xmrig | 64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 04:42 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
Size

2.2MB
MD5

da7bbb1bb7734a6832d6cc8b681f36c0
SHA1

2ca1a282dee03db09c5a3070799153f30e9d8927
SHA256

64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474
SHA512

3bcdd4d334302369ad9cfbc47f748c3737b13f36f04a928a43096473efe4a27e0cfa76ccc06031e5ca863bdf5c5b3d2676f857de91245f15438a630729002e21
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGJLuIaRNfGq9E5g:BemTLkNdfE0pZrb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2332-0-0x00007FF6404D0000-0x00007FF640824000-memory.dmp	xmrig
behavioral2/files/0x000b000000023225-4.dat	xmrig
behavioral2/files/0x0007000000023256-8.dat	xmrig
behavioral2/files/0x0008000000023255-12.dat	xmrig
behavioral2/files/0x0007000000023257-18.dat	xmrig
behavioral2/memory/4380-23-0x00007FF6CE600000-0x00007FF6CE954000-memory.dmp	xmrig
behavioral2/files/0x0007000000023258-28.dat	xmrig
behavioral2/files/0x0007000000023259-35.dat	xmrig
behavioral2/files/0x000700000002325c-57.dat	xmrig
behavioral2/files/0x0008000000023253-76.dat	xmrig
behavioral2/files/0x000700000002325f-87.dat	xmrig
behavioral2/memory/3028-95-0x00007FF656BA0000-0x00007FF656EF4000-memory.dmp	xmrig
behavioral2/memory/3852-103-0x00007FF6B4640000-0x00007FF6B4994000-memory.dmp	xmrig
behavioral2/memory/712-106-0x00007FF6C0E60000-0x00007FF6C11B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023268-137.dat	xmrig
behavioral2/files/0x0007000000023273-187.dat	xmrig
behavioral2/files/0x0007000000023272-182.dat	xmrig
behavioral2/memory/4912-233-0x00007FF744240000-0x00007FF744594000-memory.dmp	xmrig
behavioral2/memory/948-232-0x00007FF781E40000-0x00007FF782194000-memory.dmp	xmrig
behavioral2/memory/2864-231-0x00007FF7B6020000-0x00007FF7B6374000-memory.dmp	xmrig
behavioral2/memory/2408-230-0x00007FF67B770000-0x00007FF67BAC4000-memory.dmp	xmrig
behavioral2/memory/2040-229-0x00007FF7187C0000-0x00007FF718B14000-memory.dmp	xmrig
behavioral2/memory/1980-228-0x00007FF604580000-0x00007FF6048D4000-memory.dmp	xmrig
behavioral2/memory/4840-227-0x00007FF649350000-0x00007FF6496A4000-memory.dmp	xmrig
behavioral2/memory/2316-226-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp	xmrig
behavioral2/memory/2356-225-0x00007FF6B4B40000-0x00007FF6B4E94000-memory.dmp	xmrig
behavioral2/memory/3460-223-0x00007FF63A960000-0x00007FF63ACB4000-memory.dmp	xmrig
behavioral2/memory/3752-222-0x00007FF61E700000-0x00007FF61EA54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023271-174.dat	xmrig
behavioral2/files/0x0007000000023270-172.dat	xmrig
behavioral2/files/0x000700000002326f-166.dat	xmrig
behavioral2/files/0x000700000002326e-162.dat	xmrig
behavioral2/files/0x000700000002326d-160.dat	xmrig
behavioral2/files/0x000700000002326c-157.dat	xmrig
behavioral2/files/0x000700000002326b-149.dat	xmrig
behavioral2/files/0x000700000002326a-144.dat	xmrig
behavioral2/files/0x0007000000023269-140.dat	xmrig
behavioral2/files/0x0007000000023267-126.dat	xmrig
behavioral2/files/0x0007000000023266-122.dat	xmrig
behavioral2/files/0x0007000000023265-116.dat	xmrig
behavioral2/memory/436-110-0x00007FF763440000-0x00007FF763794000-memory.dmp	xmrig
behavioral2/memory/3984-109-0x00007FF701C90000-0x00007FF701FE4000-memory.dmp	xmrig
behavioral2/memory/4556-108-0x00007FF670B00000-0x00007FF670E54000-memory.dmp	xmrig
behavioral2/memory/2132-107-0x00007FF6C25D0000-0x00007FF6C2924000-memory.dmp	xmrig
behavioral2/memory/2072-105-0x00007FF7295F0000-0x00007FF729944000-memory.dmp	xmrig
behavioral2/memory/1264-104-0x00007FF7D2690000-0x00007FF7D29E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023262-101.dat	xmrig
behavioral2/files/0x0007000000023264-99.dat	xmrig
behavioral2/memory/744-98-0x00007FF6B1680000-0x00007FF6B19D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023263-96.dat	xmrig
behavioral2/files/0x0007000000023261-90.dat	xmrig
behavioral2/memory/4184-89-0x00007FF619B00000-0x00007FF619E54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023260-81.dat	xmrig
behavioral2/memory/2260-79-0x00007FF754290000-0x00007FF7545E4000-memory.dmp	xmrig
behavioral2/memory/216-70-0x00007FF7DFCC0000-0x00007FF7E0014000-memory.dmp	xmrig
behavioral2/files/0x000700000002325e-72.dat	xmrig
behavioral2/memory/3560-67-0x00007FF6A5A20000-0x00007FF6A5D74000-memory.dmp	xmrig
behavioral2/files/0x000700000002325d-62.dat	xmrig
behavioral2/files/0x000700000002325b-51.dat	xmrig
behavioral2/files/0x000700000002325a-40.dat	xmrig
behavioral2/memory/2824-19-0x00007FF7A64C0000-0x00007FF7A6814000-memory.dmp	xmrig
behavioral2/memory/884-17-0x00007FF76B780000-0x00007FF76BAD4000-memory.dmp	xmrig
behavioral2/memory/4036-11-0x00007FF6A48B0000-0x00007FF6A4C04000-memory.dmp	xmrig
behavioral2/memory/4380-2045-0x00007FF6CE600000-0x00007FF6CE954000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4036	LPvSazK.exe
2824	OtQggOC.exe
884	bmVUwaw.exe
4380	stiBpky.exe
3560	MRzQTBg.exe
216	acxuvyl.exe
2260	xxTSGRU.exe
4184	OAQkcaD.exe
3028	cixlWxB.exe
744	epzLyLG.exe
3852	kVzhhjq.exe
1264	odXmPmr.exe
2132	PePNlhr.exe
4556	fMWSwGW.exe
2072	TpQQHwX.exe
3984	ShWrlkY.exe
712	BdMqwWc.exe
436	ykxwgKw.exe
3752	rVuQNhq.exe
3460	HEqYLVG.exe
2356	cqaIhnF.exe
2316	BOZxxyJ.exe
4840	swKHLtb.exe
1980	bhdniNv.exe
2040	BWDmUIk.exe
2408	aWeBMAc.exe
2864	erNWoee.exe
948	DqxrjZo.exe
4912	ceubTnH.exe
3968	dEQbjCy.exe
3544	TlsrKrD.exe
4396	dIAHgzI.exe
1384	qOpcZOF.exe
3980	MuOdkZu.exe
1932	taRRgiR.exe
2340	gpNdKmF.exe
228	pidGotX.exe
1128	tCDUlDX.exe
432	QgoBjNA.exe
1016	BJZJiow.exe
4876	bHBiHyT.exe
2168	GBFoXoP.exe
4668	BjGiYrQ.exe
3672	ndoYEmB.exe
4996	vfhvdlq.exe
3232	sMvRGZJ.exe
4608	UkVTNUN.exe
3780	mQcFzDx.exe
2764	MSPRmwY.exe
4436	DJocFml.exe
4848	RSIVaUW.exe
5144	RwHSgYr.exe
5160	pCHtMoT.exe
5180	sPvzOfw.exe
5196	WmnmalP.exe
5216	URkDxkx.exe
5232	NERysvs.exe
5248	BvWImDS.exe
5264	ibmREiJ.exe
5308	DDHhjXo.exe
5324	jCWLTPo.exe
5340	xbhzilN.exe
5356	RjbGubz.exe
5372	pSJcRel.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2332-0-0x00007FF6404D0000-0x00007FF640824000-memory.dmp	upx
behavioral2/files/0x000b000000023225-4.dat	upx
behavioral2/files/0x0007000000023256-8.dat	upx
behavioral2/files/0x0008000000023255-12.dat	upx
behavioral2/files/0x0007000000023257-18.dat	upx
behavioral2/memory/4380-23-0x00007FF6CE600000-0x00007FF6CE954000-memory.dmp	upx
behavioral2/files/0x0007000000023258-28.dat	upx
behavioral2/files/0x0007000000023259-35.dat	upx
behavioral2/files/0x000700000002325c-57.dat	upx
behavioral2/files/0x0008000000023253-76.dat	upx
behavioral2/files/0x000700000002325f-87.dat	upx
behavioral2/memory/3028-95-0x00007FF656BA0000-0x00007FF656EF4000-memory.dmp	upx
behavioral2/memory/3852-103-0x00007FF6B4640000-0x00007FF6B4994000-memory.dmp	upx
behavioral2/memory/712-106-0x00007FF6C0E60000-0x00007FF6C11B4000-memory.dmp	upx
behavioral2/files/0x0007000000023268-137.dat	upx
behavioral2/files/0x0007000000023273-187.dat	upx
behavioral2/files/0x0007000000023272-182.dat	upx
behavioral2/memory/4912-233-0x00007FF744240000-0x00007FF744594000-memory.dmp	upx
behavioral2/memory/948-232-0x00007FF781E40000-0x00007FF782194000-memory.dmp	upx
behavioral2/memory/2864-231-0x00007FF7B6020000-0x00007FF7B6374000-memory.dmp	upx
behavioral2/memory/2408-230-0x00007FF67B770000-0x00007FF67BAC4000-memory.dmp	upx
behavioral2/memory/2040-229-0x00007FF7187C0000-0x00007FF718B14000-memory.dmp	upx
behavioral2/memory/1980-228-0x00007FF604580000-0x00007FF6048D4000-memory.dmp	upx
behavioral2/memory/4840-227-0x00007FF649350000-0x00007FF6496A4000-memory.dmp	upx
behavioral2/memory/2316-226-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp	upx
behavioral2/memory/2356-225-0x00007FF6B4B40000-0x00007FF6B4E94000-memory.dmp	upx
behavioral2/memory/3460-223-0x00007FF63A960000-0x00007FF63ACB4000-memory.dmp	upx
behavioral2/memory/3752-222-0x00007FF61E700000-0x00007FF61EA54000-memory.dmp	upx
behavioral2/files/0x0007000000023271-174.dat	upx
behavioral2/files/0x0007000000023270-172.dat	upx
behavioral2/files/0x000700000002326f-166.dat	upx
behavioral2/files/0x000700000002326e-162.dat	upx
behavioral2/files/0x000700000002326d-160.dat	upx
behavioral2/files/0x000700000002326c-157.dat	upx
behavioral2/files/0x000700000002326b-149.dat	upx
behavioral2/files/0x000700000002326a-144.dat	upx
behavioral2/files/0x0007000000023269-140.dat	upx
behavioral2/files/0x0007000000023267-126.dat	upx
behavioral2/files/0x0007000000023266-122.dat	upx
behavioral2/files/0x0007000000023265-116.dat	upx
behavioral2/memory/436-110-0x00007FF763440000-0x00007FF763794000-memory.dmp	upx
behavioral2/memory/3984-109-0x00007FF701C90000-0x00007FF701FE4000-memory.dmp	upx
behavioral2/memory/4556-108-0x00007FF670B00000-0x00007FF670E54000-memory.dmp	upx
behavioral2/memory/2132-107-0x00007FF6C25D0000-0x00007FF6C2924000-memory.dmp	upx
behavioral2/memory/2072-105-0x00007FF7295F0000-0x00007FF729944000-memory.dmp	upx
behavioral2/memory/1264-104-0x00007FF7D2690000-0x00007FF7D29E4000-memory.dmp	upx
behavioral2/files/0x0007000000023262-101.dat	upx
behavioral2/files/0x0007000000023264-99.dat	upx
behavioral2/memory/744-98-0x00007FF6B1680000-0x00007FF6B19D4000-memory.dmp	upx
behavioral2/files/0x0007000000023263-96.dat	upx
behavioral2/files/0x0007000000023261-90.dat	upx
behavioral2/memory/4184-89-0x00007FF619B00000-0x00007FF619E54000-memory.dmp	upx
behavioral2/files/0x0007000000023260-81.dat	upx
behavioral2/memory/2260-79-0x00007FF754290000-0x00007FF7545E4000-memory.dmp	upx
behavioral2/memory/216-70-0x00007FF7DFCC0000-0x00007FF7E0014000-memory.dmp	upx
behavioral2/files/0x000700000002325e-72.dat	upx
behavioral2/memory/3560-67-0x00007FF6A5A20000-0x00007FF6A5D74000-memory.dmp	upx
behavioral2/files/0x000700000002325d-62.dat	upx
behavioral2/files/0x000700000002325b-51.dat	upx
behavioral2/files/0x000700000002325a-40.dat	upx
behavioral2/memory/2824-19-0x00007FF7A64C0000-0x00007FF7A6814000-memory.dmp	upx
behavioral2/memory/884-17-0x00007FF76B780000-0x00007FF76BAD4000-memory.dmp	upx
behavioral2/memory/4036-11-0x00007FF6A48B0000-0x00007FF6A4C04000-memory.dmp	upx
behavioral2/memory/4380-2045-0x00007FF6CE600000-0x00007FF6CE954000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JkDuomh.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\DUYRChz.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\SUfMSzn.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\sXfTYmL.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\beGVuLq.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\AAwGydH.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\LvRTXKo.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\NqpMjzI.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\lIAzuhd.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\IWOyzdT.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\GVfmRfN.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\gwkyPmF.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\TGLOflY.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\nKbHGAV.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\uiYlHXR.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\hCFVgFX.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\cdouRrH.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\PSVifil.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\LJohcGE.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\hvjYbmp.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\aAbcIJW.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\TlsrKrD.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\fFdCYxS.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\lcducEi.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\YHclIGR.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\jazbGJm.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\bCNfHWJ.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\yTUGooL.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\SwGlcyN.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\eUlCkqZ.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\pQXGbXX.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\GNKGGzi.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\ufrOnhZ.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\odXmPmr.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\yYQBirq.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\cqaIhnF.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\LSEZRtX.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\KRzIPTq.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\HXaIVxN.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\TohPOAg.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\wvilaDB.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\epoxPvY.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\gfoNtcC.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\lcRrgLY.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\SVBJRWd.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\dSqhgHB.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\CGvHXTy.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\PRSiWXG.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\nfLDxOI.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\hGLLUzr.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\XWiItfd.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\CNBFSnA.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\RySPkJd.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\qUQDGbI.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\aGUXKUq.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\aJzNOHV.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\OBYxFXN.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\XKiHRSe.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\aDmXZsE.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\hYUwXOE.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\eJNukvR.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\BJZJiow.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\OtmVnXB.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
File created	C:\Windows\System\WMIxtIf.exe	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4036	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	93
PID 2332 wrote to memory of 4036	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	93
PID 2332 wrote to memory of 2824	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	94
PID 2332 wrote to memory of 2824	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	94
PID 2332 wrote to memory of 884	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	95
PID 2332 wrote to memory of 884	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	95
PID 2332 wrote to memory of 4380	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	96
PID 2332 wrote to memory of 4380	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	96
PID 2332 wrote to memory of 3560	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	97
PID 2332 wrote to memory of 3560	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	97
PID 2332 wrote to memory of 216	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	98
PID 2332 wrote to memory of 216	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	98
PID 2332 wrote to memory of 2260	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	99
PID 2332 wrote to memory of 2260	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	99
PID 2332 wrote to memory of 4184	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	100
PID 2332 wrote to memory of 4184	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	100
PID 2332 wrote to memory of 3028	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	101
PID 2332 wrote to memory of 3028	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	101
PID 2332 wrote to memory of 744	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	102
PID 2332 wrote to memory of 744	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	102
PID 2332 wrote to memory of 3852	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	103
PID 2332 wrote to memory of 3852	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	103
PID 2332 wrote to memory of 1264	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	104
PID 2332 wrote to memory of 1264	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	104
PID 2332 wrote to memory of 2132	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	105
PID 2332 wrote to memory of 2132	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	105
PID 2332 wrote to memory of 4556	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	106
PID 2332 wrote to memory of 4556	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	106
PID 2332 wrote to memory of 2072	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	107
PID 2332 wrote to memory of 2072	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	107
PID 2332 wrote to memory of 3984	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	108
PID 2332 wrote to memory of 3984	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	108
PID 2332 wrote to memory of 712	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	109
PID 2332 wrote to memory of 712	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	109
PID 2332 wrote to memory of 436	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	110
PID 2332 wrote to memory of 436	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	110
PID 2332 wrote to memory of 3752	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	111
PID 2332 wrote to memory of 3752	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	111
PID 2332 wrote to memory of 3460	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	112
PID 2332 wrote to memory of 3460	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	112
PID 2332 wrote to memory of 2356	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	113
PID 2332 wrote to memory of 2356	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	113
PID 2332 wrote to memory of 2316	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	114
PID 2332 wrote to memory of 2316	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	114
PID 2332 wrote to memory of 4840	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	115
PID 2332 wrote to memory of 4840	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	115
PID 2332 wrote to memory of 1980	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	116
PID 2332 wrote to memory of 1980	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	116
PID 2332 wrote to memory of 2040	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	117
PID 2332 wrote to memory of 2040	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	117
PID 2332 wrote to memory of 2408	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	118
PID 2332 wrote to memory of 2408	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	118
PID 2332 wrote to memory of 2864	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	119
PID 2332 wrote to memory of 2864	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	119
PID 2332 wrote to memory of 948	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	120
PID 2332 wrote to memory of 948	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	120
PID 2332 wrote to memory of 4912	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	121
PID 2332 wrote to memory of 4912	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	121
PID 2332 wrote to memory of 3968	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	122
PID 2332 wrote to memory of 3968	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	122
PID 2332 wrote to memory of 3544	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	123
PID 2332 wrote to memory of 3544	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	123
PID 2332 wrote to memory of 4396	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	124
PID 2332 wrote to memory of 4396	2332	64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\64e92f320f9b0969bd22c914ad1884a6165dae0335b3ed81b2207d62c96ad474_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System\LPvSazK.exe
  C:\Windows\System\LPvSazK.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\OtQggOC.exe
  C:\Windows\System\OtQggOC.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\bmVUwaw.exe
  C:\Windows\System\bmVUwaw.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\stiBpky.exe
  C:\Windows\System\stiBpky.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\MRzQTBg.exe
  C:\Windows\System\MRzQTBg.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\acxuvyl.exe
  C:\Windows\System\acxuvyl.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\xxTSGRU.exe
  C:\Windows\System\xxTSGRU.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\OAQkcaD.exe
  C:\Windows\System\OAQkcaD.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\cixlWxB.exe
  C:\Windows\System\cixlWxB.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\epzLyLG.exe
  C:\Windows\System\epzLyLG.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\kVzhhjq.exe
  C:\Windows\System\kVzhhjq.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\odXmPmr.exe
  C:\Windows\System\odXmPmr.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\PePNlhr.exe
  C:\Windows\System\PePNlhr.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\fMWSwGW.exe
  C:\Windows\System\fMWSwGW.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\TpQQHwX.exe
  C:\Windows\System\TpQQHwX.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\ShWrlkY.exe
  C:\Windows\System\ShWrlkY.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\BdMqwWc.exe
  C:\Windows\System\BdMqwWc.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\ykxwgKw.exe
  C:\Windows\System\ykxwgKw.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\rVuQNhq.exe
  C:\Windows\System\rVuQNhq.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\HEqYLVG.exe
  C:\Windows\System\HEqYLVG.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\cqaIhnF.exe
  C:\Windows\System\cqaIhnF.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\BOZxxyJ.exe
  C:\Windows\System\BOZxxyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\swKHLtb.exe
  C:\Windows\System\swKHLtb.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\bhdniNv.exe
  C:\Windows\System\bhdniNv.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\BWDmUIk.exe
  C:\Windows\System\BWDmUIk.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\aWeBMAc.exe
  C:\Windows\System\aWeBMAc.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\erNWoee.exe
  C:\Windows\System\erNWoee.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\DqxrjZo.exe
  C:\Windows\System\DqxrjZo.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\ceubTnH.exe
  C:\Windows\System\ceubTnH.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\dEQbjCy.exe
  C:\Windows\System\dEQbjCy.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\TlsrKrD.exe
  C:\Windows\System\TlsrKrD.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\dIAHgzI.exe
  C:\Windows\System\dIAHgzI.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\qOpcZOF.exe
  C:\Windows\System\qOpcZOF.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\MuOdkZu.exe
  C:\Windows\System\MuOdkZu.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\taRRgiR.exe
  C:\Windows\System\taRRgiR.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\gpNdKmF.exe
  C:\Windows\System\gpNdKmF.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\pidGotX.exe
  C:\Windows\System\pidGotX.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\tCDUlDX.exe
  C:\Windows\System\tCDUlDX.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\QgoBjNA.exe
  C:\Windows\System\QgoBjNA.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\BJZJiow.exe
  C:\Windows\System\BJZJiow.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\bHBiHyT.exe
  C:\Windows\System\bHBiHyT.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\GBFoXoP.exe
  C:\Windows\System\GBFoXoP.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\BjGiYrQ.exe
  C:\Windows\System\BjGiYrQ.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\ndoYEmB.exe
  C:\Windows\System\ndoYEmB.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\vfhvdlq.exe
  C:\Windows\System\vfhvdlq.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\sMvRGZJ.exe
  C:\Windows\System\sMvRGZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\UkVTNUN.exe
  C:\Windows\System\UkVTNUN.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\mQcFzDx.exe
  C:\Windows\System\mQcFzDx.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\MSPRmwY.exe
  C:\Windows\System\MSPRmwY.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\DJocFml.exe
  C:\Windows\System\DJocFml.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\RSIVaUW.exe
  C:\Windows\System\RSIVaUW.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\RwHSgYr.exe
  C:\Windows\System\RwHSgYr.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\pCHtMoT.exe
  C:\Windows\System\pCHtMoT.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\sPvzOfw.exe
  C:\Windows\System\sPvzOfw.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\WmnmalP.exe
  C:\Windows\System\WmnmalP.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\URkDxkx.exe
  C:\Windows\System\URkDxkx.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\NERysvs.exe
  C:\Windows\System\NERysvs.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\BvWImDS.exe
  C:\Windows\System\BvWImDS.exe
  2⤵
  - Executes dropped EXE
  PID:5248
- C:\Windows\System\ibmREiJ.exe
  C:\Windows\System\ibmREiJ.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\DDHhjXo.exe
  C:\Windows\System\DDHhjXo.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\jCWLTPo.exe
  C:\Windows\System\jCWLTPo.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\xbhzilN.exe
  C:\Windows\System\xbhzilN.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\RjbGubz.exe
  C:\Windows\System\RjbGubz.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\pSJcRel.exe
  C:\Windows\System\pSJcRel.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\CGGVyMH.exe
  C:\Windows\System\CGGVyMH.exe
  2⤵
  PID:5388
- C:\Windows\System\ZbvaLmP.exe
  C:\Windows\System\ZbvaLmP.exe
  2⤵
  PID:5408
- C:\Windows\System\ZOwubtj.exe
  C:\Windows\System\ZOwubtj.exe
  2⤵
  PID:5432
- C:\Windows\System\HLLqmFT.exe
  C:\Windows\System\HLLqmFT.exe
  2⤵
  PID:5512
- C:\Windows\System\jyOsqMG.exe
  C:\Windows\System\jyOsqMG.exe
  2⤵
  PID:5532
- C:\Windows\System\DiPHagA.exe
  C:\Windows\System\DiPHagA.exe
  2⤵
  PID:5552
- C:\Windows\System\IMocLon.exe
  C:\Windows\System\IMocLon.exe
  2⤵
  PID:5568
- C:\Windows\System\xkIsWKH.exe
  C:\Windows\System\xkIsWKH.exe
  2⤵
  PID:5712
- C:\Windows\System\piRRDEW.exe
  C:\Windows\System\piRRDEW.exe
  2⤵
  PID:5784
- C:\Windows\System\SWkKYLU.exe
  C:\Windows\System\SWkKYLU.exe
  2⤵
  PID:5800
- C:\Windows\System\XbUmlOo.exe
  C:\Windows\System\XbUmlOo.exe
  2⤵
  PID:5816
- C:\Windows\System\sfyoadi.exe
  C:\Windows\System\sfyoadi.exe
  2⤵
  PID:5832
- C:\Windows\System\SUcczuu.exe
  C:\Windows\System\SUcczuu.exe
  2⤵
  PID:5848
- C:\Windows\System\ELEHfFp.exe
  C:\Windows\System\ELEHfFp.exe
  2⤵
  PID:5864
- C:\Windows\System\iTsWXvx.exe
  C:\Windows\System\iTsWXvx.exe
  2⤵
  PID:5880
- C:\Windows\System\VIvhlOU.exe
  C:\Windows\System\VIvhlOU.exe
  2⤵
  PID:5896
- C:\Windows\System\neEMkAN.exe
  C:\Windows\System\neEMkAN.exe
  2⤵
  PID:5912
- C:\Windows\System\ZEtvwCS.exe
  C:\Windows\System\ZEtvwCS.exe
  2⤵
  PID:5948
- C:\Windows\System\eIXtGrF.exe
  C:\Windows\System\eIXtGrF.exe
  2⤵
  PID:5968
- C:\Windows\System\MqhTNJK.exe
  C:\Windows\System\MqhTNJK.exe
  2⤵
  PID:6012
- C:\Windows\System\dbZEfgH.exe
  C:\Windows\System\dbZEfgH.exe
  2⤵
  PID:6028
- C:\Windows\System\ULzQwlc.exe
  C:\Windows\System\ULzQwlc.exe
  2⤵
  PID:6044
- C:\Windows\System\XPJckSw.exe
  C:\Windows\System\XPJckSw.exe
  2⤵
  PID:6060
- C:\Windows\System\JBeUsJw.exe
  C:\Windows\System\JBeUsJw.exe
  2⤵
  PID:6076
- C:\Windows\System\OtJXVJP.exe
  C:\Windows\System\OtJXVJP.exe
  2⤵
  PID:6092
- C:\Windows\System\mQFybos.exe
  C:\Windows\System\mQFybos.exe
  2⤵
  PID:6108
- C:\Windows\System\uHEFYBO.exe
  C:\Windows\System\uHEFYBO.exe
  2⤵
  PID:6124
- C:\Windows\System\SXqVuey.exe
  C:\Windows\System\SXqVuey.exe
  2⤵
  PID:6140
- C:\Windows\System\DYrHxEM.exe
  C:\Windows\System\DYrHxEM.exe
  2⤵
  PID:3820
- C:\Windows\System\aGUXKUq.exe
  C:\Windows\System\aGUXKUq.exe
  2⤵
  PID:5172
- C:\Windows\System\GyxnlvS.exe
  C:\Windows\System\GyxnlvS.exe
  2⤵
  PID:5204
- C:\Windows\System\LHpYofV.exe
  C:\Windows\System\LHpYofV.exe
  2⤵
  PID:5228
- C:\Windows\System\ZILACDV.exe
  C:\Windows\System\ZILACDV.exe
  2⤵
  PID:5860
- C:\Windows\System\tYVAuak.exe
  C:\Windows\System\tYVAuak.exe
  2⤵
  PID:6084
- C:\Windows\System\DiTnRTl.exe
  C:\Windows\System\DiTnRTl.exe
  2⤵
  PID:5892
- C:\Windows\System\EyUKMke.exe
  C:\Windows\System\EyUKMke.exe
  2⤵
  PID:6116
- C:\Windows\System\qmRxXLk.exe
  C:\Windows\System\qmRxXLk.exe
  2⤵
  PID:5888
- C:\Windows\System\aYsglFZ.exe
  C:\Windows\System\aYsglFZ.exe
  2⤵
  PID:5824
- C:\Windows\System\lIWAHxR.exe
  C:\Windows\System\lIWAHxR.exe
  2⤵
  PID:5976
- C:\Windows\System\BIBNbJw.exe
  C:\Windows\System\BIBNbJw.exe
  2⤵
  PID:5996
- C:\Windows\System\nDKsOTW.exe
  C:\Windows\System\nDKsOTW.exe
  2⤵
  PID:6056
- C:\Windows\System\hHDhafj.exe
  C:\Windows\System\hHDhafj.exe
  2⤵
  PID:6120
- C:\Windows\System\TiNZzZt.exe
  C:\Windows\System\TiNZzZt.exe
  2⤵
  PID:2984
- C:\Windows\System\NVIkCnr.exe
  C:\Windows\System\NVIkCnr.exe
  2⤵
  PID:5128
- C:\Windows\System\YheaZby.exe
  C:\Windows\System\YheaZby.exe
  2⤵
  PID:5212
- C:\Windows\System\YMyrIjm.exe
  C:\Windows\System\YMyrIjm.exe
  2⤵
  PID:2152
- C:\Windows\System\URwwtfn.exe
  C:\Windows\System\URwwtfn.exe
  2⤵
  PID:1588
- C:\Windows\System\sNLdMkl.exe
  C:\Windows\System\sNLdMkl.exe
  2⤵
  PID:3636
- C:\Windows\System\bCNfHWJ.exe
  C:\Windows\System\bCNfHWJ.exe
  2⤵
  PID:4700
- C:\Windows\System\TcYEgjM.exe
  C:\Windows\System\TcYEgjM.exe
  2⤵
  PID:5060
- C:\Windows\System\hFJeKaC.exe
  C:\Windows\System\hFJeKaC.exe
  2⤵
  PID:3668
- C:\Windows\System\WxpHTwX.exe
  C:\Windows\System\WxpHTwX.exe
  2⤵
  PID:5840
- C:\Windows\System\NlIUaAY.exe
  C:\Windows\System\NlIUaAY.exe
  2⤵
  PID:5032
- C:\Windows\System\IfBCWuT.exe
  C:\Windows\System\IfBCWuT.exe
  2⤵
  PID:5808
- C:\Windows\System\EaOVPgR.exe
  C:\Windows\System\EaOVPgR.exe
  2⤵
  PID:3588
- C:\Windows\System\AmEFOxv.exe
  C:\Windows\System\AmEFOxv.exe
  2⤵
  PID:4660
- C:\Windows\System\NMjMAqp.exe
  C:\Windows\System\NMjMAqp.exe
  2⤵
  PID:4628
- C:\Windows\System\loOfqPx.exe
  C:\Windows\System\loOfqPx.exe
  2⤵
  PID:5028
- C:\Windows\System\JZTXsQl.exe
  C:\Windows\System\JZTXsQl.exe
  2⤵
  PID:400
- C:\Windows\System\lStcVOc.exe
  C:\Windows\System\lStcVOc.exe
  2⤵
  PID:6136
- C:\Windows\System\flHQcRi.exe
  C:\Windows\System\flHQcRi.exe
  2⤵
  PID:5244
- C:\Windows\System\hCFVgFX.exe
  C:\Windows\System\hCFVgFX.exe
  2⤵
  PID:404
- C:\Windows\System\wvilaDB.exe
  C:\Windows\System\wvilaDB.exe
  2⤵
  PID:4964
- C:\Windows\System\qLcoBVx.exe
  C:\Windows\System\qLcoBVx.exe
  2⤵
  PID:3664
- C:\Windows\System\qDfYRBL.exe
  C:\Windows\System\qDfYRBL.exe
  2⤵
  PID:4908
- C:\Windows\System\TVaNwph.exe
  C:\Windows\System\TVaNwph.exe
  2⤵
  PID:5924
- C:\Windows\System\dOeQiHY.exe
  C:\Windows\System\dOeQiHY.exe
  2⤵
  PID:1560
- C:\Windows\System\TPJjxyM.exe
  C:\Windows\System\TPJjxyM.exe
  2⤵
  PID:3268
- C:\Windows\System\QogNqRd.exe
  C:\Windows\System\QogNqRd.exe
  2⤵
  PID:492
- C:\Windows\System\DbXbPyy.exe
  C:\Windows\System\DbXbPyy.exe
  2⤵
  PID:5768
- C:\Windows\System\vJGdiWp.exe
  C:\Windows\System\vJGdiWp.exe
  2⤵
  PID:6040
- C:\Windows\System\GvkktxM.exe
  C:\Windows\System\GvkktxM.exe
  2⤵
  PID:1252
- C:\Windows\System\ETPpCPT.exe
  C:\Windows\System\ETPpCPT.exe
  2⤵
  PID:3436
- C:\Windows\System\EKAFrNs.exe
  C:\Windows\System\EKAFrNs.exe
  2⤵
  PID:5748
- C:\Windows\System\ZVBwYSE.exe
  C:\Windows\System\ZVBwYSE.exe
  2⤵
  PID:6168
- C:\Windows\System\rfLhHQm.exe
  C:\Windows\System\rfLhHQm.exe
  2⤵
  PID:6188
- C:\Windows\System\JCAEfyP.exe
  C:\Windows\System\JCAEfyP.exe
  2⤵
  PID:6216
- C:\Windows\System\DvcDsRb.exe
  C:\Windows\System\DvcDsRb.exe
  2⤵
  PID:6244
- C:\Windows\System\CHFqcam.exe
  C:\Windows\System\CHFqcam.exe
  2⤵
  PID:6272
- C:\Windows\System\bLnrnpi.exe
  C:\Windows\System\bLnrnpi.exe
  2⤵
  PID:6304
- C:\Windows\System\OllqeNG.exe
  C:\Windows\System\OllqeNG.exe
  2⤵
  PID:6332
- C:\Windows\System\uzNEMkd.exe
  C:\Windows\System\uzNEMkd.exe
  2⤵
  PID:6364
- C:\Windows\System\gwkyPmF.exe
  C:\Windows\System\gwkyPmF.exe
  2⤵
  PID:6440
- C:\Windows\System\dbCgOKe.exe
  C:\Windows\System\dbCgOKe.exe
  2⤵
  PID:6464
- C:\Windows\System\dInJWMW.exe
  C:\Windows\System\dInJWMW.exe
  2⤵
  PID:6488
- C:\Windows\System\gWwThxg.exe
  C:\Windows\System\gWwThxg.exe
  2⤵
  PID:6504
- C:\Windows\System\bnQlMvM.exe
  C:\Windows\System\bnQlMvM.exe
  2⤵
  PID:6532
- C:\Windows\System\KCyufnX.exe
  C:\Windows\System\KCyufnX.exe
  2⤵
  PID:6556
- C:\Windows\System\ZnPyxiP.exe
  C:\Windows\System\ZnPyxiP.exe
  2⤵
  PID:6588
- C:\Windows\System\RzPzUbS.exe
  C:\Windows\System\RzPzUbS.exe
  2⤵
  PID:6612
- C:\Windows\System\NreOZTc.exe
  C:\Windows\System\NreOZTc.exe
  2⤵
  PID:6648
- C:\Windows\System\yTUGooL.exe
  C:\Windows\System\yTUGooL.exe
  2⤵
  PID:6680
- C:\Windows\System\ZklgpHm.exe
  C:\Windows\System\ZklgpHm.exe
  2⤵
  PID:6712
- C:\Windows\System\luJrgZH.exe
  C:\Windows\System\luJrgZH.exe
  2⤵
  PID:6752
- C:\Windows\System\ZBuqivN.exe
  C:\Windows\System\ZBuqivN.exe
  2⤵
  PID:6788
- C:\Windows\System\TuJIQBg.exe
  C:\Windows\System\TuJIQBg.exe
  2⤵
  PID:6808
- C:\Windows\System\SHqOCjt.exe
  C:\Windows\System\SHqOCjt.exe
  2⤵
  PID:6840
- C:\Windows\System\YWbjFGb.exe
  C:\Windows\System\YWbjFGb.exe
  2⤵
  PID:6864
- C:\Windows\System\duxZber.exe
  C:\Windows\System\duxZber.exe
  2⤵
  PID:6884
- C:\Windows\System\wNFaplH.exe
  C:\Windows\System\wNFaplH.exe
  2⤵
  PID:6912
- C:\Windows\System\LBSkroJ.exe
  C:\Windows\System\LBSkroJ.exe
  2⤵
  PID:6940
- C:\Windows\System\nfucAcP.exe
  C:\Windows\System\nfucAcP.exe
  2⤵
  PID:6964
- C:\Windows\System\HDtbeGd.exe
  C:\Windows\System\HDtbeGd.exe
  2⤵
  PID:6996
- C:\Windows\System\EYEicda.exe
  C:\Windows\System\EYEicda.exe
  2⤵
  PID:7032
- C:\Windows\System\XScVFgV.exe
  C:\Windows\System\XScVFgV.exe
  2⤵
  PID:7068
- C:\Windows\System\LSFrJcS.exe
  C:\Windows\System\LSFrJcS.exe
  2⤵
  PID:7092
- C:\Windows\System\xSECwZn.exe
  C:\Windows\System\xSECwZn.exe
  2⤵
  PID:7116
- C:\Windows\System\TmVDqsQ.exe
  C:\Windows\System\TmVDqsQ.exe
  2⤵
  PID:7148
- C:\Windows\System\QbqqfrY.exe
  C:\Windows\System\QbqqfrY.exe
  2⤵
  PID:464
- C:\Windows\System\VtGZwlu.exe
  C:\Windows\System\VtGZwlu.exe
  2⤵
  PID:3112
- C:\Windows\System\ApoUECk.exe
  C:\Windows\System\ApoUECk.exe
  2⤵
  PID:6212
- C:\Windows\System\lOZXGfq.exe
  C:\Windows\System\lOZXGfq.exe
  2⤵
  PID:6284
- C:\Windows\System\GoBsSfZ.exe
  C:\Windows\System\GoBsSfZ.exe
  2⤵
  PID:6236
- C:\Windows\System\aMwNWus.exe
  C:\Windows\System\aMwNWus.exe
  2⤵
  PID:6392
- C:\Windows\System\QkCNGXX.exe
  C:\Windows\System\QkCNGXX.exe
  2⤵
  PID:6436
- C:\Windows\System\DUYRChz.exe
  C:\Windows\System\DUYRChz.exe
  2⤵
  PID:6496
- C:\Windows\System\BoAUyfK.exe
  C:\Windows\System\BoAUyfK.exe
  2⤵
  PID:6528
- C:\Windows\System\JdgolmG.exe
  C:\Windows\System\JdgolmG.exe
  2⤵
  PID:6644
- C:\Windows\System\SUfMSzn.exe
  C:\Windows\System\SUfMSzn.exe
  2⤵
  PID:2140
- C:\Windows\System\TagDQsH.exe
  C:\Windows\System\TagDQsH.exe
  2⤵
  PID:6696
- C:\Windows\System\yOHhcOa.exe
  C:\Windows\System\yOHhcOa.exe
  2⤵
  PID:6780
- C:\Windows\System\nJCbPMa.exe
  C:\Windows\System\nJCbPMa.exe
  2⤵
  PID:6872
- C:\Windows\System\IfXaKxu.exe
  C:\Windows\System\IfXaKxu.exe
  2⤵
  PID:6852
- C:\Windows\System\TPwbTyz.exe
  C:\Windows\System\TPwbTyz.exe
  2⤵
  PID:6976
- C:\Windows\System\GIoCalt.exe
  C:\Windows\System\GIoCalt.exe
  2⤵
  PID:6988
- C:\Windows\System\erLWxBl.exe
  C:\Windows\System\erLWxBl.exe
  2⤵
  PID:5168
- C:\Windows\System\wpucpvE.exe
  C:\Windows\System\wpucpvE.exe
  2⤵
  PID:7124
- C:\Windows\System\RYGmCbi.exe
  C:\Windows\System\RYGmCbi.exe
  2⤵
  PID:6260
- C:\Windows\System\rhNmSSv.exe
  C:\Windows\System\rhNmSSv.exe
  2⤵
  PID:6228
- C:\Windows\System\DjJyhiB.exe
  C:\Windows\System\DjJyhiB.exe
  2⤵
  PID:6572
- C:\Windows\System\YaMLOXW.exe
  C:\Windows\System\YaMLOXW.exe
  2⤵
  PID:6548
- C:\Windows\System\QspDfoV.exe
  C:\Windows\System\QspDfoV.exe
  2⤵
  PID:1260
- C:\Windows\System\HBqjCgW.exe
  C:\Windows\System\HBqjCgW.exe
  2⤵
  PID:6820
- C:\Windows\System\BtBikJk.exe
  C:\Windows\System\BtBikJk.exe
  2⤵
  PID:6800
- C:\Windows\System\UZClgpX.exe
  C:\Windows\System\UZClgpX.exe
  2⤵
  PID:7088
- C:\Windows\System\CqLWpST.exe
  C:\Windows\System\CqLWpST.exe
  2⤵
  PID:4208
- C:\Windows\System\GXCMoeg.exe
  C:\Windows\System\GXCMoeg.exe
  2⤵
  PID:6676
- C:\Windows\System\FzbqrRt.exe
  C:\Windows\System\FzbqrRt.exe
  2⤵
  PID:7172
- C:\Windows\System\GzNsFOu.exe
  C:\Windows\System\GzNsFOu.exe
  2⤵
  PID:7200
- C:\Windows\System\gxlyXsB.exe
  C:\Windows\System\gxlyXsB.exe
  2⤵
  PID:7224
- C:\Windows\System\JVcRqve.exe
  C:\Windows\System\JVcRqve.exe
  2⤵
  PID:7256
- C:\Windows\System\amFmkph.exe
  C:\Windows\System\amFmkph.exe
  2⤵
  PID:7284
- C:\Windows\System\LSEZRtX.exe
  C:\Windows\System\LSEZRtX.exe
  2⤵
  PID:7320
- C:\Windows\System\HyrbpjS.exe
  C:\Windows\System\HyrbpjS.exe
  2⤵
  PID:7348
- C:\Windows\System\efriXbP.exe
  C:\Windows\System\efriXbP.exe
  2⤵
  PID:7376
- C:\Windows\System\umsVmom.exe
  C:\Windows\System\umsVmom.exe
  2⤵
  PID:7404
- C:\Windows\System\ljxtSsb.exe
  C:\Windows\System\ljxtSsb.exe
  2⤵
  PID:7436
- C:\Windows\System\adgdmeC.exe
  C:\Windows\System\adgdmeC.exe
  2⤵
  PID:7464
- C:\Windows\System\wSpYCOs.exe
  C:\Windows\System\wSpYCOs.exe
  2⤵
  PID:7492
- C:\Windows\System\JTBVBAW.exe
  C:\Windows\System\JTBVBAW.exe
  2⤵
  PID:7520
- C:\Windows\System\cumdrME.exe
  C:\Windows\System\cumdrME.exe
  2⤵
  PID:7552
- C:\Windows\System\mSOhHUr.exe
  C:\Windows\System\mSOhHUr.exe
  2⤵
  PID:7580
- C:\Windows\System\oOkhsoJ.exe
  C:\Windows\System\oOkhsoJ.exe
  2⤵
  PID:7600
- C:\Windows\System\TBMCFbV.exe
  C:\Windows\System\TBMCFbV.exe
  2⤵
  PID:7632
- C:\Windows\System\OfRDjWM.exe
  C:\Windows\System\OfRDjWM.exe
  2⤵
  PID:7656
- C:\Windows\System\HlULZBw.exe
  C:\Windows\System\HlULZBw.exe
  2⤵
  PID:7684
- C:\Windows\System\RnlGgvO.exe
  C:\Windows\System\RnlGgvO.exe
  2⤵
  PID:7708
- C:\Windows\System\cwoCpnX.exe
  C:\Windows\System\cwoCpnX.exe
  2⤵
  PID:7744
- C:\Windows\System\tieIDYD.exe
  C:\Windows\System\tieIDYD.exe
  2⤵
  PID:7768
- C:\Windows\System\tOtERSk.exe
  C:\Windows\System\tOtERSk.exe
  2⤵
  PID:7800
- C:\Windows\System\SZLbYoU.exe
  C:\Windows\System\SZLbYoU.exe
  2⤵
  PID:7828
- C:\Windows\System\yZuQUkz.exe
  C:\Windows\System\yZuQUkz.exe
  2⤵
  PID:7856
- C:\Windows\System\xCClhXu.exe
  C:\Windows\System\xCClhXu.exe
  2⤵
  PID:7896
- C:\Windows\System\NOYucDL.exe
  C:\Windows\System\NOYucDL.exe
  2⤵
  PID:7936
- C:\Windows\System\SwGlcyN.exe
  C:\Windows\System\SwGlcyN.exe
  2⤵
  PID:7972
- C:\Windows\System\pNnaWeF.exe
  C:\Windows\System\pNnaWeF.exe
  2⤵
  PID:7996
- C:\Windows\System\KnmlTvV.exe
  C:\Windows\System\KnmlTvV.exe
  2⤵
  PID:8024
- C:\Windows\System\tvTNanu.exe
  C:\Windows\System\tvTNanu.exe
  2⤵
  PID:8052
- C:\Windows\System\xbgayqQ.exe
  C:\Windows\System\xbgayqQ.exe
  2⤵
  PID:8076
- C:\Windows\System\nRbClPq.exe
  C:\Windows\System\nRbClPq.exe
  2⤵
  PID:8100
- C:\Windows\System\lruQYvf.exe
  C:\Windows\System\lruQYvf.exe
  2⤵
  PID:8132
- C:\Windows\System\adsROOZ.exe
  C:\Windows\System\adsROOZ.exe
  2⤵
  PID:8156
- C:\Windows\System\qGBkthg.exe
  C:\Windows\System\qGBkthg.exe
  2⤵
  PID:8188
- C:\Windows\System\eJdazOm.exe
  C:\Windows\System\eJdazOm.exe
  2⤵
  PID:4896
- C:\Windows\System\JGuGatJ.exe
  C:\Windows\System\JGuGatJ.exe
  2⤵
  PID:6256
- C:\Windows\System\oAyVsQo.exe
  C:\Windows\System\oAyVsQo.exe
  2⤵
  PID:7244
- C:\Windows\System\uBTAJlC.exe
  C:\Windows\System\uBTAJlC.exe
  2⤵
  PID:7212
- C:\Windows\System\nvDTeHG.exe
  C:\Windows\System\nvDTeHG.exe
  2⤵
  PID:7372
- C:\Windows\System\KwKEKVB.exe
  C:\Windows\System\KwKEKVB.exe
  2⤵
  PID:7344
- C:\Windows\System\puJxPiy.exe
  C:\Windows\System\puJxPiy.exe
  2⤵
  PID:7460
- C:\Windows\System\ygcJyEe.exe
  C:\Windows\System\ygcJyEe.exe
  2⤵
  PID:7532
- C:\Windows\System\uBUVixx.exe
  C:\Windows\System\uBUVixx.exe
  2⤵
  PID:7572
- C:\Windows\System\ZkhFESN.exe
  C:\Windows\System\ZkhFESN.exe
  2⤵
  PID:7560
- C:\Windows\System\MKsfWuE.exe
  C:\Windows\System\MKsfWuE.exe
  2⤵
  PID:7720
- C:\Windows\System\vSMidpD.exe
  C:\Windows\System\vSMidpD.exe
  2⤵
  PID:7764
- C:\Windows\System\UltBkoM.exe
  C:\Windows\System\UltBkoM.exe
  2⤵
  PID:7792
- C:\Windows\System\IdvSAwI.exe
  C:\Windows\System\IdvSAwI.exe
  2⤵
  PID:7928
- C:\Windows\System\iSoNbBS.exe
  C:\Windows\System\iSoNbBS.exe
  2⤵
  PID:7984
- C:\Windows\System\MgtgUTG.exe
  C:\Windows\System\MgtgUTG.exe
  2⤵
  PID:8004
- C:\Windows\System\XeDfZdr.exe
  C:\Windows\System\XeDfZdr.exe
  2⤵
  PID:8148
- C:\Windows\System\kxJOLsm.exe
  C:\Windows\System\kxJOLsm.exe
  2⤵
  PID:8096
- C:\Windows\System\vSrpvyq.exe
  C:\Windows\System\vSrpvyq.exe
  2⤵
  PID:7024
- C:\Windows\System\UiVGyHu.exe
  C:\Windows\System\UiVGyHu.exe
  2⤵
  PID:7428
- C:\Windows\System\OGfLOky.exe
  C:\Windows\System\OGfLOky.exe
  2⤵
  PID:6348
- C:\Windows\System\luRobVC.exe
  C:\Windows\System\luRobVC.exe
  2⤵
  PID:7624
- C:\Windows\System\hoiWXKp.exe
  C:\Windows\System\hoiWXKp.exe
  2⤵
  PID:7400
- C:\Windows\System\GTguntQ.exe
  C:\Windows\System\GTguntQ.exe
  2⤵
  PID:7736
- C:\Windows\System\riYkroW.exe
  C:\Windows\System\riYkroW.exe
  2⤵
  PID:7816
- C:\Windows\System\ZKIRkkB.exe
  C:\Windows\System\ZKIRkkB.exe
  2⤵
  PID:8088
- C:\Windows\System\hWtWxtj.exe
  C:\Windows\System\hWtWxtj.exe
  2⤵
  PID:8036
- C:\Windows\System\StLqEWd.exe
  C:\Windows\System\StLqEWd.exe
  2⤵
  PID:8140
- C:\Windows\System\RoHbgMQ.exe
  C:\Windows\System\RoHbgMQ.exe
  2⤵
  PID:7912
- C:\Windows\System\qZpoWHN.exe
  C:\Windows\System\qZpoWHN.exe
  2⤵
  PID:8220
- C:\Windows\System\FGtZGvE.exe
  C:\Windows\System\FGtZGvE.exe
  2⤵
  PID:8248
- C:\Windows\System\dXPrjSO.exe
  C:\Windows\System\dXPrjSO.exe
  2⤵
  PID:8272
- C:\Windows\System\xHMELBz.exe
  C:\Windows\System\xHMELBz.exe
  2⤵
  PID:8300
- C:\Windows\System\geZoAws.exe
  C:\Windows\System\geZoAws.exe
  2⤵
  PID:8328
- C:\Windows\System\OWrATfQ.exe
  C:\Windows\System\OWrATfQ.exe
  2⤵
  PID:8360
- C:\Windows\System\bCwiXiH.exe
  C:\Windows\System\bCwiXiH.exe
  2⤵
  PID:8380
- C:\Windows\System\ZGDIrjx.exe
  C:\Windows\System\ZGDIrjx.exe
  2⤵
  PID:8412
- C:\Windows\System\QeVlBbW.exe
  C:\Windows\System\QeVlBbW.exe
  2⤵
  PID:8436
- C:\Windows\System\VyMgkDV.exe
  C:\Windows\System\VyMgkDV.exe
  2⤵
  PID:8480
- C:\Windows\System\MDzTOCi.exe
  C:\Windows\System\MDzTOCi.exe
  2⤵
  PID:8500
- C:\Windows\System\efZCMMh.exe
  C:\Windows\System\efZCMMh.exe
  2⤵
  PID:8524
- C:\Windows\System\RoZIklv.exe
  C:\Windows\System\RoZIklv.exe
  2⤵
  PID:8548
- C:\Windows\System\IDSNTmJ.exe
  C:\Windows\System\IDSNTmJ.exe
  2⤵
  PID:8584
- C:\Windows\System\wLiLVNE.exe
  C:\Windows\System\wLiLVNE.exe
  2⤵
  PID:8608
- C:\Windows\System\DEpmOmn.exe
  C:\Windows\System\DEpmOmn.exe
  2⤵
  PID:8640
- C:\Windows\System\mHPeBAi.exe
  C:\Windows\System\mHPeBAi.exe
  2⤵
  PID:8664
- C:\Windows\System\UNduInt.exe
  C:\Windows\System\UNduInt.exe
  2⤵
  PID:8696
- C:\Windows\System\UKuFRqg.exe
  C:\Windows\System\UKuFRqg.exe
  2⤵
  PID:8720
- C:\Windows\System\kNpowxe.exe
  C:\Windows\System\kNpowxe.exe
  2⤵
  PID:8752
- C:\Windows\System\JBrNZUg.exe
  C:\Windows\System\JBrNZUg.exe
  2⤵
  PID:8784
- C:\Windows\System\HVAFHYK.exe
  C:\Windows\System\HVAFHYK.exe
  2⤵
  PID:8808
- C:\Windows\System\YtmgiWf.exe
  C:\Windows\System\YtmgiWf.exe
  2⤵
  PID:8836
- C:\Windows\System\yPwGUvB.exe
  C:\Windows\System\yPwGUvB.exe
  2⤵
  PID:8864
- C:\Windows\System\sXfTYmL.exe
  C:\Windows\System\sXfTYmL.exe
  2⤵
  PID:8888
- C:\Windows\System\fNgcSdz.exe
  C:\Windows\System\fNgcSdz.exe
  2⤵
  PID:9000
- C:\Windows\System\HcNaNGy.exe
  C:\Windows\System\HcNaNGy.exe
  2⤵
  PID:9040
- C:\Windows\System\olwUWNq.exe
  C:\Windows\System\olwUWNq.exe
  2⤵
  PID:9076
- C:\Windows\System\FyYKjAE.exe
  C:\Windows\System\FyYKjAE.exe
  2⤵
  PID:9096
- C:\Windows\System\NLipdzf.exe
  C:\Windows\System\NLipdzf.exe
  2⤵
  PID:9112
- C:\Windows\System\beGVuLq.exe
  C:\Windows\System\beGVuLq.exe
  2⤵
  PID:9132
- C:\Windows\System\WjECqUz.exe
  C:\Windows\System\WjECqUz.exe
  2⤵
  PID:8200
- C:\Windows\System\AnMPOgZ.exe
  C:\Windows\System\AnMPOgZ.exe
  2⤵
  PID:8124
- C:\Windows\System\RbZGEQW.exe
  C:\Windows\System\RbZGEQW.exe
  2⤵
  PID:8324
- C:\Windows\System\eUlCkqZ.exe
  C:\Windows\System\eUlCkqZ.exe
  2⤵
  PID:8376
- C:\Windows\System\ULkyhYl.exe
  C:\Windows\System\ULkyhYl.exe
  2⤵
  PID:8284
- C:\Windows\System\niKUixZ.exe
  C:\Windows\System\niKUixZ.exe
  2⤵
  PID:8460
- C:\Windows\System\epoxPvY.exe
  C:\Windows\System\epoxPvY.exe
  2⤵
  PID:8352
- C:\Windows\System\rruAFgG.exe
  C:\Windows\System\rruAFgG.exe
  2⤵
  PID:8496
- C:\Windows\System\DnKWaba.exe
  C:\Windows\System\DnKWaba.exe
  2⤵
  PID:8568
- C:\Windows\System\iXaAUay.exe
  C:\Windows\System\iXaAUay.exe
  2⤵
  PID:8544
- C:\Windows\System\EhokOTB.exe
  C:\Windows\System\EhokOTB.exe
  2⤵
  PID:8508
- C:\Windows\System\OgvrOfU.exe
  C:\Windows\System\OgvrOfU.exe
  2⤵
  PID:8512
- C:\Windows\System\DkXGWZX.exe
  C:\Windows\System\DkXGWZX.exe
  2⤵
  PID:6804
- C:\Windows\System\YOZOEhS.exe
  C:\Windows\System\YOZOEhS.exe
  2⤵
  PID:8712
- C:\Windows\System\nDEsohK.exe
  C:\Windows\System\nDEsohK.exe
  2⤵
  PID:8904
- C:\Windows\System\hNTlmAb.exe
  C:\Windows\System\hNTlmAb.exe
  2⤵
  PID:8908
- C:\Windows\System\cSQLWeg.exe
  C:\Windows\System\cSQLWeg.exe
  2⤵
  PID:9032
- C:\Windows\System\AjPDCwY.exe
  C:\Windows\System\AjPDCwY.exe
  2⤵
  PID:9108
- C:\Windows\System\RDiahxE.exe
  C:\Windows\System\RDiahxE.exe
  2⤵
  PID:9092
- C:\Windows\System\hXdELvU.exe
  C:\Windows\System\hXdELvU.exe
  2⤵
  PID:9180
- C:\Windows\System\NkEfcJN.exe
  C:\Windows\System\NkEfcJN.exe
  2⤵
  PID:7484
- C:\Windows\System\NDNPjwj.exe
  C:\Windows\System\NDNPjwj.exe
  2⤵
  PID:8432
- C:\Windows\System\gfoNtcC.exe
  C:\Windows\System\gfoNtcC.exe
  2⤵
  PID:8320
- C:\Windows\System\WZmeswF.exe
  C:\Windows\System\WZmeswF.exe
  2⤵
  PID:8576
- C:\Windows\System\cokVgpN.exe
  C:\Windows\System\cokVgpN.exe
  2⤵
  PID:8744
- C:\Windows\System\tPGqJis.exe
  C:\Windows\System\tPGqJis.exe
  2⤵
  PID:8828
- C:\Windows\System\vzhwvsR.exe
  C:\Windows\System\vzhwvsR.exe
  2⤵
  PID:9028
- C:\Windows\System\zwlCdNQ.exe
  C:\Windows\System\zwlCdNQ.exe
  2⤵
  PID:9008
- C:\Windows\System\iVxCoqT.exe
  C:\Windows\System\iVxCoqT.exe
  2⤵
  PID:3008
- C:\Windows\System\CGvHXTy.exe
  C:\Windows\System\CGvHXTy.exe
  2⤵
  PID:7540
- C:\Windows\System\eOIaCqy.exe
  C:\Windows\System\eOIaCqy.exe
  2⤵
  PID:8716
- C:\Windows\System\WNpbzpV.exe
  C:\Windows\System\WNpbzpV.exe
  2⤵
  PID:9228
- C:\Windows\System\DAGmxAk.exe
  C:\Windows\System\DAGmxAk.exe
  2⤵
  PID:9264
- C:\Windows\System\cvtqQmd.exe
  C:\Windows\System\cvtqQmd.exe
  2⤵
  PID:9296
- C:\Windows\System\KRzIPTq.exe
  C:\Windows\System\KRzIPTq.exe
  2⤵
  PID:9320
- C:\Windows\System\bBumwMU.exe
  C:\Windows\System\bBumwMU.exe
  2⤵
  PID:9352
- C:\Windows\System\xyFiEZF.exe
  C:\Windows\System\xyFiEZF.exe
  2⤵
  PID:9372
- C:\Windows\System\aJzNOHV.exe
  C:\Windows\System\aJzNOHV.exe
  2⤵
  PID:9392
- C:\Windows\System\PdCKWhb.exe
  C:\Windows\System\PdCKWhb.exe
  2⤵
  PID:9416
- C:\Windows\System\cAyhJof.exe
  C:\Windows\System\cAyhJof.exe
  2⤵
  PID:9440
- C:\Windows\System\CZSfmXt.exe
  C:\Windows\System\CZSfmXt.exe
  2⤵
  PID:9472
- C:\Windows\System\BWFCMBb.exe
  C:\Windows\System\BWFCMBb.exe
  2⤵
  PID:9492
- C:\Windows\System\UYGzFoT.exe
  C:\Windows\System\UYGzFoT.exe
  2⤵
  PID:9524
- C:\Windows\System\MhkYrwj.exe
  C:\Windows\System\MhkYrwj.exe
  2⤵
  PID:9552
- C:\Windows\System\tgmSlYj.exe
  C:\Windows\System\tgmSlYj.exe
  2⤵
  PID:9580
- C:\Windows\System\bbSeUiK.exe
  C:\Windows\System\bbSeUiK.exe
  2⤵
  PID:9612
- C:\Windows\System\lcRrgLY.exe
  C:\Windows\System\lcRrgLY.exe
  2⤵
  PID:9640
- C:\Windows\System\czKIcHW.exe
  C:\Windows\System\czKIcHW.exe
  2⤵
  PID:9656
- C:\Windows\System\KLeDEvN.exe
  C:\Windows\System\KLeDEvN.exe
  2⤵
  PID:9684
- C:\Windows\System\NEcmMkZ.exe
  C:\Windows\System\NEcmMkZ.exe
  2⤵
  PID:9704
- C:\Windows\System\uzMNegR.exe
  C:\Windows\System\uzMNegR.exe
  2⤵
  PID:9736
- C:\Windows\System\yGCymrj.exe
  C:\Windows\System\yGCymrj.exe
  2⤵
  PID:9764
- C:\Windows\System\wjrCCLO.exe
  C:\Windows\System\wjrCCLO.exe
  2⤵
  PID:9784
- C:\Windows\System\qSaubMO.exe
  C:\Windows\System\qSaubMO.exe
  2⤵
  PID:9816
- C:\Windows\System\nQvzdBa.exe
  C:\Windows\System\nQvzdBa.exe
  2⤵
  PID:9840
- C:\Windows\System\eLWTBnK.exe
  C:\Windows\System\eLWTBnK.exe
  2⤵
  PID:9864
- C:\Windows\System\FSlVsZh.exe
  C:\Windows\System\FSlVsZh.exe
  2⤵
  PID:9900
- C:\Windows\System\VrYBAcV.exe
  C:\Windows\System\VrYBAcV.exe
  2⤵
  PID:9920
- C:\Windows\System\FKGmaPS.exe
  C:\Windows\System\FKGmaPS.exe
  2⤵
  PID:9956
- C:\Windows\System\vExNLVd.exe
  C:\Windows\System\vExNLVd.exe
  2⤵
  PID:9988
- C:\Windows\System\bbkJVUr.exe
  C:\Windows\System\bbkJVUr.exe
  2⤵
  PID:10012
- C:\Windows\System\JLVulBP.exe
  C:\Windows\System\JLVulBP.exe
  2⤵
  PID:10044
- C:\Windows\System\cKkZMha.exe
  C:\Windows\System\cKkZMha.exe
  2⤵
  PID:10064
- C:\Windows\System\dnZkIxU.exe
  C:\Windows\System\dnZkIxU.exe
  2⤵
  PID:10092
- C:\Windows\System\ACEHcIH.exe
  C:\Windows\System\ACEHcIH.exe
  2⤵
  PID:10120
- C:\Windows\System\xrVvMOt.exe
  C:\Windows\System\xrVvMOt.exe
  2⤵
  PID:10144
- C:\Windows\System\BXLTUBm.exe
  C:\Windows\System\BXLTUBm.exe
  2⤵
  PID:10180
- C:\Windows\System\qvoerkH.exe
  C:\Windows\System\qvoerkH.exe
  2⤵
  PID:10200
- C:\Windows\System\OveVymZ.exe
  C:\Windows\System\OveVymZ.exe
  2⤵
  PID:10224
- C:\Windows\System\hMPSVgG.exe
  C:\Windows\System\hMPSVgG.exe
  2⤵
  PID:8656
- C:\Windows\System\TOddOwS.exe
  C:\Windows\System\TOddOwS.exe
  2⤵
  PID:8992
- C:\Windows\System\sUHmtKN.exe
  C:\Windows\System\sUHmtKN.exe
  2⤵
  PID:9332
- C:\Windows\System\CmEjLsv.exe
  C:\Windows\System\CmEjLsv.exe
  2⤵
  PID:9348
- C:\Windows\System\xHeaeFY.exe
  C:\Windows\System\xHeaeFY.exe
  2⤵
  PID:9312
- C:\Windows\System\LHsaYsP.exe
  C:\Windows\System\LHsaYsP.exe
  2⤵
  PID:9412
- C:\Windows\System\hjCSncL.exe
  C:\Windows\System\hjCSncL.exe
  2⤵
  PID:9572
- C:\Windows\System\WYPuNxp.exe
  C:\Windows\System\WYPuNxp.exe
  2⤵
  PID:9604
- C:\Windows\System\MCnGXAP.exe
  C:\Windows\System\MCnGXAP.exe
  2⤵
  PID:9436
- C:\Windows\System\pQXGbXX.exe
  C:\Windows\System\pQXGbXX.exe
  2⤵
  PID:9600
- C:\Windows\System\QxsQpID.exe
  C:\Windows\System\QxsQpID.exe
  2⤵
  PID:9776
- C:\Windows\System\OHbjdqu.exe
  C:\Windows\System\OHbjdqu.exe
  2⤵
  PID:9852
- C:\Windows\System\GNKGGzi.exe
  C:\Windows\System\GNKGGzi.exe
  2⤵
  PID:9912
- C:\Windows\System\hmqaTNT.exe
  C:\Windows\System\hmqaTNT.exe
  2⤵
  PID:9968
- C:\Windows\System\EDJRCpt.exe
  C:\Windows\System\EDJRCpt.exe
  2⤵
  PID:9932
- C:\Windows\System\cPDthdm.exe
  C:\Windows\System\cPDthdm.exe
  2⤵
  PID:9880
- C:\Windows\System\aDmXZsE.exe
  C:\Windows\System\aDmXZsE.exe
  2⤵
  PID:8240
- C:\Windows\System\vBhRMAM.exe
  C:\Windows\System\vBhRMAM.exe
  2⤵
  PID:10168
- C:\Windows\System\QORmlSz.exe
  C:\Windows\System\QORmlSz.exe
  2⤵
  PID:10068
- C:\Windows\System\cLKxHwO.exe
  C:\Windows\System\cLKxHwO.exe
  2⤵
  PID:10156
- C:\Windows\System\XMCsDUP.exe
  C:\Windows\System\XMCsDUP.exe
  2⤵
  PID:9280
- C:\Windows\System\VrytQyc.exe
  C:\Windows\System\VrytQyc.exe
  2⤵
  PID:10260
- C:\Windows\System\ueqgPnF.exe
  C:\Windows\System\ueqgPnF.exe
  2⤵
  PID:10292
- C:\Windows\System\eavuMZQ.exe
  C:\Windows\System\eavuMZQ.exe
  2⤵
  PID:10312
- C:\Windows\System\lwQVROn.exe
  C:\Windows\System\lwQVROn.exe
  2⤵
  PID:10340
- C:\Windows\System\eJWnPpN.exe
  C:\Windows\System\eJWnPpN.exe
  2⤵
  PID:10372
- C:\Windows\System\rzJLxJh.exe
  C:\Windows\System\rzJLxJh.exe
  2⤵
  PID:10396
- C:\Windows\System\opsOine.exe
  C:\Windows\System\opsOine.exe
  2⤵
  PID:10412
- C:\Windows\System\QGsAOPv.exe
  C:\Windows\System\QGsAOPv.exe
  2⤵
  PID:10436
- C:\Windows\System\BNuOXjU.exe
  C:\Windows\System\BNuOXjU.exe
  2⤵
  PID:10456
- C:\Windows\System\zkNWRjL.exe
  C:\Windows\System\zkNWRjL.exe
  2⤵
  PID:10480
- C:\Windows\System\ufrOnhZ.exe
  C:\Windows\System\ufrOnhZ.exe
  2⤵
  PID:10508
- C:\Windows\System\AafSmbl.exe
  C:\Windows\System\AafSmbl.exe
  2⤵
  PID:10528
- C:\Windows\System\zxUGOCn.exe
  C:\Windows\System\zxUGOCn.exe
  2⤵
  PID:10556
- C:\Windows\System\djZPNOy.exe
  C:\Windows\System\djZPNOy.exe
  2⤵
  PID:10572
- C:\Windows\System\GNUEdyH.exe
  C:\Windows\System\GNUEdyH.exe
  2⤵
  PID:10604
- C:\Windows\System\KFEUgRO.exe
  C:\Windows\System\KFEUgRO.exe
  2⤵
  PID:10628
- C:\Windows\System\TFtxwZV.exe
  C:\Windows\System\TFtxwZV.exe
  2⤵
  PID:10660
- C:\Windows\System\eLhJIox.exe
  C:\Windows\System\eLhJIox.exe
  2⤵
  PID:10684
- C:\Windows\System\LExBJwt.exe
  C:\Windows\System\LExBJwt.exe
  2⤵
  PID:10712
- C:\Windows\System\RIwkivN.exe
  C:\Windows\System\RIwkivN.exe
  2⤵
  PID:10736
- C:\Windows\System\NsAiWKm.exe
  C:\Windows\System\NsAiWKm.exe
  2⤵
  PID:10764
- C:\Windows\System\BdUoLQD.exe
  C:\Windows\System\BdUoLQD.exe
  2⤵
  PID:10792
- C:\Windows\System\syHGjma.exe
  C:\Windows\System\syHGjma.exe
  2⤵
  PID:10808
- C:\Windows\System\OsFrruB.exe
  C:\Windows\System\OsFrruB.exe
  2⤵
  PID:10828
- C:\Windows\System\EkNajWt.exe
  C:\Windows\System\EkNajWt.exe
  2⤵
  PID:10856
- C:\Windows\System\elxPQLA.exe
  C:\Windows\System\elxPQLA.exe
  2⤵
  PID:10884
- C:\Windows\System\pgiGuqB.exe
  C:\Windows\System\pgiGuqB.exe
  2⤵
  PID:10916
- C:\Windows\System\UWGNfZj.exe
  C:\Windows\System\UWGNfZj.exe
  2⤵
  PID:10948
- C:\Windows\System\tUSXkgv.exe
  C:\Windows\System\tUSXkgv.exe
  2⤵
  PID:10972
- C:\Windows\System\NbMSkkM.exe
  C:\Windows\System\NbMSkkM.exe
  2⤵
  PID:11000
- C:\Windows\System\qNWBVBu.exe
  C:\Windows\System\qNWBVBu.exe
  2⤵
  PID:11024
- C:\Windows\System\NYVkkvZ.exe
  C:\Windows\System\NYVkkvZ.exe
  2⤵
  PID:11056
- C:\Windows\System\vRubxFN.exe
  C:\Windows\System\vRubxFN.exe
  2⤵
  PID:11084
- C:\Windows\System\SgbJKyl.exe
  C:\Windows\System\SgbJKyl.exe
  2⤵
  PID:11104
- C:\Windows\System\DXxhjvg.exe
  C:\Windows\System\DXxhjvg.exe
  2⤵
  PID:11136
- C:\Windows\System\hpqJCXy.exe
  C:\Windows\System\hpqJCXy.exe
  2⤵
  PID:11156
- C:\Windows\System\JeerXGn.exe
  C:\Windows\System\JeerXGn.exe
  2⤵
  PID:11188
- C:\Windows\System\ICuKVqa.exe
  C:\Windows\System\ICuKVqa.exe
  2⤵
  PID:11204
- C:\Windows\System\gRBmFBr.exe
  C:\Windows\System\gRBmFBr.exe
  2⤵
  PID:11244
- C:\Windows\System\FcixrKi.exe
  C:\Windows\System\FcixrKi.exe
  2⤵
  PID:10220
- C:\Windows\System\BhrKPfG.exe
  C:\Windows\System\BhrKPfG.exe
  2⤵
  PID:9500
- C:\Windows\System\sZGDflQ.exe
  C:\Windows\System\sZGDflQ.exe
  2⤵
  PID:9756
- C:\Windows\System\hxRzFxf.exe
  C:\Windows\System\hxRzFxf.exe
  2⤵
  PID:9544
- C:\Windows\System\UEpGXMi.exe
  C:\Windows\System\UEpGXMi.exe
  2⤵
  PID:10384
- C:\Windows\System\OMBfmPu.exe
  C:\Windows\System\OMBfmPu.exe
  2⤵
  PID:2452
- C:\Windows\System\uWRbfsd.exe
  C:\Windows\System\uWRbfsd.exe
  2⤵
  PID:10472
- C:\Windows\System\zyWssAq.exe
  C:\Windows\System\zyWssAq.exe
  2⤵
  PID:10448
- C:\Windows\System\nyhVMaj.exe
  C:\Windows\System\nyhVMaj.exe
  2⤵
  PID:10424
- C:\Windows\System\XnCghJB.exe
  C:\Windows\System\XnCghJB.exe
  2⤵
  PID:10640
- C:\Windows\System\HvlSNvY.exe
  C:\Windows\System\HvlSNvY.exe
  2⤵
  PID:10616
- C:\Windows\System\djkgGJm.exe
  C:\Windows\System\djkgGJm.exe
  2⤵
  PID:10748
- C:\Windows\System\xZKxRzQ.exe
  C:\Windows\System\xZKxRzQ.exe
  2⤵
  PID:10804
- C:\Windows\System\OtmVnXB.exe
  C:\Windows\System\OtmVnXB.exe
  2⤵
  PID:10872
- C:\Windows\System\LEqdOMv.exe
  C:\Windows\System\LEqdOMv.exe
  2⤵
  PID:10984
- C:\Windows\System\LEVQYUJ.exe
  C:\Windows\System\LEVQYUJ.exe
  2⤵
  PID:11016
- C:\Windows\System\rUBJZUi.exe
  C:\Windows\System\rUBJZUi.exe
  2⤵
  PID:10880
- C:\Windows\System\GokRCxM.exe
  C:\Windows\System\GokRCxM.exe
  2⤵
  PID:11132
- C:\Windows\System\tSQTTpW.exe
  C:\Windows\System\tSQTTpW.exe
  2⤵
  PID:11044
- C:\Windows\System\zNYnxFm.exe
  C:\Windows\System\zNYnxFm.exe
  2⤵
  PID:11240
- C:\Windows\System\QeFaXJh.exe
  C:\Windows\System\QeFaXJh.exe
  2⤵
  PID:11200
- C:\Windows\System\ZSOEzpk.exe
  C:\Windows\System\ZSOEzpk.exe
  2⤵
  PID:11100
- C:\Windows\System\XWiItfd.exe
  C:\Windows\System\XWiItfd.exe
  2⤵
  PID:4156
- C:\Windows\System\TGLOflY.exe
  C:\Windows\System\TGLOflY.exe
  2⤵
  PID:10388
- C:\Windows\System\VYDUhJg.exe
  C:\Windows\System\VYDUhJg.exe
  2⤵
  PID:11256
- C:\Windows\System\YpdGlkH.exe
  C:\Windows\System\YpdGlkH.exe
  2⤵
  PID:10680
- C:\Windows\System\oYvGKiV.exe
  C:\Windows\System\oYvGKiV.exe
  2⤵
  PID:4944
- C:\Windows\System\GlLyzoA.exe
  C:\Windows\System\GlLyzoA.exe
  2⤵
  PID:10912
- C:\Windows\System\HArZlWb.exe
  C:\Windows\System\HArZlWb.exe
  2⤵
  PID:11292
- C:\Windows\System\cdouRrH.exe
  C:\Windows\System\cdouRrH.exe
  2⤵
  PID:11316
- C:\Windows\System\AjPXBhE.exe
  C:\Windows\System\AjPXBhE.exe
  2⤵
  PID:11348
- C:\Windows\System\fTibFPK.exe
  C:\Windows\System\fTibFPK.exe
  2⤵
  PID:11380
- C:\Windows\System\scbUtLb.exe
  C:\Windows\System\scbUtLb.exe
  2⤵
  PID:11408
- C:\Windows\System\LIjHRbS.exe
  C:\Windows\System\LIjHRbS.exe
  2⤵
  PID:11428
- C:\Windows\System\HPnogZs.exe
  C:\Windows\System\HPnogZs.exe
  2⤵
  PID:11452
- C:\Windows\System\IiPGqBe.exe
  C:\Windows\System\IiPGqBe.exe
  2⤵
  PID:11480
- C:\Windows\System\UJdONGo.exe
  C:\Windows\System\UJdONGo.exe
  2⤵
  PID:11504
- C:\Windows\System\aMraesi.exe
  C:\Windows\System\aMraesi.exe
  2⤵
  PID:11524
- C:\Windows\System\jdWQVJx.exe
  C:\Windows\System\jdWQVJx.exe
  2⤵
  PID:11556
- C:\Windows\System\NVCiQSf.exe
  C:\Windows\System\NVCiQSf.exe
  2⤵
  PID:11576
- C:\Windows\System\wBDnxPS.exe
  C:\Windows\System\wBDnxPS.exe
  2⤵
  PID:11616
- C:\Windows\System\HQiLCaz.exe
  C:\Windows\System\HQiLCaz.exe
  2⤵
  PID:11652
- C:\Windows\System\fhOoeyA.exe
  C:\Windows\System\fhOoeyA.exe
  2⤵
  PID:11680
- C:\Windows\System\qpNnvEi.exe
  C:\Windows\System\qpNnvEi.exe
  2⤵
  PID:11704
- C:\Windows\System\MgIoLAM.exe
  C:\Windows\System\MgIoLAM.exe
  2⤵
  PID:11728
- C:\Windows\System\nNHhkec.exe
  C:\Windows\System\nNHhkec.exe
  2⤵
  PID:11756
- C:\Windows\System\CQHDvCN.exe
  C:\Windows\System\CQHDvCN.exe
  2⤵
  PID:11776
- C:\Windows\System\gJvZTvM.exe
  C:\Windows\System\gJvZTvM.exe
  2⤵
  PID:11812
- C:\Windows\System\yluFUyc.exe
  C:\Windows\System\yluFUyc.exe
  2⤵
  PID:11840
- C:\Windows\System\nKbHGAV.exe
  C:\Windows\System\nKbHGAV.exe
  2⤵
  PID:11872
- C:\Windows\System\ZNVSaYf.exe
  C:\Windows\System\ZNVSaYf.exe
  2⤵
  PID:11896
- C:\Windows\System\vTYxJwD.exe
  C:\Windows\System\vTYxJwD.exe
  2⤵
  PID:11924
- C:\Windows\System\yjMoxVj.exe
  C:\Windows\System\yjMoxVj.exe
  2⤵
  PID:11948
- C:\Windows\System\vYcwABl.exe
  C:\Windows\System\vYcwABl.exe
  2⤵
  PID:11976
- C:\Windows\System\AGYEJGK.exe
  C:\Windows\System\AGYEJGK.exe
  2⤵
  PID:12004
- C:\Windows\System\XDzKTPa.exe
  C:\Windows\System\XDzKTPa.exe
  2⤵
  PID:12032
- C:\Windows\System\TdxpdBT.exe
  C:\Windows\System\TdxpdBT.exe
  2⤵
  PID:12052
- C:\Windows\System\rLLGfXU.exe
  C:\Windows\System\rLLGfXU.exe
  2⤵
  PID:12088
- C:\Windows\System\UEGGJpf.exe
  C:\Windows\System\UEGGJpf.exe
  2⤵
  PID:12104
- C:\Windows\System\vxEkfWM.exe
  C:\Windows\System\vxEkfWM.exe
  2⤵
  PID:12132
- C:\Windows\System\bmevuwY.exe
  C:\Windows\System\bmevuwY.exe
  2⤵
  PID:12160
- C:\Windows\System\lmHKcYF.exe
  C:\Windows\System\lmHKcYF.exe
  2⤵
  PID:12176
- C:\Windows\System\ILknkob.exe
  C:\Windows\System\ILknkob.exe
  2⤵
  PID:12204
- C:\Windows\System\fFdCYxS.exe
  C:\Windows\System\fFdCYxS.exe
  2⤵
  PID:12228
- C:\Windows\System\gQzvaJs.exe
  C:\Windows\System\gQzvaJs.exe
  2⤵
  PID:12252
- C:\Windows\System\XYtFVxN.exe
  C:\Windows\System\XYtFVxN.exe
  2⤵
  PID:12280
- C:\Windows\System\gcYtbUy.exe
  C:\Windows\System\gcYtbUy.exe
  2⤵
  PID:11080
- C:\Windows\System\pBiszPW.exe
  C:\Windows\System\pBiszPW.exe
  2⤵
  PID:10996
- C:\Windows\System\XiKZPnN.exe
  C:\Windows\System\XiKZPnN.exe
  2⤵
  PID:4960
- C:\Windows\System\QGZWrxH.exe
  C:\Windows\System\QGZWrxH.exe
  2⤵
  PID:11272
- C:\Windows\System\RHFInTI.exe
  C:\Windows\System\RHFInTI.exe
  2⤵
  PID:11304
- C:\Windows\System\LSArOFG.exe
  C:\Windows\System\LSArOFG.exe
  2⤵
  PID:11372
- C:\Windows\System\rmAgzBc.exe
  C:\Windows\System\rmAgzBc.exe
  2⤵
  PID:11360
- C:\Windows\System\kRmpAGP.exe
  C:\Windows\System\kRmpAGP.exe
  2⤵
  PID:11512
- C:\Windows\System\vDfrTgq.exe
  C:\Windows\System\vDfrTgq.exe
  2⤵
  PID:11584
- C:\Windows\System\AAwGydH.exe
  C:\Windows\System\AAwGydH.exe
  2⤵
  PID:11336
- C:\Windows\System\CVXnpjY.exe
  C:\Windows\System\CVXnpjY.exe
  2⤵
  PID:11668
- C:\Windows\System\SyYuMxw.exe
  C:\Windows\System\SyYuMxw.exe
  2⤵
  PID:11396
- C:\Windows\System\PRSiWXG.exe
  C:\Windows\System\PRSiWXG.exe
  2⤵
  PID:11800
- C:\Windows\System\GtjWEwO.exe
  C:\Windows\System\GtjWEwO.exe
  2⤵
  PID:11868
- C:\Windows\System\WzwiivH.exe
  C:\Windows\System\WzwiivH.exe
  2⤵
  PID:11688
- C:\Windows\System\vzjYNFK.exe
  C:\Windows\System\vzjYNFK.exe
  2⤵
  PID:12172
- C:\Windows\System\BOLjzvu.exe
  C:\Windows\System\BOLjzvu.exe
  2⤵
  PID:12044
- C:\Windows\System\rxeQjGf.exe
  C:\Windows\System\rxeQjGf.exe
  2⤵
  PID:12140
- C:\Windows\System\PWywDqJ.exe
  C:\Windows\System\PWywDqJ.exe
  2⤵
  PID:12260
- C:\Windows\System\WMGbDdC.exe
  C:\Windows\System\WMGbDdC.exe
  2⤵
  PID:12020
- C:\Windows\System\rnkZnJn.exe
  C:\Windows\System\rnkZnJn.exe
  2⤵
  PID:12152
- C:\Windows\System\dpXLzMo.exe
  C:\Windows\System\dpXLzMo.exe
  2⤵
  PID:10784
- C:\Windows\System\xJONxHz.exe
  C:\Windows\System\xJONxHz.exe
  2⤵
  PID:2100
- C:\Windows\System\IGFpUOe.exe
  C:\Windows\System\IGFpUOe.exe
  2⤵
  PID:11820
- C:\Windows\System\lOfCKkZ.exe
  C:\Windows\System\lOfCKkZ.exe
  2⤵
  PID:12300
- C:\Windows\System\DvAUtoM.exe
  C:\Windows\System\DvAUtoM.exe
  2⤵
  PID:12336
- C:\Windows\System\ryPdwBH.exe
  C:\Windows\System\ryPdwBH.exe
  2⤵
  PID:12368
- C:\Windows\System\axJhICG.exe
  C:\Windows\System\axJhICG.exe
  2⤵
  PID:12392
- C:\Windows\System\eeytQoH.exe
  C:\Windows\System\eeytQoH.exe
  2⤵
  PID:12416
- C:\Windows\System\tEYNwqn.exe
  C:\Windows\System\tEYNwqn.exe
  2⤵
  PID:12436
- C:\Windows\System\qHWhRRt.exe
  C:\Windows\System\qHWhRRt.exe
  2⤵
  PID:12468
- C:\Windows\System\HtNLTvn.exe
  C:\Windows\System\HtNLTvn.exe
  2⤵
  PID:12496
- C:\Windows\System\RtFiyhT.exe
  C:\Windows\System\RtFiyhT.exe
  2⤵
  PID:12512
- C:\Windows\System\iXJhjOu.exe
  C:\Windows\System\iXJhjOu.exe
  2⤵
  PID:12544
- C:\Windows\System\PiMBHmE.exe
  C:\Windows\System\PiMBHmE.exe
  2⤵
  PID:12564
- C:\Windows\System\LItvPBW.exe
  C:\Windows\System\LItvPBW.exe
  2⤵
  PID:12952
- C:\Windows\System\eBhwHTg.exe
  C:\Windows\System\eBhwHTg.exe
  2⤵
  PID:12968
- C:\Windows\System\SNjNlNU.exe
  C:\Windows\System\SNjNlNU.exe
  2⤵
  PID:12984
- C:\Windows\System\WByIjbE.exe
  C:\Windows\System\WByIjbE.exe
  2⤵
  PID:13004
- C:\Windows\System\cxcnnQR.exe
  C:\Windows\System\cxcnnQR.exe
  2⤵
  PID:13040
- C:\Windows\System\XfKUhCV.exe
  C:\Windows\System\XfKUhCV.exe
  2⤵
  PID:13080
- C:\Windows\System\OJTlgED.exe
  C:\Windows\System\OJTlgED.exe
  2⤵
  PID:13096
- C:\Windows\System\QZKQTeO.exe
  C:\Windows\System\QZKQTeO.exe
  2⤵
  PID:13124
- C:\Windows\System\PSVifil.exe
  C:\Windows\System\PSVifil.exe
  2⤵
  PID:13144
- C:\Windows\System\ROzJbwV.exe
  C:\Windows\System\ROzJbwV.exe
  2⤵
  PID:13176
- C:\Windows\System\GAOZrfc.exe
  C:\Windows\System\GAOZrfc.exe
  2⤵
  PID:13196
- C:\Windows\System\pteYEEP.exe
  C:\Windows\System\pteYEEP.exe
  2⤵
  PID:13212
- C:\Windows\System\zjTLYiM.exe
  C:\Windows\System\zjTLYiM.exe
  2⤵
  PID:13252
- C:\Windows\System\iRnOtjn.exe
  C:\Windows\System\iRnOtjn.exe
  2⤵
  PID:13276
- C:\Windows\System\hvjYbmp.exe
  C:\Windows\System\hvjYbmp.exe
  2⤵
  PID:13300
- C:\Windows\System\dTEenOr.exe
  C:\Windows\System\dTEenOr.exe
  2⤵
  PID:11284
- C:\Windows\System\nwCxQUu.exe
  C:\Windows\System\nwCxQUu.exe
  2⤵
  PID:10328
- C:\Windows\System\QiRFAnE.exe
  C:\Windows\System\QiRFAnE.exe
  2⤵
  PID:12248
- C:\Windows\System\NDLVCMC.exe
  C:\Windows\System\NDLVCMC.exe
  2⤵
  PID:12076
- C:\Windows\System\xGUmXcP.exe
  C:\Windows\System\xGUmXcP.exe
  2⤵
  PID:10612
- C:\Windows\System\vuGBHCX.exe
  C:\Windows\System\vuGBHCX.exe
  2⤵
  PID:12292
- C:\Windows\System\YEUJVuT.exe
  C:\Windows\System\YEUJVuT.exe
  2⤵
  PID:12348
- C:\Windows\System\EukWJhA.exe
  C:\Windows\System\EukWJhA.exe
  2⤵
  PID:12408
- C:\Windows\System\cWzEYOe.exe
  C:\Windows\System\cWzEYOe.exe
  2⤵
  PID:12480
- C:\Windows\System\nCEWJpZ.exe
  C:\Windows\System\nCEWJpZ.exe
  2⤵
  PID:10272
- C:\Windows\System\czsnfaU.exe
  C:\Windows\System\czsnfaU.exe
  2⤵
  PID:12096
- C:\Windows\System\wIYSjPi.exe
  C:\Windows\System\wIYSjPi.exe
  2⤵
  PID:12432
- C:\Windows\System\BNHLWOV.exe
  C:\Windows\System\BNHLWOV.exe
  2⤵
  PID:12648
- C:\Windows\System\QPAKWfY.exe
  C:\Windows\System\QPAKWfY.exe
  2⤵
  PID:12556
- C:\Windows\System\HXaIVxN.exe
  C:\Windows\System\HXaIVxN.exe
  2⤵
  PID:12628
- C:\Windows\System\hYUwXOE.exe
  C:\Windows\System\hYUwXOE.exe
  2⤵
  PID:12784
- C:\Windows\System\EqoUKfw.exe
  C:\Windows\System\EqoUKfw.exe
  2⤵
  PID:12928
- C:\Windows\System\lcducEi.exe
  C:\Windows\System\lcducEi.exe
  2⤵
  PID:3204
- C:\Windows\System\sGGwPGC.exe
  C:\Windows\System\sGGwPGC.exe
  2⤵
  PID:12960
- C:\Windows\System\uWJOIFc.exe
  C:\Windows\System\uWJOIFc.exe
  2⤵
  PID:13020
- C:\Windows\System\OKupXGn.exe
  C:\Windows\System\OKupXGn.exe
  2⤵
  PID:13108
- C:\Windows\System\xFPxGnU.exe
  C:\Windows\System\xFPxGnU.exe
  2⤵
  PID:13184
- C:\Windows\System\yEVGWcO.exe
  C:\Windows\System\yEVGWcO.exe
  2⤵
  PID:13240
- C:\Windows\System\oSsvgdI.exe
  C:\Windows\System\oSsvgdI.exe
  2⤵
  PID:11420
- C:\Windows\System\MwpYkKs.exe
  C:\Windows\System\MwpYkKs.exe
  2⤵
  PID:11856
- C:\Windows\System\ADuvxZK.exe
  C:\Windows\System\ADuvxZK.exe
  2⤵
  PID:12364
- C:\Windows\System\nsTeljA.exe
  C:\Windows\System\nsTeljA.exe
  2⤵
  PID:12168
- C:\Windows\System\YHclIGR.exe
  C:\Windows\System\YHclIGR.exe
  2⤵
  PID:12700
- C:\Windows\System\EtGsDxW.exe
  C:\Windows\System\EtGsDxW.exe
  2⤵
  PID:12636
- C:\Windows\System\JZHhyBj.exe
  C:\Windows\System\JZHhyBj.exe
  2⤵
  PID:10836
- C:\Windows\System\IuODRYv.exe
  C:\Windows\System\IuODRYv.exe
  2⤵
  PID:12868
- C:\Windows\System\grmxsmP.exe
  C:\Windows\System\grmxsmP.exe
  2⤵
  PID:11916
- C:\Windows\System\OBYxFXN.exe
  C:\Windows\System\OBYxFXN.exe
  2⤵
  PID:13164
- C:\Windows\System\ZyxLDYB.exe
  C:\Windows\System\ZyxLDYB.exe
  2⤵
  PID:13324
- C:\Windows\System\wLcuYyJ.exe
  C:\Windows\System\wLcuYyJ.exe
  2⤵
  PID:13352
- C:\Windows\System\JkDuomh.exe
  C:\Windows\System\JkDuomh.exe
  2⤵
  PID:13372
- C:\Windows\System\HuiIgYP.exe
  C:\Windows\System\HuiIgYP.exe
  2⤵
  PID:13400
- C:\Windows\System\kMOYylA.exe
  C:\Windows\System\kMOYylA.exe
  2⤵
  PID:13436
- C:\Windows\System\ltjfOsI.exe
  C:\Windows\System\ltjfOsI.exe
  2⤵
  PID:13452
- C:\Windows\System\oWAiBng.exe
  C:\Windows\System\oWAiBng.exe
  2⤵
  PID:13476
- C:\Windows\System\zqdoutn.exe
  C:\Windows\System\zqdoutn.exe
  2⤵
  PID:13496
- C:\Windows\System\xeaWHYa.exe
  C:\Windows\System\xeaWHYa.exe
  2⤵
  PID:13516
- C:\Windows\System\FqvDZcG.exe
  C:\Windows\System\FqvDZcG.exe
  2⤵
  PID:13540
- C:\Windows\System\WNVRPfS.exe
  C:\Windows\System\WNVRPfS.exe
  2⤵
  PID:13560
- C:\Windows\System\COkTBwI.exe
  C:\Windows\System\COkTBwI.exe
  2⤵
  PID:13580
- C:\Windows\System\DAKiuLE.exe
  C:\Windows\System\DAKiuLE.exe
  2⤵
  PID:13640
- C:\Windows\System\ZAPGKXA.exe
  C:\Windows\System\ZAPGKXA.exe
  2⤵
  PID:13664
- C:\Windows\System\oDYffqK.exe
  C:\Windows\System\oDYffqK.exe
  2⤵
  PID:13700
- C:\Windows\System\cZBnnKW.exe
  C:\Windows\System\cZBnnKW.exe
  2⤵
  PID:13744
- C:\Windows\System\DwKytPn.exe
  C:\Windows\System\DwKytPn.exe
  2⤵
  PID:13776
- C:\Windows\System\GDxbPuG.exe
  C:\Windows\System\GDxbPuG.exe
  2⤵
  PID:13804
- C:\Windows\System\qNBtVWv.exe
  C:\Windows\System\qNBtVWv.exe
  2⤵
  PID:13824
- C:\Windows\System\aFIxFGs.exe
  C:\Windows\System\aFIxFGs.exe
  2⤵
  PID:13864
- C:\Windows\System\OAYWyti.exe
  C:\Windows\System\OAYWyti.exe
  2⤵
  PID:13888
- C:\Windows\System\pxKFMNo.exe
  C:\Windows\System\pxKFMNo.exe
  2⤵
  PID:13904
- C:\Windows\System\fzPiQAD.exe
  C:\Windows\System\fzPiQAD.exe
  2⤵
  PID:13924
- C:\Windows\System\chpLZXv.exe
  C:\Windows\System\chpLZXv.exe
  2⤵
  PID:13948
- C:\Windows\System\DELgGHn.exe
  C:\Windows\System\DELgGHn.exe
  2⤵
  PID:13968
- C:\Windows\System\XKiHRSe.exe
  C:\Windows\System\XKiHRSe.exe
  2⤵
  PID:13992
- C:\Windows\System\kEWTDUB.exe
  C:\Windows\System\kEWTDUB.exe
  2⤵
  PID:14020
- C:\Windows\System\eSaVSVx.exe
  C:\Windows\System\eSaVSVx.exe
  2⤵
  PID:14052
- C:\Windows\System\PxoCANL.exe
  C:\Windows\System\PxoCANL.exe
  2⤵
  PID:14068
- C:\Windows\System\HlmrJNx.exe
  C:\Windows\System\HlmrJNx.exe
  2⤵
  PID:14096
- C:\Windows\System\AaPKXpP.exe
  C:\Windows\System\AaPKXpP.exe
  2⤵
  PID:14120
- C:\Windows\System\ddBqKzr.exe
  C:\Windows\System\ddBqKzr.exe
  2⤵
  PID:14152
- C:\Windows\System\dIkctJg.exe
  C:\Windows\System\dIkctJg.exe
  2⤵
  PID:14188
- C:\Windows\System\hZwhbBx.exe
  C:\Windows\System\hZwhbBx.exe
  2⤵
  PID:14236
- C:\Windows\System\HunodSE.exe
  C:\Windows\System\HunodSE.exe
  2⤵
  PID:14268
- C:\Windows\System\gPHlJWs.exe
  C:\Windows\System\gPHlJWs.exe
  2⤵
  PID:14292
- C:\Windows\System\bwaIOIt.exe
  C:\Windows\System\bwaIOIt.exe
  2⤵
  PID:13088
- C:\Windows\System\XMasxhE.exe
  C:\Windows\System\XMasxhE.exe
  2⤵
  PID:5072
- C:\Windows\System\aImsLgj.exe
  C:\Windows\System\aImsLgj.exe
  2⤵
  PID:13320
- C:\Windows\System\XfdRlvT.exe
  C:\Windows\System\XfdRlvT.exe
  2⤵
  PID:12948
- C:\Windows\System\gftoOrO.exe
  C:\Windows\System\gftoOrO.exe
  2⤵
  PID:12716
- C:\Windows\System\xEaewgU.exe
  C:\Windows\System\xEaewgU.exe
  2⤵
  PID:13380
- C:\Windows\System\YjzUbms.exe
  C:\Windows\System\YjzUbms.exe
  2⤵
  PID:13488
- C:\Windows\System\luPXCtq.exe
  C:\Windows\System\luPXCtq.exe
  2⤵
  PID:13448
- C:\Windows\System\LPdbtSv.exe
  C:\Windows\System\LPdbtSv.exe
  2⤵
  PID:13556
- C:\Windows\System\VWcYiQG.exe
  C:\Windows\System\VWcYiQG.exe
  2⤵
  PID:13708
- C:\Windows\System\SsMIyAl.exe
  C:\Windows\System\SsMIyAl.exe
  2⤵
  PID:13732
- C:\Windows\System\sorJsTj.exe
  C:\Windows\System\sorJsTj.exe
  2⤵
  PID:13756
- C:\Windows\System\wqZLiCG.exe
  C:\Windows\System\wqZLiCG.exe
  2⤵
  PID:13880
- C:\Windows\System\onqHFUI.exe
  C:\Windows\System\onqHFUI.exe
  2⤵
  PID:13844
- C:\Windows\System\zKmrUDA.exe
  C:\Windows\System\zKmrUDA.exe
  2⤵
  PID:13816
- C:\Windows\System\HmYvfKL.exe
  C:\Windows\System\HmYvfKL.exe
  2⤵
  PID:14256
- C:\Windows\System\vnuszNl.exe
  C:\Windows\System\vnuszNl.exe
  2⤵
  PID:14288
- C:\Windows\System\mhcwzbe.exe
  C:\Windows\System\mhcwzbe.exe
  2⤵
  PID:13384
- C:\Windows\System\URvoaCr.exe
  C:\Windows\System\URvoaCr.exe
  2⤵
  PID:13432
- C:\Windows\System\AFqorAW.exe
  C:\Windows\System\AFqorAW.exe
  2⤵
  PID:13624
- C:\Windows\System\zoKgbSM.exe
  C:\Windows\System\zoKgbSM.exe
  2⤵
  PID:13524
- C:\Windows\System\jeiZMCE.exe
  C:\Windows\System\jeiZMCE.exe
  2⤵
  PID:4188
- C:\Windows\System\kGSYsty.exe
  C:\Windows\System\kGSYsty.exe
  2⤵
  PID:13848
- C:\Windows\System\ZRfCOAR.exe
  C:\Windows\System\ZRfCOAR.exe
  2⤵
  PID:13468
- C:\Windows\System\iGkzrlU.exe
  C:\Windows\System\iGkzrlU.exe
  2⤵
  PID:13760
- C:\Windows\System\OceZlBz.exe
  C:\Windows\System\OceZlBz.exe
  2⤵
  PID:2520
- C:\Windows\System\pcmzePX.exe
  C:\Windows\System\pcmzePX.exe
  2⤵
  PID:3372
- C:\Windows\System\aAbcIJW.exe
  C:\Windows\System\aAbcIJW.exe
  2⤵
  PID:2284
- C:\Windows\System\lfktDXj.exe
  C:\Windows\System\lfktDXj.exe
  2⤵
  PID:880
- C:\Windows\System\WMIxtIf.exe
  C:\Windows\System\WMIxtIf.exe
  2⤵
  PID:13000
- C:\Windows\System\RsGbJXz.exe
  C:\Windows\System\RsGbJXz.exe
  2⤵
  PID:2096
- C:\Windows\System\XZKkMjm.exe
  C:\Windows\System\XZKkMjm.exe
  2⤵
  PID:12708
- C:\Windows\System\eZfuxbZ.exe
  C:\Windows\System\eZfuxbZ.exe
  2⤵
  PID:14344
- C:\Windows\System\wKwFFJe.exe
  C:\Windows\System\wKwFFJe.exe
  2⤵
  PID:14436
- C:\Windows\System\unGqNqi.exe
  C:\Windows\System\unGqNqi.exe
  2⤵
  PID:14464
- C:\Windows\System\xyzUAEL.exe
  C:\Windows\System\xyzUAEL.exe
  2⤵
  PID:14492
- C:\Windows\System\fVEqnsN.exe
  C:\Windows\System\fVEqnsN.exe
  2⤵
  PID:14508
- C:\Windows\System\HCWrwde.exe
  C:\Windows\System\HCWrwde.exe
  2⤵
  PID:14528
- C:\Windows\System\RINMrdQ.exe
  C:\Windows\System\RINMrdQ.exe
  2⤵
  PID:14544
- C:\Windows\System\YODZdtm.exe
  C:\Windows\System\YODZdtm.exe
  2⤵
  PID:14560
- C:\Windows\System\UMqJWqP.exe
  C:\Windows\System\UMqJWqP.exe
  2⤵
  PID:14576
- C:\Windows\System\PaWNzQs.exe
  C:\Windows\System\PaWNzQs.exe
  2⤵
  PID:14600
- C:\Windows\System\AbOHmmK.exe
  C:\Windows\System\AbOHmmK.exe
  2⤵
  PID:14620
- C:\Windows\System\mOtAekZ.exe
  C:\Windows\System\mOtAekZ.exe
  2⤵
  PID:14644
- C:\Windows\System\qhUbNnt.exe
  C:\Windows\System\qhUbNnt.exe
  2⤵
  PID:14716
- C:\Windows\System\qZzjtzc.exe
  C:\Windows\System\qZzjtzc.exe
  2⤵
  PID:14736
- C:\Windows\System\cXCFSCo.exe
  C:\Windows\System\cXCFSCo.exe
  2⤵
  PID:14756
- C:\Windows\System\VlGKihX.exe
  C:\Windows\System\VlGKihX.exe
  2⤵
  PID:14776
- C:\Windows\System\QasPKPH.exe
  C:\Windows\System\QasPKPH.exe
  2⤵
  PID:14960
- C:\Windows\System\tzhsZQk.exe
  C:\Windows\System\tzhsZQk.exe
  2⤵
  PID:14984
- C:\Windows\System\vyfbUIR.exe
  C:\Windows\System\vyfbUIR.exe
  2⤵
  PID:15004
- C:\Windows\System\dMADGGn.exe
  C:\Windows\System\dMADGGn.exe
  2⤵
  PID:15020
- C:\Windows\System\DxQTNbf.exe
  C:\Windows\System\DxQTNbf.exe
  2⤵
  PID:15048
- C:\Windows\System\NATGsZb.exe
  C:\Windows\System\NATGsZb.exe
  2⤵
  PID:15064
- C:\Windows\System\uXAMThU.exe
  C:\Windows\System\uXAMThU.exe
  2⤵
  PID:15088
- C:\Windows\System\XObSISp.exe
  C:\Windows\System\XObSISp.exe
  2⤵
  PID:15112
- C:\Windows\System\JjSryWz.exe
  C:\Windows\System\JjSryWz.exe
  2⤵
  PID:15148
- C:\Windows\System\yIWmUMF.exe
  C:\Windows\System\yIWmUMF.exe
  2⤵
  PID:15168
- C:\Windows\System\XznGAMa.exe
  C:\Windows\System\XznGAMa.exe
  2⤵
  PID:15184
- C:\Windows\System\HmvGJYF.exe
  C:\Windows\System\HmvGJYF.exe
  2⤵
  PID:15204
- C:\Windows\System\HazdzUR.exe
  C:\Windows\System\HazdzUR.exe
  2⤵
  PID:15220
- C:\Windows\System\JiMGuqZ.exe
  C:\Windows\System\JiMGuqZ.exe
  2⤵
  PID:15244
- C:\Windows\System\jrZObSe.exe
  C:\Windows\System\jrZObSe.exe
  2⤵
  PID:15264
- C:\Windows\System\tGHcdeT.exe
  C:\Windows\System\tGHcdeT.exe
  2⤵
  PID:15292
- C:\Windows\System\LZWHdZK.exe
  C:\Windows\System\LZWHdZK.exe
  2⤵
  PID:3388
- C:\Windows\System\bwyFsZr.exe
  C:\Windows\System\bwyFsZr.exe
  2⤵
  PID:2128
- C:\Windows\System\EmSTfMa.exe
  C:\Windows\System\EmSTfMa.exe
  2⤵
  PID:2600
- C:\Windows\System\NTnBXHQ.exe
  C:\Windows\System\NTnBXHQ.exe
  2⤵
  PID:3288
- C:\Windows\System\ZiAjMnL.exe
  C:\Windows\System\ZiAjMnL.exe
  2⤵
  PID:3000
- C:\Windows\System\iryQaKA.exe
  C:\Windows\System\iryQaKA.exe
  2⤵
  PID:4084
- C:\Windows\System\lIAzuhd.exe
  C:\Windows\System\lIAzuhd.exe
  2⤵
  PID:14352
- C:\Windows\System\HOjGTlr.exe
  C:\Windows\System\HOjGTlr.exe
  2⤵
  PID:14144
- C:\Windows\System\cGADYGU.exe
  C:\Windows\System\cGADYGU.exe
  2⤵
  PID:792
- C:\Windows\System\WtkaRCH.exe
  C:\Windows\System\WtkaRCH.exe
  2⤵
  PID:14584
- C:\Windows\System\diHRSzr.exe
  C:\Windows\System\diHRSzr.exe
  2⤵
  PID:14652
- C:\Windows\System\WWTIHdC.exe
  C:\Windows\System\WWTIHdC.exe
  2⤵
  PID:14876
- C:\Windows\System\TJUaCbG.exe
  C:\Windows\System\TJUaCbG.exe
  2⤵
  PID:796
- C:\Windows\System\VKwcMAc.exe
  C:\Windows\System\VKwcMAc.exe
  2⤵
  PID:14764
- C:\Windows\System\TNdYoLy.exe
  C:\Windows\System\TNdYoLy.exe
  2⤵
  PID:4224
- C:\Windows\System\HSWoIQA.exe
  C:\Windows\System\HSWoIQA.exe
  2⤵
  PID:1436
- C:\Windows\System\nCeprbh.exe
  C:\Windows\System\nCeprbh.exe
  2⤵
  PID:14824
- C:\Windows\System\lZpKxxR.exe
  C:\Windows\System\lZpKxxR.exe
  2⤵
  PID:3324
- C:\Windows\System\hbBNfPm.exe
  C:\Windows\System\hbBNfPm.exe
  2⤵
  PID:1104
- C:\Windows\System\uxcfXWY.exe
  C:\Windows\System\uxcfXWY.exe
  2⤵
  PID:13512
- C:\Windows\System\btGEiwx.exe
  C:\Windows\System\btGEiwx.exe
  2⤵
  PID:15176
- C:\Windows\System\ERtqHbs.exe
  C:\Windows\System\ERtqHbs.exe
  2⤵
  PID:14896
- C:\Windows\System\YtoNYEo.exe
  C:\Windows\System\YtoNYEo.exe
  2⤵
  PID:1344
- C:\Windows\System\QVBVOZY.exe
  C:\Windows\System\QVBVOZY.exe
  2⤵
  PID:15128
- C:\Windows\System\hrXDxGv.exe
  C:\Windows\System\hrXDxGv.exe
  2⤵
  PID:15180
- C:\Windows\System\bwnfCWi.exe
  C:\Windows\System\bwnfCWi.exe
  2⤵
  PID:4708
- C:\Windows\System\vywwxZF.exe
  C:\Windows\System\vywwxZF.exe
  2⤵
  PID:15084
- C:\Windows\System\bySZOyA.exe
  C:\Windows\System\bySZOyA.exe
  2⤵
  PID:15040
- C:\Windows\System\CvbVXiU.exe
  C:\Windows\System\CvbVXiU.exe
  2⤵
  PID:15272
- C:\Windows\System\rzaIxxk.exe
  C:\Windows\System\rzaIxxk.exe
  2⤵
  PID:15144
- C:\Windows\System\dhiKqfm.exe
  C:\Windows\System\dhiKqfm.exe
  2⤵
  PID:15200
- C:\Windows\System\UXoOyBp.exe
  C:\Windows\System\UXoOyBp.exe
  2⤵
  PID:15240
- C:\Windows\System\JUOCIuD.exe
  C:\Windows\System\JUOCIuD.exe
  2⤵
  PID:15288
- C:\Windows\System\RySPkJd.exe
  C:\Windows\System\RySPkJd.exe
  2⤵
  PID:15316
- C:\Windows\System\cBiSRMN.exe
  C:\Windows\System\cBiSRMN.exe
  2⤵
  PID:4464
- C:\Windows\System\iEqhosL.exe
  C:\Windows\System\iEqhosL.exe
  2⤵
  PID:14372
- C:\Windows\System\hRIyNSQ.exe
  C:\Windows\System\hRIyNSQ.exe
  2⤵
  PID:4120
- C:\Windows\System\xRcZCLk.exe
  C:\Windows\System\xRcZCLk.exe
  2⤵
  PID:6052
- C:\Windows\System\NolVOvD.exe
  C:\Windows\System\NolVOvD.exe
  2⤵
  PID:4056
- C:\Windows\System\xAMTJlY.exe
  C:\Windows\System\xAMTJlY.exe
  2⤵
  PID:5476
- C:\Windows\System\cIndAQU.exe
  C:\Windows\System\cIndAQU.exe
  2⤵
  PID:412
- C:\Windows\System\gYHclRt.exe
  C:\Windows\System\gYHclRt.exe
  2⤵
  PID:5624
- C:\Windows\System\KmhATno.exe
  C:\Windows\System\KmhATno.exe
  2⤵
  PID:14612
- C:\Windows\System\KvPTbBE.exe
  C:\Windows\System\KvPTbBE.exe
  2⤵
  PID:14632
- C:\Windows\System\PbSRkzu.exe
  C:\Windows\System\PbSRkzu.exe
  2⤵
  PID:5280
- C:\Windows\System\iFsScnZ.exe
  C:\Windows\System\iFsScnZ.exe
  2⤵
  PID:5656
- C:\Windows\System\iERujee.exe
  C:\Windows\System\iERujee.exe
  2⤵
  PID:5292
- C:\Windows\System\MljMLSp.exe
  C:\Windows\System\MljMLSp.exe
  2⤵
  PID:14752
- C:\Windows\System\cSMYqBG.exe
  C:\Windows\System\cSMYqBG.exe
  2⤵
  PID:5472
- C:\Windows\System\IPkPoAd.exe
  C:\Windows\System\IPkPoAd.exe
  2⤵
  PID:5932
- C:\Windows\System\lXWBfng.exe
  C:\Windows\System\lXWBfng.exe
  2⤵
  PID:5588
- C:\Windows\System\CNBFSnA.exe
  C:\Windows\System\CNBFSnA.exe
  2⤵
  PID:14640
- C:\Windows\System\MdsaGUR.exe
  C:\Windows\System\MdsaGUR.exe
  2⤵
  PID:15000
- C:\Windows\System\jgTVhql.exe
  C:\Windows\System\jgTVhql.exe
  2⤵
  PID:14808
- C:\Windows\System\qVtfzTH.exe
  C:\Windows\System\qVtfzTH.exe
  2⤵
  PID:15124
- C:\Windows\System\yWLbdrd.exe
  C:\Windows\System\yWLbdrd.exe
  2⤵
  PID:5632
- C:\Windows\System\swPYJdc.exe
  C:\Windows\System\swPYJdc.exe
  2⤵
  PID:15100
- C:\Windows\System\PfFlodT.exe
  C:\Windows\System\PfFlodT.exe
  2⤵
  PID:14864
- C:\Windows\System\DpbpRuO.exe
  C:\Windows\System\DpbpRuO.exe
  2⤵
  PID:11908
- C:\Windows\System\HyGUUtE.exe
  C:\Windows\System\HyGUUtE.exe
  2⤵
  PID:13960
- C:\Windows\System\avnyeDQ.exe
  C:\Windows\System\avnyeDQ.exe
  2⤵
  PID:15044
- C:\Windows\System\OSPuGMZ.exe
  C:\Windows\System\OSPuGMZ.exe
  2⤵
  PID:6720
- C:\Windows\System\kmbxJAo.exe
  C:\Windows\System\kmbxJAo.exe
  2⤵
  PID:5484
- C:\Windows\System\JoigiXo.exe
  C:\Windows\System\JoigiXo.exe
  2⤵
  PID:5368
- C:\Windows\System\MwuLNAJ.exe
  C:\Windows\System\MwuLNAJ.exe
  2⤵
  PID:5400
- C:\Windows\System\uDvLEMA.exe
  C:\Windows\System\uDvLEMA.exe
  2⤵
  PID:14792
- C:\Windows\System\AaVQFTz.exe
  C:\Windows\System\AaVQFTz.exe
  2⤵
  PID:5108
- C:\Windows\System\OXfpScz.exe
  C:\Windows\System\OXfpScz.exe
  2⤵
  PID:4104
- C:\Windows\System\yWxxyiF.exe
  C:\Windows\System\yWxxyiF.exe
  2⤵
  PID:4300
- C:\Windows\System\mQMKrfx.exe
  C:\Windows\System\mQMKrfx.exe
  2⤵
  PID:5756
- C:\Windows\System\VdVmDNq.exe
  C:\Windows\System\VdVmDNq.exe
  2⤵
  PID:4588
- C:\Windows\System\bHsGliY.exe
  C:\Windows\System\bHsGliY.exe
  2⤵
  PID:7724
- C:\Windows\System\gJuRONi.exe
  C:\Windows\System\gJuRONi.exe
  2⤵
  PID:2416
- C:\Windows\System\VcTpHBB.exe
  C:\Windows\System\VcTpHBB.exe
  2⤵
  PID:5652
- C:\Windows\System\spKUkRj.exe
  C:\Windows\System\spKUkRj.exe
  2⤵
  PID:5564
- C:\Windows\System\iDGUiiQ.exe
  C:\Windows\System\iDGUiiQ.exe
  2⤵
  PID:5772
- C:\Windows\System\VuwrSZW.exe
  C:\Windows\System\VuwrSZW.exe
  2⤵
  PID:3680
- C:\Windows\System\gyAmVTM.exe
  C:\Windows\System\gyAmVTM.exe
  2⤵
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:14524

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 14544 -ip 14544
1⤵
PID:14792

Network

DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

100.58.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.58.20.217.in-addr.arpa

IN PTR

Response
DNS

164.189.21.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

164.189.21.2.in-addr.arpa

IN PTR

Response

164.189.21.2.in-addr.arpa

IN PTR

a2-21-189-164deploystaticakamaitechnologiescom
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

75.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

14.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.160.190.20.in-addr.arpa

IN PTR

Response
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

101.58.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.58.20.217.in-addr.arpa

IN PTR

Response
DNS

31.243.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

31.243.111.52.in-addr.arpa

IN PTR

Response
DNS

0.204.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.204.248.87.in-addr.arpa

IN PTR

Response

0.204.248.87.in-addr.arpa

IN PTR

https-87-248-204-0lhrllnwnet
DNS

208.143.182.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

208.143.182.52.in-addr.arpa

IN PTR

Response

13.107.253.64:443

46 B
40 B
1
1
52.142.223.178:80

322 B
7

8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

100.58.20.217.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

100.58.20.217.in-addr.arpa
8.8.8.8:53

164.189.21.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

164.189.21.2.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

75.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

75.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

14.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.160.190.20.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

101.58.20.217.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

101.58.20.217.in-addr.arpa
8.8.8.8:53

31.243.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

31.243.111.52.in-addr.arpa
8.8.8.8:53

0.204.248.87.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

0.204.248.87.in-addr.arpa
8.8.8.8:53

208.143.182.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

208.143.182.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BOZxxyJ.exe

Filesize
2.2MB

MD5
8c9e5afb2b0539b35eb7a942a13484f3

SHA1
1f5e20910258e24f701edb39639fbc40d77fccd5

SHA256
59f2d6de81fe639127d6b7903c51dcd058522754ee5ea994a5d7a66454099f1a

SHA512
745568dacd7b5ce7ed3fbe4724941f8a16ccd31d24758454411b12909c8fc11cd6d8ec07aebdbf9bc12003d1302fb71d61a3d76c37f5bbb0334f37bc5bbf39c7

Download Submit
C:\Windows\System\BWDmUIk.exe

Filesize
2.2MB

MD5
ec5834722bb04a911e420961c34692b2

SHA1
d20c56e484ef6b5292c3dd135e813c500d23075a

SHA256
82818681e184987992b1d31c3ffd2b632280ae5f824490f5c50bbc5168066678

SHA512
fe1802c5139e6ca399726ed4f1e240ce8c2411c0bf0fac75a5c8dae6e628b01e83aa52c21d7e6959cf542d9e58f5188864d1c271d1dc89dcc4dde51955b50ac0

Download Submit
C:\Windows\System\BdMqwWc.exe

Filesize
2.2MB

MD5
b6aa8fb6cefc0a54ea0f15f4f1466ed1

SHA1
dcbe8cf2005f00e65a490f0918d1c071491bf37d

SHA256
ee9d9dc0baedba8f9ad32f7626e64786007946f886269a4a326779e6330e7768

SHA512
84829f794bd5d748c1ec2e251efffcde09a26be04ec3add7683712e1a8aecbac55c45a758f4984bf88fd2f7c1c8c08835525909605c01da08722d60db3b29e23

Download Submit
C:\Windows\System\DqxrjZo.exe

Filesize
2.2MB

MD5
54aa2d5ca36ed81da598c9740459ebee

SHA1
4d1b303ba6fbaadf35639a33013db4231a1086bd

SHA256
58a42d179b878bc7c3206f2770681a7067d7e70cfb047e860846c05a85e7993f

SHA512
8bef73d1b1f9eca12393816d009b0827e8fae2cde7ae04ac1dea5c459dfe888b272ec2e68561e52cc1a5e7715e6b2c4af90e3c8dfb45b33329c5d58df3dfa8c0

Download Submit
C:\Windows\System\HEqYLVG.exe

Filesize
2.2MB

MD5
1159318c853ba8d445eceb4d46d2cd06

SHA1
23d8bb76054bc87ad3988104c56a9013041d6883

SHA256
1d8a99cc01fc2c73749038f24c0e99563124340a737696dd2f78ab7702372b42

SHA512
a56da4b5cf6807535e6b093082895f5b5b5659d56956c6e9857947c1694423c0ab74aca12334cd16626813e93301fc9586d2608c2f427cc394d96aa76d3fafc4

Download Submit
C:\Windows\System\LPvSazK.exe

Filesize
2.2MB

MD5
383b3dc386a3f9b2d94297941e98c7f1

SHA1
ed782dda12867b982cea7873492e269b2744a9e4

SHA256
ae3405c7576a9f8cc9cce0b6a7e76729fdfb13aba05636979c006d8992e84cf0

SHA512
774a63f57993203b927296c1ff2a2e6c67d99d4531bd820db3c742fcf218173a0f97b8632a6aa1c8bea7897095b060f4483d29e71645c190b8f3e57fdacfa583

Download Submit
C:\Windows\System\MRzQTBg.exe

Filesize
2.2MB

MD5
391ff51a946c49b777b2fbe8ee5255b1

SHA1
ece1c7e50f53fb8e16395d304c98a9610fce7136

SHA256
1f90b443e43c324e2eb9c0c914c57ee885ebe74fcddc6317fd05f10cf8004513

SHA512
3d4f4a5f86c33d260ee2e09175ff2bb2aaeacbcac70ee9199f313b50f736e300a2920eb11072663377fca14ab7e542671b2622e3048f0006c36a4ae9ddac9465

Download Submit
C:\Windows\System\OAQkcaD.exe

Filesize
2.2MB

MD5
190c95ecf64bd1556c068d9f42c20de1

SHA1
b9f807f012e4bc5010f9747cd83ef0358c903571

SHA256
f023c9e525ea0ea134d838eda49d816362df609765db005c1e7a8117dba30559

SHA512
26e5bbf6694887f941d7e3407df2a33e9c01fd5909ec213662e3e8c9d914d0db39521ea2d56f0de522418571524000612b04ecf9c4f0498200640377f096b261

Download Submit
C:\Windows\System\OtQggOC.exe

Filesize
2.2MB

MD5
d4edfcbb0f3a5c3c8e5419501bb2ff39

SHA1
1842c8e9e11f6044cf078d8097fc4f04db0ac0eb

SHA256
6b998fb20e0a38cc7d0f6c91dc59d6655ac713741729bf5c142a11583896c5d2

SHA512
ba87157d1b21850d5cf562514c07e882cbfe615e0afaa4f54704d1cf2c3b69c8fc3a0227c63b736145c5b17efea2ae2671e8d8b3b9d32736ced38fb85b9fc5ba

Download Submit
C:\Windows\System\PePNlhr.exe

Filesize
2.2MB

MD5
d4354597da2b9cc1c54f20491f9a97a1

SHA1
f18c5dfc6484b58cb244be4453af25e49a068547

SHA256
2cdbb00fee18870e8c8b44c789bd19b893d5f6d470ee68e8034509913f3cf703

SHA512
888658aa519863d347501a87b24128a2da2985664bba75902b6ef62222b8416f45ca6884efa98eca536c8ebc133182d0ab78bfdbeb676a110b98afb615c405d3

Download Submit
C:\Windows\System\ShWrlkY.exe

Filesize
2.2MB

MD5
950266544a9b96ec999891f2738b20b9

SHA1
5bb06946aa77da444b7130e8f7b48866bf6b2d65

SHA256
6435650d82cf5825279940eb1d0ca3b5e0dde060b3a6b7b2ccc70a05c3447c79

SHA512
2aa904c12d21edc8d3790907e589b0da4072beadc395c45b244a454dcc57bd1b702da8371d5c63807870c3f3ab25f8dc8c9f21df3199d3f8deb70e9f68cacb96

Download Submit
C:\Windows\System\TlsrKrD.exe

Filesize
2.2MB

MD5
a49b33e1bbaa74bc0e29d6fa7514ad06

SHA1
e3d9d26e9a7ef41609f77a5b6aaafaee15ded46b

SHA256
470ffec6c53a8331282237baa98d7098399ba5fc3cd04893268beaeeecd34a68

SHA512
f2a4373717719306071eacecf1782ca3a44a11baff651d5c165a0a809cc78b271b41d7f0ebfbc16d477fa9b815cd198123526cf97a0d7f8f26eba1ec7770090a

Download Submit
C:\Windows\System\TpQQHwX.exe

Filesize
2.2MB

MD5
ade41fc3e37b9130da7391eb22c90481

SHA1
b6a6732ab06f069a0d86221030b97d4630962e3d

SHA256
b8c644e5b8a6711e64a99bfeb6f4ec1647a8162982fb746b2ecf4f4f6c375d27

SHA512
3f3c522033df17661d49e45f8a606383d5cbfed9a67faf72b24947218b85f6834ee0af3a70cbc00480400a1faf31589a29b974c6635b3303b5fbce177ddaa58c

Download Submit
C:\Windows\System\aWeBMAc.exe

Filesize
2.2MB

MD5
012d6e68ba149a7f492f5e0f76102085

SHA1
ca6e9999e11d1f96b995559f69ef633ec06ee8f8

SHA256
4800a1ff36b3e0cefb296a35f05bcd82e49753323840772f07b6778c0ac504db

SHA512
e7eb5db3e50e465881421c5b84d1b47a61a1508be071102aab4f2634f9609052bb0a225546c3fd4a802f6988a0c3b1e4b2aaf4e4078a6a1263c2973fd83df7df

Download Submit
C:\Windows\System\acxuvyl.exe

Filesize
2.2MB

MD5
9ec59460fde274df17ec4934ee66124b

SHA1
b0ef74f39207918753a949d1dc58e171cf4a3e4f

SHA256
8e9a85a39d52e79447fe4e82c9571004f31a0cf380092e83846dd19e9d1b1f6f

SHA512
3fd366846c32e2df2bc008cc6cbe6bf1aa34712dff380ba4d55f70a1c07724f02756ebb69c570927dd956d7af7886f8975fa17c16c3d024ed32d492661769714

Download Submit
C:\Windows\System\bhdniNv.exe

Filesize
2.2MB

MD5
8742e287eb4b7947d0ab41451ed71734

SHA1
b3b60b49883ac0be31dd7d35d6dd94a48d6f0a58

SHA256
a16e4052982303031611a0a1f202d9babc3ea87d89aa8d03bc210df46e82e352

SHA512
0438e4c63ca63abd2eeeb8b563879e5a927ff4b5b4f371c0c02cd89ef8b4737fd54a5c95c1e1cde24f1a8074f3f7c857855b8aa64706f255a65265d4e956e2bb

Download Submit
C:\Windows\System\bmVUwaw.exe

Filesize
2.2MB

MD5
6c58d52fadb04c0b1a2f6d41a2b93ba1

SHA1
02398e758ee188062c53572a6c21b7125a32e0a5

SHA256
eb0438a58b58da354c42885683ec148e0e023b67d80266561d27efcf058da7e8

SHA512
8c30d6b645fda1d2e41195c378e265cd53cafc9a1d00187e4f3de8bebd98028e625381174ae8717935ac686f7034476c17648a89303906dd4c70a1ff06759f5e

Download Submit
C:\Windows\System\ceubTnH.exe

Filesize
2.2MB

MD5
5487b33d16594d3c4e7e7e122bafb4c3

SHA1
e57e0f0cfbcc907f1ebea76879d36c971b7cbec3

SHA256
278ee045c80787b70a43605eb4faec0d698c81320998c8e365541fc3365b3804

SHA512
09f9b3479cf550c7ceed1ea6dbd44a86400b4ca3565c5e379bedaa5c1cd100f659a694ab83f6be7d3f0152acbe94ae66894b46a6d9a06da31856afa47faacfc9

Download Submit
C:\Windows\System\cixlWxB.exe

Filesize
2.2MB

MD5
c8eb41f940a7fe5b6baec9e2570c48ad

SHA1
dfc6b3d42188ac80a8c3fc0ef48ab9149da56650

SHA256
7a9abf861e6ca2f21b7b1d499b0fc1e9cc820e286fd41649568f4eb7e8ae6d04

SHA512
d66a02fc28e292a4663d1d3576b5bc9bf22259aa027fa1ab984286dd424e499ef374b67b6576840288ecb27733ea94ef000117752a18de10d4b5661622f6de19

Download Submit
C:\Windows\System\cqaIhnF.exe

Filesize
2.2MB

MD5
f866c28dbb901f63603e3cc45e7aec80

SHA1
3841f1ef2f84efabe24f5b38e15954ed33685d69

SHA256
9667f0e08369033d3fe85baf4d8c94ea75b1933b599c1fa4ef579f7733cd7d2a

SHA512
b58567f5acbefad51fc34c0ea316b0899441f2b5b054b607029a4fee750b2a3a49bfc4441a0a93142e76eeeda8fad4c540e720264c5a72d6961779dfdcbb88d0

Download Submit
C:\Windows\System\dEQbjCy.exe

Filesize
2.2MB

MD5
20a7165fb1f74e4674c978442220feb9

SHA1
41a28738b9b3cca483e5fbd2ba44d9887171e27c

SHA256
139cc599c42bbfd4f230f7dd50bf0a99163d48715c09cbf9a0c8319f78a6c35d

SHA512
e9cff5dacf6e83025b94d64e614762f0eee126a3f2ed16c2f7ab1cb25de16f46d23c5b4ca22f8e771f345f3b82ac8d02812433c366909c8268c031e8ea5e0d00

Download Submit
C:\Windows\System\dIAHgzI.exe

Filesize
2.2MB

MD5
60867037f8023984b38dc661864e3d44

SHA1
5a102d09c255a19ec445cd37333a869c0efe34a0

SHA256
fd112a2fe245faa18fa7f33a5831b2b33cdd30a512e9138a952a3065799a870a

SHA512
83f205819d97790acdd6bcc964da617e46d109bcd8c29402ac102edb4ef4e5059955ff399dac97763cc70414a50105e97acce6b41d4e01e81027ad9765ad3f67

Download Submit
C:\Windows\System\epzLyLG.exe

Filesize
2.2MB

MD5
91a01993ec990ed5e839bfbe0d7f7055

SHA1
789e5c1859c581df2100416609b057c4ce5024ba

SHA256
8f7cc78a24cee3df6658aa80fb838028feeec29b655186576250f4a25d57e153

SHA512
f148c1082b75223938ead883b2b87eb8720f2768734b956e1d99ce86e1a4adcc4334c9a36c8af5a3a11a7ed077832cb590cede517e3a6527c191aa79b2b93d31

Download Submit
C:\Windows\System\erNWoee.exe

Filesize
2.2MB

MD5
b13bf5f7358264dc70d13f22ef701709

SHA1
1cbee5af0a32c48f34aa7008e899a88ffa679b5d

SHA256
d28f5e888db952d5216d2e15657d0bd7dca4054d54d720de8f396c5db2667333

SHA512
88c96c21a020771b20476fd5c475e1054bc1811c6399ec794fe61cd8bff3b625ef9037ff7d6c2bdf8a12e25b84916a32a6cf5330d43fbfbedb1d53d02371070f

Download Submit
C:\Windows\System\fMWSwGW.exe

Filesize
2.2MB

MD5
ee7aeeae986de6b72a079ada5aad399e

SHA1
21e3971f7c3e55cbd8dc0eb244c89efb1774e16f

SHA256
da0e51dd0bdcb0ce07cf137e9ce2a4795376e10ac9c50f003d65bc5885d39d73

SHA512
1a679c4cc9a0882d5994eefdca8badf0cda67fdda6ac52a83268e52e2bbcb76ab333f8e20e1ff2790e3106e545dbfc86d0c8758022fb3e62811ff9d0bf73c54b

Download Submit
C:\Windows\System\kVzhhjq.exe

Filesize
2.2MB

MD5
9e93c27a87f9d4ef0597e626588016aa

SHA1
03f587aa10861cea63f3e3938a802381253f1839

SHA256
7af18de6664bae56ac3a59e0b550f87a6524d2b0041c1115adc49e3e9b1fe88b

SHA512
6429dadba4c944c523e1a4a4cd08d043867cd5eb8b26c65c7cbedece619adafbd6f4dddc487287eb9a4d58b48541d7d4a8c0b9657e405c79a0f7ca5aea012b29

Download Submit
C:\Windows\System\odXmPmr.exe

Filesize
2.2MB

MD5
6b5ea3dae47b691d0a5f4693564e8e0c

SHA1
3614972c1e90ba860a900040190eac3156bead2c

SHA256
0130a156bc269620e2f4345658c8e6d0e520cc2f4733460b7d92ddeacad83df7

SHA512
07a2bb6e7046a70b030f3cbee05988040048ee689a87c147d74e830d54bd76fd3c339049e0a32e5b0bdd19310350ab6ad889dfd11b9d53dfed5c0d5672ca622e

Download Submit
C:\Windows\System\qOpcZOF.exe

Filesize
2.2MB

MD5
7072d69bf74a435e47f842beafb82758

SHA1
5fa0c8c842c3bc84861a018b27bfbe9291d090ae

SHA256
9bf58e871d199ad9773f605fa4b605223adefd3ac2b3ac7bdddd9dead67393b9

SHA512
0a484404f820e27e0ad201bde0da27118d19374dd8fb308c79df82bbf25b54eb0cfc4665929f2f5b6b9dc0146869b85c8d80377d15caaf677f9b914088438fb5

Download Submit
C:\Windows\System\rVuQNhq.exe

Filesize
2.2MB

MD5
bffae8ae64abdd0664ae0d59485c7e08

SHA1
c793c136efc2846ecf413fa194bd7cb03889aeff

SHA256
d110e2cd4bd89a2e219872d76f19be60d4bcf39badba45be44a11224055de3c2

SHA512
e3386de882f923a907ee43f18db92ed8eb0bdb05c04c39452243bdf5d4756baebdc5977d7504bdb3ac114615379e22c84e8c44d76067c17b38e15e5ccf68386b

Download Submit
C:\Windows\System\stiBpky.exe

Filesize
2.2MB

MD5
c6832a293694515a4022478fd2acd352

SHA1
4e9bfe95a44ff9b9d93dafcf950314fa352eaf6f

SHA256
bdecd6cd33dc08e318f85cbde47632c564ed4d851381b1496be4c98efa57ace8

SHA512
5929e094a5931691847d9592cd4ffd34c0de46880bb84a280f345d5dc0dfb29a8fa33b43e734f119109b807eb591db208af8fcf8632f0833644487223690280a

Download Submit
C:\Windows\System\swKHLtb.exe

Filesize
2.2MB

MD5
9feda90b03eaa2a7665931139f627a6b

SHA1
fb70ba51c7ed873f1a62da47867eabbd3dd1c07d

SHA256
4b3c7c8c7b0e8fae197e931c583c55369b92a6150a2e13d10a6e45a9f18812bc

SHA512
d31b33f435c6d6e792aa69f00fc203a54a92057c2a28e7e998d7e6ebd740b7bb3b1524e5910f05ae1dd49422146589e3135d8647555a02cc9f65cbd34f204625

Download Submit
C:\Windows\System\xxTSGRU.exe

Filesize
2.2MB

MD5
c09176f6ad2a9b34bc11d8b1778d4cd8

SHA1
041269fd11181e912814642ee76cb15dc19bed69

SHA256
8a05983258338fce9fe8db4fad8e16c6f4fd34d4d5c727892c755b57083c29ca

SHA512
cc31d0fe44e0a99e362d7b63421044c0067beca709f8fa67fd56ec06e3a047c44ac9e8c21b1fea35c354cbfe82c5f9842adf0d82dbeb0c9a5cf952ba95a1cfb1

Download Submit
C:\Windows\System\ykxwgKw.exe

Filesize
2.2MB

MD5
7433f4ccb053241c6a3a567f5f966e76

SHA1
67f326505fba140166ae1af6d10362be98a80388

SHA256
b2d15e50c9595156dc7be528cbfca156d94400436106fce84980f6fbc7864e3f

SHA512
eb3b9cfddd8057bc0bb5220866bba855b1dd5bf9e178d5c8b5a8853c6be376d70cc982356d009d1e72b83ca20ad930d6cbe3b5d3f4de7d0565cef20a0221dec7

Download Submit
memory/216-70-0x00007FF7DFCC0000-0x00007FF7E0014000-memory.dmp

Filesize
3.3MB

Download
memory/216-2072-0x00007FF7DFCC0000-0x00007FF7E0014000-memory.dmp

Filesize
3.3MB

Download
memory/436-2146-0x00007FF763440000-0x00007FF763794000-memory.dmp

Filesize
3.3MB

Download
memory/436-110-0x00007FF763440000-0x00007FF763794000-memory.dmp

Filesize
3.3MB

Download
memory/712-106-0x00007FF6C0E60000-0x00007FF6C11B4000-memory.dmp

Filesize
3.3MB

Download
memory/744-2118-0x00007FF6B1680000-0x00007FF6B19D4000-memory.dmp

Filesize
3.3MB

Download
memory/744-98-0x00007FF6B1680000-0x00007FF6B19D4000-memory.dmp

Filesize
3.3MB

Download
memory/884-17-0x00007FF76B780000-0x00007FF76BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/948-232-0x00007FF781E40000-0x00007FF782194000-memory.dmp

Filesize
3.3MB

Download
memory/948-2218-0x00007FF781E40000-0x00007FF782194000-memory.dmp

Filesize
3.3MB

Download
memory/1264-104-0x00007FF7D2690000-0x00007FF7D29E4000-memory.dmp

Filesize
3.3MB

Download
memory/1264-2107-0x00007FF7D2690000-0x00007FF7D29E4000-memory.dmp

Filesize
3.3MB

Download
memory/1980-228-0x00007FF604580000-0x00007FF6048D4000-memory.dmp

Filesize
3.3MB

Download
memory/1980-2234-0x00007FF604580000-0x00007FF6048D4000-memory.dmp

Filesize
3.3MB

Download
memory/2040-2214-0x00007FF7187C0000-0x00007FF718B14000-memory.dmp

Filesize
3.3MB

Download
memory/2040-229-0x00007FF7187C0000-0x00007FF718B14000-memory.dmp

Filesize
3.3MB

Download
memory/2072-105-0x00007FF7295F0000-0x00007FF729944000-memory.dmp

Filesize
3.3MB

Download
memory/2072-2151-0x00007FF7295F0000-0x00007FF729944000-memory.dmp

Filesize
3.3MB

Download
memory/2132-107-0x00007FF6C25D0000-0x00007FF6C2924000-memory.dmp

Filesize
3.3MB

Download
memory/2132-2121-0x00007FF6C25D0000-0x00007FF6C2924000-memory.dmp

Filesize
3.3MB

Download
memory/2260-79-0x00007FF754290000-0x00007FF7545E4000-memory.dmp

Filesize
3.3MB

Download
memory/2260-2067-0x00007FF754290000-0x00007FF7545E4000-memory.dmp

Filesize
3.3MB

Download
memory/2316-226-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp

Filesize
3.3MB

Download
memory/2316-2223-0x00007FF69F0E0000-0x00007FF69F434000-memory.dmp

Filesize
3.3MB

Download
memory/2332-0-0x00007FF6404D0000-0x00007FF640824000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1-0x000001D1BBA60000-0x000001D1BBA70000-memory.dmp

Filesize
64KB

Download
memory/2356-2186-0x00007FF6B4B40000-0x00007FF6B4E94000-memory.dmp

Filesize
3.3MB

Download
memory/2356-225-0x00007FF6B4B40000-0x00007FF6B4E94000-memory.dmp

Filesize
3.3MB

Download
memory/2408-230-0x00007FF67B770000-0x00007FF67BAC4000-memory.dmp

Filesize
3.3MB

Download
memory/2824-19-0x00007FF7A64C0000-0x00007FF7A6814000-memory.dmp

Filesize
3.3MB

Download
memory/2824-2032-0x00007FF7A64C0000-0x00007FF7A6814000-memory.dmp

Filesize
3.3MB

Download
memory/2864-2227-0x00007FF7B6020000-0x00007FF7B6374000-memory.dmp

Filesize
3.3MB

Download
memory/2864-231-0x00007FF7B6020000-0x00007FF7B6374000-memory.dmp

Filesize
3.3MB

Download
memory/3028-95-0x00007FF656BA0000-0x00007FF656EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3028-2105-0x00007FF656BA0000-0x00007FF656EF4000-memory.dmp

Filesize
3.3MB

Download
memory/3460-223-0x00007FF63A960000-0x00007FF63ACB4000-memory.dmp

Filesize
3.3MB

Download
memory/3560-67-0x00007FF6A5A20000-0x00007FF6A5D74000-memory.dmp

Filesize
3.3MB

Download
memory/3560-2062-0x00007FF6A5A20000-0x00007FF6A5D74000-memory.dmp

Filesize
3.3MB

Download
memory/3752-2211-0x00007FF61E700000-0x00007FF61EA54000-memory.dmp

Filesize
3.3MB

Download
memory/3752-222-0x00007FF61E700000-0x00007FF61EA54000-memory.dmp

Filesize
3.3MB

Download
memory/3852-2111-0x00007FF6B4640000-0x00007FF6B4994000-memory.dmp

Filesize
3.3MB

Download
memory/3852-103-0x00007FF6B4640000-0x00007FF6B4994000-memory.dmp

Filesize
3.3MB

Download
memory/3984-109-0x00007FF701C90000-0x00007FF701FE4000-memory.dmp

Filesize
3.3MB

Download
memory/3984-2143-0x00007FF701C90000-0x00007FF701FE4000-memory.dmp

Filesize
3.3MB

Download
memory/4036-11-0x00007FF6A48B0000-0x00007FF6A4C04000-memory.dmp

Filesize
3.3MB

Download
memory/4184-2097-0x00007FF619B00000-0x00007FF619E54000-memory.dmp

Filesize
3.3MB

Download
memory/4184-89-0x00007FF619B00000-0x00007FF619E54000-memory.dmp

Filesize
3.3MB

Download
memory/4380-2045-0x00007FF6CE600000-0x00007FF6CE954000-memory.dmp

Filesize
3.3MB

Download
memory/4380-23-0x00007FF6CE600000-0x00007FF6CE954000-memory.dmp

Filesize
3.3MB

Download
memory/4556-2115-0x00007FF670B00000-0x00007FF670E54000-memory.dmp

Filesize
3.3MB

Download
memory/4556-108-0x00007FF670B00000-0x00007FF670E54000-memory.dmp

Filesize
3.3MB

Download
memory/4840-227-0x00007FF649350000-0x00007FF6496A4000-memory.dmp

Filesize
3.3MB

Download
memory/4912-2220-0x00007FF744240000-0x00007FF744594000-memory.dmp

Filesize
3.3MB

Download
memory/4912-233-0x00007FF744240000-0x00007FF744594000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.