.exe

Path C:\Windows\System\ctmfSGk.exe
Size 1.9MB
SHA256 5a17dc55d79ed4cfc9e42a325bbb0e6ea337f4015db313ff30ef9b8db1ef2faf
MD5 0fa9de685196f01af27bbc22e02b190f
SHA1 69c4a2e928bc503ef607894cec5db0bb5e78a527
SHA512 be23dd4ee380f1ddb5ba9d16236d2ab9276f615f457303e39a1da0b1903c45f70c168967f538c53dc945d6845519297a3377993b95072c22f66e2991462e5479
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQ8:BemTLkNdfE0pZru
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnSSywO.exe

Path C:\Windows\System\dnSSywO.exe
Size 1.9MB
SHA256 05ccc1a2c69ae485c753b28695a3dcf59af7083d12b4b1107f0d0958cb566b70
MD5 ab42f13fff82fc09ddd20ddbafb17c92
SHA1 6ae48178ad2a4137f2751b5ea8267c66860539da
SHA512 d3b6d1ac33dc2a3bdf85356f3707346f82fab79b8afc072dec188b1dae3d62750c4d15d0aba05dea04323504b8d4c904babdfcfb3640b19ee825dc08b3426cea
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQy:BemTLkNdfE0pZrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

gqLGfRs.exe

Path C:\Windows\System\gqLGfRs.exe
Size 1.9MB
SHA256 49f0f5e8901ab66476d705a4b289d2727878333b1d86cda05499dceec68ff5dd
MD5 e4a6183c1ce9615eb37c0edf98f5bc7a
SHA1 d2915a30d48eeef7df843a68212e4fbf5268331e
SHA512 2fd5d511058f5af98fc54246f9c50f601b09c885e9d8cf2546126ffa6e3372dd0924de6df2d7203b4049d511d8797cd0990f4d012946161467a8b3b2e3ab392f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQ9:BemTLkNdfE0pZrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

gqtSMni.exe

Path C:\Windows\System\gqtSMni.exe
Size 1.9MB
SHA256 432b01454a9aabe0966b8d501016951d8ff62099b46b8f04acf7df08c7c23252
MD5 aacaac06f89920874bb9722384e5ed55
SHA1 73b60631519fb14cde9842fce715e0780e0727a1
SHA512 1ed9ee93fcd988c4f9ac3beb341af225d96df7fac62a6ffcc874639e0458c14a0142b30004623b4fe13108148c4f3abe6f70cb5fc8d1b18c2cacf8c7a40984d5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQai:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

iijERLq.exe

Path C:\Windows\System\iijERLq.exe
Size 1.9MB
SHA256 4db9935e37209ab1d57252524bdc2d16974a1b938763b87f9827cd47cb8e0882
MD5 a77818a7de30a64f5bea9ec4ee83599f
SHA1 079e5bdd8cdfed23cb15a3f51eb6fe63beb66a60
SHA512 91b20c29730e4192c6b8b33fdc252eab19af14e7d04620f53b8ca0507e738064083934071322722d6492c50a4e3aba7dc9a04ed03aa38c3c11af82aaffb38d09
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQf:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhmBnTT.exe

Path C:\Windows\System\jhmBnTT.exe
Size 1.9MB
SHA256 0e37e2788be48ed3fcb8e36d506a2c05f2f65d5786da33e6c47cd3d34c76f2f4
MD5 20c5bb3d6709d8788bb3200b6f201c3f
SHA1 1dff81a1d9d0483c73a7e65e0170ee422715bdb5
SHA512 e14702f6d962aaa885f8b3350cda6a534ffe6e1b28525b95d4a01db73d412e04a5ea669983dfbf1a775e6969b81bbfeb6b81ef3b6002792047926ec97d7869b0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQx:BemTLkNdfE0pZrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

kEeOqta.exe

Path C:\Windows\System\kEeOqta.exe
Size 1.9MB
SHA256 622eb423823f686070decaaa9cba2380936f641c61ec8b2d673edc61d04eea7f
MD5 209e5ff2ac90230a0f6085c7ebce8b3d
SHA1 c62196c52a6d0e8a03cdeddd66923122e26f873d
SHA512 9dfef868b44383400e17a0bf375621f8e08c30e626f5220799e79f7e875140604a2edc6ace14a49a5ac14a254e64e5a7c13198d738860ca6aedaa49ed86b0487
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQx:BemTLkNdfE0pZrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

mHsyTqO.exe

Path C:\Windows\System\mHsyTqO.exe
Size 1.9MB
SHA256 578a90ba8d0a3fe426c68c685f51db2b059cc4d8f9dd88cf0ca19940d58c8bbe
MD5 1c74217b1c4e5d67805d01fedaa425d1
SHA1 bca5a482abac727095f975d0f48ec40af75bcda3
SHA512 98891aeba06fdaa81a63d6189fbc3ede578a6f59f192eae436b97dd0643ddff937c53987255c007aeb18b15312ca082efbb66425298b1d6ed107b729b634d74e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQI:BemTLkNdfE0pZrm
MD5 SHA1 SHA512 SSDEEP

Submit Download

nHxONxb.exe

Path C:\Windows\System\nHxONxb.exe
Size 1.9MB
SHA256 d756904f22ae6d3bd065b10baf28c410eda5d6e1275de3895cf9181f32b72285
MD5 bed72bb4f2165650ac6dac74943c7dd1
SHA1 9187d02d45e2390e46c00efae57b1ac70dc85eb7
SHA512 a06df1365045e8854eb16f13f1b3924779d46ae98be4c4f9be416f329c7a99cb1f0347b7e7b55ea0aec25eae8f52d8035ce8cae63fe5de65218aad8506e530d3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQm:BemTLkNdfE0pZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

sonPqNT.exe

Path C:\Windows\System\sonPqNT.exe
Size 1.9MB
SHA256 95a60ab9e1da866ce1a22d1b31d8d888d0b1bfdfb9e9a0f1a776372a174832ab
MD5 852fded3d1ab02d95cd7150fc0a8d0a1
SHA1 111cc6a96b97cb7a239b7f84364a355f278f839d
SHA512 f5d4a0f52c14fac5a9545575751c3ba1d3a3ce678e303d10210663b30b62ae58070cc580bfd3e393e3740e8687f1a13bc89cb18b7169a07b9676de892a270a7c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQi:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

xSiaSSh.exe

Path C:\Windows\System\xSiaSSh.exe
Size 1.9MB
SHA256 9db27bece4af3c8432056be6f9703ef34cfdc6518ed2b8628e8bb2f1dca2e1f0
MD5 a0d6a5e49a86a773b8fc36d13c506127
SHA1 ac83db4a357a23c90f079d3fd825927203bfdf2b
SHA512 e9483539841ef938503d79c8f2c774de8816fa72a07aae2cf28d22708600fe8773d85fed8be3c71797060da0fa92ccca564c746366639fda5fbfcfffa3bfe2f9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQy:BemTLkNdfE0pZrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxgZxhb.exe

Path C:\Windows\System\xxgZxhb.exe
Size 1.9MB
SHA256 253a6099722447baa7223e6bd0661e2c93cd89abe0dfb405453e1ecf2a978574
MD5 06399d605fdbd7af28bba7c319fc5497
SHA1 54e076a0e5dff8566c3c42d11b70db81249dfab9
SHA512 d355778e641b760ecb1c7be92700e11552f009e473dead02fb86fc4f24e51cf879ed696d67bff0d6120829feeaf6def6c6b0556b62bb279ea379d91dd45f9138
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQx:BemTLkNdfE0pZrf
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvbDMeT.exe

Path C:\Windows\System\yvbDMeT.exe
Size 1.9MB
SHA256 4d675f48b9ec8a4baaffd5c292edea3220345997924ace68af5f3786e44de59a
MD5 dcb52ccf7b91c1e7ba4a9ed3b1719fa1
SHA1 36311bd7c4fa0a4a38dbc339bd65dfe670fad510
SHA512 c8c907aa6a8d9971f211d31a14158c7ab00145da50e5c2f065ec5940bba576c883861e1dc54696ac004d3337f4b7d1217984fb5b7b2b4048695e94d700c7fa82
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQt:BemTLkNdfE0pZrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

zYGDRTT.exe

Path C:\Windows\System\zYGDRTT.exe
Size 1.9MB
SHA256 a764bf8478151a37898a89210fbcbfadffe132b8e582ebca42d5dbc28eb13aa0
MD5 e2ccf371a54af7dca8d508cd36ddc500
SHA1 b27e185731c815452f1830783a2ea77bd1530855
SHA512 c68ab23f1a43764c5efd170f27599828e6de9162e8992c57c610359c5c76a76f4f921cb16a4551ef91ac0a1359919d363c62ae170dea2b11fbba0c0560b3f80e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIaHs1PTma87NQY:BemTLkNdfE0pZre
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-15-0x00007FF6FFFE0000-0x00007FF700334000-memory.dmp

Download

memory/224-2189-0x00007FF6FFFE0000-0x00007FF700334000-memory.dmp

Download

memory/536-1-0x0000022CF6240000-0x0000022CF6250000-memory.dmp

Download

memory/536-0-0x00007FF6456A0000-0x00007FF6459F4000-memory.dmp

Download

memory/536-82-0x00007FF6456A0000-0x00007FF6459F4000-memory.dmp

Download

memory/540-2214-0x00007FF6898D0000-0x00007FF689C24000-memory.dmp

Download

memory/540-522-0x00007FF6898D0000-0x00007FF689C24000-memory.dmp

Download

memory/1324-508-0x00007FF6DB360000-0x00007FF6DB6B4000-memory.dmp

Download

memory/1324-2215-0x00007FF6DB360000-0x00007FF6DB6B4000-memory.dmp

Download

memory/1844-2208-0x00007FF67FCC0000-0x00007FF680014000-memory.dmp

Download

memory/1844-509-0x00007FF67FCC0000-0x00007FF680014000-memory.dmp

Download

memory/1896-2197-0x00007FF604650000-0x00007FF6049A4000-memory.dmp

Download

memory/1896-70-0x00007FF604650000-0x00007FF6049A4000-memory.dmp

Download

memory/1932-529-0x00007FF6984E0000-0x00007FF698834000-memory.dmp

Download

memory/1932-2205-0x00007FF6984E0000-0x00007FF698834000-memory.dmp

Download

memory/2004-2206-0x00007FF606B90000-0x00007FF606EE4000-memory.dmp

Download

memory/2004-515-0x00007FF606B90000-0x00007FF606EE4000-memory.dmp

Download

memory/2012-2198-0x00007FF6DA530000-0x00007FF6DA884000-memory.dmp

Download

memory/2012-2186-0x00007FF6DA530000-0x00007FF6DA884000-memory.dmp

Download

memory/2012-62-0x00007FF6DA530000-0x00007FF6DA884000-memory.dmp

Download

memory/2040-2192-0x00007FF675650000-0x00007FF6759A4000-memory.dmp

Download

memory/2040-34-0x00007FF675650000-0x00007FF6759A4000-memory.dmp

Download

memory/2040-1801-0x00007FF675650000-0x00007FF6759A4000-memory.dmp

Download

memory/2256-2190-0x00007FF6B47F0000-0x00007FF6B4B44000-memory.dmp

Download

memory/2256-22-0x00007FF6B47F0000-0x00007FF6B4B44000-memory.dmp

Download

memory/2508-506-0x00007FF6A47D0000-0x00007FF6A4B24000-memory.dmp

Download

memory/2508-2202-0x00007FF6A47D0000-0x00007FF6A4B24000-memory.dmp

Download

memory/2772-570-0x00007FF76B2C0000-0x00007FF76B614000-memory.dmp

Download

memory/2772-2216-0x00007FF76B2C0000-0x00007FF76B614000-memory.dmp

Download

memory/2848-2213-0x00007FF6090D0000-0x00007FF609424000-memory.dmp

Download

memory/2848-537-0x00007FF6090D0000-0x00007FF609424000-memory.dmp

Download

memory/3068-2196-0x00007FF60EB40000-0x00007FF60EE94000-memory.dmp

Download

memory/3068-2185-0x00007FF60EB40000-0x00007FF60EE94000-memory.dmp

Download

memory/3068-51-0x00007FF60EB40000-0x00007FF60EE94000-memory.dmp

Download

memory/3084-2200-0x00007FF7B4D80000-0x00007FF7B50D4000-memory.dmp

Download

memory/3084-504-0x00007FF7B4D80000-0x00007FF7B50D4000-memory.dmp

Download

memory/3124-510-0x00007FF6A50F0000-0x00007FF6A5444000-memory.dmp

Download

memory/3124-2207-0x00007FF6A50F0000-0x00007FF6A5444000-memory.dmp

Download

memory/3288-2193-0x00007FF7E66E0000-0x00007FF7E6A34000-memory.dmp

Download

memory/3288-44-0x00007FF7E66E0000-0x00007FF7E6A34000-memory.dmp

Download

memory/3288-1444-0x00007FF7E66E0000-0x00007FF7E6A34000-memory.dmp

Download

memory/3444-2187-0x00007FF767BB0000-0x00007FF767F04000-memory.dmp

Download

memory/3444-2201-0x00007FF767BB0000-0x00007FF767F04000-memory.dmp

Download

memory/3444-94-0x00007FF767BB0000-0x00007FF767F04000-memory.dmp

Download

memory/3628-557-0x00007FF7DCC80000-0x00007FF7DCFD4000-memory.dmp

Download

memory/3628-2209-0x00007FF7DCC80000-0x00007FF7DCFD4000-memory.dmp

Download

memory/3968-505-0x00007FF688EC0000-0x00007FF689214000-memory.dmp

Download

memory/3968-2204-0x00007FF688EC0000-0x00007FF689214000-memory.dmp

Download

memory/4004-507-0x00007FF7F3670000-0x00007FF7F39C4000-memory.dmp

Download

memory/4004-2210-0x00007FF7F3670000-0x00007FF7F39C4000-memory.dmp

Download

memory/4048-8-0x00007FF7D9680000-0x00007FF7D99D4000-memory.dmp

Download

memory/4048-2188-0x00007FF7D9680000-0x00007FF7D99D4000-memory.dmp

Download

memory/4072-2211-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp

Download

memory/4072-555-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp

Download

memory/4200-2195-0x00007FF7C7FE0000-0x00007FF7C8334000-memory.dmp

Download

memory/4200-55-0x00007FF7C7FE0000-0x00007FF7C8334000-memory.dmp

Download

memory/4244-2191-0x00007FF6B2F60000-0x00007FF6B32B4000-memory.dmp

Download

memory/4244-28-0x00007FF6B2F60000-0x00007FF6B32B4000-memory.dmp

Download

memory/4348-2199-0x00007FF7BDBC0000-0x00007FF7BDF14000-memory.dmp

Download

memory/4348-87-0x00007FF7BDBC0000-0x00007FF7BDF14000-memory.dmp

Download

memory/4376-2212-0x00007FF6038D0000-0x00007FF603C24000-memory.dmp

Download

memory/4376-541-0x00007FF6038D0000-0x00007FF603C24000-memory.dmp

Download

memory/4604-549-0x00007FF7789E0000-0x00007FF778D34000-memory.dmp

Download

memory/4604-2203-0x00007FF7789E0000-0x00007FF778D34000-memory.dmp

Download

memory/4928-47-0x00007FF6050C0000-0x00007FF605414000-memory.dmp

Download

memory/4928-2194-0x00007FF6050C0000-0x00007FF605414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads