xmrig | 4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
Size

2.4MB
MD5

13700495e8d7ada22e333cb54f194610
SHA1

39ae033646996f29bac2d22130dfc4cf68180a92
SHA256

4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a
SHA512

ebe1079f3cfa3cf6ca5e7920c8a3965bcca24f916441ff5390d59edf5134540f52b5b5c1094dd6b478201d42cd0640a6455bd0bb4f581553df40aeba42620a2b
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUpUba8ldHeh:oemTLkNdfE0pZrQ7

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF781670000-0x00007FF7819C4000-memory.dmp	xmrig
behavioral2/files/0x000800000002323f-4.dat	xmrig
behavioral2/files/0x0008000000023245-8.dat	xmrig
behavioral2/memory/4824-10-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023242-12.dat	xmrig
behavioral2/memory/3656-16-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023247-20.dat	xmrig
behavioral2/memory/2420-27-0x00007FF7AB460000-0x00007FF7AB7B4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023243-34.dat	xmrig
behavioral2/files/0x0007000000023249-40.dat	xmrig
behavioral2/files/0x000700000002324d-61.dat	xmrig
behavioral2/files/0x000700000002324e-67.dat	xmrig
behavioral2/memory/3988-82-0x00007FF6B0650000-0x00007FF6B09A4000-memory.dmp	xmrig
behavioral2/memory/3432-86-0x00007FF708D00000-0x00007FF709054000-memory.dmp	xmrig
behavioral2/memory/1656-89-0x00007FF654F30000-0x00007FF655284000-memory.dmp	xmrig
behavioral2/memory/4372-93-0x00007FF756180000-0x00007FF7564D4000-memory.dmp	xmrig
behavioral2/memory/1796-94-0x00007FF643080000-0x00007FF6433D4000-memory.dmp	xmrig
behavioral2/memory/1800-92-0x00007FF6B4A90000-0x00007FF6B4DE4000-memory.dmp	xmrig
behavioral2/memory/572-91-0x00007FF7B9960000-0x00007FF7B9CB4000-memory.dmp	xmrig
behavioral2/memory/4916-90-0x00007FF6974A0000-0x00007FF6977F4000-memory.dmp	xmrig
behavioral2/memory/3884-88-0x00007FF657FD0000-0x00007FF658324000-memory.dmp	xmrig
behavioral2/memory/1556-87-0x00007FF6BAAD0000-0x00007FF6BAE24000-memory.dmp	xmrig
behavioral2/memory/2620-85-0x00007FF7B5A40000-0x00007FF7B5D94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023252-84.dat	xmrig
behavioral2/files/0x0007000000023251-83.dat	xmrig
behavioral2/files/0x0007000000023250-81.dat	xmrig
behavioral2/files/0x000700000002324f-78.dat	xmrig
behavioral2/files/0x000700000002324c-56.dat	xmrig
behavioral2/files/0x000700000002324b-51.dat	xmrig
behavioral2/files/0x000700000002324a-46.dat	xmrig
behavioral2/files/0x0007000000023248-33.dat	xmrig
behavioral2/memory/416-32-0x00007FF76FC30000-0x00007FF76FF84000-memory.dmp	xmrig
behavioral2/memory/4648-21-0x00007FF60B540000-0x00007FF60B894000-memory.dmp	xmrig
behavioral2/files/0x0007000000023253-99.dat	xmrig
behavioral2/memory/2944-104-0x00007FF719F40000-0x00007FF71A294000-memory.dmp	xmrig
behavioral2/files/0x0007000000023256-112.dat	xmrig
behavioral2/files/0x000700000002325b-136.dat	xmrig
behavioral2/files/0x000700000002325c-145.dat	xmrig
behavioral2/files/0x000700000002325d-165.dat	xmrig
behavioral2/files/0x0007000000023264-184.dat	xmrig
behavioral2/files/0x0007000000023265-190.dat	xmrig
behavioral2/files/0x0007000000023262-189.dat	xmrig
behavioral2/memory/3088-198-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	xmrig
behavioral2/memory/2716-202-0x00007FF757900000-0x00007FF757C54000-memory.dmp	xmrig
behavioral2/memory/4648-204-0x00007FF60B540000-0x00007FF60B894000-memory.dmp	xmrig
behavioral2/memory/1020-203-0x00007FF611CF0000-0x00007FF612044000-memory.dmp	xmrig
behavioral2/memory/2576-201-0x00007FF66B950000-0x00007FF66BCA4000-memory.dmp	xmrig
behavioral2/memory/404-200-0x00007FF6D6460000-0x00007FF6D67B4000-memory.dmp	xmrig
behavioral2/memory/640-199-0x00007FF763590000-0x00007FF7638E4000-memory.dmp	xmrig
behavioral2/memory/3404-197-0x00007FF7731F0000-0x00007FF773544000-memory.dmp	xmrig
behavioral2/files/0x0007000000023260-182.dat	xmrig
behavioral2/files/0x0007000000023263-181.dat	xmrig
behavioral2/files/0x000700000002325f-176.dat	xmrig
behavioral2/files/0x0007000000023261-172.dat	xmrig
behavioral2/memory/3656-170-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002325e-164.dat	xmrig
behavioral2/memory/908-161-0x00007FF7DCFB0000-0x00007FF7DD304000-memory.dmp	xmrig
behavioral2/memory/4824-152-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002325a-155.dat	xmrig
behavioral2/memory/4904-141-0x00007FF625380000-0x00007FF6256D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023259-140.dat	xmrig
behavioral2/files/0x0007000000023257-134.dat	xmrig
behavioral2/memory/2816-133-0x00007FF65F490000-0x00007FF65F7E4000-memory.dmp	xmrig
behavioral2/memory/1448-125-0x00007FF781670000-0x00007FF7819C4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4824	ZfsgErs.exe
3656	hsFmJTH.exe
4648	MSRjTBr.exe
2420	QKWbcye.exe
416	accSaVp.exe
3988	xdBGjjr.exe
2620	VCcBpfS.exe
3432	DbFzCrj.exe
1556	LyFUdCc.exe
3884	yAvqUll.exe
1656	ZeIBCqv.exe
4916	XgfssNy.exe
572	LzETndf.exe
1800	AnZDGvn.exe
4372	tIiVAus.exe
1796	PWthzAk.exe
2944	kqMoqNM.exe
1528	YnojDWK.exe
5012	qKqBYEA.exe
2816	jhGYjHG.exe
4904	bdDKHxd.exe
908	yMomxWw.exe
404	GkccSBU.exe
3404	vaxnqKZ.exe
3088	puYXlcR.exe
2576	WKTCrJW.exe
2716	mxjnPqy.exe
1020	oexDxrw.exe
640	gayBiql.exe
3308	giBFSLc.exe
3668	KRkXLpl.exe
4196	ORkJRVa.exe
872	fYWrkoH.exe
4584	rhChnUR.exe
4640	KSmONXT.exe
1892	kLWufzC.exe
488	Uihjatk.exe
1744	aazwlEu.exe
1812	YzgUTzu.exe
2980	ECMHKtp.exe
4828	WnimQJh.exe
3840	tLOwDSJ.exe
3036	QaQcUal.exe
5084	aMdCoBY.exe
1344	dPYKoUU.exe
436	cYZjRVI.exe
2776	iWfVSyM.exe
232	jlllmPU.exe
3184	DYHHnKw.exe
2212	WjSSwpi.exe
2648	MrsiQyA.exe
4428	PKaguHm.exe
2132	YktAfCZ.exe
1204	buapHrp.exe
3316	yhxtcDC.exe
3324	kwojiFZ.exe
852	DYQJmXN.exe
224	hOFpsgn.exe
4772	SixDNWa.exe
5020	YXbmSmE.exe
1984	eJERnLM.exe
4520	mPCPeCe.exe
2868	AZJzVhy.exe
4848	ehdXTsb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF781670000-0x00007FF7819C4000-memory.dmp	upx
behavioral2/files/0x000800000002323f-4.dat	upx
behavioral2/files/0x0008000000023245-8.dat	upx
behavioral2/memory/4824-10-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp	upx
behavioral2/files/0x0008000000023242-12.dat	upx
behavioral2/memory/3656-16-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp	upx
behavioral2/files/0x0008000000023247-20.dat	upx
behavioral2/memory/2420-27-0x00007FF7AB460000-0x00007FF7AB7B4000-memory.dmp	upx
behavioral2/files/0x0008000000023243-34.dat	upx
behavioral2/files/0x0007000000023249-40.dat	upx
behavioral2/files/0x000700000002324d-61.dat	upx
behavioral2/files/0x000700000002324e-67.dat	upx
behavioral2/memory/3988-82-0x00007FF6B0650000-0x00007FF6B09A4000-memory.dmp	upx
behavioral2/memory/3432-86-0x00007FF708D00000-0x00007FF709054000-memory.dmp	upx
behavioral2/memory/1656-89-0x00007FF654F30000-0x00007FF655284000-memory.dmp	upx
behavioral2/memory/4372-93-0x00007FF756180000-0x00007FF7564D4000-memory.dmp	upx
behavioral2/memory/1796-94-0x00007FF643080000-0x00007FF6433D4000-memory.dmp	upx
behavioral2/memory/1800-92-0x00007FF6B4A90000-0x00007FF6B4DE4000-memory.dmp	upx
behavioral2/memory/572-91-0x00007FF7B9960000-0x00007FF7B9CB4000-memory.dmp	upx
behavioral2/memory/4916-90-0x00007FF6974A0000-0x00007FF6977F4000-memory.dmp	upx
behavioral2/memory/3884-88-0x00007FF657FD0000-0x00007FF658324000-memory.dmp	upx
behavioral2/memory/1556-87-0x00007FF6BAAD0000-0x00007FF6BAE24000-memory.dmp	upx
behavioral2/memory/2620-85-0x00007FF7B5A40000-0x00007FF7B5D94000-memory.dmp	upx
behavioral2/files/0x0007000000023252-84.dat	upx
behavioral2/files/0x0007000000023251-83.dat	upx
behavioral2/files/0x0007000000023250-81.dat	upx
behavioral2/files/0x000700000002324f-78.dat	upx
behavioral2/files/0x000700000002324c-56.dat	upx
behavioral2/files/0x000700000002324b-51.dat	upx
behavioral2/files/0x000700000002324a-46.dat	upx
behavioral2/files/0x0007000000023248-33.dat	upx
behavioral2/memory/416-32-0x00007FF76FC30000-0x00007FF76FF84000-memory.dmp	upx
behavioral2/memory/4648-21-0x00007FF60B540000-0x00007FF60B894000-memory.dmp	upx
behavioral2/files/0x0007000000023253-99.dat	upx
behavioral2/memory/2944-104-0x00007FF719F40000-0x00007FF71A294000-memory.dmp	upx
behavioral2/files/0x0007000000023256-112.dat	upx
behavioral2/files/0x000700000002325b-136.dat	upx
behavioral2/files/0x000700000002325c-145.dat	upx
behavioral2/files/0x000700000002325d-165.dat	upx
behavioral2/files/0x0007000000023264-184.dat	upx
behavioral2/files/0x0007000000023265-190.dat	upx
behavioral2/files/0x0007000000023262-189.dat	upx
behavioral2/memory/3088-198-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	upx
behavioral2/memory/2716-202-0x00007FF757900000-0x00007FF757C54000-memory.dmp	upx
behavioral2/memory/4648-204-0x00007FF60B540000-0x00007FF60B894000-memory.dmp	upx
behavioral2/memory/1020-203-0x00007FF611CF0000-0x00007FF612044000-memory.dmp	upx
behavioral2/memory/2576-201-0x00007FF66B950000-0x00007FF66BCA4000-memory.dmp	upx
behavioral2/memory/404-200-0x00007FF6D6460000-0x00007FF6D67B4000-memory.dmp	upx
behavioral2/memory/640-199-0x00007FF763590000-0x00007FF7638E4000-memory.dmp	upx
behavioral2/memory/3404-197-0x00007FF7731F0000-0x00007FF773544000-memory.dmp	upx
behavioral2/files/0x0007000000023260-182.dat	upx
behavioral2/files/0x0007000000023263-181.dat	upx
behavioral2/files/0x000700000002325f-176.dat	upx
behavioral2/files/0x0007000000023261-172.dat	upx
behavioral2/memory/3656-170-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp	upx
behavioral2/files/0x000700000002325e-164.dat	upx
behavioral2/memory/908-161-0x00007FF7DCFB0000-0x00007FF7DD304000-memory.dmp	upx
behavioral2/memory/4824-152-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp	upx
behavioral2/files/0x000700000002325a-155.dat	upx
behavioral2/memory/4904-141-0x00007FF625380000-0x00007FF6256D4000-memory.dmp	upx
behavioral2/files/0x0007000000023259-140.dat	upx
behavioral2/files/0x0007000000023257-134.dat	upx
behavioral2/memory/2816-133-0x00007FF65F490000-0x00007FF65F7E4000-memory.dmp	upx
behavioral2/memory/1448-125-0x00007FF781670000-0x00007FF7819C4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\izUtWbB.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\XeVDsXm.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\jhGYjHG.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\cYZjRVI.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\XMNcoHB.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\yawwrWR.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\PfMIhlw.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\FglOlqh.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\FSSTBLR.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\bPtCZuL.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\yhxtcDC.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\eiqRCNB.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\efSqDbO.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\eoxffUo.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\oiefBXg.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\qShNvRC.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\oEkzvTH.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\fsdUnsC.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\JHNeKXl.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\ipDDMKV.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\UTOcCyn.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\jtXYeoE.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\tgUqshF.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\inVwuLS.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\yffofEW.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\QzQqoAF.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\PKHQNxU.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\beAlqdb.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\OuDIQrX.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\pYUKVdA.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\yMomxWw.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\vLKFKvs.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\qiytiRv.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\RlHTHib.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\DzZVKAX.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\jWATZzI.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\gsiCkjK.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\LyFUdCc.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\HWtlEFO.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\AfZzkWE.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\WqAwhtr.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\MPfPFYX.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\dpNrAfl.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\ufxHGwo.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\SPOmBZF.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\igsQQkL.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\FysjVEz.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\Rzzrogi.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\oJpSkco.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\xmtvhbs.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\eUVYgzK.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\PAjTeWO.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\lJHpFrl.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\egxvdGg.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\SixDNWa.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\VajQomZ.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\aWwrkfp.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\bdrzCUJ.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\CLhVYIa.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\tGLdPuV.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\XOXRPoj.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\hsFmJTH.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\XXUMpTK.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
File created	C:\Windows\System\qBmUghc.exe	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4824	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	92
PID 1448 wrote to memory of 4824	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	92
PID 1448 wrote to memory of 3656	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	93
PID 1448 wrote to memory of 3656	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	93
PID 1448 wrote to memory of 4648	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	94
PID 1448 wrote to memory of 4648	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	94
PID 1448 wrote to memory of 2420	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	95
PID 1448 wrote to memory of 2420	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	95
PID 1448 wrote to memory of 416	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	96
PID 1448 wrote to memory of 416	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	96
PID 1448 wrote to memory of 3988	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	97
PID 1448 wrote to memory of 3988	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	97
PID 1448 wrote to memory of 2620	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	98
PID 1448 wrote to memory of 2620	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	98
PID 1448 wrote to memory of 3432	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	99
PID 1448 wrote to memory of 3432	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	99
PID 1448 wrote to memory of 1556	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	100
PID 1448 wrote to memory of 1556	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	100
PID 1448 wrote to memory of 3884	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	101
PID 1448 wrote to memory of 3884	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	101
PID 1448 wrote to memory of 1656	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	102
PID 1448 wrote to memory of 1656	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	102
PID 1448 wrote to memory of 4916	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	103
PID 1448 wrote to memory of 4916	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	103
PID 1448 wrote to memory of 572	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	104
PID 1448 wrote to memory of 572	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	104
PID 1448 wrote to memory of 1800	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	105
PID 1448 wrote to memory of 1800	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	105
PID 1448 wrote to memory of 4372	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	106
PID 1448 wrote to memory of 4372	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	106
PID 1448 wrote to memory of 1796	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	107
PID 1448 wrote to memory of 1796	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	107
PID 1448 wrote to memory of 2944	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	108
PID 1448 wrote to memory of 2944	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	108
PID 1448 wrote to memory of 1528	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	109
PID 1448 wrote to memory of 1528	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	109
PID 1448 wrote to memory of 5012	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	110
PID 1448 wrote to memory of 5012	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	110
PID 1448 wrote to memory of 2816	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	111
PID 1448 wrote to memory of 2816	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	111
PID 1448 wrote to memory of 4904	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	112
PID 1448 wrote to memory of 4904	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	112
PID 1448 wrote to memory of 908	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	113
PID 1448 wrote to memory of 908	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	113
PID 1448 wrote to memory of 404	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	114
PID 1448 wrote to memory of 404	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	114
PID 1448 wrote to memory of 3404	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	115
PID 1448 wrote to memory of 3404	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	115
PID 1448 wrote to memory of 3088	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	116
PID 1448 wrote to memory of 3088	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	116
PID 1448 wrote to memory of 2576	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	117
PID 1448 wrote to memory of 2576	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	117
PID 1448 wrote to memory of 1020	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	118
PID 1448 wrote to memory of 1020	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	118
PID 1448 wrote to memory of 2716	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	119
PID 1448 wrote to memory of 2716	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	119
PID 1448 wrote to memory of 640	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	120
PID 1448 wrote to memory of 640	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	120
PID 1448 wrote to memory of 3308	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	121
PID 1448 wrote to memory of 3308	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	121
PID 1448 wrote to memory of 3668	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	122
PID 1448 wrote to memory of 3668	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	122
PID 1448 wrote to memory of 4196	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	123
PID 1448 wrote to memory of 4196	1448	4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d4e45ec89b1b6c85d0ac571f5cf7343d367b69065871dfd2cfc1190f202db7a_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System\ZfsgErs.exe
  C:\Windows\System\ZfsgErs.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\hsFmJTH.exe
  C:\Windows\System\hsFmJTH.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\MSRjTBr.exe
  C:\Windows\System\MSRjTBr.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\QKWbcye.exe
  C:\Windows\System\QKWbcye.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\accSaVp.exe
  C:\Windows\System\accSaVp.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\xdBGjjr.exe
  C:\Windows\System\xdBGjjr.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\VCcBpfS.exe
  C:\Windows\System\VCcBpfS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\DbFzCrj.exe
  C:\Windows\System\DbFzCrj.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\LyFUdCc.exe
  C:\Windows\System\LyFUdCc.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\yAvqUll.exe
  C:\Windows\System\yAvqUll.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\ZeIBCqv.exe
  C:\Windows\System\ZeIBCqv.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\XgfssNy.exe
  C:\Windows\System\XgfssNy.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\LzETndf.exe
  C:\Windows\System\LzETndf.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\AnZDGvn.exe
  C:\Windows\System\AnZDGvn.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\tIiVAus.exe
  C:\Windows\System\tIiVAus.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\PWthzAk.exe
  C:\Windows\System\PWthzAk.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\kqMoqNM.exe
  C:\Windows\System\kqMoqNM.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\YnojDWK.exe
  C:\Windows\System\YnojDWK.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\qKqBYEA.exe
  C:\Windows\System\qKqBYEA.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\jhGYjHG.exe
  C:\Windows\System\jhGYjHG.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\bdDKHxd.exe
  C:\Windows\System\bdDKHxd.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\yMomxWw.exe
  C:\Windows\System\yMomxWw.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\GkccSBU.exe
  C:\Windows\System\GkccSBU.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\vaxnqKZ.exe
  C:\Windows\System\vaxnqKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\puYXlcR.exe
  C:\Windows\System\puYXlcR.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\WKTCrJW.exe
  C:\Windows\System\WKTCrJW.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\oexDxrw.exe
  C:\Windows\System\oexDxrw.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\mxjnPqy.exe
  C:\Windows\System\mxjnPqy.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gayBiql.exe
  C:\Windows\System\gayBiql.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\giBFSLc.exe
  C:\Windows\System\giBFSLc.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\KRkXLpl.exe
  C:\Windows\System\KRkXLpl.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\ORkJRVa.exe
  C:\Windows\System\ORkJRVa.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\fYWrkoH.exe
  C:\Windows\System\fYWrkoH.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\rhChnUR.exe
  C:\Windows\System\rhChnUR.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\Uihjatk.exe
  C:\Windows\System\Uihjatk.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\KSmONXT.exe
  C:\Windows\System\KSmONXT.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\kLWufzC.exe
  C:\Windows\System\kLWufzC.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\aazwlEu.exe
  C:\Windows\System\aazwlEu.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\YzgUTzu.exe
  C:\Windows\System\YzgUTzu.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\ECMHKtp.exe
  C:\Windows\System\ECMHKtp.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\WnimQJh.exe
  C:\Windows\System\WnimQJh.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\tLOwDSJ.exe
  C:\Windows\System\tLOwDSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\QaQcUal.exe
  C:\Windows\System\QaQcUal.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\aMdCoBY.exe
  C:\Windows\System\aMdCoBY.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\dPYKoUU.exe
  C:\Windows\System\dPYKoUU.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\cYZjRVI.exe
  C:\Windows\System\cYZjRVI.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\iWfVSyM.exe
  C:\Windows\System\iWfVSyM.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\jlllmPU.exe
  C:\Windows\System\jlllmPU.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\DYHHnKw.exe
  C:\Windows\System\DYHHnKw.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\WjSSwpi.exe
  C:\Windows\System\WjSSwpi.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\MrsiQyA.exe
  C:\Windows\System\MrsiQyA.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PKaguHm.exe
  C:\Windows\System\PKaguHm.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\YktAfCZ.exe
  C:\Windows\System\YktAfCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\buapHrp.exe
  C:\Windows\System\buapHrp.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\yhxtcDC.exe
  C:\Windows\System\yhxtcDC.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\kwojiFZ.exe
  C:\Windows\System\kwojiFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\DYQJmXN.exe
  C:\Windows\System\DYQJmXN.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\hOFpsgn.exe
  C:\Windows\System\hOFpsgn.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\SixDNWa.exe
  C:\Windows\System\SixDNWa.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\YXbmSmE.exe
  C:\Windows\System\YXbmSmE.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\eJERnLM.exe
  C:\Windows\System\eJERnLM.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\mPCPeCe.exe
  C:\Windows\System\mPCPeCe.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\AZJzVhy.exe
  C:\Windows\System\AZJzVhy.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ehdXTsb.exe
  C:\Windows\System\ehdXTsb.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\EZGGiyx.exe
  C:\Windows\System\EZGGiyx.exe
  2⤵
  PID:1716
- C:\Windows\System\KDeBgTJ.exe
  C:\Windows\System\KDeBgTJ.exe
  2⤵
  PID:1768
- C:\Windows\System\WqAwhtr.exe
  C:\Windows\System\WqAwhtr.exe
  2⤵
  PID:5044
- C:\Windows\System\GtLjUHo.exe
  C:\Windows\System\GtLjUHo.exe
  2⤵
  PID:4400
- C:\Windows\System\ypKLuwg.exe
  C:\Windows\System\ypKLuwg.exe
  2⤵
  PID:876
- C:\Windows\System\VajQomZ.exe
  C:\Windows\System\VajQomZ.exe
  2⤵
  PID:1428
- C:\Windows\System\AbkDZjN.exe
  C:\Windows\System\AbkDZjN.exe
  2⤵
  PID:2872
- C:\Windows\System\cOrOjAX.exe
  C:\Windows\System\cOrOjAX.exe
  2⤵
  PID:4560
- C:\Windows\System\skBJtti.exe
  C:\Windows\System\skBJtti.exe
  2⤵
  PID:2824
- C:\Windows\System\UkoMbNM.exe
  C:\Windows\System\UkoMbNM.exe
  2⤵
  PID:1384
- C:\Windows\System\MxjvsnQ.exe
  C:\Windows\System\MxjvsnQ.exe
  2⤵
  PID:2308
- C:\Windows\System\vTKRoVI.exe
  C:\Windows\System\vTKRoVI.exe
  2⤵
  PID:5140
- C:\Windows\System\FysjVEz.exe
  C:\Windows\System\FysjVEz.exe
  2⤵
  PID:5168
- C:\Windows\System\FuAsjrN.exe
  C:\Windows\System\FuAsjrN.exe
  2⤵
  PID:5196
- C:\Windows\System\QznEDhZ.exe
  C:\Windows\System\QznEDhZ.exe
  2⤵
  PID:5224
- C:\Windows\System\uOJcqwK.exe
  C:\Windows\System\uOJcqwK.exe
  2⤵
  PID:5252
- C:\Windows\System\iJogTZy.exe
  C:\Windows\System\iJogTZy.exe
  2⤵
  PID:5280
- C:\Windows\System\YWGELAX.exe
  C:\Windows\System\YWGELAX.exe
  2⤵
  PID:5308
- C:\Windows\System\pGsGlMd.exe
  C:\Windows\System\pGsGlMd.exe
  2⤵
  PID:5336
- C:\Windows\System\jSyfIyL.exe
  C:\Windows\System\jSyfIyL.exe
  2⤵
  PID:5364
- C:\Windows\System\DSEgvFL.exe
  C:\Windows\System\DSEgvFL.exe
  2⤵
  PID:5392
- C:\Windows\System\meDaIiP.exe
  C:\Windows\System\meDaIiP.exe
  2⤵
  PID:5420
- C:\Windows\System\CTsMxSs.exe
  C:\Windows\System\CTsMxSs.exe
  2⤵
  PID:5460
- C:\Windows\System\abzUsxE.exe
  C:\Windows\System\abzUsxE.exe
  2⤵
  PID:5488
- C:\Windows\System\OBzUcis.exe
  C:\Windows\System\OBzUcis.exe
  2⤵
  PID:5516
- C:\Windows\System\XMNcoHB.exe
  C:\Windows\System\XMNcoHB.exe
  2⤵
  PID:5544
- C:\Windows\System\msdNpDQ.exe
  C:\Windows\System\msdNpDQ.exe
  2⤵
  PID:5572
- C:\Windows\System\eRhDnvS.exe
  C:\Windows\System\eRhDnvS.exe
  2⤵
  PID:5604
- C:\Windows\System\oaTtFzH.exe
  C:\Windows\System\oaTtFzH.exe
  2⤵
  PID:5632
- C:\Windows\System\eXPhKYa.exe
  C:\Windows\System\eXPhKYa.exe
  2⤵
  PID:5660
- C:\Windows\System\AMnUkNa.exe
  C:\Windows\System\AMnUkNa.exe
  2⤵
  PID:5688
- C:\Windows\System\PljSEKq.exe
  C:\Windows\System\PljSEKq.exe
  2⤵
  PID:5716
- C:\Windows\System\rOCbeff.exe
  C:\Windows\System\rOCbeff.exe
  2⤵
  PID:5744
- C:\Windows\System\LEeStOM.exe
  C:\Windows\System\LEeStOM.exe
  2⤵
  PID:5772
- C:\Windows\System\tvXyYyE.exe
  C:\Windows\System\tvXyYyE.exe
  2⤵
  PID:5800
- C:\Windows\System\KTsQsfJ.exe
  C:\Windows\System\KTsQsfJ.exe
  2⤵
  PID:5828
- C:\Windows\System\AmRfcxk.exe
  C:\Windows\System\AmRfcxk.exe
  2⤵
  PID:5856
- C:\Windows\System\cuzpwcD.exe
  C:\Windows\System\cuzpwcD.exe
  2⤵
  PID:5884
- C:\Windows\System\SGQhTJe.exe
  C:\Windows\System\SGQhTJe.exe
  2⤵
  PID:5912
- C:\Windows\System\gFFZrHV.exe
  C:\Windows\System\gFFZrHV.exe
  2⤵
  PID:5940
- C:\Windows\System\emavcXU.exe
  C:\Windows\System\emavcXU.exe
  2⤵
  PID:5968
- C:\Windows\System\gZffcpv.exe
  C:\Windows\System\gZffcpv.exe
  2⤵
  PID:5996
- C:\Windows\System\jYoLffI.exe
  C:\Windows\System\jYoLffI.exe
  2⤵
  PID:6024
- C:\Windows\System\poUDJnP.exe
  C:\Windows\System\poUDJnP.exe
  2⤵
  PID:6052
- C:\Windows\System\KyMaekw.exe
  C:\Windows\System\KyMaekw.exe
  2⤵
  PID:6080
- C:\Windows\System\xwcrzOy.exe
  C:\Windows\System\xwcrzOy.exe
  2⤵
  PID:6108
- C:\Windows\System\aQamTZj.exe
  C:\Windows\System\aQamTZj.exe
  2⤵
  PID:6136
- C:\Windows\System\rnNdynM.exe
  C:\Windows\System\rnNdynM.exe
  2⤵
  PID:5164
- C:\Windows\System\XDUYiqO.exe
  C:\Windows\System\XDUYiqO.exe
  2⤵
  PID:5236
- C:\Windows\System\gLXmLtY.exe
  C:\Windows\System\gLXmLtY.exe
  2⤵
  PID:5304
- C:\Windows\System\hfFaIzZ.exe
  C:\Windows\System\hfFaIzZ.exe
  2⤵
  PID:5356
- C:\Windows\System\JLtVNnO.exe
  C:\Windows\System\JLtVNnO.exe
  2⤵
  PID:5432
- C:\Windows\System\tgUqshF.exe
  C:\Windows\System\tgUqshF.exe
  2⤵
  PID:768
- C:\Windows\System\Rzzrogi.exe
  C:\Windows\System\Rzzrogi.exe
  2⤵
  PID:5556
- C:\Windows\System\COQtErv.exe
  C:\Windows\System\COQtErv.exe
  2⤵
  PID:5624
- C:\Windows\System\OxuXbis.exe
  C:\Windows\System\OxuXbis.exe
  2⤵
  PID:5684
- C:\Windows\System\DYzyWft.exe
  C:\Windows\System\DYzyWft.exe
  2⤵
  PID:5756
- C:\Windows\System\yawwrWR.exe
  C:\Windows\System\yawwrWR.exe
  2⤵
  PID:5820
- C:\Windows\System\AimNGBd.exe
  C:\Windows\System\AimNGBd.exe
  2⤵
  PID:5880
- C:\Windows\System\URxaeaM.exe
  C:\Windows\System\URxaeaM.exe
  2⤵
  PID:5952
- C:\Windows\System\eZwjaRP.exe
  C:\Windows\System\eZwjaRP.exe
  2⤵
  PID:6016
- C:\Windows\System\YtELnmm.exe
  C:\Windows\System\YtELnmm.exe
  2⤵
  PID:6092
- C:\Windows\System\YfyOoVu.exe
  C:\Windows\System\YfyOoVu.exe
  2⤵
  PID:5160
- C:\Windows\System\fsdUnsC.exe
  C:\Windows\System\fsdUnsC.exe
  2⤵
  PID:5348
- C:\Windows\System\yOnICwl.exe
  C:\Windows\System\yOnICwl.exe
  2⤵
  PID:5528
- C:\Windows\System\JpxpSeo.exe
  C:\Windows\System\JpxpSeo.exe
  2⤵
  PID:5672
- C:\Windows\System\lflGewL.exe
  C:\Windows\System\lflGewL.exe
  2⤵
  PID:5812
- C:\Windows\System\whruusJ.exe
  C:\Windows\System\whruusJ.exe
  2⤵
  PID:5932
- C:\Windows\System\uHrAVKo.exe
  C:\Windows\System\uHrAVKo.exe
  2⤵
  PID:6120
- C:\Windows\System\BmMOqOx.exe
  C:\Windows\System\BmMOqOx.exe
  2⤵
  PID:5276
- C:\Windows\System\inVwuLS.exe
  C:\Windows\System\inVwuLS.exe
  2⤵
  PID:5616
- C:\Windows\System\aOoXQYX.exe
  C:\Windows\System\aOoXQYX.exe
  2⤵
  PID:5908
- C:\Windows\System\vkGDqOO.exe
  C:\Windows\System\vkGDqOO.exe
  2⤵
  PID:5388
- C:\Windows\System\DwjtykA.exe
  C:\Windows\System\DwjtykA.exe
  2⤵
  PID:6128
- C:\Windows\System\zRUvNXk.exe
  C:\Windows\System\zRUvNXk.exe
  2⤵
  PID:6160
- C:\Windows\System\hgFJawd.exe
  C:\Windows\System\hgFJawd.exe
  2⤵
  PID:6188
- C:\Windows\System\VxLWbRv.exe
  C:\Windows\System\VxLWbRv.exe
  2⤵
  PID:6216
- C:\Windows\System\RTfpFXo.exe
  C:\Windows\System\RTfpFXo.exe
  2⤵
  PID:6244
- C:\Windows\System\ewcDOAA.exe
  C:\Windows\System\ewcDOAA.exe
  2⤵
  PID:6276
- C:\Windows\System\mKDsozt.exe
  C:\Windows\System\mKDsozt.exe
  2⤵
  PID:6308
- C:\Windows\System\kqcrtlm.exe
  C:\Windows\System\kqcrtlm.exe
  2⤵
  PID:6336
- C:\Windows\System\cyZbeYE.exe
  C:\Windows\System\cyZbeYE.exe
  2⤵
  PID:6364
- C:\Windows\System\kOglpWG.exe
  C:\Windows\System\kOglpWG.exe
  2⤵
  PID:6392
- C:\Windows\System\vFzfWqG.exe
  C:\Windows\System\vFzfWqG.exe
  2⤵
  PID:6420
- C:\Windows\System\hrwbSHx.exe
  C:\Windows\System\hrwbSHx.exe
  2⤵
  PID:6452
- C:\Windows\System\ZaWisrr.exe
  C:\Windows\System\ZaWisrr.exe
  2⤵
  PID:6480
- C:\Windows\System\pFLQVYr.exe
  C:\Windows\System\pFLQVYr.exe
  2⤵
  PID:6508
- C:\Windows\System\KIIQSPK.exe
  C:\Windows\System\KIIQSPK.exe
  2⤵
  PID:6536
- C:\Windows\System\ervUQMN.exe
  C:\Windows\System\ervUQMN.exe
  2⤵
  PID:6564
- C:\Windows\System\WGeEIhV.exe
  C:\Windows\System\WGeEIhV.exe
  2⤵
  PID:6592
- C:\Windows\System\xSkgXhZ.exe
  C:\Windows\System\xSkgXhZ.exe
  2⤵
  PID:6620
- C:\Windows\System\txfqUJY.exe
  C:\Windows\System\txfqUJY.exe
  2⤵
  PID:6648
- C:\Windows\System\iuLpYym.exe
  C:\Windows\System\iuLpYym.exe
  2⤵
  PID:6676
- C:\Windows\System\rStRXTD.exe
  C:\Windows\System\rStRXTD.exe
  2⤵
  PID:6704
- C:\Windows\System\eiqRCNB.exe
  C:\Windows\System\eiqRCNB.exe
  2⤵
  PID:6732
- C:\Windows\System\gGZjKOn.exe
  C:\Windows\System\gGZjKOn.exe
  2⤵
  PID:6760
- C:\Windows\System\POKaoeq.exe
  C:\Windows\System\POKaoeq.exe
  2⤵
  PID:6788
- C:\Windows\System\oTYmDbq.exe
  C:\Windows\System\oTYmDbq.exe
  2⤵
  PID:6816
- C:\Windows\System\aETXMHg.exe
  C:\Windows\System\aETXMHg.exe
  2⤵
  PID:6844
- C:\Windows\System\hLjpQsp.exe
  C:\Windows\System\hLjpQsp.exe
  2⤵
  PID:6872
- C:\Windows\System\BGTqdem.exe
  C:\Windows\System\BGTqdem.exe
  2⤵
  PID:6900
- C:\Windows\System\gBGoNAT.exe
  C:\Windows\System\gBGoNAT.exe
  2⤵
  PID:6928
- C:\Windows\System\ITVOcbY.exe
  C:\Windows\System\ITVOcbY.exe
  2⤵
  PID:6956
- C:\Windows\System\sVkljYY.exe
  C:\Windows\System\sVkljYY.exe
  2⤵
  PID:6972
- C:\Windows\System\ZbjwFmM.exe
  C:\Windows\System\ZbjwFmM.exe
  2⤵
  PID:6992
- C:\Windows\System\QAQRszo.exe
  C:\Windows\System\QAQRszo.exe
  2⤵
  PID:7012
- C:\Windows\System\baSjNSW.exe
  C:\Windows\System\baSjNSW.exe
  2⤵
  PID:7048
- C:\Windows\System\TnXXoFd.exe
  C:\Windows\System\TnXXoFd.exe
  2⤵
  PID:7096
- C:\Windows\System\JlyLTPX.exe
  C:\Windows\System\JlyLTPX.exe
  2⤵
  PID:7128
- C:\Windows\System\EzPcdtK.exe
  C:\Windows\System\EzPcdtK.exe
  2⤵
  PID:7152
- C:\Windows\System\mBhzxtl.exe
  C:\Windows\System\mBhzxtl.exe
  2⤵
  PID:6172
- C:\Windows\System\MisCWtl.exe
  C:\Windows\System\MisCWtl.exe
  2⤵
  PID:6228
- C:\Windows\System\SQeiTyN.exe
  C:\Windows\System\SQeiTyN.exe
  2⤵
  PID:6288
- C:\Windows\System\zrlwyjZ.exe
  C:\Windows\System\zrlwyjZ.exe
  2⤵
  PID:6348
- C:\Windows\System\rXgPgTC.exe
  C:\Windows\System\rXgPgTC.exe
  2⤵
  PID:6432
- C:\Windows\System\imQrJcM.exe
  C:\Windows\System\imQrJcM.exe
  2⤵
  PID:6500
- C:\Windows\System\XUtOgnJ.exe
  C:\Windows\System\XUtOgnJ.exe
  2⤵
  PID:6556
- C:\Windows\System\uzxcDhu.exe
  C:\Windows\System\uzxcDhu.exe
  2⤵
  PID:6616
- C:\Windows\System\ApgdJjy.exe
  C:\Windows\System\ApgdJjy.exe
  2⤵
  PID:6696
- C:\Windows\System\kSOGwJv.exe
  C:\Windows\System\kSOGwJv.exe
  2⤵
  PID:6752
- C:\Windows\System\bLiySgQ.exe
  C:\Windows\System\bLiySgQ.exe
  2⤵
  PID:6812
- C:\Windows\System\pCedZXa.exe
  C:\Windows\System\pCedZXa.exe
  2⤵
  PID:6896
- C:\Windows\System\vLKFKvs.exe
  C:\Windows\System\vLKFKvs.exe
  2⤵
  PID:6940
- C:\Windows\System\DdnFAuX.exe
  C:\Windows\System\DdnFAuX.exe
  2⤵
  PID:6968
- C:\Windows\System\eSTvkmJ.exe
  C:\Windows\System\eSTvkmJ.exe
  2⤵
  PID:7092
- C:\Windows\System\YGmeYiD.exe
  C:\Windows\System\YGmeYiD.exe
  2⤵
  PID:7140
- C:\Windows\System\TongNmU.exe
  C:\Windows\System\TongNmU.exe
  2⤵
  PID:5264
- C:\Windows\System\uTbrfvo.exe
  C:\Windows\System\uTbrfvo.exe
  2⤵
  PID:6404
- C:\Windows\System\XSdRHMb.exe
  C:\Windows\System\XSdRHMb.exe
  2⤵
  PID:6604
- C:\Windows\System\oVOLrsu.exe
  C:\Windows\System\oVOLrsu.exe
  2⤵
  PID:6780
- C:\Windows\System\JhxCOmT.exe
  C:\Windows\System\JhxCOmT.exe
  2⤵
  PID:6944
- C:\Windows\System\plAtgtA.exe
  C:\Windows\System\plAtgtA.exe
  2⤵
  PID:7056
- C:\Windows\System\zVFwTSs.exe
  C:\Windows\System\zVFwTSs.exe
  2⤵
  PID:6256
- C:\Windows\System\DgFvluY.exe
  C:\Windows\System\DgFvluY.exe
  2⤵
  PID:6640
- C:\Windows\System\MiFporE.exe
  C:\Windows\System\MiFporE.exe
  2⤵
  PID:7044
- C:\Windows\System\FGqKHDu.exe
  C:\Windows\System\FGqKHDu.exe
  2⤵
  PID:6612
- C:\Windows\System\KTaHITU.exe
  C:\Windows\System\KTaHITU.exe
  2⤵
  PID:6264
- C:\Windows\System\bdIbPtA.exe
  C:\Windows\System\bdIbPtA.exe
  2⤵
  PID:7196
- C:\Windows\System\omrQNxV.exe
  C:\Windows\System\omrQNxV.exe
  2⤵
  PID:7224
- C:\Windows\System\fIEFNpf.exe
  C:\Windows\System\fIEFNpf.exe
  2⤵
  PID:7252
- C:\Windows\System\WNAJrqG.exe
  C:\Windows\System\WNAJrqG.exe
  2⤵
  PID:7280
- C:\Windows\System\knSFIop.exe
  C:\Windows\System\knSFIop.exe
  2⤵
  PID:7312
- C:\Windows\System\mfNZLMY.exe
  C:\Windows\System\mfNZLMY.exe
  2⤵
  PID:7340
- C:\Windows\System\IHWutRA.exe
  C:\Windows\System\IHWutRA.exe
  2⤵
  PID:7368
- C:\Windows\System\FrIjMyl.exe
  C:\Windows\System\FrIjMyl.exe
  2⤵
  PID:7396
- C:\Windows\System\iWPAYsW.exe
  C:\Windows\System\iWPAYsW.exe
  2⤵
  PID:7424
- C:\Windows\System\VHGZMXz.exe
  C:\Windows\System\VHGZMXz.exe
  2⤵
  PID:7452
- C:\Windows\System\hjMFNTc.exe
  C:\Windows\System\hjMFNTc.exe
  2⤵
  PID:7480
- C:\Windows\System\AdukIwL.exe
  C:\Windows\System\AdukIwL.exe
  2⤵
  PID:7508
- C:\Windows\System\PBeWdBK.exe
  C:\Windows\System\PBeWdBK.exe
  2⤵
  PID:7536
- C:\Windows\System\fBfAXPv.exe
  C:\Windows\System\fBfAXPv.exe
  2⤵
  PID:7564
- C:\Windows\System\AxTJejB.exe
  C:\Windows\System\AxTJejB.exe
  2⤵
  PID:7592
- C:\Windows\System\KTWYdTl.exe
  C:\Windows\System\KTWYdTl.exe
  2⤵
  PID:7620
- C:\Windows\System\RZwGgwh.exe
  C:\Windows\System\RZwGgwh.exe
  2⤵
  PID:7648
- C:\Windows\System\cQUNpOS.exe
  C:\Windows\System\cQUNpOS.exe
  2⤵
  PID:7676
- C:\Windows\System\UulBKoz.exe
  C:\Windows\System\UulBKoz.exe
  2⤵
  PID:7720
- C:\Windows\System\WnQolsp.exe
  C:\Windows\System\WnQolsp.exe
  2⤵
  PID:7736
- C:\Windows\System\LQIQFZu.exe
  C:\Windows\System\LQIQFZu.exe
  2⤵
  PID:7764
- C:\Windows\System\CyFdtCD.exe
  C:\Windows\System\CyFdtCD.exe
  2⤵
  PID:7784
- C:\Windows\System\TXQfHsP.exe
  C:\Windows\System\TXQfHsP.exe
  2⤵
  PID:7812
- C:\Windows\System\BhGVUCL.exe
  C:\Windows\System\BhGVUCL.exe
  2⤵
  PID:7848
- C:\Windows\System\ijozgKJ.exe
  C:\Windows\System\ijozgKJ.exe
  2⤵
  PID:7876
- C:\Windows\System\dGKuwFp.exe
  C:\Windows\System\dGKuwFp.exe
  2⤵
  PID:7904
- C:\Windows\System\jGauyyz.exe
  C:\Windows\System\jGauyyz.exe
  2⤵
  PID:7932
- C:\Windows\System\LGaisZs.exe
  C:\Windows\System\LGaisZs.exe
  2⤵
  PID:7960
- C:\Windows\System\JmdrLhU.exe
  C:\Windows\System\JmdrLhU.exe
  2⤵
  PID:7980
- C:\Windows\System\druTnGw.exe
  C:\Windows\System\druTnGw.exe
  2⤵
  PID:8016
- C:\Windows\System\KqteiQo.exe
  C:\Windows\System\KqteiQo.exe
  2⤵
  PID:8044
- C:\Windows\System\LjjJUxn.exe
  C:\Windows\System\LjjJUxn.exe
  2⤵
  PID:8076
- C:\Windows\System\ZLOLToe.exe
  C:\Windows\System\ZLOLToe.exe
  2⤵
  PID:8104
- C:\Windows\System\ttGmPQl.exe
  C:\Windows\System\ttGmPQl.exe
  2⤵
  PID:8132
- C:\Windows\System\RpCXbEQ.exe
  C:\Windows\System\RpCXbEQ.exe
  2⤵
  PID:8160
- C:\Windows\System\kVmCvVD.exe
  C:\Windows\System\kVmCvVD.exe
  2⤵
  PID:8188
- C:\Windows\System\HAawEYF.exe
  C:\Windows\System\HAawEYF.exe
  2⤵
  PID:7208
- C:\Windows\System\oEBPpdF.exe
  C:\Windows\System\oEBPpdF.exe
  2⤵
  PID:7248
- C:\Windows\System\aqlpZSd.exe
  C:\Windows\System\aqlpZSd.exe
  2⤵
  PID:6268
- C:\Windows\System\AHYShbu.exe
  C:\Windows\System\AHYShbu.exe
  2⤵
  PID:7388
- C:\Windows\System\kQmPAzz.exe
  C:\Windows\System\kQmPAzz.exe
  2⤵
  PID:7448
- C:\Windows\System\GsVfCSo.exe
  C:\Windows\System\GsVfCSo.exe
  2⤵
  PID:7520
- C:\Windows\System\qDnznZU.exe
  C:\Windows\System\qDnznZU.exe
  2⤵
  PID:7588
- C:\Windows\System\fQoQgvV.exe
  C:\Windows\System\fQoQgvV.exe
  2⤵
  PID:7644
- C:\Windows\System\qhyCrTE.exe
  C:\Windows\System\qhyCrTE.exe
  2⤵
  PID:7700
- C:\Windows\System\WuANfQI.exe
  C:\Windows\System\WuANfQI.exe
  2⤵
  PID:7792
- C:\Windows\System\ccfdoKy.exe
  C:\Windows\System\ccfdoKy.exe
  2⤵
  PID:7808
- C:\Windows\System\uZitYiQ.exe
  C:\Windows\System\uZitYiQ.exe
  2⤵
  PID:7888
- C:\Windows\System\pYtvtqk.exe
  C:\Windows\System\pYtvtqk.exe
  2⤵
  PID:7968
- C:\Windows\System\MPfPFYX.exe
  C:\Windows\System\MPfPFYX.exe
  2⤵
  PID:8032
- C:\Windows\System\NIJcjHU.exe
  C:\Windows\System\NIJcjHU.exe
  2⤵
  PID:8100
- C:\Windows\System\IrHcpNU.exe
  C:\Windows\System\IrHcpNU.exe
  2⤵
  PID:8156
- C:\Windows\System\XRFRjwj.exe
  C:\Windows\System\XRFRjwj.exe
  2⤵
  PID:7272
- C:\Windows\System\VIUjPnx.exe
  C:\Windows\System\VIUjPnx.exe
  2⤵
  PID:7412
- C:\Windows\System\pnzrOFr.exe
  C:\Windows\System\pnzrOFr.exe
  2⤵
  PID:7560
- C:\Windows\System\rovCJQj.exe
  C:\Windows\System\rovCJQj.exe
  2⤵
  PID:7696
- C:\Windows\System\ZRhfMQl.exe
  C:\Windows\System\ZRhfMQl.exe
  2⤵
  PID:7900
- C:\Windows\System\yPPUyqk.exe
  C:\Windows\System\yPPUyqk.exe
  2⤵
  PID:8028
- C:\Windows\System\MLxzgoV.exe
  C:\Windows\System\MLxzgoV.exe
  2⤵
  PID:7184
- C:\Windows\System\KPtFUdY.exe
  C:\Windows\System\KPtFUdY.exe
  2⤵
  PID:7548
- C:\Windows\System\JQjstfg.exe
  C:\Windows\System\JQjstfg.exe
  2⤵
  PID:7892
- C:\Windows\System\UjqVnwh.exe
  C:\Windows\System\UjqVnwh.exe
  2⤵
  PID:8172
- C:\Windows\System\xTWaese.exe
  C:\Windows\System\xTWaese.exe
  2⤵
  PID:7716
- C:\Windows\System\oUzUDgA.exe
  C:\Windows\System\oUzUDgA.exe
  2⤵
  PID:8204
- C:\Windows\System\kqEibhY.exe
  C:\Windows\System\kqEibhY.exe
  2⤵
  PID:8232
- C:\Windows\System\yzYrUqK.exe
  C:\Windows\System\yzYrUqK.exe
  2⤵
  PID:8260
- C:\Windows\System\AnsBhaP.exe
  C:\Windows\System\AnsBhaP.exe
  2⤵
  PID:8288
- C:\Windows\System\oynvfJu.exe
  C:\Windows\System\oynvfJu.exe
  2⤵
  PID:8316
- C:\Windows\System\qildwdt.exe
  C:\Windows\System\qildwdt.exe
  2⤵
  PID:8332
- C:\Windows\System\CKrMJsb.exe
  C:\Windows\System\CKrMJsb.exe
  2⤵
  PID:8348
- C:\Windows\System\KNcCuJO.exe
  C:\Windows\System\KNcCuJO.exe
  2⤵
  PID:8372
- C:\Windows\System\ttbNxTd.exe
  C:\Windows\System\ttbNxTd.exe
  2⤵
  PID:8388
- C:\Windows\System\VgLeFOw.exe
  C:\Windows\System\VgLeFOw.exe
  2⤵
  PID:8412
- C:\Windows\System\GYajWfo.exe
  C:\Windows\System\GYajWfo.exe
  2⤵
  PID:8436
- C:\Windows\System\voxUNQn.exe
  C:\Windows\System\voxUNQn.exe
  2⤵
  PID:8452
- C:\Windows\System\cEWmdjR.exe
  C:\Windows\System\cEWmdjR.exe
  2⤵
  PID:8476
- C:\Windows\System\BaFRQbL.exe
  C:\Windows\System\BaFRQbL.exe
  2⤵
  PID:8500
- C:\Windows\System\IkOcByp.exe
  C:\Windows\System\IkOcByp.exe
  2⤵
  PID:8520
- C:\Windows\System\yHMXGGA.exe
  C:\Windows\System\yHMXGGA.exe
  2⤵
  PID:8540
- C:\Windows\System\EmuPjnW.exe
  C:\Windows\System\EmuPjnW.exe
  2⤵
  PID:8572
- C:\Windows\System\WZxtyTp.exe
  C:\Windows\System\WZxtyTp.exe
  2⤵
  PID:8596
- C:\Windows\System\GUfQSaP.exe
  C:\Windows\System\GUfQSaP.exe
  2⤵
  PID:8620
- C:\Windows\System\WjwMmPF.exe
  C:\Windows\System\WjwMmPF.exe
  2⤵
  PID:8644
- C:\Windows\System\GJMcOME.exe
  C:\Windows\System\GJMcOME.exe
  2⤵
  PID:8672
- C:\Windows\System\msuWJFr.exe
  C:\Windows\System\msuWJFr.exe
  2⤵
  PID:8728
- C:\Windows\System\CxFlhgG.exe
  C:\Windows\System\CxFlhgG.exe
  2⤵
  PID:8772
- C:\Windows\System\TtBgztY.exe
  C:\Windows\System\TtBgztY.exe
  2⤵
  PID:8800
- C:\Windows\System\fWirYma.exe
  C:\Windows\System\fWirYma.exe
  2⤵
  PID:8824
- C:\Windows\System\FXmFUDz.exe
  C:\Windows\System\FXmFUDz.exe
  2⤵
  PID:8864
- C:\Windows\System\VNjDPTZ.exe
  C:\Windows\System\VNjDPTZ.exe
  2⤵
  PID:8892
- C:\Windows\System\YoluEhX.exe
  C:\Windows\System\YoluEhX.exe
  2⤵
  PID:8920
- C:\Windows\System\yffofEW.exe
  C:\Windows\System\yffofEW.exe
  2⤵
  PID:8948
- C:\Windows\System\syBmJqw.exe
  C:\Windows\System\syBmJqw.exe
  2⤵
  PID:8964
- C:\Windows\System\BmefHae.exe
  C:\Windows\System\BmefHae.exe
  2⤵
  PID:8980
- C:\Windows\System\gzRpwLE.exe
  C:\Windows\System\gzRpwLE.exe
  2⤵
  PID:9016
- C:\Windows\System\cBAVvNI.exe
  C:\Windows\System\cBAVvNI.exe
  2⤵
  PID:9048
- C:\Windows\System\OfOctzE.exe
  C:\Windows\System\OfOctzE.exe
  2⤵
  PID:9064
- C:\Windows\System\PQQajVE.exe
  C:\Windows\System\PQQajVE.exe
  2⤵
  PID:9092
- C:\Windows\System\dpNrAfl.exe
  C:\Windows\System\dpNrAfl.exe
  2⤵
  PID:9148
- C:\Windows\System\FGAyDBb.exe
  C:\Windows\System\FGAyDBb.exe
  2⤵
  PID:9180
- C:\Windows\System\tsKblIx.exe
  C:\Windows\System\tsKblIx.exe
  2⤵
  PID:8244
- C:\Windows\System\GZATJiH.exe
  C:\Windows\System\GZATJiH.exe
  2⤵
  PID:8368
- C:\Windows\System\heYRfWu.exe
  C:\Windows\System\heYRfWu.exe
  2⤵
  PID:8408
- C:\Windows\System\SBmjEFy.exe
  C:\Windows\System\SBmjEFy.exe
  2⤵
  PID:8468
- C:\Windows\System\hGZIMvg.exe
  C:\Windows\System\hGZIMvg.exe
  2⤵
  PID:8528
- C:\Windows\System\aWwrkfp.exe
  C:\Windows\System\aWwrkfp.exe
  2⤵
  PID:4980
- C:\Windows\System\BriDOOn.exe
  C:\Windows\System\BriDOOn.exe
  2⤵
  PID:8656
- C:\Windows\System\zlNHGmB.exe
  C:\Windows\System\zlNHGmB.exe
  2⤵
  PID:8792
- C:\Windows\System\kZYqUZg.exe
  C:\Windows\System\kZYqUZg.exe
  2⤵
  PID:8880
- C:\Windows\System\rLnUOCL.exe
  C:\Windows\System\rLnUOCL.exe
  2⤵
  PID:8940
- C:\Windows\System\xXfTnCJ.exe
  C:\Windows\System\xXfTnCJ.exe
  2⤵
  PID:1720
- C:\Windows\System\IFiFngX.exe
  C:\Windows\System\IFiFngX.exe
  2⤵
  PID:8992
- C:\Windows\System\nxrbpsO.exe
  C:\Windows\System\nxrbpsO.exe
  2⤵
  PID:9060
- C:\Windows\System\KpzXATu.exe
  C:\Windows\System\KpzXATu.exe
  2⤵
  PID:9144
- C:\Windows\System\GucmLEH.exe
  C:\Windows\System\GucmLEH.exe
  2⤵
  PID:7832
- C:\Windows\System\nVuvZrj.exe
  C:\Windows\System\nVuvZrj.exe
  2⤵
  PID:8536
- C:\Windows\System\mmXUvRV.exe
  C:\Windows\System\mmXUvRV.exe
  2⤵
  PID:8308
- C:\Windows\System\qiytiRv.exe
  C:\Windows\System\qiytiRv.exe
  2⤵
  PID:4240
- C:\Windows\System\xvSlbdG.exe
  C:\Windows\System\xvSlbdG.exe
  2⤵
  PID:8508
- C:\Windows\System\qtxKVFF.exe
  C:\Windows\System\qtxKVFF.exe
  2⤵
  PID:8720
- C:\Windows\System\WeXgvbI.exe
  C:\Windows\System\WeXgvbI.exe
  2⤵
  PID:8832
- C:\Windows\System\xSqnZcI.exe
  C:\Windows\System\xSqnZcI.exe
  2⤵
  PID:8816
- C:\Windows\System\LESuBuQ.exe
  C:\Windows\System\LESuBuQ.exe
  2⤵
  PID:9056
- C:\Windows\System\aPAotux.exe
  C:\Windows\System\aPAotux.exe
  2⤵
  PID:8380
- C:\Windows\System\NMEJzBX.exe
  C:\Windows\System\NMEJzBX.exe
  2⤵
  PID:4948
- C:\Windows\System\nPfpLaU.exe
  C:\Windows\System\nPfpLaU.exe
  2⤵
  PID:9244
- C:\Windows\System\fVFAMIz.exe
  C:\Windows\System\fVFAMIz.exe
  2⤵
  PID:9268
- C:\Windows\System\FgccPGi.exe
  C:\Windows\System\FgccPGi.exe
  2⤵
  PID:9292
- C:\Windows\System\fEVILbI.exe
  C:\Windows\System\fEVILbI.exe
  2⤵
  PID:9324
- C:\Windows\System\JEfouaQ.exe
  C:\Windows\System\JEfouaQ.exe
  2⤵
  PID:9360
- C:\Windows\System\gRzcfvy.exe
  C:\Windows\System\gRzcfvy.exe
  2⤵
  PID:9384
- C:\Windows\System\PzAaWaO.exe
  C:\Windows\System\PzAaWaO.exe
  2⤵
  PID:9412
- C:\Windows\System\XXUMpTK.exe
  C:\Windows\System\XXUMpTK.exe
  2⤵
  PID:9440
- C:\Windows\System\SzEVYpI.exe
  C:\Windows\System\SzEVYpI.exe
  2⤵
  PID:9460
- C:\Windows\System\CUAbZId.exe
  C:\Windows\System\CUAbZId.exe
  2⤵
  PID:9484
- C:\Windows\System\IrsoWVQ.exe
  C:\Windows\System\IrsoWVQ.exe
  2⤵
  PID:9508
- C:\Windows\System\RGdpNGJ.exe
  C:\Windows\System\RGdpNGJ.exe
  2⤵
  PID:9540
- C:\Windows\System\RekzkRm.exe
  C:\Windows\System\RekzkRm.exe
  2⤵
  PID:9564
- C:\Windows\System\zwumKyB.exe
  C:\Windows\System\zwumKyB.exe
  2⤵
  PID:9588
- C:\Windows\System\tskaNtw.exe
  C:\Windows\System\tskaNtw.exe
  2⤵
  PID:9612
- C:\Windows\System\paRXTyW.exe
  C:\Windows\System\paRXTyW.exe
  2⤵
  PID:9636
- C:\Windows\System\RyyWgWm.exe
  C:\Windows\System\RyyWgWm.exe
  2⤵
  PID:9652
- C:\Windows\System\yKvgErH.exe
  C:\Windows\System\yKvgErH.exe
  2⤵
  PID:9680
- C:\Windows\System\efSqDbO.exe
  C:\Windows\System\efSqDbO.exe
  2⤵
  PID:9728
- C:\Windows\System\IVAhfwt.exe
  C:\Windows\System\IVAhfwt.exe
  2⤵
  PID:9812
- C:\Windows\System\AYQIKtA.exe
  C:\Windows\System\AYQIKtA.exe
  2⤵
  PID:9856
- C:\Windows\System\emmuqjJ.exe
  C:\Windows\System\emmuqjJ.exe
  2⤵
  PID:9892
- C:\Windows\System\nHhRGAD.exe
  C:\Windows\System\nHhRGAD.exe
  2⤵
  PID:9916
- C:\Windows\System\snEdFpa.exe
  C:\Windows\System\snEdFpa.exe
  2⤵
  PID:9940
- C:\Windows\System\RjoNXCw.exe
  C:\Windows\System\RjoNXCw.exe
  2⤵
  PID:9976
- C:\Windows\System\kwdvmBh.exe
  C:\Windows\System\kwdvmBh.exe
  2⤵
  PID:10004
- C:\Windows\System\YfWSGwH.exe
  C:\Windows\System\YfWSGwH.exe
  2⤵
  PID:10028
- C:\Windows\System\VcvRPvG.exe
  C:\Windows\System\VcvRPvG.exe
  2⤵
  PID:10052
- C:\Windows\System\CMBNtLh.exe
  C:\Windows\System\CMBNtLh.exe
  2⤵
  PID:10080
- C:\Windows\System\BAgujch.exe
  C:\Windows\System\BAgujch.exe
  2⤵
  PID:10100
- C:\Windows\System\GVbMlEc.exe
  C:\Windows\System\GVbMlEc.exe
  2⤵
  PID:10132
- C:\Windows\System\qNcVRcR.exe
  C:\Windows\System\qNcVRcR.exe
  2⤵
  PID:10152
- C:\Windows\System\kTXDrWu.exe
  C:\Windows\System\kTXDrWu.exe
  2⤵
  PID:10176
- C:\Windows\System\UlGeecB.exe
  C:\Windows\System\UlGeecB.exe
  2⤵
  PID:8564
- C:\Windows\System\pDtxwZz.exe
  C:\Windows\System\pDtxwZz.exe
  2⤵
  PID:9140
- C:\Windows\System\uPtyaJi.exe
  C:\Windows\System\uPtyaJi.exe
  2⤵
  PID:9352
- C:\Windows\System\eoxffUo.exe
  C:\Windows\System\eoxffUo.exe
  2⤵
  PID:9448
- C:\Windows\System\JHNeKXl.exe
  C:\Windows\System\JHNeKXl.exe
  2⤵
  PID:9308
- C:\Windows\System\eQcgdID.exe
  C:\Windows\System\eQcgdID.exe
  2⤵
  PID:9536
- C:\Windows\System\KflbDwY.exe
  C:\Windows\System\KflbDwY.exe
  2⤵
  PID:9572
- C:\Windows\System\iSMLnXT.exe
  C:\Windows\System\iSMLnXT.exe
  2⤵
  PID:3596
- C:\Windows\System\xHBDsUH.exe
  C:\Windows\System\xHBDsUH.exe
  2⤵
  PID:9632
- C:\Windows\System\WSkTIPQ.exe
  C:\Windows\System\WSkTIPQ.exe
  2⤵
  PID:9648
- C:\Windows\System\PIGeABW.exe
  C:\Windows\System\PIGeABW.exe
  2⤵
  PID:9724
- C:\Windows\System\LYWGdCG.exe
  C:\Windows\System\LYWGdCG.exe
  2⤵
  PID:9796
- C:\Windows\System\LOpzZlo.exe
  C:\Windows\System\LOpzZlo.exe
  2⤵
  PID:9924
- C:\Windows\System\lbgYUbN.exe
  C:\Windows\System\lbgYUbN.exe
  2⤵
  PID:9948
- C:\Windows\System\zlRzKAu.exe
  C:\Windows\System\zlRzKAu.exe
  2⤵
  PID:9972
- C:\Windows\System\bdrzCUJ.exe
  C:\Windows\System\bdrzCUJ.exe
  2⤵
  PID:10068
- C:\Windows\System\PSaShtc.exe
  C:\Windows\System\PSaShtc.exe
  2⤵
  PID:10172
- C:\Windows\System\hgGDrmz.exe
  C:\Windows\System\hgGDrmz.exe
  2⤵
  PID:10116
- C:\Windows\System\xgnAEkE.exe
  C:\Windows\System\xgnAEkE.exe
  2⤵
  PID:9240
- C:\Windows\System\kTlDVAJ.exe
  C:\Windows\System\kTlDVAJ.exe
  2⤵
  PID:9284
- C:\Windows\System\PaKQcWU.exe
  C:\Windows\System\PaKQcWU.exe
  2⤵
  PID:9400
- C:\Windows\System\nwCXULC.exe
  C:\Windows\System\nwCXULC.exe
  2⤵
  PID:9552
- C:\Windows\System\ETZiksG.exe
  C:\Windows\System\ETZiksG.exe
  2⤵
  PID:9664
- C:\Windows\System\DHMStgU.exe
  C:\Windows\System\DHMStgU.exe
  2⤵
  PID:9876
- C:\Windows\System\PsrRgIx.exe
  C:\Windows\System\PsrRgIx.exe
  2⤵
  PID:9852
- C:\Windows\System\kgDWNGh.exe
  C:\Windows\System\kgDWNGh.exe
  2⤵
  PID:10128
- C:\Windows\System\lPafiQP.exe
  C:\Windows\System\lPafiQP.exe
  2⤵
  PID:9992
- C:\Windows\System\JmMciKx.exe
  C:\Windows\System\JmMciKx.exe
  2⤵
  PID:10096
- C:\Windows\System\hTrbzWt.exe
  C:\Windows\System\hTrbzWt.exe
  2⤵
  PID:10244
- C:\Windows\System\TbJkUyV.exe
  C:\Windows\System\TbJkUyV.exe
  2⤵
  PID:10276
- C:\Windows\System\dKSSRbX.exe
  C:\Windows\System\dKSSRbX.exe
  2⤵
  PID:10448
- C:\Windows\System\yhENkpO.exe
  C:\Windows\System\yhENkpO.exe
  2⤵
  PID:10464
- C:\Windows\System\hbOfZqj.exe
  C:\Windows\System\hbOfZqj.exe
  2⤵
  PID:10492
- C:\Windows\System\hioQkxa.exe
  C:\Windows\System\hioQkxa.exe
  2⤵
  PID:10524
- C:\Windows\System\ufxHGwo.exe
  C:\Windows\System\ufxHGwo.exe
  2⤵
  PID:10552
- C:\Windows\System\dfRKDNp.exe
  C:\Windows\System\dfRKDNp.exe
  2⤵
  PID:10568
- C:\Windows\System\bdeTdCH.exe
  C:\Windows\System\bdeTdCH.exe
  2⤵
  PID:10600
- C:\Windows\System\fhfrUqv.exe
  C:\Windows\System\fhfrUqv.exe
  2⤵
  PID:10624
- C:\Windows\System\AXQnfqG.exe
  C:\Windows\System\AXQnfqG.exe
  2⤵
  PID:10656
- C:\Windows\System\oiefBXg.exe
  C:\Windows\System\oiefBXg.exe
  2⤵
  PID:10676
- C:\Windows\System\vffKYlU.exe
  C:\Windows\System\vffKYlU.exe
  2⤵
  PID:10696
- C:\Windows\System\yzIOJQJ.exe
  C:\Windows\System\yzIOJQJ.exe
  2⤵
  PID:10716
- C:\Windows\System\qcZPxFP.exe
  C:\Windows\System\qcZPxFP.exe
  2⤵
  PID:10744
- C:\Windows\System\tpxIIqv.exe
  C:\Windows\System\tpxIIqv.exe
  2⤵
  PID:10784
- C:\Windows\System\nePAcxg.exe
  C:\Windows\System\nePAcxg.exe
  2⤵
  PID:10816
- C:\Windows\System\TksUsay.exe
  C:\Windows\System\TksUsay.exe
  2⤵
  PID:10848
- C:\Windows\System\pFFBkJY.exe
  C:\Windows\System\pFFBkJY.exe
  2⤵
  PID:10876
- C:\Windows\System\cCWZtbZ.exe
  C:\Windows\System\cCWZtbZ.exe
  2⤵
  PID:10904
- C:\Windows\System\WyIeeXf.exe
  C:\Windows\System\WyIeeXf.exe
  2⤵
  PID:10936
- C:\Windows\System\bAiBvkI.exe
  C:\Windows\System\bAiBvkI.exe
  2⤵
  PID:10960
- C:\Windows\System\bWpcIYB.exe
  C:\Windows\System\bWpcIYB.exe
  2⤵
  PID:10980
- C:\Windows\System\TQTSRWZ.exe
  C:\Windows\System\TQTSRWZ.exe
  2⤵
  PID:10996
- C:\Windows\System\KYxYIHU.exe
  C:\Windows\System\KYxYIHU.exe
  2⤵
  PID:11020
- C:\Windows\System\GKpAJRm.exe
  C:\Windows\System\GKpAJRm.exe
  2⤵
  PID:11048
- C:\Windows\System\RlHTHib.exe
  C:\Windows\System\RlHTHib.exe
  2⤵
  PID:11080
- C:\Windows\System\PfMIhlw.exe
  C:\Windows\System\PfMIhlw.exe
  2⤵
  PID:11108
- C:\Windows\System\ebXnBHi.exe
  C:\Windows\System\ebXnBHi.exe
  2⤵
  PID:11124
- C:\Windows\System\sZOAxxj.exe
  C:\Windows\System\sZOAxxj.exe
  2⤵
  PID:11168
- C:\Windows\System\CGdTFKl.exe
  C:\Windows\System\CGdTFKl.exe
  2⤵
  PID:11204
- C:\Windows\System\YAOFDhi.exe
  C:\Windows\System\YAOFDhi.exe
  2⤵
  PID:11244
- C:\Windows\System\QzQqoAF.exe
  C:\Windows\System\QzQqoAF.exe
  2⤵
  PID:10024
- C:\Windows\System\DzZVKAX.exe
  C:\Windows\System\DzZVKAX.exe
  2⤵
  PID:8724
- C:\Windows\System\bCwzqnl.exe
  C:\Windows\System\bCwzqnl.exe
  2⤵
  PID:9100
- C:\Windows\System\yHgjFOw.exe
  C:\Windows\System\yHgjFOw.exe
  2⤵
  PID:10168
- C:\Windows\System\JIyMOgB.exe
  C:\Windows\System\JIyMOgB.exe
  2⤵
  PID:10260
- C:\Windows\System\cLOZiGt.exe
  C:\Windows\System\cLOZiGt.exe
  2⤵
  PID:10428
- C:\Windows\System\iYlWzlA.exe
  C:\Windows\System\iYlWzlA.exe
  2⤵
  PID:10440
- C:\Windows\System\PdzeqJX.exe
  C:\Windows\System\PdzeqJX.exe
  2⤵
  PID:10516
- C:\Windows\System\oVYVRQP.exe
  C:\Windows\System\oVYVRQP.exe
  2⤵
  PID:10592
- C:\Windows\System\JyaXHlI.exe
  C:\Windows\System\JyaXHlI.exe
  2⤵
  PID:10616
- C:\Windows\System\agtVKBt.exe
  C:\Windows\System\agtVKBt.exe
  2⤵
  PID:10688
- C:\Windows\System\yhzaetC.exe
  C:\Windows\System\yhzaetC.exe
  2⤵
  PID:10760
- C:\Windows\System\qQIzMFE.exe
  C:\Windows\System\qQIzMFE.exe
  2⤵
  PID:10828
- C:\Windows\System\uauHBSb.exe
  C:\Windows\System\uauHBSb.exe
  2⤵
  PID:10888
- C:\Windows\System\bfVnXhs.exe
  C:\Windows\System\bfVnXhs.exe
  2⤵
  PID:10956
- C:\Windows\System\mHpmJNU.exe
  C:\Windows\System\mHpmJNU.exe
  2⤵
  PID:10992
- C:\Windows\System\QfALeMW.exe
  C:\Windows\System\QfALeMW.exe
  2⤵
  PID:11040
- C:\Windows\System\fZlzdHS.exe
  C:\Windows\System\fZlzdHS.exe
  2⤵
  PID:11196
- C:\Windows\System\IivXBQu.exe
  C:\Windows\System\IivXBQu.exe
  2⤵
  PID:11140
- C:\Windows\System\GHzBnbF.exe
  C:\Windows\System\GHzBnbF.exe
  2⤵
  PID:10736
- C:\Windows\System\nqibHCD.exe
  C:\Windows\System\nqibHCD.exe
  2⤵
  PID:10668
- C:\Windows\System\uSeqclS.exe
  C:\Windows\System\uSeqclS.exe
  2⤵
  PID:10976
- C:\Windows\System\EjlDGvn.exe
  C:\Windows\System\EjlDGvn.exe
  2⤵
  PID:10916
- C:\Windows\System\omdSWhR.exe
  C:\Windows\System\omdSWhR.exe
  2⤵
  PID:11072
- C:\Windows\System\CVJGyFf.exe
  C:\Windows\System\CVJGyFf.exe
  2⤵
  PID:10476
- C:\Windows\System\gXxxnWq.exe
  C:\Windows\System\gXxxnWq.exe
  2⤵
  PID:11272
- C:\Windows\System\VOYgSzc.exe
  C:\Windows\System\VOYgSzc.exe
  2⤵
  PID:11296
- C:\Windows\System\OLtPTrj.exe
  C:\Windows\System\OLtPTrj.exe
  2⤵
  PID:11328
- C:\Windows\System\NVZOsOM.exe
  C:\Windows\System\NVZOsOM.exe
  2⤵
  PID:11352
- C:\Windows\System\CqWWyEM.exe
  C:\Windows\System\CqWWyEM.exe
  2⤵
  PID:11380
- C:\Windows\System\FZAEYFS.exe
  C:\Windows\System\FZAEYFS.exe
  2⤵
  PID:11412
- C:\Windows\System\pCUTXqx.exe
  C:\Windows\System\pCUTXqx.exe
  2⤵
  PID:11432
- C:\Windows\System\WZFRSqs.exe
  C:\Windows\System\WZFRSqs.exe
  2⤵
  PID:11452
- C:\Windows\System\JrgmTpu.exe
  C:\Windows\System\JrgmTpu.exe
  2⤵
  PID:11472
- C:\Windows\System\oWUqVmO.exe
  C:\Windows\System\oWUqVmO.exe
  2⤵
  PID:11500
- C:\Windows\System\MDVYboF.exe
  C:\Windows\System\MDVYboF.exe
  2⤵
  PID:11544
- C:\Windows\System\RuEMhDP.exe
  C:\Windows\System\RuEMhDP.exe
  2⤵
  PID:11604
- C:\Windows\System\APWDmwY.exe
  C:\Windows\System\APWDmwY.exe
  2⤵
  PID:11628
- C:\Windows\System\rGOrUcI.exe
  C:\Windows\System\rGOrUcI.exe
  2⤵
  PID:11644
- C:\Windows\System\iKAOoay.exe
  C:\Windows\System\iKAOoay.exe
  2⤵
  PID:11660
- C:\Windows\System\SPOmBZF.exe
  C:\Windows\System\SPOmBZF.exe
  2⤵
  PID:11684
- C:\Windows\System\FPZtiVT.exe
  C:\Windows\System\FPZtiVT.exe
  2⤵
  PID:11708
- C:\Windows\System\sCDeiNY.exe
  C:\Windows\System\sCDeiNY.exe
  2⤵
  PID:11736
- C:\Windows\System\FcEYuOp.exe
  C:\Windows\System\FcEYuOp.exe
  2⤵
  PID:11752
- C:\Windows\System\JTDLSGP.exe
  C:\Windows\System\JTDLSGP.exe
  2⤵
  PID:11780
- C:\Windows\System\jWATZzI.exe
  C:\Windows\System\jWATZzI.exe
  2⤵
  PID:11804
- C:\Windows\System\QDDezvF.exe
  C:\Windows\System\QDDezvF.exe
  2⤵
  PID:11836
- C:\Windows\System\OUXfECR.exe
  C:\Windows\System\OUXfECR.exe
  2⤵
  PID:11860
- C:\Windows\System\CLhVYIa.exe
  C:\Windows\System\CLhVYIa.exe
  2⤵
  PID:11888
- C:\Windows\System\CInrCxZ.exe
  C:\Windows\System\CInrCxZ.exe
  2⤵
  PID:11916
- C:\Windows\System\oiRrSpX.exe
  C:\Windows\System\oiRrSpX.exe
  2⤵
  PID:11936
- C:\Windows\System\XhGvrkJ.exe
  C:\Windows\System\XhGvrkJ.exe
  2⤵
  PID:11956
- C:\Windows\System\UqrlnyC.exe
  C:\Windows\System\UqrlnyC.exe
  2⤵
  PID:11996
- C:\Windows\System\vaenZSn.exe
  C:\Windows\System\vaenZSn.exe
  2⤵
  PID:12020
- C:\Windows\System\nbQjgGV.exe
  C:\Windows\System\nbQjgGV.exe
  2⤵
  PID:12052
- C:\Windows\System\MNUxXeT.exe
  C:\Windows\System\MNUxXeT.exe
  2⤵
  PID:12080
- C:\Windows\System\NMvSzUg.exe
  C:\Windows\System\NMvSzUg.exe
  2⤵
  PID:12104
- C:\Windows\System\tGLdPuV.exe
  C:\Windows\System\tGLdPuV.exe
  2⤵
  PID:12132
- C:\Windows\System\WlpURzX.exe
  C:\Windows\System\WlpURzX.exe
  2⤵
  PID:12156
- C:\Windows\System\QqMXFlN.exe
  C:\Windows\System\QqMXFlN.exe
  2⤵
  PID:12180
- C:\Windows\System\xzfxqAD.exe
  C:\Windows\System\xzfxqAD.exe
  2⤵
  PID:12204
- C:\Windows\System\LraNlAE.exe
  C:\Windows\System\LraNlAE.exe
  2⤵
  PID:12232
- C:\Windows\System\FACqSUc.exe
  C:\Windows\System\FACqSUc.exe
  2⤵
  PID:12260
- C:\Windows\System\gsFmfrj.exe
  C:\Windows\System\gsFmfrj.exe
  2⤵
  PID:12284
- C:\Windows\System\DYnZCgr.exe
  C:\Windows\System\DYnZCgr.exe
  2⤵
  PID:11268
- C:\Windows\System\qiBAqaS.exe
  C:\Windows\System\qiBAqaS.exe
  2⤵
  PID:11304
- C:\Windows\System\wmkFUWj.exe
  C:\Windows\System\wmkFUWj.exe
  2⤵
  PID:11364
- C:\Windows\System\oJpSkco.exe
  C:\Windows\System\oJpSkco.exe
  2⤵
  PID:11520
- C:\Windows\System\DzoMiWN.exe
  C:\Windows\System\DzoMiWN.exe
  2⤵
  PID:11528
- C:\Windows\System\HVPwJMI.exe
  C:\Windows\System\HVPwJMI.exe
  2⤵
  PID:11612
- C:\Windows\System\vxsnukH.exe
  C:\Windows\System\vxsnukH.exe
  2⤵
  PID:11672
- C:\Windows\System\hWoLoOO.exe
  C:\Windows\System\hWoLoOO.exe
  2⤵
  PID:11744
- C:\Windows\System\FtEDFdL.exe
  C:\Windows\System\FtEDFdL.exe
  2⤵
  PID:11772
- C:\Windows\System\xITtUJk.exe
  C:\Windows\System\xITtUJk.exe
  2⤵
  PID:4476
- C:\Windows\System\hsooaGf.exe
  C:\Windows\System\hsooaGf.exe
  2⤵
  PID:11932
- C:\Windows\System\dObZBoW.exe
  C:\Windows\System\dObZBoW.exe
  2⤵
  PID:12004
- C:\Windows\System\dSKVsgJ.exe
  C:\Windows\System\dSKVsgJ.exe
  2⤵
  PID:12064
- C:\Windows\System\hYZSsaB.exe
  C:\Windows\System\hYZSsaB.exe
  2⤵
  PID:12008
- C:\Windows\System\cCOcZcS.exe
  C:\Windows\System\cCOcZcS.exe
  2⤵
  PID:12168
- C:\Windows\System\KfDgoqi.exe
  C:\Windows\System\KfDgoqi.exe
  2⤵
  PID:12268
- C:\Windows\System\pbwmALv.exe
  C:\Windows\System\pbwmALv.exe
  2⤵
  PID:12280
- C:\Windows\System\PpVHdSD.exe
  C:\Windows\System\PpVHdSD.exe
  2⤵
  PID:2208
- C:\Windows\System\MbtHeUx.exe
  C:\Windows\System\MbtHeUx.exe
  2⤵
  PID:11388
- C:\Windows\System\MPLbdav.exe
  C:\Windows\System\MPLbdav.exe
  2⤵
  PID:11404
- C:\Windows\System\TeQRTKf.exe
  C:\Windows\System\TeQRTKf.exe
  2⤵
  PID:11512
- C:\Windows\System\BuCcCFr.exe
  C:\Windows\System\BuCcCFr.exe
  2⤵
  PID:11496
- C:\Windows\System\FDiIkhd.exe
  C:\Windows\System\FDiIkhd.exe
  2⤵
  PID:11948
- C:\Windows\System\FOTqKQE.exe
  C:\Windows\System\FOTqKQE.exe
  2⤵
  PID:12044
- C:\Windows\System\NHEEqkR.exe
  C:\Windows\System\NHEEqkR.exe
  2⤵
  PID:12096
- C:\Windows\System\OnCpscN.exe
  C:\Windows\System\OnCpscN.exe
  2⤵
  PID:12140
- C:\Windows\System\EPrtRbI.exe
  C:\Windows\System\EPrtRbI.exe
  2⤵
  PID:12376
- C:\Windows\System\dNXsFHg.exe
  C:\Windows\System\dNXsFHg.exe
  2⤵
  PID:12472
- C:\Windows\System\pcehfCP.exe
  C:\Windows\System\pcehfCP.exe
  2⤵
  PID:12584
- C:\Windows\System\aToFlzc.exe
  C:\Windows\System\aToFlzc.exe
  2⤵
  PID:12608
- C:\Windows\System\mjsuJDZ.exe
  C:\Windows\System\mjsuJDZ.exe
  2⤵
  PID:12624
- C:\Windows\System\zDeHzQG.exe
  C:\Windows\System\zDeHzQG.exe
  2⤵
  PID:12640
- C:\Windows\System\LWOuqjy.exe
  C:\Windows\System\LWOuqjy.exe
  2⤵
  PID:12664
- C:\Windows\System\cktepma.exe
  C:\Windows\System\cktepma.exe
  2⤵
  PID:12680
- C:\Windows\System\uZyBFmD.exe
  C:\Windows\System\uZyBFmD.exe
  2⤵
  PID:12764
- C:\Windows\System\pSyfqvm.exe
  C:\Windows\System\pSyfqvm.exe
  2⤵
  PID:12780
- C:\Windows\System\xmtvhbs.exe
  C:\Windows\System\xmtvhbs.exe
  2⤵
  PID:12800
- C:\Windows\System\KnneGwd.exe
  C:\Windows\System\KnneGwd.exe
  2⤵
  PID:12816
- C:\Windows\System\VmydtOY.exe
  C:\Windows\System\VmydtOY.exe
  2⤵
  PID:12836
- C:\Windows\System\MNKwvBk.exe
  C:\Windows\System\MNKwvBk.exe
  2⤵
  PID:12852
- C:\Windows\System\bkGwVQG.exe
  C:\Windows\System\bkGwVQG.exe
  2⤵
  PID:12868
- C:\Windows\System\DCApyCf.exe
  C:\Windows\System\DCApyCf.exe
  2⤵
  PID:12888
- C:\Windows\System\GvTYXtQ.exe
  C:\Windows\System\GvTYXtQ.exe
  2⤵
  PID:12908
- C:\Windows\System\qBmUghc.exe
  C:\Windows\System\qBmUghc.exe
  2⤵
  PID:12924
- C:\Windows\System\wblBXMi.exe
  C:\Windows\System\wblBXMi.exe
  2⤵
  PID:12940
- C:\Windows\System\QnIEKfR.exe
  C:\Windows\System\QnIEKfR.exe
  2⤵
  PID:12968
- C:\Windows\System\rzLGBgX.exe
  C:\Windows\System\rzLGBgX.exe
  2⤵
  PID:12996
- C:\Windows\System\kEEELAz.exe
  C:\Windows\System\kEEELAz.exe
  2⤵
  PID:13016
- C:\Windows\System\UuqmMAi.exe
  C:\Windows\System\UuqmMAi.exe
  2⤵
  PID:13048
- C:\Windows\System\OuDIQrX.exe
  C:\Windows\System\OuDIQrX.exe
  2⤵
  PID:13068
- C:\Windows\System\FGJxlSo.exe
  C:\Windows\System\FGJxlSo.exe
  2⤵
  PID:13096
- C:\Windows\System\wieRCio.exe
  C:\Windows\System\wieRCio.exe
  2⤵
  PID:13136
- C:\Windows\System\rSNmLDR.exe
  C:\Windows\System\rSNmLDR.exe
  2⤵
  PID:13156
- C:\Windows\System\WoixUcB.exe
  C:\Windows\System\WoixUcB.exe
  2⤵
  PID:13180
- C:\Windows\System\olulaXG.exe
  C:\Windows\System\olulaXG.exe
  2⤵
  PID:13212
- C:\Windows\System\pvrSZME.exe
  C:\Windows\System\pvrSZME.exe
  2⤵
  PID:13236
- C:\Windows\System\ovGXrWC.exe
  C:\Windows\System\ovGXrWC.exe
  2⤵
  PID:13264
- C:\Windows\System\iaHQwZN.exe
  C:\Windows\System\iaHQwZN.exe
  2⤵
  PID:13288
- C:\Windows\System\pYUKVdA.exe
  C:\Windows\System\pYUKVdA.exe
  2⤵
  PID:1336
- C:\Windows\System\lPoOyNR.exe
  C:\Windows\System\lPoOyNR.exe
  2⤵
  PID:4516
- C:\Windows\System\KAwVffw.exe
  C:\Windows\System\KAwVffw.exe
  2⤵
  PID:8932
- C:\Windows\System\RLjqCDg.exe
  C:\Windows\System\RLjqCDg.exe
  2⤵
  PID:1308
- C:\Windows\System\YvFTXwb.exe
  C:\Windows\System\YvFTXwb.exe
  2⤵
  PID:11292
- C:\Windows\System\MlPZbnb.exe
  C:\Windows\System\MlPZbnb.exe
  2⤵
  PID:1532
- C:\Windows\System\xcvYJJE.exe
  C:\Windows\System\xcvYJJE.exe
  2⤵
  PID:12692
- C:\Windows\System\qGbIOSk.exe
  C:\Windows\System\qGbIOSk.exe
  2⤵
  PID:12832
- C:\Windows\System\MgMKHCD.exe
  C:\Windows\System\MgMKHCD.exe
  2⤵
  PID:12876
- C:\Windows\System\wGDBZWf.exe
  C:\Windows\System\wGDBZWf.exe
  2⤵
  PID:12952
- C:\Windows\System\eHoSdTS.exe
  C:\Windows\System\eHoSdTS.exe
  2⤵
  PID:13060
- C:\Windows\System\lKonNma.exe
  C:\Windows\System\lKonNma.exe
  2⤵
  PID:13148
- C:\Windows\System\FglOlqh.exe
  C:\Windows\System\FglOlqh.exe
  2⤵
  PID:12984
- C:\Windows\System\MkamZdW.exe
  C:\Windows\System\MkamZdW.exe
  2⤵
  PID:13092
- C:\Windows\System\izUtWbB.exe
  C:\Windows\System\izUtWbB.exe
  2⤵
  PID:12416
- C:\Windows\System\WkNUcUt.exe
  C:\Windows\System\WkNUcUt.exe
  2⤵
  PID:8972
- C:\Windows\System\vbIyjAd.exe
  C:\Windows\System\vbIyjAd.exe
  2⤵
  PID:11640
- C:\Windows\System\nyvrrvM.exe
  C:\Windows\System\nyvrrvM.exe
  2⤵
  PID:13256
- C:\Windows\System\dltMSef.exe
  C:\Windows\System\dltMSef.exe
  2⤵
  PID:12676
- C:\Windows\System\HcTZfCx.exe
  C:\Windows\System\HcTZfCx.exe
  2⤵
  PID:12828
- C:\Windows\System\ySGsnmJ.exe
  C:\Windows\System\ySGsnmJ.exe
  2⤵
  PID:12932
- C:\Windows\System\izCfjxI.exe
  C:\Windows\System\izCfjxI.exe
  2⤵
  PID:13248
- C:\Windows\System\cSDxvLe.exe
  C:\Windows\System\cSDxvLe.exe
  2⤵
  PID:1740
- C:\Windows\System\QoilUfP.exe
  C:\Windows\System\QoilUfP.exe
  2⤵
  PID:12452
- C:\Windows\System\UuXqDJp.exe
  C:\Windows\System\UuXqDJp.exe
  2⤵
  PID:3900
- C:\Windows\System\VSMRVTX.exe
  C:\Windows\System\VSMRVTX.exe
  2⤵
  PID:2728
- C:\Windows\System\tzNtnhq.exe
  C:\Windows\System\tzNtnhq.exe
  2⤵
  PID:12592
- C:\Windows\System\gRmCSaS.exe
  C:\Windows\System\gRmCSaS.exe
  2⤵
  PID:1168
- C:\Windows\System\XbMSwNf.exe
  C:\Windows\System\XbMSwNf.exe
  2⤵
  PID:3836
- C:\Windows\System\PKHQNxU.exe
  C:\Windows\System\PKHQNxU.exe
  2⤵
  PID:3920
- C:\Windows\System\uHKxaYk.exe
  C:\Windows\System\uHKxaYk.exe
  2⤵
  PID:5056
- C:\Windows\System\mjJipQF.exe
  C:\Windows\System\mjJipQF.exe
  2⤵
  PID:208
- C:\Windows\System\swNmObj.exe
  C:\Windows\System\swNmObj.exe
  2⤵
  PID:3928
- C:\Windows\System\rCdkUPH.exe
  C:\Windows\System\rCdkUPH.exe
  2⤵
  PID:1820
- C:\Windows\System\eblZegP.exe
  C:\Windows\System\eblZegP.exe
  2⤵
  PID:3764
- C:\Windows\System\iiGMVOL.exe
  C:\Windows\System\iiGMVOL.exe
  2⤵
  PID:2972
- C:\Windows\System\AvqGdxc.exe
  C:\Windows\System\AvqGdxc.exe
  2⤵
  PID:2344
- C:\Windows\System\iwOBOqr.exe
  C:\Windows\System\iwOBOqr.exe
  2⤵
  PID:13324
- C:\Windows\System\mJojwEp.exe
  C:\Windows\System\mJojwEp.exe
  2⤵
  PID:13340
- C:\Windows\System\ceIrBer.exe
  C:\Windows\System\ceIrBer.exe
  2⤵
  PID:13356
- C:\Windows\System\cPwIjqS.exe
  C:\Windows\System\cPwIjqS.exe
  2⤵
  PID:13372
- C:\Windows\System\pBbSTUq.exe
  C:\Windows\System\pBbSTUq.exe
  2⤵
  PID:13388
- C:\Windows\System\fiYYnJY.exe
  C:\Windows\System\fiYYnJY.exe
  2⤵
  PID:13416
- C:\Windows\System\beAlqdb.exe
  C:\Windows\System\beAlqdb.exe
  2⤵
  PID:13432
- C:\Windows\System\gCcFRbZ.exe
  C:\Windows\System\gCcFRbZ.exe
  2⤵
  PID:13448
- C:\Windows\System\YCtzGIl.exe
  C:\Windows\System\YCtzGIl.exe
  2⤵
  PID:13468
- C:\Windows\System\jsyOvoB.exe
  C:\Windows\System\jsyOvoB.exe
  2⤵
  PID:13488
- C:\Windows\System\DCObKSg.exe
  C:\Windows\System\DCObKSg.exe
  2⤵
  PID:13512
- C:\Windows\System\IPfeBBW.exe
  C:\Windows\System\IPfeBBW.exe
  2⤵
  PID:13528
- C:\Windows\System\eNEpMkW.exe
  C:\Windows\System\eNEpMkW.exe
  2⤵
  PID:13560
- C:\Windows\System\kICtzWC.exe
  C:\Windows\System\kICtzWC.exe
  2⤵
  PID:13588
- C:\Windows\System\DrRhQrU.exe
  C:\Windows\System\DrRhQrU.exe
  2⤵
  PID:13620
- C:\Windows\System\XfqBKna.exe
  C:\Windows\System\XfqBKna.exe
  2⤵
  PID:13648
- C:\Windows\System\gJOaVlY.exe
  C:\Windows\System\gJOaVlY.exe
  2⤵
  PID:13672
- C:\Windows\System\ZkAruRs.exe
  C:\Windows\System\ZkAruRs.exe
  2⤵
  PID:13696
- C:\Windows\System\oAqXlQe.exe
  C:\Windows\System\oAqXlQe.exe
  2⤵
  PID:13720
- C:\Windows\System\KUpqpHc.exe
  C:\Windows\System\KUpqpHc.exe
  2⤵
  PID:13756
- C:\Windows\System\lqLbSsa.exe
  C:\Windows\System\lqLbSsa.exe
  2⤵
  PID:13776
- C:\Windows\System\XgUpqLB.exe
  C:\Windows\System\XgUpqLB.exe
  2⤵
  PID:13800
- C:\Windows\System\gsiCkjK.exe
  C:\Windows\System\gsiCkjK.exe
  2⤵
  PID:13824
- C:\Windows\System\eUVYgzK.exe
  C:\Windows\System\eUVYgzK.exe
  2⤵
  PID:13852
- C:\Windows\System\cVEZlZC.exe
  C:\Windows\System\cVEZlZC.exe
  2⤵
  PID:13876
- C:\Windows\System\topwgkH.exe
  C:\Windows\System\topwgkH.exe
  2⤵
  PID:13956
- C:\Windows\System\snRQoqx.exe
  C:\Windows\System\snRQoqx.exe
  2⤵
  PID:13976
- C:\Windows\System\QyXyacA.exe
  C:\Windows\System\QyXyacA.exe
  2⤵
  PID:13996
- C:\Windows\System\grMYkqo.exe
  C:\Windows\System\grMYkqo.exe
  2⤵
  PID:14032
- C:\Windows\System\fpVyvpq.exe
  C:\Windows\System\fpVyvpq.exe
  2⤵
  PID:14060
- C:\Windows\System\ipDDMKV.exe
  C:\Windows\System\ipDDMKV.exe
  2⤵
  PID:14084
- C:\Windows\System\JayiqyL.exe
  C:\Windows\System\JayiqyL.exe
  2⤵
  PID:14108
- C:\Windows\System\CfeKJFI.exe
  C:\Windows\System\CfeKJFI.exe
  2⤵
  PID:14132
- C:\Windows\System\SfOSsLy.exe
  C:\Windows\System\SfOSsLy.exe
  2⤵
  PID:13332
- C:\Windows\System\CGDKAJn.exe
  C:\Windows\System\CGDKAJn.exe
  2⤵
  PID:13168
- C:\Windows\System\yyIHoep.exe
  C:\Windows\System\yyIHoep.exe
  2⤵
  PID:1712
- C:\Windows\System\YOAXWMv.exe
  C:\Windows\System\YOAXWMv.exe
  2⤵
  PID:13460
- C:\Windows\System\LDmhXnH.exe
  C:\Windows\System\LDmhXnH.exe
  2⤵
  PID:13348
- C:\Windows\System\eOiZqRp.exe
  C:\Windows\System\eOiZqRp.exe
  2⤵
  PID:13484
- C:\Windows\System\ZOMjGiI.exe
  C:\Windows\System\ZOMjGiI.exe
  2⤵
  PID:13656
- C:\Windows\System\wjHWCCi.exe
  C:\Windows\System\wjHWCCi.exe
  2⤵
  PID:13412
- C:\Windows\System\mUoLshR.exe
  C:\Windows\System\mUoLshR.exe
  2⤵
  PID:13544
- C:\Windows\System\cUCsvdF.exe
  C:\Windows\System\cUCsvdF.exe
  2⤵
  PID:13584
- C:\Windows\System\hMgMBLE.exe
  C:\Windows\System\hMgMBLE.exe
  2⤵
  PID:13636
- C:\Windows\System\lJHpFrl.exe
  C:\Windows\System\lJHpFrl.exe
  2⤵
  PID:13664
- C:\Windows\System\ZMLUkHo.exe
  C:\Windows\System\ZMLUkHo.exe
  2⤵
  PID:4816
- C:\Windows\System\sUCsYzs.exe
  C:\Windows\System\sUCsYzs.exe
  2⤵
  PID:5112
- C:\Windows\System\ozfNLar.exe
  C:\Windows\System\ozfNLar.exe
  2⤵
  PID:13552
- C:\Windows\System\EAMYUHV.exe
  C:\Windows\System\EAMYUHV.exe
  2⤵
  PID:4512
- C:\Windows\System\DbDXQEv.exe
  C:\Windows\System\DbDXQEv.exe
  2⤵
  PID:13784
- C:\Windows\System\yMCgqnA.exe
  C:\Windows\System\yMCgqnA.exe
  2⤵
  PID:5156
- C:\Windows\System\iEFNyjE.exe
  C:\Windows\System\iEFNyjE.exe
  2⤵
  PID:13796
- C:\Windows\System\BTQqBzV.exe
  C:\Windows\System\BTQqBzV.exe
  2⤵
  PID:14024
- C:\Windows\System\PAjTeWO.exe
  C:\Windows\System\PAjTeWO.exe
  2⤵
  PID:5260
- C:\Windows\System\JujXGjv.exe
  C:\Windows\System\JujXGjv.exe
  2⤵
  PID:5372
- C:\Windows\System\qsZGMQW.exe
  C:\Windows\System\qsZGMQW.exe
  2⤵
  PID:13992
- C:\Windows\System\jCCwzin.exe
  C:\Windows\System\jCCwzin.exe
  2⤵
  PID:14232
- C:\Windows\System\HWtlEFO.exe
  C:\Windows\System\HWtlEFO.exe
  2⤵
  PID:14100
- C:\Windows\System\CoaNdvQ.exe
  C:\Windows\System\CoaNdvQ.exe
  2⤵
  PID:5496
- C:\Windows\System\qyQbjgQ.exe
  C:\Windows\System\qyQbjgQ.exe
  2⤵
  PID:4448
- C:\Windows\System\ohUsBYA.exe
  C:\Windows\System\ohUsBYA.exe
  2⤵
  PID:14288
- C:\Windows\System\UKyrrOa.exe
  C:\Windows\System\UKyrrOa.exe
  2⤵
  PID:4128
- C:\Windows\System\tcxbKCX.exe
  C:\Windows\System\tcxbKCX.exe
  2⤵
  PID:13308
- C:\Windows\System\rSOnoZX.exe
  C:\Windows\System\rSOnoZX.exe
  2⤵
  PID:5976
- C:\Windows\System\WOdMMlw.exe
  C:\Windows\System\WOdMMlw.exe
  2⤵
  PID:1616
- C:\Windows\System\RjunKmn.exe
  C:\Windows\System\RjunKmn.exe
  2⤵
  PID:2488
- C:\Windows\System\JAVqxIk.exe
  C:\Windows\System\JAVqxIk.exe
  2⤵
  PID:408
- C:\Windows\System\QMiTqDD.exe
  C:\Windows\System\QMiTqDD.exe
  2⤵
  PID:5124
- C:\Windows\System\MyxMVZw.exe
  C:\Windows\System\MyxMVZw.exe
  2⤵
  PID:5208
- C:\Windows\System\WjtKpGZ.exe
  C:\Windows\System\WjtKpGZ.exe
  2⤵
  PID:5332
- C:\Windows\System\AfZzkWE.exe
  C:\Windows\System\AfZzkWE.exe
  2⤵
  PID:368
- C:\Windows\System\cAIeEDG.exe
  C:\Windows\System\cAIeEDG.exe
  2⤵
  PID:2424
- C:\Windows\System\IvbMMRr.exe
  C:\Windows\System\IvbMMRr.exe
  2⤵
  PID:5708
- C:\Windows\System\zTusqdC.exe
  C:\Windows\System\zTusqdC.exe
  2⤵
  PID:5840
- C:\Windows\System\vyRyMRB.exe
  C:\Windows\System\vyRyMRB.exe
  2⤵
  PID:6076
- C:\Windows\System\luLEXei.exe
  C:\Windows\System\luLEXei.exe
  2⤵
  PID:5416
- C:\Windows\System\wPClBcS.exe
  C:\Windows\System\wPClBcS.exe
  2⤵
  PID:5712
- C:\Windows\System\xKRiGKJ.exe
  C:\Windows\System\xKRiGKJ.exe
  2⤵
  PID:6048
- C:\Windows\System\aaqyrQp.exe
  C:\Windows\System\aaqyrQp.exe
  2⤵
  PID:1676
- C:\Windows\System\xwqcaEA.exe
  C:\Windows\System\xwqcaEA.exe
  2⤵
  PID:4120
- C:\Windows\System\USTSScf.exe
  C:\Windows\System\USTSScf.exe
  2⤵
  PID:2480
- C:\Windows\System\egxvdGg.exe
  C:\Windows\System\egxvdGg.exe
  2⤵
  PID:3164
- C:\Windows\System\fCTnknd.exe
  C:\Windows\System\fCTnknd.exe
  2⤵
  PID:13904
- C:\Windows\System\DNxDmdm.exe
  C:\Windows\System\DNxDmdm.exe
  2⤵
  PID:6284
- C:\Windows\System\hVPEDbJ.exe
  C:\Windows\System\hVPEDbJ.exe
  2⤵
  PID:13792
- C:\Windows\System\MqyRRup.exe
  C:\Windows\System\MqyRRup.exe
  2⤵
  PID:14080
- C:\Windows\System\JXrwBmk.exe
  C:\Windows\System\JXrwBmk.exe
  2⤵
  PID:5400
- C:\Windows\System\lbjdFVb.exe
  C:\Windows\System\lbjdFVb.exe
  2⤵
  PID:6344
- C:\Windows\System\YxcVJwo.exe
  C:\Windows\System\YxcVJwo.exe
  2⤵
  PID:14152
- C:\Windows\System\NgEYmru.exe
  C:\Windows\System\NgEYmru.exe
  2⤵
  PID:6460
- C:\Windows\System\nwBhPLQ.exe
  C:\Windows\System\nwBhPLQ.exe
  2⤵
  PID:14276
- C:\Windows\System\OyuroTy.exe
  C:\Windows\System\OyuroTy.exe
  2⤵
  PID:6524
- C:\Windows\System\rOceLvA.exe
  C:\Windows\System\rOceLvA.exe
  2⤵
  PID:6580
- C:\Windows\System\OSnZCSn.exe
  C:\Windows\System\OSnZCSn.exe
  2⤵
  PID:5900
- C:\Windows\System\brgXwDx.exe
  C:\Windows\System\brgXwDx.exe
  2⤵
  PID:6656
- C:\Windows\System\nDRmhcO.exe
  C:\Windows\System\nDRmhcO.exe
  2⤵
  PID:6796
- C:\Windows\System\EFDALeZ.exe
  C:\Windows\System\EFDALeZ.exe
  2⤵
  PID:6852
- C:\Windows\System\yYapSNP.exe
  C:\Windows\System\yYapSNP.exe
  2⤵
  PID:6916
- C:\Windows\System\sGlKerq.exe
  C:\Windows\System\sGlKerq.exe
  2⤵
  PID:7000
- C:\Windows\System\QVZMpLp.exe
  C:\Windows\System\QVZMpLp.exe
  2⤵
  PID:6212
- C:\Windows\System\qEJxkoq.exe
  C:\Windows\System\qEJxkoq.exe
  2⤵
  PID:6004
- C:\Windows\System\gQeqMtX.exe
  C:\Windows\System\gQeqMtX.exe
  2⤵
  PID:6096
- C:\Windows\System\WgXTgBT.exe
  C:\Windows\System\WgXTgBT.exe
  2⤵
  PID:5272
- C:\Windows\System\qShNvRC.exe
  C:\Windows\System\qShNvRC.exe
  2⤵
  PID:6912
- C:\Windows\System\FSSTBLR.exe
  C:\Windows\System\FSSTBLR.exe
  2⤵
  PID:7036
- C:\Windows\System\igsQQkL.exe
  C:\Windows\System\igsQQkL.exe
  2⤵
  PID:3880
- C:\Windows\System\cglWlRu.exe
  C:\Windows\System\cglWlRu.exe
  2⤵
  PID:5384
- C:\Windows\System\BEoxALZ.exe
  C:\Windows\System\BEoxALZ.exe
  2⤵
  PID:6836
- C:\Windows\System\ZeMXQII.exe
  C:\Windows\System\ZeMXQII.exe
  2⤵
  PID:6208
- C:\Windows\System\XQbWFKW.exe
  C:\Windows\System\XQbWFKW.exe
  2⤵
  PID:6864
- C:\Windows\System\ECxqxEc.exe
  C:\Windows\System\ECxqxEc.exe
  2⤵
  PID:5988
- C:\Windows\System\NgLXGBR.exe
  C:\Windows\System\NgLXGBR.exe
  2⤵
  PID:3692
- C:\Windows\System\XSUnRQw.exe
  C:\Windows\System\XSUnRQw.exe
  2⤵
  PID:1196
- C:\Windows\System\hrPNBFj.exe
  C:\Windows\System\hrPNBFj.exe
  2⤵
  PID:13524
- C:\Windows\System\ZJwdTth.exe
  C:\Windows\System\ZJwdTth.exe
  2⤵
  PID:13716
- C:\Windows\System\scUoWRp.exe
  C:\Windows\System\scUoWRp.exe
  2⤵
  PID:6176
- C:\Windows\System\VDFrHxV.exe
  C:\Windows\System\VDFrHxV.exe
  2⤵
  PID:6252
- C:\Windows\System\DfMSoyS.exe
  C:\Windows\System\DfMSoyS.exe
  2⤵
  PID:10548
- C:\Windows\System\GGXIwVX.exe
  C:\Windows\System\GGXIwVX.exe
  2⤵
  PID:13704
- C:\Windows\System\VSjMaat.exe
  C:\Windows\System\VSjMaat.exe
  2⤵
  PID:5380
- C:\Windows\System\DgqhcBf.exe
  C:\Windows\System\DgqhcBf.exe
  2⤵
  PID:14040
- C:\Windows\System\TDohjWu.exe
  C:\Windows\System\TDohjWu.exe
  2⤵
  PID:7552
- C:\Windows\System\oSuRwdg.exe
  C:\Windows\System\oSuRwdg.exe
  2⤵
  PID:7580
- C:\Windows\System\fwYLytS.exe
  C:\Windows\System\fwYLytS.exe
  2⤵
  PID:7600
- C:\Windows\System\UTOcCyn.exe
  C:\Windows\System\UTOcCyn.exe
  2⤵
  PID:6468
- C:\Windows\System\DiijTmG.exe
  C:\Windows\System\DiijTmG.exe
  2⤵
  PID:7684
- C:\Windows\System\bJEJUTe.exe
  C:\Windows\System\bJEJUTe.exe
  2⤵
  PID:6544
- C:\Windows\System\Lnwfqnz.exe
  C:\Windows\System\Lnwfqnz.exe
  2⤵
  PID:5780
- C:\Windows\System\QNxRSsV.exe
  C:\Windows\System\QNxRSsV.exe
  2⤵
  PID:6768
- C:\Windows\System\OkbTCYH.exe
  C:\Windows\System\OkbTCYH.exe
  2⤵
  PID:7896
- C:\Windows\System\sMsmRSp.exe
  C:\Windows\System\sMsmRSp.exe
  2⤵
  PID:7940
- C:\Windows\System\CmHaFXt.exe
  C:\Windows\System\CmHaFXt.exe
  2⤵
  PID:7732
- C:\Windows\System\WDuaLvm.exe
  C:\Windows\System\WDuaLvm.exe
  2⤵
  PID:7232
- C:\Windows\System\HdpSWZV.exe
  C:\Windows\System\HdpSWZV.exe
  2⤵
  PID:5740
- C:\Windows\System\lasIMQy.exe
  C:\Windows\System\lasIMQy.exe
  2⤵
  PID:2416
- C:\Windows\System\XeVDsXm.exe
  C:\Windows\System\XeVDsXm.exe
  2⤵
  PID:7300
- C:\Windows\System\yzPfNDm.exe
  C:\Windows\System\yzPfNDm.exe
  2⤵
  PID:13380
- C:\Windows\System\NXvBmmA.exe
  C:\Windows\System\NXvBmmA.exe
  2⤵
  PID:7356
- C:\Windows\System\wOlaYki.exe
  C:\Windows\System\wOlaYki.exe
  2⤵
  PID:5232
- C:\Windows\System\AOKXZcE.exe
  C:\Windows\System\AOKXZcE.exe
  2⤵
  PID:14056
- C:\Windows\System\RcmOkUg.exe
  C:\Windows\System\RcmOkUg.exe
  2⤵
  PID:7408
- C:\Windows\System\nirbBlC.exe
  C:\Windows\System\nirbBlC.exe
  2⤵
  PID:7628
- C:\Windows\System\WapZExI.exe
  C:\Windows\System\WapZExI.exe
  2⤵
  PID:7608
- C:\Windows\System\wrqfmyG.exe
  C:\Windows\System\wrqfmyG.exe
  2⤵
  PID:5532
- C:\Windows\System\dmVbZUc.exe
  C:\Windows\System\dmVbZUc.exe
  2⤵
  PID:7692
- C:\Windows\System\ELFXRtX.exe
  C:\Windows\System\ELFXRtX.exe
  2⤵
  PID:7612
- C:\Windows\System\oEkzvTH.exe
  C:\Windows\System\oEkzvTH.exe
  2⤵
  PID:6496
- C:\Windows\System\mEUOPXI.exe
  C:\Windows\System\mEUOPXI.exe
  2⤵
  PID:8088
- C:\Windows\System\PiDHwyu.exe
  C:\Windows\System\PiDHwyu.exe
  2⤵
  PID:14184
- C:\Windows\System\icDhvbP.exe
  C:\Windows\System\icDhvbP.exe
  2⤵
  PID:7800
- C:\Windows\System\iAWeuZb.exe
  C:\Windows\System\iAWeuZb.exe
  2⤵
  PID:8008
- C:\Windows\System\BClhwSu.exe
  C:\Windows\System\BClhwSu.exe
  2⤵
  PID:7420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=760 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:13228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AnZDGvn.exe

Filesize
2.4MB

MD5
3244ca38302da5087f45a2f76ae42c5b

SHA1
8e8979acd3a3ba9cf73dd53c721cd801481fc4cb

SHA256
89082ee54406d51ce3602586753d4e09f7eeb87b2a648be214ebb2b4fd87d3e5

SHA512
87c56d68b40a317e9e97409a14627c6c5a390f52b1ba0db5278fa6b88440398cb7034a0d638ef9a94239da505bb394b55d8bca42c0754c3e99d5a99afc26a300

Download Submit
C:\Windows\System\DbFzCrj.exe

Filesize
2.4MB

MD5
c1388db03b082ab84b75e3d7d0ff1b71

SHA1
d9bbd7a2545015c02966bf2b266ac829fffc7fbb

SHA256
cf54ea476751631f42db791fe4cf41f45f21368960a940d6957eaae4197d7b15

SHA512
5af13e65f09b25853214e47dd4340ed66dfcc4401dd09f3745cad797c1a6fc52946cdf96754f542e0a58d544859e4bb16c161dd3f7d75c8f6a5f584dc6f11879

Download Submit
C:\Windows\System\GkccSBU.exe

Filesize
2.4MB

MD5
0c66969b18b1c39422d923df94780da9

SHA1
87af1e2043a209a0f9af252acfca66cc0f44bab1

SHA256
df2acd0d342ac95a472bc33b8c55e433a459c094f2ef91d832a17de304299ee4

SHA512
0abd921316bbb9d174766294d6141da7dfb7cb69fbb76659cb2e67c084d555260a40b9a94c3a58872865a7c8479076133cb7a02d8574584e79bf0593342dedc8

Download Submit
C:\Windows\System\KRkXLpl.exe

Filesize
2.4MB

MD5
dc325814995c76b9935d1aad7585df09

SHA1
2f085a7945ab58d34d859df16d6826a53350cb8f

SHA256
c14f6c481ae518f3942a9f1d3d5fa620ad9381c8eb6b1e9b63697ea594f05d68

SHA512
1738bb2f5a512b334a8d83d656ca7822403e6d263460a61810d8e381969a9c7f4e5bbe6a882e9ff3eec10068023234954ab24620ec1a388e32c4fc678df2dbc3

Download Submit
C:\Windows\System\LyFUdCc.exe

Filesize
2.4MB

MD5
6e784eab2990eee988fa2bf92863919f

SHA1
b3a50d8ff086824cc82969d1d12270c69864098e

SHA256
be09148da6fb9cac61a1f865bc65bb512fd7b480c6f4a94adc008f51a6a6312d

SHA512
40faa64108842a67bf6c387d58401c03a07d1c1d38e28a47bea592fa9eef94f41a026ba3778f03a670e6461d3d8359e05fc411b37ab44544bf12b7ad93c6e59a

Download Submit
C:\Windows\System\LzETndf.exe

Filesize
2.4MB

MD5
f15c5c4707e5f48b5db127ed98fce180

SHA1
7b88877aae2d52d7346fe756762d46f83563828a

SHA256
a561c1abee8926463aff7d5e15a7f4fb56fce3d6f285a7fd829ffe6fa3466814

SHA512
78c060dffb7a724dbfc2ca05083634b249316a7777a3fd060c14cf284c82dcd1730d545dffbd87a4bfb2123e311c8b7010e6a01dbfe1c03c34afc514901077c1

Download Submit
C:\Windows\System\MSRjTBr.exe

Filesize
2.4MB

MD5
51e83153860d73e3da953f84d1303de8

SHA1
d2258d2ef5a01383fa0f95c53d3261879c87440a

SHA256
433d490e552fed717a383a972d25cc2f7af24ffdcdbb7bda08ce8bc504840663

SHA512
f0bdc1a55e85f78a113a536e0c14bc46517541f42ba681e20befee2337042c7d76b7f82eca58d6db4d4d318dc71145fa0236d5d7d2e19ee081dbec2391edcee3

Download Submit
C:\Windows\System\ORkJRVa.exe

Filesize
2.4MB

MD5
2eda76e30d508130012e2d71ac92bca0

SHA1
2652b9a0b07073e7b4ae89c17d284a85449bcbe3

SHA256
a82bae6b5281bb6e7d7cd3f1964ffd4b9c2b3cdf8d8844818ab954bae576e3cf

SHA512
efc31b22304eafd4f6e980ae060913ae750780cfc949db7df6a1d23340f794ea30bfb1882d7544648269cc30f9ed6029c0a1d3f69d11b9b00188e83e1cd25f24

Download Submit
C:\Windows\System\PWthzAk.exe

Filesize
2.4MB

MD5
95ec74d2c146e6ac0925aa6b3791e982

SHA1
15fee6915d1b7732b3ee801d7803acd884f8e2f3

SHA256
925d531b6d699f633ce97f1f6426f7127296a87466a69d58058f96e4304a680c

SHA512
033d484d9dda717f7878f5832889a8844f27469d0b5545c846b37150ef48af49c348288334ad2adcc944b10f1cda0edaf149a0e2e4779d509fe1dfb73a3ee88e

Download Submit
C:\Windows\System\QKWbcye.exe

Filesize
2.4MB

MD5
9401cd883ff7d131ee5e963e2c131097

SHA1
b9e00b1ae5ffff61cf4e01d2f1da19f0817b6792

SHA256
45615f180af32d334c6752e478a2f3c345e2bc15ceaaa0409d6b2406270a9265

SHA512
fe9febf4ffdd11c055fcae54070eab43a17d162c3a6df91520514fad74f2b7d3024257c41e778eb461bc4546afa25e8d46de9a4694f9aca11dee11a226ad8709

Download Submit
C:\Windows\System\VCcBpfS.exe

Filesize
2.4MB

MD5
5612218152ec0a0e49a5e1130027988e

SHA1
83818ce86c4e266d3e43e233a660883b195c4f0e

SHA256
2e53c2974c47d0bac31a4484d71786c0a31046b63917e44e9f11716b3df88f81

SHA512
cd57ca1971a2095aaa86ffa5753960900d1593743ad50c8231ce18a3e95965ca2073a904cc0813bf6728c7b51159d039862de0e12675aecb875c4c439c5ea0ab

Download Submit
C:\Windows\System\WKTCrJW.exe

Filesize
2.4MB

MD5
d7b1d6f73a3c9646584d88e2a2a9c9d5

SHA1
8709a62f90c94a2da1e25eac47f9985d5151f933

SHA256
3b15923487b3b1d16b6ffbd26e2a4ebe70f2de3fe2774e1969b9e829f84aeabd

SHA512
b088ec13002bc8ff49171beeffe3d076a8147d7e4bdeb33469b1e26fbc93c3c1aad4ba72de00adeb527bc17e14b579346521855a480ec32096d2a5d3583e0062

Download Submit
C:\Windows\System\XgfssNy.exe

Filesize
2.4MB

MD5
e2ef08995c49cf58470544c075977fbd

SHA1
530cd478a4d43a411ab362384b1d8c7af918a876

SHA256
db4f1d110844bfe63e09d84ac6fd7b47158eaa5eb646b1abf17367e04517c8f1

SHA512
505da9ab4406d4894135c7d6466445689251dee814420beb13d096c540ef674fb47cf6d16e91a5db76bbc311c43acbf5e0f4b442e8ff5ae6000b85bfb0294e78

Download Submit
C:\Windows\System\YnojDWK.exe

Filesize
2.4MB

MD5
7e47b5f659a13d1dcf08108eb8d7547a

SHA1
b4e80d9b9f26799b791897aa59332ffd4e35ba94

SHA256
34b69effe222b4272699271295473db120dbc558fa19f4c79b48142bef64698d

SHA512
3f5349522517790c30172ec802f64c3c333241ff1ea1e1f2abd3d07b82bbbb077d040882813e7355d0ac152bb22b781e44a3dabf888ba053af19ed24d967da2e

Download Submit
C:\Windows\System\ZeIBCqv.exe

Filesize
2.4MB

MD5
13317ff401d8f20436386d6c0f08e266

SHA1
baa95e10df4491634f0722a82ab9eabec68322ac

SHA256
8225f65b51a1613e05a962a37266cd7677ad7d3ceca3568464e33d3a96a82db0

SHA512
c945312dc9096f49dbca5e1a4d97df7f630b689e3ac45f72a066c774367568c2dece2ed97281966d49268b1473e35e053d0255932c0846fafa1c016021590e49

Download Submit
C:\Windows\System\ZfsgErs.exe

Filesize
2.4MB

MD5
cffb1b98f25fe776b912fa8dbb647afc

SHA1
d7947fc7eabbb88d3a2cf3fcec1303be4c517610

SHA256
012070676abaabacd11c1f193b9f98bf6ccbc83e061f69b1f383e010ca1d1923

SHA512
5594c588658adf1f682b28d34189e96f8e9c7eacb8244b3e97ac7b40b42896096aa475386ad9f23eb3ae7a354da333dc2d8f3f7a6ae5761b0e519102bc6019a9

Download Submit
C:\Windows\System\accSaVp.exe

Filesize
2.4MB

MD5
1f2e83ae1a6f2b582e2cf7208c06c509

SHA1
906cdf7ac977a15e2c2fc6f87f8bda7874cae358

SHA256
0e70a02d13ab5299007d81b674bd59044187316b44e0645724150b65d0005fd3

SHA512
3b2d772b2fc41dcb853ef9850d05cf13089d29c2404b9f4ca4e1893d1e23c0056012c9098b6c30df18c100dae0892cca74579f18ec2f64297f623e353e931b7e

Download Submit
C:\Windows\System\bdDKHxd.exe

Filesize
2.4MB

MD5
f62dbf2ac7cc889fa45a91668d7977ab

SHA1
5853a5f6dc3103d74a581f120d0fb3f04ea70bfa

SHA256
2b7f5f2bd714f5cfaceb0642f59703809e1abc86ec7baf1eb6da5e4f7f8be9cf

SHA512
e8fcb557c6e866d219111a7d0a34c9be193afe0cbdab7753fc08b21abac59c4ffda598c1afa9dfcf4cf4eeda6dcab76d9f1fc26b87925c3889075c74151d2ae0

Download Submit
C:\Windows\System\fYWrkoH.exe

Filesize
2.4MB

MD5
c9a1a03f4a1799d0f4185bfaf496c9ce

SHA1
9a98c0472ee9d6f0fc9c39b320772bd758884679

SHA256
39d203ab533be4ab7425cd4998da0cb878da9a769598561c0066fdb8def0280f

SHA512
e778f026ea3dfdb767e3ab11fbbe548e9b301899db804cb63da19e1553a64aa4744490bc7d830cb74da4ebceb9a8680bccf3627c4a1549ca21e7f8d36939b6b8

Download Submit
C:\Windows\System\gayBiql.exe

Filesize
2.4MB

MD5
8cfc958787be150c94cae1a426b78394

SHA1
81c98ac01227410b6227a91fe285d51e1a055408

SHA256
c54e490e8f66f55f6d437cae8198e8169ee55ec6ef6b4a4114110f11f0942780

SHA512
4a23536b5916f44f2e2e8cd01121a4616831f16d3dfb4ce9bd9f97f58095855ee3940f7372c4976fb62464a11a958d0a4ceebac1195a8833a6d94be7e8b086ae

Download Submit
C:\Windows\System\giBFSLc.exe

Filesize
2.4MB

MD5
fd93434779d5cd404fc3fa387d50c4b9

SHA1
ae737e604e46351060e9425c7d8772faa338d89a

SHA256
f59a26ae7653fedf2cfb1f086a75c6796de9991d974926a3c9a8337bc146137e

SHA512
e9c7a5b47eff3593bbcbd193e7a087b4bff3497b8450d8b5b9d36f1f098520f8af8664eb17c599cef9de838ad7528cd09167bcc5828d891650daa36712e94327

Download Submit
C:\Windows\System\hsFmJTH.exe

Filesize
2.4MB

MD5
081c506595140075255d0415c03c1a12

SHA1
b4020b3c7b58e7135ca372d90ea8dd901b406b17

SHA256
18c520ee570af5ee54d0f9bd8e97f12cf3bd8b50756b4afbd614e44b5126d8ea

SHA512
45be057cb33796184034e3783db0f6ba47340cd4318f7e4ba279f810d7405bb657fc6ec94eee21b0d153119d35b22bef66f37e57bcc855652b0e14e4a34a2150

Download Submit
C:\Windows\System\jhGYjHG.exe

Filesize
2.4MB

MD5
018a8c82ed0ff207fe0c42cb75872b9d

SHA1
79f517a5bb53fbaeb1051406db3d95b5b6f68d1f

SHA256
c50da229a19a2aef5750eea592cbf48f5bf3054e99584dcee0fda33bf6ebdfa5

SHA512
4fc79910bb0cb9c70bed2a20836e432fed59cd74a7f51e8de0ddc3e1e3afb362eb2ec61682ee97089744684ff374ac6d8d4d9f6cd42948b6a2e4496f6c4056ea

Download Submit
C:\Windows\System\kqMoqNM.exe

Filesize
2.4MB

MD5
ada365a80a4b11a08895db1c3290c18d

SHA1
00f50007b262760accb7bf95d5d420f7663a7024

SHA256
0f1092510894d27c7025723671b66c2c3eb69f65dd3c423cf1ed7f0f3e9f6364

SHA512
048fd56ed218dbc8720b14708011f42b81d106b0bce666074edc6933d97642abbdf7fec5771f67098bc4f217c68799db14b46c9e6cddcbb68ba21a5dcea55967

Download Submit
C:\Windows\System\mxjnPqy.exe

Filesize
2.4MB

MD5
43309c1a1ee6dbb93f868e3449ee8a5d

SHA1
8c112c65d7dd13e15c1e7d4bb3d89eb373371593

SHA256
169b0ca85ec5caefce4e5a43aeb6f45b76476bdce779c21e1db374867f9c1835

SHA512
93a5057cf07647899cdd130bc45a06ddca88b534e3e61551099b6ca93952571c9eeabe9dd8d42f63491ee2136d3526ef000a42a722ada1ee7026ca568450293e

Download Submit
C:\Windows\System\oexDxrw.exe

Filesize
2.4MB

MD5
8a995816e4dccf55d9a3dcd46243d0a9

SHA1
409e48a8d8bfe53f73eced7b823a6d7085a5c2a4

SHA256
75ee9f17b880e35b1d0b78db0cbb5d17d8e7fb741359a07077210af88312517f

SHA512
5867bbc0ff10399c14fc89474132a1d54319c36603a71f8cccfa847ae9008a6c82d7d378fce8dfbf59f84b37521387b681e95a18450802c12ddaae031b69c087

Download Submit
C:\Windows\System\puYXlcR.exe

Filesize
2.4MB

MD5
92ec6362dbea295be548d7d2114a4d3f

SHA1
e3e32f76da85039b7f1b5cad8bb14fef47d3d7c3

SHA256
1090ef7f8dee91ed00c7b89a0fd178e7d3ff9030cff548b35787b6bd24737936

SHA512
a6a6a75435c1488c35c3a4bfe3a272da3211b715f91cb795bc4c53295789c90de6461705501e6baec63fa9f84d44b5124b742588e1cd1f91a7a8ce0ff209c5f3

Download Submit
C:\Windows\System\qKqBYEA.exe

Filesize
2.4MB

MD5
0d222ea5662ff5e2bb0ea5f333c585d4

SHA1
814bffe90ac8ac0c63fdf2fe2e8f0037ab573aac

SHA256
48438cccce4ce32711ae404301642abc6bddcfdc9a033b3120ef45f94486ffe0

SHA512
f2299862415405616d901817697f8980561dea31ddaa38e14e34182caafca8e8f63427da54a9f0f93ecd2aac2cc283a4b070879b67ec951429c695ce2ac1554c

Download Submit
C:\Windows\System\rhChnUR.exe

Filesize
2.4MB

MD5
67b68529149e561c30a5274516c6c58c

SHA1
d16ffd2a35759724fc36d7344be3e5c4016de74b

SHA256
d05961aa4cad77146c22ef26c29b89ee4525c52defbbbb427b20155a7727f08c

SHA512
560b98cfca81d9ee7793d38e546e33420ecade8caa530efede9ba9a35380f2ff691d6b3d4fb7dc7e0804ae5689fc4bd76415a8979c010f807f8f54e935222354

Download Submit
C:\Windows\System\tIiVAus.exe

Filesize
2.4MB

MD5
eb817e7bba06b8e26d465dd58ead5632

SHA1
46d1ffa0f097e77b0ccedf4176503a3aeac84638

SHA256
0bbf39049550698e519f689967ea9b10ab34f6ffddcd0e29a571c610e2465366

SHA512
90f28fc2d30b09893d2d857103c5f1324f1ccd480b0a868e6c82ed7805c64ce6b241c010f613972cbbed99218933dabef989f950e6f506cea10d4c9ea3dd65dc

Download Submit
C:\Windows\System\vaxnqKZ.exe

Filesize
2.4MB

MD5
5b731481312b2adecb80fe8ce43dc8dc

SHA1
5aa81c5be88d56accdafd043479f2183eaef497c

SHA256
0edbd3ffc83224235a11032e37927c6c6c4f63ea1cdeebdc9fb59826e6d8ffa0

SHA512
8162a9634a88504251178a0ddeb337c0c3c48b130ffeadfb486db4636107b28129c9ee8fa40d3001218c295810cb8024cb2ef0a8815fe5b3f7164d73600fe449

Download Submit
C:\Windows\System\xdBGjjr.exe

Filesize
2.4MB

MD5
ee7e51b70e51cda4ab59cf011fc5ec0d

SHA1
66b665a87fdee7080c6e33758527cb198e4b5630

SHA256
ce0a1d88f65ad4fab128c103de5647d49eaf84901e2126bc3b4fc52d1c550e24

SHA512
08f1129d33183000f267c34bb545021abaa7102df0b9eede97768186ea5e9dc3dda7357b1e137cf4c747a8c0c33be2163d061d5088d8d292e6570d6ea5607dcd

Download Submit
C:\Windows\System\yAvqUll.exe

Filesize
2.4MB

MD5
7a69c25db3a51b58d7d9d2ed8baee14e

SHA1
52eec1c00472173c3a2fa92f725f2f51015fe429

SHA256
d4422de04d8e9dd3d17ec95e5c49db58a0e95e8dbc9e09ac88ac5ea22bc9f0a1

SHA512
c3e4b714d8a692f4a179afde6b78a631d4ceb5681c6ca65368183d5a042dcd7755f56dcbf0623c4d0b7d59c8ba1e917b97cbd928329ab1a0d0dd2c8c479a3d24

Download Submit
C:\Windows\System\yMomxWw.exe

Filesize
2.4MB

MD5
6e6f802dc2fe15d11414927d52c50757

SHA1
960fcfd5b3e7889c4e0902eb63af07aef1850dc2

SHA256
8c62bcd291403a58f4cf2c9e8edd330dc5e6468bc2b83ac92a45721c7f02bada

SHA512
1954428a61ee65e7d0c90fa07d797142efd7ce2f9240eef4d64887e149eccd4b480a53f96fe27a8237abe77f6db8094704a71b49b5b5eb6ee3dce4582c451164

Download Submit
memory/404-1967-0x00007FF6D6460000-0x00007FF6D67B4000-memory.dmp

Filesize
3.3MB

Download
memory/404-200-0x00007FF6D6460000-0x00007FF6D67B4000-memory.dmp

Filesize
3.3MB

Download
memory/416-1619-0x00007FF76FC30000-0x00007FF76FF84000-memory.dmp

Filesize
3.3MB

Download
memory/416-32-0x00007FF76FC30000-0x00007FF76FF84000-memory.dmp

Filesize
3.3MB

Download
memory/416-525-0x00007FF76FC30000-0x00007FF76FF84000-memory.dmp

Filesize
3.3MB

Download
memory/572-91-0x00007FF7B9960000-0x00007FF7B9CB4000-memory.dmp

Filesize
3.3MB

Download
memory/572-935-0x00007FF7B9960000-0x00007FF7B9CB4000-memory.dmp

Filesize
3.3MB

Download
memory/572-1933-0x00007FF7B9960000-0x00007FF7B9CB4000-memory.dmp

Filesize
3.3MB

Download
memory/640-199-0x00007FF763590000-0x00007FF7638E4000-memory.dmp

Filesize
3.3MB

Download
memory/640-1977-0x00007FF763590000-0x00007FF7638E4000-memory.dmp

Filesize
3.3MB

Download
memory/908-161-0x00007FF7DCFB0000-0x00007FF7DD304000-memory.dmp

Filesize
3.3MB

Download
memory/908-1965-0x00007FF7DCFB0000-0x00007FF7DD304000-memory.dmp

Filesize
3.3MB

Download
memory/1020-203-0x00007FF611CF0000-0x00007FF612044000-memory.dmp

Filesize
3.3MB

Download
memory/1020-1986-0x00007FF611CF0000-0x00007FF612044000-memory.dmp

Filesize
3.3MB

Download
memory/1448-0-0x00007FF781670000-0x00007FF7819C4000-memory.dmp

Filesize
3.3MB

Download
memory/1448-125-0x00007FF781670000-0x00007FF7819C4000-memory.dmp

Filesize
3.3MB

Download
memory/1448-1-0x0000024FF6C60000-0x0000024FF6C70000-memory.dmp

Filesize
64KB

Download
memory/1528-113-0x00007FF72CF40000-0x00007FF72D294000-memory.dmp

Filesize
3.3MB

Download
memory/1528-1950-0x00007FF72CF40000-0x00007FF72D294000-memory.dmp

Filesize
3.3MB

Download
memory/1556-1621-0x00007FF6BAAD0000-0x00007FF6BAE24000-memory.dmp

Filesize
3.3MB

Download
memory/1556-87-0x00007FF6BAAD0000-0x00007FF6BAE24000-memory.dmp

Filesize
3.3MB

Download
memory/1656-1626-0x00007FF654F30000-0x00007FF655284000-memory.dmp

Filesize
3.3MB

Download
memory/1656-89-0x00007FF654F30000-0x00007FF655284000-memory.dmp

Filesize
3.3MB

Download
memory/1796-957-0x00007FF643080000-0x00007FF6433D4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-94-0x00007FF643080000-0x00007FF6433D4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-1942-0x00007FF643080000-0x00007FF6433D4000-memory.dmp

Filesize
3.3MB

Download
memory/1800-92-0x00007FF6B4A90000-0x00007FF6B4DE4000-memory.dmp

Filesize
3.3MB

Download
memory/1800-945-0x00007FF6B4A90000-0x00007FF6B4DE4000-memory.dmp

Filesize
3.3MB

Download
memory/1800-1946-0x00007FF6B4A90000-0x00007FF6B4DE4000-memory.dmp

Filesize
3.3MB

Download
memory/2420-289-0x00007FF7AB460000-0x00007FF7AB7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2420-27-0x00007FF7AB460000-0x00007FF7AB7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2420-1620-0x00007FF7AB460000-0x00007FF7AB7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-1973-0x00007FF66B950000-0x00007FF66BCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-201-0x00007FF66B950000-0x00007FF66BCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2620-85-0x00007FF7B5A40000-0x00007FF7B5D94000-memory.dmp

Filesize
3.3MB

Download
memory/2620-1618-0x00007FF7B5A40000-0x00007FF7B5D94000-memory.dmp

Filesize
3.3MB

Download
memory/2716-202-0x00007FF757900000-0x00007FF757C54000-memory.dmp

Filesize
3.3MB

Download
memory/2716-1974-0x00007FF757900000-0x00007FF757C54000-memory.dmp

Filesize
3.3MB

Download
memory/2816-133-0x00007FF65F490000-0x00007FF65F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2816-1964-0x00007FF65F490000-0x00007FF65F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2944-1940-0x00007FF719F40000-0x00007FF71A294000-memory.dmp

Filesize
3.3MB

Download
memory/2944-104-0x00007FF719F40000-0x00007FF71A294000-memory.dmp

Filesize
3.3MB

Download
memory/3088-198-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp

Filesize
3.3MB

Download
memory/3088-1969-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp

Filesize
3.3MB

Download
memory/3404-197-0x00007FF7731F0000-0x00007FF773544000-memory.dmp

Filesize
3.3MB

Download
memory/3404-1963-0x00007FF7731F0000-0x00007FF773544000-memory.dmp

Filesize
3.3MB

Download
memory/3432-86-0x00007FF708D00000-0x00007FF709054000-memory.dmp

Filesize
3.3MB

Download
memory/3432-1624-0x00007FF708D00000-0x00007FF709054000-memory.dmp

Filesize
3.3MB

Download
memory/3656-16-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp

Filesize
3.3MB

Download
memory/3656-170-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp

Filesize
3.3MB

Download
memory/3656-1605-0x00007FF7BAEA0000-0x00007FF7BB1F4000-memory.dmp

Filesize
3.3MB

Download
memory/3884-88-0x00007FF657FD0000-0x00007FF658324000-memory.dmp

Filesize
3.3MB

Download
memory/3884-1625-0x00007FF657FD0000-0x00007FF658324000-memory.dmp

Filesize
3.3MB

Download
memory/3988-1609-0x00007FF6B0650000-0x00007FF6B09A4000-memory.dmp

Filesize
3.3MB

Download
memory/3988-82-0x00007FF6B0650000-0x00007FF6B09A4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-954-0x00007FF756180000-0x00007FF7564D4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-93-0x00007FF756180000-0x00007FF7564D4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-1931-0x00007FF756180000-0x00007FF7564D4000-memory.dmp

Filesize
3.3MB

Download
memory/4648-1599-0x00007FF60B540000-0x00007FF60B894000-memory.dmp

Filesize
3.3MB

Download
memory/4648-204-0x00007FF60B540000-0x00007FF60B894000-memory.dmp

Filesize
3.3MB

Download
memory/4648-21-0x00007FF60B540000-0x00007FF60B894000-memory.dmp

Filesize
3.3MB

Download
memory/4824-152-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4824-10-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4824-1582-0x00007FF7C4860000-0x00007FF7C4BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4904-1959-0x00007FF625380000-0x00007FF6256D4000-memory.dmp

Filesize
3.3MB

Download
memory/4904-141-0x00007FF625380000-0x00007FF6256D4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-1644-0x00007FF6974A0000-0x00007FF6977F4000-memory.dmp

Filesize
3.3MB

Download
memory/4916-90-0x00007FF6974A0000-0x00007FF6977F4000-memory.dmp

Filesize
3.3MB

Download
memory/5012-121-0x00007FF741CE0000-0x00007FF742034000-memory.dmp

Filesize
3.3MB

Download
memory/5012-1956-0x00007FF741CE0000-0x00007FF742034000-memory.dmp

Filesize
3.3MB

Download
memory/5012-1665-0x00007FF741CE0000-0x00007FF742034000-memory.dmp

Filesize
3.3MB

Download