xmrig | ea1e8e3d30cdfeb69b34427b7dfefb4fdb85f72e95199e270a839c318697e693

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
Size 1.9MB
Sample240612-m7gf3sscqa
SHA256 ea1e8e3d30cdfeb69b34427b7dfefb4fdb85f72e95199e270a839c318697e693
MD5 351c8d10886c24f3811554b9ac721c00
SHA1 2e734a6f24838c45a811c9f582d356d700a1dc3a
SHA512 af29feb8f8c0dfa9c408d9606068f15a36fdfae4b80aed19cd8238ce2062f5de8f75b4e9c494ad11bd3c84ac1823f93203f34b4bcc5bd16c3ded4821f2351844
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXZ:RWWBib356utgpPFoJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/5072-12-0x00007FF732CE0000-0x00007FF733031000-memory.dmp	xmrig
behavioral2/memory/4040-84-0x00007FF723620000-0x00007FF723971000-memory.dmp	xmrig
behavioral2/memory/2688-78-0x00007FF6C74A0000-0x00007FF6C77F1000-memory.dmp	xmrig
behavioral2/memory/212-98-0x00007FF6D06B0000-0x00007FF6D0A01000-memory.dmp	xmrig
behavioral2/memory/3508-95-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp	xmrig
behavioral2/memory/1400-94-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp	xmrig
behavioral2/memory/4264-106-0x00007FF787850000-0x00007FF787BA1000-memory.dmp	xmrig
behavioral2/memory/4656-177-0x00007FF6BF940000-0x00007FF6BFC91000-memory.dmp	xmrig
behavioral2/memory/544-208-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp	xmrig
behavioral2/memory/2388-207-0x00007FF76A180000-0x00007FF76A4D1000-memory.dmp	xmrig
behavioral2/memory/4716-206-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp	xmrig
behavioral2/memory/1520-200-0x00007FF715700000-0x00007FF715A51000-memory.dmp	xmrig
behavioral2/memory/2744-197-0x00007FF6D62A0000-0x00007FF6D65F1000-memory.dmp	xmrig
behavioral2/memory/1460-178-0x00007FF625B20000-0x00007FF625E71000-memory.dmp	xmrig
behavioral2/memory/3972-171-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp	xmrig
behavioral2/memory/2104-168-0x00007FF6457B0000-0x00007FF645B01000-memory.dmp	xmrig
behavioral2/memory/1932-160-0x00007FF77DD90000-0x00007FF77E0E1000-memory.dmp	xmrig
behavioral2/memory/3252-119-0x00007FF78ADB0000-0x00007FF78B101000-memory.dmp	xmrig
behavioral2/memory/3708-117-0x00007FF739070000-0x00007FF7393C1000-memory.dmp	xmrig
behavioral2/memory/1600-111-0x00007FF694F10000-0x00007FF695261000-memory.dmp	xmrig
behavioral2/memory/536-1478-0x00007FF6AF710000-0x00007FF6AFA61000-memory.dmp	xmrig
behavioral2/memory/1516-2062-0x00007FF79C820000-0x00007FF79CB71000-memory.dmp	xmrig
behavioral2/memory/5016-2277-0x00007FF6AC7C0000-0x00007FF6ACB11000-memory.dmp	xmrig
behavioral2/memory/2212-2294-0x00007FF7FBBF0000-0x00007FF7FBF41000-memory.dmp	xmrig
behavioral2/memory/4372-2295-0x00007FF719030000-0x00007FF719381000-memory.dmp	xmrig
behavioral2/memory/2548-2313-0x00007FF7C5390000-0x00007FF7C56E1000-memory.dmp	xmrig
behavioral2/memory/2600-2312-0x00007FF75C080000-0x00007FF75C3D1000-memory.dmp	xmrig
behavioral2/memory/4260-2315-0x00007FF64BF40000-0x00007FF64C291000-memory.dmp	xmrig
behavioral2/memory/2460-2314-0x00007FF779EB0000-0x00007FF77A201000-memory.dmp	xmrig
behavioral2/memory/4448-2316-0x00007FF6DCB60000-0x00007FF6DCEB1000-memory.dmp	xmrig
behavioral2/memory/5072-2319-0x00007FF732CE0000-0x00007FF733031000-memory.dmp	xmrig
behavioral2/memory/4040-2321-0x00007FF723620000-0x00007FF723971000-memory.dmp	xmrig
behavioral2/memory/1400-2323-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp	xmrig
behavioral2/memory/3508-2325-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp	xmrig
behavioral2/memory/3972-2328-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp	xmrig
behavioral2/memory/3708-2333-0x00007FF739070000-0x00007FF7393C1000-memory.dmp	xmrig
behavioral2/memory/4264-2332-0x00007FF787850000-0x00007FF787BA1000-memory.dmp	xmrig
behavioral2/memory/1520-2335-0x00007FF715700000-0x00007FF715A51000-memory.dmp	xmrig
behavioral2/memory/3252-2330-0x00007FF78ADB0000-0x00007FF78B101000-memory.dmp	xmrig
behavioral2/memory/536-2338-0x00007FF6AF710000-0x00007FF6AFA61000-memory.dmp	xmrig
behavioral2/memory/1516-2345-0x00007FF79C820000-0x00007FF79CB71000-memory.dmp	xmrig
behavioral2/memory/5016-2344-0x00007FF6AC7C0000-0x00007FF6ACB11000-memory.dmp	xmrig
behavioral2/memory/4716-2341-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp	xmrig
behavioral2/memory/544-2340-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp	xmrig
behavioral2/memory/212-2393-0x00007FF6D06B0000-0x00007FF6D0A01000-memory.dmp	xmrig
behavioral2/memory/1600-2395-0x00007FF694F10000-0x00007FF695261000-memory.dmp	xmrig
behavioral2/memory/2600-2418-0x00007FF75C080000-0x00007FF75C3D1000-memory.dmp	xmrig
behavioral2/memory/2104-2420-0x00007FF6457B0000-0x00007FF645B01000-memory.dmp	xmrig
behavioral2/memory/4372-2424-0x00007FF719030000-0x00007FF719381000-memory.dmp	xmrig
behavioral2/memory/1932-2423-0x00007FF77DD90000-0x00007FF77E0E1000-memory.dmp	xmrig
behavioral2/memory/4260-2433-0x00007FF64BF40000-0x00007FF64C291000-memory.dmp	xmrig
behavioral2/memory/2548-2436-0x00007FF7C5390000-0x00007FF7C56E1000-memory.dmp	xmrig
behavioral2/memory/2460-2435-0x00007FF779EB0000-0x00007FF77A201000-memory.dmp	xmrig
behavioral2/memory/1460-2431-0x00007FF625B20000-0x00007FF625E71000-memory.dmp	xmrig
behavioral2/memory/2212-2429-0x00007FF7FBBF0000-0x00007FF7FBF41000-memory.dmp	xmrig
behavioral2/memory/4656-2427-0x00007FF6BF940000-0x00007FF6BFC91000-memory.dmp	xmrig
behavioral2/memory/2388-2441-0x00007FF76A180000-0x00007FF76A4D1000-memory.dmp	xmrig
behavioral2/memory/2744-2442-0x00007FF6D62A0000-0x00007FF6D65F1000-memory.dmp	xmrig
behavioral2/memory/4448-2439-0x00007FF6DCB60000-0x00007FF6DCEB1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5072	LCiegaw.exe
4040	VeDjXkn.exe
1400	LumTRrO.exe
3508	GhLFVWS.exe
3708	KgjbnKW.exe
4264	ofaTgGR.exe
3252	FbvWcBw.exe
3972	YfIaCqu.exe
4716	VInICeq.exe
1520	mkXDnCb.exe
544	QlrNlqH.exe
536	FfosDuu.exe
1516	ZyCsMCH.exe
5016	SAiXLmH.exe
212	XGClzUC.exe
1600	jgVSHuI.exe
2600	HMHujhP.exe
2212	wkLkmTu.exe
2104	qUpupcg.exe
4656	OCvEDJo.exe
2548	wrtpHiS.exe
4372	HyUSSQn.exe
2460	pJbhmqK.exe
1460	kbuibFT.exe
4260	wgePfGY.exe
1932	QauvyQT.exe
2744	XcYThvf.exe
2388	NLMXyMs.exe
4448	Babfebt.exe
4412	LRjcVVP.exe
4752	bMHgwMG.exe
3276	sBEZwIf.exe
3324	IQNjSZG.exe
2400	LCzFlXR.exe
2376	TRVQmSw.exe
3668	GnKMEmu.exe
4292	OXRswGg.exe
1552	YSwZYID.exe
4664	ezPunRb.exe
4332	zkwpsnv.exe
4360	xgunzMn.exe
4900	cihoDlS.exe
2064	NBbThBm.exe
524	USatbKA.exe
984	eMWgxfT.exe
3820	aVVOIWo.exe
4216	ZNfIPUd.exe
5024	UaHbKDH.exe
4228	gTvnbjO.exe
1884	JaLIgNx.exe
2924	oiCzbcv.exe
3896	BQdAWdM.exe
4312	bucFYno.exe
3156	aiWFNqO.exe
216	JjOhptc.exe
3924	IiPMBqh.exe
3140	zTOsXQF.exe
3756	slodKlb.exe
4868	ipJZKYX.exe
2192	oSnuIBq.exe
4856	oSndnJG.exe
2704	Nrxnakr.exe
676	wdgzWnp.exe
1364	EGNgFYJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2688-0-0x00007FF6C74A0000-0x00007FF6C77F1000-memory.dmp	upx
behavioral2/files/0x00090000000233fd-6.dat	upx
behavioral2/files/0x0007000000023419-14.dat	upx
behavioral2/files/0x0007000000023418-13.dat	upx
behavioral2/memory/5072-12-0x00007FF732CE0000-0x00007FF733031000-memory.dmp	upx
behavioral2/memory/1400-24-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp	upx
behavioral2/memory/3508-29-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp	upx
behavioral2/memory/3708-36-0x00007FF739070000-0x00007FF7393C1000-memory.dmp	upx
behavioral2/files/0x000700000002341e-47.dat	upx
behavioral2/files/0x0007000000023420-56.dat	upx
behavioral2/files/0x0007000000023422-67.dat	upx
behavioral2/files/0x0007000000023424-86.dat	upx
behavioral2/memory/5016-85-0x00007FF6AC7C0000-0x00007FF6ACB11000-memory.dmp	upx
behavioral2/memory/4040-84-0x00007FF723620000-0x00007FF723971000-memory.dmp	upx
behavioral2/memory/1516-83-0x00007FF79C820000-0x00007FF79CB71000-memory.dmp	upx
behavioral2/files/0x0007000000023423-81.dat	upx
behavioral2/memory/2688-78-0x00007FF6C74A0000-0x00007FF6C77F1000-memory.dmp	upx
behavioral2/files/0x0007000000023421-73.dat	upx
behavioral2/memory/536-71-0x00007FF6AF710000-0x00007FF6AFA61000-memory.dmp	upx
behavioral2/memory/544-70-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp	upx
behavioral2/files/0x000700000002341f-64.dat	upx
behavioral2/memory/4716-63-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp	upx
behavioral2/memory/1520-57-0x00007FF715700000-0x00007FF715A51000-memory.dmp	upx
behavioral2/memory/3972-49-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp	upx
behavioral2/memory/3252-48-0x00007FF78ADB0000-0x00007FF78B101000-memory.dmp	upx
behavioral2/files/0x000700000002341d-46.dat	upx
behavioral2/files/0x000700000002341c-42.dat	upx
behavioral2/files/0x000700000002341b-38.dat	upx
behavioral2/files/0x000700000002341a-32.dat	upx
behavioral2/memory/4264-30-0x00007FF787850000-0x00007FF787BA1000-memory.dmp	upx
behavioral2/memory/4040-20-0x00007FF723620000-0x00007FF723971000-memory.dmp	upx
behavioral2/files/0x0007000000023425-92.dat	upx
behavioral2/memory/212-98-0x00007FF6D06B0000-0x00007FF6D0A01000-memory.dmp	upx
behavioral2/files/0x0008000000023415-100.dat	upx
behavioral2/memory/3508-95-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp	upx
behavioral2/memory/1400-94-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp	upx
behavioral2/memory/4264-106-0x00007FF787850000-0x00007FF787BA1000-memory.dmp	upx
behavioral2/files/0x000700000002342c-132.dat	upx
behavioral2/files/0x000700000002342d-141.dat	upx
behavioral2/files/0x0007000000023433-176.dat	upx
behavioral2/memory/4656-177-0x00007FF6BF940000-0x00007FF6BFC91000-memory.dmp	upx
behavioral2/memory/4448-184-0x00007FF6DCB60000-0x00007FF6DCEB1000-memory.dmp	upx
behavioral2/memory/544-208-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp	upx
behavioral2/memory/2388-207-0x00007FF76A180000-0x00007FF76A4D1000-memory.dmp	upx
behavioral2/memory/4716-206-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp	upx
behavioral2/files/0x0007000000023437-205.dat	upx
behavioral2/files/0x0007000000023436-204.dat	upx
behavioral2/files/0x0007000000023435-202.dat	upx
behavioral2/files/0x0007000000023434-201.dat	upx
behavioral2/memory/1520-200-0x00007FF715700000-0x00007FF715A51000-memory.dmp	upx
behavioral2/memory/2744-197-0x00007FF6D62A0000-0x00007FF6D65F1000-memory.dmp	upx
behavioral2/files/0x0007000000023432-182.dat	upx
behavioral2/files/0x0007000000023431-181.dat	upx
behavioral2/files/0x0007000000023430-179.dat	upx
behavioral2/memory/1460-178-0x00007FF625B20000-0x00007FF625E71000-memory.dmp	upx
behavioral2/memory/3972-171-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp	upx
behavioral2/memory/2104-168-0x00007FF6457B0000-0x00007FF645B01000-memory.dmp	upx
behavioral2/memory/1932-160-0x00007FF77DD90000-0x00007FF77E0E1000-memory.dmp	upx
behavioral2/memory/4260-159-0x00007FF64BF40000-0x00007FF64C291000-memory.dmp	upx
behavioral2/files/0x0007000000023429-152.dat	upx
behavioral2/memory/2460-150-0x00007FF779EB0000-0x00007FF77A201000-memory.dmp	upx
behavioral2/files/0x000700000002342f-146.dat	upx
behavioral2/files/0x000700000002342e-145.dat	upx
behavioral2/files/0x000700000002342a-144.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wigKfNr.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\cOVnOTk.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\dFICEHq.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\PnqUyMR.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\vFKGoZB.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\TenQUzv.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\qiREUhV.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\SEkhtyF.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\AKEfLBK.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\eMWgxfT.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\XVjDzGY.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\viGANoz.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\oGFIiVw.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\qVNHjwF.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\lfZfOHx.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\uhlBDmH.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\WrfEMUH.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\RgFtocs.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\uDlvlMG.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\wKpZIoJ.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\JOJapoM.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\xVDAogW.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\JfCpPWl.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\ZgjSkUk.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\MpIGUWg.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\IIwBKfY.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\qSvmwAF.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\kBVGgQt.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\yOFFZEN.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\ztEEUPd.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\ZNfIPUd.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\yhOgUJA.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\ptNeSiN.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\xxGoLoA.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\HXMXPQY.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\VPhvqNo.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\QQRgqIL.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\iYDzhvk.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\MhQxJWY.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\paQUrae.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\EGjVbmg.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\hlTZIvm.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\FJpLnmu.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\iGIuVJg.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\pKjAwPi.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\FoDhbgP.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\qYkzCOJ.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\newkKRp.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\RbRGtVx.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\EnRUkDG.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\gekVEoA.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\tScVonF.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\LCTDqhX.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\oeVCPxH.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\IoiNlhp.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\LCiegaw.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\kbuibFT.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\CsHlJSu.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\FIHsDNv.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\YMgmSgB.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\QqwoTuS.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\VInICeq.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\KGOltfT.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
File created	C:\Windows\System\qFRryqu.exe	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 5072	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	82
PID 2688 wrote to memory of 5072	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	82
PID 2688 wrote to memory of 4040	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	83
PID 2688 wrote to memory of 4040	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	83
PID 2688 wrote to memory of 1400	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	84
PID 2688 wrote to memory of 1400	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	84
PID 2688 wrote to memory of 3508	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	85
PID 2688 wrote to memory of 3508	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	85
PID 2688 wrote to memory of 3708	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	86
PID 2688 wrote to memory of 3708	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	86
PID 2688 wrote to memory of 4264	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	87
PID 2688 wrote to memory of 4264	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	87
PID 2688 wrote to memory of 3252	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	88
PID 2688 wrote to memory of 3252	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	88
PID 2688 wrote to memory of 3972	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	89
PID 2688 wrote to memory of 3972	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	89
PID 2688 wrote to memory of 4716	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	90
PID 2688 wrote to memory of 4716	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	90
PID 2688 wrote to memory of 1520	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	91
PID 2688 wrote to memory of 1520	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	91
PID 2688 wrote to memory of 544	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	93
PID 2688 wrote to memory of 544	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	93
PID 2688 wrote to memory of 536	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	94
PID 2688 wrote to memory of 536	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	94
PID 2688 wrote to memory of 1516	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	95
PID 2688 wrote to memory of 1516	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	95
PID 2688 wrote to memory of 5016	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	96
PID 2688 wrote to memory of 5016	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	96
PID 2688 wrote to memory of 212	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	97
PID 2688 wrote to memory of 212	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	97
PID 2688 wrote to memory of 1600	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	100
PID 2688 wrote to memory of 1600	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	100
PID 2688 wrote to memory of 2600	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	101
PID 2688 wrote to memory of 2600	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	101
PID 2688 wrote to memory of 2212	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	102
PID 2688 wrote to memory of 2212	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	102
PID 2688 wrote to memory of 2104	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	103
PID 2688 wrote to memory of 2104	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	103
PID 2688 wrote to memory of 2548	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	104
PID 2688 wrote to memory of 2548	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	104
PID 2688 wrote to memory of 4372	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	105
PID 2688 wrote to memory of 4372	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	105
PID 2688 wrote to memory of 4656	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	106
PID 2688 wrote to memory of 4656	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	106
PID 2688 wrote to memory of 2460	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	107
PID 2688 wrote to memory of 2460	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	107
PID 2688 wrote to memory of 1460	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	108
PID 2688 wrote to memory of 1460	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	108
PID 2688 wrote to memory of 4260	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	109
PID 2688 wrote to memory of 4260	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	109
PID 2688 wrote to memory of 1932	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	110
PID 2688 wrote to memory of 1932	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	110
PID 2688 wrote to memory of 2744	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	111
PID 2688 wrote to memory of 2744	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	111
PID 2688 wrote to memory of 2388	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	112
PID 2688 wrote to memory of 2388	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	112
PID 2688 wrote to memory of 4448	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	113
PID 2688 wrote to memory of 4448	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	113
PID 2688 wrote to memory of 4412	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	114
PID 2688 wrote to memory of 4412	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	114
PID 2688 wrote to memory of 4752	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	115
PID 2688 wrote to memory of 4752	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	115
PID 2688 wrote to memory of 3276	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	116
PID 2688 wrote to memory of 3276	2688	351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\351c8d10886c24f3811554b9ac721c00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\System\LCiegaw.exe
  C:\Windows\System\LCiegaw.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\VeDjXkn.exe
  C:\Windows\System\VeDjXkn.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\LumTRrO.exe
  C:\Windows\System\LumTRrO.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\GhLFVWS.exe
  C:\Windows\System\GhLFVWS.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\KgjbnKW.exe
  C:\Windows\System\KgjbnKW.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\ofaTgGR.exe
  C:\Windows\System\ofaTgGR.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\FbvWcBw.exe
  C:\Windows\System\FbvWcBw.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\YfIaCqu.exe
  C:\Windows\System\YfIaCqu.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\VInICeq.exe
  C:\Windows\System\VInICeq.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\mkXDnCb.exe
  C:\Windows\System\mkXDnCb.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\QlrNlqH.exe
  C:\Windows\System\QlrNlqH.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\FfosDuu.exe
  C:\Windows\System\FfosDuu.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\ZyCsMCH.exe
  C:\Windows\System\ZyCsMCH.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\SAiXLmH.exe
  C:\Windows\System\SAiXLmH.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\XGClzUC.exe
  C:\Windows\System\XGClzUC.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\jgVSHuI.exe
  C:\Windows\System\jgVSHuI.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\HMHujhP.exe
  C:\Windows\System\HMHujhP.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\wkLkmTu.exe
  C:\Windows\System\wkLkmTu.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\qUpupcg.exe
  C:\Windows\System\qUpupcg.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\wrtpHiS.exe
  C:\Windows\System\wrtpHiS.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\HyUSSQn.exe
  C:\Windows\System\HyUSSQn.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\OCvEDJo.exe
  C:\Windows\System\OCvEDJo.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\pJbhmqK.exe
  C:\Windows\System\pJbhmqK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\kbuibFT.exe
  C:\Windows\System\kbuibFT.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\wgePfGY.exe
  C:\Windows\System\wgePfGY.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\QauvyQT.exe
  C:\Windows\System\QauvyQT.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\XcYThvf.exe
  C:\Windows\System\XcYThvf.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\NLMXyMs.exe
  C:\Windows\System\NLMXyMs.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\Babfebt.exe
  C:\Windows\System\Babfebt.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\LRjcVVP.exe
  C:\Windows\System\LRjcVVP.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\bMHgwMG.exe
  C:\Windows\System\bMHgwMG.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\sBEZwIf.exe
  C:\Windows\System\sBEZwIf.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\IQNjSZG.exe
  C:\Windows\System\IQNjSZG.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\LCzFlXR.exe
  C:\Windows\System\LCzFlXR.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\TRVQmSw.exe
  C:\Windows\System\TRVQmSw.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\GnKMEmu.exe
  C:\Windows\System\GnKMEmu.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\OXRswGg.exe
  C:\Windows\System\OXRswGg.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\YSwZYID.exe
  C:\Windows\System\YSwZYID.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ezPunRb.exe
  C:\Windows\System\ezPunRb.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\zkwpsnv.exe
  C:\Windows\System\zkwpsnv.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\xgunzMn.exe
  C:\Windows\System\xgunzMn.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\cihoDlS.exe
  C:\Windows\System\cihoDlS.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\NBbThBm.exe
  C:\Windows\System\NBbThBm.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\USatbKA.exe
  C:\Windows\System\USatbKA.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\eMWgxfT.exe
  C:\Windows\System\eMWgxfT.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\aVVOIWo.exe
  C:\Windows\System\aVVOIWo.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\ZNfIPUd.exe
  C:\Windows\System\ZNfIPUd.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\UaHbKDH.exe
  C:\Windows\System\UaHbKDH.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\gTvnbjO.exe
  C:\Windows\System\gTvnbjO.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\JaLIgNx.exe
  C:\Windows\System\JaLIgNx.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\oiCzbcv.exe
  C:\Windows\System\oiCzbcv.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\BQdAWdM.exe
  C:\Windows\System\BQdAWdM.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\bucFYno.exe
  C:\Windows\System\bucFYno.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\aiWFNqO.exe
  C:\Windows\System\aiWFNqO.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\JjOhptc.exe
  C:\Windows\System\JjOhptc.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\IiPMBqh.exe
  C:\Windows\System\IiPMBqh.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\zTOsXQF.exe
  C:\Windows\System\zTOsXQF.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\slodKlb.exe
  C:\Windows\System\slodKlb.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\ipJZKYX.exe
  C:\Windows\System\ipJZKYX.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\oSnuIBq.exe
  C:\Windows\System\oSnuIBq.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\oSndnJG.exe
  C:\Windows\System\oSndnJG.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\Nrxnakr.exe
  C:\Windows\System\Nrxnakr.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\wdgzWnp.exe
  C:\Windows\System\wdgzWnp.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\EGNgFYJ.exe
  C:\Windows\System\EGNgFYJ.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\KGOltfT.exe
  C:\Windows\System\KGOltfT.exe
  2⤵
  PID:4968
- C:\Windows\System\fwRhohF.exe
  C:\Windows\System\fwRhohF.exe
  2⤵
  PID:4940
- C:\Windows\System\KiCcDSE.exe
  C:\Windows\System\KiCcDSE.exe
  2⤵
  PID:4472
- C:\Windows\System\iJXvonw.exe
  C:\Windows\System\iJXvonw.exe
  2⤵
  PID:384
- C:\Windows\System\iuZCJJA.exe
  C:\Windows\System\iuZCJJA.exe
  2⤵
  PID:1096
- C:\Windows\System\cxgTxhT.exe
  C:\Windows\System\cxgTxhT.exe
  2⤵
  PID:1660
- C:\Windows\System\XqDgZWr.exe
  C:\Windows\System\XqDgZWr.exe
  2⤵
  PID:3248
- C:\Windows\System\MhQxJWY.exe
  C:\Windows\System\MhQxJWY.exe
  2⤵
  PID:4668
- C:\Windows\System\iEvvygS.exe
  C:\Windows\System\iEvvygS.exe
  2⤵
  PID:5040
- C:\Windows\System\HLhAaxF.exe
  C:\Windows\System\HLhAaxF.exe
  2⤵
  PID:4652
- C:\Windows\System\EFASqTD.exe
  C:\Windows\System\EFASqTD.exe
  2⤵
  PID:1388
- C:\Windows\System\zXlNfky.exe
  C:\Windows\System\zXlNfky.exe
  2⤵
  PID:4012
- C:\Windows\System\Efgdgue.exe
  C:\Windows\System\Efgdgue.exe
  2⤵
  PID:5064
- C:\Windows\System\LKDSjBw.exe
  C:\Windows\System\LKDSjBw.exe
  2⤵
  PID:2752
- C:\Windows\System\RuLNaBL.exe
  C:\Windows\System\RuLNaBL.exe
  2⤵
  PID:3356
- C:\Windows\System\XIRXjuS.exe
  C:\Windows\System\XIRXjuS.exe
  2⤵
  PID:3612
- C:\Windows\System\YweSuJd.exe
  C:\Windows\System\YweSuJd.exe
  2⤵
  PID:4108
- C:\Windows\System\MVHllJD.exe
  C:\Windows\System\MVHllJD.exe
  2⤵
  PID:4972
- C:\Windows\System\YASojHD.exe
  C:\Windows\System\YASojHD.exe
  2⤵
  PID:552
- C:\Windows\System\HLsNuoN.exe
  C:\Windows\System\HLsNuoN.exe
  2⤵
  PID:1508
- C:\Windows\System\IJbXxvE.exe
  C:\Windows\System\IJbXxvE.exe
  2⤵
  PID:3960
- C:\Windows\System\IIwBKfY.exe
  C:\Windows\System\IIwBKfY.exe
  2⤵
  PID:3024
- C:\Windows\System\tByZRbN.exe
  C:\Windows\System\tByZRbN.exe
  2⤵
  PID:776
- C:\Windows\System\eAZdoPl.exe
  C:\Windows\System\eAZdoPl.exe
  2⤵
  PID:1168
- C:\Windows\System\uNeQDwH.exe
  C:\Windows\System\uNeQDwH.exe
  2⤵
  PID:4580
- C:\Windows\System\ARYxzWB.exe
  C:\Windows\System\ARYxzWB.exe
  2⤵
  PID:4016
- C:\Windows\System\mpNnCeD.exe
  C:\Windows\System\mpNnCeD.exe
  2⤵
  PID:1704
- C:\Windows\System\ZdgSlBw.exe
  C:\Windows\System\ZdgSlBw.exe
  2⤵
  PID:3344
- C:\Windows\System\OmEfEVE.exe
  C:\Windows\System\OmEfEVE.exe
  2⤵
  PID:4164
- C:\Windows\System\KEYdbIs.exe
  C:\Windows\System\KEYdbIs.exe
  2⤵
  PID:1900
- C:\Windows\System\GNfNBAC.exe
  C:\Windows\System\GNfNBAC.exe
  2⤵
  PID:3584
- C:\Windows\System\AryoREU.exe
  C:\Windows\System\AryoREU.exe
  2⤵
  PID:4052
- C:\Windows\System\EzlCMiO.exe
  C:\Windows\System\EzlCMiO.exe
  2⤵
  PID:4604
- C:\Windows\System\KBBTktb.exe
  C:\Windows\System\KBBTktb.exe
  2⤵
  PID:4948
- C:\Windows\System\jpcXqqC.exe
  C:\Windows\System\jpcXqqC.exe
  2⤵
  PID:2664
- C:\Windows\System\mDQmlPk.exe
  C:\Windows\System\mDQmlPk.exe
  2⤵
  PID:3272
- C:\Windows\System\BqNViId.exe
  C:\Windows\System\BqNViId.exe
  2⤵
  PID:3300
- C:\Windows\System\FDBBXrY.exe
  C:\Windows\System\FDBBXrY.exe
  2⤵
  PID:4492
- C:\Windows\System\HbDBIxs.exe
  C:\Windows\System\HbDBIxs.exe
  2⤵
  PID:608
- C:\Windows\System\VesllEu.exe
  C:\Windows\System\VesllEu.exe
  2⤵
  PID:4340
- C:\Windows\System\oYLwHME.exe
  C:\Windows\System\oYLwHME.exe
  2⤵
  PID:5128
- C:\Windows\System\kEtHaYP.exe
  C:\Windows\System\kEtHaYP.exe
  2⤵
  PID:5152
- C:\Windows\System\oXSSHld.exe
  C:\Windows\System\oXSSHld.exe
  2⤵
  PID:5180
- C:\Windows\System\RrskfuV.exe
  C:\Windows\System\RrskfuV.exe
  2⤵
  PID:5220
- C:\Windows\System\PNgpwkL.exe
  C:\Windows\System\PNgpwkL.exe
  2⤵
  PID:5280
- C:\Windows\System\ZnAvgvH.exe
  C:\Windows\System\ZnAvgvH.exe
  2⤵
  PID:5304
- C:\Windows\System\DMvsPhy.exe
  C:\Windows\System\DMvsPhy.exe
  2⤵
  PID:5332
- C:\Windows\System\jNhSOic.exe
  C:\Windows\System\jNhSOic.exe
  2⤵
  PID:5356
- C:\Windows\System\tetCnXk.exe
  C:\Windows\System\tetCnXk.exe
  2⤵
  PID:5372
- C:\Windows\System\hsApxQn.exe
  C:\Windows\System\hsApxQn.exe
  2⤵
  PID:5404
- C:\Windows\System\MbuyTUz.exe
  C:\Windows\System\MbuyTUz.exe
  2⤵
  PID:5448
- C:\Windows\System\YXjYyzn.exe
  C:\Windows\System\YXjYyzn.exe
  2⤵
  PID:5472
- C:\Windows\System\CAixYFv.exe
  C:\Windows\System\CAixYFv.exe
  2⤵
  PID:5496
- C:\Windows\System\wgtiaQW.exe
  C:\Windows\System\wgtiaQW.exe
  2⤵
  PID:5520
- C:\Windows\System\fkNmwot.exe
  C:\Windows\System\fkNmwot.exe
  2⤵
  PID:5544
- C:\Windows\System\wLNkowf.exe
  C:\Windows\System\wLNkowf.exe
  2⤵
  PID:5584
- C:\Windows\System\kBSjuZi.exe
  C:\Windows\System\kBSjuZi.exe
  2⤵
  PID:5604
- C:\Windows\System\DXYhIyx.exe
  C:\Windows\System\DXYhIyx.exe
  2⤵
  PID:5624
- C:\Windows\System\MgcRfui.exe
  C:\Windows\System\MgcRfui.exe
  2⤵
  PID:5652
- C:\Windows\System\nlMPvpY.exe
  C:\Windows\System\nlMPvpY.exe
  2⤵
  PID:5676
- C:\Windows\System\PyZlIHZ.exe
  C:\Windows\System\PyZlIHZ.exe
  2⤵
  PID:5696
- C:\Windows\System\iPPOkhp.exe
  C:\Windows\System\iPPOkhp.exe
  2⤵
  PID:5724
- C:\Windows\System\jZHXwuN.exe
  C:\Windows\System\jZHXwuN.exe
  2⤵
  PID:5752
- C:\Windows\System\cKgRiUs.exe
  C:\Windows\System\cKgRiUs.exe
  2⤵
  PID:5808
- C:\Windows\System\WPIHtQq.exe
  C:\Windows\System\WPIHtQq.exe
  2⤵
  PID:5828
- C:\Windows\System\DzvsiVo.exe
  C:\Windows\System\DzvsiVo.exe
  2⤵
  PID:5848
- C:\Windows\System\gOpzivz.exe
  C:\Windows\System\gOpzivz.exe
  2⤵
  PID:5876
- C:\Windows\System\iULkyMa.exe
  C:\Windows\System\iULkyMa.exe
  2⤵
  PID:5896
- C:\Windows\System\sIOmLGn.exe
  C:\Windows\System\sIOmLGn.exe
  2⤵
  PID:5940
- C:\Windows\System\BBcWqsc.exe
  C:\Windows\System\BBcWqsc.exe
  2⤵
  PID:5960
- C:\Windows\System\WyYBdIO.exe
  C:\Windows\System\WyYBdIO.exe
  2⤵
  PID:6000
- C:\Windows\System\vbsWcIU.exe
  C:\Windows\System\vbsWcIU.exe
  2⤵
  PID:6036
- C:\Windows\System\rxFyazB.exe
  C:\Windows\System\rxFyazB.exe
  2⤵
  PID:6056
- C:\Windows\System\rbPalTp.exe
  C:\Windows\System\rbPalTp.exe
  2⤵
  PID:6076
- C:\Windows\System\nCFDomg.exe
  C:\Windows\System\nCFDomg.exe
  2⤵
  PID:6104
- C:\Windows\System\GCLGeeS.exe
  C:\Windows\System\GCLGeeS.exe
  2⤵
  PID:6140
- C:\Windows\System\TZuLRgb.exe
  C:\Windows\System\TZuLRgb.exe
  2⤵
  PID:5148
- C:\Windows\System\FhexWEM.exe
  C:\Windows\System\FhexWEM.exe
  2⤵
  PID:4008
- C:\Windows\System\bEWwDRA.exe
  C:\Windows\System\bEWwDRA.exe
  2⤵
  PID:1876
- C:\Windows\System\RZsQUjq.exe
  C:\Windows\System\RZsQUjq.exe
  2⤵
  PID:5256
- C:\Windows\System\MGztTBr.exe
  C:\Windows\System\MGztTBr.exe
  2⤵
  PID:5328
- C:\Windows\System\uHIbYau.exe
  C:\Windows\System\uHIbYau.exe
  2⤵
  PID:5368
- C:\Windows\System\SxmoKXk.exe
  C:\Windows\System\SxmoKXk.exe
  2⤵
  PID:5480
- C:\Windows\System\KkutYOA.exe
  C:\Windows\System\KkutYOA.exe
  2⤵
  PID:5532
- C:\Windows\System\adbeply.exe
  C:\Windows\System\adbeply.exe
  2⤵
  PID:5632
- C:\Windows\System\yhOgUJA.exe
  C:\Windows\System\yhOgUJA.exe
  2⤵
  PID:5692
- C:\Windows\System\WrfEMUH.exe
  C:\Windows\System\WrfEMUH.exe
  2⤵
  PID:5820
- C:\Windows\System\LNgJxeg.exe
  C:\Windows\System\LNgJxeg.exe
  2⤵
  PID:5844
- C:\Windows\System\xwXcReC.exe
  C:\Windows\System\xwXcReC.exe
  2⤵
  PID:5892
- C:\Windows\System\qFRryqu.exe
  C:\Windows\System\qFRryqu.exe
  2⤵
  PID:5952
- C:\Windows\System\zRupDkF.exe
  C:\Windows\System\zRupDkF.exe
  2⤵
  PID:5992
- C:\Windows\System\jReRHHr.exe
  C:\Windows\System\jReRHHr.exe
  2⤵
  PID:6072
- C:\Windows\System\OvtkDof.exe
  C:\Windows\System\OvtkDof.exe
  2⤵
  PID:6128
- C:\Windows\System\NVjJdzc.exe
  C:\Windows\System\NVjJdzc.exe
  2⤵
  PID:5168
- C:\Windows\System\hYFVkzO.exe
  C:\Windows\System\hYFVkzO.exe
  2⤵
  PID:5276
- C:\Windows\System\HSbQTLe.exe
  C:\Windows\System\HSbQTLe.exe
  2⤵
  PID:5428
- C:\Windows\System\kHaUKLQ.exe
  C:\Windows\System\kHaUKLQ.exe
  2⤵
  PID:5504
- C:\Windows\System\UnOCkZz.exe
  C:\Windows\System\UnOCkZz.exe
  2⤵
  PID:5620
- C:\Windows\System\yNHOzMr.exe
  C:\Windows\System\yNHOzMr.exe
  2⤵
  PID:5800
- C:\Windows\System\CRArxYC.exe
  C:\Windows\System\CRArxYC.exe
  2⤵
  PID:5908
- C:\Windows\System\LmQQFID.exe
  C:\Windows\System\LmQQFID.exe
  2⤵
  PID:6068
- C:\Windows\System\uPkvpWZ.exe
  C:\Windows\System\uPkvpWZ.exe
  2⤵
  PID:6116
- C:\Windows\System\kgNQrAs.exe
  C:\Windows\System\kgNQrAs.exe
  2⤵
  PID:5660
- C:\Windows\System\lwsrHjP.exe
  C:\Windows\System\lwsrHjP.exe
  2⤵
  PID:6176
- C:\Windows\System\PnqUyMR.exe
  C:\Windows\System\PnqUyMR.exe
  2⤵
  PID:6200
- C:\Windows\System\oGdACoe.exe
  C:\Windows\System\oGdACoe.exe
  2⤵
  PID:6232
- C:\Windows\System\qipyVHR.exe
  C:\Windows\System\qipyVHR.exe
  2⤵
  PID:6252
- C:\Windows\System\erTTROP.exe
  C:\Windows\System\erTTROP.exe
  2⤵
  PID:6272
- C:\Windows\System\jeCnPTM.exe
  C:\Windows\System\jeCnPTM.exe
  2⤵
  PID:6296
- C:\Windows\System\pUgLCoF.exe
  C:\Windows\System\pUgLCoF.exe
  2⤵
  PID:6320
- C:\Windows\System\VCZPeOG.exe
  C:\Windows\System\VCZPeOG.exe
  2⤵
  PID:6344
- C:\Windows\System\JYGqXfv.exe
  C:\Windows\System\JYGqXfv.exe
  2⤵
  PID:6368
- C:\Windows\System\ercBKDW.exe
  C:\Windows\System\ercBKDW.exe
  2⤵
  PID:6392
- C:\Windows\System\paQUrae.exe
  C:\Windows\System\paQUrae.exe
  2⤵
  PID:6412
- C:\Windows\System\OsezAtN.exe
  C:\Windows\System\OsezAtN.exe
  2⤵
  PID:6436
- C:\Windows\System\fbLYtll.exe
  C:\Windows\System\fbLYtll.exe
  2⤵
  PID:6452
- C:\Windows\System\sxLGcug.exe
  C:\Windows\System\sxLGcug.exe
  2⤵
  PID:6480
- C:\Windows\System\CsHlJSu.exe
  C:\Windows\System\CsHlJSu.exe
  2⤵
  PID:6504
- C:\Windows\System\aDPWJUx.exe
  C:\Windows\System\aDPWJUx.exe
  2⤵
  PID:6528
- C:\Windows\System\aMwFMAD.exe
  C:\Windows\System\aMwFMAD.exe
  2⤵
  PID:6548
- C:\Windows\System\KVgNPdX.exe
  C:\Windows\System\KVgNPdX.exe
  2⤵
  PID:6568
- C:\Windows\System\VdIezCc.exe
  C:\Windows\System\VdIezCc.exe
  2⤵
  PID:6608
- C:\Windows\System\UezBAzD.exe
  C:\Windows\System\UezBAzD.exe
  2⤵
  PID:6676
- C:\Windows\System\juXjglt.exe
  C:\Windows\System\juXjglt.exe
  2⤵
  PID:6720
- C:\Windows\System\gzWLlIu.exe
  C:\Windows\System\gzWLlIu.exe
  2⤵
  PID:6756
- C:\Windows\System\claPlSH.exe
  C:\Windows\System\claPlSH.exe
  2⤵
  PID:6776
- C:\Windows\System\fHfngqZ.exe
  C:\Windows\System\fHfngqZ.exe
  2⤵
  PID:6804
- C:\Windows\System\GPzokVx.exe
  C:\Windows\System\GPzokVx.exe
  2⤵
  PID:6832
- C:\Windows\System\GLUgfFV.exe
  C:\Windows\System\GLUgfFV.exe
  2⤵
  PID:6856
- C:\Windows\System\KyADMiV.exe
  C:\Windows\System\KyADMiV.exe
  2⤵
  PID:6876
- C:\Windows\System\wmcDhed.exe
  C:\Windows\System\wmcDhed.exe
  2⤵
  PID:6916
- C:\Windows\System\XNKVvuY.exe
  C:\Windows\System\XNKVvuY.exe
  2⤵
  PID:6932
- C:\Windows\System\JNzLOlY.exe
  C:\Windows\System\JNzLOlY.exe
  2⤵
  PID:6984
- C:\Windows\System\jISsEqc.exe
  C:\Windows\System\jISsEqc.exe
  2⤵
  PID:7008
- C:\Windows\System\dtTtsRI.exe
  C:\Windows\System\dtTtsRI.exe
  2⤵
  PID:7032
- C:\Windows\System\xVDAogW.exe
  C:\Windows\System\xVDAogW.exe
  2⤵
  PID:7056
- C:\Windows\System\ANxLsRU.exe
  C:\Windows\System\ANxLsRU.exe
  2⤵
  PID:7112
- C:\Windows\System\eXNBJHC.exe
  C:\Windows\System\eXNBJHC.exe
  2⤵
  PID:7132
- C:\Windows\System\gCWWmLf.exe
  C:\Windows\System\gCWWmLf.exe
  2⤵
  PID:7160
- C:\Windows\System\qSvmwAF.exe
  C:\Windows\System\qSvmwAF.exe
  2⤵
  PID:5824
- C:\Windows\System\cWEKGAt.exe
  C:\Windows\System\cWEKGAt.exe
  2⤵
  PID:5460
- C:\Windows\System\vfLCLvg.exe
  C:\Windows\System\vfLCLvg.exe
  2⤵
  PID:6192
- C:\Windows\System\uBnfrqM.exe
  C:\Windows\System\uBnfrqM.exe
  2⤵
  PID:6248
- C:\Windows\System\OanDloz.exe
  C:\Windows\System\OanDloz.exe
  2⤵
  PID:6288
- C:\Windows\System\WSdHfdM.exe
  C:\Windows\System\WSdHfdM.exe
  2⤵
  PID:6304
- C:\Windows\System\GFIillj.exe
  C:\Windows\System\GFIillj.exe
  2⤵
  PID:6424
- C:\Windows\System\xGOFhaD.exe
  C:\Windows\System\xGOFhaD.exe
  2⤵
  PID:6444
- C:\Windows\System\mgcMdJK.exe
  C:\Windows\System\mgcMdJK.exe
  2⤵
  PID:6468
- C:\Windows\System\sRmlRwJ.exe
  C:\Windows\System\sRmlRwJ.exe
  2⤵
  PID:6620
- C:\Windows\System\tJLTULo.exe
  C:\Windows\System\tJLTULo.exe
  2⤵
  PID:6672
- C:\Windows\System\gPNppOF.exe
  C:\Windows\System\gPNppOF.exe
  2⤵
  PID:6712
- C:\Windows\System\OiWijUh.exe
  C:\Windows\System\OiWijUh.exe
  2⤵
  PID:6772
- C:\Windows\System\FBKEVFF.exe
  C:\Windows\System\FBKEVFF.exe
  2⤵
  PID:6800
- C:\Windows\System\ApbeRRE.exe
  C:\Windows\System\ApbeRRE.exe
  2⤵
  PID:6868
- C:\Windows\System\PCrccbY.exe
  C:\Windows\System\PCrccbY.exe
  2⤵
  PID:5916
- C:\Windows\System\AzdznKe.exe
  C:\Windows\System\AzdznKe.exe
  2⤵
  PID:5580
- C:\Windows\System\JjyyvaJ.exe
  C:\Windows\System\JjyyvaJ.exe
  2⤵
  PID:5984
- C:\Windows\System\FcXsxOg.exe
  C:\Windows\System\FcXsxOg.exe
  2⤵
  PID:6376
- C:\Windows\System\xdAMNXh.exe
  C:\Windows\System\xdAMNXh.exe
  2⤵
  PID:6476
- C:\Windows\System\UhARFTi.exe
  C:\Windows\System\UhARFTi.exe
  2⤵
  PID:6520
- C:\Windows\System\UicVxFT.exe
  C:\Windows\System\UicVxFT.exe
  2⤵
  PID:6728
- C:\Windows\System\gyXbAIJ.exe
  C:\Windows\System\gyXbAIJ.exe
  2⤵
  PID:6828
- C:\Windows\System\vFKGoZB.exe
  C:\Windows\System\vFKGoZB.exe
  2⤵
  PID:7152
- C:\Windows\System\DFtbDWD.exe
  C:\Windows\System\DFtbDWD.exe
  2⤵
  PID:6264
- C:\Windows\System\LyrHMSL.exe
  C:\Windows\System\LyrHMSL.exe
  2⤵
  PID:6820
- C:\Windows\System\EBNtdVq.exe
  C:\Windows\System\EBNtdVq.exe
  2⤵
  PID:7184
- C:\Windows\System\pgpFcbk.exe
  C:\Windows\System\pgpFcbk.exe
  2⤵
  PID:7232
- C:\Windows\System\YXLlNwp.exe
  C:\Windows\System\YXLlNwp.exe
  2⤵
  PID:7248
- C:\Windows\System\jbevHtm.exe
  C:\Windows\System\jbevHtm.exe
  2⤵
  PID:7268
- C:\Windows\System\JQUSSoe.exe
  C:\Windows\System\JQUSSoe.exe
  2⤵
  PID:7284
- C:\Windows\System\aIMDEjP.exe
  C:\Windows\System\aIMDEjP.exe
  2⤵
  PID:7300
- C:\Windows\System\EwXseCM.exe
  C:\Windows\System\EwXseCM.exe
  2⤵
  PID:7316
- C:\Windows\System\dEMnbhX.exe
  C:\Windows\System\dEMnbhX.exe
  2⤵
  PID:7332
- C:\Windows\System\xHVuOty.exe
  C:\Windows\System\xHVuOty.exe
  2⤵
  PID:7352
- C:\Windows\System\EShUnSu.exe
  C:\Windows\System\EShUnSu.exe
  2⤵
  PID:7372
- C:\Windows\System\RHDfFaz.exe
  C:\Windows\System\RHDfFaz.exe
  2⤵
  PID:7388
- C:\Windows\System\sDBPzUj.exe
  C:\Windows\System\sDBPzUj.exe
  2⤵
  PID:7404
- C:\Windows\System\enEopLz.exe
  C:\Windows\System\enEopLz.exe
  2⤵
  PID:7420
- C:\Windows\System\bFCIORw.exe
  C:\Windows\System\bFCIORw.exe
  2⤵
  PID:7436
- C:\Windows\System\MeJTnET.exe
  C:\Windows\System\MeJTnET.exe
  2⤵
  PID:7452
- C:\Windows\System\dbAwwAS.exe
  C:\Windows\System\dbAwwAS.exe
  2⤵
  PID:7532
- C:\Windows\System\NeKIDAS.exe
  C:\Windows\System\NeKIDAS.exe
  2⤵
  PID:7560
- C:\Windows\System\aguGSvh.exe
  C:\Windows\System\aguGSvh.exe
  2⤵
  PID:7652
- C:\Windows\System\TFGOAjh.exe
  C:\Windows\System\TFGOAjh.exe
  2⤵
  PID:7680
- C:\Windows\System\sEIqbqw.exe
  C:\Windows\System\sEIqbqw.exe
  2⤵
  PID:7700
- C:\Windows\System\eLLESQF.exe
  C:\Windows\System\eLLESQF.exe
  2⤵
  PID:7724
- C:\Windows\System\gtJbueB.exe
  C:\Windows\System\gtJbueB.exe
  2⤵
  PID:7748
- C:\Windows\System\jFXbIpK.exe
  C:\Windows\System\jFXbIpK.exe
  2⤵
  PID:7796
- C:\Windows\System\UoqSjOM.exe
  C:\Windows\System\UoqSjOM.exe
  2⤵
  PID:7836
- C:\Windows\System\mxLIsLh.exe
  C:\Windows\System\mxLIsLh.exe
  2⤵
  PID:7856
- C:\Windows\System\DfhxHSI.exe
  C:\Windows\System\DfhxHSI.exe
  2⤵
  PID:7884
- C:\Windows\System\rMaXLNU.exe
  C:\Windows\System\rMaXLNU.exe
  2⤵
  PID:7936
- C:\Windows\System\jpWhEjP.exe
  C:\Windows\System\jpWhEjP.exe
  2⤵
  PID:7956
- C:\Windows\System\XxpISeI.exe
  C:\Windows\System\XxpISeI.exe
  2⤵
  PID:8000
- C:\Windows\System\vqesUbL.exe
  C:\Windows\System\vqesUbL.exe
  2⤵
  PID:8016
- C:\Windows\System\AQGgnft.exe
  C:\Windows\System\AQGgnft.exe
  2⤵
  PID:8044
- C:\Windows\System\cPQNGSj.exe
  C:\Windows\System\cPQNGSj.exe
  2⤵
  PID:8060
- C:\Windows\System\ptNeSiN.exe
  C:\Windows\System\ptNeSiN.exe
  2⤵
  PID:8080
- C:\Windows\System\BNbERje.exe
  C:\Windows\System\BNbERje.exe
  2⤵
  PID:8108
- C:\Windows\System\qAWrVOB.exe
  C:\Windows\System\qAWrVOB.exe
  2⤵
  PID:8128
- C:\Windows\System\mKGQAIS.exe
  C:\Windows\System\mKGQAIS.exe
  2⤵
  PID:8164
- C:\Windows\System\HTWOhVx.exe
  C:\Windows\System\HTWOhVx.exe
  2⤵
  PID:7068
- C:\Windows\System\creqFes.exe
  C:\Windows\System\creqFes.exe
  2⤵
  PID:7244
- C:\Windows\System\SBoNgSU.exe
  C:\Windows\System\SBoNgSU.exe
  2⤵
  PID:7364
- C:\Windows\System\ToKGYGk.exe
  C:\Windows\System\ToKGYGk.exe
  2⤵
  PID:7200
- C:\Windows\System\ZryiXKY.exe
  C:\Windows\System\ZryiXKY.exe
  2⤵
  PID:6632
- C:\Windows\System\BUeUiXM.exe
  C:\Windows\System\BUeUiXM.exe
  2⤵
  PID:7496
- C:\Windows\System\dzVjjOO.exe
  C:\Windows\System\dzVjjOO.exe
  2⤵
  PID:7280
- C:\Windows\System\EEMkOGh.exe
  C:\Windows\System\EEMkOGh.exe
  2⤵
  PID:7544
- C:\Windows\System\lasepKh.exe
  C:\Windows\System\lasepKh.exe
  2⤵
  PID:7604
- C:\Windows\System\kTJkdnL.exe
  C:\Windows\System\kTJkdnL.exe
  2⤵
  PID:7572
- C:\Windows\System\rpdPsvs.exe
  C:\Windows\System\rpdPsvs.exe
  2⤵
  PID:7668
- C:\Windows\System\YBkayai.exe
  C:\Windows\System\YBkayai.exe
  2⤵
  PID:7720
- C:\Windows\System\wigKfNr.exe
  C:\Windows\System\wigKfNr.exe
  2⤵
  PID:7828
- C:\Windows\System\aRBqIwv.exe
  C:\Windows\System\aRBqIwv.exe
  2⤵
  PID:7876
- C:\Windows\System\UXvVGLP.exe
  C:\Windows\System\UXvVGLP.exe
  2⤵
  PID:8032
- C:\Windows\System\ykbGxwQ.exe
  C:\Windows\System\ykbGxwQ.exe
  2⤵
  PID:8072
- C:\Windows\System\vmwHsWz.exe
  C:\Windows\System\vmwHsWz.exe
  2⤵
  PID:8116
- C:\Windows\System\yLrMLBd.exe
  C:\Windows\System\yLrMLBd.exe
  2⤵
  PID:6844
- C:\Windows\System\DDWvCUB.exe
  C:\Windows\System\DDWvCUB.exe
  2⤵
  PID:7224
- C:\Windows\System\iomyTWc.exe
  C:\Windows\System\iomyTWc.exe
  2⤵
  PID:7264
- C:\Windows\System\CFcTsxn.exe
  C:\Windows\System\CFcTsxn.exe
  2⤵
  PID:7204
- C:\Windows\System\NZtCiXc.exe
  C:\Windows\System\NZtCiXc.exe
  2⤵
  PID:7612
- C:\Windows\System\hggLgOL.exe
  C:\Windows\System\hggLgOL.exe
  2⤵
  PID:7696
- C:\Windows\System\KzsZEGB.exe
  C:\Windows\System\KzsZEGB.exe
  2⤵
  PID:7864
- C:\Windows\System\vVAUJJR.exe
  C:\Windows\System\vVAUJJR.exe
  2⤵
  PID:8028
- C:\Windows\System\nRgcebw.exe
  C:\Windows\System\nRgcebw.exe
  2⤵
  PID:8148
- C:\Windows\System\FHwRzzo.exe
  C:\Windows\System\FHwRzzo.exe
  2⤵
  PID:7328
- C:\Windows\System\Siugged.exe
  C:\Windows\System\Siugged.exe
  2⤵
  PID:8088
- C:\Windows\System\qYTmUsO.exe
  C:\Windows\System\qYTmUsO.exe
  2⤵
  PID:7172
- C:\Windows\System\MReadnE.exe
  C:\Windows\System\MReadnE.exe
  2⤵
  PID:7968
- C:\Windows\System\WFlpfTx.exe
  C:\Windows\System\WFlpfTx.exe
  2⤵
  PID:8208
- C:\Windows\System\riJFjOu.exe
  C:\Windows\System\riJFjOu.exe
  2⤵
  PID:8232
- C:\Windows\System\uqLlHps.exe
  C:\Windows\System\uqLlHps.exe
  2⤵
  PID:8260
- C:\Windows\System\CrOmvZm.exe
  C:\Windows\System\CrOmvZm.exe
  2⤵
  PID:8280
- C:\Windows\System\bwmJujM.exe
  C:\Windows\System\bwmJujM.exe
  2⤵
  PID:8304
- C:\Windows\System\aCZQnIQ.exe
  C:\Windows\System\aCZQnIQ.exe
  2⤵
  PID:8324
- C:\Windows\System\ybMUWPM.exe
  C:\Windows\System\ybMUWPM.exe
  2⤵
  PID:8364
- C:\Windows\System\EbidjjW.exe
  C:\Windows\System\EbidjjW.exe
  2⤵
  PID:8400
- C:\Windows\System\YGnCrbR.exe
  C:\Windows\System\YGnCrbR.exe
  2⤵
  PID:8432
- C:\Windows\System\mwnPfso.exe
  C:\Windows\System\mwnPfso.exe
  2⤵
  PID:8476
- C:\Windows\System\nNwoUNW.exe
  C:\Windows\System\nNwoUNW.exe
  2⤵
  PID:8500
- C:\Windows\System\PKhvALJ.exe
  C:\Windows\System\PKhvALJ.exe
  2⤵
  PID:8536
- C:\Windows\System\NaMAjyZ.exe
  C:\Windows\System\NaMAjyZ.exe
  2⤵
  PID:8552
- C:\Windows\System\tBwnyda.exe
  C:\Windows\System\tBwnyda.exe
  2⤵
  PID:8580
- C:\Windows\System\JfCpPWl.exe
  C:\Windows\System\JfCpPWl.exe
  2⤵
  PID:8608
- C:\Windows\System\yLWEFHw.exe
  C:\Windows\System\yLWEFHw.exe
  2⤵
  PID:8632
- C:\Windows\System\uvPtxMM.exe
  C:\Windows\System\uvPtxMM.exe
  2⤵
  PID:8652
- C:\Windows\System\agyWiLE.exe
  C:\Windows\System\agyWiLE.exe
  2⤵
  PID:8676
- C:\Windows\System\RtFfizr.exe
  C:\Windows\System\RtFfizr.exe
  2⤵
  PID:8700
- C:\Windows\System\iwnVBSF.exe
  C:\Windows\System\iwnVBSF.exe
  2⤵
  PID:8720
- C:\Windows\System\cKkdqGr.exe
  C:\Windows\System\cKkdqGr.exe
  2⤵
  PID:8752
- C:\Windows\System\vIKKSHM.exe
  C:\Windows\System\vIKKSHM.exe
  2⤵
  PID:8808
- C:\Windows\System\BcuwKlO.exe
  C:\Windows\System\BcuwKlO.exe
  2⤵
  PID:8832
- C:\Windows\System\caNflaa.exe
  C:\Windows\System\caNflaa.exe
  2⤵
  PID:8864
- C:\Windows\System\CBwMuvo.exe
  C:\Windows\System\CBwMuvo.exe
  2⤵
  PID:8888
- C:\Windows\System\MAEpwAV.exe
  C:\Windows\System\MAEpwAV.exe
  2⤵
  PID:8908
- C:\Windows\System\woljBQg.exe
  C:\Windows\System\woljBQg.exe
  2⤵
  PID:8932
- C:\Windows\System\lOISJvk.exe
  C:\Windows\System\lOISJvk.exe
  2⤵
  PID:8960
- C:\Windows\System\GWbPBFR.exe
  C:\Windows\System\GWbPBFR.exe
  2⤵
  PID:8984
- C:\Windows\System\OxUsCmE.exe
  C:\Windows\System\OxUsCmE.exe
  2⤵
  PID:9008
- C:\Windows\System\MTuaaRZ.exe
  C:\Windows\System\MTuaaRZ.exe
  2⤵
  PID:9108
- C:\Windows\System\KotaUUP.exe
  C:\Windows\System\KotaUUP.exe
  2⤵
  PID:9124
- C:\Windows\System\lqQbyfN.exe
  C:\Windows\System\lqQbyfN.exe
  2⤵
  PID:9140
- C:\Windows\System\tOlAPbw.exe
  C:\Windows\System\tOlAPbw.exe
  2⤵
  PID:9164
- C:\Windows\System\PgSfOqq.exe
  C:\Windows\System\PgSfOqq.exe
  2⤵
  PID:9184
- C:\Windows\System\jUOztEy.exe
  C:\Windows\System\jUOztEy.exe
  2⤵
  PID:9204
- C:\Windows\System\bmEjUYK.exe
  C:\Windows\System\bmEjUYK.exe
  2⤵
  PID:7780
- C:\Windows\System\maLbLmu.exe
  C:\Windows\System\maLbLmu.exe
  2⤵
  PID:8272
- C:\Windows\System\YQaWemz.exe
  C:\Windows\System\YQaWemz.exe
  2⤵
  PID:8340
- C:\Windows\System\xxGoLoA.exe
  C:\Windows\System\xxGoLoA.exe
  2⤵
  PID:8316
- C:\Windows\System\wAjERav.exe
  C:\Windows\System\wAjERav.exe
  2⤵
  PID:8348
- C:\Windows\System\DdSxnPy.exe
  C:\Windows\System\DdSxnPy.exe
  2⤵
  PID:8420
- C:\Windows\System\XVjDzGY.exe
  C:\Windows\System\XVjDzGY.exe
  2⤵
  PID:8548
- C:\Windows\System\FcQTqqk.exe
  C:\Windows\System\FcQTqqk.exe
  2⤵
  PID:8620
- C:\Windows\System\UFzgZKK.exe
  C:\Windows\System\UFzgZKK.exe
  2⤵
  PID:8600
- C:\Windows\System\DtfXDaZ.exe
  C:\Windows\System\DtfXDaZ.exe
  2⤵
  PID:8784
- C:\Windows\System\sVYHRDW.exe
  C:\Windows\System\sVYHRDW.exe
  2⤵
  PID:8800
- C:\Windows\System\oyOHvxQ.exe
  C:\Windows\System\oyOHvxQ.exe
  2⤵
  PID:8844
- C:\Windows\System\JklUFJv.exe
  C:\Windows\System\JklUFJv.exe
  2⤵
  PID:8928
- C:\Windows\System\nuhojOS.exe
  C:\Windows\System\nuhojOS.exe
  2⤵
  PID:4080
- C:\Windows\System\iqUNscI.exe
  C:\Windows\System\iqUNscI.exe
  2⤵
  PID:9104
- C:\Windows\System\fYvelNk.exe
  C:\Windows\System\fYvelNk.exe
  2⤵
  PID:9136
- C:\Windows\System\qeNnIST.exe
  C:\Windows\System\qeNnIST.exe
  2⤵
  PID:9176
- C:\Windows\System\SdCWYMB.exe
  C:\Windows\System\SdCWYMB.exe
  2⤵
  PID:7416
- C:\Windows\System\gxAwdRu.exe
  C:\Windows\System\gxAwdRu.exe
  2⤵
  PID:8412
- C:\Windows\System\eKXXszT.exe
  C:\Windows\System\eKXXszT.exe
  2⤵
  PID:8464
- C:\Windows\System\nvNvonS.exe
  C:\Windows\System\nvNvonS.exe
  2⤵
  PID:8716
- C:\Windows\System\viGANoz.exe
  C:\Windows\System\viGANoz.exe
  2⤵
  PID:8824
- C:\Windows\System\xsIzTrm.exe
  C:\Windows\System\xsIzTrm.exe
  2⤵
  PID:8924
- C:\Windows\System\mhGWRbJ.exe
  C:\Windows\System\mhGWRbJ.exe
  2⤵
  PID:8948
- C:\Windows\System\MssIGJN.exe
  C:\Windows\System\MssIGJN.exe
  2⤵
  PID:9152
- C:\Windows\System\nGUuJFM.exe
  C:\Windows\System\nGUuJFM.exe
  2⤵
  PID:8216
- C:\Windows\System\aODytjV.exe
  C:\Windows\System\aODytjV.exe
  2⤵
  PID:3192
- C:\Windows\System\rtNifnz.exe
  C:\Windows\System\rtNifnz.exe
  2⤵
  PID:9016
- C:\Windows\System\mPnaHNS.exe
  C:\Windows\System\mPnaHNS.exe
  2⤵
  PID:8616
- C:\Windows\System\tnMXCvi.exe
  C:\Windows\System\tnMXCvi.exe
  2⤵
  PID:1360
- C:\Windows\System\RgFtocs.exe
  C:\Windows\System\RgFtocs.exe
  2⤵
  PID:9228
- C:\Windows\System\EGjVbmg.exe
  C:\Windows\System\EGjVbmg.exe
  2⤵
  PID:9256
- C:\Windows\System\uyCZdrt.exe
  C:\Windows\System\uyCZdrt.exe
  2⤵
  PID:9280
- C:\Windows\System\yIqpche.exe
  C:\Windows\System\yIqpche.exe
  2⤵
  PID:9308
- C:\Windows\System\wKpZIoJ.exe
  C:\Windows\System\wKpZIoJ.exe
  2⤵
  PID:9352
- C:\Windows\System\oTdhFUW.exe
  C:\Windows\System\oTdhFUW.exe
  2⤵
  PID:9384
- C:\Windows\System\pFPhZiY.exe
  C:\Windows\System\pFPhZiY.exe
  2⤵
  PID:9424
- C:\Windows\System\NLobqBM.exe
  C:\Windows\System\NLobqBM.exe
  2⤵
  PID:9448
- C:\Windows\System\OoXKsxf.exe
  C:\Windows\System\OoXKsxf.exe
  2⤵
  PID:9468
- C:\Windows\System\CDkzvnE.exe
  C:\Windows\System\CDkzvnE.exe
  2⤵
  PID:9488
- C:\Windows\System\CtBpudv.exe
  C:\Windows\System\CtBpudv.exe
  2⤵
  PID:9524
- C:\Windows\System\HXMXPQY.exe
  C:\Windows\System\HXMXPQY.exe
  2⤵
  PID:9540
- C:\Windows\System\BtVGiIL.exe
  C:\Windows\System\BtVGiIL.exe
  2⤵
  PID:9560
- C:\Windows\System\LhBqSLT.exe
  C:\Windows\System\LhBqSLT.exe
  2⤵
  PID:9584
- C:\Windows\System\AcMVOrN.exe
  C:\Windows\System\AcMVOrN.exe
  2⤵
  PID:9608
- C:\Windows\System\aeBBXjA.exe
  C:\Windows\System\aeBBXjA.exe
  2⤵
  PID:9632
- C:\Windows\System\ugMofNT.exe
  C:\Windows\System\ugMofNT.exe
  2⤵
  PID:9696
- C:\Windows\System\ibxVAFL.exe
  C:\Windows\System\ibxVAFL.exe
  2⤵
  PID:9720
- C:\Windows\System\ZiEqbKb.exe
  C:\Windows\System\ZiEqbKb.exe
  2⤵
  PID:9768
- C:\Windows\System\kNmndiu.exe
  C:\Windows\System\kNmndiu.exe
  2⤵
  PID:9784
- C:\Windows\System\dgazviT.exe
  C:\Windows\System\dgazviT.exe
  2⤵
  PID:9812
- C:\Windows\System\VyOkxmx.exe
  C:\Windows\System\VyOkxmx.exe
  2⤵
  PID:9836
- C:\Windows\System\cSKSKmS.exe
  C:\Windows\System\cSKSKmS.exe
  2⤵
  PID:9856
- C:\Windows\System\HypTKSS.exe
  C:\Windows\System\HypTKSS.exe
  2⤵
  PID:9880
- C:\Windows\System\CXxSpES.exe
  C:\Windows\System\CXxSpES.exe
  2⤵
  PID:9904
- C:\Windows\System\ZSWVCIy.exe
  C:\Windows\System\ZSWVCIy.exe
  2⤵
  PID:9944
- C:\Windows\System\thrshXe.exe
  C:\Windows\System\thrshXe.exe
  2⤵
  PID:9980
- C:\Windows\System\vIkxfvi.exe
  C:\Windows\System\vIkxfvi.exe
  2⤵
  PID:10008
- C:\Windows\System\osZSxEg.exe
  C:\Windows\System\osZSxEg.exe
  2⤵
  PID:10052
- C:\Windows\System\DNlIeqo.exe
  C:\Windows\System\DNlIeqo.exe
  2⤵
  PID:10072
- C:\Windows\System\WciMvdc.exe
  C:\Windows\System\WciMvdc.exe
  2⤵
  PID:10104
- C:\Windows\System\lkSWJey.exe
  C:\Windows\System\lkSWJey.exe
  2⤵
  PID:10128
- C:\Windows\System\ZgjSkUk.exe
  C:\Windows\System\ZgjSkUk.exe
  2⤵
  PID:10148
- C:\Windows\System\sJNNNDa.exe
  C:\Windows\System\sJNNNDa.exe
  2⤵
  PID:10196
- C:\Windows\System\chkBhfg.exe
  C:\Windows\System\chkBhfg.exe
  2⤵
  PID:10212
- C:\Windows\System\yIveWZd.exe
  C:\Windows\System\yIveWZd.exe
  2⤵
  PID:4496
- C:\Windows\System\UYjVjpd.exe
  C:\Windows\System\UYjVjpd.exe
  2⤵
  PID:9272
- C:\Windows\System\FIHsDNv.exe
  C:\Windows\System\FIHsDNv.exe
  2⤵
  PID:9364
- C:\Windows\System\kBVGgQt.exe
  C:\Windows\System\kBVGgQt.exe
  2⤵
  PID:9464
- C:\Windows\System\CnFULDb.exe
  C:\Windows\System\CnFULDb.exe
  2⤵
  PID:9500
- C:\Windows\System\onKKZvy.exe
  C:\Windows\System\onKKZvy.exe
  2⤵
  PID:9568
- C:\Windows\System\FNfrvLA.exe
  C:\Windows\System\FNfrvLA.exe
  2⤵
  PID:9580
- C:\Windows\System\ODXkxhj.exe
  C:\Windows\System\ODXkxhj.exe
  2⤵
  PID:9616
- C:\Windows\System\UFBSqcq.exe
  C:\Windows\System\UFBSqcq.exe
  2⤵
  PID:9708
- C:\Windows\System\VPhvqNo.exe
  C:\Windows\System\VPhvqNo.exe
  2⤵
  PID:9744
- C:\Windows\System\cAOijDx.exe
  C:\Windows\System\cAOijDx.exe
  2⤵
  PID:9848
- C:\Windows\System\ISuBVpx.exe
  C:\Windows\System\ISuBVpx.exe
  2⤵
  PID:9912
- C:\Windows\System\cVdojxP.exe
  C:\Windows\System\cVdojxP.exe
  2⤵
  PID:9992
- C:\Windows\System\HqkYhxb.exe
  C:\Windows\System\HqkYhxb.exe
  2⤵
  PID:10064
- C:\Windows\System\TByMZnE.exe
  C:\Windows\System\TByMZnE.exe
  2⤵
  PID:3576
- C:\Windows\System\WmpaYBp.exe
  C:\Windows\System\WmpaYBp.exe
  2⤵
  PID:10140
- C:\Windows\System\lGCodoH.exe
  C:\Windows\System\lGCodoH.exe
  2⤵
  PID:10204
- C:\Windows\System\yOFFZEN.exe
  C:\Windows\System\yOFFZEN.exe
  2⤵
  PID:9224
- C:\Windows\System\UtrUqnZ.exe
  C:\Windows\System\UtrUqnZ.exe
  2⤵
  PID:9380
- C:\Windows\System\VHInMCn.exe
  C:\Windows\System\VHInMCn.exe
  2⤵
  PID:9516
- C:\Windows\System\SHFSgug.exe
  C:\Windows\System\SHFSgug.exe
  2⤵
  PID:9556
- C:\Windows\System\FjMbFcI.exe
  C:\Windows\System\FjMbFcI.exe
  2⤵
  PID:9736
- C:\Windows\System\MpIGUWg.exe
  C:\Windows\System\MpIGUWg.exe
  2⤵
  PID:9872
- C:\Windows\System\bqPRAKp.exe
  C:\Windows\System\bqPRAKp.exe
  2⤵
  PID:10024
- C:\Windows\System\biSRKFN.exe
  C:\Windows\System\biSRKFN.exe
  2⤵
  PID:2356
- C:\Windows\System\qmQBRDh.exe
  C:\Windows\System\qmQBRDh.exe
  2⤵
  PID:4552
- C:\Windows\System\CbOlpTi.exe
  C:\Windows\System\CbOlpTi.exe
  2⤵
  PID:9420
- C:\Windows\System\pmtDPgR.exe
  C:\Windows\System\pmtDPgR.exe
  2⤵
  PID:10080
- C:\Windows\System\GaCTzYV.exe
  C:\Windows\System\GaCTzYV.exe
  2⤵
  PID:452
- C:\Windows\System\zrDySaV.exe
  C:\Windows\System\zrDySaV.exe
  2⤵
  PID:9456
- C:\Windows\System\YZpyUIK.exe
  C:\Windows\System\YZpyUIK.exe
  2⤵
  PID:10096
- C:\Windows\System\iqDXuzt.exe
  C:\Windows\System\iqDXuzt.exe
  2⤵
  PID:10252
- C:\Windows\System\EGPgaxq.exe
  C:\Windows\System\EGPgaxq.exe
  2⤵
  PID:10276
- C:\Windows\System\yPoVEKp.exe
  C:\Windows\System\yPoVEKp.exe
  2⤵
  PID:10328
- C:\Windows\System\tdRwWll.exe
  C:\Windows\System\tdRwWll.exe
  2⤵
  PID:10368
- C:\Windows\System\NYeeZEd.exe
  C:\Windows\System\NYeeZEd.exe
  2⤵
  PID:10392
- C:\Windows\System\dZxGrCJ.exe
  C:\Windows\System\dZxGrCJ.exe
  2⤵
  PID:10412
- C:\Windows\System\MqqJFgR.exe
  C:\Windows\System\MqqJFgR.exe
  2⤵
  PID:10436
- C:\Windows\System\vUmUaBo.exe
  C:\Windows\System\vUmUaBo.exe
  2⤵
  PID:10460
- C:\Windows\System\gekVEoA.exe
  C:\Windows\System\gekVEoA.exe
  2⤵
  PID:10484
- C:\Windows\System\AyoMCBD.exe
  C:\Windows\System\AyoMCBD.exe
  2⤵
  PID:10500
- C:\Windows\System\GqMCcPh.exe
  C:\Windows\System\GqMCcPh.exe
  2⤵
  PID:10524
- C:\Windows\System\ZQtuSbi.exe
  C:\Windows\System\ZQtuSbi.exe
  2⤵
  PID:10552
- C:\Windows\System\JOJapoM.exe
  C:\Windows\System\JOJapoM.exe
  2⤵
  PID:10608
- C:\Windows\System\GPGbXwf.exe
  C:\Windows\System\GPGbXwf.exe
  2⤵
  PID:10628
- C:\Windows\System\LiWxEFw.exe
  C:\Windows\System\LiWxEFw.exe
  2⤵
  PID:10660
- C:\Windows\System\xCCuIWK.exe
  C:\Windows\System\xCCuIWK.exe
  2⤵
  PID:10680
- C:\Windows\System\nPxDTrX.exe
  C:\Windows\System\nPxDTrX.exe
  2⤵
  PID:10704
- C:\Windows\System\cWmNNHZ.exe
  C:\Windows\System\cWmNNHZ.exe
  2⤵
  PID:10720
- C:\Windows\System\pbMteYD.exe
  C:\Windows\System\pbMteYD.exe
  2⤵
  PID:10740
- C:\Windows\System\zNtUEaj.exe
  C:\Windows\System\zNtUEaj.exe
  2⤵
  PID:10816
- C:\Windows\System\ZYbpeQx.exe
  C:\Windows\System\ZYbpeQx.exe
  2⤵
  PID:10836
- C:\Windows\System\FardHcz.exe
  C:\Windows\System\FardHcz.exe
  2⤵
  PID:10888
- C:\Windows\System\QepKaip.exe
  C:\Windows\System\QepKaip.exe
  2⤵
  PID:10936
- C:\Windows\System\juQpDMN.exe
  C:\Windows\System\juQpDMN.exe
  2⤵
  PID:10956
- C:\Windows\System\QrQhEIi.exe
  C:\Windows\System\QrQhEIi.exe
  2⤵
  PID:11020
- C:\Windows\System\TGsulHJ.exe
  C:\Windows\System\TGsulHJ.exe
  2⤵
  PID:11040
- C:\Windows\System\QQRgqIL.exe
  C:\Windows\System\QQRgqIL.exe
  2⤵
  PID:11072
- C:\Windows\System\dYyYbgp.exe
  C:\Windows\System\dYyYbgp.exe
  2⤵
  PID:11108
- C:\Windows\System\PfgXOSj.exe
  C:\Windows\System\PfgXOSj.exe
  2⤵
  PID:11136
- C:\Windows\System\BIsEuVL.exe
  C:\Windows\System\BIsEuVL.exe
  2⤵
  PID:11156
- C:\Windows\System\CRXiCVo.exe
  C:\Windows\System\CRXiCVo.exe
  2⤵
  PID:11192
- C:\Windows\System\oGFIiVw.exe
  C:\Windows\System\oGFIiVw.exe
  2⤵
  PID:11208
- C:\Windows\System\zGbpCNy.exe
  C:\Windows\System\zGbpCNy.exe
  2⤵
  PID:11236
- C:\Windows\System\KmMZept.exe
  C:\Windows\System\KmMZept.exe
  2⤵
  PID:9964
- C:\Windows\System\dLurDFA.exe
  C:\Windows\System\dLurDFA.exe
  2⤵
  PID:10260
- C:\Windows\System\mdvztSG.exe
  C:\Windows\System\mdvztSG.exe
  2⤵
  PID:10428
- C:\Windows\System\EaLVMtR.exe
  C:\Windows\System\EaLVMtR.exe
  2⤵
  PID:10476
- C:\Windows\System\SwlzGUP.exe
  C:\Windows\System\SwlzGUP.exe
  2⤵
  PID:10544
- C:\Windows\System\HRlRbLw.exe
  C:\Windows\System\HRlRbLw.exe
  2⤵
  PID:10572
- C:\Windows\System\nHdtdKZ.exe
  C:\Windows\System\nHdtdKZ.exe
  2⤵
  PID:10644
- C:\Windows\System\RbgAIPo.exe
  C:\Windows\System\RbgAIPo.exe
  2⤵
  PID:10668
- C:\Windows\System\ppmeAMQ.exe
  C:\Windows\System\ppmeAMQ.exe
  2⤵
  PID:10728
- C:\Windows\System\WSnTJUa.exe
  C:\Windows\System\WSnTJUa.exe
  2⤵
  PID:10764
- C:\Windows\System\QVmInZW.exe
  C:\Windows\System\QVmInZW.exe
  2⤵
  PID:10828
- C:\Windows\System\OXqiRjQ.exe
  C:\Windows\System\OXqiRjQ.exe
  2⤵
  PID:10812
- C:\Windows\System\TLPMqtI.exe
  C:\Windows\System\TLPMqtI.exe
  2⤵
  PID:10864
- C:\Windows\System\GXcYTIv.exe
  C:\Windows\System\GXcYTIv.exe
  2⤵
  PID:10912
- C:\Windows\System\dGtPtru.exe
  C:\Windows\System\dGtPtru.exe
  2⤵
  PID:10996
- C:\Windows\System\ilnpDjP.exe
  C:\Windows\System\ilnpDjP.exe
  2⤵
  PID:11152
- C:\Windows\System\GjRfnOH.exe
  C:\Windows\System\GjRfnOH.exe
  2⤵
  PID:11224
- C:\Windows\System\QmrcLAv.exe
  C:\Windows\System\QmrcLAv.exe
  2⤵
  PID:10188
- C:\Windows\System\iHpbujz.exe
  C:\Windows\System\iHpbujz.exe
  2⤵
  PID:10364
- C:\Windows\System\NukNprp.exe
  C:\Windows\System\NukNprp.exe
  2⤵
  PID:10520
- C:\Windows\System\Vizoiwd.exe
  C:\Windows\System\Vizoiwd.exe
  2⤵
  PID:10624
- C:\Windows\System\vXIooLp.exe
  C:\Windows\System\vXIooLp.exe
  2⤵
  PID:10884
- C:\Windows\System\QdNHcPl.exe
  C:\Windows\System\QdNHcPl.exe
  2⤵
  PID:10872
- C:\Windows\System\izixhMV.exe
  C:\Windows\System\izixhMV.exe
  2⤵
  PID:10984
- C:\Windows\System\eHPxEkb.exe
  C:\Windows\System\eHPxEkb.exe
  2⤵
  PID:10360
- C:\Windows\System\iEbHcag.exe
  C:\Windows\System\iEbHcag.exe
  2⤵
  PID:10580
- C:\Windows\System\GXUPVHx.exe
  C:\Windows\System\GXUPVHx.exe
  2⤵
  PID:10712
- C:\Windows\System\bYvaXWy.exe
  C:\Windows\System\bYvaXWy.exe
  2⤵
  PID:10860
- C:\Windows\System\RTRDvVg.exe
  C:\Windows\System\RTRDvVg.exe
  2⤵
  PID:11176
- C:\Windows\System\PBBsFxr.exe
  C:\Windows\System\PBBsFxr.exe
  2⤵
  PID:11272
- C:\Windows\System\vIZghlz.exe
  C:\Windows\System\vIZghlz.exe
  2⤵
  PID:11288
- C:\Windows\System\eQOpxMM.exe
  C:\Windows\System\eQOpxMM.exe
  2⤵
  PID:11312
- C:\Windows\System\VozUwPL.exe
  C:\Windows\System\VozUwPL.exe
  2⤵
  PID:11340
- C:\Windows\System\tScVonF.exe
  C:\Windows\System\tScVonF.exe
  2⤵
  PID:11360
- C:\Windows\System\WprnGXr.exe
  C:\Windows\System\WprnGXr.exe
  2⤵
  PID:11404
- C:\Windows\System\swiwdYo.exe
  C:\Windows\System\swiwdYo.exe
  2⤵
  PID:11428
- C:\Windows\System\FRNNTOQ.exe
  C:\Windows\System\FRNNTOQ.exe
  2⤵
  PID:11444
- C:\Windows\System\YMgmSgB.exe
  C:\Windows\System\YMgmSgB.exe
  2⤵
  PID:11468
- C:\Windows\System\mSoqKtu.exe
  C:\Windows\System\mSoqKtu.exe
  2⤵
  PID:11488
- C:\Windows\System\ztEEUPd.exe
  C:\Windows\System\ztEEUPd.exe
  2⤵
  PID:11516
- C:\Windows\System\PkLjpIo.exe
  C:\Windows\System\PkLjpIo.exe
  2⤵
  PID:11576
- C:\Windows\System\UQyZsVD.exe
  C:\Windows\System\UQyZsVD.exe
  2⤵
  PID:11600
- C:\Windows\System\DyeulrJ.exe
  C:\Windows\System\DyeulrJ.exe
  2⤵
  PID:11628
- C:\Windows\System\MjpUPng.exe
  C:\Windows\System\MjpUPng.exe
  2⤵
  PID:11660
- C:\Windows\System\WqskRme.exe
  C:\Windows\System\WqskRme.exe
  2⤵
  PID:11680
- C:\Windows\System\ulDESHU.exe
  C:\Windows\System\ulDESHU.exe
  2⤵
  PID:11704
- C:\Windows\System\rBPIoWT.exe
  C:\Windows\System\rBPIoWT.exe
  2⤵
  PID:11740
- C:\Windows\System\SffHtTG.exe
  C:\Windows\System\SffHtTG.exe
  2⤵
  PID:11768
- C:\Windows\System\CfhVJLq.exe
  C:\Windows\System\CfhVJLq.exe
  2⤵
  PID:11796
- C:\Windows\System\WXLmUuL.exe
  C:\Windows\System\WXLmUuL.exe
  2⤵
  PID:11820
- C:\Windows\System\KxuPFSo.exe
  C:\Windows\System\KxuPFSo.exe
  2⤵
  PID:11868
- C:\Windows\System\UBpJftW.exe
  C:\Windows\System\UBpJftW.exe
  2⤵
  PID:11884
- C:\Windows\System\NFbiWps.exe
  C:\Windows\System\NFbiWps.exe
  2⤵
  PID:11904
- C:\Windows\System\QqwoTuS.exe
  C:\Windows\System\QqwoTuS.exe
  2⤵
  PID:11932
- C:\Windows\System\BvpHSan.exe
  C:\Windows\System\BvpHSan.exe
  2⤵
  PID:11964
- C:\Windows\System\gWyxeWZ.exe
  C:\Windows\System\gWyxeWZ.exe
  2⤵
  PID:11996
- C:\Windows\System\FoDhbgP.exe
  C:\Windows\System\FoDhbgP.exe
  2⤵
  PID:12016
- C:\Windows\System\ghbyqba.exe
  C:\Windows\System\ghbyqba.exe
  2⤵
  PID:12056
- C:\Windows\System\bRpMLSp.exe
  C:\Windows\System\bRpMLSp.exe
  2⤵
  PID:12088
- C:\Windows\System\qKKqNoB.exe
  C:\Windows\System\qKKqNoB.exe
  2⤵
  PID:12116
- C:\Windows\System\mDYOhsQ.exe
  C:\Windows\System\mDYOhsQ.exe
  2⤵
  PID:12136
- C:\Windows\System\FpyeRja.exe
  C:\Windows\System\FpyeRja.exe
  2⤵
  PID:12168
- C:\Windows\System\qXvYgVP.exe
  C:\Windows\System\qXvYgVP.exe
  2⤵
  PID:12204
- C:\Windows\System\phvtoUL.exe
  C:\Windows\System\phvtoUL.exe
  2⤵
  PID:12228
- C:\Windows\System\EYMWbQo.exe
  C:\Windows\System\EYMWbQo.exe
  2⤵
  PID:12244
- C:\Windows\System\SbrMilS.exe
  C:\Windows\System\SbrMilS.exe
  2⤵
  PID:2044
- C:\Windows\System\QUrseHt.exe
  C:\Windows\System\QUrseHt.exe
  2⤵
  PID:10736
- C:\Windows\System\KwkasAv.exe
  C:\Windows\System\KwkasAv.exe
  2⤵
  PID:11328
- C:\Windows\System\vvcwDpS.exe
  C:\Windows\System\vvcwDpS.exe
  2⤵
  PID:11412
- C:\Windows\System\InfivMB.exe
  C:\Windows\System\InfivMB.exe
  2⤵
  PID:11508
- C:\Windows\System\QMzornQ.exe
  C:\Windows\System\QMzornQ.exe
  2⤵
  PID:11484
- C:\Windows\System\sVvaSad.exe
  C:\Windows\System\sVvaSad.exe
  2⤵
  PID:11588
- C:\Windows\System\DuzPoKg.exe
  C:\Windows\System\DuzPoKg.exe
  2⤵
  PID:11624
- C:\Windows\System\MwYxSbc.exe
  C:\Windows\System\MwYxSbc.exe
  2⤵
  PID:11700
- C:\Windows\System\cfpBpjC.exe
  C:\Windows\System\cfpBpjC.exe
  2⤵
  PID:11844
- C:\Windows\System\HhLdfDN.exe
  C:\Windows\System\HhLdfDN.exe
  2⤵
  PID:11892
- C:\Windows\System\RrmfoIx.exe
  C:\Windows\System\RrmfoIx.exe
  2⤵
  PID:11956
- C:\Windows\System\VcElJuh.exe
  C:\Windows\System\VcElJuh.exe
  2⤵
  PID:11988
- C:\Windows\System\KnogGSC.exe
  C:\Windows\System\KnogGSC.exe
  2⤵
  PID:12080
- C:\Windows\System\XVaehyw.exe
  C:\Windows\System\XVaehyw.exe
  2⤵
  PID:12132
- C:\Windows\System\qYkzCOJ.exe
  C:\Windows\System\qYkzCOJ.exe
  2⤵
  PID:12180
- C:\Windows\System\TXEntch.exe
  C:\Windows\System\TXEntch.exe
  2⤵
  PID:12276
- C:\Windows\System\lnMmtEo.exe
  C:\Windows\System\lnMmtEo.exe
  2⤵
  PID:11268
- C:\Windows\System\kRuXeKF.exe
  C:\Windows\System\kRuXeKF.exe
  2⤵
  PID:11424
- C:\Windows\System\JDlIXFp.exe
  C:\Windows\System\JDlIXFp.exe
  2⤵
  PID:11696
- C:\Windows\System\xOvKDBD.exe
  C:\Windows\System\xOvKDBD.exe
  2⤵
  PID:11836
- C:\Windows\System\eCetdpz.exe
  C:\Windows\System\eCetdpz.exe
  2⤵
  PID:11928
- C:\Windows\System\TpUcQCY.exe
  C:\Windows\System\TpUcQCY.exe
  2⤵
  PID:12096
- C:\Windows\System\fTkzLpz.exe
  C:\Windows\System\fTkzLpz.exe
  2⤵
  PID:12236
- C:\Windows\System\nNMdtGO.exe
  C:\Windows\System\nNMdtGO.exe
  2⤵
  PID:11380
- C:\Windows\System\TenQUzv.exe
  C:\Windows\System\TenQUzv.exe
  2⤵
  PID:11736
- C:\Windows\System\LvYCldo.exe
  C:\Windows\System\LvYCldo.exe
  2⤵
  PID:11900
- C:\Windows\System\EnpxBqf.exe
  C:\Windows\System\EnpxBqf.exe
  2⤵
  PID:11776
- C:\Windows\System\GESYErM.exe
  C:\Windows\System\GESYErM.exe
  2⤵
  PID:12312
- C:\Windows\System\xMaqfwp.exe
  C:\Windows\System\xMaqfwp.exe
  2⤵
  PID:12336
- C:\Windows\System\nEzKztr.exe
  C:\Windows\System\nEzKztr.exe
  2⤵
  PID:12356
- C:\Windows\System\kSGqTKy.exe
  C:\Windows\System\kSGqTKy.exe
  2⤵
  PID:12388
- C:\Windows\System\QQhXydx.exe
  C:\Windows\System\QQhXydx.exe
  2⤵
  PID:12440
- C:\Windows\System\IkfAdsS.exe
  C:\Windows\System\IkfAdsS.exe
  2⤵
  PID:12460
- C:\Windows\System\VjQblpI.exe
  C:\Windows\System\VjQblpI.exe
  2⤵
  PID:12476
- C:\Windows\System\iqiuWfM.exe
  C:\Windows\System\iqiuWfM.exe
  2⤵
  PID:12500
- C:\Windows\System\DvmXTva.exe
  C:\Windows\System\DvmXTva.exe
  2⤵
  PID:12524
- C:\Windows\System\VvmBLgy.exe
  C:\Windows\System\VvmBLgy.exe
  2⤵
  PID:12548
- C:\Windows\System\mDqCHmd.exe
  C:\Windows\System\mDqCHmd.exe
  2⤵
  PID:12608
- C:\Windows\System\dbaiNKK.exe
  C:\Windows\System\dbaiNKK.exe
  2⤵
  PID:12628
- C:\Windows\System\qVNHjwF.exe
  C:\Windows\System\qVNHjwF.exe
  2⤵
  PID:12656
- C:\Windows\System\maFBTfP.exe
  C:\Windows\System\maFBTfP.exe
  2⤵
  PID:12672
- C:\Windows\System\ydyUToV.exe
  C:\Windows\System\ydyUToV.exe
  2⤵
  PID:12696
- C:\Windows\System\kOwJWfh.exe
  C:\Windows\System\kOwJWfh.exe
  2⤵
  PID:12724
- C:\Windows\System\jflfYfw.exe
  C:\Windows\System\jflfYfw.exe
  2⤵
  PID:12744
- C:\Windows\System\zYjTBfN.exe
  C:\Windows\System\zYjTBfN.exe
  2⤵
  PID:12800
- C:\Windows\System\VpTKmIR.exe
  C:\Windows\System\VpTKmIR.exe
  2⤵
  PID:12824
- C:\Windows\System\glzxCIg.exe
  C:\Windows\System\glzxCIg.exe
  2⤵
  PID:12840
- C:\Windows\System\gCILhvb.exe
  C:\Windows\System\gCILhvb.exe
  2⤵
  PID:12864
- C:\Windows\System\JUkRNbK.exe
  C:\Windows\System\JUkRNbK.exe
  2⤵
  PID:12884
- C:\Windows\System\KPFSBfN.exe
  C:\Windows\System\KPFSBfN.exe
  2⤵
  PID:12948
- C:\Windows\System\xdpSNkd.exe
  C:\Windows\System\xdpSNkd.exe
  2⤵
  PID:12972
- C:\Windows\System\KZjyFYJ.exe
  C:\Windows\System\KZjyFYJ.exe
  2⤵
  PID:12992
- C:\Windows\System\RjZxRqJ.exe
  C:\Windows\System\RjZxRqJ.exe
  2⤵
  PID:13016
- C:\Windows\System\pQKorwh.exe
  C:\Windows\System\pQKorwh.exe
  2⤵
  PID:13036
- C:\Windows\System\hDmdCAJ.exe
  C:\Windows\System\hDmdCAJ.exe
  2⤵
  PID:13060
- C:\Windows\System\iYDzhvk.exe
  C:\Windows\System\iYDzhvk.exe
  2⤵
  PID:13096
- C:\Windows\System\mlabpQx.exe
  C:\Windows\System\mlabpQx.exe
  2⤵
  PID:13128
- C:\Windows\System\vdybols.exe
  C:\Windows\System\vdybols.exe
  2⤵
  PID:13148
- C:\Windows\System\LnxyHjp.exe
  C:\Windows\System\LnxyHjp.exe
  2⤵
  PID:13172
- C:\Windows\System\ACZEdUt.exe
  C:\Windows\System\ACZEdUt.exe
  2⤵
  PID:13192
- C:\Windows\System\rlGaubw.exe
  C:\Windows\System\rlGaubw.exe
  2⤵
  PID:13228
- C:\Windows\System\RqEfWbg.exe
  C:\Windows\System\RqEfWbg.exe
  2⤵
  PID:13244
- C:\Windows\System\hCvAYBQ.exe
  C:\Windows\System\hCvAYBQ.exe
  2⤵
  PID:13288
- C:\Windows\System\nNmoPxT.exe
  C:\Windows\System\nNmoPxT.exe
  2⤵
  PID:12268
- C:\Windows\System\CFehutj.exe
  C:\Windows\System\CFehutj.exe
  2⤵
  PID:12348
- C:\Windows\System\GeMjNEa.exe
  C:\Windows\System\GeMjNEa.exe
  2⤵
  PID:12448
- C:\Windows\System\oYEJXeK.exe
  C:\Windows\System\oYEJXeK.exe
  2⤵
  PID:12496
- C:\Windows\System\tmtsbcf.exe
  C:\Windows\System\tmtsbcf.exe
  2⤵
  PID:12588
- C:\Windows\System\cOVnOTk.exe
  C:\Windows\System\cOVnOTk.exe
  2⤵
  PID:12616
- C:\Windows\System\newkKRp.exe
  C:\Windows\System\newkKRp.exe
  2⤵
  PID:12688
- C:\Windows\System\RyYlsnZ.exe
  C:\Windows\System\RyYlsnZ.exe
  2⤵
  PID:12732
- C:\Windows\System\TIuXSFZ.exe
  C:\Windows\System\TIuXSFZ.exe
  2⤵
  PID:12812
- C:\Windows\System\xQtOehG.exe
  C:\Windows\System\xQtOehG.exe
  2⤵
  PID:12912
- C:\Windows\System\OjSFMeg.exe
  C:\Windows\System\OjSFMeg.exe
  2⤵
  PID:12964
- C:\Windows\System\hlTZIvm.exe
  C:\Windows\System\hlTZIvm.exe
  2⤵
  PID:12988
- C:\Windows\System\eMrDEFF.exe
  C:\Windows\System\eMrDEFF.exe
  2⤵
  PID:13008
- C:\Windows\System\OxaKHab.exe
  C:\Windows\System\OxaKHab.exe
  2⤵
  PID:13084
- C:\Windows\System\IUjeJtZ.exe
  C:\Windows\System\IUjeJtZ.exe
  2⤵
  PID:13164
- C:\Windows\System\wFbEFsE.exe
  C:\Windows\System\wFbEFsE.exe
  2⤵
  PID:13212
- C:\Windows\System\TrpRVcS.exe
  C:\Windows\System\TrpRVcS.exe
  2⤵
  PID:13240
- C:\Windows\System\xNprGop.exe
  C:\Windows\System\xNprGop.exe
  2⤵
  PID:13304
- C:\Windows\System\JxJbYTy.exe
  C:\Windows\System\JxJbYTy.exe
  2⤵
  PID:12400
- C:\Windows\System\hnNQLge.exe
  C:\Windows\System\hnNQLge.exe
  2⤵
  PID:12516
- C:\Windows\System\xaOJDwy.exe
  C:\Windows\System\xaOJDwy.exe
  2⤵
  PID:12796
- C:\Windows\System\QDaQSam.exe
  C:\Windows\System\QDaQSam.exe
  2⤵
  PID:13028
- C:\Windows\System\LCTDqhX.exe
  C:\Windows\System\LCTDqhX.exe
  2⤵
  PID:13136
- C:\Windows\System\HUZxeYB.exe
  C:\Windows\System\HUZxeYB.exe
  2⤵
  PID:13236
- C:\Windows\System\tTyVNus.exe
  C:\Windows\System\tTyVNus.exe
  2⤵
  PID:12472
- C:\Windows\System\AilIlLE.exe
  C:\Windows\System\AilIlLE.exe
  2⤵
  PID:12832
- C:\Windows\System\eGtMjzQ.exe
  C:\Windows\System\eGtMjzQ.exe
  2⤵
  PID:12376
- C:\Windows\System\cwrniPe.exe
  C:\Windows\System\cwrniPe.exe
  2⤵
  PID:13336
- C:\Windows\System\njrEUbu.exe
  C:\Windows\System\njrEUbu.exe
  2⤵
  PID:13364
- C:\Windows\System\xreuOhM.exe
  C:\Windows\System\xreuOhM.exe
  2⤵
  PID:13384
- C:\Windows\System\djmvkyW.exe
  C:\Windows\System\djmvkyW.exe
  2⤵
  PID:13424
- C:\Windows\System\OUCAmgb.exe
  C:\Windows\System\OUCAmgb.exe
  2⤵
  PID:13476
- C:\Windows\System\wPIteXB.exe
  C:\Windows\System\wPIteXB.exe
  2⤵
  PID:13504
- C:\Windows\System\jcYFeiY.exe
  C:\Windows\System\jcYFeiY.exe
  2⤵
  PID:13524
- C:\Windows\System\lzvXaZq.exe
  C:\Windows\System\lzvXaZq.exe
  2⤵
  PID:13544
- C:\Windows\System\oeVCPxH.exe
  C:\Windows\System\oeVCPxH.exe
  2⤵
  PID:13588
- C:\Windows\System\NdgFxYl.exe
  C:\Windows\System\NdgFxYl.exe
  2⤵
  PID:13608
- C:\Windows\System\uBoawUv.exe
  C:\Windows\System\uBoawUv.exe
  2⤵
  PID:13644
- C:\Windows\System\qiREUhV.exe
  C:\Windows\System\qiREUhV.exe
  2⤵
  PID:13668
- C:\Windows\System\exxnhdP.exe
  C:\Windows\System\exxnhdP.exe
  2⤵
  PID:13688
- C:\Windows\System\RoathLS.exe
  C:\Windows\System\RoathLS.exe
  2⤵
  PID:13712
- C:\Windows\System\aTSgnLM.exe
  C:\Windows\System\aTSgnLM.exe
  2⤵
  PID:13748
- C:\Windows\System\HbpUfbt.exe
  C:\Windows\System\HbpUfbt.exe
  2⤵
  PID:13776
- C:\Windows\System\dhWUCAT.exe
  C:\Windows\System\dhWUCAT.exe
  2⤵
  PID:13800
- C:\Windows\System\DyOELuP.exe
  C:\Windows\System\DyOELuP.exe
  2⤵
  PID:13820
- C:\Windows\System\esInvzR.exe
  C:\Windows\System\esInvzR.exe
  2⤵
  PID:13848
- C:\Windows\System\dAREddU.exe
  C:\Windows\System\dAREddU.exe
  2⤵
  PID:13872
- C:\Windows\System\fquPMHo.exe
  C:\Windows\System\fquPMHo.exe
  2⤵
  PID:13892
- C:\Windows\System\ufnmAyy.exe
  C:\Windows\System\ufnmAyy.exe
  2⤵
  PID:13912
- C:\Windows\System\dFICEHq.exe
  C:\Windows\System\dFICEHq.exe
  2⤵
  PID:14024
- C:\Windows\System\DZqxPfJ.exe
  C:\Windows\System\DZqxPfJ.exe
  2⤵
  PID:14040
- C:\Windows\System\SEkhtyF.exe
  C:\Windows\System\SEkhtyF.exe
  2⤵
  PID:14056
- C:\Windows\System\IJOGXsa.exe
  C:\Windows\System\IJOGXsa.exe
  2⤵
  PID:14072
- C:\Windows\System\fIOZoAW.exe
  C:\Windows\System\fIOZoAW.exe
  2⤵
  PID:14088
- C:\Windows\System\OogWarg.exe
  C:\Windows\System\OogWarg.exe
  2⤵
  PID:14104
- C:\Windows\System\NWtiKKe.exe
  C:\Windows\System\NWtiKKe.exe
  2⤵
  PID:14132
- C:\Windows\System\UZcPaTm.exe
  C:\Windows\System\UZcPaTm.exe
  2⤵
  PID:14152
- C:\Windows\System\eiMJqTd.exe
  C:\Windows\System\eiMJqTd.exe
  2⤵
  PID:14168
- C:\Windows\System\DgnNssV.exe
  C:\Windows\System\DgnNssV.exe
  2⤵
  PID:14196
- C:\Windows\System\RJIJbfl.exe
  C:\Windows\System\RJIJbfl.exe
  2⤵
  PID:14212
- C:\Windows\System\lnAzljS.exe
  C:\Windows\System\lnAzljS.exe
  2⤵
  PID:14232
- C:\Windows\System\Dmkwlzm.exe
  C:\Windows\System\Dmkwlzm.exe
  2⤵
  PID:14252
- C:\Windows\System\JxvVaGh.exe
  C:\Windows\System\JxvVaGh.exe
  2⤵
  PID:14276
- C:\Windows\System\QlGTCUB.exe
  C:\Windows\System\QlGTCUB.exe
  2⤵
  PID:14292
- C:\Windows\System\CCivnZl.exe
  C:\Windows\System\CCivnZl.exe
  2⤵
  PID:14328
- C:\Windows\System\ydupMao.exe
  C:\Windows\System\ydupMao.exe
  2⤵
  PID:12624
- C:\Windows\System\iXVaWzi.exe
  C:\Windows\System\iXVaWzi.exe
  2⤵
  PID:13408
- C:\Windows\System\KPVZhPo.exe
  C:\Windows\System\KPVZhPo.exe
  2⤵
  PID:13756
- C:\Windows\System\UZPHHyr.exe
  C:\Windows\System\UZPHHyr.exe
  2⤵
  PID:13784
- C:\Windows\System\uwyMqQi.exe
  C:\Windows\System\uwyMqQi.exe
  2⤵
  PID:13856
- C:\Windows\System\IoiNlhp.exe
  C:\Windows\System\IoiNlhp.exe
  2⤵
  PID:14140
- C:\Windows\System\szJswJQ.exe
  C:\Windows\System\szJswJQ.exe
  2⤵
  PID:13928
- C:\Windows\System\qGpohAq.exe
  C:\Windows\System\qGpohAq.exe
  2⤵
  PID:13956
- C:\Windows\System\TfuuhYx.exe
  C:\Windows\System\TfuuhYx.exe
  2⤵
  PID:14020
- C:\Windows\System\MtWuvqE.exe
  C:\Windows\System\MtWuvqE.exe
  2⤵
  PID:14052
- C:\Windows\System\ZNJSXzi.exe
  C:\Windows\System\ZNJSXzi.exe
  2⤵
  PID:14096
- C:\Windows\System\FJpLnmu.exe
  C:\Windows\System\FJpLnmu.exe
  2⤵
  PID:14248
- C:\Windows\System\YWUwJxG.exe
  C:\Windows\System\YWUwJxG.exe
  2⤵
  PID:12468
- C:\Windows\System\qVeGYAy.exe
  C:\Windows\System\qVeGYAy.exe
  2⤵
  PID:13328
- C:\Windows\System\RbRGtVx.exe
  C:\Windows\System\RbRGtVx.exe
  2⤵
  PID:13512
- C:\Windows\System\sZVCvEc.exe
  C:\Windows\System\sZVCvEc.exe
  2⤵
  PID:13320
- C:\Windows\System\htfoylq.exe
  C:\Windows\System\htfoylq.exe
  2⤵
  PID:13720
- C:\Windows\System\llvcTPR.exe
  C:\Windows\System\llvcTPR.exe
  2⤵
  PID:13812
- C:\Windows\System\iMnXRip.exe
  C:\Windows\System\iMnXRip.exe
  2⤵
  PID:13964
- C:\Windows\System\XuwZANz.exe
  C:\Windows\System\XuwZANz.exe
  2⤵
  PID:14204
- C:\Windows\System\oYvoUBU.exe
  C:\Windows\System\oYvoUBU.exe
  2⤵
  PID:14288
- C:\Windows\System\tlLdKPS.exe
  C:\Windows\System\tlLdKPS.exe
  2⤵
  PID:13492
- C:\Windows\System\OcVpKJg.exe
  C:\Windows\System\OcVpKJg.exe
  2⤵
  PID:13924
- C:\Windows\System\LIydDiW.exe
  C:\Windows\System\LIydDiW.exe
  2⤵
  PID:14312
- C:\Windows\System\CdEkJUW.exe
  C:\Windows\System\CdEkJUW.exe
  2⤵
  PID:12716
- C:\Windows\System\bJhGBHm.exe
  C:\Windows\System\bJhGBHm.exe
  2⤵
  PID:14352
- C:\Windows\System\wsTYqZY.exe
  C:\Windows\System\wsTYqZY.exe
  2⤵
  PID:14380
- C:\Windows\System\MqkeYdm.exe
  C:\Windows\System\MqkeYdm.exe
  2⤵
  PID:14400
- C:\Windows\System\QrOvhAm.exe
  C:\Windows\System\QrOvhAm.exe
  2⤵
  PID:14424
- C:\Windows\System\ATOWELQ.exe
  C:\Windows\System\ATOWELQ.exe
  2⤵
  PID:14444
- C:\Windows\System\jHdLLwR.exe
  C:\Windows\System\jHdLLwR.exe
  2⤵
  PID:14468
- C:\Windows\System\idWmTST.exe
  C:\Windows\System\idWmTST.exe
  2⤵
  PID:14568
- C:\Windows\System\InTFdkT.exe
  C:\Windows\System\InTFdkT.exe
  2⤵
  PID:14584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Babfebt.exe

Path C:\Windows\System\Babfebt.exe
Size 1.9MB
SHA256 5708a1ba0989d7c50d6beda226333f3a1d5cdc087df8ef058d9bda3219bea068
MD5 5374cc84b107c9305dd6d5f060621d71
SHA1 9baa575eb3e0ccfe294c1c25e37e3cbfb190319e
SHA512 36821b08a6bbd6673736a4a4650b6e857d3c0655c79726b4504862ba158807e886130312789a6cea06608902b55ea9fb657ab91af878b01d5945d5266ebd3c9f
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXH:RWWBib356utgpPFoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

FbvWcBw.exe

Path C:\Windows\System\FbvWcBw.exe
Size 1.9MB
SHA256 a17ff8ce0e83d5eae5215b67e43d69ad6e353a7ff131895f093a0f62740c3bc2
MD5 676d0f9eeb1418d588487b0448a625a0
SHA1 942cbdd341ec4462f9f632790e2710b49b7ef7d9
SHA512 bc9a8e56dd6b5057d9ef7659aa5610f25ad9668dba48aa2a119d1a5377cd8194f3546cde9101168910dcb3f77da2eab63989cdf827c0c1d62946f0d3a7b1742b
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXB:RWWBib356utgpPFox
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfosDuu.exe

Path C:\Windows\System\FfosDuu.exe
Size 1.9MB
SHA256 0e126a20c142d55aed14d150fc4a6b8b0d7fed55e17a395b44ccb85a14c7cd25
MD5 8a62d9ebf1a5b016e36bc1e17d017fa2
SHA1 8e6237d479b301aff607ae795c51ee923bc94f80
SHA512 88d6cdea44c15b59f32021a0d84b927702255eb88117e78c745a93656c20e61534f7561682efd965ff9da6a14466bc31affadfe63fc22ae2a5a0ddd80e91ab6c
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX3:RWWBib356utgpPFoH
MD5 SHA1 SHA512 SSDEEP

Submit Download

GhLFVWS.exe

Path C:\Windows\System\GhLFVWS.exe
Size 1.9MB
SHA256 4dcba14aef1b1310a2246b8cf4334c12a6d33574968c3e44408c407c034f0762
MD5 ad660ad7f453568e354e16c04425cf93
SHA1 0c1a39c028d64525714014a2f8772373e0d17078
SHA512 3d9deccf161866c5cde0ab0f50e52079b475fd76282c59842f6173733c383676f0e3f94355fcb818577a5649364b324816e3c4fa2242121eab16c95bf2faaa9d
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX3:RWWBib356utgpPFon
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMHujhP.exe

Path C:\Windows\System\HMHujhP.exe
Size 1.9MB
SHA256 6c2863a7f82b44537a1a3ce80275d330c8808063291463c1efb7cd7edc71af71
MD5 d8946c3273f91f7a132af57e10348297
SHA1 b09be96f4072a78cb841f65d28c610a010652026
SHA512 fecd54eb038c13964193deec9d83daf066aea513e48e13049dbc2707943ad27ae89014d4c01fbbb938bae5e11711778d023c32c19c98b2699024cd8e0b8abc90
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXX:RWWBib356utgpPFoH
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyUSSQn.exe

Path C:\Windows\System\HyUSSQn.exe
Size 1.9MB
SHA256 d77d383764ba1c3a66adabcc3cb8f3dadb84c79bf2013e2bcb2b200cdb06d6f9
MD5 8414116d44338a4cefa191c2a7226a70
SHA1 9a01ea48c3fc31c481aa10e0845b427c8bba6473
SHA512 61d5f25b9558e69b3b2652382547ebc710323960980b5a4b56e8afb6f6125db568d330f06aa2429299aeb2d42e0fd0e9ac256b9ca3266e93c925693c066cb801
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXP:RWWBib356utgpPFof
MD5 SHA1 SHA512 SSDEEP

Submit Download

IQNjSZG.exe

Path C:\Windows\System\IQNjSZG.exe
Size 1.9MB
SHA256 5c3e1a6de5fbaed1f5abe19eaaef7d4145863caf7c305031abf668e4b5ff6d41
MD5 10b11c151271c2792df513a7ca5fcc63
SHA1 c03962d74c9439f732c5596e63f7b22a1e5e373a
SHA512 ddfd460613948136d2db0c3926e2f3759da3e5a1645d6f84a0cec1b83dffda1c5d2ee2b3b50a9fd9afb9b25fbefb1eb06f3261f413114089aa32a9dc5309f693
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXu:RWWBib356utgpPFo+
MD5 SHA1 SHA512 SSDEEP

Submit Download

KgjbnKW.exe

Path C:\Windows\System\KgjbnKW.exe
Size 1.9MB
SHA256 bf52c4ed1db00cef208e30e467ed4ba007cfebb12c7aba8cc9ef8fa190d2f716
MD5 ed1f06e97bc3f7e4d3263bd085e0cb68
SHA1 0f77a533896ccf0de0fbd768f89919378ccb3f62
SHA512 25e20f598b50ac0b72c465776453aee666f6f1eaa5c310dc23c3b9ad869ddc6988024c12c4489530ff42d2315da5a66d0756c184c3e0d0065a5de2d747ae1dc0
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXy:RWWBib356utgpPFoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LCiegaw.exe

Path C:\Windows\System\LCiegaw.exe
Size 1.9MB
SHA256 5a4db4fee21582b68b5533c0915b04ba948bfb5f5956dc6c1aba6d29b2d37f97
MD5 3a06b3c343e4b9a676f95579e4cc8f15
SHA1 a1e850cc43aabbd71663c5a7022497228fb8403b
SHA512 eec2bde55bae0cb00f3dffeb21da1ff8c590f4bb0e05c8501c7df72a2feedc085de311fd108c251ebc0d281b70dc3f77427e91fd492055e99fb36b3544c48fc8
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXi:RWWBib356utgpPFoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LCzFlXR.exe

Path C:\Windows\System\LCzFlXR.exe
Size 1.9MB
SHA256 449efb5bde4b21708a38f49597f5ea19109dd07eeeffec730e00cd6c26259fe9
MD5 32f95b3a5a9ca4aca90b5a078ec4e87c
SHA1 a9fc4a6fa2e28e06c7d425d0570ec58b34795d3d
SHA512 559a0219d44891cf95ecebfdbad11656de92ee4834f7a1c202d87d7f0facd92c42768e9d751a3ca53b6ea93ddf4c94cf9d6fd12fb61c09a46a802194aa38d0e0
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX8:RWWBib356utgpPFos
MD5 SHA1 SHA512 SSDEEP

Submit Download

LRjcVVP.exe

Path C:\Windows\System\LRjcVVP.exe
Size 1.9MB
SHA256 a40e72ad5febb0033bf8a9aef031b4799a123bf6fcfde94dbb9f68b71d6d93fd
MD5 eeefedcadd5aed3377117e066e3b3e14
SHA1 970ff6c5a117cf3bf5fccea7a9485f188d5d4127
SHA512 0d987e935c8c04ccd4dcdae640331564bad7ed9ce56a23f9128208c60341886f6fd39a4d4ec1a94f9a48cc78c8bb044f2fd195d0d8279bab37b689de8c533410
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX1:RWWBib356utgpPFoF
MD5 SHA1 SHA512 SSDEEP

Submit Download

LumTRrO.exe

Path C:\Windows\System\LumTRrO.exe
Size 1.9MB
SHA256 db60d3a0a6e4455e68a3257f4514e9e0bfb2fda07a1851050379693d29c38a38
MD5 63fba50a08fb87cde6e7a4f770ea85ef
SHA1 a82964b232d49498a5ad09ef149eeec91a1d0e66
SHA512 3ab82509e982cfab91df31a07f3e2b4ea96e73496a8870aa6c7bb70f4be95e13d6b58c437bcc24e9b56cf51816687ae3c744534f3b43a6790908434e28396108
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXa:RWWBib356utgpPFoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLMXyMs.exe

Path C:\Windows\System\NLMXyMs.exe
Size 1.9MB
SHA256 984e5530c0c7c971d156e74aa41b749f001ee94fee5ce9ee14482d26c43c905a
MD5 ab55ed80c6d7c6602bb4c24d905f6ccc
SHA1 9ab47125f268c27ca79937e6dc357a71db88917c
SHA512 3a7e01f91810bf2201ad40fc8dc4de868f47bb1c464523068a47d6f4641d5d56183939d0245c83a7d3f4852ffd3128a5b4db95e31ae9bd7691da28b04d0fdb16
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXD:RWWBib356utgpPFoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OCvEDJo.exe

Path C:\Windows\System\OCvEDJo.exe
Size 1.9MB
SHA256 090689deaa06a3b34c1dba8f3e75ce19960b3e8b6f8b9600ed86fe54d0d2a501
MD5 02078802afcd68a1635564799697aa29
SHA1 d8d41eb2b1ec24ee5050ac2838a4a4064753c26b
SHA512 38d14264c4b6c13d8dfa82206e9ca949162c6f7735e1624c7b8fab00cea281101d2d25a2acd4bc7388b7877e35e2d777e1e2793953a32898b91e0eb0b4dcf805
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXy:RWWBib356utgpPFoC
MD5 SHA1 SHA512 SSDEEP

Submit Download

QauvyQT.exe

Path C:\Windows\System\QauvyQT.exe
Size 1.9MB
SHA256 1bc1a5b7963648bc433164acaee4b6aac627bcf693ceb1930bce8034aed22a6d
MD5 50842d0be7da37712f831690600d0839
SHA1 351227cf0b0c8271a498ee2cb01327affd15b196
SHA512 9228a5d35628e34e246fff146e4551177e1cdaf8b249298eb69b71dd521fb32a37273e4344ab32c6033ca0eaf56a02c6ca76dfebdde31cbd2b07b2cb4d0b7b90
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXZ:RWWBib356utgpPFop
MD5 SHA1 SHA512 SSDEEP

Submit Download

QlrNlqH.exe

Path C:\Windows\System\QlrNlqH.exe
Size 1.9MB
SHA256 5aa9bcfbc481636413373e268c1fb5b5215ca9878d46d6caf7157c959d313156
MD5 6bb444a87382c877f044b4a2cd4d5f35
SHA1 1f3557e5b784054f6cbf42f6aa138984524196cc
SHA512 8dda0293577cbdeb665cc771bd89c3cffeea96fe1c53afd5df6e38d683b890aa0671e35f72abf091894c60c1a4f18dc86b1d851856fdd2d59e0178c982a0b7fb
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXE:RWWBib356utgpPFoU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SAiXLmH.exe

Path C:\Windows\System\SAiXLmH.exe
Size 1.9MB
SHA256 7a1983024b56d516ae9284d4406c0c5bd8bb8d4af05d9d75c9196ce623b5008b
MD5 58f4fc8e4eef18dd87ef6c434b132e80
SHA1 e5e07fb0bb61cccc6126b22f396146bc2d662312
SHA512 08deec7b27dcc9485c9ac7cb23f936e2a02547495194185bdcef30ccdce76c5062517c208d3b5cae2a2eede097350db187801f9ac9aa28ad8580d94d7d77df65
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX3:RWWBib356utgpPFon
MD5 SHA1 SHA512 SSDEEP

Submit Download

VInICeq.exe

Path C:\Windows\System\VInICeq.exe
Size 1.9MB
SHA256 81a7de7a6e67aeff2f6130ca30c9877a3319ca98d9c1cf2abd62ba2334670ae3
MD5 6fb5c8ed20d6550a071a81a14c1f9142
SHA1 5d90de6be9b2837e2c3271b89be7b576d92aa753
SHA512 fa80f26ff404563d1b6719ae046ed0a09c96a338eaa934953e1f1162e213f67ca4dbc7396b21dea2a643ee42373d1f2602d0e0ebe0b63cdc1e0916a62bd7530a
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXM:RWWBib356utgpPFo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

VeDjXkn.exe

Path C:\Windows\System\VeDjXkn.exe
Size 1.9MB
SHA256 3b6354062849b13346609c61cda3b9e89eb2a8e51946a486c30798f0cf83ff5d
MD5 0c0ba2199fc66d29d092cb036430153a
SHA1 867b36b91b47ba74f6d1eeae6e49789fd3148282
SHA512 64d9efd70b3572d73a9d6d5d1d97140d5a2ec5a4b86c58da2e7df97ed962444772b63fbe2da70df21bd7067f82c61d9f3a0ff19d4957143bf5a860655f0fa58d
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXe:RWWBib356utgpPFoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

XGClzUC.exe

Path C:\Windows\System\XGClzUC.exe
Size 1.9MB
SHA256 ea928a614d4892cfc4ff82a112d9acd309f544231a3c82a66add3b8e59fbf3ed
MD5 3335ee4d3055b72f5b447a2c77f30d20
SHA1 2b1df965f6a3a8b2dd791c3bbae97b56d3bf0471
SHA512 5335d068c39ba21a73f87b2ae2107c87b378b48ea1b9d5dcd943e9570a66876af2cacdfa5dcae14ae87ea6072ae62efae8f8610844ac5a96e9decc62a9c21697
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXS:RWWBib356utgpPFoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

XcYThvf.exe

Path C:\Windows\System\XcYThvf.exe
Size 1.9MB
SHA256 478e94aebe649db86b671127c740af2c61c795dfa299723ce77b6303daf401ab
MD5 1542f2af7e9badfa34964d0d09d42ec8
SHA1 d31ff33173e61ad0aa64b7ae62f2eae18466c749
SHA512 72851bffdf3803af83633c34d4ba96870078803a924f92584ab63fafe277e3eddeaa8b17073ca9417ceb9f9869238ba780e70f988e68c35e86adc887f031d567
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXz:RWWBib356utgpPFoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

YfIaCqu.exe

Path C:\Windows\System\YfIaCqu.exe
Size 1.9MB
SHA256 38132b7421cae39724ffee22a19dc8f2c765ece9fddb604b9d93db984711420f
MD5 bd53e5d2df9c93b694d756c4c909c405
SHA1 011a0b19761c3e7566a46fd98003a803cd152360
SHA512 25c25a70b3ed3dab80a706f49c4abe1fea878f4a1dcb2e0d18e49cd3b355431b8c7ca431e5d657941e1745e47c9c0429c932580b5065e17a39462c02e523d6cc
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXT:RWWBib356utgpPFoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZyCsMCH.exe

Path C:\Windows\System\ZyCsMCH.exe
Size 1.9MB
SHA256 896a7946cdcfa53e81c6dbef3246b63a4aebd9bc485b2701752385eb352a2f23
MD5 9638fd0274d58825e57514bbfff3f0fe
SHA1 4d96b23e10956e41c971a3a1108ad2dff9fee979
SHA512 e53d832a872ee95f6b34d510d4d7d2e10b1f8a2abc1971c92f7de693ee507b1ba8d6651df635fb22b352139a6f1135ce71ece42a5503cbb6250a60a292e9fe17
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXl:RWWBib356utgpPFoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bMHgwMG.exe

Path C:\Windows\System\bMHgwMG.exe
Size 1.9MB
SHA256 4d0ab5976d064b191639c0af1671a62d341270484cc2ec6960f141adcffe7a23
MD5 2c899b16663ca605526e94737a08ac7d
SHA1 a72c841d7cb501b12ca71c346756ad8c4a160fdd
SHA512 32418c13debcaac80a75e15c8c1e0fb00c55e7866e45ffb41b12c5f44ac326418851d2ea891fd543d6d05a9e2c5983e5a5db5ff4d2cfa31832d51cca1438da4d
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXG:RWWBib356utgpPFo2
MD5 SHA1 SHA512 SSDEEP

Submit Download

jgVSHuI.exe

Path C:\Windows\System\jgVSHuI.exe
Size 1.9MB
SHA256 dfccbf68dfa83b52df8b5a92414ebfffd3fbf928a5297eecbaf2a6097bd9ee15
MD5 5205c122ddf63d01fd804aa6eb53aa80
SHA1 93da04df658e04ddec666c7f5eef0406f040b437
SHA512 c1f7f23a05302bf72328318e8d3ed7d8ec37159052ddd3e076732a13b53b3c4fdc367ad9d4efbbc6092d27155773bce75f4c9572be833ed0685469112d3c219e
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXJ:RWWBib356utgpPFo5
MD5 SHA1 SHA512 SSDEEP

Submit Download

kbuibFT.exe

Path C:\Windows\System\kbuibFT.exe
Size 1.9MB
SHA256 3b5fb1a88d4df0c5ac7016095ae34eb4b89010eaa1fd92f2786d3f9a6c897636
MD5 564b98bdbac8b6a3ab360195540daea8
SHA1 2543ec4ddb2aaf4617d557d0c8a5d31d713af576
SHA512 e43a875915022c6a275cdc7304642fbe096f9f1c6b33ab0a6e25d43463c88a75021b70daf5100424bd2faa3d3645ac89ed59a210dc877fda74baee8cb40c414d
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX2:RWWBib356utgpPFom
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkXDnCb.exe

Path C:\Windows\System\mkXDnCb.exe
Size 1.9MB
SHA256 ead79f50007aebd928c97291e7dfd92c277958604c5b483a48e8cb7c5f7a5677
MD5 d20fa6b7be018862c002f3c5de1eb489
SHA1 b0e976ecd25f482a3452e46e05d5b7dc7c0c16fe
SHA512 088cdf2bbd52f65cd708ac640cf5e18d8dea8a6abffcfd70a81d873cb99c6f58a687bea7ca0753d230662a12e4a20e12e8c5b047a5d178b1e919f21e1855ce7c
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXC:RWWBib356utgpPFoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofaTgGR.exe

Path C:\Windows\System\ofaTgGR.exe
Size 1.9MB
SHA256 5650025fa7500745f567094c421ce8cbc08bd468521899be3f1cad4a9ad10425
MD5 6f45b317fff7acaf1d25dfd7b44ca977
SHA1 9f55783961ea1f6006e6ef3df12a797d3e9f067f
SHA512 198edf982f57f1da32e00549c1265c3c289a841af353445735876c3d39e48f992482501fa7878ffdb4698e8872547289c66cab386329f9ce25df533a3f9c1c02
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXr:RWWBib356utgpPFob
MD5 SHA1 SHA512 SSDEEP

Submit Download

pJbhmqK.exe

Path C:\Windows\System\pJbhmqK.exe
Size 1.9MB
SHA256 e1f08959b8affb4da99410a4ed046ae503dc5be6117afe768250cb172e2f26ce
MD5 df6289309a899ebff430f6e5a2255f4c
SHA1 5468d6cbab5f83e3f851f08c899f15afa9fc7f08
SHA512 ce2e5f7a0025aa32aa863bdbbfe9835c9734698ffb8444b14d4a3b1b7065e46cf7762ce5e9d18649d62a4977792e1f04eacea48ffe3d1bbc85ab60239ec205d0
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXn:RWWBib356utgpPFo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

qUpupcg.exe

Path C:\Windows\System\qUpupcg.exe
Size 1.9MB
SHA256 7bcefbd73dce6b59415fb68b1c56d6035e39a05d82e73cc21ae807321944a7fb
MD5 1222eb6643b68d2468e95d7135844904
SHA1 7fd9dbab664feea9d3bf89d57b5ff216f36e7836
SHA512 a83996e951710259d925d372764a620a4dcec5baf9d546e4c7dc87fb55c90bb75cc7c70fc4231379db42df2c54cbe961ddad691ba3551e7a98091927039e953c
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXA:RWWBib356utgpPFow
MD5 SHA1 SHA512 SSDEEP

Submit Download

sBEZwIf.exe

Path C:\Windows\System\sBEZwIf.exe
Size 1.9MB
SHA256 a4867cb8ed5c0f2b8ec1ad7971b2eea845b68549462ef9f3462083368d715536
MD5 aa3614050aae925e9d4092428dd53c39
SHA1 9fb946a9ec6f54f0950c9e2343f404a3cb1b2fab
SHA512 8d4fe30b79df14edc2d9274fa355815f2c94b7d9cf5d91e6f6c5e2d694f758adaeab273e05254e82977e10a767bf201602f5533d3399e275345bf43181930bfb
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeX5:RWWBib356utgpPFoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wgePfGY.exe

Path C:\Windows\System\wgePfGY.exe
Size 1.9MB
SHA256 b92a8454089060fc6da265d50130bae7e652fdfee4e8b97ecb0cb09edc87485c
MD5 11cc694ef77a5f459698442fbd89cc7c
SHA1 ceacf0044c5d8cf38ec0f7a20b9f2e8ff30441b5
SHA512 3f76689a01602c2beea3a37dc45c985a341b2fe7ea2f6a9dcb2bb1a07da14529a732aff467675aa23cce97530727b675f72d89de7e7f53c8ee5ff2c523920ed7
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXU:RWWBib356utgpPFoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wkLkmTu.exe

Path C:\Windows\System\wkLkmTu.exe
Size 1.9MB
SHA256 6edfc37dd4fd222e3ffef814ed692283300396c795eabfba32fa8e3a77e711dd
MD5 5ee35e425dac2a028e2ecdef5588f7c5
SHA1 3ed565fefa5e62eb987c59f913d87eaeb721f6e0
SHA512 52b4baadbe03423ce4655709ad23bd740112d35cb63cc8ee200363526f0f87ba2c80b59cbdb5c5163dc5fc87f4e28b0551ef62c3422501539c70294a2a98512a
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXD:RWWBib356utgpPFoz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrtpHiS.exe

Path C:\Windows\System\wrtpHiS.exe
Size 1.9MB
SHA256 dd16c6216ce95ed0eb1d880e75e43b122b9263bb019775ea181862e3e8214a62
MD5 d6f195a74a9addc592f096751c586140
SHA1 566552ae860d141bb8619236611c86cc82b0f388
SHA512 26ba49f16a36c4869e6a5fece2be23485633be5b6e7defd27d37d6659e4b25d4efcc42ef0f021f56519a6b13c48772f15b5b7bef4bd4ff09361130d732d1af08
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdMKPFo4BwHzQHeXZ:RWWBib356utgpPFop
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-2393-0x00007FF6D06B0000-0x00007FF6D0A01000-memory.dmp

Download

memory/212-98-0x00007FF6D06B0000-0x00007FF6D0A01000-memory.dmp

Download

memory/536-2338-0x00007FF6AF710000-0x00007FF6AFA61000-memory.dmp

Download

memory/536-71-0x00007FF6AF710000-0x00007FF6AFA61000-memory.dmp

Download

memory/536-1478-0x00007FF6AF710000-0x00007FF6AFA61000-memory.dmp

Download

memory/544-2340-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp

Download

memory/544-208-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp

Download

memory/544-70-0x00007FF6CEB70000-0x00007FF6CEEC1000-memory.dmp

Download

memory/1400-24-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp

Download

memory/1400-94-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp

Download

memory/1400-2323-0x00007FF67FCE0000-0x00007FF680031000-memory.dmp

Download

memory/1460-178-0x00007FF625B20000-0x00007FF625E71000-memory.dmp

Download

memory/1460-2431-0x00007FF625B20000-0x00007FF625E71000-memory.dmp

Download

memory/1516-2062-0x00007FF79C820000-0x00007FF79CB71000-memory.dmp

Download

memory/1516-2345-0x00007FF79C820000-0x00007FF79CB71000-memory.dmp

Download

memory/1516-83-0x00007FF79C820000-0x00007FF79CB71000-memory.dmp

Download

memory/1520-2335-0x00007FF715700000-0x00007FF715A51000-memory.dmp

Download

memory/1520-200-0x00007FF715700000-0x00007FF715A51000-memory.dmp

Download

memory/1520-57-0x00007FF715700000-0x00007FF715A51000-memory.dmp

Download

memory/1600-2395-0x00007FF694F10000-0x00007FF695261000-memory.dmp

Download

memory/1600-111-0x00007FF694F10000-0x00007FF695261000-memory.dmp

Download

memory/1932-160-0x00007FF77DD90000-0x00007FF77E0E1000-memory.dmp

Download

memory/1932-2423-0x00007FF77DD90000-0x00007FF77E0E1000-memory.dmp

Download

memory/2104-168-0x00007FF6457B0000-0x00007FF645B01000-memory.dmp

Download

memory/2104-2420-0x00007FF6457B0000-0x00007FF645B01000-memory.dmp

Download

memory/2212-2429-0x00007FF7FBBF0000-0x00007FF7FBF41000-memory.dmp

Download

memory/2212-2294-0x00007FF7FBBF0000-0x00007FF7FBF41000-memory.dmp

Download

memory/2212-133-0x00007FF7FBBF0000-0x00007FF7FBF41000-memory.dmp

Download

memory/2388-207-0x00007FF76A180000-0x00007FF76A4D1000-memory.dmp

Download

memory/2388-2441-0x00007FF76A180000-0x00007FF76A4D1000-memory.dmp

Download

memory/2460-2314-0x00007FF779EB0000-0x00007FF77A201000-memory.dmp

Download

memory/2460-2435-0x00007FF779EB0000-0x00007FF77A201000-memory.dmp

Download

memory/2460-150-0x00007FF779EB0000-0x00007FF77A201000-memory.dmp

Download

memory/2548-136-0x00007FF7C5390000-0x00007FF7C56E1000-memory.dmp

Download

memory/2548-2436-0x00007FF7C5390000-0x00007FF7C56E1000-memory.dmp

Download

memory/2548-2313-0x00007FF7C5390000-0x00007FF7C56E1000-memory.dmp

Download

memory/2600-2418-0x00007FF75C080000-0x00007FF75C3D1000-memory.dmp

Download

memory/2600-2312-0x00007FF75C080000-0x00007FF75C3D1000-memory.dmp

Download

memory/2600-122-0x00007FF75C080000-0x00007FF75C3D1000-memory.dmp

Download

memory/2688-78-0x00007FF6C74A0000-0x00007FF6C77F1000-memory.dmp

Download

memory/2688-0-0x00007FF6C74A0000-0x00007FF6C77F1000-memory.dmp

Download

memory/2688-1-0x000002259D370000-0x000002259D380000-memory.dmp

Download

memory/2744-197-0x00007FF6D62A0000-0x00007FF6D65F1000-memory.dmp

Download

memory/2744-2442-0x00007FF6D62A0000-0x00007FF6D65F1000-memory.dmp

Download

memory/3252-119-0x00007FF78ADB0000-0x00007FF78B101000-memory.dmp

Download

memory/3252-48-0x00007FF78ADB0000-0x00007FF78B101000-memory.dmp

Download

memory/3252-2330-0x00007FF78ADB0000-0x00007FF78B101000-memory.dmp

Download

memory/3508-29-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp

Download

memory/3508-95-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp

Download

memory/3508-2325-0x00007FF6DBC10000-0x00007FF6DBF61000-memory.dmp

Download

memory/3708-36-0x00007FF739070000-0x00007FF7393C1000-memory.dmp

Download

memory/3708-2333-0x00007FF739070000-0x00007FF7393C1000-memory.dmp

Download

memory/3708-117-0x00007FF739070000-0x00007FF7393C1000-memory.dmp

Download

memory/3972-49-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp

Download

memory/3972-2328-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp

Download

memory/3972-171-0x00007FF64FFC0000-0x00007FF650311000-memory.dmp

Download

memory/4040-84-0x00007FF723620000-0x00007FF723971000-memory.dmp

Download

memory/4040-2321-0x00007FF723620000-0x00007FF723971000-memory.dmp

Download

memory/4040-20-0x00007FF723620000-0x00007FF723971000-memory.dmp

Download

memory/4260-159-0x00007FF64BF40000-0x00007FF64C291000-memory.dmp

Download

memory/4260-2315-0x00007FF64BF40000-0x00007FF64C291000-memory.dmp

Download

memory/4260-2433-0x00007FF64BF40000-0x00007FF64C291000-memory.dmp

Download

memory/4264-2332-0x00007FF787850000-0x00007FF787BA1000-memory.dmp

Download

memory/4264-106-0x00007FF787850000-0x00007FF787BA1000-memory.dmp

Download

memory/4264-30-0x00007FF787850000-0x00007FF787BA1000-memory.dmp

Download

memory/4372-2295-0x00007FF719030000-0x00007FF719381000-memory.dmp

Download

memory/4372-2424-0x00007FF719030000-0x00007FF719381000-memory.dmp

Download

memory/4372-147-0x00007FF719030000-0x00007FF719381000-memory.dmp

Download

memory/4448-2439-0x00007FF6DCB60000-0x00007FF6DCEB1000-memory.dmp

Download

memory/4448-2316-0x00007FF6DCB60000-0x00007FF6DCEB1000-memory.dmp

Download

memory/4448-184-0x00007FF6DCB60000-0x00007FF6DCEB1000-memory.dmp

Download

memory/4656-2427-0x00007FF6BF940000-0x00007FF6BFC91000-memory.dmp

Download

memory/4656-177-0x00007FF6BF940000-0x00007FF6BFC91000-memory.dmp

Download

memory/4716-2341-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp

Download

memory/4716-206-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp

Download

memory/4716-63-0x00007FF6B8280000-0x00007FF6B85D1000-memory.dmp

Download

memory/5016-2277-0x00007FF6AC7C0000-0x00007FF6ACB11000-memory.dmp

Download

memory/5016-2344-0x00007FF6AC7C0000-0x00007FF6ACB11000-memory.dmp

Download

memory/5016-85-0x00007FF6AC7C0000-0x00007FF6ACB11000-memory.dmp

Download

memory/5072-12-0x00007FF732CE0000-0x00007FF733031000-memory.dmp

Download

memory/5072-2319-0x00007FF732CE0000-0x00007FF733031000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads