xmrig | 2c7202e14a74f3012d074b4ac5e8070f06cce6960db83938d8cc691f0c440a5b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 16:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
Size

1.2MB
MD5

c8b962d20ac3c6c2e2939b3a36364b30
SHA1

d03dec041f433388d1aef1354bfe8990ed1bb8f5
SHA256

2c7202e14a74f3012d074b4ac5e8070f06cce6960db83938d8cc691f0c440a5b
SHA512

b471ab8936f19803e682d826180aa65a4fba32b0538c77033521d2b723f6732c8770eead447c48d55cfaf0e1aa74b9cda9f35753c3fdc06393009abbd9a5706a
SSDEEP

24576:RVIl/WDGCi7/qkat62wT83PzKgAm0PyFLb//e3XZXW+NguyN+UjygSef:ROdWCCi7/ra+GvAFnhyN1G0

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 61 IoCs

miner

resource	yara_rule
behavioral2/memory/3280-430-0x00007FF7E9A60000-0x00007FF7E9DB1000-memory.dmp	xmrig
behavioral2/memory/4140-779-0x00007FF79E5B0000-0x00007FF79E901000-memory.dmp	xmrig
behavioral2/memory/1456-889-0x00007FF602F70000-0x00007FF6032C1000-memory.dmp	xmrig
behavioral2/memory/744-1994-0x00007FF747DF0000-0x00007FF748141000-memory.dmp	xmrig
behavioral2/memory/3748-2098-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp	xmrig
behavioral2/memory/1284-2097-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp	xmrig
behavioral2/memory/4636-2099-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp	xmrig
behavioral2/memory/4844-2100-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp	xmrig
behavioral2/memory/4820-888-0x00007FF76F3A0000-0x00007FF76F6F1000-memory.dmp	xmrig
behavioral2/memory/2080-887-0x00007FF72BE40000-0x00007FF72C191000-memory.dmp	xmrig
behavioral2/memory/1984-886-0x00007FF670CE0000-0x00007FF671031000-memory.dmp	xmrig
behavioral2/memory/3604-885-0x00007FF76E430000-0x00007FF76E781000-memory.dmp	xmrig
behavioral2/memory/556-884-0x00007FF759C10000-0x00007FF759F61000-memory.dmp	xmrig
behavioral2/memory/4808-882-0x00007FF75FC70000-0x00007FF75FFC1000-memory.dmp	xmrig
behavioral2/memory/3356-881-0x00007FF7CDF50000-0x00007FF7CE2A1000-memory.dmp	xmrig
behavioral2/memory/3228-776-0x00007FF603100000-0x00007FF603451000-memory.dmp	xmrig
behavioral2/memory/1224-621-0x00007FF757D60000-0x00007FF7580B1000-memory.dmp	xmrig
behavioral2/memory/3952-613-0x00007FF7FE720000-0x00007FF7FEA71000-memory.dmp	xmrig
behavioral2/memory/2580-511-0x00007FF7AFBA0000-0x00007FF7AFEF1000-memory.dmp	xmrig
behavioral2/memory/4064-425-0x00007FF724510000-0x00007FF724861000-memory.dmp	xmrig
behavioral2/memory/2324-348-0x00007FF6B78B0000-0x00007FF6B7C01000-memory.dmp	xmrig
behavioral2/memory/2092-340-0x00007FF6F42C0000-0x00007FF6F4611000-memory.dmp	xmrig
behavioral2/memory/2576-284-0x00007FF62A080000-0x00007FF62A3D1000-memory.dmp	xmrig
behavioral2/memory/1020-229-0x00007FF6A6660000-0x00007FF6A69B1000-memory.dmp	xmrig
behavioral2/memory/1780-224-0x00007FF63D010000-0x00007FF63D361000-memory.dmp	xmrig
behavioral2/memory/3732-193-0x00007FF7B8370000-0x00007FF7B86C1000-memory.dmp	xmrig
behavioral2/memory/3044-2104-0x00007FF7EF0C0000-0x00007FF7EF411000-memory.dmp	xmrig
behavioral2/memory/3376-2108-0x00007FF721000000-0x00007FF721351000-memory.dmp	xmrig
behavioral2/memory/556-2114-0x00007FF759C10000-0x00007FF759F61000-memory.dmp	xmrig
behavioral2/memory/1852-2112-0x00007FF7F2730000-0x00007FF7F2A81000-memory.dmp	xmrig
behavioral2/memory/2576-2116-0x00007FF62A080000-0x00007FF62A3D1000-memory.dmp	xmrig
behavioral2/memory/4672-2110-0x00007FF7E2DF0000-0x00007FF7E3141000-memory.dmp	xmrig
behavioral2/memory/1780-2120-0x00007FF63D010000-0x00007FF63D361000-memory.dmp	xmrig
behavioral2/memory/1020-2124-0x00007FF6A6660000-0x00007FF6A69B1000-memory.dmp	xmrig
behavioral2/memory/2092-2128-0x00007FF6F42C0000-0x00007FF6F4611000-memory.dmp	xmrig
behavioral2/memory/1984-2132-0x00007FF670CE0000-0x00007FF671031000-memory.dmp	xmrig
behavioral2/memory/4820-2130-0x00007FF76F3A0000-0x00007FF76F6F1000-memory.dmp	xmrig
behavioral2/memory/4636-2126-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp	xmrig
behavioral2/memory/3952-2139-0x00007FF7FE720000-0x00007FF7FEA71000-memory.dmp	xmrig
behavioral2/memory/2324-2143-0x00007FF6B78B0000-0x00007FF6B7C01000-memory.dmp	xmrig
behavioral2/memory/1456-2142-0x00007FF602F70000-0x00007FF6032C1000-memory.dmp	xmrig
behavioral2/memory/3356-2150-0x00007FF7CDF50000-0x00007FF7CE2A1000-memory.dmp	xmrig
behavioral2/memory/1224-2158-0x00007FF757D60000-0x00007FF7580B1000-memory.dmp	xmrig
behavioral2/memory/4844-2163-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp	xmrig
behavioral2/memory/2580-2160-0x00007FF7AFBA0000-0x00007FF7AFEF1000-memory.dmp	xmrig
behavioral2/memory/4140-2170-0x00007FF79E5B0000-0x00007FF79E901000-memory.dmp	xmrig
behavioral2/memory/4808-2199-0x00007FF75FC70000-0x00007FF75FFC1000-memory.dmp	xmrig
behavioral2/memory/3228-2146-0x00007FF603100000-0x00007FF603451000-memory.dmp	xmrig
behavioral2/memory/4064-2147-0x00007FF724510000-0x00007FF724861000-memory.dmp	xmrig
behavioral2/memory/3280-2141-0x00007FF7E9A60000-0x00007FF7E9DB1000-memory.dmp	xmrig
behavioral2/memory/2080-2137-0x00007FF72BE40000-0x00007FF72C191000-memory.dmp	xmrig
behavioral2/memory/3604-2123-0x00007FF76E430000-0x00007FF76E781000-memory.dmp	xmrig
behavioral2/memory/3732-2118-0x00007FF7B8370000-0x00007FF7B86C1000-memory.dmp	xmrig
behavioral2/memory/3748-2106-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp	xmrig
behavioral2/memory/1284-2102-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp	xmrig
behavioral2/memory/1852-102-0x00007FF7F2730000-0x00007FF7F2A81000-memory.dmp	xmrig
behavioral2/memory/3376-80-0x00007FF721000000-0x00007FF721351000-memory.dmp	xmrig
behavioral2/memory/4672-73-0x00007FF7E2DF0000-0x00007FF7E3141000-memory.dmp	xmrig
behavioral2/memory/3044-57-0x00007FF7EF0C0000-0x00007FF7EF411000-memory.dmp	xmrig
behavioral2/memory/3748-30-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp	xmrig
behavioral2/memory/1284-13-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1284	bXUGGBR.exe
3748	Oaejyrl.exe
3044	mNvSDDh.exe
4672	GYAGYVP.exe
556	woyWFZf.exe
3376	PGfkDQR.exe
1852	qCANcld.exe
3604	KmKiOzM.exe
4636	BzAFYbn.exe
4844	FFiknUQ.exe
1984	RDuSzOE.exe
3732	AEpGUdZ.exe
1780	RoNsAwu.exe
1020	MpYOzbH.exe
2576	yJTDKQJ.exe
2092	JCsuDyv.exe
2080	hCqbfbh.exe
2324	klSrfCF.exe
4064	XMHDXiM.exe
3280	SaTclYU.exe
2580	zLnqgmN.exe
4820	XJZSTho.exe
3952	IVeFaxo.exe
1224	UsmUwpD.exe
3228	SkmQHqg.exe
4140	YQowRhN.exe
3356	ysPUYqH.exe
1456	BcQdXVc.exe
4808	SBByVjZ.exe
1700	mOJinjI.exe
564	oNJRJRl.exe
3252	LPRwoTf.exe
5116	piKbnhF.exe
5060	LakfYgd.exe
1988	BHrHBsA.exe
1404	uMsILYc.exe
3296	hmhuJAv.exe
3272	wjgRJKE.exe
5000	WvAZoxN.exe
5040	eFiRFjF.exe
2684	HFblpDf.exe
1096	vVUyvgb.exe
3036	pBCbPoV.exe
4968	tawSNxi.exe
4516	xGwEhGB.exe
1936	FWRLvsA.exe
4960	aXZvnKU.exe
2508	diBxifM.exe
1048	EiyQcHG.exe
4012	ViQgjSQ.exe
2472	iBBdvZY.exe
3444	ISGFuZF.exe
2728	syaEWpb.exe
2152	yxnjjHC.exe
2932	KvmSbDf.exe
2136	RvgOvUw.exe
4076	NSKIffX.exe
4500	oHvoCOu.exe
4724	bDWRsqw.exe
3408	osQacsW.exe
4856	hyApmXA.exe
116	WQhgxeY.exe
2708	fZjEioZ.exe
4476	QjaYUWh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/744-0-0x00007FF747DF0000-0x00007FF748141000-memory.dmp	upx
behavioral2/files/0x000b0000000232f0-6.dat	upx
behavioral2/files/0x0007000000023420-15.dat	upx
behavioral2/files/0x0007000000023431-93.dat	upx
behavioral2/memory/3280-430-0x00007FF7E9A60000-0x00007FF7E9DB1000-memory.dmp	upx
behavioral2/memory/4140-779-0x00007FF79E5B0000-0x00007FF79E901000-memory.dmp	upx
behavioral2/memory/1456-889-0x00007FF602F70000-0x00007FF6032C1000-memory.dmp	upx
behavioral2/memory/744-1994-0x00007FF747DF0000-0x00007FF748141000-memory.dmp	upx
behavioral2/memory/3748-2098-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp	upx
behavioral2/memory/1284-2097-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp	upx
behavioral2/memory/4636-2099-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp	upx
behavioral2/memory/4844-2100-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp	upx
behavioral2/memory/4820-888-0x00007FF76F3A0000-0x00007FF76F6F1000-memory.dmp	upx
behavioral2/memory/2080-887-0x00007FF72BE40000-0x00007FF72C191000-memory.dmp	upx
behavioral2/memory/1984-886-0x00007FF670CE0000-0x00007FF671031000-memory.dmp	upx
behavioral2/memory/3604-885-0x00007FF76E430000-0x00007FF76E781000-memory.dmp	upx
behavioral2/memory/556-884-0x00007FF759C10000-0x00007FF759F61000-memory.dmp	upx
behavioral2/memory/4808-882-0x00007FF75FC70000-0x00007FF75FFC1000-memory.dmp	upx
behavioral2/memory/3356-881-0x00007FF7CDF50000-0x00007FF7CE2A1000-memory.dmp	upx
behavioral2/memory/3228-776-0x00007FF603100000-0x00007FF603451000-memory.dmp	upx
behavioral2/memory/1224-621-0x00007FF757D60000-0x00007FF7580B1000-memory.dmp	upx
behavioral2/memory/3952-613-0x00007FF7FE720000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2580-511-0x00007FF7AFBA0000-0x00007FF7AFEF1000-memory.dmp	upx
behavioral2/memory/4064-425-0x00007FF724510000-0x00007FF724861000-memory.dmp	upx
behavioral2/memory/2324-348-0x00007FF6B78B0000-0x00007FF6B7C01000-memory.dmp	upx
behavioral2/memory/2092-340-0x00007FF6F42C0000-0x00007FF6F4611000-memory.dmp	upx
behavioral2/memory/2576-284-0x00007FF62A080000-0x00007FF62A3D1000-memory.dmp	upx
behavioral2/files/0x0007000000023445-198.dat	upx
behavioral2/memory/1020-229-0x00007FF6A6660000-0x00007FF6A69B1000-memory.dmp	upx
behavioral2/memory/1780-224-0x00007FF63D010000-0x00007FF63D361000-memory.dmp	upx
behavioral2/memory/3732-193-0x00007FF7B8370000-0x00007FF7B86C1000-memory.dmp	upx
behavioral2/files/0x0007000000023444-192.dat	upx
behavioral2/files/0x0007000000023438-189.dat	upx
behavioral2/files/0x0007000000023441-186.dat	upx
behavioral2/files/0x000700000002342e-175.dat	upx
behavioral2/files/0x000700000002343e-174.dat	upx
behavioral2/memory/3044-2104-0x00007FF7EF0C0000-0x00007FF7EF411000-memory.dmp	upx
behavioral2/memory/3376-2108-0x00007FF721000000-0x00007FF721351000-memory.dmp	upx
behavioral2/memory/556-2114-0x00007FF759C10000-0x00007FF759F61000-memory.dmp	upx
behavioral2/memory/1852-2112-0x00007FF7F2730000-0x00007FF7F2A81000-memory.dmp	upx
behavioral2/memory/2576-2116-0x00007FF62A080000-0x00007FF62A3D1000-memory.dmp	upx
behavioral2/memory/4672-2110-0x00007FF7E2DF0000-0x00007FF7E3141000-memory.dmp	upx
behavioral2/memory/1780-2120-0x00007FF63D010000-0x00007FF63D361000-memory.dmp	upx
behavioral2/memory/1020-2124-0x00007FF6A6660000-0x00007FF6A69B1000-memory.dmp	upx
behavioral2/memory/2092-2128-0x00007FF6F42C0000-0x00007FF6F4611000-memory.dmp	upx
behavioral2/memory/1984-2132-0x00007FF670CE0000-0x00007FF671031000-memory.dmp	upx
behavioral2/memory/4820-2130-0x00007FF76F3A0000-0x00007FF76F6F1000-memory.dmp	upx
behavioral2/memory/4636-2126-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp	upx
behavioral2/memory/3952-2139-0x00007FF7FE720000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2324-2143-0x00007FF6B78B0000-0x00007FF6B7C01000-memory.dmp	upx
behavioral2/memory/1456-2142-0x00007FF602F70000-0x00007FF6032C1000-memory.dmp	upx
behavioral2/memory/3356-2150-0x00007FF7CDF50000-0x00007FF7CE2A1000-memory.dmp	upx
behavioral2/memory/1224-2158-0x00007FF757D60000-0x00007FF7580B1000-memory.dmp	upx
behavioral2/memory/4844-2163-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp	upx
behavioral2/memory/2580-2160-0x00007FF7AFBA0000-0x00007FF7AFEF1000-memory.dmp	upx
behavioral2/memory/4140-2170-0x00007FF79E5B0000-0x00007FF79E901000-memory.dmp	upx
behavioral2/memory/4808-2199-0x00007FF75FC70000-0x00007FF75FFC1000-memory.dmp	upx
behavioral2/memory/3228-2146-0x00007FF603100000-0x00007FF603451000-memory.dmp	upx
behavioral2/memory/4064-2147-0x00007FF724510000-0x00007FF724861000-memory.dmp	upx
behavioral2/memory/3280-2141-0x00007FF7E9A60000-0x00007FF7E9DB1000-memory.dmp	upx
behavioral2/memory/2080-2137-0x00007FF72BE40000-0x00007FF72C191000-memory.dmp	upx
behavioral2/memory/3604-2123-0x00007FF76E430000-0x00007FF76E781000-memory.dmp	upx
behavioral2/memory/3732-2118-0x00007FF7B8370000-0x00007FF7B86C1000-memory.dmp	upx
behavioral2/memory/3748-2106-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QvNyVzU.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\OuFTymf.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\DZeIYLu.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\jZyqHjG.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\eHZtRsc.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\zHFguRG.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\WubyCvK.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\OjPQumF.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\AEpGUdZ.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\rxPYhaF.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\POjyUnT.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\FCJsQuL.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\TECgXKR.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\PUmyuWo.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\MwLpDJA.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\KDDLNYS.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\VPCVUXe.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\vSDgtof.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\UGPBVzP.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\zdTwGfm.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\Qtfefnq.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\OLVowOw.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\htlBtNX.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\kIqSwdc.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\COodMiy.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\chfbvop.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\FWRLvsA.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\NeXfeuF.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\UKWPKrW.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\EAEBaku.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\GCPFyOz.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\RtLZBuv.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\jXGgzWv.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\yeIZljz.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\XlrNjIa.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\RDuSzOE.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\udWesYT.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\VJxwVqc.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\IwwSeIA.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\UHdlFlC.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\rbDfvMo.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\TdfJNAt.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\YdxncWu.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\STTVokX.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\OjUDtRG.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\MQkpyUj.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\XhfkvlC.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\JBHgTSd.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\yQUBTgw.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\WvAZoxN.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\EiyQcHG.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\hyApmXA.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\SDgLcDz.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\uYECBQZ.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\UsqFApm.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\UkqmTQr.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\qCANcld.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\vQNhbha.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\oTzudTD.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\drmLvjN.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\OYYIzMC.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\vTFyzeh.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\OlUpfib.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
File created	C:\Windows\System\eRjEobK.exe	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1284	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	83
PID 744 wrote to memory of 1284	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	83
PID 744 wrote to memory of 3748	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	84
PID 744 wrote to memory of 3748	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	84
PID 744 wrote to memory of 3044	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	85
PID 744 wrote to memory of 3044	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	85
PID 744 wrote to memory of 4672	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	86
PID 744 wrote to memory of 4672	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	86
PID 744 wrote to memory of 556	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	87
PID 744 wrote to memory of 556	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	87
PID 744 wrote to memory of 3376	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	88
PID 744 wrote to memory of 3376	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	88
PID 744 wrote to memory of 1852	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	89
PID 744 wrote to memory of 1852	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	89
PID 744 wrote to memory of 1780	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	90
PID 744 wrote to memory of 1780	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	90
PID 744 wrote to memory of 1020	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	91
PID 744 wrote to memory of 1020	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	91
PID 744 wrote to memory of 3604	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	92
PID 744 wrote to memory of 3604	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	92
PID 744 wrote to memory of 4636	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	93
PID 744 wrote to memory of 4636	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	93
PID 744 wrote to memory of 4844	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	94
PID 744 wrote to memory of 4844	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	94
PID 744 wrote to memory of 1984	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	95
PID 744 wrote to memory of 1984	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	95
PID 744 wrote to memory of 3732	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	96
PID 744 wrote to memory of 3732	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	96
PID 744 wrote to memory of 2576	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	97
PID 744 wrote to memory of 2576	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	97
PID 744 wrote to memory of 2092	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	98
PID 744 wrote to memory of 2092	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	98
PID 744 wrote to memory of 4064	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	99
PID 744 wrote to memory of 4064	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	99
PID 744 wrote to memory of 2080	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	100
PID 744 wrote to memory of 2080	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	100
PID 744 wrote to memory of 2324	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	101
PID 744 wrote to memory of 2324	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	101
PID 744 wrote to memory of 3280	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	102
PID 744 wrote to memory of 3280	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	102
PID 744 wrote to memory of 2580	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	103
PID 744 wrote to memory of 2580	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	103
PID 744 wrote to memory of 4820	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	104
PID 744 wrote to memory of 4820	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	104
PID 744 wrote to memory of 3952	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	105
PID 744 wrote to memory of 3952	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	105
PID 744 wrote to memory of 1224	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	106
PID 744 wrote to memory of 1224	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	106
PID 744 wrote to memory of 3228	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	107
PID 744 wrote to memory of 3228	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	107
PID 744 wrote to memory of 4140	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	108
PID 744 wrote to memory of 4140	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	108
PID 744 wrote to memory of 3356	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	109
PID 744 wrote to memory of 3356	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	109
PID 744 wrote to memory of 1456	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	110
PID 744 wrote to memory of 1456	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	110
PID 744 wrote to memory of 4808	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	111
PID 744 wrote to memory of 4808	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	111
PID 744 wrote to memory of 1700	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	112
PID 744 wrote to memory of 1700	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	112
PID 744 wrote to memory of 564	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	113
PID 744 wrote to memory of 564	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	113
PID 744 wrote to memory of 3252	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	114
PID 744 wrote to memory of 3252	744	c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c8b962d20ac3c6c2e2939b3a36364b30_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\System\bXUGGBR.exe
  C:\Windows\System\bXUGGBR.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\Oaejyrl.exe
  C:\Windows\System\Oaejyrl.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\mNvSDDh.exe
  C:\Windows\System\mNvSDDh.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\GYAGYVP.exe
  C:\Windows\System\GYAGYVP.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\woyWFZf.exe
  C:\Windows\System\woyWFZf.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\PGfkDQR.exe
  C:\Windows\System\PGfkDQR.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\qCANcld.exe
  C:\Windows\System\qCANcld.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\RoNsAwu.exe
  C:\Windows\System\RoNsAwu.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\MpYOzbH.exe
  C:\Windows\System\MpYOzbH.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\KmKiOzM.exe
  C:\Windows\System\KmKiOzM.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\BzAFYbn.exe
  C:\Windows\System\BzAFYbn.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\FFiknUQ.exe
  C:\Windows\System\FFiknUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\RDuSzOE.exe
  C:\Windows\System\RDuSzOE.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\AEpGUdZ.exe
  C:\Windows\System\AEpGUdZ.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\yJTDKQJ.exe
  C:\Windows\System\yJTDKQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\JCsuDyv.exe
  C:\Windows\System\JCsuDyv.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\XMHDXiM.exe
  C:\Windows\System\XMHDXiM.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\hCqbfbh.exe
  C:\Windows\System\hCqbfbh.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\klSrfCF.exe
  C:\Windows\System\klSrfCF.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\SaTclYU.exe
  C:\Windows\System\SaTclYU.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\zLnqgmN.exe
  C:\Windows\System\zLnqgmN.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\XJZSTho.exe
  C:\Windows\System\XJZSTho.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\IVeFaxo.exe
  C:\Windows\System\IVeFaxo.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\UsmUwpD.exe
  C:\Windows\System\UsmUwpD.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\SkmQHqg.exe
  C:\Windows\System\SkmQHqg.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\YQowRhN.exe
  C:\Windows\System\YQowRhN.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\ysPUYqH.exe
  C:\Windows\System\ysPUYqH.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\BcQdXVc.exe
  C:\Windows\System\BcQdXVc.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\SBByVjZ.exe
  C:\Windows\System\SBByVjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\mOJinjI.exe
  C:\Windows\System\mOJinjI.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\oNJRJRl.exe
  C:\Windows\System\oNJRJRl.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\LPRwoTf.exe
  C:\Windows\System\LPRwoTf.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\piKbnhF.exe
  C:\Windows\System\piKbnhF.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\vVUyvgb.exe
  C:\Windows\System\vVUyvgb.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\pBCbPoV.exe
  C:\Windows\System\pBCbPoV.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\LakfYgd.exe
  C:\Windows\System\LakfYgd.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\aXZvnKU.exe
  C:\Windows\System\aXZvnKU.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\diBxifM.exe
  C:\Windows\System\diBxifM.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\BHrHBsA.exe
  C:\Windows\System\BHrHBsA.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\uMsILYc.exe
  C:\Windows\System\uMsILYc.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\hmhuJAv.exe
  C:\Windows\System\hmhuJAv.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\wjgRJKE.exe
  C:\Windows\System\wjgRJKE.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\WvAZoxN.exe
  C:\Windows\System\WvAZoxN.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\eFiRFjF.exe
  C:\Windows\System\eFiRFjF.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\HFblpDf.exe
  C:\Windows\System\HFblpDf.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\tawSNxi.exe
  C:\Windows\System\tawSNxi.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\xGwEhGB.exe
  C:\Windows\System\xGwEhGB.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\FWRLvsA.exe
  C:\Windows\System\FWRLvsA.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\EiyQcHG.exe
  C:\Windows\System\EiyQcHG.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\bDWRsqw.exe
  C:\Windows\System\bDWRsqw.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\ViQgjSQ.exe
  C:\Windows\System\ViQgjSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\iBBdvZY.exe
  C:\Windows\System\iBBdvZY.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ISGFuZF.exe
  C:\Windows\System\ISGFuZF.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ElkTzwN.exe
  C:\Windows\System\ElkTzwN.exe
  2⤵
  PID:2816
- C:\Windows\System\syaEWpb.exe
  C:\Windows\System\syaEWpb.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\yxnjjHC.exe
  C:\Windows\System\yxnjjHC.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\KvmSbDf.exe
  C:\Windows\System\KvmSbDf.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\sVIMkxU.exe
  C:\Windows\System\sVIMkxU.exe
  2⤵
  PID:5100
- C:\Windows\System\RvgOvUw.exe
  C:\Windows\System\RvgOvUw.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\NSKIffX.exe
  C:\Windows\System\NSKIffX.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\oHvoCOu.exe
  C:\Windows\System\oHvoCOu.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\osQacsW.exe
  C:\Windows\System\osQacsW.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\hyApmXA.exe
  C:\Windows\System\hyApmXA.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\WQhgxeY.exe
  C:\Windows\System\WQhgxeY.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\fZjEioZ.exe
  C:\Windows\System\fZjEioZ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\QjaYUWh.exe
  C:\Windows\System\QjaYUWh.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\DgWqfyK.exe
  C:\Windows\System\DgWqfyK.exe
  2⤵
  PID:4192
- C:\Windows\System\GkwzXmW.exe
  C:\Windows\System\GkwzXmW.exe
  2⤵
  PID:4832
- C:\Windows\System\jvBNvkA.exe
  C:\Windows\System\jvBNvkA.exe
  2⤵
  PID:3020
- C:\Windows\System\lZOfQYI.exe
  C:\Windows\System\lZOfQYI.exe
  2⤵
  PID:372
- C:\Windows\System\xzSyTNu.exe
  C:\Windows\System\xzSyTNu.exe
  2⤵
  PID:3596
- C:\Windows\System\zczloIB.exe
  C:\Windows\System\zczloIB.exe
  2⤵
  PID:2888
- C:\Windows\System\FxHYDCl.exe
  C:\Windows\System\FxHYDCl.exe
  2⤵
  PID:3980
- C:\Windows\System\unsDoPW.exe
  C:\Windows\System\unsDoPW.exe
  2⤵
  PID:3480
- C:\Windows\System\uIqzKjU.exe
  C:\Windows\System\uIqzKjU.exe
  2⤵
  PID:3988
- C:\Windows\System\EAEBaku.exe
  C:\Windows\System\EAEBaku.exe
  2⤵
  PID:1684
- C:\Windows\System\zJMvzAH.exe
  C:\Windows\System\zJMvzAH.exe
  2⤵
  PID:3468
- C:\Windows\System\JtggeMY.exe
  C:\Windows\System\JtggeMY.exe
  2⤵
  PID:2308
- C:\Windows\System\rCcfalk.exe
  C:\Windows\System\rCcfalk.exe
  2⤵
  PID:1848
- C:\Windows\System\STTVokX.exe
  C:\Windows\System\STTVokX.exe
  2⤵
  PID:4408
- C:\Windows\System\aLujjhO.exe
  C:\Windows\System\aLujjhO.exe
  2⤵
  PID:3892
- C:\Windows\System\ncwkSMb.exe
  C:\Windows\System\ncwkSMb.exe
  2⤵
  PID:3412
- C:\Windows\System\zptBRlC.exe
  C:\Windows\System\zptBRlC.exe
  2⤵
  PID:4240
- C:\Windows\System\calwlze.exe
  C:\Windows\System\calwlze.exe
  2⤵
  PID:4020
- C:\Windows\System\hRaMSan.exe
  C:\Windows\System\hRaMSan.exe
  2⤵
  PID:4028
- C:\Windows\System\AGBOEdl.exe
  C:\Windows\System\AGBOEdl.exe
  2⤵
  PID:4816
- C:\Windows\System\zwrhbJj.exe
  C:\Windows\System\zwrhbJj.exe
  2⤵
  PID:1784
- C:\Windows\System\zgtZxnv.exe
  C:\Windows\System\zgtZxnv.exe
  2⤵
  PID:920
- C:\Windows\System\DeYcIdZ.exe
  C:\Windows\System\DeYcIdZ.exe
  2⤵
  PID:2256
- C:\Windows\System\SKcGtte.exe
  C:\Windows\System\SKcGtte.exe
  2⤵
  PID:4284
- C:\Windows\System\dSrsXwb.exe
  C:\Windows\System\dSrsXwb.exe
  2⤵
  PID:2984
- C:\Windows\System\BZkkblE.exe
  C:\Windows\System\BZkkblE.exe
  2⤵
  PID:64
- C:\Windows\System\wWgvdAZ.exe
  C:\Windows\System\wWgvdAZ.exe
  2⤵
  PID:5128
- C:\Windows\System\UVOqbve.exe
  C:\Windows\System\UVOqbve.exe
  2⤵
  PID:5152
- C:\Windows\System\koUehdn.exe
  C:\Windows\System\koUehdn.exe
  2⤵
  PID:5172
- C:\Windows\System\PfIeMSw.exe
  C:\Windows\System\PfIeMSw.exe
  2⤵
  PID:5196
- C:\Windows\System\OwfRFpq.exe
  C:\Windows\System\OwfRFpq.exe
  2⤵
  PID:5216
- C:\Windows\System\PshpMlY.exe
  C:\Windows\System\PshpMlY.exe
  2⤵
  PID:5236
- C:\Windows\System\EtKQqFp.exe
  C:\Windows\System\EtKQqFp.exe
  2⤵
  PID:5264
- C:\Windows\System\dPbERqc.exe
  C:\Windows\System\dPbERqc.exe
  2⤵
  PID:5288
- C:\Windows\System\ySPxSpE.exe
  C:\Windows\System\ySPxSpE.exe
  2⤵
  PID:5316
- C:\Windows\System\PhzdhZg.exe
  C:\Windows\System\PhzdhZg.exe
  2⤵
  PID:5336
- C:\Windows\System\SDgLcDz.exe
  C:\Windows\System\SDgLcDz.exe
  2⤵
  PID:5360
- C:\Windows\System\ydLwmqM.exe
  C:\Windows\System\ydLwmqM.exe
  2⤵
  PID:5384
- C:\Windows\System\gEivReY.exe
  C:\Windows\System\gEivReY.exe
  2⤵
  PID:5408
- C:\Windows\System\NPxFlGK.exe
  C:\Windows\System\NPxFlGK.exe
  2⤵
  PID:5432
- C:\Windows\System\DbEQbUS.exe
  C:\Windows\System\DbEQbUS.exe
  2⤵
  PID:5452
- C:\Windows\System\sduwsOK.exe
  C:\Windows\System\sduwsOK.exe
  2⤵
  PID:5472
- C:\Windows\System\bktQMbk.exe
  C:\Windows\System\bktQMbk.exe
  2⤵
  PID:5492
- C:\Windows\System\tNhnkLA.exe
  C:\Windows\System\tNhnkLA.exe
  2⤵
  PID:5512
- C:\Windows\System\bEKozEm.exe
  C:\Windows\System\bEKozEm.exe
  2⤵
  PID:5536
- C:\Windows\System\WmDuRyz.exe
  C:\Windows\System\WmDuRyz.exe
  2⤵
  PID:5552
- C:\Windows\System\BtpsbLB.exe
  C:\Windows\System\BtpsbLB.exe
  2⤵
  PID:5572
- C:\Windows\System\sFljFiE.exe
  C:\Windows\System\sFljFiE.exe
  2⤵
  PID:5592
- C:\Windows\System\mEzrEfb.exe
  C:\Windows\System\mEzrEfb.exe
  2⤵
  PID:5620
- C:\Windows\System\mxvSddX.exe
  C:\Windows\System\mxvSddX.exe
  2⤵
  PID:5636
- C:\Windows\System\OjUDtRG.exe
  C:\Windows\System\OjUDtRG.exe
  2⤵
  PID:5676
- C:\Windows\System\Wxncyuj.exe
  C:\Windows\System\Wxncyuj.exe
  2⤵
  PID:5704
- C:\Windows\System\SwAaHMF.exe
  C:\Windows\System\SwAaHMF.exe
  2⤵
  PID:5728
- C:\Windows\System\jtrKHzg.exe
  C:\Windows\System\jtrKHzg.exe
  2⤵
  PID:5760
- C:\Windows\System\azdyfdi.exe
  C:\Windows\System\azdyfdi.exe
  2⤵
  PID:5780
- C:\Windows\System\WRIthgA.exe
  C:\Windows\System\WRIthgA.exe
  2⤵
  PID:5800
- C:\Windows\System\AQXGwWY.exe
  C:\Windows\System\AQXGwWY.exe
  2⤵
  PID:5820
- C:\Windows\System\Qtfefnq.exe
  C:\Windows\System\Qtfefnq.exe
  2⤵
  PID:5848
- C:\Windows\System\hRvqltQ.exe
  C:\Windows\System\hRvqltQ.exe
  2⤵
  PID:5868
- C:\Windows\System\pwHFFrW.exe
  C:\Windows\System\pwHFFrW.exe
  2⤵
  PID:5892
- C:\Windows\System\TVPOgBC.exe
  C:\Windows\System\TVPOgBC.exe
  2⤵
  PID:5920
- C:\Windows\System\XbTtCJs.exe
  C:\Windows\System\XbTtCJs.exe
  2⤵
  PID:5948
- C:\Windows\System\JyMXHdE.exe
  C:\Windows\System\JyMXHdE.exe
  2⤵
  PID:5968
- C:\Windows\System\OLVowOw.exe
  C:\Windows\System\OLVowOw.exe
  2⤵
  PID:5992
- C:\Windows\System\goGlNVw.exe
  C:\Windows\System\goGlNVw.exe
  2⤵
  PID:6016
- C:\Windows\System\eBHhmxL.exe
  C:\Windows\System\eBHhmxL.exe
  2⤵
  PID:6036
- C:\Windows\System\GZOPUnN.exe
  C:\Windows\System\GZOPUnN.exe
  2⤵
  PID:6056
- C:\Windows\System\dZFPxbt.exe
  C:\Windows\System\dZFPxbt.exe
  2⤵
  PID:6076
- C:\Windows\System\Kdwcnus.exe
  C:\Windows\System\Kdwcnus.exe
  2⤵
  PID:6092
- C:\Windows\System\DCuGuHX.exe
  C:\Windows\System\DCuGuHX.exe
  2⤵
  PID:6116
- C:\Windows\System\TECgXKR.exe
  C:\Windows\System\TECgXKR.exe
  2⤵
  PID:6136
- C:\Windows\System\wewvSTT.exe
  C:\Windows\System\wewvSTT.exe
  2⤵
  PID:3956
- C:\Windows\System\ncKaHmY.exe
  C:\Windows\System\ncKaHmY.exe
  2⤵
  PID:4908
- C:\Windows\System\OKGDNKF.exe
  C:\Windows\System\OKGDNKF.exe
  2⤵
  PID:5052
- C:\Windows\System\SVGghfy.exe
  C:\Windows\System\SVGghfy.exe
  2⤵
  PID:1884
- C:\Windows\System\NeXfeuF.exe
  C:\Windows\System\NeXfeuF.exe
  2⤵
  PID:4944
- C:\Windows\System\DoNLusC.exe
  C:\Windows\System\DoNLusC.exe
  2⤵
  PID:5080
- C:\Windows\System\XuovfCO.exe
  C:\Windows\System\XuovfCO.exe
  2⤵
  PID:1368
- C:\Windows\System\YdxncWu.exe
  C:\Windows\System\YdxncWu.exe
  2⤵
  PID:3260
- C:\Windows\System\mrAwuyI.exe
  C:\Windows\System\mrAwuyI.exe
  2⤵
  PID:4444
- C:\Windows\System\eHZtRsc.exe
  C:\Windows\System\eHZtRsc.exe
  2⤵
  PID:5076
- C:\Windows\System\tGLaSLG.exe
  C:\Windows\System\tGLaSLG.exe
  2⤵
  PID:4260
- C:\Windows\System\jtsxeyE.exe
  C:\Windows\System\jtsxeyE.exe
  2⤵
  PID:1636
- C:\Windows\System\gDMwWvH.exe
  C:\Windows\System\gDMwWvH.exe
  2⤵
  PID:1260
- C:\Windows\System\VEHFvnf.exe
  C:\Windows\System\VEHFvnf.exe
  2⤵
  PID:5500
- C:\Windows\System\udWesYT.exe
  C:\Windows\System\udWesYT.exe
  2⤵
  PID:3224
- C:\Windows\System\bwVmdfv.exe
  C:\Windows\System\bwVmdfv.exe
  2⤵
  PID:5684
- C:\Windows\System\NSTnAwG.exe
  C:\Windows\System\NSTnAwG.exe
  2⤵
  PID:5696
- C:\Windows\System\PutLhzG.exe
  C:\Windows\System\PutLhzG.exe
  2⤵
  PID:6156
- C:\Windows\System\XpEMzke.exe
  C:\Windows\System\XpEMzke.exe
  2⤵
  PID:6184
- C:\Windows\System\LBMfLNW.exe
  C:\Windows\System\LBMfLNW.exe
  2⤵
  PID:6208
- C:\Windows\System\APbAoRy.exe
  C:\Windows\System\APbAoRy.exe
  2⤵
  PID:6236
- C:\Windows\System\bquQirW.exe
  C:\Windows\System\bquQirW.exe
  2⤵
  PID:6252
- C:\Windows\System\QwlvDZU.exe
  C:\Windows\System\QwlvDZU.exe
  2⤵
  PID:6272
- C:\Windows\System\GVpxtQK.exe
  C:\Windows\System\GVpxtQK.exe
  2⤵
  PID:6388
- C:\Windows\System\ANMfjzO.exe
  C:\Windows\System\ANMfjzO.exe
  2⤵
  PID:6412
- C:\Windows\System\DTXUTKI.exe
  C:\Windows\System\DTXUTKI.exe
  2⤵
  PID:6428
- C:\Windows\System\OPGjiiO.exe
  C:\Windows\System\OPGjiiO.exe
  2⤵
  PID:6456
- C:\Windows\System\levPQNJ.exe
  C:\Windows\System\levPQNJ.exe
  2⤵
  PID:6476
- C:\Windows\System\stqxxNy.exe
  C:\Windows\System\stqxxNy.exe
  2⤵
  PID:6492
- C:\Windows\System\HaLUQPk.exe
  C:\Windows\System\HaLUQPk.exe
  2⤵
  PID:6516
- C:\Windows\System\wcjmMYI.exe
  C:\Windows\System\wcjmMYI.exe
  2⤵
  PID:6536
- C:\Windows\System\aSfVpST.exe
  C:\Windows\System\aSfVpST.exe
  2⤵
  PID:6556
- C:\Windows\System\zVUhXmv.exe
  C:\Windows\System\zVUhXmv.exe
  2⤵
  PID:6576
- C:\Windows\System\pePZFAX.exe
  C:\Windows\System\pePZFAX.exe
  2⤵
  PID:6600
- C:\Windows\System\NCmtsPk.exe
  C:\Windows\System\NCmtsPk.exe
  2⤵
  PID:6636
- C:\Windows\System\olMCVcd.exe
  C:\Windows\System\olMCVcd.exe
  2⤵
  PID:6652
- C:\Windows\System\UAChYEk.exe
  C:\Windows\System\UAChYEk.exe
  2⤵
  PID:6680
- C:\Windows\System\werpaAA.exe
  C:\Windows\System\werpaAA.exe
  2⤵
  PID:6696
- C:\Windows\System\IEabhoy.exe
  C:\Windows\System\IEabhoy.exe
  2⤵
  PID:6720
- C:\Windows\System\sMrZHdt.exe
  C:\Windows\System\sMrZHdt.exe
  2⤵
  PID:6752
- C:\Windows\System\htlBtNX.exe
  C:\Windows\System\htlBtNX.exe
  2⤵
  PID:6772
- C:\Windows\System\EbcpoQP.exe
  C:\Windows\System\EbcpoQP.exe
  2⤵
  PID:6796
- C:\Windows\System\VJxwVqc.exe
  C:\Windows\System\VJxwVqc.exe
  2⤵
  PID:6812
- C:\Windows\System\VbMjnpQ.exe
  C:\Windows\System\VbMjnpQ.exe
  2⤵
  PID:6844
- C:\Windows\System\beOeeti.exe
  C:\Windows\System\beOeeti.exe
  2⤵
  PID:6860
- C:\Windows\System\LxmSIZE.exe
  C:\Windows\System\LxmSIZE.exe
  2⤵
  PID:6880
- C:\Windows\System\UkhJRjK.exe
  C:\Windows\System\UkhJRjK.exe
  2⤵
  PID:6900
- C:\Windows\System\BLXeZWf.exe
  C:\Windows\System\BLXeZWf.exe
  2⤵
  PID:6924
- C:\Windows\System\hoxORXc.exe
  C:\Windows\System\hoxORXc.exe
  2⤵
  PID:6948
- C:\Windows\System\nbcYvtf.exe
  C:\Windows\System\nbcYvtf.exe
  2⤵
  PID:6964
- C:\Windows\System\WvRkoIv.exe
  C:\Windows\System\WvRkoIv.exe
  2⤵
  PID:7008
- C:\Windows\System\KqYMTfX.exe
  C:\Windows\System\KqYMTfX.exe
  2⤵
  PID:7024
- C:\Windows\System\BKJGBYF.exe
  C:\Windows\System\BKJGBYF.exe
  2⤵
  PID:7044
- C:\Windows\System\vQNhbha.exe
  C:\Windows\System\vQNhbha.exe
  2⤵
  PID:7072
- C:\Windows\System\snmyawY.exe
  C:\Windows\System\snmyawY.exe
  2⤵
  PID:7088
- C:\Windows\System\ycKLNRc.exe
  C:\Windows\System\ycKLNRc.exe
  2⤵
  PID:7108
- C:\Windows\System\tNxMuZA.exe
  C:\Windows\System\tNxMuZA.exe
  2⤵
  PID:7136
- C:\Windows\System\OrZXhQh.exe
  C:\Windows\System\OrZXhQh.exe
  2⤵
  PID:7160
- C:\Windows\System\AGexluZ.exe
  C:\Windows\System\AGexluZ.exe
  2⤵
  PID:5796
- C:\Windows\System\nBwcjnh.exe
  C:\Windows\System\nBwcjnh.exe
  2⤵
  PID:5284
- C:\Windows\System\jhLAnAD.exe
  C:\Windows\System\jhLAnAD.exe
  2⤵
  PID:876
- C:\Windows\System\heODneX.exe
  C:\Windows\System\heODneX.exe
  2⤵
  PID:1964
- C:\Windows\System\qOnXjrt.exe
  C:\Windows\System\qOnXjrt.exe
  2⤵
  PID:5488
- C:\Windows\System\VAlcPOq.exe
  C:\Windows\System\VAlcPOq.exe
  2⤵
  PID:5560
- C:\Windows\System\qXBOBPU.exe
  C:\Windows\System\qXBOBPU.exe
  2⤵
  PID:5608
- C:\Windows\System\mKLjSJZ.exe
  C:\Windows\System\mKLjSJZ.exe
  2⤵
  PID:5672
- C:\Windows\System\ypkWJWr.exe
  C:\Windows\System\ypkWJWr.exe
  2⤵
  PID:6152
- C:\Windows\System\afLbNKY.exe
  C:\Windows\System\afLbNKY.exe
  2⤵
  PID:6228
- C:\Windows\System\zXKgiBU.exe
  C:\Windows\System\zXKgiBU.exe
  2⤵
  PID:5792
- C:\Windows\System\tyKdLNF.exe
  C:\Windows\System\tyKdLNF.exe
  2⤵
  PID:5260
- C:\Windows\System\VTiApQt.exe
  C:\Windows\System\VTiApQt.exe
  2⤵
  PID:5356
- C:\Windows\System\xIbFShf.exe
  C:\Windows\System\xIbFShf.exe
  2⤵
  PID:5956
- C:\Windows\System\FgFravd.exe
  C:\Windows\System\FgFravd.exe
  2⤵
  PID:6084
- C:\Windows\System\KPGRsjg.exe
  C:\Windows\System\KPGRsjg.exe
  2⤵
  PID:6436
- C:\Windows\System\tmNZUGA.exe
  C:\Windows\System\tmNZUGA.exe
  2⤵
  PID:6472
- C:\Windows\System\rEiJoXh.exe
  C:\Windows\System\rEiJoXh.exe
  2⤵
  PID:5548
- C:\Windows\System\GPruUsX.exe
  C:\Windows\System\GPruUsX.exe
  2⤵
  PID:2536
- C:\Windows\System\ZHCPhDO.exe
  C:\Windows\System\ZHCPhDO.exe
  2⤵
  PID:7176
- C:\Windows\System\ORdiqKX.exe
  C:\Windows\System\ORdiqKX.exe
  2⤵
  PID:7196
- C:\Windows\System\hqBBbqr.exe
  C:\Windows\System\hqBBbqr.exe
  2⤵
  PID:7228
- C:\Windows\System\kAKrJXW.exe
  C:\Windows\System\kAKrJXW.exe
  2⤵
  PID:7260
- C:\Windows\System\HsAByFR.exe
  C:\Windows\System\HsAByFR.exe
  2⤵
  PID:7276
- C:\Windows\System\wevysAF.exe
  C:\Windows\System\wevysAF.exe
  2⤵
  PID:7300
- C:\Windows\System\DnWeBBG.exe
  C:\Windows\System\DnWeBBG.exe
  2⤵
  PID:7316
- C:\Windows\System\rfbfJFb.exe
  C:\Windows\System\rfbfJFb.exe
  2⤵
  PID:7336
- C:\Windows\System\RFMrvsm.exe
  C:\Windows\System\RFMrvsm.exe
  2⤵
  PID:7360
- C:\Windows\System\dIrvYQU.exe
  C:\Windows\System\dIrvYQU.exe
  2⤵
  PID:7376
- C:\Windows\System\UbeiltS.exe
  C:\Windows\System\UbeiltS.exe
  2⤵
  PID:7404
- C:\Windows\System\uwlUpom.exe
  C:\Windows\System\uwlUpom.exe
  2⤵
  PID:7420
- C:\Windows\System\XuGAPDb.exe
  C:\Windows\System\XuGAPDb.exe
  2⤵
  PID:7440
- C:\Windows\System\FstDzVN.exe
  C:\Windows\System\FstDzVN.exe
  2⤵
  PID:7464
- C:\Windows\System\KesPYcJ.exe
  C:\Windows\System\KesPYcJ.exe
  2⤵
  PID:7480
- C:\Windows\System\sRgblHp.exe
  C:\Windows\System\sRgblHp.exe
  2⤵
  PID:7508
- C:\Windows\System\auzqdiG.exe
  C:\Windows\System\auzqdiG.exe
  2⤵
  PID:7532
- C:\Windows\System\GZVQpus.exe
  C:\Windows\System\GZVQpus.exe
  2⤵
  PID:7552
- C:\Windows\System\LArRiIL.exe
  C:\Windows\System\LArRiIL.exe
  2⤵
  PID:7576
- C:\Windows\System\dhcoAen.exe
  C:\Windows\System\dhcoAen.exe
  2⤵
  PID:7596
- C:\Windows\System\oTzudTD.exe
  C:\Windows\System\oTzudTD.exe
  2⤵
  PID:7616
- C:\Windows\System\dzxjYvM.exe
  C:\Windows\System\dzxjYvM.exe
  2⤵
  PID:7640
- C:\Windows\System\ywKXNFd.exe
  C:\Windows\System\ywKXNFd.exe
  2⤵
  PID:7656
- C:\Windows\System\djGQQaO.exe
  C:\Windows\System\djGQQaO.exe
  2⤵
  PID:7672
- C:\Windows\System\rskDmXs.exe
  C:\Windows\System\rskDmXs.exe
  2⤵
  PID:7696
- C:\Windows\System\rxPYhaF.exe
  C:\Windows\System\rxPYhaF.exe
  2⤵
  PID:7716
- C:\Windows\System\mupbHRw.exe
  C:\Windows\System\mupbHRw.exe
  2⤵
  PID:7740
- C:\Windows\System\eEnqwNK.exe
  C:\Windows\System\eEnqwNK.exe
  2⤵
  PID:7756
- C:\Windows\System\mkHGWZx.exe
  C:\Windows\System\mkHGWZx.exe
  2⤵
  PID:7784
- C:\Windows\System\WdfTZCe.exe
  C:\Windows\System\WdfTZCe.exe
  2⤵
  PID:7800
- C:\Windows\System\BxmOjyc.exe
  C:\Windows\System\BxmOjyc.exe
  2⤵
  PID:7840
- C:\Windows\System\yTFVTva.exe
  C:\Windows\System\yTFVTva.exe
  2⤵
  PID:7864
- C:\Windows\System\vzzCmkB.exe
  C:\Windows\System\vzzCmkB.exe
  2⤵
  PID:7884
- C:\Windows\System\XxNmKfM.exe
  C:\Windows\System\XxNmKfM.exe
  2⤵
  PID:7904
- C:\Windows\System\yDmPbAq.exe
  C:\Windows\System\yDmPbAq.exe
  2⤵
  PID:7932
- C:\Windows\System\xJPBMLT.exe
  C:\Windows\System\xJPBMLT.exe
  2⤵
  PID:7948
- C:\Windows\System\HByppzW.exe
  C:\Windows\System\HByppzW.exe
  2⤵
  PID:7972
- C:\Windows\System\yGipRQd.exe
  C:\Windows\System\yGipRQd.exe
  2⤵
  PID:7992
- C:\Windows\System\sduQcWd.exe
  C:\Windows\System\sduQcWd.exe
  2⤵
  PID:8012
- C:\Windows\System\LfPzbcp.exe
  C:\Windows\System\LfPzbcp.exe
  2⤵
  PID:8040
- C:\Windows\System\abGZLqP.exe
  C:\Windows\System\abGZLqP.exe
  2⤵
  PID:8060
- C:\Windows\System\VmwelQw.exe
  C:\Windows\System\VmwelQw.exe
  2⤵
  PID:8080
- C:\Windows\System\pSXUHPN.exe
  C:\Windows\System\pSXUHPN.exe
  2⤵
  PID:8100
- C:\Windows\System\NNCbEBi.exe
  C:\Windows\System\NNCbEBi.exe
  2⤵
  PID:8120
- C:\Windows\System\UAIUAwZ.exe
  C:\Windows\System\UAIUAwZ.exe
  2⤵
  PID:8136
- C:\Windows\System\NXUxxph.exe
  C:\Windows\System\NXUxxph.exe
  2⤵
  PID:8164
- C:\Windows\System\HvsgQuc.exe
  C:\Windows\System\HvsgQuc.exe
  2⤵
  PID:8184
- C:\Windows\System\gNoGGPv.exe
  C:\Windows\System\gNoGGPv.exe
  2⤵
  PID:5604
- C:\Windows\System\AcDgkIt.exe
  C:\Windows\System\AcDgkIt.exe
  2⤵
  PID:5632
- C:\Windows\System\jZyqHjG.exe
  C:\Windows\System\jZyqHjG.exe
  2⤵
  PID:6712
- C:\Windows\System\NUnyUjl.exe
  C:\Windows\System\NUnyUjl.exe
  2⤵
  PID:4320
- C:\Windows\System\xvEhggk.exe
  C:\Windows\System\xvEhggk.exe
  2⤵
  PID:6804
- C:\Windows\System\UaujvFo.exe
  C:\Windows\System\UaujvFo.exe
  2⤵
  PID:6856
- C:\Windows\System\pYVvVgd.exe
  C:\Windows\System\pYVvVgd.exe
  2⤵
  PID:6192
- C:\Windows\System\afpptFi.exe
  C:\Windows\System\afpptFi.exe
  2⤵
  PID:6960
- C:\Windows\System\TonCuXB.exe
  C:\Windows\System\TonCuXB.exe
  2⤵
  PID:5788
- C:\Windows\System\Gwvslsq.exe
  C:\Windows\System\Gwvslsq.exe
  2⤵
  PID:7056
- C:\Windows\System\sGpspyH.exe
  C:\Windows\System\sGpspyH.exe
  2⤵
  PID:5856
- C:\Windows\System\QPFHtGK.exe
  C:\Windows\System\QPFHtGK.exe
  2⤵
  PID:5900
- C:\Windows\System\FEMekpS.exe
  C:\Windows\System\FEMekpS.exe
  2⤵
  PID:6336
- C:\Windows\System\zWpAieR.exe
  C:\Windows\System\zWpAieR.exe
  2⤵
  PID:6008
- C:\Windows\System\UiKoajL.exe
  C:\Windows\System\UiKoajL.exe
  2⤵
  PID:6072
- C:\Windows\System\zdTwGfm.exe
  C:\Windows\System\zdTwGfm.exe
  2⤵
  PID:6452
- C:\Windows\System\fEaOvDI.exe
  C:\Windows\System\fEaOvDI.exe
  2⤵
  PID:6500
- C:\Windows\System\UfFuTtJ.exe
  C:\Windows\System\UfFuTtJ.exe
  2⤵
  PID:4296
- C:\Windows\System\ObVRbQm.exe
  C:\Windows\System\ObVRbQm.exe
  2⤵
  PID:6584
- C:\Windows\System\yUZppcU.exe
  C:\Windows\System\yUZppcU.exe
  2⤵
  PID:5380
- C:\Windows\System\EkIWdiF.exe
  C:\Windows\System\EkIWdiF.exe
  2⤵
  PID:5280
- C:\Windows\System\rRyalgw.exe
  C:\Windows\System\rRyalgw.exe
  2⤵
  PID:5308
- C:\Windows\System\IrKImPq.exe
  C:\Windows\System\IrKImPq.exe
  2⤵
  PID:7284
- C:\Windows\System\TLtooGu.exe
  C:\Windows\System\TLtooGu.exe
  2⤵
  PID:6708
- C:\Windows\System\sibPjvi.exe
  C:\Windows\System\sibPjvi.exe
  2⤵
  PID:8216
- C:\Windows\System\achXNHc.exe
  C:\Windows\System\achXNHc.exe
  2⤵
  PID:8236
- C:\Windows\System\POjyUnT.exe
  C:\Windows\System\POjyUnT.exe
  2⤵
  PID:8260
- C:\Windows\System\JNTANbF.exe
  C:\Windows\System\JNTANbF.exe
  2⤵
  PID:8276
- C:\Windows\System\wJMsqyL.exe
  C:\Windows\System\wJMsqyL.exe
  2⤵
  PID:8296
- C:\Windows\System\gAzvFBR.exe
  C:\Windows\System\gAzvFBR.exe
  2⤵
  PID:8316
- C:\Windows\System\zmTQKZV.exe
  C:\Windows\System\zmTQKZV.exe
  2⤵
  PID:8344
- C:\Windows\System\XjHzTUM.exe
  C:\Windows\System\XjHzTUM.exe
  2⤵
  PID:8360
- C:\Windows\System\rFVyKTK.exe
  C:\Windows\System\rFVyKTK.exe
  2⤵
  PID:8380
- C:\Windows\System\rSixCvW.exe
  C:\Windows\System\rSixCvW.exe
  2⤵
  PID:8400
- C:\Windows\System\xJJNkAP.exe
  C:\Windows\System\xJJNkAP.exe
  2⤵
  PID:8424
- C:\Windows\System\bObVvhB.exe
  C:\Windows\System\bObVvhB.exe
  2⤵
  PID:8444
- C:\Windows\System\YoOdYTs.exe
  C:\Windows\System\YoOdYTs.exe
  2⤵
  PID:8464
- C:\Windows\System\jSYOsnO.exe
  C:\Windows\System\jSYOsnO.exe
  2⤵
  PID:8484
- C:\Windows\System\bYsCxoG.exe
  C:\Windows\System\bYsCxoG.exe
  2⤵
  PID:8508
- C:\Windows\System\UxkzsSd.exe
  C:\Windows\System\UxkzsSd.exe
  2⤵
  PID:8532
- C:\Windows\System\FOespDd.exe
  C:\Windows\System\FOespDd.exe
  2⤵
  PID:8548
- C:\Windows\System\VyIzGrG.exe
  C:\Windows\System\VyIzGrG.exe
  2⤵
  PID:8572
- C:\Windows\System\qnRwWVL.exe
  C:\Windows\System\qnRwWVL.exe
  2⤵
  PID:8588
- C:\Windows\System\rhDOQvX.exe
  C:\Windows\System\rhDOQvX.exe
  2⤵
  PID:8616
- C:\Windows\System\hITuVUs.exe
  C:\Windows\System\hITuVUs.exe
  2⤵
  PID:8636
- C:\Windows\System\dEHHLfQ.exe
  C:\Windows\System\dEHHLfQ.exe
  2⤵
  PID:8656
- C:\Windows\System\ulcQJoy.exe
  C:\Windows\System\ulcQJoy.exe
  2⤵
  PID:8676
- C:\Windows\System\pUVdZXF.exe
  C:\Windows\System\pUVdZXF.exe
  2⤵
  PID:8696
- C:\Windows\System\AggNgDl.exe
  C:\Windows\System\AggNgDl.exe
  2⤵
  PID:8720
- C:\Windows\System\pdUDAeX.exe
  C:\Windows\System\pdUDAeX.exe
  2⤵
  PID:8744
- C:\Windows\System\BzaXCzJ.exe
  C:\Windows\System\BzaXCzJ.exe
  2⤵
  PID:8764
- C:\Windows\System\nLEudhK.exe
  C:\Windows\System\nLEudhK.exe
  2⤵
  PID:8784
- C:\Windows\System\hYYIZWT.exe
  C:\Windows\System\hYYIZWT.exe
  2⤵
  PID:8804
- C:\Windows\System\PUmyuWo.exe
  C:\Windows\System\PUmyuWo.exe
  2⤵
  PID:8824
- C:\Windows\System\ZBzarqV.exe
  C:\Windows\System\ZBzarqV.exe
  2⤵
  PID:8840
- C:\Windows\System\LNXIThq.exe
  C:\Windows\System\LNXIThq.exe
  2⤵
  PID:8860
- C:\Windows\System\ncRhhZX.exe
  C:\Windows\System\ncRhhZX.exe
  2⤵
  PID:9044
- C:\Windows\System\IusdTiS.exe
  C:\Windows\System\IusdTiS.exe
  2⤵
  PID:9060
- C:\Windows\System\HfLIOHf.exe
  C:\Windows\System\HfLIOHf.exe
  2⤵
  PID:9076
- C:\Windows\System\QkrjeuI.exe
  C:\Windows\System\QkrjeuI.exe
  2⤵
  PID:9092
- C:\Windows\System\GrNJggB.exe
  C:\Windows\System\GrNJggB.exe
  2⤵
  PID:9108
- C:\Windows\System\jPycGfe.exe
  C:\Windows\System\jPycGfe.exe
  2⤵
  PID:9124
- C:\Windows\System\YkOLuLO.exe
  C:\Windows\System\YkOLuLO.exe
  2⤵
  PID:9140
- C:\Windows\System\dcKEkyw.exe
  C:\Windows\System\dcKEkyw.exe
  2⤵
  PID:9156
- C:\Windows\System\EZyZqJB.exe
  C:\Windows\System\EZyZqJB.exe
  2⤵
  PID:9172
- C:\Windows\System\AucKSzL.exe
  C:\Windows\System\AucKSzL.exe
  2⤵
  PID:9188
- C:\Windows\System\URCAKPL.exe
  C:\Windows\System\URCAKPL.exe
  2⤵
  PID:9204
- C:\Windows\System\cBRdaSi.exe
  C:\Windows\System\cBRdaSi.exe
  2⤵
  PID:5448
- C:\Windows\System\sFNqlYg.exe
  C:\Windows\System\sFNqlYg.exe
  2⤵
  PID:6780
- C:\Windows\System\kIqSwdc.exe
  C:\Windows\System\kIqSwdc.exe
  2⤵
  PID:5652
- C:\Windows\System\zHFguRG.exe
  C:\Windows\System\zHFguRG.exe
  2⤵
  PID:2076
- C:\Windows\System\KOMLyAM.exe
  C:\Windows\System\KOMLyAM.exe
  2⤵
  PID:7432
- C:\Windows\System\LNhIQHj.exe
  C:\Windows\System\LNhIQHj.exe
  2⤵
  PID:5208
- C:\Windows\System\luLQEOM.exe
  C:\Windows\System\luLQEOM.exe
  2⤵
  PID:7496
- C:\Windows\System\gPHwoJh.exe
  C:\Windows\System\gPHwoJh.exe
  2⤵
  PID:6932
- C:\Windows\System\GaTDQhr.exe
  C:\Windows\System\GaTDQhr.exe
  2⤵
  PID:3568
- C:\Windows\System\qZJAsvS.exe
  C:\Windows\System\qZJAsvS.exe
  2⤵
  PID:2716
- C:\Windows\System\oyGOSyt.exe
  C:\Windows\System\oyGOSyt.exe
  2⤵
  PID:5396
- C:\Windows\System\tOLtxNk.exe
  C:\Windows\System\tOLtxNk.exe
  2⤵
  PID:6424
- C:\Windows\System\nDhyxYa.exe
  C:\Windows\System\nDhyxYa.exe
  2⤵
  PID:7236
- C:\Windows\System\WKgOTHT.exe
  C:\Windows\System\WKgOTHT.exe
  2⤵
  PID:7308
- C:\Windows\System\lzkWman.exe
  C:\Windows\System\lzkWman.exe
  2⤵
  PID:7344
- C:\Windows\System\AnDfmvt.exe
  C:\Windows\System\AnDfmvt.exe
  2⤵
  PID:7560
- C:\Windows\System\BORuYMz.exe
  C:\Windows\System\BORuYMz.exe
  2⤵
  PID:7612
- C:\Windows\System\oenQYGU.exe
  C:\Windows\System\oenQYGU.exe
  2⤵
  PID:7652
- C:\Windows\System\XXIObey.exe
  C:\Windows\System\XXIObey.exe
  2⤵
  PID:7728
- C:\Windows\System\ioJYMwN.exe
  C:\Windows\System\ioJYMwN.exe
  2⤵
  PID:7852
- C:\Windows\System\oIelXrK.exe
  C:\Windows\System\oIelXrK.exe
  2⤵
  PID:7988
- C:\Windows\System\ItiExkX.exe
  C:\Windows\System\ItiExkX.exe
  2⤵
  PID:8176
- C:\Windows\System\hPmUwYk.exe
  C:\Windows\System\hPmUwYk.exe
  2⤵
  PID:5864
- C:\Windows\System\GyRgHTa.exe
  C:\Windows\System\GyRgHTa.exe
  2⤵
  PID:8232
- C:\Windows\System\RzEzyQR.exe
  C:\Windows\System\RzEzyQR.exe
  2⤵
  PID:8408
- C:\Windows\System\jMcwFcD.exe
  C:\Windows\System\jMcwFcD.exe
  2⤵
  PID:8560
- C:\Windows\System\qkRNiqX.exe
  C:\Windows\System\qkRNiqX.exe
  2⤵
  PID:8704
- C:\Windows\System\QvNyVzU.exe
  C:\Windows\System\QvNyVzU.exe
  2⤵
  PID:7772
- C:\Windows\System\hywmZwH.exe
  C:\Windows\System\hywmZwH.exe
  2⤵
  PID:7832
- C:\Windows\System\UxKGEpc.exe
  C:\Windows\System\UxKGEpc.exe
  2⤵
  PID:7872
- C:\Windows\System\zBddsKY.exe
  C:\Windows\System\zBddsKY.exe
  2⤵
  PID:7940
- C:\Windows\System\AuWxhOy.exe
  C:\Windows\System\AuWxhOy.exe
  2⤵
  PID:8008
- C:\Windows\System\hAbOdPI.exe
  C:\Windows\System\hAbOdPI.exe
  2⤵
  PID:8072
- C:\Windows\System\AlBTGDj.exe
  C:\Windows\System\AlBTGDj.exe
  2⤵
  PID:8112
- C:\Windows\System\LfHNuaZ.exe
  C:\Windows\System\LfHNuaZ.exe
  2⤵
  PID:8172
- C:\Windows\System\cpqCWvd.exe
  C:\Windows\System\cpqCWvd.exe
  2⤵
  PID:6648
- C:\Windows\System\EkhCtPk.exe
  C:\Windows\System\EkhCtPk.exe
  2⤵
  PID:6908
- C:\Windows\System\sKxKCaG.exe
  C:\Windows\System\sKxKCaG.exe
  2⤵
  PID:6980
- C:\Windows\System\CwgnuZh.exe
  C:\Windows\System\CwgnuZh.exe
  2⤵
  PID:5912
- C:\Windows\System\drmLvjN.exe
  C:\Windows\System\drmLvjN.exe
  2⤵
  PID:6408
- C:\Windows\System\uYECBQZ.exe
  C:\Windows\System\uYECBQZ.exe
  2⤵
  PID:6532
- C:\Windows\System\AXlahMH.exe
  C:\Windows\System\AXlahMH.exe
  2⤵
  PID:7204
- C:\Windows\System\FFsubke.exe
  C:\Windows\System\FFsubke.exe
  2⤵
  PID:6704
- C:\Windows\System\IRshSQY.exe
  C:\Windows\System\IRshSQY.exe
  2⤵
  PID:8248
- C:\Windows\System\iyGrGQh.exe
  C:\Windows\System\iyGrGQh.exe
  2⤵
  PID:8312
- C:\Windows\System\pdaqOFE.exe
  C:\Windows\System\pdaqOFE.exe
  2⤵
  PID:8372
- C:\Windows\System\KDNSDln.exe
  C:\Windows\System\KDNSDln.exe
  2⤵
  PID:8416
- C:\Windows\System\FUwGdfF.exe
  C:\Windows\System\FUwGdfF.exe
  2⤵
  PID:8500
- C:\Windows\System\RktiwcE.exe
  C:\Windows\System\RktiwcE.exe
  2⤵
  PID:8556
- C:\Windows\System\CteeNqN.exe
  C:\Windows\System\CteeNqN.exe
  2⤵
  PID:8608
- C:\Windows\System\gmwCZVe.exe
  C:\Windows\System\gmwCZVe.exe
  2⤵
  PID:8672
- C:\Windows\System\iELMVyv.exe
  C:\Windows\System\iELMVyv.exe
  2⤵
  PID:8752
- C:\Windows\System\mYQDtkA.exe
  C:\Windows\System\mYQDtkA.exe
  2⤵
  PID:8820
- C:\Windows\System\HpiRssO.exe
  C:\Windows\System\HpiRssO.exe
  2⤵
  PID:9228
- C:\Windows\System\xRYzQYP.exe
  C:\Windows\System\xRYzQYP.exe
  2⤵
  PID:9252
- C:\Windows\System\WubyCvK.exe
  C:\Windows\System\WubyCvK.exe
  2⤵
  PID:9308
- C:\Windows\System\MOEDScV.exe
  C:\Windows\System\MOEDScV.exe
  2⤵
  PID:9340
- C:\Windows\System\rTCaikv.exe
  C:\Windows\System\rTCaikv.exe
  2⤵
  PID:9368
- C:\Windows\System\DsNEWjC.exe
  C:\Windows\System\DsNEWjC.exe
  2⤵
  PID:9392
- C:\Windows\System\zBrqbml.exe
  C:\Windows\System\zBrqbml.exe
  2⤵
  PID:9420
- C:\Windows\System\LGNqzen.exe
  C:\Windows\System\LGNqzen.exe
  2⤵
  PID:9448
- C:\Windows\System\PlnWCIM.exe
  C:\Windows\System\PlnWCIM.exe
  2⤵
  PID:9472
- C:\Windows\System\wAFgMdM.exe
  C:\Windows\System\wAFgMdM.exe
  2⤵
  PID:9500
- C:\Windows\System\WEQCXYn.exe
  C:\Windows\System\WEQCXYn.exe
  2⤵
  PID:9516
- C:\Windows\System\NVqBIPg.exe
  C:\Windows\System\NVqBIPg.exe
  2⤵
  PID:9544
- C:\Windows\System\oIffwBM.exe
  C:\Windows\System\oIffwBM.exe
  2⤵
  PID:9564
- C:\Windows\System\MQkpyUj.exe
  C:\Windows\System\MQkpyUj.exe
  2⤵
  PID:9588
- C:\Windows\System\vKCDkPY.exe
  C:\Windows\System\vKCDkPY.exe
  2⤵
  PID:9612
- C:\Windows\System\QqqXDDp.exe
  C:\Windows\System\QqqXDDp.exe
  2⤵
  PID:9648
- C:\Windows\System\tHeIhpn.exe
  C:\Windows\System\tHeIhpn.exe
  2⤵
  PID:9668
- C:\Windows\System\MwLpDJA.exe
  C:\Windows\System\MwLpDJA.exe
  2⤵
  PID:9696
- C:\Windows\System\ETSmqvL.exe
  C:\Windows\System\ETSmqvL.exe
  2⤵
  PID:9720
- C:\Windows\System\CxAsDPZ.exe
  C:\Windows\System\CxAsDPZ.exe
  2⤵
  PID:9748
- C:\Windows\System\XhfkvlC.exe
  C:\Windows\System\XhfkvlC.exe
  2⤵
  PID:9768
- C:\Windows\System\WdhbtNh.exe
  C:\Windows\System\WdhbtNh.exe
  2⤵
  PID:9796
- C:\Windows\System\gXQrJWC.exe
  C:\Windows\System\gXQrJWC.exe
  2⤵
  PID:9816
- C:\Windows\System\sUhPwlC.exe
  C:\Windows\System\sUhPwlC.exe
  2⤵
  PID:9840
- C:\Windows\System\dDuwjeY.exe
  C:\Windows\System\dDuwjeY.exe
  2⤵
  PID:9872
- C:\Windows\System\KDDLNYS.exe
  C:\Windows\System\KDDLNYS.exe
  2⤵
  PID:9900
- C:\Windows\System\tBWoDlL.exe
  C:\Windows\System\tBWoDlL.exe
  2⤵
  PID:9928
- C:\Windows\System\zQQtnmk.exe
  C:\Windows\System\zQQtnmk.exe
  2⤵
  PID:9948
- C:\Windows\System\BOwalhf.exe
  C:\Windows\System\BOwalhf.exe
  2⤵
  PID:9968
- C:\Windows\System\RUBJUNE.exe
  C:\Windows\System\RUBJUNE.exe
  2⤵
  PID:9988
- C:\Windows\System\OxHBnTS.exe
  C:\Windows\System\OxHBnTS.exe
  2⤵
  PID:10008
- C:\Windows\System\xEJCogx.exe
  C:\Windows\System\xEJCogx.exe
  2⤵
  PID:10028
- C:\Windows\System\fllWYep.exe
  C:\Windows\System\fllWYep.exe
  2⤵
  PID:10044
- C:\Windows\System\PTnvvrt.exe
  C:\Windows\System\PTnvvrt.exe
  2⤵
  PID:10064
- C:\Windows\System\JwlyUDl.exe
  C:\Windows\System\JwlyUDl.exe
  2⤵
  PID:10084
- C:\Windows\System\jVkPMbu.exe
  C:\Windows\System\jVkPMbu.exe
  2⤵
  PID:10108
- C:\Windows\System\iRhmnWn.exe
  C:\Windows\System\iRhmnWn.exe
  2⤵
  PID:10124
- C:\Windows\System\UXhNqsR.exe
  C:\Windows\System\UXhNqsR.exe
  2⤵
  PID:10140
- C:\Windows\System\oQCFdMA.exe
  C:\Windows\System\oQCFdMA.exe
  2⤵
  PID:10156
- C:\Windows\System\XkqUFki.exe
  C:\Windows\System\XkqUFki.exe
  2⤵
  PID:10172
- C:\Windows\System\gtzfOWE.exe
  C:\Windows\System\gtzfOWE.exe
  2⤵
  PID:10188
- C:\Windows\System\uBrLWfD.exe
  C:\Windows\System\uBrLWfD.exe
  2⤵
  PID:10204
- C:\Windows\System\IqtkKAg.exe
  C:\Windows\System\IqtkKAg.exe
  2⤵
  PID:10224
- C:\Windows\System\VPCVUXe.exe
  C:\Windows\System\VPCVUXe.exe
  2⤵
  PID:10252
- C:\Windows\System\IPCHfYn.exe
  C:\Windows\System\IPCHfYn.exe
  2⤵
  PID:10272
- C:\Windows\System\DCkTWiQ.exe
  C:\Windows\System\DCkTWiQ.exe
  2⤵
  PID:10288
- C:\Windows\System\HCwDMNa.exe
  C:\Windows\System\HCwDMNa.exe
  2⤵
  PID:10304
- C:\Windows\System\vSDgtof.exe
  C:\Windows\System\vSDgtof.exe
  2⤵
  PID:10328
- C:\Windows\System\tZgIhHR.exe
  C:\Windows\System\tZgIhHR.exe
  2⤵
  PID:10344
- C:\Windows\System\COodMiy.exe
  C:\Windows\System\COodMiy.exe
  2⤵
  PID:10368
- C:\Windows\System\GCPFyOz.exe
  C:\Windows\System\GCPFyOz.exe
  2⤵
  PID:10388
- C:\Windows\System\IztszGc.exe
  C:\Windows\System\IztszGc.exe
  2⤵
  PID:10404
- C:\Windows\System\vAAMnYE.exe
  C:\Windows\System\vAAMnYE.exe
  2⤵
  PID:10424
- C:\Windows\System\RtLZBuv.exe
  C:\Windows\System\RtLZBuv.exe
  2⤵
  PID:10444
- C:\Windows\System\FCJsQuL.exe
  C:\Windows\System\FCJsQuL.exe
  2⤵
  PID:10464
- C:\Windows\System\TyJIKIJ.exe
  C:\Windows\System\TyJIKIJ.exe
  2⤵
  PID:10480
- C:\Windows\System\NWAwhlG.exe
  C:\Windows\System\NWAwhlG.exe
  2⤵
  PID:10500
- C:\Windows\System\JxlVnXB.exe
  C:\Windows\System\JxlVnXB.exe
  2⤵
  PID:10520
- C:\Windows\System\FUQtqce.exe
  C:\Windows\System\FUQtqce.exe
  2⤵
  PID:10540
- C:\Windows\System\DsWTEBz.exe
  C:\Windows\System\DsWTEBz.exe
  2⤵
  PID:10560
- C:\Windows\System\HFtbURw.exe
  C:\Windows\System\HFtbURw.exe
  2⤵
  PID:10576
- C:\Windows\System\qGTxvQc.exe
  C:\Windows\System\qGTxvQc.exe
  2⤵
  PID:10596
- C:\Windows\System\qTrwdMm.exe
  C:\Windows\System\qTrwdMm.exe
  2⤵
  PID:10616
- C:\Windows\System\iVEpNwZ.exe
  C:\Windows\System\iVEpNwZ.exe
  2⤵
  PID:10636
- C:\Windows\System\drruveL.exe
  C:\Windows\System\drruveL.exe
  2⤵
  PID:10652
- C:\Windows\System\sYpOlUt.exe
  C:\Windows\System\sYpOlUt.exe
  2⤵
  PID:10672
- C:\Windows\System\CHVXVWk.exe
  C:\Windows\System\CHVXVWk.exe
  2⤵
  PID:10692
- C:\Windows\System\kconiMs.exe
  C:\Windows\System\kconiMs.exe
  2⤵
  PID:10716
- C:\Windows\System\FWhabMo.exe
  C:\Windows\System\FWhabMo.exe
  2⤵
  PID:10732
- C:\Windows\System\oICmlOp.exe
  C:\Windows\System\oICmlOp.exe
  2⤵
  PID:10752
- C:\Windows\System\zjlpFwS.exe
  C:\Windows\System\zjlpFwS.exe
  2⤵
  PID:10772
- C:\Windows\System\OfGwBat.exe
  C:\Windows\System\OfGwBat.exe
  2⤵
  PID:10792
- C:\Windows\System\gdkUyql.exe
  C:\Windows\System\gdkUyql.exe
  2⤵
  PID:10808
- C:\Windows\System\CqxcPSe.exe
  C:\Windows\System\CqxcPSe.exe
  2⤵
  PID:10840
- C:\Windows\System\IwwSeIA.exe
  C:\Windows\System\IwwSeIA.exe
  2⤵
  PID:11152
- C:\Windows\System\xtPeDPI.exe
  C:\Windows\System\xtPeDPI.exe
  2⤵
  PID:11168
- C:\Windows\System\gurvfBL.exe
  C:\Windows\System\gurvfBL.exe
  2⤵
  PID:11184
- C:\Windows\System\ZWIPkYS.exe
  C:\Windows\System\ZWIPkYS.exe
  2⤵
  PID:11204
- C:\Windows\System\dNiKawP.exe
  C:\Windows\System\dNiKawP.exe
  2⤵
  PID:11224
- C:\Windows\System\WwRXOyy.exe
  C:\Windows\System\WwRXOyy.exe
  2⤵
  PID:11240
- C:\Windows\System\GsnpgBo.exe
  C:\Windows\System\GsnpgBo.exe
  2⤵
  PID:9000
- C:\Windows\System\UKWPKrW.exe
  C:\Windows\System\UKWPKrW.exe
  2⤵
  PID:11284
- C:\Windows\System\sJGwiSl.exe
  C:\Windows\System\sJGwiSl.exe
  2⤵
  PID:11304
- C:\Windows\System\mkRyIap.exe
  C:\Windows\System\mkRyIap.exe
  2⤵
  PID:11324
- C:\Windows\System\xfzQNzh.exe
  C:\Windows\System\xfzQNzh.exe
  2⤵
  PID:11344
- C:\Windows\System\ZWFEbhc.exe
  C:\Windows\System\ZWFEbhc.exe
  2⤵
  PID:11360
- C:\Windows\System\DLUqRyq.exe
  C:\Windows\System\DLUqRyq.exe
  2⤵
  PID:11376
- C:\Windows\System\SHiUJCN.exe
  C:\Windows\System\SHiUJCN.exe
  2⤵
  PID:11392
- C:\Windows\System\JELbEDC.exe
  C:\Windows\System\JELbEDC.exe
  2⤵
  PID:11408
- C:\Windows\System\UHdlFlC.exe
  C:\Windows\System\UHdlFlC.exe
  2⤵
  PID:11428
- C:\Windows\System\EZDNEjR.exe
  C:\Windows\System\EZDNEjR.exe
  2⤵
  PID:11444
- C:\Windows\System\IPnwraq.exe
  C:\Windows\System\IPnwraq.exe
  2⤵
  PID:11464
- C:\Windows\System\vVCKZlx.exe
  C:\Windows\System\vVCKZlx.exe
  2⤵
  PID:11484
- C:\Windows\System\vfrgXIS.exe
  C:\Windows\System\vfrgXIS.exe
  2⤵
  PID:11504
- C:\Windows\System\yGNzyck.exe
  C:\Windows\System\yGNzyck.exe
  2⤵
  PID:11532
- C:\Windows\System\HWdxgaj.exe
  C:\Windows\System\HWdxgaj.exe
  2⤵
  PID:11552
- C:\Windows\System\wAAVofg.exe
  C:\Windows\System\wAAVofg.exe
  2⤵
  PID:11576
- C:\Windows\System\niXizgY.exe
  C:\Windows\System\niXizgY.exe
  2⤵
  PID:11600
- C:\Windows\System\JkCaMmT.exe
  C:\Windows\System\JkCaMmT.exe
  2⤵
  PID:11628
- C:\Windows\System\cXnIXAK.exe
  C:\Windows\System\cXnIXAK.exe
  2⤵
  PID:11656
- C:\Windows\System\OYYIzMC.exe
  C:\Windows\System\OYYIzMC.exe
  2⤵
  PID:11684
- C:\Windows\System\PzCCgaK.exe
  C:\Windows\System\PzCCgaK.exe
  2⤵
  PID:11700
- C:\Windows\System\SijidqB.exe
  C:\Windows\System\SijidqB.exe
  2⤵
  PID:11732
- C:\Windows\System\yvKmgMB.exe
  C:\Windows\System\yvKmgMB.exe
  2⤵
  PID:11752
- C:\Windows\System\yVQJZIW.exe
  C:\Windows\System\yVQJZIW.exe
  2⤵
  PID:11768
- C:\Windows\System\cGpNdKo.exe
  C:\Windows\System\cGpNdKo.exe
  2⤵
  PID:11784
- C:\Windows\System\ZDlWpjS.exe
  C:\Windows\System\ZDlWpjS.exe
  2⤵
  PID:11800
- C:\Windows\System\txdFziE.exe
  C:\Windows\System\txdFziE.exe
  2⤵
  PID:11816
- C:\Windows\System\FMxGTJO.exe
  C:\Windows\System\FMxGTJO.exe
  2⤵
  PID:11832
- C:\Windows\System\gsaspCH.exe
  C:\Windows\System\gsaspCH.exe
  2⤵
  PID:11848
- C:\Windows\System\ZvaJzxM.exe
  C:\Windows\System\ZvaJzxM.exe
  2⤵
  PID:11864
- C:\Windows\System\rSXxXJC.exe
  C:\Windows\System\rSXxXJC.exe
  2⤵
  PID:11896
- C:\Windows\System\JBHgTSd.exe
  C:\Windows\System\JBHgTSd.exe
  2⤵
  PID:11924
- C:\Windows\System\AFjkKVY.exe
  C:\Windows\System\AFjkKVY.exe
  2⤵
  PID:11968
- C:\Windows\System\rbDfvMo.exe
  C:\Windows\System\rbDfvMo.exe
  2⤵
  PID:11988
- C:\Windows\System\AnyjSbE.exe
  C:\Windows\System\AnyjSbE.exe
  2⤵
  PID:12012
- C:\Windows\System\zDMNhwu.exe
  C:\Windows\System\zDMNhwu.exe
  2⤵
  PID:12036
- C:\Windows\System\qfUvGrc.exe
  C:\Windows\System\qfUvGrc.exe
  2⤵
  PID:12072
- C:\Windows\System\BCBbjyg.exe
  C:\Windows\System\BCBbjyg.exe
  2⤵
  PID:12096
- C:\Windows\System\hIJcdas.exe
  C:\Windows\System\hIJcdas.exe
  2⤵
  PID:12144
- C:\Windows\System\TERMYfR.exe
  C:\Windows\System\TERMYfR.exe
  2⤵
  PID:12164
- C:\Windows\System\vTFyzeh.exe
  C:\Windows\System\vTFyzeh.exe
  2⤵
  PID:12180
- C:\Windows\System\WtGbFcy.exe
  C:\Windows\System\WtGbFcy.exe
  2⤵
  PID:12208
- C:\Windows\System\TdfJNAt.exe
  C:\Windows\System\TdfJNAt.exe
  2⤵
  PID:12232
- C:\Windows\System\FGKbthi.exe
  C:\Windows\System\FGKbthi.exe
  2⤵
  PID:12260
- C:\Windows\System\MkcTzzG.exe
  C:\Windows\System\MkcTzzG.exe
  2⤵
  PID:6508
- C:\Windows\System\lCLoAQr.exe
  C:\Windows\System\lCLoAQr.exe
  2⤵
  PID:7396
- C:\Windows\System\CoBKIPh.exe
  C:\Windows\System\CoBKIPh.exe
  2⤵
  PID:8304
- C:\Windows\System\JtEQjNt.exe
  C:\Windows\System\JtEQjNt.exe
  2⤵
  PID:6568
- C:\Windows\System\ZsdOnKN.exe
  C:\Windows\System\ZsdOnKN.exe
  2⤵
  PID:8524
- C:\Windows\System\OuFTymf.exe
  C:\Windows\System\OuFTymf.exe
  2⤵
  PID:9348
- C:\Windows\System\afDRTuU.exe
  C:\Windows\System\afDRTuU.exe
  2⤵
  PID:9976
- C:\Windows\System\PqJlvER.exe
  C:\Windows\System\PqJlvER.exe
  2⤵
  PID:12300
- C:\Windows\System\tVkQXSk.exe
  C:\Windows\System\tVkQXSk.exe
  2⤵
  PID:12316
- C:\Windows\System\fwVOcMw.exe
  C:\Windows\System\fwVOcMw.exe
  2⤵
  PID:12340
- C:\Windows\System\VttltSw.exe
  C:\Windows\System\VttltSw.exe
  2⤵
  PID:12356
- C:\Windows\System\rSgWktY.exe
  C:\Windows\System\rSgWktY.exe
  2⤵
  PID:12372
- C:\Windows\System\voJlucy.exe
  C:\Windows\System\voJlucy.exe
  2⤵
  PID:12396
- C:\Windows\System\jzpqJtz.exe
  C:\Windows\System\jzpqJtz.exe
  2⤵
  PID:12412
- C:\Windows\System\wighLRu.exe
  C:\Windows\System\wighLRu.exe
  2⤵
  PID:12428
- C:\Windows\System\SakVHei.exe
  C:\Windows\System\SakVHei.exe
  2⤵
  PID:12444
- C:\Windows\System\uXdjsMA.exe
  C:\Windows\System\uXdjsMA.exe
  2⤵
  PID:12460
- C:\Windows\System\zUNTtbV.exe
  C:\Windows\System\zUNTtbV.exe
  2⤵
  PID:12476
- C:\Windows\System\IlxWQNy.exe
  C:\Windows\System\IlxWQNy.exe
  2⤵
  PID:12492
- C:\Windows\System\BegPrHr.exe
  C:\Windows\System\BegPrHr.exe
  2⤵
  PID:12508
- C:\Windows\System\oNxXOTN.exe
  C:\Windows\System\oNxXOTN.exe
  2⤵
  PID:12524
- C:\Windows\System\xkolZJu.exe
  C:\Windows\System\xkolZJu.exe
  2⤵
  PID:12544
- C:\Windows\System\XnRxlkS.exe
  C:\Windows\System\XnRxlkS.exe
  2⤵
  PID:12560
- C:\Windows\System\DDsTaxp.exe
  C:\Windows\System\DDsTaxp.exe
  2⤵
  PID:12580
- C:\Windows\System\QNmDvBH.exe
  C:\Windows\System\QNmDvBH.exe
  2⤵
  PID:12596
- C:\Windows\System\UQDPKTU.exe
  C:\Windows\System\UQDPKTU.exe
  2⤵
  PID:12612
- C:\Windows\System\tRhnVjA.exe
  C:\Windows\System\tRhnVjA.exe
  2⤵
  PID:12628
- C:\Windows\System\xJBTtjK.exe
  C:\Windows\System\xJBTtjK.exe
  2⤵
  PID:12656
- C:\Windows\System\uvzsqcw.exe
  C:\Windows\System\uvzsqcw.exe
  2⤵
  PID:12720
- C:\Windows\System\jXGgzWv.exe
  C:\Windows\System\jXGgzWv.exe
  2⤵
  PID:12736
- C:\Windows\System\nOuhkMu.exe
  C:\Windows\System\nOuhkMu.exe
  2⤵
  PID:12752
- C:\Windows\System\JJmSQpP.exe
  C:\Windows\System\JJmSQpP.exe
  2⤵
  PID:12768
- C:\Windows\System\hQiJtPf.exe
  C:\Windows\System\hQiJtPf.exe
  2⤵
  PID:12784
- C:\Windows\System\AsuSewr.exe
  C:\Windows\System\AsuSewr.exe
  2⤵
  PID:12800
- C:\Windows\System\yLzgSny.exe
  C:\Windows\System\yLzgSny.exe
  2⤵
  PID:12816
- C:\Windows\System\UsqFApm.exe
  C:\Windows\System\UsqFApm.exe
  2⤵
  PID:12836
- C:\Windows\System\GiHzrvJ.exe
  C:\Windows\System\GiHzrvJ.exe
  2⤵
  PID:12852
- C:\Windows\System\liYmzKB.exe
  C:\Windows\System\liYmzKB.exe
  2⤵
  PID:12868
- C:\Windows\System\zqDHODq.exe
  C:\Windows\System\zqDHODq.exe
  2⤵
  PID:12884
- C:\Windows\System\vadFPiV.exe
  C:\Windows\System\vadFPiV.exe
  2⤵
  PID:12900
- C:\Windows\System\eVulpnb.exe
  C:\Windows\System\eVulpnb.exe
  2⤵
  PID:12916
- C:\Windows\System\iLYTivU.exe
  C:\Windows\System\iLYTivU.exe
  2⤵
  PID:12932
- C:\Windows\System\KNHepEn.exe
  C:\Windows\System\KNHepEn.exe
  2⤵
  PID:12948
- C:\Windows\System\TSAoJRZ.exe
  C:\Windows\System\TSAoJRZ.exe
  2⤵
  PID:12964
- C:\Windows\System\UGPBVzP.exe
  C:\Windows\System\UGPBVzP.exe
  2⤵
  PID:12980
- C:\Windows\System\ujPXOGs.exe
  C:\Windows\System\ujPXOGs.exe
  2⤵
  PID:12996
- C:\Windows\System\PgEavnd.exe
  C:\Windows\System\PgEavnd.exe
  2⤵
  PID:13012
- C:\Windows\System\izZoded.exe
  C:\Windows\System\izZoded.exe
  2⤵
  PID:13028
- C:\Windows\System\OjPQumF.exe
  C:\Windows\System\OjPQumF.exe
  2⤵
  PID:13044
- C:\Windows\System\uQDZmeA.exe
  C:\Windows\System\uQDZmeA.exe
  2⤵
  PID:13068
- C:\Windows\System\UrgCEbc.exe
  C:\Windows\System\UrgCEbc.exe
  2⤵
  PID:13088
- C:\Windows\System\kodsjDD.exe
  C:\Windows\System\kodsjDD.exe
  2⤵
  PID:13108
- C:\Windows\System\MbOools.exe
  C:\Windows\System\MbOools.exe
  2⤵
  PID:13124
- C:\Windows\System\YOYXfLR.exe
  C:\Windows\System\YOYXfLR.exe
  2⤵
  PID:13148
- C:\Windows\System\PKqadpP.exe
  C:\Windows\System\PKqadpP.exe
  2⤵
  PID:13180
- C:\Windows\System\IgLqMEr.exe
  C:\Windows\System\IgLqMEr.exe
  2⤵
  PID:13196
- C:\Windows\System\nzrsSdR.exe
  C:\Windows\System\nzrsSdR.exe
  2⤵
  PID:13216
- C:\Windows\System\TrosSQm.exe
  C:\Windows\System\TrosSQm.exe
  2⤵
  PID:13232
- C:\Windows\System\kULDGnf.exe
  C:\Windows\System\kULDGnf.exe
  2⤵
  PID:13252
- C:\Windows\System\DZeIYLu.exe
  C:\Windows\System\DZeIYLu.exe
  2⤵
  PID:13272
- C:\Windows\System\AdNAYoS.exe
  C:\Windows\System\AdNAYoS.exe
  2⤵
  PID:13292
- C:\Windows\System\XwWsQFd.exe
  C:\Windows\System\XwWsQFd.exe
  2⤵
  PID:10152
- C:\Windows\System\hlwMiJP.exe
  C:\Windows\System\hlwMiJP.exe
  2⤵
  PID:10320
- C:\Windows\System\oWhONZH.exe
  C:\Windows\System\oWhONZH.exe
  2⤵
  PID:10360
- C:\Windows\System\HYGkuWz.exe
  C:\Windows\System\HYGkuWz.exe
  2⤵
  PID:10396
- C:\Windows\System\GCWulrh.exe
  C:\Windows\System\GCWulrh.exe
  2⤵
  PID:10492
- C:\Windows\System\DSYmeGR.exe
  C:\Windows\System\DSYmeGR.exe
  2⤵
  PID:10552
- C:\Windows\System\FGgDvnK.exe
  C:\Windows\System\FGgDvnK.exe
  2⤵
  PID:10608
- C:\Windows\System\WjNYarC.exe
  C:\Windows\System\WjNYarC.exe
  2⤵
  PID:10764
- C:\Windows\System\acvuCKg.exe
  C:\Windows\System\acvuCKg.exe
  2⤵
  PID:4404
- C:\Windows\System\bliIQTa.exe
  C:\Windows\System\bliIQTa.exe
  2⤵
  PID:8368
- C:\Windows\System\atCnqAK.exe
  C:\Windows\System\atCnqAK.exe
  2⤵
  PID:7968
- C:\Windows\System\OlUpfib.exe
  C:\Windows\System\OlUpfib.exe
  2⤵
  PID:8052
- C:\Windows\System\heCkbtg.exe
  C:\Windows\System\heCkbtg.exe
  2⤵
  PID:6488
- C:\Windows\System\lmRVQOq.exe
  C:\Windows\System\lmRVQOq.exe
  2⤵
  PID:11696
- C:\Windows\System\iOMyRTA.exe
  C:\Windows\System\iOMyRTA.exe
  2⤵
  PID:9776
- C:\Windows\System\afkLSEn.exe
  C:\Windows\System\afkLSEn.exe
  2⤵
  PID:9832
- C:\Windows\System\OAItidf.exe
  C:\Windows\System\OAItidf.exe
  2⤵
  PID:8268
- C:\Windows\System\pnoUDkV.exe
  C:\Windows\System\pnoUDkV.exe
  2⤵
  PID:10100
- C:\Windows\System\zMobnDx.exe
  C:\Windows\System\zMobnDx.exe
  2⤵
  PID:10248
- C:\Windows\System\gdwLfhi.exe
  C:\Windows\System\gdwLfhi.exe
  2⤵
  PID:10528
- C:\Windows\System\vMoNFgE.exe
  C:\Windows\System\vMoNFgE.exe
  2⤵
  PID:10728
- C:\Windows\System\oMHAghK.exe
  C:\Windows\System\oMHAghK.exe
  2⤵
  PID:12624
- C:\Windows\System\LMILrrI.exe
  C:\Windows\System\LMILrrI.exe
  2⤵
  PID:10832
- C:\Windows\System\SQkzTFq.exe
  C:\Windows\System\SQkzTFq.exe
  2⤵
  PID:9068
- C:\Windows\System\nioFaMa.exe
  C:\Windows\System\nioFaMa.exe
  2⤵
  PID:9100
- C:\Windows\System\gDliSsl.exe
  C:\Windows\System\gDliSsl.exe
  2⤵
  PID:9132
- C:\Windows\System\etbpdXT.exe
  C:\Windows\System\etbpdXT.exe
  2⤵
  PID:9168
- C:\Windows\System\YmuWCZe.exe
  C:\Windows\System\YmuWCZe.exe
  2⤵
  PID:9212
- C:\Windows\System\PYTkPWL.exe
  C:\Windows\System\PYTkPWL.exe
  2⤵
  PID:6764
- C:\Windows\System\UkqmTQr.exe
  C:\Windows\System\UkqmTQr.exe
  2⤵
  PID:6836
- C:\Windows\System\nrJUXkk.exe
  C:\Windows\System\nrJUXkk.exe
  2⤵
  PID:6940
- C:\Windows\System\yQUBTgw.exe
  C:\Windows\System\yQUBTgw.exe
  2⤵
  PID:7128
- C:\Windows\System\fgWjElc.exe
  C:\Windows\System\fgWjElc.exe
  2⤵
  PID:5944
- C:\Windows\System\dAEuqEI.exe
  C:\Windows\System\dAEuqEI.exe
  2⤵
  PID:7824
- C:\Windows\System\oIvoBxc.exe
  C:\Windows\System\oIvoBxc.exe
  2⤵
  PID:3644
- C:\Windows\System\kXUuRyw.exe
  C:\Windows\System\kXUuRyw.exe
  2⤵
  PID:5600
- C:\Windows\System\xVjzLVB.exe
  C:\Windows\System\xVjzLVB.exe
  2⤵
  PID:6220
- C:\Windows\System\OlzOfVw.exe
  C:\Windows\System\OlzOfVw.exe
  2⤵
  PID:6052
- C:\Windows\System\vIQLVSV.exe
  C:\Windows\System\vIQLVSV.exe
  2⤵
  PID:12844
- C:\Windows\System\cRfBMtD.exe
  C:\Windows\System\cRfBMtD.exe
  2⤵
  PID:8736
- C:\Windows\System\OvABYCb.exe
  C:\Windows\System\OvABYCb.exe
  2⤵
  PID:8856
- C:\Windows\System\pMCWSFF.exe
  C:\Windows\System\pMCWSFF.exe
  2⤵
  PID:9292
- C:\Windows\System\oCUtkEQ.exe
  C:\Windows\System\oCUtkEQ.exe
  2⤵
  PID:13100
- C:\Windows\System\COircxU.exe
  C:\Windows\System\COircxU.exe
  2⤵
  PID:12060
- C:\Windows\System\hlMCjyp.exe
  C:\Windows\System\hlMCjyp.exe
  2⤵
  PID:12080
- C:\Windows\System\WhidFYI.exe
  C:\Windows\System\WhidFYI.exe
  2⤵
  PID:9556
- C:\Windows\System\rqXNloK.exe
  C:\Windows\System\rqXNloK.exe
  2⤵
  PID:9624
- C:\Windows\System\yeIZljz.exe
  C:\Windows\System\yeIZljz.exe
  2⤵
  PID:13208
- C:\Windows\System\chfbvop.exe
  C:\Windows\System\chfbvop.exe
  2⤵
  PID:9852
- C:\Windows\System\nrqEjGf.exe
  C:\Windows\System\nrqEjGf.exe
  2⤵
  PID:9892
- C:\Windows\System\kJrOSLr.exe
  C:\Windows\System\kJrOSLr.exe
  2⤵
  PID:9944
- C:\Windows\System\wJYYmTP.exe
  C:\Windows\System\wJYYmTP.exe
  2⤵
  PID:9964
- C:\Windows\System\NqkdCCK.exe
  C:\Windows\System\NqkdCCK.exe
  2⤵
  PID:9996
- C:\Windows\System\GzrZAsq.exe
  C:\Windows\System\GzrZAsq.exe
  2⤵
  PID:10020
- C:\Windows\System\xUHiDnu.exe
  C:\Windows\System\xUHiDnu.exe
  2⤵
  PID:8648
- C:\Windows\System\UOotnQK.exe
  C:\Windows\System\UOotnQK.exe
  2⤵
  PID:10132
- C:\Windows\System\urGLyqi.exe
  C:\Windows\System\urGLyqi.exe
  2⤵
  PID:10356
- C:\Windows\System\ReevVib.exe
  C:\Windows\System\ReevVib.exe
  2⤵
  PID:11332
- C:\Windows\System\CbfiPtn.exe
  C:\Windows\System\CbfiPtn.exe
  2⤵
  PID:11420
- C:\Windows\System\eRjEobK.exe
  C:\Windows\System\eRjEobK.exe
  2⤵
  PID:11668
- C:\Windows\System\EILGlFf.exe
  C:\Windows\System\EILGlFf.exe
  2⤵
  PID:11812
- C:\Windows\System\AXidiMh.exe
  C:\Windows\System\AXidiMh.exe
  2⤵
  PID:12928
- C:\Windows\System\vfjyMtQ.exe
  C:\Windows\System\vfjyMtQ.exe
  2⤵
  PID:12956
- C:\Windows\System\XQszaoM.exe
  C:\Windows\System\XQszaoM.exe
  2⤵
  PID:12972
- C:\Windows\System\BSvchiA.exe
  C:\Windows\System\BSvchiA.exe
  2⤵
  PID:11916
- C:\Windows\System\qSkkHhk.exe
  C:\Windows\System\qSkkHhk.exe
  2⤵
  PID:13064
- C:\Windows\System\rXllUFd.exe
  C:\Windows\System\rXllUFd.exe
  2⤵
  PID:11976
- C:\Windows\System\euesIVP.exe
  C:\Windows\System\euesIVP.exe
  2⤵
  PID:12008
- C:\Windows\System\eZxlaPB.exe
  C:\Windows\System\eZxlaPB.exe
  2⤵
  PID:12152
- C:\Windows\System\VZQOmOB.exe
  C:\Windows\System\VZQOmOB.exe
  2⤵
  PID:13668
- C:\Windows\System\GgknZrP.exe
  C:\Windows\System\GgknZrP.exe
  2⤵
  PID:13684
- C:\Windows\System\MfQWFpd.exe
  C:\Windows\System\MfQWFpd.exe
  2⤵
  PID:13700
- C:\Windows\System\AHGxtqC.exe
  C:\Windows\System\AHGxtqC.exe
  2⤵
  PID:13716
- C:\Windows\System\CsZZGdt.exe
  C:\Windows\System\CsZZGdt.exe
  2⤵
  PID:13732
- C:\Windows\System\yJGhnpX.exe
  C:\Windows\System\yJGhnpX.exe
  2⤵
  PID:13748
- C:\Windows\System\hmlEquh.exe
  C:\Windows\System\hmlEquh.exe
  2⤵
  PID:13764
- C:\Windows\System\FYCIvBO.exe
  C:\Windows\System\FYCIvBO.exe
  2⤵
  PID:13780
- C:\Windows\System\hxLIBmX.exe
  C:\Windows\System\hxLIBmX.exe
  2⤵
  PID:13796
- C:\Windows\System\DPfbkrJ.exe
  C:\Windows\System\DPfbkrJ.exe
  2⤵
  PID:13812
- C:\Windows\System\gBHnDPS.exe
  C:\Windows\System\gBHnDPS.exe
  2⤵
  PID:13840
- C:\Windows\System\qvdfBOq.exe
  C:\Windows\System\qvdfBOq.exe
  2⤵
  PID:13856
- C:\Windows\System\pckxUGy.exe
  C:\Windows\System\pckxUGy.exe
  2⤵
  PID:13876
- C:\Windows\System\CNYkdQz.exe
  C:\Windows\System\CNYkdQz.exe
  2⤵
  PID:13908
- C:\Windows\System\rSoiMdg.exe
  C:\Windows\System\rSoiMdg.exe
  2⤵
  PID:13944
- C:\Windows\System\FbXcFvA.exe
  C:\Windows\System\FbXcFvA.exe
  2⤵
  PID:13976
- C:\Windows\System\XlrNjIa.exe
  C:\Windows\System\XlrNjIa.exe
  2⤵
  PID:14016
- C:\Windows\System\XmjTnKq.exe
  C:\Windows\System\XmjTnKq.exe
  2⤵
  PID:14044
- C:\Windows\System\iSmRxFw.exe
  C:\Windows\System\iSmRxFw.exe
  2⤵
  PID:14068
- C:\Windows\System\KmKYjvr.exe
  C:\Windows\System\KmKYjvr.exe
  2⤵
  PID:14096
- C:\Windows\System\XONvQuO.exe
  C:\Windows\System\XONvQuO.exe
  2⤵
  PID:14132
- C:\Windows\System\GJMTKBW.exe
  C:\Windows\System\GJMTKBW.exe
  2⤵
  PID:14148
- C:\Windows\System\AJfDLtU.exe
  C:\Windows\System\AJfDLtU.exe
  2⤵
  PID:14164
- C:\Windows\System\yVaKlMQ.exe
  C:\Windows\System\yVaKlMQ.exe
  2⤵
  PID:14180
- C:\Windows\System\AxscUCa.exe
  C:\Windows\System\AxscUCa.exe
  2⤵
  PID:14196
- C:\Windows\System\vliGizH.exe
  C:\Windows\System\vliGizH.exe
  2⤵
  PID:14228
- C:\Windows\System\kwVudDy.exe
  C:\Windows\System\kwVudDy.exe
  2⤵
  PID:14248
- C:\Windows\System\riElUkl.exe
  C:\Windows\System\riElUkl.exe
  2⤵
  PID:14268
- C:\Windows\System\UoSmOVW.exe
  C:\Windows\System\UoSmOVW.exe
  2⤵
  PID:14328
- C:\Windows\System\whOkeIT.exe
  C:\Windows\System\whOkeIT.exe
  2⤵
  PID:4224
- C:\Windows\System\UxOyoCY.exe
  C:\Windows\System\UxOyoCY.exe
  2⤵
  PID:9980

Network

DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

68.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.32.126.40.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

105.83.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

105.83.221.88.in-addr.arpa

IN PTR

Response

105.83.221.88.in-addr.arpa

IN PTR

a88-221-83-105deploystaticakamaitechnologiescom

No results found

8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

68.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

68.32.126.40.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

105.83.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

105.83.221.88.in-addr.arpa
8.8.8.8:53

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AEpGUdZ.exe

Filesize
1.2MB

MD5
c6ed2c4d9c1c39b5b36e96319f7d7806

SHA1
5d8ea15365f3bb2e5f1505df622e9fa60ade47e3

SHA256
72398e11c036e085015ea991d8e6b9997aa92fbf10dca296a2ab4860db0cbcef

SHA512
d2a63c106629fb566d687278c23432111ef5d89f05f1328cb40bb95491c800c2748a64cf9a176d580526c778992c9d236fadc0fd802b55ad71f49a3670ec9204

Download Submit
C:\Windows\System\BHrHBsA.exe

Filesize
1.2MB

MD5
fdb5c16a0b371cc54c91d146e7af8a45

SHA1
e8f200f526b1477edfc3749201c2de9bd46862bb

SHA256
50cc55f9bdb038ccafa851f065c65c55efe9f8f88cab5e2115da75b4f1e76f49

SHA512
69faccfc766514e070374acda65aabb322e9fb33e30d9946123855c6041021c1626d2870352c1c74817dc3b1bacaab74640bc2e5cd16254346f8e6fb19b84463

Download Submit
C:\Windows\System\BcQdXVc.exe

Filesize
1.2MB

MD5
5d1561c4fa006ec577606736fdcc38e8

SHA1
9a9fdb9d26e9b97bcb7cc77747953df818404c90

SHA256
9917045cae049bc036ee30dcdc4a92e7bc9fb3edf1758fe1380cba3c9dc7f19a

SHA512
21cc6d755ceac04edd87ec937467a61c19a5af2066a8fb4c67551b07f351a95819dbab466adb0724664e1b64ca3ade8b96bc829001a11eca9b5f747ae65e3de2

Download Submit
C:\Windows\System\BzAFYbn.exe

Filesize
1.2MB

MD5
b900e3ba4ffcafa5245796dbc46926b1

SHA1
eb454285024aa67a6f38f3073ddd5a7dc6e96f0f

SHA256
cc1cf874b03560fcf76f83c395eb1d935d96b4d17b1e549789ef7f19b4b5e189

SHA512
3e1e71f9cec29167a91ed2014e4ecbeaec9d6cfbe31f438293e92756fb835f5b8665f638e6bfe9f66bed8095330a26497e926385dbf4629b7d174144750cf2fa

Download Submit
C:\Windows\System\FFiknUQ.exe

Filesize
1.2MB

MD5
82e7cc9e2e3686804ca3d2e51c0d9eee

SHA1
8a47bcb7a7b5f09d199e36da1d72e1482a10db04

SHA256
6f5d80b96d693e38b3078cbe4df5b945e2ecfb295ee8077656d557239b4a04d0

SHA512
346c47438c49a34ecfd1a5b93582409c4b2514ae601d36759e885a29cbc98d620f7c60a966778903c50d549c2007e312d2b968e2e7b4e1f10ff40e7a2369ad08

Download Submit
C:\Windows\System\GYAGYVP.exe

Filesize
1.2MB

MD5
a318e58b1579a034775c00236fcf0ebb

SHA1
582c9bf2af467b65826522a8868d5b4bc6b9a7c2

SHA256
047277d5aa4774a4bac1ed32b3e426b1e2e8e11e85eaaddf2a7101ac211d61b0

SHA512
b598af921d83000bb7c6cbd5fa5dc7aac7f9f68dfb9b3e737187939a95124d4733f60eb8fa8befe1dfb3fc2045f05e77e8c2b7a833bf98ea858df2c83bcbb6dd

Download Submit
C:\Windows\System\IVeFaxo.exe

Filesize
1.2MB

MD5
ff7547128c6526724aea91f13a38ec7b

SHA1
25c27e46dda68ba5ffa89bd14d63fa23b4fff578

SHA256
21b9f35ba877fa24ec9ab4cdc70b0c2f336e2be97b4a169fc239418cabcd3c27

SHA512
87efb9963beb9932e0c641f7cc5b3f9fbcc07c6ec99ec56720c4034bcb0889046c21b9912209c397b4aab71773001fe0d14d7490c802c676a4089738d2f12956

Download Submit
C:\Windows\System\JCsuDyv.exe

Filesize
1.2MB

MD5
1ed844914c2e31725a758e76edebdeb0

SHA1
7c13c8e2fdd487fdeb1d616d69edcb1f01e5b1d0

SHA256
dd4a0c9792940aabd9ddbb3cd254e24acff5c96f14276d782e51b4fc3336f77c

SHA512
8bdffeddd09034798eb23dcc0ffcd2b1e65808a881ec8f60d86ff722b06898f7f322b9b435281c2cd007c67bb97aedf051bded911ff316881d5c9ceae4eb4eed

Download Submit
C:\Windows\System\KmKiOzM.exe

Filesize
1.2MB

MD5
9e9abb96f2c1a9c9c13b5706c166a770

SHA1
2fe7210d04e772734b9cf690964014e03ac526fb

SHA256
5de42ae4f25dd75bdd068212aca286b9212f0d38df183a7d8ef049a936fbd02c

SHA512
51ddc8f1505719cc56c1f323e1fea7bbdaa3d1995d3eca5617c4423b9403533f842ee014850e12044018cb1bce1054cef9ca5e75a9982d1af7fb70fe3b3c1d05

Download Submit
C:\Windows\System\LPRwoTf.exe

Filesize
1.2MB

MD5
95d10ed58ddfed6a2c08efa73b2f297d

SHA1
c083bcc0c39f0450a7d762db69167b5a1d3fcf73

SHA256
dc9320c36a581f1e8f47d47f96de5e671931f229fd1d8f5dc42478aebed9e9fd

SHA512
e4eeb7d3217a5d73437a28707e6b15612b74c1f221c9a84f1281f6be3397076d4aaf3ca85a9f29f5091cd118d09093f9c73b86ffde129fb88dc72b3f0e6c20b2

Download Submit
C:\Windows\System\LakfYgd.exe

Filesize
1.2MB

MD5
71a05b970d634453b82f30b14216fd45

SHA1
769d5c34ecf29ae9acf43fdcb3fe3610ef15bc2b

SHA256
0097770bcdab1481095bbcf362b41c0398f891421e204ae0e717582500dba65b

SHA512
3ecd51ab0c3fa883b40b910de9c0f4544452b26a2d0f89f6f07fd08ea0871441c21f3287d370780c46cf1c9f532adc4a7072c760baf7d56d7b0ee623c170a794

Download Submit
C:\Windows\System\MpYOzbH.exe

Filesize
1.2MB

MD5
0d8dccce6e4b687cb3ccd29304682996

SHA1
dbbb157a6cb1ee463a8e18168b84971d7aa7ffcd

SHA256
4896932ef6f20632c87008646a0b9249a28ded12fc5db08a6da87c7b438de9cd

SHA512
f12ce264aac5e71b78b3323fa2f02698d0c56e87f87aa37dc18359ad4cfdaa1693d7d11d5e11f5b14523394165c4e01c990dc10eacfc7e034e77a3cb14ba96fe

Download Submit
C:\Windows\System\Oaejyrl.exe

Filesize
1.2MB

MD5
b488b0b17c270ff20d2e48149a8475a9

SHA1
d15ade1231c0a0ded516380c684a1bf807cc63d6

SHA256
17fe9b0e9e7580d68ea0ad07d4cd2a756da68f1c1a3358fd905a71f2c932e330

SHA512
a3cffd5ec2a658c9adc7d4780c6ce4ea930774bafe86f6fd51d97244ec6a636ccdfbcff85300046695c2a9e6a9c7c480534bac5e4df1740d80920b9b5a287d62

Download Submit
C:\Windows\System\PGfkDQR.exe

Filesize
1.2MB

MD5
af294ffaeeaa5db403d7634798b38b81

SHA1
4d7cc591e60e7070412e98ea3c6b3efb52e1c4d4

SHA256
9475431a7608867bd24e2d39740c07a75c005afddddaf8b1fae39dd52aa836a6

SHA512
9c65c7865355fe193aefa3149b9af1e4c1497832e0d49810578f761c2704245371c085faa0165dd7665bee0448a717472ad096a1b0594c189bc0b66086975bad

Download Submit
C:\Windows\System\RDuSzOE.exe

Filesize
1.2MB

MD5
39a1746093daef9b3e5ae5e1776404f1

SHA1
ed44641af8acff9fc7fff53e4788f87f6a0cc782

SHA256
540678d2b4bf88ea7d7235894e0987930b1cc180ec2dc14caa78255fd9f62682

SHA512
b15c00803af2d9af392972e82d741ac0f55bf22862c7ae54cfd5bb8ec5e802ea10d601dd6a26b696448ddae06fe929595def5063cd0a0ba6e6ec32360f0b2218

Download Submit
C:\Windows\System\RoNsAwu.exe

Filesize
1.2MB

MD5
3352ac938a8135b4e51538d0f02a6d7e

SHA1
303f48f62574ba95877f4afbfb6f4b3eb1400a92

SHA256
ef1c0ec49f123efaba1f81f877589dfa03ec7659c7411341ed3180e13fea4650

SHA512
73e1cb6877093cd5ed5d5f8282c80e4e6f4d2914423a34c5165efab55f8825765c10bddb04f1509b63ef0d85883fe05c0801f70f4acb3566ce1484918aa563c0

Download Submit
C:\Windows\System\SBByVjZ.exe

Filesize
1.2MB

MD5
f80b8ebfa4453dd0a3f7f0215bbd9b79

SHA1
faaa5245591c64d47a4ca826d5789599cbc95ce9

SHA256
ddceb15de57c6ebcffa5b02e8336796c559b3c6bf46638317f77e319b2c445c2

SHA512
efd41afed2314032149c2b5843b0c9ecf95dbafc75a0e0f9890647a09d5d7722ca2e82281bf802850e8835507456c9cb768d1167db50f2487c888b7cc8685d8b

Download Submit
C:\Windows\System\SaTclYU.exe

Filesize
1.2MB

MD5
152d8246e39841117ff13c0c7a5a8ffe

SHA1
d56cad9af3647bac83a165023ad38b0f55fb29a4

SHA256
cbd8be427d398eb18ed5fd5291616a325c99985ca01bf3b1470ada3f6756df90

SHA512
09b795e2d3085c8819d261c354bccb2069a261290912a411976b3d3c74b631512aa576564ae9086b8d709172d03136bf67bdcefbb725d0ee77e01497ac30d0c4

Download Submit
C:\Windows\System\SkmQHqg.exe

Filesize
1.2MB

MD5
d2de74e37a920a315865fbb01b75f01f

SHA1
7cb45b99c6b53285e0baf871e4219427286872b4

SHA256
9f5f91f0be790b70f8a672c76443153000c2e257d76d053242aae283783f9451

SHA512
ea588a72078480c26f97fca1cf87849bd937262762f91a57e097846e83575bfbb87b612e376363fde9e1fecd0250f5964e4ef9bf4da85f150bfdb6ac3877d634

Download Submit
C:\Windows\System\UsmUwpD.exe

Filesize
1.2MB

MD5
b16c1263f80ea114ea6abbd117ccd720

SHA1
99a499390e0e4d1d5a758976ebef919ea0375a23

SHA256
758950135cd0ed75eefca745d402334cb6d0e8484aafaac7d0f9a84c70fc19a7

SHA512
e8734c8f09ce99ce8e79041ed77f77b4af4014f8283d5873b3ef5580713241d88abbaa4e12bc08c9398a32f89bb57b69a17ec503d3ac0675a1837d32a852b2fb

Download Submit
C:\Windows\System\XJZSTho.exe

Filesize
1.2MB

MD5
616686b0522d9d873761a2c71c019dbf

SHA1
a2a18853435b46725729b6316ed0baf5ef9a24c0

SHA256
2b5ff0871b90ac44d894808b88ffb429d867d9c9281b6b719cbd92ad76f47fb5

SHA512
c917443b702a9a3d86a41f8b597f5e7b1939575066bd6996742632d21c9c824774f364203ee3e44511a8eb5135cc9ad78a6ce9b95949e83f4c5ef05b89bb4959

Download Submit
C:\Windows\System\XMHDXiM.exe

Filesize
1.2MB

MD5
aa8bbdf48f7934d6b66b248f00cc5a5a

SHA1
d6d89ed6e4812bb5ace8fc0d2436c2b8779117d1

SHA256
071a84e09e2f14abc35d5a86ee72ec3f2db0316272b716c14d1db11248521549

SHA512
67dcacb5378a057af71d0fc312ac005df0fa10a35acfde085ba033e139d7a84f23d50aec036d0fcdf9d19a4afd654b1cf8c4ae15790fcf90ddbf90d13565b71c

Download Submit
C:\Windows\System\YQowRhN.exe

Filesize
1.2MB

MD5
8a887af118d3bd2111c2ceb5eced2e05

SHA1
9d52ace9361315c34c61c85ac42e194f3e4b75d6

SHA256
c772d26be39f23ef9c2fb5025f27d5444d3703c3dee7db83504d3f53aa3762db

SHA512
dbd94ddabb972ae8e8957297aefc01d2970cf57515a8355eb222b217fd1773f8047c7489310d19abd8370af2c9858193d60da08f7f60d022cca5b66df388c16b

Download Submit
C:\Windows\System\bXUGGBR.exe

Filesize
1.2MB

MD5
4c11a3445c90670281d368a6093b1600

SHA1
0f0e219b45a8d1cc4c2c9c34379515ea5bb3bc0c

SHA256
d93ae6fe7a711e7bfafc5741aba343e16b9f48af27d5a0c0c6b2443d594bd4ae

SHA512
c1bb148219f6b974a9efc4e3b0fa3d772cf295dd61031ec9073cafb75d1767356bc7c61f04cc519a8620729edaf8d875d4f5a6e5a610e605dc53036fa8ab1133

Download Submit
C:\Windows\System\hCqbfbh.exe

Filesize
1.2MB

MD5
5051704be70059377642c826c857f545

SHA1
0157f8af3c8d09bdf69f8777a3e56bf3034d349b

SHA256
415fad07a5090829225123a21bc40d2874df270db457662b8b7f28a3d4ac25d2

SHA512
875898dacef29ae0efb80914fe6313e02d3a5438513ea1f7fae3cf91e4e58d897a14587d9112e6c7389fba22b057d9af20e691952e64c2334f24a3bddafd2174

Download Submit
C:\Windows\System\hmhuJAv.exe

Filesize
1.2MB

MD5
9c971b7b785748f05c23ce458af8416a

SHA1
a67e37f3d05ff104c678c1aed4a17caba56ba8d4

SHA256
d7fbc024d8daa5991e9259f8e4a714acafaaa1aee60588126416a11a51949339

SHA512
b45b5e6ad73e525ece4f565de0790df78f71633543243155ba9d9bf38f67ad287512aba1f3069e9a3ae122a312a4529e2ef568b574f1779a9954feead29ca54d

Download Submit
C:\Windows\System\klSrfCF.exe

Filesize
1.2MB

MD5
467a48087efd774f50af0c6b6ce8fbbf

SHA1
d379e4ccdb85b9aaba8ff9b55003ae97e2b80ca0

SHA256
64a0e3134cdf7f8992e83b4dc00d7ad98ae5bb4645de3c1342ee83b4d4c2031a

SHA512
bdc77a64a33cd7b27b4dc2c80545f8146149892c7dfc35ee4c51528056cec8b7ba943ac1227ab75fd3da558a98b27df96c1f005e7e220e7ef82bc1a0c22c74b1

Download Submit
C:\Windows\System\mNvSDDh.exe

Filesize
1.2MB

MD5
9c3e4687aed564de51ff9ec8dab0efaa

SHA1
a55006f2fe56aad01f06f0d1252b0139c2e0993e

SHA256
9583e0f4de994782632d421335af06bad1ffacfb657af7a787628663b26a0c9d

SHA512
6496c54b44c362268b9d7d2c1de78936502e4758d00709447904289e3e2975e3f43d3c855553e4fdf8c90212eab296c9c76e2abc63c4d063c289b9dfda299121

Download Submit
C:\Windows\System\mOJinjI.exe

Filesize
1.2MB

MD5
ec84b8bf7ff02b39fccf5417db178bec

SHA1
d0284099de4a8dc382049275c145a145ce097c72

SHA256
f03afccd025290721953eb09d6647fa32f17784a556314a0bf0fe7545d491be6

SHA512
6415d331b85d21da921fe1e5b6082a234f535174f5edb0cc089e86e610dbaf869b460f7e880427844b6d12d9c122cb6081624056fa79744eec972757c9111406

Download Submit
C:\Windows\System\oNJRJRl.exe

Filesize
1.2MB

MD5
8a2eef1c3ca114b00d0675f273f633ed

SHA1
1e1b2d24d0fb81b4037dc7b7f976f264c036f1ca

SHA256
223733d9a45f064bced9378fd511cb9991ebd09f77caa2b01c82325e8ff219d0

SHA512
c946028494e7786977877b058da35ba6a001e0ede6304c6a7b9bac5b372d88259cf7d906e52bc8a1b2446abf3a5f1b7ea5d16a05d75a4c320e175ca757131ff4

Download Submit
C:\Windows\System\piKbnhF.exe

Filesize
1.2MB

MD5
c6029543a5b03dc22ab120cca88f86f5

SHA1
64703e10bbcc8aabd791f3d8d06a4b4ab4f5848c

SHA256
306b6dacf27a082e5e3b394c3441f27996e4e0fd1c8a1cd29e27c55ffd63d21a

SHA512
dcbc863064c58cbd262fe963a2350c686a4f9c6b2ea70ad7b27d37313ba6e8943e5b5bcf0cc174d1250996201a85df713badb15ae0137ab6a1303d2b66174fdd

Download Submit
C:\Windows\System\qCANcld.exe

Filesize
1.2MB

MD5
50243d270e6c0a8357e0ad781e2fae46

SHA1
d7ec19d450600413f8991b688427a794bc860f2c

SHA256
dea51742930a82d7d578bb836412b134083cbd0859ca7422366266ca20187aa8

SHA512
b885ab2ec65254571004905b6bc65ca8d89f90bd90240f55ec3f8530667d670fa8c48aa5634c20b6322bfe4b7f264fa47c49b2bf062140916807098d85cef7c2

Download Submit
C:\Windows\System\uMsILYc.exe

Filesize
1.2MB

MD5
32d884fad1e542e18b497fbe50ac8551

SHA1
87b90a241baecba4543ac40b32f47eead3d2918f

SHA256
7db6a50e29894cfef8f705d1d9d1fe2dc261e15d2910d922bed727c82ddf39ad

SHA512
6be15c7538a0ce18169a086c14a440bf3108a8557b5b1d52c91e33181bb02279bf995421f0f4fd84f51e063c85c59ccc8d786d174bdecb0cd951f5f3ddd584f0

Download Submit
C:\Windows\System\woyWFZf.exe

Filesize
1.2MB

MD5
4814f665179c6123e600209159df4019

SHA1
74f5d691c232f9eb86c856452be2047ae2ba91e7

SHA256
df02314851945ff5366f4700dd7af218ca6cfc0654acc3f70b8acebba593074a

SHA512
4450c4c87443d5128a669fc2b1727f9e4783c78088d491030b248404c6e629688115c8600f3d597612b2183129ee2c7feb11400a939167a6e18d18ece64a1488

Download Submit
C:\Windows\System\yJTDKQJ.exe

Filesize
1.2MB

MD5
dc8da9140bd7db1ed055c387bc884cf4

SHA1
9a7ecc4434615bb888211fceeb43baf33e40287e

SHA256
1937bd66974ef42a7a81094aaf8df6f53a7f1f5ea43271d6b17e3673fd07fc55

SHA512
7408792c34481f3e1e8fd3eaaa917a1fdd157b4c98a3acb2ea951df1a20597fc5dc4945865e9e0a9c916a97bf4fb45b9d878fdd3f8a5507a12112ca7a19d2aef

Download Submit
C:\Windows\System\ysPUYqH.exe

Filesize
1.2MB

MD5
912f21f1df9f19e7d17c514413317a50

SHA1
09df5ae5d705e581589f833a9177670855886cd5

SHA256
89d61ffb8dcbdc68f59d69a111ede675de1e1694742875e0b399051c8440bca4

SHA512
fb6224807f398f99360dd4a915ae478099da0ea1afa067cb8edd0651ef37275bd19ff7032aefee1549fbd180f1d919ae7539d7d7b569716626dc2673f8118c56

Download Submit
C:\Windows\System\zLnqgmN.exe

Filesize
1.2MB

MD5
5c1d3f807f3f872bf625613c1c4a2a08

SHA1
867f58f2e6f5b3e087942f301a71837165018b53

SHA256
2cce210a82c137988c23aa5b4febfd01ef8d67f776b9ea899f1cd421342a44b7

SHA512
febdf96961f6d70a6eaaf1d30988b05d93409eb0d785b82d480d7172358e7cc1aae9f54b692d2582b51a99b1768d4a1a6956b7d9e915ce10c3dc6780d67c69f8

Download Submit
memory/556-884-0x00007FF759C10000-0x00007FF759F61000-memory.dmp

Filesize
3.3MB

Download
memory/556-2114-0x00007FF759C10000-0x00007FF759F61000-memory.dmp

Filesize
3.3MB

Download
memory/744-1-0x00000182A0240000-0x00000182A0250000-memory.dmp

Filesize
64KB

Download
memory/744-1994-0x00007FF747DF0000-0x00007FF748141000-memory.dmp

Filesize
3.3MB

Download
memory/744-0-0x00007FF747DF0000-0x00007FF748141000-memory.dmp

Filesize
3.3MB

Download
memory/1020-2124-0x00007FF6A6660000-0x00007FF6A69B1000-memory.dmp

Filesize
3.3MB

Download
memory/1020-229-0x00007FF6A6660000-0x00007FF6A69B1000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2158-0x00007FF757D60000-0x00007FF7580B1000-memory.dmp

Filesize
3.3MB

Download
memory/1224-621-0x00007FF757D60000-0x00007FF7580B1000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2097-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp

Filesize
3.3MB

Download
memory/1284-13-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2102-0x00007FF721D70000-0x00007FF7220C1000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2142-0x00007FF602F70000-0x00007FF6032C1000-memory.dmp

Filesize
3.3MB

Download
memory/1456-889-0x00007FF602F70000-0x00007FF6032C1000-memory.dmp

Filesize
3.3MB

Download
memory/1780-2120-0x00007FF63D010000-0x00007FF63D361000-memory.dmp

Filesize
3.3MB

Download
memory/1780-224-0x00007FF63D010000-0x00007FF63D361000-memory.dmp

Filesize
3.3MB

Download
memory/1852-102-0x00007FF7F2730000-0x00007FF7F2A81000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2112-0x00007FF7F2730000-0x00007FF7F2A81000-memory.dmp

Filesize
3.3MB

Download
memory/1984-886-0x00007FF670CE0000-0x00007FF671031000-memory.dmp

Filesize
3.3MB

Download
memory/1984-2132-0x00007FF670CE0000-0x00007FF671031000-memory.dmp

Filesize
3.3MB

Download
memory/2080-887-0x00007FF72BE40000-0x00007FF72C191000-memory.dmp

Filesize
3.3MB

Download
memory/2080-2137-0x00007FF72BE40000-0x00007FF72C191000-memory.dmp

Filesize
3.3MB

Download
memory/2092-340-0x00007FF6F42C0000-0x00007FF6F4611000-memory.dmp

Filesize
3.3MB

Download
memory/2092-2128-0x00007FF6F42C0000-0x00007FF6F4611000-memory.dmp

Filesize
3.3MB

Download
memory/2324-348-0x00007FF6B78B0000-0x00007FF6B7C01000-memory.dmp

Filesize
3.3MB

Download
memory/2324-2143-0x00007FF6B78B0000-0x00007FF6B7C01000-memory.dmp

Filesize
3.3MB

Download
memory/2576-284-0x00007FF62A080000-0x00007FF62A3D1000-memory.dmp

Filesize
3.3MB

Download
memory/2576-2116-0x00007FF62A080000-0x00007FF62A3D1000-memory.dmp

Filesize
3.3MB

Download
memory/2580-2160-0x00007FF7AFBA0000-0x00007FF7AFEF1000-memory.dmp

Filesize
3.3MB

Download
memory/2580-511-0x00007FF7AFBA0000-0x00007FF7AFEF1000-memory.dmp

Filesize
3.3MB

Download
memory/3044-2104-0x00007FF7EF0C0000-0x00007FF7EF411000-memory.dmp

Filesize
3.3MB

Download
memory/3044-57-0x00007FF7EF0C0000-0x00007FF7EF411000-memory.dmp

Filesize
3.3MB

Download
memory/3228-776-0x00007FF603100000-0x00007FF603451000-memory.dmp

Filesize
3.3MB

Download
memory/3228-2146-0x00007FF603100000-0x00007FF603451000-memory.dmp

Filesize
3.3MB

Download
memory/3280-2141-0x00007FF7E9A60000-0x00007FF7E9DB1000-memory.dmp

Filesize
3.3MB

Download
memory/3280-430-0x00007FF7E9A60000-0x00007FF7E9DB1000-memory.dmp

Filesize
3.3MB

Download
memory/3356-881-0x00007FF7CDF50000-0x00007FF7CE2A1000-memory.dmp

Filesize
3.3MB

Download
memory/3356-2150-0x00007FF7CDF50000-0x00007FF7CE2A1000-memory.dmp

Filesize
3.3MB

Download
memory/3376-80-0x00007FF721000000-0x00007FF721351000-memory.dmp

Filesize
3.3MB

Download
memory/3376-2108-0x00007FF721000000-0x00007FF721351000-memory.dmp

Filesize
3.3MB

Download
memory/3604-885-0x00007FF76E430000-0x00007FF76E781000-memory.dmp

Filesize
3.3MB

Download
memory/3604-2123-0x00007FF76E430000-0x00007FF76E781000-memory.dmp

Filesize
3.3MB

Download
memory/3732-193-0x00007FF7B8370000-0x00007FF7B86C1000-memory.dmp

Filesize
3.3MB

Download
memory/3732-2118-0x00007FF7B8370000-0x00007FF7B86C1000-memory.dmp

Filesize
3.3MB

Download
memory/3748-2106-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp

Filesize
3.3MB

Download
memory/3748-2098-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp

Filesize
3.3MB

Download
memory/3748-30-0x00007FF6EBA00000-0x00007FF6EBD51000-memory.dmp

Filesize
3.3MB

Download
memory/3952-613-0x00007FF7FE720000-0x00007FF7FEA71000-memory.dmp

Filesize
3.3MB

Download
memory/3952-2139-0x00007FF7FE720000-0x00007FF7FEA71000-memory.dmp

Filesize
3.3MB

Download
memory/4064-425-0x00007FF724510000-0x00007FF724861000-memory.dmp

Filesize
3.3MB

Download
memory/4064-2147-0x00007FF724510000-0x00007FF724861000-memory.dmp

Filesize
3.3MB

Download
memory/4140-2170-0x00007FF79E5B0000-0x00007FF79E901000-memory.dmp

Filesize
3.3MB

Download
memory/4140-779-0x00007FF79E5B0000-0x00007FF79E901000-memory.dmp

Filesize
3.3MB

Download
memory/4636-105-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp

Filesize
3.3MB

Download
memory/4636-2126-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp

Filesize
3.3MB

Download
memory/4636-2099-0x00007FF6CB120000-0x00007FF6CB471000-memory.dmp

Filesize
3.3MB

Download
memory/4672-73-0x00007FF7E2DF0000-0x00007FF7E3141000-memory.dmp

Filesize
3.3MB

Download
memory/4672-2110-0x00007FF7E2DF0000-0x00007FF7E3141000-memory.dmp

Filesize
3.3MB

Download
memory/4808-882-0x00007FF75FC70000-0x00007FF75FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/4808-2199-0x00007FF75FC70000-0x00007FF75FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/4820-888-0x00007FF76F3A0000-0x00007FF76F6F1000-memory.dmp

Filesize
3.3MB

Download
memory/4820-2130-0x00007FF76F3A0000-0x00007FF76F6F1000-memory.dmp

Filesize
3.3MB

Download
memory/4844-2163-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp

Filesize
3.3MB

Download
memory/4844-2100-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp

Filesize
3.3MB

Download
memory/4844-145-0x00007FF7DFC80000-0x00007FF7DFFD1000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.