xmrig | 16900e40603b2882b9d1911d01c21056317a7ebdf88239ce96124d27d5abfbb6

Analysis

max time kernel
130s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
Size 1.3MB
Sample240526-182ejafa74
SHA256 16900e40603b2882b9d1911d01c21056317a7ebdf88239ce96124d27d5abfbb6
MD5 0755cdbfbaf60b43abc0974db00a5580
SHA1 adf390724f19cdd985d2e7af7d581e8fc2d11547
SHA512 044e19c1a9b1300a6dbf6141d02bd3a2f9dc7c30eff9c06cde3fbc82b8ef9bc4cec8cc028b961af47e755beb41f476f1a1cb40eda02b441b7cedd361e179bbe1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0u:ROdWCCi7/rahW/zaZT2D6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral2/memory/2288-197-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp	xmrig
behavioral2/memory/400-196-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp	xmrig
behavioral2/memory/4880-195-0x00007FF6936D0000-0x00007FF693A21000-memory.dmp	xmrig
behavioral2/memory/5044-189-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp	xmrig
behavioral2/memory/4780-188-0x00007FF690FC0000-0x00007FF691311000-memory.dmp	xmrig
behavioral2/memory/2856-181-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp	xmrig
behavioral2/memory/5032-174-0x00007FF60CEE0000-0x00007FF60D231000-memory.dmp	xmrig
behavioral2/memory/4412-173-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp	xmrig
behavioral2/memory/684-167-0x00007FF7ED1E0000-0x00007FF7ED531000-memory.dmp	xmrig
behavioral2/memory/208-154-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp	xmrig
behavioral2/memory/3732-153-0x00007FF7DEAB0000-0x00007FF7DEE01000-memory.dmp	xmrig
behavioral2/memory/4048-152-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp	xmrig
behavioral2/memory/2632-146-0x00007FF760520000-0x00007FF760871000-memory.dmp	xmrig
behavioral2/memory/3476-139-0x00007FF696C10000-0x00007FF696F61000-memory.dmp	xmrig
behavioral2/memory/4952-134-0x00007FF6E85D0000-0x00007FF6E8921000-memory.dmp	xmrig
behavioral2/memory/2756-133-0x00007FF7527B0000-0x00007FF752B01000-memory.dmp	xmrig
behavioral2/memory/3788-61-0x00007FF7E8EB0000-0x00007FF7E9201000-memory.dmp	xmrig
behavioral2/memory/3736-1500-0x00007FF6ED960000-0x00007FF6EDCB1000-memory.dmp	xmrig
behavioral2/memory/2852-1501-0x00007FF78FB80000-0x00007FF78FED1000-memory.dmp	xmrig
behavioral2/memory/2108-1508-0x00007FF696AA0000-0x00007FF696DF1000-memory.dmp	xmrig
behavioral2/memory/5076-2313-0x00007FF6B1D60000-0x00007FF6B20B1000-memory.dmp	xmrig
behavioral2/memory/1796-2315-0x00007FF634C50000-0x00007FF634FA1000-memory.dmp	xmrig
behavioral2/memory/1420-2314-0x00007FF71E730000-0x00007FF71EA81000-memory.dmp	xmrig
behavioral2/memory/4764-2316-0x00007FF632CB0000-0x00007FF633001000-memory.dmp	xmrig
behavioral2/memory/448-2353-0x00007FF656DE0000-0x00007FF657131000-memory.dmp	xmrig
behavioral2/memory/404-2354-0x00007FF672700000-0x00007FF672A51000-memory.dmp	xmrig
behavioral2/memory/2328-2356-0x00007FF79D7A0000-0x00007FF79DAF1000-memory.dmp	xmrig
behavioral2/memory/2756-2375-0x00007FF7527B0000-0x00007FF752B01000-memory.dmp	xmrig
behavioral2/memory/3476-2377-0x00007FF696C10000-0x00007FF696F61000-memory.dmp	xmrig
behavioral2/memory/4048-2379-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp	xmrig
behavioral2/memory/2632-2381-0x00007FF760520000-0x00007FF760871000-memory.dmp	xmrig
behavioral2/memory/3788-2383-0x00007FF7E8EB0000-0x00007FF7E9201000-memory.dmp	xmrig
behavioral2/memory/3732-2385-0x00007FF7DEAB0000-0x00007FF7DEE01000-memory.dmp	xmrig
behavioral2/memory/208-2388-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp	xmrig
behavioral2/memory/4412-2391-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp	xmrig
behavioral2/memory/684-2395-0x00007FF7ED1E0000-0x00007FF7ED531000-memory.dmp	xmrig
behavioral2/memory/4780-2397-0x00007FF690FC0000-0x00007FF691311000-memory.dmp	xmrig
behavioral2/memory/5044-2393-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp	xmrig
behavioral2/memory/2856-2389-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp	xmrig
behavioral2/memory/2288-2403-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp	xmrig
behavioral2/memory/2108-2405-0x00007FF696AA0000-0x00007FF696DF1000-memory.dmp	xmrig
behavioral2/memory/2852-2399-0x00007FF78FB80000-0x00007FF78FED1000-memory.dmp	xmrig
behavioral2/memory/3736-2401-0x00007FF6ED960000-0x00007FF6EDCB1000-memory.dmp	xmrig
behavioral2/memory/5076-2420-0x00007FF6B1D60000-0x00007FF6B20B1000-memory.dmp	xmrig
behavioral2/memory/1796-2416-0x00007FF634C50000-0x00007FF634FA1000-memory.dmp	xmrig
behavioral2/memory/1872-2410-0x00007FF747A70000-0x00007FF747DC1000-memory.dmp	xmrig
behavioral2/memory/2328-2426-0x00007FF79D7A0000-0x00007FF79DAF1000-memory.dmp	xmrig
behavioral2/memory/4880-2429-0x00007FF6936D0000-0x00007FF693A21000-memory.dmp	xmrig
behavioral2/memory/404-2427-0x00007FF672700000-0x00007FF672A51000-memory.dmp	xmrig
behavioral2/memory/5032-2423-0x00007FF60CEE0000-0x00007FF60D231000-memory.dmp	xmrig
behavioral2/memory/2360-2421-0x00007FF714880000-0x00007FF714BD1000-memory.dmp	xmrig
behavioral2/memory/1420-2418-0x00007FF71E730000-0x00007FF71EA81000-memory.dmp	xmrig
behavioral2/memory/4764-2414-0x00007FF632CB0000-0x00007FF633001000-memory.dmp	xmrig
behavioral2/memory/1928-2412-0x00007FF695720000-0x00007FF695A71000-memory.dmp	xmrig
behavioral2/memory/448-2408-0x00007FF656DE0000-0x00007FF657131000-memory.dmp	xmrig
behavioral2/memory/400-2712-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2756	AjdtEUX.exe
3476	kBdxOje.exe
4048	zjWGzfP.exe
2632	sDGyTfy.exe
4412	IRofytp.exe
3732	CCRqiVi.exe
3788	NJCYyxk.exe
684	kYLZNgT.exe
208	efEccLp.exe
2856	BHKCWii.exe
4780	IqNXrQT.exe
5044	QMoJBYV.exe
400	inpwRrS.exe
3736	FJrycYB.exe
2852	oxzomQc.exe
2288	qPdCJDO.exe
2108	wjYfqNG.exe
1872	JPsAiuO.exe
2360	khjXhMI.exe
5076	yFgYmij.exe
1420	oIVEfig.exe
1796	IXDkMiI.exe
4764	qYbAajC.exe
1928	XnjRVyE.exe
448	Awadzug.exe
5032	baJBZXr.exe
404	PJMKCGe.exe
2328	CrWFacE.exe
4880	zhPYVBs.exe
4644	mEgVNMf.exe
2056	yuUCHgY.exe
4608	DwzYOxA.exe
4564	KLCtPhU.exe
4736	pLtAdWp.exe
2820	TgdwAmt.exe
3364	BjRIbJl.exe
4732	rCWOGJo.exe
1120	XryftlO.exe
8	PnrxBqs.exe
1900	RtQwsnI.exe
4432	HxSSmuc.exe
2932	ZPQvSUN.exe
1596	ptnugTT.exe
2536	ewlYoco.exe
3568	kGfTSmn.exe
4340	lrrsHNR.exe
4360	uveCRRT.exe
3408	RAvjZbm.exe
536	MzVuDHe.exe
2892	khrfftV.exe
808	dXKuYfU.exe
2684	NsgmIVR.exe
3380	eikuqtd.exe
4828	KZtehir.exe
4592	XjzURYL.exe
3324	JVfbuQW.exe
4924	eeVEvgi.exe
4628	MRitevs.exe
4652	ZYuvpTI.exe
4216	SzERzgu.exe
4636	ChIPTcr.exe
3616	RYLCYSA.exe
2412	Elgxztm.exe
848	lpMIxFr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4952-0-0x00007FF6E85D0000-0x00007FF6E8921000-memory.dmp	upx
behavioral2/files/0x0007000000023443-10.dat	upx
behavioral2/memory/2632-24-0x00007FF760520000-0x00007FF760871000-memory.dmp	upx
behavioral2/memory/4048-31-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp	upx
behavioral2/memory/208-51-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp	upx
behavioral2/memory/4412-60-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp	upx
behavioral2/files/0x000700000002344d-63.dat	upx
behavioral2/files/0x000700000002344b-70.dat	upx
behavioral2/memory/5044-84-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp	upx
behavioral2/memory/400-90-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp	upx
behavioral2/files/0x0007000000023451-101.dat	upx
behavioral2/memory/2108-111-0x00007FF696AA0000-0x00007FF696DF1000-memory.dmp	upx
behavioral2/memory/2360-121-0x00007FF714880000-0x00007FF714BD1000-memory.dmp	upx
behavioral2/files/0x0007000000023455-131.dat	upx
behavioral2/memory/4764-145-0x00007FF632CB0000-0x00007FF633001000-memory.dmp	upx
behavioral2/files/0x000700000002345e-198.dat	upx
behavioral2/files/0x0007000000023461-205.dat	upx
behavioral2/files/0x000700000002345f-203.dat	upx
behavioral2/files/0x0007000000023460-200.dat	upx
behavioral2/memory/2288-197-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp	upx
behavioral2/memory/400-196-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp	upx
behavioral2/memory/4880-195-0x00007FF6936D0000-0x00007FF693A21000-memory.dmp	upx
behavioral2/files/0x000700000002345d-190.dat	upx
behavioral2/memory/5044-189-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp	upx
behavioral2/memory/4780-188-0x00007FF690FC0000-0x00007FF691311000-memory.dmp	upx
behavioral2/memory/2328-187-0x00007FF79D7A0000-0x00007FF79DAF1000-memory.dmp	upx
behavioral2/files/0x000700000002345c-182.dat	upx
behavioral2/memory/2856-181-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp	upx
behavioral2/memory/404-180-0x00007FF672700000-0x00007FF672A51000-memory.dmp	upx
behavioral2/files/0x000700000002345b-175.dat	upx
behavioral2/memory/5032-174-0x00007FF60CEE0000-0x00007FF60D231000-memory.dmp	upx
behavioral2/memory/4412-173-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp	upx
behavioral2/files/0x000700000002345a-168.dat	upx
behavioral2/memory/684-167-0x00007FF7ED1E0000-0x00007FF7ED531000-memory.dmp	upx
behavioral2/files/0x0007000000023459-162.dat	upx
behavioral2/memory/448-161-0x00007FF656DE0000-0x00007FF657131000-memory.dmp	upx
behavioral2/memory/1928-160-0x00007FF695720000-0x00007FF695A71000-memory.dmp	upx
behavioral2/files/0x0007000000023458-155.dat	upx
behavioral2/memory/208-154-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp	upx
behavioral2/memory/3732-153-0x00007FF7DEAB0000-0x00007FF7DEE01000-memory.dmp	upx
behavioral2/memory/4048-152-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp	upx
behavioral2/files/0x0007000000023457-147.dat	upx
behavioral2/memory/2632-146-0x00007FF760520000-0x00007FF760871000-memory.dmp	upx
behavioral2/files/0x0007000000023456-140.dat	upx
behavioral2/memory/3476-139-0x00007FF696C10000-0x00007FF696F61000-memory.dmp	upx
behavioral2/memory/1796-138-0x00007FF634C50000-0x00007FF634FA1000-memory.dmp	upx
behavioral2/memory/4952-134-0x00007FF6E85D0000-0x00007FF6E8921000-memory.dmp	upx
behavioral2/memory/2756-133-0x00007FF7527B0000-0x00007FF752B01000-memory.dmp	upx
behavioral2/memory/1420-127-0x00007FF71E730000-0x00007FF71EA81000-memory.dmp	upx
behavioral2/files/0x0008000000023440-125.dat	upx
behavioral2/memory/5076-122-0x00007FF6B1D60000-0x00007FF6B20B1000-memory.dmp	upx
behavioral2/files/0x0007000000023454-118.dat	upx
behavioral2/files/0x0007000000023453-113.dat	upx
behavioral2/memory/1872-112-0x00007FF747A70000-0x00007FF747DC1000-memory.dmp	upx
behavioral2/files/0x0007000000023452-106.dat	upx
behavioral2/memory/2852-105-0x00007FF78FB80000-0x00007FF78FED1000-memory.dmp	upx
behavioral2/files/0x0007000000023450-99.dat	upx
behavioral2/files/0x000700000002344f-97.dat	upx
behavioral2/memory/2288-95-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp	upx
behavioral2/memory/3736-91-0x00007FF6ED960000-0x00007FF6EDCB1000-memory.dmp	upx
behavioral2/files/0x000700000002344e-89.dat	upx
behavioral2/memory/4780-71-0x00007FF690FC0000-0x00007FF691311000-memory.dmp	upx
behavioral2/files/0x000700000002344c-68.dat	upx
behavioral2/memory/2856-66-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pFTdrzY.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\FbErXhm.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\LlfqJHC.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\WKxuJQC.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\dDnWNiL.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\IqNXrQT.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\gCnZAvW.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\cJQnsQg.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\kxrbdHt.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\eikuqtd.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\UtSyida.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\QtAhBaG.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\WRztygK.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\icfReXY.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\nLythRT.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\vasJOux.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\NouoQlZ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\gMcUoEk.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\pLtAdWp.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\RHDFMsy.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\wzDxPKP.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\EIyBdId.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\bsPxKry.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\AkGZktz.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\odzTHsk.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\XPIhPWf.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\TFFNale.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\UVdliqH.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\wfHNvUG.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\gjsGrnQ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\htzTzzR.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\xoOGhuS.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\mpVuRbQ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\pWWzEJt.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\CwNtLjq.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\Ijgbbrc.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\WeTdaWD.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\kPcHdxV.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\fHHjZqB.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\MPXeYob.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\vWrsrSg.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\BGAsrjL.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\mWsIhuM.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\eIesnIx.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\RDKjzaG.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\jRShgGW.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\aDZjxkp.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\YtkonDl.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\kGtPOCd.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\wHMaMkk.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\BAUFQjY.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\KbukWGQ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\MeIzxoJ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\khrmqcr.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\ZyqJSOG.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\aWqkMNg.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\IvIcEYl.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\CbSexQq.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\mZfGcFJ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\YGmvfqk.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\eahXWzJ.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\cdVinCb.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\nRHgxEP.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
File created	C:\Windows\System\zCZSfKV.exe	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2756	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	83
PID 4952 wrote to memory of 2756	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	83
PID 4952 wrote to memory of 3476	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	84
PID 4952 wrote to memory of 3476	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	84
PID 4952 wrote to memory of 4048	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	85
PID 4952 wrote to memory of 4048	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	85
PID 4952 wrote to memory of 2632	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	86
PID 4952 wrote to memory of 2632	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	86
PID 4952 wrote to memory of 4412	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	87
PID 4952 wrote to memory of 4412	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	87
PID 4952 wrote to memory of 3732	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	88
PID 4952 wrote to memory of 3732	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	88
PID 4952 wrote to memory of 3788	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	89
PID 4952 wrote to memory of 3788	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	89
PID 4952 wrote to memory of 684	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	90
PID 4952 wrote to memory of 684	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	90
PID 4952 wrote to memory of 208	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	91
PID 4952 wrote to memory of 208	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	91
PID 4952 wrote to memory of 2856	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	92
PID 4952 wrote to memory of 2856	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	92
PID 4952 wrote to memory of 4780	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	93
PID 4952 wrote to memory of 4780	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	93
PID 4952 wrote to memory of 5044	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	94
PID 4952 wrote to memory of 5044	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	94
PID 4952 wrote to memory of 400	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	95
PID 4952 wrote to memory of 400	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	95
PID 4952 wrote to memory of 3736	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	96
PID 4952 wrote to memory of 3736	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	96
PID 4952 wrote to memory of 2852	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	97
PID 4952 wrote to memory of 2852	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	97
PID 4952 wrote to memory of 2288	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	98
PID 4952 wrote to memory of 2288	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	98
PID 4952 wrote to memory of 2108	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	99
PID 4952 wrote to memory of 2108	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	99
PID 4952 wrote to memory of 1872	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	100
PID 4952 wrote to memory of 1872	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	100
PID 4952 wrote to memory of 2360	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	101
PID 4952 wrote to memory of 2360	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	101
PID 4952 wrote to memory of 5076	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	102
PID 4952 wrote to memory of 5076	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	102
PID 4952 wrote to memory of 1420	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	103
PID 4952 wrote to memory of 1420	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	103
PID 4952 wrote to memory of 1796	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	104
PID 4952 wrote to memory of 1796	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	104
PID 4952 wrote to memory of 4764	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	105
PID 4952 wrote to memory of 4764	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	105
PID 4952 wrote to memory of 1928	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	106
PID 4952 wrote to memory of 1928	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	106
PID 4952 wrote to memory of 448	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	107
PID 4952 wrote to memory of 448	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	107
PID 4952 wrote to memory of 5032	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	108
PID 4952 wrote to memory of 5032	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	108
PID 4952 wrote to memory of 404	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	109
PID 4952 wrote to memory of 404	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	109
PID 4952 wrote to memory of 2328	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	110
PID 4952 wrote to memory of 2328	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	110
PID 4952 wrote to memory of 4880	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	111
PID 4952 wrote to memory of 4880	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	111
PID 4952 wrote to memory of 4644	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	112
PID 4952 wrote to memory of 4644	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	112
PID 4952 wrote to memory of 2056	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	113
PID 4952 wrote to memory of 2056	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	113
PID 4952 wrote to memory of 4608	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	114
PID 4952 wrote to memory of 4608	4952	0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0755cdbfbaf60b43abc0974db00a5580_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System\AjdtEUX.exe
  C:\Windows\System\AjdtEUX.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\kBdxOje.exe
  C:\Windows\System\kBdxOje.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\zjWGzfP.exe
  C:\Windows\System\zjWGzfP.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\sDGyTfy.exe
  C:\Windows\System\sDGyTfy.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\IRofytp.exe
  C:\Windows\System\IRofytp.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\CCRqiVi.exe
  C:\Windows\System\CCRqiVi.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\NJCYyxk.exe
  C:\Windows\System\NJCYyxk.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\kYLZNgT.exe
  C:\Windows\System\kYLZNgT.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\efEccLp.exe
  C:\Windows\System\efEccLp.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\BHKCWii.exe
  C:\Windows\System\BHKCWii.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\IqNXrQT.exe
  C:\Windows\System\IqNXrQT.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\QMoJBYV.exe
  C:\Windows\System\QMoJBYV.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\inpwRrS.exe
  C:\Windows\System\inpwRrS.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\FJrycYB.exe
  C:\Windows\System\FJrycYB.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\oxzomQc.exe
  C:\Windows\System\oxzomQc.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\qPdCJDO.exe
  C:\Windows\System\qPdCJDO.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\wjYfqNG.exe
  C:\Windows\System\wjYfqNG.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\JPsAiuO.exe
  C:\Windows\System\JPsAiuO.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\khjXhMI.exe
  C:\Windows\System\khjXhMI.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\yFgYmij.exe
  C:\Windows\System\yFgYmij.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\oIVEfig.exe
  C:\Windows\System\oIVEfig.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\IXDkMiI.exe
  C:\Windows\System\IXDkMiI.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\qYbAajC.exe
  C:\Windows\System\qYbAajC.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\XnjRVyE.exe
  C:\Windows\System\XnjRVyE.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\Awadzug.exe
  C:\Windows\System\Awadzug.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\baJBZXr.exe
  C:\Windows\System\baJBZXr.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\PJMKCGe.exe
  C:\Windows\System\PJMKCGe.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\CrWFacE.exe
  C:\Windows\System\CrWFacE.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\zhPYVBs.exe
  C:\Windows\System\zhPYVBs.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\mEgVNMf.exe
  C:\Windows\System\mEgVNMf.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\yuUCHgY.exe
  C:\Windows\System\yuUCHgY.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\DwzYOxA.exe
  C:\Windows\System\DwzYOxA.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\KLCtPhU.exe
  C:\Windows\System\KLCtPhU.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\pLtAdWp.exe
  C:\Windows\System\pLtAdWp.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\TgdwAmt.exe
  C:\Windows\System\TgdwAmt.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\BjRIbJl.exe
  C:\Windows\System\BjRIbJl.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\rCWOGJo.exe
  C:\Windows\System\rCWOGJo.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\XryftlO.exe
  C:\Windows\System\XryftlO.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\PnrxBqs.exe
  C:\Windows\System\PnrxBqs.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\RtQwsnI.exe
  C:\Windows\System\RtQwsnI.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\HxSSmuc.exe
  C:\Windows\System\HxSSmuc.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\ZPQvSUN.exe
  C:\Windows\System\ZPQvSUN.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ptnugTT.exe
  C:\Windows\System\ptnugTT.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ewlYoco.exe
  C:\Windows\System\ewlYoco.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\kGfTSmn.exe
  C:\Windows\System\kGfTSmn.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\lrrsHNR.exe
  C:\Windows\System\lrrsHNR.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\uveCRRT.exe
  C:\Windows\System\uveCRRT.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\RAvjZbm.exe
  C:\Windows\System\RAvjZbm.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\MzVuDHe.exe
  C:\Windows\System\MzVuDHe.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\khrfftV.exe
  C:\Windows\System\khrfftV.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\dXKuYfU.exe
  C:\Windows\System\dXKuYfU.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\NsgmIVR.exe
  C:\Windows\System\NsgmIVR.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\eikuqtd.exe
  C:\Windows\System\eikuqtd.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\KZtehir.exe
  C:\Windows\System\KZtehir.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\XjzURYL.exe
  C:\Windows\System\XjzURYL.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\JVfbuQW.exe
  C:\Windows\System\JVfbuQW.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\eeVEvgi.exe
  C:\Windows\System\eeVEvgi.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\MRitevs.exe
  C:\Windows\System\MRitevs.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\ZYuvpTI.exe
  C:\Windows\System\ZYuvpTI.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\SzERzgu.exe
  C:\Windows\System\SzERzgu.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\ChIPTcr.exe
  C:\Windows\System\ChIPTcr.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\RYLCYSA.exe
  C:\Windows\System\RYLCYSA.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\Elgxztm.exe
  C:\Windows\System\Elgxztm.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\lpMIxFr.exe
  C:\Windows\System\lpMIxFr.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\YJNjTUn.exe
  C:\Windows\System\YJNjTUn.exe
  2⤵
  PID:4808
- C:\Windows\System\STMUphm.exe
  C:\Windows\System\STMUphm.exe
  2⤵
  PID:2880
- C:\Windows\System\tCDeypW.exe
  C:\Windows\System\tCDeypW.exe
  2⤵
  PID:964
- C:\Windows\System\hbhofZK.exe
  C:\Windows\System\hbhofZK.exe
  2⤵
  PID:2172
- C:\Windows\System\tZqwpgY.exe
  C:\Windows\System\tZqwpgY.exe
  2⤵
  PID:1660
- C:\Windows\System\GTaNgOZ.exe
  C:\Windows\System\GTaNgOZ.exe
  2⤵
  PID:2528
- C:\Windows\System\iOZDTrJ.exe
  C:\Windows\System\iOZDTrJ.exe
  2⤵
  PID:3836
- C:\Windows\System\AOOYFgy.exe
  C:\Windows\System\AOOYFgy.exe
  2⤵
  PID:1476
- C:\Windows\System\QLSrEcy.exe
  C:\Windows\System\QLSrEcy.exe
  2⤵
  PID:620
- C:\Windows\System\kuWCLAV.exe
  C:\Windows\System\kuWCLAV.exe
  2⤵
  PID:5148
- C:\Windows\System\YhgMEWm.exe
  C:\Windows\System\YhgMEWm.exe
  2⤵
  PID:5176
- C:\Windows\System\XGPHcaA.exe
  C:\Windows\System\XGPHcaA.exe
  2⤵
  PID:5204
- C:\Windows\System\hvJyqFE.exe
  C:\Windows\System\hvJyqFE.exe
  2⤵
  PID:5232
- C:\Windows\System\EuVBSFE.exe
  C:\Windows\System\EuVBSFE.exe
  2⤵
  PID:5260
- C:\Windows\System\EKWudxz.exe
  C:\Windows\System\EKWudxz.exe
  2⤵
  PID:5284
- C:\Windows\System\FcAtyMq.exe
  C:\Windows\System\FcAtyMq.exe
  2⤵
  PID:5316
- C:\Windows\System\dhjwZsC.exe
  C:\Windows\System\dhjwZsC.exe
  2⤵
  PID:5344
- C:\Windows\System\HcGLOFW.exe
  C:\Windows\System\HcGLOFW.exe
  2⤵
  PID:5368
- C:\Windows\System\UtSyida.exe
  C:\Windows\System\UtSyida.exe
  2⤵
  PID:5404
- C:\Windows\System\xcZvNwN.exe
  C:\Windows\System\xcZvNwN.exe
  2⤵
  PID:5428
- C:\Windows\System\ZyqJSOG.exe
  C:\Windows\System\ZyqJSOG.exe
  2⤵
  PID:5456
- C:\Windows\System\sUiVHuj.exe
  C:\Windows\System\sUiVHuj.exe
  2⤵
  PID:5484
- C:\Windows\System\Iuajwdo.exe
  C:\Windows\System\Iuajwdo.exe
  2⤵
  PID:5508
- C:\Windows\System\HoBNSXz.exe
  C:\Windows\System\HoBNSXz.exe
  2⤵
  PID:5540
- C:\Windows\System\WugIdDK.exe
  C:\Windows\System\WugIdDK.exe
  2⤵
  PID:5568
- C:\Windows\System\jddvLPD.exe
  C:\Windows\System\jddvLPD.exe
  2⤵
  PID:5592
- C:\Windows\System\QtAhBaG.exe
  C:\Windows\System\QtAhBaG.exe
  2⤵
  PID:5624
- C:\Windows\System\KuJrruU.exe
  C:\Windows\System\KuJrruU.exe
  2⤵
  PID:5664
- C:\Windows\System\iwOjThv.exe
  C:\Windows\System\iwOjThv.exe
  2⤵
  PID:5688
- C:\Windows\System\KbaLxha.exe
  C:\Windows\System\KbaLxha.exe
  2⤵
  PID:5720
- C:\Windows\System\aPvGPIf.exe
  C:\Windows\System\aPvGPIf.exe
  2⤵
  PID:5736
- C:\Windows\System\iPwXfzQ.exe
  C:\Windows\System\iPwXfzQ.exe
  2⤵
  PID:5764
- C:\Windows\System\NTuXVcZ.exe
  C:\Windows\System\NTuXVcZ.exe
  2⤵
  PID:5792
- C:\Windows\System\iJhfEBf.exe
  C:\Windows\System\iJhfEBf.exe
  2⤵
  PID:5820
- C:\Windows\System\nKIMHoK.exe
  C:\Windows\System\nKIMHoK.exe
  2⤵
  PID:5844
- C:\Windows\System\XPIhPWf.exe
  C:\Windows\System\XPIhPWf.exe
  2⤵
  PID:5876
- C:\Windows\System\SIsRjLj.exe
  C:\Windows\System\SIsRjLj.exe
  2⤵
  PID:5904
- C:\Windows\System\kWTAuNL.exe
  C:\Windows\System\kWTAuNL.exe
  2⤵
  PID:5932
- C:\Windows\System\oYVdbFP.exe
  C:\Windows\System\oYVdbFP.exe
  2⤵
  PID:5960
- C:\Windows\System\nzEfsfx.exe
  C:\Windows\System\nzEfsfx.exe
  2⤵
  PID:5988
- C:\Windows\System\oCSTnNA.exe
  C:\Windows\System\oCSTnNA.exe
  2⤵
  PID:6016
- C:\Windows\System\McfmgZs.exe
  C:\Windows\System\McfmgZs.exe
  2⤵
  PID:6040
- C:\Windows\System\qSamzTL.exe
  C:\Windows\System\qSamzTL.exe
  2⤵
  PID:6068
- C:\Windows\System\VjnzAMe.exe
  C:\Windows\System\VjnzAMe.exe
  2⤵
  PID:6100
- C:\Windows\System\eRAtqVM.exe
  C:\Windows\System\eRAtqVM.exe
  2⤵
  PID:6124
- C:\Windows\System\UtfcKET.exe
  C:\Windows\System\UtfcKET.exe
  2⤵
  PID:5020
- C:\Windows\System\YGmvfqk.exe
  C:\Windows\System\YGmvfqk.exe
  2⤵
  PID:4712
- C:\Windows\System\OXtMzLj.exe
  C:\Windows\System\OXtMzLj.exe
  2⤵
  PID:1456
- C:\Windows\System\DFYepFr.exe
  C:\Windows\System\DFYepFr.exe
  2⤵
  PID:3328
- C:\Windows\System\ZSfCPcs.exe
  C:\Windows\System\ZSfCPcs.exe
  2⤵
  PID:4524
- C:\Windows\System\AyGpNYo.exe
  C:\Windows\System\AyGpNYo.exe
  2⤵
  PID:800
- C:\Windows\System\eahXWzJ.exe
  C:\Windows\System\eahXWzJ.exe
  2⤵
  PID:4152
- C:\Windows\System\gdIFyEb.exe
  C:\Windows\System\gdIFyEb.exe
  2⤵
  PID:5140
- C:\Windows\System\zkUSCGL.exe
  C:\Windows\System\zkUSCGL.exe
  2⤵
  PID:5192
- C:\Windows\System\pawwIEs.exe
  C:\Windows\System\pawwIEs.exe
  2⤵
  PID:5252
- C:\Windows\System\gpObaOj.exe
  C:\Windows\System\gpObaOj.exe
  2⤵
  PID:5308
- C:\Windows\System\oARAlqr.exe
  C:\Windows\System\oARAlqr.exe
  2⤵
  PID:5384
- C:\Windows\System\lCyBuGs.exe
  C:\Windows\System\lCyBuGs.exe
  2⤵
  PID:5444
- C:\Windows\System\gxZJitF.exe
  C:\Windows\System\gxZJitF.exe
  2⤵
  PID:5496
- C:\Windows\System\OjFIIfR.exe
  C:\Windows\System\OjFIIfR.exe
  2⤵
  PID:1360
- C:\Windows\System\wHMaMkk.exe
  C:\Windows\System\wHMaMkk.exe
  2⤵
  PID:3492
- C:\Windows\System\RHDFMsy.exe
  C:\Windows\System\RHDFMsy.exe
  2⤵
  PID:5656
- C:\Windows\System\WRztygK.exe
  C:\Windows\System\WRztygK.exe
  2⤵
  PID:5708
- C:\Windows\System\pRBBLBr.exe
  C:\Windows\System\pRBBLBr.exe
  2⤵
  PID:5776
- C:\Windows\System\pdJAXOK.exe
  C:\Windows\System\pdJAXOK.exe
  2⤵
  PID:5836
- C:\Windows\System\BwxSMgP.exe
  C:\Windows\System\BwxSMgP.exe
  2⤵
  PID:5892
- C:\Windows\System\VMvjIDN.exe
  C:\Windows\System\VMvjIDN.exe
  2⤵
  PID:5972
- C:\Windows\System\hVNsxJq.exe
  C:\Windows\System\hVNsxJq.exe
  2⤵
  PID:6032
- C:\Windows\System\ZIXtYFk.exe
  C:\Windows\System\ZIXtYFk.exe
  2⤵
  PID:6088
- C:\Windows\System\RoXpwSv.exe
  C:\Windows\System\RoXpwSv.exe
  2⤵
  PID:3520
- C:\Windows\System\HpZkVgU.exe
  C:\Windows\System\HpZkVgU.exe
  2⤵
  PID:4136
- C:\Windows\System\IYvgdJV.exe
  C:\Windows\System\IYvgdJV.exe
  2⤵
  PID:1784
- C:\Windows\System\JlYFmgt.exe
  C:\Windows\System\JlYFmgt.exe
  2⤵
  PID:4316
- C:\Windows\System\hoUqLIY.exe
  C:\Windows\System\hoUqLIY.exe
  2⤵
  PID:3636
- C:\Windows\System\WMiGRoG.exe
  C:\Windows\System\WMiGRoG.exe
  2⤵
  PID:5304
- C:\Windows\System\qpngZHF.exe
  C:\Windows\System\qpngZHF.exe
  2⤵
  PID:5424
- C:\Windows\System\uKTQGhX.exe
  C:\Windows\System\uKTQGhX.exe
  2⤵
  PID:5532
- C:\Windows\System\TMfJipF.exe
  C:\Windows\System\TMfJipF.exe
  2⤵
  PID:5640
- C:\Windows\System\QQGnbqZ.exe
  C:\Windows\System\QQGnbqZ.exe
  2⤵
  PID:5748
- C:\Windows\System\KUdkubk.exe
  C:\Windows\System\KUdkubk.exe
  2⤵
  PID:5868
- C:\Windows\System\lNGgihQ.exe
  C:\Windows\System\lNGgihQ.exe
  2⤵
  PID:5948
- C:\Windows\System\vwUXySe.exe
  C:\Windows\System\vwUXySe.exe
  2⤵
  PID:4988
- C:\Windows\System\OEcxzWf.exe
  C:\Windows\System\OEcxzWf.exe
  2⤵
  PID:1464
- C:\Windows\System\fpmzBSC.exe
  C:\Windows\System\fpmzBSC.exe
  2⤵
  PID:2568
- C:\Windows\System\QHejADx.exe
  C:\Windows\System\QHejADx.exe
  2⤵
  PID:4596
- C:\Windows\System\PdOgPlI.exe
  C:\Windows\System\PdOgPlI.exe
  2⤵
  PID:5528
- C:\Windows\System\aWqkMNg.exe
  C:\Windows\System\aWqkMNg.exe
  2⤵
  PID:6148
- C:\Windows\System\UEqGHhm.exe
  C:\Windows\System\UEqGHhm.exe
  2⤵
  PID:6176
- C:\Windows\System\QdrVsqR.exe
  C:\Windows\System\QdrVsqR.exe
  2⤵
  PID:6204
- C:\Windows\System\JMUCNxz.exe
  C:\Windows\System\JMUCNxz.exe
  2⤵
  PID:6232
- C:\Windows\System\wzDxPKP.exe
  C:\Windows\System\wzDxPKP.exe
  2⤵
  PID:6264
- C:\Windows\System\qLVDlHe.exe
  C:\Windows\System\qLVDlHe.exe
  2⤵
  PID:6288
- C:\Windows\System\DpUjsOa.exe
  C:\Windows\System\DpUjsOa.exe
  2⤵
  PID:6320
- C:\Windows\System\iaFXClU.exe
  C:\Windows\System\iaFXClU.exe
  2⤵
  PID:6348
- C:\Windows\System\tmudtDM.exe
  C:\Windows\System\tmudtDM.exe
  2⤵
  PID:6376
- C:\Windows\System\aMQaPKQ.exe
  C:\Windows\System\aMQaPKQ.exe
  2⤵
  PID:6404
- C:\Windows\System\HGuiVKN.exe
  C:\Windows\System\HGuiVKN.exe
  2⤵
  PID:6432
- C:\Windows\System\AJYtLkt.exe
  C:\Windows\System\AJYtLkt.exe
  2⤵
  PID:6460
- C:\Windows\System\uYFpVGI.exe
  C:\Windows\System\uYFpVGI.exe
  2⤵
  PID:6488
- C:\Windows\System\GrcgYGL.exe
  C:\Windows\System\GrcgYGL.exe
  2⤵
  PID:6516
- C:\Windows\System\SBkEMDX.exe
  C:\Windows\System\SBkEMDX.exe
  2⤵
  PID:6544
- C:\Windows\System\JCkcBNa.exe
  C:\Windows\System\JCkcBNa.exe
  2⤵
  PID:6568
- C:\Windows\System\QzPwasy.exe
  C:\Windows\System\QzPwasy.exe
  2⤵
  PID:6596
- C:\Windows\System\bIHuzou.exe
  C:\Windows\System\bIHuzou.exe
  2⤵
  PID:6624
- C:\Windows\System\xoOGhuS.exe
  C:\Windows\System\xoOGhuS.exe
  2⤵
  PID:6652
- C:\Windows\System\NgRwmDE.exe
  C:\Windows\System\NgRwmDE.exe
  2⤵
  PID:6680
- C:\Windows\System\VCcmiov.exe
  C:\Windows\System\VCcmiov.exe
  2⤵
  PID:6708
- C:\Windows\System\YGddxrX.exe
  C:\Windows\System\YGddxrX.exe
  2⤵
  PID:6736
- C:\Windows\System\hgwbKhJ.exe
  C:\Windows\System\hgwbKhJ.exe
  2⤵
  PID:6764
- C:\Windows\System\TozVuFb.exe
  C:\Windows\System\TozVuFb.exe
  2⤵
  PID:6792
- C:\Windows\System\VDiGENz.exe
  C:\Windows\System\VDiGENz.exe
  2⤵
  PID:6820
- C:\Windows\System\EIyBdId.exe
  C:\Windows\System\EIyBdId.exe
  2⤵
  PID:6852
- C:\Windows\System\BXrttqy.exe
  C:\Windows\System\BXrttqy.exe
  2⤵
  PID:6876
- C:\Windows\System\TFFNale.exe
  C:\Windows\System\TFFNale.exe
  2⤵
  PID:6908
- C:\Windows\System\llhkarc.exe
  C:\Windows\System\llhkarc.exe
  2⤵
  PID:6932
- C:\Windows\System\uVTqOkP.exe
  C:\Windows\System\uVTqOkP.exe
  2⤵
  PID:6964
- C:\Windows\System\LUHJXfz.exe
  C:\Windows\System\LUHJXfz.exe
  2⤵
  PID:6992
- C:\Windows\System\IsxshIq.exe
  C:\Windows\System\IsxshIq.exe
  2⤵
  PID:7020
- C:\Windows\System\yyjyRmr.exe
  C:\Windows\System\yyjyRmr.exe
  2⤵
  PID:7048
- C:\Windows\System\olxcvso.exe
  C:\Windows\System\olxcvso.exe
  2⤵
  PID:7076
- C:\Windows\System\enOTBDe.exe
  C:\Windows\System\enOTBDe.exe
  2⤵
  PID:7100
- C:\Windows\System\MqsKuzc.exe
  C:\Windows\System\MqsKuzc.exe
  2⤵
  PID:7128
- C:\Windows\System\oFoLuYm.exe
  C:\Windows\System\oFoLuYm.exe
  2⤵
  PID:7156
- C:\Windows\System\WkYJLuK.exe
  C:\Windows\System\WkYJLuK.exe
  2⤵
  PID:4568
- C:\Windows\System\kkzxpSR.exe
  C:\Windows\System\kkzxpSR.exe
  2⤵
  PID:5024
- C:\Windows\System\RgYyauc.exe
  C:\Windows\System\RgYyauc.exe
  2⤵
  PID:4536
- C:\Windows\System\fuvrvjt.exe
  C:\Windows\System\fuvrvjt.exe
  2⤵
  PID:5068
- C:\Windows\System\mpVuRbQ.exe
  C:\Windows\System\mpVuRbQ.exe
  2⤵
  PID:5588
- C:\Windows\System\tmZbVYT.exe
  C:\Windows\System\tmZbVYT.exe
  2⤵
  PID:6192
- C:\Windows\System\TAeQKVI.exe
  C:\Windows\System\TAeQKVI.exe
  2⤵
  PID:2620
- C:\Windows\System\OdyXpSl.exe
  C:\Windows\System\OdyXpSl.exe
  2⤵
  PID:6276
- C:\Windows\System\xouqpZM.exe
  C:\Windows\System\xouqpZM.exe
  2⤵
  PID:2468
- C:\Windows\System\NOLvWfQ.exe
  C:\Windows\System\NOLvWfQ.exe
  2⤵
  PID:6360
- C:\Windows\System\UXQUZpz.exe
  C:\Windows\System\UXQUZpz.exe
  2⤵
  PID:6396
- C:\Windows\System\vAhElZC.exe
  C:\Windows\System\vAhElZC.exe
  2⤵
  PID:6452
- C:\Windows\System\jwbngng.exe
  C:\Windows\System\jwbngng.exe
  2⤵
  PID:6528
- C:\Windows\System\lrjVtff.exe
  C:\Windows\System\lrjVtff.exe
  2⤵
  PID:6588
- C:\Windows\System\rmJnDEA.exe
  C:\Windows\System\rmJnDEA.exe
  2⤵
  PID:6668
- C:\Windows\System\yGTIqja.exe
  C:\Windows\System\yGTIqja.exe
  2⤵
  PID:6724
- C:\Windows\System\MuXybQF.exe
  C:\Windows\System\MuXybQF.exe
  2⤵
  PID:6784
- C:\Windows\System\kEziOuf.exe
  C:\Windows\System\kEziOuf.exe
  2⤵
  PID:6844
- C:\Windows\System\eIesnIx.exe
  C:\Windows\System\eIesnIx.exe
  2⤵
  PID:6924
- C:\Windows\System\HDnNutt.exe
  C:\Windows\System\HDnNutt.exe
  2⤵
  PID:6984
- C:\Windows\System\lDtbaPm.exe
  C:\Windows\System\lDtbaPm.exe
  2⤵
  PID:7060
- C:\Windows\System\FSJlBap.exe
  C:\Windows\System\FSJlBap.exe
  2⤵
  PID:7120
- C:\Windows\System\lzgqZnL.exe
  C:\Windows\System\lzgqZnL.exe
  2⤵
  PID:2272
- C:\Windows\System\OmAVvxW.exe
  C:\Windows\System\OmAVvxW.exe
  2⤵
  PID:3020
- C:\Windows\System\lKwpkSa.exe
  C:\Windows\System\lKwpkSa.exe
  2⤵
  PID:5476
- C:\Windows\System\IXoAKtd.exe
  C:\Windows\System\IXoAKtd.exe
  2⤵
  PID:6220
- C:\Windows\System\SgTxBXc.exe
  C:\Windows\System\SgTxBXc.exe
  2⤵
  PID:4476
- C:\Windows\System\ruanSdu.exe
  C:\Windows\System\ruanSdu.exe
  2⤵
  PID:4204
- C:\Windows\System\HHKmnEV.exe
  C:\Windows\System\HHKmnEV.exe
  2⤵
  PID:4020
- C:\Windows\System\qEeBwpE.exe
  C:\Windows\System\qEeBwpE.exe
  2⤵
  PID:6620
- C:\Windows\System\hduBiow.exe
  C:\Windows\System\hduBiow.exe
  2⤵
  PID:6756
- C:\Windows\System\ZdApOMx.exe
  C:\Windows\System\ZdApOMx.exe
  2⤵
  PID:6892
- C:\Windows\System\JRSFdsi.exe
  C:\Windows\System\JRSFdsi.exe
  2⤵
  PID:1416
- C:\Windows\System\SOAyFgO.exe
  C:\Windows\System\SOAyFgO.exe
  2⤵
  PID:4796
- C:\Windows\System\avYKZUV.exe
  C:\Windows\System\avYKZUV.exe
  2⤵
  PID:2380
- C:\Windows\System\EBSGsBc.exe
  C:\Windows\System\EBSGsBc.exe
  2⤵
  PID:3824
- C:\Windows\System\MBPhvix.exe
  C:\Windows\System\MBPhvix.exe
  2⤵
  PID:4036
- C:\Windows\System\VdTYCob.exe
  C:\Windows\System\VdTYCob.exe
  2⤵
  PID:4920
- C:\Windows\System\ApWrRZN.exe
  C:\Windows\System\ApWrRZN.exe
  2⤵
  PID:6836
- C:\Windows\System\GxJlqyS.exe
  C:\Windows\System\GxJlqyS.exe
  2⤵
  PID:7032
- C:\Windows\System\UVdliqH.exe
  C:\Windows\System\UVdliqH.exe
  2⤵
  PID:2124
- C:\Windows\System\PgTgPHk.exe
  C:\Windows\System\PgTgPHk.exe
  2⤵
  PID:4092
- C:\Windows\System\yziGhLI.exe
  C:\Windows\System\yziGhLI.exe
  2⤵
  PID:6060
- C:\Windows\System\ozxYfCL.exe
  C:\Windows\System\ozxYfCL.exe
  2⤵
  PID:1104
- C:\Windows\System\IEQqOHE.exe
  C:\Windows\System\IEQqOHE.exe
  2⤵
  PID:908
- C:\Windows\System\trzzxGr.exe
  C:\Windows\System\trzzxGr.exe
  2⤵
  PID:1092
- C:\Windows\System\ULFbkSY.exe
  C:\Windows\System\ULFbkSY.exe
  2⤵
  PID:1544
- C:\Windows\System\ZuAyECU.exe
  C:\Windows\System\ZuAyECU.exe
  2⤵
  PID:1128
- C:\Windows\System\OHbAoVK.exe
  C:\Windows\System\OHbAoVK.exe
  2⤵
  PID:7180
- C:\Windows\System\qJeSSXP.exe
  C:\Windows\System\qJeSSXP.exe
  2⤵
  PID:7204
- C:\Windows\System\BEgRsOL.exe
  C:\Windows\System\BEgRsOL.exe
  2⤵
  PID:7244
- C:\Windows\System\WhXYZod.exe
  C:\Windows\System\WhXYZod.exe
  2⤵
  PID:7264
- C:\Windows\System\bxJOHDP.exe
  C:\Windows\System\bxJOHDP.exe
  2⤵
  PID:7288
- C:\Windows\System\umUBKaw.exe
  C:\Windows\System\umUBKaw.exe
  2⤵
  PID:7308
- C:\Windows\System\bsPxKry.exe
  C:\Windows\System\bsPxKry.exe
  2⤵
  PID:7328
- C:\Windows\System\PyPzrKg.exe
  C:\Windows\System\PyPzrKg.exe
  2⤵
  PID:7348
- C:\Windows\System\egZgzwE.exe
  C:\Windows\System\egZgzwE.exe
  2⤵
  PID:7368
- C:\Windows\System\YNdgTwz.exe
  C:\Windows\System\YNdgTwz.exe
  2⤵
  PID:7408
- C:\Windows\System\VeSdyBP.exe
  C:\Windows\System\VeSdyBP.exe
  2⤵
  PID:7436
- C:\Windows\System\nPVGDct.exe
  C:\Windows\System\nPVGDct.exe
  2⤵
  PID:7456
- C:\Windows\System\RESonIG.exe
  C:\Windows\System\RESonIG.exe
  2⤵
  PID:7520
- C:\Windows\System\rEXHqsM.exe
  C:\Windows\System\rEXHqsM.exe
  2⤵
  PID:7560
- C:\Windows\System\cBdrdEK.exe
  C:\Windows\System\cBdrdEK.exe
  2⤵
  PID:7584
- C:\Windows\System\GcQdGss.exe
  C:\Windows\System\GcQdGss.exe
  2⤵
  PID:7600
- C:\Windows\System\pafkncS.exe
  C:\Windows\System\pafkncS.exe
  2⤵
  PID:7640
- C:\Windows\System\lodketU.exe
  C:\Windows\System\lodketU.exe
  2⤵
  PID:7680
- C:\Windows\System\hhpRCyT.exe
  C:\Windows\System\hhpRCyT.exe
  2⤵
  PID:7700
- C:\Windows\System\gwnXNdm.exe
  C:\Windows\System\gwnXNdm.exe
  2⤵
  PID:7720
- C:\Windows\System\pvDjLFx.exe
  C:\Windows\System\pvDjLFx.exe
  2⤵
  PID:7748
- C:\Windows\System\QzijVli.exe
  C:\Windows\System\QzijVli.exe
  2⤵
  PID:7784
- C:\Windows\System\BspnkeF.exe
  C:\Windows\System\BspnkeF.exe
  2⤵
  PID:7800
- C:\Windows\System\lWXrbfG.exe
  C:\Windows\System\lWXrbfG.exe
  2⤵
  PID:7820
- C:\Windows\System\tUviXcw.exe
  C:\Windows\System\tUviXcw.exe
  2⤵
  PID:7848
- C:\Windows\System\AUZQwvl.exe
  C:\Windows\System\AUZQwvl.exe
  2⤵
  PID:7864
- C:\Windows\System\bTSZYbu.exe
  C:\Windows\System\bTSZYbu.exe
  2⤵
  PID:7884
- C:\Windows\System\vIWVvkC.exe
  C:\Windows\System\vIWVvkC.exe
  2⤵
  PID:7908
- C:\Windows\System\HUmvXOw.exe
  C:\Windows\System\HUmvXOw.exe
  2⤵
  PID:7952
- C:\Windows\System\CbTXGpH.exe
  C:\Windows\System\CbTXGpH.exe
  2⤵
  PID:7972
- C:\Windows\System\eLFQmuo.exe
  C:\Windows\System\eLFQmuo.exe
  2⤵
  PID:8016
- C:\Windows\System\fzTmSYv.exe
  C:\Windows\System\fzTmSYv.exe
  2⤵
  PID:8036
- C:\Windows\System\qrsbnnc.exe
  C:\Windows\System\qrsbnnc.exe
  2⤵
  PID:8056
- C:\Windows\System\wxDJVUT.exe
  C:\Windows\System\wxDJVUT.exe
  2⤵
  PID:8080
- C:\Windows\System\AUehGPk.exe
  C:\Windows\System\AUehGPk.exe
  2⤵
  PID:8104
- C:\Windows\System\WcoaTXN.exe
  C:\Windows\System\WcoaTXN.exe
  2⤵
  PID:8128
- C:\Windows\System\yNwixkY.exe
  C:\Windows\System\yNwixkY.exe
  2⤵
  PID:8148
- C:\Windows\System\FMCoBVg.exe
  C:\Windows\System\FMCoBVg.exe
  2⤵
  PID:2692
- C:\Windows\System\wJaWcWh.exe
  C:\Windows\System\wJaWcWh.exe
  2⤵
  PID:7092
- C:\Windows\System\bjLYkNQ.exe
  C:\Windows\System\bjLYkNQ.exe
  2⤵
  PID:7212
- C:\Windows\System\XQKKEWU.exe
  C:\Windows\System\XQKKEWU.exe
  2⤵
  PID:7360
- C:\Windows\System\VeBSARx.exe
  C:\Windows\System\VeBSARx.exe
  2⤵
  PID:7384
- C:\Windows\System\lQZEEsq.exe
  C:\Windows\System\lQZEEsq.exe
  2⤵
  PID:7428
- C:\Windows\System\QYIwhNb.exe
  C:\Windows\System\QYIwhNb.exe
  2⤵
  PID:7508
- C:\Windows\System\rasLeVG.exe
  C:\Windows\System\rasLeVG.exe
  2⤵
  PID:7596
- C:\Windows\System\PBBWWfl.exe
  C:\Windows\System\PBBWWfl.exe
  2⤵
  PID:7660
- C:\Windows\System\ylOPXEa.exe
  C:\Windows\System\ylOPXEa.exe
  2⤵
  PID:7712
- C:\Windows\System\XaYCUOn.exe
  C:\Windows\System\XaYCUOn.exe
  2⤵
  PID:7768
- C:\Windows\System\snjtODG.exe
  C:\Windows\System\snjtODG.exe
  2⤵
  PID:7816
- C:\Windows\System\qWLxFXD.exe
  C:\Windows\System\qWLxFXD.exe
  2⤵
  PID:7876
- C:\Windows\System\FdPmBiY.exe
  C:\Windows\System\FdPmBiY.exe
  2⤵
  PID:7896
- C:\Windows\System\GeuhNiz.exe
  C:\Windows\System\GeuhNiz.exe
  2⤵
  PID:7964
- C:\Windows\System\EFMIeEb.exe
  C:\Windows\System\EFMIeEb.exe
  2⤵
  PID:8052
- C:\Windows\System\OZwkQEo.exe
  C:\Windows\System\OZwkQEo.exe
  2⤵
  PID:8064
- C:\Windows\System\mUGunPh.exe
  C:\Windows\System\mUGunPh.exe
  2⤵
  PID:7272
- C:\Windows\System\nBsRXEN.exe
  C:\Windows\System\nBsRXEN.exe
  2⤵
  PID:7324
- C:\Windows\System\hXvQbkQ.exe
  C:\Windows\System\hXvQbkQ.exe
  2⤵
  PID:7688
- C:\Windows\System\ODFgLBF.exe
  C:\Windows\System\ODFgLBF.exe
  2⤵
  PID:7840
- C:\Windows\System\GVBlPtg.exe
  C:\Windows\System\GVBlPtg.exe
  2⤵
  PID:7984
- C:\Windows\System\IohDNfD.exe
  C:\Windows\System\IohDNfD.exe
  2⤵
  PID:7432
- C:\Windows\System\jXACBHa.exe
  C:\Windows\System\jXACBHa.exe
  2⤵
  PID:7672
- C:\Windows\System\avFVTqf.exe
  C:\Windows\System\avFVTqf.exe
  2⤵
  PID:8008
- C:\Windows\System\llMqlXd.exe
  C:\Windows\System\llMqlXd.exe
  2⤵
  PID:8184
- C:\Windows\System\TdLyitN.exe
  C:\Windows\System\TdLyitN.exe
  2⤵
  PID:8220
- C:\Windows\System\gFTGRmU.exe
  C:\Windows\System\gFTGRmU.exe
  2⤵
  PID:8244
- C:\Windows\System\hWmQllO.exe
  C:\Windows\System\hWmQllO.exe
  2⤵
  PID:8260
- C:\Windows\System\vNCbwyc.exe
  C:\Windows\System\vNCbwyc.exe
  2⤵
  PID:8280
- C:\Windows\System\CMpjpux.exe
  C:\Windows\System\CMpjpux.exe
  2⤵
  PID:8312
- C:\Windows\System\MtbvgiK.exe
  C:\Windows\System\MtbvgiK.exe
  2⤵
  PID:8344
- C:\Windows\System\kPcHdxV.exe
  C:\Windows\System\kPcHdxV.exe
  2⤵
  PID:8364
- C:\Windows\System\RCfwQuG.exe
  C:\Windows\System\RCfwQuG.exe
  2⤵
  PID:8388
- C:\Windows\System\PPwnviG.exe
  C:\Windows\System\PPwnviG.exe
  2⤵
  PID:8404
- C:\Windows\System\ldHTyDs.exe
  C:\Windows\System\ldHTyDs.exe
  2⤵
  PID:8480
- C:\Windows\System\DeVUmGX.exe
  C:\Windows\System\DeVUmGX.exe
  2⤵
  PID:8496
- C:\Windows\System\NEUzcur.exe
  C:\Windows\System\NEUzcur.exe
  2⤵
  PID:8512
- C:\Windows\System\UWRoHUN.exe
  C:\Windows\System\UWRoHUN.exe
  2⤵
  PID:8532
- C:\Windows\System\QuphCtB.exe
  C:\Windows\System\QuphCtB.exe
  2⤵
  PID:8556
- C:\Windows\System\YVlORfw.exe
  C:\Windows\System\YVlORfw.exe
  2⤵
  PID:8580
- C:\Windows\System\KnBzgnY.exe
  C:\Windows\System\KnBzgnY.exe
  2⤵
  PID:8616
- C:\Windows\System\NqobCyj.exe
  C:\Windows\System\NqobCyj.exe
  2⤵
  PID:8648
- C:\Windows\System\PVWVJpl.exe
  C:\Windows\System\PVWVJpl.exe
  2⤵
  PID:8684
- C:\Windows\System\cviYeMT.exe
  C:\Windows\System\cviYeMT.exe
  2⤵
  PID:8720
- C:\Windows\System\cPbPfyy.exe
  C:\Windows\System\cPbPfyy.exe
  2⤵
  PID:8740
- C:\Windows\System\YPcdNZu.exe
  C:\Windows\System\YPcdNZu.exe
  2⤵
  PID:8760
- C:\Windows\System\KVEZEFj.exe
  C:\Windows\System\KVEZEFj.exe
  2⤵
  PID:8796
- C:\Windows\System\zqYKXpJ.exe
  C:\Windows\System\zqYKXpJ.exe
  2⤵
  PID:8816
- C:\Windows\System\RTOBikn.exe
  C:\Windows\System\RTOBikn.exe
  2⤵
  PID:8844
- C:\Windows\System\FdDcsJv.exe
  C:\Windows\System\FdDcsJv.exe
  2⤵
  PID:8864
- C:\Windows\System\NCJAuqX.exe
  C:\Windows\System\NCJAuqX.exe
  2⤵
  PID:8888
- C:\Windows\System\owmOJzT.exe
  C:\Windows\System\owmOJzT.exe
  2⤵
  PID:8912
- C:\Windows\System\hPlUJJs.exe
  C:\Windows\System\hPlUJJs.exe
  2⤵
  PID:8928
- C:\Windows\System\vasJOux.exe
  C:\Windows\System\vasJOux.exe
  2⤵
  PID:8960
- C:\Windows\System\oXruhuh.exe
  C:\Windows\System\oXruhuh.exe
  2⤵
  PID:8984
- C:\Windows\System\lUDjYua.exe
  C:\Windows\System\lUDjYua.exe
  2⤵
  PID:9012
- C:\Windows\System\PCvpVJF.exe
  C:\Windows\System\PCvpVJF.exe
  2⤵
  PID:9076
- C:\Windows\System\iHZVtZt.exe
  C:\Windows\System\iHZVtZt.exe
  2⤵
  PID:9124
- C:\Windows\System\QOCZpGt.exe
  C:\Windows\System\QOCZpGt.exe
  2⤵
  PID:9140
- C:\Windows\System\ZpxjAHA.exe
  C:\Windows\System\ZpxjAHA.exe
  2⤵
  PID:9156
- C:\Windows\System\qKWMncl.exe
  C:\Windows\System\qKWMncl.exe
  2⤵
  PID:9176
- C:\Windows\System\UVWRpRW.exe
  C:\Windows\System\UVWRpRW.exe
  2⤵
  PID:7540
- C:\Windows\System\ILxiUyz.exe
  C:\Windows\System\ILxiUyz.exe
  2⤵
  PID:8196
- C:\Windows\System\gfXmjUG.exe
  C:\Windows\System\gfXmjUG.exe
  2⤵
  PID:8252
- C:\Windows\System\YzgZPpA.exe
  C:\Windows\System\YzgZPpA.exe
  2⤵
  PID:8288
- C:\Windows\System\xHhofKo.exe
  C:\Windows\System\xHhofKo.exe
  2⤵
  PID:8372
- C:\Windows\System\gMlUVtN.exe
  C:\Windows\System\gMlUVtN.exe
  2⤵
  PID:8376
- C:\Windows\System\xYRHFpq.exe
  C:\Windows\System\xYRHFpq.exe
  2⤵
  PID:8568
- C:\Windows\System\LmneZsg.exe
  C:\Windows\System\LmneZsg.exe
  2⤵
  PID:8528
- C:\Windows\System\YfJjezL.exe
  C:\Windows\System\YfJjezL.exe
  2⤵
  PID:8664
- C:\Windows\System\tflvGar.exe
  C:\Windows\System\tflvGar.exe
  2⤵
  PID:8708
- C:\Windows\System\cLOCKkB.exe
  C:\Windows\System\cLOCKkB.exe
  2⤵
  PID:8752
- C:\Windows\System\QdROEtA.exe
  C:\Windows\System\QdROEtA.exe
  2⤵
  PID:8808
- C:\Windows\System\nWTqVqe.exe
  C:\Windows\System\nWTqVqe.exe
  2⤵
  PID:8840
- C:\Windows\System\nXcTRuL.exe
  C:\Windows\System\nXcTRuL.exe
  2⤵
  PID:9004
- C:\Windows\System\EVBtBQk.exe
  C:\Windows\System\EVBtBQk.exe
  2⤵
  PID:9032
- C:\Windows\System\kwUoYLe.exe
  C:\Windows\System\kwUoYLe.exe
  2⤵
  PID:9060
- C:\Windows\System\JkvbgmM.exe
  C:\Windows\System\JkvbgmM.exe
  2⤵
  PID:9168
- C:\Windows\System\uVgYpat.exe
  C:\Windows\System\uVgYpat.exe
  2⤵
  PID:8240
- C:\Windows\System\LDyehsQ.exe
  C:\Windows\System\LDyehsQ.exe
  2⤵
  PID:8236
- C:\Windows\System\lHJplWh.exe
  C:\Windows\System\lHJplWh.exe
  2⤵
  PID:8524
- C:\Windows\System\uIVWISR.exe
  C:\Windows\System\uIVWISR.exe
  2⤵
  PID:8768
- C:\Windows\System\LvVNNCF.exe
  C:\Windows\System\LvVNNCF.exe
  2⤵
  PID:8940
- C:\Windows\System\jStrekD.exe
  C:\Windows\System\jStrekD.exe
  2⤵
  PID:8904
- C:\Windows\System\CVQLKiH.exe
  C:\Windows\System\CVQLKiH.exe
  2⤵
  PID:8492
- C:\Windows\System\IGpohPt.exe
  C:\Windows\System\IGpohPt.exe
  2⤵
  PID:8360
- C:\Windows\System\LqHVPXt.exe
  C:\Windows\System\LqHVPXt.exe
  2⤵
  PID:8612
- C:\Windows\System\pBsTSFx.exe
  C:\Windows\System\pBsTSFx.exe
  2⤵
  PID:8992
- C:\Windows\System\LWSdqYW.exe
  C:\Windows\System\LWSdqYW.exe
  2⤵
  PID:8352
- C:\Windows\System\jWAmrZX.exe
  C:\Windows\System\jWAmrZX.exe
  2⤵
  PID:9228
- C:\Windows\System\pFTdrzY.exe
  C:\Windows\System\pFTdrzY.exe
  2⤵
  PID:9244
- C:\Windows\System\pWWzEJt.exe
  C:\Windows\System\pWWzEJt.exe
  2⤵
  PID:9292
- C:\Windows\System\FfBnedp.exe
  C:\Windows\System\FfBnedp.exe
  2⤵
  PID:9316
- C:\Windows\System\icfReXY.exe
  C:\Windows\System\icfReXY.exe
  2⤵
  PID:9336
- C:\Windows\System\fUwltLh.exe
  C:\Windows\System\fUwltLh.exe
  2⤵
  PID:9372
- C:\Windows\System\hhyUKDg.exe
  C:\Windows\System\hhyUKDg.exe
  2⤵
  PID:9388
- C:\Windows\System\hbhszHb.exe
  C:\Windows\System\hbhszHb.exe
  2⤵
  PID:9420
- C:\Windows\System\BPeGScg.exe
  C:\Windows\System\BPeGScg.exe
  2⤵
  PID:9464
- C:\Windows\System\QPzNWSu.exe
  C:\Windows\System\QPzNWSu.exe
  2⤵
  PID:9480
- C:\Windows\System\rakshtc.exe
  C:\Windows\System\rakshtc.exe
  2⤵
  PID:9508
- C:\Windows\System\NouoQlZ.exe
  C:\Windows\System\NouoQlZ.exe
  2⤵
  PID:9532
- C:\Windows\System\QRRIZIM.exe
  C:\Windows\System\QRRIZIM.exe
  2⤵
  PID:9600
- C:\Windows\System\BnjSNvQ.exe
  C:\Windows\System\BnjSNvQ.exe
  2⤵
  PID:9620
- C:\Windows\System\FkEWupv.exe
  C:\Windows\System\FkEWupv.exe
  2⤵
  PID:9640
- C:\Windows\System\pYHoDiW.exe
  C:\Windows\System\pYHoDiW.exe
  2⤵
  PID:9688
- C:\Windows\System\mYmOFMS.exe
  C:\Windows\System\mYmOFMS.exe
  2⤵
  PID:9708
- C:\Windows\System\mmCYVtu.exe
  C:\Windows\System\mmCYVtu.exe
  2⤵
  PID:9728
- C:\Windows\System\lWtPGNa.exe
  C:\Windows\System\lWtPGNa.exe
  2⤵
  PID:9756
- C:\Windows\System\KPmOiJj.exe
  C:\Windows\System\KPmOiJj.exe
  2⤵
  PID:9772
- C:\Windows\System\QfRyTph.exe
  C:\Windows\System\QfRyTph.exe
  2⤵
  PID:9816
- C:\Windows\System\ElnmheG.exe
  C:\Windows\System\ElnmheG.exe
  2⤵
  PID:9836
- C:\Windows\System\GaHEWYu.exe
  C:\Windows\System\GaHEWYu.exe
  2⤵
  PID:9856
- C:\Windows\System\jkfMXIC.exe
  C:\Windows\System\jkfMXIC.exe
  2⤵
  PID:9888
- C:\Windows\System\LQKcofN.exe
  C:\Windows\System\LQKcofN.exe
  2⤵
  PID:9912
- C:\Windows\System\IIrcbYB.exe
  C:\Windows\System\IIrcbYB.exe
  2⤵
  PID:9928
- C:\Windows\System\VQGwKYF.exe
  C:\Windows\System\VQGwKYF.exe
  2⤵
  PID:9960
- C:\Windows\System\jRJtDNc.exe
  C:\Windows\System\jRJtDNc.exe
  2⤵
  PID:9988
- C:\Windows\System\iBibPgL.exe
  C:\Windows\System\iBibPgL.exe
  2⤵
  PID:10016
- C:\Windows\System\HgLWXjb.exe
  C:\Windows\System\HgLWXjb.exe
  2⤵
  PID:10036
- C:\Windows\System\RKMxQuI.exe
  C:\Windows\System\RKMxQuI.exe
  2⤵
  PID:10052
- C:\Windows\System\OZoGfhH.exe
  C:\Windows\System\OZoGfhH.exe
  2⤵
  PID:10076
- C:\Windows\System\amtXNUE.exe
  C:\Windows\System\amtXNUE.exe
  2⤵
  PID:10100
- C:\Windows\System\NCMmIsF.exe
  C:\Windows\System\NCMmIsF.exe
  2⤵
  PID:10132
- C:\Windows\System\Akdmzbi.exe
  C:\Windows\System\Akdmzbi.exe
  2⤵
  PID:10152
- C:\Windows\System\QVTJFpx.exe
  C:\Windows\System\QVTJFpx.exe
  2⤵
  PID:10188
- C:\Windows\System\ecBVteL.exe
  C:\Windows\System\ecBVteL.exe
  2⤵
  PID:10228
- C:\Windows\System\rXtZXhX.exe
  C:\Windows\System\rXtZXhX.exe
  2⤵
  PID:9184
- C:\Windows\System\iHsybyb.exe
  C:\Windows\System\iHsybyb.exe
  2⤵
  PID:9328
- C:\Windows\System\nnYNVKf.exe
  C:\Windows\System\nnYNVKf.exe
  2⤵
  PID:9396
- C:\Windows\System\eelbPsk.exe
  C:\Windows\System\eelbPsk.exe
  2⤵
  PID:9564
- C:\Windows\System\BAUFQjY.exe
  C:\Windows\System\BAUFQjY.exe
  2⤵
  PID:9460
- C:\Windows\System\uavNKvn.exe
  C:\Windows\System\uavNKvn.exe
  2⤵
  PID:9568
- C:\Windows\System\EkNlkHg.exe
  C:\Windows\System\EkNlkHg.exe
  2⤵
  PID:9676
- C:\Windows\System\IvIcEYl.exe
  C:\Windows\System\IvIcEYl.exe
  2⤵
  PID:9748
- C:\Windows\System\pcpEFtU.exe
  C:\Windows\System\pcpEFtU.exe
  2⤵
  PID:9824
- C:\Windows\System\kTjzQUL.exe
  C:\Windows\System\kTjzQUL.exe
  2⤵
  PID:9884
- C:\Windows\System\wrzJNTX.exe
  C:\Windows\System\wrzJNTX.exe
  2⤵
  PID:9924
- C:\Windows\System\lBkCaHG.exe
  C:\Windows\System\lBkCaHG.exe
  2⤵
  PID:9968
- C:\Windows\System\tEHLObU.exe
  C:\Windows\System\tEHLObU.exe
  2⤵
  PID:9984
- C:\Windows\System\LjFEJRp.exe
  C:\Windows\System\LjFEJRp.exe
  2⤵
  PID:10032
- C:\Windows\System\CwNtLjq.exe
  C:\Windows\System\CwNtLjq.exe
  2⤵
  PID:10072
- C:\Windows\System\vytqgao.exe
  C:\Windows\System\vytqgao.exe
  2⤵
  PID:10148
- C:\Windows\System\hDnjISM.exe
  C:\Windows\System\hDnjISM.exe
  2⤵
  PID:8272
- C:\Windows\System\cdVinCb.exe
  C:\Windows\System\cdVinCb.exe
  2⤵
  PID:9300
- C:\Windows\System\BAvrSuu.exe
  C:\Windows\System\BAvrSuu.exe
  2⤵
  PID:9444
- C:\Windows\System\jKZDcRV.exe
  C:\Windows\System\jKZDcRV.exe
  2⤵
  PID:9540
- C:\Windows\System\nUcgEDU.exe
  C:\Windows\System\nUcgEDU.exe
  2⤵
  PID:9764
- C:\Windows\System\KDUbRcK.exe
  C:\Windows\System\KDUbRcK.exe
  2⤵
  PID:9944
- C:\Windows\System\aBcUQuQ.exe
  C:\Windows\System\aBcUQuQ.exe
  2⤵
  PID:9952
- C:\Windows\System\fiZaTaL.exe
  C:\Windows\System\fiZaTaL.exe
  2⤵
  PID:10172
- C:\Windows\System\drcZJVp.exe
  C:\Windows\System\drcZJVp.exe
  2⤵
  PID:10248
- C:\Windows\System\RbPiDbS.exe
  C:\Windows\System\RbPiDbS.exe
  2⤵
  PID:10268
- C:\Windows\System\KbukWGQ.exe
  C:\Windows\System\KbukWGQ.exe
  2⤵
  PID:10288
- C:\Windows\System\UPcXlKW.exe
  C:\Windows\System\UPcXlKW.exe
  2⤵
  PID:10320
- C:\Windows\System\KZrjnCE.exe
  C:\Windows\System\KZrjnCE.exe
  2⤵
  PID:10372
- C:\Windows\System\XMIJaOF.exe
  C:\Windows\System\XMIJaOF.exe
  2⤵
  PID:10420
- C:\Windows\System\aDYlhDE.exe
  C:\Windows\System\aDYlhDE.exe
  2⤵
  PID:10440
- C:\Windows\System\StWhZwC.exe
  C:\Windows\System\StWhZwC.exe
  2⤵
  PID:10456
- C:\Windows\System\ImrPWBl.exe
  C:\Windows\System\ImrPWBl.exe
  2⤵
  PID:10492
- C:\Windows\System\pYTrgRL.exe
  C:\Windows\System\pYTrgRL.exe
  2⤵
  PID:10512
- C:\Windows\System\ibvQlAs.exe
  C:\Windows\System\ibvQlAs.exe
  2⤵
  PID:10544
- C:\Windows\System\kWsOWru.exe
  C:\Windows\System\kWsOWru.exe
  2⤵
  PID:10572
- C:\Windows\System\TDuZcrH.exe
  C:\Windows\System\TDuZcrH.exe
  2⤵
  PID:10592
- C:\Windows\System\NFJosWi.exe
  C:\Windows\System\NFJosWi.exe
  2⤵
  PID:10616
- C:\Windows\System\xRRaaYe.exe
  C:\Windows\System\xRRaaYe.exe
  2⤵
  PID:10672
- C:\Windows\System\YuGfcbq.exe
  C:\Windows\System\YuGfcbq.exe
  2⤵
  PID:10696
- C:\Windows\System\UjMrQbU.exe
  C:\Windows\System\UjMrQbU.exe
  2⤵
  PID:10716
- C:\Windows\System\VMzlYfM.exe
  C:\Windows\System\VMzlYfM.exe
  2⤵
  PID:10732
- C:\Windows\System\uskBpnJ.exe
  C:\Windows\System\uskBpnJ.exe
  2⤵
  PID:10780
- C:\Windows\System\JgSAkci.exe
  C:\Windows\System\JgSAkci.exe
  2⤵
  PID:10796
- C:\Windows\System\wfHNvUG.exe
  C:\Windows\System\wfHNvUG.exe
  2⤵
  PID:10908
- C:\Windows\System\rjqPFwW.exe
  C:\Windows\System\rjqPFwW.exe
  2⤵
  PID:10924
- C:\Windows\System\YoNAznz.exe
  C:\Windows\System\YoNAznz.exe
  2⤵
  PID:10940
- C:\Windows\System\kRjMCgW.exe
  C:\Windows\System\kRjMCgW.exe
  2⤵
  PID:10960
- C:\Windows\System\YVxcdkF.exe
  C:\Windows\System\YVxcdkF.exe
  2⤵
  PID:10976
- C:\Windows\System\RDKjzaG.exe
  C:\Windows\System\RDKjzaG.exe
  2⤵
  PID:10992
- C:\Windows\System\DNGbkNG.exe
  C:\Windows\System\DNGbkNG.exe
  2⤵
  PID:11008
- C:\Windows\System\WSvBkbY.exe
  C:\Windows\System\WSvBkbY.exe
  2⤵
  PID:11024
- C:\Windows\System\CbSexQq.exe
  C:\Windows\System\CbSexQq.exe
  2⤵
  PID:11040
- C:\Windows\System\gjsGrnQ.exe
  C:\Windows\System\gjsGrnQ.exe
  2⤵
  PID:11056
- C:\Windows\System\stVsHhn.exe
  C:\Windows\System\stVsHhn.exe
  2⤵
  PID:11072
- C:\Windows\System\xlVTqNM.exe
  C:\Windows\System\xlVTqNM.exe
  2⤵
  PID:11088
- C:\Windows\System\EVZuxSZ.exe
  C:\Windows\System\EVZuxSZ.exe
  2⤵
  PID:11104
- C:\Windows\System\EVRVWSA.exe
  C:\Windows\System\EVRVWSA.exe
  2⤵
  PID:11120
- C:\Windows\System\fHHjZqB.exe
  C:\Windows\System\fHHjZqB.exe
  2⤵
  PID:11136
- C:\Windows\System\QBNKvgL.exe
  C:\Windows\System\QBNKvgL.exe
  2⤵
  PID:11152
- C:\Windows\System\KXzRNVg.exe
  C:\Windows\System\KXzRNVg.exe
  2⤵
  PID:11168
- C:\Windows\System\JyxBudg.exe
  C:\Windows\System\JyxBudg.exe
  2⤵
  PID:11248
- C:\Windows\System\JJwwlAn.exe
  C:\Windows\System\JJwwlAn.exe
  2⤵
  PID:9864
- C:\Windows\System\LUYMydy.exe
  C:\Windows\System\LUYMydy.exe
  2⤵
  PID:10060
- C:\Windows\System\VnstSqb.exe
  C:\Windows\System\VnstSqb.exe
  2⤵
  PID:10004
- C:\Windows\System\hVbnQjD.exe
  C:\Windows\System\hVbnQjD.exe
  2⤵
  PID:10276
- C:\Windows\System\DXWtvcG.exe
  C:\Windows\System\DXWtvcG.exe
  2⤵
  PID:10312
- C:\Windows\System\sBgrmjl.exe
  C:\Windows\System\sBgrmjl.exe
  2⤵
  PID:10612
- C:\Windows\System\GeJwhkS.exe
  C:\Windows\System\GeJwhkS.exe
  2⤵
  PID:10680
- C:\Windows\System\tGcbnux.exe
  C:\Windows\System\tGcbnux.exe
  2⤵
  PID:10756
- C:\Windows\System\eLJjdNG.exe
  C:\Windows\System\eLJjdNG.exe
  2⤵
  PID:10872
- C:\Windows\System\wwToole.exe
  C:\Windows\System\wwToole.exe
  2⤵
  PID:10848
- C:\Windows\System\egDZHNX.exe
  C:\Windows\System\egDZHNX.exe
  2⤵
  PID:10900
- C:\Windows\System\Ijgbbrc.exe
  C:\Windows\System\Ijgbbrc.exe
  2⤵
  PID:11084
- C:\Windows\System\SJrINKG.exe
  C:\Windows\System\SJrINKG.exe
  2⤵
  PID:10400
- C:\Windows\System\FbErXhm.exe
  C:\Windows\System\FbErXhm.exe
  2⤵
  PID:10452
- C:\Windows\System\LWSGAgz.exe
  C:\Windows\System\LWSGAgz.exe
  2⤵
  PID:10728
- C:\Windows\System\gMcUoEk.exe
  C:\Windows\System\gMcUoEk.exe
  2⤵
  PID:10300
- C:\Windows\System\caiIhjd.exe
  C:\Windows\System\caiIhjd.exe
  2⤵
  PID:10552
- C:\Windows\System\ALHcyZj.exe
  C:\Windows\System\ALHcyZj.exe
  2⤵
  PID:10648
- C:\Windows\System\ZkATCKo.exe
  C:\Windows\System\ZkATCKo.exe
  2⤵
  PID:10968
- C:\Windows\System\AtVdqog.exe
  C:\Windows\System\AtVdqog.exe
  2⤵
  PID:10860
- C:\Windows\System\wMnGPvk.exe
  C:\Windows\System\wMnGPvk.exe
  2⤵
  PID:10988
- C:\Windows\System\lbEgImy.exe
  C:\Windows\System\lbEgImy.exe
  2⤵
  PID:11164
- C:\Windows\System\kCvWRjG.exe
  C:\Windows\System\kCvWRjG.exe
  2⤵
  PID:9616
- C:\Windows\System\qDtfANR.exe
  C:\Windows\System\qDtfANR.exe
  2⤵
  PID:10688
- C:\Windows\System\FzUayhM.exe
  C:\Windows\System\FzUayhM.exe
  2⤵
  PID:10828
- C:\Windows\System\BumHHEG.exe
  C:\Windows\System\BumHHEG.exe
  2⤵
  PID:11204
- C:\Windows\System\hQwxLEt.exe
  C:\Windows\System\hQwxLEt.exe
  2⤵
  PID:11048
- C:\Windows\System\ArXbtoK.exe
  C:\Windows\System\ArXbtoK.exe
  2⤵
  PID:856
- C:\Windows\System\kusneSP.exe
  C:\Windows\System\kusneSP.exe
  2⤵
  PID:10880
- C:\Windows\System\zHTkVtp.exe
  C:\Windows\System\zHTkVtp.exe
  2⤵
  PID:11284
- C:\Windows\System\DKszxxO.exe
  C:\Windows\System\DKszxxO.exe
  2⤵
  PID:11316
- C:\Windows\System\KisIVki.exe
  C:\Windows\System\KisIVki.exe
  2⤵
  PID:11332
- C:\Windows\System\DssFGwK.exe
  C:\Windows\System\DssFGwK.exe
  2⤵
  PID:11360
- C:\Windows\System\hbmDxvq.exe
  C:\Windows\System\hbmDxvq.exe
  2⤵
  PID:11400
- C:\Windows\System\mDxUmgm.exe
  C:\Windows\System\mDxUmgm.exe
  2⤵
  PID:11420
- C:\Windows\System\JYaHIJP.exe
  C:\Windows\System\JYaHIJP.exe
  2⤵
  PID:11440
- C:\Windows\System\paiUWrO.exe
  C:\Windows\System\paiUWrO.exe
  2⤵
  PID:11488
- C:\Windows\System\hMgakWV.exe
  C:\Windows\System\hMgakWV.exe
  2⤵
  PID:11516
- C:\Windows\System\ifHTAYq.exe
  C:\Windows\System\ifHTAYq.exe
  2⤵
  PID:11536
- C:\Windows\System\EvKMuHk.exe
  C:\Windows\System\EvKMuHk.exe
  2⤵
  PID:11552
- C:\Windows\System\cDEnJCm.exe
  C:\Windows\System\cDEnJCm.exe
  2⤵
  PID:11584
- C:\Windows\System\IbnvNxS.exe
  C:\Windows\System\IbnvNxS.exe
  2⤵
  PID:11604
- C:\Windows\System\YqoIGXs.exe
  C:\Windows\System\YqoIGXs.exe
  2⤵
  PID:11620
- C:\Windows\System\hZLKYQp.exe
  C:\Windows\System\hZLKYQp.exe
  2⤵
  PID:11636
- C:\Windows\System\prXnrRp.exe
  C:\Windows\System\prXnrRp.exe
  2⤵
  PID:11684
- C:\Windows\System\pYOjHMC.exe
  C:\Windows\System\pYOjHMC.exe
  2⤵
  PID:11708
- C:\Windows\System\NucpaPM.exe
  C:\Windows\System\NucpaPM.exe
  2⤵
  PID:11752
- C:\Windows\System\TkCTQzr.exe
  C:\Windows\System\TkCTQzr.exe
  2⤵
  PID:11772
- C:\Windows\System\auZAdEh.exe
  C:\Windows\System\auZAdEh.exe
  2⤵
  PID:11792
- C:\Windows\System\HjiVmvO.exe
  C:\Windows\System\HjiVmvO.exe
  2⤵
  PID:11836
- C:\Windows\System\xglCSLd.exe
  C:\Windows\System\xglCSLd.exe
  2⤵
  PID:11860
- C:\Windows\System\napAhMI.exe
  C:\Windows\System\napAhMI.exe
  2⤵
  PID:11884
- C:\Windows\System\cFDCpye.exe
  C:\Windows\System\cFDCpye.exe
  2⤵
  PID:11936
- C:\Windows\System\MPXeYob.exe
  C:\Windows\System\MPXeYob.exe
  2⤵
  PID:11964
- C:\Windows\System\xYibBbF.exe
  C:\Windows\System\xYibBbF.exe
  2⤵
  PID:12004
- C:\Windows\System\lEtkrWg.exe
  C:\Windows\System\lEtkrWg.exe
  2⤵
  PID:12020
- C:\Windows\System\ZdSRNPI.exe
  C:\Windows\System\ZdSRNPI.exe
  2⤵
  PID:12056
- C:\Windows\System\EKdpGhH.exe
  C:\Windows\System\EKdpGhH.exe
  2⤵
  PID:12076
- C:\Windows\System\nBziORT.exe
  C:\Windows\System\nBziORT.exe
  2⤵
  PID:12100
- C:\Windows\System\nRHgxEP.exe
  C:\Windows\System\nRHgxEP.exe
  2⤵
  PID:12120
- C:\Windows\System\VsBAHYg.exe
  C:\Windows\System\VsBAHYg.exe
  2⤵
  PID:12148
- C:\Windows\System\QCPcWVa.exe
  C:\Windows\System\QCPcWVa.exe
  2⤵
  PID:12188
- C:\Windows\System\mZfGcFJ.exe
  C:\Windows\System\mZfGcFJ.exe
  2⤵
  PID:12228
- C:\Windows\System\bwnvMHr.exe
  C:\Windows\System\bwnvMHr.exe
  2⤵
  PID:12260
- C:\Windows\System\WqmpfzY.exe
  C:\Windows\System\WqmpfzY.exe
  2⤵
  PID:12284
- C:\Windows\System\NUoWhYP.exe
  C:\Windows\System\NUoWhYP.exe
  2⤵
  PID:11272
- C:\Windows\System\YaNJYzI.exe
  C:\Windows\System\YaNJYzI.exe
  2⤵
  PID:11328
- C:\Windows\System\XDNbSDM.exe
  C:\Windows\System\XDNbSDM.exe
  2⤵
  PID:11392
- C:\Windows\System\gCnZAvW.exe
  C:\Windows\System\gCnZAvW.exe
  2⤵
  PID:2376
- C:\Windows\System\PjRjlUO.exe
  C:\Windows\System\PjRjlUO.exe
  2⤵
  PID:11480
- C:\Windows\System\eBlNDEv.exe
  C:\Windows\System\eBlNDEv.exe
  2⤵
  PID:11612
- C:\Windows\System\ZmLxDuw.exe
  C:\Windows\System\ZmLxDuw.exe
  2⤵
  PID:11600
- C:\Windows\System\LYMjvrj.exe
  C:\Windows\System\LYMjvrj.exe
  2⤵
  PID:11672
- C:\Windows\System\YLCpGQO.exe
  C:\Windows\System\YLCpGQO.exe
  2⤵
  PID:10560
- C:\Windows\System\dfYKFhd.exe
  C:\Windows\System\dfYKFhd.exe
  2⤵
  PID:64
- C:\Windows\System\AkGZktz.exe
  C:\Windows\System\AkGZktz.exe
  2⤵
  PID:11880
- C:\Windows\System\aWhEgbm.exe
  C:\Windows\System\aWhEgbm.exe
  2⤵
  PID:12000
- C:\Windows\System\ukjMENj.exe
  C:\Windows\System\ukjMENj.exe
  2⤵
  PID:12068
- C:\Windows\System\ceOiQwl.exe
  C:\Windows\System\ceOiQwl.exe
  2⤵
  PID:12108
- C:\Windows\System\PUZsncn.exe
  C:\Windows\System\PUZsncn.exe
  2⤵
  PID:12140
- C:\Windows\System\iYlgIVf.exe
  C:\Windows\System\iYlgIVf.exe
  2⤵
  PID:12280
- C:\Windows\System\JouLeaU.exe
  C:\Windows\System\JouLeaU.exe
  2⤵
  PID:11340
- C:\Windows\System\cJQnsQg.exe
  C:\Windows\System\cJQnsQg.exe
  2⤵
  PID:11576
- C:\Windows\System\sGFpLtP.exe
  C:\Windows\System\sGFpLtP.exe
  2⤵
  PID:11660
- C:\Windows\System\IYuBjqb.exe
  C:\Windows\System\IYuBjqb.exe
  2⤵
  PID:11764
- C:\Windows\System\JgJNYzs.exe
  C:\Windows\System\JgJNYzs.exe
  2⤵
  PID:12040
- C:\Windows\System\gZfVciq.exe
  C:\Windows\System\gZfVciq.exe
  2⤵
  PID:11876
- C:\Windows\System\PjabyDJ.exe
  C:\Windows\System\PjabyDJ.exe
  2⤵
  PID:12092
- C:\Windows\System\wOdOjHv.exe
  C:\Windows\System\wOdOjHv.exe
  2⤵
  PID:12244
- C:\Windows\System\scQvEKB.exe
  C:\Windows\System\scQvEKB.exe
  2⤵
  PID:11296
- C:\Windows\System\GLKlcpi.exe
  C:\Windows\System\GLKlcpi.exe
  2⤵
  PID:11768
- C:\Windows\System\qHzTlck.exe
  C:\Windows\System\qHzTlck.exe
  2⤵
  PID:12048
- C:\Windows\System\rZOWdXG.exe
  C:\Windows\System\rZOWdXG.exe
  2⤵
  PID:11592
- C:\Windows\System\HaQcmsd.exe
  C:\Windows\System\HaQcmsd.exe
  2⤵
  PID:12312
- C:\Windows\System\jRShgGW.exe
  C:\Windows\System\jRShgGW.exe
  2⤵
  PID:12368
- C:\Windows\System\rfcfunX.exe
  C:\Windows\System\rfcfunX.exe
  2⤵
  PID:12388
- C:\Windows\System\khMccxy.exe
  C:\Windows\System\khMccxy.exe
  2⤵
  PID:12412
- C:\Windows\System\ZfufPSt.exe
  C:\Windows\System\ZfufPSt.exe
  2⤵
  PID:12432
- C:\Windows\System\yHZSWsb.exe
  C:\Windows\System\yHZSWsb.exe
  2⤵
  PID:12456
- C:\Windows\System\JtBGqFq.exe
  C:\Windows\System\JtBGqFq.exe
  2⤵
  PID:12492
- C:\Windows\System\FhxgkyQ.exe
  C:\Windows\System\FhxgkyQ.exe
  2⤵
  PID:12516
- C:\Windows\System\fhzKHrp.exe
  C:\Windows\System\fhzKHrp.exe
  2⤵
  PID:12536
- C:\Windows\System\gkcrlsQ.exe
  C:\Windows\System\gkcrlsQ.exe
  2⤵
  PID:12564
- C:\Windows\System\OAksgqj.exe
  C:\Windows\System\OAksgqj.exe
  2⤵
  PID:12584
- C:\Windows\System\HWheGrx.exe
  C:\Windows\System\HWheGrx.exe
  2⤵
  PID:12624
- C:\Windows\System\zCZSfKV.exe
  C:\Windows\System\zCZSfKV.exe
  2⤵
  PID:12680
- C:\Windows\System\ptqFcou.exe
  C:\Windows\System\ptqFcou.exe
  2⤵
  PID:12700
- C:\Windows\System\NnzpZoU.exe
  C:\Windows\System\NnzpZoU.exe
  2⤵
  PID:12716
- C:\Windows\System\VKlUxwJ.exe
  C:\Windows\System\VKlUxwJ.exe
  2⤵
  PID:12744
- C:\Windows\System\vLQGZir.exe
  C:\Windows\System\vLQGZir.exe
  2⤵
  PID:12772
- C:\Windows\System\ameyGQx.exe
  C:\Windows\System\ameyGQx.exe
  2⤵
  PID:12796
- C:\Windows\System\VchXXrE.exe
  C:\Windows\System\VchXXrE.exe
  2⤵
  PID:12828
- C:\Windows\System\kNpetUG.exe
  C:\Windows\System\kNpetUG.exe
  2⤵
  PID:12848
- C:\Windows\System\aDZjxkp.exe
  C:\Windows\System\aDZjxkp.exe
  2⤵
  PID:12868
- C:\Windows\System\ZmlAtQN.exe
  C:\Windows\System\ZmlAtQN.exe
  2⤵
  PID:12912
- C:\Windows\System\gpWAxEN.exe
  C:\Windows\System\gpWAxEN.exe
  2⤵
  PID:12928
- C:\Windows\System\zUjNtVW.exe
  C:\Windows\System\zUjNtVW.exe
  2⤵
  PID:12968
- C:\Windows\System\inmXsnP.exe
  C:\Windows\System\inmXsnP.exe
  2⤵
  PID:12988
- C:\Windows\System\uGyhXiS.exe
  C:\Windows\System\uGyhXiS.exe
  2⤵
  PID:13028
- C:\Windows\System\QdAaHvQ.exe
  C:\Windows\System\QdAaHvQ.exe
  2⤵
  PID:13072
- C:\Windows\System\ieTlMtM.exe
  C:\Windows\System\ieTlMtM.exe
  2⤵
  PID:13092
- C:\Windows\System\aMRRwDI.exe
  C:\Windows\System\aMRRwDI.exe
  2⤵
  PID:13108
- C:\Windows\System\nZKGXiX.exe
  C:\Windows\System\nZKGXiX.exe
  2⤵
  PID:13128
- C:\Windows\System\BOucWal.exe
  C:\Windows\System\BOucWal.exe
  2⤵
  PID:13164
- C:\Windows\System\ZBOxdPo.exe
  C:\Windows\System\ZBOxdPo.exe
  2⤵
  PID:13184
- C:\Windows\System\RjrfMrK.exe
  C:\Windows\System\RjrfMrK.exe
  2⤵
  PID:13216
- C:\Windows\System\CAblIwZ.exe
  C:\Windows\System\CAblIwZ.exe
  2⤵
  PID:13236
- C:\Windows\System\LlfqJHC.exe
  C:\Windows\System\LlfqJHC.exe
  2⤵
  PID:13284
- C:\Windows\System\mFRBWZQ.exe
  C:\Windows\System\mFRBWZQ.exe
  2⤵
  PID:13308
- C:\Windows\System\lykRyHf.exe
  C:\Windows\System\lykRyHf.exe
  2⤵
  PID:12052
- C:\Windows\System\QIthhqy.exe
  C:\Windows\System\QIthhqy.exe
  2⤵
  PID:12328
- C:\Windows\System\UTpVDTF.exe
  C:\Windows\System\UTpVDTF.exe
  2⤵
  PID:12396
- C:\Windows\System\nbTBdPT.exe
  C:\Windows\System\nbTBdPT.exe
  2⤵
  PID:12500
- C:\Windows\System\dPuDnRl.exe
  C:\Windows\System\dPuDnRl.exe
  2⤵
  PID:12508
- C:\Windows\System\SpnsMcK.exe
  C:\Windows\System\SpnsMcK.exe
  2⤵
  PID:12608
- C:\Windows\System\PZZETrn.exe
  C:\Windows\System\PZZETrn.exe
  2⤵
  PID:12660
- C:\Windows\System\nZJZuzX.exe
  C:\Windows\System\nZJZuzX.exe
  2⤵
  PID:12756
- C:\Windows\System\rmvhdDI.exe
  C:\Windows\System\rmvhdDI.exe
  2⤵
  PID:12816
- C:\Windows\System\ZZPkLzR.exe
  C:\Windows\System\ZZPkLzR.exe
  2⤵
  PID:12924
- C:\Windows\System\TjhFSrd.exe
  C:\Windows\System\TjhFSrd.exe
  2⤵
  PID:13012
- C:\Windows\System\vivjclP.exe
  C:\Windows\System\vivjclP.exe
  2⤵
  PID:13040
- C:\Windows\System\UVYUcNY.exe
  C:\Windows\System\UVYUcNY.exe
  2⤵
  PID:13088
- C:\Windows\System\ZOeNlvt.exe
  C:\Windows\System\ZOeNlvt.exe
  2⤵
  PID:13176
- C:\Windows\System\LcyEFpK.exe
  C:\Windows\System\LcyEFpK.exe
  2⤵
  PID:13256
- C:\Windows\System\HcjbwPP.exe
  C:\Windows\System\HcjbwPP.exe
  2⤵
  PID:13252
- C:\Windows\System\iSCpzLs.exe
  C:\Windows\System\iSCpzLs.exe
  2⤵
  PID:13300
- C:\Windows\System\kxrbdHt.exe
  C:\Windows\System\kxrbdHt.exe
  2⤵
  PID:12116
- C:\Windows\System\oIxkKNl.exe
  C:\Windows\System\oIxkKNl.exe
  2⤵
  PID:12592
- C:\Windows\System\xjXcHlS.exe
  C:\Windows\System\xjXcHlS.exe
  2⤵
  PID:12736
- C:\Windows\System\bfhqrOm.exe
  C:\Windows\System\bfhqrOm.exe
  2⤵
  PID:12792
- C:\Windows\System\MeIzxoJ.exe
  C:\Windows\System\MeIzxoJ.exe
  2⤵
  PID:12952
- C:\Windows\System\PVMMTTR.exe
  C:\Windows\System\PVMMTTR.exe
  2⤵
  PID:13024
- C:\Windows\System\HCPFhFU.exe
  C:\Windows\System\HCPFhFU.exe
  2⤵
  PID:13080
- C:\Windows\System\OWCcCGq.exe
  C:\Windows\System\OWCcCGq.exe
  2⤵
  PID:12380
- C:\Windows\System\lubaQOE.exe
  C:\Windows\System\lubaQOE.exe
  2⤵
  PID:12652
- C:\Windows\System\YtkonDl.exe
  C:\Windows\System\YtkonDl.exe
  2⤵
  PID:4408
- C:\Windows\System\HPGCxVu.exe
  C:\Windows\System\HPGCxVu.exe
  2⤵
  PID:12420
- C:\Windows\System\CAwdZhC.exe
  C:\Windows\System\CAwdZhC.exe
  2⤵
  PID:12844
- C:\Windows\System\nRRtlXN.exe
  C:\Windows\System\nRRtlXN.exe
  2⤵
  PID:13324
- C:\Windows\System\uctWAjp.exe
  C:\Windows\System\uctWAjp.exe
  2⤵
  PID:13344
- C:\Windows\System\AghAwAR.exe
  C:\Windows\System\AghAwAR.exe
  2⤵
  PID:13392
- C:\Windows\System\fHKSjnm.exe
  C:\Windows\System\fHKSjnm.exe
  2⤵
  PID:13420
- C:\Windows\System\XrFgVpt.exe
  C:\Windows\System\XrFgVpt.exe
  2⤵
  PID:13436
- C:\Windows\System\BDxQhUA.exe
  C:\Windows\System\BDxQhUA.exe
  2⤵
  PID:13468
- C:\Windows\System\zyCshDs.exe
  C:\Windows\System\zyCshDs.exe
  2⤵
  PID:13500
- C:\Windows\System\nGBOlJJ.exe
  C:\Windows\System\nGBOlJJ.exe
  2⤵
  PID:13532
- C:\Windows\System\NHGdYvx.exe
  C:\Windows\System\NHGdYvx.exe
  2⤵
  PID:13552
- C:\Windows\System\IxiECpX.exe
  C:\Windows\System\IxiECpX.exe
  2⤵
  PID:13592
- C:\Windows\System\haBPEbi.exe
  C:\Windows\System\haBPEbi.exe
  2⤵
  PID:13620
- C:\Windows\System\yqDbTLn.exe
  C:\Windows\System\yqDbTLn.exe
  2⤵
  PID:13636
- C:\Windows\System\VGnOWzb.exe
  C:\Windows\System\VGnOWzb.exe
  2⤵
  PID:13668
- C:\Windows\System\cKkWljZ.exe
  C:\Windows\System\cKkWljZ.exe
  2⤵
  PID:13684
- C:\Windows\System\vnGdawG.exe
  C:\Windows\System\vnGdawG.exe
  2⤵
  PID:13708
- C:\Windows\System\eZYQvpB.exe
  C:\Windows\System\eZYQvpB.exe
  2⤵
  PID:13732
- C:\Windows\System\jrRqVxt.exe
  C:\Windows\System\jrRqVxt.exe
  2⤵
  PID:13788
- C:\Windows\System\IDDPRFy.exe
  C:\Windows\System\IDDPRFy.exe
  2⤵
  PID:13808
- C:\Windows\System\BVzuuLC.exe
  C:\Windows\System\BVzuuLC.exe
  2⤵
  PID:13836
- C:\Windows\System\tYxchUS.exe
  C:\Windows\System\tYxchUS.exe
  2⤵
  PID:13860
- C:\Windows\System\NYmeFVC.exe
  C:\Windows\System\NYmeFVC.exe
  2⤵
  PID:13880
- C:\Windows\System\mhTZTMY.exe
  C:\Windows\System\mhTZTMY.exe
  2⤵
  PID:13900
- C:\Windows\System\XzuMJRA.exe
  C:\Windows\System\XzuMJRA.exe
  2⤵
  PID:13928
- C:\Windows\System\vWrsrSg.exe
  C:\Windows\System\vWrsrSg.exe
  2⤵
  PID:13944
- C:\Windows\System\khrmqcr.exe
  C:\Windows\System\khrmqcr.exe
  2⤵
  PID:13984
- C:\Windows\System\oCqErJh.exe
  C:\Windows\System\oCqErJh.exe
  2⤵
  PID:14004
- C:\Windows\System\SdxexGT.exe
  C:\Windows\System\SdxexGT.exe
  2⤵
  PID:14032
- C:\Windows\System\bLBrLSI.exe
  C:\Windows\System\bLBrLSI.exe
  2⤵
  PID:14056
- C:\Windows\System\IzNboQe.exe
  C:\Windows\System\IzNboQe.exe
  2⤵
  PID:14080
- C:\Windows\System\PNdPhjF.exe
  C:\Windows\System\PNdPhjF.exe
  2⤵
  PID:14100
- C:\Windows\System\iUBHiIQ.exe
  C:\Windows\System\iUBHiIQ.exe
  2⤵
  PID:14172
- C:\Windows\System\QXyCWKT.exe
  C:\Windows\System\QXyCWKT.exe
  2⤵
  PID:14192
- C:\Windows\System\acMiRvj.exe
  C:\Windows\System\acMiRvj.exe
  2⤵
  PID:14224
- C:\Windows\System\lgypuIH.exe
  C:\Windows\System\lgypuIH.exe
  2⤵
  PID:14248
- C:\Windows\System\qUIanue.exe
  C:\Windows\System\qUIanue.exe
  2⤵
  PID:14304
- C:\Windows\System\WKxuJQC.exe
  C:\Windows\System\WKxuJQC.exe
  2⤵
  PID:14320
- C:\Windows\System\upIxKhY.exe
  C:\Windows\System\upIxKhY.exe
  2⤵
  PID:13320
- C:\Windows\System\ucVRRxM.exe
  C:\Windows\System\ucVRRxM.exe
  2⤵
  PID:13336
- C:\Windows\System\UlaVaxZ.exe
  C:\Windows\System\UlaVaxZ.exe
  2⤵
  PID:13388
- C:\Windows\System\rvEfZIP.exe
  C:\Windows\System\rvEfZIP.exe
  2⤵
  PID:13432
- C:\Windows\System\BaVqFeQ.exe
  C:\Windows\System\BaVqFeQ.exe
  2⤵
  PID:13496
- C:\Windows\System\iPyWulX.exe
  C:\Windows\System\iPyWulX.exe
  2⤵
  PID:13548
- C:\Windows\System\QEmVwHZ.exe
  C:\Windows\System\QEmVwHZ.exe
  2⤵
  PID:13692
- C:\Windows\System\VjHTOZN.exe
  C:\Windows\System\VjHTOZN.exe
  2⤵
  PID:13740
- C:\Windows\System\XCdBxbx.exe
  C:\Windows\System\XCdBxbx.exe
  2⤵
  PID:13784
- C:\Windows\System\qTxnGDK.exe
  C:\Windows\System\qTxnGDK.exe
  2⤵
  PID:13844
- C:\Windows\System\KRvDvTY.exe
  C:\Windows\System\KRvDvTY.exe
  2⤵
  PID:13868
- C:\Windows\System\ZIQRrLm.exe
  C:\Windows\System\ZIQRrLm.exe
  2⤵
  PID:13892
- C:\Windows\System\eQzKZRE.exe
  C:\Windows\System\eQzKZRE.exe
  2⤵
  PID:13960
- C:\Windows\System\BGAsrjL.exe
  C:\Windows\System\BGAsrjL.exe
  2⤵
  PID:14012
- C:\Windows\System\oIrpyYG.exe
  C:\Windows\System\oIrpyYG.exe
  2⤵
  PID:14064
- C:\Windows\System\ypWdOvv.exe
  C:\Windows\System\ypWdOvv.exe
  2⤵
  PID:14132
- C:\Windows\System\ZjwfTfO.exe
  C:\Windows\System\ZjwfTfO.exe
  2⤵
  PID:13196
- C:\Windows\System\PbmgnQa.exe
  C:\Windows\System\PbmgnQa.exe
  2⤵
  PID:14236
- C:\Windows\System\hEPcDCR.exe
  C:\Windows\System\hEPcDCR.exe
  2⤵
  PID:14300
- C:\Windows\System\OufLOqR.exe
  C:\Windows\System\OufLOqR.exe
  2⤵
  PID:13428
- C:\Windows\System\vnVDzZr.exe
  C:\Windows\System\vnVDzZr.exe
  2⤵
  PID:13544
- C:\Windows\System\IfKItDq.exe
  C:\Windows\System\IfKItDq.exe
  2⤵
  PID:13648
- C:\Windows\System\RLNxIhc.exe
  C:\Windows\System\RLNxIhc.exe
  2⤵
  PID:13852
- C:\Windows\System\badLfqd.exe
  C:\Windows\System\badLfqd.exe
  2⤵
  PID:14028
- C:\Windows\System\dsfuRkm.exe
  C:\Windows\System\dsfuRkm.exe
  2⤵
  PID:14048
- C:\Windows\System\KESYbdU.exe
  C:\Windows\System\KESYbdU.exe
  2⤵
  PID:13608
- C:\Windows\System\hcVJrAu.exe
  C:\Windows\System\hcVJrAu.exe
  2⤵
  PID:13936
- C:\Windows\System\JGWORKb.exe
  C:\Windows\System\JGWORKb.exe
  2⤵
  PID:14364
- C:\Windows\System\bFgcwvD.exe
  C:\Windows\System\bFgcwvD.exe
  2⤵
  PID:14388
- C:\Windows\System\nLythRT.exe
  C:\Windows\System\nLythRT.exe
  2⤵
  PID:14404
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14404 -s 168
    3⤵
    PID:14876
- C:\Windows\System\QwjLSrb.exe
  C:\Windows\System\QwjLSrb.exe
  2⤵
  PID:14420
- C:\Windows\System\xtoCMsL.exe
  C:\Windows\System\xtoCMsL.exe
  2⤵
  PID:14444
- C:\Windows\System\GleSMPc.exe
  C:\Windows\System\GleSMPc.exe
  2⤵
  PID:14464
- C:\Windows\System\WqadRBB.exe
  C:\Windows\System\WqadRBB.exe
  2⤵
  PID:14560
- C:\Windows\System\TYxjWiE.exe
  C:\Windows\System\TYxjWiE.exe
  2⤵
  PID:14580
- C:\Windows\System\zWnXJJf.exe
  C:\Windows\System\zWnXJJf.exe
  2⤵
  PID:14604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AjdtEUX.exe

Path C:\Windows\System\AjdtEUX.exe
Size 1.3MB
SHA256 be20531697df8e9db0442b4abef92bc58ba7b1f5ac03cf3f0d35ec11a4453fd5
MD5 20c93803d24abe82820ca88252d27d24
SHA1 db98f736f4de17639be79c62785461a08bed7c36
SHA512 d0da539f6706a81afb6d34f47a5bf322c287ea0cf0ac024424feaa3be6c4e0efe9d87641f64f8c998ba14c9dca06c3557501aec618d4323a58e557655b2ea30d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0r:ROdWCCi7/rahW/zaZT2Dv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Awadzug.exe

Path C:\Windows\System\Awadzug.exe
Size 1.3MB
SHA256 f64ceeb1b56ad8e25be8ac1fdcc2ab0dadb85c62a315db56d772bf603d45f024
MD5 1be465376928107a61f241aec6907255
SHA1 4d0cb0f2b3b0717619d151b659d98c5562296d4d
SHA512 ee570d2a9dcbdee667aa6e3a09a22a5faa84cbf5d736a3e2e915cced420366d1778c365f45ef91f8114226f989c378f6b3a5e4bfac9411a479e9313f6b8b1806
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0w:ROdWCCi7/rahW/zaZT2Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

BHKCWii.exe

Path C:\Windows\System\BHKCWii.exe
Size 1.3MB
SHA256 37fba85b20d451810b582dffb6274dc9369e42cecda3322256f6f8ccf0d82201
MD5 ddeba0b7f1212afe5d8b5d5a598540d8
SHA1 e264b93dec563a72396f4f18d7bde31f9a6a452a
SHA512 4e337b18196b9dd82b5363fc57919019c85cad2785aa631c407f2942d879f75686916c13a7295584e709635e2cd0bccf30eda01430af5f8f68ff01f883f4767d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0+:ROdWCCi7/rahW/zaZT2Dy
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCRqiVi.exe

Path C:\Windows\System\CCRqiVi.exe
Size 1.3MB
SHA256 9f0201c8b3cc5b36d0f13a2fbfaaa1a87a411a88a6143cfe50647d6fd6e58e0d
MD5 d53d26c5eba33b205df889067412262c
SHA1 d2de9e9db2254139d3d2600abcdec133ae974bca
SHA512 6593b2e5615d30eeafe850f3da62585b11572d1532eb25cc74bc3b0b0f331295f6450f221a99992f548e8ac1c2553bf195574d1c35ffb3346e4943c64e1f8682
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0v:ROdWCCi7/rahW/zaZT2DD
MD5 SHA1 SHA512 SSDEEP

Submit Download

CrWFacE.exe

Path C:\Windows\System\CrWFacE.exe
Size 1.3MB
SHA256 1587c3838748874835a2a3aa4f237a4c105d60ea7e62cef56ca73667305028af
MD5 0accd84b896de5a17f551da95b3e579f
SHA1 4b41d5d538e15600461be1f615f57599ad791cee
SHA512 b897de5e435cfeefbf88f870adae443643d8717b8f305b7688b94ade753028b0342c5a4f46c49775dee61a5a727df3a43f01725896a731ec2df175b95434dcc7
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0T:ROdWCCi7/rahW/zaZT2Dv
MD5 SHA1 SHA512 SSDEEP

Submit Download

DwzYOxA.exe

Path C:\Windows\System\DwzYOxA.exe
Size 1.3MB
SHA256 5a491aea9704a2203d0460711e90550ac914d8b4f88f74c402c64c0f89796138
MD5 970130a902312e8390e52763600f5e69
SHA1 38a65e5a3641e0c8104631d32d4b21def5cdcf9f
SHA512 8c526ba7c50a68527cc41baaa3312495416fd2ae2795bedb9a20cc997653516f18586b7de8ac7b46c0aada828147ed58e782f3613cf0e11af9b89f2e5239375f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0y:ROdWCCi7/rahW/zaZT2Dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

FJrycYB.exe

Path C:\Windows\System\FJrycYB.exe
Size 1.3MB
SHA256 403fd3ef2f74985269030eb1d805e673dca5740463fd5a57e395cf1a7bf8cfe7
MD5 c4e02a137dc65c5eccee14b220cd015b
SHA1 478ee020573f0d7f05c4c72e22227f8b96aea099
SHA512 2b144614641fe9e38d71fe6a8ddb43bbb56389c6fd3611a553cf8fce353ce8d1e18a97478cdeb26732a2b6a52899d18ff21afa8e64fce825454e4ee13b8d0080
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0d:ROdWCCi7/rahW/zaZT2DB
MD5 SHA1 SHA512 SSDEEP

Submit Download

IRofytp.exe

Path C:\Windows\System\IRofytp.exe
Size 1.3MB
SHA256 9a5e8c4116e9c536b278aee77a5c31750a7e2e13471c5e89df985b0c9d01cee5
MD5 ec9e952a73526775a97e6fad7c7df96d
SHA1 26e44f6c3f2fa5ae5ceea906b800aac1d0748dca
SHA512 dc6210530f848d67890fc895ea9b84819edcb00f38d9231b3de186a71ab0665b6063dbaa2057c592ab4b32223300ea2d248270b65f3bab3e525a4d89772d383d
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0a:ROdWCCi7/rahW/zaZT2De
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXDkMiI.exe

Path C:\Windows\System\IXDkMiI.exe
Size 1.3MB
SHA256 29e7421fef6bc290f502b30f4d48237188327bdb8f67ccf278627a1a38cf90c4
MD5 df3f3d208077acc8c5911c4a34b102ca
SHA1 f7826bf252ab30e374ed8f39528ea89cc22e8573
SHA512 e4bdedd2c45a90e34ee73c1b90c1eb1389537bf7b768f3282249d59d5dee8795bbb98fa22eb6e7fde522782933464881a50fc8b0e299413a4b1c615e49f09066
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0n:ROdWCCi7/rahW/zaZT2Dr
MD5 SHA1 SHA512 SSDEEP

Submit Download

IqNXrQT.exe

Path C:\Windows\System\IqNXrQT.exe
Size 1.3MB
SHA256 3b0bbe3215809e1de2cdaab847b05a3f9d90115af0b0e28e6d4b9205249624fe
MD5 12716a266d0d190882504b5bff17030f
SHA1 f21baf4259e8759e89be493b84b0407d9ccfc955
SHA512 5fc05c8a5a7972e5a5b74a23fa2af6d9fa68d6a442df36fbe6632806b526dd3520d97a6986c7c7497efd1543c18a603881ea13426f155401f4223198de65f666
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0r:ROdWCCi7/rahW/zaZT2D3
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPsAiuO.exe

Path C:\Windows\System\JPsAiuO.exe
Size 1.3MB
SHA256 bd03fc2984a90c523d8f88ab9871eca3f56dba60e308a7267e64588657de9bb7
MD5 d6d35bd2546cb7e519eefe756c4ec4dd
SHA1 b83a70151f3bf378fac549bb19b143a00b0f74db
SHA512 44d80d561d21c08984453697afa90bafcce65ca084c7746752bd24d5c151187a596288ed0891aa9806d29519d304ec2188e629a409a015034a12e351c8cca032
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0d:ROdWCCi7/rahW/zaZT2DR
MD5 SHA1 SHA512 SSDEEP

Submit Download

KLCtPhU.exe

Path C:\Windows\System\KLCtPhU.exe
Size 1.3MB
SHA256 f08a46ff233b5f3340fa0c24aeb983549d6d951a759e59c1967995e26c9d9143
MD5 87482c3e9260cdaf9b4f740d22b16f4e
SHA1 c43ea9722f78ed49f3387b43b7ba2d427899536c
SHA512 f99b419ad1d19da0cecd26dd7390e6644a55f987110966901bae73af6fea9bb2e683ae8ae57e9b3c2cefff460512cfea1764be73e47f43c2aca637fd47384403
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0I:ROdWCCi7/rahW/zaZT2D8
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJCYyxk.exe

Path C:\Windows\System\NJCYyxk.exe
Size 1.3MB
SHA256 50d79e5dc61a2c1f1f6847c067ec04f91b76b157fb9c0ef03d2b37074447f19c
MD5 dc6a2c3cc2aec7e57381adba6f977a17
SHA1 b62d3c898490a9b8e8ad77ee5d039b1deddcb30e
SHA512 249d1fc6fc4350771cf473e7b57505ec305d31991b5f135ed345533ff3652e1022a6ed54625808d5d91ec6e871b97bab525ce8dcace03f3989e80dffbe5bfbba
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0I:ROdWCCi7/rahW/zaZT2DU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PJMKCGe.exe

Path C:\Windows\System\PJMKCGe.exe
Size 1.3MB
SHA256 a4d42cdc892c6a6f0b7bca0f366a48cc1f4143d37963ebc41a83c8052c749594
MD5 14607647b98171b65dafeba8e0b7ca3a
SHA1 fdcb87fe5a6006f1db6fa20376e5937d8975cb66
SHA512 1cfed4ef0000375d3dd2a98b81a2c45372ee629e68894ad3ea824586e1afc8d33efcc861e18c2ea586090d267fab3c7432a218faa250dc2033284661f707b7fc
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0+:ROdWCCi7/rahW/zaZT2DK
MD5 SHA1 SHA512 SSDEEP

Submit Download

QMoJBYV.exe

Path C:\Windows\System\QMoJBYV.exe
Size 1.3MB
SHA256 408467e44392d51e62a805f543f4528c51212310da84664310fd4934ba70e53d
MD5 a651ef0849f9b36f3362dac93d7ca283
SHA1 2b57d3b7b35e946dd5bc640c338c86392748b1e5
SHA512 1d210e1e283d3f93e041af5dcd7b72f9071e2c282a99b9f9c72ef55a9a4ecf1303cea6cc4aa85c9dd366a21550c1157bdf505f3494ae118fed6086edc143ce99
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0Zy:ROdWCCi7/rahW/zaZT2Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnjRVyE.exe

Path C:\Windows\System\XnjRVyE.exe
Size 1.3MB
SHA256 f6a91e8e8bc57fbfb7bedf16a00665d950ae4b9ca39d4e7154672cb13fb3033a
MD5 3d172007d37c4ec023fb9ab8f16a5ba0
SHA1 5abc0c96dc378f8eaf091257ebe02dc6387e3c5f
SHA512 987a8e17e2850f8e204ec06ffed17ca72699a974d276dba2e85b0d7aff7404b8a5597d130306f0fddbebcdec904378202fd7e280a0710f4ac313e1afa9124717
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0A:ROdWCCi7/rahW/zaZT2Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

baJBZXr.exe

Path C:\Windows\System\baJBZXr.exe
Size 1.3MB
SHA256 f97d7779cd6fc3887d5214eb14660a246acf9caec5e1727b19f9216e502e43be
MD5 cf0fb71229f4a0940f204a8beec46baf
SHA1 3128808d624956fc2f2d5498c79f53cebc4626bc
SHA512 3c95b10dca3c5e776f9dfa44fb1487ba9dbc988e8815c0d99856f40310eb27844a8b3a909a4460ea139fbbf54dbd43337bba5d07d1e2110991a5f33586c8908a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0dL:ROdWCCi7/rahW/zaZT2DR
MD5 SHA1 SHA512 SSDEEP

Submit Download

efEccLp.exe

Path C:\Windows\System\efEccLp.exe
Size 1.3MB
SHA256 f152738a2a6b86aa76ce0bad671819a51b6a70517e5826f0efdca79ec3e009be
MD5 01d0773ef8a39e8802e2af62854b59fb
SHA1 913c0e79f67318b0eb50499da20dbc96a44227dc
SHA512 0e8463c172dda03872b24989a2846d0700a284d7d6d78981a6ce04fc7a953bbb3cffb1d93728eaf5b45d55ac3c4af4800033e2db731c80ec3dad3a1fdb7a7c88
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0A:ROdWCCi7/rahW/zaZT2Ds
MD5 SHA1 SHA512 SSDEEP

Submit Download

inpwRrS.exe

Path C:\Windows\System\inpwRrS.exe
Size 1.3MB
SHA256 537be43467e66067cf56a364fd182dca006297e28a9e203eb00a9d50c94d896f
MD5 a3d2b4042c320a3d92652601e499bd9e
SHA1 d5c21c1685792ff0092e53e10ba4c0d57ce70dd8
SHA512 e602000c9e48f68cddc1de316ba4647f46253cc5aae0d4049be8d84cb3bf3aadacf8b16789fde453c5baa7a4f9eb42736b07f203951322a9db01546e30bc8c33
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0R:ROdWCCi7/rahW/zaZT2DV
MD5 SHA1 SHA512 SSDEEP

Submit Download

kBdxOje.exe

Path C:\Windows\System\kBdxOje.exe
Size 1.3MB
SHA256 2d7bebcea4614a2d32196aadf294bca457493d8c66edf54bd8bc88b3d939d201
MD5 71211e881dcf537e49679d527f5e7223
SHA1 682dbeea09785f297b1b38b6b696dd9f76c2e35b
SHA512 1f7812be417c5e331de58df22ad9e5d35855f7f425534f77270222ad152b621558bfd28f00673712fa6c2ca507d8b1010d76424ba4a1ac9db9196b29d2076da6
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0N:ROdWCCi7/rahW/zaZT2DZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kYLZNgT.exe

Path C:\Windows\System\kYLZNgT.exe
Size 1.3MB
SHA256 2479cc617a88ce6e0a8173db5789703fec0f53292a0102b13d04498373956065
MD5 69fcaaa7cdcd6a7847c24f47c4f8e08b
SHA1 f1c88fab2b9f41e7e450092b79ee4520dea80a4a
SHA512 1ecf11855aa164d0aea8a0e21f397f5ccf52381352955e62a20094202e18fcea412a48ed53025468d66b3ee09e3951cba4bb55b9d2e0e76f8c46d2586ce9138b
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0j:ROdWCCi7/rahW/zaZT2DH
MD5 SHA1 SHA512 SSDEEP

Submit Download

khjXhMI.exe

Path C:\Windows\System\khjXhMI.exe
Size 1.3MB
SHA256 1302f952d33ce7dee3c0eea7c8778626b75f179e635fb0b9648a6d5188f08f5d
MD5 639c69b44f297ab9ec0378760d8ec5b3
SHA1 0c4474311798922417ae9630dc627f95e5c2f62d
SHA512 2c65577c7d60ecb871c46bafed141194c9c0ed8bb03d307e6f5455258dda781744053eb2ba1dade357005879780aba47013a593d32c33bdef491d276cd19b0d0
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0t3:ROdWCCi7/rahW/zaZT2Dl
MD5 SHA1 SHA512 SSDEEP

Submit Download

mEgVNMf.exe

Path C:\Windows\System\mEgVNMf.exe
Size 1.3MB
SHA256 b6c5e74f8c23da38e4aa34143519b57244c74e7e9aa506957200ba9976ad0166
MD5 39a52867731e178d641910011ecbf542
SHA1 b623674e9bf3bc5879d56a84550e74c7dc829ea3
SHA512 de308a4ee4ee97d46de47df4f2d9cae62977f301ca361f3b902bbb9afd68ec3969a9590da9518f14f7ecb8319a27bafb6cafdc2dd4b9c8909cab59408cd5c774
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0D:ROdWCCi7/rahW/zaZT2Dv
MD5 SHA1 SHA512 SSDEEP

Submit Download

oIVEfig.exe

Path C:\Windows\System\oIVEfig.exe
Size 1.3MB
SHA256 6ba2fd52dad4db743d613ded8b5a2941657797dbcfbbcb0b53a41fe0e54a1a75
MD5 f21b27146f2df895ba126c5a01ffd050
SHA1 a33cb88c41ce4a51986fa39cb882d57372845e97
SHA512 86dfd022a230a5ab51131ec2274a6b4770e48ab31d670b3332b07a72390c91e7a713ec71456084e6b64a4e5762b72e0e1e8dedccb5ac3a2fd7ccb3c97251080e
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0+:ROdWCCi7/rahW/zaZT2DK
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxzomQc.exe

Path C:\Windows\System\oxzomQc.exe
Size 1.3MB
SHA256 0c4fa96e311ad64926e7335ea1c79f0d526ac77a64a22c65775d1a312cec0d04
MD5 63005decf6ecd6742f222d9b9cb450e0
SHA1 8233b3be021611722f1adc057e026fb5fdab02d2
SHA512 12561cb676b0269ee8bc53b0215b4df49c69c53b8872e717cc39015957a8c452aaf52c18695ca73a6b794abcb9c8b0109b31fbf21d0b9b958eff00be93cb29a1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0T:ROdWCCi7/rahW/zaZT2Df
MD5 SHA1 SHA512 SSDEEP

Submit Download

qPdCJDO.exe

Path C:\Windows\System\qPdCJDO.exe
Size 1.3MB
SHA256 090a6707ecb00ba61b51b568190a6e1c9f630efef4635496802161bae5777869
MD5 7c03c4322019f250950d3a6e588d7016
SHA1 4f72c7a71ef32598314ab9b5b2d21c8aff97c256
SHA512 d3c124ca02a20568720fb12d47205339e3310549eac2375b7bd8ab75a971660c1a075429ce32896c5a48c5c5d373083e81de51e1b07233b4b9e3e28059472441
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0e:ROdWCCi7/rahW/zaZT2Dy
MD5 SHA1 SHA512 SSDEEP

Submit Download

qYbAajC.exe

Path C:\Windows\System\qYbAajC.exe
Size 1.3MB
SHA256 cce9777436851f60e303f80a5f814ad418ab5ef6f3d66c88d3a101a917079ab2
MD5 be3e6fc61bb99869340e949234cced68
SHA1 ff7bd2b52aa7b2b56c7de0c89bac677ed9e5f564
SHA512 b993e191946612f556643ec60db3ef914d8ada194c7f18c1d806d248d29918580d1e667830855f7ba1cc3d8c3d3ca8786ffb4620f31e6d154ad7c7c26d37193a
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0L:ROdWCCi7/rahW/zaZT2D/
MD5 SHA1 SHA512 SSDEEP

Submit Download

sDGyTfy.exe

Path C:\Windows\System\sDGyTfy.exe
Size 1.3MB
SHA256 8d4dd7ec3978f68693b13ada53fed5602410afb5220e2d2fcc6b11f88f64e9ff
MD5 a78bc2bbcbe74c0532c82d62b973f152
SHA1 8784e7aca80c1d3f4722e6241e23cdf051899761
SHA512 49049430e3c5f29796dca9b3d51b7e1128cc519b55d9cc34536d3c10e7105b450a89b8bbfa5add715c3705bc066dd2d56955eaaa8ef7230a0641a004c5ff4b66
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0T:ROdWCCi7/rahW/zaZT2DH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjYfqNG.exe

Path C:\Windows\System\wjYfqNG.exe
Size 1.3MB
SHA256 cbe9df482a4b118b1e3e1da1129a0c3f31fa29b490aa9e13fab34d92df197aef
MD5 e06797501f13b07bf75e2cbe034b3140
SHA1 6521eff37327399fc4e5d49fe401a151a362bde7
SHA512 85e3f5f5f89dc0a29048fa978b7369e3a4c82037c7de3a3c37390d2321ca5d70a6e7b001eee8e15aaa05740ace52199e452b355e83db6e4b163d49cfe93f875f
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0u:ROdWCCi7/rahW/zaZT2DS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yFgYmij.exe

Path C:\Windows\System\yFgYmij.exe
Size 1.3MB
SHA256 59ee3874749d49871f9900ddf86338703a24d2688bfaff63cb838ba9a0d3bf10
MD5 ab828e4ee13f8e6914c047e9ffccd02f
SHA1 70bc89f35a36e7c97877c350a670773bd41086ed
SHA512 9eeaa686fd45ce7d3d0990fdab7471bedf08a2cc609774c88a04635059ddfcae3f9fc89c3ad9240315c92a8eb280457a611a65e67151c371be5b7c165b39e86c
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0Q:ROdWCCi7/rahW/zaZT2DM
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuUCHgY.exe

Path C:\Windows\System\yuUCHgY.exe
Size 1.3MB
SHA256 c7beda0c00eb8c8ddc11b014f661f53f2c4ed3870e3e8e8942e6c4658e62e84f
MD5 f975e4a9883d74542b6327726ff7bbc7
SHA1 48884017ec813f02e44aad4558fcdba5021d5b7f
SHA512 f7689ff83cfea68a2f258ec5a9a26620dfb81e00bdb02d30be2cb8a7c6906f97b14325d3e7226d36f47fcf7a9632db530ee56123fdfafde99a516817085dccc1
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0rR:ROdWCCi7/rahW/zaZT2DHR
MD5 SHA1 SHA512 SSDEEP

Submit Download

zhPYVBs.exe

Path C:\Windows\System\zhPYVBs.exe
Size 1.3MB
SHA256 aeacf1ce092b1e621010d8664911837846f28511c63c4cdc4d59647679c374e4
MD5 60b1cbeb9b449fe1b58ec4ee08d68764
SHA1 118f0a6faae3d38abb3ebb3a9f9578b1f3a997e9
SHA512 18f2537c4b74e472abe7117386fe8ebdeab5a699ee272b7871741d0dbc7cf3bf3236e28d503bc290e37db5201dc80cc1f5909e0c39dbabba57ae865c6c327383
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0l:ROdWCCi7/rahW/zaZT2Dp
MD5 SHA1 SHA512 SSDEEP

Submit Download

zjWGzfP.exe

Path C:\Windows\System\zjWGzfP.exe
Size 1.3MB
SHA256 070ed13504a7178dc8669bbb340fca0ba915b815abf9d23b76dd65a25fc0d328
MD5 91703054e166cfe33d7e56612ea040c0
SHA1 16daa4a14ac8fea0947e71746de5a8247b875d81
SHA512 c9a6771859d95c1cf6b11bf937535048370fcf4804be722c99ec22eb4d28b4aa170bfe9f2d1faf89a21d8aaf4faedb78061d3f40afe0f47936c103e848505941
SSDEEP 24576:RVIl/WDGCi7/qkatXBF6727vrNaT/QoZo6TOZmkTziDG0R:ROdWCCi7/rahW/zaZT2Dl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-154-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp

Download

memory/208-51-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp

Download

memory/208-2388-0x00007FF7EF6E0000-0x00007FF7EFA31000-memory.dmp

Download

memory/400-196-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp

Download

memory/400-90-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp

Download

memory/400-2712-0x00007FF687C80000-0x00007FF687FD1000-memory.dmp

Download

memory/404-180-0x00007FF672700000-0x00007FF672A51000-memory.dmp

Download

memory/404-2427-0x00007FF672700000-0x00007FF672A51000-memory.dmp

Download

memory/404-2354-0x00007FF672700000-0x00007FF672A51000-memory.dmp

Download

memory/448-2408-0x00007FF656DE0000-0x00007FF657131000-memory.dmp

Download

memory/448-161-0x00007FF656DE0000-0x00007FF657131000-memory.dmp

Download

memory/448-2353-0x00007FF656DE0000-0x00007FF657131000-memory.dmp

Download

memory/684-45-0x00007FF7ED1E0000-0x00007FF7ED531000-memory.dmp

Download

memory/684-2395-0x00007FF7ED1E0000-0x00007FF7ED531000-memory.dmp

Download

memory/684-167-0x00007FF7ED1E0000-0x00007FF7ED531000-memory.dmp

Download

memory/1420-2314-0x00007FF71E730000-0x00007FF71EA81000-memory.dmp

Download

memory/1420-2418-0x00007FF71E730000-0x00007FF71EA81000-memory.dmp

Download

memory/1420-127-0x00007FF71E730000-0x00007FF71EA81000-memory.dmp

Download

memory/1796-2315-0x00007FF634C50000-0x00007FF634FA1000-memory.dmp

Download

memory/1796-2416-0x00007FF634C50000-0x00007FF634FA1000-memory.dmp

Download

memory/1796-138-0x00007FF634C50000-0x00007FF634FA1000-memory.dmp

Download

memory/1872-112-0x00007FF747A70000-0x00007FF747DC1000-memory.dmp

Download

memory/1872-2410-0x00007FF747A70000-0x00007FF747DC1000-memory.dmp

Download

memory/1928-160-0x00007FF695720000-0x00007FF695A71000-memory.dmp

Download

memory/1928-2412-0x00007FF695720000-0x00007FF695A71000-memory.dmp

Download

memory/2108-1508-0x00007FF696AA0000-0x00007FF696DF1000-memory.dmp

Download

memory/2108-111-0x00007FF696AA0000-0x00007FF696DF1000-memory.dmp

Download

memory/2108-2405-0x00007FF696AA0000-0x00007FF696DF1000-memory.dmp

Download

memory/2288-197-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp

Download

memory/2288-2403-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp

Download

memory/2288-95-0x00007FF779FC0000-0x00007FF77A311000-memory.dmp

Download

memory/2328-2356-0x00007FF79D7A0000-0x00007FF79DAF1000-memory.dmp

Download

memory/2328-187-0x00007FF79D7A0000-0x00007FF79DAF1000-memory.dmp

Download

memory/2328-2426-0x00007FF79D7A0000-0x00007FF79DAF1000-memory.dmp

Download

memory/2360-2421-0x00007FF714880000-0x00007FF714BD1000-memory.dmp

Download

memory/2360-121-0x00007FF714880000-0x00007FF714BD1000-memory.dmp

Download

memory/2632-24-0x00007FF760520000-0x00007FF760871000-memory.dmp

Download

memory/2632-2381-0x00007FF760520000-0x00007FF760871000-memory.dmp

Download

memory/2632-146-0x00007FF760520000-0x00007FF760871000-memory.dmp

Download

memory/2756-133-0x00007FF7527B0000-0x00007FF752B01000-memory.dmp

Download

memory/2756-2375-0x00007FF7527B0000-0x00007FF752B01000-memory.dmp

Download

memory/2756-13-0x00007FF7527B0000-0x00007FF752B01000-memory.dmp

Download

memory/2852-1501-0x00007FF78FB80000-0x00007FF78FED1000-memory.dmp

Download

memory/2852-2399-0x00007FF78FB80000-0x00007FF78FED1000-memory.dmp

Download

memory/2852-105-0x00007FF78FB80000-0x00007FF78FED1000-memory.dmp

Download

memory/2856-66-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp

Download

memory/2856-181-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp

Download

memory/2856-2389-0x00007FF7CB330000-0x00007FF7CB681000-memory.dmp

Download

memory/3476-2377-0x00007FF696C10000-0x00007FF696F61000-memory.dmp

Download

memory/3476-19-0x00007FF696C10000-0x00007FF696F61000-memory.dmp

Download

memory/3476-139-0x00007FF696C10000-0x00007FF696F61000-memory.dmp

Download

memory/3732-2385-0x00007FF7DEAB0000-0x00007FF7DEE01000-memory.dmp

Download

memory/3732-41-0x00007FF7DEAB0000-0x00007FF7DEE01000-memory.dmp

Download

memory/3732-153-0x00007FF7DEAB0000-0x00007FF7DEE01000-memory.dmp

Download

memory/3736-91-0x00007FF6ED960000-0x00007FF6EDCB1000-memory.dmp

Download

memory/3736-1500-0x00007FF6ED960000-0x00007FF6EDCB1000-memory.dmp

Download

memory/3736-2401-0x00007FF6ED960000-0x00007FF6EDCB1000-memory.dmp

Download

memory/3788-2383-0x00007FF7E8EB0000-0x00007FF7E9201000-memory.dmp

Download

memory/3788-61-0x00007FF7E8EB0000-0x00007FF7E9201000-memory.dmp

Download

memory/4048-2379-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp

Download

memory/4048-31-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp

Download

memory/4048-152-0x00007FF772C90000-0x00007FF772FE1000-memory.dmp

Download

memory/4412-2391-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp

Download

memory/4412-173-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp

Download

memory/4412-60-0x00007FF655D90000-0x00007FF6560E1000-memory.dmp

Download

memory/4764-2414-0x00007FF632CB0000-0x00007FF633001000-memory.dmp

Download

memory/4764-145-0x00007FF632CB0000-0x00007FF633001000-memory.dmp

Download

memory/4764-2316-0x00007FF632CB0000-0x00007FF633001000-memory.dmp

Download

memory/4780-71-0x00007FF690FC0000-0x00007FF691311000-memory.dmp

Download

memory/4780-188-0x00007FF690FC0000-0x00007FF691311000-memory.dmp

Download

memory/4780-2397-0x00007FF690FC0000-0x00007FF691311000-memory.dmp

Download

memory/4880-195-0x00007FF6936D0000-0x00007FF693A21000-memory.dmp

Download

memory/4880-2429-0x00007FF6936D0000-0x00007FF693A21000-memory.dmp

Download

memory/4952-0-0x00007FF6E85D0000-0x00007FF6E8921000-memory.dmp

Download

memory/4952-134-0x00007FF6E85D0000-0x00007FF6E8921000-memory.dmp

Download

memory/4952-1-0x0000028A53930000-0x0000028A53940000-memory.dmp

Download

memory/5032-174-0x00007FF60CEE0000-0x00007FF60D231000-memory.dmp

Download

memory/5032-2423-0x00007FF60CEE0000-0x00007FF60D231000-memory.dmp

Download

memory/5044-2393-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp

Download

memory/5044-189-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp

Download

memory/5044-84-0x00007FF66A470000-0x00007FF66A7C1000-memory.dmp

Download

memory/5076-2420-0x00007FF6B1D60000-0x00007FF6B20B1000-memory.dmp

Download

memory/5076-122-0x00007FF6B1D60000-0x00007FF6B20B1000-memory.dmp

Download

memory/5076-2313-0x00007FF6B1D60000-0x00007FF6B20B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads