xmrig | 20d5e8cdcbde47a774111fda83c6e21e65b7d6521844477e1636956753f770c1

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
Size 1.5MB
Sample240523-v6lcmsaf96
SHA256 20d5e8cdcbde47a774111fda83c6e21e65b7d6521844477e1636956753f770c1
MD5 c99a3c1090d75de91a932d6e1cd852a0
SHA1 295148834ba2eaabc8091e526c3c3dc0f002e391
SHA512 22db4ec5cdd52f3193060613a4e0efa3503c420714a7fe58b3b36b9c2601b058304908bcb4f4a988b8cb952ce333a3866ed5d17aeb93fd97b5fade48d284f6f2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAT:ROdWCCi7/rahOYFoIBmCyY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral2/memory/2880-244-0x00007FF6A27A0000-0x00007FF6A2AF1000-memory.dmp	xmrig
behavioral2/memory/1388-301-0x00007FF6D0E70000-0x00007FF6D11C1000-memory.dmp	xmrig
behavioral2/memory/3672-360-0x00007FF708F40000-0x00007FF709291000-memory.dmp	xmrig
behavioral2/memory/4464-427-0x00007FF65D860000-0x00007FF65DBB1000-memory.dmp	xmrig
behavioral2/memory/1160-482-0x00007FF6BCB80000-0x00007FF6BCED1000-memory.dmp	xmrig
behavioral2/memory/4204-485-0x00007FF68CE40000-0x00007FF68D191000-memory.dmp	xmrig
behavioral2/memory/4020-484-0x00007FF772990000-0x00007FF772CE1000-memory.dmp	xmrig
behavioral2/memory/700-483-0x00007FF626CE0000-0x00007FF627031000-memory.dmp	xmrig
behavioral2/memory/4832-428-0x00007FF6B1610000-0x00007FF6B1961000-memory.dmp	xmrig
behavioral2/memory/2216-423-0x00007FF73F250000-0x00007FF73F5A1000-memory.dmp	xmrig
behavioral2/memory/3532-422-0x00007FF7D9010000-0x00007FF7D9361000-memory.dmp	xmrig
behavioral2/memory/2408-389-0x00007FF7A7300000-0x00007FF7A7651000-memory.dmp	xmrig
behavioral2/memory/3976-359-0x00007FF71BBE0000-0x00007FF71BF31000-memory.dmp	xmrig
behavioral2/memory/736-354-0x00007FF73F200000-0x00007FF73F551000-memory.dmp	xmrig
behavioral2/memory/4808-353-0x00007FF7CC4A0000-0x00007FF7CC7F1000-memory.dmp	xmrig
behavioral2/memory/212-283-0x00007FF70D600000-0x00007FF70D951000-memory.dmp	xmrig
behavioral2/memory/3708-222-0x00007FF7E90C0000-0x00007FF7E9411000-memory.dmp	xmrig
behavioral2/memory/4116-221-0x00007FF6C4550000-0x00007FF6C48A1000-memory.dmp	xmrig
behavioral2/memory/3108-187-0x00007FF7D9540000-0x00007FF7D9891000-memory.dmp	xmrig
behavioral2/memory/1836-140-0x00007FF62D440000-0x00007FF62D791000-memory.dmp	xmrig
behavioral2/memory/868-119-0x00007FF7C6DF0000-0x00007FF7C7141000-memory.dmp	xmrig
behavioral2/memory/2112-92-0x00007FF79B690000-0x00007FF79B9E1000-memory.dmp	xmrig
behavioral2/memory/404-44-0x00007FF761D80000-0x00007FF7620D1000-memory.dmp	xmrig
behavioral2/memory/3944-43-0x00007FF68EB70000-0x00007FF68EEC1000-memory.dmp	xmrig
behavioral2/memory/4384-2354-0x00007FF7A2B70000-0x00007FF7A2EC1000-memory.dmp	xmrig
behavioral2/memory/3636-2467-0x00007FF76A5E0000-0x00007FF76A931000-memory.dmp	xmrig
behavioral2/memory/1056-2469-0x00007FF793BB0000-0x00007FF793F01000-memory.dmp	xmrig
behavioral2/memory/3944-2473-0x00007FF68EB70000-0x00007FF68EEC1000-memory.dmp	xmrig
behavioral2/memory/404-2472-0x00007FF761D80000-0x00007FF7620D1000-memory.dmp	xmrig
behavioral2/memory/4328-2479-0x00007FF629AD0000-0x00007FF629E21000-memory.dmp	xmrig
behavioral2/memory/1836-2489-0x00007FF62D440000-0x00007FF62D791000-memory.dmp	xmrig
behavioral2/memory/2880-2493-0x00007FF6A27A0000-0x00007FF6A2AF1000-memory.dmp	xmrig
behavioral2/memory/212-2491-0x00007FF70D600000-0x00007FF70D951000-memory.dmp	xmrig
behavioral2/memory/700-2487-0x00007FF626CE0000-0x00007FF627031000-memory.dmp	xmrig
behavioral2/memory/868-2485-0x00007FF7C6DF0000-0x00007FF7C7141000-memory.dmp	xmrig
behavioral2/memory/4116-2481-0x00007FF6C4550000-0x00007FF6C48A1000-memory.dmp	xmrig
behavioral2/memory/3108-2483-0x00007FF7D9540000-0x00007FF7D9891000-memory.dmp	xmrig
behavioral2/memory/2112-2476-0x00007FF79B690000-0x00007FF79B9E1000-memory.dmp	xmrig
behavioral2/memory/1160-2478-0x00007FF6BCB80000-0x00007FF6BCED1000-memory.dmp	xmrig
behavioral2/memory/4464-2519-0x00007FF65D860000-0x00007FF65DBB1000-memory.dmp	xmrig
behavioral2/memory/4808-2526-0x00007FF7CC4A0000-0x00007FF7CC7F1000-memory.dmp	xmrig
behavioral2/memory/1556-2531-0x00007FF77FC30000-0x00007FF77FF81000-memory.dmp	xmrig
behavioral2/memory/3976-2528-0x00007FF71BBE0000-0x00007FF71BF31000-memory.dmp	xmrig
behavioral2/memory/3392-2525-0x00007FF697CF0000-0x00007FF698041000-memory.dmp	xmrig
behavioral2/memory/3672-2523-0x00007FF708F40000-0x00007FF709291000-memory.dmp	xmrig
behavioral2/memory/4832-2521-0x00007FF6B1610000-0x00007FF6B1961000-memory.dmp	xmrig
behavioral2/memory/4204-2513-0x00007FF68CE40000-0x00007FF68D191000-memory.dmp	xmrig
behavioral2/memory/3532-2511-0x00007FF7D9010000-0x00007FF7D9361000-memory.dmp	xmrig
behavioral2/memory/4020-2506-0x00007FF772990000-0x00007FF772CE1000-memory.dmp	xmrig
behavioral2/memory/736-2502-0x00007FF73F200000-0x00007FF73F551000-memory.dmp	xmrig
behavioral2/memory/1388-2497-0x00007FF6D0E70000-0x00007FF6D11C1000-memory.dmp	xmrig
behavioral2/memory/3708-2495-0x00007FF7E90C0000-0x00007FF7E9411000-memory.dmp	xmrig
behavioral2/memory/2408-2509-0x00007FF7A7300000-0x00007FF7A7651000-memory.dmp	xmrig
behavioral2/memory/2216-2500-0x00007FF73F250000-0x00007FF73F5A1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3636	CCeNzqZ.exe
1056	rlLIruQ.exe
3944	rNDwJsb.exe
404	zaKhrhz.exe
4328	sbKpmMM.exe
1160	ODKEyEC.exe
2112	fTdCAmP.exe
700	KVNWlCe.exe
1556	JnswCQQ.exe
868	oVeMCzK.exe
1836	gbPkUWc.exe
3392	sBLsqtJ.exe
3108	fsawIYc.exe
4116	ylMeiia.exe
3708	qNZacDH.exe
2880	ZHtZXNE.exe
4020	zioZEvw.exe
212	ScYnhrH.exe
1388	iUOoZNQ.exe
4808	PyLRFpz.exe
736	HGHQzIi.exe
3976	BbcgjVV.exe
3672	WrRsKFG.exe
2408	TvdhKQM.exe
3532	SSbszAK.exe
4204	fDxSjqz.exe
2216	ICQAGFk.exe
4464	tjZtIxV.exe
4832	FuTRVfk.exe
4308	vMhWxyu.exe
4528	NlTIkjP.exe
3884	hHppNYd.exe
428	uPQNtgk.exe
3732	BPVsXWA.exe
4680	jVpIgpu.exe
4968	HDuKxsj.exe
1980	VGmiUQT.exe
1324	kZrOnYM.exe
408	HTYolLq.exe
5028	tBalrxY.exe
4392	PJCNGnD.exe
2416	NbgaMsC.exe
4560	nafJmcq.exe
3360	CpwOUNv.exe
4492	gudZmhV.exe
4548	bXBKkxC.exe
3996	rzJEydd.exe
1484	bsSGqYx.exe
1292	FgUzBaP.exe
2008	bKpuRlm.exe
3092	eNxIQiH.exe
2348	hNqVaZB.exe
4480	wVNnVPR.exe
320	ganokZf.exe
4996	CIjyDYO.exe
3516	LDGSiYe.exe
1936	sAZnGFM.exe
4356	FausCyv.exe
1524	ZczWdef.exe
4856	MNElmho.exe
3228	fiurwrM.exe
4936	RhWoMtt.exe
3332	zsLFQuS.exe
4444	TXvFRkw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4384-0-0x00007FF7A2B70000-0x00007FF7A2EC1000-memory.dmp	upx
behavioral2/files/0x000b00000002345d-5.dat	upx
behavioral2/files/0x0007000000023467-7.dat	upx
behavioral2/memory/1056-42-0x00007FF793BB0000-0x00007FF793F01000-memory.dmp	upx
behavioral2/files/0x0007000000023473-84.dat	upx
behavioral2/files/0x0007000000023474-136.dat	upx
behavioral2/files/0x000700000002347d-172.dat	upx
behavioral2/memory/2880-244-0x00007FF6A27A0000-0x00007FF6A2AF1000-memory.dmp	upx
behavioral2/memory/1388-301-0x00007FF6D0E70000-0x00007FF6D11C1000-memory.dmp	upx
behavioral2/memory/3672-360-0x00007FF708F40000-0x00007FF709291000-memory.dmp	upx
behavioral2/memory/4464-427-0x00007FF65D860000-0x00007FF65DBB1000-memory.dmp	upx
behavioral2/memory/1160-482-0x00007FF6BCB80000-0x00007FF6BCED1000-memory.dmp	upx
behavioral2/memory/4204-485-0x00007FF68CE40000-0x00007FF68D191000-memory.dmp	upx
behavioral2/memory/4020-484-0x00007FF772990000-0x00007FF772CE1000-memory.dmp	upx
behavioral2/memory/700-483-0x00007FF626CE0000-0x00007FF627031000-memory.dmp	upx
behavioral2/memory/4832-428-0x00007FF6B1610000-0x00007FF6B1961000-memory.dmp	upx
behavioral2/memory/2216-423-0x00007FF73F250000-0x00007FF73F5A1000-memory.dmp	upx
behavioral2/memory/3532-422-0x00007FF7D9010000-0x00007FF7D9361000-memory.dmp	upx
behavioral2/memory/2408-389-0x00007FF7A7300000-0x00007FF7A7651000-memory.dmp	upx
behavioral2/memory/3976-359-0x00007FF71BBE0000-0x00007FF71BF31000-memory.dmp	upx
behavioral2/memory/736-354-0x00007FF73F200000-0x00007FF73F551000-memory.dmp	upx
behavioral2/memory/4808-353-0x00007FF7CC4A0000-0x00007FF7CC7F1000-memory.dmp	upx
behavioral2/memory/212-283-0x00007FF70D600000-0x00007FF70D951000-memory.dmp	upx
behavioral2/memory/3708-222-0x00007FF7E90C0000-0x00007FF7E9411000-memory.dmp	upx
behavioral2/memory/4116-221-0x00007FF6C4550000-0x00007FF6C48A1000-memory.dmp	upx
behavioral2/files/0x000700000002348a-196.dat	upx
behavioral2/files/0x0007000000023478-195.dat	upx
behavioral2/files/0x0008000000023463-194.dat	upx
behavioral2/files/0x000700000002346f-193.dat	upx
behavioral2/files/0x000700000002347f-192.dat	upx
behavioral2/files/0x0007000000023489-190.dat	upx
behavioral2/memory/3108-187-0x00007FF7D9540000-0x00007FF7D9891000-memory.dmp	upx
behavioral2/files/0x000700000002347e-173.dat	upx
behavioral2/files/0x000700000002347c-171.dat	upx
behavioral2/files/0x0007000000023488-170.dat	upx
behavioral2/files/0x0007000000023487-168.dat	upx
behavioral2/files/0x000700000002347a-165.dat	upx
behavioral2/files/0x000700000002346d-163.dat	upx
behavioral2/files/0x0007000000023486-159.dat	upx
behavioral2/files/0x0007000000023485-152.dat	upx
behavioral2/files/0x0007000000023484-151.dat	upx
behavioral2/files/0x0007000000023477-147.dat	upx
behavioral2/files/0x0007000000023476-145.dat	upx
behavioral2/files/0x0007000000023475-143.dat	upx
behavioral2/memory/3392-141-0x00007FF697CF0000-0x00007FF698041000-memory.dmp	upx
behavioral2/memory/1836-140-0x00007FF62D440000-0x00007FF62D791000-memory.dmp	upx
behavioral2/files/0x0007000000023483-139.dat	upx
behavioral2/files/0x0007000000023482-134.dat	upx
behavioral2/files/0x000700000002347b-133.dat	upx
behavioral2/files/0x0007000000023481-130.dat	upx
behavioral2/files/0x0007000000023480-123.dat	upx
behavioral2/memory/868-119-0x00007FF7C6DF0000-0x00007FF7C7141000-memory.dmp	upx
behavioral2/memory/1556-118-0x00007FF77FC30000-0x00007FF77FF81000-memory.dmp	upx
behavioral2/files/0x0007000000023472-105.dat	upx
behavioral2/files/0x0007000000023479-104.dat	upx
behavioral2/files/0x000700000002346e-97.dat	upx
behavioral2/memory/2112-92-0x00007FF79B690000-0x00007FF79B9E1000-memory.dmp	upx
behavioral2/files/0x000700000002346c-89.dat	upx
behavioral2/memory/4328-86-0x00007FF629AD0000-0x00007FF629E21000-memory.dmp	upx
behavioral2/files/0x000700000002346b-74.dat	upx
behavioral2/files/0x0007000000023471-72.dat	upx
behavioral2/files/0x000700000002346a-67.dat	upx
behavioral2/files/0x0007000000023470-80.dat	upx
behavioral2/memory/404-44-0x00007FF761D80000-0x00007FF7620D1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nqwDCxc.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\wSPMBDV.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\eaBmYbd.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\DyUPlVe.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\lpxTxod.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\bUZOojh.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\sAZnGFM.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\sRXXlKZ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\MNIrxsa.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\qbJQsYQ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\iMVctRq.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\mHxlTqZ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\JnswCQQ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\HTYolLq.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\LflaVuB.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\pwnFUCY.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\TvdhKQM.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\VDiOzHN.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\xdvbjjG.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\KXxzUzx.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\pZBWDcT.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\CMCUXeZ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\PuzIDxo.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\ejygxgB.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\nlYRxoZ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\XmNkTfP.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\IvrrJxu.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\wTpWThH.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\zkRKgjw.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\ChAbAje.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\czwhEAs.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\lNreKMq.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\BkWwDyz.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\LCRDCei.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\WxbAdZv.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\OjTfrfZ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\yXImCdy.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\eRlKnzZ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\CzBLCfz.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\gwQddCD.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\DfoXDkQ.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\gDSDEuC.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\SnABmYd.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\xjfyeXm.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\OIuxHqk.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\IFoOdXg.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\AEwuqPu.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\JSFULdf.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\duJXPSx.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\OZhixaB.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\HfDbMzp.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\pljBqkc.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\JTyhVAc.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\BVFkYUk.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\PJCNGnD.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\ganokZf.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\wlCCPox.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\GrHkEPY.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\zAmCQpX.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\DluShcA.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\hVtunlW.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\HjcoIMK.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\gqmvfEe.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
File created	C:\Windows\System\eTTNEPC.exe	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3636	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	83
PID 4384 wrote to memory of 3636	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	83
PID 4384 wrote to memory of 1056	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	84
PID 4384 wrote to memory of 1056	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	84
PID 4384 wrote to memory of 3944	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	85
PID 4384 wrote to memory of 3944	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	85
PID 4384 wrote to memory of 404	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	86
PID 4384 wrote to memory of 404	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	86
PID 4384 wrote to memory of 4328	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	87
PID 4384 wrote to memory of 4328	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	87
PID 4384 wrote to memory of 1160	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	88
PID 4384 wrote to memory of 1160	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	88
PID 4384 wrote to memory of 2112	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	89
PID 4384 wrote to memory of 2112	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	89
PID 4384 wrote to memory of 700	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	90
PID 4384 wrote to memory of 700	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	90
PID 4384 wrote to memory of 1556	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	91
PID 4384 wrote to memory of 1556	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	91
PID 4384 wrote to memory of 868	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	92
PID 4384 wrote to memory of 868	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	92
PID 4384 wrote to memory of 3392	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	93
PID 4384 wrote to memory of 3392	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	93
PID 4384 wrote to memory of 1836	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	94
PID 4384 wrote to memory of 1836	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	94
PID 4384 wrote to memory of 3108	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	95
PID 4384 wrote to memory of 3108	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	95
PID 4384 wrote to memory of 4116	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	96
PID 4384 wrote to memory of 4116	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	96
PID 4384 wrote to memory of 3708	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	97
PID 4384 wrote to memory of 3708	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	97
PID 4384 wrote to memory of 2880	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	98
PID 4384 wrote to memory of 2880	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	98
PID 4384 wrote to memory of 4020	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	99
PID 4384 wrote to memory of 4020	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	99
PID 4384 wrote to memory of 212	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	100
PID 4384 wrote to memory of 212	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	100
PID 4384 wrote to memory of 1388	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	101
PID 4384 wrote to memory of 1388	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	101
PID 4384 wrote to memory of 4808	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	102
PID 4384 wrote to memory of 4808	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	102
PID 4384 wrote to memory of 736	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	103
PID 4384 wrote to memory of 736	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	103
PID 4384 wrote to memory of 3976	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	104
PID 4384 wrote to memory of 3976	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	104
PID 4384 wrote to memory of 4832	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	105
PID 4384 wrote to memory of 4832	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	105
PID 4384 wrote to memory of 3672	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	106
PID 4384 wrote to memory of 3672	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	106
PID 4384 wrote to memory of 2408	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	107
PID 4384 wrote to memory of 2408	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	107
PID 4384 wrote to memory of 3532	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	108
PID 4384 wrote to memory of 3532	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	108
PID 4384 wrote to memory of 4204	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	109
PID 4384 wrote to memory of 4204	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	109
PID 4384 wrote to memory of 2216	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	110
PID 4384 wrote to memory of 2216	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	110
PID 4384 wrote to memory of 4464	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	111
PID 4384 wrote to memory of 4464	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	111
PID 4384 wrote to memory of 4308	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	112
PID 4384 wrote to memory of 4308	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	112
PID 4384 wrote to memory of 4528	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	113
PID 4384 wrote to memory of 4528	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	113
PID 4384 wrote to memory of 3884	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	114
PID 4384 wrote to memory of 3884	4384	c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c99a3c1090d75de91a932d6e1cd852a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System\CCeNzqZ.exe
  C:\Windows\System\CCeNzqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\rlLIruQ.exe
  C:\Windows\System\rlLIruQ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\rNDwJsb.exe
  C:\Windows\System\rNDwJsb.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\zaKhrhz.exe
  C:\Windows\System\zaKhrhz.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\sbKpmMM.exe
  C:\Windows\System\sbKpmMM.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ODKEyEC.exe
  C:\Windows\System\ODKEyEC.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\fTdCAmP.exe
  C:\Windows\System\fTdCAmP.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\KVNWlCe.exe
  C:\Windows\System\KVNWlCe.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\JnswCQQ.exe
  C:\Windows\System\JnswCQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\oVeMCzK.exe
  C:\Windows\System\oVeMCzK.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\sBLsqtJ.exe
  C:\Windows\System\sBLsqtJ.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\gbPkUWc.exe
  C:\Windows\System\gbPkUWc.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\fsawIYc.exe
  C:\Windows\System\fsawIYc.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\ylMeiia.exe
  C:\Windows\System\ylMeiia.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\qNZacDH.exe
  C:\Windows\System\qNZacDH.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\ZHtZXNE.exe
  C:\Windows\System\ZHtZXNE.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\zioZEvw.exe
  C:\Windows\System\zioZEvw.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ScYnhrH.exe
  C:\Windows\System\ScYnhrH.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\iUOoZNQ.exe
  C:\Windows\System\iUOoZNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\PyLRFpz.exe
  C:\Windows\System\PyLRFpz.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\HGHQzIi.exe
  C:\Windows\System\HGHQzIi.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\BbcgjVV.exe
  C:\Windows\System\BbcgjVV.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\FuTRVfk.exe
  C:\Windows\System\FuTRVfk.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\WrRsKFG.exe
  C:\Windows\System\WrRsKFG.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\TvdhKQM.exe
  C:\Windows\System\TvdhKQM.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\SSbszAK.exe
  C:\Windows\System\SSbszAK.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\fDxSjqz.exe
  C:\Windows\System\fDxSjqz.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\ICQAGFk.exe
  C:\Windows\System\ICQAGFk.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\tjZtIxV.exe
  C:\Windows\System\tjZtIxV.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\vMhWxyu.exe
  C:\Windows\System\vMhWxyu.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\NlTIkjP.exe
  C:\Windows\System\NlTIkjP.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\hHppNYd.exe
  C:\Windows\System\hHppNYd.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\uPQNtgk.exe
  C:\Windows\System\uPQNtgk.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\BPVsXWA.exe
  C:\Windows\System\BPVsXWA.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\jVpIgpu.exe
  C:\Windows\System\jVpIgpu.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\HDuKxsj.exe
  C:\Windows\System\HDuKxsj.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\VGmiUQT.exe
  C:\Windows\System\VGmiUQT.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\kZrOnYM.exe
  C:\Windows\System\kZrOnYM.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\HTYolLq.exe
  C:\Windows\System\HTYolLq.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\tBalrxY.exe
  C:\Windows\System\tBalrxY.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\PJCNGnD.exe
  C:\Windows\System\PJCNGnD.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\NbgaMsC.exe
  C:\Windows\System\NbgaMsC.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\nafJmcq.exe
  C:\Windows\System\nafJmcq.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\CpwOUNv.exe
  C:\Windows\System\CpwOUNv.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\gudZmhV.exe
  C:\Windows\System\gudZmhV.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\bXBKkxC.exe
  C:\Windows\System\bXBKkxC.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\rzJEydd.exe
  C:\Windows\System\rzJEydd.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\bsSGqYx.exe
  C:\Windows\System\bsSGqYx.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\FgUzBaP.exe
  C:\Windows\System\FgUzBaP.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\bKpuRlm.exe
  C:\Windows\System\bKpuRlm.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\eNxIQiH.exe
  C:\Windows\System\eNxIQiH.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\hNqVaZB.exe
  C:\Windows\System\hNqVaZB.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\wVNnVPR.exe
  C:\Windows\System\wVNnVPR.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\ganokZf.exe
  C:\Windows\System\ganokZf.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\CIjyDYO.exe
  C:\Windows\System\CIjyDYO.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\LDGSiYe.exe
  C:\Windows\System\LDGSiYe.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\sAZnGFM.exe
  C:\Windows\System\sAZnGFM.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\fiurwrM.exe
  C:\Windows\System\fiurwrM.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\FausCyv.exe
  C:\Windows\System\FausCyv.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\ZczWdef.exe
  C:\Windows\System\ZczWdef.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\MNElmho.exe
  C:\Windows\System\MNElmho.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\dXjQQWZ.exe
  C:\Windows\System\dXjQQWZ.exe
  2⤵
  PID:412
- C:\Windows\System\RhWoMtt.exe
  C:\Windows\System\RhWoMtt.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\zsLFQuS.exe
  C:\Windows\System\zsLFQuS.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\TXvFRkw.exe
  C:\Windows\System\TXvFRkw.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\OKcHHxG.exe
  C:\Windows\System\OKcHHxG.exe
  2⤵
  PID:4780
- C:\Windows\System\nqwDCxc.exe
  C:\Windows\System\nqwDCxc.exe
  2⤵
  PID:5072
- C:\Windows\System\QfrlhDZ.exe
  C:\Windows\System\QfrlhDZ.exe
  2⤵
  PID:4396
- C:\Windows\System\QCTanjP.exe
  C:\Windows\System\QCTanjP.exe
  2⤵
  PID:3084
- C:\Windows\System\LhkZEZI.exe
  C:\Windows\System\LhkZEZI.exe
  2⤵
  PID:4920
- C:\Windows\System\VhQGHHm.exe
  C:\Windows\System\VhQGHHm.exe
  2⤵
  PID:2288
- C:\Windows\System\YoulFqq.exe
  C:\Windows\System\YoulFqq.exe
  2⤵
  PID:4240
- C:\Windows\System\gqJJGUd.exe
  C:\Windows\System\gqJJGUd.exe
  2⤵
  PID:4620
- C:\Windows\System\qKwoBaQ.exe
  C:\Windows\System\qKwoBaQ.exe
  2⤵
  PID:1136
- C:\Windows\System\PuzIDxo.exe
  C:\Windows\System\PuzIDxo.exe
  2⤵
  PID:4060
- C:\Windows\System\lZiYSoi.exe
  C:\Windows\System\lZiYSoi.exe
  2⤵
  PID:4236
- C:\Windows\System\fCuhclT.exe
  C:\Windows\System\fCuhclT.exe
  2⤵
  PID:1844
- C:\Windows\System\nQZnODp.exe
  C:\Windows\System\nQZnODp.exe
  2⤵
  PID:2260
- C:\Windows\System\MmtRjrC.exe
  C:\Windows\System\MmtRjrC.exe
  2⤵
  PID:5132
- C:\Windows\System\QEMPZLI.exe
  C:\Windows\System\QEMPZLI.exe
  2⤵
  PID:5168
- C:\Windows\System\rbQDVXG.exe
  C:\Windows\System\rbQDVXG.exe
  2⤵
  PID:5184
- C:\Windows\System\BvGuNVs.exe
  C:\Windows\System\BvGuNVs.exe
  2⤵
  PID:5200
- C:\Windows\System\fYrdEEi.exe
  C:\Windows\System\fYrdEEi.exe
  2⤵
  PID:5216
- C:\Windows\System\cJlQcTW.exe
  C:\Windows\System\cJlQcTW.exe
  2⤵
  PID:5232
- C:\Windows\System\tqFPTSD.exe
  C:\Windows\System\tqFPTSD.exe
  2⤵
  PID:5248
- C:\Windows\System\MNIrxsa.exe
  C:\Windows\System\MNIrxsa.exe
  2⤵
  PID:5264
- C:\Windows\System\jNBoobb.exe
  C:\Windows\System\jNBoobb.exe
  2⤵
  PID:5280
- C:\Windows\System\HvhzqmZ.exe
  C:\Windows\System\HvhzqmZ.exe
  2⤵
  PID:5296
- C:\Windows\System\CTtsTKo.exe
  C:\Windows\System\CTtsTKo.exe
  2⤵
  PID:5332
- C:\Windows\System\RyBFmgQ.exe
  C:\Windows\System\RyBFmgQ.exe
  2⤵
  PID:5360
- C:\Windows\System\frRPCzu.exe
  C:\Windows\System\frRPCzu.exe
  2⤵
  PID:5380
- C:\Windows\System\sJtSQCh.exe
  C:\Windows\System\sJtSQCh.exe
  2⤵
  PID:5400
- C:\Windows\System\YfruUab.exe
  C:\Windows\System\YfruUab.exe
  2⤵
  PID:5428
- C:\Windows\System\ZnJVZOx.exe
  C:\Windows\System\ZnJVZOx.exe
  2⤵
  PID:5452
- C:\Windows\System\uGKUKgR.exe
  C:\Windows\System\uGKUKgR.exe
  2⤵
  PID:5472
- C:\Windows\System\fBuzCdA.exe
  C:\Windows\System\fBuzCdA.exe
  2⤵
  PID:5488
- C:\Windows\System\OasKYRq.exe
  C:\Windows\System\OasKYRq.exe
  2⤵
  PID:5504
- C:\Windows\System\aFYZOHm.exe
  C:\Windows\System\aFYZOHm.exe
  2⤵
  PID:5524
- C:\Windows\System\EDwtPAb.exe
  C:\Windows\System\EDwtPAb.exe
  2⤵
  PID:5540
- C:\Windows\System\rBxjDMo.exe
  C:\Windows\System\rBxjDMo.exe
  2⤵
  PID:5560
- C:\Windows\System\VFRfUsk.exe
  C:\Windows\System\VFRfUsk.exe
  2⤵
  PID:5580
- C:\Windows\System\IozICTV.exe
  C:\Windows\System\IozICTV.exe
  2⤵
  PID:5612
- C:\Windows\System\bpTPOQr.exe
  C:\Windows\System\bpTPOQr.exe
  2⤵
  PID:5628
- C:\Windows\System\vSPiEkM.exe
  C:\Windows\System\vSPiEkM.exe
  2⤵
  PID:5644
- C:\Windows\System\wuDdqGJ.exe
  C:\Windows\System\wuDdqGJ.exe
  2⤵
  PID:5660
- C:\Windows\System\qrHLWDi.exe
  C:\Windows\System\qrHLWDi.exe
  2⤵
  PID:5688
- C:\Windows\System\ViYdnID.exe
  C:\Windows\System\ViYdnID.exe
  2⤵
  PID:5704
- C:\Windows\System\UuTZBrS.exe
  C:\Windows\System\UuTZBrS.exe
  2⤵
  PID:5732
- C:\Windows\System\oyMMYtE.exe
  C:\Windows\System\oyMMYtE.exe
  2⤵
  PID:5752
- C:\Windows\System\qhDiLCb.exe
  C:\Windows\System\qhDiLCb.exe
  2⤵
  PID:5944
- C:\Windows\System\hKokZDU.exe
  C:\Windows\System\hKokZDU.exe
  2⤵
  PID:5960
- C:\Windows\System\NtOYPeH.exe
  C:\Windows\System\NtOYPeH.exe
  2⤵
  PID:5976
- C:\Windows\System\EBCuzcc.exe
  C:\Windows\System\EBCuzcc.exe
  2⤵
  PID:6000
- C:\Windows\System\HGXbbXf.exe
  C:\Windows\System\HGXbbXf.exe
  2⤵
  PID:6016
- C:\Windows\System\oXJrhQV.exe
  C:\Windows\System\oXJrhQV.exe
  2⤵
  PID:6040
- C:\Windows\System\jteqiZa.exe
  C:\Windows\System\jteqiZa.exe
  2⤵
  PID:6068
- C:\Windows\System\OdhDsNQ.exe
  C:\Windows\System\OdhDsNQ.exe
  2⤵
  PID:1352
- C:\Windows\System\nsxIudj.exe
  C:\Windows\System\nsxIudj.exe
  2⤵
  PID:5092
- C:\Windows\System\CJBfBbO.exe
  C:\Windows\System\CJBfBbO.exe
  2⤵
  PID:668
- C:\Windows\System\dZSjAvi.exe
  C:\Windows\System\dZSjAvi.exe
  2⤵
  PID:2844
- C:\Windows\System\BCyZVTJ.exe
  C:\Windows\System\BCyZVTJ.exe
  2⤵
  PID:3080
- C:\Windows\System\YSVhvHp.exe
  C:\Windows\System\YSVhvHp.exe
  2⤵
  PID:4876
- C:\Windows\System\YdfiFgQ.exe
  C:\Windows\System\YdfiFgQ.exe
  2⤵
  PID:1944
- C:\Windows\System\HlNIOnh.exe
  C:\Windows\System\HlNIOnh.exe
  2⤵
  PID:2032
- C:\Windows\System\sHmMrsn.exe
  C:\Windows\System\sHmMrsn.exe
  2⤵
  PID:4044
- C:\Windows\System\ZEjijxC.exe
  C:\Windows\System\ZEjijxC.exe
  2⤵
  PID:5348
- C:\Windows\System\BGPJzEK.exe
  C:\Windows\System\BGPJzEK.exe
  2⤵
  PID:5396
- C:\Windows\System\UtFqZDC.exe
  C:\Windows\System\UtFqZDC.exe
  2⤵
  PID:5440
- C:\Windows\System\wmtXNSR.exe
  C:\Windows\System\wmtXNSR.exe
  2⤵
  PID:5484
- C:\Windows\System\wlCCPox.exe
  C:\Windows\System\wlCCPox.exe
  2⤵
  PID:5548
- C:\Windows\System\UWHizGJ.exe
  C:\Windows\System\UWHizGJ.exe
  2⤵
  PID:5592
- C:\Windows\System\QapbMlB.exe
  C:\Windows\System\QapbMlB.exe
  2⤵
  PID:5640
- C:\Windows\System\eAHCffu.exe
  C:\Windows\System\eAHCffu.exe
  2⤵
  PID:5696
- C:\Windows\System\vlbkrpZ.exe
  C:\Windows\System\vlbkrpZ.exe
  2⤵
  PID:5720
- C:\Windows\System\eVHMXAk.exe
  C:\Windows\System\eVHMXAk.exe
  2⤵
  PID:5848
- C:\Windows\System\DCWEcMD.exe
  C:\Windows\System\DCWEcMD.exe
  2⤵
  PID:6160
- C:\Windows\System\HqfzsuU.exe
  C:\Windows\System\HqfzsuU.exe
  2⤵
  PID:6184
- C:\Windows\System\aWtRgFD.exe
  C:\Windows\System\aWtRgFD.exe
  2⤵
  PID:6208
- C:\Windows\System\BqOIkOn.exe
  C:\Windows\System\BqOIkOn.exe
  2⤵
  PID:6224
- C:\Windows\System\BMBKFCC.exe
  C:\Windows\System\BMBKFCC.exe
  2⤵
  PID:6248
- C:\Windows\System\QLMqbjs.exe
  C:\Windows\System\QLMqbjs.exe
  2⤵
  PID:6276
- C:\Windows\System\gUumjCH.exe
  C:\Windows\System\gUumjCH.exe
  2⤵
  PID:6424
- C:\Windows\System\mOHRoCU.exe
  C:\Windows\System\mOHRoCU.exe
  2⤵
  PID:6444
- C:\Windows\System\mgGGCeB.exe
  C:\Windows\System\mgGGCeB.exe
  2⤵
  PID:6460
- C:\Windows\System\ChAbAje.exe
  C:\Windows\System\ChAbAje.exe
  2⤵
  PID:6476
- C:\Windows\System\WUoBBFe.exe
  C:\Windows\System\WUoBBFe.exe
  2⤵
  PID:6492
- C:\Windows\System\SsTGXUg.exe
  C:\Windows\System\SsTGXUg.exe
  2⤵
  PID:6508
- C:\Windows\System\lxbKodT.exe
  C:\Windows\System\lxbKodT.exe
  2⤵
  PID:6524
- C:\Windows\System\qhPPqlQ.exe
  C:\Windows\System\qhPPqlQ.exe
  2⤵
  PID:6540
- C:\Windows\System\Xkpkkmx.exe
  C:\Windows\System\Xkpkkmx.exe
  2⤵
  PID:6556
- C:\Windows\System\stUIlKw.exe
  C:\Windows\System\stUIlKw.exe
  2⤵
  PID:6572
- C:\Windows\System\uPMPlEx.exe
  C:\Windows\System\uPMPlEx.exe
  2⤵
  PID:6588
- C:\Windows\System\VviBBjH.exe
  C:\Windows\System\VviBBjH.exe
  2⤵
  PID:6604
- C:\Windows\System\pRVLKZn.exe
  C:\Windows\System\pRVLKZn.exe
  2⤵
  PID:6620
- C:\Windows\System\hdTwkOx.exe
  C:\Windows\System\hdTwkOx.exe
  2⤵
  PID:6636
- C:\Windows\System\gAgvTbJ.exe
  C:\Windows\System\gAgvTbJ.exe
  2⤵
  PID:6652
- C:\Windows\System\kGUHbwf.exe
  C:\Windows\System\kGUHbwf.exe
  2⤵
  PID:6668
- C:\Windows\System\qjdbDUz.exe
  C:\Windows\System\qjdbDUz.exe
  2⤵
  PID:6684
- C:\Windows\System\nNGmCBN.exe
  C:\Windows\System\nNGmCBN.exe
  2⤵
  PID:6700
- C:\Windows\System\uqBgmTa.exe
  C:\Windows\System\uqBgmTa.exe
  2⤵
  PID:6716
- C:\Windows\System\nxMBQET.exe
  C:\Windows\System\nxMBQET.exe
  2⤵
  PID:6732
- C:\Windows\System\ICmGvtB.exe
  C:\Windows\System\ICmGvtB.exe
  2⤵
  PID:6748
- C:\Windows\System\jBjHKEJ.exe
  C:\Windows\System\jBjHKEJ.exe
  2⤵
  PID:6764
- C:\Windows\System\rMVPovY.exe
  C:\Windows\System\rMVPovY.exe
  2⤵
  PID:6780
- C:\Windows\System\BLGEwca.exe
  C:\Windows\System\BLGEwca.exe
  2⤵
  PID:6844
- C:\Windows\System\QsIlTVd.exe
  C:\Windows\System\QsIlTVd.exe
  2⤵
  PID:6864
- C:\Windows\System\LzrBZTS.exe
  C:\Windows\System\LzrBZTS.exe
  2⤵
  PID:6880
- C:\Windows\System\cBagdBt.exe
  C:\Windows\System\cBagdBt.exe
  2⤵
  PID:6900
- C:\Windows\System\VhanXUu.exe
  C:\Windows\System\VhanXUu.exe
  2⤵
  PID:6916
- C:\Windows\System\VDZcJHk.exe
  C:\Windows\System\VDZcJHk.exe
  2⤵
  PID:6936
- C:\Windows\System\qWAOcSQ.exe
  C:\Windows\System\qWAOcSQ.exe
  2⤵
  PID:6976
- C:\Windows\System\OErKPVH.exe
  C:\Windows\System\OErKPVH.exe
  2⤵
  PID:6996
- C:\Windows\System\elyTZJV.exe
  C:\Windows\System\elyTZJV.exe
  2⤵
  PID:7012
- C:\Windows\System\hXovfxS.exe
  C:\Windows\System\hXovfxS.exe
  2⤵
  PID:7028
- C:\Windows\System\DOopbPx.exe
  C:\Windows\System\DOopbPx.exe
  2⤵
  PID:7044
- C:\Windows\System\NEpzNma.exe
  C:\Windows\System\NEpzNma.exe
  2⤵
  PID:7064
- C:\Windows\System\colfrJb.exe
  C:\Windows\System\colfrJb.exe
  2⤵
  PID:7088
- C:\Windows\System\ppQQoBd.exe
  C:\Windows\System\ppQQoBd.exe
  2⤵
  PID:7112
- C:\Windows\System\sIQfGCI.exe
  C:\Windows\System\sIQfGCI.exe
  2⤵
  PID:7136
- C:\Windows\System\QtSkjAD.exe
  C:\Windows\System\QtSkjAD.exe
  2⤵
  PID:7164
- C:\Windows\System\xfYnvNs.exe
  C:\Windows\System\xfYnvNs.exe
  2⤵
  PID:5904
- C:\Windows\System\yXImCdy.exe
  C:\Windows\System\yXImCdy.exe
  2⤵
  PID:5940
- C:\Windows\System\JMkPUax.exe
  C:\Windows\System\JMkPUax.exe
  2⤵
  PID:5988
- C:\Windows\System\ZSctJwq.exe
  C:\Windows\System\ZSctJwq.exe
  2⤵
  PID:6032
- C:\Windows\System\lVrpXoW.exe
  C:\Windows\System\lVrpXoW.exe
  2⤵
  PID:6100
- C:\Windows\System\jYnbfFf.exe
  C:\Windows\System\jYnbfFf.exe
  2⤵
  PID:2228
- C:\Windows\System\ZvKDCna.exe
  C:\Windows\System\ZvKDCna.exe
  2⤵
  PID:4600
- C:\Windows\System\UjALwEi.exe
  C:\Windows\System\UjALwEi.exe
  2⤵
  PID:512
- C:\Windows\System\JXOzcNr.exe
  C:\Windows\System\JXOzcNr.exe
  2⤵
  PID:1044
- C:\Windows\System\EHsnbPw.exe
  C:\Windows\System\EHsnbPw.exe
  2⤵
  PID:840
- C:\Windows\System\ydxskGq.exe
  C:\Windows\System\ydxskGq.exe
  2⤵
  PID:2872
- C:\Windows\System\qalkZOc.exe
  C:\Windows\System\qalkZOc.exe
  2⤵
  PID:4948
- C:\Windows\System\sWAcyrG.exe
  C:\Windows\System\sWAcyrG.exe
  2⤵
  PID:5468
- C:\Windows\System\bIMhPFc.exe
  C:\Windows\System\bIMhPFc.exe
  2⤵
  PID:5576
- C:\Windows\System\fNxKYtb.exe
  C:\Windows\System\fNxKYtb.exe
  2⤵
  PID:5712
- C:\Windows\System\sRXXlKZ.exe
  C:\Windows\System\sRXXlKZ.exe
  2⤵
  PID:6156
- C:\Windows\System\SZZLDvb.exe
  C:\Windows\System\SZZLDvb.exe
  2⤵
  PID:6200
- C:\Windows\System\yNiGJFs.exe
  C:\Windows\System\yNiGJFs.exe
  2⤵
  PID:7328
- C:\Windows\System\YuHpBjs.exe
  C:\Windows\System\YuHpBjs.exe
  2⤵
  PID:7352
- C:\Windows\System\MXJULzE.exe
  C:\Windows\System\MXJULzE.exe
  2⤵
  PID:7376
- C:\Windows\System\xUSAMfy.exe
  C:\Windows\System\xUSAMfy.exe
  2⤵
  PID:7392
- C:\Windows\System\zaESGCn.exe
  C:\Windows\System\zaESGCn.exe
  2⤵
  PID:7412
- C:\Windows\System\MVLFZsL.exe
  C:\Windows\System\MVLFZsL.exe
  2⤵
  PID:7436
- C:\Windows\System\wNpiqfp.exe
  C:\Windows\System\wNpiqfp.exe
  2⤵
  PID:7460
- C:\Windows\System\OQJbeLg.exe
  C:\Windows\System\OQJbeLg.exe
  2⤵
  PID:7476
- C:\Windows\System\BZxrGZv.exe
  C:\Windows\System\BZxrGZv.exe
  2⤵
  PID:7500
- C:\Windows\System\kiJMWkR.exe
  C:\Windows\System\kiJMWkR.exe
  2⤵
  PID:7520
- C:\Windows\System\AnSNXey.exe
  C:\Windows\System\AnSNXey.exe
  2⤵
  PID:7540
- C:\Windows\System\RAlNByM.exe
  C:\Windows\System\RAlNByM.exe
  2⤵
  PID:7568
- C:\Windows\System\ksEtduE.exe
  C:\Windows\System\ksEtduE.exe
  2⤵
  PID:7588
- C:\Windows\System\uLVwldH.exe
  C:\Windows\System\uLVwldH.exe
  2⤵
  PID:7612
- C:\Windows\System\Oydmvln.exe
  C:\Windows\System\Oydmvln.exe
  2⤵
  PID:7632
- C:\Windows\System\IvrrJxu.exe
  C:\Windows\System\IvrrJxu.exe
  2⤵
  PID:7652
- C:\Windows\System\xMzKEbj.exe
  C:\Windows\System\xMzKEbj.exe
  2⤵
  PID:7676
- C:\Windows\System\xiDHbsk.exe
  C:\Windows\System\xiDHbsk.exe
  2⤵
  PID:7696
- C:\Windows\System\OipKUHa.exe
  C:\Windows\System\OipKUHa.exe
  2⤵
  PID:7720
- C:\Windows\System\nlYRxoZ.exe
  C:\Windows\System\nlYRxoZ.exe
  2⤵
  PID:7744
- C:\Windows\System\fvFhBzn.exe
  C:\Windows\System\fvFhBzn.exe
  2⤵
  PID:7764
- C:\Windows\System\QTwCZFJ.exe
  C:\Windows\System\QTwCZFJ.exe
  2⤵
  PID:7784
- C:\Windows\System\MtepdWT.exe
  C:\Windows\System\MtepdWT.exe
  2⤵
  PID:7808
- C:\Windows\System\KoEQqcj.exe
  C:\Windows\System\KoEQqcj.exe
  2⤵
  PID:7824
- C:\Windows\System\KEPaWKf.exe
  C:\Windows\System\KEPaWKf.exe
  2⤵
  PID:7840
- C:\Windows\System\ngOTExA.exe
  C:\Windows\System\ngOTExA.exe
  2⤵
  PID:7856
- C:\Windows\System\MlLyufO.exe
  C:\Windows\System\MlLyufO.exe
  2⤵
  PID:7872
- C:\Windows\System\LCRDCei.exe
  C:\Windows\System\LCRDCei.exe
  2⤵
  PID:7896
- C:\Windows\System\QanftxR.exe
  C:\Windows\System\QanftxR.exe
  2⤵
  PID:7928
- C:\Windows\System\rxYgUiL.exe
  C:\Windows\System\rxYgUiL.exe
  2⤵
  PID:7952
- C:\Windows\System\vtyEhez.exe
  C:\Windows\System\vtyEhez.exe
  2⤵
  PID:7972
- C:\Windows\System\QgaxsFQ.exe
  C:\Windows\System\QgaxsFQ.exe
  2⤵
  PID:7996
- C:\Windows\System\fBmHNJI.exe
  C:\Windows\System\fBmHNJI.exe
  2⤵
  PID:8016
- C:\Windows\System\eGvMOOX.exe
  C:\Windows\System\eGvMOOX.exe
  2⤵
  PID:8040
- C:\Windows\System\ZDodOyH.exe
  C:\Windows\System\ZDodOyH.exe
  2⤵
  PID:8064
- C:\Windows\System\ZZovZtx.exe
  C:\Windows\System\ZZovZtx.exe
  2⤵
  PID:8080
- C:\Windows\System\xaqNztF.exe
  C:\Windows\System\xaqNztF.exe
  2⤵
  PID:8104
- C:\Windows\System\gALiUde.exe
  C:\Windows\System\gALiUde.exe
  2⤵
  PID:8132
- C:\Windows\System\Yvfxyhb.exe
  C:\Windows\System\Yvfxyhb.exe
  2⤵
  PID:8156
- C:\Windows\System\xjfyeXm.exe
  C:\Windows\System\xjfyeXm.exe
  2⤵
  PID:8172
- C:\Windows\System\UvPDEQP.exe
  C:\Windows\System\UvPDEQP.exe
  2⤵
  PID:3024
- C:\Windows\System\YCYxmLA.exe
  C:\Windows\System\YCYxmLA.exe
  2⤵
  PID:6440
- C:\Windows\System\bLWuuWG.exe
  C:\Windows\System\bLWuuWG.exe
  2⤵
  PID:6500
- C:\Windows\System\TcAmkVJ.exe
  C:\Windows\System\TcAmkVJ.exe
  2⤵
  PID:6896
- C:\Windows\System\cnbCCxU.exe
  C:\Windows\System\cnbCCxU.exe
  2⤵
  PID:6932
- C:\Windows\System\RwieieH.exe
  C:\Windows\System\RwieieH.exe
  2⤵
  PID:6952
- C:\Windows\System\pyDNyiq.exe
  C:\Windows\System\pyDNyiq.exe
  2⤵
  PID:6988
- C:\Windows\System\KFNDyGs.exe
  C:\Windows\System\KFNDyGs.exe
  2⤵
  PID:7020
- C:\Windows\System\UIACnHr.exe
  C:\Windows\System\UIACnHr.exe
  2⤵
  PID:7076
- C:\Windows\System\cgoNJYe.exe
  C:\Windows\System\cgoNJYe.exe
  2⤵
  PID:7108
- C:\Windows\System\qOISNdv.exe
  C:\Windows\System\qOISNdv.exe
  2⤵
  PID:7160
- C:\Windows\System\OZdQWHN.exe
  C:\Windows\System\OZdQWHN.exe
  2⤵
  PID:5956
- C:\Windows\System\cizquXx.exe
  C:\Windows\System\cizquXx.exe
  2⤵
  PID:6052
- C:\Windows\System\jtdtAbU.exe
  C:\Windows\System\jtdtAbU.exe
  2⤵
  PID:640
- C:\Windows\System\eTTNEPC.exe
  C:\Windows\System\eTTNEPC.exe
  2⤵
  PID:3244
- C:\Windows\System\EDVSFjn.exe
  C:\Windows\System\EDVSFjn.exe
  2⤵
  PID:4280
- C:\Windows\System\eTadaZK.exe
  C:\Windows\System\eTadaZK.exe
  2⤵
  PID:4244
- C:\Windows\System\CZwaGIw.exe
  C:\Windows\System\CZwaGIw.exe
  2⤵
  PID:5572
- C:\Windows\System\OZhixaB.exe
  C:\Windows\System\OZhixaB.exe
  2⤵
  PID:5776
- C:\Windows\System\kvXKpnw.exe
  C:\Windows\System\kvXKpnw.exe
  2⤵
  PID:7644
- C:\Windows\System\neklKHM.exe
  C:\Windows\System\neklKHM.exe
  2⤵
  PID:7780
- C:\Windows\System\IzVlstZ.exe
  C:\Windows\System\IzVlstZ.exe
  2⤵
  PID:7776
- C:\Windows\System\IOiFsGG.exe
  C:\Windows\System\IOiFsGG.exe
  2⤵
  PID:8204
- C:\Windows\System\vCLwbhX.exe
  C:\Windows\System\vCLwbhX.exe
  2⤵
  PID:8224
- C:\Windows\System\uXCxsDS.exe
  C:\Windows\System\uXCxsDS.exe
  2⤵
  PID:8468
- C:\Windows\System\JQkHQBb.exe
  C:\Windows\System\JQkHQBb.exe
  2⤵
  PID:8484
- C:\Windows\System\HXSXWiC.exe
  C:\Windows\System\HXSXWiC.exe
  2⤵
  PID:8500
- C:\Windows\System\jKpDJsb.exe
  C:\Windows\System\jKpDJsb.exe
  2⤵
  PID:8516
- C:\Windows\System\iQOoooH.exe
  C:\Windows\System\iQOoooH.exe
  2⤵
  PID:8532
- C:\Windows\System\xjHapkf.exe
  C:\Windows\System\xjHapkf.exe
  2⤵
  PID:8548
- C:\Windows\System\wbZMsHe.exe
  C:\Windows\System\wbZMsHe.exe
  2⤵
  PID:8564
- C:\Windows\System\jzRcpTq.exe
  C:\Windows\System\jzRcpTq.exe
  2⤵
  PID:8580
- C:\Windows\System\GAHuiIG.exe
  C:\Windows\System\GAHuiIG.exe
  2⤵
  PID:8596
- C:\Windows\System\RnbxWFo.exe
  C:\Windows\System\RnbxWFo.exe
  2⤵
  PID:8612
- C:\Windows\System\JdJYITk.exe
  C:\Windows\System\JdJYITk.exe
  2⤵
  PID:8628
- C:\Windows\System\UgSVPnG.exe
  C:\Windows\System\UgSVPnG.exe
  2⤵
  PID:8644
- C:\Windows\System\YAHcskf.exe
  C:\Windows\System\YAHcskf.exe
  2⤵
  PID:8660
- C:\Windows\System\RQmJzML.exe
  C:\Windows\System\RQmJzML.exe
  2⤵
  PID:8680
- C:\Windows\System\rgknztp.exe
  C:\Windows\System\rgknztp.exe
  2⤵
  PID:8704
- C:\Windows\System\oUGLDix.exe
  C:\Windows\System\oUGLDix.exe
  2⤵
  PID:8724
- C:\Windows\System\ftlfjzM.exe
  C:\Windows\System\ftlfjzM.exe
  2⤵
  PID:8748
- C:\Windows\System\GYHcatj.exe
  C:\Windows\System\GYHcatj.exe
  2⤵
  PID:8776
- C:\Windows\System\EvtCujj.exe
  C:\Windows\System\EvtCujj.exe
  2⤵
  PID:8800
- C:\Windows\System\VDiOzHN.exe
  C:\Windows\System\VDiOzHN.exe
  2⤵
  PID:8828
- C:\Windows\System\aNOscmz.exe
  C:\Windows\System\aNOscmz.exe
  2⤵
  PID:8848
- C:\Windows\System\aYUkvaW.exe
  C:\Windows\System\aYUkvaW.exe
  2⤵
  PID:8868
- C:\Windows\System\bvSWItY.exe
  C:\Windows\System\bvSWItY.exe
  2⤵
  PID:8888
- C:\Windows\System\SRCFxkL.exe
  C:\Windows\System\SRCFxkL.exe
  2⤵
  PID:8908
- C:\Windows\System\rbNATzB.exe
  C:\Windows\System\rbNATzB.exe
  2⤵
  PID:8928
- C:\Windows\System\jpGhrnW.exe
  C:\Windows\System\jpGhrnW.exe
  2⤵
  PID:8952
- C:\Windows\System\WwzcCHi.exe
  C:\Windows\System\WwzcCHi.exe
  2⤵
  PID:8976
- C:\Windows\System\yzXiGsg.exe
  C:\Windows\System\yzXiGsg.exe
  2⤵
  PID:9004
- C:\Windows\System\BWmxSRp.exe
  C:\Windows\System\BWmxSRp.exe
  2⤵
  PID:9020
- C:\Windows\System\sdIKeYG.exe
  C:\Windows\System\sdIKeYG.exe
  2⤵
  PID:9052
- C:\Windows\System\vCgnJfk.exe
  C:\Windows\System\vCgnJfk.exe
  2⤵
  PID:9076
- C:\Windows\System\UkECDIn.exe
  C:\Windows\System\UkECDIn.exe
  2⤵
  PID:9092
- C:\Windows\System\anQUlSl.exe
  C:\Windows\System\anQUlSl.exe
  2⤵
  PID:9116
- C:\Windows\System\czwhEAs.exe
  C:\Windows\System\czwhEAs.exe
  2⤵
  PID:9140
- C:\Windows\System\AxMDysd.exe
  C:\Windows\System\AxMDysd.exe
  2⤵
  PID:9160
- C:\Windows\System\hqMBpBP.exe
  C:\Windows\System\hqMBpBP.exe
  2⤵
  PID:9180
- C:\Windows\System\rcJWhLA.exe
  C:\Windows\System\rcJWhLA.exe
  2⤵
  PID:9204
- C:\Windows\System\PSUPpBl.exe
  C:\Windows\System\PSUPpBl.exe
  2⤵
  PID:5376
- C:\Windows\System\VYPXUxa.exe
  C:\Windows\System\VYPXUxa.exe
  2⤵
  PID:7224
- C:\Windows\System\OIuxHqk.exe
  C:\Windows\System\OIuxHqk.exe
  2⤵
  PID:7264
- C:\Windows\System\yEeNotw.exe
  C:\Windows\System\yEeNotw.exe
  2⤵
  PID:6420
- C:\Windows\System\NApnqZP.exe
  C:\Windows\System\NApnqZP.exe
  2⤵
  PID:8152
- C:\Windows\System\aNrlKQe.exe
  C:\Windows\System\aNrlKQe.exe
  2⤵
  PID:8052
- C:\Windows\System\dRcjzoG.exe
  C:\Windows\System\dRcjzoG.exe
  2⤵
  PID:7820
- C:\Windows\System\BkVvftr.exe
  C:\Windows\System\BkVvftr.exe
  2⤵
  PID:7712
- C:\Windows\System\kUuiqPT.exe
  C:\Windows\System\kUuiqPT.exe
  2⤵
  PID:7664
- C:\Windows\System\JVdkjDM.exe
  C:\Windows\System\JVdkjDM.exe
  2⤵
  PID:7640
- C:\Windows\System\JKNXkUF.exe
  C:\Windows\System\JKNXkUF.exe
  2⤵
  PID:7596
- C:\Windows\System\KGJYrBz.exe
  C:\Windows\System\KGJYrBz.exe
  2⤵
  PID:7548
- C:\Windows\System\TEwFbNO.exe
  C:\Windows\System\TEwFbNO.exe
  2⤵
  PID:7508
- C:\Windows\System\cRUQaQJ.exe
  C:\Windows\System\cRUQaQJ.exe
  2⤵
  PID:7452
- C:\Windows\System\tTosGSP.exe
  C:\Windows\System\tTosGSP.exe
  2⤵
  PID:7408
- C:\Windows\System\ObCMgzf.exe
  C:\Windows\System\ObCMgzf.exe
  2⤵
  PID:7384
- C:\Windows\System\vhSPNxv.exe
  C:\Windows\System\vhSPNxv.exe
  2⤵
  PID:7312
- C:\Windows\System\DzHpiRs.exe
  C:\Windows\System\DzHpiRs.exe
  2⤵
  PID:7280
- C:\Windows\System\AKvuSvc.exe
  C:\Windows\System\AKvuSvc.exe
  2⤵
  PID:8356
- C:\Windows\System\EcgCBhu.exe
  C:\Windows\System\EcgCBhu.exe
  2⤵
  PID:6744
- C:\Windows\System\mnDRmYt.exe
  C:\Windows\System\mnDRmYt.exe
  2⤵
  PID:6944
- C:\Windows\System\gcKchPU.exe
  C:\Windows\System\gcKchPU.exe
  2⤵
  PID:7036
- C:\Windows\System\bNjDVmh.exe
  C:\Windows\System\bNjDVmh.exe
  2⤵
  PID:7128
- C:\Windows\System\FnOolaQ.exe
  C:\Windows\System\FnOolaQ.exe
  2⤵
  PID:6008
- C:\Windows\System\fkYRoKA.exe
  C:\Windows\System\fkYRoKA.exe
  2⤵
  PID:5084
- C:\Windows\System\zAmCQpX.exe
  C:\Windows\System\zAmCQpX.exe
  2⤵
  PID:5388
- C:\Windows\System\eFuFiso.exe
  C:\Windows\System\eFuFiso.exe
  2⤵
  PID:7760
- C:\Windows\System\ECjrgBq.exe
  C:\Windows\System\ECjrgBq.exe
  2⤵
  PID:8048
- C:\Windows\System\tbVnxTx.exe
  C:\Windows\System\tbVnxTx.exe
  2⤵
  PID:8240
- C:\Windows\System\vyuHMjh.exe
  C:\Windows\System\vyuHMjh.exe
  2⤵
  PID:9012
- C:\Windows\System\RmxZYoq.exe
  C:\Windows\System\RmxZYoq.exe
  2⤵
  PID:9100
- C:\Windows\System\DCHxVGk.exe
  C:\Windows\System\DCHxVGk.exe
  2⤵
  PID:9228
- C:\Windows\System\DluShcA.exe
  C:\Windows\System\DluShcA.exe
  2⤵
  PID:9248
- C:\Windows\System\zCqVQue.exe
  C:\Windows\System\zCqVQue.exe
  2⤵
  PID:9272
- C:\Windows\System\xSUxjAk.exe
  C:\Windows\System\xSUxjAk.exe
  2⤵
  PID:9296
- C:\Windows\System\mnrbUxI.exe
  C:\Windows\System\mnrbUxI.exe
  2⤵
  PID:9340
- C:\Windows\System\tSiUDBK.exe
  C:\Windows\System\tSiUDBK.exe
  2⤵
  PID:9360
- C:\Windows\System\HeDDUtX.exe
  C:\Windows\System\HeDDUtX.exe
  2⤵
  PID:9376
- C:\Windows\System\qmsnDkK.exe
  C:\Windows\System\qmsnDkK.exe
  2⤵
  PID:9396
- C:\Windows\System\evIcKkf.exe
  C:\Windows\System\evIcKkf.exe
  2⤵
  PID:9420
- C:\Windows\System\RhOHdvX.exe
  C:\Windows\System\RhOHdvX.exe
  2⤵
  PID:9604
- C:\Windows\System\XfQvAwS.exe
  C:\Windows\System\XfQvAwS.exe
  2⤵
  PID:9624
- C:\Windows\System\ZhgrNlN.exe
  C:\Windows\System\ZhgrNlN.exe
  2⤵
  PID:9640
- C:\Windows\System\dvMrzSL.exe
  C:\Windows\System\dvMrzSL.exe
  2⤵
  PID:9716
- C:\Windows\System\aIDncGQ.exe
  C:\Windows\System\aIDncGQ.exe
  2⤵
  PID:9732
- C:\Windows\System\zMgqwcV.exe
  C:\Windows\System\zMgqwcV.exe
  2⤵
  PID:9748
- C:\Windows\System\PrxuqpN.exe
  C:\Windows\System\PrxuqpN.exe
  2⤵
  PID:9764
- C:\Windows\System\TNveyKs.exe
  C:\Windows\System\TNveyKs.exe
  2⤵
  PID:9780
- C:\Windows\System\wcWOnQD.exe
  C:\Windows\System\wcWOnQD.exe
  2⤵
  PID:9796
- C:\Windows\System\mGuxsfr.exe
  C:\Windows\System\mGuxsfr.exe
  2⤵
  PID:9812
- C:\Windows\System\TSrfnWx.exe
  C:\Windows\System\TSrfnWx.exe
  2⤵
  PID:9828
- C:\Windows\System\jHnrBLn.exe
  C:\Windows\System\jHnrBLn.exe
  2⤵
  PID:9844
- C:\Windows\System\HDkacKG.exe
  C:\Windows\System\HDkacKG.exe
  2⤵
  PID:9860
- C:\Windows\System\rjOmZdf.exe
  C:\Windows\System\rjOmZdf.exe
  2⤵
  PID:9876
- C:\Windows\System\WuJAfEZ.exe
  C:\Windows\System\WuJAfEZ.exe
  2⤵
  PID:9892
- C:\Windows\System\AEwuqPu.exe
  C:\Windows\System\AEwuqPu.exe
  2⤵
  PID:9908
- C:\Windows\System\jQePcEx.exe
  C:\Windows\System\jQePcEx.exe
  2⤵
  PID:9928
- C:\Windows\System\ShqdeUP.exe
  C:\Windows\System\ShqdeUP.exe
  2⤵
  PID:9944
- C:\Windows\System\CzBLCfz.exe
  C:\Windows\System\CzBLCfz.exe
  2⤵
  PID:9960
- C:\Windows\System\ZrzWGNV.exe
  C:\Windows\System\ZrzWGNV.exe
  2⤵
  PID:9984
- C:\Windows\System\LgaZTuH.exe
  C:\Windows\System\LgaZTuH.exe
  2⤵
  PID:10004
- C:\Windows\System\ZSYFegc.exe
  C:\Windows\System\ZSYFegc.exe
  2⤵
  PID:10024
- C:\Windows\System\UMMKnAQ.exe
  C:\Windows\System\UMMKnAQ.exe
  2⤵
  PID:10052
- C:\Windows\System\SFfoSCv.exe
  C:\Windows\System\SFfoSCv.exe
  2⤵
  PID:10072
- C:\Windows\System\FPUYsSM.exe
  C:\Windows\System\FPUYsSM.exe
  2⤵
  PID:10092
- C:\Windows\System\pZBWDcT.exe
  C:\Windows\System\pZBWDcT.exe
  2⤵
  PID:10116
- C:\Windows\System\pcXNjiO.exe
  C:\Windows\System\pcXNjiO.exe
  2⤵
  PID:10136
- C:\Windows\System\YmOScer.exe
  C:\Windows\System\YmOScer.exe
  2⤵
  PID:10160
- C:\Windows\System\anvrsrE.exe
  C:\Windows\System\anvrsrE.exe
  2⤵
  PID:10184
- C:\Windows\System\XmNkTfP.exe
  C:\Windows\System\XmNkTfP.exe
  2⤵
  PID:10200
- C:\Windows\System\bjkCYrl.exe
  C:\Windows\System\bjkCYrl.exe
  2⤵
  PID:10224
- C:\Windows\System\HoGxTvr.exe
  C:\Windows\System\HoGxTvr.exe
  2⤵
  PID:8384
- C:\Windows\System\ZSBVtpI.exe
  C:\Windows\System\ZSBVtpI.exe
  2⤵
  PID:8112
- C:\Windows\System\pljBqkc.exe
  C:\Windows\System\pljBqkc.exe
  2⤵
  PID:8312
- C:\Windows\System\JGozyCX.exe
  C:\Windows\System\JGozyCX.exe
  2⤵
  PID:8836
- C:\Windows\System\EpOQjqq.exe
  C:\Windows\System\EpOQjqq.exe
  2⤵
  PID:9044
- C:\Windows\System\dmpzYks.exe
  C:\Windows\System\dmpzYks.exe
  2⤵
  PID:9108
- C:\Windows\System\RAGuWMD.exe
  C:\Windows\System\RAGuWMD.exe
  2⤵
  PID:9152
- C:\Windows\System\FpjLsEf.exe
  C:\Windows\System\FpjLsEf.exe
  2⤵
  PID:6432
- C:\Windows\System\ufIufcn.exe
  C:\Windows\System\ufIufcn.exe
  2⤵
  PID:8432
- C:\Windows\System\dRhJeva.exe
  C:\Windows\System\dRhJeva.exe
  2⤵
  PID:7240
- C:\Windows\System\DZrfVHF.exe
  C:\Windows\System\DZrfVHF.exe
  2⤵
  PID:5292
- C:\Windows\System\XsDxezm.exe
  C:\Windows\System\XsDxezm.exe
  2⤵
  PID:9188
- C:\Windows\System\aeTwmtM.exe
  C:\Windows\System\aeTwmtM.exe
  2⤵
  PID:8968
- C:\Windows\System\hhuzkYB.exe
  C:\Windows\System\hhuzkYB.exe
  2⤵
  PID:8884
- C:\Windows\System\fFvyEpP.exe
  C:\Windows\System\fFvyEpP.exe
  2⤵
  PID:8808
- C:\Windows\System\SdQqLUt.exe
  C:\Windows\System\SdQqLUt.exe
  2⤵
  PID:8764
- C:\Windows\System\pjQcfCF.exe
  C:\Windows\System\pjQcfCF.exe
  2⤵
  PID:8656
- C:\Windows\System\bstdzBk.exe
  C:\Windows\System\bstdzBk.exe
  2⤵
  PID:8636
- C:\Windows\System\STyMSri.exe
  C:\Windows\System\STyMSri.exe
  2⤵
  PID:8592
- C:\Windows\System\PMNLpxW.exe
  C:\Windows\System\PMNLpxW.exe
  2⤵
  PID:8544
- C:\Windows\System\DOIOrGm.exe
  C:\Windows\System\DOIOrGm.exe
  2⤵
  PID:8512
- C:\Windows\System\dzrSbIV.exe
  C:\Windows\System\dzrSbIV.exe
  2⤵
  PID:8480
- C:\Windows\System\QAhzWhY.exe
  C:\Windows\System\QAhzWhY.exe
  2⤵
  PID:8
- C:\Windows\System\Oixgxac.exe
  C:\Windows\System\Oixgxac.exe
  2⤵
  PID:7892
- C:\Windows\System\NKKeHSd.exe
  C:\Windows\System\NKKeHSd.exe
  2⤵
  PID:7716
- C:\Windows\System\PVPjdSm.exe
  C:\Windows\System\PVPjdSm.exe
  2⤵
  PID:7580
- C:\Windows\System\hyETSxE.exe
  C:\Windows\System\hyETSxE.exe
  2⤵
  PID:7512
- C:\Windows\System\coNbxnP.exe
  C:\Windows\System\coNbxnP.exe
  2⤵
  PID:7400
- C:\Windows\System\tvLSMNc.exe
  C:\Windows\System\tvLSMNc.exe
  2⤵
  PID:7288
- C:\Windows\System\GRyFiMC.exe
  C:\Windows\System\GRyFiMC.exe
  2⤵
  PID:6856
- C:\Windows\System\zfrCUpS.exe
  C:\Windows\System\zfrCUpS.exe
  2⤵
  PID:7052
- C:\Windows\System\wQnHhcw.exe
  C:\Windows\System\wQnHhcw.exe
  2⤵
  PID:4408
- C:\Windows\System\RlMnBAz.exe
  C:\Windows\System\RlMnBAz.exe
  2⤵
  PID:5436
- C:\Windows\System\yCoRKQs.exe
  C:\Windows\System\yCoRKQs.exe
  2⤵
  PID:8216
- C:\Windows\System\TrldreO.exe
  C:\Windows\System\TrldreO.exe
  2⤵
  PID:9068
- C:\Windows\System\wcoTrUl.exe
  C:\Windows\System\wcoTrUl.exe
  2⤵
  PID:9264
- C:\Windows\System\aOTAlBB.exe
  C:\Windows\System\aOTAlBB.exe
  2⤵
  PID:9292
- C:\Windows\System\qAwUnls.exe
  C:\Windows\System\qAwUnls.exe
  2⤵
  PID:9368
- C:\Windows\System\swRxuKr.exe
  C:\Windows\System\swRxuKr.exe
  2⤵
  PID:9404
- C:\Windows\System\QAFUvPS.exe
  C:\Windows\System\QAFUvPS.exe
  2⤵
  PID:9980
- C:\Windows\System\SUuNhvW.exe
  C:\Windows\System\SUuNhvW.exe
  2⤵
  PID:10740
- C:\Windows\System\BXPoMrx.exe
  C:\Windows\System\BXPoMrx.exe
  2⤵
  PID:10796
- C:\Windows\System\oTbGmMi.exe
  C:\Windows\System\oTbGmMi.exe
  2⤵
  PID:10880
- C:\Windows\System\WxbAdZv.exe
  C:\Windows\System\WxbAdZv.exe
  2⤵
  PID:10900
- C:\Windows\System\eLfVBqz.exe
  C:\Windows\System\eLfVBqz.exe
  2⤵
  PID:10916
- C:\Windows\System\edeEebp.exe
  C:\Windows\System\edeEebp.exe
  2⤵
  PID:10936
- C:\Windows\System\RgMgcYc.exe
  C:\Windows\System\RgMgcYc.exe
  2⤵
  PID:10952
- C:\Windows\System\oiYIWAo.exe
  C:\Windows\System\oiYIWAo.exe
  2⤵
  PID:10968
- C:\Windows\System\JSFULdf.exe
  C:\Windows\System\JSFULdf.exe
  2⤵
  PID:10984
- C:\Windows\System\YSPtxdR.exe
  C:\Windows\System\YSPtxdR.exe
  2⤵
  PID:11000
- C:\Windows\System\AIQswPF.exe
  C:\Windows\System\AIQswPF.exe
  2⤵
  PID:11016
- C:\Windows\System\RdlsRwT.exe
  C:\Windows\System\RdlsRwT.exe
  2⤵
  PID:11032
- C:\Windows\System\jgvzBfY.exe
  C:\Windows\System\jgvzBfY.exe
  2⤵
  PID:11048
- C:\Windows\System\ZHoTxiQ.exe
  C:\Windows\System\ZHoTxiQ.exe
  2⤵
  PID:11064
- C:\Windows\System\wWKvqok.exe
  C:\Windows\System\wWKvqok.exe
  2⤵
  PID:11084
- C:\Windows\System\rABMyzj.exe
  C:\Windows\System\rABMyzj.exe
  2⤵
  PID:11100
- C:\Windows\System\vJIxnHD.exe
  C:\Windows\System\vJIxnHD.exe
  2⤵
  PID:11116
- C:\Windows\System\PDKhwAc.exe
  C:\Windows\System\PDKhwAc.exe
  2⤵
  PID:11136
- C:\Windows\System\mvPgDhf.exe
  C:\Windows\System\mvPgDhf.exe
  2⤵
  PID:11160
- C:\Windows\System\pcAQuHR.exe
  C:\Windows\System\pcAQuHR.exe
  2⤵
  PID:11184
- C:\Windows\System\hVCMLGU.exe
  C:\Windows\System\hVCMLGU.exe
  2⤵
  PID:11200
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11200 -s 248
    3⤵
    PID:8560
- C:\Windows\System\yTNVMcv.exe
  C:\Windows\System\yTNVMcv.exe
  2⤵
  PID:11224
- C:\Windows\System\OifDyno.exe
  C:\Windows\System\OifDyno.exe
  2⤵
  PID:11240
- C:\Windows\System\JytDWEb.exe
  C:\Windows\System\JytDWEb.exe
  2⤵
  PID:9620
- C:\Windows\System\nQZrDas.exe
  C:\Windows\System\nQZrDas.exe
  2⤵
  PID:1840
- C:\Windows\System\bcnpMwx.exe
  C:\Windows\System\bcnpMwx.exe
  2⤵
  PID:9540
- C:\Windows\System\syuQebj.exe
  C:\Windows\System\syuQebj.exe
  2⤵
  PID:540
- C:\Windows\System\jBisDmO.exe
  C:\Windows\System\jBisDmO.exe
  2⤵
  PID:10048
- C:\Windows\System\lEbWqGr.exe
  C:\Windows\System\lEbWqGr.exe
  2⤵
  PID:9632
- C:\Windows\System\vFuHFQG.exe
  C:\Windows\System\vFuHFQG.exe
  2⤵
  PID:9728
- C:\Windows\System\LaWEtRu.exe
  C:\Windows\System\LaWEtRu.exe
  2⤵
  PID:9776
- C:\Windows\System\wtrgsuO.exe
  C:\Windows\System\wtrgsuO.exe
  2⤵
  PID:9808
- C:\Windows\System\YyERQZb.exe
  C:\Windows\System\YyERQZb.exe
  2⤵
  PID:9852
- C:\Windows\System\QEHjqCi.exe
  C:\Windows\System\QEHjqCi.exe
  2⤵
  PID:9904
- C:\Windows\System\ogdvuAx.exe
  C:\Windows\System\ogdvuAx.exe
  2⤵
  PID:9976
- C:\Windows\System\mhWRFsE.exe
  C:\Windows\System\mhWRFsE.exe
  2⤵
  PID:10100
- C:\Windows\System\nKWxpDS.exe
  C:\Windows\System\nKWxpDS.exe
  2⤵
  PID:10168
- C:\Windows\System\UoOOXCL.exe
  C:\Windows\System\UoOOXCL.exe
  2⤵
  PID:8116
- C:\Windows\System\AWuwiwy.exe
  C:\Windows\System\AWuwiwy.exe
  2⤵
  PID:9088
- C:\Windows\System\BBlvbJE.exe
  C:\Windows\System\BBlvbJE.exe
  2⤵
  PID:8400
- C:\Windows\System\zegQVIf.exe
  C:\Windows\System\zegQVIf.exe
  2⤵
  PID:8168
- C:\Windows\System\YAOUyYB.exe
  C:\Windows\System\YAOUyYB.exe
  2⤵
  PID:9212
- C:\Windows\System\wTfxVEr.exe
  C:\Windows\System\wTfxVEr.exe
  2⤵
  PID:8900
- C:\Windows\System\NeSAvyd.exe
  C:\Windows\System\NeSAvyd.exe
  2⤵
  PID:8784
- C:\Windows\System\pTKsDVD.exe
  C:\Windows\System\pTKsDVD.exe
  2⤵
  PID:8696
- C:\Windows\System\pAyHMgA.exe
  C:\Windows\System\pAyHMgA.exe
  2⤵
  PID:4104
- C:\Windows\System\YSWTzZI.exe
  C:\Windows\System\YSWTzZI.exe
  2⤵
  PID:8556
- C:\Windows\System\HAOhHMl.exe
  C:\Windows\System\HAOhHMl.exe
  2⤵
  PID:1504
- C:\Windows\System\xWUkfMv.exe
  C:\Windows\System\xWUkfMv.exe
  2⤵
  PID:7836
- C:\Windows\System\VxbUcZU.exe
  C:\Windows\System\VxbUcZU.exe
  2⤵
  PID:7608
- C:\Windows\System\bruQaSt.exe
  C:\Windows\System\bruQaSt.exe
  2⤵
  PID:7428
- C:\Windows\System\BtUkfXi.exe
  C:\Windows\System\BtUkfXi.exe
  2⤵
  PID:1068
- C:\Windows\System\dVQDpxT.exe
  C:\Windows\System\dVQDpxT.exe
  2⤵
  PID:6968
- C:\Windows\System\WqeYTPZ.exe
  C:\Windows\System\WqeYTPZ.exe
  2⤵
  PID:6172
- C:\Windows\System\EOBlAJm.exe
  C:\Windows\System\EOBlAJm.exe
  2⤵
  PID:9240
- C:\Windows\System\yQeSsXN.exe
  C:\Windows\System\yQeSsXN.exe
  2⤵
  PID:9356
- C:\Windows\System\WGOPnmE.exe
  C:\Windows\System\WGOPnmE.exe
  2⤵
  PID:9956
- C:\Windows\System\hVtunlW.exe
  C:\Windows\System\hVtunlW.exe
  2⤵
  PID:10220
- C:\Windows\System\mdaCEvQ.exe
  C:\Windows\System\mdaCEvQ.exe
  2⤵
  PID:10272
- C:\Windows\System\BbqUYxJ.exe
  C:\Windows\System\BbqUYxJ.exe
  2⤵
  PID:1192
- C:\Windows\System\HfDbMzp.exe
  C:\Windows\System\HfDbMzp.exe
  2⤵
  PID:2068
- C:\Windows\System\CamfrQe.exe
  C:\Windows\System\CamfrQe.exe
  2⤵
  PID:2272
- C:\Windows\System\bkVCTKq.exe
  C:\Windows\System\bkVCTKq.exe
  2⤵
  PID:4612
- C:\Windows\System\gWVomAW.exe
  C:\Windows\System\gWVomAW.exe
  2⤵
  PID:3780
- C:\Windows\System\OTzbOqE.exe
  C:\Windows\System\OTzbOqE.exe
  2⤵
  PID:2904
- C:\Windows\System\vGKSkjH.exe
  C:\Windows\System\vGKSkjH.exe
  2⤵
  PID:2324
- C:\Windows\System\aYIyWNS.exe
  C:\Windows\System\aYIyWNS.exe
  2⤵
  PID:832
- C:\Windows\System\bcFePtt.exe
  C:\Windows\System\bcFePtt.exe
  2⤵
  PID:4440
- C:\Windows\System\VdeBTJV.exe
  C:\Windows\System\VdeBTJV.exe
  2⤵
  PID:804
- C:\Windows\System\RVAFKLD.exe
  C:\Windows\System\RVAFKLD.exe
  2⤵
  PID:5856
- C:\Windows\System\lktPHUK.exe
  C:\Windows\System\lktPHUK.exe
  2⤵
  PID:4016
- C:\Windows\System\TbbqDza.exe
  C:\Windows\System\TbbqDza.exe
  2⤵
  PID:2704
- C:\Windows\System\DzIijtx.exe
  C:\Windows\System\DzIijtx.exe
  2⤵
  PID:1940
- C:\Windows\System\rLOzObm.exe
  C:\Windows\System\rLOzObm.exe
  2⤵
  PID:5012
- C:\Windows\System\mZLOcWW.exe
  C:\Windows\System\mZLOcWW.exe
  2⤵
  PID:6104
- C:\Windows\System\qOLSfCs.exe
  C:\Windows\System\qOLSfCs.exe
  2⤵
  PID:6416
- C:\Windows\System\NxPqqNl.exe
  C:\Windows\System\NxPqqNl.exe
  2⤵
  PID:10808
- C:\Windows\System\GjTHolU.exe
  C:\Windows\System\GjTHolU.exe
  2⤵
  PID:10932
- C:\Windows\System\QlWBBGA.exe
  C:\Windows\System\QlWBBGA.exe
  2⤵
  PID:6408
- C:\Windows\System\WcOYPgV.exe
  C:\Windows\System\WcOYPgV.exe
  2⤵
  PID:11044
- C:\Windows\System\iZLPwxT.exe
  C:\Windows\System\iZLPwxT.exe
  2⤵
  PID:11108
- C:\Windows\System\seUWjUR.exe
  C:\Windows\System\seUWjUR.exe
  2⤵
  PID:11236
- C:\Windows\System\SbpgdCF.exe
  C:\Windows\System\SbpgdCF.exe
  2⤵
  PID:9460
- C:\Windows\System\PSmwWSZ.exe
  C:\Windows\System\PSmwWSZ.exe
  2⤵
  PID:10772
- C:\Windows\System\PFbUbhp.exe
  C:\Windows\System\PFbUbhp.exe
  2⤵
  PID:9920
- C:\Windows\System\lNreKMq.exe
  C:\Windows\System\lNreKMq.exe
  2⤵
  PID:11288
- C:\Windows\System\yxfnqkS.exe
  C:\Windows\System\yxfnqkS.exe
  2⤵
  PID:11308
- C:\Windows\System\rWLnGpr.exe
  C:\Windows\System\rWLnGpr.exe
  2⤵
  PID:11332
- C:\Windows\System\FijRnaR.exe
  C:\Windows\System\FijRnaR.exe
  2⤵
  PID:11352
- C:\Windows\System\LdnBLwP.exe
  C:\Windows\System\LdnBLwP.exe
  2⤵
  PID:11372
- C:\Windows\System\fUpGnmQ.exe
  C:\Windows\System\fUpGnmQ.exe
  2⤵
  PID:11396
- C:\Windows\System\ejygxgB.exe
  C:\Windows\System\ejygxgB.exe
  2⤵
  PID:11416
- C:\Windows\System\qOODiCz.exe
  C:\Windows\System\qOODiCz.exe
  2⤵
  PID:11436
- C:\Windows\System\ItkZtqu.exe
  C:\Windows\System\ItkZtqu.exe
  2⤵
  PID:11464
- C:\Windows\System\eaBmYbd.exe
  C:\Windows\System\eaBmYbd.exe
  2⤵
  PID:11484
- C:\Windows\System\KJvjBGQ.exe
  C:\Windows\System\KJvjBGQ.exe
  2⤵
  PID:11500
- C:\Windows\System\zwXLGQD.exe
  C:\Windows\System\zwXLGQD.exe
  2⤵
  PID:11532
- C:\Windows\System\FWopmLj.exe
  C:\Windows\System\FWopmLj.exe
  2⤵
  PID:11552
- C:\Windows\System\QIWCZbz.exe
  C:\Windows\System\QIWCZbz.exe
  2⤵
  PID:11572
- C:\Windows\System\IOEcBPn.exe
  C:\Windows\System\IOEcBPn.exe
  2⤵
  PID:11592
- C:\Windows\System\QKrYSpN.exe
  C:\Windows\System\QKrYSpN.exe
  2⤵
  PID:11620
- C:\Windows\System\HVHYAEc.exe
  C:\Windows\System\HVHYAEc.exe
  2⤵
  PID:11636
- C:\Windows\System\DyUPlVe.exe
  C:\Windows\System\DyUPlVe.exe
  2⤵
  PID:11660
- C:\Windows\System\fHPuZWh.exe
  C:\Windows\System\fHPuZWh.exe
  2⤵
  PID:11680
- C:\Windows\System\CMCUXeZ.exe
  C:\Windows\System\CMCUXeZ.exe
  2⤵
  PID:11708
- C:\Windows\System\YaNQRhm.exe
  C:\Windows\System\YaNQRhm.exe
  2⤵
  PID:11728
- C:\Windows\System\KFBIiBz.exe
  C:\Windows\System\KFBIiBz.exe
  2⤵
  PID:11756
- C:\Windows\System\JTyhVAc.exe
  C:\Windows\System\JTyhVAc.exe
  2⤵
  PID:11776
- C:\Windows\System\XaNkYss.exe
  C:\Windows\System\XaNkYss.exe
  2⤵
  PID:11796
- C:\Windows\System\cbBuZrV.exe
  C:\Windows\System\cbBuZrV.exe
  2⤵
  PID:11832
- C:\Windows\System\diuroZF.exe
  C:\Windows\System\diuroZF.exe
  2⤵
  PID:11852
- C:\Windows\System\EPsxbqg.exe
  C:\Windows\System\EPsxbqg.exe
  2⤵
  PID:11876
- C:\Windows\System\nRNmoWu.exe
  C:\Windows\System\nRNmoWu.exe
  2⤵
  PID:11896
- C:\Windows\System\wTpWThH.exe
  C:\Windows\System\wTpWThH.exe
  2⤵
  PID:11924
- C:\Windows\System\hZRHyLJ.exe
  C:\Windows\System\hZRHyLJ.exe
  2⤵
  PID:11944
- C:\Windows\System\oJqGUcW.exe
  C:\Windows\System\oJqGUcW.exe
  2⤵
  PID:11968
- C:\Windows\System\IAJvkrR.exe
  C:\Windows\System\IAJvkrR.exe
  2⤵
  PID:11996
- C:\Windows\System\FQvORBq.exe
  C:\Windows\System\FQvORBq.exe
  2⤵
  PID:12016
- C:\Windows\System\XFPoLPS.exe
  C:\Windows\System\XFPoLPS.exe
  2⤵
  PID:12036
- C:\Windows\System\HVaCNdV.exe
  C:\Windows\System\HVaCNdV.exe
  2⤵
  PID:12056
- C:\Windows\System\IKEzQIS.exe
  C:\Windows\System\IKEzQIS.exe
  2⤵
  PID:12076
- C:\Windows\System\qbJQsYQ.exe
  C:\Windows\System\qbJQsYQ.exe
  2⤵
  PID:12096
- C:\Windows\System\NzgkTzx.exe
  C:\Windows\System\NzgkTzx.exe
  2⤵
  PID:12120
- C:\Windows\System\jlsMBrD.exe
  C:\Windows\System\jlsMBrD.exe
  2⤵
  PID:12136
- C:\Windows\System\kkshZTo.exe
  C:\Windows\System\kkshZTo.exe
  2⤵
  PID:12156
- C:\Windows\System\lsMpaqn.exe
  C:\Windows\System\lsMpaqn.exe
  2⤵
  PID:12176
- C:\Windows\System\gyPCcrO.exe
  C:\Windows\System\gyPCcrO.exe
  2⤵
  PID:12204
- C:\Windows\System\ZaGiiQB.exe
  C:\Windows\System\ZaGiiQB.exe
  2⤵
  PID:12224
- C:\Windows\System\INAWwRn.exe
  C:\Windows\System\INAWwRn.exe
  2⤵
  PID:12244
- C:\Windows\System\HjcoIMK.exe
  C:\Windows\System\HjcoIMK.exe
  2⤵
  PID:12272
- C:\Windows\System\gqmvfEe.exe
  C:\Windows\System\gqmvfEe.exe
  2⤵
  PID:10784
- C:\Windows\System\VOeMASc.exe
  C:\Windows\System\VOeMASc.exe
  2⤵
  PID:10832
- C:\Windows\System\kMTrSGG.exe
  C:\Windows\System\kMTrSGG.exe
  2⤵
  PID:4652
- C:\Windows\System\rqXYYCH.exe
  C:\Windows\System\rqXYYCH.exe
  2⤵
  PID:8640
- C:\Windows\System\iYohRhY.exe
  C:\Windows\System\iYohRhY.exe
  2⤵
  PID:7672
- C:\Windows\System\BpTKlNy.exe
  C:\Windows\System\BpTKlNy.exe
  2⤵
  PID:3052
- C:\Windows\System\XXCcGuo.exe
  C:\Windows\System\XXCcGuo.exe
  2⤵
  PID:9952
- C:\Windows\System\fjoJCiX.exe
  C:\Windows\System\fjoJCiX.exe
  2⤵
  PID:11172
- C:\Windows\System\UzDSGsa.exe
  C:\Windows\System\UzDSGsa.exe
  2⤵
  PID:1320
- C:\Windows\System\BXcTdxV.exe
  C:\Windows\System\BXcTdxV.exe
  2⤵
  PID:4764
- C:\Windows\System\KcADkpN.exe
  C:\Windows\System\KcADkpN.exe
  2⤵
  PID:9452
- C:\Windows\System\fEjABYD.exe
  C:\Windows\System\fEjABYD.exe
  2⤵
  PID:9568
- C:\Windows\System\WLBjcRl.exe
  C:\Windows\System\WLBjcRl.exe
  2⤵
  PID:2960
- C:\Windows\System\sZYnWNW.exe
  C:\Windows\System\sZYnWNW.exe
  2⤵
  PID:960
- C:\Windows\System\aDtdArE.exe
  C:\Windows\System\aDtdArE.exe
  2⤵
  PID:1316
- C:\Windows\System\CIfLOca.exe
  C:\Windows\System\CIfLOca.exe
  2⤵
  PID:4216
- C:\Windows\System\holyNrO.exe
  C:\Windows\System\holyNrO.exe
  2⤵
  PID:10980
- C:\Windows\System\TsAclNB.exe
  C:\Windows\System\TsAclNB.exe
  2⤵
  PID:9836
- C:\Windows\System\zixjFzD.exe
  C:\Windows\System\zixjFzD.exe
  2⤵
  PID:11232
- C:\Windows\System\dTzgZkr.exe
  C:\Windows\System\dTzgZkr.exe
  2⤵
  PID:12300
- C:\Windows\System\LflaVuB.exe
  C:\Windows\System\LflaVuB.exe
  2⤵
  PID:12320
- C:\Windows\System\sgtRwRz.exe
  C:\Windows\System\sgtRwRz.exe
  2⤵
  PID:12336
- C:\Windows\System\kYEvjQn.exe
  C:\Windows\System\kYEvjQn.exe
  2⤵
  PID:12368
- C:\Windows\System\FkOhutR.exe
  C:\Windows\System\FkOhutR.exe
  2⤵
  PID:12400
- C:\Windows\System\SnZRKXh.exe
  C:\Windows\System\SnZRKXh.exe
  2⤵
  PID:12420
- C:\Windows\System\fEYhZys.exe
  C:\Windows\System\fEYhZys.exe
  2⤵
  PID:12436
- C:\Windows\System\esdxEEh.exe
  C:\Windows\System\esdxEEh.exe
  2⤵
  PID:12456
- C:\Windows\System\pbXuWPo.exe
  C:\Windows\System\pbXuWPo.exe
  2⤵
  PID:12472
- C:\Windows\System\zyfkrat.exe
  C:\Windows\System\zyfkrat.exe
  2⤵
  PID:12488
- C:\Windows\System\ITNgkJc.exe
  C:\Windows\System\ITNgkJc.exe
  2⤵
  PID:12508
- C:\Windows\System\vhtubBE.exe
  C:\Windows\System\vhtubBE.exe
  2⤵
  PID:12528
- C:\Windows\System\YXnvuhs.exe
  C:\Windows\System\YXnvuhs.exe
  2⤵
  PID:12548
- C:\Windows\System\XlpKZCA.exe
  C:\Windows\System\XlpKZCA.exe
  2⤵
  PID:12572
- C:\Windows\System\bRIEUne.exe
  C:\Windows\System\bRIEUne.exe
  2⤵
  PID:12592
- C:\Windows\System\pwnFUCY.exe
  C:\Windows\System\pwnFUCY.exe
  2⤵
  PID:12612
- C:\Windows\System\JmRQTlk.exe
  C:\Windows\System\JmRQTlk.exe
  2⤵
  PID:12640
- C:\Windows\System\XZIBTOz.exe
  C:\Windows\System\XZIBTOz.exe
  2⤵
  PID:12656
- C:\Windows\System\dhBnzFx.exe
  C:\Windows\System\dhBnzFx.exe
  2⤵
  PID:12672
- C:\Windows\System\iqPsMJw.exe
  C:\Windows\System\iqPsMJw.exe
  2⤵
  PID:12692
- C:\Windows\System\BkWwDyz.exe
  C:\Windows\System\BkWwDyz.exe
  2⤵
  PID:12712
- C:\Windows\System\gTfxRYG.exe
  C:\Windows\System\gTfxRYG.exe
  2⤵
  PID:12732
- C:\Windows\System\DfoXDkQ.exe
  C:\Windows\System\DfoXDkQ.exe
  2⤵
  PID:12752
- C:\Windows\System\sZcGLHf.exe
  C:\Windows\System\sZcGLHf.exe
  2⤵
  PID:12768
- C:\Windows\System\LKBXBpm.exe
  C:\Windows\System\LKBXBpm.exe
  2⤵
  PID:12792
- C:\Windows\System\nmYYFma.exe
  C:\Windows\System\nmYYFma.exe
  2⤵
  PID:12808
- C:\Windows\System\gDSDEuC.exe
  C:\Windows\System\gDSDEuC.exe
  2⤵
  PID:12832
- C:\Windows\System\uXcXsZJ.exe
  C:\Windows\System\uXcXsZJ.exe
  2⤵
  PID:12852
- C:\Windows\System\BxyHuyO.exe
  C:\Windows\System\BxyHuyO.exe
  2⤵
  PID:12872
- C:\Windows\System\iYokFOc.exe
  C:\Windows\System\iYokFOc.exe
  2⤵
  PID:12892
- C:\Windows\System\oknExOX.exe
  C:\Windows\System\oknExOX.exe
  2⤵
  PID:12912
- C:\Windows\System\SEjJdll.exe
  C:\Windows\System\SEjJdll.exe
  2⤵
  PID:12940
- C:\Windows\System\MHhRdVv.exe
  C:\Windows\System\MHhRdVv.exe
  2⤵
  PID:12964
- C:\Windows\System\DHXUqmz.exe
  C:\Windows\System\DHXUqmz.exe
  2⤵
  PID:12988
- C:\Windows\System\gjPdHTw.exe
  C:\Windows\System\gjPdHTw.exe
  2⤵
  PID:13004
- C:\Windows\System\YdTjCYw.exe
  C:\Windows\System\YdTjCYw.exe
  2⤵
  PID:13028
- C:\Windows\System\AxzasgL.exe
  C:\Windows\System\AxzasgL.exe
  2⤵
  PID:13052
- C:\Windows\System\zvGdLfk.exe
  C:\Windows\System\zvGdLfk.exe
  2⤵
  PID:13072
- C:\Windows\System\npIJqyx.exe
  C:\Windows\System\npIJqyx.exe
  2⤵
  PID:13096
- C:\Windows\System\sHZZzHG.exe
  C:\Windows\System\sHZZzHG.exe
  2⤵
  PID:13116
- C:\Windows\System\UgHkNXL.exe
  C:\Windows\System\UgHkNXL.exe
  2⤵
  PID:13140
- C:\Windows\System\CAQihIa.exe
  C:\Windows\System\CAQihIa.exe
  2⤵
  PID:13160
- C:\Windows\System\xCfuoXv.exe
  C:\Windows\System\xCfuoXv.exe
  2⤵
  PID:13184
- C:\Windows\System\MaTNQCD.exe
  C:\Windows\System\MaTNQCD.exe
  2⤵
  PID:13212
- C:\Windows\System\ksFqreK.exe
  C:\Windows\System\ksFqreK.exe
  2⤵
  PID:13232
- C:\Windows\System\tOhriCc.exe
  C:\Windows\System\tOhriCc.exe
  2⤵
  PID:13256
- C:\Windows\System\BvmmxQQ.exe
  C:\Windows\System\BvmmxQQ.exe
  2⤵
  PID:13276
- C:\Windows\System\zggDrby.exe
  C:\Windows\System\zggDrby.exe
  2⤵
  PID:13292
- C:\Windows\System\FRHhHNS.exe
  C:\Windows\System\FRHhHNS.exe
  2⤵
  PID:9724
- C:\Windows\System\tadYzPz.exe
  C:\Windows\System\tadYzPz.exe
  2⤵
  PID:10792
- C:\Windows\System\bcAcpmp.exe
  C:\Windows\System\bcAcpmp.exe
  2⤵
  PID:11476
- C:\Windows\System\UeSCxUn.exe
  C:\Windows\System\UeSCxUn.exe
  2⤵
  PID:10848
- C:\Windows\System\duJXPSx.exe
  C:\Windows\System\duJXPSx.exe
  2⤵
  PID:10864
- C:\Windows\System\eCkUWRc.exe
  C:\Windows\System\eCkUWRc.exe
  2⤵
  PID:10892
- C:\Windows\System\NfclyVn.exe
  C:\Windows\System\NfclyVn.exe
  2⤵
  PID:11560
- C:\Windows\System\UApmglf.exe
  C:\Windows\System\UApmglf.exe
  2⤵
  PID:11648
- C:\Windows\System\UyPpruZ.exe
  C:\Windows\System\UyPpruZ.exe
  2⤵
  PID:11724
- C:\Windows\System\RsnNHlf.exe
  C:\Windows\System\RsnNHlf.exe
  2⤵
  PID:3440
- C:\Windows\System\agvUqFJ.exe
  C:\Windows\System\agvUqFJ.exe
  2⤵
  PID:8496
- C:\Windows\System\QFCawDq.exe
  C:\Windows\System\QFCawDq.exe
  2⤵
  PID:1404
- C:\Windows\System\SuOdEaQ.exe
  C:\Windows\System\SuOdEaQ.exe
  2⤵
  PID:11844
- C:\Windows\System\tWoqSey.exe
  C:\Windows\System\tWoqSey.exe
  2⤵
  PID:7516
- C:\Windows\System\EZoQAZi.exe
  C:\Windows\System\EZoQAZi.exe
  2⤵
  PID:11988
- C:\Windows\System\MAnIENN.exe
  C:\Windows\System\MAnIENN.exe
  2⤵
  PID:12028
- C:\Windows\System\omTNKeG.exe
  C:\Windows\System\omTNKeG.exe
  2⤵
  PID:12112
- C:\Windows\System\rVjWQqA.exe
  C:\Windows\System\rVjWQqA.exe
  2⤵
  PID:12168
- C:\Windows\System\QOgYrgk.exe
  C:\Windows\System\QOgYrgk.exe
  2⤵
  PID:12192
- C:\Windows\System\BBbxWKx.exe
  C:\Windows\System\BBbxWKx.exe
  2⤵
  PID:12216
- C:\Windows\System\UbjpMYg.exe
  C:\Windows\System\UbjpMYg.exe
  2⤵
  PID:4292
- C:\Windows\System\xziLXUv.exe
  C:\Windows\System\xziLXUv.exe
  2⤵
  PID:12240
- C:\Windows\System\WBCtWhI.exe
  C:\Windows\System\WBCtWhI.exe
  2⤵
  PID:12268
- C:\Windows\System\ezUqTFe.exe
  C:\Windows\System\ezUqTFe.exe
  2⤵
  PID:3520
- C:\Windows\System\eZWJYYB.exe
  C:\Windows\System\eZWJYYB.exe
  2⤵
  PID:2836
- C:\Windows\System\etnjJCG.exe
  C:\Windows\System\etnjJCG.exe
  2⤵
  PID:11096
- C:\Windows\System\OmegVIn.exe
  C:\Windows\System\OmegVIn.exe
  2⤵
  PID:3720
- C:\Windows\System\yuxxcGm.exe
  C:\Windows\System\yuxxcGm.exe
  2⤵
  PID:11260
- C:\Windows\System\IPtidEK.exe
  C:\Windows\System\IPtidEK.exe
  2⤵
  PID:13328
- C:\Windows\System\yfENvsb.exe
  C:\Windows\System\yfENvsb.exe
  2⤵
  PID:13348
- C:\Windows\System\HUrAKPK.exe
  C:\Windows\System\HUrAKPK.exe
  2⤵
  PID:13384
- C:\Windows\System\pGFtwyR.exe
  C:\Windows\System\pGFtwyR.exe
  2⤵
  PID:13400
- C:\Windows\System\ThPyTNW.exe
  C:\Windows\System\ThPyTNW.exe
  2⤵
  PID:13416
- C:\Windows\System\JHLAkFN.exe
  C:\Windows\System\JHLAkFN.exe
  2⤵
  PID:13436
- C:\Windows\System\nJMeIUr.exe
  C:\Windows\System\nJMeIUr.exe
  2⤵
  PID:13452
- C:\Windows\System\pivopaQ.exe
  C:\Windows\System\pivopaQ.exe
  2⤵
  PID:13468
- C:\Windows\System\rliZxZy.exe
  C:\Windows\System\rliZxZy.exe
  2⤵
  PID:13488
- C:\Windows\System\VPikJHk.exe
  C:\Windows\System\VPikJHk.exe
  2⤵
  PID:13512
- C:\Windows\System\CCRVcNI.exe
  C:\Windows\System\CCRVcNI.exe
  2⤵
  PID:13532
- C:\Windows\System\tOTTQMZ.exe
  C:\Windows\System\tOTTQMZ.exe
  2⤵
  PID:13552
- C:\Windows\System\KXtCGaQ.exe
  C:\Windows\System\KXtCGaQ.exe
  2⤵
  PID:13572
- C:\Windows\System\wplQlpr.exe
  C:\Windows\System\wplQlpr.exe
  2⤵
  PID:13592
- C:\Windows\System\ckJKjJm.exe
  C:\Windows\System\ckJKjJm.exe
  2⤵
  PID:13608
- C:\Windows\System\qlaNPKp.exe
  C:\Windows\System\qlaNPKp.exe
  2⤵
  PID:13628
- C:\Windows\System\MiWUkoi.exe
  C:\Windows\System\MiWUkoi.exe
  2⤵
  PID:13648
- C:\Windows\System\TBwndRp.exe
  C:\Windows\System\TBwndRp.exe
  2⤵
  PID:13668
- C:\Windows\System\DibuZpE.exe
  C:\Windows\System\DibuZpE.exe
  2⤵
  PID:13692
- C:\Windows\System\UhOsrKM.exe
  C:\Windows\System\UhOsrKM.exe
  2⤵
  PID:13708
- C:\Windows\System\HXrLvFt.exe
  C:\Windows\System\HXrLvFt.exe
  2⤵
  PID:13728
- C:\Windows\System\usJwVuh.exe
  C:\Windows\System\usJwVuh.exe
  2⤵
  PID:13748
- C:\Windows\System\wucWjbx.exe
  C:\Windows\System\wucWjbx.exe
  2⤵
  PID:13764
- C:\Windows\System\ivajbtH.exe
  C:\Windows\System\ivajbtH.exe
  2⤵
  PID:13784
- C:\Windows\System\cBfdUNi.exe
  C:\Windows\System\cBfdUNi.exe
  2⤵
  PID:13804
- C:\Windows\System\OEBbchy.exe
  C:\Windows\System\OEBbchy.exe
  2⤵
  PID:13824
- C:\Windows\System\xZGGeRH.exe
  C:\Windows\System\xZGGeRH.exe
  2⤵
  PID:13844
- C:\Windows\System\sLLmTCm.exe
  C:\Windows\System\sLLmTCm.exe
  2⤵
  PID:13868
- C:\Windows\System\fRLabLC.exe
  C:\Windows\System\fRLabLC.exe
  2⤵
  PID:13892
- C:\Windows\System\JwsWtbL.exe
  C:\Windows\System\JwsWtbL.exe
  2⤵
  PID:13912
- C:\Windows\System\BPdxEpL.exe
  C:\Windows\System\BPdxEpL.exe
  2⤵
  PID:13936
- C:\Windows\System\hGUwBAL.exe
  C:\Windows\System\hGUwBAL.exe
  2⤵
  PID:13956
- C:\Windows\System\bkoBWtK.exe
  C:\Windows\System\bkoBWtK.exe
  2⤵
  PID:13980
- C:\Windows\System\ODsILYp.exe
  C:\Windows\System\ODsILYp.exe
  2⤵
  PID:14000
- C:\Windows\System\uXIsFUg.exe
  C:\Windows\System\uXIsFUg.exe
  2⤵
  PID:14016
- C:\Windows\System\heiaiqd.exe
  C:\Windows\System\heiaiqd.exe
  2⤵
  PID:14036
- C:\Windows\System\HwMQAbo.exe
  C:\Windows\System\HwMQAbo.exe
  2⤵
  PID:14052
- C:\Windows\System\aMxawaP.exe
  C:\Windows\System\aMxawaP.exe
  2⤵
  PID:14068
- C:\Windows\System\oxmpGaL.exe
  C:\Windows\System\oxmpGaL.exe
  2⤵
  PID:14088
- C:\Windows\System\TgdoMLn.exe
  C:\Windows\System\TgdoMLn.exe
  2⤵
  PID:14108
- C:\Windows\System\octxKLM.exe
  C:\Windows\System\octxKLM.exe
  2⤵
  PID:14128
- C:\Windows\System\nudYDqF.exe
  C:\Windows\System\nudYDqF.exe
  2⤵
  PID:14148
- C:\Windows\System\zRqnXOq.exe
  C:\Windows\System\zRqnXOq.exe
  2⤵
  PID:14168
- C:\Windows\System\YFTYiMc.exe
  C:\Windows\System\YFTYiMc.exe
  2⤵
  PID:14184
- C:\Windows\System\ENgPvOl.exe
  C:\Windows\System\ENgPvOl.exe
  2⤵
  PID:14200
- C:\Windows\System\OhvcNax.exe
  C:\Windows\System\OhvcNax.exe
  2⤵
  PID:14216
- C:\Windows\System\kESfwzD.exe
  C:\Windows\System\kESfwzD.exe
  2⤵
  PID:14236
- C:\Windows\System\AWhkjFQ.exe
  C:\Windows\System\AWhkjFQ.exe
  2⤵
  PID:14256
- C:\Windows\System\fGvWGMi.exe
  C:\Windows\System\fGvWGMi.exe
  2⤵
  PID:14280
- C:\Windows\System\XhpMSMA.exe
  C:\Windows\System\XhpMSMA.exe
  2⤵
  PID:14304
- C:\Windows\System\jFXUivI.exe
  C:\Windows\System\jFXUivI.exe
  2⤵
  PID:14320
- C:\Windows\System\QEuXNJN.exe
  C:\Windows\System\QEuXNJN.exe
  2⤵
  PID:828
- C:\Windows\System\GrHkEPY.exe
  C:\Windows\System\GrHkEPY.exe
  2⤵
  PID:10820
- C:\Windows\System\MBjyiWw.exe
  C:\Windows\System\MBjyiWw.exe
  2⤵
  PID:12328
- C:\Windows\System\liTGkWN.exe
  C:\Windows\System\liTGkWN.exe
  2⤵
  PID:11316
- C:\Windows\System\vlMzURU.exe
  C:\Windows\System\vlMzURU.exe
  2⤵
  PID:11340
- C:\Windows\System\hyLpBTA.exe
  C:\Windows\System\hyLpBTA.exe
  2⤵
  PID:11368
- C:\Windows\System\HBzaycx.exe
  C:\Windows\System\HBzaycx.exe
  2⤵
  PID:11404
- C:\Windows\System\KkBiWqt.exe
  C:\Windows\System\KkBiWqt.exe
  2⤵
  PID:11412
- C:\Windows\System\CzlRcGC.exe
  C:\Windows\System\CzlRcGC.exe
  2⤵
  PID:11452
- C:\Windows\System\atmpFzF.exe
  C:\Windows\System\atmpFzF.exe
  2⤵
  PID:12428
- C:\Windows\System\zcitwbb.exe
  C:\Windows\System\zcitwbb.exe
  2⤵
  PID:11512
- C:\Windows\System\xbKSseA.exe
  C:\Windows\System\xbKSseA.exe
  2⤵
  PID:12520
- C:\Windows\System\eDqinBN.exe
  C:\Windows\System\eDqinBN.exe
  2⤵
  PID:14044
- C:\Windows\System\beCjEjN.exe
  C:\Windows\System\beCjEjN.exe
  2⤵
  PID:14084
- C:\Windows\System\RXiaMKn.exe
  C:\Windows\System\RXiaMKn.exe
  2⤵
  PID:11700
- C:\Windows\System\ZKTcUXD.exe
  C:\Windows\System\ZKTcUXD.exe
  2⤵
  PID:11524
- C:\Windows\System\aasLher.exe
  C:\Windows\System\aasLher.exe
  2⤵
  PID:12608
- C:\Windows\System\RVPddxl.exe
  C:\Windows\System\RVPddxl.exe
  2⤵
  PID:12908
- C:\Windows\System\yLWSdnk.exe
  C:\Windows\System\yLWSdnk.exe
  2⤵
  PID:11872
- C:\Windows\System\GrzMgxx.exe
  C:\Windows\System\GrzMgxx.exe
  2⤵
  PID:12700
- C:\Windows\System\IFoOdXg.exe
  C:\Windows\System\IFoOdXg.exe
  2⤵
  PID:376
- C:\Windows\System\BVFkYUk.exe
  C:\Windows\System\BVFkYUk.exe
  2⤵
  PID:8672
- C:\Windows\System\knpiReA.exe
  C:\Windows\System\knpiReA.exe
  2⤵
  PID:4224
- C:\Windows\System\nOGYJgY.exe
  C:\Windows\System\nOGYJgY.exe
  2⤵
  PID:11132
- C:\Windows\System\wyQPovY.exe
  C:\Windows\System\wyQPovY.exe
  2⤵
  PID:3180
- C:\Windows\System\bjlKjnN.exe
  C:\Windows\System\bjlKjnN.exe
  2⤵
  PID:13252
- C:\Windows\System\mNkZquL.exe
  C:\Windows\System\mNkZquL.exe
  2⤵
  PID:13412
- C:\Windows\System\vspvJYQ.exe
  C:\Windows\System\vspvJYQ.exe
  2⤵
  PID:13480
- C:\Windows\System\dVzQxAR.exe
  C:\Windows\System\dVzQxAR.exe
  2⤵
  PID:12292
- C:\Windows\System\BMggHYX.exe
  C:\Windows\System\BMggHYX.exe
  2⤵
  PID:12408
- C:\Windows\System\skrzsfH.exe
  C:\Windows\System\skrzsfH.exe
  2⤵
  PID:13776
- C:\Windows\System\fgedDxo.exe
  C:\Windows\System\fgedDxo.exe
  2⤵
  PID:12564
- C:\Windows\System\mHxlTqZ.exe
  C:\Windows\System\mHxlTqZ.exe
  2⤵
  PID:12604
- C:\Windows\System\xlNUiRl.exe
  C:\Windows\System\xlNUiRl.exe
  2⤵
  PID:12764
- C:\Windows\System\mQaJFsN.exe
  C:\Windows\System\mQaJFsN.exe
  2⤵
  PID:14176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BPVsXWA.exe

Path C:\Windows\System\BPVsXWA.exe
Size 1.5MB
SHA256 3017eba419b7173a1027bc6e362384e514d4d7d83de6807b5ef1719486b8f71e
MD5 42d7d195e85194e81a71a58a051860dc
SHA1 150a540ee1e2727a0900fe96de746f2797479624
SHA512 ec3c8a25c3b70afa57f826e81dfff2355c9ba4796f577cccea8d92006a05c92522b23aa0b4b614c5c86b6f8407456ea9350d5389f2475a2d54303a79d203ce08
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAe:ROdWCCi7/rahOYFoIBmCyP
MD5 SHA1 SHA512 SSDEEP

Submit Download

BbcgjVV.exe

Path C:\Windows\System\BbcgjVV.exe
Size 1.5MB
SHA256 f8bf529701479315e82cc03e5ac1e7b94276d98d16583659cee25b323a707456
MD5 bc271353b24b33430fa322a187e4037d
SHA1 72d3ca2d957dfefa94b824dc28bef5a4237d430a
SHA512 2183aec89bcd0550efdc1de0ed78d8a6236d56c3b7c966d803243821dfe7f42a17d96458f55d845797eddcab9a464007b6285603dd5d99dc52f68986f899e2e2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAg:ROdWCCi7/rahOYFoIBmCy9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCeNzqZ.exe

Path C:\Windows\System\CCeNzqZ.exe
Size 1.5MB
SHA256 a9a82cf07a5a74362502570350c17d9dd2857f2f0ad65317ef3b64017c37757e
MD5 5eaadf02317d1c2633c1892fe60d0906
SHA1 29bbbe8ce368bebfa1c167d978b5f86cab77ab6d
SHA512 63be5f2185912dca8acb063dd2e8ea11f4ec6d45ff4f3c70a0c0b6ccbc4cbb2fff22fdfd4a23c0c0d3d04268960011c5482d943fb2834147d061aa1a99b29cf2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAp:ROdWCCi7/rahOYFoIBmCyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

FuTRVfk.exe

Path C:\Windows\System\FuTRVfk.exe
Size 1.5MB
SHA256 48d83ef9ea8b13350a737f89693f2b68516ae631a8724be86729ac831217e0b4
MD5 a5daae11d74619fb336475ba63942e6f
SHA1 2674b4909b943d2fc8da4ef49bcf0cdce79e7614
SHA512 5816e74b8d436eac9abda2a807185fffa711dffdae240e24bd563f0a3374762aa709f37edce433545c616721006cb561401543840f55c49b8a6e43a52eb13f53
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAi:ROdWCCi7/rahOYFoIBmCyN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDuKxsj.exe

Path C:\Windows\System\HDuKxsj.exe
Size 1.5MB
SHA256 485de1b76a288f3ccb26433a8d2bdf554e70549dcbfe8dca98ba04248a2ac1ec
MD5 a0f2091d884b8f3b44271cfa925cdc01
SHA1 7d5a37c20832999c4b06f07eb8ac7f9fc6c93e3e
SHA512 2dbbfc1552d759ba1ec0515ceb9b62ce7f77c8766cdc79516da144c081ffb903e7958814c53eb383466d144f1eaa626bd286bc97de4e8682ea9af065ac8ac9a8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAz:ROdWCCi7/rahOYFoIBmCyW
MD5 SHA1 SHA512 SSDEEP

Submit Download

HGHQzIi.exe

Path C:\Windows\System\HGHQzIi.exe
Size 1.5MB
SHA256 7f64eca07aaf0f7535b1eabdf4199f1783b635ae467f32cd12d2006ec97b0759
MD5 eedf28d53258e7f81ddc2101c2c4200f
SHA1 965204943e8a256016477a739bf52b64b0d0bdd7
SHA512 ae2217a7cfe3bef39fa9d04672af7ac08c1a20526e5131b0482e73f9efbdf620c9c222b93bebf55ff54e3a7914c01431f6ea799f094fafe975fd741dd345b42f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA8:ROdWCCi7/rahOYFoIBmCy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

HTYolLq.exe

Path C:\Windows\System\HTYolLq.exe
Size 1.5MB
SHA256 44f22d8481b342fbc8b04cc44bfaedfedb00128c8a8b2fec6dcdcf84ebcd6979
MD5 e931f71d79a1fce00636428573b0d30f
SHA1 d943ebefcaadcc54b1deef49d7488e640b67f1bc
SHA512 2806604e2e463ffb46f3a324b2655dd3cc1b9110c171fb48bca6ba5034eb9c9a39f84b8bcbb1a7df4b304b8b810e8e008ca21020962695d3145bdc6aeda4b477
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAJ:ROdWCCi7/rahOYFoIBmCym
MD5 SHA1 SHA512 SSDEEP

Submit Download

ICQAGFk.exe

Path C:\Windows\System\ICQAGFk.exe
Size 1.5MB
SHA256 2001ef775dee8a18b3852ba0cfa54197e55b18a78d884f0458e06ef40faf4b06
MD5 37d4f3d81c291414ea9b9291d7374530
SHA1 d440bea03824a435961fc32944623d2aa0a64a74
SHA512 8e32a0782d43f9425ad020ef2efb38b135f2f39732ff277ed9aad5bb47b5905a69a87aa5daf5899ead2ea4d7a5996440da24c1bf088f94b01eeb2ba5db9c623b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAZ:ROdWCCi7/rahOYFoIBmCyc
MD5 SHA1 SHA512 SSDEEP

Submit Download

JnswCQQ.exe

Path C:\Windows\System\JnswCQQ.exe
Size 1.5MB
SHA256 761bf039bc17a8eccf2ddf8857c6b0801c4237948685582390af5090c45da959
MD5 977a3b85f4ea12a5ad7bcc1ad68f77c8
SHA1 9db22907abbf83ecdb45668b660088b548e8b021
SHA512 927248936c43ecbe59444ad7af35a2bd7fddcfe340704988b86f6ff3878543690ac940be47a2198d51264d296348decf2881372cb54607b1511991e44055b70f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAv:ROdWCCi7/rahOYFoIBmCyo
MD5 SHA1 SHA512 SSDEEP

Submit Download

KVNWlCe.exe

Path C:\Windows\System\KVNWlCe.exe
Size 1.5MB
SHA256 2414266c76b6f2391865916a5236d29701e9e4cac40bcffb0a7799f054aa731d
MD5 3fcfd8efbfcdf5fd87bcdc67dce079da
SHA1 ad078a3f051e698ad701a1cbbad8c78abbc208cf
SHA512 4ae8046294a8697005fd1300766c096d5c563f0ed1474ec43aa061f77a6a584367b1112d6be0fcb04afc3b181ccb5dab3e1ec18cea491393aa3bf60d030cbcad
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAv:ROdWCCi7/rahOYFoIBmCyq
MD5 SHA1 SHA512 SSDEEP

Submit Download

NlTIkjP.exe

Path C:\Windows\System\NlTIkjP.exe
Size 1.5MB
SHA256 d9f0cab6a74cb855cd053286e647afc28b031b58d7d4a8ecc5b38bfaba639c59
MD5 13247ca2cd0d4a2446bed6c15b3c9810
SHA1 41a69c6fba7d4302d18a24d5064b5a9bdbaa3e47
SHA512 5e355fadbbeb4184bbcaacc47475338bc703687ce9d0796ee823cacb8099dc4ceacc897cc308da1f3e67afc9bc3d89c1bcc6a1cf5773700e818961600256fbe0
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA1:ROdWCCi7/rahOYFoIBmCyK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODKEyEC.exe

Path C:\Windows\System\ODKEyEC.exe
Size 1.5MB
SHA256 1756eadcac96a4b052afc4d5611e0ad55f4934af07502f1b1af92f02954cb87e
MD5 108e61b62d8016a61131f3380db97ab4
SHA1 3eafd102adea3ab457b1b1299e311b1ba3f33813
SHA512 3b7b2eff230791cc6fcd925f8175756eea7f928c0fee8175f939347698a44d0744ce2cdfb8c0cb7129589381a44a7be8c21c9586ca786e8882457d1a6263cf9d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA9:ROdWCCi7/rahOYFoIBmCyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

PyLRFpz.exe

Path C:\Windows\System\PyLRFpz.exe
Size 1.5MB
SHA256 c45542e3171c52e4bf01945fc607c89c7483097222bff99182ee65ba43ba5662
MD5 d30051fd80b8103d392965ff3cf83789
SHA1 8091ca9cf2369265d744bc6368a8f5c5b39532df
SHA512 757de8d45baae4ba7ceff2a32f89dc45c6d51159602d424344c266e4b094743cff09799df1b87e8c94eee2a07c5e53976faa20ed4a1b86c89af613eb14b506f6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAw:ROdWCCi7/rahOYFoIBmCyV
MD5 SHA1 SHA512 SSDEEP

Submit Download

SSbszAK.exe

Path C:\Windows\System\SSbszAK.exe
Size 1.5MB
SHA256 8ba669a17fc432d2c6969196b23336a2466789ebd2f45d33162aeaa2123a13c0
MD5 25fa94053991c12d48a7fe2a6e648401
SHA1 c0d9af4c02fd2876769e6e926d93acca0ac9e96f
SHA512 564d8faf4cee860a85d372ea9cce8f1b1f8ba59a1170ff9bbedcb4ee1707cc103c2c8d18ff1346006756bb971b6aec6fc4601af334a30a0ae52f5877d03907b6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAS:ROdWCCi7/rahOYFoIBmCyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScYnhrH.exe

Path C:\Windows\System\ScYnhrH.exe
Size 1.5MB
SHA256 c0080d4ba9563ed576547438b09535f969a2a43404509ccbdeaa9c48f658c136
MD5 66087ac969dcf14cfb15eec95a828e55
SHA1 729b309677c30f8ee6ce528526862a624aeca38f
SHA512 197298af0ba457df0d8492168c14de49750b24f2aa42c50421ccc97382f88959842d4c9388fba3db9b20feeadca6ce32c9adfa33083c4b2fcb25628ff7c5425a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAw:ROdWCCi7/rahOYFoIBmCy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TvdhKQM.exe

Path C:\Windows\System\TvdhKQM.exe
Size 1.5MB
SHA256 a7c7d0cea97a140455da1cc4444d42a3bef2de5f6c013996add5c90e00abbbb5
MD5 afbb7c6d3ca5ca46b171a356ece94534
SHA1 b836a27b10066b91c18cae6f047cb6e73135afaf
SHA512 4538bb4c381d7d92702945fd67ec49f7741668cbb58648d7c25002e27f6fc278c76acf59d9d16010a47cec4cc15f13fa139899c79d20e3c32f195a6129b103ef
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAF:ROdWCCi7/rahOYFoIBmCy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

VGmiUQT.exe

Path C:\Windows\System\VGmiUQT.exe
Size 1.5MB
SHA256 80874f50ad0a43022155a98786de02838586b51ced0bcc0285868f3f98da64ce
MD5 dcd66447cd59e3e8293c40c01670b0a7
SHA1 58f1a41846227dd88025482c22a465c60c6a32d1
SHA512 dad9c359fb1939c7d7189a47747f73748b54d5ec74dc8318f2a7faec315d9e14ce7897910bc36034a4089b3569739c19efa6ece35c7e37366ceef1cdfa85545f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAl:ROdWCCi7/rahOYFoIBmCy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrRsKFG.exe

Path C:\Windows\System\WrRsKFG.exe
Size 1.5MB
SHA256 9c56f52a4582c4d8df1da9c1c976ec9fb21d94eba3d3fab9e31a5b6436c3fc93
MD5 8d82446622521d38e9d9eb9b5d1cf573
SHA1 5181ada401748524a06141a42d65b46a14013491
SHA512 2c48ff9dbee78ffb1ecde5c8f9eea31eab58f140a0f9998805e7a0ff88584b6eacd37249e1d2106cbd12b2a42de9c8fc02ef71bdf0c1d5678047c6dd8a2aed82
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA5:ROdWCCi7/rahOYFoIBmCyc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZHtZXNE.exe

Path C:\Windows\System\ZHtZXNE.exe
Size 1.5MB
SHA256 b754a09107dec79abfeb13cf1871ad015781b77967addc7a7ce4eea00ca0073d
MD5 9e96d31ce04f62307b63d440eb465dcb
SHA1 10fc4d52399b5652a0f029b5dc580e2653ff1cec
SHA512 b562bf644889adc826af96751b0e6c9fb01da735741e6070883aaea106ddbdfab80b3832b5695f29c2388a3650688891f9c5eb1779625df3ef52d4753f81a9f8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAV:ROdWCCi7/rahOYFoIBmCyA
MD5 SHA1 SHA512 SSDEEP

Submit Download

fDxSjqz.exe

Path C:\Windows\System\fDxSjqz.exe
Size 1.5MB
SHA256 68665fe9ea075735073ed58c30038c1c439d0c7c63cbdc0743b731554344a24f
MD5 9060bd94fecc52f687a5e19ade3f1a7d
SHA1 d61a21b774e085b4d5dcc026981b91e332498d1c
SHA512 fb0d1b9ccf6b3a9aa0efdad5e428e74dab464287e4b67c16be8727e796ae6c84b30682a959343db65851e257f6c3ce392ace43d44dd1fe8af97273e13a03ad9a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAr:ROdWCCi7/rahOYFoIBmCyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

fTdCAmP.exe

Path C:\Windows\System\fTdCAmP.exe
Size 1.5MB
SHA256 e6c7eb6223b8dcd8862d9f833ed474def3c25ef74bd89f5488749a490334c54a
MD5 dbce24763cc1ca2a9735b4361ca26bc9
SHA1 ddc4a267401a9daf4ac53eff98576e6d11248bed
SHA512 3e0b6e5e286d90f77b388ebb81c3ae7e04966291e2e5ec8967d3c9d57e0849cc828f9ed98981d8c9e3407c64582e0af61c5d398ec7f7d132b08974d3d65c876f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAY:ROdWCCi7/rahOYFoIBmCyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

fsawIYc.exe

Path C:\Windows\System\fsawIYc.exe
Size 1.5MB
SHA256 7810da4972fc033fb9e6c4fa0fa041aef289ac0db85c86ae685497a572f366ab
MD5 ffb77d9f3657e2a1ff9278abe6b277ca
SHA1 f2cb9f331aa5aba61776f7a5979f6e33e103314b
SHA512 bb7737c8629c7f94f02421fdd7cb4095d5c212f1cb93d73a54bbcee8527d44e40af92e91aaae333a86ec20eb255d3e5b7f0270fb814f72712ff4e5809c094e98
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAY:ROdWCCi7/rahOYFoIBmCyr
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbPkUWc.exe

Path C:\Windows\System\gbPkUWc.exe
Size 1.5MB
SHA256 e9111fae7014d7ee3e791e89a7ccb6b8218e34a9058486b84035e33e3cb810b6
MD5 2857a9989f746b508d59ea516af42928
SHA1 34739a2f664cf28be029afcff8ce516b25e2c286
SHA512 6a6aadd0050fc396e4e4b57e17e508e723ad3cd26436f69aaa361407ffb32e3ab2d91293cdf53c68010c177112fb1eefed1a0bf3e9fbcdea6a4a111cdbe370de
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA5:ROdWCCi7/rahOYFoIBmCyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hHppNYd.exe

Path C:\Windows\System\hHppNYd.exe
Size 1.5MB
SHA256 7ba6d1dee63ad880f2729f9b3abb0a4e4cd7e7476047977ba5c45ec55e85b7b6
MD5 7b0c8b860ebaaf7df649c4f40b2761d7
SHA1 2fe24035a3c441784d8b6fcc4dad9ff1fd618722
SHA512 8f7196ee5d6c3bb6d36a4b1889e2be9b8f350f47b98b7a0fb72014b2ba4bfb04f04904cac9dad895bfda5e9891bac0b4cd28217bbe6dcf2e95d85e59bc69254b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAC:ROdWCCi7/rahOYFoIBmCyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

iUOoZNQ.exe

Path C:\Windows\System\iUOoZNQ.exe
Size 1.5MB
SHA256 20805fa438b5f0bca80a2b2c529a3081cc96ece7e0eac4564463a9fe9e9ec888
MD5 3822888ba14d65de7095e5b2c74db683
SHA1 39f2be1376e99d0f0ea7985767b29a7b08deedae
SHA512 cafdc293fcaab08b905bd446f1f3a026bd1cad94c00e6c0ccc3994e8c86cd918a1ae3a4307a988f58c0a5fe947a5b48d2fa037852b3c8349f17fb2175d7c7532
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAB:ROdWCCi7/rahOYFoIBmCy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

jVpIgpu.exe

Path C:\Windows\System\jVpIgpu.exe
Size 1.5MB
SHA256 edafd78f0a8e3a284ffe58cb24f8722424444c81cbbf66035a9fd4f1c7b97cdb
MD5 290dd77e73bf5449871a6ac04f1ef13c
SHA1 2e5287358736f580ce3675fc5b1923ecbb5936d4
SHA512 64696ef03d0f0e99f8ec5098cca2f7ecdb787887df910a4f090b7ef33ff675f375c929642df797e010e8e8e619fe522886c4c28067a69661fdb115f2d8cc1d5f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAW:ROdWCCi7/rahOYFoIBmCyN
MD5 SHA1 SHA512 SSDEEP

Submit Download

kZrOnYM.exe

Path C:\Windows\System\kZrOnYM.exe
Size 1.5MB
SHA256 b609c7da02f2121f7bdd0eceb680ad4c514c3f97a31e9a0fa29dd058c8311be8
MD5 d4f644e9ee087ed14e6f72987037be92
SHA1 0bb7a2d1a2af125d52c61a1d40aa1bfa6e790917
SHA512 1ad20a9d2adf22175e95e2ec1c82ce276c150eb2d64d3037c2cd9732efceac4a8a1ab0713c5b07eb7610d44376e70a8c003b2603d63a10c3b0e928b27139df2c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAt:ROdWCCi7/rahOYFoIBmCyg
MD5 SHA1 SHA512 SSDEEP

Submit Download

oVeMCzK.exe

Path C:\Windows\System\oVeMCzK.exe
Size 1.5MB
SHA256 58c186c3cff532f15f0618bd8f3056880c8b2e28e842c8cb2a11292cce5b479f
MD5 609b854e912d496fae474e5a80f03d76
SHA1 84e254a187519a6702ac43ac15e716d988431b2b
SHA512 ad529653f21e89fe51fb919a838e6a5b6489db218cfcec0e196c15373484cf1ba873602aba301b941e89de0f8970bfd706b41e0643500ab005cc9e93ebf5d571
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAm:ROdWCCi7/rahOYFoIBmCyT
MD5 SHA1 SHA512 SSDEEP

Submit Download

qNZacDH.exe

Path C:\Windows\System\qNZacDH.exe
Size 1.5MB
SHA256 760964344ae404f0cecbfdac43e4a82d42e029e06c75b088ce05d58410e67262
MD5 845066acdf67858d279d84b8eab8626f
SHA1 e80a249af81fcbf2c60f1a4e5c9128cf0fbbde3e
SHA512 5205a2085bc2082d34c9e90fceb4fe5f9cbcf3db9d2ba56b013e7d055109d7e7db88b11ff14e6767b78a385ee1aeec4f77c786073d18331c82e6b179b2eb43b9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAK:ROdWCCi7/rahOYFoIBmCyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

rNDwJsb.exe

Path C:\Windows\System\rNDwJsb.exe
Size 1.5MB
SHA256 619da26634232d2e5f19f8b712854f1543fcf896812f767f90291cca12c7a9ca
MD5 aa00ed349b8fd17fb6fd004c024ea836
SHA1 7439bcf4f4b2e0d8f0d7691ff836b817d4b745fc
SHA512 8f4980d03b1767435f488c059ff8504925a87843a10cb89f8dace9ca14e48876bdde465efcba875528a08aae2b22de64acd42836bb03b61a5bafff5c7ebebbcc
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAt:ROdWCCi7/rahOYFoIBmCya
MD5 SHA1 SHA512 SSDEEP

Submit Download

rlLIruQ.exe

Path C:\Windows\System\rlLIruQ.exe
Size 1.5MB
SHA256 9855555397b1ab2569581653a5c3c9a1ba2363ef931bbbb9f3b72142fd4f3472
MD5 1d9c5834dfcd43544014cf6488310cbc
SHA1 0ccaf7b9a07b8db508243d640e33aafc99d34f27
SHA512 0b93e4ed064d1dd6a29b6cbff76ffb2f630747e00695bfbd4a1bbfbfb21cf56f3879c308958e6f3ac965d8ba7f54fe372cc869926d2de8bfc818c6a4477ff4f9
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAy:ROdWCCi7/rahOYFoIBmCyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sBLsqtJ.exe

Path C:\Windows\System\sBLsqtJ.exe
Size 1.5MB
SHA256 b8460c28cba9e48041ec993b1daae3fff734e65a8862d3be1685a57264e1157a
MD5 b7ff95e0dd340d8c1b296db5ba4aa4ba
SHA1 897657e70a2d13cb40ca477eb2e1f41166de412e
SHA512 861340039dcea776c4140a40c3fa615d17b8abf610e94d9853d5391288a459d9151c0d0d50d1e25554b1260223aa4ad8dc26525bd46a00c3bbe9050d399a0c88
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAV:ROdWCCi7/rahOYFoIBmCy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

sbKpmMM.exe

Path C:\Windows\System\sbKpmMM.exe
Size 1.5MB
SHA256 6b9016d286625da58eb48153b475c300172e1e164f8e8cf353807ae00d22de6c
MD5 00d431221987b0447936001dec54b313
SHA1 f5822b658ddd8d38f118a70cf51114ec1c20dc93
SHA512 4fb63dbeeae92f2d83674f8fb184e40785029eef55c66159f1f207092bcf2aa7880936c2518343fd0caa4e8842ccf600f80eaa67cb9e881c38adeadf5112efea
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAd:ROdWCCi7/rahOYFoIBmCye
MD5 SHA1 SHA512 SSDEEP

Submit Download

tjZtIxV.exe

Path C:\Windows\System\tjZtIxV.exe
Size 1.5MB
SHA256 678ec08e3aa0a1a56ac7ff6a4d3e6d55a83380d266eee7bb830a38bfcc84b49b
MD5 a02ae0ffadd0d2aa4b55e38c5b04e1df
SHA1 7eac3c5c3533cebb750c1ee79e03d0cd273969b1
SHA512 a9a92a85ae49ed56debdf84bf59e21f2f4ac0f92ffe6e535bb6cadf82e82de38d1d4ab794f1e2ad52614f2d1fe1a3e997f5f1645adb58bea74c754668b318722
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAm:ROdWCCi7/rahOYFoIBmCyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

uPQNtgk.exe

Path C:\Windows\System\uPQNtgk.exe
Size 1.5MB
SHA256 25fa475441aabe5f5d3270327cc35b0352d2c04adae784dc6863cf4b2519cda5
MD5 1ce4685d2e3c229a82c4de3570dd306a
SHA1 ab481c630371e5a4c47a5d314cbbb38fba912ebb
SHA512 6b6d601491e180da8de2b5e1d2d99ccedadb0e16d30d372ef3f454a9adfebd0b345456154e7ec81a69063bf433efe6697085c2ee252434c0d0f0f1fc7cb415b7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA8:ROdWCCi7/rahOYFoIBmCy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

vMhWxyu.exe

Path C:\Windows\System\vMhWxyu.exe
Size 1.5MB
SHA256 474e79b7ae741398d3fd54daf8dbf630fd802a611c470439a03541327f01d986
MD5 26df97052a4e23d840ead0877f5179df
SHA1 b41e85981da794cf44a4e2238c8b4f959457976d
SHA512 6da7f9da395f8a799270570113c306b97cfe53bbceaf8b424fd006f730766001fd3ba765ebede3b7dd3ba9b83dfab35c55b70e59fc89f49e4e58e60d1020f087
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAO:ROdWCCi7/rahOYFoIBmCyuC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylMeiia.exe

Path C:\Windows\System\ylMeiia.exe
Size 1.5MB
SHA256 e3b9ae7048b2789ff04f45c08246f9b6263ad920c95a143372b4db3e262d35c7
MD5 a60b573a393e500b70152039edf660a4
SHA1 9b07f882e152446f1ec5e3f7bd603ef7ef91df5c
SHA512 ad5c661b78a525b9a0276def54bdc69f683cd05737351c20a50c6226206f6f645a5c9d7693ffb048ad33e4510c4d22d687a1be0fdd393e6f147e62e9656176d5
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFA7:ROdWCCi7/rahOYFoIBmCyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaKhrhz.exe

Path C:\Windows\System\zaKhrhz.exe
Size 1.5MB
SHA256 c8acfb26b85b9eb1b41acc36cfac49865573c73e6c8e0d8068d4372eb9870c8a
MD5 8f7466ffd44ee3e788fe71ecb1e99d57
SHA1 56aafb1232299f39862b32cd801681c638c6db6c
SHA512 93ec3a7812a89141417c925d5bc831071d2024669c41eef453ea9daae821347dde159ab2e7169d92c978aab66fcd852ed66e4bd816e84a55304609c589c56ad7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAb:ROdWCCi7/rahOYFoIBmCyW
MD5 SHA1 SHA512 SSDEEP

Submit Download

zioZEvw.exe

Path C:\Windows\System\zioZEvw.exe
Size 1.5MB
SHA256 020aeaca85eff070c3f645ec73b533ab700c3da3afdb700b7c313f709eaab7a5
MD5 01ecf2f932385620c62e64a925968c8b
SHA1 2a76b84ea53be8130dd21e9ab6e10759ec6ede8a
SHA512 247c548ce595b8c7bd5266927585a0dbbbba30b937611db4e2f669f772d2365fabdd645e3a67b0de4bfad4678468c7cba3051d3e34979f15ea100cfbd2a3c338
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727HeoPO+XC7A9GaFDnFelw+HT8V1NCgrrJEFVcuPFAD:ROdWCCi7/rahOYFoIBmCyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-2491-0x00007FF70D600000-0x00007FF70D951000-memory.dmp

Download

memory/212-283-0x00007FF70D600000-0x00007FF70D951000-memory.dmp

Download

memory/404-2472-0x00007FF761D80000-0x00007FF7620D1000-memory.dmp

Download

memory/404-44-0x00007FF761D80000-0x00007FF7620D1000-memory.dmp

Download

memory/700-483-0x00007FF626CE0000-0x00007FF627031000-memory.dmp

Download

memory/700-2487-0x00007FF626CE0000-0x00007FF627031000-memory.dmp

Download

memory/736-2502-0x00007FF73F200000-0x00007FF73F551000-memory.dmp

Download

memory/736-354-0x00007FF73F200000-0x00007FF73F551000-memory.dmp

Download

memory/868-2485-0x00007FF7C6DF0000-0x00007FF7C7141000-memory.dmp

Download

memory/868-119-0x00007FF7C6DF0000-0x00007FF7C7141000-memory.dmp

Download

memory/1056-2469-0x00007FF793BB0000-0x00007FF793F01000-memory.dmp

Download

memory/1056-42-0x00007FF793BB0000-0x00007FF793F01000-memory.dmp

Download

memory/1160-2478-0x00007FF6BCB80000-0x00007FF6BCED1000-memory.dmp

Download

memory/1160-482-0x00007FF6BCB80000-0x00007FF6BCED1000-memory.dmp

Download

memory/1388-301-0x00007FF6D0E70000-0x00007FF6D11C1000-memory.dmp

Download

memory/1388-2497-0x00007FF6D0E70000-0x00007FF6D11C1000-memory.dmp

Download

memory/1556-2531-0x00007FF77FC30000-0x00007FF77FF81000-memory.dmp

Download

memory/1556-118-0x00007FF77FC30000-0x00007FF77FF81000-memory.dmp

Download

memory/1836-2489-0x00007FF62D440000-0x00007FF62D791000-memory.dmp

Download

memory/1836-140-0x00007FF62D440000-0x00007FF62D791000-memory.dmp

Download

memory/2112-2476-0x00007FF79B690000-0x00007FF79B9E1000-memory.dmp

Download

memory/2112-92-0x00007FF79B690000-0x00007FF79B9E1000-memory.dmp

Download

memory/2216-423-0x00007FF73F250000-0x00007FF73F5A1000-memory.dmp

Download

memory/2216-2500-0x00007FF73F250000-0x00007FF73F5A1000-memory.dmp

Download

memory/2408-389-0x00007FF7A7300000-0x00007FF7A7651000-memory.dmp

Download

memory/2408-2509-0x00007FF7A7300000-0x00007FF7A7651000-memory.dmp

Download

memory/2880-2493-0x00007FF6A27A0000-0x00007FF6A2AF1000-memory.dmp

Download

memory/2880-244-0x00007FF6A27A0000-0x00007FF6A2AF1000-memory.dmp

Download

memory/3108-187-0x00007FF7D9540000-0x00007FF7D9891000-memory.dmp

Download

memory/3108-2483-0x00007FF7D9540000-0x00007FF7D9891000-memory.dmp

Download

memory/3392-2525-0x00007FF697CF0000-0x00007FF698041000-memory.dmp

Download

memory/3392-141-0x00007FF697CF0000-0x00007FF698041000-memory.dmp

Download

memory/3532-2511-0x00007FF7D9010000-0x00007FF7D9361000-memory.dmp

Download

memory/3532-422-0x00007FF7D9010000-0x00007FF7D9361000-memory.dmp

Download

memory/3636-2467-0x00007FF76A5E0000-0x00007FF76A931000-memory.dmp

Download

memory/3636-12-0x00007FF76A5E0000-0x00007FF76A931000-memory.dmp

Download

memory/3672-2523-0x00007FF708F40000-0x00007FF709291000-memory.dmp

Download

memory/3672-360-0x00007FF708F40000-0x00007FF709291000-memory.dmp

Download

memory/3708-222-0x00007FF7E90C0000-0x00007FF7E9411000-memory.dmp

Download

memory/3708-2495-0x00007FF7E90C0000-0x00007FF7E9411000-memory.dmp

Download

memory/3944-2473-0x00007FF68EB70000-0x00007FF68EEC1000-memory.dmp

Download

memory/3944-43-0x00007FF68EB70000-0x00007FF68EEC1000-memory.dmp

Download

memory/3976-2528-0x00007FF71BBE0000-0x00007FF71BF31000-memory.dmp

Download

memory/3976-359-0x00007FF71BBE0000-0x00007FF71BF31000-memory.dmp

Download

memory/4020-2506-0x00007FF772990000-0x00007FF772CE1000-memory.dmp

Download

memory/4020-484-0x00007FF772990000-0x00007FF772CE1000-memory.dmp

Download

memory/4116-2481-0x00007FF6C4550000-0x00007FF6C48A1000-memory.dmp

Download

memory/4116-221-0x00007FF6C4550000-0x00007FF6C48A1000-memory.dmp

Download

memory/4204-485-0x00007FF68CE40000-0x00007FF68D191000-memory.dmp

Download

memory/4204-2513-0x00007FF68CE40000-0x00007FF68D191000-memory.dmp

Download

memory/4328-2479-0x00007FF629AD0000-0x00007FF629E21000-memory.dmp

Download

memory/4328-86-0x00007FF629AD0000-0x00007FF629E21000-memory.dmp

Download

memory/4384-0-0x00007FF7A2B70000-0x00007FF7A2EC1000-memory.dmp

Download

memory/4384-2354-0x00007FF7A2B70000-0x00007FF7A2EC1000-memory.dmp

Download

memory/4384-1-0x000001C7E3700000-0x000001C7E3710000-memory.dmp

Download

memory/4464-2519-0x00007FF65D860000-0x00007FF65DBB1000-memory.dmp

Download

memory/4464-427-0x00007FF65D860000-0x00007FF65DBB1000-memory.dmp

Download

memory/4808-2526-0x00007FF7CC4A0000-0x00007FF7CC7F1000-memory.dmp

Download

memory/4808-353-0x00007FF7CC4A0000-0x00007FF7CC7F1000-memory.dmp

Download

memory/4832-2521-0x00007FF6B1610000-0x00007FF6B1961000-memory.dmp

Download

memory/4832-428-0x00007FF6B1610000-0x00007FF6B1961000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads