xmrig | 0dc411f681779ed9e48bde9587d843e2ca448386e020452aa94b50d0e53a7e14

Analysis

max time kernel
62s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
Size 2.2MB
Sample240612-2q24sateld
SHA256 0dc411f681779ed9e48bde9587d843e2ca448386e020452aa94b50d0e53a7e14
MD5 4a7fc324d2bd9c4ca9ec4e8f5f2e5100
SHA1 9fcd0ac00ebbbbc8e93b61107c090e474c4abe34
SHA512 28e640b8973d03b726470c0ed1233f824486eb5f04d70828deb7e8e95e05989370eea4df1dac897152cbca73f10bd3f4a29b70b512673fef85bf029352cc4324
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6P:oemTLkNdfE0pZrQh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1836-0-0x00007FF75F440000-0x00007FF75F794000-memory.dmp	xmrig
behavioral2/files/0x0009000000023437-5.dat	xmrig
behavioral2/files/0x0007000000023441-9.dat	xmrig
behavioral2/files/0x0007000000023440-10.dat	xmrig
behavioral2/memory/3568-11-0x00007FF7DB180000-0x00007FF7DB4D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-28.dat	xmrig
behavioral2/memory/2708-34-0x00007FF743DE0000-0x00007FF744134000-memory.dmp	xmrig
behavioral2/memory/2312-24-0x00007FF6DE6D0000-0x00007FF6DEA24000-memory.dmp	xmrig
behavioral2/memory/4044-21-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp	xmrig
behavioral2/memory/1436-52-0x00007FF785D10000-0x00007FF786064000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-73.dat	xmrig
behavioral2/memory/1196-87-0x00007FF748720000-0x00007FF748A74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023450-106.dat	xmrig
behavioral2/files/0x0007000000023451-128.dat	xmrig
behavioral2/files/0x0007000000023453-158.dat	xmrig
behavioral2/memory/4424-179-0x00007FF7469C0000-0x00007FF746D14000-memory.dmp	xmrig
behavioral2/memory/1532-185-0x00007FF747D90000-0x00007FF7480E4000-memory.dmp	xmrig
behavioral2/memory/4644-194-0x00007FF71D960000-0x00007FF71DCB4000-memory.dmp	xmrig
behavioral2/memory/3992-193-0x00007FF7742D0000-0x00007FF774624000-memory.dmp	xmrig
behavioral2/memory/840-192-0x00007FF6FC1D0000-0x00007FF6FC524000-memory.dmp	xmrig
behavioral2/memory/3320-191-0x00007FF7C1390000-0x00007FF7C16E4000-memory.dmp	xmrig
behavioral2/memory/920-190-0x00007FF7CE8C0000-0x00007FF7CEC14000-memory.dmp	xmrig
behavioral2/memory/1732-189-0x00007FF722060000-0x00007FF7223B4000-memory.dmp	xmrig
behavioral2/memory/4596-188-0x00007FF62F550000-0x00007FF62F8A4000-memory.dmp	xmrig
behavioral2/memory/400-187-0x00007FF6F98E0000-0x00007FF6F9C34000-memory.dmp	xmrig
behavioral2/memory/2516-186-0x00007FF672BA0000-0x00007FF672EF4000-memory.dmp	xmrig
behavioral2/memory/4752-184-0x00007FF6D4E50000-0x00007FF6D51A4000-memory.dmp	xmrig
behavioral2/memory/4396-183-0x00007FF6953D0000-0x00007FF695724000-memory.dmp	xmrig
behavioral2/memory/1592-182-0x00007FF78AC40000-0x00007FF78AF94000-memory.dmp	xmrig
behavioral2/memory/3700-181-0x00007FF735980000-0x00007FF735CD4000-memory.dmp	xmrig
behavioral2/memory/1748-180-0x00007FF7C1020000-0x00007FF7C1374000-memory.dmp	xmrig
behavioral2/files/0x000700000002345d-175.dat	xmrig
behavioral2/files/0x000700000002345c-173.dat	xmrig
behavioral2/files/0x000700000002345b-171.dat	xmrig
behavioral2/files/0x000700000002345a-169.dat	xmrig
behavioral2/files/0x0007000000023459-167.dat	xmrig
behavioral2/files/0x0007000000023458-165.dat	xmrig
behavioral2/files/0x0007000000023457-163.dat	xmrig
behavioral2/memory/4132-162-0x00007FF63DA90000-0x00007FF63DDE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023456-160.dat	xmrig
behavioral2/memory/3620-157-0x00007FF6C84C0000-0x00007FF6C8814000-memory.dmp	xmrig
behavioral2/memory/956-156-0x00007FF618510000-0x00007FF618864000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-155.dat	xmrig
behavioral2/files/0x000700000002345e-154.dat	xmrig
behavioral2/files/0x0007000000023455-147.dat	xmrig
behavioral2/files/0x0007000000023454-145.dat	xmrig
behavioral2/memory/3216-137-0x00007FF7FF4F0000-0x00007FF7FF844000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-136.dat	xmrig
behavioral2/files/0x000700000002344c-104.dat	xmrig
behavioral2/files/0x000700000002344f-102.dat	xmrig
behavioral2/memory/2580-101-0x00007FF6BCEC0000-0x00007FF6BD214000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-98.dat	xmrig
behavioral2/files/0x000700000002344b-93.dat	xmrig
behavioral2/memory/1316-92-0x00007FF779FC0000-0x00007FF77A314000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-90.dat	xmrig
behavioral2/files/0x000700000002344a-84.dat	xmrig
behavioral2/files/0x000700000002344d-95.dat	xmrig
behavioral2/files/0x0007000000023445-81.dat	xmrig
behavioral2/files/0x0007000000023446-79.dat	xmrig
behavioral2/memory/4140-70-0x00007FF669C10000-0x00007FF669F64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-58.dat	xmrig
behavioral2/files/0x0007000000023447-48.dat	xmrig
behavioral2/files/0x0007000000023443-44.dat	xmrig
behavioral2/memory/4044-2131-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3568	IsqSPnI.exe
4044	qXASXRE.exe
2312	bGRKiVc.exe
400	orCnmnN.exe
2708	INKXpOG.exe
4596	aXOPVZr.exe
1436	yjrqrDY.exe
1732	CODEnNB.exe
4140	NGjWzdX.exe
920	CoGGvxC.exe
1196	cCNQiRE.exe
1316	gzLtWkn.exe
2580	CIseFyS.exe
3216	orYpVUM.exe
3320	OAgprns.exe
956	KHAJZwX.exe
3620	iLWDESR.exe
4132	NvaMvNp.exe
840	juEamrG.exe
4424	OTETgsl.exe
3992	UsiUTxt.exe
1748	vJINHSZ.exe
3700	HlqKFqP.exe
1592	mLaMJtU.exe
4644	djZkept.exe
4396	vuUxSaw.exe
4752	cKMpxND.exe
1532	ojDRwJK.exe
2516	VorGnuV.exe
4792	dbUdhLs.exe
3088	somlTHF.exe
2316	xwzGqGH.exe
2068	XndptnR.exe
1392	JhWasRi.exe
4996	XiVICvn.exe
2824	chndqpu.exe
2836	HvIJRkk.exe
2116	IJDkGDk.exe
4680	Qolibqd.exe
3884	UJOLdxA.exe
4948	NhOjPnR.exe
4020	WZpnwzJ.exe
4936	IYXoBSP.exe
1948	xeIriZa.exe
2688	yqOzwHG.exe
224	BVzBIVa.exe
1200	fYzpXHr.exe
1224	FpGHcDZ.exe
2356	Tvohjcw.exe
2980	Fgyaajt.exe
2644	KMniadK.exe
2296	kgBRvpV.exe
3960	XTJVPjy.exe
1660	QTjVqZh.exe
1048	OvXYkiy.exe
1568	pUskewM.exe
3976	tghlOOo.exe
4924	TNcYNvH.exe
3616	VKGbStW.exe
3412	XchLNUq.exe
4436	HYfRliP.exe
4960	ftnbeFt.exe
2380	xOAAkJy.exe
3192	iGzkcOR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1836-0-0x00007FF75F440000-0x00007FF75F794000-memory.dmp	upx
behavioral2/files/0x0009000000023437-5.dat	upx
behavioral2/files/0x0007000000023441-9.dat	upx
behavioral2/files/0x0007000000023440-10.dat	upx
behavioral2/memory/3568-11-0x00007FF7DB180000-0x00007FF7DB4D4000-memory.dmp	upx
behavioral2/files/0x0007000000023442-28.dat	upx
behavioral2/memory/2708-34-0x00007FF743DE0000-0x00007FF744134000-memory.dmp	upx
behavioral2/memory/2312-24-0x00007FF6DE6D0000-0x00007FF6DEA24000-memory.dmp	upx
behavioral2/memory/4044-21-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp	upx
behavioral2/memory/1436-52-0x00007FF785D10000-0x00007FF786064000-memory.dmp	upx
behavioral2/files/0x0007000000023448-73.dat	upx
behavioral2/memory/1196-87-0x00007FF748720000-0x00007FF748A74000-memory.dmp	upx
behavioral2/files/0x0007000000023450-106.dat	upx
behavioral2/files/0x0007000000023451-128.dat	upx
behavioral2/files/0x0007000000023453-158.dat	upx
behavioral2/memory/4424-179-0x00007FF7469C0000-0x00007FF746D14000-memory.dmp	upx
behavioral2/memory/1532-185-0x00007FF747D90000-0x00007FF7480E4000-memory.dmp	upx
behavioral2/memory/4644-194-0x00007FF71D960000-0x00007FF71DCB4000-memory.dmp	upx
behavioral2/memory/3992-193-0x00007FF7742D0000-0x00007FF774624000-memory.dmp	upx
behavioral2/memory/840-192-0x00007FF6FC1D0000-0x00007FF6FC524000-memory.dmp	upx
behavioral2/memory/3320-191-0x00007FF7C1390000-0x00007FF7C16E4000-memory.dmp	upx
behavioral2/memory/920-190-0x00007FF7CE8C0000-0x00007FF7CEC14000-memory.dmp	upx
behavioral2/memory/1732-189-0x00007FF722060000-0x00007FF7223B4000-memory.dmp	upx
behavioral2/memory/4596-188-0x00007FF62F550000-0x00007FF62F8A4000-memory.dmp	upx
behavioral2/memory/400-187-0x00007FF6F98E0000-0x00007FF6F9C34000-memory.dmp	upx
behavioral2/memory/2516-186-0x00007FF672BA0000-0x00007FF672EF4000-memory.dmp	upx
behavioral2/memory/4752-184-0x00007FF6D4E50000-0x00007FF6D51A4000-memory.dmp	upx
behavioral2/memory/4396-183-0x00007FF6953D0000-0x00007FF695724000-memory.dmp	upx
behavioral2/memory/1592-182-0x00007FF78AC40000-0x00007FF78AF94000-memory.dmp	upx
behavioral2/memory/3700-181-0x00007FF735980000-0x00007FF735CD4000-memory.dmp	upx
behavioral2/memory/1748-180-0x00007FF7C1020000-0x00007FF7C1374000-memory.dmp	upx
behavioral2/files/0x000700000002345d-175.dat	upx
behavioral2/files/0x000700000002345c-173.dat	upx
behavioral2/files/0x000700000002345b-171.dat	upx
behavioral2/files/0x000700000002345a-169.dat	upx
behavioral2/files/0x0007000000023459-167.dat	upx
behavioral2/files/0x0007000000023458-165.dat	upx
behavioral2/files/0x0007000000023457-163.dat	upx
behavioral2/memory/4132-162-0x00007FF63DA90000-0x00007FF63DDE4000-memory.dmp	upx
behavioral2/files/0x0007000000023456-160.dat	upx
behavioral2/memory/3620-157-0x00007FF6C84C0000-0x00007FF6C8814000-memory.dmp	upx
behavioral2/memory/956-156-0x00007FF618510000-0x00007FF618864000-memory.dmp	upx
behavioral2/files/0x000700000002345f-155.dat	upx
behavioral2/files/0x000700000002345e-154.dat	upx
behavioral2/files/0x0007000000023455-147.dat	upx
behavioral2/files/0x0007000000023454-145.dat	upx
behavioral2/memory/3216-137-0x00007FF7FF4F0000-0x00007FF7FF844000-memory.dmp	upx
behavioral2/files/0x0007000000023452-136.dat	upx
behavioral2/files/0x000700000002344c-104.dat	upx
behavioral2/files/0x000700000002344f-102.dat	upx
behavioral2/memory/2580-101-0x00007FF6BCEC0000-0x00007FF6BD214000-memory.dmp	upx
behavioral2/files/0x000700000002344e-98.dat	upx
behavioral2/files/0x000700000002344b-93.dat	upx
behavioral2/memory/1316-92-0x00007FF779FC0000-0x00007FF77A314000-memory.dmp	upx
behavioral2/files/0x0007000000023449-90.dat	upx
behavioral2/files/0x000700000002344a-84.dat	upx
behavioral2/files/0x000700000002344d-95.dat	upx
behavioral2/files/0x0007000000023445-81.dat	upx
behavioral2/files/0x0007000000023446-79.dat	upx
behavioral2/memory/4140-70-0x00007FF669C10000-0x00007FF669F64000-memory.dmp	upx
behavioral2/files/0x0007000000023444-58.dat	upx
behavioral2/files/0x0007000000023447-48.dat	upx
behavioral2/files/0x0007000000023443-44.dat	upx
behavioral2/memory/4044-2131-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BDNnOAO.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\tHCjLiD.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\fTUEwCH.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\wlwDsJA.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\obOsVUQ.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\OJGcbSm.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\fEMIJHs.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\gXxZZrk.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\cbtkppB.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\cxaqwKW.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\qenfuxL.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\NVhbdiJ.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\uypZrSW.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\cYiSsCS.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\ZdtwCDb.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\UJOLdxA.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\hhVhhUW.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\yoXZPDc.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\Skzotbz.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\uKGSqcA.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\FpusHti.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\fhCTMjD.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\UPsSUBx.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\WRtUlps.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\xAGysUq.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\tpmYWpn.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\MrDzmLy.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\xgAPCqH.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\dPdumjf.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\CUsCclI.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\gOMRcbA.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\CmtGIkz.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\rEtNcdb.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\gZQZfdZ.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\unXAzpi.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\HvaHwOv.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\yhlckom.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\LHsTIyv.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\cfHgeBf.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\mkpKcQK.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\GYOOWgV.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\TvKJese.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\TmtndwX.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\vXUGuCG.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\CODEnNB.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\XwXTbks.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\jNtrUNO.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\kgaeboF.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\FZcmlwV.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\DtCwfoe.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\IYXoBSP.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\jofEluh.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\ZGfTBne.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\YaeBMkj.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\sNsNNfp.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\MpzfBKO.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\AmwaYxa.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\ykbtMVp.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\tnHWYpX.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\UXpeaIM.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\upvQilF.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\rnsbiHb.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\RwzWLzY.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
File created	C:\Windows\System\nUvtAaT.exe	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3568	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	82
PID 1836 wrote to memory of 3568	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	82
PID 1836 wrote to memory of 4044	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	83
PID 1836 wrote to memory of 4044	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	83
PID 1836 wrote to memory of 2312	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	84
PID 1836 wrote to memory of 2312	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	84
PID 1836 wrote to memory of 400	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	85
PID 1836 wrote to memory of 400	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	85
PID 1836 wrote to memory of 4596	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	86
PID 1836 wrote to memory of 4596	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	86
PID 1836 wrote to memory of 2708	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	87
PID 1836 wrote to memory of 2708	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	87
PID 1836 wrote to memory of 1436	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	88
PID 1836 wrote to memory of 1436	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	88
PID 1836 wrote to memory of 1732	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	89
PID 1836 wrote to memory of 1732	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	89
PID 1836 wrote to memory of 4140	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	90
PID 1836 wrote to memory of 4140	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	90
PID 1836 wrote to memory of 920	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	91
PID 1836 wrote to memory of 920	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	91
PID 1836 wrote to memory of 1196	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	92
PID 1836 wrote to memory of 1196	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	92
PID 1836 wrote to memory of 1316	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	93
PID 1836 wrote to memory of 1316	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	93
PID 1836 wrote to memory of 2580	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	94
PID 1836 wrote to memory of 2580	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	94
PID 1836 wrote to memory of 3216	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	95
PID 1836 wrote to memory of 3216	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	95
PID 1836 wrote to memory of 3320	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	96
PID 1836 wrote to memory of 3320	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	96
PID 1836 wrote to memory of 956	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	97
PID 1836 wrote to memory of 956	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	97
PID 1836 wrote to memory of 3620	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	98
PID 1836 wrote to memory of 3620	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	98
PID 1836 wrote to memory of 4132	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	99
PID 1836 wrote to memory of 4132	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	99
PID 1836 wrote to memory of 840	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	100
PID 1836 wrote to memory of 840	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	100
PID 1836 wrote to memory of 4424	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	101
PID 1836 wrote to memory of 4424	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	101
PID 1836 wrote to memory of 3992	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	102
PID 1836 wrote to memory of 3992	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	102
PID 1836 wrote to memory of 1748	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	103
PID 1836 wrote to memory of 1748	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	103
PID 1836 wrote to memory of 3700	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	104
PID 1836 wrote to memory of 3700	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	104
PID 1836 wrote to memory of 1592	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	105
PID 1836 wrote to memory of 1592	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	105
PID 1836 wrote to memory of 4644	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	106
PID 1836 wrote to memory of 4644	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	106
PID 1836 wrote to memory of 4396	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	107
PID 1836 wrote to memory of 4396	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	107
PID 1836 wrote to memory of 4752	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	108
PID 1836 wrote to memory of 4752	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	108
PID 1836 wrote to memory of 1532	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	109
PID 1836 wrote to memory of 1532	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	109
PID 1836 wrote to memory of 2516	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	110
PID 1836 wrote to memory of 2516	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	110
PID 1836 wrote to memory of 4792	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	111
PID 1836 wrote to memory of 4792	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	111
PID 1836 wrote to memory of 3088	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	112
PID 1836 wrote to memory of 3088	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	112
PID 1836 wrote to memory of 2316	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	113
PID 1836 wrote to memory of 2316	1836	4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a7fc324d2bd9c4ca9ec4e8f5f2e5100_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\System\IsqSPnI.exe
  C:\Windows\System\IsqSPnI.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\qXASXRE.exe
  C:\Windows\System\qXASXRE.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\bGRKiVc.exe
  C:\Windows\System\bGRKiVc.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\orCnmnN.exe
  C:\Windows\System\orCnmnN.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\aXOPVZr.exe
  C:\Windows\System\aXOPVZr.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\INKXpOG.exe
  C:\Windows\System\INKXpOG.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\yjrqrDY.exe
  C:\Windows\System\yjrqrDY.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\CODEnNB.exe
  C:\Windows\System\CODEnNB.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\NGjWzdX.exe
  C:\Windows\System\NGjWzdX.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\CoGGvxC.exe
  C:\Windows\System\CoGGvxC.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\cCNQiRE.exe
  C:\Windows\System\cCNQiRE.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\gzLtWkn.exe
  C:\Windows\System\gzLtWkn.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\CIseFyS.exe
  C:\Windows\System\CIseFyS.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\orYpVUM.exe
  C:\Windows\System\orYpVUM.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\OAgprns.exe
  C:\Windows\System\OAgprns.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\KHAJZwX.exe
  C:\Windows\System\KHAJZwX.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\iLWDESR.exe
  C:\Windows\System\iLWDESR.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\NvaMvNp.exe
  C:\Windows\System\NvaMvNp.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\juEamrG.exe
  C:\Windows\System\juEamrG.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\OTETgsl.exe
  C:\Windows\System\OTETgsl.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\UsiUTxt.exe
  C:\Windows\System\UsiUTxt.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\vJINHSZ.exe
  C:\Windows\System\vJINHSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\HlqKFqP.exe
  C:\Windows\System\HlqKFqP.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\mLaMJtU.exe
  C:\Windows\System\mLaMJtU.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\djZkept.exe
  C:\Windows\System\djZkept.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\vuUxSaw.exe
  C:\Windows\System\vuUxSaw.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\cKMpxND.exe
  C:\Windows\System\cKMpxND.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\ojDRwJK.exe
  C:\Windows\System\ojDRwJK.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\VorGnuV.exe
  C:\Windows\System\VorGnuV.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\dbUdhLs.exe
  C:\Windows\System\dbUdhLs.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\somlTHF.exe
  C:\Windows\System\somlTHF.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\xwzGqGH.exe
  C:\Windows\System\xwzGqGH.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\XndptnR.exe
  C:\Windows\System\XndptnR.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\JhWasRi.exe
  C:\Windows\System\JhWasRi.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\XiVICvn.exe
  C:\Windows\System\XiVICvn.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\chndqpu.exe
  C:\Windows\System\chndqpu.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\HvIJRkk.exe
  C:\Windows\System\HvIJRkk.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\IJDkGDk.exe
  C:\Windows\System\IJDkGDk.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\Qolibqd.exe
  C:\Windows\System\Qolibqd.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\UJOLdxA.exe
  C:\Windows\System\UJOLdxA.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\NhOjPnR.exe
  C:\Windows\System\NhOjPnR.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\WZpnwzJ.exe
  C:\Windows\System\WZpnwzJ.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\IYXoBSP.exe
  C:\Windows\System\IYXoBSP.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\xeIriZa.exe
  C:\Windows\System\xeIriZa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\yqOzwHG.exe
  C:\Windows\System\yqOzwHG.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\BVzBIVa.exe
  C:\Windows\System\BVzBIVa.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\fYzpXHr.exe
  C:\Windows\System\fYzpXHr.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\FpGHcDZ.exe
  C:\Windows\System\FpGHcDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\Tvohjcw.exe
  C:\Windows\System\Tvohjcw.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\Fgyaajt.exe
  C:\Windows\System\Fgyaajt.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\KMniadK.exe
  C:\Windows\System\KMniadK.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\kgBRvpV.exe
  C:\Windows\System\kgBRvpV.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\XTJVPjy.exe
  C:\Windows\System\XTJVPjy.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\QTjVqZh.exe
  C:\Windows\System\QTjVqZh.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\OvXYkiy.exe
  C:\Windows\System\OvXYkiy.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\pUskewM.exe
  C:\Windows\System\pUskewM.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\tghlOOo.exe
  C:\Windows\System\tghlOOo.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\TNcYNvH.exe
  C:\Windows\System\TNcYNvH.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\VKGbStW.exe
  C:\Windows\System\VKGbStW.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\XchLNUq.exe
  C:\Windows\System\XchLNUq.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\HYfRliP.exe
  C:\Windows\System\HYfRliP.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\ftnbeFt.exe
  C:\Windows\System\ftnbeFt.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\xOAAkJy.exe
  C:\Windows\System\xOAAkJy.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\iGzkcOR.exe
  C:\Windows\System\iGzkcOR.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\VrLYgAz.exe
  C:\Windows\System\VrLYgAz.exe
  2⤵
  PID:1828
- C:\Windows\System\oZyCfGs.exe
  C:\Windows\System\oZyCfGs.exe
  2⤵
  PID:3944
- C:\Windows\System\waGZqgB.exe
  C:\Windows\System\waGZqgB.exe
  2⤵
  PID:2152
- C:\Windows\System\bfriHIh.exe
  C:\Windows\System\bfriHIh.exe
  2⤵
  PID:3996
- C:\Windows\System\fOuOpnn.exe
  C:\Windows\System\fOuOpnn.exe
  2⤵
  PID:1968
- C:\Windows\System\qeysEZE.exe
  C:\Windows\System\qeysEZE.exe
  2⤵
  PID:408
- C:\Windows\System\gZQZfdZ.exe
  C:\Windows\System\gZQZfdZ.exe
  2⤵
  PID:3652
- C:\Windows\System\cbtkppB.exe
  C:\Windows\System\cbtkppB.exe
  2⤵
  PID:2952
- C:\Windows\System\NyzZgzl.exe
  C:\Windows\System\NyzZgzl.exe
  2⤵
  PID:4876
- C:\Windows\System\EoOJhLV.exe
  C:\Windows\System\EoOJhLV.exe
  2⤵
  PID:3428
- C:\Windows\System\tFFwTrK.exe
  C:\Windows\System\tFFwTrK.exe
  2⤵
  PID:4404
- C:\Windows\System\qXijvJx.exe
  C:\Windows\System\qXijvJx.exe
  2⤵
  PID:3444
- C:\Windows\System\TttROWW.exe
  C:\Windows\System\TttROWW.exe
  2⤵
  PID:2880
- C:\Windows\System\aUOKsQD.exe
  C:\Windows\System\aUOKsQD.exe
  2⤵
  PID:3500
- C:\Windows\System\RujDKNm.exe
  C:\Windows\System\RujDKNm.exe
  2⤵
  PID:2292
- C:\Windows\System\eFfjzdz.exe
  C:\Windows\System\eFfjzdz.exe
  2⤵
  PID:2008
- C:\Windows\System\jvqRClX.exe
  C:\Windows\System\jvqRClX.exe
  2⤵
  PID:5020
- C:\Windows\System\oLupDge.exe
  C:\Windows\System\oLupDge.exe
  2⤵
  PID:4660
- C:\Windows\System\khCYkuR.exe
  C:\Windows\System\khCYkuR.exe
  2⤵
  PID:2028
- C:\Windows\System\GQmhhtt.exe
  C:\Windows\System\GQmhhtt.exe
  2⤵
  PID:1700
- C:\Windows\System\XwXTbks.exe
  C:\Windows\System\XwXTbks.exe
  2⤵
  PID:3148
- C:\Windows\System\lXvTBHs.exe
  C:\Windows\System\lXvTBHs.exe
  2⤵
  PID:1936
- C:\Windows\System\RKYXAbb.exe
  C:\Windows\System\RKYXAbb.exe
  2⤵
  PID:3260
- C:\Windows\System\aensjUM.exe
  C:\Windows\System\aensjUM.exe
  2⤵
  PID:880
- C:\Windows\System\alKEKOb.exe
  C:\Windows\System\alKEKOb.exe
  2⤵
  PID:4248
- C:\Windows\System\gcoCOUx.exe
  C:\Windows\System\gcoCOUx.exe
  2⤵
  PID:3972
- C:\Windows\System\kgHfAne.exe
  C:\Windows\System\kgHfAne.exe
  2⤵
  PID:2436
- C:\Windows\System\WyrNsBw.exe
  C:\Windows\System\WyrNsBw.exe
  2⤵
  PID:3980
- C:\Windows\System\ovjSlJi.exe
  C:\Windows\System\ovjSlJi.exe
  2⤵
  PID:4308
- C:\Windows\System\fTUEwCH.exe
  C:\Windows\System\fTUEwCH.exe
  2⤵
  PID:3752
- C:\Windows\System\KvNMTvd.exe
  C:\Windows\System\KvNMTvd.exe
  2⤵
  PID:2272
- C:\Windows\System\unXAzpi.exe
  C:\Windows\System\unXAzpi.exe
  2⤵
  PID:4428
- C:\Windows\System\hWHqkpj.exe
  C:\Windows\System\hWHqkpj.exe
  2⤵
  PID:4920
- C:\Windows\System\IxLCHYT.exe
  C:\Windows\System\IxLCHYT.exe
  2⤵
  PID:756
- C:\Windows\System\iTpTJVb.exe
  C:\Windows\System\iTpTJVb.exe
  2⤵
  PID:1400
- C:\Windows\System\cPSnFoN.exe
  C:\Windows\System\cPSnFoN.exe
  2⤵
  PID:3636
- C:\Windows\System\spperyh.exe
  C:\Windows\System\spperyh.exe
  2⤵
  PID:3860
- C:\Windows\System\oDRMrYR.exe
  C:\Windows\System\oDRMrYR.exe
  2⤵
  PID:1728
- C:\Windows\System\dhtOLQq.exe
  C:\Windows\System\dhtOLQq.exe
  2⤵
  PID:2924
- C:\Windows\System\YXDOakA.exe
  C:\Windows\System\YXDOakA.exe
  2⤵
  PID:1328
- C:\Windows\System\RwRXoFA.exe
  C:\Windows\System\RwRXoFA.exe
  2⤵
  PID:2352
- C:\Windows\System\EFGIPbS.exe
  C:\Windows\System\EFGIPbS.exe
  2⤵
  PID:2032
- C:\Windows\System\tnHWYpX.exe
  C:\Windows\System\tnHWYpX.exe
  2⤵
  PID:1636
- C:\Windows\System\CwbaUZF.exe
  C:\Windows\System\CwbaUZF.exe
  2⤵
  PID:736
- C:\Windows\System\cxaqwKW.exe
  C:\Windows\System\cxaqwKW.exe
  2⤵
  PID:1916
- C:\Windows\System\KxxkjlS.exe
  C:\Windows\System\KxxkjlS.exe
  2⤵
  PID:5072
- C:\Windows\System\TejKHXI.exe
  C:\Windows\System\TejKHXI.exe
  2⤵
  PID:4216
- C:\Windows\System\tnlEmxS.exe
  C:\Windows\System\tnlEmxS.exe
  2⤵
  PID:1412
- C:\Windows\System\ocuKkUs.exe
  C:\Windows\System\ocuKkUs.exe
  2⤵
  PID:4152
- C:\Windows\System\LZxLGNS.exe
  C:\Windows\System\LZxLGNS.exe
  2⤵
  PID:3692
- C:\Windows\System\dWXYYHB.exe
  C:\Windows\System\dWXYYHB.exe
  2⤵
  PID:3776
- C:\Windows\System\VdhrLIA.exe
  C:\Windows\System\VdhrLIA.exe
  2⤵
  PID:5140
- C:\Windows\System\lbXyrbb.exe
  C:\Windows\System\lbXyrbb.exe
  2⤵
  PID:5168
- C:\Windows\System\fCBWewL.exe
  C:\Windows\System\fCBWewL.exe
  2⤵
  PID:5184
- C:\Windows\System\TbxaLHv.exe
  C:\Windows\System\TbxaLHv.exe
  2⤵
  PID:5212
- C:\Windows\System\zsLZsxU.exe
  C:\Windows\System\zsLZsxU.exe
  2⤵
  PID:5232
- C:\Windows\System\heJCnmG.exe
  C:\Windows\System\heJCnmG.exe
  2⤵
  PID:5260
- C:\Windows\System\gztUFmt.exe
  C:\Windows\System\gztUFmt.exe
  2⤵
  PID:5296
- C:\Windows\System\ZfJbSDT.exe
  C:\Windows\System\ZfJbSDT.exe
  2⤵
  PID:5336
- C:\Windows\System\pFRwifM.exe
  C:\Windows\System\pFRwifM.exe
  2⤵
  PID:5372
- C:\Windows\System\LJaFJzr.exe
  C:\Windows\System\LJaFJzr.exe
  2⤵
  PID:5400
- C:\Windows\System\IAKURzc.exe
  C:\Windows\System\IAKURzc.exe
  2⤵
  PID:5416
- C:\Windows\System\tWoKLXt.exe
  C:\Windows\System\tWoKLXt.exe
  2⤵
  PID:5432
- C:\Windows\System\HoPYmhi.exe
  C:\Windows\System\HoPYmhi.exe
  2⤵
  PID:5448
- C:\Windows\System\obOsVUQ.exe
  C:\Windows\System\obOsVUQ.exe
  2⤵
  PID:5464
- C:\Windows\System\BStKqAA.exe
  C:\Windows\System\BStKqAA.exe
  2⤵
  PID:5480
- C:\Windows\System\xqFVkwo.exe
  C:\Windows\System\xqFVkwo.exe
  2⤵
  PID:5516
- C:\Windows\System\ouLglRC.exe
  C:\Windows\System\ouLglRC.exe
  2⤵
  PID:5536
- C:\Windows\System\kRrCPqJ.exe
  C:\Windows\System\kRrCPqJ.exe
  2⤵
  PID:5564
- C:\Windows\System\zpWYHcr.exe
  C:\Windows\System\zpWYHcr.exe
  2⤵
  PID:5596
- C:\Windows\System\TtcuHnL.exe
  C:\Windows\System\TtcuHnL.exe
  2⤵
  PID:5628
- C:\Windows\System\urwfBWs.exe
  C:\Windows\System\urwfBWs.exe
  2⤵
  PID:5660
- C:\Windows\System\ooPWqVF.exe
  C:\Windows\System\ooPWqVF.exe
  2⤵
  PID:5704
- C:\Windows\System\CDUwRoD.exe
  C:\Windows\System\CDUwRoD.exe
  2⤵
  PID:5748
- C:\Windows\System\WIxEfXz.exe
  C:\Windows\System\WIxEfXz.exe
  2⤵
  PID:5784
- C:\Windows\System\WRtUlps.exe
  C:\Windows\System\WRtUlps.exe
  2⤵
  PID:5820
- C:\Windows\System\fqMsZsl.exe
  C:\Windows\System\fqMsZsl.exe
  2⤵
  PID:5848
- C:\Windows\System\BkojMbc.exe
  C:\Windows\System\BkojMbc.exe
  2⤵
  PID:5876
- C:\Windows\System\eVVzEPJ.exe
  C:\Windows\System\eVVzEPJ.exe
  2⤵
  PID:5892
- C:\Windows\System\WemdKYF.exe
  C:\Windows\System\WemdKYF.exe
  2⤵
  PID:5908
- C:\Windows\System\OQOplvK.exe
  C:\Windows\System\OQOplvK.exe
  2⤵
  PID:5936
- C:\Windows\System\UuXnmtv.exe
  C:\Windows\System\UuXnmtv.exe
  2⤵
  PID:5976
- C:\Windows\System\dVEflPH.exe
  C:\Windows\System\dVEflPH.exe
  2⤵
  PID:6008
- C:\Windows\System\RecGzaW.exe
  C:\Windows\System\RecGzaW.exe
  2⤵
  PID:6044
- C:\Windows\System\RTNONMb.exe
  C:\Windows\System\RTNONMb.exe
  2⤵
  PID:6064
- C:\Windows\System\mDCrmcp.exe
  C:\Windows\System\mDCrmcp.exe
  2⤵
  PID:6100
- C:\Windows\System\VhJWIUx.exe
  C:\Windows\System\VhJWIUx.exe
  2⤵
  PID:6140
- C:\Windows\System\yQEdUYU.exe
  C:\Windows\System\yQEdUYU.exe
  2⤵
  PID:5208
- C:\Windows\System\WdSvXDt.exe
  C:\Windows\System\WdSvXDt.exe
  2⤵
  PID:5292
- C:\Windows\System\RGywAwh.exe
  C:\Windows\System\RGywAwh.exe
  2⤵
  PID:5308
- C:\Windows\System\whbNFmh.exe
  C:\Windows\System\whbNFmh.exe
  2⤵
  PID:5392
- C:\Windows\System\XOPPNYO.exe
  C:\Windows\System\XOPPNYO.exe
  2⤵
  PID:5460
- C:\Windows\System\GVgLoBq.exe
  C:\Windows\System\GVgLoBq.exe
  2⤵
  PID:5548
- C:\Windows\System\TVyuWpO.exe
  C:\Windows\System\TVyuWpO.exe
  2⤵
  PID:5552
- C:\Windows\System\CkLxoXa.exe
  C:\Windows\System\CkLxoXa.exe
  2⤵
  PID:5656
- C:\Windows\System\zFUjiaV.exe
  C:\Windows\System\zFUjiaV.exe
  2⤵
  PID:5740
- C:\Windows\System\qwglbbq.exe
  C:\Windows\System\qwglbbq.exe
  2⤵
  PID:5764
- C:\Windows\System\TkQTgyG.exe
  C:\Windows\System\TkQTgyG.exe
  2⤵
  PID:5872
- C:\Windows\System\tVarWQF.exe
  C:\Windows\System\tVarWQF.exe
  2⤵
  PID:5932
- C:\Windows\System\qiTdtrU.exe
  C:\Windows\System\qiTdtrU.exe
  2⤵
  PID:6016
- C:\Windows\System\VgKIKGx.exe
  C:\Windows\System\VgKIKGx.exe
  2⤵
  PID:6072
- C:\Windows\System\CDNUdpO.exe
  C:\Windows\System\CDNUdpO.exe
  2⤵
  PID:5132
- C:\Windows\System\bQRZPGF.exe
  C:\Windows\System\bQRZPGF.exe
  2⤵
  PID:5316
- C:\Windows\System\DVBjxwW.exe
  C:\Windows\System\DVBjxwW.exe
  2⤵
  PID:5456
- C:\Windows\System\HhUlmuA.exe
  C:\Windows\System\HhUlmuA.exe
  2⤵
  PID:5620
- C:\Windows\System\mkpKcQK.exe
  C:\Windows\System\mkpKcQK.exe
  2⤵
  PID:5768
- C:\Windows\System\vVohkmW.exe
  C:\Windows\System\vVohkmW.exe
  2⤵
  PID:5920
- C:\Windows\System\FpOQCRw.exe
  C:\Windows\System\FpOQCRw.exe
  2⤵
  PID:6112
- C:\Windows\System\nPrKejJ.exe
  C:\Windows\System\nPrKejJ.exe
  2⤵
  PID:5384
- C:\Windows\System\YfbaqQD.exe
  C:\Windows\System\YfbaqQD.exe
  2⤵
  PID:5808
- C:\Windows\System\BPTawCR.exe
  C:\Windows\System\BPTawCR.exe
  2⤵
  PID:6040
- C:\Windows\System\ZUZVXxy.exe
  C:\Windows\System\ZUZVXxy.exe
  2⤵
  PID:5888
- C:\Windows\System\MHPyhgC.exe
  C:\Windows\System\MHPyhgC.exe
  2⤵
  PID:6152
- C:\Windows\System\QKFdMVC.exe
  C:\Windows\System\QKFdMVC.exe
  2⤵
  PID:6168
- C:\Windows\System\QnRzIef.exe
  C:\Windows\System\QnRzIef.exe
  2⤵
  PID:6196
- C:\Windows\System\xgAPCqH.exe
  C:\Windows\System\xgAPCqH.exe
  2⤵
  PID:6212
- C:\Windows\System\fiGMOAH.exe
  C:\Windows\System\fiGMOAH.exe
  2⤵
  PID:6228
- C:\Windows\System\dPdumjf.exe
  C:\Windows\System\dPdumjf.exe
  2⤵
  PID:6244
- C:\Windows\System\GYOOWgV.exe
  C:\Windows\System\GYOOWgV.exe
  2⤵
  PID:6264
- C:\Windows\System\FwPmLcv.exe
  C:\Windows\System\FwPmLcv.exe
  2⤵
  PID:6284
- C:\Windows\System\QJpifrZ.exe
  C:\Windows\System\QJpifrZ.exe
  2⤵
  PID:6308
- C:\Windows\System\JRLwEqT.exe
  C:\Windows\System\JRLwEqT.exe
  2⤵
  PID:6336
- C:\Windows\System\FBagELc.exe
  C:\Windows\System\FBagELc.exe
  2⤵
  PID:6372
- C:\Windows\System\Mgpjzyv.exe
  C:\Windows\System\Mgpjzyv.exe
  2⤵
  PID:6408
- C:\Windows\System\sJpSsGz.exe
  C:\Windows\System\sJpSsGz.exe
  2⤵
  PID:6448
- C:\Windows\System\DsMfjuV.exe
  C:\Windows\System\DsMfjuV.exe
  2⤵
  PID:6484
- C:\Windows\System\XHgryQE.exe
  C:\Windows\System\XHgryQE.exe
  2⤵
  PID:6520
- C:\Windows\System\wuxVWau.exe
  C:\Windows\System\wuxVWau.exe
  2⤵
  PID:6560
- C:\Windows\System\WxNuKTe.exe
  C:\Windows\System\WxNuKTe.exe
  2⤵
  PID:6600
- C:\Windows\System\uflXKRU.exe
  C:\Windows\System\uflXKRU.exe
  2⤵
  PID:6636
- C:\Windows\System\aVotUiz.exe
  C:\Windows\System\aVotUiz.exe
  2⤵
  PID:6660
- C:\Windows\System\bqSRCGk.exe
  C:\Windows\System\bqSRCGk.exe
  2⤵
  PID:6688
- C:\Windows\System\CTGiMLP.exe
  C:\Windows\System\CTGiMLP.exe
  2⤵
  PID:6716
- C:\Windows\System\KZAvrXn.exe
  C:\Windows\System\KZAvrXn.exe
  2⤵
  PID:6744
- C:\Windows\System\dzEmfdq.exe
  C:\Windows\System\dzEmfdq.exe
  2⤵
  PID:6772
- C:\Windows\System\AfxEDZy.exe
  C:\Windows\System\AfxEDZy.exe
  2⤵
  PID:6800
- C:\Windows\System\ljdpoyl.exe
  C:\Windows\System\ljdpoyl.exe
  2⤵
  PID:6828
- C:\Windows\System\sqDVYet.exe
  C:\Windows\System\sqDVYet.exe
  2⤵
  PID:6856
- C:\Windows\System\UiHZpJT.exe
  C:\Windows\System\UiHZpJT.exe
  2⤵
  PID:6892
- C:\Windows\System\owsrbxJ.exe
  C:\Windows\System\owsrbxJ.exe
  2⤵
  PID:6920
- C:\Windows\System\wKDkmvI.exe
  C:\Windows\System\wKDkmvI.exe
  2⤵
  PID:6936
- C:\Windows\System\fclNfTt.exe
  C:\Windows\System\fclNfTt.exe
  2⤵
  PID:6964
- C:\Windows\System\tyeWnpd.exe
  C:\Windows\System\tyeWnpd.exe
  2⤵
  PID:7004
- C:\Windows\System\ibPNEJj.exe
  C:\Windows\System\ibPNEJj.exe
  2⤵
  PID:7032
- C:\Windows\System\DkYkYQd.exe
  C:\Windows\System\DkYkYQd.exe
  2⤵
  PID:7060
- C:\Windows\System\XpiRbIr.exe
  C:\Windows\System\XpiRbIr.exe
  2⤵
  PID:7088
- C:\Windows\System\CUsCclI.exe
  C:\Windows\System\CUsCclI.exe
  2⤵
  PID:7112
- C:\Windows\System\pZVdBWw.exe
  C:\Windows\System\pZVdBWw.exe
  2⤵
  PID:7132
- C:\Windows\System\MWlKZXI.exe
  C:\Windows\System\MWlKZXI.exe
  2⤵
  PID:7160
- C:\Windows\System\wlwDsJA.exe
  C:\Windows\System\wlwDsJA.exe
  2⤵
  PID:6204
- C:\Windows\System\vtuEHdD.exe
  C:\Windows\System\vtuEHdD.exe
  2⤵
  PID:6240
- C:\Windows\System\xFTHelH.exe
  C:\Windows\System\xFTHelH.exe
  2⤵
  PID:6260
- C:\Windows\System\TrxEwft.exe
  C:\Windows\System\TrxEwft.exe
  2⤵
  PID:6364
- C:\Windows\System\isQjUdA.exe
  C:\Windows\System\isQjUdA.exe
  2⤵
  PID:6440
- C:\Windows\System\NGgUoHP.exe
  C:\Windows\System\NGgUoHP.exe
  2⤵
  PID:6532
- C:\Windows\System\ZbGYuKu.exe
  C:\Windows\System\ZbGYuKu.exe
  2⤵
  PID:6572
- C:\Windows\System\NPxzqPa.exe
  C:\Windows\System\NPxzqPa.exe
  2⤵
  PID:6652
- C:\Windows\System\RcIqczX.exe
  C:\Windows\System\RcIqczX.exe
  2⤵
  PID:6712
- C:\Windows\System\VHfZZHo.exe
  C:\Windows\System\VHfZZHo.exe
  2⤵
  PID:6768
- C:\Windows\System\ojmLvUK.exe
  C:\Windows\System\ojmLvUK.exe
  2⤵
  PID:6840
- C:\Windows\System\puprqAC.exe
  C:\Windows\System\puprqAC.exe
  2⤵
  PID:6928
- C:\Windows\System\TfrEYZR.exe
  C:\Windows\System\TfrEYZR.exe
  2⤵
  PID:6988
- C:\Windows\System\EtkXKhc.exe
  C:\Windows\System\EtkXKhc.exe
  2⤵
  PID:7044
- C:\Windows\System\ePvBBNM.exe
  C:\Windows\System\ePvBBNM.exe
  2⤵
  PID:7084
- C:\Windows\System\rmteYsA.exe
  C:\Windows\System\rmteYsA.exe
  2⤵
  PID:7120
- C:\Windows\System\CUNuvBE.exe
  C:\Windows\System\CUNuvBE.exe
  2⤵
  PID:6164
- C:\Windows\System\Ipwyncw.exe
  C:\Windows\System\Ipwyncw.exe
  2⤵
  PID:6332
- C:\Windows\System\jfUXnKT.exe
  C:\Windows\System\jfUXnKT.exe
  2⤵
  PID:6596
- C:\Windows\System\jTmSoQN.exe
  C:\Windows\System\jTmSoQN.exe
  2⤵
  PID:6812
- C:\Windows\System\gOMRcbA.exe
  C:\Windows\System\gOMRcbA.exe
  2⤵
  PID:6932
- C:\Windows\System\APjYnwD.exe
  C:\Windows\System\APjYnwD.exe
  2⤵
  PID:7096
- C:\Windows\System\mnLkUEx.exe
  C:\Windows\System\mnLkUEx.exe
  2⤵
  PID:6420
- C:\Windows\System\mOpSGhn.exe
  C:\Windows\System\mOpSGhn.exe
  2⤵
  PID:6672
- C:\Windows\System\RTHuaPG.exe
  C:\Windows\System\RTHuaPG.exe
  2⤵
  PID:7104
- C:\Windows\System\hVSlRKo.exe
  C:\Windows\System\hVSlRKo.exe
  2⤵
  PID:7148
- C:\Windows\System\BUTWyfV.exe
  C:\Windows\System\BUTWyfV.exe
  2⤵
  PID:6876
- C:\Windows\System\uvHMKDY.exe
  C:\Windows\System\uvHMKDY.exe
  2⤵
  PID:7184
- C:\Windows\System\CvSfQil.exe
  C:\Windows\System\CvSfQil.exe
  2⤵
  PID:7220
- C:\Windows\System\vfXrZzc.exe
  C:\Windows\System\vfXrZzc.exe
  2⤵
  PID:7244
- C:\Windows\System\KhOVOpU.exe
  C:\Windows\System\KhOVOpU.exe
  2⤵
  PID:7284
- C:\Windows\System\KNOKcHa.exe
  C:\Windows\System\KNOKcHa.exe
  2⤵
  PID:7312
- C:\Windows\System\BeNplhw.exe
  C:\Windows\System\BeNplhw.exe
  2⤵
  PID:7340
- C:\Windows\System\UXpeaIM.exe
  C:\Windows\System\UXpeaIM.exe
  2⤵
  PID:7368
- C:\Windows\System\jvQoNUW.exe
  C:\Windows\System\jvQoNUW.exe
  2⤵
  PID:7396
- C:\Windows\System\NNrFIje.exe
  C:\Windows\System\NNrFIje.exe
  2⤵
  PID:7412
- C:\Windows\System\rTappNn.exe
  C:\Windows\System\rTappNn.exe
  2⤵
  PID:7440
- C:\Windows\System\eisSRln.exe
  C:\Windows\System\eisSRln.exe
  2⤵
  PID:7460
- C:\Windows\System\igDRUsT.exe
  C:\Windows\System\igDRUsT.exe
  2⤵
  PID:7496
- C:\Windows\System\ZhJDxrq.exe
  C:\Windows\System\ZhJDxrq.exe
  2⤵
  PID:7536
- C:\Windows\System\EbBseoq.exe
  C:\Windows\System\EbBseoq.exe
  2⤵
  PID:7564
- C:\Windows\System\KDuqZux.exe
  C:\Windows\System\KDuqZux.exe
  2⤵
  PID:7592
- C:\Windows\System\ZczjsJN.exe
  C:\Windows\System\ZczjsJN.exe
  2⤵
  PID:7608
- C:\Windows\System\KgrXvrE.exe
  C:\Windows\System\KgrXvrE.exe
  2⤵
  PID:7640
- C:\Windows\System\AEqdVqa.exe
  C:\Windows\System\AEqdVqa.exe
  2⤵
  PID:7668
- C:\Windows\System\znFqWhQ.exe
  C:\Windows\System\znFqWhQ.exe
  2⤵
  PID:7696
- C:\Windows\System\kgEEAOj.exe
  C:\Windows\System\kgEEAOj.exe
  2⤵
  PID:7720
- C:\Windows\System\cIpeWaI.exe
  C:\Windows\System\cIpeWaI.exe
  2⤵
  PID:7752
- C:\Windows\System\AzJsjRL.exe
  C:\Windows\System\AzJsjRL.exe
  2⤵
  PID:7780
- C:\Windows\System\IGWxbKn.exe
  C:\Windows\System\IGWxbKn.exe
  2⤵
  PID:7820
- C:\Windows\System\aiSdDmn.exe
  C:\Windows\System\aiSdDmn.exe
  2⤵
  PID:7836
- C:\Windows\System\kwyXyDH.exe
  C:\Windows\System\kwyXyDH.exe
  2⤵
  PID:7856
- C:\Windows\System\acYOEWJ.exe
  C:\Windows\System\acYOEWJ.exe
  2⤵
  PID:7896
- C:\Windows\System\xAGysUq.exe
  C:\Windows\System\xAGysUq.exe
  2⤵
  PID:7928
- C:\Windows\System\hhVhhUW.exe
  C:\Windows\System\hhVhhUW.exe
  2⤵
  PID:7956
- C:\Windows\System\pWYQBoN.exe
  C:\Windows\System\pWYQBoN.exe
  2⤵
  PID:7984
- C:\Windows\System\yrVbmFQ.exe
  C:\Windows\System\yrVbmFQ.exe
  2⤵
  PID:8016
- C:\Windows\System\OJGcbSm.exe
  C:\Windows\System\OJGcbSm.exe
  2⤵
  PID:8036
- C:\Windows\System\OkZxMbQ.exe
  C:\Windows\System\OkZxMbQ.exe
  2⤵
  PID:8072
- C:\Windows\System\eFaundX.exe
  C:\Windows\System\eFaundX.exe
  2⤵
  PID:8100
- C:\Windows\System\jsBoaUG.exe
  C:\Windows\System\jsBoaUG.exe
  2⤵
  PID:8116
- C:\Windows\System\reBOMFF.exe
  C:\Windows\System\reBOMFF.exe
  2⤵
  PID:8156
- C:\Windows\System\seUTTGf.exe
  C:\Windows\System\seUTTGf.exe
  2⤵
  PID:8184
- C:\Windows\System\ylxfjPJ.exe
  C:\Windows\System\ylxfjPJ.exe
  2⤵
  PID:7216
- C:\Windows\System\tpmYWpn.exe
  C:\Windows\System\tpmYWpn.exe
  2⤵
  PID:7256
- C:\Windows\System\gOpcyBX.exe
  C:\Windows\System\gOpcyBX.exe
  2⤵
  PID:7328
- C:\Windows\System\OebNnEl.exe
  C:\Windows\System\OebNnEl.exe
  2⤵
  PID:7380
- C:\Windows\System\LjDQBnO.exe
  C:\Windows\System\LjDQBnO.exe
  2⤵
  PID:7468
- C:\Windows\System\rZPumIO.exe
  C:\Windows\System\rZPumIO.exe
  2⤵
  PID:7508
- C:\Windows\System\VLmoaxU.exe
  C:\Windows\System\VLmoaxU.exe
  2⤵
  PID:7548
- C:\Windows\System\CCUfHgT.exe
  C:\Windows\System\CCUfHgT.exe
  2⤵
  PID:7652
- C:\Windows\System\odwtpGE.exe
  C:\Windows\System\odwtpGE.exe
  2⤵
  PID:7716
- C:\Windows\System\tZNFLdy.exe
  C:\Windows\System\tZNFLdy.exe
  2⤵
  PID:7764
- C:\Windows\System\qDnvqCA.exe
  C:\Windows\System\qDnvqCA.exe
  2⤵
  PID:7800
- C:\Windows\System\iYBrHnq.exe
  C:\Windows\System\iYBrHnq.exe
  2⤵
  PID:7892
- C:\Windows\System\ZvoDZCk.exe
  C:\Windows\System\ZvoDZCk.exe
  2⤵
  PID:7972
- C:\Windows\System\qGTqFJD.exe
  C:\Windows\System\qGTqFJD.exe
  2⤵
  PID:8056
- C:\Windows\System\XeLsPPB.exe
  C:\Windows\System\XeLsPPB.exe
  2⤵
  PID:8112
- C:\Windows\System\ZGfTBne.exe
  C:\Windows\System\ZGfTBne.exe
  2⤵
  PID:8176
- C:\Windows\System\MnRVgzP.exe
  C:\Windows\System\MnRVgzP.exe
  2⤵
  PID:7296
- C:\Windows\System\AXYuARg.exe
  C:\Windows\System\AXYuARg.exe
  2⤵
  PID:7404
- C:\Windows\System\bLamkVt.exe
  C:\Windows\System\bLamkVt.exe
  2⤵
  PID:7556
- C:\Windows\System\vIApqiU.exe
  C:\Windows\System\vIApqiU.exe
  2⤵
  PID:7688
- C:\Windows\System\dzDSeEb.exe
  C:\Windows\System\dzDSeEb.exe
  2⤵
  PID:7872
- C:\Windows\System\fYRYejG.exe
  C:\Windows\System\fYRYejG.exe
  2⤵
  PID:8012
- C:\Windows\System\GRSMYEQ.exe
  C:\Windows\System\GRSMYEQ.exe
  2⤵
  PID:7196
- C:\Windows\System\BywXObP.exe
  C:\Windows\System\BywXObP.exe
  2⤵
  PID:7484
- C:\Windows\System\ZrAPYRI.exe
  C:\Windows\System\ZrAPYRI.exe
  2⤵
  PID:7736
- C:\Windows\System\jofEluh.exe
  C:\Windows\System\jofEluh.exe
  2⤵
  PID:8044
- C:\Windows\System\rEnunJY.exe
  C:\Windows\System\rEnunJY.exe
  2⤵
  PID:8096
- C:\Windows\System\BNVIKuz.exe
  C:\Windows\System\BNVIKuz.exe
  2⤵
  PID:7848
- C:\Windows\System\zRCNPWk.exe
  C:\Windows\System\zRCNPWk.exe
  2⤵
  PID:8220
- C:\Windows\System\HkQOmps.exe
  C:\Windows\System\HkQOmps.exe
  2⤵
  PID:8248
- C:\Windows\System\agmrBqM.exe
  C:\Windows\System\agmrBqM.exe
  2⤵
  PID:8276
- C:\Windows\System\WrQqqmG.exe
  C:\Windows\System\WrQqqmG.exe
  2⤵
  PID:8312
- C:\Windows\System\djTpvUM.exe
  C:\Windows\System\djTpvUM.exe
  2⤵
  PID:8344
- C:\Windows\System\SCzmVPZ.exe
  C:\Windows\System\SCzmVPZ.exe
  2⤵
  PID:8376
- C:\Windows\System\rzwfFsA.exe
  C:\Windows\System\rzwfFsA.exe
  2⤵
  PID:8404
- C:\Windows\System\pOezByf.exe
  C:\Windows\System\pOezByf.exe
  2⤵
  PID:8428
- C:\Windows\System\vflmBiL.exe
  C:\Windows\System\vflmBiL.exe
  2⤵
  PID:8448
- C:\Windows\System\EEmapJD.exe
  C:\Windows\System\EEmapJD.exe
  2⤵
  PID:8492
- C:\Windows\System\jaLMHsi.exe
  C:\Windows\System\jaLMHsi.exe
  2⤵
  PID:8520
- C:\Windows\System\WuVSxCI.exe
  C:\Windows\System\WuVSxCI.exe
  2⤵
  PID:8548
- C:\Windows\System\mlfFDhA.exe
  C:\Windows\System\mlfFDhA.exe
  2⤵
  PID:8576
- C:\Windows\System\cSuZwFB.exe
  C:\Windows\System\cSuZwFB.exe
  2⤵
  PID:8616
- C:\Windows\System\UMkUtKv.exe
  C:\Windows\System\UMkUtKv.exe
  2⤵
  PID:8632
- C:\Windows\System\rFvxUGD.exe
  C:\Windows\System\rFvxUGD.exe
  2⤵
  PID:8668
- C:\Windows\System\LiEjExI.exe
  C:\Windows\System\LiEjExI.exe
  2⤵
  PID:8700
- C:\Windows\System\WkFjmKr.exe
  C:\Windows\System\WkFjmKr.exe
  2⤵
  PID:8720
- C:\Windows\System\opqzjnd.exe
  C:\Windows\System\opqzjnd.exe
  2⤵
  PID:8744
- C:\Windows\System\IDVKuWf.exe
  C:\Windows\System\IDVKuWf.exe
  2⤵
  PID:8780
- C:\Windows\System\xGBHLqg.exe
  C:\Windows\System\xGBHLqg.exe
  2⤵
  PID:8800
- C:\Windows\System\rnagHDe.exe
  C:\Windows\System\rnagHDe.exe
  2⤵
  PID:8816
- C:\Windows\System\uHwSsfU.exe
  C:\Windows\System\uHwSsfU.exe
  2⤵
  PID:8856
- C:\Windows\System\IBdvSdj.exe
  C:\Windows\System\IBdvSdj.exe
  2⤵
  PID:8872
- C:\Windows\System\iPTkQYK.exe
  C:\Windows\System\iPTkQYK.exe
  2⤵
  PID:8900
- C:\Windows\System\lWFvnHg.exe
  C:\Windows\System\lWFvnHg.exe
  2⤵
  PID:8928
- C:\Windows\System\TJOFKMt.exe
  C:\Windows\System\TJOFKMt.exe
  2⤵
  PID:8964
- C:\Windows\System\jDFlXPZ.exe
  C:\Windows\System\jDFlXPZ.exe
  2⤵
  PID:8996
- C:\Windows\System\uyetKva.exe
  C:\Windows\System\uyetKva.exe
  2⤵
  PID:9024
- C:\Windows\System\YDMLSgc.exe
  C:\Windows\System\YDMLSgc.exe
  2⤵
  PID:9048
- C:\Windows\System\xylBSeA.exe
  C:\Windows\System\xylBSeA.exe
  2⤵
  PID:9076
- C:\Windows\System\ngsFWjj.exe
  C:\Windows\System\ngsFWjj.exe
  2⤵
  PID:9096
- C:\Windows\System\ojuqzqp.exe
  C:\Windows\System\ojuqzqp.exe
  2⤵
  PID:9124
- C:\Windows\System\LWijwmo.exe
  C:\Windows\System\LWijwmo.exe
  2⤵
  PID:9152
- C:\Windows\System\RwzWLzY.exe
  C:\Windows\System\RwzWLzY.exe
  2⤵
  PID:9184
- C:\Windows\System\NFHnFKs.exe
  C:\Windows\System\NFHnFKs.exe
  2⤵
  PID:7632
- C:\Windows\System\lDXQHsV.exe
  C:\Windows\System\lDXQHsV.exe
  2⤵
  PID:8204
- C:\Windows\System\YaeBMkj.exe
  C:\Windows\System\YaeBMkj.exe
  2⤵
  PID:8292
- C:\Windows\System\qenfuxL.exe
  C:\Windows\System\qenfuxL.exe
  2⤵
  PID:8372
- C:\Windows\System\GbwIKFq.exe
  C:\Windows\System\GbwIKFq.exe
  2⤵
  PID:8444
- C:\Windows\System\toVPuek.exe
  C:\Windows\System\toVPuek.exe
  2⤵
  PID:8500
- C:\Windows\System\VOguKBf.exe
  C:\Windows\System\VOguKBf.exe
  2⤵
  PID:8532
- C:\Windows\System\CftsFyw.exe
  C:\Windows\System\CftsFyw.exe
  2⤵
  PID:8624
- C:\Windows\System\pbRSpCI.exe
  C:\Windows\System\pbRSpCI.exe
  2⤵
  PID:8688
- C:\Windows\System\HzsLXzt.exe
  C:\Windows\System\HzsLXzt.exe
  2⤵
  PID:8728
- C:\Windows\System\vrBfuul.exe
  C:\Windows\System\vrBfuul.exe
  2⤵
  PID:8764
- C:\Windows\System\dZzMYUo.exe
  C:\Windows\System\dZzMYUo.exe
  2⤵
  PID:8828
- C:\Windows\System\jNtrUNO.exe
  C:\Windows\System\jNtrUNO.exe
  2⤵
  PID:8892
- C:\Windows\System\wFuGAOK.exe
  C:\Windows\System\wFuGAOK.exe
  2⤵
  PID:8940
- C:\Windows\System\uYolpIn.exe
  C:\Windows\System\uYolpIn.exe
  2⤵
  PID:9064
- C:\Windows\System\vuHiWHR.exe
  C:\Windows\System\vuHiWHR.exe
  2⤵
  PID:9084
- C:\Windows\System\VuaQhNZ.exe
  C:\Windows\System\VuaQhNZ.exe
  2⤵
  PID:9144
- C:\Windows\System\SsSVZkI.exe
  C:\Windows\System\SsSVZkI.exe
  2⤵
  PID:8232
- C:\Windows\System\wXCZOVB.exe
  C:\Windows\System\wXCZOVB.exe
  2⤵
  PID:8272
- C:\Windows\System\QXMtsuL.exe
  C:\Windows\System\QXMtsuL.exe
  2⤵
  PID:8464
- C:\Windows\System\kdhTjfc.exe
  C:\Windows\System\kdhTjfc.exe
  2⤵
  PID:8684
- C:\Windows\System\SILQgtX.exe
  C:\Windows\System\SILQgtX.exe
  2⤵
  PID:8808
- C:\Windows\System\pyzoxxn.exe
  C:\Windows\System\pyzoxxn.exe
  2⤵
  PID:9068
- C:\Windows\System\ouTcXZo.exe
  C:\Windows\System\ouTcXZo.exe
  2⤵
  PID:9168
- C:\Windows\System\PrUhgKn.exe
  C:\Windows\System\PrUhgKn.exe
  2⤵
  PID:8364
- C:\Windows\System\IBtAMWg.exe
  C:\Windows\System\IBtAMWg.exe
  2⤵
  PID:8756
- C:\Windows\System\obWxZAm.exe
  C:\Windows\System\obWxZAm.exe
  2⤵
  PID:8912
- C:\Windows\System\EBMBYfJ.exe
  C:\Windows\System\EBMBYfJ.exe
  2⤵
  PID:9136
- C:\Windows\System\edFjpGY.exe
  C:\Windows\System\edFjpGY.exe
  2⤵
  PID:3864
- C:\Windows\System\RMsdxRd.exe
  C:\Windows\System\RMsdxRd.exe
  2⤵
  PID:9248
- C:\Windows\System\tAbSnuy.exe
  C:\Windows\System\tAbSnuy.exe
  2⤵
  PID:9276
- C:\Windows\System\KAnYPzn.exe
  C:\Windows\System\KAnYPzn.exe
  2⤵
  PID:9304
- C:\Windows\System\UWwGKYd.exe
  C:\Windows\System\UWwGKYd.exe
  2⤵
  PID:9336
- C:\Windows\System\PhhpAjC.exe
  C:\Windows\System\PhhpAjC.exe
  2⤵
  PID:9352
- C:\Windows\System\KsROBpU.exe
  C:\Windows\System\KsROBpU.exe
  2⤵
  PID:9384
- C:\Windows\System\UZaARoF.exe
  C:\Windows\System\UZaARoF.exe
  2⤵
  PID:9424
- C:\Windows\System\bVCenWo.exe
  C:\Windows\System\bVCenWo.exe
  2⤵
  PID:9448
- C:\Windows\System\cTyCCmq.exe
  C:\Windows\System\cTyCCmq.exe
  2⤵
  PID:9476
- C:\Windows\System\iNfguiS.exe
  C:\Windows\System\iNfguiS.exe
  2⤵
  PID:9512
- C:\Windows\System\XKGyMtk.exe
  C:\Windows\System\XKGyMtk.exe
  2⤵
  PID:9532
- C:\Windows\System\Umtaasr.exe
  C:\Windows\System\Umtaasr.exe
  2⤵
  PID:9552
- C:\Windows\System\DYdkIFR.exe
  C:\Windows\System\DYdkIFR.exe
  2⤵
  PID:9584
- C:\Windows\System\FYBrXvR.exe
  C:\Windows\System\FYBrXvR.exe
  2⤵
  PID:9616
- C:\Windows\System\QWAYMbD.exe
  C:\Windows\System\QWAYMbD.exe
  2⤵
  PID:9644
- C:\Windows\System\EyQQrUc.exe
  C:\Windows\System\EyQQrUc.exe
  2⤵
  PID:9676
- C:\Windows\System\nAMBJcF.exe
  C:\Windows\System\nAMBJcF.exe
  2⤵
  PID:9708
- C:\Windows\System\kIAOkLU.exe
  C:\Windows\System\kIAOkLU.exe
  2⤵
  PID:9732
- C:\Windows\System\CrRtNiB.exe
  C:\Windows\System\CrRtNiB.exe
  2⤵
  PID:9756
- C:\Windows\System\ZQteUNU.exe
  C:\Windows\System\ZQteUNU.exe
  2⤵
  PID:9780
- C:\Windows\System\TvndOPH.exe
  C:\Windows\System\TvndOPH.exe
  2⤵
  PID:9812
- C:\Windows\System\kgaeboF.exe
  C:\Windows\System\kgaeboF.exe
  2⤵
  PID:9848
- C:\Windows\System\CmtGIkz.exe
  C:\Windows\System\CmtGIkz.exe
  2⤵
  PID:9876
- C:\Windows\System\GgsZChi.exe
  C:\Windows\System\GgsZChi.exe
  2⤵
  PID:9908
- C:\Windows\System\VffQqYG.exe
  C:\Windows\System\VffQqYG.exe
  2⤵
  PID:9936
- C:\Windows\System\nUvtAaT.exe
  C:\Windows\System\nUvtAaT.exe
  2⤵
  PID:9964
- C:\Windows\System\JWcDSbu.exe
  C:\Windows\System\JWcDSbu.exe
  2⤵
  PID:9992
- C:\Windows\System\kTpYyRN.exe
  C:\Windows\System\kTpYyRN.exe
  2⤵
  PID:10008
- C:\Windows\System\LpJnGLm.exe
  C:\Windows\System\LpJnGLm.exe
  2⤵
  PID:10040
- C:\Windows\System\QxfBGCd.exe
  C:\Windows\System\QxfBGCd.exe
  2⤵
  PID:10076
- C:\Windows\System\fEMIJHs.exe
  C:\Windows\System\fEMIJHs.exe
  2⤵
  PID:10092
- C:\Windows\System\nAQmGwy.exe
  C:\Windows\System\nAQmGwy.exe
  2⤵
  PID:10128
- C:\Windows\System\rIeFOes.exe
  C:\Windows\System\rIeFOes.exe
  2⤵
  PID:10144
- C:\Windows\System\aIszXFB.exe
  C:\Windows\System\aIszXFB.exe
  2⤵
  PID:10180
- C:\Windows\System\qGSjZaD.exe
  C:\Windows\System\qGSjZaD.exe
  2⤵
  PID:10204
- C:\Windows\System\ASeDbBK.exe
  C:\Windows\System\ASeDbBK.exe
  2⤵
  PID:10220
- C:\Windows\System\AtCeavw.exe
  C:\Windows\System\AtCeavw.exe
  2⤵
  PID:9108
- C:\Windows\System\JoFsqUt.exe
  C:\Windows\System\JoFsqUt.exe
  2⤵
  PID:9288
- C:\Windows\System\ujpFpJt.exe
  C:\Windows\System\ujpFpJt.exe
  2⤵
  PID:780
- C:\Windows\System\eICgnIi.exe
  C:\Windows\System\eICgnIi.exe
  2⤵
  PID:9408
- C:\Windows\System\BuBgvdX.exe
  C:\Windows\System\BuBgvdX.exe
  2⤵
  PID:2300
- C:\Windows\System\LbaGskX.exe
  C:\Windows\System\LbaGskX.exe
  2⤵
  PID:9496
- C:\Windows\System\TXGNrrk.exe
  C:\Windows\System\TXGNrrk.exe
  2⤵
  PID:9564
- C:\Windows\System\mdBmuQf.exe
  C:\Windows\System\mdBmuQf.exe
  2⤵
  PID:9604
- C:\Windows\System\iYqqnGy.exe
  C:\Windows\System\iYqqnGy.exe
  2⤵
  PID:9660
- C:\Windows\System\wzcLEnx.exe
  C:\Windows\System\wzcLEnx.exe
  2⤵
  PID:9728
- C:\Windows\System\OohkJyS.exe
  C:\Windows\System\OohkJyS.exe
  2⤵
  PID:9748
- C:\Windows\System\xajpgMB.exe
  C:\Windows\System\xajpgMB.exe
  2⤵
  PID:9868
- C:\Windows\System\doIMrOO.exe
  C:\Windows\System\doIMrOO.exe
  2⤵
  PID:2400
- C:\Windows\System\SOGEXrr.exe
  C:\Windows\System\SOGEXrr.exe
  2⤵
  PID:9956
- C:\Windows\System\iexYUpR.exe
  C:\Windows\System\iexYUpR.exe
  2⤵
  PID:10048
- C:\Windows\System\cIMklKd.exe
  C:\Windows\System\cIMklKd.exe
  2⤵
  PID:10112
- C:\Windows\System\sNsNNfp.exe
  C:\Windows\System\sNsNNfp.exe
  2⤵
  PID:10212
- C:\Windows\System\jZwDIUC.exe
  C:\Windows\System\jZwDIUC.exe
  2⤵
  PID:8284
- C:\Windows\System\LIAaVae.exe
  C:\Windows\System\LIAaVae.exe
  2⤵
  PID:9320
- C:\Windows\System\AVzxHyL.exe
  C:\Windows\System\AVzxHyL.exe
  2⤵
  PID:9396
- C:\Windows\System\QTCAWhH.exe
  C:\Windows\System\QTCAWhH.exe
  2⤵
  PID:9472
- C:\Windows\System\kEGkvVk.exe
  C:\Windows\System\kEGkvVk.exe
  2⤵
  PID:9788
- C:\Windows\System\xXBugkH.exe
  C:\Windows\System\xXBugkH.exe
  2⤵
  PID:9892
- C:\Windows\System\WOzirRf.exe
  C:\Windows\System\WOzirRf.exe
  2⤵
  PID:10000
- C:\Windows\System\XWqeLxk.exe
  C:\Windows\System\XWqeLxk.exe
  2⤵
  PID:10020
- C:\Windows\System\fAHtluX.exe
  C:\Windows\System\fAHtluX.exe
  2⤵
  PID:10200
- C:\Windows\System\eoIgRFL.exe
  C:\Windows\System\eoIgRFL.exe
  2⤵
  PID:9528
- C:\Windows\System\fwhPCFd.exe
  C:\Windows\System\fwhPCFd.exe
  2⤵
  PID:9796
- C:\Windows\System\CJBkOvX.exe
  C:\Windows\System\CJBkOvX.exe
  2⤵
  PID:10072
- C:\Windows\System\LYwmhkX.exe
  C:\Windows\System\LYwmhkX.exe
  2⤵
  PID:9628
- C:\Windows\System\KDJVXJd.exe
  C:\Windows\System\KDJVXJd.exe
  2⤵
  PID:10268
- C:\Windows\System\AIcdCNF.exe
  C:\Windows\System\AIcdCNF.exe
  2⤵
  PID:10296
- C:\Windows\System\KHxtsDC.exe
  C:\Windows\System\KHxtsDC.exe
  2⤵
  PID:10324
- C:\Windows\System\UHGstmc.exe
  C:\Windows\System\UHGstmc.exe
  2⤵
  PID:10364
- C:\Windows\System\EBAagUU.exe
  C:\Windows\System\EBAagUU.exe
  2⤵
  PID:10380
- C:\Windows\System\aLaebrP.exe
  C:\Windows\System\aLaebrP.exe
  2⤵
  PID:10408
- C:\Windows\System\XNaIrtd.exe
  C:\Windows\System\XNaIrtd.exe
  2⤵
  PID:10424
- C:\Windows\System\jdtTpNc.exe
  C:\Windows\System\jdtTpNc.exe
  2⤵
  PID:10440
- C:\Windows\System\ImcieEU.exe
  C:\Windows\System\ImcieEU.exe
  2⤵
  PID:10476
- C:\Windows\System\IzlcIpW.exe
  C:\Windows\System\IzlcIpW.exe
  2⤵
  PID:10508
- C:\Windows\System\grlHjiZ.exe
  C:\Windows\System\grlHjiZ.exe
  2⤵
  PID:10536
- C:\Windows\System\sfcFqrC.exe
  C:\Windows\System\sfcFqrC.exe
  2⤵
  PID:10576
- C:\Windows\System\qHIXPXf.exe
  C:\Windows\System\qHIXPXf.exe
  2⤵
  PID:10604
- C:\Windows\System\OOSwLEk.exe
  C:\Windows\System\OOSwLEk.exe
  2⤵
  PID:10632
- C:\Windows\System\FdTWXWn.exe
  C:\Windows\System\FdTWXWn.exe
  2⤵
  PID:10660
- C:\Windows\System\SclSVVj.exe
  C:\Windows\System\SclSVVj.exe
  2⤵
  PID:10688
- C:\Windows\System\wpJwGKk.exe
  C:\Windows\System\wpJwGKk.exe
  2⤵
  PID:10716
- C:\Windows\System\FfJZakj.exe
  C:\Windows\System\FfJZakj.exe
  2⤵
  PID:10744
- C:\Windows\System\FjaoPDm.exe
  C:\Windows\System\FjaoPDm.exe
  2⤵
  PID:10772
- C:\Windows\System\knswvJd.exe
  C:\Windows\System\knswvJd.exe
  2⤵
  PID:10800
- C:\Windows\System\wmRxBMS.exe
  C:\Windows\System\wmRxBMS.exe
  2⤵
  PID:10816
- C:\Windows\System\BSJERql.exe
  C:\Windows\System\BSJERql.exe
  2⤵
  PID:10844
- C:\Windows\System\LdRSMQX.exe
  C:\Windows\System\LdRSMQX.exe
  2⤵
  PID:10888
- C:\Windows\System\WVvMPvp.exe
  C:\Windows\System\WVvMPvp.exe
  2⤵
  PID:10912
- C:\Windows\System\afuXZDL.exe
  C:\Windows\System\afuXZDL.exe
  2⤵
  PID:10928
- C:\Windows\System\uFreMQF.exe
  C:\Windows\System\uFreMQF.exe
  2⤵
  PID:10956
- C:\Windows\System\gsxtHxp.exe
  C:\Windows\System\gsxtHxp.exe
  2⤵
  PID:10972
- C:\Windows\System\ecYOaMs.exe
  C:\Windows\System\ecYOaMs.exe
  2⤵
  PID:11004
- C:\Windows\System\nHGtpPI.exe
  C:\Windows\System\nHGtpPI.exe
  2⤵
  PID:11044
- C:\Windows\System\ozdogcc.exe
  C:\Windows\System\ozdogcc.exe
  2⤵
  PID:11072
- C:\Windows\System\NVhbdiJ.exe
  C:\Windows\System\NVhbdiJ.exe
  2⤵
  PID:11096
- C:\Windows\System\aefINKq.exe
  C:\Windows\System\aefINKq.exe
  2⤵
  PID:11132
- C:\Windows\System\gEGlITd.exe
  C:\Windows\System\gEGlITd.exe
  2⤵
  PID:11164
- C:\Windows\System\tIzMVcM.exe
  C:\Windows\System\tIzMVcM.exe
  2⤵
  PID:11192
- C:\Windows\System\TvKJese.exe
  C:\Windows\System\TvKJese.exe
  2⤵
  PID:11224
- C:\Windows\System\UtUCkrj.exe
  C:\Windows\System\UtUCkrj.exe
  2⤵
  PID:11260
- C:\Windows\System\xFahdEY.exe
  C:\Windows\System\xFahdEY.exe
  2⤵
  PID:9932
- C:\Windows\System\HANYech.exe
  C:\Windows\System\HANYech.exe
  2⤵
  PID:10288
- C:\Windows\System\zbBfwkA.exe
  C:\Windows\System\zbBfwkA.exe
  2⤵
  PID:10372
- C:\Windows\System\kPcvxIn.exe
  C:\Windows\System\kPcvxIn.exe
  2⤵
  PID:10404
- C:\Windows\System\MrDzmLy.exe
  C:\Windows\System\MrDzmLy.exe
  2⤵
  PID:10500
- C:\Windows\System\VxVmvxs.exe
  C:\Windows\System\VxVmvxs.exe
  2⤵
  PID:10532
- C:\Windows\System\hVoqxWa.exe
  C:\Windows\System\hVoqxWa.exe
  2⤵
  PID:10544
- C:\Windows\System\fdKSvwv.exe
  C:\Windows\System\fdKSvwv.exe
  2⤵
  PID:10616
- C:\Windows\System\JpyynsN.exe
  C:\Windows\System\JpyynsN.exe
  2⤵
  PID:10700
- C:\Windows\System\TmtndwX.exe
  C:\Windows\System\TmtndwX.exe
  2⤵
  PID:10732
- C:\Windows\System\EKlsriC.exe
  C:\Windows\System\EKlsriC.exe
  2⤵
  PID:10832
- C:\Windows\System\yHRMDtr.exe
  C:\Windows\System\yHRMDtr.exe
  2⤵
  PID:10868
- C:\Windows\System\Otffwgb.exe
  C:\Windows\System\Otffwgb.exe
  2⤵
  PID:10944
- C:\Windows\System\wzNPBfW.exe
  C:\Windows\System\wzNPBfW.exe
  2⤵
  PID:11028
- C:\Windows\System\OuPqPnF.exe
  C:\Windows\System\OuPqPnF.exe
  2⤵
  PID:11144
- C:\Windows\System\zZIczjZ.exe
  C:\Windows\System\zZIczjZ.exe
  2⤵
  PID:11180
- C:\Windows\System\kLgOmOD.exe
  C:\Windows\System\kLgOmOD.exe
  2⤵
  PID:11248
- C:\Windows\System\JpbJMql.exe
  C:\Windows\System\JpbJMql.exe
  2⤵
  PID:10316
- C:\Windows\System\lwEsIQF.exe
  C:\Windows\System\lwEsIQF.exe
  2⤵
  PID:10432
- C:\Windows\System\DROdrDD.exe
  C:\Windows\System\DROdrDD.exe
  2⤵
  PID:10588
- C:\Windows\System\rbQTLJh.exe
  C:\Windows\System\rbQTLJh.exe
  2⤵
  PID:1456
- C:\Windows\System\gXxZZrk.exe
  C:\Windows\System\gXxZZrk.exe
  2⤵
  PID:10756
- C:\Windows\System\uypZrSW.exe
  C:\Windows\System\uypZrSW.exe
  2⤵
  PID:10896
- C:\Windows\System\ceoclAq.exe
  C:\Windows\System\ceoclAq.exe
  2⤵
  PID:11016
- C:\Windows\System\HtoRnjq.exe
  C:\Windows\System\HtoRnjq.exe
  2⤵
  PID:11112
- C:\Windows\System\HwvHGtJ.exe
  C:\Windows\System\HwvHGtJ.exe
  2⤵
  PID:10256
- C:\Windows\System\ogGEQlu.exe
  C:\Windows\System\ogGEQlu.exe
  2⤵
  PID:3812
- C:\Windows\System\BDNnOAO.exe
  C:\Windows\System\BDNnOAO.exe
  2⤵
  PID:10904
- C:\Windows\System\JvXriQC.exe
  C:\Windows\System\JvXriQC.exe
  2⤵
  PID:11176
- C:\Windows\System\eajimyT.exe
  C:\Windows\System\eajimyT.exe
  2⤵
  PID:10520
- C:\Windows\System\lQRWdMi.exe
  C:\Windows\System\lQRWdMi.exe
  2⤵
  PID:11268
- C:\Windows\System\QwaBOHi.exe
  C:\Windows\System\QwaBOHi.exe
  2⤵
  PID:11304
- C:\Windows\System\mjkYkXj.exe
  C:\Windows\System\mjkYkXj.exe
  2⤵
  PID:11332
- C:\Windows\System\olwqFWS.exe
  C:\Windows\System\olwqFWS.exe
  2⤵
  PID:11360
- C:\Windows\System\UIdJpvC.exe
  C:\Windows\System\UIdJpvC.exe
  2⤵
  PID:11392
- C:\Windows\System\ZpsyHmR.exe
  C:\Windows\System\ZpsyHmR.exe
  2⤵
  PID:11416
- C:\Windows\System\pOmpTMB.exe
  C:\Windows\System\pOmpTMB.exe
  2⤵
  PID:11436
- C:\Windows\System\WecANqD.exe
  C:\Windows\System\WecANqD.exe
  2⤵
  PID:11472
- C:\Windows\System\lZWPMhw.exe
  C:\Windows\System\lZWPMhw.exe
  2⤵
  PID:11500
- C:\Windows\System\GbGZhgg.exe
  C:\Windows\System\GbGZhgg.exe
  2⤵
  PID:11528
- C:\Windows\System\yoXZPDc.exe
  C:\Windows\System\yoXZPDc.exe
  2⤵
  PID:11560
- C:\Windows\System\UapgKJQ.exe
  C:\Windows\System\UapgKJQ.exe
  2⤵
  PID:11588
- C:\Windows\System\BTVGQAz.exe
  C:\Windows\System\BTVGQAz.exe
  2⤵
  PID:11620
- C:\Windows\System\cvfCAGa.exe
  C:\Windows\System\cvfCAGa.exe
  2⤵
  PID:11640
- C:\Windows\System\ZSqftQS.exe
  C:\Windows\System\ZSqftQS.exe
  2⤵
  PID:11660
- C:\Windows\System\XzjXhbm.exe
  C:\Windows\System\XzjXhbm.exe
  2⤵
  PID:11692
- C:\Windows\System\vwBfyIb.exe
  C:\Windows\System\vwBfyIb.exe
  2⤵
  PID:11724
- C:\Windows\System\tHCjLiD.exe
  C:\Windows\System\tHCjLiD.exe
  2⤵
  PID:11760
- C:\Windows\System\xsMyqsT.exe
  C:\Windows\System\xsMyqsT.exe
  2⤵
  PID:11792
- C:\Windows\System\zQbkmWv.exe
  C:\Windows\System\zQbkmWv.exe
  2⤵
  PID:11820
- C:\Windows\System\OxrDOTV.exe
  C:\Windows\System\OxrDOTV.exe
  2⤵
  PID:11856
- C:\Windows\System\hOwMwhq.exe
  C:\Windows\System\hOwMwhq.exe
  2⤵
  PID:11884
- C:\Windows\System\dYBPBgr.exe
  C:\Windows\System\dYBPBgr.exe
  2⤵
  PID:11900
- C:\Windows\System\vIRuPZP.exe
  C:\Windows\System\vIRuPZP.exe
  2⤵
  PID:11920
- C:\Windows\System\ZCaUrYT.exe
  C:\Windows\System\ZCaUrYT.exe
  2⤵
  PID:11956
- C:\Windows\System\WVtKqlP.exe
  C:\Windows\System\WVtKqlP.exe
  2⤵
  PID:12000
- C:\Windows\System\cYiSsCS.exe
  C:\Windows\System\cYiSsCS.exe
  2⤵
  PID:12028
- C:\Windows\System\JKwzMkW.exe
  C:\Windows\System\JKwzMkW.exe
  2⤵
  PID:12044
- C:\Windows\System\MpzfBKO.exe
  C:\Windows\System\MpzfBKO.exe
  2⤵
  PID:12072
- C:\Windows\System\XzrxohN.exe
  C:\Windows\System\XzrxohN.exe
  2⤵
  PID:12088
- C:\Windows\System\aJsctVq.exe
  C:\Windows\System\aJsctVq.exe
  2⤵
  PID:12124
- C:\Windows\System\UozVvLU.exe
  C:\Windows\System\UozVvLU.exe
  2⤵
  PID:12148
- C:\Windows\System\Skzotbz.exe
  C:\Windows\System\Skzotbz.exe
  2⤵
  PID:12176
- C:\Windows\System\ZbqyaRj.exe
  C:\Windows\System\ZbqyaRj.exe
  2⤵
  PID:12212
- C:\Windows\System\Opagtjw.exe
  C:\Windows\System\Opagtjw.exe
  2⤵
  PID:12248
- C:\Windows\System\rEtNcdb.exe
  C:\Windows\System\rEtNcdb.exe
  2⤵
  PID:12268
- C:\Windows\System\fBfaBKZ.exe
  C:\Windows\System\fBfaBKZ.exe
  2⤵
  PID:10940
- C:\Windows\System\SvoVHpO.exe
  C:\Windows\System\SvoVHpO.exe
  2⤵
  PID:11316
- C:\Windows\System\ZumREYg.exe
  C:\Windows\System\ZumREYg.exe
  2⤵
  PID:11404
- C:\Windows\System\iDLAxWB.exe
  C:\Windows\System\iDLAxWB.exe
  2⤵
  PID:11464
- C:\Windows\System\FZcmlwV.exe
  C:\Windows\System\FZcmlwV.exe
  2⤵
  PID:11608
- C:\Windows\System\HQrfyIt.exe
  C:\Windows\System\HQrfyIt.exe
  2⤵
  PID:11596
- C:\Windows\System\CgrrkaR.exe
  C:\Windows\System\CgrrkaR.exe
  2⤵
  PID:11636
- C:\Windows\System\kadJBaA.exe
  C:\Windows\System\kadJBaA.exe
  2⤵
  PID:11716
- C:\Windows\System\pFNPvOU.exe
  C:\Windows\System\pFNPvOU.exe
  2⤵
  PID:11808
- C:\Windows\System\GcOshMt.exe
  C:\Windows\System\GcOshMt.exe
  2⤵
  PID:11844
- C:\Windows\System\eETbONl.exe
  C:\Windows\System\eETbONl.exe
  2⤵
  PID:11932
- C:\Windows\System\PItcNjM.exe
  C:\Windows\System\PItcNjM.exe
  2⤵
  PID:11952
- C:\Windows\System\QegjIVw.exe
  C:\Windows\System\QegjIVw.exe
  2⤵
  PID:12040
- C:\Windows\System\iSPXNGl.exe
  C:\Windows\System\iSPXNGl.exe
  2⤵
  PID:12084
- C:\Windows\System\DAeJnmk.exe
  C:\Windows\System\DAeJnmk.exe
  2⤵
  PID:12196
- C:\Windows\System\hdnlokm.exe
  C:\Windows\System\hdnlokm.exe
  2⤵
  PID:12224
- C:\Windows\System\zSuSusY.exe
  C:\Windows\System\zSuSusY.exe
  2⤵
  PID:12284
- C:\Windows\System\VCHTNiV.exe
  C:\Windows\System\VCHTNiV.exe
  2⤵
  PID:11380
- C:\Windows\System\mYYKhkD.exe
  C:\Windows\System\mYYKhkD.exe
  2⤵
  PID:11488
- C:\Windows\System\YliGsUT.exe
  C:\Windows\System\YliGsUT.exe
  2⤵
  PID:11576
- C:\Windows\System\SLFkeUU.exe
  C:\Windows\System\SLFkeUU.exe
  2⤵
  PID:11804
- C:\Windows\System\ASodJNa.exe
  C:\Windows\System\ASodJNa.exe
  2⤵
  PID:11996
- C:\Windows\System\CrCgRhi.exe
  C:\Windows\System\CrCgRhi.exe
  2⤵
  PID:12020
- C:\Windows\System\kDqYXyr.exe
  C:\Windows\System\kDqYXyr.exe
  2⤵
  PID:12280
- C:\Windows\System\BkFwBiO.exe
  C:\Windows\System\BkFwBiO.exe
  2⤵
  PID:11156
- C:\Windows\System\feUBcFq.exe
  C:\Windows\System\feUBcFq.exe
  2⤵
  PID:11972
- C:\Windows\System\BavOqyn.exe
  C:\Windows\System\BavOqyn.exe
  2⤵
  PID:10644
- C:\Windows\System\LnsNvSl.exe
  C:\Windows\System\LnsNvSl.exe
  2⤵
  PID:11896
- C:\Windows\System\RFTMZLt.exe
  C:\Windows\System\RFTMZLt.exe
  2⤵
  PID:11448
- C:\Windows\System\nvGxOzc.exe
  C:\Windows\System\nvGxOzc.exe
  2⤵
  PID:12292
- C:\Windows\System\WizwgVY.exe
  C:\Windows\System\WizwgVY.exe
  2⤵
  PID:12308
- C:\Windows\System\jDjbVCs.exe
  C:\Windows\System\jDjbVCs.exe
  2⤵
  PID:12336
- C:\Windows\System\UdvJKhQ.exe
  C:\Windows\System\UdvJKhQ.exe
  2⤵
  PID:12352
- C:\Windows\System\zBVarhV.exe
  C:\Windows\System\zBVarhV.exe
  2⤵
  PID:12396
- C:\Windows\System\ahNKiKs.exe
  C:\Windows\System\ahNKiKs.exe
  2⤵
  PID:12420
- C:\Windows\System\iyGwXTF.exe
  C:\Windows\System\iyGwXTF.exe
  2⤵
  PID:12444
- C:\Windows\System\LHsTIyv.exe
  C:\Windows\System\LHsTIyv.exe
  2⤵
  PID:12472
- C:\Windows\System\eBnswEf.exe
  C:\Windows\System\eBnswEf.exe
  2⤵
  PID:12508
- C:\Windows\System\VAxxjin.exe
  C:\Windows\System\VAxxjin.exe
  2⤵
  PID:12552
- C:\Windows\System\xWBZbcK.exe
  C:\Windows\System\xWBZbcK.exe
  2⤵
  PID:12600
- C:\Windows\System\cfHgeBf.exe
  C:\Windows\System\cfHgeBf.exe
  2⤵
  PID:12628
- C:\Windows\System\uKGSqcA.exe
  C:\Windows\System\uKGSqcA.exe
  2⤵
  PID:12656
- C:\Windows\System\TPFvSAn.exe
  C:\Windows\System\TPFvSAn.exe
  2⤵
  PID:12676
- C:\Windows\System\mhpgndL.exe
  C:\Windows\System\mhpgndL.exe
  2⤵
  PID:12712
- C:\Windows\System\FTunkPw.exe
  C:\Windows\System\FTunkPw.exe
  2⤵
  PID:12748
- C:\Windows\System\FajmouN.exe
  C:\Windows\System\FajmouN.exe
  2⤵
  PID:12768
- C:\Windows\System\zPeWjAx.exe
  C:\Windows\System\zPeWjAx.exe
  2⤵
  PID:12784
- C:\Windows\System\KRycUTv.exe
  C:\Windows\System\KRycUTv.exe
  2⤵
  PID:12804
- C:\Windows\System\cuoeVaE.exe
  C:\Windows\System\cuoeVaE.exe
  2⤵
  PID:12828
- C:\Windows\System\EbBEzFe.exe
  C:\Windows\System\EbBEzFe.exe
  2⤵
  PID:12860
- C:\Windows\System\TrCkvvy.exe
  C:\Windows\System\TrCkvvy.exe
  2⤵
  PID:12896
- C:\Windows\System\qtqtlfe.exe
  C:\Windows\System\qtqtlfe.exe
  2⤵
  PID:12912
- C:\Windows\System\bMUkVxI.exe
  C:\Windows\System\bMUkVxI.exe
  2⤵
  PID:12948
- C:\Windows\System\dgcFOSz.exe
  C:\Windows\System\dgcFOSz.exe
  2⤵
  PID:12972
- C:\Windows\System\ITOZwux.exe
  C:\Windows\System\ITOZwux.exe
  2⤵
  PID:13008
- C:\Windows\System\yNfSGzi.exe
  C:\Windows\System\yNfSGzi.exe
  2⤵
  PID:13048
- C:\Windows\System\iGUuFtN.exe
  C:\Windows\System\iGUuFtN.exe
  2⤵
  PID:13064
- C:\Windows\System\rQIbqpg.exe
  C:\Windows\System\rQIbqpg.exe
  2⤵
  PID:13092
- C:\Windows\System\klGrkBO.exe
  C:\Windows\System\klGrkBO.exe
  2⤵
  PID:13108
- C:\Windows\System\upvQilF.exe
  C:\Windows\System\upvQilF.exe
  2⤵
  PID:13144
- C:\Windows\System\ZdtwCDb.exe
  C:\Windows\System\ZdtwCDb.exe
  2⤵
  PID:13184
- C:\Windows\System\gaLlNoQ.exe
  C:\Windows\System\gaLlNoQ.exe
  2⤵
  PID:13204
- C:\Windows\System\dbBZZBF.exe
  C:\Windows\System\dbBZZBF.exe
  2⤵
  PID:13232
- C:\Windows\System\AbqePJt.exe
  C:\Windows\System\AbqePJt.exe
  2⤵
  PID:13260
- C:\Windows\System\BoNjvcw.exe
  C:\Windows\System\BoNjvcw.exe
  2⤵
  PID:13280
- C:\Windows\System\MrWPQQz.exe
  C:\Windows\System\MrWPQQz.exe
  2⤵
  PID:13308
- C:\Windows\System\eVKQAmk.exe
  C:\Windows\System\eVKQAmk.exe
  2⤵
  PID:12368
- C:\Windows\System\mOFkzmH.exe
  C:\Windows\System\mOFkzmH.exe
  2⤵
  PID:12344
- C:\Windows\System\stoSIfT.exe
  C:\Windows\System\stoSIfT.exe
  2⤵
  PID:12456
- C:\Windows\System\mtoTqwt.exe
  C:\Windows\System\mtoTqwt.exe
  2⤵
  PID:12484
- C:\Windows\System\KoCzGbC.exe
  C:\Windows\System\KoCzGbC.exe
  2⤵
  PID:12648
- C:\Windows\System\miuwXGw.exe
  C:\Windows\System\miuwXGw.exe
  2⤵
  PID:12688
- C:\Windows\System\xZYJOxr.exe
  C:\Windows\System\xZYJOxr.exe
  2⤵
  PID:12764
- C:\Windows\System\jFHxSlq.exe
  C:\Windows\System\jFHxSlq.exe
  2⤵
  PID:12816
- C:\Windows\System\CXkDqwu.exe
  C:\Windows\System\CXkDqwu.exe
  2⤵
  PID:12884
- C:\Windows\System\Ubcrmff.exe
  C:\Windows\System\Ubcrmff.exe
  2⤵
  PID:12960
- C:\Windows\System\vRhBScK.exe
  C:\Windows\System\vRhBScK.exe
  2⤵
  PID:13060
- C:\Windows\System\DtCwfoe.exe
  C:\Windows\System\DtCwfoe.exe
  2⤵
  PID:13104
- C:\Windows\System\AmwaYxa.exe
  C:\Windows\System\AmwaYxa.exe
  2⤵
  PID:13152
- C:\Windows\System\OUBZaoG.exe
  C:\Windows\System\OUBZaoG.exe
  2⤵
  PID:13224
- C:\Windows\System\wWbbhuT.exe
  C:\Windows\System\wWbbhuT.exe
  2⤵
  PID:12320
- C:\Windows\System\JyKGSur.exe
  C:\Windows\System\JyKGSur.exe
  2⤵
  PID:12388
- C:\Windows\System\AzFRIcv.exe
  C:\Windows\System\AzFRIcv.exe
  2⤵
  PID:12460
- C:\Windows\System\iYLSDeO.exe
  C:\Windows\System\iYLSDeO.exe
  2⤵
  PID:12724
- C:\Windows\System\BaSInQI.exe
  C:\Windows\System\BaSInQI.exe
  2⤵
  PID:12796
- C:\Windows\System\pTEpZyz.exe
  C:\Windows\System\pTEpZyz.exe
  2⤵
  PID:12908
- C:\Windows\System\rmznmyX.exe
  C:\Windows\System\rmznmyX.exe
  2⤵
  PID:13080
- C:\Windows\System\JhKtuNt.exe
  C:\Windows\System\JhKtuNt.exe
  2⤵
  PID:13252
- C:\Windows\System\gyserDb.exe
  C:\Windows\System\gyserDb.exe
  2⤵
  PID:12440
- C:\Windows\System\CcTrdoo.exe
  C:\Windows\System\CcTrdoo.exe
  2⤵
  PID:12560
- C:\Windows\System\RgwVJlz.exe
  C:\Windows\System\RgwVJlz.exe
  2⤵
  PID:12588
- C:\Windows\System\tlKcXuZ.exe
  C:\Windows\System\tlKcXuZ.exe
  2⤵
  PID:13328
- C:\Windows\System\QmxGHIv.exe
  C:\Windows\System\QmxGHIv.exe
  2⤵
  PID:13356
- C:\Windows\System\rnsbiHb.exe
  C:\Windows\System\rnsbiHb.exe
  2⤵
  PID:13380
- C:\Windows\System\PmyXIvh.exe
  C:\Windows\System\PmyXIvh.exe
  2⤵
  PID:13412
- C:\Windows\System\ykbtMVp.exe
  C:\Windows\System\ykbtMVp.exe
  2⤵
  PID:13440
- C:\Windows\System\JzZjQbQ.exe
  C:\Windows\System\JzZjQbQ.exe
  2⤵
  PID:13480
- C:\Windows\System\VAHnwVE.exe
  C:\Windows\System\VAHnwVE.exe
  2⤵
  PID:13504
- C:\Windows\System\oHJvDte.exe
  C:\Windows\System\oHJvDte.exe
  2⤵
  PID:13524
- C:\Windows\System\dsLNNHA.exe
  C:\Windows\System\dsLNNHA.exe
  2⤵
  PID:13552
- C:\Windows\System\EVLAlss.exe
  C:\Windows\System\EVLAlss.exe
  2⤵
  PID:13580
- C:\Windows\System\gdnxToE.exe
  C:\Windows\System\gdnxToE.exe
  2⤵
  PID:13616
- C:\Windows\System\FpusHti.exe
  C:\Windows\System\FpusHti.exe
  2⤵
  PID:13636
- C:\Windows\System\jOqHahQ.exe
  C:\Windows\System\jOqHahQ.exe
  2⤵
  PID:13664
- C:\Windows\System\UMHFUiJ.exe
  C:\Windows\System\UMHFUiJ.exe
  2⤵
  PID:13692
- C:\Windows\System\QRWAFHd.exe
  C:\Windows\System\QRWAFHd.exe
  2⤵
  PID:13724
- C:\Windows\System\dzMHxtY.exe
  C:\Windows\System\dzMHxtY.exe
  2⤵
  PID:13760
- C:\Windows\System\IFmPqvN.exe
  C:\Windows\System\IFmPqvN.exe
  2⤵
  PID:13776
- C:\Windows\System\sPMzrHL.exe
  C:\Windows\System\sPMzrHL.exe
  2⤵
  PID:13808
- C:\Windows\System\nZzHwOt.exe
  C:\Windows\System\nZzHwOt.exe
  2⤵
  PID:13836
- C:\Windows\System\LgEYoHk.exe
  C:\Windows\System\LgEYoHk.exe
  2⤵
  PID:13868
- C:\Windows\System\ZmCddlT.exe
  C:\Windows\System\ZmCddlT.exe
  2⤵
  PID:13888
- C:\Windows\System\cwNoPdV.exe
  C:\Windows\System\cwNoPdV.exe
  2⤵
  PID:13904
- C:\Windows\System\XDMVdWh.exe
  C:\Windows\System\XDMVdWh.exe
  2⤵
  PID:13932
- C:\Windows\System\BDMlwMU.exe
  C:\Windows\System\BDMlwMU.exe
  2⤵
  PID:13960
- C:\Windows\System\nvCPMkD.exe
  C:\Windows\System\nvCPMkD.exe
  2⤵
  PID:13992
- C:\Windows\System\xGwsVsM.exe
  C:\Windows\System\xGwsVsM.exe
  2⤵
  PID:14032
- C:\Windows\System\tEXCqjp.exe
  C:\Windows\System\tEXCqjp.exe
  2⤵
  PID:14056
- C:\Windows\System\iQJGggN.exe
  C:\Windows\System\iQJGggN.exe
  2⤵
  PID:14084
- C:\Windows\System\bjExzTG.exe
  C:\Windows\System\bjExzTG.exe
  2⤵
  PID:14112
- C:\Windows\System\mhZkpgR.exe
  C:\Windows\System\mhZkpgR.exe
  2⤵
  PID:14128
- C:\Windows\System\jkeSmPF.exe
  C:\Windows\System\jkeSmPF.exe
  2⤵
  PID:14168
- C:\Windows\System\uGGymvV.exe
  C:\Windows\System\uGGymvV.exe
  2⤵
  PID:14184
- C:\Windows\System\BwtZIHX.exe
  C:\Windows\System\BwtZIHX.exe
  2⤵
  PID:14224
- C:\Windows\System\lRoNxEz.exe
  C:\Windows\System\lRoNxEz.exe
  2⤵
  PID:14240
- C:\Windows\System\iXebHxm.exe
  C:\Windows\System\iXebHxm.exe
  2⤵
  PID:14280
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14280 -s 252
    3⤵
    PID:13464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CIseFyS.exe

Path C:\Windows\System\CIseFyS.exe
Size 2.2MB
SHA256 39bccad8827f37478f464332ed8a16e2fc76e643ac385d41d70a2c19d01e1fff
MD5 c221c4cb8581b40cfe40f1f6ce1b5ada
SHA1 234b262abd840997456f88f4c568cd1db9e04468
SHA512 46dc68f64e81f0dcbe1abd7df537e11802f11c451b3f3d5dee4cd32ab19635990bb95156936ffaffd8b577200e6a401d0da7607b62ca51faa178f17de2df07e6
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6b:oemTLkNdfE0pZrQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CODEnNB.exe

Path C:\Windows\System\CODEnNB.exe
Size 2.2MB
SHA256 4e0dc806474430275593b69f30d05cad256f1e3f0faf63606b05e5800b5a4bd2
MD5 b7eb5b3332734b72527ec37bbee12efb
SHA1 2b9b6f79d7e3fbc6eb8e504b4ad31c7fe6d5235d
SHA512 67f8d16b9b101a89b3587afc4d8bb054b7f52a0bcdecca54f2393d2c140c554d1ad06bcce2ab6d7f024fb744558b1e33606c92f5feef31f4ce609e989decd2bd
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq62:oemTLkNdfE0pZrQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CoGGvxC.exe

Path C:\Windows\System\CoGGvxC.exe
Size 2.2MB
SHA256 2fbb68e109c53db545062c4e532e54af2349332166abc5af42ad8e086c164eee
MD5 ee6eb2c562e7ca870347687e1cc7af7e
SHA1 bf02a768905880c29be4b165efad555c968b8d87
SHA512 b9cec38ee00174eb98371c2347363dcbbd52769b6a722d11e6e6e9c568c917b3135b0c6434bbca648026cb6f8b60a86bf6a1bc7853b04d7d9122a20085629619
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6P:oemTLkNdfE0pZrQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

HlqKFqP.exe

Path C:\Windows\System\HlqKFqP.exe
Size 2.2MB
SHA256 5411aeb1e4e574d10dd18151626aced7cea298923613d46bc8883631e2153262
MD5 c96b32d375b0b496237bec0357ad714d
SHA1 7575d6205c8c1ade6c9767dd9bcdfa6f3143e3f4
SHA512 fe9ab0e698e96409d6d54f5ac25566d8ef900d2765e182e0d61c59a71d6bad088114adf08f90ca46c0b0e358a784cfd0dcea3190e04d77e7f5be92cf6a015276
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6M:oemTLkNdfE0pZrQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

INKXpOG.exe

Path C:\Windows\System\INKXpOG.exe
Size 2.2MB
SHA256 fd00da11f2466a0a350549fcc17e8962d1c6a12aeae33eec568039e267c4b0b8
MD5 ff39b5e9a5dc43840d471abde73fbf4d
SHA1 2d83b33477b3870a710e2fe62bfc5cc1d6f7a781
SHA512 82668873573e001dce45716b20fd4f4f64cc10cae8d6f92553b7f1bc65b41f77c92b2927d3fe991e43e0ce30cd7f38a6dad2c87e7651f140b416f31aacaae360
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6B:oemTLkNdfE0pZrQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

IsqSPnI.exe

Path C:\Windows\System\IsqSPnI.exe
Size 2.2MB
SHA256 83108ecda5419dfe1ab8d5c51d693d4eddbb66c34d98e88f6daceac5d95b5a8f
MD5 6b4ea45c84dd0b7e772abf1f7737964d
SHA1 4a1c0ad12844ea2295d7f7d3756d057b960f0dba
SHA512 fc7443e5379a79cb12de97ea9d71cbffb2e49785e7af8d064edf0b272ba5f7d8eafc2746bf5ed1b42b3fdc11de91a5d209b24af9c9d191881f511cadf2fe1ffb
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6F:oemTLkNdfE0pZrQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHAJZwX.exe

Path C:\Windows\System\KHAJZwX.exe
Size 2.2MB
SHA256 0549f89e7f9c2a560326fd845a245bd9613cc10d854627d3d76cea26c7272427
MD5 820fecfd1641a9446aa97508e1c7ea92
SHA1 bc35798a03d2250bfe4868ac518e8f2cd1834c35
SHA512 98435b8a30bc1185681223acb156691e3f86704a9f4fb441b345c7f3ede23bc910f5503bc462c506529c64d0218378589311c576da6b93edac0cf583add71259
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6u:oemTLkNdfE0pZrQM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NGjWzdX.exe

Path C:\Windows\System\NGjWzdX.exe
Size 2.2MB
SHA256 2d853726d15e6f9cfee7c28651411f77c316c02022ab135a263718e79b96a45a
MD5 eade42043c86c586021480871a1068d0
SHA1 5f142713422dd811b94d628590bb0acf94a865af
SHA512 4b255b145e5a37880daa6dc8adaa8ef378fb6566c330c7a71509ab0ade8c9b1f140e5a2e4c045e9de979a38d4a577a55b877484bdb4a9c240586a3ca022d41ed
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq60d:oemTLkNdfE0pZrQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvaMvNp.exe

Path C:\Windows\System\NvaMvNp.exe
Size 2.2MB
SHA256 2cded92300359b152939c8a328ea70d839d188fa52fef716e327c23be7d7dbfc
MD5 0809da571a25a7e0d41474992f41a29d
SHA1 ca7ba14e5bba6e643904092698378215e5075123
SHA512 1af0a43a80742d8669fc1a544c7aed5dde94aec9afb09a4b5721d641cda7ea73e17624e5bfd9b673cb45a4bf614933c88ad36a0abdf561dfe885a29c78aeb9e2
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6F:oemTLkNdfE0pZrQH
MD5 SHA1 SHA512 SSDEEP

Submit Download

OAgprns.exe

Path C:\Windows\System\OAgprns.exe
Size 2.2MB
SHA256 15310b19fd5913d59b92880b23098064ca712ebc0dde8d8807413f09ed073d67
MD5 1a1ee33d62fbba7e02136de43193f0d8
SHA1 903d6f71284df9876f4a405af6a7da53c3fc0b6b
SHA512 91635fe1a1fbfe4f677d6bbd3e0402890d2442f4914bbf431a4c6ae1d6c7f9727694366de7a2b1da5c13222c50532ba601523fc95d5b1bf87739b89a1bc558ad
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6Z:oemTLkNdfE0pZrQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

OTETgsl.exe

Path C:\Windows\System\OTETgsl.exe
Size 2.2MB
SHA256 b40a49c9a6a1bdf234a0ae4ed0848b7235b5aaff7da683eb1a5badc65924dacb
MD5 60c2d049eecf3d7398a696511d4b9e35
SHA1 e0232ab68dde6e36b3f942eb581cef711648feb4
SHA512 aa81133f274038ab0945144169550607194351a6e993b8e4f864c88e9bcc59c66d11be5f4ea018e417e0744942a7011c0d3e690f703d21cf5bad0e73edba61ad
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6e:oemTLkNdfE0pZrQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

UsiUTxt.exe

Path C:\Windows\System\UsiUTxt.exe
Size 2.2MB
SHA256 e5b3e373b77d91525e23d29fda02382e0ee74627361dcff9388fcd9069dad754
MD5 2b83aa347f126c5a29e887f791e163dc
SHA1 485336da2108877c5d8414953d3527649e198df8
SHA512 315b7ed6764a5a140356625db84702453348d926bd42c99d0b7adbe0eafc632df7998780546e6594b2d1a6ef86698d3122d1b68058dce0e19500b339ef865037
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6K:oemTLkNdfE0pZrQo
MD5 SHA1 SHA512 SSDEEP

Submit Download

VorGnuV.exe

Path C:\Windows\System\VorGnuV.exe
Size 2.2MB
SHA256 0a9dd6833fb90fce6f261bf3e4dee289cc6de30c9c28d42c6191d73aa4ce9e8e
MD5 d942bc2fb54ab03129f47411c69718af
SHA1 13091d4211486c009ff8959b77123cf628b70402
SHA512 83a3e8dec5869887989e18004ff87cc9b9d9d2b4615b572ef8ef493b4ea263a58d2f2750a8a7f78785f6de5033dd011c013cd98c282bea2a726bb411adb5d412
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq60:oemTLkNdfE0pZrQ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

XndptnR.exe

Path C:\Windows\System\XndptnR.exe
Size 2.2MB
SHA256 3ad4fb608308fd51f56352324b87a27f87deeb97fc8f1c00acff8b4a32c1fdb1
MD5 18a553a657cf406334f52eb20355dfcd
SHA1 1687ff20cd670b2261de53dc90e5eada396247bf
SHA512 e65890c7a74fabe458549e231f39b63c4841b3bd0a78425dfa63d7ba5ae0d55e4a83dbb87691bc6d4a3330f8b455b414c1e4467c67529eb3f7925d60bcd27d8d
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6n:oemTLkNdfE0pZrQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

aXOPVZr.exe

Path C:\Windows\System\aXOPVZr.exe
Size 2.2MB
SHA256 f2b8199d3e841890ac7c4b59e7992104a17d93094e3a2a627c5ca816824fce5c
MD5 2b9d58a732236519bef580cfb126d33b
SHA1 2fec207de786286dd71318476c76eeac646f4b37
SHA512 63c8ee0dae5610356410351bccc2d8346cef37b4b4acec99dea0baac971b802a4c12e498fc00c4300664f31613c2e5b495c0105e8858d6ab5fa232dc31266a83
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6+:oemTLkNdfE0pZrQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

bGRKiVc.exe

Path C:\Windows\System\bGRKiVc.exe
Size 2.2MB
SHA256 efe1b01bade330c77c4aa274f62eb17bf3e2eafe3ed59f8ef884a7f8faabb61f
MD5 189a77b3f03cc8dd018748fd2c2cde50
SHA1 32fb7b0a0c900be5b84f7bf9b2099caa817c8e07
SHA512 fad6da71d4eee00dc89d67e7f369d82a635d165b9400b719415647f49ebd825bbadbee164b70afbcf220d10d90a7910e3d5e79ce125b85c18a05ac37ddf385a7
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6U:oemTLkNdfE0pZrQa
MD5 SHA1 SHA512 SSDEEP

Submit Download

cCNQiRE.exe

Path C:\Windows\System\cCNQiRE.exe
Size 2.2MB
SHA256 d23e53909d43751ce1b49e3273585e8da74cc32ce0a65d2955b5bdbf4e671c6f
MD5 735b46b050e79e92cc9b3ba30b3c11f7
SHA1 75c5fd7d19c37f6c33f3b7db957e78b5c4a3314c
SHA512 7354bee0b07070299a647f2bc1540a52b14285ea7112fb19785588023452bf48c4fad572234e8ca730415e69d02d93b9284a956c05fea87762bf6963fc760104
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6A:oemTLkNdfE0pZrQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

cKMpxND.exe

Path C:\Windows\System\cKMpxND.exe
Size 2.2MB
SHA256 85dbde2e4fa45c916ea2506de73c6edc2c35280f61cfb77e9bc79b90bbb97ced
MD5 a10530b5efc3393491a237c3d5f97178
SHA1 32529a8d9759406ae7c6148675bfc40161bde72a
SHA512 cb5e88de42e6c62854df6db466a005133ea68adc1736cff90ee2f76244f84fe03b34a9621e7885bf0ce59b350d738fa7c58bcb1fe9cef95cb3ba6378502f448d
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6J:oemTLkNdfE0pZrQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbUdhLs.exe

Path C:\Windows\System\dbUdhLs.exe
Size 2.2MB
SHA256 579126fa14612977c7502fd07bdd50131b0b4ce6fb066e1e375031c6616aee36
MD5 a20273c614d6066cdd87f653f0cedc7f
SHA1 2f5cc2e7060b3b6608f3cdfe8490235fc3eaa74b
SHA512 cb82107dd6a672f68c71cdb2d801d59280a9e963369c379301191012ecccdcd004978141df8129103c493baeebee55535574975de99804dbbcd280bc179a5fe1
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6D:oemTLkNdfE0pZrQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

djZkept.exe

Path C:\Windows\System\djZkept.exe
Size 2.2MB
SHA256 ae7dcc4bbf99e5fc6a454d52a69b885f6d9ac9992643a0b6fa043bd4d3ee0f2f
MD5 66863b2875346c1410300b45dad3b07d
SHA1 ab82e22716ecd50fee2830284ec72559a2840407
SHA512 ec2ca372f6581ba704220918d86ed29c8a69d04a92c1e6bd6cd7e316f636e1a6f3f34e8a7badcaa6714eebc5969cfc51926e86658197e7e8fb5affa9644da405
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6a:oemTLkNdfE0pZrQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

gzLtWkn.exe

Path C:\Windows\System\gzLtWkn.exe
Size 2.2MB
SHA256 3033a0543640e26dfe9668a756c025ef381a124d1bae7e0c0aa4d6b655dd5ed2
MD5 84e9c697985d63f41bf95977d1dd26ae
SHA1 7b23eb709dd4e7436c4f7f8c7c5ae085dd1c6b18
SHA512 f17295ff4f14b8146ee92949d28222780b83cff38554645d3500abe253baad7ffc2bf9cb9f287191cedd6bac1bdb2e9271f9a858121ea9623017dc9429209132
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6C:oemTLkNdfE0pZrQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

iLWDESR.exe

Path C:\Windows\System\iLWDESR.exe
Size 2.2MB
SHA256 f57285e05dcf149f69dbd54b64daf5678efd0b90ec2d3a64e537d9c4ec03efd2
MD5 356d6f969d8bc7c58e5d93db5f04beb6
SHA1 da4e1320c42246e975b642df6c099faf8cd95d3f
SHA512 037d25b79dbade07bdf31898b38bd481fcecb7fb4cbbd3c61a9fbcb5dc6a588cf82f393f9cbe81fcd51a4d85119098253366b4052bffbc1353c7d46197d05806
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq69V:oemTLkNdfE0pZrQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

juEamrG.exe

Path C:\Windows\System\juEamrG.exe
Size 2.2MB
SHA256 13e1e7d6a209f854e1ecfb1bea9c2b5831624e7815006e7727672dca2fd8cd07
MD5 fc4e8f7fffed0ff70005870cf2daf7f1
SHA1 453602bbc675e6c7d5e6d0a5ad06cd6c7c08af91
SHA512 f4953c49a8ab344b634dd8b3ecfc057aaafe8a07eb9306ca085fb17f754f307c174b9e8da1fe8381948d2a2f2386a60c7fb7101643f5a8fd52c2291b295885d7
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6y:oemTLkNdfE0pZrQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

mLaMJtU.exe

Path C:\Windows\System\mLaMJtU.exe
Size 2.2MB
SHA256 00d2ba89654213e8e16e1937c07c3e05a7eb3d6a50472dadc952d756387096f2
MD5 b505b0df2548d4dfecef28fcb1a1d79c
SHA1 33f9ef17afb26a76b402809669e0fa5927daa500
SHA512 4c3ec99c2171c6cf6b6efef31ed69167dc46265aec1e81b1cdff6cead82297ea3c0fa22cd9ab542c1c67dbe2c7130c80f191d92b3ba2db002227443af591a173
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6V:oemTLkNdfE0pZrQH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ojDRwJK.exe

Path C:\Windows\System\ojDRwJK.exe
Size 2.2MB
SHA256 bf4034269d92afb67b7c0447d8ba939ef84234076a84294e8e7a0de5130e1a83
MD5 427a3148b8628b9a71d6f1565fc56de2
SHA1 83790b1796be714d4bad2545a8953e448915acb3
SHA512 9deb609d1530756cae4cb8f4523a02ee812faa97973a7675bf8ff745125f82525c7de97f32fbd6981214cc64208d7df923ac97c44717e2d7c5375b8849c31af8
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6z:oemTLkNdfE0pZrQl
MD5 SHA1 SHA512 SSDEEP

Submit Download

orCnmnN.exe

Path C:\Windows\System\orCnmnN.exe
Size 2.2MB
SHA256 f24b2778678ce9de3bb5213ee56d05da61818800dab179e9ecc0e37885a73530
MD5 44b749a8abb33207348c2519fe1b76f3
SHA1 d7514a002e56eb946859bfc2facdbb49a6bd9c31
SHA512 416c220b3e63aa5fd53915caa1fe188c7d0fe2c76daec05ef57c40b1404e426c7885d460ea39bc683a4415556426efedc7983a930d247d9affd885f9c46be6c3
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6J:oemTLkNdfE0pZrQf
MD5 SHA1 SHA512 SSDEEP

Submit Download

orYpVUM.exe

Path C:\Windows\System\orYpVUM.exe
Size 2.2MB
SHA256 36c0931913758408500bf70cfae8945242cc9a0262d02be55d377b98ca508a0c
MD5 258ada5943756f6dc164beb585254146
SHA1 616ddf464c6cc8a378d042513840834e3499fbb8
SHA512 4b921ceb40e39f908726273784dca45b429dccd11a6b95e9162750adc1a7cd21bef14546c7f97b2b63cb9062a1d84a0ef8211a789881191b6cb0033700996014
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6n:oemTLkNdfE0pZrQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

qXASXRE.exe

Path C:\Windows\System\qXASXRE.exe
Size 2.2MB
SHA256 0afe2582833b190df3f356f94d68f146f8e73d131d3eb8dd9692c00f8f48413e
MD5 7b2ac65c280414b9b79174056588de8d
SHA1 d906a8dbdb046ac49ab8ff3485cf6cb9a501f62a
SHA512 2edb56c11e35df31ccd949afb3335dbc417dd54e404331d0f9da2f9152cafc24e457a5b75ca10557b4a1f671767bf7d681d27d9225fa812a71738aaecf8d1a9b
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6C:oemTLkNdfE0pZrQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

somlTHF.exe

Path C:\Windows\System\somlTHF.exe
Size 2.2MB
SHA256 4e802f0097b91ec67b55ae502d22a98636e5f13d252f5fc0f48ae86eaa64dbb8
MD5 05c09b8f9aea5599986dbb4d0cbf415c
SHA1 0fbb57a253309b131b8555cdf0fde2a2d05d16b9
SHA512 3bd95084a1393ab4f254e9901e580b1dc57115cd39f00ab88cf31bb223549b6717f7283d5bc843a1363866c18f77c7e6f24e4f48eadf61ad38cd40082bf930f3
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq63E:oemTLkNdfE0pZrQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vJINHSZ.exe

Path C:\Windows\System\vJINHSZ.exe
Size 2.2MB
SHA256 bc2a79d6394fe242976c964cbd728a53aeaecbfac9c4d1c41620dbd68f8352c1
MD5 5f334bffe0bbb392e3cc7571bd972c4e
SHA1 177dbfffea45a6257801805a8a974c54f6cb2aa8
SHA512 60d7b434994b9c8d13cab9e1bd78247facde707c2723bbb55c01eaedac618ed2d1a23b36b81c391339caaabfcc2f4a48dd8b6087f1ace6632bcfa7229b708d7e
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq64:oemTLkNdfE0pZrQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vuUxSaw.exe

Path C:\Windows\System\vuUxSaw.exe
Size 2.2MB
SHA256 3601ecf0bc4d014afcb4d0ad44a7119b696801912c8ebcce96bc28ed815c2d53
MD5 484f271322230834a02de9ef65c7a8b5
SHA1 0d6e45ab6cd0a46795703fd05c429a1d9aa793d3
SHA512 41d1bdbb0f7781c8a8e02f7875c01d2fd491f55f87ae478dbbdab5f9852306a6a527d20b1beb2f6f05207312225e0d69a0cd7bce04982ec03fc42a4acbfefca7
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6Z:oemTLkNdfE0pZrQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

xwzGqGH.exe

Path C:\Windows\System\xwzGqGH.exe
Size 2.2MB
SHA256 1186ba4d5631519b841034e7ead2541953b1e231748c0dc733eab1bb4959841f
MD5 41a376f0c52b2f3ca3f26ba2ddec1591
SHA1 3dda5b0bbd2d467ba1204a9885e578d52a861d7f
SHA512 495853c26f6710d3434e0a9931ca2494c9780139876fa01e8d784cc1ad620ae5c7abe459206484dcba1f77df9ffb1d1d586d84f530351c51784dfe140dea587e
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6q:oemTLkNdfE0pZrQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjrqrDY.exe

Path C:\Windows\System\yjrqrDY.exe
Size 2.2MB
SHA256 2a93a04d10d9627200de08810a2a2d2870750d9a995b9400c21080b880cc759f
MD5 65b5680fe7e8fa6b3168fb14ddcbaace
SHA1 ea0e7fe067fa7566703cffb27ababaaa63032c5f
SHA512 67814720b1905688265c6c4fae3aee43f852ae5a9e9b59fb58e775ff4b9830257afa6d298b275ce5baf65591d55fec6c3716536f3f8c34fc7c712e746c8f983e
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUnj7Zq6Q:oemTLkNdfE0pZrQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-2144-0x00007FF6F98E0000-0x00007FF6F9C34000-memory.dmp

Download

memory/400-187-0x00007FF6F98E0000-0x00007FF6F9C34000-memory.dmp

Download

memory/840-2163-0x00007FF6FC1D0000-0x00007FF6FC524000-memory.dmp

Download

memory/840-192-0x00007FF6FC1D0000-0x00007FF6FC524000-memory.dmp

Download

memory/920-2149-0x00007FF7CE8C0000-0x00007FF7CEC14000-memory.dmp

Download

memory/920-190-0x00007FF7CE8C0000-0x00007FF7CEC14000-memory.dmp

Download

memory/956-2150-0x00007FF618510000-0x00007FF618864000-memory.dmp

Download

memory/956-156-0x00007FF618510000-0x00007FF618864000-memory.dmp

Download

memory/1196-87-0x00007FF748720000-0x00007FF748A74000-memory.dmp

Download

memory/1196-2146-0x00007FF748720000-0x00007FF748A74000-memory.dmp

Download

memory/1196-2135-0x00007FF748720000-0x00007FF748A74000-memory.dmp

Download

memory/1316-2145-0x00007FF779FC0000-0x00007FF77A314000-memory.dmp

Download

memory/1316-92-0x00007FF779FC0000-0x00007FF77A314000-memory.dmp

Download

memory/1436-52-0x00007FF785D10000-0x00007FF786064000-memory.dmp

Download

memory/1436-2134-0x00007FF785D10000-0x00007FF786064000-memory.dmp

Download

memory/1436-2142-0x00007FF785D10000-0x00007FF786064000-memory.dmp

Download

memory/1532-185-0x00007FF747D90000-0x00007FF7480E4000-memory.dmp

Download

memory/1532-2156-0x00007FF747D90000-0x00007FF7480E4000-memory.dmp

Download

memory/1592-2160-0x00007FF78AC40000-0x00007FF78AF94000-memory.dmp

Download

memory/1592-182-0x00007FF78AC40000-0x00007FF78AF94000-memory.dmp

Download

memory/1732-189-0x00007FF722060000-0x00007FF7223B4000-memory.dmp

Download

memory/1732-2151-0x00007FF722060000-0x00007FF7223B4000-memory.dmp

Download

memory/1748-2161-0x00007FF7C1020000-0x00007FF7C1374000-memory.dmp

Download

memory/1748-180-0x00007FF7C1020000-0x00007FF7C1374000-memory.dmp

Download

memory/1836-0-0x00007FF75F440000-0x00007FF75F794000-memory.dmp

Download

memory/1836-1-0x00000224FD400000-0x00000224FD410000-memory.dmp

Download

memory/2312-24-0x00007FF6DE6D0000-0x00007FF6DEA24000-memory.dmp

Download

memory/2312-2139-0x00007FF6DE6D0000-0x00007FF6DEA24000-memory.dmp

Download

memory/2312-2132-0x00007FF6DE6D0000-0x00007FF6DEA24000-memory.dmp

Download

memory/2516-2155-0x00007FF672BA0000-0x00007FF672EF4000-memory.dmp

Download

memory/2516-186-0x00007FF672BA0000-0x00007FF672EF4000-memory.dmp

Download

memory/2580-101-0x00007FF6BCEC0000-0x00007FF6BD214000-memory.dmp

Download

memory/2580-2148-0x00007FF6BCEC0000-0x00007FF6BD214000-memory.dmp

Download

memory/2708-2133-0x00007FF743DE0000-0x00007FF744134000-memory.dmp

Download

memory/2708-2143-0x00007FF743DE0000-0x00007FF744134000-memory.dmp

Download

memory/2708-34-0x00007FF743DE0000-0x00007FF744134000-memory.dmp

Download

memory/3216-2136-0x00007FF7FF4F0000-0x00007FF7FF844000-memory.dmp

Download

memory/3216-137-0x00007FF7FF4F0000-0x00007FF7FF844000-memory.dmp

Download

memory/3216-2152-0x00007FF7FF4F0000-0x00007FF7FF844000-memory.dmp

Download

memory/3320-191-0x00007FF7C1390000-0x00007FF7C16E4000-memory.dmp

Download

memory/3320-2147-0x00007FF7C1390000-0x00007FF7C16E4000-memory.dmp

Download

memory/3568-11-0x00007FF7DB180000-0x00007FF7DB4D4000-memory.dmp

Download

memory/3568-2137-0x00007FF7DB180000-0x00007FF7DB4D4000-memory.dmp

Download

memory/3620-2153-0x00007FF6C84C0000-0x00007FF6C8814000-memory.dmp

Download

memory/3620-157-0x00007FF6C84C0000-0x00007FF6C8814000-memory.dmp

Download

memory/3700-181-0x00007FF735980000-0x00007FF735CD4000-memory.dmp

Download

memory/3700-2165-0x00007FF735980000-0x00007FF735CD4000-memory.dmp

Download

memory/3992-193-0x00007FF7742D0000-0x00007FF774624000-memory.dmp

Download

memory/3992-2164-0x00007FF7742D0000-0x00007FF774624000-memory.dmp

Download

memory/4044-21-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp

Download

memory/4044-2131-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp

Download

memory/4044-2138-0x00007FF6DD590000-0x00007FF6DD8E4000-memory.dmp

Download

memory/4132-162-0x00007FF63DA90000-0x00007FF63DDE4000-memory.dmp

Download

memory/4132-2154-0x00007FF63DA90000-0x00007FF63DDE4000-memory.dmp

Download

memory/4140-70-0x00007FF669C10000-0x00007FF669F64000-memory.dmp

Download

memory/4140-2140-0x00007FF669C10000-0x00007FF669F64000-memory.dmp

Download

memory/4396-2158-0x00007FF6953D0000-0x00007FF695724000-memory.dmp

Download

memory/4396-183-0x00007FF6953D0000-0x00007FF695724000-memory.dmp

Download

memory/4424-179-0x00007FF7469C0000-0x00007FF746D14000-memory.dmp

Download

memory/4424-2162-0x00007FF7469C0000-0x00007FF746D14000-memory.dmp

Download

memory/4596-188-0x00007FF62F550000-0x00007FF62F8A4000-memory.dmp

Download

memory/4596-2141-0x00007FF62F550000-0x00007FF62F8A4000-memory.dmp

Download

memory/4644-194-0x00007FF71D960000-0x00007FF71DCB4000-memory.dmp

Download

memory/4644-2159-0x00007FF71D960000-0x00007FF71DCB4000-memory.dmp

Download

memory/4752-2157-0x00007FF6D4E50000-0x00007FF6D51A4000-memory.dmp

Download

memory/4752-184-0x00007FF6D4E50000-0x00007FF6D51A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads