xmrig | 754efb9b3b42d63a6c64f2281e51bb11537471c93b216b0e22983905c692f225

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
Size 1.5MB
Sample240525-w9dyeaec47
SHA256 754efb9b3b42d63a6c64f2281e51bb11537471c93b216b0e22983905c692f225
MD5 0919a3c8fa9a826f8e327350f6c488a0
SHA1 2e43ae42fb2dad66ea85d8d9af84c6c23b130373
SHA512 5b2500bbc278c4726f91c5639aa7ae818cf17513b1e2a1a0b4a620870cb54c872514b8c0d283746adbc30f231f6cae7000dede2b4b03b65b24d6f19119584efb
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY9:ROdWCCi7/rahHxJTFlt2O+2BWZ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral2/memory/2632-17-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp	xmrig
behavioral2/memory/5108-573-0x00007FF6D0890000-0x00007FF6D0BE1000-memory.dmp	xmrig
behavioral2/memory/4756-693-0x00007FF75B550000-0x00007FF75B8A1000-memory.dmp	xmrig
behavioral2/memory/3568-733-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp	xmrig
behavioral2/memory/412-736-0x00007FF72D6D0000-0x00007FF72DA21000-memory.dmp	xmrig
behavioral2/memory/4196-2073-0x00007FF714280000-0x00007FF7145D1000-memory.dmp	xmrig
behavioral2/memory/1704-735-0x00007FF69D220000-0x00007FF69D571000-memory.dmp	xmrig
behavioral2/memory/1356-734-0x00007FF605990000-0x00007FF605CE1000-memory.dmp	xmrig
behavioral2/memory/4076-732-0x00007FF6CB060000-0x00007FF6CB3B1000-memory.dmp	xmrig
behavioral2/memory/4116-731-0x00007FF6C4840000-0x00007FF6C4B91000-memory.dmp	xmrig
behavioral2/memory/1752-730-0x00007FF793A30000-0x00007FF793D81000-memory.dmp	xmrig
behavioral2/memory/2532-729-0x00007FF71A290000-0x00007FF71A5E1000-memory.dmp	xmrig
behavioral2/memory/3036-728-0x00007FF6F9730000-0x00007FF6F9A81000-memory.dmp	xmrig
behavioral2/memory/5064-689-0x00007FF759F60000-0x00007FF75A2B1000-memory.dmp	xmrig
behavioral2/memory/1152-570-0x00007FF6D28F0000-0x00007FF6D2C41000-memory.dmp	xmrig
behavioral2/memory/3248-441-0x00007FF71AF20000-0x00007FF71B271000-memory.dmp	xmrig
behavioral2/memory/4628-370-0x00007FF63F7E0000-0x00007FF63FB31000-memory.dmp	xmrig
behavioral2/memory/2956-362-0x00007FF7C67D0000-0x00007FF7C6B21000-memory.dmp	xmrig
behavioral2/memory/4892-320-0x00007FF7268A0000-0x00007FF726BF1000-memory.dmp	xmrig
behavioral2/memory/388-316-0x00007FF650F10000-0x00007FF651261000-memory.dmp	xmrig
behavioral2/memory/4636-261-0x00007FF70E720000-0x00007FF70EA71000-memory.dmp	xmrig
behavioral2/memory/220-228-0x00007FF69D060000-0x00007FF69D3B1000-memory.dmp	xmrig
behavioral2/memory/376-171-0x00007FF73A030000-0x00007FF73A381000-memory.dmp	xmrig
behavioral2/memory/4216-122-0x00007FF6C4BD0000-0x00007FF6C4F21000-memory.dmp	xmrig
behavioral2/memory/4236-87-0x00007FF6E2660000-0x00007FF6E29B1000-memory.dmp	xmrig
behavioral2/memory/2632-2178-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp	xmrig
behavioral2/memory/4064-2179-0x00007FF7489E0000-0x00007FF748D31000-memory.dmp	xmrig
behavioral2/memory/4660-2180-0x00007FF63FF00000-0x00007FF640251000-memory.dmp	xmrig
behavioral2/memory/4228-2181-0x00007FF6673A0000-0x00007FF6676F1000-memory.dmp	xmrig
behavioral2/memory/1312-2182-0x00007FF683590000-0x00007FF6838E1000-memory.dmp	xmrig
behavioral2/memory/536-2183-0x00007FF737BF0000-0x00007FF737F41000-memory.dmp	xmrig
behavioral2/memory/2632-2185-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp	xmrig
behavioral2/memory/4076-2187-0x00007FF6CB060000-0x00007FF6CB3B1000-memory.dmp	xmrig
behavioral2/memory/4064-2189-0x00007FF7489E0000-0x00007FF748D31000-memory.dmp	xmrig
behavioral2/memory/4216-2194-0x00007FF6C4BD0000-0x00007FF6C4F21000-memory.dmp	xmrig
behavioral2/memory/4660-2195-0x00007FF63FF00000-0x00007FF640251000-memory.dmp	xmrig
behavioral2/memory/4236-2192-0x00007FF6E2660000-0x00007FF6E29B1000-memory.dmp	xmrig
behavioral2/memory/388-2199-0x00007FF650F10000-0x00007FF651261000-memory.dmp	xmrig
behavioral2/memory/3568-2203-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp	xmrig
behavioral2/memory/1312-2211-0x00007FF683590000-0x00007FF6838E1000-memory.dmp	xmrig
behavioral2/memory/3036-2210-0x00007FF6F9730000-0x00007FF6F9A81000-memory.dmp	xmrig
behavioral2/memory/4636-2208-0x00007FF70E720000-0x00007FF70EA71000-memory.dmp	xmrig
behavioral2/memory/1356-2206-0x00007FF605990000-0x00007FF605CE1000-memory.dmp	xmrig
behavioral2/memory/4228-2198-0x00007FF6673A0000-0x00007FF6676F1000-memory.dmp	xmrig
behavioral2/memory/376-2213-0x00007FF73A030000-0x00007FF73A381000-memory.dmp	xmrig
behavioral2/memory/1704-2219-0x00007FF69D220000-0x00007FF69D571000-memory.dmp	xmrig
behavioral2/memory/4892-2216-0x00007FF7268A0000-0x00007FF726BF1000-memory.dmp	xmrig
behavioral2/memory/412-2202-0x00007FF72D6D0000-0x00007FF72DA21000-memory.dmp	xmrig
behavioral2/memory/5108-2224-0x00007FF6D0890000-0x00007FF6D0BE1000-memory.dmp	xmrig
behavioral2/memory/2956-2228-0x00007FF7C67D0000-0x00007FF7C6B21000-memory.dmp	xmrig
behavioral2/memory/220-2234-0x00007FF69D060000-0x00007FF69D3B1000-memory.dmp	xmrig
behavioral2/memory/2532-2240-0x00007FF71A290000-0x00007FF71A5E1000-memory.dmp	xmrig
behavioral2/memory/4628-2242-0x00007FF63F7E0000-0x00007FF63FB31000-memory.dmp	xmrig
behavioral2/memory/536-2238-0x00007FF737BF0000-0x00007FF737F41000-memory.dmp	xmrig
behavioral2/memory/4756-2236-0x00007FF75B550000-0x00007FF75B8A1000-memory.dmp	xmrig
behavioral2/memory/3248-2232-0x00007FF71AF20000-0x00007FF71B271000-memory.dmp	xmrig
behavioral2/memory/1152-2230-0x00007FF6D28F0000-0x00007FF6D2C41000-memory.dmp	xmrig
behavioral2/memory/4116-2227-0x00007FF6C4840000-0x00007FF6C4B91000-memory.dmp	xmrig
behavioral2/memory/5064-2223-0x00007FF759F60000-0x00007FF75A2B1000-memory.dmp	xmrig
behavioral2/memory/1752-2250-0x00007FF793A30000-0x00007FF793D81000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2632	EYUgHsk.exe
4064	FjcHMnP.exe
4076	IWAqLMi.exe
1312	xqkPerJ.exe
4660	kLfIVke.exe
4236	yNTcTud.exe
4216	GWKrUeO.exe
4228	DBqBpFQ.exe
376	sgINlLZ.exe
3568	OMcGuKK.exe
536	gUKkAnL.exe
220	JzhdZPM.exe
4636	OtBcLaB.exe
388	XxDyrIU.exe
4892	XJztrTg.exe
1356	GyxihyZ.exe
1704	tKvorUD.exe
2956	TyiHtiO.exe
4628	crUXhit.exe
3248	TBhepMu.exe
1152	hTpFuuY.exe
5108	ehUhZYx.exe
5064	jGuRzYg.exe
4756	USPRJQX.exe
3036	APEDrnG.exe
2532	eyRzpCX.exe
412	GEWEZkU.exe
1752	rdzcdLn.exe
4116	Pmugkto.exe
4244	CqqUiLU.exe
2764	RrqoKxE.exe
3304	XfibGhx.exe
3564	Lkxtafn.exe
2524	cNWRLwF.exe
1864	qRbjlvj.exe
1924	OavWYtx.exe
1280	vWCDHKz.exe
912	YsTfIyo.exe
4604	RHNKWxJ.exe
4940	rxSQDIS.exe
1808	imUnPep.exe
1952	wBkqPYz.exe
2236	VdOCHiu.exe
2172	vpoJOQX.exe
3712	QnuNtQx.exe
1596	upYHgKH.exe
4912	RagCcuQ.exe
3560	JSetDgl.exe
3504	EsxbZbd.exe
1344	OZOWitJ.exe
5072	hjhQytn.exe
2768	rpVvNQx.exe
1332	eHtHzpo.exe
5100	bUJASxa.exe
5080	BBQrnve.exe
1912	VqJgOxA.exe
1284	RfqhXGG.exe
208	gZSxxlp.exe
4080	rHyOMRb.exe
3276	qCllLyp.exe
3084	ytAWSfe.exe
4876	XABwfuU.exe
4540	sJfDsAm.exe
4524	ZAdUhZl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4196-0-0x00007FF714280000-0x00007FF7145D1000-memory.dmp	upx
behavioral2/files/0x000900000002342a-5.dat	upx
behavioral2/files/0x0007000000023431-8.dat	upx
behavioral2/memory/2632-17-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp	upx
behavioral2/files/0x0007000000023444-104.dat	upx
behavioral2/memory/5108-573-0x00007FF6D0890000-0x00007FF6D0BE1000-memory.dmp	upx
behavioral2/memory/4756-693-0x00007FF75B550000-0x00007FF75B8A1000-memory.dmp	upx
behavioral2/memory/3568-733-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp	upx
behavioral2/memory/412-736-0x00007FF72D6D0000-0x00007FF72DA21000-memory.dmp	upx
behavioral2/memory/4196-2073-0x00007FF714280000-0x00007FF7145D1000-memory.dmp	upx
behavioral2/memory/1704-735-0x00007FF69D220000-0x00007FF69D571000-memory.dmp	upx
behavioral2/memory/1356-734-0x00007FF605990000-0x00007FF605CE1000-memory.dmp	upx
behavioral2/memory/4076-732-0x00007FF6CB060000-0x00007FF6CB3B1000-memory.dmp	upx
behavioral2/memory/4116-731-0x00007FF6C4840000-0x00007FF6C4B91000-memory.dmp	upx
behavioral2/memory/1752-730-0x00007FF793A30000-0x00007FF793D81000-memory.dmp	upx
behavioral2/memory/2532-729-0x00007FF71A290000-0x00007FF71A5E1000-memory.dmp	upx
behavioral2/memory/3036-728-0x00007FF6F9730000-0x00007FF6F9A81000-memory.dmp	upx
behavioral2/memory/5064-689-0x00007FF759F60000-0x00007FF75A2B1000-memory.dmp	upx
behavioral2/memory/1152-570-0x00007FF6D28F0000-0x00007FF6D2C41000-memory.dmp	upx
behavioral2/memory/3248-441-0x00007FF71AF20000-0x00007FF71B271000-memory.dmp	upx
behavioral2/memory/4628-370-0x00007FF63F7E0000-0x00007FF63FB31000-memory.dmp	upx
behavioral2/memory/2956-362-0x00007FF7C67D0000-0x00007FF7C6B21000-memory.dmp	upx
behavioral2/memory/4892-320-0x00007FF7268A0000-0x00007FF726BF1000-memory.dmp	upx
behavioral2/memory/388-316-0x00007FF650F10000-0x00007FF651261000-memory.dmp	upx
behavioral2/memory/4636-261-0x00007FF70E720000-0x00007FF70EA71000-memory.dmp	upx
behavioral2/memory/536-225-0x00007FF737BF0000-0x00007FF737F41000-memory.dmp	upx
behavioral2/files/0x0007000000023455-200.dat	upx
behavioral2/files/0x000700000002344b-195.dat	upx
behavioral2/files/0x0007000000023454-192.dat	upx
behavioral2/files/0x0007000000023443-188.dat	upx
behavioral2/files/0x0007000000023453-186.dat	upx
behavioral2/files/0x0007000000023452-185.dat	upx
behavioral2/files/0x0007000000023451-180.dat	upx
behavioral2/files/0x0007000000023442-179.dat	upx
behavioral2/files/0x0007000000023440-176.dat	upx
behavioral2/files/0x000700000002343f-174.dat	upx
behavioral2/memory/220-228-0x00007FF69D060000-0x00007FF69D3B1000-memory.dmp	upx
behavioral2/memory/376-171-0x00007FF73A030000-0x00007FF73A381000-memory.dmp	upx
behavioral2/files/0x0007000000023450-164.dat	upx
behavioral2/files/0x000700000002344f-160.dat	upx
behavioral2/files/0x000700000002344e-156.dat	upx
behavioral2/files/0x000700000002344c-155.dat	upx
behavioral2/files/0x000700000002344d-154.dat	upx
behavioral2/files/0x0007000000023439-149.dat	upx
behavioral2/files/0x000700000002343d-146.dat	upx
behavioral2/files/0x0007000000023449-132.dat	upx
behavioral2/memory/4228-168-0x00007FF6673A0000-0x00007FF6676F1000-memory.dmp	upx
behavioral2/memory/4216-122-0x00007FF6C4BD0000-0x00007FF6C4F21000-memory.dmp	upx
behavioral2/files/0x000700000002343b-115.dat	upx
behavioral2/files/0x000700000002343e-109.dat	upx
behavioral2/files/0x0007000000023447-108.dat	upx
behavioral2/files/0x0007000000023446-107.dat	upx
behavioral2/files/0x0007000000023445-106.dat	upx
behavioral2/files/0x000700000002344a-137.dat	upx
behavioral2/files/0x0007000000023438-94.dat	upx
behavioral2/files/0x0007000000023441-92.dat	upx
behavioral2/files/0x000700000002343c-126.dat	upx
behavioral2/files/0x0007000000023448-120.dat	upx
behavioral2/memory/4660-83-0x00007FF63FF00000-0x00007FF640251000-memory.dmp	upx
behavioral2/files/0x000800000002342d-75.dat	upx
behavioral2/files/0x0007000000023433-72.dat	upx
behavioral2/files/0x0007000000023437-96.dat	upx
behavioral2/files/0x0007000000023436-67.dat	upx
behavioral2/files/0x0007000000023435-63.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sbFyHyo.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\nUYEPvS.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\oWlWkKG.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\YKwpFSP.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\iALJdvC.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\ipTZyBq.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\WEYKXFb.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\wQOelQc.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\AeqJOAc.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\VTEQarj.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\AxErezA.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\FqQNKDs.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\ohBXaTk.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\KZaPKly.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\vCArOeR.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\MZLeVBX.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\AvPMZob.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\jVHMeVp.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\iNJXTTR.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\YJCBFmi.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\SZaYWtK.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\BdxpWsy.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\DFcsWCP.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\UEDiKSZ.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\lvLFXNj.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\TUxuMUe.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\TUSrzKk.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZWuMiOk.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\WsqjGFh.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\xkrNDjA.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\xJtmdyC.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZDMSiSp.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\mkpVUPo.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\SFYiKRO.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\EAqTxzx.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\RxqKdQj.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\QByTJJn.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\XVZVCPw.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\YSkneNv.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\tXnOveS.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\JSetDgl.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\aqqpKqL.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\eTxLJET.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\nLWlkPF.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\jKwymMr.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\vzNoNbJ.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\nxdcniQ.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\RqPtWrK.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\ogHMFaO.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\FQLXkgP.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\pWMdGZf.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\oCcvkpA.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\tdXTgIv.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\sgINlLZ.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\KoLsKRO.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\wxVAzoQ.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\LwgsSRe.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\dZbiDpp.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\klRrSCp.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\wZPYwFI.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\uoOLuqz.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\mEQVmgv.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\drJuRTl.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZXhcVEV.exe	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2632	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	83
PID 4196 wrote to memory of 2632	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	83
PID 4196 wrote to memory of 1312	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	84
PID 4196 wrote to memory of 1312	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	84
PID 4196 wrote to memory of 4064	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	85
PID 4196 wrote to memory of 4064	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	85
PID 4196 wrote to memory of 4076	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	86
PID 4196 wrote to memory of 4076	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	86
PID 4196 wrote to memory of 376	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	87
PID 4196 wrote to memory of 376	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	87
PID 4196 wrote to memory of 4660	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	88
PID 4196 wrote to memory of 4660	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	88
PID 4196 wrote to memory of 4236	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	89
PID 4196 wrote to memory of 4236	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	89
PID 4196 wrote to memory of 4216	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	90
PID 4196 wrote to memory of 4216	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	90
PID 4196 wrote to memory of 4228	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	91
PID 4196 wrote to memory of 4228	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	91
PID 4196 wrote to memory of 3568	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	92
PID 4196 wrote to memory of 3568	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	92
PID 4196 wrote to memory of 536	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	93
PID 4196 wrote to memory of 536	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	93
PID 4196 wrote to memory of 220	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	94
PID 4196 wrote to memory of 220	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	94
PID 4196 wrote to memory of 4636	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	95
PID 4196 wrote to memory of 4636	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	95
PID 4196 wrote to memory of 388	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	96
PID 4196 wrote to memory of 388	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	96
PID 4196 wrote to memory of 4892	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	97
PID 4196 wrote to memory of 4892	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	97
PID 4196 wrote to memory of 1356	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	98
PID 4196 wrote to memory of 1356	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	98
PID 4196 wrote to memory of 1704	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	99
PID 4196 wrote to memory of 1704	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	99
PID 4196 wrote to memory of 2956	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	100
PID 4196 wrote to memory of 2956	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	100
PID 4196 wrote to memory of 4628	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	101
PID 4196 wrote to memory of 4628	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	101
PID 4196 wrote to memory of 3248	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	102
PID 4196 wrote to memory of 3248	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	102
PID 4196 wrote to memory of 1152	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	103
PID 4196 wrote to memory of 1152	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	103
PID 4196 wrote to memory of 5108	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	104
PID 4196 wrote to memory of 5108	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	104
PID 4196 wrote to memory of 5064	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	105
PID 4196 wrote to memory of 5064	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	105
PID 4196 wrote to memory of 4756	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	106
PID 4196 wrote to memory of 4756	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	106
PID 4196 wrote to memory of 3036	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	107
PID 4196 wrote to memory of 3036	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	107
PID 4196 wrote to memory of 2532	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	108
PID 4196 wrote to memory of 2532	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	108
PID 4196 wrote to memory of 412	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	109
PID 4196 wrote to memory of 412	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	109
PID 4196 wrote to memory of 1752	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	110
PID 4196 wrote to memory of 1752	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	110
PID 4196 wrote to memory of 4116	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	111
PID 4196 wrote to memory of 4116	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	111
PID 4196 wrote to memory of 4244	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	112
PID 4196 wrote to memory of 4244	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	112
PID 4196 wrote to memory of 2764	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	113
PID 4196 wrote to memory of 2764	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	113
PID 4196 wrote to memory of 3304	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	114
PID 4196 wrote to memory of 3304	4196	0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0919a3c8fa9a826f8e327350f6c488a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\System\EYUgHsk.exe
  C:\Windows\System\EYUgHsk.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xqkPerJ.exe
  C:\Windows\System\xqkPerJ.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\FjcHMnP.exe
  C:\Windows\System\FjcHMnP.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\IWAqLMi.exe
  C:\Windows\System\IWAqLMi.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\sgINlLZ.exe
  C:\Windows\System\sgINlLZ.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\kLfIVke.exe
  C:\Windows\System\kLfIVke.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\yNTcTud.exe
  C:\Windows\System\yNTcTud.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\GWKrUeO.exe
  C:\Windows\System\GWKrUeO.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\DBqBpFQ.exe
  C:\Windows\System\DBqBpFQ.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\OMcGuKK.exe
  C:\Windows\System\OMcGuKK.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\gUKkAnL.exe
  C:\Windows\System\gUKkAnL.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\JzhdZPM.exe
  C:\Windows\System\JzhdZPM.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\OtBcLaB.exe
  C:\Windows\System\OtBcLaB.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\XxDyrIU.exe
  C:\Windows\System\XxDyrIU.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\XJztrTg.exe
  C:\Windows\System\XJztrTg.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\GyxihyZ.exe
  C:\Windows\System\GyxihyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\tKvorUD.exe
  C:\Windows\System\tKvorUD.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\TyiHtiO.exe
  C:\Windows\System\TyiHtiO.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\crUXhit.exe
  C:\Windows\System\crUXhit.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\TBhepMu.exe
  C:\Windows\System\TBhepMu.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\hTpFuuY.exe
  C:\Windows\System\hTpFuuY.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\ehUhZYx.exe
  C:\Windows\System\ehUhZYx.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\jGuRzYg.exe
  C:\Windows\System\jGuRzYg.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\USPRJQX.exe
  C:\Windows\System\USPRJQX.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\APEDrnG.exe
  C:\Windows\System\APEDrnG.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\eyRzpCX.exe
  C:\Windows\System\eyRzpCX.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\GEWEZkU.exe
  C:\Windows\System\GEWEZkU.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\rdzcdLn.exe
  C:\Windows\System\rdzcdLn.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\Pmugkto.exe
  C:\Windows\System\Pmugkto.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\CqqUiLU.exe
  C:\Windows\System\CqqUiLU.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\RrqoKxE.exe
  C:\Windows\System\RrqoKxE.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\XfibGhx.exe
  C:\Windows\System\XfibGhx.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\Lkxtafn.exe
  C:\Windows\System\Lkxtafn.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\cNWRLwF.exe
  C:\Windows\System\cNWRLwF.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\qRbjlvj.exe
  C:\Windows\System\qRbjlvj.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\OavWYtx.exe
  C:\Windows\System\OavWYtx.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\vWCDHKz.exe
  C:\Windows\System\vWCDHKz.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\YsTfIyo.exe
  C:\Windows\System\YsTfIyo.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\RHNKWxJ.exe
  C:\Windows\System\RHNKWxJ.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\rxSQDIS.exe
  C:\Windows\System\rxSQDIS.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\imUnPep.exe
  C:\Windows\System\imUnPep.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\wBkqPYz.exe
  C:\Windows\System\wBkqPYz.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\VdOCHiu.exe
  C:\Windows\System\VdOCHiu.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\vpoJOQX.exe
  C:\Windows\System\vpoJOQX.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\QnuNtQx.exe
  C:\Windows\System\QnuNtQx.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\upYHgKH.exe
  C:\Windows\System\upYHgKH.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RagCcuQ.exe
  C:\Windows\System\RagCcuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\JSetDgl.exe
  C:\Windows\System\JSetDgl.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\EsxbZbd.exe
  C:\Windows\System\EsxbZbd.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\sJfDsAm.exe
  C:\Windows\System\sJfDsAm.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\OZOWitJ.exe
  C:\Windows\System\OZOWitJ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\hjhQytn.exe
  C:\Windows\System\hjhQytn.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\rpVvNQx.exe
  C:\Windows\System\rpVvNQx.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\eHtHzpo.exe
  C:\Windows\System\eHtHzpo.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\bUJASxa.exe
  C:\Windows\System\bUJASxa.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\BBQrnve.exe
  C:\Windows\System\BBQrnve.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\VqJgOxA.exe
  C:\Windows\System\VqJgOxA.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\RfqhXGG.exe
  C:\Windows\System\RfqhXGG.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\gZSxxlp.exe
  C:\Windows\System\gZSxxlp.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\bpVWvsn.exe
  C:\Windows\System\bpVWvsn.exe
  2⤵
  PID:1000
- C:\Windows\System\rHyOMRb.exe
  C:\Windows\System\rHyOMRb.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\qCllLyp.exe
  C:\Windows\System\qCllLyp.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\ytAWSfe.exe
  C:\Windows\System\ytAWSfe.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\AEkCaCo.exe
  C:\Windows\System\AEkCaCo.exe
  2⤵
  PID:2464
- C:\Windows\System\XABwfuU.exe
  C:\Windows\System\XABwfuU.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\ZAdUhZl.exe
  C:\Windows\System\ZAdUhZl.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\SawYwUr.exe
  C:\Windows\System\SawYwUr.exe
  2⤵
  PID:4036
- C:\Windows\System\ElEKYaE.exe
  C:\Windows\System\ElEKYaE.exe
  2⤵
  PID:1660
- C:\Windows\System\IGxFZMw.exe
  C:\Windows\System\IGxFZMw.exe
  2⤵
  PID:3508
- C:\Windows\System\pZGkNkq.exe
  C:\Windows\System\pZGkNkq.exe
  2⤵
  PID:2792
- C:\Windows\System\QPEgfbZ.exe
  C:\Windows\System\QPEgfbZ.exe
  2⤵
  PID:816
- C:\Windows\System\OGMeakQ.exe
  C:\Windows\System\OGMeakQ.exe
  2⤵
  PID:4812
- C:\Windows\System\mwWfREV.exe
  C:\Windows\System\mwWfREV.exe
  2⤵
  PID:2300
- C:\Windows\System\WnSIfvZ.exe
  C:\Windows\System\WnSIfvZ.exe
  2⤵
  PID:1520
- C:\Windows\System\IRqgTpI.exe
  C:\Windows\System\IRqgTpI.exe
  2⤵
  PID:5032
- C:\Windows\System\JOMQNLK.exe
  C:\Windows\System\JOMQNLK.exe
  2⤵
  PID:640
- C:\Windows\System\gUJfkGJ.exe
  C:\Windows\System\gUJfkGJ.exe
  2⤵
  PID:3292
- C:\Windows\System\flFeiAH.exe
  C:\Windows\System\flFeiAH.exe
  2⤵
  PID:1200
- C:\Windows\System\MJVVeSX.exe
  C:\Windows\System\MJVVeSX.exe
  2⤵
  PID:4920
- C:\Windows\System\DrNeozD.exe
  C:\Windows\System\DrNeozD.exe
  2⤵
  PID:2640
- C:\Windows\System\KKgtDkJ.exe
  C:\Windows\System\KKgtDkJ.exe
  2⤵
  PID:4968
- C:\Windows\System\LZyOuNf.exe
  C:\Windows\System\LZyOuNf.exe
  2⤵
  PID:1464
- C:\Windows\System\DFcsWCP.exe
  C:\Windows\System\DFcsWCP.exe
  2⤵
  PID:2940
- C:\Windows\System\KSmFEws.exe
  C:\Windows\System\KSmFEws.exe
  2⤵
  PID:2316
- C:\Windows\System\JIHTrWP.exe
  C:\Windows\System\JIHTrWP.exe
  2⤵
  PID:4916
- C:\Windows\System\oWzatdH.exe
  C:\Windows\System\oWzatdH.exe
  2⤵
  PID:4504
- C:\Windows\System\cujzIam.exe
  C:\Windows\System\cujzIam.exe
  2⤵
  PID:5128
- C:\Windows\System\UEDiKSZ.exe
  C:\Windows\System\UEDiKSZ.exe
  2⤵
  PID:5168
- C:\Windows\System\GrQDbhO.exe
  C:\Windows\System\GrQDbhO.exe
  2⤵
  PID:5204
- C:\Windows\System\KPvwySs.exe
  C:\Windows\System\KPvwySs.exe
  2⤵
  PID:5220
- C:\Windows\System\TPJXcvj.exe
  C:\Windows\System\TPJXcvj.exe
  2⤵
  PID:5240
- C:\Windows\System\RFyZiNg.exe
  C:\Windows\System\RFyZiNg.exe
  2⤵
  PID:5264
- C:\Windows\System\NmUQHiw.exe
  C:\Windows\System\NmUQHiw.exe
  2⤵
  PID:5280
- C:\Windows\System\RbVOOYn.exe
  C:\Windows\System\RbVOOYn.exe
  2⤵
  PID:5308
- C:\Windows\System\QToZwxE.exe
  C:\Windows\System\QToZwxE.exe
  2⤵
  PID:5324
- C:\Windows\System\bEXkOGG.exe
  C:\Windows\System\bEXkOGG.exe
  2⤵
  PID:5348
- C:\Windows\System\rmTazVV.exe
  C:\Windows\System\rmTazVV.exe
  2⤵
  PID:5364
- C:\Windows\System\NSGrQPV.exe
  C:\Windows\System\NSGrQPV.exe
  2⤵
  PID:5384
- C:\Windows\System\tfOGBwy.exe
  C:\Windows\System\tfOGBwy.exe
  2⤵
  PID:5400
- C:\Windows\System\qrbuzmR.exe
  C:\Windows\System\qrbuzmR.exe
  2⤵
  PID:5420
- C:\Windows\System\LETLrRQ.exe
  C:\Windows\System\LETLrRQ.exe
  2⤵
  PID:5440
- C:\Windows\System\KoLsKRO.exe
  C:\Windows\System\KoLsKRO.exe
  2⤵
  PID:5460
- C:\Windows\System\zWJRSjV.exe
  C:\Windows\System\zWJRSjV.exe
  2⤵
  PID:5484
- C:\Windows\System\pFWscKQ.exe
  C:\Windows\System\pFWscKQ.exe
  2⤵
  PID:5548
- C:\Windows\System\gJQoSzC.exe
  C:\Windows\System\gJQoSzC.exe
  2⤵
  PID:5572
- C:\Windows\System\bSXsJkv.exe
  C:\Windows\System\bSXsJkv.exe
  2⤵
  PID:5628
- C:\Windows\System\RYnjryk.exe
  C:\Windows\System\RYnjryk.exe
  2⤵
  PID:5644
- C:\Windows\System\BlxuCKN.exe
  C:\Windows\System\BlxuCKN.exe
  2⤵
  PID:5664
- C:\Windows\System\QBUSURk.exe
  C:\Windows\System\QBUSURk.exe
  2⤵
  PID:5680
- C:\Windows\System\eFJWTHG.exe
  C:\Windows\System\eFJWTHG.exe
  2⤵
  PID:5704
- C:\Windows\System\asbGcds.exe
  C:\Windows\System\asbGcds.exe
  2⤵
  PID:5720
- C:\Windows\System\SlfJDvQ.exe
  C:\Windows\System\SlfJDvQ.exe
  2⤵
  PID:5736
- C:\Windows\System\NWLWuKh.exe
  C:\Windows\System\NWLWuKh.exe
  2⤵
  PID:5756
- C:\Windows\System\OLdPHAW.exe
  C:\Windows\System\OLdPHAW.exe
  2⤵
  PID:5776
- C:\Windows\System\CmlpuBC.exe
  C:\Windows\System\CmlpuBC.exe
  2⤵
  PID:5796
- C:\Windows\System\hqPkalL.exe
  C:\Windows\System\hqPkalL.exe
  2⤵
  PID:5816
- C:\Windows\System\GXHYreK.exe
  C:\Windows\System\GXHYreK.exe
  2⤵
  PID:5836
- C:\Windows\System\FbNtlZE.exe
  C:\Windows\System\FbNtlZE.exe
  2⤵
  PID:5860
- C:\Windows\System\eIVpHgN.exe
  C:\Windows\System\eIVpHgN.exe
  2⤵
  PID:5880
- C:\Windows\System\vafunWI.exe
  C:\Windows\System\vafunWI.exe
  2⤵
  PID:5904
- C:\Windows\System\eKpPuzQ.exe
  C:\Windows\System\eKpPuzQ.exe
  2⤵
  PID:5924
- C:\Windows\System\BFLylog.exe
  C:\Windows\System\BFLylog.exe
  2⤵
  PID:5940
- C:\Windows\System\ZJKcQHJ.exe
  C:\Windows\System\ZJKcQHJ.exe
  2⤵
  PID:5964
- C:\Windows\System\DeXZsbM.exe
  C:\Windows\System\DeXZsbM.exe
  2⤵
  PID:5988
- C:\Windows\System\jSaZpOT.exe
  C:\Windows\System\jSaZpOT.exe
  2⤵
  PID:6008
- C:\Windows\System\PCeuPtA.exe
  C:\Windows\System\PCeuPtA.exe
  2⤵
  PID:6036
- C:\Windows\System\xDnIuqM.exe
  C:\Windows\System\xDnIuqM.exe
  2⤵
  PID:6052
- C:\Windows\System\gOOzPFf.exe
  C:\Windows\System\gOOzPFf.exe
  2⤵
  PID:6096
- C:\Windows\System\gIoiCME.exe
  C:\Windows\System\gIoiCME.exe
  2⤵
  PID:6112
- C:\Windows\System\QgnMkws.exe
  C:\Windows\System\QgnMkws.exe
  2⤵
  PID:6132
- C:\Windows\System\bfxpCpY.exe
  C:\Windows\System\bfxpCpY.exe
  2⤵
  PID:1304
- C:\Windows\System\RIpDpqK.exe
  C:\Windows\System\RIpDpqK.exe
  2⤵
  PID:4676
- C:\Windows\System\sRCxVla.exe
  C:\Windows\System\sRCxVla.exe
  2⤵
  PID:2396
- C:\Windows\System\QnDlZqW.exe
  C:\Windows\System\QnDlZqW.exe
  2⤵
  PID:3384
- C:\Windows\System\gTbiHeY.exe
  C:\Windows\System\gTbiHeY.exe
  2⤵
  PID:1652
- C:\Windows\System\JxPpumV.exe
  C:\Windows\System\JxPpumV.exe
  2⤵
  PID:228
- C:\Windows\System\vTpWsHy.exe
  C:\Windows\System\vTpWsHy.exe
  2⤵
  PID:4348
- C:\Windows\System\xJtmdyC.exe
  C:\Windows\System\xJtmdyC.exe
  2⤵
  PID:3344
- C:\Windows\System\nlzJfKX.exe
  C:\Windows\System\nlzJfKX.exe
  2⤵
  PID:452
- C:\Windows\System\FCQAQuE.exe
  C:\Windows\System\FCQAQuE.exe
  2⤵
  PID:844
- C:\Windows\System\aqtlinb.exe
  C:\Windows\System\aqtlinb.exe
  2⤵
  PID:4752
- C:\Windows\System\FRJwQLf.exe
  C:\Windows\System\FRJwQLf.exe
  2⤵
  PID:3728
- C:\Windows\System\PVpuvoF.exe
  C:\Windows\System\PVpuvoF.exe
  2⤵
  PID:2088
- C:\Windows\System\cfKSkgD.exe
  C:\Windows\System\cfKSkgD.exe
  2⤵
  PID:2628
- C:\Windows\System\IHakeiI.exe
  C:\Windows\System\IHakeiI.exe
  2⤵
  PID:668
- C:\Windows\System\BeiIwJP.exe
  C:\Windows\System\BeiIwJP.exe
  2⤵
  PID:5656
- C:\Windows\System\OhxlFyb.exe
  C:\Windows\System\OhxlFyb.exe
  2⤵
  PID:3552
- C:\Windows\System\GjVJiLa.exe
  C:\Windows\System\GjVJiLa.exe
  2⤵
  PID:6152
- C:\Windows\System\vzNoNbJ.exe
  C:\Windows\System\vzNoNbJ.exe
  2⤵
  PID:6172
- C:\Windows\System\gMIFhkF.exe
  C:\Windows\System\gMIFhkF.exe
  2⤵
  PID:6192
- C:\Windows\System\iCjrZTp.exe
  C:\Windows\System\iCjrZTp.exe
  2⤵
  PID:6212
- C:\Windows\System\ArTGcqq.exe
  C:\Windows\System\ArTGcqq.exe
  2⤵
  PID:6244
- C:\Windows\System\ZPLRHlW.exe
  C:\Windows\System\ZPLRHlW.exe
  2⤵
  PID:6264
- C:\Windows\System\qSsAIqy.exe
  C:\Windows\System\qSsAIqy.exe
  2⤵
  PID:6280
- C:\Windows\System\DYtefLj.exe
  C:\Windows\System\DYtefLj.exe
  2⤵
  PID:6304
- C:\Windows\System\zunbaqq.exe
  C:\Windows\System\zunbaqq.exe
  2⤵
  PID:6324
- C:\Windows\System\qEHkPgr.exe
  C:\Windows\System\qEHkPgr.exe
  2⤵
  PID:6348
- C:\Windows\System\hElipoe.exe
  C:\Windows\System\hElipoe.exe
  2⤵
  PID:6368
- C:\Windows\System\HXMTuXJ.exe
  C:\Windows\System\HXMTuXJ.exe
  2⤵
  PID:6388
- C:\Windows\System\bnFxAHu.exe
  C:\Windows\System\bnFxAHu.exe
  2⤵
  PID:6412
- C:\Windows\System\tpjlMCA.exe
  C:\Windows\System\tpjlMCA.exe
  2⤵
  PID:6440
- C:\Windows\System\aqqpKqL.exe
  C:\Windows\System\aqqpKqL.exe
  2⤵
  PID:6460
- C:\Windows\System\nPZthVq.exe
  C:\Windows\System\nPZthVq.exe
  2⤵
  PID:6484
- C:\Windows\System\vVSkZOp.exe
  C:\Windows\System\vVSkZOp.exe
  2⤵
  PID:6508
- C:\Windows\System\CNEjwUX.exe
  C:\Windows\System\CNEjwUX.exe
  2⤵
  PID:6524
- C:\Windows\System\VsmuTHo.exe
  C:\Windows\System\VsmuTHo.exe
  2⤵
  PID:6544
- C:\Windows\System\lRblCvc.exe
  C:\Windows\System\lRblCvc.exe
  2⤵
  PID:6568
- C:\Windows\System\qDylrdr.exe
  C:\Windows\System\qDylrdr.exe
  2⤵
  PID:6584
- C:\Windows\System\spdGRXY.exe
  C:\Windows\System\spdGRXY.exe
  2⤵
  PID:6600
- C:\Windows\System\uJtJowF.exe
  C:\Windows\System\uJtJowF.exe
  2⤵
  PID:6620
- C:\Windows\System\AJwaEuc.exe
  C:\Windows\System\AJwaEuc.exe
  2⤵
  PID:6640
- C:\Windows\System\hNxdZGT.exe
  C:\Windows\System\hNxdZGT.exe
  2⤵
  PID:6664
- C:\Windows\System\vSKeEKa.exe
  C:\Windows\System\vSKeEKa.exe
  2⤵
  PID:6684
- C:\Windows\System\algLZfe.exe
  C:\Windows\System\algLZfe.exe
  2⤵
  PID:6712
- C:\Windows\System\NedIjil.exe
  C:\Windows\System\NedIjil.exe
  2⤵
  PID:6728
- C:\Windows\System\OSLUAKd.exe
  C:\Windows\System\OSLUAKd.exe
  2⤵
  PID:6772
- C:\Windows\System\QtCaeXd.exe
  C:\Windows\System\QtCaeXd.exe
  2⤵
  PID:6788
- C:\Windows\System\avfbMQF.exe
  C:\Windows\System\avfbMQF.exe
  2⤵
  PID:6804
- C:\Windows\System\itAjzpi.exe
  C:\Windows\System\itAjzpi.exe
  2⤵
  PID:6840
- C:\Windows\System\NWjRCID.exe
  C:\Windows\System\NWjRCID.exe
  2⤵
  PID:6860
- C:\Windows\System\wYZBBys.exe
  C:\Windows\System\wYZBBys.exe
  2⤵
  PID:6880
- C:\Windows\System\ZzDYmEx.exe
  C:\Windows\System\ZzDYmEx.exe
  2⤵
  PID:6900
- C:\Windows\System\vIUvnSn.exe
  C:\Windows\System\vIUvnSn.exe
  2⤵
  PID:6920
- C:\Windows\System\nxdcniQ.exe
  C:\Windows\System\nxdcniQ.exe
  2⤵
  PID:6940
- C:\Windows\System\IbvXpJo.exe
  C:\Windows\System\IbvXpJo.exe
  2⤵
  PID:6964
- C:\Windows\System\geVjPDL.exe
  C:\Windows\System\geVjPDL.exe
  2⤵
  PID:6980
- C:\Windows\System\ZkibMxu.exe
  C:\Windows\System\ZkibMxu.exe
  2⤵
  PID:7004
- C:\Windows\System\tPzaMdd.exe
  C:\Windows\System\tPzaMdd.exe
  2⤵
  PID:7028
- C:\Windows\System\qXmaYIF.exe
  C:\Windows\System\qXmaYIF.exe
  2⤵
  PID:7064
- C:\Windows\System\OoeJJrH.exe
  C:\Windows\System\OoeJJrH.exe
  2⤵
  PID:7088
- C:\Windows\System\VuMDQUm.exe
  C:\Windows\System\VuMDQUm.exe
  2⤵
  PID:7104
- C:\Windows\System\TLXPVJL.exe
  C:\Windows\System\TLXPVJL.exe
  2⤵
  PID:7132
- C:\Windows\System\mpxxQch.exe
  C:\Windows\System\mpxxQch.exe
  2⤵
  PID:7152
- C:\Windows\System\mQFLFod.exe
  C:\Windows\System\mQFLFod.exe
  2⤵
  PID:3840
- C:\Windows\System\OLJSFCI.exe
  C:\Windows\System\OLJSFCI.exe
  2⤵
  PID:5452
- C:\Windows\System\WABFYJw.exe
  C:\Windows\System\WABFYJw.exe
  2⤵
  PID:6016
- C:\Windows\System\uYrNrCa.exe
  C:\Windows\System\uYrNrCa.exe
  2⤵
  PID:1876
- C:\Windows\System\HxXIMrW.exe
  C:\Windows\System\HxXIMrW.exe
  2⤵
  PID:1600
- C:\Windows\System\FqQNKDs.exe
  C:\Windows\System\FqQNKDs.exe
  2⤵
  PID:5140
- C:\Windows\System\EbVrvFz.exe
  C:\Windows\System\EbVrvFz.exe
  2⤵
  PID:5180
- C:\Windows\System\eTxLJET.exe
  C:\Windows\System\eTxLJET.exe
  2⤵
  PID:5232
- C:\Windows\System\mFYHlQp.exe
  C:\Windows\System\mFYHlQp.exe
  2⤵
  PID:5276
- C:\Windows\System\KfIoZBs.exe
  C:\Windows\System\KfIoZBs.exe
  2⤵
  PID:5320
- C:\Windows\System\fWnFTIP.exe
  C:\Windows\System\fWnFTIP.exe
  2⤵
  PID:4840
- C:\Windows\System\PedHdoU.exe
  C:\Windows\System\PedHdoU.exe
  2⤵
  PID:5356
- C:\Windows\System\IxjzxkH.exe
  C:\Windows\System\IxjzxkH.exe
  2⤵
  PID:5712
- C:\Windows\System\CtscoBj.exe
  C:\Windows\System\CtscoBj.exe
  2⤵
  PID:5408
- C:\Windows\System\gRLltmN.exe
  C:\Windows\System\gRLltmN.exe
  2⤵
  PID:6168
- C:\Windows\System\LIDFoiS.exe
  C:\Windows\System\LIDFoiS.exe
  2⤵
  PID:5480
- C:\Windows\System\fayhPaE.exe
  C:\Windows\System\fayhPaE.exe
  2⤵
  PID:6256
- C:\Windows\System\LTRNMLR.exe
  C:\Windows\System\LTRNMLR.exe
  2⤵
  PID:6288
- C:\Windows\System\TpCHfRE.exe
  C:\Windows\System\TpCHfRE.exe
  2⤵
  PID:6360
- C:\Windows\System\wZPYwFI.exe
  C:\Windows\System\wZPYwFI.exe
  2⤵
  PID:6424
- C:\Windows\System\lvLFXNj.exe
  C:\Windows\System\lvLFXNj.exe
  2⤵
  PID:6468
- C:\Windows\System\NbVVdOs.exe
  C:\Windows\System\NbVVdOs.exe
  2⤵
  PID:6496
- C:\Windows\System\uGguLGK.exe
  C:\Windows\System\uGguLGK.exe
  2⤵
  PID:5608
- C:\Windows\System\qtsYZLS.exe
  C:\Windows\System\qtsYZLS.exe
  2⤵
  PID:7176
- C:\Windows\System\wYqNWDz.exe
  C:\Windows\System\wYqNWDz.exe
  2⤵
  PID:7196
- C:\Windows\System\TMhRwky.exe
  C:\Windows\System\TMhRwky.exe
  2⤵
  PID:7212
- C:\Windows\System\XMmXadD.exe
  C:\Windows\System\XMmXadD.exe
  2⤵
  PID:7236
- C:\Windows\System\rdlwgTg.exe
  C:\Windows\System\rdlwgTg.exe
  2⤵
  PID:7260
- C:\Windows\System\iawwTHd.exe
  C:\Windows\System\iawwTHd.exe
  2⤵
  PID:7276
- C:\Windows\System\AISnmpV.exe
  C:\Windows\System\AISnmpV.exe
  2⤵
  PID:7300
- C:\Windows\System\lRiFKNP.exe
  C:\Windows\System\lRiFKNP.exe
  2⤵
  PID:7320
- C:\Windows\System\HtBJcFa.exe
  C:\Windows\System\HtBJcFa.exe
  2⤵
  PID:7344
- C:\Windows\System\NRufhqj.exe
  C:\Windows\System\NRufhqj.exe
  2⤵
  PID:7360
- C:\Windows\System\kfHvCzZ.exe
  C:\Windows\System\kfHvCzZ.exe
  2⤵
  PID:7380
- C:\Windows\System\GnujKcV.exe
  C:\Windows\System\GnujKcV.exe
  2⤵
  PID:7404
- C:\Windows\System\ohBXaTk.exe
  C:\Windows\System\ohBXaTk.exe
  2⤵
  PID:7432
- C:\Windows\System\JNGyLfe.exe
  C:\Windows\System\JNGyLfe.exe
  2⤵
  PID:7448
- C:\Windows\System\sWbjIKQ.exe
  C:\Windows\System\sWbjIKQ.exe
  2⤵
  PID:7476
- C:\Windows\System\novFOsR.exe
  C:\Windows\System\novFOsR.exe
  2⤵
  PID:7500
- C:\Windows\System\FxdWSiF.exe
  C:\Windows\System\FxdWSiF.exe
  2⤵
  PID:7520
- C:\Windows\System\bmcakql.exe
  C:\Windows\System\bmcakql.exe
  2⤵
  PID:7540
- C:\Windows\System\GFdGqLH.exe
  C:\Windows\System\GFdGqLH.exe
  2⤵
  PID:7560
- C:\Windows\System\VpKxXde.exe
  C:\Windows\System\VpKxXde.exe
  2⤵
  PID:7588
- C:\Windows\System\hxhZyzd.exe
  C:\Windows\System\hxhZyzd.exe
  2⤵
  PID:7608
- C:\Windows\System\AWhtmte.exe
  C:\Windows\System\AWhtmte.exe
  2⤵
  PID:7628
- C:\Windows\System\BVUzNaV.exe
  C:\Windows\System\BVUzNaV.exe
  2⤵
  PID:7648
- C:\Windows\System\NZAMRic.exe
  C:\Windows\System\NZAMRic.exe
  2⤵
  PID:7672
- C:\Windows\System\kxYzCDa.exe
  C:\Windows\System\kxYzCDa.exe
  2⤵
  PID:7692
- C:\Windows\System\JWRSRBp.exe
  C:\Windows\System\JWRSRBp.exe
  2⤵
  PID:7712
- C:\Windows\System\lLyiISn.exe
  C:\Windows\System\lLyiISn.exe
  2⤵
  PID:7736
- C:\Windows\System\XOxUdtg.exe
  C:\Windows\System\XOxUdtg.exe
  2⤵
  PID:7756
- C:\Windows\System\dQbRVWt.exe
  C:\Windows\System\dQbRVWt.exe
  2⤵
  PID:7776
- C:\Windows\System\jozNylp.exe
  C:\Windows\System\jozNylp.exe
  2⤵
  PID:7800
- C:\Windows\System\YqVEWnC.exe
  C:\Windows\System\YqVEWnC.exe
  2⤵
  PID:7816
- C:\Windows\System\veoyBmH.exe
  C:\Windows\System\veoyBmH.exe
  2⤵
  PID:7844
- C:\Windows\System\DgThbtE.exe
  C:\Windows\System\DgThbtE.exe
  2⤵
  PID:7864
- C:\Windows\System\uRPjiat.exe
  C:\Windows\System\uRPjiat.exe
  2⤵
  PID:7880
- C:\Windows\System\MpupqAe.exe
  C:\Windows\System\MpupqAe.exe
  2⤵
  PID:7904
- C:\Windows\System\PZttXyD.exe
  C:\Windows\System\PZttXyD.exe
  2⤵
  PID:7928
- C:\Windows\System\ksPMEXF.exe
  C:\Windows\System\ksPMEXF.exe
  2⤵
  PID:7952
- C:\Windows\System\KifyLjW.exe
  C:\Windows\System\KifyLjW.exe
  2⤵
  PID:7972
- C:\Windows\System\jVHMeVp.exe
  C:\Windows\System\jVHMeVp.exe
  2⤵
  PID:8152
- C:\Windows\System\xqlfEle.exe
  C:\Windows\System\xqlfEle.exe
  2⤵
  PID:8168
- C:\Windows\System\ZDMSiSp.exe
  C:\Windows\System\ZDMSiSp.exe
  2⤵
  PID:8184
- C:\Windows\System\fRbTzYQ.exe
  C:\Windows\System\fRbTzYQ.exe
  2⤵
  PID:5672
- C:\Windows\System\VyuWJFW.exe
  C:\Windows\System\VyuWJFW.exe
  2⤵
  PID:5696
- C:\Windows\System\pxqubfz.exe
  C:\Windows\System\pxqubfz.exe
  2⤵
  PID:3860
- C:\Windows\System\MRMMqsw.exe
  C:\Windows\System\MRMMqsw.exe
  2⤵
  PID:6916
- C:\Windows\System\AYQIWXT.exe
  C:\Windows\System\AYQIWXT.exe
  2⤵
  PID:5036
- C:\Windows\System\rTXGgnI.exe
  C:\Windows\System\rTXGgnI.exe
  2⤵
  PID:5752
- C:\Windows\System\yTEVBNc.exe
  C:\Windows\System\yTEVBNc.exe
  2⤵
  PID:5772
- C:\Windows\System\VUUSagp.exe
  C:\Windows\System\VUUSagp.exe
  2⤵
  PID:5448
- C:\Windows\System\PgbYCMa.exe
  C:\Windows\System\PgbYCMa.exe
  2⤵
  PID:5852
- C:\Windows\System\wxVAzoQ.exe
  C:\Windows\System\wxVAzoQ.exe
  2⤵
  PID:7096
- C:\Windows\System\OvXdVhN.exe
  C:\Windows\System\OvXdVhN.exe
  2⤵
  PID:1552
- C:\Windows\System\zsVcJye.exe
  C:\Windows\System\zsVcJye.exe
  2⤵
  PID:5136
- C:\Windows\System\YqLgaQL.exe
  C:\Windows\System\YqLgaQL.exe
  2⤵
  PID:5932
- C:\Windows\System\eiRRTsa.exe
  C:\Windows\System\eiRRTsa.exe
  2⤵
  PID:664
- C:\Windows\System\HanYwUV.exe
  C:\Windows\System\HanYwUV.exe
  2⤵
  PID:6316
- C:\Windows\System\jSFkJuN.exe
  C:\Windows\System\jSFkJuN.exe
  2⤵
  PID:6044
- C:\Windows\System\EEeabHg.exe
  C:\Windows\System\EEeabHg.exe
  2⤵
  PID:6064
- C:\Windows\System\DNyRUEq.exe
  C:\Windows\System\DNyRUEq.exe
  2⤵
  PID:2456
- C:\Windows\System\lEpjbCC.exe
  C:\Windows\System\lEpjbCC.exe
  2⤵
  PID:2376
- C:\Windows\System\VqVAsfe.exe
  C:\Windows\System\VqVAsfe.exe
  2⤵
  PID:2064
- C:\Windows\System\zTcfJWG.exe
  C:\Windows\System\zTcfJWG.exe
  2⤵
  PID:5068
- C:\Windows\System\tJoUoUf.exe
  C:\Windows\System\tJoUoUf.exe
  2⤵
  PID:6340
- C:\Windows\System\PXIyAHn.exe
  C:\Windows\System\PXIyAHn.exe
  2⤵
  PID:6520
- C:\Windows\System\DOUxrVG.exe
  C:\Windows\System\DOUxrVG.exe
  2⤵
  PID:6612
- C:\Windows\System\GFIoOdl.exe
  C:\Windows\System\GFIoOdl.exe
  2⤵
  PID:6648
- C:\Windows\System\tLNrypb.exe
  C:\Windows\System\tLNrypb.exe
  2⤵
  PID:6708
- C:\Windows\System\JWclsrF.exe
  C:\Windows\System\JWclsrF.exe
  2⤵
  PID:6744
- C:\Windows\System\LkDHbCI.exe
  C:\Windows\System\LkDHbCI.exe
  2⤵
  PID:6820
- C:\Windows\System\pUUPRpg.exe
  C:\Windows\System\pUUPRpg.exe
  2⤵
  PID:6876
- C:\Windows\System\ipTZyBq.exe
  C:\Windows\System\ipTZyBq.exe
  2⤵
  PID:6912
- C:\Windows\System\DVsROMn.exe
  C:\Windows\System\DVsROMn.exe
  2⤵
  PID:7052
- C:\Windows\System\iNJXTTR.exe
  C:\Windows\System\iNJXTTR.exe
  2⤵
  PID:7120
- C:\Windows\System\UOCAOCV.exe
  C:\Windows\System\UOCAOCV.exe
  2⤵
  PID:3120
- C:\Windows\System\YJCBFmi.exe
  C:\Windows\System\YJCBFmi.exe
  2⤵
  PID:6000
- C:\Windows\System\pmhomqZ.exe
  C:\Windows\System\pmhomqZ.exe
  2⤵
  PID:4804
- C:\Windows\System\mwSaxkn.exe
  C:\Windows\System\mwSaxkn.exe
  2⤵
  PID:5260
- C:\Windows\System\DvRnvms.exe
  C:\Windows\System\DvRnvms.exe
  2⤵
  PID:5716
- C:\Windows\System\tGpvecE.exe
  C:\Windows\System\tGpvecE.exe
  2⤵
  PID:6312
- C:\Windows\System\CsjQncJ.exe
  C:\Windows\System\CsjQncJ.exe
  2⤵
  PID:6140
- C:\Windows\System\HSTrOXa.exe
  C:\Windows\System\HSTrOXa.exe
  2⤵
  PID:7456
- C:\Windows\System\jiXnhDn.exe
  C:\Windows\System\jiXnhDn.exe
  2⤵
  PID:7748
- C:\Windows\System\XzudNcX.exe
  C:\Windows\System\XzudNcX.exe
  2⤵
  PID:7912
- C:\Windows\System\mvGDoPB.exe
  C:\Windows\System\mvGDoPB.exe
  2⤵
  PID:6476
- C:\Windows\System\HXbhJuj.exe
  C:\Windows\System\HXbhJuj.exe
  2⤵
  PID:7172
- C:\Windows\System\qnpVeTG.exe
  C:\Windows\System\qnpVeTG.exe
  2⤵
  PID:7252
- C:\Windows\System\SZaYWtK.exe
  C:\Windows\System\SZaYWtK.exe
  2⤵
  PID:7316
- C:\Windows\System\kHBHQPm.exe
  C:\Windows\System\kHBHQPm.exe
  2⤵
  PID:7512
- C:\Windows\System\kdzTUyD.exe
  C:\Windows\System\kdzTUyD.exe
  2⤵
  PID:7600
- C:\Windows\System\IUjdoLY.exe
  C:\Windows\System\IUjdoLY.exe
  2⤵
  PID:7704
- C:\Windows\System\TQVADIm.exe
  C:\Windows\System\TQVADIm.exe
  2⤵
  PID:7768
- C:\Windows\System\ODGwDQg.exe
  C:\Windows\System\ODGwDQg.exe
  2⤵
  PID:8204
- C:\Windows\System\diJhNKb.exe
  C:\Windows\System\diJhNKb.exe
  2⤵
  PID:8224
- C:\Windows\System\mSOkZBZ.exe
  C:\Windows\System\mSOkZBZ.exe
  2⤵
  PID:8244
- C:\Windows\System\LMrqVSp.exe
  C:\Windows\System\LMrqVSp.exe
  2⤵
  PID:8268
- C:\Windows\System\efGvsbH.exe
  C:\Windows\System\efGvsbH.exe
  2⤵
  PID:8284
- C:\Windows\System\nSRZhwR.exe
  C:\Windows\System\nSRZhwR.exe
  2⤵
  PID:8304
- C:\Windows\System\sbFyHyo.exe
  C:\Windows\System\sbFyHyo.exe
  2⤵
  PID:8328
- C:\Windows\System\maiLsjY.exe
  C:\Windows\System\maiLsjY.exe
  2⤵
  PID:8356
- C:\Windows\System\DjSidBY.exe
  C:\Windows\System\DjSidBY.exe
  2⤵
  PID:8376
- C:\Windows\System\eqfFdqr.exe
  C:\Windows\System\eqfFdqr.exe
  2⤵
  PID:8392
- C:\Windows\System\PorYslh.exe
  C:\Windows\System\PorYslh.exe
  2⤵
  PID:8416
- C:\Windows\System\ZBVWMMQ.exe
  C:\Windows\System\ZBVWMMQ.exe
  2⤵
  PID:8440
- C:\Windows\System\iALXYGD.exe
  C:\Windows\System\iALXYGD.exe
  2⤵
  PID:8456
- C:\Windows\System\BdxpWsy.exe
  C:\Windows\System\BdxpWsy.exe
  2⤵
  PID:8480
- C:\Windows\System\QCplOhd.exe
  C:\Windows\System\QCplOhd.exe
  2⤵
  PID:8504
- C:\Windows\System\anfOebO.exe
  C:\Windows\System\anfOebO.exe
  2⤵
  PID:8524
- C:\Windows\System\pOmIhUh.exe
  C:\Windows\System\pOmIhUh.exe
  2⤵
  PID:8544
- C:\Windows\System\NBJrJPx.exe
  C:\Windows\System\NBJrJPx.exe
  2⤵
  PID:8568
- C:\Windows\System\WEYKXFb.exe
  C:\Windows\System\WEYKXFb.exe
  2⤵
  PID:8588
- C:\Windows\System\aMRcWSQ.exe
  C:\Windows\System\aMRcWSQ.exe
  2⤵
  PID:8612
- C:\Windows\System\vuuHgBL.exe
  C:\Windows\System\vuuHgBL.exe
  2⤵
  PID:8628
- C:\Windows\System\FhJmiKO.exe
  C:\Windows\System\FhJmiKO.exe
  2⤵
  PID:8652
- C:\Windows\System\PSKILct.exe
  C:\Windows\System\PSKILct.exe
  2⤵
  PID:8676
- C:\Windows\System\ZgqjjIB.exe
  C:\Windows\System\ZgqjjIB.exe
  2⤵
  PID:8704
- C:\Windows\System\WwGWOTU.exe
  C:\Windows\System\WwGWOTU.exe
  2⤵
  PID:8720
- C:\Windows\System\SuGyqRH.exe
  C:\Windows\System\SuGyqRH.exe
  2⤵
  PID:8744
- C:\Windows\System\uoOLuqz.exe
  C:\Windows\System\uoOLuqz.exe
  2⤵
  PID:8768
- C:\Windows\System\Igkzyad.exe
  C:\Windows\System\Igkzyad.exe
  2⤵
  PID:8796
- C:\Windows\System\dOsHrvz.exe
  C:\Windows\System\dOsHrvz.exe
  2⤵
  PID:8812
- C:\Windows\System\AZOgBHT.exe
  C:\Windows\System\AZOgBHT.exe
  2⤵
  PID:8836
- C:\Windows\System\IWqfsJe.exe
  C:\Windows\System\IWqfsJe.exe
  2⤵
  PID:8864
- C:\Windows\System\zIbJOWY.exe
  C:\Windows\System\zIbJOWY.exe
  2⤵
  PID:8884
- C:\Windows\System\wLfsjJh.exe
  C:\Windows\System\wLfsjJh.exe
  2⤵
  PID:8908
- C:\Windows\System\xKHQhuu.exe
  C:\Windows\System\xKHQhuu.exe
  2⤵
  PID:8932
- C:\Windows\System\yHMzyVk.exe
  C:\Windows\System\yHMzyVk.exe
  2⤵
  PID:8952
- C:\Windows\System\DPqBqQW.exe
  C:\Windows\System\DPqBqQW.exe
  2⤵
  PID:8976
- C:\Windows\System\YmpeNUi.exe
  C:\Windows\System\YmpeNUi.exe
  2⤵
  PID:9000
- C:\Windows\System\iZVAkVT.exe
  C:\Windows\System\iZVAkVT.exe
  2⤵
  PID:9020
- C:\Windows\System\jMOQUvq.exe
  C:\Windows\System\jMOQUvq.exe
  2⤵
  PID:9040
- C:\Windows\System\jlJpNHy.exe
  C:\Windows\System\jlJpNHy.exe
  2⤵
  PID:9064
- C:\Windows\System\XUrsqEK.exe
  C:\Windows\System\XUrsqEK.exe
  2⤵
  PID:9088
- C:\Windows\System\RuKqGlN.exe
  C:\Windows\System\RuKqGlN.exe
  2⤵
  PID:9112
- C:\Windows\System\IfbsNVD.exe
  C:\Windows\System\IfbsNVD.exe
  2⤵
  PID:9132
- C:\Windows\System\sfJUIXL.exe
  C:\Windows\System\sfJUIXL.exe
  2⤵
  PID:9220
- C:\Windows\System\UhexrjJ.exe
  C:\Windows\System\UhexrjJ.exe
  2⤵
  PID:9236
- C:\Windows\System\PlzrBcY.exe
  C:\Windows\System\PlzrBcY.exe
  2⤵
  PID:9252
- C:\Windows\System\ammUDrR.exe
  C:\Windows\System\ammUDrR.exe
  2⤵
  PID:9268
- C:\Windows\System\MJhvlFZ.exe
  C:\Windows\System\MJhvlFZ.exe
  2⤵
  PID:9284
- C:\Windows\System\KZaPKly.exe
  C:\Windows\System\KZaPKly.exe
  2⤵
  PID:9304
- C:\Windows\System\ylnYmFp.exe
  C:\Windows\System\ylnYmFp.exe
  2⤵
  PID:9324
- C:\Windows\System\RxqKdQj.exe
  C:\Windows\System\RxqKdQj.exe
  2⤵
  PID:9344
- C:\Windows\System\jsicfQg.exe
  C:\Windows\System\jsicfQg.exe
  2⤵
  PID:9368
- C:\Windows\System\EyEkAAX.exe
  C:\Windows\System\EyEkAAX.exe
  2⤵
  PID:9392
- C:\Windows\System\eYKmyeA.exe
  C:\Windows\System\eYKmyeA.exe
  2⤵
  PID:9416
- C:\Windows\System\bVOXsCz.exe
  C:\Windows\System\bVOXsCz.exe
  2⤵
  PID:9436
- C:\Windows\System\ogHMFaO.exe
  C:\Windows\System\ogHMFaO.exe
  2⤵
  PID:9464
- C:\Windows\System\BckXJDH.exe
  C:\Windows\System\BckXJDH.exe
  2⤵
  PID:9492
- C:\Windows\System\fsuXdkf.exe
  C:\Windows\System\fsuXdkf.exe
  2⤵
  PID:9508
- C:\Windows\System\KtiKlCC.exe
  C:\Windows\System\KtiKlCC.exe
  2⤵
  PID:9532
- C:\Windows\System\YJufreb.exe
  C:\Windows\System\YJufreb.exe
  2⤵
  PID:9560
- C:\Windows\System\VsaNcBl.exe
  C:\Windows\System\VsaNcBl.exe
  2⤵
  PID:9580
- C:\Windows\System\iyRoGjT.exe
  C:\Windows\System\iyRoGjT.exe
  2⤵
  PID:9612
- C:\Windows\System\qFBoLZp.exe
  C:\Windows\System\qFBoLZp.exe
  2⤵
  PID:9628
- C:\Windows\System\ArwNrCQ.exe
  C:\Windows\System\ArwNrCQ.exe
  2⤵
  PID:9644
- C:\Windows\System\ahQCEXo.exe
  C:\Windows\System\ahQCEXo.exe
  2⤵
  PID:9660
- C:\Windows\System\MWMhjfY.exe
  C:\Windows\System\MWMhjfY.exe
  2⤵
  PID:9676
- C:\Windows\System\ZgiokbO.exe
  C:\Windows\System\ZgiokbO.exe
  2⤵
  PID:9700
- C:\Windows\System\vSgRyYE.exe
  C:\Windows\System\vSgRyYE.exe
  2⤵
  PID:9720
- C:\Windows\System\phdJAhd.exe
  C:\Windows\System\phdJAhd.exe
  2⤵
  PID:9740
- C:\Windows\System\AlKORJB.exe
  C:\Windows\System\AlKORJB.exe
  2⤵
  PID:9760
- C:\Windows\System\UYjSEji.exe
  C:\Windows\System\UYjSEji.exe
  2⤵
  PID:9784
- C:\Windows\System\vcvBvbM.exe
  C:\Windows\System\vcvBvbM.exe
  2⤵
  PID:9804
- C:\Windows\System\UuMAqby.exe
  C:\Windows\System\UuMAqby.exe
  2⤵
  PID:9832
- C:\Windows\System\OUICPSc.exe
  C:\Windows\System\OUICPSc.exe
  2⤵
  PID:9856
- C:\Windows\System\hXxgITZ.exe
  C:\Windows\System\hXxgITZ.exe
  2⤵
  PID:9876
- C:\Windows\System\MJYPwif.exe
  C:\Windows\System\MJYPwif.exe
  2⤵
  PID:9904
- C:\Windows\System\DYFbhXe.exe
  C:\Windows\System\DYFbhXe.exe
  2⤵
  PID:9932
- C:\Windows\System\mEQVmgv.exe
  C:\Windows\System\mEQVmgv.exe
  2⤵
  PID:9956
- C:\Windows\System\HtgseOd.exe
  C:\Windows\System\HtgseOd.exe
  2⤵
  PID:9976
- C:\Windows\System\XTgtZrs.exe
  C:\Windows\System\XTgtZrs.exe
  2⤵
  PID:10004
- C:\Windows\System\jIkvhfg.exe
  C:\Windows\System\jIkvhfg.exe
  2⤵
  PID:10024
- C:\Windows\System\lbWCvWT.exe
  C:\Windows\System\lbWCvWT.exe
  2⤵
  PID:10044
- C:\Windows\System\lBWGbuD.exe
  C:\Windows\System\lBWGbuD.exe
  2⤵
  PID:10072
- C:\Windows\System\WycEKYw.exe
  C:\Windows\System\WycEKYw.exe
  2⤵
  PID:10096
- C:\Windows\System\XUZIIqA.exe
  C:\Windows\System\XUZIIqA.exe
  2⤵
  PID:10120
- C:\Windows\System\LTIDhXA.exe
  C:\Windows\System\LTIDhXA.exe
  2⤵
  PID:10140
- C:\Windows\System\ympBuhW.exe
  C:\Windows\System\ympBuhW.exe
  2⤵
  PID:10164
- C:\Windows\System\xfEJPUl.exe
  C:\Windows\System\xfEJPUl.exe
  2⤵
  PID:10196
- C:\Windows\System\TvjkKZj.exe
  C:\Windows\System\TvjkKZj.exe
  2⤵
  PID:10228
- C:\Windows\System\MOqiFMW.exe
  C:\Windows\System\MOqiFMW.exe
  2⤵
  PID:7412
- C:\Windows\System\AmCPpnc.exe
  C:\Windows\System\AmCPpnc.exe
  2⤵
  PID:7072
- C:\Windows\System\mbxGsPw.exe
  C:\Windows\System\mbxGsPw.exe
  2⤵
  PID:7580
- C:\Windows\System\mkpVUPo.exe
  C:\Windows\System\mkpVUPo.exe
  2⤵
  PID:7636
- C:\Windows\System\TUxuMUe.exe
  C:\Windows\System\TUxuMUe.exe
  2⤵
  PID:7660
- C:\Windows\System\odzLWMZ.exe
  C:\Windows\System\odzLWMZ.exe
  2⤵
  PID:7400
- C:\Windows\System\mfQIQdR.exe
  C:\Windows\System\mfQIQdR.exe
  2⤵
  PID:7204
- C:\Windows\System\pDOzSmH.exe
  C:\Windows\System\pDOzSmH.exe
  2⤵
  PID:7796
- C:\Windows\System\TUSrzKk.exe
  C:\Windows\System\TUSrzKk.exe
  2⤵
  PID:7784
- C:\Windows\System\brVYmTe.exe
  C:\Windows\System\brVYmTe.exe
  2⤵
  PID:8344
- C:\Windows\System\NeKjzEF.exe
  C:\Windows\System\NeKjzEF.exe
  2⤵
  PID:8412
- C:\Windows\System\QYmpXKU.exe
  C:\Windows\System\QYmpXKU.exe
  2⤵
  PID:7984
- C:\Windows\System\WAosQTA.exe
  C:\Windows\System\WAosQTA.exe
  2⤵
  PID:8564
- C:\Windows\System\vCArOeR.exe
  C:\Windows\System\vCArOeR.exe
  2⤵
  PID:8660
- C:\Windows\System\QByTJJn.exe
  C:\Windows\System\QByTJJn.exe
  2⤵
  PID:8960
- C:\Windows\System\uUppOLw.exe
  C:\Windows\System\uUppOLw.exe
  2⤵
  PID:2836
- C:\Windows\System\jXstTSg.exe
  C:\Windows\System\jXstTSg.exe
  2⤵
  PID:6188
- C:\Windows\System\deQjNwe.exe
  C:\Windows\System\deQjNwe.exe
  2⤵
  PID:6456
- C:\Windows\System\AeqJOAc.exe
  C:\Windows\System\AeqJOAc.exe
  2⤵
  PID:10244
- C:\Windows\System\YawAdzp.exe
  C:\Windows\System\YawAdzp.exe
  2⤵
  PID:10268
- C:\Windows\System\VTEQarj.exe
  C:\Windows\System\VTEQarj.exe
  2⤵
  PID:10288
- C:\Windows\System\vEOpGRk.exe
  C:\Windows\System\vEOpGRk.exe
  2⤵
  PID:10312
- C:\Windows\System\KsIsilW.exe
  C:\Windows\System\KsIsilW.exe
  2⤵
  PID:10332
- C:\Windows\System\cxhUsPj.exe
  C:\Windows\System\cxhUsPj.exe
  2⤵
  PID:10352
- C:\Windows\System\KAFHLfg.exe
  C:\Windows\System\KAFHLfg.exe
  2⤵
  PID:10372
- C:\Windows\System\JAFbPQF.exe
  C:\Windows\System\JAFbPQF.exe
  2⤵
  PID:10392
- C:\Windows\System\ZeIPzKw.exe
  C:\Windows\System\ZeIPzKw.exe
  2⤵
  PID:10420
- C:\Windows\System\KbNznZD.exe
  C:\Windows\System\KbNznZD.exe
  2⤵
  PID:10440
- C:\Windows\System\CWkmNBG.exe
  C:\Windows\System\CWkmNBG.exe
  2⤵
  PID:10460
- C:\Windows\System\SnpvvJK.exe
  C:\Windows\System\SnpvvJK.exe
  2⤵
  PID:10480
- C:\Windows\System\YoIeaNK.exe
  C:\Windows\System\YoIeaNK.exe
  2⤵
  PID:10504
- C:\Windows\System\RvIssma.exe
  C:\Windows\System\RvIssma.exe
  2⤵
  PID:10528
- C:\Windows\System\LjcWykF.exe
  C:\Windows\System\LjcWykF.exe
  2⤵
  PID:10552
- C:\Windows\System\zQmhctP.exe
  C:\Windows\System\zQmhctP.exe
  2⤵
  PID:10572
- C:\Windows\System\bqMvqWU.exe
  C:\Windows\System\bqMvqWU.exe
  2⤵
  PID:10600
- C:\Windows\System\qAbzFfz.exe
  C:\Windows\System\qAbzFfz.exe
  2⤵
  PID:10620
- C:\Windows\System\dzdOvvo.exe
  C:\Windows\System\dzdOvvo.exe
  2⤵
  PID:10640
- C:\Windows\System\mUveoog.exe
  C:\Windows\System\mUveoog.exe
  2⤵
  PID:10664
- C:\Windows\System\MZLeVBX.exe
  C:\Windows\System\MZLeVBX.exe
  2⤵
  PID:10688
- C:\Windows\System\PPpeYId.exe
  C:\Windows\System\PPpeYId.exe
  2⤵
  PID:10708
- C:\Windows\System\zWOQipr.exe
  C:\Windows\System\zWOQipr.exe
  2⤵
  PID:10728
- C:\Windows\System\ivAaVsm.exe
  C:\Windows\System\ivAaVsm.exe
  2⤵
  PID:10748
- C:\Windows\System\wRwLzQT.exe
  C:\Windows\System\wRwLzQT.exe
  2⤵
  PID:10764
- C:\Windows\System\mjQVZbK.exe
  C:\Windows\System\mjQVZbK.exe
  2⤵
  PID:10780
- C:\Windows\System\HgwttVy.exe
  C:\Windows\System\HgwttVy.exe
  2⤵
  PID:10796
- C:\Windows\System\frJgfAa.exe
  C:\Windows\System\frJgfAa.exe
  2⤵
  PID:10812
- C:\Windows\System\cyHWMwm.exe
  C:\Windows\System\cyHWMwm.exe
  2⤵
  PID:10832
- C:\Windows\System\amRoHLQ.exe
  C:\Windows\System\amRoHLQ.exe
  2⤵
  PID:10856
- C:\Windows\System\CnEyubS.exe
  C:\Windows\System\CnEyubS.exe
  2⤵
  PID:10884
- C:\Windows\System\oPBRDvY.exe
  C:\Windows\System\oPBRDvY.exe
  2⤵
  PID:10904
- C:\Windows\System\JeKUzCK.exe
  C:\Windows\System\JeKUzCK.exe
  2⤵
  PID:10924
- C:\Windows\System\OfbaIKD.exe
  C:\Windows\System\OfbaIKD.exe
  2⤵
  PID:10944
- C:\Windows\System\YASDYWk.exe
  C:\Windows\System\YASDYWk.exe
  2⤵
  PID:10964
- C:\Windows\System\Wjaavsy.exe
  C:\Windows\System\Wjaavsy.exe
  2⤵
  PID:10984
- C:\Windows\System\HNxQgfw.exe
  C:\Windows\System\HNxQgfw.exe
  2⤵
  PID:11004
- C:\Windows\System\RaEcFYu.exe
  C:\Windows\System\RaEcFYu.exe
  2⤵
  PID:11024
- C:\Windows\System\sIYspKo.exe
  C:\Windows\System\sIYspKo.exe
  2⤵
  PID:11044
- C:\Windows\System\ZWuMiOk.exe
  C:\Windows\System\ZWuMiOk.exe
  2⤵
  PID:11068
- C:\Windows\System\wQOelQc.exe
  C:\Windows\System\wQOelQc.exe
  2⤵
  PID:11096
- C:\Windows\System\ikIkVLD.exe
  C:\Windows\System\ikIkVLD.exe
  2⤵
  PID:11112
- C:\Windows\System\ONNDsXV.exe
  C:\Windows\System\ONNDsXV.exe
  2⤵
  PID:11136
- C:\Windows\System\pMoIaea.exe
  C:\Windows\System\pMoIaea.exe
  2⤵
  PID:11164
- C:\Windows\System\wgRDJBa.exe
  C:\Windows\System\wgRDJBa.exe
  2⤵
  PID:11188
- C:\Windows\System\NJKwtpK.exe
  C:\Windows\System\NJKwtpK.exe
  2⤵
  PID:11204
- C:\Windows\System\FQLXkgP.exe
  C:\Windows\System\FQLXkgP.exe
  2⤵
  PID:11224
- C:\Windows\System\XVZVCPw.exe
  C:\Windows\System\XVZVCPw.exe
  2⤵
  PID:11244
- C:\Windows\System\KusbtWL.exe
  C:\Windows\System\KusbtWL.exe
  2⤵
  PID:9264
- C:\Windows\System\ycXXFnm.exe
  C:\Windows\System\ycXXFnm.exe
  2⤵
  PID:9380
- C:\Windows\System\mgWFDTN.exe
  C:\Windows\System\mgWFDTN.exe
  2⤵
  PID:9448
- C:\Windows\System\KozvWvb.exe
  C:\Windows\System\KozvWvb.exe
  2⤵
  PID:5640
- C:\Windows\System\vIZTcQL.exe
  C:\Windows\System\vIZTcQL.exe
  2⤵
  PID:6536
- C:\Windows\System\nUYEPvS.exe
  C:\Windows\System\nUYEPvS.exe
  2⤵
  PID:7960
- C:\Windows\System\ZkkqLOs.exe
  C:\Windows\System\ZkkqLOs.exe
  2⤵
  PID:9636
- C:\Windows\System\otxzNDl.exe
  C:\Windows\System\otxzNDl.exe
  2⤵
  PID:7440
- C:\Windows\System\pZsgXNg.exe
  C:\Windows\System\pZsgXNg.exe
  2⤵
  PID:9768
- C:\Windows\System\vRfHHtX.exe
  C:\Windows\System\vRfHHtX.exe
  2⤵
  PID:9780
- C:\Windows\System\XjyanFQ.exe
  C:\Windows\System\XjyanFQ.exe
  2⤵
  PID:9840
- C:\Windows\System\uSymNdK.exe
  C:\Windows\System\uSymNdK.exe
  2⤵
  PID:9884
- C:\Windows\System\IHyoSEW.exe
  C:\Windows\System\IHyoSEW.exe
  2⤵
  PID:8424
- C:\Windows\System\LwgsSRe.exe
  C:\Windows\System\LwgsSRe.exe
  2⤵
  PID:9992
- C:\Windows\System\pSDrVLy.exe
  C:\Windows\System\pSDrVLy.exe
  2⤵
  PID:8532
- C:\Windows\System\XmXTsBG.exe
  C:\Windows\System\XmXTsBG.exe
  2⤵
  PID:8540
- C:\Windows\System\xRgMjUF.exe
  C:\Windows\System\xRgMjUF.exe
  2⤵
  PID:8620
- C:\Windows\System\HzyXgLD.exe
  C:\Windows\System\HzyXgLD.exe
  2⤵
  PID:8700
- C:\Windows\System\ktGXqly.exe
  C:\Windows\System\ktGXqly.exe
  2⤵
  PID:10132
- C:\Windows\System\XFnUJjI.exe
  C:\Windows\System\XFnUJjI.exe
  2⤵
  PID:8844
- C:\Windows\System\gmHVgBF.exe
  C:\Windows\System\gmHVgBF.exe
  2⤵
  PID:8876
- C:\Windows\System\fuyqZIL.exe
  C:\Windows\System\fuyqZIL.exe
  2⤵
  PID:8920
- C:\Windows\System\hLuBeVq.exe
  C:\Windows\System\hLuBeVq.exe
  2⤵
  PID:7552
- C:\Windows\System\ZnGZADI.exe
  C:\Windows\System\ZnGZADI.exe
  2⤵
  PID:5212
- C:\Windows\System\BcNkqQU.exe
  C:\Windows\System\BcNkqQU.exe
  2⤵
  PID:7312
- C:\Windows\System\eqiNXHN.exe
  C:\Windows\System\eqiNXHN.exe
  2⤵
  PID:8984
- C:\Windows\System\jZFJbhH.exe
  C:\Windows\System\jZFJbhH.exe
  2⤵
  PID:9072
- C:\Windows\System\vzxjkgu.exe
  C:\Windows\System\vzxjkgu.exe
  2⤵
  PID:8176
- C:\Windows\System\uKWIhMZ.exe
  C:\Windows\System\uKWIhMZ.exe
  2⤵
  PID:5692
- C:\Windows\System\BuSXbrt.exe
  C:\Windows\System\BuSXbrt.exe
  2⤵
  PID:4388
- C:\Windows\System\CdLgwIh.exe
  C:\Windows\System\CdLgwIh.exe
  2⤵
  PID:5788
- C:\Windows\System\lvTWRyX.exe
  C:\Windows\System\lvTWRyX.exe
  2⤵
  PID:5824
- C:\Windows\System\sPQphEt.exe
  C:\Windows\System\sPQphEt.exe
  2⤵
  PID:11280
- C:\Windows\System\WesNslq.exe
  C:\Windows\System\WesNslq.exe
  2⤵
  PID:11300
- C:\Windows\System\dZbiDpp.exe
  C:\Windows\System\dZbiDpp.exe
  2⤵
  PID:11328
- C:\Windows\System\qVisCUF.exe
  C:\Windows\System\qVisCUF.exe
  2⤵
  PID:11372
- C:\Windows\System\bpTDrNh.exe
  C:\Windows\System\bpTDrNh.exe
  2⤵
  PID:11396
- C:\Windows\System\dazMXHa.exe
  C:\Windows\System\dazMXHa.exe
  2⤵
  PID:11416
- C:\Windows\System\YAxzOsg.exe
  C:\Windows\System\YAxzOsg.exe
  2⤵
  PID:11436
- C:\Windows\System\sjdKyLn.exe
  C:\Windows\System\sjdKyLn.exe
  2⤵
  PID:11452
- C:\Windows\System\zhdSTvT.exe
  C:\Windows\System\zhdSTvT.exe
  2⤵
  PID:11476
- C:\Windows\System\GPrCDuF.exe
  C:\Windows\System\GPrCDuF.exe
  2⤵
  PID:11500
- C:\Windows\System\mshuHDb.exe
  C:\Windows\System\mshuHDb.exe
  2⤵
  PID:11532
- C:\Windows\System\agvXrCE.exe
  C:\Windows\System\agvXrCE.exe
  2⤵
  PID:11548
- C:\Windows\System\feTTiGW.exe
  C:\Windows\System\feTTiGW.exe
  2⤵
  PID:11564
- C:\Windows\System\RqPtWrK.exe
  C:\Windows\System\RqPtWrK.exe
  2⤵
  PID:11580
- C:\Windows\System\UetmnID.exe
  C:\Windows\System\UetmnID.exe
  2⤵
  PID:11596
- C:\Windows\System\BgbceOT.exe
  C:\Windows\System\BgbceOT.exe
  2⤵
  PID:11612
- C:\Windows\System\OUhcueZ.exe
  C:\Windows\System\OUhcueZ.exe
  2⤵
  PID:11632
- C:\Windows\System\NJKIMAO.exe
  C:\Windows\System\NJKIMAO.exe
  2⤵
  PID:11660
- C:\Windows\System\PAObujp.exe
  C:\Windows\System\PAObujp.exe
  2⤵
  PID:11680
- C:\Windows\System\MXpUZLS.exe
  C:\Windows\System\MXpUZLS.exe
  2⤵
  PID:11704
- C:\Windows\System\TuTPxAW.exe
  C:\Windows\System\TuTPxAW.exe
  2⤵
  PID:11732
- C:\Windows\System\ldLHUct.exe
  C:\Windows\System\ldLHUct.exe
  2⤵
  PID:11752
- C:\Windows\System\HkBtYnq.exe
  C:\Windows\System\HkBtYnq.exe
  2⤵
  PID:11772
- C:\Windows\System\qUQLRIl.exe
  C:\Windows\System\qUQLRIl.exe
  2⤵
  PID:11792
- C:\Windows\System\mjBlMLV.exe
  C:\Windows\System\mjBlMLV.exe
  2⤵
  PID:11816
- C:\Windows\System\oTDBkNU.exe
  C:\Windows\System\oTDBkNU.exe
  2⤵
  PID:11844
- C:\Windows\System\ZQIgpdb.exe
  C:\Windows\System\ZQIgpdb.exe
  2⤵
  PID:11864
- C:\Windows\System\eSTUYob.exe
  C:\Windows\System\eSTUYob.exe
  2⤵
  PID:11888
- C:\Windows\System\GrvVAGe.exe
  C:\Windows\System\GrvVAGe.exe
  2⤵
  PID:11912
- C:\Windows\System\FhYCbIx.exe
  C:\Windows\System\FhYCbIx.exe
  2⤵
  PID:11936
- C:\Windows\System\iNsSdYO.exe
  C:\Windows\System\iNsSdYO.exe
  2⤵
  PID:11956
- C:\Windows\System\YNlgkFB.exe
  C:\Windows\System\YNlgkFB.exe
  2⤵
  PID:11976
- C:\Windows\System\HKJiGwO.exe
  C:\Windows\System\HKJiGwO.exe
  2⤵
  PID:12004
- C:\Windows\System\ZAYtQgb.exe
  C:\Windows\System\ZAYtQgb.exe
  2⤵
  PID:12028
- C:\Windows\System\zoxuMhE.exe
  C:\Windows\System\zoxuMhE.exe
  2⤵
  PID:12052
- C:\Windows\System\AxErezA.exe
  C:\Windows\System\AxErezA.exe
  2⤵
  PID:12080
- C:\Windows\System\UIHuZcE.exe
  C:\Windows\System\UIHuZcE.exe
  2⤵
  PID:12100
- C:\Windows\System\FhAKAVN.exe
  C:\Windows\System\FhAKAVN.exe
  2⤵
  PID:12128
- C:\Windows\System\aUfxjra.exe
  C:\Windows\System\aUfxjra.exe
  2⤵
  PID:12148
- C:\Windows\System\KjmPLSI.exe
  C:\Windows\System\KjmPLSI.exe
  2⤵
  PID:12172
- C:\Windows\System\mxxtOWk.exe
  C:\Windows\System\mxxtOWk.exe
  2⤵
  PID:12196
- C:\Windows\System\tVIZQgB.exe
  C:\Windows\System\tVIZQgB.exe
  2⤵
  PID:12216
- C:\Windows\System\FcSpxZx.exe
  C:\Windows\System\FcSpxZx.exe
  2⤵
  PID:12244
- C:\Windows\System\ctZsSRF.exe
  C:\Windows\System\ctZsSRF.exe
  2⤵
  PID:12264
- C:\Windows\System\zNTsoID.exe
  C:\Windows\System\zNTsoID.exe
  2⤵
  PID:12280
- C:\Windows\System\kAaspFE.exe
  C:\Windows\System\kAaspFE.exe
  2⤵
  PID:7112
- C:\Windows\System\pIyVAka.exe
  C:\Windows\System\pIyVAka.exe
  2⤵
  PID:5912
- C:\Windows\System\SbQtttF.exe
  C:\Windows\System\SbQtttF.exe
  2⤵
  PID:6320
- C:\Windows\System\kddEDju.exe
  C:\Windows\System\kddEDju.exe
  2⤵
  PID:6092
- C:\Windows\System\taZFEID.exe
  C:\Windows\System\taZFEID.exe
  2⤵
  PID:4740
- C:\Windows\System\UnXrpZp.exe
  C:\Windows\System\UnXrpZp.exe
  2⤵
  PID:7084
- C:\Windows\System\DtkUOmv.exe
  C:\Windows\System\DtkUOmv.exe
  2⤵
  PID:6516
- C:\Windows\System\QKntrCv.exe
  C:\Windows\System\QKntrCv.exe
  2⤵
  PID:6636
- C:\Windows\System\PsaJeoQ.exe
  C:\Windows\System\PsaJeoQ.exe
  2⤵
  PID:6780
- C:\Windows\System\icUamoB.exe
  C:\Windows\System\icUamoB.exe
  2⤵
  PID:4416
- C:\Windows\System\TrRJEVL.exe
  C:\Windows\System\TrRJEVL.exe
  2⤵
  PID:9280
- C:\Windows\System\PgEWQIx.exe
  C:\Windows\System\PgEWQIx.exe
  2⤵
  PID:6856
- C:\Windows\System\yBPLYqp.exe
  C:\Windows\System\yBPLYqp.exe
  2⤵
  PID:9320
- C:\Windows\System\xkbdYRJ.exe
  C:\Windows\System\xkbdYRJ.exe
  2⤵
  PID:10452
- C:\Windows\System\INouWdp.exe
  C:\Windows\System\INouWdp.exe
  2⤵
  PID:10456
- C:\Windows\System\ULLycYy.exe
  C:\Windows\System\ULLycYy.exe
  2⤵
  PID:10584
- C:\Windows\System\DODwNrQ.exe
  C:\Windows\System\DODwNrQ.exe
  2⤵
  PID:10660
- C:\Windows\System\MiWGPFb.exe
  C:\Windows\System\MiWGPFb.exe
  2⤵
  PID:10808
- C:\Windows\System\ADbQWpE.exe
  C:\Windows\System\ADbQWpE.exe
  2⤵
  PID:9540
- C:\Windows\System\BpHpHte.exe
  C:\Windows\System\BpHpHte.exe
  2⤵
  PID:9576
- C:\Windows\System\JXWCroM.exe
  C:\Windows\System\JXWCroM.exe
  2⤵
  PID:10936
- C:\Windows\System\LMcwOyn.exe
  C:\Windows\System\LMcwOyn.exe
  2⤵
  PID:11016
- C:\Windows\System\dCVZlEA.exe
  C:\Windows\System\dCVZlEA.exe
  2⤵
  PID:11104
- C:\Windows\System\WsqjGFh.exe
  C:\Windows\System\WsqjGFh.exe
  2⤵
  PID:12312
- C:\Windows\System\YSkneNv.exe
  C:\Windows\System\YSkneNv.exe
  2⤵
  PID:12336
- C:\Windows\System\xkrNDjA.exe
  C:\Windows\System\xkrNDjA.exe
  2⤵
  PID:12352
- C:\Windows\System\jDMLqqc.exe
  C:\Windows\System\jDMLqqc.exe
  2⤵
  PID:12372
- C:\Windows\System\SFYiKRO.exe
  C:\Windows\System\SFYiKRO.exe
  2⤵
  PID:12396
- C:\Windows\System\eKmSOqB.exe
  C:\Windows\System\eKmSOqB.exe
  2⤵
  PID:12420
- C:\Windows\System\jpQwNlA.exe
  C:\Windows\System\jpQwNlA.exe
  2⤵
  PID:12444
- C:\Windows\System\IlqBYAs.exe
  C:\Windows\System\IlqBYAs.exe
  2⤵
  PID:12468
- C:\Windows\System\akYMsIx.exe
  C:\Windows\System\akYMsIx.exe
  2⤵
  PID:12496
- C:\Windows\System\FTgwRIE.exe
  C:\Windows\System\FTgwRIE.exe
  2⤵
  PID:12516
- C:\Windows\System\yjKuISy.exe
  C:\Windows\System\yjKuISy.exe
  2⤵
  PID:12540
- C:\Windows\System\qtHtTXT.exe
  C:\Windows\System\qtHtTXT.exe
  2⤵
  PID:12564
- C:\Windows\System\BiXljfo.exe
  C:\Windows\System\BiXljfo.exe
  2⤵
  PID:12584
- C:\Windows\System\PRoGEAr.exe
  C:\Windows\System\PRoGEAr.exe
  2⤵
  PID:12608
- C:\Windows\System\wFnUfvy.exe
  C:\Windows\System\wFnUfvy.exe
  2⤵
  PID:12628
- C:\Windows\System\YKwpFSP.exe
  C:\Windows\System\YKwpFSP.exe
  2⤵
  PID:12652
- C:\Windows\System\pWMdGZf.exe
  C:\Windows\System\pWMdGZf.exe
  2⤵
  PID:12684
- C:\Windows\System\lBXkvrc.exe
  C:\Windows\System\lBXkvrc.exe
  2⤵
  PID:12700
- C:\Windows\System\guPfYYL.exe
  C:\Windows\System\guPfYYL.exe
  2⤵
  PID:12716
- C:\Windows\System\xuBDGdm.exe
  C:\Windows\System\xuBDGdm.exe
  2⤵
  PID:12732
- C:\Windows\System\OafmWUx.exe
  C:\Windows\System\OafmWUx.exe
  2⤵
  PID:12752
- C:\Windows\System\VkSpfYc.exe
  C:\Windows\System\VkSpfYc.exe
  2⤵
  PID:12768
- C:\Windows\System\yQZfCip.exe
  C:\Windows\System\yQZfCip.exe
  2⤵
  PID:12784
- C:\Windows\System\mCHLyHX.exe
  C:\Windows\System\mCHLyHX.exe
  2⤵
  PID:12804
- C:\Windows\System\oCcvkpA.exe
  C:\Windows\System\oCcvkpA.exe
  2⤵
  PID:12828
- C:\Windows\System\BdTRUJc.exe
  C:\Windows\System\BdTRUJc.exe
  2⤵
  PID:12852
- C:\Windows\System\RJNGvZY.exe
  C:\Windows\System\RJNGvZY.exe
  2⤵
  PID:12876
- C:\Windows\System\WpgJYKJ.exe
  C:\Windows\System\WpgJYKJ.exe
  2⤵
  PID:12896
- C:\Windows\System\ZGoaRcR.exe
  C:\Windows\System\ZGoaRcR.exe
  2⤵
  PID:12920
- C:\Windows\System\oWlWkKG.exe
  C:\Windows\System\oWlWkKG.exe
  2⤵
  PID:12944
- C:\Windows\System\pRrxdts.exe
  C:\Windows\System\pRrxdts.exe
  2⤵
  PID:12964
- C:\Windows\System\ckxKkfq.exe
  C:\Windows\System\ckxKkfq.exe
  2⤵
  PID:12984
- C:\Windows\System\UuIgfoj.exe
  C:\Windows\System\UuIgfoj.exe
  2⤵
  PID:13008
- C:\Windows\System\JDJygbg.exe
  C:\Windows\System\JDJygbg.exe
  2⤵
  PID:13036
- C:\Windows\System\DSeDlcq.exe
  C:\Windows\System\DSeDlcq.exe
  2⤵
  PID:13056
- C:\Windows\System\CZGJBrX.exe
  C:\Windows\System\CZGJBrX.exe
  2⤵
  PID:13080
- C:\Windows\System\QOPNVlv.exe
  C:\Windows\System\QOPNVlv.exe
  2⤵
  PID:13096
- C:\Windows\System\OztHKEp.exe
  C:\Windows\System\OztHKEp.exe
  2⤵
  PID:13116
- C:\Windows\System\gQbqrDu.exe
  C:\Windows\System\gQbqrDu.exe
  2⤵
  PID:13140
- C:\Windows\System\tXnOveS.exe
  C:\Windows\System\tXnOveS.exe
  2⤵
  PID:13164
- C:\Windows\System\pJflbMz.exe
  C:\Windows\System\pJflbMz.exe
  2⤵
  PID:13184
- C:\Windows\System\DFSCDke.exe
  C:\Windows\System\DFSCDke.exe
  2⤵
  PID:9964
- C:\Windows\System\oIVesff.exe
  C:\Windows\System\oIVesff.exe
  2⤵
  PID:7528
- C:\Windows\System\qtMpSQd.exe
  C:\Windows\System\qtMpSQd.exe
  2⤵
  PID:8312
- C:\Windows\System\jKwymMr.exe
  C:\Windows\System\jKwymMr.exe
  2⤵
  PID:9120
- C:\Windows\System\CwvzNKG.exe
  C:\Windows\System\CwvzNKG.exe
  2⤵
  PID:9056
- C:\Windows\System\tSWZAEc.exe
  C:\Windows\System\tSWZAEc.exe
  2⤵
  PID:7872
- C:\Windows\System\JHYToiM.exe
  C:\Windows\System\JHYToiM.exe
  2⤵
  PID:11272
- C:\Windows\System\AhqJDMS.exe
  C:\Windows\System\AhqJDMS.exe
  2⤵
  PID:11296
- C:\Windows\System\UajaGad.exe
  C:\Windows\System\UajaGad.exe
  2⤵
  PID:11340
- C:\Windows\System\LrOfrbb.exe
  C:\Windows\System\LrOfrbb.exe
  2⤵
  PID:10252
- C:\Windows\System\SYfKbRK.exe
  C:\Windows\System\SYfKbRK.exe
  2⤵
  PID:11644
- C:\Windows\System\drJuRTl.exe
  C:\Windows\System\drJuRTl.exe
  2⤵
  PID:10324
- C:\Windows\System\dZYlWVQ.exe
  C:\Windows\System\dZYlWVQ.exe
  2⤵
  PID:12036
- C:\Windows\System\loDaIDL.exe
  C:\Windows\System\loDaIDL.exe
  2⤵
  PID:12068
- C:\Windows\System\ofzpAqu.exe
  C:\Windows\System\ofzpAqu.exe
  2⤵
  PID:12120
- C:\Windows\System\FPpTBEZ.exe
  C:\Windows\System\FPpTBEZ.exe
  2⤵
  PID:10568
- C:\Windows\System\CexKOKH.exe
  C:\Windows\System\CexKOKH.exe
  2⤵
  PID:10648
- C:\Windows\System\VZlnzeE.exe
  C:\Windows\System\VZlnzeE.exe
  2⤵
  PID:12224
- C:\Windows\System\ZXhcVEV.exe
  C:\Windows\System\ZXhcVEV.exe
  2⤵
  PID:12252
- C:\Windows\System\IobGgJb.exe
  C:\Windows\System\IobGgJb.exe
  2⤵
  PID:10804
- C:\Windows\System\nqjToMc.exe
  C:\Windows\System\nqjToMc.exe
  2⤵
  PID:10844
- C:\Windows\System\ZkWfMSA.exe
  C:\Windows\System\ZkWfMSA.exe
  2⤵
  PID:6164
- C:\Windows\System\gwEuusV.exe
  C:\Windows\System\gwEuusV.exe
  2⤵
  PID:13328
- C:\Windows\System\cCtTbej.exe
  C:\Windows\System\cCtTbej.exe
  2⤵
  PID:13352
- C:\Windows\System\JKvXvqs.exe
  C:\Windows\System\JKvXvqs.exe
  2⤵
  PID:13372
- C:\Windows\System\EAqTxzx.exe
  C:\Windows\System\EAqTxzx.exe
  2⤵
  PID:13404
- C:\Windows\System\TUJWAqB.exe
  C:\Windows\System\TUJWAqB.exe
  2⤵
  PID:13420
- C:\Windows\System\TKxEcFm.exe
  C:\Windows\System\TKxEcFm.exe
  2⤵
  PID:13436
- C:\Windows\System\xXhyvmg.exe
  C:\Windows\System\xXhyvmg.exe
  2⤵
  PID:13452
- C:\Windows\System\NWVkqsp.exe
  C:\Windows\System\NWVkqsp.exe
  2⤵
  PID:13468
- C:\Windows\System\oQwrWrL.exe
  C:\Windows\System\oQwrWrL.exe
  2⤵
  PID:13484
- C:\Windows\System\sCBIEGZ.exe
  C:\Windows\System\sCBIEGZ.exe
  2⤵
  PID:13500
- C:\Windows\System\WojZWVb.exe
  C:\Windows\System\WojZWVb.exe
  2⤵
  PID:13520
- C:\Windows\System\fXDBTtT.exe
  C:\Windows\System\fXDBTtT.exe
  2⤵
  PID:13540
- C:\Windows\System\hmyfETr.exe
  C:\Windows\System\hmyfETr.exe
  2⤵
  PID:13560
- C:\Windows\System\tdXTgIv.exe
  C:\Windows\System\tdXTgIv.exe
  2⤵
  PID:13584
- C:\Windows\System\zYzgSoL.exe
  C:\Windows\System\zYzgSoL.exe
  2⤵
  PID:13608
- C:\Windows\System\WnfTLNT.exe
  C:\Windows\System\WnfTLNT.exe
  2⤵
  PID:13628
- C:\Windows\System\IPiGlGz.exe
  C:\Windows\System\IPiGlGz.exe
  2⤵
  PID:13652
- C:\Windows\System\iIqjdDV.exe
  C:\Windows\System\iIqjdDV.exe
  2⤵
  PID:13672
- C:\Windows\System\zlqushr.exe
  C:\Windows\System\zlqushr.exe
  2⤵
  PID:13700
- C:\Windows\System\JXlcGWC.exe
  C:\Windows\System\JXlcGWC.exe
  2⤵
  PID:13716
- C:\Windows\System\cBTKHUH.exe
  C:\Windows\System\cBTKHUH.exe
  2⤵
  PID:13740
- C:\Windows\System\vDHAHAC.exe
  C:\Windows\System\vDHAHAC.exe
  2⤵
  PID:13768
- C:\Windows\System\GstQsfJ.exe
  C:\Windows\System\GstQsfJ.exe
  2⤵
  PID:13788
- C:\Windows\System\wtpzptf.exe
  C:\Windows\System\wtpzptf.exe
  2⤵
  PID:13816
- C:\Windows\System\uYmWJeZ.exe
  C:\Windows\System\uYmWJeZ.exe
  2⤵
  PID:13836
- C:\Windows\System\YLaAWvA.exe
  C:\Windows\System\YLaAWvA.exe
  2⤵
  PID:13856
- C:\Windows\System\fmESdaj.exe
  C:\Windows\System\fmESdaj.exe
  2⤵
  PID:13880
- C:\Windows\System\MEqVKXL.exe
  C:\Windows\System\MEqVKXL.exe
  2⤵
  PID:13908
- C:\Windows\System\RSFIXaa.exe
  C:\Windows\System\RSFIXaa.exe
  2⤵
  PID:13924
- C:\Windows\System\YbCkvPQ.exe
  C:\Windows\System\YbCkvPQ.exe
  2⤵
  PID:13944
- C:\Windows\System\VfvTNcL.exe
  C:\Windows\System\VfvTNcL.exe
  2⤵
  PID:13968
- C:\Windows\System\ITiRpET.exe
  C:\Windows\System\ITiRpET.exe
  2⤵
  PID:14000
- C:\Windows\System\AyVJfwK.exe
  C:\Windows\System\AyVJfwK.exe
  2⤵
  PID:14024
- C:\Windows\System\jbWSStc.exe
  C:\Windows\System\jbWSStc.exe
  2⤵
  PID:14048
- C:\Windows\System\OSVTPXH.exe
  C:\Windows\System\OSVTPXH.exe
  2⤵
  PID:14068
- C:\Windows\System\KCdRcmZ.exe
  C:\Windows\System\KCdRcmZ.exe
  2⤵
  PID:14088
- C:\Windows\System\LIEVNDO.exe
  C:\Windows\System\LIEVNDO.exe
  2⤵
  PID:14112
- C:\Windows\System\TTIiraf.exe
  C:\Windows\System\TTIiraf.exe
  2⤵
  PID:14136
- C:\Windows\System\yUSBhkH.exe
  C:\Windows\System\yUSBhkH.exe
  2⤵
  PID:14164
- C:\Windows\System\wyPlHUf.exe
  C:\Windows\System\wyPlHUf.exe
  2⤵
  PID:14192
- C:\Windows\System\eXKcmQy.exe
  C:\Windows\System\eXKcmQy.exe
  2⤵
  PID:14220
- C:\Windows\System\yXItcRI.exe
  C:\Windows\System\yXItcRI.exe
  2⤵
  PID:14244
- C:\Windows\System\HjIlxWt.exe
  C:\Windows\System\HjIlxWt.exe
  2⤵
  PID:14268
- C:\Windows\System\njczdRT.exe
  C:\Windows\System\njczdRT.exe
  2⤵
  PID:14288
- C:\Windows\System\jLBWKRd.exe
  C:\Windows\System\jLBWKRd.exe
  2⤵
  PID:14316
- C:\Windows\System\rPNFIjk.exe
  C:\Windows\System\rPNFIjk.exe
  2⤵
  PID:10896
- C:\Windows\System\yICNvkq.exe
  C:\Windows\System\yICNvkq.exe
  2⤵
  PID:6436
- C:\Windows\System\LWTxVeA.exe
  C:\Windows\System\LWTxVeA.exe
  2⤵
  PID:10344
- C:\Windows\System\bUNSPyC.exe
  C:\Windows\System\bUNSPyC.exe
  2⤵
  PID:6988
- C:\Windows\System\nHWZJOQ.exe
  C:\Windows\System\nHWZJOQ.exe
  2⤵
  PID:9340
- C:\Windows\System\iALJdvC.exe
  C:\Windows\System\iALJdvC.exe
  2⤵
  PID:9692
- C:\Windows\System\bpYwZUj.exe
  C:\Windows\System\bpYwZUj.exe
  2⤵
  PID:10536
- C:\Windows\System\WGqJhUV.exe
  C:\Windows\System\WGqJhUV.exe
  2⤵
  PID:9444
- C:\Windows\System\ogYPCgO.exe
  C:\Windows\System\ogYPCgO.exe
  2⤵
  PID:11128
- C:\Windows\System\vdmCNkM.exe
  C:\Windows\System\vdmCNkM.exe
  2⤵
  PID:11212
- C:\Windows\System\NlehzIJ.exe
  C:\Windows\System\NlehzIJ.exe
  2⤵
  PID:12620
- C:\Windows\System\IPnMILp.exe
  C:\Windows\System\IPnMILp.exe
  2⤵
  PID:9352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

APEDrnG.exe

Path C:\Windows\System\APEDrnG.exe
Size 1.5MB
SHA256 66737e865255e4cb560e2041e62c149e2b45a7ab67326b5a9fd37adf26dc827e
MD5 81b0f5b9f81ba3aa0652cd200866abef
SHA1 3af5528e6b7da47a621c17c22e9c74bb6e998cd8
SHA512 5b0df0a9af003cbeb133b8cfcb181382fe0b3fdb2e25f7c951b9305b30e52674e005caad42352ca21a17b78f365d18736cac4028c55f59fd1728b8e70bf0d433
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYC:ROdWCCi7/rahHxJTFlt2O+2BWZC
MD5 SHA1 SHA512 SSDEEP

Submit Download

CqqUiLU.exe

Path C:\Windows\System\CqqUiLU.exe
Size 1.5MB
SHA256 0f03e6b5a5a1173e11a4ce1d10430f20937638ccc173821425f4dad0f177a46c
MD5 78a07be5145794d6c75365908d9ae25e
SHA1 27d5eba0f7f542aca0d433bfabe5c5658b64d1dd
SHA512 7ce5519d1bba71e36aaf74cd0c34d40ad18683f5c629caa3918f69d1d458a26558dd0d1747a375c971526afba29de33760986ce9d54b671796a64a5ff8fb5861
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY4:ROdWCCi7/rahHxJTFlt2O+2BWZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

DBqBpFQ.exe

Path C:\Windows\System\DBqBpFQ.exe
Size 1.5MB
SHA256 a9c3f0dd67a99cee03021f1ffbfb077b15c162d8908a23466a2505ada43bf219
MD5 b9d48c938725843363eea89eacf54272
SHA1 af413520605a6aeb28a7ffb53f58a8b52e575b60
SHA512 1a5b6a252014fab21cfc8fe0e52a4f53afda2f7d99144af5b2664f33f21c278a432495ac1edec22d4a6c5e73c350ba5e3804a9efc151084d1379d8b4585ea4e3
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYY:ROdWCCi7/rahHxJTFlt2O+2BWZQl
MD5 SHA1 SHA512 SSDEEP

Submit Download

EYUgHsk.exe

Path C:\Windows\System\EYUgHsk.exe
Size 1.5MB
SHA256 e3ae0b7e48020de2c5f7b42aa1309adae4fe798d6a0a748d19ac9bd4d1b09ec4
MD5 21bf9ed3b3c2263cc68a27835fb21bbb
SHA1 7c4d93f73a05b71b761200f00b4f202ff2a2f927
SHA512 4c46728145db8310847149251c64fc4e34135991ef9cebeac65e1fc2d612393358e3109cbc8afb41aba8420adf6f34011d11b19d178dd7b49180a14a3982409a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYe:ROdWCCi7/rahHxJTFlt2O+2BWZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

FjcHMnP.exe

Path C:\Windows\System\FjcHMnP.exe
Size 1.5MB
SHA256 fae4f6d41378d27660e9676b82519125b758bbb9d2fa4b09cfe09b8a986c17d0
MD5 ba628db4c32d7597d732b4a37de146e3
SHA1 f01ad1162158b6d8d4b7f120223be3ed5c35cb57
SHA512 a8890399dd9f2886a7ad7abb912071db240bc903d1ee3a452c090dc917df9ea4501291d37def573fc9d6ad1b6b71edd1f4fdfcf5978b8c0462b2b620c6d24ef3
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYG:ROdWCCi7/rahHxJTFlt2O+2BWZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

GEWEZkU.exe

Path C:\Windows\System\GEWEZkU.exe
Size 1.5MB
SHA256 44e552203c9991459a803e25c864aad49f4af5cd42cbaa456ef2b981027888a8
MD5 706baf0a877191a79be952ae8dfde3d4
SHA1 b7374a56ee39f0703befdc0660d8b0963f3d135b
SHA512 edf878109cc4207bd296ca703a99c2d2c3c476699f94d8596e673452e435da128da289a392cc2d35a5939f7364922844c7e9e9a9f3576529825cccf40d5d72c8
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY1:ROdWCCi7/rahHxJTFlt2O+2BWZEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

GWKrUeO.exe

Path C:\Windows\System\GWKrUeO.exe
Size 1.5MB
SHA256 5e03c22818e70f13be6117027f0e06622056bd076622b3c4ea48fe5aa4cf28d9
MD5 307d79021af767a6cba0a9dff8b0c79e
SHA1 c8ce1eccf25622f3b26f3334a6bee1e95809bbba
SHA512 dceb4f5acab4920cd9953e961ccb1c3bf3364b24ffe54c0ed5fd30020c136b2c1bc18afd9f5e274ae4f5a88f86109772980e3f313279c5f090a1632b51a91cc7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYC:ROdWCCi7/rahHxJTFlt2O+2BWZC
MD5 SHA1 SHA512 SSDEEP

Submit Download

GyxihyZ.exe

Path C:\Windows\System\GyxihyZ.exe
Size 1.5MB
SHA256 60f78d786e981ff5bad86f12ca296a74e21867fc2ab65b437a3e124f1b3bcea1
MD5 89ffb898df9ad53a0ab72d628b49277e
SHA1 004492ea5ef1c6f588f64f8cedfe788dc5e5ecfa
SHA512 f8e70563728e93c964828cb83c8d07350cbb92bf9286b849ce8a230512e1ef2e93819424d4435196ebf148be1e6b0cb380baa11cac1e356374be73041f866667
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY5:ROdWCCi7/rahHxJTFlt2O+2BWZ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

IWAqLMi.exe

Path C:\Windows\System\IWAqLMi.exe
Size 1.5MB
SHA256 b2a606f937d63987d94c4c15ddd2fce03c224cac62654dab074ae7e87c1e5ef4
MD5 91bfa893abaf72837f62bbd22e656c99
SHA1 ecfa83741a337817821052fb22d9d296e76e3481
SHA512 5bad1de2e5437673331b5cb423b07697be49c24c0b7fb6ef3fc0d15902aa8a16ecdd34a1ec87318f5ca62de2a2dd538017813b59a2df10489a7342f7b87f5f62
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY2:ROdWCCi7/rahHxJTFlt2O+2BWZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

JzhdZPM.exe

Path C:\Windows\System\JzhdZPM.exe
Size 1.5MB
SHA256 41f72de57b8c98ac901c552a14897d0dff4b0eb135bf5d9d17e5466f0397a57a
MD5 ab20eb1aeab42e805285f91fc65319ac
SHA1 6d94d31af267ca2f1fa197e9b0141104ffc1465b
SHA512 b7327bc59923f20289238f2e63422b96c7129000110725952c03c3c90cecc534eedb83879808dfa04de6d773ec496f90265bea8aeed06ce194618b6c747217bd
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYx:ROdWCCi7/rahHxJTFlt2O+2BWZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkxtafn.exe

Path C:\Windows\System\Lkxtafn.exe
Size 1.5MB
SHA256 2c85d674a7b67e3dfc93870c03965618810fa00d34c8b31866fb38c7312291bd
MD5 c6a9061e25a14fe2d2eeeb01a9205ff1
SHA1 043f63471dace89a25899002457eb5b33394c33a
SHA512 e318d98a74b8baf3e4bf0e18c8b62793e4a33329afd726d7205feaddae94d23e7ff49ba34b2353a7634fa7f05f8cb07ab1e3b32ffb85964fc655a4d8b3ffa9b5
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYh:ROdWCCi7/rahHxJTFlt2O+2BWZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

OMcGuKK.exe

Path C:\Windows\System\OMcGuKK.exe
Size 1.5MB
SHA256 f4f7403e729d6201df59033beeadea2e71be7401227959b2cd78777ba71a995f
MD5 b26b0b3f1ddf3a36d713e87f4a9a1cff
SHA1 032d65e50e08b5c8bf5b64069abbefe40473df0e
SHA512 e5e82a03fc197202e91a5125fb95d2d07b79eb759e05cc79acab07879b0abec0029a86c31d92ebec2664823ddc051afb01612c705b9929f27abb5f2996950a1b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYz:ROdWCCi7/rahHxJTFlt2O+2BWZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OavWYtx.exe

Path C:\Windows\System\OavWYtx.exe
Size 1.5MB
SHA256 0b2ec4ff4a5f5c3b3cdb928150cc51169b6177fbf7c623ecf5804883a072da36
MD5 917f0eb56c75e6498f288f06ef3be174
SHA1 841e682aa280ba47a982b968985821b0e6b63eac
SHA512 da5a01fc141bab27a28c9a68edb51193392d85c019ffccd0b69d8a6fe2c496bdc9b6f36e399a0526a71174b753585c90b34f966c2cad0fed7f9c473c2f714062
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYz:ROdWCCi7/rahHxJTFlt2O+2BWZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OtBcLaB.exe

Path C:\Windows\System\OtBcLaB.exe
Size 1.5MB
SHA256 97192547baa40b8b7b0a1fcf79fb84576de059af9cbc59ab7bd0be26cf92fbab
MD5 70a87629f4af96bdb4bb669ef6a23b86
SHA1 3a304995c6b414a7ea7d75bc4d87f7b4d68b44a7
SHA512 9003fd7a6d6f851421c2294fec006ac903cffc4d7d0fd48fe116c4322410c98641294fdb143e1d48198d845a0cda65fbe7851d944f52a8db344cd07a6d3a93b4
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYS:ROdWCCi7/rahHxJTFlt2O+2BWZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmugkto.exe

Path C:\Windows\System\Pmugkto.exe
Size 1.5MB
SHA256 a67e8a7e2e7d584c86d1391f2660e495eb3114fba20b4e16b8450612d1ab0118
MD5 10e1c2e84d386d338519a19a9f899f44
SHA1 a083a9c191726120dfc7205d361cebfa642a7822
SHA512 4f4d7c51141a84527bdca9f5471effe57490550f847d28a75773367315859c906f2ad3ced56af3a6db4ba01af74833d8c32cc16f512733cdf4e85a4134c138d1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYs:ROdWCCi7/rahHxJTFlt2O+2BWZs
MD5 SHA1 SHA512 SSDEEP

Submit Download

RHNKWxJ.exe

Path C:\Windows\System\RHNKWxJ.exe
Size 1.5MB
SHA256 caa1679f90790c27dc325f3b58916aa27374ef94aec6d225cf51d64f0ef1c5be
MD5 52c570ce1d9067f38ca6fafb121505bb
SHA1 2c375efa7acdc2e8b6b638e39aa1a21568ad8009
SHA512 41f8b68af27abe7f8beacf90cb5479cff9d0c1c549d598ccf0e3fb84ab977e5b76f6777656a1c85229ef45c5ada59c35066004d26ff7a566d0261085973247ef
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYp:ROdWCCi7/rahHxJTFlt2O+2BWZp
MD5 SHA1 SHA512 SSDEEP

Submit Download

RrqoKxE.exe

Path C:\Windows\System\RrqoKxE.exe
Size 1.5MB
SHA256 66ae28cbd1a59257ac50244d2900fc19735be59ecf1b7778fc81bc47aca8df3a
MD5 e1ff3c7701362a7a5f50cfb2a63b641d
SHA1 bab622fee5fefd1f648903b327df3d05de25016d
SHA512 c55240af76d798a772d4c94c07b14e52c561d0cf03e8637d51566d97e3b2c92cfa76c85976c51826eff68a5301549504ad77d86ceb20fc9881df3e70de9e8e0e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYt:ROdWCCi7/rahHxJTFlt2O+2BWZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TBhepMu.exe

Path C:\Windows\System\TBhepMu.exe
Size 1.5MB
SHA256 e280d89638c2baa0a95d21a7ae0c419c9c6de3c962d40b08dc47ffd6f6b794ce
MD5 ad8dc0d7132a71d662fe94d077453ad8
SHA1 86ffb407935ada779bc46175fc6a9293993d3ae3
SHA512 f2dcf7cae0c2d1094d3660e70352855ba4492abcaa4a017705800c6cbb4e78696ad8ea209e2e3fee658f79692fcb79029ad80c919a471d67759490046964a533
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYg:ROdWCCi7/rahHxJTFlt2O+2BWZg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyiHtiO.exe

Path C:\Windows\System\TyiHtiO.exe
Size 1.5MB
SHA256 b4a2463314eeb240a40bacc0f2df3aa650932dbcb6e6037bccac2dc567d10e5a
MD5 8fb4168c9481f2ed0bbb7faabb52100a
SHA1 41204d8a339a8a18d90578f677215e1bcce80c99
SHA512 703558471c296c25e5c637852538a2a0face260a05fe9d85c92e5b340d50604366fa8cbbfc742da0df4140ee0368bc045b59180a20ebf31c52d69293e57aa681
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYa:ROdWCCi7/rahHxJTFlt2O+2BWZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

USPRJQX.exe

Path C:\Windows\System\USPRJQX.exe
Size 1.5MB
SHA256 f6bddc6272d953b0ce0e7e5f15cdcf157efeefb4d04ce9e125198057e08b2751
MD5 261be5718ae659f9ed68672ad0c460fa
SHA1 6b0a716b08940b073878cef29545c72ece4e77d3
SHA512 6d90a74ed366802d9d66b881e4fd9ccc30f04b3335e64721476521d48476547a7fc2933b71ee0b2859f4fbc232457f2f576299ed05264adb4c5dfe789ee91f22
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYs:ROdWCCi7/rahHxJTFlt2O+2BWZs
MD5 SHA1 SHA512 SSDEEP

Submit Download

XJztrTg.exe

Path C:\Windows\System\XJztrTg.exe
Size 1.5MB
SHA256 696236eb7b0466fb4106fe5c065ac682bedef2e7f10af4ba03aef5fb76bdd5cc
MD5 019ec316b8f85cfe12196b8fb24bd02d
SHA1 047d6fcc5dcef6b7a7abf18d7b45a8cf924b1b77
SHA512 543cf2b1cdfb032e3d55108e5daa33678087f094896f5b28650b398b8bae41903f4bc6516afc11a50f6cde61073e65b3b28bde3daab04403892270cb3b70d79a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY7:ROdWCCi7/rahHxJTFlt2O+2BWZ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

XfibGhx.exe

Path C:\Windows\System\XfibGhx.exe
Size 1.5MB
SHA256 99f274da6a80b87a7e3f0d97c4ec14d21a3981d1982b1bce8b2edda28f26372f
MD5 07c46659716011f70759dfe5d7dfa8df
SHA1 01bcdac15909f6799c3d010737df5ec8bf55e894
SHA512 e454e29b321ca2de0d17cef630c7296170ab4a0e1b7254b8b59328aba41f68d6b3751d86b3c2ec97810a9133e0ee0f0a29060ec86a06656f9ac8747d92903cde
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYR:ROdWCCi7/rahHxJTFlt2O+2BWZR
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxDyrIU.exe

Path C:\Windows\System\XxDyrIU.exe
Size 1.5MB
SHA256 47736a58c5d8774ac73d552382b3a08a3351809dcc6684269c95591718744140
MD5 9687c8e6ac9e3cb253364d686ff636c4
SHA1 def5b7f8847ccda9b6d95330b02781f19805ffef
SHA512 eb7810a356c48aa091767d76cfef35cdda6008cc5d742f030bccf08686dd2fdc877f48520cc637f3fba334183a5b5834aaf857e3193f10e6a832b1b0de8ad121
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYM:ROdWCCi7/rahHxJTFlt2O+2BWZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

YsTfIyo.exe

Path C:\Windows\System\YsTfIyo.exe
Size 1.5MB
SHA256 3f6f140803818375ba303fc55940b1029bf7e657ed146568390d46312da28b39
MD5 39a99a6f426f104a4625e48932121df9
SHA1 d4394ecc94468a33ceab8194ce204cc5aee43a3c
SHA512 a4cbebd7df947e9836d28de483e10c9711fe24ac9f654f636a6f050bc6b6a062f4faa2248d7263a1a858e1ce481e82ea654d7ca34b2bbc91bad3e9c5c0e92e77
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYz:ROdWCCi7/rahHxJTFlt2O+2BWZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

cNWRLwF.exe

Path C:\Windows\System\cNWRLwF.exe
Size 1.5MB
SHA256 482630fedd877da13853d67ae392a2ab6b29edd321aec3fb13b4757d057e4a84
MD5 45711cabf526b11f881a17923d4c6b50
SHA1 295f030ba405c557669ec4a099ac99b52ed2b281
SHA512 c8582bedc7180eab39b678b68ff1e277d95841c8682750e8d335f1515c5a0a178b483f875f8d038613d0d292194372d7482f5632365c4982fd849611ae5551a3
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYv:ROdWCCi7/rahHxJTFlt2O+2BWZv
MD5 SHA1 SHA512 SSDEEP

Submit Download

crUXhit.exe

Path C:\Windows\System\crUXhit.exe
Size 1.5MB
SHA256 a5626c396379d1886074834cd96f8de296f2972ddac5d417fd8f0064eee14110
MD5 504ade99d0a0064c4c33db0252eddf69
SHA1 3bf589bd646481d5476dfbadd93afe87c80414f5
SHA512 0068124418c0b5c0525ef6e7cc4520b463f8de0e3d78d35673ad2ae50dceb90a2ec70ee535b9321ce33cd8c7c3e765accc4174fe8816f232f27a83e3dbe6273f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYb:ROdWCCi7/rahHxJTFlt2O+2BWZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehUhZYx.exe

Path C:\Windows\System\ehUhZYx.exe
Size 1.5MB
SHA256 52a7d6bb41a59a05b93ee50a6fd09dfbba712e31c0ae48a2fc86c88a5a42fc7f
MD5 a7af76a79e91c4fac913b8b33febadab
SHA1 f85efec179d9b37a2c07440926240cfd0c1ecb76
SHA512 7dda121fb28e46bf792e159896f0f069398f56c304a6ff4fe0b62c92253f93eff937c609806d6824952b5ced4c76457a69b5a3417769f103234d92b5b65c3fc2
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYI:ROdWCCi7/rahHxJTFlt2O+2BWZI
MD5 SHA1 SHA512 SSDEEP

Submit Download

eyRzpCX.exe

Path C:\Windows\System\eyRzpCX.exe
Size 1.5MB
SHA256 eacb040fbe980627c6ed8de1c5e9adf50e5434a432a529d5b282f44dfd5a4a6e
MD5 888c4c0f1d638d24098847a7a7397178
SHA1 42647345413ccf5620c0cbda7160020c9fe424aa
SHA512 b071b16d2aac020e642ef0bf388b386b306e41b27a7a4142b2e8467cac2a993dd4e1700bc56e1c7b7d55bc1e8abcd7cf81a694ba55f454d1bf7293014d26fec7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYL:ROdWCCi7/rahHxJTFlt2O+2BWZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gUKkAnL.exe

Path C:\Windows\System\gUKkAnL.exe
Size 1.5MB
SHA256 e50b0dd18072a06e281c71ecf502eb60e7c30266fdee0228d757a762e0291742
MD5 dc083a62c94b44273eb61d0ad526413c
SHA1 6c786093504d90c807b57c420a66bd87d527c212
SHA512 a9e1649c89fee5716bb1a623307a051922da976262af62450bdfe0392c13382e28dcd1743761d5d8dab0bfb8f7fdbd89d6b1e0c4449faac7b6df064577849759
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY8:ROdWCCi7/rahHxJTFlt2O+2BWZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

hTpFuuY.exe

Path C:\Windows\System\hTpFuuY.exe
Size 1.5MB
SHA256 b14793b10da1c98c779b9c78ca65feaa1a25bb4a4615dde43cf37a4a3c03b401
MD5 38bd6e476780b95aef1a8326dec85d14
SHA1 a9f9e0122dfcf1e1aa5215651e09bb651122ec51
SHA512 8a35b78af023a73a3a2d85bf4cf599b57cd1699ee637ea3222ac8254b7c303cab858f5c6a69fc8bff9c9e4e79fce741ddc04cd16542c1508047009dc72b7c34e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSY3:ROdWCCi7/rahHxJTFlt2O+2BWZ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jGuRzYg.exe

Path C:\Windows\System\jGuRzYg.exe
Size 1.5MB
SHA256 f0d5635071fafafc34355711775eca9259252235d9db5153bdaecb668fbc033f
MD5 2adfe544c00ee5347e6cee8372e4dda3
SHA1 7d40f8f469aa3099aacd801a6ee9d7125b7cf90f
SHA512 4e975cedc56ad63841ca2f2f2ad56479fdb36bb6515e238b017d13a0a84cb70fe177f3589a7886230e169479eb421ebd4b4107c476cbee49c5e6db4e463cf12e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYO:ROdWCCi7/rahHxJTFlt2O+2BWZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

kLfIVke.exe

Path C:\Windows\System\kLfIVke.exe
Size 1.5MB
SHA256 f61e70f220084c663145392719fa05f9bab4c6d1e08232e2f4a8e50ef6d25f7c
MD5 a17624a3c128cb11fa62a668abb661d2
SHA1 506655e077e144d0031a6f184e99df09755ea329
SHA512 3172df7833eda10dc81927ed8d51bdbaadaf2d73038c1d6ed30dd734b4d5e2b24c5bbdc9e552cc49f29710f86632de781a356ed1b4623715b3177e17fa98823f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYe:ROdWCCi7/rahHxJTFlt2O+2BWZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

qRbjlvj.exe

Path C:\Windows\System\qRbjlvj.exe
Size 1.5MB
SHA256 45c0eed675c2eae075ae11bdb624abc711b48131c26c70655c8df81806a2c58b
MD5 271ff6fc93a02de63dddea97dbdcee81
SHA1 c66794f440b54c1e1b2ee71443467eaed86ae963
SHA512 fd85c428b91b3fdb5f3f6aa83068412e6f7b5f9ee6347fb3aaf8f3c7edaeafcec00764d980ce262ecae9891693f09c6d841ec3a1a2be65c769c8a04fe040ce7f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYl:ROdWCCi7/rahHxJTFlt2O+2BWZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdzcdLn.exe

Path C:\Windows\System\rdzcdLn.exe
Size 1.5MB
SHA256 4380808df5ad59e9bb17bf4ccbe220d8cb12fd850ddc37a04f1d00142be06e91
MD5 3607e102b8791491ea5159ead17276d1
SHA1 5161ea93adad325866705dbea9fdaeb8d2dbfe3a
SHA512 93ad5bb5e250550e6eb012079d44393bf7b98a3e4f645f09f02a4eb3c59ed8259bd5be1847e6f6c5f69ae6386b9c8e76839c62d0bca464f193bfbcc92044d3b6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYy:ROdWCCi7/rahHxJTFlt2O+2BWZy
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgINlLZ.exe

Path C:\Windows\System\sgINlLZ.exe
Size 1.5MB
SHA256 afe57a452581727d60cfd97111b8335f099ed0ef81f95fa583447d512362b1e6
MD5 ede39af9e8ad177ec33ae35a379008e9
SHA1 2ae2f5e58ed379221a3296531e3a7bff062f2aa6
SHA512 64b5d47579b9d3169e0f8362bd1d7d1e6e69d2336bd1a8c6ce26399079ea81848d2ca7de01fc1748701aa69a476d446b8a870f0d06fafcac787aad4815a08271
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYD:ROdWCCi7/rahHxJTFlt2O+2BWZD
MD5 SHA1 SHA512 SSDEEP

Submit Download

tKvorUD.exe

Path C:\Windows\System\tKvorUD.exe
Size 1.5MB
SHA256 71f8bdee5afd17882d199f34bdfe530f72b34982a09dc47d0f446e9d6453678a
MD5 2849e948a2ea76d5aec052219be98231
SHA1 480256ffd5b83589735ef7990a91f3a7972cb8f0
SHA512 22b441f669611f872da3e14f85b6f229e657c033d90f80ef8b8dbb8917a6ec843fe8895c12e6d26d36fbb80e3dfbcbf4419e1d37ca8f6d5c47418753228f6cbf
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYW:ROdWCCi7/rahHxJTFlt2O+2BWZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vWCDHKz.exe

Path C:\Windows\System\vWCDHKz.exe
Size 1.5MB
SHA256 20166d5b8073c1e51445327e83ecb11635257ba4550d9bd65674ab510c73a91f
MD5 e0359bc22af271bde8dfcb34f6aed0a6
SHA1 7dcc97cdeb7af5f8f43d095841224b537ab9313f
SHA512 1f42a8700146144ecc887ce2f9a0ac9d0458f7141a1a5994df462a63d9012da6c14fbf4419ab1582d6ff76490952bb4fe00c0b6a12822b20d773ef88e2cf868c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYO:ROdWCCi7/rahHxJTFlt2O+2BWZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqkPerJ.exe

Path C:\Windows\System\xqkPerJ.exe
Size 1.5MB
SHA256 c20bc793d351ee8d6d639de64a88ec7a0f79398412da2199e7da90268139da11
MD5 5a1ad704851d5305f1ae734596a058a9
SHA1 4a5d2652eb8dcc0c48a0f25dd7a1a18370b509a6
SHA512 02cfe3d390e26bdc8f20621f7b2b2e3fb1b20922c793049981c9f050777c394118ec2b395532d8994bea27cd3884d3126ee49a39cc60d61ab5efe9fe599ec687
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYd:ROdWCCi7/rahHxJTFlt2O+2BWZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

yNTcTud.exe

Path C:\Windows\System\yNTcTud.exe
Size 1.5MB
SHA256 955542abb8ffb46181d9ba80625023306771a1ea4d82b914c986f535b693de3f
MD5 05fc348b36099cdcb5dc40e5edd69220
SHA1 88efc3a5abc12c096358ac5a4b9e7f43d4831147
SHA512 f82a89b71986a6985bd85b106cdf0a86c7be11ebc0b405192e9c4eea7ae4f6deedcbb72be069737d8c89c6b992de8bfc0ef8163a39b5c7862b7d9268dec40e1d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727XL1+KICdyyPo++UIUFlBaNC2LKqHtl2BZquYPJSYd:ROdWCCi7/rahHxJTFlt2O+2BWZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-228-0x00007FF69D060000-0x00007FF69D3B1000-memory.dmp

Download

memory/220-2234-0x00007FF69D060000-0x00007FF69D3B1000-memory.dmp

Download

memory/376-171-0x00007FF73A030000-0x00007FF73A381000-memory.dmp

Download

memory/376-2213-0x00007FF73A030000-0x00007FF73A381000-memory.dmp

Download

memory/388-316-0x00007FF650F10000-0x00007FF651261000-memory.dmp

Download

memory/388-2199-0x00007FF650F10000-0x00007FF651261000-memory.dmp

Download

memory/412-736-0x00007FF72D6D0000-0x00007FF72DA21000-memory.dmp

Download

memory/412-2202-0x00007FF72D6D0000-0x00007FF72DA21000-memory.dmp

Download

memory/536-225-0x00007FF737BF0000-0x00007FF737F41000-memory.dmp

Download

memory/536-2183-0x00007FF737BF0000-0x00007FF737F41000-memory.dmp

Download

memory/536-2238-0x00007FF737BF0000-0x00007FF737F41000-memory.dmp

Download

memory/1152-2230-0x00007FF6D28F0000-0x00007FF6D2C41000-memory.dmp

Download

memory/1152-570-0x00007FF6D28F0000-0x00007FF6D2C41000-memory.dmp

Download

memory/1312-2182-0x00007FF683590000-0x00007FF6838E1000-memory.dmp

Download

memory/1312-46-0x00007FF683590000-0x00007FF6838E1000-memory.dmp

Download

memory/1312-2211-0x00007FF683590000-0x00007FF6838E1000-memory.dmp

Download

memory/1356-2206-0x00007FF605990000-0x00007FF605CE1000-memory.dmp

Download

memory/1356-734-0x00007FF605990000-0x00007FF605CE1000-memory.dmp

Download

memory/1704-2219-0x00007FF69D220000-0x00007FF69D571000-memory.dmp

Download

memory/1704-735-0x00007FF69D220000-0x00007FF69D571000-memory.dmp

Download

memory/1752-2250-0x00007FF793A30000-0x00007FF793D81000-memory.dmp

Download

memory/1752-730-0x00007FF793A30000-0x00007FF793D81000-memory.dmp

Download

memory/2532-729-0x00007FF71A290000-0x00007FF71A5E1000-memory.dmp

Download

memory/2532-2240-0x00007FF71A290000-0x00007FF71A5E1000-memory.dmp

Download

memory/2632-2185-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp

Download

memory/2632-17-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp

Download

memory/2632-2178-0x00007FF65AFB0000-0x00007FF65B301000-memory.dmp

Download

memory/2956-2228-0x00007FF7C67D0000-0x00007FF7C6B21000-memory.dmp

Download

memory/2956-362-0x00007FF7C67D0000-0x00007FF7C6B21000-memory.dmp

Download

memory/3036-2210-0x00007FF6F9730000-0x00007FF6F9A81000-memory.dmp

Download

memory/3036-728-0x00007FF6F9730000-0x00007FF6F9A81000-memory.dmp

Download

memory/3248-2232-0x00007FF71AF20000-0x00007FF71B271000-memory.dmp

Download

memory/3248-441-0x00007FF71AF20000-0x00007FF71B271000-memory.dmp

Download

memory/3568-733-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp

Download

memory/3568-2203-0x00007FF6C60F0000-0x00007FF6C6441000-memory.dmp

Download

memory/4064-2189-0x00007FF7489E0000-0x00007FF748D31000-memory.dmp

Download

memory/4064-2179-0x00007FF7489E0000-0x00007FF748D31000-memory.dmp

Download

memory/4064-37-0x00007FF7489E0000-0x00007FF748D31000-memory.dmp

Download

memory/4076-732-0x00007FF6CB060000-0x00007FF6CB3B1000-memory.dmp

Download

memory/4076-2187-0x00007FF6CB060000-0x00007FF6CB3B1000-memory.dmp

Download

memory/4116-2227-0x00007FF6C4840000-0x00007FF6C4B91000-memory.dmp

Download

memory/4116-731-0x00007FF6C4840000-0x00007FF6C4B91000-memory.dmp

Download

memory/4196-0-0x00007FF714280000-0x00007FF7145D1000-memory.dmp

Download

memory/4196-1-0x00000239728F0000-0x0000023972900000-memory.dmp

Download

memory/4196-2073-0x00007FF714280000-0x00007FF7145D1000-memory.dmp

Download

memory/4216-2194-0x00007FF6C4BD0000-0x00007FF6C4F21000-memory.dmp

Download

memory/4216-122-0x00007FF6C4BD0000-0x00007FF6C4F21000-memory.dmp

Download

memory/4228-2198-0x00007FF6673A0000-0x00007FF6676F1000-memory.dmp

Download

memory/4228-2181-0x00007FF6673A0000-0x00007FF6676F1000-memory.dmp

Download

memory/4228-168-0x00007FF6673A0000-0x00007FF6676F1000-memory.dmp

Download

memory/4236-2192-0x00007FF6E2660000-0x00007FF6E29B1000-memory.dmp

Download

memory/4236-87-0x00007FF6E2660000-0x00007FF6E29B1000-memory.dmp

Download

memory/4628-370-0x00007FF63F7E0000-0x00007FF63FB31000-memory.dmp

Download

memory/4628-2242-0x00007FF63F7E0000-0x00007FF63FB31000-memory.dmp

Download

memory/4636-2208-0x00007FF70E720000-0x00007FF70EA71000-memory.dmp

Download

memory/4636-261-0x00007FF70E720000-0x00007FF70EA71000-memory.dmp

Download

memory/4660-83-0x00007FF63FF00000-0x00007FF640251000-memory.dmp

Download

memory/4660-2180-0x00007FF63FF00000-0x00007FF640251000-memory.dmp

Download

memory/4660-2195-0x00007FF63FF00000-0x00007FF640251000-memory.dmp

Download

memory/4756-2236-0x00007FF75B550000-0x00007FF75B8A1000-memory.dmp

Download

memory/4756-693-0x00007FF75B550000-0x00007FF75B8A1000-memory.dmp

Download

memory/4892-2216-0x00007FF7268A0000-0x00007FF726BF1000-memory.dmp

Download

memory/4892-320-0x00007FF7268A0000-0x00007FF726BF1000-memory.dmp

Download

memory/5064-689-0x00007FF759F60000-0x00007FF75A2B1000-memory.dmp

Download

memory/5064-2223-0x00007FF759F60000-0x00007FF75A2B1000-memory.dmp

Download

memory/5108-2224-0x00007FF6D0890000-0x00007FF6D0BE1000-memory.dmp

Download

memory/5108-573-0x00007FF6D0890000-0x00007FF6D0BE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads